feat(targets): Addition of egress and ingress worker filters (#2654)

* feat(targets): Addition of egress and ingress worker filters

api/targets/option.gen.go

@@ -183,12 +183,36 @@ func DefaultDescription() Option {
 	}
 }
 
+func WithEgressWorkerFilter(inEgressWorkerFilter string) Option {
+	return func(o *options) {
+		o.postMap["egress_worker_filter"] = inEgressWorkerFilter
+	}
+}
+
+func DefaultEgressWorkerFilter() Option {
+	return func(o *options) {
+		o.postMap["egress_worker_filter"] = nil
+	}
+}
+
 func WithHostId(inHostId string) Option {
 	return func(o *options) {
 		o.postMap["host_id"] = inHostId
 	}
 }
 
+func WithIngressWorkerFilter(inIngressWorkerFilter string) Option {
+	return func(o *options) {
+		o.postMap["ingress_worker_filter"] = inIngressWorkerFilter
+	}
+}
+
+func DefaultIngressWorkerFilter() Option {
+	return func(o *options) {
+		o.postMap["ingress_worker_filter"] = nil
+	}
+}
+
 func WithInjectedApplicationCredentialSourceIds(inInjectedApplicationCredentialSourceIds []string) Option {
 	return func(o *options) {
 		o.postMap["injected_application_credential_source_ids"] = inInjectedApplicationCredentialSourceIds

api/targets/target.gen.go

@@ -27,6 +27,8 @@ type Target struct {
 	SessionMaxSeconds                      uint32                 `json:"session_max_seconds,omitempty"`
 	SessionConnectionLimit                 int32                  `json:"session_connection_limit,omitempty"`
 	WorkerFilter                           string                 `json:"worker_filter,omitempty"`
+	EgressWorkerFilter                     string                 `json:"egress_worker_filter,omitempty"`
+	IngressWorkerFilter                    string                 `json:"ingress_worker_filter,omitempty"`
 	ApplicationCredentialSourceIds         []string               `json:"application_credential_source_ids,omitempty"`
 	ApplicationCredentialSources           []*CredentialSource    `json:"application_credential_sources,omitempty"`
 	BrokeredCredentialSourceIds            []string               `json:"brokered_credential_source_ids,omitempty"`

globals/fields.go

@@ -45,6 +45,8 @@ const (
 	SessionConnectionLimitField                 = "session_connection_limit"
 	SessionMaxSecondsField                      = "session_max_seconds"
 	WorkerFilterField                           = "worker_filter"
+	EgressWorkerFilterField                     = "egress_worker_filter"
+	IngressWorkerFilterField                    = "ingress_worker_filter"
 	AccountIdsField                             = "account_ids"
 	AccountsField                               = "accounts"
 	LoginNameField                              = "login_name"

internal/cmd/commands/targetscmd/funcs.go

@@ -519,6 +519,12 @@ func printItemTable(item *targets.Target, resp *api.Response) string {
 	if item.WorkerFilter != "" {
 		nonAttributeMap["Worker Filter"] = item.WorkerFilter
 	}
+	if item.EgressWorkerFilter != "" {
+		nonAttributeMap["Egress Worker Filter"] = item.EgressWorkerFilter
+	}
+	if item.IngressWorkerFilter != "" {
+		nonAttributeMap["Ingress Worker Filter"] = item.IngressWorkerFilter
+	}
 	if resp != nil && resp.Map != nil {
 		if resp.Map[globals.SessionConnectionLimitField] != nil {
 			nonAttributeMap["Session Connection Limit"] = item.SessionConnectionLimit

internal/cmd/commands/targetscmd/ssh_funcs.go

@@ -19,8 +19,8 @@ func init() {
 
 func extraSshActionsFlagsMapFuncImpl() map[string][]string {
 	return map[string][]string{
-		"create": {"default-port", "session-max-seconds", "session-connection-limit", "worker-filter"},
-		"update": {"default-port", "session-max-seconds", "session-connection-limit", "worker-filter"},
+		"create": {"default-port", "session-max-seconds", "session-connection-limit", "egress-worker-filter", "ingress-worker-filter"},
+		"update": {"default-port", "session-max-seconds", "session-connection-limit", "worker-filter", "egress-worker-filter", "ingress-worker-filter"},
 	}
 }
 
@@ -29,6 +29,8 @@ type extraSshCmdVars struct {
 	flagSessionMaxSeconds      string
 	flagSessionConnectionLimit string
 	flagWorkerFilter           string
+	flagEgressWorkerFilter     string
+	flagIngressWorkerFilter    string
 }
 
 func (c *SshCommand) extraSshHelpFunc(helpMap map[string]func() string) string {
@@ -86,7 +88,19 @@ func extraSshFlagsFuncImpl(c *SshCommand, set *base.FlagSets, f *base.FlagSet) {
 			fs.StringVar(&base.StringVar{
 				Name:   "worker-filter",
 				Target: &c.flagWorkerFilter,
-				Usage:  "A boolean expression to filter which workers can handle sessions for this target.",
+				Usage:  "Deprecated: use egress or ingress filters instead.",
+			})
+		case "egress-worker-filter":
+			fs.StringVar(&base.StringVar{
+				Name:   "egress-worker-filter",
+				Target: &c.flagEgressWorkerFilter,
+				Usage:  "A boolean expression to filter which egress workers can handle sessions for this target.",
+			})
+		case "ingress-worker-filter":
+			fs.StringVar(&base.StringVar{
+				Name:   "ingress-worker-filter",
+				Target: &c.flagIngressWorkerFilter,
+				Usage:  "A boolean expression to filter which ingress workers can handle sessions for this target.",
 			})
 		}
 	}
@@ -145,12 +159,35 @@ func extraSshFlagsHandlingFuncImpl(c *SshCommand, _ *base.FlagSets, opts *[]targ
 		*opts = append(*opts, targets.DefaultWorkerFilter())
 	default:
 		if _, err := bexpr.CreateEvaluator(c.flagWorkerFilter); err != nil {
-			c.UI.Error(fmt.Sprintf("Unable to successfully parse filter expression: %s", err))
+			c.UI.Error(fmt.Sprintf("Unable to successfully parse worker filter expression: %s", err))
 			return false
 		}
 		*opts = append(*opts, targets.WithWorkerFilter(c.flagWorkerFilter))
 	}
 
+	switch c.flagEgressWorkerFilter {
+	case "":
+	case "null":
+		*opts = append(*opts, targets.DefaultEgressWorkerFilter())
+	default:
+		if _, err := bexpr.CreateEvaluator(c.flagEgressWorkerFilter); err != nil {
+			c.UI.Error(fmt.Sprintf("Unable to successfully parse egress filter expression: %s", err))
+			return false
+		}
+		*opts = append(*opts, targets.WithEgressWorkerFilter(c.flagEgressWorkerFilter))
+	}
+	switch c.flagIngressWorkerFilter {
+	case "":
+	case "null":
+		*opts = append(*opts, targets.DefaultIngressWorkerFilter())
+	default:
+		if _, err := bexpr.CreateEvaluator(c.flagIngressWorkerFilter); err != nil {
+			c.UI.Error(fmt.Sprintf("Unable to successfully parse ingress filter expression: %s", err))
+			return false
+		}
+		*opts = append(*opts, targets.WithIngressWorkerFilter(c.flagIngressWorkerFilter))
+	}
+
 	return true
 }
 

internal/cmd/commands/targetscmd/tcp_funcs.go

@@ -18,8 +18,8 @@ func init() {
 
 func extraTcpActionsFlagsMapFuncImpl() map[string][]string {
 	return map[string][]string{
-		"create": {"default-port", "session-max-seconds", "session-connection-limit", "worker-filter"},
-		"update": {"default-port", "session-max-seconds", "session-connection-limit", "worker-filter"},
+		"create": {"default-port", "session-max-seconds", "session-connection-limit", "egress-worker-filter", "ingress-worker-filter"},
+		"update": {"default-port", "session-max-seconds", "session-connection-limit", "worker-filter", "egress-worker-filter", "ingress-worker-filter"},
 	}
 }
 
@@ -28,6 +28,8 @@ type extraTcpCmdVars struct {
 	flagSessionMaxSeconds      string
 	flagSessionConnectionLimit string
 	flagWorkerFilter           string
+	flagEgressWorkerFilter     string
+	flagIngressWorkerFilter    string
 }
 
 func (c *TcpCommand) extraTcpHelpFunc(helpMap map[string]func() string) string {
@@ -85,7 +87,19 @@ func extraTcpFlagsFuncImpl(c *TcpCommand, set *base.FlagSets, f *base.FlagSet) {
 			fs.StringVar(&base.StringVar{
 				Name:   "worker-filter",
 				Target: &c.flagWorkerFilter,
-				Usage:  "A boolean expression to filter which workers can handle sessions for this target.",
+				Usage:  "Deprecated: use egress or ingress filters instead.",
+			})
+		case "egress-worker-filter":
+			fs.StringVar(&base.StringVar{
+				Name:   "egress-worker-filter",
+				Target: &c.flagEgressWorkerFilter,
+				Usage:  "A boolean expression to filter which egress workers can handle sessions for this target.",
+			})
+		case "ingress-worker-filter":
+			fs.StringVar(&base.StringVar{
+				Name:   "ingress-worker-filter",
+				Target: &c.flagIngressWorkerFilter,
+				Usage:  "A boolean expression to filter which ingress workers can handle sessions for this target.",
 			})
 		}
 	}
@@ -144,11 +158,34 @@ func extraTcpFlagsHandlingFuncImpl(c *TcpCommand, _ *base.FlagSets, opts *[]targ
 		*opts = append(*opts, targets.DefaultWorkerFilter())
 	default:
 		if _, err := bexpr.CreateEvaluator(c.flagWorkerFilter); err != nil {
-			c.UI.Error(fmt.Sprintf("Unable to successfully parse filter expression: %s", err))
+			c.UI.Error(fmt.Sprintf("Unable to successfully parse worker filter expression: %s", err))
 			return false
 		}
 		*opts = append(*opts, targets.WithWorkerFilter(c.flagWorkerFilter))
 	}
 
+	switch c.flagEgressWorkerFilter {
+	case "":
+	case "null":
+		*opts = append(*opts, targets.DefaultEgressWorkerFilter())
+	default:
+		if _, err := bexpr.CreateEvaluator(c.flagEgressWorkerFilter); err != nil {
+			c.UI.Error(fmt.Sprintf("Unable to successfully parse egress filter expression: %s", err))
+			return false
+		}
+		*opts = append(*opts, targets.WithEgressWorkerFilter(c.flagEgressWorkerFilter))
+	}
+	switch c.flagIngressWorkerFilter {
+	case "":
+	case "null":
+		*opts = append(*opts, targets.DefaultIngressWorkerFilter())
+	default:
+		if _, err := bexpr.CreateEvaluator(c.flagIngressWorkerFilter); err != nil {
+			c.UI.Error(fmt.Sprintf("Unable to successfully parse ingress filter expression: %s", err))
+			return false
+		}
+		*opts = append(*opts, targets.WithIngressWorkerFilter(c.flagIngressWorkerFilter))
+	}
+
 	return true
 }

internal/daemon/cluster/handlers/worker_service.go

@@ -41,6 +41,8 @@ type workerServiceServer struct {
 var (
 	_ pbs.SessionServiceServer            = &workerServiceServer{}
 	_ pbs.ServerCoordinationServiceServer = &workerServiceServer{}
+
+	workerFilterSelectionFn = workerFilterSelector
 )
 
 func NewWorkerServiceServer(
@@ -273,6 +275,69 @@ func (ws *workerServiceServer) ListHcpbWorkers(ctx context.Context, req *pbs.Lis
 	return resp, nil
 }
 
+// Single-hop filter lookup. We have either an egress filter or worker filter to use, if any
+// Used to verify that the worker serving this session to a client matches this filter
+func workerFilterSelector(sessionInfo *session.Session) string {
+	if sessionInfo.EgressWorkerFilter != "" {
+		return sessionInfo.EgressWorkerFilter
+	} else if sessionInfo.WorkerFilter != "" {
+		return sessionInfo.WorkerFilter
+	}
+	return ""
+}
+
+func lookupSessionWorkerFilter(ctx context.Context, sessionInfo *session.Session, ws *workerServiceServer,
+	req *pbs.LookupSessionRequest,
+) error {
+	const op = "workers.lookupSessionEgressWorkerFilter"
+
+	filter := workerFilterSelectionFn(sessionInfo)
+	if filter == "" {
+		return nil
+	}
+
+	if req.WorkerId == "" {
+		event.WriteError(ctx, op, errors.New("worker filter enabled for session but got no id information from worker"))
+		return status.Errorf(codes.Internal, "Did not receive worker id when looking up session but filtering is enabled")
+	}
+	serversRepo, err := ws.serversRepoFn()
+	if err != nil {
+		event.WriteError(ctx, op, err, event.WithInfoMsg("error getting server repo"))
+		return status.Errorf(codes.Internal, "Error acquiring server repo when looking up session: %v", err)
+	}
+	w, err := serversRepo.LookupWorker(ctx, req.WorkerId)
+	if err != nil {
+		event.WriteError(ctx, op, err, event.WithInfoMsg("error looking up worker", "worker_id", req.WorkerId))
+		return status.Errorf(codes.Internal, "Error looking up worker: %v", err)
+	}
+	if w == nil {
+		event.WriteError(ctx, op, err, event.WithInfoMsg("error looking up worker", "worker_id", req.WorkerId))
+		return status.Errorf(codes.Internal, "Worker not found")
+	}
+	// Build the map for filtering.
+	tagMap := w.CanonicalTags()
+
+	// Create the evaluator
+	eval, err := bexpr.CreateEvaluator(filter)
+	if err != nil {
+		event.WriteError(ctx, op, err, event.WithInfoMsg("error creating worker filter evaluator", "worker_id", req.WorkerId))
+		return status.Errorf(codes.Internal, "Error creating worker filter evaluator: %v", err)
+	}
+	filterInput := map[string]interface{}{
+		"name": w.GetName(),
+		"tags": tagMap,
+	}
+	ok, err := eval.Evaluate(filterInput)
+	if err != nil {
+		return status.Errorf(codes.Internal, fmt.Sprintf("Worker filter expression evaluation resulted in error: %s", err))
+	}
+	if !ok {
+		return handlers.ApiErrorWithCodeAndMessage(codes.FailedPrecondition, "Worker filter expression precludes this worker from serving this session")
+	}
+
+	return nil
+}
+
 func (ws *workerServiceServer) LookupSession(ctx context.Context, req *pbs.LookupSessionRequest) (*pbs.LookupSessionResponse, error) {
 	const op = "workers.(workerServiceServer).LookupSession"
 
