Vault CLI module

[bpmct]

A discussion dedicated to the Vault CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	7 / 20	10 / 10	64 / 100

Normalized: round(48 / 75 × 100) = 64 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: basic CLI-only installation, with token authentication, custom version, custom install directory, with namespace (Enterprise), and Enterprise binary. Each has sensible defaults.
Coder-context framing	8	1	README mentions "Coder agent" in variable descriptions but does not explain what the module adds on top of Coder or show where Coder fits in the Vault workflow. No framing of how this integrates Vault with Coder workspaces.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference in frontmatter.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token variable is marked sensitive = true in main.tf. README examples use var.vault_token rather than inline secrets.
Non-hardcoded auth path	4	2	README shows token-based authentication via variable. No documentation of alternative paths like Vault's native auth methods (GitHub, JWT, OIDC) that would avoid pasting tokens. Related modules are mentioned but not integrated. Partial credit for variable-based approach.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the download URL. The script hardcodes HashiCorp API endpoints and releases.hashicorp.com URLs. Version selection does not constitute URL override.
Bring-your-own binary	5	0	No documented way to skip installation when vault is already in the image. Script always attempts installation/version check.
Egress transparency	3	1.5	Endpoints are visible in run.sh (api.releases.hashicorp.com, releases.hashicorp.com) but no dedicated README section enumerates them or discusses restricted environments. Scattered across code only earns at most half per rubric.
Runs without sudo	2	2	Script attempts non-sudo installation first, falls back to sudo only when INSTALL_DIR is not writable, and has a working fallback to ~/.local/bin when sudo fails. Core functionality works without sudo.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (latest version, /usr/local/bin). Validation present for vault_cli_version (semantic version or "latest").
Test coverage	4	4	Comprehensive .tftest.hcl with 10 test runs covering: without token, with token, custom version, custom install dir, invalid version, valid semver, v-prefix rejection, namespace, token+namespace, enterprise. Tests verify environment variables, outputs, and validation logic.

Overall — 64 / 100

Raw 48 / 75 → round(48 / 75 × 100) = 64

Normalized: round(48 / 75 × 100) = 64 / 100

Track: Utility (installs CLI tool, not an agent or IDE)

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.