controller Stanza
The controller
stanza configures Boundary controller-specific parameters.
name
- Specifies a unique name of this controller within the Boundary cluster. This value can be a direct name string, can refer to a file on disk (file://) from which an name will be read; or an env var (env://) from which the name will be read.description
- Specifies a friendly description of this controller.database
- Configuration block with two valid parameters for connecting to Postgres:url
- Configures the URL for connecting to Postgresmigration_url
- Can be used to specify a different URL for migrations, as that usually requires higher privileges.max_open_connections
- Can be used to control the maximum number of connections that can be opened by the controller. The minimum number of connections required is 2. Every controller requires 1 non-pooled shared lock connection (which is held for the lifetime of the controller) and a minimum of 1 pooled connection which is used for all other database requests. Setting this value to 0 will allow the controller to open as many connections as needed.
Either can refer to a file on disk (file://) from which a URL will be read; an env var (env://) from which the URL will be read; or a direct database URL (postgres://).
public_cluster_addr
- Specifies the public host or IP address (and optionally port) at which the controller can be reached by workers. This will be used by workers after initial connection to controllers via the worker'scontrollers
block. This defaults to the address of the listener marked forcluster
purpose. This is especially useful for cloud environments that do not bind a publicly accessible IP to a NIC on the host directly, such as an Amazon EIP. This value can be a direct address string, can refer to a file on disk (file://) from which an address will be read; or an env var (env://) from which the address will be read.auth_token_time_to_live
- Maximum time to live (TTL) for all auth tokens globally (pertains to all tokens from all auth methods). Valid time units are anything specified by Golang's ParseDuration() method. Default is 7 days.auth_token_time_to_stale
- Maximum time of inactivity for all auth tokens globally (pertains to all tokens from all auth methods). Valid time units are anything specified by Golang's ParseDuration() method. Default is 1 day.
KMS Configuration
The controller requires two KMS stanzas for root
and worker-auth
purposes:
And optionally, a KMS stanza for recovery purpose:
And optionally, a KMS stanza for configuration encryption purpose:
Boundary supports many kinds of KMS integrations. For a complete guide to all available KMS types, see our KMS documentation.
Complete Configuration Example