@@ -292,48 +357,9 @@ func (ws *workerServiceServer) LookupSession(ctx context.Context, req *pbs.Looku
 		return nil, status.Error(codes.Internal, "Empty session states during lookup.")
 	}
 
-	if sessionInfo.WorkerFilter != "" {
-		if req.WorkerId == "" {
-			event.WriteError(ctx, op, errors.New("worker filter enabled for session but got no id information from worker"))
-			return nil, status.Errorf(codes.Internal, "Did not receive worker id when looking up session but filtering is enabled")
-		}
-		serversRepo, err := ws.serversRepoFn()
-		if err != nil {
-			event.WriteError(ctx, op, err, event.WithInfoMsg("error getting server repo"))
-			return nil, status.Errorf(codes.Internal, "Error acquiring server repo when looking up session: %v", err)
-		}
-		w, err := serversRepo.LookupWorker(ctx, req.WorkerId)
-		if err != nil {
-			event.WriteError(ctx, op, err, event.WithInfoMsg("error looking up worker", "worker_id", req.WorkerId))
-			return nil, status.Errorf(codes.Internal, "Error looking up worker: %v", err)
-		}
-		if w == nil {
-			event.WriteError(ctx, op, err, event.WithInfoMsg("error looking up worker", "worker_id", req.WorkerId))
-			return nil, status.Errorf(codes.Internal, "Worker not found")
-		}
-		// Build the map for filtering.
-		tagMap := w.CanonicalTags()
-
-		// Create the evaluator
-		eval, err := bexpr.CreateEvaluator(sessionInfo.WorkerFilter)
-		if err != nil {
-			event.WriteError(ctx, op, err, event.WithInfoMsg("error creating worker filter evaluator", "worker_id", req.WorkerId))
-			return nil, status.Errorf(codes.Internal, "Error creating worker filter evaluator: %v", err)
-		}
-		filterInput := map[string]any{
-			"name": w.GetName(),
-			"tags": tagMap,
-		}
-		ok, err := eval.Evaluate(filterInput)
-		if err != nil {
-			return nil, status.Errorf(codes.Internal,
-				fmt.Sprintf("Worker filter expression evaluation resulted in error: %s", err))
-		}
-		if !ok {
-			return nil, handlers.ApiErrorWithCodeAndMessage(
-				codes.FailedPrecondition,
-				"Worker filter expression precludes this worker from serving this session")
-		}
+	err = lookupSessionWorkerFilter(ctx, sessionInfo, ws, req)
+	if err != nil {
+		return nil, err
 	}
 
 	creds, err := sessRepo.ListSessionCredentials(ctx, sessionInfo.ProjectId, sessionInfo.PublicId)

internal/daemon/controller/handlers/targets/target_service.go

@@ -91,8 +91,16 @@ var (
 		action.Create,
 		action.List,
 	}
+
+	ValidateIngressWorkerFilterFn  = IngressWorkerFilterUnsupported
+	AuthorizeSessionWorkerFilterFn = AuthorizeSessionWithWorkerFilter
+	WorkerFilterDeprecationMessage = "This field is deprecated. Use egress_filter instead."
 )
 
+func IngressWorkerFilterUnsupported(string) error {
+	return fmt.Errorf("Ingress Worker Filter field is not supported in OSS")
+}
+
 // Service handles request as described by the pbs.TargetServiceServer interface.
 type Service struct {
 	pbs.UnsafeTargetServiceServer
@@ -612,6 +620,39 @@ func (s Service) RemoveTargetCredentialSources(ctx context.Context, req *pbs.Rem
 	return &pbs.RemoveTargetCredentialSourcesResponse{Item: item}, nil
 }
 
+// If set, use the worker_filter or egress_worker_filter to filtere the selected workers
+// and ensure we have workers available to service this request.
+func AuthorizeSessionWithWorkerFilter(t target.Target, selectedWorkers []*server.Worker) ([]*server.Worker, error) {
+	if len(selectedWorkers) > 0 {
+		var eval *bexpr.Evaluator
+		var err error
+		switch {
+		case len(t.GetEgressWorkerFilter()) > 0:
+			eval, err = bexpr.CreateEvaluator(t.GetEgressWorkerFilter())
+		case len(t.GetWorkerFilter()) > 0:
+			eval, err = bexpr.CreateEvaluator(t.GetWorkerFilter())
+		default: // No filter
+			return selectedWorkers, nil
+		}
+		if err != nil {
+			return nil, err
+		}
+
+		selectedWorkers, err = workerList(selectedWorkers).filtered(eval)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if len(selectedWorkers) == 0 {
+		return nil, handlers.ApiErrorWithCodeAndMessage(
+			codes.FailedPrecondition,
+			"No workers are available to handle this session, or all have been filtered.")
+	}
+
+	return selectedWorkers, nil
+}
+
 func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSessionRequest) (*pbs.AuthorizeSessionResponse, error) {
 	const op = "targets.(Service).AuthorizeSession"
 	if err := validateAuthorizeSessionRequest(req); err != nil {
@@ -691,21 +732,9 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
 		return nil, err
 	}
 
-	if len(t.GetWorkerFilter()) > 0 && len(selectedWorkers) > 0 {
-		eval, err := bexpr.CreateEvaluator(t.GetWorkerFilter())
-		if err != nil {
-			return nil, err
-		}
-		selectedWorkers, err = workerList(selectedWorkers).filtered(eval)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	if len(selectedWorkers) == 0 {
-		return nil, handlers.ApiErrorWithCodeAndMessage(
-			codes.FailedPrecondition,
-			"No workers are available to handle this session, or all have been filtered.")
+	selectedWorkers, err = AuthorizeSessionWorkerFilterFn(t, selectedWorkers)
+	if err != nil {
+		return nil, err
 	}
 
 	// Randomize the workers
@@ -824,18 +853,20 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
 	expTime := timestamppb.Now()
 	expTime.Seconds += int64(t.GetSessionMaxSeconds())
 	sessionComposition := session.ComposedOf{
-		UserId:             authResults.UserId,
-		HostId:             chosenEndpoint.HostId,
-		TargetId:           t.GetPublicId(),
-		HostSetId:          chosenEndpoint.SetId,
-		AuthTokenId:        authResults.AuthTokenId,
-		ProjectId:          authResults.Scope.Id,
-		Endpoint:           endpointUrl.String(),
-		ExpirationTime:     &timestamp.Timestamp{Timestamp: expTime},
-		ConnectionLimit:    t.GetSessionConnectionLimit(),
-		WorkerFilter:       t.GetWorkerFilter(),
-		DynamicCredentials: dynCreds,
-		StaticCredentials:  staticCreds,
+		UserId:              authResults.UserId,
+		HostId:              chosenEndpoint.HostId,
+		TargetId:            t.GetPublicId(),
+		HostSetId:           chosenEndpoint.SetId,
+		AuthTokenId:         authResults.AuthTokenId,
+		ProjectId:           authResults.Scope.Id,
+		Endpoint:            endpointUrl.String(),
+		ExpirationTime:      &timestamp.Timestamp{Timestamp: expTime},
+		ConnectionLimit:     t.GetSessionConnectionLimit(),
+		WorkerFilter:        t.GetWorkerFilter(),
+		EgressWorkerFilter:  t.GetEgressWorkerFilter(),
+		IngressWorkerFilter: t.GetIngressWorkerFilter(),
+		DynamicCredentials:  dynCreds,
+		StaticCredentials:   staticCreds,
 	}
 
 	sess, err := session.New(sessionComposition)
@@ -1000,8 +1031,11 @@ func (s Service) createInRepo(ctx context.Context, item *pb.Target) (target.Targ
 	if item.GetSessionConnectionLimit() != nil {
 		opts = append(opts, target.WithSessionConnectionLimit(item.GetSessionConnectionLimit().GetValue()))
 	}
-	if item.GetWorkerFilter() != nil {
-		opts = append(opts, target.WithWorkerFilter(item.GetWorkerFilter().GetValue()))
+	if item.GetEgressWorkerFilter() != nil {
+		opts = append(opts, target.WithEgressWorkerFilter(item.GetEgressWorkerFilter().GetValue()))
+	}
+	if item.GetIngressWorkerFilter() != nil {
+		opts = append(opts, target.WithIngressWorkerFilter(item.GetIngressWorkerFilter().GetValue()))
 	}
 
 	attr, err := subtypeRegistry.newAttribute(target.SubtypeFromType(item.GetType()), item.GetAttrs())
@@ -1043,9 +1077,16 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []st
 	if item.GetSessionConnectionLimit() != nil {
 		opts = append(opts, target.WithSessionConnectionLimit(item.GetSessionConnectionLimit().GetValue()))
 	}
-	if filter := item.GetWorkerFilter(); filter != nil {
+	// worker_filter is deprecated, but we allow users who have migrated with a worker_filter value to update it.
+	if workerFilter := item.GetWorkerFilter(); workerFilter != nil {
 		opts = append(opts, target.WithWorkerFilter(item.GetWorkerFilter().GetValue()))
 	}
+	if egressFilter := item.GetEgressWorkerFilter(); egressFilter != nil {
+		opts = append(opts, target.WithEgressWorkerFilter(item.GetEgressWorkerFilter().GetValue()))
+	}
+	if ingressFilter := item.GetIngressWorkerFilter(); ingressFilter != nil {
+		opts = append(opts, target.WithIngressWorkerFilter(item.GetIngressWorkerFilter().GetValue()))
+	}
 	subtype := target.SubtypeFromId(id)
 
 	attr, err := subtypeRegistry.newAttribute(subtype, item.GetAttrs())
@@ -1355,6 +1396,12 @@ func toProto(ctx context.Context, in target.Target, hostSources []target.HostSou
 	if outputFields.Has(globals.WorkerFilterField) && in.GetWorkerFilter() != "" {
 		out.WorkerFilter = wrapperspb.String(in.GetWorkerFilter())
 	}
+	if outputFields.Has(globals.EgressWorkerFilterField) && in.GetEgressWorkerFilter() != "" {
+		out.EgressWorkerFilter = wrapperspb.String(in.GetEgressWorkerFilter())
+	}
+	if outputFields.Has(globals.IngressWorkerFilterField) && in.GetIngressWorkerFilter() != "" {
+		out.IngressWorkerFilter = wrapperspb.String(in.GetIngressWorkerFilter())
+	}
 	if outputFields.Has(globals.ScopeField) {
 		out.Scope = opts.WithScope
 	}
@@ -1461,9 +1508,18 @@ func validateCreateRequest(req *pbs.CreateTargetRequest) error {
 		} else if target.SubtypeFromType(req.GetItem().GetType()) == "" {
 			badFields[globals.TypeField] = "Unknown type provided."
 		}
-		if filter := req.GetItem().GetWorkerFilter(); filter != nil {
-			if _, err := bexpr.CreateEvaluator(filter.GetValue()); err != nil {
-				badFields[globals.WorkerFilterField] = "Unable to successfully parse filter expression."
+		if workerFilter := req.GetItem().GetWorkerFilter(); workerFilter != nil {
+			badFields[globals.WorkerFilterField] = WorkerFilterDeprecationMessage
+		}
+		if egressFilter := req.GetItem().GetEgressWorkerFilter(); egressFilter != nil {
+			if _, err := bexpr.CreateEvaluator(egressFilter.GetValue()); err != nil {
+				badFields[globals.EgressWorkerFilterField] = "Unable to successfully parse egress filter expression."
+			}
+		}
+		if ingressFilter := req.GetItem().GetIngressWorkerFilter(); ingressFilter != nil {
+			err := ValidateIngressWorkerFilterFn(ingressFilter.GetValue())
+			if err != nil {
+				badFields[globals.IngressWorkerFilterField] = err.Error()
 			}
 		}
 
@@ -1504,10 +1560,30 @@ func validateUpdateRequest(req *pbs.UpdateTargetRequest) error {
 		if req.GetItem().GetSessionMaxSeconds() != nil && req.GetItem().GetSessionMaxSeconds().GetValue() == 0 {
 			badFields[globals.SessionMaxSecondsField] = "This must be greater than zero."
 		}
-		if filter := req.GetItem().GetWorkerFilter(); filter != nil {
-			if _, err := bexpr.CreateEvaluator(filter.GetValue()); err != nil {
+		// worker_filter is mutually exclusive from ingress and egress filter
+		workerFilterFound := false
+		if workerFilter := req.GetItem().GetWorkerFilter(); workerFilter != nil {
+			if _, err := bexpr.CreateEvaluator(workerFilter.GetValue()); err != nil {
 				badFields[globals.WorkerFilterField] = "Unable to successfully parse filter expression."
 			}
+			workerFilterFound = true
+		}
+		if egressFilter := req.GetItem().GetEgressWorkerFilter(); egressFilter != nil {
+			if workerFilterFound {
+				badFields[globals.EgressWorkerFilterField] = "Cannot set worker_filter and egress_filter; they are mutually exclusive fields."
+			}
+			if _, err := bexpr.CreateEvaluator(egressFilter.GetValue()); err != nil {
+				badFields[globals.EgressWorkerFilterField] = "Unable to successfully parse egress filter expression."
+			}
+		}
+		if ingressFilter := req.GetItem().GetIngressWorkerFilter(); ingressFilter != nil {
+			if workerFilterFound {
+				badFields[globals.IngressWorkerFilterField] = "Cannot set worker_filter and ingress_filter; they are mutually exclusive fields."
+			}
+			err := ValidateIngressWorkerFilterFn(ingressFilter.GetValue())
+			if err != nil {
+				badFields[globals.IngressWorkerFilterField] = err.Error()
+			}
 		}
 		subtype := target.SubtypeFromId(req.GetId())
 		_, err := subtypeRegistry.get(subtype)

internal/daemon/controller/handlers/targets/target_service_test.go

@@ -9,9 +9,10 @@ import (
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/server"
+	"github.com/hashicorp/boundary/internal/target/targettest"
+	"github.com/hashicorp/boundary/internal/target/targettest/store"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/targets"
-	"github.com/hashicorp/go-bexpr"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -35,11 +36,13 @@ func TestWorkerList_Addresses(t *testing.T) {
 	assert.Equal(t, workerInfos, tested.workerInfos())
 }
 
