The name. The name. The name!

2020-08-10 17:15:02 -04:00
1 parent 1c836c430b
commit 6661117d4c
@@ -5,7 +5,7 @@ jobs:
  build:
    machine:
      image: 'ubuntu-1604:201903-01'
-    working_directory: ~/watchtower
+    working_directory: ~/boundary
    steps:
    - add_ssh_keys:
        fingerprints:
@@ -4,7 +4,7 @@ THIS_FILE := $(lastword $(MAKEFILE_LIST))
 THIS_DIR := $(dir $(realpath $(firstword $(MAKEFILE_LIST))))

 TMP_DIR := $(shell mktemp -d)
-REPO_PATH := github.com/hashicorp/watchtower
+REPO_PATH := github.com/hashicorp/boundary

 GENERATED_CODE := $(shell  find ${THIS_DIR} -name '*.gen.go' && find ${THIS_DIR} -name '*.pb.go' && find ${THIS_DIR} -name '*.pb.gw.go')

@@ -24,8 +24,8 @@ cleangen:
 dev: BUILD_TAGS+=dev
 dev: BUILD_TAGS+=ui
 dev: build-ui-ifne
-	@echo "==> Building Watchtower with dev and UI features enabled"
-	@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' WATCHTOWER_DEV_BUILD=1 sh -c "'$(CURDIR)/scripts/build.sh'"
+	@echo "==> Building Boundary with dev and UI features enabled"
+	@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' BOUNDARY_DEV_BUILD=1 sh -c "'$(CURDIR)/scripts/build.sh'"

 build-ui:
 	@scripts/uigen.sh
@@ -1,49 +1,49 @@
-# Watchtower
+# Boundary

 ----

-**Please note**: We take Watchtower's security and our users' trust very
-seriously. If you believe you have found a security issue in Watchtower,
+**Please note**: We take Boundary's security and our users' trust very
+seriously. If you believe you have found a security issue in Boundary,
 _please responsibly disclose_ by contacting us at
 [security@hashicorp.com](mailto:security@hashicorp.com).

 ----

-Watchtower is a tool for controlling access to networked resources in the
+Boundary is a tool for controlling access to networked resources in the
 [SDP](https://en.wikipedia.org/wiki/Software_Defined_Perimeter) model. It is
 designed to be straightforward to understand, highly scalable, and resilient.
 It can run in clouds, on-prem, secure enclaves and more, and does not require
 an agent to be installed on every end host.

-Unlike firewalls, Watchtower performs per-access authentication and
+Unlike firewalls, Boundary performs per-access authentication and
 authorization checks, allowing for much higher level mappings of users to
 services or hosts than at network layers. Although complementary to secrets
 managers (like HashiCorp's own [Vault](https://www.vaultproject.io/)),
-Watchtower fills a different niche, allowing the credential that is eventually
+Boundary fills a different niche, allowing the credential that is eventually
 used to be hidden entirely from the user.

 Getting Started
 -------------------------------

-Watchtower consists of two server components: Controllers, which serve the API
+Boundary consists of two server components: Controllers, which serve the API
 and coordinate session requests; and Workers, which perform the actual session
-handling. A normal Watchtower installation will consist of one or more
-Controllers paired with one or more Workers. A single Watchtower binary can act
+handling. A normal Boundary installation will consist of one or more
+Controllers paired with one or more Workers. A single Boundary binary can act
 in either of these two modes.

-Additionally, Watchtower desktop clients are provided that simplify providing
+Additionally, Boundary desktop clients are provided that simplify providing
 access to request and connect to authorized sessions from desktop machines.

-Watchtower does _not_ require software to be installed on the endpoint hosts
+Boundary does _not_ require software to be installed on the endpoint hosts
 and services.

 ## Requirements

-Watchtower has two external dependencies: a SQL database, and one or more
+Boundary has two external dependencies: a SQL database, and one or more
 KMSes.  Both are readily available from cloud vendors, but can be satisfied by
 on-premise technologies as well.

-* The database contains Watchtower's configuration and session information and
+* The database contains Boundary's configuration and session information and
  must be accessible by Controller nodes. Values that are secrets (such as
  credentials) are encrypted in the database. Currently, PostgreSQL is
  supported as a database. This need can be satisfied by both hosted and
@@ -60,7 +60,7 @@ on-premise technologies as well.
  decryption needs), and key derivation is used extensively to avoid key sprawl
  of these high-value keys.

-Watchtower has a `dev` mode that can be used for testing. In this mode both a
+Boundary has a `dev` mode that can be used for testing. In this mode both a
 Controller and Worker are started with a single command, and they have the
 following properties:

@@ -69,30 +69,30 @@ following properties:
  Controller is (gracefully) shut down.
 * The Controller will use an internal KMS with an ephemeral key

-## Trying out Watchtower
-Running Watchtower in a more permanent context requires a few more steps, such
+## Trying out Boundary
+Running Boundary in a more permanent context requires a few more steps, such
 as writing some simple configuration files to tell the nodes how to reach their
 database and KMS. The steps below, along with the extra information for needed
 for permanent installations, are detailed in our [Installation Guide].

-### Build and Start Watchtower in Dev Mode
+### Build and Start Boundary in Dev Mode

 If you have the following requirements met locally:
 - Golang v1.14 or greater
 - Docker

-You can get up and running with Watchtower quickly. Simply run:
+You can get up and running with Boundary quickly. Simply run:

  ```make dev```

-This will build Watchtower. Once complete, run Watchtower in `dev` mode:
+This will build Boundary. Once complete, run Boundary in `dev` mode:

-  ```./$GOPATH/bin/watchtower dev```
+  ```./$GOPATH/bin/boundary dev```

 #### Specify a UI Commitish at Build Time

 The default UI build branch is `develop` from [the UI
-repo](https://github.com/hashicorp/watchtower-ui). A different commitish from
+repo](https://github.com/hashicorp/boundary-ui). A different commitish from
 which to build UI assets may be specified via the UI_COMMITISH environment
 variable. For example:

@@ -103,11 +103,11 @@ variable. For example:
 Download the latest release of the server binary and appropriate desktop
 client(s) from our [releases page]

-### Start Watchtower
+### Start Boundary

 Start the server binary with:

-  ```watchtower dev```
+  ```boundary dev```

 This will start a Controller service listening on `http://127.0.0.1:9200` for
 incoming API requests and a Worker service listening on the same address/port for
@@ -117,11 +117,11 @@ be used to log in.

 ### Configuring Resources

-For a simple test of Watchtower in `dev` mode you don't generally need to
+For a simple test of Boundary in `dev` mode you don't generally need to
 configure any resources at all! But it's useful to understand what `dev` mode
 did for you so you can then take further steps:

-In Watchtower, a Set is a grouping of resources that share a similarity
+In Boundary, a Set is a grouping of resources that share a similarity
 suitable for using in configuration; for instance, a User Set combines groups
 of users that should have equivalent permissions. Most Sets are automatically
 created and managed by Catalogs; for instance, an AWS Catalog can create Host
@@ -138,36 +138,36 @@ you suitable for local testing:
 * A Permissions Set mapping the given User Set to a set of permissions, in this
  case granting access to make connections to resources
 * A Credentials Catalog with a default Credential Set that is empty (meaning
-  Watchtower will require and use the user's credentials when connecting to the
+  Boundary will require and use the user's credentials when connecting to the
  networked resource; in other words, in this situation it will run in a
  TCP-only mode)

 To actually make the connection to the networked resource, a Target must be
 defined. Targets group a Host Set, a Credential Set, and a User Set, which,
 along with validation against the permissions defined by relevant Permissions
-Sets, together allow Watchtower to understand what user principals are allowed
-to connect where and using what authentication information. A `dev` Watchtower
+Sets, together allow Boundary to understand what user principals are allowed
+to connect where and using what authentication information. A `dev` Boundary
 will create a default Target that allows the generated user to make SSH
 connections to the local machine on port 22.

-You can of course go into Watchtower's web UI or use its API to change these
+You can of course go into Boundary's web UI or use its API to change these
 default values, for instance if you instead want to connect to a different host
 or need to modify the port to connect to, or want to test out the capabilities
-of Watchtower to supply the credentials for the session without user
+of Boundary to supply the credentials for the session without user
 input/knowledge.

 ### Making the Connection

-Next, let's actually make a connection to your local SSH daemon via Watchtower:
+Next, let's actually make a connection to your local SSH daemon via Boundary:

-3. Start the desktop client and point it at the local Watchtower `dev` session.
+3. Start the desktop client and point it at the local Boundary `dev` session.
   Log in with the generated username and password.
 4. You can now select the Target that grants access to the local machine and
-   hit "Request Session". Doing so will cause Watchtower to check whether this
+   hit "Request Session". Doing so will cause Boundary to check whether this
   action is allowed, and if so, send session information back to the client,
   allowing it to start a local authenticated proxy to the Worker. You will be
   shown a CLI command that can be copied and pasted into the CLI to connect to
-   the local machine via Watchtower.
+   the local machine via Boundary.
 5. Paste the CLI command into your terminal, or use the given address and port
   in the SSH client of your choice, and connect!
 6. When the session has ended, look in the given temporary directory to see
@@ -180,9 +180,9 @@ This example is a simple way to get started but omits several key steps that
 could be taken in a production context:

 * Using a firewall or other means to restrict the set of hosts allowed to
-  connect to a local SSH daemon to only Watchtower Worker nodes, thereby making
-  Watchtower the _only_ means of ingress to a host
-* Using credentials specified within Watchtower rather than the client's own
+  connect to a local SSH daemon to only Boundary Worker nodes, thereby making
+  Boundary the _only_ means of ingress to a host
+* Using credentials specified within Boundary rather than the client's own
  credentials. Because these credentials are not divulged to users, even if a
  user gets around some network-level firewall or other restriction to gain
  direct network access to a host, they will be unable to authenticate.
@@ -190,7 +190,7 @@ could be taken in a production context:

 `dev` mode by default is operating in a direct proxying mode, where it is
 simply passing the network streams along once the session has been authorized.
-However, Watchtower is built to be flexible and eventually able to understand a
+However, Boundary is built to be flexible and eventually able to understand a
 variety of networked protocols, with more capabilities to come in the future.
 We have a long roadmap planned out so stay tuned for information about new
 features and capabilities!
@@ -7,8 +7,8 @@ import (
 	"net/url"
 	"time"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/scopes"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
 )

 type Account struct {
@@ -4,11 +4,11 @@ import (
 	"context"
 	"fmt"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/authtokens"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/authtokens"
 )

-// TODO: This will need to be changed when we add Auth Method API to watchtower.  We'll also need a better
+// TODO: This will need to be changed when we add Auth Method API to boundary.  We'll also need a better
 // way to handle different auth method types.
 func (c *authmethodsClient) Authenticate(ctx context.Context, authMethodId, name, password string, opt ...Option) (*authtokens.AuthToken, *api.Error, error) {
 	if c.client == nil {
@@ -4,8 +4,8 @@ import (
 	"net/http"
 	"testing"

-	"github.com/hashicorp/watchtower/api/authmethods"
-	"github.com/hashicorp/watchtower/internal/servers/controller"
+	"github.com/hashicorp/boundary/api/authmethods"
+	"github.com/hashicorp/boundary/internal/servers/controller"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -7,8 +7,8 @@ import (
 	"net/url"
 	"time"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/scopes"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
 )

 type AuthMethod struct {
@@ -1,7 +1,7 @@
 package authmethods

 import (
-	"github.com/hashicorp/watchtower/api"
+	"github.com/hashicorp/boundary/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -5,10 +5,10 @@ import (
 	"sort"
 	"testing"

-	"github.com/hashicorp/watchtower/api/authmethods"
-	"github.com/hashicorp/watchtower/api/authtokens"
-	"github.com/hashicorp/watchtower/internal/authtoken"
-	"github.com/hashicorp/watchtower/internal/servers/controller"
+	"github.com/hashicorp/boundary/api/authmethods"
+	"github.com/hashicorp/boundary/api/authtokens"
+	"github.com/hashicorp/boundary/internal/authtoken"
+	"github.com/hashicorp/boundary/internal/servers/controller"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -6,8 +6,8 @@ import (
 	"fmt"
 	"time"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/scopes"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
 )

 type AuthToken struct {
@@ -1,7 +1,7 @@
 package authtokens

 import (
-	"github.com/hashicorp/watchtower/api"
+	"github.com/hashicorp/boundary/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -19,42 +19,42 @@ import (
 	"time"
 	"unicode"

+	"github.com/hashicorp/boundary/api/internal/parseutil"
 	cleanhttp "github.com/hashicorp/go-cleanhttp"
 	retryablehttp "github.com/hashicorp/go-retryablehttp"
 	rootcerts "github.com/hashicorp/go-rootcerts"
-	"github.com/hashicorp/watchtower/api/internal/parseutil"
 	"golang.org/x/time/rate"
 )

-const EnvWatchtowerAddr = "WATCHTOWER_ADDR"
-const EnvWatchtowerCACert = "WATCHTOWER_CACERT"
-const EnvWatchtowerCAPath = "WATCHTOWER_CAPATH"
-const EnvWatchtowerClientCert = "WATCHTOWER_CLIENT_CERT"
-const EnvWatchtowerClientKey = "WATCHTOWER_CLIENT_KEY"
-const EnvWatchtowerClientTimeout = "WATCHTOWER_CLIENT_TIMEOUT"
-const EnvWatchtowerTLSInsecure = "WATCHTOWER_TLS_INSECURE"
-const EnvWatchtowerTLSServerName = "WATCHTOWER_TLS_SERVER_NAME"
-const EnvWatchtowerMaxRetries = "WATCHTOWER_MAX_RETRIES"
-const EnvWatchtowerToken = "WATCHTOWER_TOKEN"
-const EnvWatchtowerRateLimit = "WATCHTOWER_RATE_LIMIT"
-const EnvWatchtowerSRVLookup = "WATCHTOWER_SRV_LOOKUP"
-const EnvWatchtowerScopeId = "WATCHTOWER_SCOPE_ID"
+const EnvBoundaryAddr = "BOUNDARY_ADDR"
+const EnvBoundaryCACert = "BOUNDARY_CACERT"
+const EnvBoundaryCAPath = "BOUNDARY_CAPATH"
+const EnvBoundaryClientCert = "BOUNDARY_CLIENT_CERT"
+const EnvBoundaryClientKey = "BOUNDARY_CLIENT_KEY"
+const EnvBoundaryClientTimeout = "BOUNDARY_CLIENT_TIMEOUT"
+const EnvBoundaryTLSInsecure = "BOUNDARY_TLS_INSECURE"
+const EnvBoundaryTLSServerName = "BOUNDARY_TLS_SERVER_NAME"
+const EnvBoundaryMaxRetries = "BOUNDARY_MAX_RETRIES"
+const EnvBoundaryToken = "BOUNDARY_TOKEN"
+const EnvBoundaryRateLimit = "BOUNDARY_RATE_LIMIT"
+const EnvBoundarySRVLookup = "BOUNDARY_SRV_LOOKUP"
+const EnvBoundaryScopeId = "BOUNDARY_SCOPE_ID"

 // Config is used to configure the creation of the client
 type Config struct {
-	// Addr is the address of the Watchtower controller. This should be a
-	// complete URL such as "http://watchtower.example.com". If you need a custom
+	// Addr is the address of the Boundary controller. This should be a
+	// complete URL such as "http://boundary.example.com". If you need a custom
 	// SSL cert or want to enable insecure mode, you need to specify a custom
 	// HttpClient.
 	Addr string

 	// Token is the client token that reuslts from authentication and can be
-	// used to make calls into Watchtower
+	// used to make calls into Boundary
 	Token string

-	// HttpClient is the HTTP client to use. Watchtower sets sane defaults for
+	// HttpClient is the HTTP client to use. Boundary sets sane defaults for
 	// the http.Client and its associated http.Transport created in
-	// DefaultConfig. If you must modify Watchtower's defaults, it is
+	// DefaultConfig. If you must modify Boundary's defaults, it is
 	// suggested that you start with that client and modify as needed rather
 	// than start with an empty client (or http.DefaultClient).
 	HttpClient *http.Client
@@ -103,20 +103,20 @@ type Config struct {
 }

 // TLSConfig contains the parameters needed to configure TLS on the HTTP client
-// used to communicate with Watchtower.
+// used to communicate with Boundary.
 type TLSConfig struct {
 	// CACert is the path to a PEM-encoded CA cert file to use to verify the
-	// Watchtower server SSL certificate.
+	// Boundary server SSL certificate.
 	CACert string

 	// CAPath is the path to a directory of PEM-encoded CA cert files to verify
-	// the Watchtower server SSL certificate.
+	// the Boundary server SSL certificate.
 	CAPath string

-	// ClientCert is the path to the certificate for Watchtower communication
+	// ClientCert is the path to the certificate for Boundary communication
 	ClientCert string

-	// ClientKey is the path to the private key for Watchtower communication
+	// ClientKey is the path to the private key for Boundary communication
 	ClientKey string

 	// ServerName, if set, is used to set the SNI host when connecting via
@@ -131,7 +131,7 @@ type TLSConfig struct {
 // safe to modify the return value of this function.
 //
 // The default Addr is https://127.0.0.1:9200, but this can be overridden by
-// setting the `WATCHTOWER_ADDR` environment variable.
+// setting the `BOUNDARY_ADDR` environment variable.
 //
 // If an error is encountered, this will return nil.
 func DefaultConfig() (*Config, error) {
@@ -237,7 +237,7 @@ func (c *Config) setAddr(addr string) error {
 	// Remove trailing or leading slashes
 	path := strings.Trim(u.Path, "/")
 	// Remove v1 in front or back (e.g. they could have
-	// https://watchtower.example.com/myinstall/v1 which would put it at the
+	// https://boundary.example.com/myinstall/v1 which would put it at the
 	// back)
 	path = strings.Trim(path, "v1")
 	// Finally check again to make sure any slashes are removed before we join
@@ -262,19 +262,19 @@ func (c *Config) ReadEnvironment() error {
 	var envServerName string

