I’ve been quietly reading through the Boundary and Vault discussions here for a while, especially the technical deep-dives on extending them. Last month, I finally had a reason to build a custom controller plugin for Boundary in a test environment, integrating it with our internal customer success tooling for access reviews.
The goal was to automatically suspend Boundary sessions and targets based on signals from our support platform—like if a CSM leaves the company or a client contract is put on hold. The documentation on plugin development is decent, but the actual path to a working, deployable plugin had some sharp edges I wasn’t expecting.
The biggest hurdle was the plugin’s configuration lifecycle. Getting the controller to correctly parse and validate my custom attributes, and then persist that state, took more iteration than I thought. I also underestimated the need for robust error handling within the plugin’s gRPC service; a silent failure in one of my health check calls caused the controller to mark the plugin as unhealthy without clear logging on my end.
Has anyone else built a custom controller plugin for a similar purpose—tying Boundary events to external B2B systems? I’m particularly curious about how you handled testing the plugin outside of a full Boundary deployment, and whether you found a good pattern for managing secrets the plugin itself needs (like API keys for the external system). I used Vault’s dynamic secrets for the plugin’s database connection, but the authentication flow for the external service API felt clunky.