Boundary, Run To The Controller's Door Twice
boundary on EL 10 from releases.hashicorp.com; SHA256SUMS is signature-checked against HashiCorp's key before get_url trusts it, the live test re-checks both, then runs authenticate against a dead address ('connection refused') and database init with a throwaway config (parsed, root key loaded, then the database refused). Pinned. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-21 · podman 4.9.3 · ansible 2.21.4 · how we verify
Documentation
boundary
HashiCorp boundary on EL 10 from the vendor's release, checked against the
published SHA-256 and the vendor's signature on it, pinned to a version, installed as root's binary
in /usr/local/bin. Original role for EL 10, live-tested with podman on
Rocky Linux 10.
No package worth the name. EL 10 carries no boundary, and a
third-party repository is one more key to trust. This role takes the
release from releases.hashicorp.com, has Ansible's get_url refuse the asset unless
its SHA-256 is the published one, and the live test checks the asset on
disk against the same published value again.
The checksum file is signed, and the signature is checked first. HashiCorp Security
signs boundary_0.21.3_SHA256SUMS; the role ships HashiCorp Security's public key
(C874 011F 0AB4 0511 0D02 1055 3436 5D94 72D7 468F), imports it into a GnuPG home of its own under
/usr/local/src, asserts that fingerprint, and verifies the signature
before get_url is allowed to trust the file. The live test re-verifies
the signature and asserts the home holds exactly the expected key(s).
Pinned. boundary_version is what gets installed, kept in a directory
of its own so the checksum file and the asset it names stay together. A
newer release is a variable change and a run; the same version is
changed=0.
Proven to run. The live test runs boundary authenticate password -addr http://127.0.0.1:1 -auth-method-id ampw_1234567890 -login-name probe -password env://BOUNDARY_PROBE_PW and expects
"connect: connection refused" - the binary ran all the way to the point where it
needed something this host does not have.
Run to the controller's door, twice. Boundary brokers sessions to
targets through a controller the lane does not have. The live test runs
boundary authenticate password against a dead address (the client built
its request and stopped at "connection refused") and boundary database init with a throwaway controller config (the config parsed, the AEAD
root key loaded, then "Unable to connect to the database"). The same
binary runs a controller or worker; this role installs it and configures
nothing - a controller needs PostgreSQL and real KMS keys.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-authelia
Authelia from the upstream release (sha256-verified) as a hardened system service on loopback with file users and sqlite; its secrets are generated once on the host and reach the service as AUTHELIA_*_FILE variables. The live test hashes a password with Authelia's hasher, logs in, sees a wrong password refused and an anonymous visitor sent to the portal. Original role, live-tested on Rocky 10.
ansible-bandit
bandit on EL 10 from PyPI into a venv of its own with a link in the PATH; the live test runs pip check, then scans a module that passes a string to subprocess.call with shell=True (B602, High, exit 1) and a clean module (exit 0). Pinned. Original role, live-tested on Rocky Linux 10.
ansible-base-hardening
SSH hardening drop-in, sysctl security profile, login banner, and time sync. Original, live-tested (Molecule) role.
ansible-dockle
dockle on EL 10 from the GitHub release; get_url refuses it unless its SHA-256 is in the vendor's checksums file, and the live test re-checks it, then scans a one-layer image whose config names no user, expecting CIS-DI-0001 in the output, exit code 1 with --exit-level warn, and the warning counted in the JSON form. Pinned. Original role, live-tested on Rocky Linux 10.
ansible-gitleaks
gitleaks on EL 10 from the GitHub release, refused by Ansible's get_url unless its SHA-256 is the one in the project's checksums file, and re-checked with sha256sum -c by the live test, which then plants a file holding an AWS access key that is not one and runs gitleaks detect over it, expecting 'leaks found: 1'. Original role, live-tested on Rocky Linux 10.
ansible-grype
grype on EL 10 from the GitHub release, refused by Ansible's get_url unless its SHA-256 is the one in Anchore's checksums file, and re-checked with sha256sum -c by the live test, which then runs grype db status with no database fetched and expects 'database does not exist'. Anchore also signs the checksums with cosign; the role checks the hash. Original role, live-tested on Rocky Linux 10.