-func TestWorkerList_Filter(t *testing.T) {
+func TestWorkerList_EgressFilter(t *testing.T) {
+	t.Parallel()
 	conn, _ := db.TestSetup(t, "postgres")
 	wrapper := db.TestWrapper(t)
 	kmsCache := kms.TestKms(t, conn, wrapper)
 	require.NoError(t, kmsCache.CreateKeys(context.Background(), scope.Global.String(), kms.WithRandomReader(rand.Reader)))
+
 	var workers []*server.Worker
 	for i := 0; i < 5; i++ {
 		switch {
@@ -60,25 +63,66 @@ func TestWorkerList_Filter(t *testing.T) {
 		}
 	}
 
-	{
-		ev, err := bexpr.CreateEvaluator(`"/name" matches "test_worker_[13]" and "configvalue2" in "/tags/key"`)
-		require.NoError(t, err)
-		got, err := workerList(workers).filtered(ev)
-		require.NoError(t, err)
-		assert.Len(t, got, 0)
+	cases := []struct {
+		name        string
+		in          []*server.Worker
+		out         []*server.Worker
+		filter      string
+		errContains string
+	}{
+		{
+			name:        "no-workers",
+			in:          []*server.Worker{},
+			out:         []*server.Worker{},
+			filter:      "",
+			errContains: "No workers are available to handle this session, or all have been filtered",
+		},
+		{
+			name: "no-filter",
+			in:   workers,
+			out:  workers,
+		},
+		{
+			name:        "filter-no-matches",
+			in:          workers,
+			out:         workers,
+			filter:      `"/name" matches "test_worker_[13]" and "configvalue2" in "/tags/key"`,
+			errContains: "No workers are available to handle this session, or all have been filtered",
+		},
+		{
+			name:   "filter-one-match",
+			in:     workers,
+			out:    []*server.Worker{workers[1]},
+			filter: `"/name" matches "test_worker_[12]" and "configvalue" in "/tags/key"`,
+		},
+		{
+			name:   "filter-two-matches",
+			in:     workers,
+			out:    []*server.Worker{workers[1], workers[3]},
+			filter: `"configvalue" in "/tags/key"`,
+		},
 	}
-	{
-		ev, err := bexpr.CreateEvaluator(`"/name" matches "test_worker_[12]" and "configvalue" in "/tags/key"`)
-		require.NoError(t, err)
-		got, err := workerList(workers).filtered(ev)
-		require.NoError(t, err)
-		assert.Len(t, got, 1)
-	}
-	{
-		ev, err := bexpr.CreateEvaluator(`"configvalue" in "/tags/key"`)
-		require.NoError(t, err)
-		got, err := workerList(workers).filtered(ev)
-		require.NoError(t, err)
-		assert.Len(t, got, 2)
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			target := &targettest.Target{
+				Target: &store.Target{},
+			}
+			if len(tc.filter) > 0 {
+				target.EgressWorkerFilter = tc.filter
+			}
+			out, err := AuthorizeSessionWithWorkerFilter(target, tc.in)
+			if tc.errContains != "" {
+				assert.Contains(err.Error(), tc.errContains)
+				assert.Nil(out)
+				return
+			}
+
+			require.NoError(err)
+			require.Len(out, len(tc.out))
+			for i, exp := range tc.out {
+				assert.Equal(exp.Name, out[i].Name)
+			}
+		})
 	}
 }

internal/daemon/controller/handlers/targets/tcp/target_service_test.go

@@ -534,6 +534,10 @@ func TestCreate(t *testing.T) {
 	_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
 	_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
 
+	// Ensure we are using the OSS worker filter function
+	workerFilterFn := targets.AuthorizeSessionWorkerFilterFn
+	targets.AuthorizeSessionWorkerFilterFn = targets.AuthorizeSessionWithWorkerFilter
+
 	cases := []struct {
 		name string
 		req  *pbs.CreateTargetRequest
@@ -552,7 +556,7 @@ func TestCreate(t *testing.T) {
 						DefaultPort: wrapperspb.UInt32(2),
 					},
 				},
-				WorkerFilter: wrapperspb.String(`type == "bar"`),
+				EgressWorkerFilter: wrapperspb.String(`type == "bar"`),
 			}},
 			res: &pbs.CreateTargetResponse{
 				Uri: fmt.Sprintf("targets/%s_", tcp.TargetPrefix),
@@ -570,18 +574,18 @@ func TestCreate(t *testing.T) {
 					SessionMaxSeconds:      wrapperspb.UInt32(28800),
 					SessionConnectionLimit: wrapperspb.Int32(-1),
 					AuthorizedActions:      testAuthorizedActions,
-					WorkerFilter:           wrapperspb.String(`type == "bar"`),
+					EgressWorkerFilter:     wrapperspb.String(`type == "bar"`),
 				},
 			},
 		},
 		{
 			name: "Create a target with no port",
 			req: &pbs.CreateTargetRequest{Item: &pb.Target{
-				ScopeId:      proj.GetPublicId(),
-				Name:         wrapperspb.String("name"),
-				Description:  wrapperspb.String("desc"),
-				Type:         tcp.Subtype.String(),
-				WorkerFilter: wrapperspb.String(`type == "bar"`),
+				ScopeId:            proj.GetPublicId(),
+				Name:               wrapperspb.String("name"),
+				Description:        wrapperspb.String("desc"),
+				Type:               tcp.Subtype.String(),
+				EgressWorkerFilter: wrapperspb.String(`type == "bar"`),
 			}},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
@@ -643,7 +647,23 @@ func TestCreate(t *testing.T) {
 		{
 			name: "Invalid worker filter expression",
 			req: &pbs.CreateTargetRequest{Item: &pb.Target{
-				WorkerFilter: wrapperspb.String("bad expression"),
+				EgressWorkerFilter: wrapperspb.String("bad expression"),
+			}},
+			res: nil,
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Deprecated worker filter",
+			req: &pbs.CreateTargetRequest{Item: &pb.Target{
+				WorkerFilter: wrapperspb.String(`"/name" matches "test-worker"`),
+			}},
+			res: nil,
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Ingress filter unsupported on OSS",
+			req: &pbs.CreateTargetRequest{Item: &pb.Target{
+				IngressWorkerFilter: wrapperspb.String(`"/name" matches "test-worker"`),
 			}},
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -687,6 +707,8 @@ func TestCreate(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "CreateTarget(%q)\n got response %q\n, wanted %q\n", tc.req, got, tc.res)
 		})
 	}
+	// Reset worker filter func
+	targets.AuthorizeSessionWorkerFilterFn = workerFilterFn
 }
 
 func TestUpdate(t *testing.T) {
@@ -757,6 +779,12 @@ func TestUpdate(t *testing.T) {
 	tested, err := testService(t, context.Background(), conn, kms, wrapper)
 	require.NoError(t, err, "Failed to create a new host set service.")
 
+	// Ensure we are using the OSS worker filter functions
+	workerFilterFn := targets.AuthorizeSessionWorkerFilterFn
+	targets.AuthorizeSessionWorkerFilterFn = targets.AuthorizeSessionWithWorkerFilter
+	validateIngressFn := targets.ValidateIngressWorkerFilterFn
+	targets.ValidateIngressWorkerFilterFn = targets.IngressWorkerFilterUnsupported
+
 	cases := []struct {
 		name string
 		req  *pbs.UpdateTargetRequest
@@ -1054,6 +1082,33 @@ func TestUpdate(t *testing.T) {
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
+		{
+			name: "Ingress filter unsupported",
+			req: &pbs.UpdateTargetRequest{
+				UpdateMask: &field_mask.FieldMask{
+					Paths: []string{"ingress_worker_filter"},
+				},
+				Item: &pb.Target{
+					IngressWorkerFilter: wrapperspb.String(`type == "bar"`),
+				},
+			},
+			res: nil,
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Can't update worker filter and egress filter",
+			req: &pbs.UpdateTargetRequest{
+				UpdateMask: &field_mask.FieldMask{
+					Paths: []string{"worker_filter", "egress_worker_filter"},
+				},
+				Item: &pb.Target{
+					WorkerFilter:       wrapperspb.String(`type == "bar"`),
+					EgressWorkerFilter: wrapperspb.String(`type == "bar"`),
+				},
+			},
+			res: nil,
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -1095,6 +1150,9 @@ func TestUpdate(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "UpdateTarget(%q) got response %q, wanted %q", req, got, tc.res)
 		})
 	}
+	// Reset worker filter funcs
+	targets.AuthorizeSessionWorkerFilterFn = workerFilterFn
+	targets.ValidateIngressWorkerFilterFn = validateIngressFn
 }
 
 func TestUpdate_BadVersion(t *testing.T) {

internal/db/schema/migrations/oss/postgres/1/01_server_tags_migrations.up.sql

@@ -43,6 +43,7 @@ alter table session
   add column worker_filter wt_bexprfilter;
 
 -- Replace the immutable columns trigger from 50 to add worker_filter
+-- Replaced in 59/01_target_ingress_egress_worker_filters.up.sql
 drop trigger immutable_columns on session;
 create trigger immutable_columns before update on session
     for each row execute procedure immutable_columns('public_id', 'certificate', 'expiration_time', 'connection_limit', 'create_time', 'endpoint', 'worker_filter');

internal/db/schema/migrations/oss/postgres/44/03_targets.up.sql

@@ -216,6 +216,7 @@ begin;
         and o.type = 'org';
 
   -- Replaces target_all_subtypes defined in 1/01_server_tags_migrations.up.sql
+  -- Replaced in 59/01_target_ingress_egress_worker_filters.up.sql
   drop view target_all_subtypes;
   create view target_all_subtypes as
   select public_id,

internal/db/schema/migrations/oss/postgres/58/06_add_session_private_key_column.up.sql

@@ -5,6 +5,7 @@ begin;
   alter table session add column certificate_private_key bytea null;
 
   -- Replaces the view created in 44/05_session_list_no_connections
+  -- Replaced in 59/01_target_ingress_egress_worker_filters.up.sql
   drop view session_list;
   create view session_list as
   select

internal/db/schema/migrations/oss/postgres/59/01_target_ingress_egress_worker_filters.up.sql

@@ -0,0 +1,137 @@
+begin;
+
+-- Update tables to add ingress_worker_filter and egress_worker_filter
+alter table session
+  add column egress_worker_filter wt_bexprfilter,
+  add column ingress_worker_filter wt_bexprfilter;
+
+alter table target_tcp
+  add column egress_worker_filter wt_bexprfilter,
+  add column ingress_worker_filter wt_bexprfilter;
+
+-- Trigger functions to ensure that worker_filter and ingress/egress_worker_filter are mutually exclusive
+-- and that worker_filter can only be updated
+create function validate_filter_values_on_insert() returns trigger
+as $$
+begin
+  if new.worker_filter is not null then
+    raise exception 'worker_filter is deprecated and cannot be set';
+  end if;
+
+  return new;
+
+end;
+$$ language plpgsql;
+
+create function validate_filter_values_on_update() returns trigger
+as $$
+begin
+  if new.egress_worker_filter is not null then
+    if new.worker_filter = old.worker_filter then
+      new.worker_filter = null;
+    end if;
+  end if;
+
+  if new.ingress_worker_filter is not null then
+    if new.worker_filter = old.worker_filter then
+      new.worker_filter = null;
+    end if;
+  end if;
+
+  if new.worker_filter is not null then
+-- New worker_filter values are only allowed as an update to support users with existing worker_filter values
+    if old.worker_filter is null then
+      raise exception 'worker_filter is deprecated and cannot be set';
+    end if;
+
+    if new.egress_worker_filter is not null then
+      raise exception 'cannot set worker_filter and egress_filter; they are mutually exclusive fields';
+    end if;
+
+    if new.ingress_worker_filter is not null then
+      raise exception 'cannot set worker_filter and ingress_filter; they are mutually exclusive fields';
+    end if;
+  end if;
+
+  return new;
+
+end;
+$$ language plpgsql;
+
+create trigger update_tcp_target_filter_validate before update on target_tcp
+  for each row execute procedure validate_filter_values_on_update();
+
+create trigger insert_tcp_target_filter_validate before insert on target_tcp
+  for each row execute procedure validate_filter_values_on_insert();
+
+-- Update views
+
+-- Replaces target_all_subtypes defined in 44/03_targets.up.sql
+drop view target_all_subtypes;
+create view target_all_subtypes as
+select public_id,
+   project_id,
+   name,
+   description,
+   default_port,
+   session_max_seconds,
+   session_connection_limit,
+   version,
+   create_time,
+   update_time,
+   worker_filter,
+   egress_worker_filter,
+   ingress_worker_filter,
+   'tcp' as type
+from target_tcp;
+
+-- Replaces view from 58/06_add_session_private_key_column.up.sql
+drop view session_list;
+create view session_list as
+select
+  s.public_id,
+  s.user_id,
+  s.host_id,
+  s.target_id,
+  s.host_set_id,
+  s.auth_token_id,
+  s.project_id,
+  s.certificate,
+  s.certificate_private_key,
+  s.expiration_time,
+  s.connection_limit,
+  s.tofu_token,
+  s.key_id,
+  s.termination_reason,
+  s.version,
+  s.create_time,
+  s.update_time,
+  s.endpoint,
+  s.worker_filter,
+  s.egress_worker_filter,
+  s.ingress_worker_filter,
+  ss.state,
+  ss.previous_end_time,
+  ss.start_time,
+  ss.end_time,
+  sc.public_id as connection_id,
+  sc.client_tcp_address,
+  sc.client_tcp_port,
+  sc.endpoint_tcp_address,
+  sc.endpoint_tcp_port,
+  sc.bytes_up,
+  sc.bytes_down,
+  sc.closed_reason
+from session s
+  join session_state ss on
+    s.public_id = ss.session_id
+  left join session_connection sc on
+    s.public_id = sc.session_id;
+
+-- Update session immutable columns
+drop trigger immutable_columns on session;
+create trigger immutable_columns before update on session
+  for each row execute procedure immutable_columns('public_id', 'certificate', 'expiration_time', 'connection_limit',
+    'create_time', 'endpoint', 'worker_filter', 'egress_worker_filter', 'ingress_worker_filter');
+
+commit;

