Remove deprecated methods/fields on targets (#2393)

CHANGELOG.md

@@ -6,12 +6,26 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ### New and Improved
 
-* Workers: Added the ability to read and reinitialize the Worker certificate
+* workers: Added the ability to read and reinitialize the Worker certificate
   authority ([PR1](https://github.com/hashicorp/boundary/pull/2312),
   [PR2](https://github.com/hashicorp/boundary/pull/2387))
-* Workers: Return the worker Boundary binary version on worker list and read
+* workers: Return the worker Boundary binary version on worker list and read
   ([PR](https://github.com/hashicorp/boundary/pull/2377))
 
+### Deprecations/Changes
+
+* In 0.5.0, the `add-host-sets`, `remove-host-sets`, and `set-host-sets` actions
+on targets were deprecated in favor of `add-host-sources`,
+`remove-host-sources`, and `set-host-sources`. Originally these actions and API
+calls were to be removed in 0.6, but this was delayed to give extra time for
+clients to switch over. This has now been fully switched over. A database
+migration will modify any grants in roles to have the new actions. This same
+changeover has been made for `add-/remove-/set-credential-libraries` to
+`add-/remove-/set-credential-sources`, although those actions would only be in
+grant strings in very rare circumstances as the `-sources` actions replaced the
+`-libraries` actions very quickly.
+([PR](https://github.com/hashicorp/boundary/pull/2393))
+
 ## 0.10.5 (2022/09/13)
 
 ### Bug Fixes
@@ -56,9 +70,6 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ### Bug Fixes
 
-* vault: Correctly handle Vault credential stores and libraries that are linked to an
-  expired Vault token. ([Issue](https://github.com/hashicorp/boundary/issues/2179),
-  [PR](https://github.com/hashicorp/boundary/pull/2399)).
 * aws host catalog: Fix an issue where the request to list hosts could timeout
   on a large number of hosts
   ([Issue](https://github.com/hashicorp/boundary/issues/2224),
@@ -84,12 +95,17 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
   ([PR](https://github.com/hashicorp/boundary/pull/2388))
 * workers: Add the ability to set API-based worker tags via the CLI
   ([PR](https://github.com/hashicorp/boundary/pull/2266))
+* vault: Correctly handle Vault credential stores and libraries that are linked
+  to an expired Vault token
+  ([Issue](https://github.com/hashicorp/boundary/issues/2179),
+  [PR](https://github.com/hashicorp/boundary/pull/2399))
 
 ## 0.10.3 (2022/08/30)
 
 ### Bug Fixes
 
-* db: Fix an issue with migrations failing due to not updating the project_id value for the host plugin set
+* db: Fix an issue with migrations failing due to not updating the project_id
+  value for the host plugin set
   ([Issue](https://github.com/hashicorp/boundary/issues/2349#issuecomment-1229953874),
   [PR](https://github.com/hashicorp/boundary/pull/2407)).
 
@@ -97,23 +113,25 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ### Security
 
-* Fix security vulnerability CVE-2022-36130, Boundary up to 0.10.1 did not properly perform  
-  authorization checks to ensure the resources were associated with the correct scopes,  
-  allowing potential privilege escalation for authorized users of another scope.
+* Fix security vulnerability CVE-2022-36130: Boundary up to 0.10.1 did not
+  properly perform data integrity checks to ensure that host-set and
+  credential-source resources being added to a target were associated with the
+  same scope as the target. This could allow privilege escalation via allowing a
+  user able to modify a target to provide connections to unintended hosts.
   [[HCSEC-2022-17](https://discuss.hashicorp.com/t/hcsec-2022017-boundary-allowed-access-to-host-sets-and-credential-sources-for-authorized-users-of-another-scope/43493)]
 
 ## 0.10.1 (2022/08/11)
 
 ### Bug Fixes
 
-* db: Fix an issue with migrations affecting clusters that contain 
-  credential libraries or static credentials.
-  ([Issue](https://github.com/hashicorp/boundary/issues/2349),
-  [PR](https://github.com/hashicorp/boundary/pull/2351)).
-* managed groups: Fix an issue where the `filter` field is not sent by
-  admin UI ([PR](https://github.com/hashicorp/boundary-ui/pull/1238)).
-* host sets: Fix an issue causing host sets to not display in UI when using the aws plugin 
-  ([PR](https://github.com/hashicorp/boundary-ui/pull/1251))
+* db: Fix an issue with migrations affecting clusters that contain credential
+  libraries or static credentials.
+  ([Issue](https://github.com/hashicorp/boundary/issues/2349)),
+  ([PR](https://github.com/hashicorp/boundary/pull/2351)).
+* managed groups: Fix an issue where the `filter` field is not sent by admin UI
+  ([PR](https://github.com/hashicorp/boundary-ui/pull/1238)).
+* host sets: Fix an issue causing host sets to not display in UI when using the
+  aws plugin ([PR](https://github.com/hashicorp/boundary-ui/pull/1251))
 * plugins: Fixes regression from 0.9.0 causing a failure to start when using
   multiple KMS blocks of the same type
   ([PR1](https://github.com/hashicorp/go-secure-stdlib/pull/43),

api/targets/host_set.gen.go

@@ -1,7 +0,0 @@
-// Code generated by "make api"; DO NOT EDIT.
-package targets
-
-type HostSet struct {
-	Id            string `json:"id,omitempty"`
-	HostCatalogId string `json:"host_catalog_id,omitempty"`
-}

api/targets/target.gen.go

@@ -22,8 +22,6 @@ type Target struct {
 	UpdatedTime                            time.Time              `json:"updated_time,omitempty"`
 	Version                                uint32                 `json:"version,omitempty"`
 	Type                                   string                 `json:"type,omitempty"`
-	HostSetIds                             []string               `json:"host_set_ids,omitempty"`
-	HostSets                               []*HostSet             `json:"host_sets,omitempty"`
 	HostSourceIds                          []string               `json:"host_source_ids,omitempty"`
 	HostSources                            []*HostSource          `json:"host_sources,omitempty"`
 	SessionMaxSeconds                      uint32                 `json:"session_max_seconds,omitempty"`
@@ -401,76 +399,6 @@ func (c *Client) AddCredentialSources(ctx context.Context, id string, version ui
 	return target, nil
 }
 
-func (c *Client) AddHostSets(ctx context.Context, id string, version uint32, hostSetIds []string, opt ...Option) (*TargetUpdateResult, error) {
-	if id == "" {
-		return nil, fmt.Errorf("empty id value passed into AddHostSets request")
-	}
-
-	if len(hostSetIds) == 0 {
-		return nil, errors.New("empty hostSetIds passed into AddHostSets request")
-	}
-
-	if c.client == nil {
-		return nil, errors.New("nil client")
-	}
-
-	opts, apiOpts := getOpts(opt...)
-
-	if version == 0 {
-		if !opts.withAutomaticVersioning {
-			return nil, errors.New("zero version number passed into AddHostSets request")
-		}
-		existingTarget, existingErr := c.Read(ctx, id, append([]Option{WithSkipCurlOutput(true)}, opt...)...)
-		if existingErr != nil {
-			if api.AsServerError(existingErr) != nil {
-				return nil, fmt.Errorf("error from controller when performing initial check-and-set read: %w", existingErr)
-			}
-			return nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
-		}
-		if existingTarget == nil {
-			return nil, errors.New("nil resource response found when performing initial check-and-set read")
-		}
-		if existingTarget.Item == nil {
-			return nil, errors.New("nil resource found when performing initial check-and-set read")
-		}
-		version = existingTarget.Item.Version
-	}
-
-	opts.postMap["version"] = version
-
-	opts.postMap["host_set_ids"] = hostSetIds
-
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-host-sets", url.PathEscape(id)), opts.postMap, apiOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("error creating AddHostSets request: %w", err)
-	}
-
-	if len(opts.queryMap) > 0 {
-		q := url.Values{}
-		for k, v := range opts.queryMap {
-			q.Add(k, v)
-		}
-		req.URL.RawQuery = q.Encode()
-	}
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("error performing client request during AddHostSets call: %w", err)
-	}
-
-	target := new(TargetUpdateResult)
-	target.Item = new(Target)
-	apiErr, err := resp.Decode(target.Item)
-	if err != nil {
-		return nil, fmt.Errorf("error decoding AddHostSets response: %w", err)
-	}
-	if apiErr != nil {
-		return nil, apiErr
-	}
-	target.response = resp
-	return target, nil
-}
-
 func (c *Client) AddHostSources(ctx context.Context, id string, version uint32, hostSourceIds []string, opt ...Option) (*TargetUpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into AddHostSources request")
@@ -605,72 +533,6 @@ func (c *Client) SetCredentialSources(ctx context.Context, id string, version ui
 	return target, nil
 }
 
-func (c *Client) SetHostSets(ctx context.Context, id string, version uint32, hostSetIds []string, opt ...Option) (*TargetUpdateResult, error) {
-	if id == "" {
-		return nil, fmt.Errorf("empty id value passed into SetHostSets request")
-	}
-
-	if c.client == nil {
-		return nil, errors.New("nil client")
-	}
-
-	opts, apiOpts := getOpts(opt...)
-
-	if version == 0 {
-		if !opts.withAutomaticVersioning {
-			return nil, errors.New("zero version number passed into SetHostSets request")
-		}
-		existingTarget, existingErr := c.Read(ctx, id, append([]Option{WithSkipCurlOutput(true)}, opt...)...)
-		if existingErr != nil {
-			if api.AsServerError(existingErr) != nil {
-				return nil, fmt.Errorf("error from controller when performing initial check-and-set read: %w", existingErr)
-			}
-			return nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
-		}
-		if existingTarget == nil {
-			return nil, errors.New("nil resource response found when performing initial check-and-set read")
-		}
-		if existingTarget.Item == nil {
-			return nil, errors.New("nil resource found when performing initial check-and-set read")
-		}
-		version = existingTarget.Item.Version
-	}
-
-	opts.postMap["version"] = version
-
-	opts.postMap["host_set_ids"] = hostSetIds
-
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-host-sets", url.PathEscape(id)), opts.postMap, apiOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("error creating SetHostSets request: %w", err)
-	}
-
-	if len(opts.queryMap) > 0 {
-		q := url.Values{}
-		for k, v := range opts.queryMap {
-			q.Add(k, v)
-		}
-		req.URL.RawQuery = q.Encode()
-	}
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("error performing client request during SetHostSets call: %w", err)
-	}
-
-	target := new(TargetUpdateResult)
-	target.Item = new(Target)
-	apiErr, err := resp.Decode(target.Item)
-	if err != nil {
-		return nil, fmt.Errorf("error decoding SetHostSets response: %w", err)
-	}
-	if apiErr != nil {
-		return nil, apiErr
-	}
-	target.response = resp
-	return target, nil
-}
-
 func (c *Client) SetHostSources(ctx context.Context, id string, version uint32, hostSourceIds []string, opt ...Option) (*TargetUpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into SetHostSources request")
@@ -801,76 +663,6 @@ func (c *Client) RemoveCredentialSources(ctx context.Context, id string, version
 	return target, nil
 }
 
-func (c *Client) RemoveHostSets(ctx context.Context, id string, version uint32, hostSetIds []string, opt ...Option) (*TargetUpdateResult, error) {
-	if id == "" {
-		return nil, fmt.Errorf("empty id value passed into RemoveHostSets request")
-	}
-
-	if len(hostSetIds) == 0 {
-		return nil, errors.New("empty hostSetIds passed into RemoveHostSets request")
-	}
-
-	if c.client == nil {
-		return nil, errors.New("nil client")
-	}
-
-	opts, apiOpts := getOpts(opt...)
-
-	if version == 0 {
-		if !opts.withAutomaticVersioning {
-			return nil, errors.New("zero version number passed into RemoveHostSets request")
-		}
-		existingTarget, existingErr := c.Read(ctx, id, append([]Option{WithSkipCurlOutput(true)}, opt...)...)
-		if existingErr != nil {
-			if api.AsServerError(existingErr) != nil {
-				return nil, fmt.Errorf("error from controller when performing initial check-and-set read: %w", existingErr)
-			}
-			return nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
-		}
-		if existingTarget == nil {
-			return nil, errors.New("nil resource response found when performing initial check-and-set read")
-		}
-		if existingTarget.Item == nil {
-			return nil, errors.New("nil resource found when performing initial check-and-set read")
-		}
-		version = existingTarget.Item.Version
-	}
-
-	opts.postMap["version"] = version
-
-	opts.postMap["host_set_ids"] = hostSetIds
-
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-host-sets", url.PathEscape(id)), opts.postMap, apiOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("error creating RemoveHostSets request: %w", err)
-	}
-
-	if len(opts.queryMap) > 0 {
-		q := url.Values{}
-		for k, v := range opts.queryMap {
-			q.Add(k, v)
-		}
-		req.URL.RawQuery = q.Encode()
-	}
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("error performing client request during RemoveHostSets call: %w", err)
-	}
-
-	target := new(TargetUpdateResult)
-	target.Item = new(Target)
-	apiErr, err := resp.Decode(target.Item)
-	if err != nil {
-		return nil, fmt.Errorf("error decoding RemoveHostSets response: %w", err)
-	}
-	if apiErr != nil {
-		return nil, apiErr
-	}
-	target.response = resp
-	return target, nil
-}
-
 func (c *Client) RemoveHostSources(ctx context.Context, id string, version uint32, hostSourceIds []string, opt ...Option) (*TargetUpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into RemoveHostSources request")

enos/modules/test_smoke/main.tf

@@ -104,7 +104,7 @@ locals {
 
 resource "enos_local_exec" "add_hosts_to_target" {
   environment = local.base_environment
-  inline      = ["${var.local_boundary_dir}/boundary targets add-host-sets -id=${local.target_id} -host-set=${local.host_set_id} -format=json"]
+  inline      = ["${var.local_boundary_dir}/boundary targets add-host-sources -id=${local.target_id} -host-source=${local.host_set_id} -format=json"]
 }
 
 resource "enos_local_exec" "connect_target" {

internal/api/genapi/input.go

@@ -683,10 +683,6 @@ var inputStructs = []*structInfo{
 		versionEnabled:      true,
 		createResponseTypes: []string{CreateResponseType, ReadResponseType, UpdateResponseType, DeleteResponseType, ListResponseType},
 	},
-	{
-		inProto: &targets.HostSet{},
-		outFile: "targets/host_set.gen.go",
-	},
 	{
 		inProto: &targets.HostSource{},
 		outFile: "targets/host_source.gen.go",
@@ -769,10 +765,6 @@ var inputStructs = []*structInfo{
 		},
 		pluralResourceName: "targets",
 		sliceSubtypes: map[string]sliceSubtypeInfo{
-			"HostSets": {
-				SliceType: "[]string",
-				VarName:   "hostSetIds",
-			},
 			"HostSources": {
 				SliceType: "[]string",
 				VarName:   "hostSourceIds",

internal/cmd/commands.go

@@ -988,24 +988,6 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) {
 				Func:    "update",
 			}, nil
 		},
-		"targets add-host-sets": func() (cli.Command, error) {
-			return &targetscmd.Command{
-				Command: base.NewCommand(ui),
-				Func:    "add-host-sets",
-			}, nil
-		},
-		"targets remove-host-sets": func() (cli.Command, error) {
-			return &targetscmd.Command{
-				Command: base.NewCommand(ui),
-				Func:    "remove-host-sets",
-			}, nil
-		},
-		"targets set-host-sets": func() (cli.Command, error) {
-			return &targetscmd.Command{
-				Command: base.NewCommand(ui),
-				Func:    "set-host-sets",
-			}, nil
-		},
 		"targets add-host-sources": func() (cli.Command, error) {
 			return &targetscmd.Command{
 				Command: base.NewCommand(ui),

internal/cmd/commands/targetscmd/funcs.go

@@ -41,9 +41,6 @@ type extraCmdVars struct {
 func extraActionsFlagsMapFuncImpl() map[string][]string {
 	return map[string][]string{
 		"authorize-session":         {"id", "host-id"},
-		"add-host-sets":             {"id", "host-set", "version"},
-		"remove-host-sets":          {"id", "host-set", "version"},
-		"set-host-sets":             {"id", "host-set", "version"},
 		"add-host-sources":          {"id", "host-source", "version"},
 		"remove-host-sources":       {"id", "host-source", "version"},
 		"set-host-sources":          {"id", "host-source", "version"},
@@ -55,18 +52,6 @@ func extraActionsFlagsMapFuncImpl() map[string][]string {
 
 func extraSynopsisFuncImpl(c *Command) string {
 	switch c.Func {
-	case "add-host-sets", "set-host-sets", "remove-host-sets":
-		var in string
-		switch {
-		case strings.HasPrefix(c.Func, "add"):
-			in = "Add host sets to"
-		case strings.HasPrefix(c.Func, "set"):
-			in = "Set the full contents of the host sets on"
-		case strings.HasPrefix(c.Func, "remove"):
-			in = "Remove host sets from"
-		}
-		return wordwrap.WrapString(fmt.Sprintf("%s a target", in), base.TermWidth)
-
 	case "add-host-sources", "set-host-sources", "remove-host-sources":
 		var in string
 		switch {
@@ -138,48 +123,6 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})
-	case "add-host-sets":
-		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary target add-host-sets [options] [args]",
-			"",
-			"  DEPRECATED: Use add-host-sources instead.",
-			"",
-			"  This command allows adding host-set resources to target resources. Example:",
-			"",
-			"    Add host-set resources to a tcp-type target:",
-			"",
-			`      $ boundary targets add-host-sets -id ttcp_1234567890 -host-set hsst_1234567890 -host-set hsst_0987654321`,
-			"",
-			"",
-		})
-	case "remove-host-sets":
-		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary target remove-host-sets [options] [args]",
-			"",
-			"  DEPRECATED: Use remove-host-sources instead.",
-			"",
-			"  This command allows removing host-set resources from target resources. Example:",
-			"",
-			"    Remove host-set resources from a tcp-type target:",
-			"",
-			`      $ boundary targets remove-host-sets -id ttcp_1234567890 -host hsst_1234567890 -host-set hsst_0987654321`,
-			"",
-			"",
-		})
-	case "set-host-sets":
-		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary target set-host-sets [options] [args]",
-			"",
-			"  DEPRECATED: Use set-host-sources instead.",
-			"",
-			"  This command allows setting the complete set of host-set resources on a target resource. Example:",
-			"",
-			"    Set host-set resources on a tcp-type target:",
-			"",
-			`      $ boundary targets set-host-sets -id ttcp_1234567890 -host-set hsst_1234567890`,
-			"",
-			"",
-		})
 	case "add-host-sources":
 		helpStr = base.WrapForHelpText([]string{
 			"Usage: boundary target add-host-sources [options] [args]",
@@ -375,29 +318,12 @@ func extraFlagsHandlingFuncImpl(c *Command, _ *base.FlagSets, opts *[]targets.Op
 	}
 
 	switch c.Func {
-	case "add-host-sets", "remove-host-sets":
-		if len(c.flagHostSets) == 0 {
-			c.UI.Error("No host-sets supplied via -host-set")
-			return false
-		}
-
 	case "add-host-sources", "remove-host-sources":
 		if len(c.flagHostSources) == 0 {
 			c.UI.Error("No host sources supplied via -host-source")
 			return false
 		}
 
