Hashicorp Vault Integration (JWT) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (JWT) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	12 / 20	1 / 20	8 / 10	49 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README shows multiple distinct configuration modes with sensible defaults: default OIDC-token auth, custom auth path, group-to-role mapping, version pinning, custom display name, and a full custom-JWT-signing example with a sample Vault role/policy.
Visual preview	5	0	No image, GIF, or video anywhere in the README.

Credential Hygiene — 12 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	vault_jwt_token is declared sensitive = true in main.tf, but the top-level README example inlines a placeholder-looking token value (vault_jwt_token = "eyJhbGciOiJIUzI1N..."), which caps this at half per the inline-secret rule.
Non-hardcoded auth path	4	4	Default behavior reuses data.coder_workspace_owner.me.oidc_access_token (Coder's OIDC token) instead of requiring a pasted static key — clearly documented as the primary path.

Restricted-Environment Readiness — 1 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh hardcodes https://releases.hashicorp.com/vault/... for both version discovery and binary download; no module variable overrides this URL.
Bring-your-own binary	10	0	The script silently skips reinstalling if an existing vault binary's version happens to match vault_cli_version, but this is undocumented, automatic, and not a user-facing toggle to disable install entirely — no README mention of a BYOB path.
Egress transparency	3	0	No dedicated network/offline/air-gapped section; the only endpoint (releases.hashicorp.com) is visible solely in script internals, not documented.
Runs without sudo	2	1	Script attempts sudo mv vault /usr/local/bin/vault 2> /dev/null but falls back to ~/.local/bin and prints a PATH note if sudo is unavailable — a working non-root fallback for an optional placement step, earning half.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions and sensible defaults (vault_jwt_auth_path = "jwt", vault_cli_version = "latest", display_name), plus a regex validation block on vault_cli_version.
Test coverage	4	2	main.test.ts only runs testRequiredVariables/terraform init smoke checks; no .tftest.hcl business-logic tests and no deeper TypeScript end-to-end coverage of the install/auth flow.

Overall — 49 / 100

Raw 33 / 67 → round(33 / 67 × 100) = 49

Track: Utility (Hashicorp Vault auth integration; not an agent or IDE module).

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.