From 017458d69792aa6a217138c14b8e3ba816159a8c Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Sat, 27 Jun 2026 09:04:04 +0000
Subject: [PATCH] Fix ESO namespace rewrite for secret plane

---
 scripts/src/platform-infra-secret-plane.ts | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/scripts/src/platform-infra-secret-plane.ts b/scripts/src/platform-infra-secret-plane.ts
index a8095029..5fde92f0 100644
--- a/scripts/src/platform-infra-secret-plane.ts
+++ b/scripts/src/platform-infra-secret-plane.ts
@@ -377,7 +377,22 @@ async function fetchEsoManifest(secretPlane: SecretPlaneConfig, target: SecretPl
   if (!text.includes(secretPlane.eso.version) || !text.includes("kind: CustomResourceDefinition")) {
     throw new Error(`ESO manifest ${secretPlane.eso.manifestUrl} does not look like ${secretPlane.eso.version} static install YAML`);
   }
-  return text.replace(/^(\s*namespace:\s*)default\s*$/gmu, `$1${target.namespace}`);
+  return rewriteEsoManifestNamespace(text, target.namespace);
+}
+
+function rewriteEsoManifestNamespace(text: string, namespaceName: string): string {
+  const rewritten = text
+    .replace(/^(\s*namespace:\s*)default\s*$/gmu, `$1${namespaceName}`)
+    .replaceAll("external-secrets-webhook.default.svc", `external-secrets-webhook.${namespaceName}.svc`)
+    .replaceAll("--service-namespace=default", `--service-namespace=${namespaceName}`)
+    .replaceAll("--secret-namespace=default", `--secret-namespace=${namespaceName}`);
+  const remainingRuntimeDefaultRefs = [
+    "external-secrets-webhook.default.svc",
+    "--service-namespace=default",
+    "--secret-namespace=default",
+  ].filter((needle) => rewritten.includes(needle));
+  if (remainingRuntimeDefaultRefs.length > 0) throw new Error(`ESO manifest namespace rewrite left runtime default references: ${remainingRuntimeDefaultRefs.join(", ")}`);
+  return rewritten;
 }
 
 function renderWorkloadManifest(secretPlane: SecretPlaneConfig, target: SecretPlaneTarget): string {