Skip to content

feat: Add support for Vault namespaces to Vault modules #554

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 20, 2025
Merged

feat: Add support for Vault namespaces to Vault modules #554

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f37f3a9
vault namespace support added
rowansmithau Nov 20, 2025
89f2dab
always forget the version bump
rowansmithau Nov 20, 2025
2f94c58
Merge branch 'main' into rowansmithau/feat/vault-namespace-support
DevelopmentCats Nov 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions registry/coder/modules/vault-github/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ This module lets you authenticate with [Hashicorp Vault](https://www.vaultprojec
module "vault" {
count = data.coder_workspace.me.start_count
source = "registry.coder.com/coder/vault-github/coder"
version = "1.0.31"
version = "1.1.0"
agent_id = coder_agent.example.id
vault_addr = "https://vault.example.com"
}
Expand Down Expand Up @@ -46,7 +46,7 @@ To configure the Vault module, you must set up a Vault GitHub auth method. See t
module "vault" {
count = data.coder_workspace.me.start_count
source = "registry.coder.com/coder/vault-github/coder"
version = "1.0.31"
version = "1.1.0"
agent_id = coder_agent.example.id
vault_addr = "https://vault.example.com"
coder_github_auth_id = "my-github-auth-id"
Expand All @@ -59,7 +59,7 @@ module "vault" {
module "vault" {
count = data.coder_workspace.me.start_count
source = "registry.coder.com/coder/vault-github/coder"
version = "1.0.31"
version = "1.1.0"
agent_id = coder_agent.example.id
vault_addr = "https://vault.example.com"
coder_github_auth_id = "my-github-auth-id"
Expand All @@ -73,7 +73,7 @@ module "vault" {
module "vault" {
count = data.coder_workspace.me.start_count
source = "registry.coder.com/coder/vault-github/coder"
version = "1.0.31"
version = "1.1.0"
agent_id = coder_agent.example.id
vault_addr = "https://vault.example.com"
vault_cli_version = "1.15.0"
Expand Down
14 changes: 14 additions & 0 deletions registry/coder/modules/vault-github/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,12 @@ variable "vault_github_auth_path" {
default = "github"
}

variable "vault_namespace" {
type = string
description = "The Vault Enterprise namespace that contains the GitHub auth mount."
default = null
}

variable "vault_cli_version" {
type = string
description = "The version of Vault to install."
Expand All @@ -52,6 +58,7 @@ resource "coder_script" "vault" {
AUTH_PATH : var.vault_github_auth_path,
GITHUB_EXTERNAL_AUTH_ID : data.coder_external_auth.github.id,
INSTALL_VERSION : var.vault_cli_version,
VAULT_NAMESPACE : var.vault_namespace != null ? var.vault_namespace : "",
})
run_on_start = true
start_blocks_login = true
Expand All @@ -63,6 +70,13 @@ resource "coder_env" "vault_addr" {
value = var.vault_addr
}

resource "coder_env" "vault_namespace" {
count = var.vault_namespace == null ? 0 : 1
agent_id = var.agent_id
name = "VAULT_NAMESPACE"
value = var.vault_namespace
}

data "coder_external_auth" "github" {
id = var.coder_github_auth_id
}
6 changes: 6 additions & 0 deletions registry/coder/modules/vault-github/run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
INSTALL_VERSION=${INSTALL_VERSION}
GITHUB_EXTERNAL_AUTH_ID=${GITHUB_EXTERNAL_AUTH_ID}
AUTH_PATH=${AUTH_PATH}
VAULT_NAMESPACE=${VAULT_NAMESPACE}

fetch() {
dest="$1"
Expand Down Expand Up @@ -104,6 +105,11 @@ if ! (
fi
rm -rf "$TMP"

if [ -n "$${VAULT_NAMESPACE}" ]; then
export VAULT_NAMESPACE
printf "📁 Using Vault namespace: %s\n\n" "$${VAULT_NAMESPACE}"
fi

# Authenticate with Vault
printf "🔑 Authenticating with Vault ...\n\n"
GITHUB_TOKEN=$(coder external-auth access-token "$${GITHUB_EXTERNAL_AUTH_ID}")
Expand Down
10 changes: 5 additions & 5 deletions registry/coder/modules/vault-jwt/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ This module lets you authenticate with [Hashicorp Vault](https://www.vaultprojec
module "vault" {
count = data.coder_workspace.me.start_count
source = "registry.coder.com/coder/vault-jwt/coder"
version = "1.1.1"
version = "1.2.0"
agent_id = coder_agent.example.id
vault_addr = "https://vault.example.com"
vault_jwt_role = "coder" # The Vault role to use for authentication
Expand Down Expand Up @@ -42,7 +42,7 @@ curl -H "X-Vault-Token: ${VAULT_TOKEN}" -X GET "${VAULT_ADDR}/v1/coder/secrets/d
module "vault" {
count = data.coder_workspace.me.start_count
source = "registry.coder.com/coder/vault-jwt/coder"
version = "1.1.1"
version = "1.2.0"
agent_id = coder_agent.example.id
vault_addr = "https://vault.example.com"
vault_jwt_auth_path = "oidc"
Expand All @@ -58,7 +58,7 @@ data "coder_workspace_owner" "me" {}
module "vault" {
count = data.coder_workspace.me.start_count
source = "registry.coder.com/coder/vault-jwt/coder"
version = "1.1.1"
version = "1.2.0"
agent_id = coder_agent.example.id
vault_addr = "https://vault.example.com"
vault_jwt_role = data.coder_workspace_owner.me.groups[0]
Expand All @@ -71,7 +71,7 @@ module "vault" {
module "vault" {
count = data.coder_workspace.me.start_count
source = "registry.coder.com/coder/vault-jwt/coder"
version = "1.1.1"
version = "1.2.0"
agent_id = coder_agent.example.id
vault_addr = "https://vault.example.com"
vault_jwt_role = "coder" # The Vault role to use for authentication
Expand Down Expand Up @@ -132,7 +132,7 @@ resource "jwt_signed_token" "vault" {
module "vault" {
count = data.coder_workspace.me.start_count
source = "registry.coder.com/coder/vault-jwt/coder"
version = "1.1.1"
version = "1.2.0"
agent_id = coder_agent.example.id
vault_addr = "https://vault.example.com"
vault_jwt_role = "coder" # The Vault role to use for authentication
Expand Down
14 changes: 14 additions & 0 deletions registry/coder/modules/vault-jwt/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,12 @@ variable "vault_jwt_role" {
description = "The name of the Vault role to use for authentication."
}

