fix: use direct in-cluster kubernetes auth instead of kubeconfig file

- providers.tf: use host + token + ca_crt from mounted service account secrets
- workflow: remove kubeconfig generation step (no longer needed)
- variables.tf: remove unused kubeconfig_path variable

This is the standard pattern for running terraform inside k8s pods.

terraform/providers.tf

@@ -29,12 +29,18 @@ terraform {
 }
 
 provider "kubernetes" {
-  config_path = var.kubeconfig_path
+  host                   = "https://kubernetes.default"
+  token                   = file("/var/run/secrets/kubernetes.io/serviceaccount/token")
+  cluster_ca_certificate = file("/var/run/secrets/kubernetes.io/serviceaccount/ca.crt")
+  insecure               = false
 }
 
 provider "helm" {
   kubernetes {
-    config_path = var.kubeconfig_path
+    host                   = "https://kubernetes.default"
+    token                   = file("/var/run/secrets/kubernetes.io/serviceaccount/token")
+    cluster_ca_certificate = file("/var/run/secrets/kubernetes.io/serviceaccount/ca.crt")
+    insecure               = false
   }
 }
 

terraform/variables.tf

@@ -1,9 +1,3 @@
-variable "kubeconfig_path" {
-  description = "Path to kubeconfig file"
-  type        = string
-  default     = "/tmp/kubeconfig"
-}
-
 variable "cluster_domain" {
   description = "Cluster domain (e.g., riotpiao.homelab.com)"
   type        = string