Hashicorp Vault Integration (JWT) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (JWT) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	18 / 20	7 / 20	8 / 10	67 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: default OIDC token usage, custom JWT token, non-standard auth path, version pinning, group-to-role mapping. Each has sensible defaults.
Coder-context framing	8	5	Explains the module authenticates with Vault using Coder's OIDC token and names both Coder and Vault. Shows usage in workspace context with data.coder_workspace.me.start_count. Does not explicitly show where Coder fits in the broader authentication flow or diagram the integration architecture.
Visual preview	5	0	No image, GIF, or video in README. Icon reference exists but is not embedded preview content.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_jwt_token variable is marked sensitive = true. README examples show token as truncated placeholder "eyJhbGciOiJIUzI1N..." or reference jwt_signed_token.vault[0].token resource output, avoiding inline literal secrets.
Non-hardcoded auth path	4	2	Documents using Coder's OIDC access token via data.coder_workspace_owner.me.oidc_access_token, which is a form of external auth integration. However, the default path still involves passing tokens through Terraform variables. Custom JWT example shows more sophisticated approach but is complex. Partial credit for documented OIDC integration.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	Vault CLI download URL is hardcoded to https://releases.hashicorp.com/vault/ in run.sh. No module input variable overrides this download URL. vault_cli_version only controls version selection, not source location.
Bring-your-own binary	5	0	No documented way to skip Vault CLI installation when it's already in the image. The install() function in run.sh checks if the correct version exists but always attempts installation/upgrade if versions don't match. No skip-install flag or variable.
Egress transparency	3	1.5	Endpoints are scattered across examples and inferable from code (releases.hashicorp.com, Vault server at vault_addr). No dedicated README section enumerating external endpoints for restricted environments. Partial credit for endpoints being visible in examples.
Runs without sudo	2	2	Script attempts sudo mv vault /usr/local/bin/vault but explicitly falls back to ~/.local/bin/vault when sudo fails, with user notification. Core functionality (Vault authentication) works without sudo. Full credit for graceful degradation.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (vault_jwt_auth_path = "jwt", vault_cli_version = "latest", vault_jwt_token = null). Validation rule on vault_cli_version enforces format. vault_namespace properly nullable.
Test coverage	4	2	main.test.ts exists and tests required variables with testRequiredVariables. However, only covers basic input validation, not business logic scenarios (authentication flow, version handling, namespace configuration). No end-to-end tests visible. Partial credit for minimal test structure.

Overall — 67 / 100

Raw 50 / 75 → round(50 / 75 × 100) = 67

Track: Utility (authentication/integration module, not an agent or IDE)

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.