logarchiver encrypts archived logs to an OpenPGP key held in the gpg engine
so the private key never leaves Vault; retrieval delegates decryption back to
gpg/decrypt/logarchive. This provisions that key and lets the service read its
public key.
- Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount.
- Add k8s auth role logarchiver bound to the logarchiver ServiceAccount in the
logging namespace.
- Add policy granting read on gpg/keys/logarchive to that role (public key only;
no decrypt).
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
benvin
ea2f03558a