worker Stanza

The worker stanza configures Boundary worker-specific parameters.

  1. worker {
  2.   name = "example-worker"
  3.   description = "An example worker"
  4.   public_addr = "5.1.23.198"
  5. }

  • name - Specifies a unique name of this worker within the Boundary worker cluster.

  • description - Specifies a friendly description of this worker.

  • public_addr - Specifies the public host or IP address (and optionally port) at which the worker can be reached by clients for proxying. This defaults to the address of the listener marked for proxy purpose. This is especially useful for cloud environments that do not bind a publicly accessible IP to a NIC on the host directly, such as an Amazon EIP.

  • controllers - A list of hosts/IP addresses and optionally ports for reaching controllers. The port will default to :9201 if not specified.

  • KMS block designated for worker-auth - This is the KMS configuration for authentication between the workers and controllers and must be present. Example (not safe for production!):

  1.     purpose = "worker-auth"
  2.     aead_type = "aes-gcm"
  3.     key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
  4.     key_id = "global_worker-auth"
  5. }

Complete Configuration Example

  1. listener "tcp" {
  2.     purpose = "proxy"
  3.     tls_disable = true
  4. }
  6. worker {
  7.   # Name attr must be unique across workers
  8.   name = "demo-worker-1"
  9.   description = "A default worker created demonstration"
  11.   # Workers must be able to reach controllers on :9202
  12.   controllers = [
  13.     "10.0.0.1",
  14.     "10.0.0.2",
  15.     "10.0.0.3",
  16.   ]
  18.   public_addr = "myhost.mycompany.com"
  19. }
  21. # must be same key as used on controller config
  22. kms "aead" {
  23.     purpose = "worker-auth"
  24.     aead_type = "aes-gcm"
  25.     key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
  26.     key_id = "global_worker-auth"
  27. }