feat: major restructuring in migration to terragrunt

- migrate from individual terraform files to config-driven terragrunt module structure
- add vault_cluster module with config discovery system
- replace individual .tf files with centralized config.hcl
- restructure auth and secret backends as configurable modules
- move auth roles and secret backends to yaml-based configuration
- convert policies from .hcl to .yaml format, add rules/auth definition
- add pre-commit hooks for yaml formatting and file cleanup
- add terragrunt cache to gitignore
- update makefile with terragrunt commands and format target

config/auth_approle_role/approle/certmanager.yaml

@@ -0,0 +1,13 @@
+token_policies:
+  - "pki_int/certmanager"
+token_ttl: 30
+token_max_ttl: 30
+bind_secret_id: false
+token_bound_cidrs:
+  - "198.18.25.5/32"
+  - "198.18.26.3/32"
+  - "198.18.27.89/32"
+  - "198.18.28.8/32"
+  - "198.18.29.33/32"
+  - "198.18.29.239/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/incus_cluster.yaml

@@ -0,0 +1,12 @@
+token_policies:
+  - "default_access"
+  - "kv/service/incus/incus-cluster-join-tokens"
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.13.77/32"
+  - "198.18.13.78/32"
+  - "198.18.13.79/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/packer_builder.yaml

@@ -0,0 +1,12 @@
+token_policies:
+  - "default_access"
+  - "kv/service/packer/packer_builder"
+token_ttl: 300
+token_max_ttl: 600
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/puppetapi.yaml

@@ -0,0 +1,13 @@
+token_policies:
+  - "kv/service/puppetapi/puppetapi_read_tokens"
+token_ttl: 30
+token_max_ttl: 30
+bind_secret_id: false
+token_bound_cidrs:
+  - "198.18.25.5/32"
+  - "198.18.26.3/32"
+  - "198.18.27.89/32"
+  - "198.18.28.8/32"
+  - "198.18.29.33/32"
+  - "198.18.29.239/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/rpmbuilder.yaml

@@ -0,0 +1,12 @@
+token_policies:
+  - "kv/service/github/neoloc/tokens/read-only-token/read"
+  - "kv/service/gitea/unkinben/tokens/read-only-packages/read"
+token_ttl: 30
+token_max_ttl: 30
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/rundeck-role.yaml

@@ -0,0 +1,8 @@
+token_policies:
+  - "rundeck/rundeck"
+token_ttl: 3600
+token_max_ttl: 14400
+bind_secret_id: true
+token_bound_cidrs:
+  - "198.18.13.59/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/sshsigner.yaml

@@ -0,0 +1,14 @@
+token_policies:
+  - "ssh-host-signer/sshsigner"
+  - "sshca_signhost"
+token_ttl: 30
+token_max_ttl: 30
+bind_secret_id: false
+token_bound_cidrs:
+  - "198.18.25.5/32"
+  - "198.18.26.3/32"
+  - "198.18.27.89/32"
+  - "198.18.28.8/32"
+  - "198.18.29.33/32"
+  - "198.18.29.239/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/terraform_incus.yaml

@@ -0,0 +1,13 @@
+token_policies:
+  - "default_access"
+  - "kv/service/terraform/incus"
+  - "kv/service/puppet/certificates/terraform_puppet_cert"
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/terraform_nomad.yaml

@@ -0,0 +1,12 @@
+token_policies:
+  - "default_access"
+  - "kv/service/terraform/nomad"
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/terraform_repoflow.yaml

@@ -0,0 +1,13 @@
+token_policies:
+  - "default_access"
+  - "kv/service/repoflow/unkinadmin/tokens/terraform/read"
+  - "kv/service/terraform/repoflow"
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/tf_vault.yaml

@@ -0,0 +1,30 @@
+token_policies:
+  - "default_access"
+  - "approle_token_create"
+  - "auth/approle/approle_role_admin"
+  - "auth/approle/approle_role_login"
+  - "auth/kubernetes/k8s_auth_admin"
+  - "auth/ldap/ldap_admin"
+  - "auth/token/auth_token_create"
+  - "auth/token/auth_token_self"
+  - "auth/token/auth_token_roles_admin"
+  - "kubernetes/au/config_admin"
+  - "kubernetes/au/roles_admin"
+  - "kv/service/glauth/services/svc_vault_read"
+  - "kv/service/kubernetes/au/syd1/token_reviewer_jwt/read"
+  - "kv/service/kubernetes/au/syd1/service_account_jwt/read"
+  - "kv/service/vault/auth_backends_read"
+  - "pki_int/pki_int_roles_admin"
+  - "pki_root/pki_root_roles_admin"
+  - "ssh-host-signer/ssh-host-signer_roles_admin"
+  - "sshca/sshca_roles_admin"
+  - "sys/sys_auth_admin"
+  - "sys/sys_mounts_admin"
+  - "sys/sys_policy_admin"
+  - "transit/keys/admin"
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+use_deterministic_role_id: false