unkinben
c0cc74927c
ci/woodpecker/push/apply Pipeline was successful
## Why logarchiver encrypts archived logs to an OpenPGP key held in Vault's gpg engine so the private key never leaves Vault (retrieval delegates decryption to `gpg/decrypt/logarchive`, operator-only). This provisions the key and lets the service read only its public key. ## Changes - Create gpg key `logarchive` (rsa-4096, non-exportable) in the `gpg` mount. - Add k8s auth role `logging_logarchiver` bound to SA `logarchiver` in the `logging` namespace. - Add policy granting `read` on `gpg/keys/logarchive` to that role (public key only; no decrypt/export). Cross-repo: this must apply before the argocd-apps logarchiver Deployment (unkin/argocd-apps) can fetch the key. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --------- Co-authored-by: benvin <neotheo@gmail.com> Reviewed-on: #106 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
9 lines
424 B
YAML
9 lines
424 B
YAML
# config/gpg_key/gpg/logarchive.yaml
|
|
# OpenPGP key in the gpg engine for the logarchiver service. The private key
|
|
# stays in Vault; logarchiver reads only the exported public key
|
|
# (gpg/keys/logarchive) to encrypt archived logs, and retrieval delegates
|
|
# decryption back to gpg/decrypt/logarchive. Key name = "logarchive", backend = "gpg".
|
|
algorithm: rsa-4096
|
|
identity: "logarchive <logarchive@unkin.net>"
|
|
exportable: false
|