PKI CA snapshots

This independent Terraform root reads pki/ica_clients/cert/ca and pki/ica_servers/cert/ca through the existing Vault provider, then writes only their certificate fields to pki_ca_clients.crt and pki_ca_servers.crt. It uses the existing Local provider; no additional provider or copied Vault KV secret is needed. The parent BUILD targets consume checked-in files, not this root. The manually maintained root and intermediate CA1 certificates are not managed here.

The repository AL wrapper supplies the Vault connection, trusted CA, and operator authentication. The provider uses that existing token without creating a child token; it needs auth/token/lookup-self access. No infrastructure targets or Terraform state are read. The local backend path below keeps state under ignored out/ and shares it between the plan and apply launchers. Provider locks stay in Bazel runfiles. This root manages only local snapshots and needs no shared state backend.

From the repository root, review a refresh before applying it:

mkdir -p out/pki-ca
export AL_TF_BACKEND_CONFIG_path="path=$PWD/out/pki-ca/terraform.tfstate"
bazel run //data/ssl/alwaldend.com/tf:tf.plan -- \
  -var="output_directory=$PWD/data/ssl/alwaldend.com"
bazel run //data/ssl/alwaldend.com/tf:tf.apply -- \
  -var="output_directory=$PWD/data/ssl/alwaldend.com"

These are explicit operator commands that contact Vault. The apply command asks for confirmation. Review and commit the resulting certificate changes. The absolute output directory avoids writing only into Bazel runfiles. The existing issuer resources remain owned by infrastructure Terraform, which no longer writes these snapshots.

Offline checks use :tf_tests.fmt_test and :validate_test; neither refreshes the files or contacts Vault.