unkinben
c0cc74927c
ci/woodpecker/push/apply Pipeline was successful
## Why logarchiver encrypts archived logs to an OpenPGP key held in Vault's gpg engine so the private key never leaves Vault (retrieval delegates decryption to `gpg/decrypt/logarchive`, operator-only). This provisions the key and lets the service read only its public key. ## Changes - Create gpg key `logarchive` (rsa-4096, non-exportable) in the `gpg` mount. - Add k8s auth role `logging_logarchiver` bound to SA `logarchiver` in the `logging` namespace. - Add policy granting `read` on `gpg/keys/logarchive` to that role (public key only; no decrypt/export). Cross-repo: this must apply before the argocd-apps logarchiver Deployment (unkin/argocd-apps) can fetch the key. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --------- Co-authored-by: benvin <neotheo@gmail.com> Reviewed-on: #106 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>