terraform-netbox supersedes terraform-infra but has no identity to run as: the terraform-infra policies bind to a terraform_infra approle and a woodpecker_terraform_infra k8s role that were never created.
- rename the netbox and consul creds policies, the engine role and the consul ACL rules to terraform-netbox
- add the terraform_netbox approle and woodpecker_terraform_netbox k8s role
- grant the engine role extras.customfield, dcim.platform and the device inventory types the module creates (manufacturer, devicetype, devicerole, tag, ipam.role) — the old scope would have 403ed on first apply
- drop the kv/service/terraform/infra policy: the kea_token is gone with Kea and the NetBox token is minted per run
Needs the terraform-netbox woodpecker ServiceAccount in argocd-apps before CI can auth.
Reviewed-on: #161
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
unkin-agent
e2c07a8c83