Hashicorp Vault Integration (JWT) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (JWT) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	12 / 20	6 / 20	8 / 10	57 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents six distinct examples covering all major configuration modes: default auth path, non-standard auth path (vault_jwt_auth_path = "oidc"), group-to-role mapping, pinned CLI version, custom display_name, and a full custom-JWT generation example with jwt_signed_token resource. Each example uses sensible defaults and is self-contained.
Visual preview	5	0	No embedded image, GIF, or video in the README. The frontmatter references an SVG icon (icon: ../../../../.icons/vault.svg), but an icon is not a visual preview of the module in action.

Credential Hygiene — 12 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	vault_jwt_token is correctly marked sensitive = true in main.tf. However, the first README example inlines a placeholder JWT (vault_jwt_token = "eyJhbGciOiJIUzI1N..."), which per calibration counts as an inline secret, capping this criterion at half.
Non-hardcoded auth path	4	4	The module's default auth path uses data.coder_workspace_owner.me.oidc_access_token (Coder OIDC), documented in the README intro. The "Use a custom JWT token" example shows generating a signed JWT via Terraform provider rather than pasting a raw key. Both paths avoid hardcoding secrets into templates.

Restricted-Environment Readiness — 6 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The Vault CLI download URL is hardcoded in run.sh as https://releases.hashicorp.com/vault/.... No module input variable overrides this URL. vault_cli_version is a version pin, not a URL override; vault_addr is the Vault server address, not the artifact source. No variable can be named that replaces the download URL.
Bring-your-own binary	10	5	run.sh checks command -v vault and skips installation if the installed version matches VAULT_CLI_VERSION. This is implemented but not documented in the README—there is no section or example stating "if Vault is already in your image, the module will detect it and skip download." Half credit for implemented-but-undocumented.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (e.g., releases.hashicorp.com, the Vault server). Endpoints are only visible in run.sh source and scattered across examples. Per rubric, inferable endpoints and scattered mentions do not count.
Runs without sudo	2	1	run.sh attempts sudo mv vault /usr/local/bin/vault 2> /dev/null and falls back to mkdir -p ~/.local/bin && mv vault ~/.local/bin/vault when sudo is unavailable. Sudo is used only for the optional system-path install with a working non-root fallback. Half credit per calibration.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All eight variables in main.tf have clear description fields and sensible defaults (vault_jwt_auth_path = "jwt", vault_cli_version = "latest", display_name = "Vault (JWT)", vault_jwt_token = null, vault_namespace = null). vault_cli_version includes a validation block with a regex and error message. vault_jwt_token is marked sensitive.
Test coverage	4	2	main.test.ts runs runTerraformInit and testRequiredVariables (verifying agent_id, vault_addr, vault_jwt_role are required). No .tftest.hcl file is present. No business-logic tests (e.g., conditional vault_namespace env, OIDC token fallback, script template rendering) and no end-to-end behavior tests. Minimal smoke test only.

Overall — 57 / 100

Raw 38 / 67 → round(38 / 67 × 100) = 57

Track: Utility (auth/integration module; not an AI agent or IDE)

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.