From ea2f03558a229d5f7c6a90193953a078d18ebb91 Mon Sep 17 00:00:00 2001
From: benvin <neotheo@gmail.com>
Date: Wed, 29 Jul 2026 20:23:18 +1000
Subject: [PATCH] Add logarchive gpg key and logging-namespace public-key read

logarchiver encrypts archived logs to an OpenPGP key held in the gpg engine
so the private key never leaves Vault; retrieval delegates decryption back to
gpg/decrypt/logarchive. This provisions that key and lets the service read its
public key.

- Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount.
- Add k8s auth role logarchiver bound to the logarchiver ServiceAccount in the
  logging namespace.
- Add policy granting read on gpg/keys/logarchive to that role (public key only;
  no decrypt).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
---
 .../k8s/au/syd1/logarchiver.yaml                     |  7 +++++++
 config/gpg_key/gpg/logarchive.yaml                   |  8 ++++++++
 policies/gpg/logarchive_public_read.yaml             | 12 ++++++++++++
 3 files changed, 27 insertions(+)
 create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/logarchiver.yaml
 create mode 100644 config/gpg_key/gpg/logarchive.yaml
 create mode 100644 policies/gpg/logarchive_public_read.yaml

diff --git a/config/auth_kubernetes_role/k8s/au/syd1/logarchiver.yaml b/config/auth_kubernetes_role/k8s/au/syd1/logarchiver.yaml
new file mode 100644
index 0000000..1f8f7b1
--- /dev/null
+++ b/config/auth_kubernetes_role/k8s/au/syd1/logarchiver.yaml
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - logarchiver
+bound_service_account_namespaces:
+  - logging
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
diff --git a/config/gpg_key/gpg/logarchive.yaml b/config/gpg_key/gpg/logarchive.yaml
new file mode 100644
index 0000000..a39f961
--- /dev/null
+++ b/config/gpg_key/gpg/logarchive.yaml
@@ -0,0 +1,8 @@
+# config/gpg_key/gpg/logarchive.yaml
+# OpenPGP key in the gpg engine for the logarchiver service. The private key
+# stays in Vault; logarchiver reads only the exported public key
+# (gpg/keys/logarchive) to encrypt archived logs, and retrieval delegates
+# decryption back to gpg/decrypt/logarchive. Key name = "logarchive", backend = "gpg".
+algorithm: rsa-4096
+identity: "logarchive <logarchive@unkin.net>"
+exportable: false
diff --git a/policies/gpg/logarchive_public_read.yaml b/policies/gpg/logarchive_public_read.yaml
new file mode 100644
index 0000000..07c1044
--- /dev/null
+++ b/policies/gpg/logarchive_public_read.yaml
@@ -0,0 +1,12 @@
+# Allow the logarchiver service (logging namespace) to read the logarchive
+# public key. A plain read on gpg/keys/<name> returns the armored public_key;
+# no decrypt/export capability is granted.
+---
+rules:
+  - path: "gpg/keys/logarchive"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - logarchiver