feat: add plan workflow

- update makefile to enable kubernetes auth or roleid auth
- add plan workflow
- update all policies to allow the terraform-vault kubernetes role

.woodpecker/apply.yaml

@@ -1,23 +0,0 @@
-when:
-  - event: push
-    branch: master
-
-steps:
-  - name: apply
-    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
-    environment:
-      VAULT_AUTH_METHOD: kubernetes
-    commands:
-      - dnf install vault -y
-      - make plan
-      - make apply
-    backend_options:
-      kubernetes:
-        serviceAccountName: terraform-vault
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2

.woodpecker/plan.yaml

@@ -3,7 +3,7 @@ when:
 
 steps:
   - name: plan
-    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260308
     environment:
       VAULT_AUTH_METHOD: kubernetes
     commands:

.woodpecker/pre-commit.yaml

@@ -3,7 +3,7 @@ when:
 
 steps:
   - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260308
     commands:
       - uvx pre-commit run --all-files
     backend_options:

config/auth_approle_role/approle/terraform_git.yaml

@@ -1,9 +0,0 @@
-token_ttl: 120
-token_max_ttl: 120
-bind_secret_id: false
-token_bound_cidrs:
-  - "10.10.12.200/32"
-  - "198.18.25.102/32"
-  - "198.18.26.91/32"
-  - "198.18.27.40/32"
-use_deterministic_role_id: true

config/auth_kubernetes_role/k8s/au/syd1/forgebot.yaml

@@ -1,8 +0,0 @@
-bound_service_account_names:
-  - default
-  - forgebot-operator
-bound_service_account_namespaces:
-  - forgebot
-token_ttl: 600
-token_max_ttl: 600
-audience: vault

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_git.yaml

@@ -1,7 +0,0 @@
-bound_service_account_names:
-  - terraform-git
-bound_service_account_namespaces:
-  - woodpecker
-token_ttl: 600
-token_max_ttl: 600
-audience: https://kubernetes.default.svc.cluster.local

config/consul_secret_backend_role/consul_root/au/syd1/terraform-git.yaml

@@ -1,5 +0,0 @@
-consul_roles:
-  - terraform-git
-ttl: 120
-max_ttl: 300
-datacenters: []

policies/consul_root/au/syd1/creds/terraform-git.yaml

@@ -1,11 +0,0 @@
----
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-git"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_git
-  k8s/au/syd1:
-    - woodpecker_terraform_git

policies/kv/service/forgebot/config/read.yaml

@@ -1,9 +0,0 @@
----
-rules:
-  - path: "kv/data/kubernetes/namespace/forgebot/*"
-    capabilities:
-      - read
-
-auth:
-  k8s/au/syd1:
-    - forgebot

policies/kv/service/gitea/gitadmin/tokens/terraform-git/read.yaml

@@ -1,12 +0,0 @@
-# Allow reading Gitea admin token
----
-rules:
-  - path: "kv/data/service/gitea/gitadmin/tokens/terraform-git"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_git
-  k8s/au/syd1:
-    - woodpecker_terraform_git

policies/kv/service/woodpecker/tokens/gitadmin.yaml

@@ -1,11 +0,0 @@
----
-rules:
-  - path: "kv/data/service/woodpecker/tokens/gitadmin"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_git
-  k8s/au/syd1:
-    - woodpecker_terraform_git

resources/secret_backend/consul_root/au/syd1/terraform-git.hcl

@@ -1,7 +0,0 @@
-key_prefix "infra/terraform/git/" {
-  policy = "write"
-}
-
-session_prefix "" {
-  policy = "write"
-}