Merge remote-tracking branch 'origin/byow-attrib-consolidation' into llb-byow

internal/daemon/controller/handlers/targets/target_service.go

@@ -2140,7 +2140,7 @@ type workerList []*servers.Worker
 func (w workerList) addresses() []string {
 	ret := make([]string, 0, len(w))
 	for _, worker := range w {
-		ret = append(ret, worker.CanonicalAddress())
+		ret = append(ret, worker.GetAddress())
 	}
 	return ret
 }
@@ -2149,7 +2149,7 @@ func (w workerList) addresses() []string {
 func (w workerList) workerInfos() []*pb.WorkerInfo {
 	ret := make([]*pb.WorkerInfo, 0, len(w))
 	for _, worker := range w {
-		ret = append(ret, &pb.WorkerInfo{Address: worker.CanonicalAddress()})
+		ret = append(ret, &pb.WorkerInfo{Address: worker.GetAddress()})
 	}
 	return ret
 }
@@ -2159,15 +2159,8 @@ func (w workerList) workerInfos() []*pb.WorkerInfo {
 func (w workerList) filtered(eval *bexpr.Evaluator) (workerList, error) {
 	var ret []*servers.Worker
 	for _, worker := range w {
-
-		// TODO: Decide how we are actually going to filter by name now that
-		//   we are separating reported status name and the resource name.
-		name := worker.GetName()
-		if name == "" {
-			name = worker.GetWorkerReportedName()
-		}
 		filterInput := map[string]interface{}{
-			"name": name,
+			"name": worker.GetName(),
 			"tags": worker.CanonicalTags(),
 		}
 		ok, err := eval.Evaluate(filterInput)

internal/daemon/controller/handlers/targets/target_service_test.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/servers"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/targets"
@@ -32,18 +33,20 @@ func TestWorkerList_Addresses(t *testing.T) {
 }
 
 func TestWorkerList_Filter(t *testing.T) {
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
 	var workers []*servers.Worker
 	for i := 0; i < 5; i++ {
 		switch {
 		case i%2 == 0:
-			workers = append(workers, servers.NewWorker(scope.Global.String(),
+			workers = append(workers, servers.TestKmsWorker(t, conn, wrapper,
 				servers.WithName(fmt.Sprintf("test_worker_%d", i)),
 				servers.WithWorkerTags(&servers.Tag{
 					Key:   fmt.Sprintf("key%d", i),
 					Value: fmt.Sprintf("value%d", i),
 				})))
 		default:
-			workers = append(workers, servers.NewWorkerForStatus(scope.Global.String(),
+			workers = append(workers, servers.TestPkiWorker(t, conn, wrapper,
 				servers.WithName(fmt.Sprintf("test_worker_%d", i)),
 				servers.WithWorkerTags(&servers.Tag{
 					Key:   "key",

internal/daemon/controller/handlers/targets/tcp/target_service_test.go

@@ -2784,7 +2784,7 @@ func TestAuthorizeSession(t *testing.T) {
 			require.NoError(t, err)
 
 			// Tell our DB that there is a worker ready to serve the data
-			servers.TestWorker(t, conn, wrapper)
+			servers.TestKmsWorker(t, conn, wrapper)
 
 			asRes1, err := s.AuthorizeSession(ctx, &pbs.AuthorizeSessionRequest{
 				Id: tar.GetPublicId(),
@@ -3062,7 +3062,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 			require.NoError(t, err)
 
 			// Tell our DB that there is a worker ready to serve the data
-			servers.TestWorker(t, conn, wrapper)
+			servers.TestKmsWorker(t, conn, wrapper)
 
 			asRes, err := s.AuthorizeSession(ctx, &pbs.AuthorizeSessionRequest{
 				Id: tar.GetPublicId(),

internal/daemon/controller/handlers/workers/worker_service.go

@@ -3,6 +3,7 @@ package workers
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
@@ -19,6 +20,7 @@ import (
 	"github.com/hashicorp/boundary/internal/types/resource"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/workers"
+	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/nodeenrollment/types"
 	"github.com/mr-tron/base58"
 	"google.golang.org/grpc/codes"
@@ -27,6 +29,11 @@ import (
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
+const (
+	PkiWorkerType = "pki"
+	KmsWorkerType = "kms"
+)
+
 var (
 	maskManager handlers.MaskManager
 
