explicitly set the labels of external-secret managed secrets to prevent it being pruned on apply

kustomize/bases/drone-server/drone-server-externalsecret.yaml

@@ -8,6 +8,11 @@ spec:
     kind: ClusterSecretStore
   target:
     name: drone-secret
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/managed-by: external-secret
+        annotations: {}
   data:
     - secretKey: rpc_secret
       remoteRef:
@@ -26,10 +31,15 @@ spec:
     kind: ClusterSecretStore
   target:
     name: drone-gitea-oauth-secret
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/managed-by: external-secret
+        annotations: {}
   data:
     - secretKey: client_id
       remoteRef:
         key: /k3s/prod/drone/gitea/client_id
     - secretKey: client_secret
       remoteRef:
-        key: /k3s/prod/drone/gitea/client_secret
+        key: /k3s/prod/drone/gitea/client_secret

kustomize/bases/grafana-agent/grafana-agent-externalsecret.yaml

@@ -8,6 +8,11 @@ spec:
     kind: ClusterSecretStore
   target:
     name: grafana-agent
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/managed-by: external-secret
+        annotations: {}
   data:
     - secretKey: agent.yaml
       remoteRef:

kustomize/bases/grafana/grafana-externalsecret.yaml

@@ -8,6 +8,11 @@ spec:
     kind: ClusterSecretStore
   target:
     name: grafana-config
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/managed-by: external-secret
+        annotations: {}
   data:
     - secretKey: custom.ini
       remoteRef:

kustomize/bases/longhorn/longhorn-externalsecret.yaml

@@ -9,6 +9,11 @@ spec:
     kind: ClusterSecretStore
   target:
     name: s3-backupstore-credentials
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/managed-by: external-secret
+        annotations: {}
   data:
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:

kustomize/bases/postgres/postgres-externalsecret.yaml

@@ -8,6 +8,11 @@ spec:
     kind: ClusterSecretStore
   target:
     name: postgres-credentials
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/managed-by: external-secret
+        annotations: {}
   data:
     - secretKey: database
       remoteRef:

kustomize/bases/redis/redis-externalsecret.yaml

@@ -8,7 +8,13 @@ spec:
     kind: ClusterSecretStore
   target:
     name: redis-credentials
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/managed-by: external-secret
+        annotations: {}
+
   data:
     - secretKey: password
       remoteRef:
-        key: changeme
+        key: changeme

kustomize/env/prod/kustomization.yaml

@@ -32,7 +32,7 @@ images:
   - name: postgres
     newTag: 9.6.23
   - name: redis
-    newTag: 6.2.5
+    newTag: 6.2.10
 
 configMapGenerator:
   - name: replacements