 	// Parse the environment variables
-	if v := os.Getenv(EnvWatchtowerAddr); v != "" {
+	if v := os.Getenv(EnvBoundaryAddr); v != "" {
 		c.Addr = v
 	}

-	if v := os.Getenv(EnvWatchtowerToken); v != "" {
+	if v := os.Getenv(EnvBoundaryToken); v != "" {
 		c.Token = v
 	}

-	if v := os.Getenv(EnvWatchtowerScopeId); v != "" {
+	if v := os.Getenv(EnvBoundaryScopeId); v != "" {
 		c.ScopeId = v
 	}

-	if v := os.Getenv(EnvWatchtowerMaxRetries); v != "" {
+	if v := os.Getenv(EnvBoundaryMaxRetries); v != "" {
 		maxRetries, err := strconv.ParseUint(v, 10, 32)
 		if err != nil {
 			return err
@@ -282,24 +282,24 @@ func (c *Config) ReadEnvironment() error {
 		c.MaxRetries = int(maxRetries)
 	}

-	if v := os.Getenv(EnvWatchtowerSRVLookup); v != "" {
+	if v := os.Getenv(EnvBoundarySRVLookup); v != "" {
 		var err error
 		lookup, err := strconv.ParseBool(v)
 		if err != nil {
-			return fmt.Errorf("could not parse %s", EnvWatchtowerSRVLookup)
+			return fmt.Errorf("could not parse %s", EnvBoundarySRVLookup)
 		}
 		c.SRVLookup = lookup
 	}

-	if t := os.Getenv(EnvWatchtowerClientTimeout); t != "" {
+	if t := os.Getenv(EnvBoundaryClientTimeout); t != "" {
 		clientTimeout, err := parseutil.ParseDurationSecond(t)
 		if err != nil {
-			return fmt.Errorf("could not parse %q", EnvWatchtowerClientTimeout)
+			return fmt.Errorf("could not parse %q", EnvBoundaryClientTimeout)
 		}
 		c.Timeout = clientTimeout
 	}

-	if v := os.Getenv(EnvWatchtowerRateLimit); v != "" {
+	if v := os.Getenv(EnvBoundaryRateLimit); v != "" {
 		rateLimit, burstLimit, err := parseRateLimit(v)
 		if err != nil {
 			return err
@@ -310,31 +310,31 @@ func (c *Config) ReadEnvironment() error {
 	// TLS Config
 	{
 		var foundTLSConfig bool
-		if v := os.Getenv(EnvWatchtowerCACert); v != "" {
+		if v := os.Getenv(EnvBoundaryCACert); v != "" {
 			foundTLSConfig = true
 			envCACert = v
 		}
-		if v := os.Getenv(EnvWatchtowerCAPath); v != "" {
+		if v := os.Getenv(EnvBoundaryCAPath); v != "" {
 			foundTLSConfig = true
 			envCAPath = v
 		}
-		if v := os.Getenv(EnvWatchtowerClientCert); v != "" {
+		if v := os.Getenv(EnvBoundaryClientCert); v != "" {
 			foundTLSConfig = true
 			envClientCert = v
 		}
-		if v := os.Getenv(EnvWatchtowerClientKey); v != "" {
+		if v := os.Getenv(EnvBoundaryClientKey); v != "" {
 			foundTLSConfig = true
 			envClientKey = v
 		}
-		if v := os.Getenv(EnvWatchtowerTLSInsecure); v != "" {
+		if v := os.Getenv(EnvBoundaryTLSInsecure); v != "" {
 			foundTLSConfig = true
 			var err error
 			envInsecure, err = strconv.ParseBool(v)
 			if err != nil {
-				return fmt.Errorf("could not parse WATCHTOWER_TLS_INSECURE")
+				return fmt.Errorf("could not parse BOUNDARY_TLS_INSECURE")
 			}
 		}
-		if v := os.Getenv(EnvWatchtowerTLSServerName); v != "" {
+		if v := os.Getenv(EnvBoundaryTLSServerName); v != "" {
 			foundTLSConfig = true
 			envServerName = v
 		}
@@ -361,7 +361,7 @@ func parseRateLimit(val string) (rate float64, burst int, err error) {
 	if err != nil {
 		rate, err = strconv.ParseFloat(val, 64)
 		if err != nil {
-			err = fmt.Errorf("%v was provided but incorrectly formatted", EnvWatchtowerRateLimit)
+			err = fmt.Errorf("%v was provided but incorrectly formatted", EnvBoundaryRateLimit)
 		}
 		burst = int(rate)
 	}
@@ -369,7 +369,7 @@ func parseRateLimit(val string) (rate float64, burst int, err error) {
 	return rate, burst, err
 }

-// Client is the client to the Watchtower API. Create a client with NewClient.
+// Client is the client to the Boundary API. Create a client with NewClient.
 type Client struct {
 	modifyLock sync.RWMutex
 	config     *Config
@@ -377,10 +377,10 @@ type Client struct {

 // NewClient returns a new client for the given configuration.
 //
-// If the configuration is nil, Watchtower will use configuration from
+// If the configuration is nil, Boundary will use configuration from
 // DefaultConfig(), which is the recommended starting configuration.
 //
-// If the environment variable `WATCHTOWER_TOKEN` is present, the token will be
+// If the environment variable `BOUNDARY_TOKEN` is present, the token will be
 // automatically added to the client. Otherwise, you must manually call
 // `SetToken()`.
 func NewClient(c *Config) (*Client, error) {
@@ -421,9 +421,9 @@ func NewClient(c *Config) (*Client, error) {
 	}, nil
 }

-// Sets the address of Watchtower in the client. The format of address should
+// Sets the address of Boundary in the client. The format of address should
 // be "<Scheme>://<Host>:<Port>". Setting this on a client will override the
-// value of the WATCHTOWER_ADDR environment variable.
+// value of the BOUNDARY_ADDR environment variable.
 func (c *Client) SetAddr(addr string) error {
 	c.modifyLock.Lock()
 	defer c.modifyLock.Unlock()
@@ -595,7 +595,7 @@ func getBufferForJSON(val interface{}) (*bytes.Buffer, error) {
 	return bytes.NewBuffer(b), nil
 }

-// NewRequest creates a new raw request object to query the Watchtower controller
+// NewRequest creates a new raw request object to query the Boundary controller
 // configured for this client. This is an advanced method and generally
 // doesn't need to be called externally.
 func (c *Client) NewRequest(ctx context.Context, method, requestPath string, body interface{}, opt ...Option) (*retryablehttp.Request, error) {
@@ -742,7 +742,7 @@ func (c *Client) Do(r *retryablehttp.Request) (*Response, error) {
 		return !unicode.IsPrint(c)
 	})
 	if idx != -1 {
-		return nil, fmt.Errorf("configured Watchtower token contains non-printable characters and cannot be used")
+		return nil, fmt.Errorf("configured Boundary token contains non-printable characters and cannot be used")
 	}

 	if outputCurlString {
@@ -803,9 +803,9 @@ func (c *Client) Do(r *retryablehttp.Request) (*Response, error) {
 					"but the client is configured to use TLS. Please either enable TLS\n"+
 					"on the server or run the client with -address set to an address\n"+
 					"that uses the http protocol:\n\n"+
-					"    watchtower <command> -address http://<address>\n\n"+
-					"You can also set the WATCHTOWER_ADDR environment variable:\n\n\n"+
-					"    WATCHTOWER_ADDR=http://<address> watchtower <command>\n\n"+
+					"    boundary <command> -address http://<address>\n\n"+
+					"You can also set the BOUNDARY_ADDR environment variable:\n\n\n"+
+					"    BOUNDARY_ADDR=http://<address> boundary <command>\n\n"+
 					"where <address> is replaced by the actual address to the controller.",
 				err)
 		}
@@ -10,8 +10,8 @@ import (

 	"github.com/kr/pretty"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/scopes"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
 )

 type Group struct {
@@ -5,12 +5,12 @@ import (
 	"net/http"
 	"testing"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/groups"
-	"github.com/hashicorp/watchtower/api/scopes"
-	"github.com/hashicorp/watchtower/api/users"
-	"github.com/hashicorp/watchtower/internal/iam"
-	"github.com/hashicorp/watchtower/internal/servers/controller"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/groups"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/api/users"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -1,7 +1,7 @@
 package groups

 import (
-	"github.com/hashicorp/watchtower/api"
+	"github.com/hashicorp/boundary/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -7,8 +7,8 @@ import (
 	"net/url"
 	"time"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/scopes"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
 )

 type Host struct {
@@ -7,8 +7,8 @@ import (
 	"net/url"
 	"time"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/scopes"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
 )

 type HostCatalog struct {
@@ -1,7 +1,7 @@
 package hosts

 import (
-	"github.com/hashicorp/watchtower/api"
+	"github.com/hashicorp/boundary/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -3,14 +3,14 @@ package main
 import (
 	"text/template"

-	"github.com/hashicorp/watchtower/internal/gen/controller/api"
-	"github.com/hashicorp/watchtower/internal/gen/controller/api/resources/authmethods"
-	"github.com/hashicorp/watchtower/internal/gen/controller/api/resources/authtokens"
-	"github.com/hashicorp/watchtower/internal/gen/controller/api/resources/groups"
-	"github.com/hashicorp/watchtower/internal/gen/controller/api/resources/hosts"
-	"github.com/hashicorp/watchtower/internal/gen/controller/api/resources/roles"
-	"github.com/hashicorp/watchtower/internal/gen/controller/api/resources/scopes"
-	"github.com/hashicorp/watchtower/internal/gen/controller/api/resources/users"
+	"github.com/hashicorp/boundary/internal/gen/controller/api"
+	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/authmethods"
+	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/authtokens"
+	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/groups"
+	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/hosts"
+	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/roles"
+	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/scopes"
+	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/users"
 	"google.golang.org/protobuf/proto"
 )

@@ -10,7 +10,7 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 	"google.golang.org/protobuf/types/known/wrapperspb"

-	"github.com/hashicorp/watchtower/internal/gen/controller/protooptions"
+	"github.com/hashicorp/boundary/internal/gen/controller/protooptions"

 	"github.com/iancoleman/strcase"
 )
@@ -470,8 +470,8 @@ import (

 	"github.com/kr/pretty"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/scopes"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
 )

 type {{ .Name }} struct { {{ range .Fields }}
@@ -497,7 +497,7 @@ import (
 	"fmt"
 	"time"

-	"github.com/hashicorp/watchtower/api"
+	"github.com/hashicorp/boundary/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"time"

+	"github.com/hashicorp/boundary/api/internal/strutil"
 	"github.com/hashicorp/errwrap"
 	sockaddr "github.com/hashicorp/go-sockaddr"
-	"github.com/hashicorp/watchtower/api/internal/strutil"
 	"github.com/mitchellh/mapstructure"
 )

@@ -1,7 +1,7 @@
 package roles

 import (
-	"github.com/hashicorp/watchtower/api"
+	"github.com/hashicorp/boundary/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -10,8 +10,8 @@ import (

 	"github.com/kr/pretty"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/scopes"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
 )

 type Role struct {
@@ -5,14 +5,14 @@ import (
 	"net/http"
 	"testing"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/groups"
-	"github.com/hashicorp/watchtower/api/internal/strutil"
-	"github.com/hashicorp/watchtower/api/roles"
-	"github.com/hashicorp/watchtower/api/scopes"
-	"github.com/hashicorp/watchtower/api/users"
-	"github.com/hashicorp/watchtower/internal/iam"
-	"github.com/hashicorp/watchtower/internal/servers/controller"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/groups"
+	"github.com/hashicorp/boundary/api/internal/strutil"
+	"github.com/hashicorp/boundary/api/roles"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/api/users"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
 	"github.com/kr/pretty"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -1,7 +1,7 @@
 package scopes

 import (
-	"github.com/hashicorp/watchtower/api"
+	"github.com/hashicorp/boundary/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -5,9 +5,9 @@ import (
 	"net/http"
 	"testing"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/scopes"
-	"github.com/hashicorp/watchtower/internal/servers/controller"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/internal/servers/controller"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -10,7 +10,7 @@ import (

 	"github.com/kr/pretty"

-	"github.com/hashicorp/watchtower/api"
+	"github.com/hashicorp/boundary/api"
 )

 type Scope struct {
@@ -1,7 +1,7 @@
 package users

 import (
-	"github.com/hashicorp/watchtower/api"
+	"github.com/hashicorp/boundary/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -10,8 +10,8 @@ import (

 	"github.com/kr/pretty"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/scopes"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
 )

 type User struct {
@@ -5,10 +5,10 @@ import (
 	"net/http"
 	"testing"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/users"
-	"github.com/hashicorp/watchtower/internal/iam"