@@ -330,7 +337,6 @@ func (s Service) createInRepo(ctx context.Context, worker *pb.Worker, creds *typ
 		worker.GetScopeId(),
 		servers.WithName(worker.GetName().GetValue()),
 		servers.WithDescription(worker.GetDescription().GetValue()),
-		servers.WithAddress(worker.GetAddress().GetValue()),
 	)
 	retWorker, err := repo.CreateWorker(ctx, newWorker, servers.WithFetchNodeCredentialsRequest(creds))
 	if err != nil {
@@ -364,9 +370,6 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []st
 	if name := item.GetName(); name != nil {
 		opts = append(opts, servers.WithName(name.GetValue()))
 	}
-	if addr := item.GetAddress(); addr != nil {
-		opts = append(opts, servers.WithAddress(addr.GetValue()))
-	}
 	w := servers.NewWorker(scopeId, opts...)
 	w.PublicId = id
 	dbMask := maskManager.Translate(mask)
@@ -452,12 +455,22 @@ func toProto(ctx context.Context, in *servers.Worker, opt ...handlers.Option) (*
 	}
 	if outputFields.Has(globals.AuthorizedActionsField) {
 		out.AuthorizedActions = opts.WithAuthorizedActions
+		if in.Type == KmsWorkerType && out.AuthorizedActions != nil {
+			// KMS workers cannot be updated through the API
+			allActions := out.AuthorizedActions
+			out.AuthorizedActions = make([]string, 0, len(allActions))
+			for _, act := range allActions {
+				if act != action.Update.String() {
+					out.AuthorizedActions = append(out.AuthorizedActions, act)
+				}
+			}
+		}
 	}
 	if outputFields.Has(globals.AddressField) && in.GetAddress() != "" {
-		out.Address = wrapperspb.String(in.GetAddress())
+		out.Address = in.GetAddress()
 	}
-	if outputFields.Has(globals.CanonicalAddressField) {
-		out.CanonicalAddress = in.CanonicalAddress()
+	if outputFields.Has(globals.TypeField) && in.GetType() != "" {
+		out.Type = in.GetType()
 	}
 	if outputFields.Has(globals.LastStatusTimeField) {
 		out.LastStatusTime = in.GetLastStatusTime().GetTimestamp()
@@ -465,6 +478,13 @@ func toProto(ctx context.Context, in *servers.Worker, opt ...handlers.Option) (*
 	if outputFields.Has(globals.ActiveConnectionCountField) {
 		out.ActiveConnectionCount = &wrapperspb.UInt32Value{Value: in.ActiveConnectionCount()}
 	}
+	if outputFields.Has(globals.ConfigTagsField) && len(in.GetConfigTags()) > 0 {
+		var err error
+		out.ConfigTags, err = tagsToMapProto(in.GetConfigTags())
+		if err != nil {
+			return nil, errors.Wrap(ctx, err, op, errors.WithMsg("error preparing config tags proto"))
+		}
+	}
 	if outputFields.Has(globals.CanonicalTagsField) && len(in.CanonicalTags()) > 0 {
 		var err error
 		out.CanonicalTags, err = tagsToMapProto(in.CanonicalTags())
@@ -472,31 +492,6 @@ func toProto(ctx context.Context, in *servers.Worker, opt ...handlers.Option) (*
 			return nil, errors.Wrap(ctx, err, op, errors.WithMsg("error preparing canonical tags proto"))
 		}
 	}
-	if outputFields.Has(globals.TagsField) && len(in.GetApiTags()) > 0 {
-		var err error
-		out.Tags, err = tagsToMapProto(in.GetApiTags())
-		if err != nil {
-			return nil, errors.Wrap(ctx, err, op, errors.WithMsg("error preparing api tags proto"))
-		}
-	}
-	if outputFields.Has(globals.ConfigurationField) {
-		if in.GetWorkerReportedAddress() != "" ||
-			in.GetWorkerReportedName() != "" ||
-			len(in.GetConfigTags()) > 0 {
-			out.WorkerProvidedConfiguration = &pb.WorkerProvidedConfiguration{}
-		}
-		if len(in.GetConfigTags()) > 0 {
-			var err error
-			out.GetWorkerProvidedConfiguration().Tags, err = tagsToMapProto(in.GetConfigTags())
-			if err != nil {
-				return nil, errors.Wrap(ctx, err, op, errors.WithMsg("error preparing config tags proto"))
-			}
-		}
-		if out.WorkerProvidedConfiguration != nil {
-			out.GetWorkerProvidedConfiguration().Address = in.GetWorkerReportedAddress()
-			out.GetWorkerProvidedConfiguration().Name = in.GetWorkerReportedName()
-		}
-	}
 