-	case "set-host-sets":
-		switch len(c.flagHostSets) {
-		case 0:
-			c.UI.Error("No host-sets supplied via -host-set")
-			return false
-		case 1:
-			if c.flagHostSets[0] == "null" {
-				c.flagHostSets = nil
-			}
-		}
-
 	case "set-host-sources":
 		switch len(c.flagHostSources) {
 		case 0:
@@ -464,24 +390,6 @@ func extraFlagsHandlingFuncImpl(c *Command, _ *base.FlagSets, opts *[]targets.Op
 
 func executeExtraActionsImpl(c *Command, origResp *api.Response, origItem *targets.Target, origItems []*targets.Target, origError error, targetClient *targets.Client, version uint32, opts []targets.Option) (*api.Response, *targets.Target, []*targets.Target, error) {
 	switch c.Func {
-	case "add-host-sets":
-		result, err := targetClient.AddHostSets(c.Context, c.FlagId, version, c.flagHostSets, opts...)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		return result.GetResponse(), result.GetItem(), nil, err
-	case "remove-host-sets":
-		result, err := targetClient.RemoveHostSets(c.Context, c.FlagId, version, c.flagHostSets, opts...)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		return result.GetResponse(), result.GetItem(), nil, err
-	case "set-host-sets":
-		result, err := targetClient.SetHostSets(c.Context, c.FlagId, version, c.flagHostSets, opts...)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		return result.GetResponse(), result.GetItem(), nil, err
 	case "add-host-sources":
 		result, err := targetClient.AddHostSources(c.Context, c.FlagId, version, c.flagHostSources, opts...)
 		if err != nil {
@@ -623,8 +531,7 @@ func printItemTable(item *targets.Target, resp *api.Response) string {
 	maxLength := base.MaxAttributesLength(nonAttributeMap, item.Attributes, keySubstMap)
 
 	var hostSourceMaps []map[string]interface{}
-	switch {
-	case len(item.HostSources) > 0:
+	if len(item.HostSources) > 0 {
 		for _, set := range item.HostSources {
 			m := map[string]interface{}{
 				"ID":              set.Id,
@@ -635,17 +542,6 @@ func printItemTable(item *targets.Target, resp *api.Response) string {
 		if l := len("Host Catalog ID"); l > maxLength {
 			maxLength = l
 		}
-	case len(item.HostSets) > 0:
-		for _, set := range item.HostSets {
-			m := map[string]interface{}{
-				"ID":              set.Id,
-				"Host Catalog ID": set.HostCatalogId,
-			}
-			hostSourceMaps = append(hostSourceMaps, m)
-		}
-		if l := len("Host Catalog ID"); l > maxLength {
-			maxLength = l
-		}
 	}
 
 	var credentialSourceMaps map[credential.Purpose][]map[string]interface{}
@@ -886,14 +782,14 @@ func exampleOutput() string {
 		Scope: &scopes.ScopeInfo{
 			Id: scope.Global.String(),
 		},
-		Name:        "foo",
-		Description: "The bar of foos",
-		CreatedTime: time.Now().Add(-5 * time.Minute),
-		UpdatedTime: time.Now(),
-		Version:     3,
-		Type:        "tcp",
-		HostSetIds:  []string{"hsst_1234567890", "hsst_0987654321"},
-		HostSets: []*targets.HostSet{
+		Name:          "foo",
+		Description:   "The bar of foos",
+		CreatedTime:   time.Now().Add(-5 * time.Minute),
+		UpdatedTime:   time.Now(),
+		Version:       3,
+		Type:          "tcp",
+		HostSourceIds: []string{"hsst_1234567890", "hsst_0987654321"},
+		HostSources: []*targets.HostSource{
 			{
 				Id:            "hsst_1234567890",
 				HostCatalogId: "hcst_1234567890",

internal/cmd/commands/targetscmd/targets.gen.go

@@ -201,30 +201,6 @@ func (c *Command) Run(args []string) int {
 
 	switch c.Func {
 
-	case "add-host-sets":
-		switch c.FlagVersion {
-		case 0:
-			opts = append(opts, targets.WithAutomaticVersioning(true))
-		default:
-			version = uint32(c.FlagVersion)
-		}
-
-	case "remove-host-sets":
-		switch c.FlagVersion {
-		case 0:
-			opts = append(opts, targets.WithAutomaticVersioning(true))
-		default:
-			version = uint32(c.FlagVersion)
-		}
-
-	case "set-host-sets":
-		switch c.FlagVersion {
-		case 0:
-			opts = append(opts, targets.WithAutomaticVersioning(true))
-		default:
-			version = uint32(c.FlagVersion)
-		}
-
 	case "add-host-sources":
 		switch c.FlagVersion {
 		case 0:

internal/cmd/gencli/input.go

@@ -478,7 +478,7 @@ var inputStructs = map[string][]*cmdInfo{
 			HasName:             true,
 			HasDescription:      true,
 			Container:           "Scope",
-			VersionedActions:    []string{"add-host-sets", "remove-host-sets", "set-host-sets", "add-host-sources", "remove-host-sources", "set-host-sources", "add-credential-sources", "remove-credential-sources", "set-credential-sources"},
+			VersionedActions:    []string{"add-host-sources", "remove-host-sources", "set-host-sources", "add-credential-sources", "remove-credential-sources", "set-credential-sources"},
 		},
 		{
 			ResourceType:         resource.Target.String(),

internal/daemon/controller/handler_test.go

@@ -160,9 +160,6 @@ func TestHandleImplementedPaths(t *testing.T) {
 			"v1/roles/someid:remove-principals",
 			"v1/sessions/someid:cancel",
 			"v1/targets/someid:authorize-session",
-			"v1/targets/someid:add-host-sets",
-			"v1/targets/someid:set-host-sets",
-			"v1/targets/someid:remove-host-sets",
 			"v1/targets/someid:add-host-sources",
 			"v1/targets/someid:set-host-sources",
 			"v1/targets/someid:remove-host-sources",

internal/daemon/controller/handlers/roles/role_service.go

@@ -1053,10 +1053,17 @@ func validateAddRoleGrantsRequest(req *pbs.AddRoleGrantsRequest) error {
 			badFields["grant_strings"] = "Grant strings must not be empty."
 			break
 		}
-		if _, err := perms.Parse("p_anything", v); err != nil {
+		grant, err := perms.Parse("p_anything", v)
+		if err != nil {
 			badFields["grant_strings"] = fmt.Sprintf("Improperly formatted grant %q.", v)
 			break
 		}
+		_, actStrs := grant.Actions()
+		for _, actStr := range actStrs {
+			if depAct := action.DeprecatedMap[actStr]; depAct != action.Unknown {
+				badFields["grant_strings"] = fmt.Sprintf("Action %q has been deprecated and is not allowed to be set in grants. Use %q instead.", actStr, depAct.String())
+			}
+		}
 	}
 	if len(badFields) > 0 {
 		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)
@@ -1077,10 +1084,17 @@ func validateSetRoleGrantsRequest(req *pbs.SetRoleGrantsRequest) error {
 			badFields["grant_strings"] = "Grant strings must not be empty."
 			break
 		}
-		if _, err := perms.Parse("p_anything", v); err != nil {
+		grant, err := perms.Parse("p_anything", v)
+		if err != nil {
 			badFields["grant_strings"] = fmt.Sprintf("Improperly formatted grant %q.", v)
 			break
 		}
+		_, actStrs := grant.Actions()
+		for _, actStr := range actStrs {
+			if depAct := action.DeprecatedMap[actStr]; depAct != action.Unknown {
+				badFields["grant_strings"] = fmt.Sprintf("Action %q has been deprecated and is not allowed to be set in grants. Use %q instead.", actStr, depAct.String())
+			}
+		}
 	}
 	if len(badFields) > 0 {
 		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)
@@ -1108,6 +1122,7 @@ func validateRemoveRoleGrantsRequest(req *pbs.RemoveRoleGrantsRequest) error {
 			badFields["grant_strings"] = fmt.Sprintf("Improperly formatted grant %q.", v)
 			break
 		}
+		// NOTE: we don't do a deprecation check here because it's fine to allow people to remove deprecated grants.
 	}
 	if len(badFields) > 0 {
 		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)

internal/daemon/controller/handlers/roles/role_service_test.go

@@ -1653,11 +1653,12 @@ func TestAddGrants(t *testing.T) {
 	require.NoError(t, err, "Error when getting new role service.")
 
 	addCases := []struct {
-		name     string
-		existing []string
-		add      []string
-		result   []string
-		wantErr  bool
+		name            string
+		existing        []string
+		add             []string
+		result          []string
+		wantErr         bool
+		wantErrContains string
 	}{
 		{
 			name:   "Add grant on empty role",
@@ -1682,6 +1683,13 @@ func TestAddGrants(t *testing.T) {
 			add:      []string{"id=*;type=*;actions=delete"},
 			wantErr:  true,
 		},
+		{
+			name:            "Check deprecation",
+			existing:        []string{"id=1;actions=read", "id=*;type=*;actions=delete"},
+			add:             []string{"id=*;type=target;actions=add-host-sets"},
+			wantErr:         true,
+			wantErrContains: "Use \\\"add-host-sources\\\" instead",
+		},
 	}
 
 	for _, tc := range addCases {
@@ -1705,6 +1713,9 @@ func TestAddGrants(t *testing.T) {
 				got, err := s.AddRoleGrants(auth.DisabledAuthTestContext(repoFn, scopeId), req)
 				if tc.wantErr {
 					assert.Error(err)
+					if tc.wantErrContains != "" {
+						assert.Contains(err.Error(), tc.wantErrContains)
+					}
 					return
 				}
 				require.NoError(err)
@@ -1781,11 +1792,12 @@ func TestSetGrants(t *testing.T) {
 	require.NoError(t, err, "Error when getting new role service.")
 
 	setCases := []struct {
-		name     string
-		existing []string
-		set      []string
-		result   []string
-		wantErr  bool
+		name            string
+		existing        []string
+		set             []string
+		result          []string
+		wantErr         bool
+		wantErrContains string
 	}{
 		{
 			name:   "Set grant on empty role",
@@ -1816,6 +1828,13 @@ func TestSetGrants(t *testing.T) {
 			set:      nil,
 			result:   nil,
 		},
+		{
+			name:            "Check deprecation",
+			existing:        []string{"id=1;actions=read", "id=*;type=*;actions=delete"},
+			set:             []string{"id=*;type=target;actions=add-host-sets"},
+			wantErr:         true,
+			wantErrContains: "Use \\\"add-host-sources\\\" instead",
+		},
 	}
 
 	for _, tc := range setCases {
@@ -1839,6 +1858,9 @@ func TestSetGrants(t *testing.T) {
 				got, err := s.SetRoleGrants(auth.DisabledAuthTestContext(repoFn, scopeId), req)
 				if tc.wantErr {
 					assert.Error(err)
+					if tc.wantErrContains != "" {
+						assert.Contains(err.Error(), tc.wantErrContains)
+					}
 					return
 				}
 				require.NoError(err, "Got error %v", err)

internal/daemon/controller/handlers/targets/target_service.go

@@ -74,9 +74,6 @@ var (
 		action.Read,
 		action.Update,
 		action.Delete,
-		action.AddHostSets,
-		action.SetHostSets,
-		action.RemoveHostSets,
 		action.AddHostSources,
 		action.SetHostSources,
 		action.RemoveHostSources,
@@ -376,120 +373,6 @@ func (s Service) DeleteTarget(ctx context.Context, req *pbs.DeleteTargetRequest)
 	return nil, nil
 }
 
-// AddTargetHostSets implements the interface pbs.TargetServiceServer.
-func (s Service) AddTargetHostSets(ctx context.Context, req *pbs.AddTargetHostSetsRequest) (*pbs.AddTargetHostSetsResponse, error) {
-	const op = "targets.(Service).AddTargetHostSets"
-
-	if err := validateAddSetsRequest(req); err != nil {
-		return nil, err
-	}
-	authResults := s.authResult(ctx, req.GetId(), action.AddHostSets)
-	if authResults.Error != nil {
-		return nil, authResults.Error
-	}
-	t, ts, cl, err := s.addHostSourcesInRepo(ctx, req.GetId(), req.GetHostSetIds(), req.GetVersion())
-	if err != nil {
-		return nil, err
-	}
-
-	outputFields, ok := requests.OutputFields(ctx)
-	if !ok {
-		return nil, errors.New(ctx, errors.Internal, op, "no request context found")
-	}
-
-	outputOpts := make([]handlers.Option, 0, 3)
-	outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
-	if outputFields.Has(globals.ScopeField) {
-		outputOpts = append(outputOpts, handlers.WithScope(authResults.Scope))
-	}
-	if outputFields.Has(globals.AuthorizedActionsField) {
-		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, t.GetPublicId(), IdActions).Strings()))
-	}
-
-	item, err := toProto(ctx, t, ts, cl, outputOpts...)
-	if err != nil {
-		return nil, err
-	}
-
-	return &pbs.AddTargetHostSetsResponse{Item: item}, nil
-}
-
-// SetTargetHostSets implements the interface pbs.TargetServiceServer.
-func (s Service) SetTargetHostSets(ctx context.Context, req *pbs.SetTargetHostSetsRequest) (*pbs.SetTargetHostSetsResponse, error) {
-	const op = "targets.(Service).SetTargetHostSets"
-
-	if err := validateSetSetsRequest(req); err != nil {
-		return nil, err
-	}
-	authResults := s.authResult(ctx, req.GetId(), action.SetHostSets)
-	if authResults.Error != nil {
-		return nil, authResults.Error
-	}
-	t, ts, cl, err := s.setHostSourcesInRepo(ctx, req.GetId(), req.GetHostSetIds(), req.GetVersion())
-	if err != nil {
-		return nil, err
-	}
-
-	outputFields, ok := requests.OutputFields(ctx)
-	if !ok {
-		return nil, errors.New(ctx, errors.Internal, op, "no request context found")
-	}
-
-	outputOpts := make([]handlers.Option, 0, 3)
-	outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
-	if outputFields.Has(globals.ScopeField) {
-		outputOpts = append(outputOpts, handlers.WithScope(authResults.Scope))
-	}
-	if outputFields.Has(globals.AuthorizedActionsField) {
-		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, t.GetPublicId(), IdActions).Strings()))
-	}
-
-	item, err := toProto(ctx, t, ts, cl, outputOpts...)
-	if err != nil {
-		return nil, err
-	}
-
-	return &pbs.SetTargetHostSetsResponse{Item: item}, nil
-}
-
-// RemoveTargetHostSets implements the interface pbs.TargetServiceServer.
-func (s Service) RemoveTargetHostSets(ctx context.Context, req *pbs.RemoveTargetHostSetsRequest) (*pbs.RemoveTargetHostSetsResponse, error) {
-	const op = "targets.(Service).RemoveTargetHostSets"
-
-	if err := validateRemoveSetsRequest(req); err != nil {
-		return nil, err
-	}
-	authResults := s.authResult(ctx, req.GetId(), action.RemoveHostSets)
-	if authResults.Error != nil {
-		return nil, authResults.Error
-	}
-	t, ts, cl, err := s.removeHostSourcesInRepo(ctx, req.GetId(), req.GetHostSetIds(), req.GetVersion())
-	if err != nil {
-		return nil, err
-	}
-
-	outputFields, ok := requests.OutputFields(ctx)
-	if !ok {
-		return nil, errors.New(ctx, errors.Internal, op, "no request context found")
-	}
-
-	outputOpts := make([]handlers.Option, 0, 3)
-	outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
-	if outputFields.Has(globals.ScopeField) {
-		outputOpts = append(outputOpts, handlers.WithScope(authResults.Scope))
-	}
-	if outputFields.Has(globals.AuthorizedActionsField) {
-		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, t.GetPublicId(), IdActions).Strings()))
-	}
-
-	item, err := toProto(ctx, t, ts, cl, outputOpts...)
-	if err != nil {
-		return nil, err
-	}
-
-	return &pbs.RemoveTargetHostSetsResponse{Item: item}, nil
-}
-
 // AddTargetHostSources implements the interface pbs.TargetServiceServer.
 func (s Service) AddTargetHostSources(ctx context.Context, req *pbs.AddTargetHostSourcesRequest) (*pbs.AddTargetHostSourcesResponse, error) {
 	const op = "targets.(Service).AddTargetHostSources"
@@ -613,12 +496,7 @@ func (s Service) AddTargetCredentialSources(ctx context.Context, req *pbs.AddTar
 	}
 	authResults := s.authResult(ctx, req.GetId(), action.AddCredentialSources)
 	if authResults.Error != nil {
-		// TODO AddCredentialLibraries was deprecated but grant actions were never migrated
-		// remove this check once actions have been migrated
-		authResults = s.authResult(ctx, req.GetId(), action.AddCredentialLibraries)
-		if authResults.Error != nil {
-			return nil, authResults.Error
-		}
+		return nil, authResults.Error
 	}
 
 	brokeredCredentialSources := strutil.MergeSlices(req.GetApplicationCredentialSourceIds(), req.GetBrokeredCredentialSourceIds())
@@ -658,12 +536,7 @@ func (s Service) SetTargetCredentialSources(ctx context.Context, req *pbs.SetTar
 	}
 	authResults := s.authResult(ctx, req.GetId(), action.SetCredentialSources)
 	if authResults.Error != nil {
-		// TODO SetCredentialLibraries was deprecated but grant actions were never migrated
-		// remove this check once actions have been migrated
-		authResults = s.authResult(ctx, req.GetId(), action.SetCredentialLibraries)
-		if authResults.Error != nil {
-			return nil, authResults.Error
-		}
+		return nil, authResults.Error
 	}
 
 	brokeredCredentialSources := strutil.MergeSlices(req.GetApplicationCredentialSourceIds(), req.GetBrokeredCredentialSourceIds())
@@ -703,12 +576,7 @@ func (s Service) RemoveTargetCredentialSources(ctx context.Context, req *pbs.Rem
 	}
 	authResults := s.authResult(ctx, req.GetId(), action.RemoveCredentialSources)
 	if authResults.Error != nil {
-		// TODO RemoveCredentialLibraries was deprecated but grant actions were never migrated
-		// remove this check once actions have been migrated
-		authResults = s.authResult(ctx, req.GetId(), action.RemoveCredentialLibraries)
-		if authResults.Error != nil {
-			return nil, authResults.Error
-		}
+		return nil, authResults.Error
 	}
 
 	brokeredCredentialSources := strutil.MergeSlices(req.GetApplicationCredentialSourceIds(), req.GetBrokeredCredentialSourceIds())
@@ -1483,24 +1351,11 @@ func toProto(ctx context.Context, in target.Target, hostSources []target.HostSou
 	if outputFields.Has(globals.AuthorizedActionsField) {
 		out.AuthorizedActions = opts.WithAuthorizedActions
 	}
-	if outputFields.Has(globals.HostSetIdsField) {
-		for _, hs := range hostSources {
-			out.HostSetIds = append(out.HostSetIds, hs.Id())
-		}
-	}
 	if outputFields.Has(globals.HostSourceIdsField) {
 		for _, hs := range hostSources {
 			out.HostSourceIds = append(out.HostSourceIds, hs.Id())
 		}
 	}
-	if outputFields.Has(globals.HostSetsField) {
-		for _, hs := range hostSources {
-			out.HostSets = append(out.HostSets, &pb.HostSet{
-				Id:            hs.Id(),
-				HostCatalogId: hs.HostCatalogId(),
-			})
-		}
-	}
 	if outputFields.Has(globals.HostSourcesField) {
 		for _, hs := range hostSources {
 			out.HostSources = append(out.HostSources, &pb.HostSource{
@@ -1685,72 +1540,6 @@ func validateListRequest(req *pbs.ListTargetsRequest) error {
 	return nil
 }
 
