benvin
ed2443b1e2
logarchiver encrypts archived logs to an OpenPGP key held in the gpg engine so the private key never leaves Vault; retrieval delegates decryption back to gpg/decrypt/logarchive. This provisions the key and lets the service read only its public key via a dedicated k8s auth role. - Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount. - Add k8s auth role logging_logarchiver bound to the logarchiver ServiceAccount in the logging namespace. - Add policy granting read on gpg/keys/logarchive to that role (public key only; no decrypt/export). Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
13 lines
368 B
YAML
13 lines
368 B
YAML
# Allow the logarchiver service (logging namespace, SA logarchiver) to read the
|
|
# logarchive public key. A plain read on gpg/keys/logarchive returns the armored
|
|
# public_key; no decrypt/export capability is granted (decrypt stays operator-only).
|
|
---
|
|
rules:
|
|
- path: "gpg/keys/logarchive"
|
|
capabilities:
|
|
- read
|
|
|
|
auth:
|
|
k8s/au/syd1:
|
|
- logging_logarchiver
|