feat: major restructuring in migration to terragrunt

- migrate from individual terraform files to config-driven terragrunt module structure
- add vault_cluster module with config discovery system
- replace individual .tf files with centralized config.hcl
- restructure auth and secret backends as configurable modules
- move auth roles and secret backends to yaml-based configuration
- convert policies from .hcl to .yaml format, add rules/auth definition
- add pre-commit hooks for yaml formatting and file cleanup
- add terragrunt cache to gitignore
- update makefile with terragrunt commands and format target

policies/auth/approle/admin.yaml

@@ -0,0 +1,14 @@
+# Allow full administration of AppRole roles
+---
+rules:
+  - path: "auth/approle/role/*"
+    capabilities:
+      - create
+      - update
+      - read
+      - delete
+      - list
+
+auth:
+  approle:
+    - tf_vault

policies/auth/approle/approle_role_admin.hcl

@@ -1,3 +0,0 @@
-path "auth/approle/role/*" {
-  capabilities = ["create", "update", "read", "delete", "list"]
-}

policies/auth/approle/approle_role_login.hcl

@@ -1,3 +0,0 @@
-path "auth/approle/login" {
-  capabilities = ["create"]
-}

policies/auth/approle/login.yaml

@@ -0,0 +1,10 @@
+# Allow AppRole login
+---
+rules:
+  - path: "auth/approle/login"
+    capabilities:
+      - create
+
+auth:
+  approle:
+    - tf_vault

policies/auth/k8s/au/syd1/admin.yaml

@@ -0,0 +1,23 @@
+# Allow administration of Kubernetes authentication backend
+---
+rules:
+  - path: "auth/k8s/au/syd1/config"
+    capabilities:
+      - create
+      - update
+      - read
+      - delete
+  - path: "auth/k8s/au/syd1/role/*"
+    capabilities:
+      - create
+      - update
+      - read
+      - delete
+      - list
+  - path: "auth/k8s/au/syd1/role"
+    capabilities:
+      - list
+
+auth:
+  approle:
+    - tf_vault

policies/auth/kubernetes/k8s_auth_admin.hcl

@@ -1,14 +0,0 @@
-# Allow configuration of Kubernetes authentication backend
-path "auth/kubernetes/config" {
-  capabilities = ["create", "update", "read", "delete"]
-}
-
-# Allow management of Kubernetes auth roles
-path "auth/kubernetes/role/*" {
-  capabilities = ["create", "update", "read", "delete", "list"]
-}
-
-# Allow listing auth/kubernetes/role
-path "auth/kubernetes/role" {
-  capabilities = ["list"]
-}

policies/auth/ldap/admin.yaml

@@ -0,0 +1,14 @@
+# Allow full administration of LDAP auth backend
+---
+rules:
+  - path: "auth/ldap/*"
+    capabilities:
+      - create
+      - update
+      - read
+      - delete
+      - list
+
+auth:
+  approle:
+    - tf_vault

policies/auth/ldap/ldap_admin.hcl

@@ -1,3 +0,0 @@
-path "auth/ldap/*" {
-  capabilities = ["create", "update", "read", "delete", "list"]
-}

policies/auth/token/auth_token_create.hcl

@@ -1,7 +0,0 @@
-path "auth/token/create" {
-  capabilities = ["create", "read", "update", "list"]
-}
-
-path "auth/token/*" {
-  capabilities = ["create", "update"]
-}

policies/auth/token/auth_token_lookup.hcl

@@ -1,4 +0,0 @@
-# Allow listing and reading tokens
-path "auth/token/lookup" {
-  capabilities = ["read", "list"]
-}

policies/auth/token/auth_token_renew.hcl

@@ -1,4 +0,0 @@
-# Allow renewing tokens
-path "auth/token/renew" {
-  capabilities = ["update"]
-}

policies/auth/token/auth_token_roles_admin.hcl

@@ -1,3 +0,0 @@
-path "auth/token/roles/*" {
-  capabilities = ["create", "read", "update", "delete", "list"]
-}

policies/auth/token/auth_token_self.hcl

@@ -1,14 +0,0 @@
-# Allow tokens to query themselves
-path "auth/token/lookup-self" {
-  capabilities = ["read"]
-}
-
-# Allow tokens to renew themselves
-path "auth/token/renew-self" {
-  capabilities = ["update"]
-}
-
-# Allow tokens to revoke themselves
-path "auth/token/revoke-self" {
-  capabilities = ["update"]
-}

policies/auth/token/create.yaml

@@ -0,0 +1,17 @@
+# Allow token creation and management
+---
+rules:
+  - path: "auth/token/create"
+    capabilities:
+      - create
+      - read
+      - update
+      - list
+  - path: "auth/token/*"
+    capabilities:
+      - create
+      - update
+
+auth:
+  approle:
+    - tf_vault

policies/auth/token/lookup.yaml

@@ -0,0 +1,11 @@
+# Allow listing and reading tokens
+---
+rules:
+  - path: "auth/token/lookup"
+    capabilities:
+      - read
+      - list
+
+auth:
+  approle:
+    - tf_vault

policies/auth/token/renew.yaml

@@ -0,0 +1,10 @@
+# Allow renewing tokens
+---
+rules:
+  - path: "auth/token/renew"
+    capabilities:
+      - update
+
+auth:
+  approle:
+    - tf_vault

policies/auth/token/roles/admin.yaml

@@ -0,0 +1,14 @@
+# Allow administration of token roles
+---
+rules:
+  - path: "auth/token/roles/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+      - list
+
+auth:
+  approle:
+    - tf_vault

policies/auth/token/self.yaml

@@ -0,0 +1,16 @@
+# Allow tokens to query themselves
+---
+rules:
+  - path: "auth/token/lookup-self"
+    capabilities:
+      - read
+  - path: "auth/token/renew-self"
+    capabilities:
+      - update
+  - path: "auth/token/revoke-self"
+    capabilities:
+      - update
+
+auth:
+  approle:
+    - tf_vault