-func validateAddSetsRequest(req *pbs.AddTargetHostSetsRequest) error {
-	badFields := map[string]string{}
-	if !handlers.ValidId(handlers.Id(req.GetId()), target.Prefixes()...) {
-		badFields[globals.IdField] = "Incorrectly formatted identifier."
-	}
-	if req.GetVersion() == 0 {
-		badFields[globals.VersionField] = "Required field."
-	}
-	if len(req.GetHostSetIds()) == 0 {
-		badFields[globals.HostSetIdsField] = "Must be non-empty."
-	}
-	for _, id := range req.GetHostSetIds() {
-		if !handlers.ValidId(handlers.Id(id), static.HostSetPrefix, plugin.HostSetPrefix, plugin.PreviousHostSetPrefix) {
-			badFields[globals.HostSetIdsField] = fmt.Sprintf("Incorrectly formatted host set identifier %q.", id)
-			break
-		}
-	}
-	if len(badFields) > 0 {
-		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)
-	}
-	return nil
-}
-
-func validateSetSetsRequest(req *pbs.SetTargetHostSetsRequest) error {
-	badFields := map[string]string{}
-	if !handlers.ValidId(handlers.Id(req.GetId()), target.Prefixes()...) {
-		badFields[globals.IdField] = "Incorrectly formatted identifier."
-	}
-	if req.GetVersion() == 0 {
-		badFields[globals.VersionField] = "Required field."
-	}
-	for _, id := range req.GetHostSetIds() {
-		if !handlers.ValidId(handlers.Id(id), static.HostSetPrefix, plugin.HostSetPrefix, plugin.PreviousHostSetPrefix) {
-			badFields[globals.HostSetIdsField] = fmt.Sprintf("Incorrectly formatted host set identifier %q.", id)
-			break
-		}
-	}
-	if len(badFields) > 0 {
-		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)
-	}
-	return nil
-}
-
-func validateRemoveSetsRequest(req *pbs.RemoveTargetHostSetsRequest) error {
-	badFields := map[string]string{}
-	if !handlers.ValidId(handlers.Id(req.GetId()), target.Prefixes()...) {
-		badFields[globals.IdField] = "Incorrectly formatted identifier."
-	}
-	if req.GetVersion() == 0 {
-		badFields[globals.VersionField] = "Required field."
-	}
-	if len(req.GetHostSetIds()) == 0 {
-		badFields[globals.HostSetIdsField] = "Must be non-empty."
-	}
-	for _, id := range req.GetHostSetIds() {
-		if !handlers.ValidId(handlers.Id(id), static.HostSetPrefix, plugin.HostSetPrefix, plugin.PreviousHostSetPrefix) {
-			badFields[globals.HostSetIdsField] = fmt.Sprintf("Incorrectly formatted host set identifier %q.", id)
-			break
-		}
-	}
-	if len(badFields) > 0 {
-		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)
-	}
-	return nil
-}
-
 func validateAddHostSourcesRequest(req *pbs.AddTargetHostSourcesRequest) error {
 	badFields := map[string]string{}
 	if !handlers.ValidId(handlers.Id(req.GetId()), target.Prefixes()...) {

internal/daemon/controller/handlers/targets/tcp/target_service_test.go

@@ -61,9 +61,6 @@ var testAuthorizedActions = []string{
 	"read",
 	"update",
 	"delete",
-	"add-host-sets",
-	"set-host-sets",
-	"remove-host-sets",
 	"add-host-sources",
 	"set-host-sources",
 	"remove-host-sources",
@@ -142,7 +139,6 @@ func TestGet(t *testing.T) {
 		UpdatedTime:            tar.GetUpdateTime().GetTimestamp(),
 		Scope:                  &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: o.GetPublicId()},
 		Type:                   tcp.Subtype.String(),
-		HostSetIds:             []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
 		HostSourceIds:          []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
 		Attrs:                  &pb.Target_TcpTargetAttributes{},
 		SessionMaxSeconds:      wrapperspb.UInt32(28800),
@@ -150,7 +146,6 @@ func TestGet(t *testing.T) {
 		AuthorizedActions:      testAuthorizedActions,
 	}
 	for _, ihs := range hs {
-		pTar.HostSets = append(pTar.HostSets, &pb.HostSet{Id: ihs.GetPublicId(), HostCatalogId: ihs.GetCatalogId()})
 		pTar.HostSources = append(pTar.HostSources, &pb.HostSource{Id: ihs.GetPublicId(), HostCatalogId: ihs.GetCatalogId()})
 	}
 
@@ -719,11 +714,6 @@ func TestUpdate(t *testing.T) {
 
 	hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 2)
-	hsIds := []string{hs[0].GetPublicId(), hs[1].GetPublicId()}
-	hostSets := []*pb.HostSet{
-		{Id: hs[0].GetPublicId(), HostCatalogId: hs[0].GetCatalogId()},
-		{Id: hs[1].GetPublicId(), HostCatalogId: hs[1].GetCatalogId()},
-	}
 	hostSourceIds := []string{hs[0].GetPublicId(), hs[1].GetPublicId()}
 	hostSources := []*pb.HostSource{
 		{Id: hs[0].GetPublicId(), HostCatalogId: hs[0].GetCatalogId()},
@@ -793,8 +783,6 @@ func TestUpdate(t *testing.T) {
 						},
 					},
 					CreatedTime:            tar.GetCreateTime().GetTimestamp(),
-					HostSetIds:             hsIds,
-					HostSets:               hostSets,
 					HostSourceIds:          hostSourceIds,
 					HostSources:            hostSources,
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
@@ -829,8 +817,6 @@ func TestUpdate(t *testing.T) {
 							DefaultPort: wrapperspb.UInt32(2),
 						},
 					},
-					HostSetIds:             hsIds,
-					HostSets:               hostSets,
 					HostSourceIds:          hostSourceIds,
 					HostSources:            hostSources,
 					SessionMaxSeconds:      wrapperspb.UInt32(tar.GetSessionMaxSeconds()),
@@ -928,8 +914,6 @@ func TestUpdate(t *testing.T) {
 							DefaultPort: wrapperspb.UInt32(2),
 						},
 					},
-					HostSetIds:             hsIds,
-					HostSets:               hostSets,
 					HostSourceIds:          hostSourceIds,
 					HostSources:            hostSources,
 					SessionMaxSeconds:      wrapperspb.UInt32(tar.GetSessionMaxSeconds()),
@@ -963,8 +947,6 @@ func TestUpdate(t *testing.T) {
 							DefaultPort: wrapperspb.UInt32(2),
 						},
 					},
-					HostSetIds:             hsIds,
-					HostSets:               hostSets,
 					HostSourceIds:          hostSourceIds,
 					HostSources:            hostSources,
 					SessionMaxSeconds:      wrapperspb.UInt32(tar.GetSessionMaxSeconds()),
@@ -998,8 +980,6 @@ func TestUpdate(t *testing.T) {
 						},
 					},
 					Type:                   tcp.Subtype.String(),
-					HostSetIds:             hsIds,
-					HostSets:               hostSets,
 					HostSourceIds:          hostSourceIds,
 					HostSources:            hostSources,
 					SessionMaxSeconds:      wrapperspb.UInt32(tar.GetSessionMaxSeconds()),
@@ -1171,492 +1151,6 @@ func TestUpdate_BadVersion(t *testing.T) {
 	assert.True(t, errors.Is(err, handlers.NotFoundError()), "Got %v, wanted not found error.", err)
 }
 
