From 92b8fdd0dd93c962c2a009c6c6f571954f719352 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Wed, 5 Aug 2026 00:52:10 +1000
Subject: [PATCH] Rename terraform-ipam CI Vault access -> terraform-infra

Follows the terraform-ipam -> terraform-infra repo rename: role
woodpecker_terraform_infra, consul role/ACL policy terraform-infra
(state path infra/terraform/infra/*), creds + kv read policies.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
---
 ...rm_ipam.yaml => woodpecker_terraform_infra.yaml} |  2 +-
 .../{terraform-ipam.yaml => terraform-infra.yaml}   |  2 +-
 .../consul_root/au/syd1/creds/terraform-infra.yaml  | 11 +++++++++++
 .../consul_root/au/syd1/creds/terraform-ipam.yaml   | 11 -----------
 policies/kv/service/terraform/infra.yaml            | 13 +++++++++++++
 policies/kv/service/terraform/ipam.yaml             | 13 -------------
 .../{terraform-ipam.hcl => terraform-infra.hcl}     |  2 +-
 7 files changed, 27 insertions(+), 27 deletions(-)
 rename config/auth_kubernetes_role/k8s/au/syd1/{woodpecker_terraform_ipam.yaml => woodpecker_terraform_infra.yaml} (89%)
 rename config/consul_secret_backend_role/consul_root/au/syd1/{terraform-ipam.yaml => terraform-infra.yaml} (72%)
 create mode 100644 policies/consul_root/au/syd1/creds/terraform-infra.yaml
 delete mode 100644 policies/consul_root/au/syd1/creds/terraform-ipam.yaml
 create mode 100644 policies/kv/service/terraform/infra.yaml
 delete mode 100644 policies/kv/service/terraform/ipam.yaml
 rename resources/secret_backend/consul_root/au/syd1/{terraform-ipam.hcl => terraform-infra.hcl} (62%)

diff --git a/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_ipam.yaml b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_infra.yaml
similarity index 89%
rename from config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_ipam.yaml
rename to config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_infra.yaml
index b2f6011..1beda15 100644
--- a/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_ipam.yaml
+++ b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_infra.yaml
@@ -1,5 +1,5 @@
 bound_service_account_names:
-  - terraform-ipam
+  - terraform-infra
 bound_service_account_namespaces:
   - woodpecker
 token_ttl: 600
diff --git a/config/consul_secret_backend_role/consul_root/au/syd1/terraform-ipam.yaml b/config/consul_secret_backend_role/consul_root/au/syd1/terraform-infra.yaml
similarity index 72%
rename from config/consul_secret_backend_role/consul_root/au/syd1/terraform-ipam.yaml
rename to config/consul_secret_backend_role/consul_root/au/syd1/terraform-infra.yaml
index c5d82f8..6d3954d 100644
--- a/config/consul_secret_backend_role/consul_root/au/syd1/terraform-ipam.yaml
+++ b/config/consul_secret_backend_role/consul_root/au/syd1/terraform-infra.yaml
@@ -1,5 +1,5 @@
 consul_roles:
-  - terraform-ipam
+  - terraform-infra
 ttl: 120
 max_ttl: 300
 datacenters: []
diff --git a/policies/consul_root/au/syd1/creds/terraform-infra.yaml b/policies/consul_root/au/syd1/creds/terraform-infra.yaml
new file mode 100644
index 0000000..ecee6a8
--- /dev/null
+++ b/policies/consul_root/au/syd1/creds/terraform-infra.yaml
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-infra"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_infra
+  k8s/au/syd1:
+    - woodpecker_terraform_infra
diff --git a/policies/consul_root/au/syd1/creds/terraform-ipam.yaml b/policies/consul_root/au/syd1/creds/terraform-ipam.yaml
deleted file mode 100644
index b6e25b6..0000000
--- a/policies/consul_root/au/syd1/creds/terraform-ipam.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
----
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-ipam"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_ipam
-  k8s/au/syd1:
-    - woodpecker_terraform_ipam
diff --git a/policies/kv/service/terraform/infra.yaml b/policies/kv/service/terraform/infra.yaml
new file mode 100644
index 0000000..7524228
--- /dev/null
+++ b/policies/kv/service/terraform/infra.yaml
@@ -0,0 +1,13 @@
+# Allow the terraform-infra runner to read the NetBox + KeaAPI tokens
+# (netbox_token / kea_token fields) used by the netbox and kea providers.
+---
+rules:
+  - path: "kv/data/service/terraform/infra"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_infra
+  k8s/au/syd1:
+    - woodpecker_terraform_infra
diff --git a/policies/kv/service/terraform/ipam.yaml b/policies/kv/service/terraform/ipam.yaml
deleted file mode 100644
index 7572a05..0000000
--- a/policies/kv/service/terraform/ipam.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# Allow the Terraform IPAM runner to read the NetBox + KeaAPI tokens
-# (netbox_token / kea_token fields) used by the netbox and kea providers.
----
-rules:
-  - path: "kv/data/service/terraform/ipam"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_ipam
-  k8s/au/syd1:
-    - woodpecker_terraform_ipam
diff --git a/resources/secret_backend/consul_root/au/syd1/terraform-ipam.hcl b/resources/secret_backend/consul_root/au/syd1/terraform-infra.hcl
similarity index 62%
rename from resources/secret_backend/consul_root/au/syd1/terraform-ipam.hcl
rename to resources/secret_backend/consul_root/au/syd1/terraform-infra.hcl
index 6f94b75..ff21a9f 100644
--- a/resources/secret_backend/consul_root/au/syd1/terraform-ipam.hcl
+++ b/resources/secret_backend/consul_root/au/syd1/terraform-infra.hcl
@@ -1,4 +1,4 @@
-key_prefix "infra/terraform/ipam/" {
+key_prefix "infra/terraform/infra/" {
   policy = "write"
 }