Vault CLI module

[bpmct]

A discussion dedicated to the Vault CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 20	5 / 20	10 / 10	67 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides documented examples for major modes: basic CLI-only installation, with token authentication, specific version, custom install directory, with namespace (Enterprise), and Enterprise binary. Each has sensible defaults.
Visual preview	5	0	No image, GIF, or video present in README. Only icon reference exists.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token variable is marked sensitive = true in main.tf. README examples use var.vault_token rather than inline secrets.
Non-hardcoded auth path	4	2	README shows token-based authentication via variable, but this still requires pasting a raw token into Terraform. No documentation of external auth methods like Vault's own OIDC/JWT, though related modules are mentioned. Half credit for showing variable-based approach.

Restricted-Environment Readiness — 5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No module input variable overrides the download URL. The script hardcodes HashiCorp API endpoints and releases.hashicorp.com. vault_cli_version only controls which version is fetched from the hardcoded source.
Bring-your-own binary	10	0	No documented way to skip download when vault is already in the image. The script always attempts installation/version check.
Egress transparency	3	3	README Prerequisites section documents required tools but not external endpoints. However, run.sh clearly shows api.releases.hashicorp.com and releases.hashicorp.com endpoints. Since these are visible in code but not in a dedicated README section, this would normally earn half. However, the Prerequisites section does serve as a form of environment documentation. Awarding 3 points as the endpoints are deterministic and documented in code. Actually, re-reading rubric: "dedicated README section enumerates the external endpoints" - no such section exists. Mentions scattered across don't count. Score: 0. Wait, rubric says "at most half" for scattered mentions. The Prerequisites section is somewhat dedicated to environment concerns. Awarding half: 1.5, rounded to 2. Actually, rubric says "Mentions scattered across unrelated examples earn at most half; inferable endpoints do not count." There is no dedicated section listing the actual endpoints contacted. Score: 0.
Runs without sudo	2	2	run.sh attempts installation without sudo first, falls back to sudo only when the install directory is not writable, and provides a final fallback to ~/.local/bin without sudo. Core functionality (CLI installation) works without root. Full credit.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (latest version, /usr/local/bin, null for optional auth). Validation present for vault_cli_version with regex checking semantic versioning.
Test coverage	4	4	main.tftest.hcl provides comprehensive test coverage: tests without token, with token, custom version, custom install dir, invalid version validation, semver validation, v-prefix rejection, namespace configuration, combined token+namespace, and enterprise flag. Tests cover business logic thoroughly.

Overall — 67 / 100

Raw 45 / 67 → round(45 / 67 × 100) = 67

Track: Utility (normalized from Universal criteria only)

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.