-func TestAddTargetHostSets(t *testing.T) {
-	conn, _ := db.TestSetup(t, "postgres")
-	wrapper := db.TestWrapper(t)
-	kms := kms.TestKms(t, conn, wrapper)
-	sche := scheduler.TestScheduler(t, conn, wrapper)
-
-	rw := db.New(conn)
-
-	iamRepo := iam.TestRepo(t, conn, wrapper)
-	iamRepoFn := func() (*iam.Repository, error) {
-		return iamRepo, nil
-	}
-	tokenRepoFn := func() (*authtoken.Repository, error) {
-		return authtoken.NewRepository(rw, rw, kms)
-	}
-	serversRepoFn := func() (*server.Repository, error) {
-		return server.NewRepository(rw, rw, kms)
-	}
-
-	org, proj := iam.TestScopes(t, iamRepo)
-	at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
-	r := iam.TestRole(t, conn, proj.GetPublicId())
-	_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
-	_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
-
-	s, err := testService(t, context.Background(), conn, kms, wrapper)
-	require.NoError(t, err, "Error when getting new target service.")
-
-	hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
-	hs := static.TestSets(t, conn, hc.GetPublicId(), 2)
-
-	plg := host.TestPlugin(t, conn, "test")
-	pluginHc := plugin.TestCatalog(t, conn, proj.GetPublicId(), plg.GetPublicId())
-	pluginHs := plugin.TestSet(t, conn, kms, sche, pluginHc, map[string]plgpb.HostPluginServiceClient{
-		plg.GetPublicId(): plugin.NewWrappingPluginClient(&plugin.TestPluginServer{}),
-	})
-	ctx := context.Background()
-
-	addCases := []struct {
-		name           string
-		tar            target.Target
-		addHostSets    []string
-		resultHostSets []string
-	}{
-		{
-			name:           "Add set on empty target",
-			tar:            tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "empty"),
-			addHostSets:    []string{hs[1].GetPublicId()},
-			resultHostSets: []string{hs[1].GetPublicId()},
-		},
-		{
-			name:           "Add set on populated target",
-			tar:            tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated", target.WithHostSources([]string{hs[0].GetPublicId()})),
-			addHostSets:    []string{hs[1].GetPublicId()},
-			resultHostSets: []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
-		},
-		{
-			name:           "Add duplicated sets on populated target",
-			tar:            tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "duplicated", target.WithHostSources([]string{hs[0].GetPublicId()})),
-			addHostSets:    []string{hs[1].GetPublicId(), hs[1].GetPublicId()},
-			resultHostSets: []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
-		},
-		{
-			name:           "Add plugin set on empty target",
-			tar:            tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "plugin empty"),
-			addHostSets:    []string{pluginHs.GetPublicId()},
-			resultHostSets: []string{pluginHs.GetPublicId()},
-		},
-		{
-			name:           "Add plugin set on populated target",
-			tar:            tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "plugin populated", target.WithHostSources([]string{hs[0].GetPublicId()})),
-			addHostSets:    []string{pluginHs.GetPublicId()},
-			resultHostSets: []string{hs[0].GetPublicId(), pluginHs.GetPublicId()},
-		},
-	}
-
-	for _, tc := range addCases {
-		t.Run(tc.name, func(t *testing.T) {
-			req := &pbs.AddTargetHostSetsRequest{
-				Id:         tc.tar.GetPublicId(),
-				Version:    tc.tar.GetVersion(),
-				HostSetIds: tc.addHostSets,
-			}
-
-			requestInfo := authpb.RequestInfo{
-				TokenFormat: uint32(auth.AuthTokenTypeBearer),
-				PublicId:    at.GetPublicId(),
-				Token:       at.GetToken(),
-			}
-			requestContext := context.WithValue(context.Background(), requests.ContextRequestInformationKey, &requests.RequestContext{})
-			ctx := auth.NewVerifierContext(requestContext, iamRepoFn, tokenRepoFn, serversRepoFn, kms, &requestInfo)
-			got, err := s.AddTargetHostSets(ctx, req)
-			s, ok := status.FromError(err)
-			require.True(t, ok)
-			require.NoError(t, err, "Got error: %v", s)
-
-			assert.ElementsMatch(t, tc.resultHostSets, got.GetItem().GetHostSetIds())
-		})
-	}
-
-	tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "test")
-
-	failCases := []struct {
-		name string
-		req  *pbs.AddTargetHostSetsRequest
-		err  error
-	}{
-		{
-			name: "Bad Set Id",
-			req: &pbs.AddTargetHostSetsRequest{
-				Id:         "bad id",
-				Version:    tar.GetVersion(),
-				HostSetIds: []string{hs[0].GetPublicId()},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-		{
-			name: "Bad version",
-			req: &pbs.AddTargetHostSetsRequest{
-				Id:         tar.GetPublicId(),
-				Version:    tar.GetVersion() + 2,
-				HostSetIds: []string{hs[0].GetPublicId()},
-			},
-			err: handlers.ApiErrorWithCode(codes.Internal),
-		},
-		{
-			name: "Empty host set list",
-			req: &pbs.AddTargetHostSetsRequest{
-				Id:      tar.GetPublicId(),
-				Version: tar.GetVersion(),
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-		{
-			name: "Incorrect host set ids",
-			req: &pbs.AddTargetHostSetsRequest{
-				Id:         tar.GetPublicId(),
-				Version:    tar.GetVersion(),
-				HostSetIds: []string{"incorrect"},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-	}
-	for _, tc := range failCases {
-		t.Run(tc.name, func(t *testing.T) {
-			assert, require := assert.New(t), require.New(t)
-			requestInfo := authpb.RequestInfo{
-				TokenFormat: uint32(auth.AuthTokenTypeBearer),
-				PublicId:    at.GetPublicId(),
-				Token:       at.GetToken(),
-			}
-			requestContext := context.WithValue(context.Background(), requests.ContextRequestInformationKey, &requests.RequestContext{})
-			ctx := auth.NewVerifierContext(requestContext, iamRepoFn, tokenRepoFn, serversRepoFn, kms, &requestInfo)
-			_, gErr := s.AddTargetHostSets(ctx, tc.req)
-			if tc.err != nil {
-				require.Error(gErr)
-				assert.True(errors.Is(gErr, tc.err), "AddTargetHostSets(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
-			}
-		})
-	}
-}
-
-func TestSetTargetHostSets(t *testing.T) {
-	conn, _ := db.TestSetup(t, "postgres")
-	wrapper := db.TestWrapper(t)
-	kms := kms.TestKms(t, conn, wrapper)
-	sche := scheduler.TestScheduler(t, conn, wrapper)
-
-	rw := db.New(conn)
-
-	iamRepo := iam.TestRepo(t, conn, wrapper)
-	iamRepoFn := func() (*iam.Repository, error) {
-		return iamRepo, nil
-	}
-	tokenRepoFn := func() (*authtoken.Repository, error) {
-		return authtoken.NewRepository(rw, rw, kms)
-	}
-	serversRepoFn := func() (*server.Repository, error) {
-		return server.NewRepository(rw, rw, kms)
-	}
-
-	org, proj := iam.TestScopes(t, iamRepo)
-	at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
-	r := iam.TestRole(t, conn, proj.GetPublicId())
-	_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
-	_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
-
-	s, err := testService(t, context.Background(), conn, kms, wrapper)
-	require.NoError(t, err, "Error when getting new host set service.")
-
-	hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
-	hs := static.TestSets(t, conn, hc.GetPublicId(), 2)
-
-	plg := host.TestPlugin(t, conn, "test")
-	pluginHc := plugin.TestCatalog(t, conn, proj.GetPublicId(), plg.GetPublicId())
-	pluginHs := plugin.TestSet(t, conn, kms, sche, pluginHc, map[string]plgpb.HostPluginServiceClient{
-		plg.GetPublicId(): plugin.NewWrappingPluginClient(&plugin.TestPluginServer{}),
-	})
-
-	ctx := context.Background()
-	setCases := []struct {
-		name           string
-		tar            target.Target
-		setHostSets    []string
-		resultHostSets []string
-	}{
-		{
-			name:           "Set on empty target",
-			tar:            tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "empty"),
-			setHostSets:    []string{hs[1].GetPublicId()},
-			resultHostSets: []string{hs[1].GetPublicId()},
-		},
-		{
-			name:           "Set on populated target",
-			tar:            tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "populated", target.WithHostSources([]string{hs[0].GetPublicId()})),
-			setHostSets:    []string{hs[1].GetPublicId()},
-			resultHostSets: []string{hs[1].GetPublicId()},
-		},
-		{
-			name:           "Set duplicate host set on populated target",
-			tar:            tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "duplicate", target.WithHostSources([]string{hs[0].GetPublicId()})),
-			setHostSets:    []string{hs[1].GetPublicId(), hs[1].GetPublicId()},
-			resultHostSets: []string{hs[1].GetPublicId()},
-		},
-		{
-			name:           "Set empty on populated target",
-			tar:            tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "another populated", target.WithHostSources([]string{hs[0].GetPublicId()})),
-			setHostSets:    []string{},
-			resultHostSets: nil,
-		},
-		{
-			name:           "Set plugin set on empty target",
-			tar:            tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "plugin empty"),
-			setHostSets:    []string{pluginHs.GetPublicId()},
-			resultHostSets: []string{pluginHs.GetPublicId()},
-		},
-		{
-			name:           "Set plugin set on populated target",
-			tar:            tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "plugin populated", target.WithHostSources([]string{hs[0].GetPublicId()})),
-			setHostSets:    []string{pluginHs.GetPublicId()},
-			resultHostSets: []string{pluginHs.GetPublicId()},
-		},
-	}
-	for _, tc := range setCases {
-		t.Run(tc.name, func(t *testing.T) {
-			req := &pbs.SetTargetHostSetsRequest{
-				Id:         tc.tar.GetPublicId(),
-				Version:    tc.tar.GetVersion(),
-				HostSetIds: tc.setHostSets,
-			}
-
-			requestInfo := authpb.RequestInfo{
-				TokenFormat: uint32(auth.AuthTokenTypeBearer),
-				PublicId:    at.GetPublicId(),
-				Token:       at.GetToken(),
-			}
-			requestContext := context.WithValue(context.Background(), requests.ContextRequestInformationKey, &requests.RequestContext{})
-			ctx := auth.NewVerifierContext(requestContext, iamRepoFn, tokenRepoFn, serversRepoFn, kms, &requestInfo)
-			got, err := s.SetTargetHostSets(ctx, req)
-			require.NoError(t, err, "Got error: %v", s)
-			assert.ElementsMatch(t, tc.resultHostSets, got.GetItem().GetHostSetIds())
-		})
-	}
-
-	tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "test name")
-
-	failCases := []struct {
-		name string
-		req  *pbs.SetTargetHostSetsRequest
-		err  error
-	}{
-		{
-			name: "Bad target Id",
-			req: &pbs.SetTargetHostSetsRequest{
-				Id:         "bad id",
-				Version:    tar.GetVersion(),
-				HostSetIds: []string{hs[0].GetPublicId()},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-		{
-			name: "Bad version",
-			req: &pbs.SetTargetHostSetsRequest{
-				Id:         tar.GetPublicId(),
-				Version:    tar.GetVersion() + 3,
-				HostSetIds: []string{hs[0].GetPublicId()},
-			},
-			err: handlers.ApiErrorWithCode(codes.Internal),
-		},
-		{
-			name: "Bad host set id",
-			req: &pbs.SetTargetHostSetsRequest{
-				Id:         tar.GetPublicId(),
-				Version:    tar.GetVersion(),
-				HostSetIds: []string{"invalid"},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-	}
-	for _, tc := range failCases {
-		t.Run(tc.name, func(t *testing.T) {
-			assert, require := assert.New(t), require.New(t)
-			requestInfo := authpb.RequestInfo{
-				TokenFormat: uint32(auth.AuthTokenTypeBearer),
-				PublicId:    at.GetPublicId(),
-				Token:       at.GetToken(),
-			}
-			requestContext := context.WithValue(context.Background(), requests.ContextRequestInformationKey, &requests.RequestContext{})
-			ctx := auth.NewVerifierContext(requestContext, iamRepoFn, tokenRepoFn, serversRepoFn, kms, &requestInfo)
-			_, gErr := s.SetTargetHostSets(ctx, tc.req)
-			if tc.err != nil {
-				require.Error(gErr)
-				assert.True(errors.Is(gErr, tc.err), "SetTargetHostSets(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
-			}
-		})
-	}
-}
-
-func TestRemoveTargetHostSets(t *testing.T) {
-	conn, _ := db.TestSetup(t, "postgres")
-	wrapper := db.TestWrapper(t)
-	kms := kms.TestKms(t, conn, wrapper)
-	sche := scheduler.TestScheduler(t, conn, wrapper)
-
-	rw := db.New(conn)
-
-	iamRepo := iam.TestRepo(t, conn, wrapper)
-	iamRepoFn := func() (*iam.Repository, error) {
-		return iamRepo, nil
-	}
-	tokenRepoFn := func() (*authtoken.Repository, error) {
-		return authtoken.NewRepository(rw, rw, kms)
-	}
-	serversRepoFn := func() (*server.Repository, error) {
-		return server.NewRepository(rw, rw, kms)
-	}
-
-	org, proj := iam.TestScopes(t, iamRepo)
-	at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
-	r := iam.TestRole(t, conn, proj.GetPublicId())
-	_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
-	_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
-
-	s, err := testService(t, context.Background(), conn, kms, wrapper)
-	require.NoError(t, err, "Error when getting new host set service.")
-
-	hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
-	hs := static.TestSets(t, conn, hc.GetPublicId(), 2)
-
-	plg := host.TestPlugin(t, conn, "test")
-	pluginHc := plugin.TestCatalog(t, conn, proj.GetPublicId(), plg.GetPublicId())
-	pluginHs := plugin.TestSet(t, conn, kms, sche, pluginHc, map[string]plgpb.HostPluginServiceClient{
-		plg.GetPublicId(): plugin.NewWrappingPluginClient(&plugin.TestPluginServer{}),
-	})
-
-	ctx := context.Background()
-	removeCases := []struct {
-		name        string
-		tar         target.Target
-		removeHosts []string
-		resultHosts []string
-		wantErr     bool
-	}{
-		{
-			name:        "Remove from empty",
-			tar:         tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "empty"),
-			removeHosts: []string{hs[1].GetPublicId()},
-			wantErr:     true,
-		},
-		{
-			name:        "Remove 1 of 2 sets",
-			tar:         tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "remove partial", target.WithHostSources([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
-			removeHosts: []string{hs[1].GetPublicId()},
-			resultHosts: []string{hs[0].GetPublicId()},
-		},
-		{
-			name:        "Remove 1 duplicate set of 2 sets",
-			tar:         tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "remove duplicate", target.WithHostSources([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
-			removeHosts: []string{hs[1].GetPublicId(), hs[1].GetPublicId()},
-			resultHosts: []string{hs[0].GetPublicId()},
-		},
-		{
-			name:        "Remove all hosts from set",
-			tar:         tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "remove all", target.WithHostSources([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
-			removeHosts: []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
-			resultHosts: []string{},
-		},
-		{
-			name:        "Remove 1 plugin of 2 sets",
-			tar:         tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "remove plugin partial", target.WithHostSources([]string{hs[0].GetPublicId(), pluginHs.GetPublicId()})),
-			removeHosts: []string{pluginHs.GetPublicId()},
-			resultHosts: []string{hs[0].GetPublicId()},
-		},
-	}
-
-	for _, tc := range removeCases {
-		t.Run(tc.name, func(t *testing.T) {
-			req := &pbs.RemoveTargetHostSetsRequest{
-				Id:         tc.tar.GetPublicId(),
-				Version:    tc.tar.GetVersion(),
-				HostSetIds: tc.removeHosts,
-			}
-
-			requestInfo := authpb.RequestInfo{
-				TokenFormat: uint32(auth.AuthTokenTypeBearer),
-				PublicId:    at.GetPublicId(),
-				Token:       at.GetToken(),
-			}
-			requestContext := context.WithValue(context.Background(), requests.ContextRequestInformationKey, &requests.RequestContext{})
-			ctx := auth.NewVerifierContext(requestContext, iamRepoFn, tokenRepoFn, serversRepoFn, kms, &requestInfo)
-			got, err := s.RemoveTargetHostSets(ctx, req)
-			if tc.wantErr {
-				assert.Error(t, err)
-				return
-			}
-			s, ok := status.FromError(err)
-			require.True(t, ok)
-			require.NoError(t, err, "Got error: %v", s)
-
-			assert.ElementsMatch(t, tc.resultHosts, got.GetItem().GetHostSetIds())
-		})
-	}
-
-	tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "testing")
-
-	failCases := []struct {
-		name string
-		req  *pbs.RemoveTargetHostSetsRequest
-		err  error
-	}{
-		{
-			name: "Bad version",
-			req: &pbs.RemoveTargetHostSetsRequest{
-				Id:         tar.GetPublicId(),
-				Version:    tar.GetVersion() + 3,
-				HostSetIds: []string{hs[0].GetPublicId()},
-			},
-			err: handlers.ApiErrorWithCode(codes.Internal),
-		},
-		{
-			name: "Bad target Id",
-			req: &pbs.RemoveTargetHostSetsRequest{
-				Id:         "bad id",
-				Version:    tar.GetVersion(),
-				HostSetIds: []string{hs[0].GetPublicId()},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-		{
-			name: "empty sets",
-			req: &pbs.RemoveTargetHostSetsRequest{
-				Id:         tar.GetPublicId(),
-				Version:    tar.GetVersion(),
-				HostSetIds: []string{},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-		{
-			name: "Invalid set ids",
-			req: &pbs.RemoveTargetHostSetsRequest{
-				Id:         tar.GetPublicId(),
-				Version:    tar.GetVersion(),
-				HostSetIds: []string{"invalid"},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-	}
-	for _, tc := range failCases {
-		t.Run(tc.name, func(t *testing.T) {
-			assert, require := assert.New(t), require.New(t)
-			requestInfo := authpb.RequestInfo{
-				TokenFormat: uint32(auth.AuthTokenTypeBearer),
-				PublicId:    at.GetPublicId(),
-				Token:       at.GetToken(),
-			}
-			requestContext := context.WithValue(context.Background(), requests.ContextRequestInformationKey, &requests.RequestContext{})
-			ctx := auth.NewVerifierContext(requestContext, iamRepoFn, tokenRepoFn, serversRepoFn, kms, &requestInfo)
-			_, gErr := s.RemoveTargetHostSets(ctx, tc.req)
-			if tc.err != nil {
-				require.Error(gErr)
-				assert.True(errors.Is(gErr, tc.err), "RemoveTargetHostSets(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
-			}
-		})
-	}
-}
-
 func TestAddTargetHostSources(t *testing.T) {
 	conn, _ := db.TestSetup(t, "postgres")
 	wrapper := db.TestWrapper(t)
@@ -3832,264 +3326,3 @@ func decodeJsonSecret(t *testing.T, in string) map[string]interface{} {
 	require.NoError(t, dec.Decode(&ret))
 	return ret
 }
-
-// Test that deprecated action add-credential-libraries still works
-// TODO: this test can be removed when grants are migrated
-func TestAddTargetCredentialLibraryPerms(t *testing.T) {
-	conn, _ := db.TestSetup(t, "postgres")
-	rw := db.New(conn)
-	wrapper := db.TestWrapper(t)
-	kms := kms.TestKms(t, conn, wrapper)
-
-	atRepoFn := func() (*authtoken.Repository, error) {
-		return authtoken.NewRepository(rw, rw, kms)
-	}
-	iamRepoFn := func() (*iam.Repository, error) {
-		return iam.TestRepo(t, conn, wrapper), nil
-	}
-	serversRepoFn := func() (*server.Repository, error) {
-		return server.NewRepository(rw, rw, kms)
-	}
-
-	iamRepo := iam.TestRepo(t, conn, wrapper)
-	_, proj := iam.TestScopes(t, iamRepo)
-	org, proj := iam.TestScopes(t, iamRepo)
-
-	storeStatic := credstatic.TestCredentialStore(t, conn, wrapper, proj.GetPublicId())
-	cred := credstatic.TestUsernamePasswordCredential(t, conn, wrapper, "user", "pass", storeStatic.GetPublicId(), proj.GetPublicId())
-
-	cases := []struct {
-		name    string
-		grant   string
-		wantErr bool
-	}{
-		{
-			name:  "valid-deprecated",
-			grant: "id=*;type=*;actions=add-credential-libraries",
-		},
-		{
-			name:    "invalid",
-			grant:   "id=*;type=*;actions=authorize-session",
-			wantErr: true,
-		},
-		{
-			name:  "valid-sources",
-			grant: "id=*;type=*;actions=add-credential-sources",
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
-			ctx := auth.NewVerifierContext(requests.NewRequestContext(context.Background()),
-				iamRepoFn,
-				atRepoFn,
-				serversRepoFn,
-				kms,
-				&authpb.RequestInfo{
-					Token:       at.GetToken(),
-					TokenFormat: uint32(auth.AuthTokenTypeBearer),
-					PublicId:    at.GetPublicId(),
-				})
-
-			r := iam.TestRole(t, conn, proj.GetPublicId())
-			_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
-			_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), tc.grant)
-
-			s, err := testService(t, context.Background(), conn, kms, wrapper)
-			require.NoError(t, err)
-
-			tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), tc.name)
-			req := &pbs.AddTargetCredentialSourcesRequest{
-				Id:                          tar.GetPublicId(),
-				Version:                     tar.GetVersion(),
-				BrokeredCredentialSourceIds: []string{cred.GetPublicId()},
-			}
-
-			got, err := s.AddTargetCredentialSources(ctx, req)
-			if tc.wantErr {
-				require.Error(t, err)
-				require.Nil(t, got)
-				return
-			}
-			status, ok := status.FromError(err)
-			require.True(t, ok)
-			require.NoError(t, err, "Got error: %v", status)
-			require.NotNil(t, got)
-		})
-	}
-}
-
-// Test that deprecated action add-credential-libraries still works
-// TODO: this test can be removed when grants are migrated
-func TestSetTargetCredentialLibraryPerms(t *testing.T) {
-	conn, _ := db.TestSetup(t, "postgres")
-	rw := db.New(conn)
-	wrapper := db.TestWrapper(t)
-	kms := kms.TestKms(t, conn, wrapper)
-
-	atRepoFn := func() (*authtoken.Repository, error) {
-		return authtoken.NewRepository(rw, rw, kms)
-	}
-	iamRepoFn := func() (*iam.Repository, error) {
-		return iam.TestRepo(t, conn, wrapper), nil
-	}
-	serversRepoFn := func() (*server.Repository, error) {
-		return server.NewRepository(rw, rw, kms)
-	}
-
-	iamRepo := iam.TestRepo(t, conn, wrapper)
-	_, proj := iam.TestScopes(t, iamRepo)
-	org, proj := iam.TestScopes(t, iamRepo)
-
-	storeStatic := credstatic.TestCredentialStore(t, conn, wrapper, proj.GetPublicId())
-	cred := credstatic.TestUsernamePasswordCredential(t, conn, wrapper, "user", "pass", storeStatic.GetPublicId(), proj.GetPublicId())
-
-	cases := []struct {
-		name    string
-		grant   string
-		wantErr bool
-	}{
-		{
-			name:  "valid-deprecated",
-			grant: "id=*;type=*;actions=set-credential-libraries",
-		},
-		{
-			name:    "invalid",
-			grant:   "id=*;type=*;actions=authorize-session",
-			wantErr: true,
-		},
-		{
-			name:  "valid-sources",
-			grant: "id=*;type=*;actions=set-credential-sources",
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
-			ctx := auth.NewVerifierContext(requests.NewRequestContext(context.Background()),
-				iamRepoFn,
-				atRepoFn,
-				serversRepoFn,
-				kms,
-				&authpb.RequestInfo{
-					Token:       at.GetToken(),
-					TokenFormat: uint32(auth.AuthTokenTypeBearer),
-					PublicId:    at.GetPublicId(),
-				})
-
-			r := iam.TestRole(t, conn, proj.GetPublicId())
-			_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
-			_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), tc.grant)
-
-			s, err := testService(t, context.Background(), conn, kms, wrapper)
-			require.NoError(t, err)
-
-			tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), tc.name)
-			req := &pbs.SetTargetCredentialSourcesRequest{
-				Id:                          tar.GetPublicId(),
-				Version:                     tar.GetVersion(),
-				BrokeredCredentialSourceIds: []string{cred.GetPublicId()},
-			}
-
-			got, err := s.SetTargetCredentialSources(ctx, req)
-			if tc.wantErr {
-				require.Error(t, err)
-				require.Nil(t, got)
-				return
-			}
-			status, ok := status.FromError(err)
-			require.True(t, ok)
-			require.NoError(t, err, "Got error: %v", status)
-			require.NotNil(t, got)
-		})
-	}
-}
-
-// Test that deprecated action remove-credential-libraries still works
-// TODO: this test can be removed when grants are migrated
-func TestRemoveTargetCredentialLibraryPerms(t *testing.T) {
-	conn, _ := db.TestSetup(t, "postgres")
-	rw := db.New(conn)
-	wrapper := db.TestWrapper(t)
-	kms := kms.TestKms(t, conn, wrapper)
-
-	atRepoFn := func() (*authtoken.Repository, error) {
-		return authtoken.NewRepository(rw, rw, kms)
-	}
-	iamRepoFn := func() (*iam.Repository, error) {
-		return iam.TestRepo(t, conn, wrapper), nil
-	}
-	serversRepoFn := func() (*server.Repository, error) {
-		return server.NewRepository(rw, rw, kms)
-	}
-
-	iamRepo := iam.TestRepo(t, conn, wrapper)
-	_, proj := iam.TestScopes(t, iamRepo)
-	org, proj := iam.TestScopes(t, iamRepo)
-
-	storeStatic := credstatic.TestCredentialStore(t, conn, wrapper, proj.GetPublicId())
-	cred := credstatic.TestUsernamePasswordCredential(t, conn, wrapper, "user", "pass", storeStatic.GetPublicId(), proj.GetPublicId())
-
-	cases := []struct {
-		name    string
-		grant   string
-		wantErr bool
-	}{
-		{
-			name:  "valid-deprecated",
-			grant: "id=*;type=*;actions=remove-credential-libraries",
-		},
-		{
-			name:    "invalid",
-			grant:   "id=*;type=*;actions=authorize-session",
-			wantErr: true,
-		},
-		{
-			name:  "valid-sources",
-			grant: "id=*;type=*;actions=remove-credential-sources",
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
-			ctx := auth.NewVerifierContext(requests.NewRequestContext(context.Background()),
-				iamRepoFn,
-				atRepoFn,
-				serversRepoFn,
-				kms,
-				&authpb.RequestInfo{
-					Token:       at.GetToken(),
-					TokenFormat: uint32(auth.AuthTokenTypeBearer),
-					PublicId:    at.GetPublicId(),
-				})
-
-			r := iam.TestRole(t, conn, proj.GetPublicId())
-			_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
-			_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), tc.grant)
-
-			s, err := testService(t, context.Background(), conn, kms, wrapper)
-			require.NoError(t, err)
-
-			tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), tc.name, target.WithStaticCredentials([]*target.StaticCredential{
-				target.TestNewStaticCredential("", cred.GetPublicId(), credential.BrokeredPurpose),
-			}))
-
-			req := &pbs.RemoveTargetCredentialSourcesRequest{
-				Id:                          tar.GetPublicId(),
-				Version:                     tar.GetVersion(),
-				BrokeredCredentialSourceIds: []string{cred.GetPublicId()},
-			}
-
-			got, err := s.RemoveTargetCredentialSources(ctx, req)
-			if tc.wantErr {
-				require.Error(t, err)
-				require.Nil(t, got)
-				return
-			}
-			status, ok := status.FromError(err)
-			require.True(t, ok)
-			require.NoError(t, err, "Got error: %v", status)
-			require.NotNil(t, got)
-		})
-	}
-}

internal/db/schema/migrations/oss/postgres/53/01_roles.up.sql

@@ -0,0 +1,111 @@
+begin;
+
+-- Remove immutable property
+drop trigger immutable_role_grant on iam_role_grant;
+
+-- Swap add-host-sets to add-host-sources
+update iam_role_grant
+set
+  canonical_grant = replace(
+    canonical_grant,
+    'add-host-sets',
+    'add-host-sources'
+  );
+
+update iam_role_grant
+set
+  raw_grant = replace(
+    raw_grant,
+    'add-host-sets',
+    'add-host-sources'
+  );
+
+-- Swap set-host-sets to set-host-sources
+update iam_role_grant
+set
+  canonical_grant = replace(
+    canonical_grant,
+    'set-host-sets',
+    'set-host-sources'
+  );
+
+update iam_role_grant
+set
+  raw_grant = replace(
+    raw_grant,
+    'set-host-sets',
+    'set-host-sources'
+  );
+
+-- Swap remove-host-sets to remove-host-sources
+update iam_role_grant
+set
+  canonical_grant = replace(
+    canonical_grant,
+    'remove-host-sets',
+    'remove-host-sources'
+  );
+
+update iam_role_grant
+set
+  raw_grant = replace(
+    raw_grant,
+    'remove-host-sets',
+    'remove-host-sources'
+  );
+
+-- Swap add-credential-libraries to add-credential-sources
+update iam_role_grant
+set
+  canonical_grant = replace(
+    canonical_grant,
+    'add-credential-libraries',
+    'add-credential-sources'
+  );
+
+update iam_role_grant
+set
+  raw_grant = replace(
+    raw_grant,
+    'add-credential-libraries',
+    'add-credential-sources'
+  );
+
+-- Swap set-credential-libraries to set-credential-sources
+update iam_role_grant
+set
+  canonical_grant = replace(
+    canonical_grant,
+    'set-credential-libraries',
+    'set-credential-sources'
+  );
+
+update iam_role_grant
+set
+  raw_grant = replace(
+    raw_grant,
+    'set-credential-libraries',
+    'set-credential-sources'
+  );
+
+-- Swap remove-credential-libraries to remove-credential-sources
+update iam_role_grant
+set
+  canonical_grant = replace(
+    canonical_grant,
+    'remove-credential-libraries',
+    'remove-credential-sources'
+  );
+
+update iam_role_grant
+set
+  raw_grant = replace(
+    raw_grant,
+    'remove-credential-libraries',
+    'remove-credential-sources'
+  );
+
+create trigger immutable_role_grant before update on iam_role_grant
+  for each row execute procedure iam_immutable_role_grant();
+
+commit;

