Grant terraform-infra kv metadata read

vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2
metadata path on every plan/apply; add read on kv/metadata/service/terraform/infra
so the plan doesn't 403 (same pattern as the terraform-git gitea config policy).

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_infra.yaml

@@ -1,5 +1,5 @@
 bound_service_account_names:
-  - terraform-ipam
+  - terraform-infra
 bound_service_account_namespaces:
   - woodpecker
 token_ttl: 600

config/consul_secret_backend_role/consul_root/au/syd1/terraform-infra.yaml

@@ -1,5 +1,5 @@
 consul_roles:
-  - terraform-ipam
+  - terraform-infra
 ttl: 120
 max_ttl: 300
 datacenters: []

policies/consul_root/au/syd1/creds/terraform-infra.yaml

@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-infra"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_infra
+  k8s/au/syd1:
+    - woodpecker_terraform_infra

policies/consul_root/au/syd1/creds/terraform-ipam.yaml

@@ -1,11 +0,0 @@
----
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-ipam"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_ipam
-  k8s/au/syd1:
-    - woodpecker_terraform_ipam

policies/kv/service/terraform/infra.yaml

@@ -0,0 +1,18 @@
+# Allow the terraform-infra runner to read the NetBox + KeaAPI tokens
+# (netbox_token / kea_token fields) used by the netbox and kea providers.
+---
+rules:
+  - path: "kv/data/service/terraform/infra"
+    capabilities:
+      - read
+  # vault_kv_secret_v2 (providers.tf data source) reads the kv-v2 metadata path
+  # on every plan/apply; a 403 here fails the plan.
+  - path: "kv/metadata/service/terraform/infra"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_infra
+  k8s/au/syd1:
+    - woodpecker_terraform_infra

policies/kv/service/terraform/ipam.yaml

@@ -1,13 +0,0 @@
-# Allow the Terraform IPAM runner to read the NetBox + KeaAPI tokens
-# (netbox_token / kea_token fields) used by the netbox and kea providers.
----
-rules:
-  - path: "kv/data/service/terraform/ipam"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_ipam
-  k8s/au/syd1:
-    - woodpecker_terraform_ipam

resources/secret_backend/consul_root/au/syd1/terraform-infra.hcl

@@ -1,4 +1,4 @@
-key_prefix "infra/terraform/ipam/" {
+key_prefix "infra/terraform/infra/" {
   policy = "write"
 }