fix(security): prevent ESO copying source annotations (CUST-WP-0073)

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
2026-09-28 15:56:50 +02:00 · 2026-09-28 15:56:50 +02:00 · 80e053988f
commit 80e053988f
parent c5d65b0b40
7 changed files with 47 additions and 0 deletions
--- a/argocd/platform-addons/openbao-secretstore/t03-requester.yaml
+++ b/argocd/platform-addons/openbao-secretstore/t03-requester.yaml
@ -34,6 +34,9 @@ spec:
    kind: ClusterSecretStore
    name: openbao-keycape-secrets-engine-requester
  target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
    name: keycape-secrets-engine-requester-client
    creationPolicy: Owner
    deletionPolicy: Retain