internal/db/schema/migrations/oss/postgres_59_01_test.go

@@ -0,0 +1,188 @@
+package oss_test
+
+import (
+	"context"
+	"crypto/rand"
+	"testing"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/db/common"
+	"github.com/hashicorp/boundary/internal/db/schema"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/target"
+	"github.com/hashicorp/boundary/internal/target/targettest"
+	"github.com/hashicorp/boundary/internal/types/scope"
+	"github.com/hashicorp/boundary/testing/dbtest"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	insertTargetQuery = `INSERT INTO "target_tcp" ("public_id","project_id","name","session_max_seconds","session_connection_limit","worker_filter") VALUES ($1,$2,$3,28800,-1,$4)`
+)
+
+func TestMigrations_AddEgressAndIngressFilters(t *testing.T) {
+	const (
+		priorMigration   = 58001
+		currentMigration = 59001
+	)
+
+	t.Parallel()
+	ctx := context.Background()
+	dialect := dbtest.Postgres
+
+	c, u, _, err := dbtest.StartUsingTemplate(dialect, dbtest.WithTemplate(dbtest.Template1))
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, c())
+	})
+	d, err := common.SqlOpen(dialect, u)
+	require.NoError(t, err)
+
+	// migration to the prior migration (before the one we want to test)
+	m, err := schema.NewManager(ctx, schema.Dialect(dialect), d, schema.WithEditions(
+		schema.TestCreatePartialEditions(schema.Dialect(dialect), schema.PartialEditions{"oss": priorMigration}),
+	))
+	require.NoError(t, err)
+
+	_, err = m.ApplyMigrations(ctx)
+	require.NoError(t, err)
+	state, err := m.CurrentState(ctx)
+	require.NoError(t, err)
+	want := &schema.State{
+		Initialized: true,
+		Editions: []schema.EditionState{
+			{
+				Name:                  "oss",
+				BinarySchemaVersion:   priorMigration,
+				DatabaseSchemaVersion: priorMigration,
+				DatabaseSchemaState:   schema.Equal,
+			},
+		},
+	}
+	require.Equal(t, want, state)
+
+	// Get a connection
+	dbType, err := db.StringToDbType(dialect)
+	require.NoError(t, err)
+	conn, err := db.Open(ctx, dbType, u)
+	require.NoError(t, err)
+
+	wrapper := db.TestWrapper(t)
+	rw := db.New(conn)
+	kmsCache := kms.TestKms(t, conn, wrapper)
+	err = kmsCache.CreateKeys(context.Background(), scope.Global.String(), kms.WithRandomReader(rand.Reader))
+	require.NoError(t, err)
+
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	_, proj := iam.TestScopes(t, iamRepo)
+
+	// Create a target with a worker filter
+	oldTargetId1, err := db.NewPublicId("ttcp")
+	oldWorkerFilter := "foo==bar"
+	require.NoError(t, err)
+	execResult, err := d.ExecContext(ctx, insertTargetQuery, oldTargetId1, proj.PublicId, "old-target-1", oldWorkerFilter)
+	require.NoError(t, err)
+	rowsAffected, err := execResult.RowsAffected()
+	require.NoError(t, err)
+	require.Equal(t, int64(1), rowsAffected)
+
+	// Create another target with a worker filter to use in testing
+	oldTargetId2, err := db.NewPublicId("ttcp")
+	require.NoError(t, err)
+	execResult, err = d.ExecContext(ctx, insertTargetQuery, oldTargetId2, proj.PublicId, "old-target-2", oldWorkerFilter)
+	require.NoError(t, err)
+	rowsAffected, err = execResult.RowsAffected()
+	require.NoError(t, err)
+	require.Equal(t, int64(1), rowsAffected)
+
+	// now we're ready for the migration we want to test.
+	m, err = schema.NewManager(ctx, schema.Dialect(dialect), d, schema.WithEditions(
+		schema.TestCreatePartialEditions(schema.Dialect(dialect), schema.PartialEditions{"oss": currentMigration}),
+	))
+	require.NoError(t, err)
+
+	_, err = m.ApplyMigrations(ctx)
+	require.NoError(t, err)
+	state, err = m.CurrentState(ctx)
+	require.NoError(t, err)
+	want = &schema.State{
+		Initialized: true,
+		Editions: []schema.EditionState{
+			{
+				Name:                  "oss",
+				BinarySchemaVersion:   currentMigration,
+				DatabaseSchemaVersion: currentMigration,
+				DatabaseSchemaState:   schema.Equal,
+			},
+		},
+	}
+	require.Equal(t, want, state)
+
+	testRepo, err := target.NewRepository(ctx, rw, rw, kmsCache)
+
+	// Ensure old target 1 still have the same worker filter
+	result, _, _, err := testRepo.LookupTarget(ctx, oldTargetId1)
+	require.Equal(t, oldWorkerFilter, result.GetWorkerFilter())
+
+	// Update the old worker filter
+	newWorkerFilter := "bar==foo"
+	result.SetWorkerFilter(newWorkerFilter)
+	result, _, _, _, err = testRepo.UpdateTarget(ctx, result, result.GetVersion(), []string{"WorkerFilter"})
+	require.Equal(t, newWorkerFilter, result.GetWorkerFilter())
+
+	// Update to set an egress filter- expect worker filter to be cleared out
+	result.SetEgressWorkerFilter(newWorkerFilter)
+	result, _, _, _, err = testRepo.UpdateTarget(ctx, result, result.GetVersion(), []string{"EgressWorkerFilter"})
+	require.Equal(t, newWorkerFilter, result.GetEgressWorkerFilter())
+	require.Empty(t, result.GetWorkerFilter())
+
+	// Attempt to set worker filter again - expect failure
+	result.SetWorkerFilter(newWorkerFilter)
+	result, _, _, _, err = testRepo.UpdateTarget(ctx, result, result.GetVersion(), []string{"WorkerFilter"})
+	require.Error(t, err)
+
+	// Ensure old target 2 still has the same worker filter
+	result, _, _, err = testRepo.LookupTarget(ctx, oldTargetId2)
+	require.Equal(t, oldWorkerFilter, result.GetWorkerFilter())
+
+	// Clear out its worker filter
+	result.SetWorkerFilter("")
+	result, _, _, _, err = testRepo.UpdateTarget(ctx, result, result.GetVersion(), []string{"WorkerFilter"})
+	require.Equal(t, "", result.GetWorkerFilter())
+
+	// Update to set an ingress filter- expect worker filter to be cleared out
+	result.SetIngressWorkerFilter(newWorkerFilter)
+	result, _, _, _, err = testRepo.UpdateTarget(ctx, result, result.GetVersion(), []string{"IngressWorkerFilter"})
+	require.Equal(t, newWorkerFilter, result.GetIngressWorkerFilter())
+	require.Empty(t, result.GetWorkerFilter())
+
+	// Attempt to create a new target with a worker filter- expect failure
+	tar, err := targettest.New(proj.PublicId, target.WithName("new-worker"), target.WithWorkerFilter(oldWorkerFilter))
+	require.NoError(t, err)
+	id, err := db.NewPublicId("ttcp")
+	require.NoError(t, err)
+	tar.SetPublicId(ctx, id)
+	err = rw.Create(context.Background(), tar)
+	require.Error(t, err)
+
+	// Create a new target with egress and ingress filters
+	tar2, err := targettest.New(proj.PublicId, target.WithName("new-worker-filters"), target.WithEgressWorkerFilter(oldWorkerFilter),
+		target.WithIngressWorkerFilter(oldWorkerFilter))
+	require.NoError(t, err)
+	id, err = db.NewPublicId("ttcp")
+	require.NoError(t, err)
+	tar2.SetPublicId(ctx, id)
+	err = rw.Create(context.Background(), tar2)
+	require.NoError(t, err)
+
+	// Attempt to create a new target with all 3 filters- expect failure
+	tar3, err := targettest.New(proj.PublicId, target.WithName("new-worker-filters"), target.WithEgressWorkerFilter(oldWorkerFilter),
+		target.WithIngressWorkerFilter(oldWorkerFilter), target.WithEgressWorkerFilter(oldWorkerFilter))
+	require.NoError(t, err)
+	id, err = db.NewPublicId("ttcp")
+	require.NoError(t, err)
+	tar3.SetPublicId(ctx, id)
+	err = rw.Create(context.Background(), tar3)
+	require.Error(t, err)
+}

internal/gen/controller.swagger.json

@@ -5641,7 +5641,15 @@
         },
         "worker_filter": {
           "type": "string",
-          "description": "Optional boolean expression to filter the workers that are allowed to satisfy this request."
+          "description": "Optional boolean expression to filter the workers that are allowed to satisfy this request.\nDeprecated; use egress or ingress worker filters instead."
+        },
+        "egress_worker_filter": {
+          "type": "string",
+          "description": "Optional boolean expressions to filter the egress workers that are allowed to satisfy this request."
+        },
+        "ingress_worker_filter": {
+          "type": "string",
+          "description": "Optional boolean expressions to filter the ingress workers that are allowed to satisfy this request.\nUnsupported on OSS."
         },
         "application_credential_source_ids": {
           "type": "array",

internal/proto/controller/api/resources/targets/v1/target.proto

@@ -135,8 +135,10 @@ message Target {
   ]; // @gotags: `class:"public"`
 
   // Optional boolean expression to filter the workers that are allowed to satisfy this request.
+  // Deprecated; use egress or ingress worker filters instead.
   google.protobuf.StringValue worker_filter = 140 [
     json_name = "worker_filter",
+    deprecated = true,
     (custom_options.v1.generate_sdk_option) = true,
     (custom_options.v1.mask_mapping) = {
       this: "worker_filter"
@@ -144,6 +146,27 @@ message Target {
     }
   ]; // @gotags: `class:"public"`
 
+  // Optional boolean expressions to filter the egress workers that are allowed to satisfy this request.
+  google.protobuf.StringValue egress_worker_filter = 160 [
+    json_name = "egress_worker_filter",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "egress_worker_filter"
+      that: "EgressWorkerFilter"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // Optional boolean expressions to filter the ingress workers that are allowed to satisfy this request.
+  // Unsupported on OSS.
+  google.protobuf.StringValue ingress_worker_filter = 170 [
+    json_name = "ingress_worker_filter",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "ingress_worker_filter"
+      that: "IngressWorkerFilter"
+    }
+  ]; // @gotags: `class:"public"`
+
   // Output only. The IDs of the application credential source ids associated with this Target.
   // Deprecated use "brokered_credential_source_ids" instead.
   repeated string application_credential_source_ids = 400 [

internal/proto/controller/storage/target/store/v1/target.proto

@@ -57,6 +57,12 @@ message TargetView {
   // A boolean expression that allows filtering the workers that can handle a session
   // @inject_tag: `gorm:"default:null"`
   string worker_filter = 120;
+
+  // @inject_tag: `gorm:"default:null"`
+  string egress_worker_filter = 130;
+
+  // @inject_tag: `gorm:"default:null"`
+  string ingress_worker_filter = 140;
 }
 
 message TargetHostSet {

internal/proto/controller/storage/target/targettest/store/v1/target.proto

@@ -71,4 +71,18 @@ message Target {
     this: "WorkerFilter"
     that: "worker_filter"
   }];
+
+  // A boolean expression that allows filtering the egress workers that can handle a session
+  // @inject_tag: `gorm:"default:null"`
+  string egress_worker_filter = 130 [(custom_options.v1.mask_mapping) = {
+    this: "EgressWorkerFilter"
+    that: "egress_worker_filter"
+  }];
+
+  // A boolean expression that allows filtering the ingress workers that can handle a session
+  // @inject_tag: `gorm:"default:null"`
+  string ingress_worker_filter = 140 [(custom_options.v1.mask_mapping) = {
+    this: "IngressWorkerFilter"
+    that: "ingress_worker_filter"
+  }];
 }

internal/proto/controller/storage/target/tcp/store/v1/target.proto

@@ -71,4 +71,18 @@ message Target {
     this: "WorkerFilter"
     that: "worker_filter"
   }];
+
+  // A boolean expression that allows filtering the egress workers that can handle a session
+  // @inject_tag: `gorm:"default:null"`
+  string egress_worker_filter = 130 [(custom_options.v1.mask_mapping) = {
+    this: "EgressWorkerFilter"
+    that: "egress_worker_filter"
+  }];
+
+  // A boolean expression that allows filtering the ingress workers that can handle a session
+  // @inject_tag: `gorm:"default:null"`
+  string ingress_worker_filter = 140 [(custom_options.v1.mask_mapping) = {
+    this: "IngressWorkerFilter"
+    that: "ingress_worker_filter"
+  }];
 }

internal/session/session.go

@@ -47,11 +47,13 @@ type ComposedOf struct {
 	ExpirationTime *timestamp.Timestamp
 	// Max connections for the session
 	ConnectionLimit int32
-	// Worker filter. Active filter when the session was created, used to
+	// Ingress and egress worker filters. Active filters when the session was created, used to
 	// validate the session via the same set of rules at consumption time as
 	// existed at creation time. Round tripping it through here saves a lookup
 	// in the DB. It is not stored in the warehouse.
-	WorkerFilter string
+	WorkerFilter        string
+	EgressWorkerFilter  string
+	IngressWorkerFilter string
 	// DynamicCredentials are dynamic credentials that will be retrieved
 	// for the session. DynamicCredentials optional.
 	DynamicCredentials []*DynamicCredential
@@ -103,8 +105,11 @@ type Session struct {
 	Endpoint string `json:"-" gorm:"default:null"`
 	// Maximum number of connections in a session
 	ConnectionLimit int32 `json:"connection_limit,omitempty" gorm:"default:null"`
-	// Worker filter
-	WorkerFilter string `json:"-" gorm:"default:null"`
+
+	// Worker filters
+	WorkerFilter        string `json:"-" gorm:"default:null"`
+	EgressWorkerFilter  string `json:"-" gorm:"default:null"`
+	IngressWorkerFilter string `json:"-" gorm:"default:null"`
 
