| name | mariadb |
| description | Deploy or remove the Boundary MariaDB target lab in hal. Use when the user asks for database target access through Boundary. |
Boundary Mariadb Workflow
Intent
Handle hal boundary mariadb requests with a stable lifecycle pattern, including optional Vault dynamic credential brokering.
Primary Command
Common Variants
- Deploy standalone DB target: hal boundary mariadb enable --mariadb-version 11.4
- Deploy and re-bootstrap from scratch: hal boundary mariadb update
- Attach Boundary target to Vault dynamic DB creds: hal boundary mariadb enable --mariadb-version 11.4 --with-vault
- Disable lab resources: hal boundary mariadb disable
Post-Deploy Access Guidance
- Always authenticate first:
- BOUNDARY_AUTHENTICATE_PASSWORD_PASSWORD=password boundary authenticate password -addr http://127.0.0.1:9200 -auth-method-id -login-name dba-user
- For this CLI version, prefer boundary connect (not boundary connect tcp).
- If using Vault brokering, prefer:
- If user wants a raw TCP tunnel:
- boundary connect -addr http://127.0.0.1:9200 -target-id -listen-port 13306
- mariadb -h 127.0.0.1 -P 13306 -u admin -ppassword targetdb
Validation
- Confirm command output and summarize the resulting lab state.
- If applicable, suggest the next expected command in the lifecycle.
- For with-vault flows, verify target includes brokered credential source IDs.
Edge Cases
- If prerequisites are missing, explain exactly what to install or start first.
- If resources are partially deployed, suggest update or cleanup path when supported.
- If user gets authorize-session or malformed identifier errors, verify command shape and current target ID.
- If Vault creds do not appear, verify the target has brokered credential source attachment.
- Prefer one-shot env assignment for password auth so no shell cleanup (unset) is needed.
