unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add logarchive gpg key + logging_logarchiver read access #106

Merged
benvin merged 1 commits from benvin/logarchive-gpg-key into master 2026-07-29 20:39:41 +10:00
Conversation 0 Commits 1 Files Changed 3
+27
unkinben commented 2026-07-29 20:23:30 +10:00
Owner
Copy Link
Copy Source

Why

logarchiver encrypts archived logs to an OpenPGP key held in Vault's gpg engine so the private key never leaves Vault (retrieval delegates decryption to gpg/decrypt/logarchive, operator-only). This provisions the key and lets the service read only its public key.

Changes

  • Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount.
  • Add k8s auth role logging_logarchiver bound to SA logarchiver in the logging namespace.
  • Add policy granting read on gpg/keys/logarchive to that role (public key only; no decrypt/export).

Cross-repo: this must apply before the argocd-apps logarchiver Deployment (unkin/argocd-apps) can fetch the key.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

## Why logarchiver encrypts archived logs to an OpenPGP key held in Vault's gpg engine so the private key never leaves Vault (retrieval delegates decryption to `gpg/decrypt/logarchive`, operator-only). This provisions the key and lets the service read only its public key. ## Changes - Create gpg key `logarchive` (rsa-4096, non-exportable) in the `gpg` mount. - Add k8s auth role `logging_logarchiver` bound to SA `logarchiver` in the `logging` namespace. - Add policy granting `read` on `gpg/keys/logarchive` to that role (public key only; no decrypt/export). Cross-repo: this must apply before the argocd-apps logarchiver Deployment (unkin/argocd-apps) can fetch the key. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben force-pushed benvin/logarchive-gpg-key from ea2f03558a to 115435ec54 2026-07-29 20:26:58 +10:00 Compare
unkinben changed title from Add logarchive gpg key + logging public-key read to Add logarchive gpg key 2026-07-29 20:27:17 +10:00
unkinben added 1 commit 2026-07-29 20:30:57 +10:00
Add logarchive gpg key + logging_logarchiver read access
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ed2443b1e2 
logarchiver encrypts archived logs to an OpenPGP key held in the gpg engine so
the private key never leaves Vault; retrieval delegates decryption back to
gpg/decrypt/logarchive. This provisions the key and lets the service read only
its public key via a dedicated k8s auth role.

- Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount.
- Add k8s auth role logging_logarchiver bound to the logarchiver ServiceAccount
  in the logging namespace.
- Add policy granting read on gpg/keys/logarchive to that role (public key only;
  no decrypt/export).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben force-pushed benvin/logarchive-gpg-key from 115435ec54 to ed2443b1e2 2026-07-29 20:30:57 +10:00 Compare
unkinben changed title from Add logarchive gpg key to Add logarchive gpg key + logging_logarchiver read access 2026-07-29 20:31:05 +10:00
benvin merged commit c0cc74927c into master 2026-07-29 20:39:41 +10:00
benvin deleted branch benvin/logarchive-gpg-key 2026-07-29 20:39:41 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#106
Delete Branch "benvin/logarchive-gpg-key"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?