internal/db/schema/migrations/oss/postgres_53_01_test.go

@@ -0,0 +1,139 @@
+package oss_test
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/db/common"
+	"github.com/hashicorp/boundary/internal/db/schema"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/testing/dbtest"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMigrations_DeprecatedGrants(t *testing.T) {
+	const (
+		priorMigration   = 52001
+		currentMigration = 53001
+	)
+
+	t.Parallel()
+	ctx := context.Background()
+	dialect := dbtest.Postgres
+
+	c, u, _, err := dbtest.StartUsingTemplate(dialect, dbtest.WithTemplate(dbtest.Template1))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, c())
+	})
+	d, err := common.SqlOpen(dialect, u)
+	require.NoError(t, err)
+
+	// migration to the prior migration (before the one we want to test)
+	m, err := schema.NewManager(ctx, schema.Dialect(dialect), d, schema.WithEditions(
+		schema.TestCreatePartialEditions(schema.Dialect(dialect), schema.PartialEditions{"oss": priorMigration}),
+	))
+	require.NoError(t, err)
+
+	_, err = m.ApplyMigrations(ctx)
+	require.NoError(t, err)
+	state, err := m.CurrentState(ctx)
+	require.NoError(t, err)
+	want := &schema.State{
+		Initialized: true,
+		Editions: []schema.EditionState{
+			{
+				Name:                  "oss",
+				BinarySchemaVersion:   priorMigration,
+				DatabaseSchemaVersion: priorMigration,
+				DatabaseSchemaState:   schema.Equal,
+			},
+		},
+	}
+	require.Equal(t, want, state)
+
+	// Get a connection
+	dbType, err := db.StringToDbType(dialect)
+	require.NoError(t, err)
+	conn, err := db.Open(ctx, dbType, u)
+	require.NoError(t, err)
+
+	// Create project
+	wrapper := db.TestWrapper(t)
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	_, proj := iam.TestScopes(t, iamRepo)
+
+	role := iam.TestRole(t, conn, proj.GetPublicId())
+
+	initialGrants := map[string]bool{
+		"id=*;type=target;actions=read,authorize-session,add-host-sets,add-host-sets":            true,
+		"id=*;type=target;actions=set-host-sets,update,delete,remove-credential-libraries":       true,
+		"id=*;type=host-set;actions=read,update,set-credential-sources,set-credential-libraries": true,
+		"id=*;type=target;actions=add-host-sources,remove-host-sets,add-credential-libraries":    true,
+	}
+
+	// Insert grants
+	for grant := range initialGrants {
+		iam.TestRoleGrant(t, conn, role.GetPublicId(), grant)
+	}
+
+	// Fetch the role
+	_, _, initialRoleGrants, err := iamRepo.LookupRole(ctx, role.GetPublicId())
+	require.NoError(t, err)
+	require.Len(t, initialRoleGrants, len(initialGrants))
+
+	// Initial grant check
+	for _, grant := range initialRoleGrants {
+		if !initialGrants[grant.RawGrant] {
+			require.FailNow(t, "raw grant not found", grant.RawGrant)
+		}
+	}
+
+	// now we're ready for the migration we want to test.
+	m, err = schema.NewManager(ctx, schema.Dialect(dialect), d, schema.WithEditions(
+		schema.TestCreatePartialEditions(schema.Dialect(dialect), schema.PartialEditions{"oss": currentMigration}),
+	))
+	require.NoError(t, err)
+
+	_, err = m.ApplyMigrations(ctx)
+	require.NoError(t, err)
+	state, err = m.CurrentState(ctx)
+	require.NoError(t, err)
+	want = &schema.State{
+		Initialized: true,
+		Editions: []schema.EditionState{
+			{
+				Name:                  "oss",
+				BinarySchemaVersion:   currentMigration,
+				DatabaseSchemaVersion: currentMigration,
+				DatabaseSchemaState:   schema.Equal,
+			},
+		},
+	}
+	require.Equal(t, want, state)
+
+	updatedGrants := make(map[string]bool, len(initialGrants))
+	for grant := range initialGrants {
+		updatedGrant := strings.ReplaceAll(grant, "add-host-sets", "add-host-sources")
+		updatedGrant = strings.ReplaceAll(updatedGrant, "set-host-sets", "set-host-sources")
+		updatedGrant = strings.ReplaceAll(updatedGrant, "remove-host-sets", "remove-host-sources")
+		updatedGrant = strings.ReplaceAll(updatedGrant, "add-credential-libraries", "add-credential-sources")
+		updatedGrant = strings.ReplaceAll(updatedGrant, "set-credential-libraries", "set-credential-sources")
+		updatedGrant = strings.ReplaceAll(updatedGrant, "remove-credential-libraries", "remove-credential-sources")
+		updatedGrants[updatedGrant] = true
+	}
+
+	// Fetch the role again
+	_, _, updatedRoleGrants, err := iamRepo.LookupRole(ctx, role.GetPublicId())
+	require.NoError(t, err)
+	require.Len(t, updatedRoleGrants, len(updatedGrants))
+
+	// Check updated grants
+	for _, grant := range updatedRoleGrants {
+		if !updatedGrants[grant.RawGrant] {
+			require.FailNow(t, "raw grant not found in migrated state", grant.RawGrant)
+		}
+	}
+}

internal/gen/controller.swagger.json

@@ -2956,52 +2956,6 @@
         ]
       }
     },
-    "/v1/targets/{id}:add-host-sets": {
-      "post": {
-        "summary": "Adds existing Host Sets to a Target.",
-        "operationId": "TargetService_AddTargetHostSets",
-        "responses": {
-          "200": {
-            "description": "",
-            "schema": {
-              "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
-            }
-          }
-        },
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "type": "string"
-          },
-          {
-            "name": "body",
-            "in": "body",
-            "required": true,
-            "schema": {
-              "type": "object",
-              "properties": {
-                "version": {
-                  "type": "integer",
-                  "format": "int64",
-                  "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
-                },
-                "host_set_ids": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  }
-                }
-              }
-            }
-          }
-        ],
-        "tags": [
-          "controller.api.services.v1.TargetService"
-        ]
-      }
-    },
     "/v1/targets/{id}:add-host-sources": {
       "post": {
         "summary": "Adds existing Host Sources to a Target.",
@@ -3161,52 +3115,6 @@
         ]
       }
     },
-    "/v1/targets/{id}:remove-host-sets": {
-      "post": {
-        "summary": "Removes Host Sets from the Target.",
-        "operationId": "TargetService_RemoveTargetHostSets",
-        "responses": {
-          "200": {
-            "description": "",
-            "schema": {
-              "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
-            }
-          }
-        },
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "type": "string"
-          },
-          {
-            "name": "body",
-            "in": "body",
-            "required": true,
-            "schema": {
-              "type": "object",
-              "properties": {
-                "version": {
-                  "type": "integer",
-                  "format": "int64",
-                  "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
-                },
-                "host_set_ids": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  }
-                }
-              }
-            }
-          }
-        ],
-        "tags": [
-          "controller.api.services.v1.TargetService"
-        ]
-      }
-    },
     "/v1/targets/{id}:remove-host-sources": {
       "post": {
         "summary": "Removes Host Sources from the Target.",
@@ -3315,52 +3223,6 @@
         ]
       }
     },
-    "/v1/targets/{id}:set-host-sets": {
-      "post": {
-        "summary": "Sets the Host Sets on the Target.",
-        "operationId": "TargetService_SetTargetHostSets",
-        "responses": {
-          "200": {
-            "description": "",
-            "schema": {
-              "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
-            }
-          }
-        },
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "type": "string"
-          },
-          {
-            "name": "body",
-            "in": "body",
-            "required": true,
-            "schema": {
-              "type": "object",
-              "properties": {
-                "version": {
-                  "type": "integer",
-                  "format": "int64",
-                  "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
-                },
-                "host_set_ids": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  }
-                }
-              }
-            }
-          }
-        ],
-        "tags": [
-          "controller.api.services.v1.TargetService"
-        ]
-      }
-    },
     "/v1/targets/{id}:set-host-sources": {
       "post": {
         "summary": "Sources the Host Sources on the Target.",
@@ -5397,21 +5259,6 @@
         }
       }
     },
-    "controller.api.resources.targets.v1.HostSet": {
-      "type": "object",
-      "properties": {
-        "id": {
-          "type": "string",
-          "description": "Output only. The ID of the Host Set.",
-          "readOnly": true
-        },
-        "host_catalog_id": {
-          "type": "string",
-          "description": "Output only. The Host Catalog to which this Host Set belongs.",
-          "readOnly": true
-        }
-      }
-    },
     "controller.api.resources.targets.v1.HostSource": {
       "type": "object",
       "properties": {
@@ -5575,22 +5422,6 @@
           "type": "string",
           "description": "The type of the Target."
         },
-        "host_set_ids": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "description": "Output only. The IDs of the Host Sets associated with this Target.",
-          "readOnly": true
-        },
-        "host_sets": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/controller.api.resources.targets.v1.HostSet"
-          },
-          "description": "Output only. The Host Sets associated with this Target.",
-          "readOnly": true
-        },
         "host_source_ids": {
           "type": "array",
           "items": {
@@ -5988,14 +5819,6 @@
         }
       }
     },
-    "controller.api.services.v1.AddTargetHostSetsResponse": {
-      "type": "object",
-      "properties": {
-        "item": {
-          "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
-        }
-      }
-    },
     "controller.api.services.v1.AddTargetHostSourcesResponse": {
       "type": "object",
       "properties": {
@@ -6672,14 +6495,6 @@
         }
       }
     },
-    "controller.api.services.v1.RemoveTargetHostSetsResponse": {
-      "type": "object",
-      "properties": {
-        "item": {
-          "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
-        }
-      }
-    },
     "controller.api.services.v1.RemoveTargetHostSourcesResponse": {
       "type": "object",
       "properties": {
@@ -6752,14 +6567,6 @@
         }
       }
     },
-    "controller.api.services.v1.SetTargetHostSetsResponse": {
-      "type": "object",
-      "properties": {
-        "item": {
-          "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
-        }
-      }
-    },
     "controller.api.services.v1.SetTargetHostSourcesResponse": {
       "type": "object",
       "properties": {

internal/gen/controller/api/services/target_service.pb.gw.go

@@ -373,210 +373,6 @@ func local_request_TargetService_AuthorizeSession_0(ctx context.Context, marshal
 
 }
 
-func request_TargetService_AddTargetHostSets_0(ctx context.Context, marshaler runtime.Marshaler, client TargetServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq AddTargetHostSetsRequest
-	var metadata runtime.ServerMetadata
-
-	newReader, berr := utilities.IOReaderFactory(req.Body)
-	if berr != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
-	}
-	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-
-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
-	msg, err := client.AddTargetHostSets(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-
-}
-
-func local_request_TargetService_AddTargetHostSets_0(ctx context.Context, marshaler runtime.Marshaler, server TargetServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq AddTargetHostSetsRequest
-	var metadata runtime.ServerMetadata
-
-	newReader, berr := utilities.IOReaderFactory(req.Body)
-	if berr != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
-	}
-	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-
-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
-	msg, err := server.AddTargetHostSets(ctx, &protoReq)
-	return msg, metadata, err
-
-}
-
-func request_TargetService_SetTargetHostSets_0(ctx context.Context, marshaler runtime.Marshaler, client TargetServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq SetTargetHostSetsRequest
-	var metadata runtime.ServerMetadata
-
-	newReader, berr := utilities.IOReaderFactory(req.Body)
-	if berr != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
-	}
-	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-
-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
-	msg, err := client.SetTargetHostSets(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-
-}
-
-func local_request_TargetService_SetTargetHostSets_0(ctx context.Context, marshaler runtime.Marshaler, server TargetServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq SetTargetHostSetsRequest
-	var metadata runtime.ServerMetadata
-
-	newReader, berr := utilities.IOReaderFactory(req.Body)
-	if berr != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
-	}
-	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-
-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
-	msg, err := server.SetTargetHostSets(ctx, &protoReq)
-	return msg, metadata, err
-
-}
-
-func request_TargetService_RemoveTargetHostSets_0(ctx context.Context, marshaler runtime.Marshaler, client TargetServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq RemoveTargetHostSetsRequest
-	var metadata runtime.ServerMetadata
-
-	newReader, berr := utilities.IOReaderFactory(req.Body)
-	if berr != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
-	}
-	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-
-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
-	msg, err := client.RemoveTargetHostSets(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-
-}
-
-func local_request_TargetService_RemoveTargetHostSets_0(ctx context.Context, marshaler runtime.Marshaler, server TargetServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq RemoveTargetHostSetsRequest
-	var metadata runtime.ServerMetadata
-
-	newReader, berr := utilities.IOReaderFactory(req.Body)
-	if berr != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
-	}
-	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-
-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
-	msg, err := server.RemoveTargetHostSets(ctx, &protoReq)
-	return msg, metadata, err
-
-}
-
 func request_TargetService_AddTargetHostSources_0(ctx context.Context, marshaler runtime.Marshaler, client TargetServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq AddTargetHostSourcesRequest
 	var metadata runtime.ServerMetadata
@@ -1141,81 +937,6 @@ func RegisterTargetServiceHandlerServer(ctx context.Context, mux *runtime.ServeM
 
 	})
 
-	mux.Handle("POST", pattern_TargetService_AddTargetHostSets_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		var err error
-		var annotatedContext context.Context
-		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.TargetService/AddTargetHostSets", runtime.WithHTTPPathPattern("/v1/targets/{id}:add-host-sets"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_TargetService_AddTargetHostSets_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-
-		forward_TargetService_AddTargetHostSets_0(annotatedContext, mux, outboundMarshaler, w, req, response_TargetService_AddTargetHostSets_0{resp}, mux.GetForwardResponseOptions()...)
-
-	})
-
-	mux.Handle("POST", pattern_TargetService_SetTargetHostSets_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		var err error
-		var annotatedContext context.Context
-		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.TargetService/SetTargetHostSets", runtime.WithHTTPPathPattern("/v1/targets/{id}:set-host-sets"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_TargetService_SetTargetHostSets_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-
-		forward_TargetService_SetTargetHostSets_0(annotatedContext, mux, outboundMarshaler, w, req, response_TargetService_SetTargetHostSets_0{resp}, mux.GetForwardResponseOptions()...)
-
-	})
-
-	mux.Handle("POST", pattern_TargetService_RemoveTargetHostSets_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		var err error
-		var annotatedContext context.Context
-		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.TargetService/RemoveTargetHostSets", runtime.WithHTTPPathPattern("/v1/targets/{id}:remove-host-sets"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_TargetService_RemoveTargetHostSets_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-
-		forward_TargetService_RemoveTargetHostSets_0(annotatedContext, mux, outboundMarshaler, w, req, response_TargetService_RemoveTargetHostSets_0{resp}, mux.GetForwardResponseOptions()...)
-
-	})
-
 	mux.Handle("POST", pattern_TargetService_AddTargetHostSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -1539,72 +1260,6 @@ func RegisterTargetServiceHandlerClient(ctx context.Context, mux *runtime.ServeM
 
 	})
 
-	mux.Handle("POST", pattern_TargetService_AddTargetHostSets_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		var err error
-		var annotatedContext context.Context
-		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.TargetService/AddTargetHostSets", runtime.WithHTTPPathPattern("/v1/targets/{id}:add-host-sets"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_TargetService_AddTargetHostSets_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-
-		forward_TargetService_AddTargetHostSets_0(annotatedContext, mux, outboundMarshaler, w, req, response_TargetService_AddTargetHostSets_0{resp}, mux.GetForwardResponseOptions()...)
-
-	})
-
-	mux.Handle("POST", pattern_TargetService_SetTargetHostSets_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		var err error
-		var annotatedContext context.Context
-		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.TargetService/SetTargetHostSets", runtime.WithHTTPPathPattern("/v1/targets/{id}:set-host-sets"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_TargetService_SetTargetHostSets_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-
-		forward_TargetService_SetTargetHostSets_0(annotatedContext, mux, outboundMarshaler, w, req, response_TargetService_SetTargetHostSets_0{resp}, mux.GetForwardResponseOptions()...)
-
-	})
-
-	mux.Handle("POST", pattern_TargetService_RemoveTargetHostSets_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		var err error
-		var annotatedContext context.Context
-		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.TargetService/RemoveTargetHostSets", runtime.WithHTTPPathPattern("/v1/targets/{id}:remove-host-sets"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_TargetService_RemoveTargetHostSets_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-
-		forward_TargetService_RemoveTargetHostSets_0(annotatedContext, mux, outboundMarshaler, w, req, response_TargetService_RemoveTargetHostSets_0{resp}, mux.GetForwardResponseOptions()...)
-
-	})
-
 	mux.Handle("POST", pattern_TargetService_AddTargetHostSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -1776,33 +1431,6 @@ func (m response_TargetService_AuthorizeSession_0) XXX_ResponseBody() interface{
 	return response.Item
 }
 
-type response_TargetService_AddTargetHostSets_0 struct {
-	proto.Message
-}
-
-func (m response_TargetService_AddTargetHostSets_0) XXX_ResponseBody() interface{} {
-	response := m.Message.(*AddTargetHostSetsResponse)
-	return response.Item
-}
-
-type response_TargetService_SetTargetHostSets_0 struct {
-	proto.Message
-}
-
-func (m response_TargetService_SetTargetHostSets_0) XXX_ResponseBody() interface{} {
-	response := m.Message.(*SetTargetHostSetsResponse)
-	return response.Item
-}
-
-type response_TargetService_RemoveTargetHostSets_0 struct {
-	proto.Message
-}
-
-func (m response_TargetService_RemoveTargetHostSets_0) XXX_ResponseBody() interface{} {
-	response := m.Message.(*RemoveTargetHostSetsResponse)
-	return response.Item
-}
-
 type response_TargetService_AddTargetHostSources_0 struct {
 	proto.Message
 }
@@ -1870,12 +1498,6 @@ var (
 
 	pattern_TargetService_AuthorizeSession_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "authorize-session"))
 
-	pattern_TargetService_AddTargetHostSets_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "add-host-sets"))
-
-	pattern_TargetService_SetTargetHostSets_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "set-host-sets"))
-
-	pattern_TargetService_RemoveTargetHostSets_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "remove-host-sets"))
-
 	pattern_TargetService_AddTargetHostSources_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "add-host-sources"))
 
 	pattern_TargetService_SetTargetHostSources_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "set-host-sources"))
@@ -1902,12 +1524,6 @@ var (
 
 	forward_TargetService_AuthorizeSession_0 = runtime.ForwardResponseMessage
 
-	forward_TargetService_AddTargetHostSets_0 = runtime.ForwardResponseMessage
-
-	forward_TargetService_SetTargetHostSets_0 = runtime.ForwardResponseMessage
-
-	forward_TargetService_RemoveTargetHostSets_0 = runtime.ForwardResponseMessage
-
 	forward_TargetService_AddTargetHostSources_0 = runtime.ForwardResponseMessage
 
 	forward_TargetService_SetTargetHostSources_0 = runtime.ForwardResponseMessage

internal/gen/controller/api/services/target_service_grpc.pb.go

@@ -48,29 +48,6 @@ type TargetServiceClient interface {
 	DeleteTarget(ctx context.Context, in *DeleteTargetRequest, opts ...grpc.CallOption) (*DeleteTargetResponse, error)
 	// AuthorizeSession creates authorization information from a given Target.
 	AuthorizeSession(ctx context.Context, in *AuthorizeSessionRequest, opts ...grpc.CallOption) (*AuthorizeSessionResponse, error)
-	// AddTargetHostSets adds Host Sets to this Target. The provided request must
-	// include the Target ID to which the Host Sets will be added.
-	// All Host Sets added to the provided Target must be a child of a Catalog that
-	// is a child of the same scope as this Target. If the scope or Target IDs are
-	// missing, malformed, or reference non-existing resources, an error is
-	// returned. An error is returned if a Host Set is attempted to be added
-	// to a target that is already present on the Target.
-	AddTargetHostSets(ctx context.Context, in *AddTargetHostSetsRequest, opts ...grpc.CallOption) (*AddTargetHostSetsResponse, error)
-	// SetTargetHostSets sets the Target's Host Sets. Any existing Host Sets on the
-	// Target are deleted if they are not included in this request. The
-	// provided request must include the scope, and the Target ID on which the
-	// Host Sets will be set.  All Host Sets in the request must be a child of
-	// a Catalog that is in the same scope as the provided Target. If any
-	// IDs are missing, malformed, or references a non-existing resource, an
-	// error is returned.
-	SetTargetHostSets(ctx context.Context, in *SetTargetHostSetsRequest, opts ...grpc.CallOption) (*SetTargetHostSetsResponse, error)
-	// RemoveTargetHostSets removes the Host Sets from the specified Target. The
-	// provided request must include the Target ID for the Target
-	// from which the Host Sets will be removed. If the ID is missing,
-	// malformed, or references a non-existing scope or Catalog, an error is
-	// returned.  An error is returned if a Host Set is attempted to be
-	// removed from the Target when the Target does not have the Host Set.
-	RemoveTargetHostSets(ctx context.Context, in *RemoveTargetHostSetsRequest, opts ...grpc.CallOption) (*RemoveTargetHostSetsResponse, error)
 	// AddTargetHostSources adds Host Sources to this Target. The provided request
 	// must include the Target ID to which the Host Sources will be added. All
 	// Host Sources added to the provided Target must be a child of a Catalog that
@@ -182,33 +159,6 @@ func (c *targetServiceClient) AuthorizeSession(ctx context.Context, in *Authoriz
 	return out, nil
 }
 
