feat: major restructuring in migration to terragrunt

- migrate from individual terraform files to config-driven terragrunt module structure
- add vault_cluster module with config discovery system
- replace individual .tf files with centralized config.hcl
- restructure auth and secret backends as configurable modules
- move auth roles and secret backends to yaml-based configuration
- convert policies from .hcl to .yaml format, add rules/auth definition
- add pre-commit hooks for yaml formatting and file cleanup
- add terragrunt cache to gitignore
- update makefile with terragrunt commands and format target

policies/pki_int/certmanager.hcl

@@ -1,9 +0,0 @@
-path "pki_int/issue/*" {
-  capabilities = ["create", "update", "read"]
-}
-path "pki_int/renew/*" {
-  capabilities = ["update"]
-}
-path "pki_int/cert/*" {
-  capabilities = ["read"]
-}

policies/pki_int/certmanager.yaml

@@ -0,0 +1,19 @@
+# Allow cert-manager to issue and manage certificates
+# used by the puppet autossl role
+---
+rules:
+  - path: "pki_int/issue/*"
+    capabilities:
+      - create
+      - update
+      - read
+  - path: "pki_int/renew/*"
+    capabilities:
+      - update
+  - path: "pki_int/cert/*"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - certmanager

policies/pki_int/issue/servers_default.hcl

@@ -1,3 +0,0 @@
-path "pki_int/issue/servers_default" {
-  capabilities = ["update"]
-}

policies/pki_int/issue/servers_default.yaml

@@ -0,0 +1,11 @@
+# Allow issuing server certificates from servers_default role
+---
+rules:
+  - path: "pki_int/issue/servers_default"
+    capabilities:
+      - update
+
+auth:
+  k8s/au/syd1:
+    - huntarr-default
+    - cert_manager_issuer

policies/pki_int/pki_int_roles_admin.hcl

@@ -1,3 +0,0 @@
-path "pki_int/roles/*" {
-  capabilities = ["create", "update", "read", "delete", "list"]
-}

policies/pki_int/roles/admin.yaml

@@ -0,0 +1,14 @@
+# Allow administration of PKI roles
+---
+rules:
+  - path: "pki_int/roles/*"
+    capabilities:
+      - create
+      - update
+      - read
+      - delete
+      - list
+
+auth:
+  approle:
+    - tf_vault

policies/pki_int/sign/servers_default.hcl

@@ -1,3 +0,0 @@
-path "pki_int/sign/servers_default" {
-  capabilities = ["update"]
-}

policies/pki_int/sign/servers_default.yaml

@@ -0,0 +1,11 @@
+# Allow signing server certificates with servers_default role
+---
+rules:
+  - path: "pki_int/sign/servers_default"
+    capabilities:
+      - update
+
+auth:
+  k8s/au/syd1:
+    - huntarr-default
+    - cert_manager_issuer