Hashicorp Vault Integration (JWT) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (JWT) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
20 / 25	18 / 20	7.5 / 20	7 / 10	70 / 100

Drilldown

Presentation & Onboarding — 20 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: default OIDC token usage, custom JWT token, non-standard auth path, version pinning, namespace configuration, and group-based role mapping. Each has sensible defaults.
Coder-context framing	8	8	README clearly explains this module authenticates with Vault using JWT from Coder's OIDC provider, names both Coder and Vault, and shows the integration flow (OIDC token → Vault auth → workspace access).
Visual preview	5	0	No image, GIF, or video present. The icon reference is metadata, not an embedded visual preview.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	14	The vault_jwt_token variable is marked sensitive = true in main.tf. However, the first README example shows vault_jwt_token = "eyJhbGciOiJIUzI1N..." with an inline placeholder JWT, which counts as an inline secret example, capping this at partial credit despite proper variable marking.
Non-hardcoded auth path	4	4	README demonstrates using Coder's OIDC authentication token as the default JWT source, avoiding raw key pasting. The custom JWT example shows generating tokens programmatically via the jwt provider.

Restricted-Environment Readiness — 7.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The run.sh script hardcodes https://releases.hashicorp.com/vault/ for downloads with no module variable to override this URL. The vault_cli_version variable only controls which version is fetched from the hardcoded domain, not where to fetch from.
Bring-your-own binary	5	5	The install function in run.sh checks if vault is already installed with the correct version and skips installation: if command -v vault > /dev/null 2>&1; then CURRENT_VERSION=$(vault version... with installation_needed=0. This is documented behavior allowing pre-baked binaries.
Egress transparency	3	1.5	External endpoints are mentioned across examples (https://vault.example.com, https://releases.hashicorp.com/vault/) but there is no dedicated README section enumerating all endpoints contacted at install and runtime with air-gapped notes. Scattered mentions earn at most half.
Runs without sudo	2	1	The run.sh script attempts sudo mv vault /usr/local/bin/vault but falls back to ~/.local/bin/vault if sudo fails, with a note to add to PATH. This is a working fallback for the optional system-wide install, but the fallback requires manual PATH configuration, making it awkward. Earns half.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (vault_jwt_auth_path = "jwt", vault_cli_version = "latest", display_name = "Vault (JWT)"). The vault_cli_version has validation: `can(regex("^(latest
Test coverage	4	1	The main.test.ts only tests required variables with testRequiredVariables, no business logic coverage. No .tftest.hcl file present. Minimal testing story.

Overall — 70 / 100

Raw 52.5 / 75 → round(52.5 / 75 × 100) = 70

Track: Utility (authentication/integration module, not an agent or IDE)

Corrected calculation: 20 + 18 + 7.5 + 7 = 52.5 / 75 → round(52.5 / 75 × 100) = 70 / 100

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.