Add worker tagging (#862)

This allows workers to have tags assigned to them, which can then be filtered to control which targets they are allowed to serve.

internal/proto/local/controller/api/resources/targets/v1/target.proto

@@ -42,7 +42,7 @@ message Target {
 	google.protobuf.Timestamp updated_time = 70 [json_name="updated_time"];
 
 	// Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
-  // The mutation will fail if the version does not match the latest known good version.
+	// The mutation will fail if the version does not match the latest known good version.
 	uint32 version = 80;
 
 	// The type of the Target.
@@ -55,10 +55,13 @@ message Target {
 	repeated HostSet host_sets = 110 [json_name="host_sets"];
 
 	// Maximum total lifetime of a created Session, in seconds.
-	google.protobuf.UInt32Value session_max_seconds = 120 [json_name="session_max_seconds", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this:"session_max_seconds" that: "SessionMaxSeconds"}];
+	google.protobuf.UInt32Value session_max_seconds = 120 [json_name="session_max_seconds", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this: "session_max_seconds" that: "SessionMaxSeconds"}];
 
 	// Maximum number of connections allowed in a Session.  Unlimited is indicated by the value -1.
-	google.protobuf.Int32Value session_connection_limit = 130 [json_name="session_connection_limit", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this:"session_connection_limit" that: "SessionConnectionLimit"}];
+	google.protobuf.Int32Value session_connection_limit = 130 [json_name="session_connection_limit", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this: "session_connection_limit" that: "SessionConnectionLimit"}];
+
+	// Optional boolean expression to filter the workers that are allowed to satisfy this request.
+	google.protobuf.StringValue worker_filter = 140 [json_name="worker_filter", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this: "worker_filter" that: "WorkerFilter"}];
 
 	// The attributes that are applicable for the specific Target.
 	google.protobuf.Struct attributes = 200 [(custom_options.v1.generate_sdk_option) = true];
@@ -70,7 +73,7 @@ message Target {
 // TcpTargetAttributes contains attributes relevant to Targets of type "tcp"
 message TcpTargetAttributes {
 	// The default TCP port that will be used when connecting to the endpoint unless overridden by a Host Set or Host.
-	google.protobuf.UInt32Value default_port = 10 [json_name="default_port", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this:"attributes.default_port" that: "DefaultPort"}];
+	google.protobuf.UInt32Value default_port = 10 [json_name="default_port", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this: "attributes.default_port" that: "DefaultPort"}];
 }
 
 // WorkerInfo contains information about workers, returned in to the client in SessionAuthorization

internal/proto/local/controller/servers/services/v1/server_coordination_service.proto

@@ -65,6 +65,12 @@ message StatusRequest {
 
   // Jobs which this worker wants to report the status.
   repeated JobStatus jobs = 20;
+
+  // Whether to update tags from the Server block on this RPC. We only need to
+  // do this at startup or (at some point) SIGHUP, so specifying when it's
+  // changed allows us to avoid constant database operations for something that
+  // won't change very often, if ever.
+  bool update_tags = 30;
 }
 
 enum CHANGETYPE {

internal/proto/local/controller/servers/services/v1/session_service.proto

@@ -33,6 +33,9 @@ service SessionService {
 message LookupSessionRequest {
 	// The session ID from the client
 	string session_id = 10;
+	// The name of the requesting worker, used for filtering to ensure this
+	// worker is allowed to handle this session.
+	string server_id = 20;
 }
 
 // LookupSessionResponse contains information necessary for a client to

internal/proto/local/controller/servers/v1/servers.proto

@@ -13,8 +13,11 @@ message Server {
   // Type of the resource (controller, worker)
   string type = 20;
 
-  // Name of the resource
-  string name = 30;
+  // Name of the resource. This is deprecated because we ended up setting the
+  // private ID and name to be identical, and there is currently no reason we
+  // can think of to allow a given server's name to match another within the
+  // same cluster. So we simply use the private ID and deprecate this.
+  string name = 30 [deprecated = true];
 
   // Description of the resource
   string description = 40;
@@ -27,4 +30,13 @@ message Server {
 
   // Last time there was an update
   storage.timestamp.v1.Timestamp update_time = 70;
+
+  // Tags for workers
+  map<string, TagValues> tags = 80;
 }
+
+// TagValues is used because map fields cannot be repeated but can be a
+// message
+message TagValues {
+  repeated string values = 10;
+}

internal/proto/local/controller/storage/target/store/v1/target.proto

@@ -53,6 +53,10 @@ message TargetView {
   // Maximum number of connections in a session
   // @inject_tag: `gorm:"default:null"`
   int32 session_connection_limit = 110;
+
+  // A boolean expression that allows filtering the workers that can handle a session
+  // @inject_tag: `gorm:"default:null"`
+  string worker_filter = 120;
 }
 
 message TargetHostSet {
@@ -124,4 +128,11 @@ message TcpTarget {
     this: "SessionConnectionLimit"
     that: "session_connection_limit"
   }];
+
+  // A boolean expression that allows filtering the workers that can handle a session
+  // @inject_tag: `gorm:"default:null"`
+  string worker_filter = 120 [(custom_options.v1.mask_mapping) = {
+    this: "WorkerFilter"
+    that: "worker_filter"
+  }];
 }