Hashicorp Vault Integration (Token) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	16 / 20	6 / 20	8 / 10	54 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows a basic usage block (token, addr, namespace) and one example with vault_cli_version. However, there is no dedicated example for the token-less path (vault_token defaults to null), no example isolating namespace-only usage, and the "Configuration" section is a procedural guide rather than a Terraform example. For a module with 5 variables and multiple optional modes, the examples are thin.
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter references an SVG icon (icon: ../../../../.icons/vault.svg), but that is not a visual preview of the module in action.

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token is declared with sensitive = true in main.tf. All README examples reference var.token (a variable), never an inline literal or placeholder key. Clean.
Non-hardcoded auth path	4	0	The README's step 3 explicitly instructs: "Copy the generated token and use in your template." No alternative path is documented (e.g., sourcing the token from a Coder variable, external secrets manager, or OIDC/AppRole flow). The only auth mechanism shown is pasting a raw token.

Restricted-Environment Readiness — 6 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The download URL is hardcoded in run.sh as https://releases.hashicorp.com/vault/…. No module input variable overrides this base URL. vault_cli_version only pins the version segment, not the host/path. No variable exists that replaces the download URL.
Bring-your-own binary	10	5	run.sh checks command -v vault and skips installation if the installed version matches INSTALL_VERSION. This is a functional skip-if-present path, but it is not documented anywhere in the README. Per rubric, behavior visible only in source code does not count as documented → half.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. The only external host contacted is releases.hashicorp.com (visible in run.sh), plus the user-supplied vault_addr. No air-gapped, offline, or network-requirements section exists.
Runs without sudo	2	1	run.sh attempts sudo mv vault /usr/local/bin/vault first, then falls back to mkdir -p ~/.local/bin && mv vault ~/.local/bin/vault when sudo is unavailable. The fallback works, so core functionality is not root-gated. However, the script does invoke sudo, so it does not meet the "never invoke sudo" bar for full credit. Half.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All five variables have type, description, and sensible default values. vault_token is sensitive = true. vault_cli_version includes a validation block with a regex enforcing latest or X.Y.Z format. Descriptions are clear and specific.
Test coverage	4	2	main.test.ts calls runTerraformInit and testRequiredVariables (verifying agent_id and vault_addr are required). No .tftest.hcl file exists. No tests cover the conditional logic (token present/absent, namespace present/absent), the version validation, or the script's install/skip behavior. Minimal coverage of variable declarations only.

Overall — 54 / 100

Raw 36 / 67 → round(36 / 67 × 100) = 54

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.