-	"github.com/hashicorp/watchtower/internal/servers/controller"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/users"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -3,7 +3,7 @@ package main
 import (
 	"os"

-	"github.com/hashicorp/watchtower/internal/cmd"
+	"github.com/hashicorp/boundary/internal/cmd"
 )

 func main() {
@@ -1,4 +1,4 @@
-module github.com/hashicorp/watchtower
+module github.com/hashicorp/boundary

 go 1.13

@@ -7,13 +7,13 @@ import (
 	"net/http"
 	"strings"

+	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/scopes"
+	"github.com/hashicorp/boundary/internal/perms"
+	"github.com/hashicorp/boundary/internal/servers/controller/common"
+	"github.com/hashicorp/boundary/internal/types/action"
+	"github.com/hashicorp/boundary/internal/types/resource"
+	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/watchtower/internal/gen/controller/api/resources/scopes"
-	"github.com/hashicorp/watchtower/internal/perms"
-	"github.com/hashicorp/watchtower/internal/servers/controller/common"
-	"github.com/hashicorp/watchtower/internal/types/action"
-	"github.com/hashicorp/watchtower/internal/types/resource"
-	"github.com/hashicorp/watchtower/internal/types/scope"
 	"github.com/kr/pretty"
 )

@@ -7,11 +7,11 @@ import (
 	"net/http/httptest"
 	"testing"

-	"github.com/hashicorp/watchtower/internal/authtoken"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
-	"github.com/hashicorp/watchtower/internal/types/action"
-	"github.com/hashicorp/watchtower/internal/types/resource"
+	"github.com/hashicorp/boundary/internal/authtoken"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/types/action"
+	"github.com/hashicorp/boundary/internal/types/resource"
 	"github.com/kr/pretty"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -3,8 +3,8 @@ package auth
 import (
 	"testing"

-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -3,9 +3,9 @@ package password
 import (
 	"fmt"

-	"github.com/hashicorp/watchtower/internal/auth/password/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/oplog"
+	"github.com/hashicorp/boundary/internal/auth/password/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/oplog"
 	"google.golang.org/protobuf/proto"
 )

@@ -4,9 +4,9 @@ import (
 	"context"
 	"testing"

-	"github.com/hashicorp/watchtower/internal/auth/password/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
+	"github.com/hashicorp/boundary/internal/auth/password/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -6,11 +6,11 @@ import (
 	"fmt"
 	"strings"

+	"github.com/hashicorp/boundary/internal/auth/password/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/oplog"
 	wrapping "github.com/hashicorp/go-kms-wrapping"
 	"github.com/hashicorp/go-kms-wrapping/structwrapping"
-	"github.com/hashicorp/watchtower/internal/auth/password/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/oplog"
 	"golang.org/x/crypto/argon2"
 	"google.golang.org/protobuf/proto"
 )
@@ -5,9 +5,9 @@ import (
 	"errors"
 	"testing"

-	"github.com/hashicorp/watchtower/internal/auth/password/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
+	"github.com/hashicorp/boundary/internal/auth/password/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/jinzhu/gorm"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -3,9 +3,9 @@ package password
 import (
 	"fmt"

-	"github.com/hashicorp/watchtower/internal/auth/password/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/oplog"
+	"github.com/hashicorp/boundary/internal/auth/password/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/oplog"
 	"google.golang.org/protobuf/proto"
 )

@@ -4,9 +4,9 @@ import (
 	"context"
 	"testing"

-	"github.com/hashicorp/watchtower/internal/auth/password/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
+	"github.com/hashicorp/boundary/internal/auth/password/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -3,7 +3,7 @@ package password
 import (
 	"fmt"

-	"github.com/hashicorp/watchtower/internal/db"
+	"github.com/hashicorp/boundary/internal/db"
 )

 // Prefixes for private ids for types in the password package.
@@ -3,7 +3,7 @@ package password
 import (
 	"fmt"

-	"github.com/hashicorp/watchtower/internal/db"
+	"github.com/hashicorp/boundary/internal/db"
 )

 // PublicId prefixes for the resources in the password package.
@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"strings"

+	"github.com/hashicorp/boundary/internal/db"
 	wrapping "github.com/hashicorp/go-kms-wrapping"
-	"github.com/hashicorp/watchtower/internal/db"
 )

 // A Repository stores and retrieves the persistent types in the password
@@ -34,7 +34,7 @@ func NewRepository(r db.Reader, w db.Writer, wrapper wrapping.Wrapper, opt ...Op

 	opts := getOpts(opt...)
 	if opts.withLimit == 0 {
-		// zero signals the watchtower defaults should be used.
+		// zero signals the boundary defaults should be used.
 		opts.withLimit = db.DefaultLimit
 	}

@@ -6,8 +6,8 @@ import (
 	"fmt"
 	"regexp"

-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/oplog"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/oplog"
 )

 // CreateAccount inserts a into the repository and returns a new
@@ -6,10 +6,10 @@ import (
 	"testing"
 	"time"

-	"github.com/hashicorp/watchtower/internal/auth/password/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
-	"github.com/hashicorp/watchtower/internal/oplog"
+	"github.com/hashicorp/boundary/internal/auth/password/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/oplog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -6,9 +6,9 @@ import (
 	"fmt"
 	"strings"

-	"github.com/hashicorp/watchtower/internal/db"
-	dbcommon "github.com/hashicorp/watchtower/internal/db/common"
-	"github.com/hashicorp/watchtower/internal/oplog"
+	"github.com/hashicorp/boundary/internal/db"
+	dbcommon "github.com/hashicorp/boundary/internal/db/common"
+	"github.com/hashicorp/boundary/internal/oplog"
 )

 // CreateAuthMethod inserts m into the repository and returns a new
@@ -8,11 +8,11 @@ import (
 	"time"

 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/watchtower/internal/auth/password/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	dbassert "github.com/hashicorp/watchtower/internal/db/assert"
-	"github.com/hashicorp/watchtower/internal/iam"
-	"github.com/hashicorp/watchtower/internal/oplog"
+	"github.com/hashicorp/boundary/internal/auth/password/store"
+	"github.com/hashicorp/boundary/internal/db"
+	dbassert "github.com/hashicorp/boundary/internal/db/assert"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/oplog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
@@ -4,9 +4,9 @@ import (
 	"context"
 	"fmt"

-	"github.com/hashicorp/watchtower/internal/auth/password/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/oplog"
+	"github.com/hashicorp/boundary/internal/auth/password/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/oplog"
 )

 // A Configuration is an interface holding one of the configuration types
@@ -6,10 +6,10 @@ import (
 	"testing"
 	"time"

-	"github.com/hashicorp/watchtower/internal/auth/password/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
-	"github.com/hashicorp/watchtower/internal/oplog"
+	"github.com/hashicorp/boundary/internal/auth/password/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/oplog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -5,8 +5,8 @@ import (
 	"crypto/subtle"
 	"fmt"

-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/oplog"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/oplog"
 	"golang.org/x/crypto/argon2"
 )

@@ -6,10 +6,10 @@ import (
 	"testing"
 	"time"

-	"github.com/hashicorp/watchtower/internal/auth/password/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
-	"github.com/hashicorp/watchtower/internal/oplog"
+	"github.com/hashicorp/boundary/internal/auth/password/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/oplog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -4,8 +4,8 @@ import (
 	"errors"
 	"testing"

+	"github.com/hashicorp/boundary/internal/db"
 	wrapping "github.com/hashicorp/go-kms-wrapping"
-	"github.com/hashicorp/watchtower/internal/db"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -10,7 +10,7 @@ package store

 import (
 	proto "github.com/golang/protobuf/proto"
-	timestamp "github.com/hashicorp/watchtower/internal/db/timestamp"
+	timestamp "github.com/hashicorp/boundary/internal/db/timestamp"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -342,12 +342,12 @@ var file_controller_storage_auth_password_store_v1_argon2_proto_rawDesc = []byte
 	0x06, 0x63, 0x74, 0x53, 0x61, 0x6c, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x61, 0x6c, 0x74, 0x18,
 	0x08, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x73, 0x61, 0x6c, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x64,
 	0x65, 0x72, 0x69, 0x76, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x0a, 0x64, 0x65, 0x72, 0x69, 0x76, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x42, 0x44, 0x5a, 0x42,
+	0x52, 0x0a, 0x64, 0x65, 0x72, 0x69, 0x76, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x42, 0x42, 0x5a, 0x40,
 	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69,
-	0x63, 0x6f, 0x72, 0x70, 0x2f, 0x77, 0x61, 0x74, 0x63, 0x68, 0x74, 0x6f, 0x77, 0x65, 0x72, 0x2f,
-	0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x70, 0x61,
-	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x70, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -10,8 +10,8 @@ package store

 import (
 	proto "github.com/golang/protobuf/proto"
-	timestamp "github.com/hashicorp/watchtower/internal/db/timestamp"
-	_ "github.com/hashicorp/watchtower/internal/gen/controller/protooptions"
+	timestamp "github.com/hashicorp/boundary/internal/db/timestamp"
+	_ "github.com/hashicorp/boundary/internal/gen/controller/protooptions"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -327,12 +327,11 @@ var file_controller_storage_auth_password_store_v1_password_proto_rawDesc = []by
 	0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x4d,
 	0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f,
 	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72,
-	0x4e, 0x61, 0x6d, 0x65, 0x42, 0x44, 0x5a, 0x42, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x77, 0x61, 0x74,
-	0x63, 0x68, 0x74, 0x6f, 0x77, 0x65, 0x72, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
-	0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x2f, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x4e, 0x61, 0x6d, 0x65, 0x42, 0x42, 0x5a, 0x40, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75,
+	0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x61,
+	0x75, 0x74, 0x68, 0x2f, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x2f, 0x73, 0x74, 0x6f,
+	0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"testing"

-	"github.com/hashicorp/watchtower/internal/db"
+	"github.com/hashicorp/boundary/internal/db"
 	"github.com/jinzhu/gorm"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -3,8 +3,8 @@ package password
 import (
 	"testing"

-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -1,14 +1,14 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.25.0
-// 	protoc        v3.12.3
+// 	protoc        v3.12.4
 // source: controller/storage/auth/store/v1/account.proto

 package store

 import (
 	proto "github.com/golang/protobuf/proto"
-	_ "github.com/hashicorp/watchtower/internal/db/timestamp"
+	_ "github.com/hashicorp/boundary/internal/db/timestamp"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -128,12 +128,11 @@ var file_controller_storage_auth_store_v1_account_proto_rawDesc = []byte{
 	0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04,
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x64, 0x12, 0x1e, 0x0a,
 	0x0b, 0x69, 0x61, 0x6d, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x09, 0x69, 0x61, 0x6d, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x42, 0x3b, 0x5a,
-	0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68,
-	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x77, 0x61, 0x74, 0x63, 0x68, 0x74, 0x6f, 0x77, 0x65, 0x72,
-	0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x28, 0x09, 0x52, 0x09, 0x69, 0x61, 0x6d, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x42, 0x39, 0x5a,
+	0x37, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69,
+	0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x73, 0x74, 0x6f,
+	0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -8,7 +8,7 @@ package store

 import (
 	proto "github.com/golang/protobuf/proto"
-	_ "github.com/hashicorp/watchtower/internal/db/timestamp"
