Hashicorp Vault Integration (JWT) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (JWT) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	12 / 20	6 / 20	6 / 10	54 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Six distinct examples cover the major modes: default OIDC token, non-standard auth path (vault_jwt_auth_path = "oidc"), group-to-role mapping, pinned CLI version, custom display name, and custom JWT token generation with full Terraform + Vault role/policy examples. Sensible defaults are shown for every variable.
Visual preview	5	0	No embedded image, GIF, or video in the README. The front-matter icon field references a static SVG logo, which does not count as a preview of the module in action.

Credential Hygiene — 12 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	vault_jwt_token is correctly marked sensitive = true in main.tf. However, the first README example inlines a placeholder JWT (vault_jwt_token = "eyJhbGciOiJIUzI1N..."), which per calibration counts as an inline secret, capping this criterion at half.
Non-hardcoded auth path	4	4	The default auth path uses data.coder_workspace_owner.me.oidc_access_token (Coder's OIDC provider), documented in the README intro. The "Use a custom JWT token" example shows generating a signed JWT with proper claims, avoiding raw key pasting into templates.

Restricted-Environment Readiness — 6 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The Vault CLI is downloaded from the hardcoded URL https://releases.hashicorp.com/vault/… in run.sh. No module input variable overrides this download URL. vault_addr is the Vault server address, not the binary download source. No variable can be named that replaces the install URL.
Bring-your-own binary	10	5	run.sh checks command -v vault and skips installation if the installed version matches VAULT_CLI_VERSION. This is a working skip-install path, but the README never documents that pre-baking Vault into the image will cause the module to skip download. Implemented but under-documented → half.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (e.g., releases.hashicorp.com for CLI download, the user-supplied vault_addr for auth/secret retrieval) or provides guidance for restricted/air-gapped environments. Endpoints are only visible in source code and configuration examples.
Runs without sudo	2	1	run.sh attempts sudo mv vault /usr/local/bin/vault and, on failure, falls back to mkdir -p ~/.local/bin && mv vault ~/.local/bin/vault. Sudo is used only for the optional system-wide install with a working non-root fallback → half.

Engineering Quality — 6 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All eight variables in main.tf carry a description, sensible default values, and vault_cli_version includes a validation block enforcing semver or latest. vault_jwt_token is additionally marked sensitive.
Test coverage	4	0	main.test.ts only calls runTerraformInit and testRequiredVariables (a smoke check that three required variables are declared). No .tftest.hcl file exists, no business-logic assertions, and no end-to-end behavior is tested.

Overall — 54 / 100

Raw 36 / 67 → round(36 / 67 × 100) = 54

---

Scored against SCORECARD.md on 2026-10-26 with solstice-1.