 	// key_id is the ID of the key version used to encrypt any fields in this struct
 	KeyId string `json:"key_id,omitempty" gorm:"default:null"`
@@ -147,18 +152,20 @@ var (
 func New(c ComposedOf, _ ...Option) (*Session, error) {
 	const op = "session.New"
 	s := Session{
-		UserId:             c.UserId,
-		HostId:             c.HostId,
-		TargetId:           c.TargetId,
-		HostSetId:          c.HostSetId,
-		AuthTokenId:        c.AuthTokenId,
-		ProjectId:          c.ProjectId,
-		Endpoint:           c.Endpoint,
-		ExpirationTime:     c.ExpirationTime,
-		ConnectionLimit:    c.ConnectionLimit,
-		WorkerFilter:       c.WorkerFilter,
-		DynamicCredentials: c.DynamicCredentials,
-		StaticCredentials:  c.StaticCredentials,
+		UserId:              c.UserId,
+		HostId:              c.HostId,
+		TargetId:            c.TargetId,
+		HostSetId:           c.HostSetId,
+		AuthTokenId:         c.AuthTokenId,
+		ProjectId:           c.ProjectId,
+		Endpoint:            c.Endpoint,
+		ExpirationTime:      c.ExpirationTime,
+		ConnectionLimit:     c.ConnectionLimit,
+		WorkerFilter:        c.WorkerFilter,
+		EgressWorkerFilter:  c.EgressWorkerFilter,
+		IngressWorkerFilter: c.IngressWorkerFilter,
+		DynamicCredentials:  c.DynamicCredentials,
+		StaticCredentials:   c.StaticCredentials,
 	}
 	if err := s.validateNewSession(); err != nil {
 		return nil, errors.WrapDeprecated(err, op)
@@ -174,19 +181,21 @@ func AllocSession() Session {
 // Clone creates a clone of the Session
 func (s *Session) Clone() any {
 	clone := &Session{
-		PublicId:          s.PublicId,
-		UserId:            s.UserId,
-		HostId:            s.HostId,
-		TargetId:          s.TargetId,
-		HostSetId:         s.HostSetId,
-		AuthTokenId:       s.AuthTokenId,
-		ProjectId:         s.ProjectId,
-		TerminationReason: s.TerminationReason,
-		Version:           s.Version,
-		Endpoint:          s.Endpoint,
-		ConnectionLimit:   s.ConnectionLimit,
-		WorkerFilter:      s.WorkerFilter,
-		KeyId:             s.KeyId,
+		PublicId:            s.PublicId,
+		UserId:              s.UserId,
+		HostId:              s.HostId,
+		TargetId:            s.TargetId,
+		HostSetId:           s.HostSetId,
+		AuthTokenId:         s.AuthTokenId,
+		ProjectId:           s.ProjectId,
+		TerminationReason:   s.TerminationReason,
+		Version:             s.Version,
+		Endpoint:            s.Endpoint,
+		ConnectionLimit:     s.ConnectionLimit,
+		WorkerFilter:        s.WorkerFilter,
+		EgressWorkerFilter:  s.EgressWorkerFilter,
+		IngressWorkerFilter: s.IngressWorkerFilter,
+		KeyId:               s.KeyId,
 	}
 	if len(s.States) > 0 {
 		clone.States = make([]*State, 0, len(s.States))
@@ -300,6 +309,10 @@ func (s *Session) VetForWrite(ctx context.Context, _ db.Reader, opType db.OpType
 			return errors.New(ctx, errors.InvalidParameter, op, "connection limit is immutable")
 		case contains(opts.WithFieldMaskPaths, "WorkerFilter"):
 			return errors.New(ctx, errors.InvalidParameter, op, "worker filter is immutable")
+		case contains(opts.WithFieldMaskPaths, "EgressWorkerFilter"):
+			return errors.New(ctx, errors.InvalidParameter, op, "egress worker filter is immutable")
+		case contains(opts.WithFieldMaskPaths, "IngressWorkerFilter"):
+			return errors.New(ctx, errors.InvalidParameter, op, "ingress worker filter is immutable")
 		case contains(opts.WithFieldMaskPaths, "DynamicCredentials"):
 			return errors.New(ctx, errors.InvalidParameter, op, "dynamic credentials are immutable")
 		case contains(opts.WithFieldMaskPaths, "StaticCredentials"):

internal/target/options.go

@@ -38,6 +38,8 @@ type options struct {
 	WithPermissions            []perms.Permission
 	WithPublicId               string
 	WithWorkerFilter           string
+	WithEgressWorkerFilter     string
+	WithIngressWorkerFilter    string
 	WithTargetIds              []string
 }
 
@@ -60,6 +62,8 @@ func getDefaultOptions() options {
 		WithPermissions:            nil,
 		WithPublicId:               "",
 		WithWorkerFilter:           "",
+		WithEgressWorkerFilter:     "",
+		WithIngressWorkerFilter:    "",
 	}
 }
 
@@ -175,6 +179,20 @@ func WithWorkerFilter(filter string) Option {
 	}
 }
 
+// WithEgressWorkerFilter provides an optional egress worker filter
+func WithEgressWorkerFilter(filter string) Option {
+	return func(o *options) {
+		o.WithEgressWorkerFilter = filter
+	}
+}
+
+// WithIngressWorkerFilter provides an optional ingress worker filter
+func WithIngressWorkerFilter(filter string) Option {
+	return func(o *options) {
+		o.WithIngressWorkerFilter = filter
+	}
+}
+
 // WithTargetIds provides an option to search by specific target IDs
 func WithTargetIds(with []string) Option {
 	return func(o *options) {

internal/target/options_test.go

@@ -109,6 +109,20 @@ func Test_GetOpts(t *testing.T) {
 		testOpts.WithWorkerFilter = `"/foo" == "bar"`
 		assert.Equal(opts, testOpts)
 	})
+	t.Run("WithEgressWorkerFilter", func(t *testing.T) {
+		assert := assert.New(t)
+		opts := GetOpts(WithEgressWorkerFilter(`"/foo" == "bar"`))
+		testOpts := getDefaultOptions()
+		testOpts.WithEgressWorkerFilter = `"/foo" == "bar"`
+		assert.Equal(opts, testOpts)
+	})
+	t.Run("WithIngressWorkerFilter", func(t *testing.T) {
+		assert := assert.New(t)
+		opts := GetOpts(WithIngressWorkerFilter(`"/foo" == "bar"`))
+		testOpts := getDefaultOptions()
+		testOpts.WithIngressWorkerFilter = `"/foo" == "bar"`
+		assert.Equal(opts, testOpts)
+	})
 	t.Run("WithPermissions", func(t *testing.T) {
 		assert := assert.New(t)
 		opts := GetOpts(WithPermissions([]perms.Permission{{ScopeId: "test1"}, {ScopeId: "test2"}}))

internal/target/repository.go

@@ -524,6 +524,8 @@ func (r *Repository) UpdateTarget(ctx context.Context, target Target, version ui
 		case strings.EqualFold("sessionmaxseconds", f):
 		case strings.EqualFold("sessionconnectionlimit", f):
 		case strings.EqualFold("workerfilter", f):
+		case strings.EqualFold("egressworkerfilter", f):
+		case strings.EqualFold("ingressworkerfilter", f):
 		default:
 			return nil, nil, nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidFieldMask, op, fmt.Sprintf("invalid field mask: %s", f))
 		}
@@ -537,6 +539,8 @@ func (r *Repository) UpdateTarget(ctx context.Context, target Target, version ui
 			"SessionMaxSeconds":      target.GetSessionMaxSeconds(),
 			"SessionConnectionLimit": target.GetSessionConnectionLimit(),
 			"WorkerFilter":           target.GetWorkerFilter(),
+			"EgressWorkerFilter":     target.GetEgressWorkerFilter(),
+			"IngressWorkerFilter":    target.GetIngressWorkerFilter(),
 		},
 		fieldMaskPaths,
 		[]string{"SessionMaxSeconds", "SessionConnectionLimit"},

internal/target/store/target.pb.go

@@ -65,6 +65,10 @@ type TargetView struct {
 	// A boolean expression that allows filtering the workers that can handle a session
 	// @inject_tag: `gorm:"default:null"`
 	WorkerFilter string `protobuf:"bytes,120,opt,name=worker_filter,json=workerFilter,proto3" json:"worker_filter,omitempty" gorm:"default:null"`
+	// @inject_tag: `gorm:"default:null"`
+	EgressWorkerFilter string `protobuf:"bytes,130,opt,name=egress_worker_filter,json=egressWorkerFilter,proto3" json:"egress_worker_filter,omitempty" gorm:"default:null"`
+	// @inject_tag: `gorm:"default:null"`
+	IngressWorkerFilter string `protobuf:"bytes,140,opt,name=ingress_worker_filter,json=ingressWorkerFilter,proto3" json:"ingress_worker_filter,omitempty" gorm:"default:null"`
 }
 
 func (x *TargetView) Reset() {
@@ -183,6 +187,20 @@ func (x *TargetView) GetWorkerFilter() string {
 	return ""
 }
 
+func (x *TargetView) GetEgressWorkerFilter() string {
+	if x != nil {
+		return x.EgressWorkerFilter
+	}
+	return ""
+}
+
+func (x *TargetView) GetIngressWorkerFilter() string {
+	if x != nil {
+		return x.IngressWorkerFilter
+	}
+	return ""
+}
+
 type TargetHostSet struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -569,7 +587,7 @@ var file_controller_storage_target_store_v1_target_proto_rawDesc = []byte{
 	0x72, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
 	0x72, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74,
 	0x61, 0x6d, 0x70, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xf8, 0x03, 0x0a, 0x0a, 0x54, 0x61, 0x72, 0x67, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe0, 0x04, 0x0a, 0x0a, 0x54, 0x61, 0x72, 0x67, 0x65,
 	0x74, 0x56, 0x69, 0x65, 0x77, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f,
 	0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
 	0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x69, 0x64,
@@ -601,68 +619,74 @@ var file_controller_storage_target_store_v1_target_proto_rawDesc = []byte{
 	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x23, 0x0a, 0x0d,
 	0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x78, 0x20,
 	0x01, 0x28, 0x09, 0x52, 0x0c, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65,
-	0x72, 0x22, 0x99, 0x01, 0x0a, 0x0d, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x48, 0x6f, 0x73, 0x74,
-	0x53, 0x65, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64,
-	0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x49, 0x64,
-	0x12, 0x1e, 0x0a, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18,
-	0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x53, 0x65, 0x74, 0x49, 0x64,
-	0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18,
-	0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
-	0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
-	0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x22, 0xe0, 0x01,
-	0x0a, 0x11, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72,
-	0x61, 0x72, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64,
-	0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x49, 0x64,
-	0x12, 0x32, 0x0a, 0x15, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c,
-	0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61,
-	0x72, 0x79, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x5f, 0x70, 0x75, 0x72, 0x70, 0x6f, 0x73, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x50, 0x75, 0x72, 0x70,
-	0x6f, 0x73, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69,
-	0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
-	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65,
-	0x22, 0xd0, 0x01, 0x0a, 0x10, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x43, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f,
-	0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74,
-	0x49, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x70, 0x75, 0x72, 0x70, 0x6f, 0x73, 0x65, 0x18, 0x1e, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x50,
-	0x75, 0x72, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
-	0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54,
-	0x69, 0x6d, 0x65, 0x22, 0xf1, 0x01, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67,
-	0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x61, 0x72,
-	0x67, 0x65, 0x74, 0x49, 0x64, 0x12, 0x30, 0x0a, 0x14, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x70, 0x75, 0x72, 0x70, 0x6f, 0x73, 0x65, 0x18, 0x1e, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x50,
-	0x75, 0x72, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
-	0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54,
-	0x69, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x32, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x47, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x56, 0x69, 0x65, 0x77, 0x12,
-	0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04,
-	0x74, 0x79, 0x70, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65,
-	0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72,
-	0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65,
-	0x74, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x72, 0x12, 0x31, 0x0a, 0x14, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b,
+	0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x12, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69,
+	0x6c, 0x74, 0x65, 0x72, 0x12, 0x33, 0x0a, 0x15, 0x69, 0x6e, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f,
+	0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x8c, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x69, 0x6e, 0x67, 0x72, 0x65, 0x73, 0x73, 0x57, 0x6f, 0x72,
+	0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x22, 0x99, 0x01, 0x0a, 0x0d, 0x54, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x48, 0x6f, 0x73, 0x74, 0x53, 0x65, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74,
+	0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x49, 0x64, 0x12, 0x1e, 0x0a, 0x0b, 0x68, 0x6f, 0x73, 0x74,
+	0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x68,
+	0x6f, 0x73, 0x74, 0x53, 0x65, 0x74, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61,
+	0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x54, 0x69, 0x6d, 0x65, 0x22, 0xe0, 0x01, 0x0a, 0x11, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x74,
+	0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x49, 0x64, 0x12, 0x32, 0x0a, 0x15, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69,
+	0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x12,
+	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x70, 0x75, 0x72, 0x70, 0x6f,
+	0x73, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x50, 0x75, 0x72, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x63,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74,
+	0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e,
+	0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x22, 0xd0, 0x01, 0x0a, 0x10, 0x53, 0x74, 0x61,
+	0x74, 0x69, 0x63, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x1b, 0x0a,
+	0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x49, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x72,
+	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x49, 0x64, 0x12,
+	0x2d, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x70, 0x75,
+	0x72, 0x70, 0x6f, 0x73, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x63, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x50, 0x75, 0x72, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x4b,
+	0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
+	0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
+	0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x22, 0xf1, 0x01, 0x0a, 0x10,
+	0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x12, 0x1b, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x49, 0x64, 0x12, 0x30, 0x0a,
+	0x14, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x63, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12,
+	0x2d, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x70, 0x75,
+	0x72, 0x70, 0x6f, 0x73, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x63, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x50, 0x75, 0x72, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x4b,
+	0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
+	0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
+	0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74,
+	0x79, 0x70, 0x65, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22,
+	0x47, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x56, 0x69, 0x65, 0x77, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x14, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b,
+	0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

internal/target/target.go

@@ -26,6 +26,8 @@ type Target interface {
 	GetSessionMaxSeconds() uint32
 	GetSessionConnectionLimit() int32
 	GetWorkerFilter() string
+	GetEgressWorkerFilter() string
+	GetIngressWorkerFilter() string
 	Clone() Target
 	SetPublicId(context.Context, string) error
 	SetProjectId(string)
@@ -38,6 +40,8 @@ type Target interface {
 	SetSessionMaxSeconds(uint32)
 	SetSessionConnectionLimit(int32)
 	SetWorkerFilter(string)
+	SetEgressWorkerFilter(string)
+	SetIngressWorkerFilter(string)
 	Oplog(op oplog.OpType) oplog.Metadata
 }
 
