Read public CA chain live from Vault PKI, not repo PEM
Date: 2026-07-03 Status: Accepted Decision: hl-d3y5 Deciders: sean
Context
Section titled “Context”Public ICA1 chain material was read from a Vault KV path via the deprecated vault_kv_secret_v2 data source in three workspaces (keycloak, cluster-bootstrap, hcp-terraform). The repo has existing precedent for committing public CA material as files (images/certs, ansible/files), but a repo copy goes stale silently when the CA rotates.
Decision
Section titled “Decision”Public CA chain reads move to the non-deprecated data "vault_pki_secret_backend_issuer" against the live ICA1 PKI mount (fzymgc-house/v1/ica1/v1), joined from ca_chain. Private key material is excluded (Vault PKI never exposes CA private keys) — the cert-manager cert+key pair reads the KV secret ephemerally into a write-only sink instead.
Rationale
Section titled “Rationale”- Vault PKI is already the live source of truth; reading it directly removes staleness risk entirely
- Public certs are not secrets, so a regular diffable data source is the correct primitive — the deprecation pressure (secrets-in-state) does not apply
Alternatives Considered
Section titled “Alternatives Considered”- vault_pki_secret_backend_issuer live read (chosen): always current, diffable, not deprecated
- Repo-committed PEM + file() (rejected): stale-by-design on rotation despite matching existing repo precedent; operator explicitly rejected
- Keep deprecated KV read (rejected): contradicts the zero-warnings goal for material with a clean alternative
Consequences
Section titled “Consequences”- Positive: CA chain always reflects the live issuer; no manual re-sync on rotation
- Negative: plan-time PKI read dependency in three workspaces; issuer-read policy grants; byte-diff verification gate before each cutover
- Neutral: diverges from the repo-committed-PEM pattern still used by ansible/argocd static consumers