+	_ "github.com/hashicorp/boundary/internal/db/timestamp"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -185,11 +185,11 @@ var file_controller_storage_auth_store_v1_auth_method_proto_rawDesc = []byte{
 	0x01, 0x28, 0x09, 0x52, 0x0a, 0x69, 0x61, 0x6d, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x64, 0x12,
 	0x1e, 0x0a, 0x0b, 0x69, 0x61, 0x6d, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x04,
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x69, 0x61, 0x6d, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x42,
-	0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61,
-	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x77, 0x61, 0x74, 0x63, 0x68, 0x74, 0x6f, 0x77,
-	0x65, 0x72, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x61, 0x75, 0x74, 0x68,
-	0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x33,
+	0x39, 0x5a, 0x37, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79,
+	0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x73,
+	0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
 }

 var (
@@ -1,7 +1,7 @@
 package authtoken

 import (
-	authStore "github.com/hashicorp/watchtower/internal/auth/store"
+	authStore "github.com/hashicorp/boundary/internal/auth/store"
 	"google.golang.org/protobuf/proto"
 )

@@ -4,11 +4,11 @@ import (
 	"context"
 	"fmt"

+	"github.com/hashicorp/boundary/internal/authtoken/store"
+	"github.com/hashicorp/boundary/internal/db"
 	wrapping "github.com/hashicorp/go-kms-wrapping"
 	"github.com/hashicorp/go-kms-wrapping/structwrapping"
 	"github.com/hashicorp/vault/sdk/helper/base62"
-	"github.com/hashicorp/watchtower/internal/authtoken/store"
-	"github.com/hashicorp/watchtower/internal/db"
 	"google.golang.org/protobuf/proto"
 )

@@ -10,11 +10,11 @@ import (
 	"time"

 	"github.com/golang/protobuf/ptypes"
-	"github.com/hashicorp/watchtower/internal/auth/password"
-	"github.com/hashicorp/watchtower/internal/authtoken/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/db/timestamp"
-	"github.com/hashicorp/watchtower/internal/iam"
+	"github.com/hashicorp/boundary/internal/auth/password"
+	"github.com/hashicorp/boundary/internal/authtoken/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/db/timestamp"
+	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
@@ -3,7 +3,7 @@ package authtoken
 import (
 	"testing"

-	"github.com/hashicorp/watchtower/internal/authtoken/store"
+	"github.com/hashicorp/boundary/internal/authtoken/store"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -4,9 +4,9 @@ import (
 	"context"
 	"testing"

-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/db/timestamp"
-	"github.com/hashicorp/watchtower/internal/iam"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/db/timestamp"
+	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
@@ -7,11 +7,11 @@ import (
 	"time"

 	"github.com/golang/protobuf/ptypes"
+	"github.com/hashicorp/boundary/internal/authtoken/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/db/timestamp"
+	"github.com/hashicorp/boundary/internal/oplog"
 	wrapping "github.com/hashicorp/go-kms-wrapping"
-	"github.com/hashicorp/watchtower/internal/authtoken/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/db/timestamp"
-	"github.com/hashicorp/watchtower/internal/oplog"
 )

 // TODO (ICU-406): Make these fields configurable.
@@ -45,7 +45,7 @@ func NewRepository(r db.Reader, w db.Writer, wrapper wrapping.Wrapper, opt ...Op

 	opts := getOpts(opt...)
 	if opts.withLimit == 0 {
-		// zero signals the watchtower defaults should be used.
+		// zero signals the boundary defaults should be used.
 		opts.withLimit = db.DefaultLimit
 	}
 	return &Repository{
@@ -9,16 +9,16 @@ import (

 	"github.com/golang/protobuf/ptypes"
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/internal/auth/password"
+	"github.com/hashicorp/boundary/internal/oplog"
 	wrapping "github.com/hashicorp/go-kms-wrapping"
-	"github.com/hashicorp/watchtower/internal/auth/password"
-	"github.com/hashicorp/watchtower/internal/oplog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/testing/protocmp"

-	"github.com/hashicorp/watchtower/internal/authtoken/store"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
+	"github.com/hashicorp/boundary/internal/authtoken/store"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
 )

 func TestRepository_New(t *testing.T) {
@@ -8,7 +8,7 @@ package store

 import (
 	proto "github.com/golang/protobuf/proto"
-	timestamp "github.com/hashicorp/watchtower/internal/db/timestamp"
+	timestamp "github.com/hashicorp/boundary/internal/db/timestamp"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -40,7 +40,7 @@ type AuthToken struct {
 	// update_time from the RDBMS
 	// @inject_tag: `gorm:"default:current_timestamp"`
 	UpdateTime *timestamp.Timestamp `protobuf:"bytes,3,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty" gorm:"default:current_timestamp"`
-	// last_access_time indicates the last time the auth token was used on the watchtower API.
+	// last_access_time indicates the last time the auth token was used on the boundary API.
 	// @inject_tag: `gorm:"default:current_timestamp"`
 	ApproximateLastAccessTime *timestamp.Timestamp `protobuf:"bytes,4,opt,name=approximate_last_access_time,json=approximateLastAccessTime,proto3" json:"approximate_last_access_time,omitempty" gorm:"default:current_timestamp"`
 	// expiration_time indicates when this session will expire.
@@ -227,11 +227,11 @@ var file_controller_storage_authtoken_store_v1_authtoken_proto_rawDesc = []byte{
 	0x28, 0x09, 0x52, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64,
 	0x12, 0x1e, 0x0a, 0x0b, 0x69, 0x61, 0x6d, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18,
 	0x0d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x69, 0x61, 0x6d, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64,
-	0x42, 0x40, 0x5a, 0x3e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x77, 0x61, 0x74, 0x63, 0x68, 0x74, 0x6f,
-	0x77, 0x65, 0x72, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x61, 0x75, 0x74,
-	0x68, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x42, 0x3e, 0x5a, 0x3c, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72,
+	0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x74,
+	0x6f, 0x6b, 0x65, 0x6e, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -4,10 +4,10 @@ import (
 	"context"
 	"testing"

+	"github.com/hashicorp/boundary/internal/auth/password"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
 	wrapping "github.com/hashicorp/go-kms-wrapping"
-	"github.com/hashicorp/watchtower/internal/auth/password"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
 	"github.com/jinzhu/gorm"
 	"github.com/stretchr/testify/require"
 )
@@ -16,8 +16,8 @@ import (
 	"sync"
 	"syscall"

-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/authtokens"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/authtokens"
 	"github.com/mitchellh/cli"
 	"github.com/pkg/errors"
 	"github.com/posener/complete"
@@ -31,7 +31,7 @@ const (
 	// NotSetValue is a flag value for a not-set value
 	NotSetValue = "(not set)"

-	envTokenName = "WATCHTOWER_TOKEN_NAME"
+	envTokenName = "BOUNDARY_TOKEN_NAME"
 )

 // reRemoveWhitespace is a regular expression for stripping whitespace from
@@ -159,7 +159,7 @@ func (c *Command) Client() (*api.Client, error) {
 	}

 	// Turn off retries on the CLI
-	if os.Getenv(api.EnvWatchtowerMaxRetries) == "" {
+	if os.Getenv(api.EnvBoundaryMaxRetries) == "" {
 		c.client.SetMaxRetries(0)
 	}

@@ -169,7 +169,7 @@ func (c *Command) Client() (*api.Client, error) {
 			tokenName = c.FlagTokenName
 		}
 		if tokenName != "none" {
-			token, err := keyring.Get("HashiCorp Watchtower Auth Token", tokenName)
+			token, err := keyring.Get("HashiCorp Boundary Auth Token", tokenName)
 			if err != nil {
 				if err == keyring.ErrNotFound {
 					c.UI.Info("No saved credential found, continuing without")
@@ -235,16 +235,16 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				Name:       FlagNameAddr,
 				Target:     &c.flagAddr,
 				Default:    NotSetValue,
-				EnvVar:     api.EnvWatchtowerAddr,
+				EnvVar:     api.EnvBoundaryAddr,
 				Completion: complete.PredictAnything,
-				Usage:      "Addr of the Watchtower controller, as a complete URL (e.g. https://watchtower.example.com:9200).",
+				Usage:      "Addr of the Boundary controller, as a complete URL (e.g. https://boundary.example.com:9200).",
 			})

 			f.StringVar(&StringVar{
 				Name:       FlagNameScope,
 				Target:     &c.flagScope,
 				Default:    NotSetValue,
-				EnvVar:     api.EnvWatchtowerScopeId,
+				EnvVar:     api.EnvBoundaryScopeId,
 				Completion: complete.PredictAnything,
 				Usage:      `Scope in which to make the request. If not specified, will default to the scope of a saved token (if found), otherwise will default to "global".`,
 			})
@@ -253,7 +253,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				Name:       FlagNameCACert,
 				Target:     &c.flagTLSCACert,
 				Default:    NotSetValue,
-				EnvVar:     api.EnvWatchtowerCACert,
+				EnvVar:     api.EnvBoundaryCACert,
 				Completion: complete.PredictFiles("*"),
 				Usage: "Path on the local disk to a single PEM-encoded CA " +
 					"certificate to verify the Controller or Worker's server's SSL certificate. This " +
@@ -264,7 +264,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				Name:       FlagNameCAPath,
 				Target:     &c.flagTLSCAPath,
 				Default:    NotSetValue,
-				EnvVar:     api.EnvWatchtowerCAPath,
+				EnvVar:     api.EnvBoundaryCAPath,
 				Completion: complete.PredictDirs("*"),
 				Usage: "Path on the local disk to a directory of PEM-encoded CA " +
 					"certificates to verify the SSL certificate of the Controller.",
@@ -274,10 +274,10 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				Name:       FlagNameClientCert,
 				Target:     &c.flagTLSClientCert,
 				Default:    NotSetValue,
-				EnvVar:     api.EnvWatchtowerClientCert,
+				EnvVar:     api.EnvBoundaryClientCert,
 				Completion: complete.PredictFiles("*"),
 				Usage: "Path on the local disk to a single PEM-encoded CA " +
-					"certificate to use for TLS authentication to the Watchtower Controller. If " +
+					"certificate to use for TLS authentication to the Boundary Controller. If " +
 					"this flag is specified, -client-key is also required.",
 			})

@@ -285,7 +285,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				Name:       FlagNameClientKey,
 				Target:     &c.flagTLSClientKey,
 				Default:    NotSetValue,
-				EnvVar:     api.EnvWatchtowerClientKey,
+				EnvVar:     api.EnvBoundaryClientKey,
 				Completion: complete.PredictFiles("*"),
 				Usage: "Path on the local disk to a single PEM-encoded private key " +
 					"matching the client certificate from -client-cert.",
@@ -295,19 +295,19 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				Name:       FlagTLSServerName,
 				Target:     &c.flagTLSServerName,
 				Default:    NotSetValue,
-				EnvVar:     api.EnvWatchtowerTLSServerName,
+				EnvVar:     api.EnvBoundaryTLSServerName,
 				Completion: complete.PredictAnything,
-				Usage: "Name to use as the SNI host when connecting to the Watchtower " +
+				Usage: "Name to use as the SNI host when connecting to the Boundary " +
 					"server via TLS.",
 			})

 			f.BoolVar(&BoolVar{
 				Name:   FlagNameTLSInsecure,
 				Target: &c.flagTLSInsecure,
-				EnvVar: api.EnvWatchtowerTLSInsecure,
+				EnvVar: api.EnvBoundaryTLSInsecure,
 				Usage: "Disable verification of TLS certificates. Using this option " +
 					"is highly discouraged as it decreases the security of data " +
-					"transmissions to and from the Watchtower server.",
+					"transmissions to and from the Boundary server.",
 			})
 		}

@@ -350,7 +350,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 					Name:       "format",
 					Target:     &c.flagFormat,
 					Default:    "table",
-					EnvVar:     EnvWatchtowerCLIFormat,
+					EnvVar:     EnvBoundaryCLIFormat,
 					Completion: complete.PredictSet("table", "json", "yaml"),
 					Usage: "Print the output in the given format. Valid formats " +
 						"are \"table\", \"json\", or \"yaml\".",
@@ -2,7 +2,7 @@ package base

 const (
 	// FlagNameAddr is the flag used in the base command to read in the
-	// address of the Watchtower server.
+	// address of the Boundary server.
 	FlagNameAddr = "addr"
 	// FlagNameScope is the flag used in the base command to read in the scope
