3 Commits

Author	SHA1	Message	Date
unkinben	a025819fcd	Mint the NetBox token from the Vault netbox engine ... Why: - The netbox provider authenticated with a static netbox_token seeded by hand into KV; the vault-plugin-secrets-netbox engine mints a per-run ephemeral token that is lease-revoked when the run ends, removing the manual seed. How: - Read netbox/creds/terraform-infra via vault_generic_secret and pass the minted netbox_token to the netbox provider. - Keep kea_token from KV for now (follow-up: its own ephemeral-token engine). Depends on the netbox engine mount + netbox/creds/terraform-infra role/policy in terraform-vault being applied first.	2026-08-09 00:18:47 +10:00
unkinben	9bdf9ce9fc	Fix vault provider auth in CI: skip_child_token + correct kv path ... The woodpecker_terraform_infra role cannot mint child tokens (auth/token/create 403), which failed the plan's vault_kv_secret_v2 read. Set skip_child_token so the provider uses the login token directly (estate pattern). Also correct the KV path missed in the ipam->infra rename: service/terraform/infra. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT	2026-08-06 23:09:00 +10:00
unkinben	9a6f775300	Rename terraform-ipam -> terraform-infra; add devices + networks + puppetdb backfill ... Scope now spans devices and provisioning, not just IPAM. - rename module/consul-path/role ipam -> infra - networks config (subnet binding + gateway/dns/search constants); prefixes tagged net:<name> - intent-only devices module: netbox_device + device_type/role/manufacturer, static or next-available IPs (sticky via ignore_changes), transitional bootstrap_mac interface for bootapi PXE keying - seed 6 pending hosts prodnxsr0014-0019 (mgmt IPs .14-.19, optiplex-3070) - ci/puppetdb_backfill.py: emit NetBox reality (serial/model/uuid/interfaces) for existing hosts Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT	2026-08-05 19:41:41 +10:00