@@ -123,5 +127,7 @@ func (t *targetView) targetSubtype(ctx context.Context) (Target, error) {
 	tt.SetSessionMaxSeconds(t.SessionMaxSeconds)
 	tt.SetSessionConnectionLimit(t.SessionConnectionLimit)
 	tt.SetWorkerFilter(t.WorkerFilter)
+	tt.SetEgressWorkerFilter(t.EgressWorkerFilter)
+	tt.SetIngressWorkerFilter(t.IngressWorkerFilter)
 	return tt, nil
 }

internal/target/targettest/store/target.pb.go

@@ -62,6 +62,12 @@ type Target struct {
 	// A boolean expression that allows filtering the workers that can handle a session
 	// @inject_tag: `gorm:"default:null"`
 	WorkerFilter string `protobuf:"bytes,120,opt,name=worker_filter,json=workerFilter,proto3" json:"worker_filter,omitempty" gorm:"default:null"`
+	// A boolean expression that allows filtering the egress workers that can handle a session
+	// @inject_tag: `gorm:"default:null"`
+	EgressWorkerFilter string `protobuf:"bytes,130,opt,name=egress_worker_filter,json=egressWorkerFilter,proto3" json:"egress_worker_filter,omitempty" gorm:"default:null"`
+	// A boolean expression that allows filtering the ingress workers that can handle a session
+	// @inject_tag: `gorm:"default:null"`
+	IngressWorkerFilter string `protobuf:"bytes,140,opt,name=ingress_worker_filter,json=ingressWorkerFilter,proto3" json:"ingress_worker_filter,omitempty" gorm:"default:null"`
 }
 
 func (x *Target) Reset() {
@@ -173,6 +179,20 @@ func (x *Target) GetWorkerFilter() string {
 	return ""
 }
 
+func (x *Target) GetEgressWorkerFilter() string {
+	if x != nil {
+		return x.EgressWorkerFilter
+	}
+	return ""
+}
+
+func (x *Target) GetIngressWorkerFilter() string {
+	if x != nil {
+		return x.IngressWorkerFilter
+	}
+	return ""
+}
+
 var File_controller_storage_target_targettest_store_v1_target_proto protoreflect.FileDescriptor
 
 var file_controller_storage_target_targettest_store_v1_target_proto_rawDesc = []byte{
@@ -188,7 +208,7 @@ var file_controller_storage_target_targettest_store_v1_target_proto_rawDesc = []
 	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
 	0x6c, 0x65, 0x72, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x74, 0x69, 0x6d, 0x65,
 	0x73, 0x74, 0x61, 0x6d, 0x70, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc7, 0x05, 0x0a, 0x06, 0x54, 0x61, 0x72,
+	0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x91, 0x07, 0x0a, 0x06, 0x54, 0x61, 0x72,
 	0x67, 0x65, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64,
 	0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64,
 	0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x14,
@@ -233,12 +253,24 @@ var file_controller_storage_target_targettest_store_v1_target_proto_rawDesc = []
 	0x09, 0x42, 0x21, 0xc2, 0xdd, 0x29, 0x1d, 0x0a, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46,
 	0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69,
 	0x6c, 0x74, 0x65, 0x72, 0x52, 0x0c, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74,
-	0x65, 0x72, 0x42, 0x46, 0x5a, 0x44, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64,
-	0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x61, 0x72,
-	0x67, 0x65, 0x74, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x74, 0x65, 0x73, 0x74, 0x2f, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x65, 0x72, 0x12, 0x61, 0x0a, 0x14, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72,
+	0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x42, 0x2e, 0xc2, 0xdd, 0x29, 0x2a, 0x0a, 0x12, 0x45, 0x67, 0x72, 0x65, 0x73, 0x73, 0x57,
+	0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x14, 0x65, 0x67, 0x72,
+	0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65,
+	0x72, 0x52, 0x12, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46,
+	0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x65, 0x0a, 0x15, 0x69, 0x6e, 0x67, 0x72, 0x65, 0x73, 0x73,
+	0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x8c,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x30, 0xc2, 0xdd, 0x29, 0x2c, 0x0a, 0x13, 0x49, 0x6e, 0x67,
+	0x72, 0x65, 0x73, 0x73, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72,
+	0x12, 0x15, 0x69, 0x6e, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72,
+	0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x13, 0x69, 0x6e, 0x67, 0x72, 0x65, 0x73, 0x73,
+	0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x42, 0x46, 0x5a, 0x44,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x2f, 0x74, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x74, 0x65, 0x73, 0x74, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73,
+	0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

internal/target/targettest/target.go

@@ -117,6 +117,14 @@ func (t *Target) GetWorkerFilter() string {
 	return t.WorkerFilter
 }
 
+func (t *Target) GetEgressWorkerFilter() string {
+	return t.EgressWorkerFilter
+}
+
+func (t *Target) GetIngressWorkerFilter() string {
+	return t.IngressWorkerFilter
+}
+
 func (t *Target) Clone() target.Target {
 	cp := proto.Clone(t.Target)
 	return &Target{
@@ -165,8 +173,16 @@ func (t *Target) SetSessionConnectionLimit(l int32) {
 	t.SessionConnectionLimit = l
 }
 
-func (t *Target) SetWorkerFilter(f string) {
-	t.WorkerFilter = f
+func (t *Target) SetWorkerFilter(filter string) {
+	t.WorkerFilter = filter
+}
+
+func (t *Target) SetEgressWorkerFilter(filter string) {
+	t.EgressWorkerFilter = filter
+}
+
+func (t *Target) SetIngressWorkerFilter(filter string) {
+	t.IngressWorkerFilter = filter
 }
 
 func (t *Target) Oplog(op oplog.OpType) oplog.Metadata {
@@ -251,6 +267,8 @@ func New(projectId string, opt ...target.Option) (target.Target, error) {
 			SessionConnectionLimit: opts.WithSessionConnectionLimit,
 			SessionMaxSeconds:      opts.WithSessionMaxSeconds,
 			WorkerFilter:           opts.WithWorkerFilter,
+			EgressWorkerFilter:     opts.WithEgressWorkerFilter,
+			IngressWorkerFilter:    opts.WithIngressWorkerFilter,
 		},
 	}
 	return t, nil

internal/target/tcp/repository_tcp_target_test.go

@@ -123,6 +123,54 @@ func TestRepository_CreateTarget(t *testing.T) {
 			wantErr:     true,
 			wantIsError: errors.InvalidParameter,
 		},
+		{
+			name: "valid-with-egress-filter",
+			args: args{
+				target: func() target.Target {
+					target, err := target.New(ctx, tcp.Subtype, proj.PublicId,
+						target.WithName("valid-egress-filter"),
+						target.WithDescription("valid-org"),
+						target.WithDefaultPort(uint32(22)),
+						target.WithEgressWorkerFilter("test-filter"))
+					require.NoError(t, err)
+					return target
+				}(),
+			},
+			wantErr: false,
+		},
+		{
+			name: "deprecated-worker-filter",
+			args: args{
+				target: func() target.Target {
+					target, err := target.New(ctx, tcp.Subtype, proj.PublicId,
+						target.WithName("bad-worker-filter"),
+						target.WithDescription("valid-org"),
+						target.WithDefaultPort(uint32(22)),
+						target.WithWorkerFilter("test-filter"))
+					require.NoError(t, err)
+					return target
+				}(),
+			},
+			wantErr:     true,
+			wantIsError: errors.Exception,
+		},
+		{
+			name: "invalid-setting-egress-and-worker-filter",
+			args: args{
+				target: func() target.Target {
+					target, err := target.New(ctx, tcp.Subtype, proj.PublicId,
+						target.WithName("bad-filters"),
+						target.WithDescription("valid-org"),
+						target.WithDefaultPort(uint32(22)),
+						target.WithWorkerFilter("test-filter"),
+						target.WithEgressWorkerFilter("test-filter"))
+					require.NoError(t, err)
+					return target
+				}(),
+			},
+			wantErr:     true,
+			wantIsError: errors.Exception,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

internal/target/tcp/store/target.pb.go

@@ -62,6 +62,12 @@ type Target struct {
 	// A boolean expression that allows filtering the workers that can handle a session
 	// @inject_tag: `gorm:"default:null"`
 	WorkerFilter string `protobuf:"bytes,120,opt,name=worker_filter,json=workerFilter,proto3" json:"worker_filter,omitempty" gorm:"default:null"`
+	// A boolean expression that allows filtering the egress workers that can handle a session
+	// @inject_tag: `gorm:"default:null"`
+	EgressWorkerFilter string `protobuf:"bytes,130,opt,name=egress_worker_filter,json=egressWorkerFilter,proto3" json:"egress_worker_filter,omitempty" gorm:"default:null"`
+	// A boolean expression that allows filtering the ingress workers that can handle a session
+	// @inject_tag: `gorm:"default:null"`
+	IngressWorkerFilter string `protobuf:"bytes,140,opt,name=ingress_worker_filter,json=ingressWorkerFilter,proto3" json:"ingress_worker_filter,omitempty" gorm:"default:null"`
 }
 
 func (x *Target) Reset() {
@@ -173,6 +179,20 @@ func (x *Target) GetWorkerFilter() string {
 	return ""
 }
 
+func (x *Target) GetEgressWorkerFilter() string {
+	if x != nil {
+		return x.EgressWorkerFilter
+	}
+	return ""
+}
+
+func (x *Target) GetIngressWorkerFilter() string {
+	if x != nil {
+		return x.IngressWorkerFilter
+	}
+	return ""
+}
+
 var File_controller_storage_target_tcp_store_v1_target_proto protoreflect.FileDescriptor
 
 var file_controller_storage_target_tcp_store_v1_target_proto_rawDesc = []byte{
@@ -187,7 +207,7 @@ var file_controller_storage_target_tcp_store_v1_target_proto_rawDesc = []byte{
 	0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72,
 	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x74, 0x69,
 	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc7, 0x05, 0x0a, 0x06, 0x54,
+	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x91, 0x07, 0x0a, 0x06, 0x54,
 	0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f,
 	0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
 	0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x69, 0x64,
@@ -232,11 +252,24 @@ var file_controller_storage_target_tcp_store_v1_target_proto_rawDesc = []byte{
 	0x01, 0x28, 0x09, 0x42, 0x21, 0xc2, 0xdd, 0x29, 0x1d, 0x0a, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65,
 	0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f,
 	0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0c, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69,
-	0x6c, 0x74, 0x65, 0x72, 0x42, 0x3f, 0x5a, 0x3d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75,
-	0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x74,
-	0x61, 0x72, 0x67, 0x65, 0x74, 0x2f, 0x74, 0x63, 0x70, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6c, 0x74, 0x65, 0x72, 0x12, 0x61, 0x0a, 0x14, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x77,
+	0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x82, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0x2e, 0xc2, 0xdd, 0x29, 0x2a, 0x0a, 0x12, 0x45, 0x67, 0x72, 0x65, 0x73,
+	0x73, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x14, 0x65,
+	0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c,
+	0x74, 0x65, 0x72, 0x52, 0x12, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x57, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x65, 0x0a, 0x15, 0x69, 0x6e, 0x67, 0x72, 0x65,
+	0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72,
+	0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x30, 0xc2, 0xdd, 0x29, 0x2c, 0x0a, 0x13, 0x49,
+	0x6e, 0x67, 0x72, 0x65, 0x73, 0x73, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74,
+	0x65, 0x72, 0x12, 0x15, 0x69, 0x6e, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b,
+	0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x13, 0x69, 0x6e, 0x67, 0x72, 0x65,
+	0x73, 0x73, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x42, 0x3f,
+	0x5a, 0x3d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f,
+	0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x2f,
+	0x74, 0x63, 0x70, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