-func (c *targetServiceClient) AddTargetHostSets(ctx context.Context, in *AddTargetHostSetsRequest, opts ...grpc.CallOption) (*AddTargetHostSetsResponse, error) {
-	out := new(AddTargetHostSetsResponse)
-	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/AddTargetHostSets", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *targetServiceClient) SetTargetHostSets(ctx context.Context, in *SetTargetHostSetsRequest, opts ...grpc.CallOption) (*SetTargetHostSetsResponse, error) {
-	out := new(SetTargetHostSetsResponse)
-	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/SetTargetHostSets", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *targetServiceClient) RemoveTargetHostSets(ctx context.Context, in *RemoveTargetHostSetsRequest, opts ...grpc.CallOption) (*RemoveTargetHostSetsResponse, error) {
-	out := new(RemoveTargetHostSetsResponse)
-	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/RemoveTargetHostSets", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *targetServiceClient) AddTargetHostSources(ctx context.Context, in *AddTargetHostSourcesRequest, opts ...grpc.CallOption) (*AddTargetHostSourcesResponse, error) {
 	out := new(AddTargetHostSourcesResponse)
 	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/AddTargetHostSources", in, out, opts...)
@@ -297,29 +247,6 @@ type TargetServiceServer interface {
 	DeleteTarget(context.Context, *DeleteTargetRequest) (*DeleteTargetResponse, error)
 	// AuthorizeSession creates authorization information from a given Target.
 	AuthorizeSession(context.Context, *AuthorizeSessionRequest) (*AuthorizeSessionResponse, error)
-	// AddTargetHostSets adds Host Sets to this Target. The provided request must
-	// include the Target ID to which the Host Sets will be added.
-	// All Host Sets added to the provided Target must be a child of a Catalog that
-	// is a child of the same scope as this Target. If the scope or Target IDs are
-	// missing, malformed, or reference non-existing resources, an error is
-	// returned. An error is returned if a Host Set is attempted to be added
-	// to a target that is already present on the Target.
-	AddTargetHostSets(context.Context, *AddTargetHostSetsRequest) (*AddTargetHostSetsResponse, error)
-	// SetTargetHostSets sets the Target's Host Sets. Any existing Host Sets on the
-	// Target are deleted if they are not included in this request. The
-	// provided request must include the scope, and the Target ID on which the
-	// Host Sets will be set.  All Host Sets in the request must be a child of
-	// a Catalog that is in the same scope as the provided Target. If any
-	// IDs are missing, malformed, or references a non-existing resource, an
-	// error is returned.
-	SetTargetHostSets(context.Context, *SetTargetHostSetsRequest) (*SetTargetHostSetsResponse, error)
-	// RemoveTargetHostSets removes the Host Sets from the specified Target. The
-	// provided request must include the Target ID for the Target
-	// from which the Host Sets will be removed. If the ID is missing,
-	// malformed, or references a non-existing scope or Catalog, an error is
-	// returned.  An error is returned if a Host Set is attempted to be
-	// removed from the Target when the Target does not have the Host Set.
-	RemoveTargetHostSets(context.Context, *RemoveTargetHostSetsRequest) (*RemoveTargetHostSetsResponse, error)
 	// AddTargetHostSources adds Host Sources to this Target. The provided request
 	// must include the Target ID to which the Host Sources will be added. All
 	// Host Sources added to the provided Target must be a child of a Catalog that
@@ -392,15 +319,6 @@ func (UnimplementedTargetServiceServer) DeleteTarget(context.Context, *DeleteTar
 func (UnimplementedTargetServiceServer) AuthorizeSession(context.Context, *AuthorizeSessionRequest) (*AuthorizeSessionResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method AuthorizeSession not implemented")
 }
-func (UnimplementedTargetServiceServer) AddTargetHostSets(context.Context, *AddTargetHostSetsRequest) (*AddTargetHostSetsResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method AddTargetHostSets not implemented")
-}
-func (UnimplementedTargetServiceServer) SetTargetHostSets(context.Context, *SetTargetHostSetsRequest) (*SetTargetHostSetsResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method SetTargetHostSets not implemented")
-}
-func (UnimplementedTargetServiceServer) RemoveTargetHostSets(context.Context, *RemoveTargetHostSetsRequest) (*RemoveTargetHostSetsResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method RemoveTargetHostSets not implemented")
-}
 func (UnimplementedTargetServiceServer) AddTargetHostSources(context.Context, *AddTargetHostSourcesRequest) (*AddTargetHostSourcesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method AddTargetHostSources not implemented")
 }
@@ -540,60 +458,6 @@ func _TargetService_AuthorizeSession_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
-func _TargetService_AddTargetHostSets_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(AddTargetHostSetsRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(TargetServiceServer).AddTargetHostSets(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/controller.api.services.v1.TargetService/AddTargetHostSets",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(TargetServiceServer).AddTargetHostSets(ctx, req.(*AddTargetHostSetsRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _TargetService_SetTargetHostSets_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(SetTargetHostSetsRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(TargetServiceServer).SetTargetHostSets(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/controller.api.services.v1.TargetService/SetTargetHostSets",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(TargetServiceServer).SetTargetHostSets(ctx, req.(*SetTargetHostSetsRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _TargetService_RemoveTargetHostSets_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(RemoveTargetHostSetsRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(TargetServiceServer).RemoveTargetHostSets(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/controller.api.services.v1.TargetService/RemoveTargetHostSets",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(TargetServiceServer).RemoveTargetHostSets(ctx, req.(*RemoveTargetHostSetsRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _TargetService_AddTargetHostSources_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(AddTargetHostSourcesRequest)
 	if err := dec(in); err != nil {
@@ -733,18 +597,6 @@ var TargetService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "AuthorizeSession",
 			Handler:    _TargetService_AuthorizeSession_Handler,
 		},
-		{
-			MethodName: "AddTargetHostSets",
-			Handler:    _TargetService_AddTargetHostSets_Handler,
-		},
-		{
-			MethodName: "SetTargetHostSets",
-			Handler:    _TargetService_SetTargetHostSets_Handler,
-		},
-		{
-			MethodName: "RemoveTargetHostSets",
-			Handler:    _TargetService_RemoveTargetHostSets_Handler,
-		},
 		{
 			MethodName: "AddTargetHostSources",
 			Handler:    _TargetService_AddTargetHostSources_Handler,

internal/proto/controller/api/resources/targets/v1/target.proto

@@ -19,14 +19,6 @@ message HostSource {
   string host_catalog_id = 20 [json_name = "host_catalog_id"]; // @gotags: `class:"public"`
 }
 
-message HostSet {
-  // Output only. The ID of the Host Set.
-  string id = 10; // @gotags: `class:"public"`
-
-  // Output only. The Host Catalog to which this Host Set belongs.
-  string host_catalog_id = 20 [json_name = "host_catalog_id"]; // @gotags: `class:"public"`
-}
-
 message CredentialSource {
   // The ID of the Credential. May be empty if the credential is dynamically generated from a library.
   string id = 10; // @gotags: `class:"public"`
@@ -116,12 +108,6 @@ message Target {
   // The type of the Target.
   string type = 90; // @gotags: `class:"public"`
 
-  // Output only. The IDs of the Host Sets associated with this Target.
-  repeated string host_set_ids = 100 [json_name = "host_set_ids"]; // @gotags: `class:"public"`
-
-  // Output only. The Host Sets associated with this Target.
-  repeated HostSet host_sets = 110 [json_name = "host_sets"];
-
   // Output only. The IDs of the Host Sources associated with this Target.
   repeated string host_source_ids = 420 [json_name = "host_source_ids"]; // @gotags: `class:"public"`
 
@@ -207,6 +193,8 @@ message Target {
   reserved 150, 180;
   reserved "egress_credential_source_ids", "egress_credential_sources";
   reserved 500, 510;
+  reserved "host_set_ids", "host_sets";
+  reserved 100, 110;
 }
 
 // TcpTargetAttributes contains attributes relevant to Targets of type "tcp"

internal/proto/controller/api/services/v1/target_service.proto

@@ -97,59 +97,6 @@ service TargetService {
     };
   }
 
-  // AddTargetHostSets adds Host Sets to this Target. The provided request must
-  // include the Target ID to which the Host Sets will be added.
-  // All Host Sets added to the provided Target must be a child of a Catalog that
-  // is a child of the same scope as this Target. If the scope or Target IDs are
-  // missing, malformed, or reference non-existing resources, an error is
-  // returned. An error is returned if a Host Set is attempted to be added
-  // to a target that is already present on the Target.
-  rpc AddTargetHostSets(AddTargetHostSetsRequest) returns (AddTargetHostSetsResponse) {
-    option (google.api.http) = {
-      post: "/v1/targets/{id}:add-host-sets"
-      body: "*"
-      response_body: "item"
-    };
-    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
-      summary: "Adds existing Host Sets to a Target."
-    };
-  }
-
-  // SetTargetHostSets sets the Target's Host Sets. Any existing Host Sets on the
-  // Target are deleted if they are not included in this request. The
-  // provided request must include the scope, and the Target ID on which the
-  // Host Sets will be set.  All Host Sets in the request must be a child of
-  // a Catalog that is in the same scope as the provided Target. If any
-  // IDs are missing, malformed, or references a non-existing resource, an
-  // error is returned.
-  rpc SetTargetHostSets(SetTargetHostSetsRequest) returns (SetTargetHostSetsResponse) {
-    option (google.api.http) = {
-      post: "/v1/targets/{id}:set-host-sets"
-      body: "*"
-      response_body: "item"
-    };
-    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
-      summary: "Sets the Host Sets on the Target."
-    };
-  }
-
-  // RemoveTargetHostSets removes the Host Sets from the specified Target. The
-  // provided request must include the Target ID for the Target
-  // from which the Host Sets will be removed. If the ID is missing,
-  // malformed, or references a non-existing scope or Catalog, an error is
-  // returned.  An error is returned if a Host Set is attempted to be
-  // removed from the Target when the Target does not have the Host Set.
-  rpc RemoveTargetHostSets(RemoveTargetHostSetsRequest) returns (RemoveTargetHostSetsResponse) {
-    option (google.api.http) = {
-      post: "/v1/targets/{id}:remove-host-sets"
-      body: "*"
-      response_body: "item"
-    };
-    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
-      summary: "Removes Host Sets from the Target."
-    };
-  }
-
   // AddTargetHostSources adds Host Sources to this Target. The provided request
   // must include the Target ID to which the Host Sources will be added. All
   // Host Sources added to the provided Target must be a child of a Catalog that
@@ -301,42 +248,6 @@ message DeleteTargetRequest {
 
 message DeleteTargetResponse {}
 
-message AddTargetHostSetsRequest {
-  string id = 1; // @gotags: `class:"public"`
-  // Version is used to ensure this resource has not changed.
-  // The mutation will fail if the version does not match the latest known good version.
-  uint32 version = 2; // @gotags: `class:"public"`
-  repeated string host_set_ids = 3 [json_name = "host_set_ids"]; // @gotags: `class:"public"`
-}
-
-message AddTargetHostSetsResponse {
-  api.resources.targets.v1.Target item = 1;
-}
-
-message SetTargetHostSetsRequest {
-  string id = 1; // @gotags: `class:"public"`
-  // Version is used to ensure this resource has not changed.
-  // The mutation will fail if the version does not match the latest known good version.
-  uint32 version = 2; // @gotags: `class:"public"`
-  repeated string host_set_ids = 3 [json_name = "host_set_ids"]; // @gotags: `class:"public"`
-}
-
-message SetTargetHostSetsResponse {
-  api.resources.targets.v1.Target item = 1;
-}
-
-message RemoveTargetHostSetsRequest {
-  string id = 1; // @gotags: `class:"public"`
-  // Version is used to ensure this resource has not changed.
-  // The mutation will fail if the version does not match the latest known good version.
-  uint32 version = 2; // @gotags: `class:"public"`
-  repeated string host_set_ids = 3 [json_name = "host_set_ids"]; // @gotags: `class:"public"`
-}
-
-message RemoveTargetHostSetsResponse {
-  api.resources.targets.v1.Target item = 1;
-}
-
 message AddTargetHostSourcesRequest {
   string id = 1; // @gotags: `class:"public"`
   // Version is used to ensure this resource has not changed.

internal/tests/api/targets/classification_test.go

@@ -53,15 +53,6 @@ func TestTargets(t *testing.T) {
 					UpdatedTime: pbNow,
 					Version:     0,
 					Type:        "type",
-					HostSetIds: []string{
-						"host-set-id",
-					},
-					HostSets: []*pb.HostSet{
-						{
-							Id:            "id",
-							HostCatalogId: "host-catalog-id",
-						},
-					},
 					HostSourceIds: []string{
 						"host-source-id",
 					},
@@ -123,15 +114,6 @@ func TestTargets(t *testing.T) {
 					UpdatedTime: pbNow,
 					Version:     0,
 					Type:        "type",
-					HostSetIds: []string{
-						"host-set-id",
-					},
-					HostSets: []*pb.HostSet{
-						{
-							Id:            "id",
-							HostCatalogId: "host-catalog-id",
-						},
-					},
 					HostSourceIds: []string{
 						"host-source-id",
 					},

internal/tests/api/targets/target_test.go

@@ -49,22 +49,22 @@ func TestHostSetASD(t *testing.T) {
 	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"), targets.WithTcpTargetDefaultPort(2))
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.Empty(tar.Item.HostSetIds)
+	assert.Empty(tar.Item.HostSourceIds)
 
-	tar, err = tarClient.AddHostSets(tc.Context(), tar.Item.Id, tar.Item.Version, []string{hSet.Item.Id})
+	tar, err = tarClient.AddHostSources(tc.Context(), tar.Item.Id, tar.Item.Version, []string{hSet.Item.Id})
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.ElementsMatch(tar.Item.HostSetIds, []string{hSet.Item.Id})
+	assert.ElementsMatch(tar.Item.HostSourceIds, []string{hSet.Item.Id})
 
-	tar, err = tarClient.SetHostSets(tc.Context(), tar.Item.Id, tar.Item.Version, []string{hSet2.Item.Id})
+	tar, err = tarClient.SetHostSources(tc.Context(), tar.Item.Id, tar.Item.Version, []string{hSet2.Item.Id})
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.ElementsMatch(tar.Item.HostSetIds, []string{hSet2.Item.Id})
+	assert.ElementsMatch(tar.Item.HostSourceIds, []string{hSet2.Item.Id})
 
-	tar, err = tarClient.RemoveHostSets(tc.Context(), tar.Item.Id, tar.Item.Version, []string{hSet2.Item.Id})
+	tar, err = tarClient.RemoveHostSources(tc.Context(), tar.Item.Id, tar.Item.Version, []string{hSet2.Item.Id})
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.Empty(tar.Item.HostSetIds)
+	assert.Empty(tar.Item.HostSourceIds)
 }
 
 func TestCredentialSourcesASD(t *testing.T) {

internal/tests/cli/boundary/_targets.bash

@@ -25,10 +25,10 @@ function list_targets() {
   boundary targets list -scope-id $1 -format json
 }
 
-function assoc_host_sets() {
+function assoc_host_sources() {
   local id=$1
   local hst=$2
-  boundary targets add-host-sets -id $id -host-set $hst
+  boundary targets add-host-sources -id $id -host-source $hst
 }
 
 function target_id_from_name() {
@@ -37,16 +37,16 @@ function target_id_from_name() {
   strip $(list_targets $sid | jq -c ".items[] | select(.name | contains(\"$name\")) | .[\"id\"]")
 }
 
-function target_host_set_ids() {
+function target_host_source_ids() {
   local tid=$1
-  boundary targets read -id $tid -format json | jq '.item.host_sets[].id'  
+  boundary targets read -id $tid -format json | jq '.item.host_sources[].id'  
 }
 
-function target_has_host_set_id() {
+function target_has_host_source_id() {
   local tid=$1
   local hsid=$2
 
-  ids=$(target_host_set_ids $tid)  
+  ids=$(target_host_source_ids $tid)  
   for id in $ids; do
     if [ $(strip "$id") == "$hsid" ]; then
       return 0 
@@ -57,7 +57,7 @@ function target_has_host_set_id() {
 
 function has_default_target_actions() {
   local out=$1
-  local actions=('read' 'update' 'delete' 'add-host-sets' 'set-host-sets' 'remove-host-sets' 'authorize-session')
+  local actions=('read' 'update' 'delete' 'add-host-sources' 'set-host-sources' 'remove-host-sources' 'authorize-session')
 
   for action in ${actions[@]}; do
     $(has_authorized_action "$out" "$action") || {

internal/tests/cli/boundary/credentials.bats

@@ -58,3 +58,18 @@ export NEW_CREDENTIAL='test'
   echo "$output"
   [ "$status" -eq 1 ]
 }
+
+@test "boundary/credential-stores: can delete $NEW_STORE static store" {
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run delete_credential_store $csid
+  echo "$output"
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-stores: can not read deleted $NEW_STORE static store" {
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+	run read_credential_store $csid
+  echo "$output"
+	[ "$status" -eq 1 ]
+}

internal/tests/cli/boundary/target.bats

@@ -74,14 +74,14 @@ load _helpers
 
 @test "boundary/target: admin user can add default host set to created target" {
   local id=$(target_id_from_name $DEFAULT_P_ID $TGT_NAME)
-  run assoc_host_sets $id $DEFAULT_HOST_SET
+  run assoc_host_sources $id $DEFAULT_HOST_SET
   echo "$output"
   [ "$status" -eq 0 ]
 }
 
 @test "boundary/target: created target has default host set" {
   local id=$(target_id_from_name $DEFAULT_P_ID $TGT_NAME)
-  run target_has_host_set_id $id $DEFAULT_HOST_SET
+  run target_has_host_source_id $id $DEFAULT_HOST_SET
   echo "$output"
   [ "$status" -eq 0 ]
 }

internal/types/action/action.go

@@ -32,9 +32,9 @@ const (
 	AddHosts                         Type = 21
 	SetHosts                         Type = 22
 	RemoveHosts                      Type = 23
-	AddHostSets                      Type = 24 // DEPRECATED
-	SetHostSets                      Type = 25 // DEPRECATED
-	RemoveHostSets                   Type = 26 // DEPRECATED
+	AddHostSets                      Type = 24 // OBSOLETE
+	SetHostSets                      Type = 25 // OBSOLETE
+	RemoveHostSets                   Type = 26 // OBSOLETE
 	Cancel                           Type = 27
 	AddAccounts                      Type = 28
 	SetAccounts                      Type = 29
@@ -121,6 +121,15 @@ var Map = map[string]Type{
 	ReadCertificateAuthority.String():         ReadCertificateAuthority,
 }
 
