Worker values

• Boundary runtime configuration
• Kubernetes infrastructure configuration
• Image values
• Worker runtime values
• Probe values
• Proxy Service values
• Operations Service values
• Resource values
• Auth storage values
• Recording storage values
• Secret reference values
• Extra environment variables
• Security context values
• ServiceAccount values
• Scheduling values
• Configuration alignment checklist

The Boundary worker Helm chart is configured with Helm values and a user-provided Boundary HCL configuration. The chart is the source of truth for supported values.

Boundary runtime configuration

The worker.config contains the Boundary worker HCL. The chart writes this value into a ConfigMap and mounts it at /etc/boundary/boundary-worker.hcl.

The chart renders worker.config with Helm's tpl function. Helm template expressions inside the HCL are evaluated during rendering.

At container startup, the chart replaces ${POD_NAME_LOWER} with the pod name converted to lowercase and starts Boundary with the processed configuration file.

The chart does not validate Boundary HCL semantics. You are responsible for configuring valid listeners, registration settings, upstreams, storage paths, and worker tags.

Kubernetes infrastructure configuration

Kubernetes-specific values control the Deployment, Services, PVCs, security contexts, and scheduling options. These values do not replace or generate the Boundary runtime HCL.

For example, if you change worker.service.proxy.targetPort to 9222, you must also update the proxy listener port in worker.config.

Refer to the configuration alignment checklist before you finalize any changes.

The following sections describe all available Helm values, grouped by function. Each table lists the key, default value, and a description.

Image values

Worker runtime values

The default worker.config includes disable_mlock = true. The chart's default security model drops all Linux capabilities and disallows privilege escalation. We do not recommend changing this value. Memory locking requires elevated privileges that the chart does not grant. If you enable swap on your nodes, address any resulting data-at-rest exposure through platform controls.

Probe values

The chart adds liveness and readiness probes against the /health endpoint on the ops listener.

Proxy Service values

The proxy Service exposes the worker's session traffic listener.

Operations Service values

The operations Service exposes the worker operations listener for health and metrics.

Keep the operations Service internal unless a trusted monitoring path requires a different exposure model.

Resource values

Tune resource values for your expected connection volume, recording usage, and cluster sizing.

Auth storage values

Auth storage stores worker identity and authentication material for registration models that require local persistence.

Disable auth storage only when your worker authentication model does not require persistent local auth material, such as KMS-backed worker authentication.

Recording storage values

Recording storage stores session recordings when recording is configured in Boundary.

If you disable recording storage, remove recording_storage_path from the HCL or ensure recording data does not need to persist.

Secret reference values

The chart injects values from an existing Kubernetes Secret as environment variables into the worker container. Use this to supply sensitive values such as a controller-generated activation token without embedding them in worker.config.

To use a Secret for controller-led registration, set controller_generated_activation_token = "env://BOUNDARY_WORKER_CONTROLLER_GENERATED_ACTIVATION_TOKEN" in worker.config and point secretRefs.secretName at the Secret that contains the token key.

Extra environment variables

Use extraEnv to inject additional environment variables into the worker container. This supports any valid Kubernetes env entry, including plain name/value pairs and valueFrom references.

Example using a plain value:

extraEnv:
  - name: BOUNDARY_WORKER_CONTROLLER_GENERATED_ACTIVATION_TOKEN
    value: "act_1234abcd..."

Example using a Secret reference:

extraEnv:
  - name: BOUNDARY_WORKER_CONTROLLER_GENERATED_ACTIVATION_TOKEN
    valueFrom:
      secretKeyRef:
        name: boundary-worker-secrets
        key: worker-controller-generated-activation-token

Use extraEnv as an alternative to secretRefs when you need finer control over how Secret keys are mapped to environment variable names, or when injecting variables unrelated to activation tokens.

Security context values

The default security settings run the worker without elevated privileges.

The Deployment also sets SKIP_SETCAP=1, which prevents the container startup path from attempting Linux capability modification.

ServiceAccount values

Scheduling values

Configuration alignment checklist

Before installing or upgrading, confirm that:

• The proxy listener port in worker.config matches worker.service.proxy.targetPort.
• The ops listener port in worker.config matches worker.service.ops.targetPort.
• The auth_storage_path matches worker.persistence.authStorage.path when auth storage is enabled.
• The recording_storage_path matches worker.persistence.recording.path when recording storage is enabled.
• The public_addr matches the endpoint other Boundary clients or workers can actually reach.
• Placeholder activation tokens, cluster IDs, and upstream addresses have been replaced.

More information

To view example worker configurations, refer to Worker Helm chart examples.