internal/target/tcp/target.go

@@ -54,6 +54,8 @@ func (h targetHooks) NewTarget(projectId string, opt ...target.Option) (target.T
 			SessionConnectionLimit: opts.WithSessionConnectionLimit,
 			SessionMaxSeconds:      opts.WithSessionMaxSeconds,
 			WorkerFilter:           opts.WithWorkerFilter,
+			EgressWorkerFilter:     opts.WithEgressWorkerFilter,
+			IngressWorkerFilter:    opts.WithIngressWorkerFilter,
 		},
 	}
 	return t, nil
@@ -171,3 +173,11 @@ func (t *Target) SetSessionConnectionLimit(limit int32) {
 func (t *Target) SetWorkerFilter(filter string) {
 	t.WorkerFilter = filter
 }
+
+func (t *Target) SetEgressWorkerFilter(filter string) {
+	t.EgressWorkerFilter = filter
+}
+
+func (t *Target) SetIngressWorkerFilter(filter string) {
+	t.IngressWorkerFilter = filter
+}

internal/tests/api/targets/classification_test.go

@@ -64,7 +64,7 @@ func TestTargets(t *testing.T) {
 					},
 					SessionMaxSeconds:           &wrapperspb.UInt32Value{Value: 0},
 					SessionConnectionLimit:      &wrapperspb.Int32Value{Value: 0},
-					WorkerFilter:                &wrapperspb.StringValue{Value: "worker-filter"},
+					EgressWorkerFilter:          &wrapperspb.StringValue{Value: "egress-worker-filter"},
 					BrokeredCredentialSourceIds: []string{"brokered-credential-source-id"},
 					BrokeredCredentialSources: []*pb.CredentialSource{
 						{
@@ -125,7 +125,7 @@ func TestTargets(t *testing.T) {
 					},
 					SessionMaxSeconds:           &wrapperspb.UInt32Value{Value: 0},
 					SessionConnectionLimit:      &wrapperspb.Int32Value{Value: 0},
-					WorkerFilter:                &wrapperspb.StringValue{Value: "worker-filter"},
+					EgressWorkerFilter:          &wrapperspb.StringValue{Value: "egress-worker-filter"},
 					BrokeredCredentialSourceIds: []string{"brokered-credential-source-id"},
 					BrokeredCredentialSources: []*pb.CredentialSource{
 						{

internal/tests/cluster/worker_tagging_test.go

@@ -6,6 +6,7 @@ import (
 	"github.com/hashicorp/boundary/api/targets"
 	"github.com/hashicorp/boundary/internal/cmd/config"
 	"github.com/hashicorp/boundary/internal/daemon/controller"
+	ct "github.com/hashicorp/boundary/internal/daemon/controller/handlers/targets"
 	"github.com/hashicorp/boundary/internal/daemon/worker"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/targets"
 	"github.com/hashicorp/go-hclog"
@@ -100,29 +101,43 @@ func TestWorkerTagging(t *testing.T) {
 
 	expectWorkers(t, c1, w1, w2, w3)
 
+	// Ensure we are using the OSS filter, which uses egress only for worker selection
+	oldAuthFun := ct.AuthorizeSessionWorkerFilterFn
+	ct.AuthorizeSessionWorkerFilterFn = ct.AuthorizeSessionWithWorkerFilter
+	validateIngressFn := ct.ValidateIngressWorkerFilterFn
+	ct.ValidateIngressWorkerFilterFn = ct.IngressWorkerFilterUnsupported
+
 	cases := []struct {
-		name       string
-		filter     string
-		expWorkers []string
+		name          string
+		egressFilter  string
+		ingressFilter string
+		expWorkers    []string
+		wantErr       bool
 	}{
 		{
 			name:       "base case",
 			expWorkers: []string{w1Addr, w2Addr, w3Addr},
 		},
 		{
-			name:       "name and region",
-			filter:     `"/name" matches "test_worker_[13]" and "west" in "/tags/region"`,
-			expWorkers: []string{w3Addr},
+			name:         "name and region",
+			egressFilter: `"/name" matches "test_worker_[13]" and "west" in "/tags/region"`,
+			expWorkers:   []string{w3Addr},
 		},
 		{
-			name:       "name and az",
-			filter:     `"/name" matches "test_worker_[23]" and "three" in "/tags/az"`,
-			expWorkers: []string{w2Addr, w3Addr},
+			name:         "name and az",
+			egressFilter: `"/name" matches "test_worker_[23]" and "three" in "/tags/az"`,
+			expWorkers:   []string{w2Addr, w3Addr},
 		},
 		{
-			name:       "key not found doesn't error",
-			filter:     `"bar" in "/tags/foo"`,
-			expWorkers: []string{w1Addr},
+			name:         "key not found doesn't error",
+			egressFilter: `"bar" in "/tags/foo"`,
+			expWorkers:   []string{w1Addr},
+		},
+		{
+			name:          "ingress filter invalid",
+			ingressFilter: `"/name" matches "test_worker_[13]" and "west" in "/tags/region"`,
+			expWorkers:    []string{w3Addr},
+			wantErr:       true,
 		},
 	}
 	for _, tc := range cases {
@@ -130,10 +145,17 @@ func TestWorkerTagging(t *testing.T) {
 			require, assert := require.New(t), assert.New(t)
 
 			opts := []targets.Option{targets.WithAutomaticVersioning(true), targets.WithDescription(tc.name)}
-			if tc.filter != "" {
-				opts = append(opts, targets.WithWorkerFilter(tc.filter))
+			if tc.egressFilter != "" {
+				opts = append(opts, targets.WithEgressWorkerFilter(tc.egressFilter))
+			}
+			if tc.ingressFilter != "" {
+				opts = append(opts, targets.WithIngressWorkerFilter(tc.ingressFilter))
 			}
 			tgt, err := tcl.Update(ctx, "ttcp_1234567890", 0, opts...)
+			if tc.wantErr {
+				require.Error(err)
+				return
+			}
 			require.NoError(err)
 			require.NotNil(tgt)
 
@@ -153,4 +175,6 @@ func TestWorkerTagging(t *testing.T) {
 			assert.ElementsMatch(tc.expWorkers, addrs)
 		})
 	}
+	ct.AuthorizeSessionWorkerFilterFn = oldAuthFun
+	ct.ValidateIngressWorkerFilterFn = validateIngressFn
 }

sdk/pbs/controller/api/resources/targets/target.pb.go

@@ -337,7 +337,15 @@ type Target struct {
 	// Maximum number of connections allowed in a Session.  Unlimited is indicated by the value -1.
 	SessionConnectionLimit *wrapperspb.Int32Value `protobuf:"bytes,130,opt,name=session_connection_limit,proto3" json:"session_connection_limit,omitempty" class:"public"` // @gotags: `class:"public"`
 	// Optional boolean expression to filter the workers that are allowed to satisfy this request.
+	// Deprecated; use egress or ingress worker filters instead.
+	//
+	// Deprecated: Do not use.
 	WorkerFilter *wrapperspb.StringValue `protobuf:"bytes,140,opt,name=worker_filter,proto3" json:"worker_filter,omitempty" class:"public"` // @gotags: `class:"public"`
+	// Optional boolean expressions to filter the egress workers that are allowed to satisfy this request.
+	EgressWorkerFilter *wrapperspb.StringValue `protobuf:"bytes,160,opt,name=egress_worker_filter,proto3" json:"egress_worker_filter,omitempty" class:"public"` // @gotags: `class:"public"`
+	// Optional boolean expressions to filter the ingress workers that are allowed to satisfy this request.
+	// Unsupported on OSS.
+	IngressWorkerFilter *wrapperspb.StringValue `protobuf:"bytes,170,opt,name=ingress_worker_filter,proto3" json:"ingress_worker_filter,omitempty" class:"public"` // @gotags: `class:"public"`
 	// Output only. The IDs of the application credential source ids associated with this Target.
 	// Deprecated use "brokered_credential_source_ids" instead.
 	//
@@ -489,6 +497,7 @@ func (x *Target) GetSessionConnectionLimit() *wrapperspb.Int32Value {
 	return nil
 }
 
+// Deprecated: Do not use.
 func (x *Target) GetWorkerFilter() *wrapperspb.StringValue {
 	if x != nil {
 		return x.WorkerFilter
@@ -496,6 +505,20 @@ func (x *Target) GetWorkerFilter() *wrapperspb.StringValue {
 	return nil
 }
 
