fix(security): prevent ESO copying source annotations (CUST-WP-0073)

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
2026-09-28 15:56:50 +02:00 · 2026-09-28 15:56:50 +02:00 · 80e053988f
commit 80e053988f
parent c5d65b0b40
7 changed files with 47 additions and 0 deletions
--- a/openbao/state-hub-preflight/delivery.yaml
+++ b/openbao/state-hub-preflight/delivery.yaml
@ -35,6 +35,9 @@ spec:
    name: openbao-state-hub-rename-preflight
    kind: SecretStore
  target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
    name: state-hub-rename-preflight
    creationPolicy: Owner
    deletionPolicy: Retain