Worker Tags and Egress Filters

This is the hands-on lab for Section 11 of the Boundary 101 course. Setup already brought up a controller plus PostgreSQL-16 on one VM and two worker-led workers on the others: worker-east tagged region=["east"] and worker-west tagged region=["west"]. A TCP target already points at the worker-west routable IP on port 22. You do not write HCL, init the database, or register the workers.

You will:

• List and read both workers, confirm tag values are arrays, and save

the east and west worker IDs

• Set an egress_worker_filter that matches no worker (for example

"south" in "/tags/region"), then prove authorize-session fails with the no-workers placement error (CE 0.21.3: 500 Internal)

• Update the same target to "west" in "/tags/region" and connect with

the boundary connect ssh helper through the west-tagged worker

• Read the target and confirm ingress_worker_filter is unset (that

attribute is HCP and Enterprise, not Community Edition)

Targets stay TCP (ttcp_*). boundary connect ssh is a helper, not an SSH target type. The target address must stay the worker-west IP from /opt/tekanaid/vm_ips.txt, never 127.0.0.1. Do not set ingress_worker_filter. Do not set a Vault worker_filter.