A generated key adopts the value an old location holds #455

Parent

#444

What to build

A generated key can name the old location of a value it must keep. When a Project moves to the estate path, some of its secrets must keep their current value: tribelt seals stored credentials with its session key, and grimoire's VAPID pair breaks every push subscription if it changes. Today someone copies those values in Vault by hand before the move.

generate gains an optional adopt, a KV location written as secret/data/<path>#<key>. When Vault does not hold the generated key, the Vault policy job copies the value at that location, unchanged, if one is there, and generates a new one only if it is not. A key Vault already holds is never changed, as today.

keys:
  - name: session_key
    generate: { adopt: secret/data/platform/tribelt#session_key }

Acceptance criteria

• Chapter 10's "Generated keys" states adopt: its form, that the value is copied verbatim (bytes and encoding describe only a value the job makes), and that it applies only while the key is absent.
• A malformed adopt is refused by the schema.
• The generated-keys document carries the location, in both implementations and their oracles.
• The job in JorisJonkers-dev/delivery copies an adopted value, falls back to generating, and never overwrites.
• tribelt's session and visitor keys move with no manual Vault write (tribelt's session and visitor keys are generated in the cluster #446).

Blocked by

• None (can start immediately)