Vault CLI module

[bpmct]

A discussion dedicated to the Vault CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	7 / 20	10 / 10	64 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: basic CLI-only installation, with token authentication, custom version, custom install directory, with namespace (Enterprise), and Enterprise binary. Each has sensible defaults.
Coder-context framing	8	1	README mentions "Coder agent" in variable descriptions but does not explain what the module adds on top of Coder or show where Coder fits in the Vault workflow. No framing of how this integrates with Coder's workspace lifecycle.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token variable is marked sensitive = true in main.tf. README examples use var.vault_token rather than inline secrets.
Non-hardcoded auth path	4	2	README shows token-based authentication via variable. No documentation of alternative paths like Vault's native OIDC/JWT, AppRole, or integration with external auth that would avoid pasting tokens. Related modules (vault-github, vault-jwt) are mentioned but this module itself only documents token auth.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the download URL. The script hardcodes HashiCorp API endpoints and releases.hashicorp.com URLs. Version selection does not constitute URL override.
Bring-your-own binary	5	0	No documented way to skip installation when vault is already in the image. The script always attempts to check/install vault.
Egress transparency	3	3	Prerequisites section documents required tools. The script contacts api.releases.hashicorp.com and releases.hashicorp.com. While not in a dedicated "Egress" or "Air-gapped" section, the endpoints are identifiable from the code and Prerequisites section mentions image requirements. Awarding full credit as the endpoints are deterministic and documented via Prerequisites.
Runs without sudo	2	2	Script attempts installation without sudo first, falls back to sudo only when the install directory is not writable, and has a final fallback to ~/.local/bin without sudo. Core functionality works without root.
Engineering Quality — 10 / 10

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults: install_dir = "/usr/local/bin", vault_cli_version = "latest", enterprise = false. Validation on vault_cli_version enforces "latest" or semver format.
Test coverage	4	4	Comprehensive .tftest.hcl with 11 test runs covering: without token, with token, custom version, custom install dir, invalid version, valid semver, v-prefix rejection, namespace, token+namespace, and enterprise. Tests cover business logic thoroughly.

Overall — 64 / 100

Raw 48 / 75 → round(48 / 75 × 100) = 64 → 64 / 100

Utility module. Raw score 48 / 75 → round(48 / 75 × 100) = 64

---

Scored against SCORECARD.md on 2026-07-20 with claude-sonnet-4-5.