variable "vault_namespace" {
type = string
description = "The Vault Enterprise namespace that contains the JWT auth mount."
default = null
}

variable "vault_cli_version" {
type = string
description = "The version of Vault to install."
Expand All @@ -57,6 +63,7 @@ resource "coder_script" "vault" {
VAULT_JWT_AUTH_PATH : var.vault_jwt_auth_path,
VAULT_JWT_ROLE : var.vault_jwt_role,
VAULT_CLI_VERSION : var.vault_cli_version,
VAULT_NAMESPACE : var.vault_namespace != null ? var.vault_namespace : "",
})
run_on_start = true
start_blocks_login = true
Expand All @@ -68,4 +75,11 @@ resource "coder_env" "vault_addr" {
value = var.vault_addr
}

resource "coder_env" "vault_namespace" {
count = var.vault_namespace == null ? 0 : 1
agent_id = var.agent_id
name = "VAULT_NAMESPACE"
value = var.vault_namespace
}

data "coder_workspace_owner" "me" {}
6 changes: 6 additions & 0 deletions registry/coder/modules/vault-jwt/run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
VAULT_CLI_VERSION=${VAULT_CLI_VERSION}
VAULT_JWT_AUTH_PATH=${VAULT_JWT_AUTH_PATH}
VAULT_JWT_ROLE=${VAULT_JWT_ROLE}
VAULT_NAMESPACE=${VAULT_NAMESPACE}
CODER_OIDC_ACCESS_TOKEN=${CODER_OIDC_ACCESS_TOKEN}

fetch() {
Expand Down Expand Up @@ -105,6 +106,11 @@ if ! (
fi
rm -rf "$TMP"

if [ -n "$${VAULT_NAMESPACE}" ]; then
export VAULT_NAMESPACE
printf "📁 Using Vault namespace: %s\n\n" "$${VAULT_NAMESPACE}"
fi

# Authenticate with Vault
printf "🔑 Authenticating with Vault ...\n\n"
echo "$${CODER_OIDC_ACCESS_TOKEN}" | vault write -field=token auth/"$${VAULT_JWT_AUTH_PATH}"/login role="$${VAULT_JWT_ROLE}" jwt=- | vault login -
Expand Down
4 changes: 2 additions & 2 deletions registry/coder/modules/vault-token/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ variable "vault_token" {

module "vault" {
source = "registry.coder.com/coder/vault-token/coder"
version = "1.2.2"
version = "1.3.0"
agent_id = coder_agent.example.id
vault_token = var.token # optional
vault_addr = "https://vault.example.com"
Expand Down Expand Up @@ -73,7 +73,7 @@ variable "vault_token" {

module "vault" {
source = "registry.coder.com/coder/vault-token/coder"
version = "1.2.2"
version = "1.3.0"
agent_id = coder_agent.example.id
vault_addr = "https://vault.example.com"
vault_token = var.token
Expand Down
3 changes: 2 additions & 1 deletion registry/coder/modules/vault-token/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ resource "coder_script" "vault" {
icon = "/icon/vault.svg"
script = templatefile("${path.module}/run.sh", {
INSTALL_VERSION : var.vault_cli_version,
VAULT_NAMESPACE : var.vault_namespace != null ? var.vault_namespace : "",
})
run_on_start = true
start_blocks_login = true
Expand All @@ -73,4 +74,4 @@ resource "coder_env" "vault_namespace" {
agent_id = var.agent_id
name = "VAULT_NAMESPACE"
value = var.vault_namespace
}
}
6 changes: 6 additions & 0 deletions registry/coder/modules/vault-token/run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

# Convert all templated variables to shell variables
INSTALL_VERSION=${INSTALL_VERSION}
VAULT_NAMESPACE=${VAULT_NAMESPACE}

fetch() {
dest="$1"
Expand Down Expand Up @@ -101,3 +102,8 @@ if ! (
exit 1
fi
rm -rf "$TMP"

if [ -n "$${VAULT_NAMESPACE}" ]; then
export VAULT_NAMESPACE
printf "📁 Using Vault namespace: %s\n\n" "$${VAULT_NAMESPACE}"
fi