Grant terraform-incus approle read on encapi environment secret

terraform-incus dual-writes ENC data to encapi and needs the
ENCAPI_WRITE_TOKEN from Vault at apply time. Add a policy granting the
terraform_incus approle read on kv/data/kubernetes/namespace/encapi/default/environment.

Prerequisite for terraform-incus PR #39.

.woodpecker/apply.yaml

@@ -7,9 +7,8 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
     commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
+      - dnf install vault -y
       - make plan
       - make apply
     backend_options:

.woodpecker/plan.yaml

@@ -6,9 +6,8 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
     commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
+      - dnf install vault -y
       - make plan
     backend_options:
       kubernetes:

config/auth_approle_role/approle/terraform_enc.yaml

@@ -1,9 +0,0 @@
-token_ttl: 120
-token_max_ttl: 120
-bind_secret_id: false
-token_bound_cidrs:
-  - "10.10.12.200/32"
-  - "198.18.25.102/32"
-  - "198.18.26.91/32"
-  - "198.18.27.40/32"
-use_deterministic_role_id: true

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_enc.yaml

@@ -1,7 +0,0 @@
-bound_service_account_names:
-  - terraform-enc
-bound_service_account_namespaces:
-  - woodpecker
-token_ttl: 600
-token_max_ttl: 600
-audience: https://kubernetes.default.svc.cluster.local

config/consul_secret_backend_role/consul_root/au/syd1/terraform-enc.yaml

@@ -1,5 +0,0 @@
-consul_roles:
-  - terraform-enc
-ttl: 120
-max_ttl: 300
-datacenters: []

policies/consul_root/au/syd1/creds/terraform-enc.yaml

@@ -1,14 +0,0 @@
-# Allow the terragrunt-enc runner to generate credentials for the
-# terraform-enc role in consul (used to lock/write its terragrunt state under
-# infra/terraform/enc/ on the consul backend).
----
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-enc"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_enc
-  k8s/au/syd1:
-    - woodpecker_terraform_enc

policies/kv/service/terraform/enc-encapi-environment.yaml

@@ -1,14 +0,0 @@
-# Allow the terragrunt-enc runner to read the encapi environment secret
-# (ENCAPI_WRITE_TOKEN), so `make apply` can write ENC data (statuses, roles,
-# nodes) to encapi via the encapi Terraform provider.
----
-rules:
-  - path: "kv/data/kubernetes/namespace/encapi/default/environment"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_enc
-  k8s/au/syd1:
-    - woodpecker_terraform_enc

policies/kv/service/terraform/incus-encapi-environment.yaml

@@ -0,0 +1,12 @@
+# Allow the Terraform Incus runner to read the encapi environment secret
+# (ENCAPI_WRITE_TOKEN), so `make apply` can dual-write ENC data to encapi via
+# the encapi Terraform provider.
+---
+rules:
+  - path: "kv/data/kubernetes/namespace/encapi/default/environment"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_incus

resources/secret_backend/consul_root/au/syd1/terraform-enc.hcl

@@ -1,7 +0,0 @@
-key_prefix "infra/terraform/enc/" {
-  policy = "write"
-}
-
-session_prefix "" {
-  policy = "write"
-}