+var DeprecatedMap = map[string]Type{
+	AddHostSets.String():               AddHostSources,
+	SetHostSets.String():               SetHostSources,
+	RemoveHostSets.String():            RemoveHostSources,
+	AddCredentialLibraries.String():    AddCredentialSources,
+	SetCredentialLibraries.String():    SetCredentialSources,
+	RemoveCredentialLibraries.String(): RemoveCredentialSources,
+}
+
 func (a Type) String() string {
 	return [...]string{
 		"unknown",

internal/website/permstable/permstable.go

@@ -758,24 +758,45 @@ var target = &Resource{
 			Actions: append(
 				rudActions("a target", false),
 				&Action{
-					Name:        "add-host-sets",
-					Description: "Add host sets to a target",
+					Name:        "add-host-sources",
+					Description: "Add host sources to a target",
 					Examples: []string{
-						"id=<id>;actions=add-host-sets",
+						"id=<id>;actions=add-host-sources",
 					},
 				},
 				&Action{
-					Name:        "set-host-sets",
-					Description: "Set the full set of host sets on a target",
+					Name:        "set-host-sources",
+					Description: "Set the full set of host sources on a target",
 					Examples: []string{
-						"id=<id>;actions=set-host-sets",
+						"id=<id>;actions=set-host-sources",
 					},
 				},
 				&Action{
-					Name:        "remove-host-sets",
-					Description: "Remove host sets from a target",
+					Name:        "remove-host-sources",
+					Description: "Remove host sources from a target",
 					Examples: []string{
-						"id=<id>;actions=remove-host-sets",
+						"id=<id>;actions=remove-host-sources",
+					},
+				},
+				&Action{
+					Name:        "add-credential-sources",
+					Description: "Add credential sources to a target",
+					Examples: []string{
+						"id=<id>;actions=add-credential-sources",
+					},
+				},
+				&Action{
+					Name:        "set-credential-sources",
+					Description: "Set the full set of credential sources on a target",
+					Examples: []string{
+						"id=<id>;actions=set-credential-sources",
+					},
+				},
+				&Action{
+					Name:        "remove-credential-sources",
+					Description: "Remove credential sources from a target",
+					Examples: []string{
+						"id=<id>;actions=remove-credential-sources",
 					},
 				},
 				&Action{

sdk/pbs/controller/api/resources/targets/target.pb.go

@@ -83,63 +83,6 @@ func (x *HostSource) GetHostCatalogId() string {
 	return ""
 }
 
-type HostSet struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Output only. The ID of the Host Set.
-	Id string `protobuf:"bytes,10,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
-	// Output only. The Host Catalog to which this Host Set belongs.
-	HostCatalogId string `protobuf:"bytes,20,opt,name=host_catalog_id,proto3" json:"host_catalog_id,omitempty" class:"public"` // @gotags: `class:"public"`
-}
-
-func (x *HostSet) Reset() {
-	*x = HostSet{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *HostSet) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*HostSet) ProtoMessage() {}
-
-func (x *HostSet) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use HostSet.ProtoReflect.Descriptor instead.
-func (*HostSet) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *HostSet) GetId() string {
-	if x != nil {
-		return x.Id
-	}
-	return ""
-}
-
-func (x *HostSet) GetHostCatalogId() string {
-	if x != nil {
-		return x.HostCatalogId
-	}
-	return ""
-}
-
 type CredentialSource struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -162,7 +105,7 @@ type CredentialSource struct {
 func (x *CredentialSource) Reset() {
 	*x = CredentialSource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -175,7 +118,7 @@ func (x *CredentialSource) String() string {
 func (*CredentialSource) ProtoMessage() {}
 
 func (x *CredentialSource) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -188,7 +131,7 @@ func (x *CredentialSource) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CredentialSource.ProtoReflect.Descriptor instead.
 func (*CredentialSource) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{2}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *CredentialSource) GetId() string {
@@ -249,7 +192,7 @@ type SessionSecret struct {
 func (x *SessionSecret) Reset() {
 	*x = SessionSecret{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -262,7 +205,7 @@ func (x *SessionSecret) String() string {
 func (*SessionSecret) ProtoMessage() {}
 
 func (x *SessionSecret) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -275,7 +218,7 @@ func (x *SessionSecret) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionSecret.ProtoReflect.Descriptor instead.
 func (*SessionSecret) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{3}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *SessionSecret) GetRaw() string {
@@ -310,7 +253,7 @@ type SessionCredential struct {
 func (x *SessionCredential) Reset() {
 	*x = SessionCredential{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -323,7 +266,7 @@ func (x *SessionCredential) String() string {
 func (*SessionCredential) ProtoMessage() {}
 
 func (x *SessionCredential) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -336,7 +279,7 @@ func (x *SessionCredential) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionCredential.ProtoReflect.Descriptor instead.
 func (*SessionCredential) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{4}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *SessionCredential) GetCredentialSource() *CredentialSource {
@@ -385,10 +328,6 @@ type Target struct {
 	Version uint32 `protobuf:"varint,80,opt,name=version,proto3" json:"version,omitempty" class:"public"` // @gotags: `class:"public"`
 	// The type of the Target.
 	Type string `protobuf:"bytes,90,opt,name=type,proto3" json:"type,omitempty" class:"public"` // @gotags: `class:"public"`
-	// Output only. The IDs of the Host Sets associated with this Target.
-	HostSetIds []string `protobuf:"bytes,100,rep,name=host_set_ids,proto3" json:"host_set_ids,omitempty" class:"public"` // @gotags: `class:"public"`
-	// Output only. The Host Sets associated with this Target.
-	HostSets []*HostSet `protobuf:"bytes,110,rep,name=host_sets,proto3" json:"host_sets,omitempty"`
 	// Output only. The IDs of the Host Sources associated with this Target.
 	HostSourceIds []string `protobuf:"bytes,420,rep,name=host_source_ids,proto3" json:"host_source_ids,omitempty" class:"public"` // @gotags: `class:"public"`
 	// Output only. The Host Sources associated with this Target.
@@ -430,7 +369,7 @@ type Target struct {
 func (x *Target) Reset() {
 	*x = Target{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -443,7 +382,7 @@ func (x *Target) String() string {
 func (*Target) ProtoMessage() {}
 
 func (x *Target) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -456,7 +395,7 @@ func (x *Target) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Target.ProtoReflect.Descriptor instead.
 func (*Target) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{5}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *Target) GetId() string {
@@ -522,20 +461,6 @@ func (x *Target) GetType() string {
 	return ""
 }
 
-func (x *Target) GetHostSetIds() []string {
-	if x != nil {
-		return x.HostSetIds
-	}
-	return nil
-}
-
-func (x *Target) GetHostSets() []*HostSet {
-	if x != nil {
-		return x.HostSets
-	}
-	return nil
-}
-
 func (x *Target) GetHostSourceIds() []string {
 	if x != nil {
 		return x.HostSourceIds
@@ -686,7 +611,7 @@ type TcpTargetAttributes struct {
 func (x *TcpTargetAttributes) Reset() {
 	*x = TcpTargetAttributes{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -699,7 +624,7 @@ func (x *TcpTargetAttributes) String() string {
 func (*TcpTargetAttributes) ProtoMessage() {}
 
 func (x *TcpTargetAttributes) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -712,7 +637,7 @@ func (x *TcpTargetAttributes) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TcpTargetAttributes.ProtoReflect.Descriptor instead.
 func (*TcpTargetAttributes) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{6}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *TcpTargetAttributes) GetDefaultPort() *wrapperspb.UInt32Value {
@@ -736,7 +661,7 @@ type SshTargetAttributes struct {
 func (x *SshTargetAttributes) Reset() {
 	*x = SshTargetAttributes{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -749,7 +674,7 @@ func (x *SshTargetAttributes) String() string {
 func (*SshTargetAttributes) ProtoMessage() {}
 
 func (x *SshTargetAttributes) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -762,7 +687,7 @@ func (x *SshTargetAttributes) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SshTargetAttributes.ProtoReflect.Descriptor instead.
 func (*SshTargetAttributes) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{7}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *SshTargetAttributes) GetDefaultPort() *wrapperspb.UInt32Value {
@@ -785,7 +710,7 @@ type WorkerInfo struct {
 func (x *WorkerInfo) Reset() {
 	*x = WorkerInfo{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -798,7 +723,7 @@ func (x *WorkerInfo) String() string {
 func (*WorkerInfo) ProtoMessage() {}
 
 func (x *WorkerInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -811,7 +736,7 @@ func (x *WorkerInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WorkerInfo.ProtoReflect.Descriptor instead.
 func (*WorkerInfo) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{8}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *WorkerInfo) GetAddress() string {
@@ -854,7 +779,7 @@ type SessionAuthorizationData struct {
 func (x *SessionAuthorizationData) Reset() {
 	*x = SessionAuthorizationData{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[9]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -867,7 +792,7 @@ func (x *SessionAuthorizationData) String() string {
 func (*SessionAuthorizationData) ProtoMessage() {}
 
 func (x *SessionAuthorizationData) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[9]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -880,7 +805,7 @@ func (x *SessionAuthorizationData) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionAuthorizationData.ProtoReflect.Descriptor instead.
 func (*SessionAuthorizationData) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{9}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *SessionAuthorizationData) GetSessionId() string {
@@ -993,7 +918,7 @@ type SessionAuthorization struct {
 func (x *SessionAuthorization) Reset() {
 	*x = SessionAuthorization{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[10]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1006,7 +931,7 @@ func (x *SessionAuthorization) String() string {
 func (*SessionAuthorization) ProtoMessage() {}
 
 func (x *SessionAuthorization) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[10]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1019,7 +944,7 @@ func (x *SessionAuthorization) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionAuthorization.ProtoReflect.Descriptor instead.
 func (*SessionAuthorization) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{10}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *SessionAuthorization) GetSessionId() string {
@@ -1114,7 +1039,7 @@ type UsernamePasswordCredential struct {
 func (x *UsernamePasswordCredential) Reset() {
 	*x = UsernamePasswordCredential{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[11]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1127,7 +1052,7 @@ func (x *UsernamePasswordCredential) String() string {
 func (*UsernamePasswordCredential) ProtoMessage() {}
 
 func (x *UsernamePasswordCredential) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[11]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1140,7 +1065,7 @@ func (x *UsernamePasswordCredential) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UsernamePasswordCredential.ProtoReflect.Descriptor instead.
 func (*UsernamePasswordCredential) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{11}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *UsernamePasswordCredential) GetUsername() string {
@@ -1174,7 +1099,7 @@ type SshPrivateKeyCredential struct {
 func (x *SshPrivateKeyCredential) Reset() {
 	*x = SshPrivateKeyCredential{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[12]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1187,7 +1112,7 @@ func (x *SshPrivateKeyCredential) String() string {
 func (*SshPrivateKeyCredential) ProtoMessage() {}
 
 func (x *SshPrivateKeyCredential) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[12]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1200,7 +1125,7 @@ func (x *SshPrivateKeyCredential) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SshPrivateKeyCredential.ProtoReflect.Descriptor instead.
 func (*SshPrivateKeyCredential) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{12}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *SshPrivateKeyCredential) GetUsername() string {
@@ -1250,193 +1175,184 @@ var file_controller_api_resources_targets_v1_target_proto_rawDesc = []byte{
 	0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x28, 0x0a,
 	0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64,
 	0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61, 0x74,
-	0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x22, 0x43, 0x0a, 0x07, 0x48, 0x6f, 0x73, 0x74, 0x53,
-	0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
-	0x69, 0x64, 0x12, 0x28, 0x0a, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61, 0x74, 0x61, 0x6c,
-	0x6f, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x68, 0x6f, 0x73,
-	0x74, 0x5f, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x22, 0xc7, 0x01, 0x0a,
-	0x10, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
-	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63,
-	0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x28,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70,
-	0x65, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x27, 0x0a,
-	0x0f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x74, 0x79, 0x70, 0x65,
-	0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x54, 0x79, 0x70, 0x65, 0x22, 0x54, 0x0a, 0x0d, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x61, 0x77, 0x18, 0x0a,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x61, 0x77, 0x12, 0x31, 0x0a, 0x07, 0x64, 0x65, 0x63,
-	0x6f, 0x64, 0x65, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72,
-	0x75, 0x63, 0x74, 0x52, 0x07, 0x64, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x64, 0x22, 0x96, 0x02, 0x0a,
-	0x11, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x12, 0x62, 0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x35, 0x2e,
-	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73,
-	0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x52, 0x10, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x4a, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74,
-	0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
+	0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x22, 0xc7, 0x01, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x0e, 0x0a, 0x02,
+	0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
+	0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72,
+	0x65, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x3c, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x46, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x54, 0x79, 0x70,
+	0x65, 0x22, 0x54, 0x0a, 0x0d, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x72,
+	0x65, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x61, 0x77, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x72, 0x61, 0x77, 0x12, 0x31, 0x0a, 0x07, 0x64, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x64, 0x18,
+	0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x07,
+	0x64, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x64, 0x22, 0x96, 0x02, 0x0a, 0x11, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x62, 0x0a,
+	0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
+	0x10, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x12, 0x4a, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x14, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x32, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72,
+	0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53,
+	0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x37, 0x0a,
+	0x0a, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x18, 0x28, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4a, 0x04, 0x08, 0x0a, 0x10, 0x0b, 0x52, 0x12, 0x63, 0x72,
+	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79,
+	0x22, 0xd2, 0x11, 0x0a, 0x06, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x73,
+	0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73,
+	0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65,
+	0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
 	0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72,
-	0x65, 0x74, 0x12, 0x37, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52,
-	0x0a, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4a, 0x04, 0x08, 0x0a, 0x10,
-	0x0b, 0x52, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69,
-	0x62, 0x72, 0x61, 0x72, 0x79, 0x22, 0x9d, 0x12, 0x0a, 0x06, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74,
-	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x1a, 0x0a, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05,
-	0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70,
-	0x65, 0x12, 0x46, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x14, 0xa0,
-	0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x62, 0x0a, 0x0b, 0x64, 0x65, 0x73,
-	0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c,
+	0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70,
+	0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x46, 0x0a, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72,
+	0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x14, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd,
+	0x29, 0x0c, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x62, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69,
+	0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x22, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29,
+	0x1a, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b,
+	0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
 	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x22, 0xa0, 0xda,
-	0x29, 0x01, 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3e, 0x0a,
-	0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x3c, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
-	0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x3e, 0x0a,
-	0x0c, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x46, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
-	0x0c, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a,
-	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x50, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07,
-	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
-	0x5a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x68,
-	0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x64, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x12,
-	0x4a, 0x0a, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x6e, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61,
-	0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x53, 0x65, 0x74,
-	0x52, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x12, 0x29, 0x0a, 0x0f, 0x68,
-	0x6f, 0x73, 0x74, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0xa4,
-	0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x54, 0x0a, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0xae, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e,
-	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73,
-	0x2e, 0x76, 0x31, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x0c,
-	0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x80, 0x01, 0x0a,
-	0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63,
-	0x6f, 0x6e, 0x64, 0x73, 0x18, 0x78, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e,
-	0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x30, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd,
-	0x29, 0x28, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f,
-	0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x11, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x4d, 0x61, 0x78, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x52, 0x13, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12,
-	0x94, 0x01, 0x0a, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x82, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65,
-	0x42, 0x3a, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x32, 0x0a, 0x18, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c,
-	0x69, 0x6d, 0x69, 0x74, 0x12, 0x16, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e,
-	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x52, 0x18, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x6a, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72,
-	0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c,
+	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x75, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x46, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
 	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x25, 0xa0, 0xda,
-	0x29, 0x01, 0xc2, 0xdd, 0x29, 0x1d, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66,
-	0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c,
-	0x74, 0x65, 0x72, 0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74,
-	0x65, 0x72, 0x12, 0x51, 0x0a, 0x21, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x90, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x02,
-	0x18, 0x01, 0x52, 0x21, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
-	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x82, 0x01, 0x0a, 0x1e, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x9a, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65,
-	0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x02, 0x18, 0x01, 0x52, 0x1e, 0x61, 0x70, 0x70, 0x6c,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x47, 0x0a, 0x1e, 0x62, 0x72,
-	0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
-	0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0xb8, 0x03, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x1e, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x72,
-	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f,
-	0x69, 0x64, 0x73, 0x12, 0x78, 0x0a, 0x1b, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f,
-	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x18, 0xc2, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x75, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x18, 0x50, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x29, 0x0a, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0xa4, 0x03, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64,
+	0x73, 0x12, 0x54, 0x0a, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x73, 0x18, 0xae, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x48,
+	0x6f, 0x73, 0x74, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x80, 0x01, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18,
+	0x78, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x42, 0x30, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x13, 0x73,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e,
+	0x64, 0x73, 0x12, 0x11, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x78, 0x53, 0x65,
+	0x63, 0x6f, 0x6e, 0x64, 0x73, 0x52, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d,
+	0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x94, 0x01, 0x0a, 0x18, 0x73,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x3a, 0xa0, 0xda, 0x29,
+	0x01, 0xc2, 0xdd, 0x29, 0x32, 0x0a, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12,
+	0x16, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x52, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69,
+	0x74, 0x12, 0x6a, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74,
+	0x65, 0x72, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69,
+	0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x25, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29,
+	0x1d, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72,
+	0x12, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0d,
+	0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x51, 0x0a,
+	0x21, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x90, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x21, 0x61,
+	0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73,
+	0x12, 0x82, 0x01, 0x0a, 0x1e, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x73, 0x18, 0x9a, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31,
+	0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x42, 0x02, 0x18, 0x01, 0x52, 0x1e, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x47, 0x0a, 0x1e, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65,
+	0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0xb8, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x1e,
+	0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x78,
+	0x0a, 0x1b, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0xc2, 0x03,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e,
+	0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x1b, 0x62, 0x72, 0x6f,
+	0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
+	0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x5f, 0x0a, 0x2a, 0x69, 0x6e, 0x6a, 0x65,
+	0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x88, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x2a, 0x69,
+	0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x90, 0x01, 0x0a, 0x27, 0x69, 0x6e,
+	0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x92, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63,
+	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x52, 0x27, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70,
+	0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x0a,
+	0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0xc8, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x42, 0x0f, 0xa0, 0xda, 0x29, 0x01,
+	0x9a, 0xe3, 0x29, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x48, 0x00, 0x52, 0x0a, 0x61,
+	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x8c, 0x01, 0x0a, 0x15, 0x74, 0x63,
+	0x70, 0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
+	0x74, 0x65, 0x73, 0x18, 0xc9, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31,
+	0x2e, 0x54, 0x63, 0x70, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62,
+	0x75, 0x74, 0x65, 0x73, 0x42, 0x1b, 0xa0, 0xda, 0x29, 0x01, 0x9a, 0xe3, 0x29, 0x03, 0x74, 0x63,
+	0x70, 0xfa, 0xd2, 0xe4, 0x93, 0x02, 0x0a, 0x12, 0x08, 0x49, 0x4e, 0x54, 0x45, 0x52, 0x4e, 0x41,
+	0x4c, 0x48, 0x00, 0x52, 0x13, 0x74, 0x63, 0x70, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74,
+	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x8c, 0x01, 0x0a, 0x15, 0x73, 0x73, 0x68,
+	0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x73, 0x18, 0xca, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
 	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
 	0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e,
-	0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x52, 0x1b, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x5f, 0x0a,
-	0x2a, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x88, 0x04, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x2a, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70,
-	0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x90,
-	0x01, 0x0a, 0x27, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70, 0x6c,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x92, 0x04, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72,
-	0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x27, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74,
-	0x65, 0x64, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63,
-	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x73, 0x12, 0x4b, 0x0a, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18,
-	0xc8, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x42,
-	0x0f, 0xa0, 0xda, 0x29, 0x01, 0x9a, 0xe3, 0x29, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
-	0x48, 0x00, 0x52, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x8c,
-	0x01, 0x0a, 0x15, 0x74, 0x63, 0x70, 0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x61, 0x74,
-	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0xc9, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x38, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65,
-	0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x63, 0x70, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41,
-	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x42, 0x1b, 0xa0, 0xda, 0x29, 0x01, 0x9a,
-	0xe3, 0x29, 0x03, 0x74, 0x63, 0x70, 0xfa, 0xd2, 0xe4, 0x93, 0x02, 0x0a, 0x12, 0x08, 0x49, 0x4e,
-	0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c, 0x48, 0x00, 0x52, 0x13, 0x74, 0x63, 0x70, 0x54, 0x61, 0x72,
-	0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x8c, 0x01,
-	0x0a, 0x15, 0x73, 0x73, 0x68, 0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x61, 0x74, 0x74,
-	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0xca, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38,
-	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74,
-	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x73, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74,
-	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x42, 0x1b, 0xa0, 0xda, 0x29, 0x01, 0x9a, 0xe3,
-	0x29, 0x03, 0x73, 0x73, 0x68, 0xfa, 0xd2, 0xe4, 0x93, 0x02, 0x0a, 0x12, 0x08, 0x49, 0x4e, 0x54,
-	0x45, 0x52, 0x4e, 0x41, 0x4c, 0x48, 0x00, 0x52, 0x13, 0x73, 0x73, 0x68, 0x54, 0x61, 0x72, 0x67,
-	0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x2f, 0x0a, 0x12,
-	0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x18, 0xac, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x07, 0x0a,
-	0x05, 0x61, 0x74, 0x74, 0x72, 0x73, 0x4a, 0x06, 0x08, 0x96, 0x01, 0x10, 0x97, 0x01, 0x4a, 0x06,
-	0x08, 0xb4, 0x01, 0x10, 0xb5, 0x01, 0x4a, 0x06, 0x08, 0xf4, 0x03, 0x10, 0xf5, 0x03, 0x4a, 0x06,
-	0x08, 0xfe, 0x03, 0x10, 0xff, 0x03, 0x52, 0x22, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c,
-	0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x73, 0x52, 0x20, 0x61, 0x70, 0x70, 0x6c,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x69, 0x65, 0x73, 0x52, 0x1c, 0x65, 0x67,
-	0x72, 0x65, 0x73, 0x73, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x52, 0x19, 0x65, 0x67, 0x72, 0x65,
-	0x73, 0x73, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x87, 0x01, 0x0a, 0x13, 0x54, 0x63, 0x70, 0x54, 0x61, 0x72,
+	0x53, 0x73, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
+	0x74, 0x65, 0x73, 0x42, 0x1b, 0xa0, 0xda, 0x29, 0x01, 0x9a, 0xe3, 0x29, 0x03, 0x73, 0x73, 0x68,
+	0xfa, 0xd2, 0xe4, 0x93, 0x02, 0x0a, 0x12, 0x08, 0x49, 0x4e, 0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c,
+	0x48, 0x00, 0x52, 0x13, 0x73, 0x73, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74, 0x74,
+	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x2f, 0x0a, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xac, 0x02,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64,
+	0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x07, 0x0a, 0x05, 0x61, 0x74, 0x74, 0x72,
+	0x73, 0x4a, 0x06, 0x08, 0x96, 0x01, 0x10, 0x97, 0x01, 0x4a, 0x06, 0x08, 0xb4, 0x01, 0x10, 0xb5,
+	0x01, 0x4a, 0x06, 0x08, 0xf4, 0x03, 0x10, 0xf5, 0x03, 0x4a, 0x06, 0x08, 0xfe, 0x03, 0x10, 0xff,
+	0x03, 0x4a, 0x04, 0x08, 0x64, 0x10, 0x65, 0x4a, 0x04, 0x08, 0x6e, 0x10, 0x6f, 0x52, 0x22, 0x61,
+	0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64,
+	0x73, 0x52, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72,
+	0x69, 0x65, 0x73, 0x52, 0x1c, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64,
+	0x73, 0x52, 0x19, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x52, 0x0c, 0x68, 0x6f,
+	0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x52, 0x09, 0x68, 0x6f, 0x73, 0x74,
+	0x5f, 0x73, 0x65, 0x74, 0x73, 0x22, 0x87, 0x01, 0x0a, 0x13, 0x54, 0x63, 0x70, 0x54, 0x61, 0x72,
 	0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x70, 0x0a,
 	0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0a, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
@@ -1552,62 +1468,60 @@ func file_controller_api_resources_targets_v1_target_proto_rawDescGZIP() []byte
 	return file_controller_api_resources_targets_v1_target_proto_rawDescData
 }
 
