feat: add incus-cluster role/policies

- add policy and role to manage incus cluster join tokens

auth_approle_incus_cluster.tf

@@ -0,0 +1,16 @@
+resource "vault_approle_auth_backend_role" "incus_cluster" {
+  role_name      = "incus_cluster"
+  bind_secret_id = false
+  token_policies = [
+    "default_access",
+    "incus-cluster-join-tokens"
+  ]
+  token_ttl     = 60
+  token_max_ttl = 120
+  token_bound_cidrs = [
+    "10.10.12.200/32",
+    "198.18.13.77/32",
+    "198.18.13.78/32",
+    "198.18.13.79/32"
+  ]
+}

policies.tf

@@ -12,6 +12,7 @@ locals {
     "policies/ssh-host-signer",
     "policies/sshca",
     "policies/kv/service/glauth/services",
+    "policies/kv/service/incus",
     "policies/kv/service/puppetapi",
     "policies/kv/service/terraform",
   ]

policies/kv/service/incus/incus-cluster-join-tokens.hcl

@@ -0,0 +1,3 @@
+path "kv/data/service/incus/cluster-join-tokens" {
+  capabilities = ["create", "read", "update", "delete"]
+}