Hashicorp Vault Integration (JWT) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (JWT) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
20 / 25	18 / 20	7.5 / 20	7 / 10	70 / 100

Drilldown

Presentation & Onboarding — 20 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: non-standard auth path, group-based role mapping, specific CLI version, custom JWT token generation. Each has sensible defaults.
Coder-context framing	8	8	README clearly explains this authenticates with Vault using JWT from Coder's OIDC provider, names both Coder and Vault, shows Coder fits in the authentication flow.
Visual preview	5	0	No image, GIF, or video in README. Icon reference does not count.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_jwt_token is marked sensitive = true in main.tf. README examples avoid inline secrets, using references like jwt_signed_token.vault[0].token or defaulting to data.coder_workspace_owner.me.oidc_access_token. The one example showing a truncated token (eyJhbGciOiJIUzI1N...) is clearly illustrative, not a literal paste instruction.
Non-hardcoded auth path	4	2	README shows using Coder's OIDC token as the default JWT source, which is a form of external auth. However, the path still requires the JWT to be passed through the template; no direct ServiceAccount, IAM role, or API key helper integration is documented. Half credit for partial non-hardcoded approach.

Restricted-Environment Readiness — 7.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The module downloads Vault CLI from https://releases.hashicorp.com/vault/... with a hardcoded URL in run.sh. No module input variable overrides this download URL. vault_cli_version only controls version selection, not the source mirror.
Bring-your-own binary	5	2.5	The install script checks if command -v vault and skips installation if the correct version is already present, but this is implicit behavior in the script. No documented example or variable shows how to disable download when vault is pre-baked. Half credit for undocumented capability.
Egress transparency	3	1.5	Endpoints are scattered across examples and code: https://releases.hashicorp.com/vault/, https://vault.example.com (user-provided). No dedicated README section enumerates external endpoints for install/runtime or notes for restricted environments. Half credit for inferable endpoints.
Runs without sudo	2	2	The run.sh script attempts sudo mv vault /usr/local/bin/vault but falls back to ~/.local/bin/vault if sudo fails, with a note to add to PATH. Core functionality (authentication) works without sudo. Full credit.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults: vault_jwt_auth_path = "jwt", vault_cli_version = "latest", display_name = "Vault (JWT)". Validation present on vault_cli_version with regex pattern.
Test coverage	4	1	main.test.ts only tests required variables with testRequiredVariables. No .tftest.hcl file. No end-to-end or business logic tests. Minimal coverage.

Overall — 70 / 100

Raw 52.5 / 75 → round(52.5 / 75 × 100) = 70

Track: Utility (authentication/integration module, not an agent or IDE)

Corrected calculation: 20 + 18 + 7.5 + 7 = 52.5 / 75 → round(52.5 / 75 × 100) = 70 / 100

---

Scored against SCORECARD.md on 2026-08-03 with claude-sonnet-4-5.