 	return &out, nil
 }
@@ -551,17 +546,25 @@ func validateDeleteRequest(req *pbs.DeleteWorkerRequest) error {
 func validateUpdateRequest(req *pbs.UpdateWorkerRequest) error {
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
-		if req.GetItem().GetWorkerProvidedConfiguration() != nil {
-			badFields[globals.ConfigurationField] = "This is a read only field."
-		}
-		if req.GetItem().GetCanonicalAddress() != "" {
-			badFields[globals.CanonicalAddressField] = "This is a read only field."
+		if req.GetItem().GetAddress() != "" {
+			badFields[globals.AddressField] = "This is a read only field."
 		}
 		if req.GetItem().GetCanonicalTags() != nil {
 			badFields[globals.CanonicalAddressField] = "This is a read only field."
 		}
-		if req.GetItem().GetTags() != nil {
-			badFields[globals.TagsField] = "These values cannot be updated in this type of request."
+		if req.GetItem().GetConfigTags() != nil {
+			badFields[globals.TagsField] = "This is a read only field."
+		}
+		nameString := req.GetItem().GetName().String()
+		if !strutil.Printable(nameString) {
+			badFields[globals.NameField] = "Contains non-printable characters"
+		}
+		if strings.ToLower(nameString) != nameString {
+			badFields[globals.NameField] = "Must be all lowercase."
+		}
+		descriptionString := req.GetItem().GetDescription().String()
+		if !strutil.Printable(descriptionString) {
+			badFields[globals.DescriptionField] = "Contains non-printable characters."
 		}
 		return badFields
 	}, servers.WorkerPrefix)
@@ -583,24 +586,32 @@ func validateCreateRequest(req *pbs.CreateWorkerLedRequest) error {
 		if req.GetItem().WorkerGeneratedAuthToken == nil {
 			badFields[globals.WorkerGeneratedAuthTokenField] = cannotBeEmptyMsg
 		}
-		if req.GetItem().CanonicalAddress != "" {
+		if req.GetItem().Address != "" {
 			badFields[globals.CanonicalAddressField] = readOnlyFieldMsg
 		}
-		if req.GetItem().Tags != nil {
-			badFields[globals.TagsField] = readOnlyFieldMsg
-		}
 		if req.GetItem().CanonicalTags != nil {
 			badFields[globals.CanonicalTagsField] = readOnlyFieldMsg
 		}
+		if req.GetItem().ConfigTags != nil {
+			badFields[globals.ConfigTagsField] = readOnlyFieldMsg
+		}
 		if req.GetItem().LastStatusTime != nil {
 			badFields[globals.LastStatusTimeField] = readOnlyFieldMsg
 		}
-		if req.GetItem().WorkerProvidedConfiguration != nil {
-			badFields[globals.WorkerProvidedConfigurationField] = readOnlyFieldMsg
-		}
 		if req.GetItem().AuthorizedActions != nil {
 			badFields[globals.AuthorizedActionsField] = readOnlyFieldMsg
 		}
+		nameString := req.GetItem().GetName().String()
+		if !strutil.Printable(nameString) {
+			badFields[globals.NameField] = "Name contains non-printable characters."
+		}
+		if strings.ToLower(nameString) != nameString {
+			badFields[globals.NameField] = "Name must be all lowercase."
+		}
+		descriptionString := req.GetItem().GetDescription().String()
+		if !strutil.Printable(descriptionString) {
+			badFields[globals.DescriptionField] = "Description contains non-printable characters."
+		}
 		return badFields
 	})
 }

internal/daemon/controller/handlers/workers/worker_service_test.go

@@ -16,10 +16,12 @@ import (
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/servers"
+	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/workers"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/workers"
+	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/nodeenrollment/rotation"
 	"github.com/hashicorp/nodeenrollment/storage/file"
 	"github.com/hashicorp/nodeenrollment/types"
@@ -63,51 +65,73 @@ func TestGet(t *testing.T) {
 		return repo, nil
 	}
 