+func (x *Target) GetEgressWorkerFilter() *wrapperspb.StringValue {
+	if x != nil {
+		return x.EgressWorkerFilter
+	}
+	return nil
+}
+
+func (x *Target) GetIngressWorkerFilter() *wrapperspb.StringValue {
+	if x != nil {
+		return x.IngressWorkerFilter
+	}
+	return nil
+}
+
 // Deprecated: Do not use.
 func (x *Target) GetApplicationCredentialSourceIds() []string {
 	if x != nil {
@@ -1211,7 +1234,7 @@ var file_controller_api_resources_targets_v1_target_proto_rawDesc = []byte{
 	0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x64,
 	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4a, 0x04, 0x08, 0x0a, 0x10, 0x0b, 0x52, 0x12, 0x63, 0x72,
 	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79,
-	0x22, 0xd2, 0x11, 0x0a, 0x06, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x22, 0xe8, 0x13, 0x0a, 0x06, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69,
 	0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x73,
 	0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73,
 	0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65,
@@ -1266,93 +1289,119 @@ var file_controller_api_resources_targets_v1_target_proto_rawDesc = []byte{
 	0x16, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
 	0x6f, 0x6e, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x52, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
 	0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69,
-	0x74, 0x12, 0x6a, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74,
+	0x74, 0x12, 0x6c, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74,
 	0x65, 0x72, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
 	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69,
-	0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x25, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29,
-	0x1d, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72,
-	0x12, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0d,
-	0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x51, 0x0a,
-	0x21, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69,
-	0x64, 0x73, 0x18, 0x90, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x21, 0x61,
-	0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73,
-	0x12, 0x82, 0x01, 0x0a, 0x1e, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x27, 0x18, 0x01, 0xa0, 0xda, 0x29, 0x01, 0xc2,
+	0xdd, 0x29, 0x1d, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74,
+	0x65, 0x72, 0x12, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72,
+	0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12,
+	0x85, 0x01, 0x0a, 0x14, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0xa0, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x32, 0xa0,
+	0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x2a, 0x0a, 0x14, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f,
+	0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x12, 0x45,
+	0x67, 0x72, 0x65, 0x73, 0x73, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65,
+	0x72, 0x52, 0x14, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72,
+	0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x89, 0x01, 0x0a, 0x15, 0x69, 0x6e, 0x67, 0x72,
+	0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65,
+	0x72, 0x18, 0xaa, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e,
+	0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x34, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x2c,
+	0x0a, 0x15, 0x69, 0x6e, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72,
+	0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x13, 0x49, 0x6e, 0x67, 0x72, 0x65, 0x73, 0x73,
+	0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x15, 0x69, 0x6e,
+	0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c,
+	0x74, 0x65, 0x72, 0x12, 0x51, 0x0a, 0x21, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x90, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42,
+	0x02, 0x18, 0x01, 0x52, 0x21, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
 	0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x73, 0x18, 0x9a, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e,
+	0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x82, 0x01, 0x0a, 0x1e, 0x61, 0x70, 0x70, 0x6c, 0x69,
+	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x9a, 0x03, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67,
+	0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x02, 0x18, 0x01, 0x52, 0x1e, 0x61, 0x70, 0x70,
+	0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x47, 0x0a, 0x1e, 0x62,
+	0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
+	0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0xb8, 0x03,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x1e, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x5f, 0x69, 0x64, 0x73, 0x12, 0x78, 0x0a, 0x1b, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64,
+	0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x73, 0x18, 0xc2, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e,
 	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f,
 	0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31,
 	0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x42, 0x02, 0x18, 0x01, 0x52, 0x1e, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x47, 0x0a, 0x1e, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65,
-	0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0xb8, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x1e,
-	0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x78,
-	0x0a, 0x1b, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0xc2, 0x03,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
-	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e,
-	0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x1b, 0x62, 0x72, 0x6f,
-	0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x5f, 0x0a, 0x2a, 0x69, 0x6e, 0x6a, 0x65,
-	0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x88, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x2a, 0x69,
-	0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x90, 0x01, 0x0a, 0x27, 0x69, 0x6e,
-	0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x92, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63,
-	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e,
-	0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x52, 0x27, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70,
+	0x65, 0x52, 0x1b, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x5f,
+	0x0a, 0x2a, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69,
+	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x88, 0x04, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x2a, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70,
 	0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x0a,
-	0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0xc8, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x42, 0x0f, 0xa0, 0xda, 0x29, 0x01,
-	0x9a, 0xe3, 0x29, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x48, 0x00, 0x52, 0x0a, 0x61,
-	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x8c, 0x01, 0x0a, 0x15, 0x74, 0x63,
-	0x70, 0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
-	0x74, 0x65, 0x73, 0x18, 0xc9, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x54, 0x63, 0x70, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62,
-	0x75, 0x74, 0x65, 0x73, 0x42, 0x1b, 0xa0, 0xda, 0x29, 0x01, 0x9a, 0xe3, 0x29, 0x03, 0x74, 0x63,
-	0x70, 0xfa, 0xd2, 0xe4, 0x93, 0x02, 0x0a, 0x12, 0x08, 0x49, 0x4e, 0x54, 0x45, 0x52, 0x4e, 0x41,
-	0x4c, 0x48, 0x00, 0x52, 0x13, 0x74, 0x63, 0x70, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74,
-	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x8c, 0x01, 0x0a, 0x15, 0x73, 0x73, 0x68,
-	0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
-	0x65, 0x73, 0x18, 0xca, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
-	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e,
-	0x53, 0x73, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
-	0x74, 0x65, 0x73, 0x42, 0x1b, 0xa0, 0xda, 0x29, 0x01, 0x9a, 0xe3, 0x29, 0x03, 0x73, 0x73, 0x68,
-	0xfa, 0xd2, 0xe4, 0x93, 0x02, 0x0a, 0x12, 0x08, 0x49, 0x4e, 0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c,
-	0x48, 0x00, 0x52, 0x13, 0x73, 0x73, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74, 0x74,
-	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x2f, 0x0a, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xac, 0x02,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64,
-	0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x07, 0x0a, 0x05, 0x61, 0x74, 0x74, 0x72,
-	0x73, 0x4a, 0x06, 0x08, 0x96, 0x01, 0x10, 0x97, 0x01, 0x4a, 0x06, 0x08, 0xb4, 0x01, 0x10, 0xb5,
-	0x01, 0x4a, 0x06, 0x08, 0xf4, 0x03, 0x10, 0xf5, 0x03, 0x4a, 0x06, 0x08, 0xfe, 0x03, 0x10, 0xff,
-	0x03, 0x4a, 0x04, 0x08, 0x64, 0x10, 0x65, 0x4a, 0x04, 0x08, 0x6e, 0x10, 0x6f, 0x52, 0x22, 0x61,
-	0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64,
-	0x73, 0x52, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63,
-	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72,
-	0x69, 0x65, 0x73, 0x52, 0x1c, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x63, 0x72, 0x65, 0x64,
-	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64,
-	0x73, 0x52, 0x19, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x52, 0x0c, 0x68, 0x6f,
-	0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x52, 0x09, 0x68, 0x6f, 0x73, 0x74,
-	0x5f, 0x73, 0x65, 0x74, 0x73, 0x22, 0x87, 0x01, 0x0a, 0x13, 0x54, 0x63, 0x70, 0x54, 0x61, 0x72,
+	0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x12,
+	0x90, 0x01, 0x0a, 0x27, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70,
+	0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x92, 0x04, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x27, 0x69, 0x6e, 0x6a, 0x65, 0x63,
+	0x74, 0x65, 0x64, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
+	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x12, 0x4b, 0x0a, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
+	0x18, 0xc8, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74,
+	0x42, 0x0f, 0xa0, 0xda, 0x29, 0x01, 0x9a, 0xe3, 0x29, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c,
+	0x74, 0x48, 0x00, 0x52, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12,
+	0x8c, 0x01, 0x0a, 0x15, 0x74, 0x63, 0x70, 0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x61,
+	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0xc9, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x38, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67,
+	0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x63, 0x70, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74,
+	0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x42, 0x1b, 0xa0, 0xda, 0x29, 0x01,
+	0x9a, 0xe3, 0x29, 0x03, 0x74, 0x63, 0x70, 0xfa, 0xd2, 0xe4, 0x93, 0x02, 0x0a, 0x12, 0x08, 0x49,
+	0x4e, 0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c, 0x48, 0x00, 0x52, 0x13, 0x74, 0x63, 0x70, 0x54, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x8c,
+	0x01, 0x0a, 0x15, 0x73, 0x73, 0x68, 0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x61, 0x74,
+	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0xca, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x38, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65,
+	0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x73, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41,
+	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x42, 0x1b, 0xa0, 0xda, 0x29, 0x01, 0x9a,
+	0xe3, 0x29, 0x03, 0x73, 0x73, 0x68, 0xfa, 0xd2, 0xe4, 0x93, 0x02, 0x0a, 0x12, 0x08, 0x49, 0x4e,
+	0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c, 0x48, 0x00, 0x52, 0x13, 0x73, 0x73, 0x68, 0x54, 0x61, 0x72,
+	0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x2f, 0x0a,
+	0x12, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0xac, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x61, 0x75, 0x74, 0x68,
+	0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x07,
+	0x0a, 0x05, 0x61, 0x74, 0x74, 0x72, 0x73, 0x4a, 0x06, 0x08, 0x96, 0x01, 0x10, 0x97, 0x01, 0x4a,
+	0x06, 0x08, 0xb4, 0x01, 0x10, 0xb5, 0x01, 0x4a, 0x06, 0x08, 0xf4, 0x03, 0x10, 0xf5, 0x03, 0x4a,
+	0x06, 0x08, 0xfe, 0x03, 0x10, 0xff, 0x03, 0x4a, 0x04, 0x08, 0x64, 0x10, 0x65, 0x4a, 0x04, 0x08,
+	0x6e, 0x10, 0x6f, 0x52, 0x22, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72,
+	0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x73, 0x52, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f,
+	0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x69, 0x65, 0x73, 0x52, 0x1c, 0x65, 0x67, 0x72, 0x65, 0x73,
+	0x73, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x52, 0x19, 0x65, 0x67, 0x72, 0x65, 0x73, 0x73, 0x5f,
+	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x52, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73,
+	0x52, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x22, 0x87, 0x01, 0x0a, 0x13,
+	0x54, 0x63, 0x70, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
+	0x74, 0x65, 0x73, 0x12, 0x70, 0x0a, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70,
+	0x6f, 0x72, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74,
+	0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x2e, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29,
+	0x26, 0x0a, 0x17, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x64, 0x65,
+	0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x0b, 0x44, 0x65, 0x66, 0x61,
+	0x75, 0x6c, 0x74, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
+	0x5f, 0x70, 0x6f, 0x72, 0x74, 0x22, 0x87, 0x01, 0x0a, 0x13, 0x53, 0x73, 0x68, 0x54, 0x61, 0x72,
 	0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x70, 0x0a,
 	0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0a, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
@@ -1361,99 +1410,91 @@ var file_controller_api_resources_targets_v1_target_proto_rawDesc = []byte{
 	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f,
 	0x70, 0x6f, 0x72, 0x74, 0x12, 0x0b, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x6f, 0x72,
 	0x74, 0x52, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x22,
-	0x87, 0x01, 0x0a, 0x13, 0x53, 0x73, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74, 0x74,
-	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x70, 0x0a, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75,
-	0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e,
+	0x26, 0x0a, 0x0a, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x18, 0x0a,
+	0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x22, 0xed, 0x03, 0x0a, 0x18, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x44, 0x61, 0x74, 0x61, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f,
+	0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x5f, 0x69, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69,
+	0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f,
+	0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f,
+	0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f,
+	0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
 	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x2e, 0xa0, 0xda, 0x29,
-	0x01, 0xc2, 0xdd, 0x29, 0x26, 0x0a, 0x17, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
-	0x73, 0x2e, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x0b,
-	0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x0c, 0x64, 0x65, 0x66,
-	0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x22, 0x26, 0x0a, 0x0a, 0x57, 0x6f, 0x72,
-	0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65,
-	0x73, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73,
-	0x73, 0x22, 0xed, 0x03, 0x0a, 0x18, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74,
-	0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x12, 0x1e,
-	0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x12, 0x1c,
-	0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05,
-	0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70,
-	0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d,
-	0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74,
-	0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d,
-	0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x2a, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x05, 0x52,
-	0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69,
-	0x74, 0x12, 0x20, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x18, 0x78, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
-	0x61, 0x74, 0x65, 0x12, 0x21, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b,
-	0x65, 0x79, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61,
-	0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69,
-	0x64, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x68, 0x6f, 0x73, 0x74, 0x49, 0x64,
-	0x12, 0x1b, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x8d, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x52, 0x0a,
-	0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x96, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74,
-	0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72,
-	0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66,
-	0x6f, 0x22, 0xeb, 0x03, 0x0a, 0x14, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74,
-	0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
-	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x61,
-	0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74,
-	0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70,
-	0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
-	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f,
-	0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x3e, 0x0a,
-	0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
-	0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a,
-	0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
-	0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f,
-	0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x6f,
-	0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73,
-	0x74, 0x5f, 0x69, 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x68, 0x6f, 0x73, 0x74,
-	0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x50, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x30, 0x0a, 0x13, 0x61, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x5a,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64,
-	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x64, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64,
-	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x58, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x61, 0x6c, 0x73, 0x18, 0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x52, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x22,
-	0x54, 0x0a, 0x1a, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77,
-	0x6f, 0x72, 0x64, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x1a, 0x0a,
-	0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73,
-	0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73,
-	0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x8c, 0x01, 0x0a, 0x17, 0x53, 0x73, 0x68, 0x50, 0x72, 0x69,
-	0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
-	0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a,
-	0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x34,
-	0x0a, 0x16, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61,
-	0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14,
-	0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x61, 0x73, 0x73, 0x70, 0x68,
-	0x72, 0x61, 0x73, 0x65, 0x42, 0x50, 0x5a, 0x4e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75,
-	0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x73, 0x2f, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x3b, 0x74,
-	0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x50, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x2a, 0x0a, 0x10, 0x63,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18,
+	0x5a, 0x20, 0x01, 0x28, 0x05, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x20, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x78, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x63, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x21, 0x0a, 0x0b, 0x70, 0x72, 0x69,
+	0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x12, 0x18, 0x0a, 0x07,
+	0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
+	0x68, 0x6f, 0x73, 0x74, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69,
+	0x6e, 0x74, 0x18, 0x8d, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f,
+	0x69, 0x6e, 0x74, 0x12, 0x52, 0x0a, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x6e,
+	0x66, 0x6f, 0x18, 0x96, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e,
+	0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0b, 0x77, 0x6f, 0x72, 0x6b,
+	0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x22, 0xeb, 0x03, 0x0a, 0x14, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64,
+	0x12, 0x1c, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x43,
+	0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63,
+	0x6f, 0x70, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74,
+	0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74,
+	0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x32,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x12, 0x20, 0x0a,
+	0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x3c, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12,
+	0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x30, 0x0a,
+	0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74,
+	0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x61, 0x75, 0x74, 0x68,
+	0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12,
+	0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x64, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x58, 0x0a, 0x0b, 0x63,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x18, 0x6e, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67,
+	0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72,
+	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x73, 0x22, 0x54, 0x0a, 0x1a, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
+	0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x8c, 0x01, 0x0a, 0x17,
+	0x53, 0x73, 0x68, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x43, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e,
+	0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b,
+	0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74,
+	0x65, 0x4b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x16, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f,
+	0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79,
+	0x50, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x42, 0x50, 0x5a, 0x4e, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x73, 0x64, 0x6b, 0x2f,
+	0x70, 0x62, 0x73, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x74, 0x61, 0x72,
+	0x67, 0x65, 0x74, 0x73, 0x3b, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1503,25 +1544,27 @@ var file_controller_api_resources_targets_v1_target_proto_depIdxs = []int32{
 	16, // 10: controller.api.resources.targets.v1.Target.session_max_seconds:type_name -> google.protobuf.UInt32Value
 	17, // 11: controller.api.resources.targets.v1.Target.session_connection_limit:type_name -> google.protobuf.Int32Value
 	14, // 12: controller.api.resources.targets.v1.Target.worker_filter:type_name -> google.protobuf.StringValue
-	1,  // 13: controller.api.resources.targets.v1.Target.application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
-	1,  // 14: controller.api.resources.targets.v1.Target.brokered_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
-	1,  // 15: controller.api.resources.targets.v1.Target.injected_application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
-	12, // 16: controller.api.resources.targets.v1.Target.attributes:type_name -> google.protobuf.Struct
-	5,  // 17: controller.api.resources.targets.v1.Target.tcp_target_attributes:type_name -> controller.api.resources.targets.v1.TcpTargetAttributes
-	6,  // 18: controller.api.resources.targets.v1.Target.ssh_target_attributes:type_name -> controller.api.resources.targets.v1.SshTargetAttributes
-	16, // 19: controller.api.resources.targets.v1.TcpTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
-	16, // 20: controller.api.resources.targets.v1.SshTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
-	13, // 21: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	15, // 22: controller.api.resources.targets.v1.SessionAuthorizationData.created_time:type_name -> google.protobuf.Timestamp
-	7,  // 23: controller.api.resources.targets.v1.SessionAuthorizationData.worker_info:type_name -> controller.api.resources.targets.v1.WorkerInfo
-	13, // 24: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	15, // 25: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp
-	3,  // 26: controller.api.resources.targets.v1.SessionAuthorization.credentials:type_name -> controller.api.resources.targets.v1.SessionCredential
-	27, // [27:27] is the sub-list for method output_type
-	27, // [27:27] is the sub-list for method input_type
-	27, // [27:27] is the sub-list for extension type_name
-	27, // [27:27] is the sub-list for extension extendee
-	0,  // [0:27] is the sub-list for field type_name
+	14, // 13: controller.api.resources.targets.v1.Target.egress_worker_filter:type_name -> google.protobuf.StringValue
+	14, // 14: controller.api.resources.targets.v1.Target.ingress_worker_filter:type_name -> google.protobuf.StringValue
+	1,  // 15: controller.api.resources.targets.v1.Target.application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
+	1,  // 16: controller.api.resources.targets.v1.Target.brokered_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
+	1,  // 17: controller.api.resources.targets.v1.Target.injected_application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
+	12, // 18: controller.api.resources.targets.v1.Target.attributes:type_name -> google.protobuf.Struct
+	5,  // 19: controller.api.resources.targets.v1.Target.tcp_target_attributes:type_name -> controller.api.resources.targets.v1.TcpTargetAttributes
+	6,  // 20: controller.api.resources.targets.v1.Target.ssh_target_attributes:type_name -> controller.api.resources.targets.v1.SshTargetAttributes
+	16, // 21: controller.api.resources.targets.v1.TcpTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
+	16, // 22: controller.api.resources.targets.v1.SshTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
+	13, // 23: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	15, // 24: controller.api.resources.targets.v1.SessionAuthorizationData.created_time:type_name -> google.protobuf.Timestamp
+	7,  // 25: controller.api.resources.targets.v1.SessionAuthorizationData.worker_info:type_name -> controller.api.resources.targets.v1.WorkerInfo
+	13, // 26: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	15, // 27: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp
+	3,  // 28: controller.api.resources.targets.v1.SessionAuthorization.credentials:type_name -> controller.api.resources.targets.v1.SessionCredential
+	29, // [29:29] is the sub-list for method output_type
+	29, // [29:29] is the sub-list for method input_type
+	29, // [29:29] is the sub-list for extension type_name
+	29, // [29:29] is the sub-list for extension extendee
+	0,  // [0:29] is the sub-list for field type_name
 }
 
 func init() { file_controller_api_resources_targets_v1_target_proto_init() }