 	// in which to make a request.
@@ -28,6 +28,6 @@ const (
 )

 const (
-	EnvWatchtowerCLINoColor = `WATCHTOWER_CLI_NO_COLOR`
-	EnvWatchtowerCLIFormat  = `WATCHTOWER_CLI_FORMAT`
+	EnvBoundaryCLINoColor = `BOUNDARY_CLI_NO_COLOR`
+	EnvBoundaryCLIFormat  = `BOUNDARY_CLI_FORMAT`
 )
@@ -398,11 +398,11 @@ var Formatters = map[string]Formatter{

 func Format(ui cli.Ui) string {
 	switch t := ui.(type) {
-	case *WatchtowerUI:
+	case *BoundaryUI:
 		return t.Format
 	}

-	format := os.Getenv(EnvWatchtowerCLIFormat)
+	format := os.Getenv(EnvBoundaryCLIFormat)
 	if format == "" {
 		format = "table"
 	}
@@ -96,7 +96,7 @@ func tcpListenerFactory(l *configutil.Listener, logger hclog.Logger, ui cli.Ui)
 		"addr": l.Address,
 	}

-	if _, ok := os.LookupEnv("WATCHTOWER_LOG_CONNECTION_MUXING"); !ok {
+	if _, ok := os.LookupEnv("BOUNDARY_LOG_CONNECTION_MUXING"); !ok {
 		logger = nil
 	}
 	alpnMux := alpnmux.New(ln, logger)
@@ -13,7 +13,7 @@ import (
 )

 func StartMemProfiler(logger hclog.Logger) {
-	profileDir := filepath.Join(os.TempDir(), "watchtowerprof")
+	profileDir := filepath.Join(os.TempDir(), "boundaryprof")
 	if err := os.MkdirAll(profileDir, 0700); err != nil {
 		logger.Debug("could not create profile directory", "error", err)
 		return
@@ -14,6 +14,11 @@ import (
 	"sync"

 	"github.com/armon/go-metrics"
+	"github.com/hashicorp/boundary/globals"
+	"github.com/hashicorp/boundary/internal/auth/password"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/version"
 	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/go-hclog"
 	wrapping "github.com/hashicorp/go-kms-wrapping"
@@ -25,11 +30,6 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/helper/mlock"
 	"github.com/hashicorp/vault/sdk/logical"
-	"github.com/hashicorp/watchtower/globals"
-	"github.com/hashicorp/watchtower/internal/auth/password"
-	"github.com/hashicorp/watchtower/internal/db"
-	"github.com/hashicorp/watchtower/internal/iam"
-	"github.com/hashicorp/watchtower/version"
 	"github.com/jinzhu/gorm"
 	"github.com/mitchellh/cli"
 	"google.golang.org/grpc/grpclog"
@@ -107,7 +107,7 @@ func (b *Server) SetupLogging(flagLogLevel, flagLogFormat, configLogLevel, confi
 	namedGRPCLogFaker := b.Logger.Named("grpclogfaker")
 	grpclog.SetLogger(&GRPCLogFaker{
 		Logger: namedGRPCLogFaker,
-		Log:    os.Getenv("WATCHTOWER_GRPC_LOGGING") != "",
+		Log:    os.Getenv("BOUNDARY_GRPC_LOGGING") != "",
 	})

 	b.Info["log level"] = logLevel.String()
@@ -181,9 +181,9 @@ func (b *Server) SetupMetrics(ui cli.Ui, telemetry *configutil.Telemetry) error
 	b.InmemSink, _, b.PrometheusEnabled, err = configutil.SetupTelemetry(&configutil.SetupTelemetryOpts{
 		Config:      telemetry,
 		Ui:          ui,
-		ServiceName: "watchtower",
-		DisplayName: "Watchtower",
-		UserAgent:   "watchtower",
+		ServiceName: "boundary",
+		DisplayName: "Boundary",
+		UserAgent:   "boundary",
 	})
 	if err != nil {
 		return fmt.Errorf("Error initializing telemetry: %w", err)
@@ -209,7 +209,7 @@ func (b *Server) PrintInfo(ui cli.Ui, mode string) {
 	// Server configuration output
 	padding := 24
 	sort.Strings(b.InfoKeys)
-	ui.Output(fmt.Sprintf("==> Watchtower %s configuration:\n", mode))
+	ui.Output(fmt.Sprintf("==> Boundary %s configuration:\n", mode))
 	for _, k := range b.InfoKeys {
 		ui.Output(fmt.Sprintf(
 			"%s%s: %s",
@@ -221,7 +221,7 @@ func (b *Server) PrintInfo(ui cli.Ui, mode string) {

 	// Output the header that the server has started
 	if !b.CombineLogs {
-		ui.Output(fmt.Sprintf("==> Watchtower %s started! Log data will stream in below:\n", mode))
+		ui.Output(fmt.Sprintf("==> Boundary %s started! Log data will stream in below:\n", mode))
 	}
 }

@@ -7,7 +7,7 @@ import (
 	"golang.org/x/crypto/ssh/terminal"
 )

-type WatchtowerUI struct {
+type BoundaryUI struct {
 	cli.Ui
 	Format string
 }
@@ -5,15 +5,15 @@ import (
 	"os/signal"
 	"syscall"

-	"github.com/hashicorp/watchtower/internal/cmd/base"
-	"github.com/hashicorp/watchtower/internal/cmd/commands/authenticate"
-	"github.com/hashicorp/watchtower/internal/cmd/commands/config"
-	"github.com/hashicorp/watchtower/internal/cmd/commands/controller"
-	"github.com/hashicorp/watchtower/internal/cmd/commands/dev"
-	"github.com/hashicorp/watchtower/internal/cmd/commands/hosts"
-	"github.com/hashicorp/watchtower/internal/cmd/commands/roles"
-	"github.com/hashicorp/watchtower/internal/cmd/commands/scopes"
-	"github.com/hashicorp/watchtower/internal/cmd/commands/worker"
+	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/cmd/commands/authenticate"
+	"github.com/hashicorp/boundary/internal/cmd/commands/config"
+	"github.com/hashicorp/boundary/internal/cmd/commands/controller"
+	"github.com/hashicorp/boundary/internal/cmd/commands/dev"
+	"github.com/hashicorp/boundary/internal/cmd/commands/hosts"
+	"github.com/hashicorp/boundary/internal/cmd/commands/roles"
+	"github.com/hashicorp/boundary/internal/cmd/commands/scopes"
+	"github.com/hashicorp/boundary/internal/cmd/commands/worker"

 	"github.com/mitchellh/cli"
 )
@@ -1,7 +1,7 @@
 package authenticate

 import (
-	"github.com/hashicorp/watchtower/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/mitchellh/cli"
 	"github.com/mitchellh/go-wordwrap"
 )
@@ -13,18 +13,18 @@ type Command struct {
 }

 func (c *Command) Synopsis() string {
-	return wordwrap.WrapString("Authenticate the Watchtower commandline client", base.TermWidth)
+	return wordwrap.WrapString("Authenticate the Boundary commandline client", base.TermWidth)
 }

 func (c *Command) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: watchtower authenticate [sub command] [options] [args]",
+		"Usage: boundary authenticate [sub command] [options] [args]",
 		"",
-		"  This command authenticates the Watchtower commandline client using a specified auth method. Examples:",
+		"  This command authenticates the Boundary commandline client using a specified auth method. Examples:",
 		"",
 		"    Authenticate with password auth method:",
 		"",
-		"      $ watchtower authenticate password -name foo -password bar",
+		"      $ boundary authenticate password -name foo -password bar",
 		"",
 		"  Please see the auth method subcommand help for detailed usage information.",
 	})
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"time"

+	"github.com/hashicorp/boundary/api/authmethods"
+	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/hashicorp/vault/sdk/helper/password"
-	"github.com/hashicorp/watchtower/api/authmethods"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
 	"github.com/kr/pretty"
 	"github.com/mitchellh/cli"
 	"github.com/mitchellh/go-wordwrap"
@@ -21,9 +21,9 @@ import (
 var _ cli.Command = (*PasswordCommand)(nil)
 var _ cli.CommandAutocomplete = (*PasswordCommand)(nil)

-var envPassword = "WATCHTOWER_AUTHENTICATE_PASSWORD"
-var envName = "WATCHTOWER_AUTHENTICATE_NAME"
-var envMethodId = "WATCHTOWER_AUTHENTICATE_METHOD_ID"
+var envPassword = "BOUNDARY_AUTHENTICATE_PASSWORD"
+var envName = "BOUNDARY_AUTHENTICATE_NAME"
+var envMethodId = "BOUNDARY_AUTHENTICATE_METHOD_ID"

 type PasswordCommand struct {
 	*base.Command
@@ -34,20 +34,20 @@ type PasswordCommand struct {
 }

 func (c *PasswordCommand) Synopsis() string {
-	return wordwrap.WrapString("Invoke the password auth method to authenticate with Watchtower", base.TermWidth)
+	return wordwrap.WrapString("Invoke the password auth method to authenticate with Boundary", base.TermWidth)
 }

 func (c *PasswordCommand) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: watchtower authenticate password [options] [args]",
+		"Usage: boundary authenticate password [options] [args]",
 		"",
-		"  Invoke the password auth method to authenticate the Watchtower CLI:",
+		"  Invoke the password auth method to authenticate the Boundary CLI:",
 		"",
-		"    $ watchtower authenticate password -name=foo -password=bar",
+		"    $ boundary authenticate password -name=foo -password=bar",
 		"",
 		"  If more than one instance of the password auth method exists, use the -method-id flag:",
 		"",
-		`    $ watchtower authenticate password -method-id am_12345 -name foo -password "bar"`,
+		`    $ boundary authenticate password -method-id am_12345 -name foo -password "bar"`,
 	}) + c.Flags().Help()
 }

@@ -156,7 +156,7 @@ func (c *PasswordCommand) Run(args []string) int {
 			c.UI.Error(fmt.Sprintf("Error marshaling auth token to save to system credential store: %s", err))
 			return 1
 		}
-		if err := keyring.Set("HashiCorp Watchtower Auth Token", tokenName, base64.RawStdEncoding.EncodeToString(marshaled)); err != nil {
+		if err := keyring.Set("HashiCorp Boundary Auth Token", tokenName, base64.RawStdEncoding.EncodeToString(marshaled)); err != nil {
 			c.UI.Error(fmt.Sprintf("Error saving auth token to system credential store: %s", err))
 			return 1
 		}
@@ -3,7 +3,7 @@ package config
 import (
 	"strings"

-	"github.com/hashicorp/watchtower/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/mitchellh/cli"
 )

@@ -14,23 +14,23 @@ type Command struct {
 }

 func (c *Command) Synopsis() string {
-	return "Manage sensitive values in Watchtower's configuration files"
+	return "Manage sensitive values in Boundary's configuration files"
 }

 func (c *Command) Help() string {
 	helpText := `
-Usage: watchtower config <subcommand> [options] [args]
+Usage: boundary config <subcommand> [options] [args]

-  This command groups subcommands for operators interacting with Watchtower's
+  This command groups subcommands for operators interacting with Boundary's
  config files. Here are a few examples of config commands:

    Encrypt sensitive values in a config file:

-    $ watchtower config encrypt config.hcl
+    $ boundary config encrypt config.hcl

    Decrypt sensitive values in a config file:

-    $ watchtower config decrypt config.hcl
+    $ boundary config decrypt config.hcl

  Please see the individual subcommand help for detailed usage information.`

@@ -6,9 +6,9 @@ import (
 	"os"
 	"strings"

+	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/sdk/helper/strutil"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
 	"github.com/mitchellh/cli"
 	"github.com/posener/complete"
 )
@@ -38,9 +38,9 @@ func (c *EncryptDecryptCommand) Help() string {
 		subCmd = "Encrypt"
 	}
 	helpText := `
-Usage: watchtower config %s [options] [args]
+Usage: boundary config %s [options] [args]
  
-	%s sensitive values in a Watchtower's configuration file. These values must be marked
+	%s sensitive values in a Boundary's configuration file. These values must be marked
  with {{%s()}} as appropriate. This can only be used with string parameters, and
  the markers must be inside the quote marks delimiting the string; as an example:
    
@@ -49,7 +49,7 @@ Usage: watchtower config %s [options] [args]
 	By default this will print the new configuration out. To overwrite into the same
  file use the -overwrite flag.
    
-		$ watchtower config %s -overwrite config.hcl
+		$ boundary config %s -overwrite config.hcl
 																																				`
 	helpText = fmt.Sprintf(helpText, strings.ToLower(subCmd), subCmd, strings.ToLower(subCmd), strings.ToLower(subCmd))

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"

-	"github.com/hashicorp/watchtower/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/mitchellh/cli"
 	"github.com/stretchr/testify/assert"
 )
@@ -6,16 +6,16 @@ import (
 	"strings"
 	"sync"

+	"github.com/hashicorp/boundary/globals"
+	"github.com/hashicorp/boundary/internal/auth/password"
+	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/cmd/config"
+	"github.com/hashicorp/boundary/internal/servers/controller"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/sdk/helper/mlock"
 	"github.com/hashicorp/vault/sdk/helper/strutil"
-	"github.com/hashicorp/watchtower/globals"
-	"github.com/hashicorp/watchtower/internal/auth/password"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
-	"github.com/hashicorp/watchtower/internal/cmd/config"
-	"github.com/hashicorp/watchtower/internal/servers/controller"
 	"github.com/mitchellh/cli"
 	"github.com/posener/complete"
 )
@@ -55,16 +55,16 @@ type Command struct {
 }

 func (c *Command) Synopsis() string {
-	return "Start a Watchtower controller"
+	return "Start a Boundary controller"
 }

 func (c *Command) Help() string {
 	helpText := `
-Usage: watchtower controller [options]
+Usage: boundary controller [options]

  Start a controller with a configuration file:

