Self-Managed Controller and Worker
Split Boundary Community Edition 0.21.3 across two VMs: write controller and worker HCL, initialize PostgreSQL-16, register a worker, and complete a TCP session with the connect ssh helper.
Lab Overview
This is the hands-on lab for Section 6 of the Boundary 101 course. You start with two Ubuntu VMs that have the pinned Boundary binary installed but not configured, and you bring up a real Community Edition cluster yourself. This is a control-plane / data-plane split, not high availability, and it is not boundary dev.
You will:
- Author controller HCL with api (9200), cluster (9201), and ops (9203)
listeners, a PostgreSQL-16 URL, disable_mlock = true, and AEAD KMS purposes root, worker-auth, recovery, and config
- Run boundary database init, start the controller under systemd, and prove
the ops listener is healthy on /health at port 9203
- Author worker HCL with a proxy listener on 9202, start the worker, and
complete worker-led registration against the controller
- Authenticate with -keyring-type=none, create a TCP target to the worker VM
on port 22, connect with the boundary connect ssh helper, then list and cancel the session
Recovery KMS is break-glass superuser (u_recovery). AEAD key bytes live in HCL and are readable to anyone who can read the file. Do not treat that as a production pattern.
What You'll Learn
Author a controller HCL file with api, cluster, and ops listeners and AEAD KMS purposes root, worker-auth, recovery, and config
Initialize Boundary's PostgreSQL-16 database and start the controller under systemd
Verify controller health on the ops listener at port 9203
Author a worker HCL file and register the worker with the worker-led flow
Authenticate the CLI with -keyring-type=none and complete a TCP session through the worker using boundary connect ssh
Prerequisites
Completion of the Boundary 101 Section 6 (Architecture and Self-Managed Deploy) lessons
Basic Linux command line and systemd service management
Familiarity with the Boundary CLI from Labs 1 and 2
Technologies Covered
Choose your plan
Simple, Transparent Pricing
Unlock full access to TeKanAid courses, labs, and bootcamps
Just exploring? Start free below. Want the full experience? Try Premium free for 7 days (card required, $0 today).
Pro
All courses, with lab scripts to run on your own machine
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Full access to all courses
- Lab scripts to download and run on your own machine (hosted labs not included)
- Progress tracking
- Certificate of completion
- Community access
- Self-paced bootcamps
- Premium puzzle library not included (5 free puzzles available)
- New content access
Premium
Full access, including unlimited hosted labs
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Everything in Pro
- Unlimited hands-on labs, fully hosted on TeKanAid Academy (nothing to set up)
- Full access to the puzzle library
- Lab AI Assistant
- Priority support
Prefer a single course?
Purchase individual courses for a one-time fee of $79. Full access to course content, quizzes, certificates, and community features, lab access is not included.
Browse CoursesJust exploring? Start free, no account needed
Three free ways to start. All bridge into the paid Premium catalog when you're ready.
Not ready to commit? The crash course is email-only. No academy account required.
Ready to Get Started?
Start this hands-on lab and build real-world Platform Engineering skills
Get Access Now