Add controller-led worker auth flow (#2413)

This adds an action to the API that allows pulling out an activation
token that can be given to a worker in its config (directly or via env
or file). The worker can pass this along with its normal request in
place of its normal nonce and the server will automatically accept it.

Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>

internal/gen/controller/api/services/worker_service_grpc.pb.go

@@ -28,12 +28,20 @@ type WorkerServiceClient interface {
 	// If the scope ID is missing, malformed, or reference a non existing scope,
 	// an error is returned.
 	ListWorkers(ctx context.Context, in *ListWorkersRequest, opts ...grpc.CallOption) (*ListWorkersResponse, error)
-	// CreateWorkerLed creates and stores a Worker in boundary.  The provided
-	// request must include the Scope id in which the Worker will be created.
-	// If the Scope id is missing, malformed or references a non existing
-	// resource, an error is returned.  If a name is provided that is in
-	// use in another Worker in the same scope, an error is returned.
+	// CreateWorkerLed creates and stores a Worker in Boundary. The provided
+	// request must include the Scope ID in which the Worker will be created. If
+	// the Scope ID is missing, malformed or references a non existing resource,
+	// an error is returned. If a name is provided that is in use in another
+	// Worker in the same scope, an error is returned.
 	CreateWorkerLed(ctx context.Context, in *CreateWorkerLedRequest, opts ...grpc.CallOption) (*CreateWorkerLedResponse, error)
+	// CreateControllerLed creates and stores a Worker in Boundary and returns an
+	// activation token that can be used by a worker binary to claim the created
+	// Worker's identity. The provided request must include the Scope ID in which
+	// the Worker will be created. If the Scope ID is missing, malformed or
+	// references a non existing resource, an error is returned. If a name is
+	// provided that is in use in another Worker in the same scope, an error is
+	// returned.
+	CreateControllerLed(ctx context.Context, in *CreateControllerLedRequest, opts ...grpc.CallOption) (*CreateControllerLedResponse, error)
 	// UpdateWorker updates an existing Worker in boundary.  The provided
 	// Worker must not have any read only fields set.  The update mask must be
 	// included in the request and contain at least 1 mutable field.  To unset
@@ -93,6 +101,15 @@ func (c *workerServiceClient) CreateWorkerLed(ctx context.Context, in *CreateWor
 	return out, nil
 }
 
+func (c *workerServiceClient) CreateControllerLed(ctx context.Context, in *CreateControllerLedRequest, opts ...grpc.CallOption) (*CreateControllerLedResponse, error) {
+	out := new(CreateControllerLedResponse)
+	err := c.cc.Invoke(ctx, "/controller.api.services.v1.WorkerService/CreateControllerLed", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *workerServiceClient) UpdateWorker(ctx context.Context, in *UpdateWorkerRequest, opts ...grpc.CallOption) (*UpdateWorkerResponse, error) {
 	out := new(UpdateWorkerResponse)
 	err := c.cc.Invoke(ctx, "/controller.api.services.v1.WorkerService/UpdateWorker", in, out, opts...)
@@ -152,12 +169,20 @@ type WorkerServiceServer interface {
 	// If the scope ID is missing, malformed, or reference a non existing scope,
 	// an error is returned.
 	ListWorkers(context.Context, *ListWorkersRequest) (*ListWorkersResponse, error)
-	// CreateWorkerLed creates and stores a Worker in boundary.  The provided
-	// request must include the Scope id in which the Worker will be created.
-	// If the Scope id is missing, malformed or references a non existing
-	// resource, an error is returned.  If a name is provided that is in
-	// use in another Worker in the same scope, an error is returned.
+	// CreateWorkerLed creates and stores a Worker in Boundary. The provided
+	// request must include the Scope ID in which the Worker will be created. If
+	// the Scope ID is missing, malformed or references a non existing resource,
+	// an error is returned. If a name is provided that is in use in another
+	// Worker in the same scope, an error is returned.
 	CreateWorkerLed(context.Context, *CreateWorkerLedRequest) (*CreateWorkerLedResponse, error)
+	// CreateControllerLed creates and stores a Worker in Boundary and returns an
+	// activation token that can be used by a worker binary to claim the created
+	// Worker's identity. The provided request must include the Scope ID in which
+	// the Worker will be created. If the Scope ID is missing, malformed or
+	// references a non existing resource, an error is returned. If a name is
+	// provided that is in use in another Worker in the same scope, an error is
+	// returned.
+	CreateControllerLed(context.Context, *CreateControllerLedRequest) (*CreateControllerLedResponse, error)
 	// UpdateWorker updates an existing Worker in boundary.  The provided
 	// Worker must not have any read only fields set.  The update mask must be
 	// included in the request and contain at least 1 mutable field.  To unset
@@ -196,6 +221,9 @@ func (UnimplementedWorkerServiceServer) ListWorkers(context.Context, *ListWorker
 func (UnimplementedWorkerServiceServer) CreateWorkerLed(context.Context, *CreateWorkerLedRequest) (*CreateWorkerLedResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateWorkerLed not implemented")
 }
+func (UnimplementedWorkerServiceServer) CreateControllerLed(context.Context, *CreateControllerLedRequest) (*CreateControllerLedResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateControllerLed not implemented")
+}
 func (UnimplementedWorkerServiceServer) UpdateWorker(context.Context, *UpdateWorkerRequest) (*UpdateWorkerResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateWorker not implemented")
 }
@@ -278,6 +306,24 @@ func _WorkerService_CreateWorkerLed_Handler(srv interface{}, ctx context.Context
 	return interceptor(ctx, in, info, handler)
 }
 
+func _WorkerService_CreateControllerLed_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateControllerLedRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(WorkerServiceServer).CreateControllerLed(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/controller.api.services.v1.WorkerService/CreateControllerLed",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(WorkerServiceServer).CreateControllerLed(ctx, req.(*CreateControllerLedRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _WorkerService_UpdateWorker_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(UpdateWorkerRequest)
 	if err := dec(in); err != nil {
@@ -387,6 +433,10 @@ var WorkerService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "CreateWorkerLed",
 			Handler:    _WorkerService_CreateWorkerLed_Handler,
 		},
+		{
+			MethodName: "CreateControllerLed",
+			Handler:    _WorkerService_CreateControllerLed_Handler,
+		},
 		{
 			MethodName: "UpdateWorker",
 			Handler:    _WorkerService_UpdateWorker_Handler,