Is auditing a BIP32 tree only possible if it is non-hardened? BIP 32 allows you to to implement the auditor use case:


  Audits: N(m/*) In case an auditor needs full access to the list of
  incoming and outgoing payments, one can share all account public
  extended keys. This will allow the auditor to see all transactions
  from and to the wallet, in all accounts, but not a single secret key.


If I want all my bitcoin transactions to be fully audited, then I would need to give my auditor my master node details. However I obviously don't want to give him my master node secret key since he would be able to steal my money. Thus I could only give the auditor my master public key and the chain code. With that he will be able to derive all public keys and see all my transactions.

But that means that my entire tree can only use non-harded BIP-32. Is that correct or am I missing something?
That is correct, you can only do this with non-hardened derivation. Only non-hardened derivation can use the master public key to derive all of the public keys. With hardened derivation, you must have the master private key in order to derive anything.