From a3a8a27a8cda32ae3c7b55353ee16a131c50a0a0 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Mon, 28 Sep 2026 15:56:50 +0200
Subject: [PATCH] fix(security): prevent ESO copying source annotations
 (CUST-WP-0073)

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
---
 k8s/railiance/externalsecret.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/k8s/railiance/externalsecret.yaml b/k8s/railiance/externalsecret.yaml
index 3eef170..f007cbb 100644
--- a/k8s/railiance/externalsecret.yaml
+++ b/k8s/railiance/externalsecret.yaml
@@ -26,6 +26,14 @@ spec:
     name: openbao-target-revenue
     kind: ClusterSecretStore
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: target-revenue
+          app.kubernetes.io/part-of: target-revenue
+        annotations:
+          argocd.argoproj.io/sync-wave: '0'
     name: target-revenue-runtime
     creationPolicy: Owner
   data: