logarchiver encrypts archived logs to an OpenPGP key held in the gpg engine so
the private key never leaves Vault; retrieval delegates decryption back to
gpg/decrypt/logarchive. This provisions the key and lets the service read only
its public key via a dedicated k8s auth role.
- Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount.
- Add k8s auth role logging_logarchiver bound to the logarchiver ServiceAccount
in the logging namespace.
- Add policy granting read on gpg/keys/logarchive to that role (public key only;
no decrypt/export).
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
benvin
ed2443b1e2