Air-gapped deployment of HashiCorp Boundary is a different kind of challenge. You’re isolating sensitive systems from all outside networks, but you still need secure, role-based access to infrastructure. Boundary was built for this, yet making it work without any external connectivity requires precision.
First, you need to control every dependency yourself. No automatic fetches, no remote service calls. That means downloading, verifying, and packaging Boundary binaries ahead of time. Store them in a trusted internal artifact repository. Everything must come from sources you’ve reviewed and approved.
Next, configure your controllers and workers for a fully internal network. In air-gapped mode, you cannot rely on public CA services. Set up your own certificate authority, distribute the internal root CA to every Boundary node, and ensure TLS termination is intact from the start.
For authentication, choose a strategy that doesn’t require cloud callbacks. That often means static credential stores, LDAP, or an internally hosted OIDC provider. Boundary’s flexibility here is key, but every provider must exist entirely within your network.