Vault CLI module

[bpmct]

A discussion dedicated to the Vault CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	18 / 20	5 / 20	10 / 10	67 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: basic CLI-only installation, with token authentication, custom version, custom install directory, with namespace (Enterprise), and Enterprise binary. Each has sensible defaults.
Coder-context framing	8	5	README names Vault and shows Terraform usage with coder_agent, but does not explain what the module adds on top of Coder or where Coder fits in the Vault authentication flow. The description mentions "integration" but lacks context about how Coder orchestrates the installation.
Visual preview	5	0	No image, GIF, or video present. Only an icon reference in frontmatter.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token variable is marked sensitive = true in main.tf. README examples use var.vault_token rather than inline secrets.
Non-hardcoded auth path	4	2	README shows token-based authentication via variable, which still requires pasting a token into the template or workspace variables. Related modules section points to vault-github and vault-jwt for better auth methods, but this module itself only documents token auth. Partial credit for acknowledging better paths exist.

Restricted-Environment Readiness — 5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable to override the download URL. The script hardcodes https://api.releases.hashicorp.com and https://releases.hashicorp.com. Version selection does not constitute URL override.
Bring-your-own binary	5	0	No documented way to skip installation when vault is already in the image. The script always attempts to check/install.
Egress transparency	3	1.5	No dedicated README section for network requirements or air-gapped environments. Endpoints are inferable from code (api.releases.hashicorp.com, releases.hashicorp.com) but not enumerated in documentation. Half credit for scattered implicit information.
Runs without sudo	2	2	Script attempts installation without sudo first, falling back to sudo only when the install directory is not writable, and further falling back to ~/.local/bin if sudo fails. Core functionality works without sudo. Full credit.
Runs without sudo	2	1	Script uses sudo as fallback for installation to system directories when not writable. If sudo is unavailable and install_dir is not writable, it falls back to ~/.local/bin. This is a working fallback, earning half credit.

Correction after re-reading run.sh:

Criterion	Max	Score	Notes
Runs without sudo	2	1	Script attempts non-sudo installation first. If INSTALL_DIR is not writable, tries sudo mv, and if that fails, falls back to ~/.local/bin. Core install functionality works without sudo via the fallback path. Half credit for sudo being optional with working fallback.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (latest version, /usr/local/bin install dir, optional token/namespace). vault_cli_version has validation for semantic versioning or "latest".
Test coverage	4	4	Comprehensive .tftest.hcl with 11 test runs covering: no token, with token, custom version, custom install dir, invalid version, valid semver, v-prefix rejection, namespace, token+namespace, and enterprise mode. Tests cover business logic thoroughly.

Overall — 67 / 100

Raw 50 / 75 → round(50 / 75 × 100) = 67

(Utility track: denominator is 75 for Universal criteria only, then normalized to 100)

---

Scored against SCORECARD.md on 2026-08-03 with claude-sonnet-4-5.