Rotate wise-vault keys. Reduce admin policies (only write secrets). Limit admin Policy change to root tokens only

[noisy]

• - Generate proper CA certs for production vault (~1-5 minutes of maintenance downtime on wise hub)
• - Test unsealing key wrapping with PKI
• - Prepare an instruction on wiki for @noisy @bgornicki @perduta how to prepare such keys: https://github.com/wise-team/ansible-playbooks/wiki/Rotate-vault-unseal-keys
• - Notify @noisy @bgornicki @perduta that instruction is ready and mark below that everyone did what is needed:
  • - @noisy
  • - @bgornicki
  • - @perduta
• - schedule time slot to replace keys on staging
• - make root token only able to write changes to admin policy on staging
• - replace keys on staging
• - schedule time slot to replace keys on production
• - make root token only able to write changes to admin policy on production
• - replace keys on production

[Jblew]

https://github.com/wise-team/ansible-playbooks/wiki/Rotate-vault-unseal-keys
@noisy @bgornicki @perduta Here are some instructions for you ;) Have a merry new year!