86 lines
2.0 KiB
Plaintext
86 lines
2.0 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: PKI Worker Configuration
|
|
description: |-
|
|
PKI worker-specific parameters.
|
|
---
|
|
|
|
|
|
## PKI Worker Configuration
|
|
PKI Workers authenticate to Boundary using a certificate-based method, allowing
|
|
for worker deployment without using a shared KMS.
|
|
|
|
PKI Workers require an accessible directory defined by `auth_storage_path` for
|
|
credential storage.
|
|
|
|
Example (not safe for production!):
|
|
|
|
```hcl
|
|
worker {
|
|
auth_storage_path="/boundary/demo-worker-1"
|
|
initial_upstreams = ["10.0.0.1"]
|
|
}
|
|
```
|
|
|
|
## KMS Configuration
|
|
PKI Workers credentials can be encrypted by including an optional KMS stanza with the purpose `worker-auth-storage`.
|
|
|
|
Example (not safe for production!):
|
|
```hcl
|
|
kms "aead" {
|
|
purpose = "worker-auth-storage"
|
|
aead_type = "aes-gcm"
|
|
key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
|
|
key_id = "worker-auth-storage"
|
|
}
|
|
```
|
|
|
|
~> **Note:** `name` and `description` fields are not valid config fields for PKI
|
|
workers. These fields are only valid for [KMS Workers][]. `name` and
|
|
`description` can only be set for PKI workers through the API.
|
|
|
|
# Complete Configuration Example
|
|
|
|
```hcl
|
|
listener "tcp" {
|
|
purpose = "proxy"
|
|
tls_disable = true
|
|
address = "127.0.0.1"
|
|
}
|
|
|
|
worker {
|
|
# Path for worker storage. Must be unique across workers
|
|
auth_storage_path="/boundary/demo-worker-1"
|
|
|
|
# Workers typically need to reach upstreams on :9201
|
|
initial_upstreams = [
|
|
"10.0.0.1",
|
|
"10.0.0.2",
|
|
"10.0.0.3",
|
|
]
|
|
|
|
public_addr = "myhost.mycompany.com"
|
|
|
|
tags {
|
|
type = ["prod", "webservers"]
|
|
region = ["us-east-1"]
|
|
}
|
|
}
|
|
|
|
# The following KMS config is an example only
|
|
# Use a production KMS such as AWS KMS for production installs
|
|
kms "aead" {
|
|
purpose = "worker-auth-storage"
|
|
aead_type = "aes-gcm"
|
|
key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
|
|
key_id = "worker-auth-storage"
|
|
}
|
|
|
|
|
|
```
|
|
[kms workers]: /docs/configuration/worker/kms-worker
|
|
|
|
## Tutorial
|
|
|
|
Refer to the [Self-Managed Worker Registration with HCP Boundary](https://learn.hashicorp.com/tutorials/boundary/hcp-manage-workers) tutorial to learn how to register and manage PKI workers.
|