Add controller-led worker auth flow (#2413)

This adds an action to the API that allows pulling out an activation
token that can be given to a worker in its config (directly or via env
or file). The worker can pass this along with its normal request in
place of its normal nonce and the server will automatically accept it.

Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>

internal/proto/controller/api/resources/workers/v1/worker.proto

@@ -72,6 +72,10 @@ message Worker {
   // https://github.com/hashicorp/nodeenrollment
   google.protobuf.StringValue worker_generated_auth_token = 150 [json_name = "worker_generated_auth_token"]; // @gotags: `class:"public"`
 
+  // Output only. An activation token that can be given to a worker to correlate
+  // it to the created resource.
+  google.protobuf.StringValue controller_generated_activation_token = 151 [json_name = "controller_generated_activation_token"]; // @gotags: `class:"secret"`
+
   // Output only. The number of connections that this worker is currently handling.
   google.protobuf.UInt32Value active_connection_count = 160 [json_name = "active_connection_count"]; // @gotags: `class:"public"`
 

internal/proto/controller/api/services/v1/worker_service.proto

@@ -38,11 +38,11 @@ service WorkerService {
     };
   }
 
-  // CreateWorkerLed creates and stores a Worker in boundary.  The provided
-  // request must include the Scope id in which the Worker will be created.
-  // If the Scope id is missing, malformed or references a non existing
-  // resource, an error is returned.  If a name is provided that is in
-  // use in another Worker in the same scope, an error is returned.
+  // CreateWorkerLed creates and stores a Worker in Boundary. The provided
+  // request must include the Scope ID in which the Worker will be created. If
+  // the Scope ID is missing, malformed or references a non existing resource,
+  // an error is returned. If a name is provided that is in use in another
+  // Worker in the same scope, an error is returned.
   rpc CreateWorkerLed(CreateWorkerLedRequest) returns (CreateWorkerLedResponse) {
     option (google.api.http) = {
       post: "/v1/workers:create:worker-led"
@@ -54,6 +54,24 @@ service WorkerService {
     };
   }
 
+  // CreateControllerLed creates and stores a Worker in Boundary and returns an
+  // activation token that can be used by a worker binary to claim the created
+  // Worker's identity. The provided request must include the Scope ID in which
+  // the Worker will be created. If the Scope ID is missing, malformed or
+  // references a non existing resource, an error is returned. If a name is
+  // provided that is in use in another Worker in the same scope, an error is
+  // returned.
+  rpc CreateControllerLed(CreateControllerLedRequest) returns (CreateControllerLedResponse) {
+    option (google.api.http) = {
+      post: "/v1/workers:create:controller-led"
+      body: "item"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Creates a single Worker."
+    };
+  }
+
   // UpdateWorker updates an existing Worker in boundary.  The provided
   // Worker must not have any read only fields set.  The update mask must be
   // included in the request and contain at least 1 mutable field.  To unset
@@ -152,6 +170,15 @@ message CreateWorkerLedResponse {
   resources.workers.v1.Worker item = 2;
 }
 
+message CreateControllerLedRequest {
+  resources.workers.v1.Worker item = 1;
+}
+
+message CreateControllerLedResponse {
+  string uri = 1; // @gotags: `class:"public"`
+  resources.workers.v1.Worker item = 2;
+}
+
 message UpdateWorkerRequest {
   string id = 1; // @gotags: `class:"public"`
   resources.workers.v1.Worker item = 2;