-var file_controller_api_resources_targets_v1_target_proto_msgTypes = make([]protoimpl.MessageInfo, 13)
+var file_controller_api_resources_targets_v1_target_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
 var file_controller_api_resources_targets_v1_target_proto_goTypes = []interface{}{
 	(*HostSource)(nil),                 // 0: controller.api.resources.targets.v1.HostSource
-	(*HostSet)(nil),                    // 1: controller.api.resources.targets.v1.HostSet
-	(*CredentialSource)(nil),           // 2: controller.api.resources.targets.v1.CredentialSource
-	(*SessionSecret)(nil),              // 3: controller.api.resources.targets.v1.SessionSecret
-	(*SessionCredential)(nil),          // 4: controller.api.resources.targets.v1.SessionCredential
-	(*Target)(nil),                     // 5: controller.api.resources.targets.v1.Target
-	(*TcpTargetAttributes)(nil),        // 6: controller.api.resources.targets.v1.TcpTargetAttributes
-	(*SshTargetAttributes)(nil),        // 7: controller.api.resources.targets.v1.SshTargetAttributes
-	(*WorkerInfo)(nil),                 // 8: controller.api.resources.targets.v1.WorkerInfo
-	(*SessionAuthorizationData)(nil),   // 9: controller.api.resources.targets.v1.SessionAuthorizationData
-	(*SessionAuthorization)(nil),       // 10: controller.api.resources.targets.v1.SessionAuthorization
-	(*UsernamePasswordCredential)(nil), // 11: controller.api.resources.targets.v1.UsernamePasswordCredential
-	(*SshPrivateKeyCredential)(nil),    // 12: controller.api.resources.targets.v1.SshPrivateKeyCredential
-	(*structpb.Struct)(nil),            // 13: google.protobuf.Struct
-	(*scopes.ScopeInfo)(nil),           // 14: controller.api.resources.scopes.v1.ScopeInfo
-	(*wrapperspb.StringValue)(nil),     // 15: google.protobuf.StringValue
-	(*timestamppb.Timestamp)(nil),      // 16: google.protobuf.Timestamp
-	(*wrapperspb.UInt32Value)(nil),     // 17: google.protobuf.UInt32Value
-	(*wrapperspb.Int32Value)(nil),      // 18: google.protobuf.Int32Value
+	(*CredentialSource)(nil),           // 1: controller.api.resources.targets.v1.CredentialSource
+	(*SessionSecret)(nil),              // 2: controller.api.resources.targets.v1.SessionSecret
+	(*SessionCredential)(nil),          // 3: controller.api.resources.targets.v1.SessionCredential
+	(*Target)(nil),                     // 4: controller.api.resources.targets.v1.Target
+	(*TcpTargetAttributes)(nil),        // 5: controller.api.resources.targets.v1.TcpTargetAttributes
+	(*SshTargetAttributes)(nil),        // 6: controller.api.resources.targets.v1.SshTargetAttributes
+	(*WorkerInfo)(nil),                 // 7: controller.api.resources.targets.v1.WorkerInfo
+	(*SessionAuthorizationData)(nil),   // 8: controller.api.resources.targets.v1.SessionAuthorizationData
+	(*SessionAuthorization)(nil),       // 9: controller.api.resources.targets.v1.SessionAuthorization
+	(*UsernamePasswordCredential)(nil), // 10: controller.api.resources.targets.v1.UsernamePasswordCredential
+	(*SshPrivateKeyCredential)(nil),    // 11: controller.api.resources.targets.v1.SshPrivateKeyCredential
+	(*structpb.Struct)(nil),            // 12: google.protobuf.Struct
+	(*scopes.ScopeInfo)(nil),           // 13: controller.api.resources.scopes.v1.ScopeInfo
+	(*wrapperspb.StringValue)(nil),     // 14: google.protobuf.StringValue
+	(*timestamppb.Timestamp)(nil),      // 15: google.protobuf.Timestamp
+	(*wrapperspb.UInt32Value)(nil),     // 16: google.protobuf.UInt32Value
+	(*wrapperspb.Int32Value)(nil),      // 17: google.protobuf.Int32Value
 }
 var file_controller_api_resources_targets_v1_target_proto_depIdxs = []int32{
-	13, // 0: controller.api.resources.targets.v1.SessionSecret.decoded:type_name -> google.protobuf.Struct
-	2,  // 1: controller.api.resources.targets.v1.SessionCredential.credential_source:type_name -> controller.api.resources.targets.v1.CredentialSource
-	3,  // 2: controller.api.resources.targets.v1.SessionCredential.secret:type_name -> controller.api.resources.targets.v1.SessionSecret
-	13, // 3: controller.api.resources.targets.v1.SessionCredential.credential:type_name -> google.protobuf.Struct
-	14, // 4: controller.api.resources.targets.v1.Target.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	15, // 5: controller.api.resources.targets.v1.Target.name:type_name -> google.protobuf.StringValue
-	15, // 6: controller.api.resources.targets.v1.Target.description:type_name -> google.protobuf.StringValue
-	16, // 7: controller.api.resources.targets.v1.Target.created_time:type_name -> google.protobuf.Timestamp
-	16, // 8: controller.api.resources.targets.v1.Target.updated_time:type_name -> google.protobuf.Timestamp
-	1,  // 9: controller.api.resources.targets.v1.Target.host_sets:type_name -> controller.api.resources.targets.v1.HostSet
-	0,  // 10: controller.api.resources.targets.v1.Target.host_sources:type_name -> controller.api.resources.targets.v1.HostSource
-	17, // 11: controller.api.resources.targets.v1.Target.session_max_seconds:type_name -> google.protobuf.UInt32Value
-	18, // 12: controller.api.resources.targets.v1.Target.session_connection_limit:type_name -> google.protobuf.Int32Value
-	15, // 13: controller.api.resources.targets.v1.Target.worker_filter:type_name -> google.protobuf.StringValue
-	2,  // 14: controller.api.resources.targets.v1.Target.application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
-	2,  // 15: controller.api.resources.targets.v1.Target.brokered_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
-	2,  // 16: controller.api.resources.targets.v1.Target.injected_application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
-	13, // 17: controller.api.resources.targets.v1.Target.attributes:type_name -> google.protobuf.Struct
-	6,  // 18: controller.api.resources.targets.v1.Target.tcp_target_attributes:type_name -> controller.api.resources.targets.v1.TcpTargetAttributes
-	7,  // 19: controller.api.resources.targets.v1.Target.ssh_target_attributes:type_name -> controller.api.resources.targets.v1.SshTargetAttributes
-	17, // 20: controller.api.resources.targets.v1.TcpTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
-	17, // 21: controller.api.resources.targets.v1.SshTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
-	14, // 22: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	16, // 23: controller.api.resources.targets.v1.SessionAuthorizationData.created_time:type_name -> google.protobuf.Timestamp
-	8,  // 24: controller.api.resources.targets.v1.SessionAuthorizationData.worker_info:type_name -> controller.api.resources.targets.v1.WorkerInfo
-	14, // 25: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	16, // 26: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp
-	4,  // 27: controller.api.resources.targets.v1.SessionAuthorization.credentials:type_name -> controller.api.resources.targets.v1.SessionCredential
-	28, // [28:28] is the sub-list for method output_type
-	28, // [28:28] is the sub-list for method input_type
-	28, // [28:28] is the sub-list for extension type_name
-	28, // [28:28] is the sub-list for extension extendee
-	0,  // [0:28] is the sub-list for field type_name
+	12, // 0: controller.api.resources.targets.v1.SessionSecret.decoded:type_name -> google.protobuf.Struct
+	1,  // 1: controller.api.resources.targets.v1.SessionCredential.credential_source:type_name -> controller.api.resources.targets.v1.CredentialSource
+	2,  // 2: controller.api.resources.targets.v1.SessionCredential.secret:type_name -> controller.api.resources.targets.v1.SessionSecret
+	12, // 3: controller.api.resources.targets.v1.SessionCredential.credential:type_name -> google.protobuf.Struct
+	13, // 4: controller.api.resources.targets.v1.Target.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	14, // 5: controller.api.resources.targets.v1.Target.name:type_name -> google.protobuf.StringValue
+	14, // 6: controller.api.resources.targets.v1.Target.description:type_name -> google.protobuf.StringValue
+	15, // 7: controller.api.resources.targets.v1.Target.created_time:type_name -> google.protobuf.Timestamp
+	15, // 8: controller.api.resources.targets.v1.Target.updated_time:type_name -> google.protobuf.Timestamp
+	0,  // 9: controller.api.resources.targets.v1.Target.host_sources:type_name -> controller.api.resources.targets.v1.HostSource
+	16, // 10: controller.api.resources.targets.v1.Target.session_max_seconds:type_name -> google.protobuf.UInt32Value
+	17, // 11: controller.api.resources.targets.v1.Target.session_connection_limit:type_name -> google.protobuf.Int32Value
+	14, // 12: controller.api.resources.targets.v1.Target.worker_filter:type_name -> google.protobuf.StringValue
+	1,  // 13: controller.api.resources.targets.v1.Target.application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
+	1,  // 14: controller.api.resources.targets.v1.Target.brokered_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
+	1,  // 15: controller.api.resources.targets.v1.Target.injected_application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
+	12, // 16: controller.api.resources.targets.v1.Target.attributes:type_name -> google.protobuf.Struct
+	5,  // 17: controller.api.resources.targets.v1.Target.tcp_target_attributes:type_name -> controller.api.resources.targets.v1.TcpTargetAttributes
+	6,  // 18: controller.api.resources.targets.v1.Target.ssh_target_attributes:type_name -> controller.api.resources.targets.v1.SshTargetAttributes
+	16, // 19: controller.api.resources.targets.v1.TcpTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
+	16, // 20: controller.api.resources.targets.v1.SshTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
+	13, // 21: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	15, // 22: controller.api.resources.targets.v1.SessionAuthorizationData.created_time:type_name -> google.protobuf.Timestamp
+	7,  // 23: controller.api.resources.targets.v1.SessionAuthorizationData.worker_info:type_name -> controller.api.resources.targets.v1.WorkerInfo
+	13, // 24: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	15, // 25: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp
+	3,  // 26: controller.api.resources.targets.v1.SessionAuthorization.credentials:type_name -> controller.api.resources.targets.v1.SessionCredential
+	27, // [27:27] is the sub-list for method output_type
+	27, // [27:27] is the sub-list for method input_type
+	27, // [27:27] is the sub-list for extension type_name
+	27, // [27:27] is the sub-list for extension extendee
+	0,  // [0:27] is the sub-list for field type_name
 }
 
 func init() { file_controller_api_resources_targets_v1_target_proto_init() }
@@ -1629,18 +1543,6 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HostSet); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_controller_api_resources_targets_v1_target_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CredentialSource); i {
 			case 0:
 				return &v.state
@@ -1652,7 +1554,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 				return nil
 			}
 		}
-		file_controller_api_resources_targets_v1_target_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*SessionSecret); i {
 			case 0:
 				return &v.state
@@ -1664,7 +1566,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 				return nil
 			}
 		}
-		file_controller_api_resources_targets_v1_target_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*SessionCredential); i {
 			case 0:
 				return &v.state
@@ -1676,7 +1578,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 				return nil
 			}
 		}
-		file_controller_api_resources_targets_v1_target_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Target); i {
 			case 0:
 				return &v.state
@@ -1688,7 +1590,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 				return nil
 			}
 		}
-		file_controller_api_resources_targets_v1_target_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*TcpTargetAttributes); i {
 			case 0:
 				return &v.state
@@ -1700,7 +1602,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 				return nil
 			}
 		}
-		file_controller_api_resources_targets_v1_target_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*SshTargetAttributes); i {
 			case 0:
 				return &v.state
@@ -1712,7 +1614,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 				return nil
 			}
 		}
-		file_controller_api_resources_targets_v1_target_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*WorkerInfo); i {
 			case 0:
 				return &v.state
@@ -1724,7 +1626,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 				return nil
 			}
 		}
-		file_controller_api_resources_targets_v1_target_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*SessionAuthorizationData); i {
 			case 0:
 				return &v.state
@@ -1736,7 +1638,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 				return nil
 			}
 		}
-		file_controller_api_resources_targets_v1_target_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*SessionAuthorization); i {
 			case 0:
 				return &v.state
@@ -1748,7 +1650,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 				return nil
 			}
 		}
-		file_controller_api_resources_targets_v1_target_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*UsernamePasswordCredential); i {
 			case 0:
 				return &v.state
@@ -1760,7 +1662,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 				return nil
 			}
 		}
-		file_controller_api_resources_targets_v1_target_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*SshPrivateKeyCredential); i {
 			case 0:
 				return &v.state
@@ -1773,7 +1675,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 	}
-	file_controller_api_resources_targets_v1_target_proto_msgTypes[5].OneofWrappers = []interface{}{
+	file_controller_api_resources_targets_v1_target_proto_msgTypes[4].OneofWrappers = []interface{}{
 		(*Target_Attributes)(nil),
 		(*Target_TcpTargetAttributes)(nil),
 		(*Target_SshTargetAttributes)(nil),
@@ -1784,7 +1686,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_controller_api_resources_targets_v1_target_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   13,
+			NumMessages:   12,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

website/content/docs/concepts/filtering/resource-listing.mdx

@@ -49,9 +49,9 @@ following is the output of `boundary targets list -scope-id p_1234567890 -format
       "read",
       "update",
       "delete",
-      "add-host-sets",
-      "set-host-sets",
-      "remove-host-sets",
+      "add-host-sources",
+      "set-host-sources",
+      "remove-host-sources",
       "authorize-session"
     ]
   }

website/content/docs/concepts/security/permissions/resource-table.mdx

@@ -1293,27 +1293,51 @@ documentation](https://www.boundaryproject.io/api-docs) for guidance.
             </li>
           </ul>
           <li>
-            <code>add-host-sets</code>: Add host sets to a target
+            <code>add-host-sources</code>: Add host sources to a target
           </li>
           <ul>
             <li>
-              <code>id=&lt;id&gt;;actions=add-host-sets</code>
+              <code>id=&lt;id&gt;;actions=add-host-sources</code>
             </li>
           </ul>
           <li>
-            <code>set-host-sets</code>: Set the full set of host sets on a target
+            <code>set-host-sources</code>: Set the full set of host sources on a target
           </li>
           <ul>
             <li>
-              <code>id=&lt;id&gt;;actions=set-host-sets</code>
+              <code>id=&lt;id&gt;;actions=set-host-sources</code>
             </li>
           </ul>
           <li>
-            <code>remove-host-sets</code>: Remove host sets from a target
+            <code>remove-host-sources</code>: Remove host sources from a target
           </li>
           <ul>
             <li>
-              <code>id=&lt;id&gt;;actions=remove-host-sets</code>
+              <code>id=&lt;id&gt;;actions=remove-host-sources</code>
+            </li>
+          </ul>
+          <li>
+            <code>add-credential-sources</code>: Add credential sources to a target
+          </li>
+          <ul>
+            <li>
+              <code>id=&lt;id&gt;;actions=add-credential-sources</code>
+            </li>
+          </ul>
+          <li>
+            <code>set-credential-sources</code>: Set the full set of credential sources on a target
+          </li>
+          <ul>
+            <li>
+              <code>id=&lt;id&gt;;actions=set-credential-sources</code>
+            </li>
+          </ul>
+          <li>
+            <code>remove-credential-sources</code>: Remove credential sources from a target
+          </li>
+          <ul>
+            <li>
+              <code>id=&lt;id&gt;;actions=remove-credential-sources</code>
             </li>
           </ul>
           <li>