From c0cc74927cac1ef08803e9d843d2e78aac11c10a Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Wed, 29 Jul 2026 20:39:41 +1000 Subject: [PATCH] Add logarchive gpg key + logging_logarchiver read access (#106) ## Why logarchiver encrypts archived logs to an OpenPGP key held in Vault's gpg engine so the private key never leaves Vault (retrieval delegates decryption to `gpg/decrypt/logarchive`, operator-only). This provisions the key and lets the service read only its public key. ## Changes - Create gpg key `logarchive` (rsa-4096, non-exportable) in the `gpg` mount. - Add k8s auth role `logging_logarchiver` bound to SA `logarchiver` in the `logging` namespace. - Add policy granting `read` on `gpg/keys/logarchive` to that role (public key only; no decrypt/export). Cross-repo: this must apply before the argocd-apps logarchiver Deployment (unkin/argocd-apps) can fetch the key. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --------- Co-authored-by: benvin Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/106 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- .../k8s/au/syd1/logging_logarchiver.yaml | 7 +++++++ config/gpg_key/gpg/logarchive.yaml | 8 ++++++++ policies/gpg/logarchive_public_read.yaml | 12 ++++++++++++ 3 files changed, 27 insertions(+) create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/logging_logarchiver.yaml create mode 100644 config/gpg_key/gpg/logarchive.yaml create mode 100644 policies/gpg/logarchive_public_read.yaml diff --git a/config/auth_kubernetes_role/k8s/au/syd1/logging_logarchiver.yaml b/config/auth_kubernetes_role/k8s/au/syd1/logging_logarchiver.yaml new file mode 100644 index 0000000..1f8f7b1 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/logging_logarchiver.yaml @@ -0,0 +1,7 @@ +bound_service_account_names: + - logarchiver +bound_service_account_namespaces: + - logging +token_ttl: 600 +token_max_ttl: 600 +audience: vault diff --git a/config/gpg_key/gpg/logarchive.yaml b/config/gpg_key/gpg/logarchive.yaml new file mode 100644 index 0000000..a39f961 --- /dev/null +++ b/config/gpg_key/gpg/logarchive.yaml @@ -0,0 +1,8 @@ +# config/gpg_key/gpg/logarchive.yaml +# OpenPGP key in the gpg engine for the logarchiver service. The private key +# stays in Vault; logarchiver reads only the exported public key +# (gpg/keys/logarchive) to encrypt archived logs, and retrieval delegates +# decryption back to gpg/decrypt/logarchive. Key name = "logarchive", backend = "gpg". +algorithm: rsa-4096 +identity: "logarchive " +exportable: false diff --git a/policies/gpg/logarchive_public_read.yaml b/policies/gpg/logarchive_public_read.yaml new file mode 100644 index 0000000..d32e28c --- /dev/null +++ b/policies/gpg/logarchive_public_read.yaml @@ -0,0 +1,12 @@ +# Allow the logarchiver service (logging namespace, SA logarchiver) to read the +# logarchive public key. A plain read on gpg/keys/logarchive returns the armored +# public_key; no decrypt/export capability is granted (decrypt stays operator-only). +--- +rules: + - path: "gpg/keys/logarchive" + capabilities: + - read + +auth: + k8s/au/syd1: + - logging_logarchiver