-      $ watchtower controller -config=/etc/watchtower/controller.hcl
+      $ boundary controller -config=/etc/boundary/controller.hcl

  For a full list of examples, please see the documentation.

@@ -91,7 +91,7 @@ func (c *Command) Flags() *base.FlagSets {
 		Name:       "log-level",
 		Target:     &c.flagLogLevel,
 		Default:    base.NotSetValue,
-		EnvVar:     "WATCHTOWER_LOG_LEVEL",
+		EnvVar:     "BOUNDARY_LOG_LEVEL",
 		Completion: complete.PredictSet("trace", "debug", "info", "warn", "err"),
 		Usage: "Log verbosity level. Supported values (in order of more detail to less) are " +
 			"\"trace\", \"debug\", \"info\", \"warn\", and \"err\".",
@@ -149,14 +149,14 @@ func (c *Command) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:   "dev-api-listen-address",
 		Target: &c.flagDevControllerAPIListenAddr,
-		EnvVar: "WATCHTOWER_DEV_CONTROLLER_API_LISTEN_ADDRESS",
+		EnvVar: "BOUNDARY_DEV_CONTROLLER_API_LISTEN_ADDRESS",
 		Usage:  "Address to bind the controller to in \"dev\" mode for \"api\" purpose.",
 	})

 	f.StringVar(&base.StringVar{
 		Name:   "dev-cluster-listen-address",
 		Target: &c.flagDevControllerClusterListenAddr,
-		EnvVar: "WATCHTOWER_DEV_CONTROLLER_CLUSTER_LISTEN_ADDRESS",
+		EnvVar: "BOUNDARY_DEV_CONTROLLER_CLUSTER_LISTEN_ADDRESS",
 		Usage:  "Address to bind the controller to in \"dev\" mode for \"cluster\" purpose.",
 	})

@@ -216,14 +216,14 @@ func (c *Command) Run(args []string) int {
 	}

 	// If mlockall(2) isn't supported, show a warning. We disable this in dev
-	// because it is quite scary to see when first using Watchtower. We also disable
+	// because it is quite scary to see when first using Boundary. We also disable
 	// this if the user has explicitly disabled mlock in configuration.
 	if !c.flagDev && !c.Config.DisableMlock && !mlock.Supported() {
 		c.UI.Warn(base.WrapAtLength(
 			"WARNING! mlock is not supported on this system! An mlockall(2)-like " +
 				"syscall to prevent memory from being swapped to disk is not " +
-				"supported on this system. For better security, only run Watchtower on " +
-				"systems where this call is supported. If you are running Watchtower" +
+				"supported on this system. For better security, only run Boundary on " +
+				"systems where this call is supported. If you are running Boundary" +
 				"in a Docker container, provide the IPC_LOCK cap to the container."))
 	}

@@ -452,7 +452,7 @@ func (c *Command) WaitForInterrupt() int {
 	for !shutdownTriggered {
 		select {
 		case <-shutdownCh:
-			c.UI.Output("==> Watchtower controller shutdown triggered")
+			c.UI.Output("==> Boundary controller shutdown triggered")

 			if err := c.controller.Shutdown(); err != nil {
 				c.UI.Error(fmt.Errorf("Error with controller shutdown: %w", err).Error())
@@ -461,7 +461,7 @@ func (c *Command) WaitForInterrupt() int {
 			shutdownTriggered = true

 		case <-c.SighupCh:
-			c.UI.Output("==> Watchtower controller reload triggered")
+			c.UI.Output("==> Boundary controller reload triggered")

 			// Check for new log level
 			var level hclog.Level
@@ -2,7 +2,7 @@

 package controller

-import "github.com/hashicorp/watchtower/internal/cmd/base"
+import "github.com/hashicorp/boundary/internal/cmd/base"

 func init() {
 	devOnlyControllerFlags = addDevOnlyControllerFlags
@@ -12,7 +12,7 @@ func addDevOnlyControllerFlags(c *Command, f *base.FlagSet) {
 	f.StringVar(&base.StringVar{
 		Name:   "dev-passthrough-directory",
 		Target: &c.flagDevPassthroughDirectory,
-		EnvVar: "WATCHTOWER_DEV_PASSTHROUGH_DIRECTORY",
+		EnvVar: "BOUNDARY_DEV_PASSTHROUGH_DIRECTORY",
 		Usage:  "Enables a passthrough directory in the webserver at /",
 	})
 }
@@ -6,11 +6,11 @@ import (
 	"strings"
 	"sync"

-	"github.com/hashicorp/watchtower/internal/auth/password"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
-	controllercmd "github.com/hashicorp/watchtower/internal/cmd/commands/controller"
-	workercmd "github.com/hashicorp/watchtower/internal/cmd/commands/worker"
-	"github.com/hashicorp/watchtower/internal/cmd/config"
+	"github.com/hashicorp/boundary/internal/auth/password"
+	"github.com/hashicorp/boundary/internal/cmd/base"
+	controllercmd "github.com/hashicorp/boundary/internal/cmd/commands/controller"
+	workercmd "github.com/hashicorp/boundary/internal/cmd/commands/worker"
+	"github.com/hashicorp/boundary/internal/cmd/config"
 	"github.com/mitchellh/cli"
 	"github.com/posener/complete"
 )
@@ -45,16 +45,16 @@ type Command struct {
 }

 func (c *Command) Synopsis() string {
-	return "Start a Watchtower dev environment"
+	return "Start a Boundary dev environment"
 }

 func (c *Command) Help() string {
 	helpText := `
-Usage: watchtower dev [options]
+Usage: boundary dev [options]

  Start a dev environment: 

-      $ watchtower dev
+      $ boundary dev

  For a full list of examples, please see the documentation.

@@ -71,7 +71,7 @@ func (c *Command) Flags() *base.FlagSets {
 		Name:       "log-level",
 		Target:     &c.flagLogLevel,
 		Default:    base.NotSetValue,
-		EnvVar:     "WATCHTOWER_LOG_LEVEL",
+		EnvVar:     "BOUNDARY_LOG_LEVEL",
 		Completion: complete.PredictSet("trace", "debug", "info", "warn", "err"),
 		Usage: "Log verbosity level. Supported values (in order of more detail to less) are " +
 			"\"trace\", \"debug\", \"info\", \"warn\", and \"err\".",
@@ -122,14 +122,14 @@ func (c *Command) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:   "dev-api-listen-address",
 		Target: &c.flagDevControllerAPIListenAddr,
-		EnvVar: "WATCHTOWER_DEV_CONTROLLER_API_LISTEN_ADDRESS",
+		EnvVar: "BOUNDARY_DEV_CONTROLLER_API_LISTEN_ADDRESS",
 		Usage:  "Address to bind to for controller \"api\" purpose.",
 	})

 	f.StringVar(&base.StringVar{
 		Name:   "dev-cluster-listen-address",
 		Target: &c.flagDevControllerClusterListenAddr,
-		EnvVar: "WATCHTOWER_DEV_CONTROLLER_CLUSTER_LISTEN_ADDRESS",
+		EnvVar: "BOUNDARY_DEV_CONTROLLER_CLUSTER_LISTEN_ADDRESS",
 		Usage:  "Address to bind to for controller \"cluster\" purpose.",
 	})

@@ -321,7 +321,7 @@ func (c *Command) Run(args []string) int {
 	for !shutdownTriggered {
 		select {
 		case <-c.ShutdownCh:
-			c.UI.Output("==> Watchtower dev environment shutdown triggered")
+			c.UI.Output("==> Boundary dev environment shutdown triggered")

 			childShutdownCh <- struct{}{}
 			childShutdownCh <- struct{}{}
@@ -329,7 +329,7 @@ func (c *Command) Run(args []string) int {
 			shutdownTriggered = true

 		case <-c.SighupCh:
-			c.UI.Output("==> Watchtower dev environment reload triggered")
+			c.UI.Output("==> Boundary dev environment reload triggered")
 			for _, v := range c.childSighupCh {
 				v <- struct{}{}
 			}
@@ -2,7 +2,7 @@

 package dev

-import "github.com/hashicorp/watchtower/internal/cmd/base"
+import "github.com/hashicorp/boundary/internal/cmd/base"

 func init() {
 	devOnlyControllerFlags = addDevOnlyControllerFlags
@@ -12,7 +12,7 @@ func addDevOnlyControllerFlags(c *Command, f *base.FlagSet) {
 	f.StringVar(&base.StringVar{
 		Name:   "dev-passthrough-directory",
 		Target: &c.flagDevPassthroughDirectory,
-		EnvVar: "WATCHTOWER_DEV_PASSTHROUGH_DIRECTORY",
+		EnvVar: "BOUNDARY_DEV_PASSTHROUGH_DIRECTORY",
 		Usage:  "Enables a passthrough directory in the webserver at /",
 	})
 }
@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"strings"

-	"github.com/hashicorp/watchtower/api/hosts"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
+	"github.com/hashicorp/boundary/api/hosts"
+	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/kr/pretty"
 	"github.com/mitchellh/cli"
 	"github.com/posener/complete"
@@ -29,14 +29,14 @@ func (c *CreateCommand) Synopsis() string {

 func (c *CreateCommand) Help() string {
 	helpText := `
-Usage: watchtower hosts create
+Usage: boundary hosts create

  Creates a host in the given host catalog. This command will result in an
  error for any catalog that does not support manual host creation.

  Example: 

-      $ watchtower hosts create -catalog-id=<id> -address=<addr> -name=<name>
+      $ boundary hosts create -catalog-id=<id> -address=<addr> -name=<name>

 ` + c.Flags().Help()

@@ -6,16 +6,16 @@ import (
 	"strings"
 	"time"

-	"github.com/hashicorp/watchtower/api/roles"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
+	"github.com/hashicorp/boundary/api/roles"
+	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/mitchellh/go-wordwrap"
 )

 func synopsisFunc(inFunc string) string {
 	if inFunc == "" {
-		return wordwrap.WrapString("Manage Watchtower roles", base.TermWidth)
+		return wordwrap.WrapString("Manage Boundary roles", base.TermWidth)
 	}
-	return wordwrap.WrapString(fmt.Sprintf("%s a role within Watchtower", textproto.CanonicalMIMEHeaderKey(inFunc)), base.TermWidth)
+	return wordwrap.WrapString(fmt.Sprintf("%s a role within Boundary", textproto.CanonicalMIMEHeaderKey(inFunc)), base.TermWidth)
 }

 func principalsGrantsSynopsisFunc(inFunc string, principals bool) string {
@@ -32,22 +32,22 @@ func principalsGrantsSynopsisFunc(inFunc string, principals bool) string {
 	case strings.HasPrefix(inFunc, "remove"):
 		in = fmt.Sprintf("Remove %s from", switchStr)
 	}
-	return wordwrap.WrapString(fmt.Sprintf("%s a role within Watchtower", in), base.TermWidth)
+	return wordwrap.WrapString(fmt.Sprintf("%s a role within Boundary", in), base.TermWidth)
 }

 func baseHelp() string {
 	return base.WrapForHelpText([]string{
-		"Usage: watchtower roles [sub command] [options] [args]",
+		"Usage: boundary roles [sub command] [options] [args]",
 		"",
-		"  This command allows operations on Watchtower roles. Examples:",
+		"  This command allows operations on Boundary roles. Examples:",
 		"",
 		"    Create a role:",
 		"",
-		`      $ watchtower roles create -name foo -description "For ProdOps usage"`,
+		`      $ boundary roles create -name foo -description "For ProdOps usage"`,
 		"",
 		"    Add a grant to a role:",
 		"",
-		`      $ watchtower roles add-grants -id r_1234567890 -grant "type=host-catalog;actions=create,delete"`,
+		`      $ boundary roles add-grants -id r_1234567890 -grant "type=host-catalog;actions=create,delete"`,
 		"",
 		"  Please see the role subcommand help for detailed usage information.",
 	})
@@ -55,11 +55,11 @@ func baseHelp() string {

 func createHelp() string {
 	return base.WrapForHelpText([]string{
-		"Usage: watchtower roles create [options] [args]",
+		"Usage: boundary roles create [options] [args]",
 		"",
 		"  Create a role. Example:",
 		"",
-		`    $ watchtower roles create -name ops -description "Role for ops grants"`,
+		`    $ boundary roles create -name ops -description "Role for ops grants"`,
 		"",
 		"",
 	})
@@ -67,71 +67,71 @@ func createHelp() string {

 func updateHelp() string {
 	return base.WrapForHelpText([]string{
-		"Usage: watchtower roles update [options] [args]",
+		"Usage: boundary roles update [options] [args]",
 		"",
 		"  Update a role given its ID. Example:",
 		"",
-		`    $ watchtower roles update -id r_1234567890 -description "Development host grants"`,
+		`    $ boundary roles update -id r_1234567890 -description "Development host grants"`,
 	})
 }

 func readHelp() string {
 	return base.WrapForHelpText([]string{
-		"Usage: watchtower roles read [options] [args]",
+		"Usage: boundary roles read [options] [args]",
 		"",
 		"  Read a role given its ID. Example:",
 		"",
-		`    $ watchtower roles read -id r_1234567890`,
+		`    $ boundary roles read -id r_1234567890`,
 	})
 }

 func deleteHelp() string {
 	return base.WrapForHelpText([]string{
-		"Usage: watchtower roles delete [options] [args]",
+		"Usage: boundary roles delete [options] [args]",
 		"",
 		"  Delete a role given its ID. Example:",
 		"",
-		`    $ watchtower roles delete -id r_1234567890`,
+		`    $ boundary roles delete -id r_1234567890`,
 	})
 }

 func listHelp() string {
 	return base.WrapForHelpText([]string{
-		"Usage: watchtower roles list [options] [args]",
+		"Usage: boundary roles list [options] [args]",
 		"",
 		"  List roles within a scope. Example:",
 		"",
-		`    $ watchtower roles list -org o_1234567890`,
+		`    $ boundary roles list -org o_1234567890`,
 	})
 }

 func addPrincipalsHelp() string {
 	return base.WrapForHelpText([]string{
-		"Usage: watchtower roles add-principals [options] [args]",
+		"Usage: boundary roles add-principals [options] [args]",
 		"",
 		`  Adds principals (users, groups) to a role given its ID. The "user" and "group" flags can be specified multiple times. Example:`,
