feat: major restructuring in migration to terragrunt

- migrate from individual terraform files to config-driven terragrunt module structure
- add vault_cluster module with config discovery system
- replace individual .tf files with centralized config.hcl
- restructure auth and secret backends as configurable modules
- move auth roles and secret backends to yaml-based configuration
- convert policies from .hcl to .yaml format, add rules/auth definition
- add pre-commit hooks for yaml formatting and file cleanup
- add terragrunt cache to gitignore
- update makefile with terragrunt commands and format target

policies/kubernetes/au/config_admin.hcl

@@ -1,3 +0,0 @@
-path "kubernetes/au/+/config" {
-  capabilities = ["create", "update", "read", "delete", "list"]
-}

policies/kubernetes/au/config_admin.yaml

@@ -0,0 +1,14 @@
+# Allow administration of Kubernetes secret backend config
+---
+rules:
+  - path: "kubernetes/au/+/config"
+    capabilities:
+      - create
+      - update
+      - read
+      - delete
+      - list
+
+auth:
+  approle:
+    - tf_vault

policies/kubernetes/au/roles_admin.hcl

@@ -1,6 +0,0 @@
-path "kubernetes/au/+/roles" {
-  capabilities = ["list"]
-}
-path "kubernetes/au/+/roles/*" {
-  capabilities = ["create", "update", "read", "delete", "list"]
-}

policies/kubernetes/au/roles_admin.yaml

@@ -0,0 +1,17 @@
+# Allow administration of Kubernetes secret backend roles
+---
+rules:
+  - path: "kubernetes/au/+/roles"
+    capabilities:
+      - list
+  - path: "kubernetes/au/+/roles/*"
+    capabilities:
+      - create
+      - update
+      - read
+      - delete
+      - list
+
+auth:
+  approle:
+    - tf_vault

policies/kubernetes/au/syd1/creds/cluster-admin.hcl

@@ -1,3 +0,0 @@
-path "kubernetes/au/syd1/creds/cluster-admin" {
-  capabilities = ["update"]
-}

policies/kubernetes/au/syd1/creds/cluster-admin.yaml

@@ -0,0 +1,10 @@
+# Allow access to cluster-admin Kubernetes credentials
+---
+rules:
+  - path: "kubernetes/au/syd1/creds/cluster-admin"
+    capabilities:
+      - update
+
+auth:
+  approle:
+    - tf_vault

policies/kubernetes/au/syd1/creds/cluster-operator.hcl

@@ -1,3 +0,0 @@
-path "kubernetes/au/syd1/creds/cluster-operator" {
-  capabilities = ["update"]
-}

policies/kubernetes/au/syd1/creds/cluster-operator.yaml

@@ -0,0 +1,10 @@
+# Allow access to cluster-operator Kubernetes credentials
+---
+rules:
+  - path: "kubernetes/au/syd1/creds/cluster-operator"
+    capabilities:
+      - update
+
+auth:
+  approle:
+    - tf_vault

policies/kubernetes/au/syd1/creds/cluster-root.hcl

@@ -1,3 +0,0 @@
-path "kubernetes/au/syd1/creds/cluster-root" {
-  capabilities = ["update"]
-}

policies/kubernetes/au/syd1/creds/cluster-root.yaml

@@ -0,0 +1,10 @@
+# Allow access to cluster-root Kubernetes credentials
+---
+rules:
+  - path: "kubernetes/au/syd1/creds/cluster-root"
+    capabilities:
+      - update
+
+auth:
+  approle:
+    - tf_vault

policies/kubernetes/au/syd1/creds/media-apps-operator.hcl

@@ -1,3 +0,0 @@
-path "kubernetes/au/syd1/creds/media-apps-operator" {
-  capabilities = ["update"]
-}

policies/kubernetes/au/syd1/creds/media-apps-operator.yaml

@@ -0,0 +1,10 @@
+# Allow access to media-apps-operator Kubernetes credentials
+---
+rules:
+  - path: "kubernetes/au/syd1/creds/media-apps-operator"
+    capabilities:
+      - update
+
+auth:
+  approle:
+    - tf_vault