Why:
- The netbox provider authenticated with a static netbox_token seeded by hand
into KV; the vault-plugin-secrets-netbox engine mints a per-run ephemeral
token that is lease-revoked when the run ends, removing the manual seed.
How:
- Read netbox/creds/terraform-infra via vault_generic_secret and pass the minted
netbox_token to the netbox provider.
- Keep kea_token from KV for now (follow-up: its own ephemeral-token engine).
Depends on the netbox engine mount + netbox/creds/terraform-infra role/policy in
terraform-vault being applied first.
unkinben
a025819fcd