 		"",
-		`    $ watchtower roles add-principals -id r_1234567890 -user u_1234567890`,
+		`    $ boundary roles add-principals -id r_1234567890 -user u_1234567890`,
 	})
 }

 func setPrincipalsHelp() string {
 	return base.WrapForHelpText([]string{
-		"Usage: watchtower roles set-principals [options] [args]",
+		"Usage: boundary roles set-principals [options] [args]",
 		"",
 		`  Sets the complete set of principals (users, groups) on a role given its ID. The "user" and "group" flags can be specified multiple times. Example:`,
 		"",
-		`    $ watchtower roles set-principals -id r_1234567890 -user u_anon -group sg_1234567890`,
+		`    $ boundary roles set-principals -id r_1234567890 -user u_anon -group sg_1234567890`,
 	})
 }

 func removePrincipalsHelp() string {
 	return base.WrapForHelpText([]string{
-		"Usage: watchtower roles remove-principals [options] [args]",
+		"Usage: boundary roles remove-principals [options] [args]",
 		"",
 		`  Removes principals (users, groups) from a role given its ID. The "user" and "group" flags can be specified multiple times. Example:`,
 		"",
-		`    $ watchtower roles remove-principals -id r_1234567890 -group sg_1234567890`,
+		`    $ boundary roles remove-principals -id r_1234567890 -group sg_1234567890`,
 	})
 }

@@ -3,11 +3,11 @@ package roles
 import (
 	"fmt"

+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/roles"
+	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/vault/sdk/helper/strutil"
-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/api/roles"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
-	"github.com/hashicorp/watchtower/internal/perms"
 	"github.com/kr/pretty"
 	"github.com/mitchellh/cli"
 	"github.com/posener/complete"
@@ -39,7 +39,7 @@ func (c *Command) Synopsis() string {
 	case "add-grants", "set-grants", "remove-grants":
 		return principalsGrantsSynopsisFunc(c.Func, false)
 	}
-	return "Manage Watchtower roles"
+	return "Manage Boundary roles"
 }

 var helpMap = map[string]func() string{
@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"strings"

-	"github.com/hashicorp/watchtower/api/scopes"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/kr/pretty"
 	"github.com/mitchellh/cli"
 	"github.com/posener/complete"
@@ -27,14 +27,14 @@ func (c *CreateScopeCommand) Synopsis() string {

 func (c *CreateScopeCommand) Help() string {
 	helpText := `
-Usage: watchtower scopes create
+Usage: boundary scopes create

  Creates a new scope within the scope specified by the ID from the
  "scope" parameter or the associated environment variable.

  Example: 

-      $ watchtower scopes create -scope=<scope_id> -name=<name>
+      $ boundary scopes create -scope=<scope_id> -name=<name>

 ` + c.Flags().Help()

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"time"

-	"github.com/hashicorp/watchtower/api/scopes"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/internal/cmd/base"
 )

 func printScope(in *scopes.Scope) string {
@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"strings"

-	"github.com/hashicorp/watchtower/api/scopes"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/kr/pretty"
 	"github.com/mitchellh/cli"
 	"github.com/posener/complete"
@@ -26,13 +26,13 @@ func (c *ReadScopeCommand) Synopsis() string {

 func (c *ReadScopeCommand) Help() string {
 	helpText := `
-Usage: watchtower scopes read 
+Usage: boundary scopes read 

  Returns information about a scope specified by the ID. The request will take place within the scope of the caller's authentication token.

  Example: 

-      $ watchtower scopes read -id=<scope_id>
+      $ boundary scopes read -id=<scope_id>

 ` + c.Flags().Help()

@@ -6,13 +6,13 @@ import (
 	"strings"
 	"sync"

+	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/cmd/config"
+	"github.com/hashicorp/boundary/internal/servers/worker"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/sdk/helper/mlock"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
-	"github.com/hashicorp/watchtower/internal/cmd/config"
-	"github.com/hashicorp/watchtower/internal/servers/worker"
 	"github.com/mitchellh/cli"
 	"github.com/posener/complete"
 )
@@ -44,16 +44,16 @@ type Command struct {
 }

 func (c *Command) Synopsis() string {
-	return "Start a Watchtower worker"
+	return "Start a Boundary worker"
 }

 func (c *Command) Help() string {
 	helpText := `
-Usage: watchtower worker [options]
+Usage: boundary worker [options]

  Start a worker with a configuration file:

-      $ watchtower worker -config=/etc/watchtower/worker.hcl
+      $ boundary worker -config=/etc/boundary/worker.hcl

  For a full list of examples, please see the documentation.

@@ -80,7 +80,7 @@ func (c *Command) Flags() *base.FlagSets {
 		Name:       "log-level",
 		Target:     &c.flagLogLevel,
 		Default:    base.NotSetValue,
-		EnvVar:     "WATCHTOWER_LOG_LEVEL",
+		EnvVar:     "BOUNDARY_LOG_LEVEL",
 		Completion: complete.PredictSet("trace", "debug", "info", "warn", "err"),
 		Usage: "Log verbosity level. Supported values (in order of more detail to less) are " +
 			"\"trace\", \"debug\", \"info\", \"warn\", and \"err\".",
@@ -106,7 +106,7 @@ func (c *Command) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:   "dev-listen-address",
 		Target: &c.flagDevWorkerListenAddr,
-		EnvVar: "WATCHTOWER_DEV_WORKER_LISTEN_ADDRESS",
+		EnvVar: "BOUNDARY_DEV_WORKER_LISTEN_ADDRESS",
 		Usage:  "Address to bind the worker to in \"dev\" mode.",
 	})

@@ -157,14 +157,14 @@ func (c *Command) Run(args []string) int {
 	}

 	// If mlockall(2) isn't supported, show a warning. We disable this in dev
-	// because it is quite scary to see when first using Watchtower. We also disable
+	// because it is quite scary to see when first using Boundary. We also disable
 	// this if the user has explicitly disabled mlock in configuration.
 	if !c.flagDev && !c.Config.DisableMlock && !mlock.Supported() {
 		c.UI.Warn(base.WrapAtLength(
 			"WARNING! mlock is not supported on this system! An mlockall(2)-like " +
 				"syscall to prevent memory from being swapped to disk is not " +
-				"supported on this system. For better security, only run Watchtower on " +
-				"systems where this call is supported. If you are running Watchtower" +
+				"supported on this system. For better security, only run Boundary on " +
+				"systems where this call is supported. If you are running Boundary" +
 				"in a Docker container, provide the IPC_LOCK cap to the container."))
 	}

@@ -287,7 +287,7 @@ func (c *Command) WaitForInterrupt() int {
 	for !shutdownTriggered {
 		select {
 		case <-shutdownCh:
-			c.UI.Output("==> Watchtower worker shutdown triggered")
+			c.UI.Output("==> Boundary worker shutdown triggered")

 			if err := c.worker.Shutdown(); err != nil {
 				c.UI.Error(fmt.Errorf("Error with worker shutdown: %w", err).Error())
@@ -296,7 +296,7 @@ func (c *Command) WaitForInterrupt() int {
 			shutdownTriggered = true

 		case <-c.SighupCh:
-			c.UI.Output("==> Watchtower worker reload triggered")
+			c.UI.Output("==> Boundary worker reload triggered")

 			// Check for new log level
 			var level hclog.Level
@@ -69,7 +69,7 @@ worker {
 `
 )

-// Config is the configuration for the watchtower controller
+// Config is the configuration for the boundary controller
 type Config struct {
 	*configutil.SharedConfig `hcl:"-"`

@@ -85,7 +85,7 @@ type Worker struct {
 	Controllers []string `hcl:"controllers"`
 }

-// DevWorker is a Config that is used for dev mode of Watchtower
+// DevWorker is a Config that is used for dev mode of Boundary
 // workers
 func DevWorker() (*Config, error) {
 	parsed, err := Parse(devConfig + devWorkerExtraConfig)
@@ -112,7 +112,7 @@ func devKeyGeneration() (string, string) {
 	return controllerKey, workerAuthKey
 }

-// DevController is a Config that is used for dev mode of Watchtower
+// DevController is a Config that is used for dev mode of Boundary
 // controllers
 func DevController() (*Config, error) {
 	controllerKey, workerAuthKey := devKeyGeneration()
@@ -12,8 +12,8 @@ import (
 	"text/tabwriter"

 	"github.com/fatih/color"
-	"github.com/hashicorp/watchtower/api"
-	"github.com/hashicorp/watchtower/internal/cmd/base"
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/internal/cmd/base"
 	colorable "github.com/mattn/go-colorable"
 	"github.com/mitchellh/cli"
 )
@@ -57,10 +57,10 @@ func setupEnv(args []string) (retArgs []string, format string, outputCurlString
 		}
 	}

-	envWatchtowerCLIFormat := os.Getenv(base.EnvWatchtowerCLIFormat)
+	envBoundaryCLIFormat := os.Getenv(base.EnvBoundaryCLIFormat)
 	// If we did not parse a value, fetch the env var
-	if format == "" && envWatchtowerCLIFormat != "" {
-		format = envWatchtowerCLIFormat
+	if format == "" && envBoundaryCLIFormat != "" {
+		format = envBoundaryCLIFormat
 	}
 	// Lowercase for consistency
 	format = strings.ToLower(format)
@@ -94,7 +94,7 @@ func RunCustom(args []string, runOpts *RunOptions) int {

 	// Don't use color if disabled
 	useColor := true
-	if os.Getenv(base.EnvWatchtowerCLINoColor) != "" || color.NoColor {
+	if os.Getenv(base.EnvBoundaryCLINoColor) != "" || color.NoColor {
 		useColor = false
 	}

@@ -123,7 +123,7 @@ func RunCustom(args []string, runOpts *RunOptions) int {
 		uiErrWriter = ioutil.Discard
 	}

-	ui := &base.WatchtowerUI{
+	ui := &base.BoundaryUI{
 		Ui: &cli.ColoredUi{
 			ErrorColor: cli.UiColorRed,
 			WarnColor:  cli.UiColorYellow,
@@ -136,7 +136,7 @@ func RunCustom(args []string, runOpts *RunOptions) int {
 		Format: format,
 	}

-	serverCmdUi := &base.WatchtowerUI{
+	serverCmdUi := &base.BoundaryUI{
 		Ui: &cli.ColoredUi{
 			ErrorColor: cli.UiColorRed,
 			WarnColor:  cli.UiColorYellow,
@@ -158,11 +158,11 @@ func RunCustom(args []string, runOpts *RunOptions) int {
 	hiddenCommands := []string{"version"}

 	cli := &cli.CLI{
-		Name:     "watchtower",
+		Name:     "boundary",
 		Args:     args,
 		Commands: Commands,
 		HelpFunc: groupedHelpFunc(
-			cli.BasicHelpFunc("watchtower"),
+			cli.BasicHelpFunc("boundary"),
 		),
 		HelpWriter:                 runOpts.Stderr,
 		HiddenCommands:             hiddenCommands,
@@ -206,7 +206,7 @@ func groupedHelpFunc(f cli.HelpFunc) cli.HelpFunc {
 		var b bytes.Buffer
 		tw := tabwriter.NewWriter(&b, 0, 2, 6, ' ', 0)

-		fmt.Fprintf(tw, "Usage: watchtower <command> [args]\n\n")
+		fmt.Fprintf(tw, "Usage: boundary <command> [args]\n\n")
 		fmt.Fprintf(tw, "Common commands:\n")
 		for _, v := range commonCommands {
 			printCommand(tw, v, commands[v])
@@ -3,8 +3,8 @@ package dbassert
 import (
 	dbassert "github.com/hashicorp/dbassert"

+	"github.com/hashicorp/boundary/internal/db"
 	gormAssert "github.com/hashicorp/dbassert/gorm"
-	"github.com/hashicorp/watchtower/internal/db"
 	"github.com/stretchr/testify/assert"
 )

@@ -6,7 +6,7 @@ import (
 	dbassert "github.com/hashicorp/dbassert"
 	gormAssert "github.com/hashicorp/dbassert/gorm"

-	"github.com/hashicorp/watchtower/internal/db"
+	"github.com/hashicorp/boundary/internal/db"
 	"github.com/jinzhu/gorm"
 	"github.com/stretchr/testify/assert"
 )
@@ -1,4 +1,4 @@
-// Package dbassert provides a set of assertions for testing the watchtower database
+// Package dbassert provides a set of assertions for testing the boundary database
 // applications.
 //
 // Example Usage:
@@ -3,9 +3,9 @@ package common
 import (
 	"testing"

+	"github.com/hashicorp/boundary/internal/db/db_test"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/sdk/helper/base62"
-	"github.com/hashicorp/watchtower/internal/db/db_test"
 	"github.com/jinzhu/gorm"
 	"github.com/stretchr/testify/assert"
 )
@@ -8,9 +8,9 @@ import (
 	"strings"

 	"github.com/golang-migrate/migrate/v4"
+	"github.com/hashicorp/boundary/internal/db/migrations"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-multierror"
-	"github.com/hashicorp/watchtower/internal/db/migrations"
 	"github.com/jinzhu/gorm"
 	"github.com/lib/pq"
 	"github.com/ory/dockertest/v3"
@@ -91,7 +91,7 @@ func StartDbInDocker(dialect string) (cleanup func() error, retURL, container st
 	var url string
 	switch dialect {
 	case "postgres":
-		resource, err = pool.Run("postgres", "latest", []string{"POSTGRES_PASSWORD=secret", "POSTGRES_DB=watchtower"})
+		resource, err = pool.Run("postgres", "latest", []string{"POSTGRES_PASSWORD=secret", "POSTGRES_DB=boundary"})
 		url = "postgres://postgres:secret@localhost:%s?sslmode=disable"
 	default:
 		panic(fmt.Sprintf("unknown dialect %q", dialect))