terraform-vault/config/auth_kubernetes_role/k8s/au/syd1/logarchiver.yaml at ea2f03558a229d5f7c6a90193953a078d18ebb91 - terraform-vault - Gitea

unkin/terraform-vault

Files

T

benvin ea2f03558a

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

Add logarchive gpg key and logging-namespace public-key read

logarchiver encrypts archived logs to an OpenPGP key held in the gpg engine
so the private key never leaves Vault; retrieval delegates decryption back to
gpg/decrypt/logarchive. This provisions that key and lets the service read its
public key.

- Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount.
- Add k8s auth role logarchiver bound to the logarchiver ServiceAccount in the
  logging namespace.
- Add policy granting read on gpg/keys/logarchive to that role (public key only;
  no decrypt).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

2026-07-29 20:23:18 +10:00

8 lines

141 B

YAML

Raw Blame History

 bound_service_account_names:
   - logarchiver
 bound_service_account_namespaces:
   - logging
 token_ttl: 600
 token_max_ttl: 600
 audience: vault