Why:
- The netbox provider authenticated with a static netbox_token seeded by hand
into KV; the vault-plugin-secrets-netbox engine mints a per-run ephemeral
token that is lease-revoked when the run ends, removing the manual seed.
How:
- Read netbox/creds/terraform-infra via vault_generic_secret and pass the minted
netbox_token to the netbox provider.
- Keep kea_token from KV for now (follow-up: its own ephemeral-token engine).
Depends on the netbox engine mount + netbox/creds/terraform-infra role/policy in
terraform-vault being applied first.
The woodpecker_terraform_infra role cannot mint child tokens (auth/token/create
403), which failed the plan's vault_kv_secret_v2 read. Set skip_child_token so the
provider uses the login token directly (estate pattern). Also correct the KV path
missed in the ipam->infra rename: service/terraform/infra.
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Manage NetBox prefixes and Kea DHCP scopes together from a single subnet
definition under config/<region>/<dc>/subnets/<name>.yaml.
- modules/ipam: netbox_prefix + netbox_ip_range (dhcp role) + gateway/managed
netbox_ip_address + kea_subnet; tokens read from Vault KV via the vault provider
- environments/au/syd1 terragrunt env, Consul state backend
- config seed: five DHCP subnets (198.18.13-17) + local netbox-only 198.18.25.0/24
- .woodpecker pre-commit+plan on PR, apply on main; Makefile Vault auth pattern
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
unkinben