benvin
ea2f03558a
logarchiver encrypts archived logs to an OpenPGP key held in the gpg engine so the private key never leaves Vault; retrieval delegates decryption back to gpg/decrypt/logarchive. This provisions that key and lets the service read its public key. - Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount. - Add k8s auth role logarchiver bound to the logarchiver ServiceAccount in the logging namespace. - Add policy granting read on gpg/keys/logarchive to that role (public key only; no decrypt). Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
9 lines
424 B
YAML
9 lines
424 B
YAML
# config/gpg_key/gpg/logarchive.yaml
|
|
# OpenPGP key in the gpg engine for the logarchiver service. The private key
|
|
# stays in Vault; logarchiver reads only the exported public key
|
|
# (gpg/keys/logarchive) to encrypt archived logs, and retrieval delegates
|
|
# decryption back to gpg/decrypt/logarchive. Key name = "logarchive", backend = "gpg".
|
|
algorithm: rsa-4096
|
|
identity: "logarchive <logarchive@unkin.net>"
|
|
exportable: false
|