Register self-managed workers

Complete the following steps to register the worker with HCP using the UI:

1. Log in to the HCP portal as the admin user.

2. From the HCP Portal's Boundary page, click Open Admin UI.

3. Enter the admin username and password you created when you deployed the new instance and click Authenticate.

4. Select Workers in the navigation pane.

5. Click New.

6. (Optional) You can construct the contents of the worker.hcl file on the new workers page, if you did not create the configuration file as part of the installation process. Provide the following details, and Boundary constructs the worker configuration file for you:

   • Boundary Cluster ID
   • Worker public address
   • Config file path
   • Worker Tags

7. Scroll to the bottom of the new workers page, and paste the Worker Auth Registration Request key. Boundary provides you with the Worker Auth Registration Request key in the CLI output when you start the self-managed worker. You can also locate this value in the auth_request_token file.

8. Click Register Worker.

9. Click Done.

   The new self-managed worker appears on the Workers page.

Complete the following steps to register the worker with HCP using the UI:

1. Use the following command to ensure that the BOUNDARY_ADDR is set as an environment variable:

   $ export BOUNDARY_ADDR="https://c3a7a20a-f663-40f3-a8e3-1b2f69b36254.boundary.hashicorp.cloud"
   

2. Log into the CLI as the admin user, providing the Auth Method ID, admin login name, and admin password when prompted.

   $ boundary authenticate password \
     -auth-method-id=ampw_KfLAjMS2CG \
     -login-name=admin
   

   Example:

   $ boundary authenticate password \
     -auth-method-id=ampw_KfLAjMS2CG \
     -login-name=admin
   Please enter the password (it will be hidden):
   
   Authentication information:
     Account ID:      acctpw_r6crEm0FgM
     Auth Method ID:  ampw_KfLAjMS2CG
     Expiration Time: Mon, 27 Jun 2024 22:03:28 MDT
     User ID:         u_ysJd0LXX9T
   
   The token was successfully stored in the chosen keyring and is not displayed here.
   

3. Next, use the following command to export the Worker Auth Request Token value as an environment variable:

   $ export WORKER_TOKEN=<Worker Auth Registration Request Value>
   

   Boundary provides you with the Worker Auth Registration Request key in the CLI output when you start the self-managed worker. You can also locate this value in the auth_request_token file.

   The token is used to issue a create worker request that will authorize the worker to Boundary and make it available. Currently worker creation is only supported for self-managed workers with an authorization token.

Create a new self-managed worker

Use the following command to create a new self-managed worker. You can manage workers using the standard boundary CRUD commands: create, read, list, update, and delete. Currently, you can only set addresses and tags in the worker configuration file. Values that can be updated in the API are indicated as "Canonical".

$ boundary workers create worker-led -worker-generated-auth-token=$WORKER_TOKEN

Worker information:
  Active Connection Count:   0
  Created Time:              Mon, 19 Sep 2023 16:39:44 MDT
  ID:                        w_r61cCrlm4M
  Type:                      pki
  Updated Time:              Mon, 19 Sep 2023 16:39:44 MDT
  Version:                   1

  Scope:
    ID:                      global
    Name:                    global
    Type:                    global

  Authorized Actions:
    no-op
    read
    update
    delete
    add-worker-tags
    set-worker-tags
    remove-worker-tags

The following fields are available on the Boundary worker resource:

• Name: The user-defined name for this worker.
• Description: The user-defined description for this worker.
• Id: The read-only ID for this worker.
• Created time: A timestamp indicating when the worker was created.
• Last status time: A timestamp indicating when the worker last sent data to a controller.
• Updated time: A timestamp indicating when this worker resource was last updated.
• Version: A read-only field indicating the version number for this resource.
• Active connection count: A read only field indicating the number of active session connections this worker is currently proxying.
• Scope: The scope for this resource.
• Scope_ID: The ID of the scope for this resource.
• Release version: The release version of the worker.
• Authorized actions: The possible actions authorized for the current user.
• Address: The address Boundary uses when handling an authorize session request. This value is never empty and is set within the worker config file from the following values in decreasing priority:
  • The value set in the public_address field in the worker stanza, if present.
  • The value set in the address field of the listener stanza with the "proxy" purpose, if present.
• Tags: The tags set in the worker configuration file.
• Type: The type of worker. A read-only field.