-	worker := servers.TestWorker(t, conn, wrap,
-		servers.WithName("test worker names"),
-		servers.WithDescription("test worker description"),
-		servers.WithAddress("test worker address"),
+	kmsWorker := servers.TestKmsWorker(t, conn, wrap,
+		servers.WithName("test kms worker names"),
+		servers.WithDescription("test kms worker description"),
+		servers.WithAddress("test kms worker address"),
 		servers.WithWorkerTags(&servers.Tag{Key: "key", Value: "val"}))
+
+	kmsAuthzActions := make([]string, len(testAuthorizedActions))
+	copy(kmsAuthzActions, testAuthorizedActions)
+
+	wantKmsWorker := &pb.Worker{
+		Id:                kmsWorker.GetPublicId(),
+		ScopeId:           kmsWorker.GetScopeId(),
+		Scope:             &scopes.ScopeInfo{Id: kmsWorker.GetScopeId(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
+		CreatedTime:       kmsWorker.CreateTime.GetTimestamp(),
+		UpdatedTime:       kmsWorker.UpdateTime.GetTimestamp(),
+		Version:           kmsWorker.GetVersion(),
+		Name:              wrapperspb.String(kmsWorker.GetName()),
+		Description:       wrapperspb.String(kmsWorker.GetDescription()),
+		Address:           kmsWorker.GetAddress(),
+		AuthorizedActions: strutil.StrListDelete(kmsAuthzActions, action.Update.String()),
+		LastStatusTime:    kmsWorker.GetLastStatusTime().GetTimestamp(),
+		CanonicalTags: map[string]*structpb.ListValue{
+			"key": structListValue(t, "val"),
+		},
+		ConfigTags: map[string]*structpb.ListValue{
+			"key": structListValue(t, "val"),
+		},
+		Type: KmsWorkerType,
+	}
+
+	var pkiWorkerKeyId string
+	pkiWorker := servers.TestPkiWorker(t, conn, wrap,
+		servers.WithName("test pki worker names"),
+		servers.WithDescription("test pki worker description"),
+		servers.WithTestPkiWorkerAuthorizedKeyId(&pkiWorkerKeyId))
 	// Add config tags to the created worker
-	worker, err = repo.UpsertWorkerStatus(context.Background(),
-		servers.NewWorkerForStatus(worker.GetScopeId(),
-			servers.WithName(worker.GetWorkerReportedName()),
-			servers.WithAddress(worker.GetWorkerReportedAddress()),
+	pkiWorker, err = repo.UpsertWorkerStatus(context.Background(),
+		servers.NewWorker(pkiWorker.GetScopeId(),
+			servers.WithAddress("test kms worker address"),
 			servers.WithWorkerTags(&servers.Tag{
 				Key:   "config",
 				Value: "test",
 			})),
 		servers.WithUpdateTags(true),
-		servers.WithPublicId(worker.GetPublicId()))
+		servers.WithPublicId(pkiWorker.GetPublicId()),
+		servers.WithKeyId(pkiWorkerKeyId))
 	require.NoError(t, err)
 
-	wantWorker := &pb.Worker{
-		Id:                worker.GetPublicId(),
-		ScopeId:           worker.GetScopeId(),
-		Scope:             &scopes.ScopeInfo{Id: worker.GetScopeId(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
-		CreatedTime:       worker.CreateTime.GetTimestamp(),
-		UpdatedTime:       worker.UpdateTime.GetTimestamp(),
-		Version:           worker.GetVersion(),
-		Name:              wrapperspb.String(worker.GetName()),
-		Description:       wrapperspb.String(worker.GetDescription()),
-		Address:           wrapperspb.String(worker.GetAddress()),
+	wantPkiWorker := &pb.Worker{
+		Id:                pkiWorker.GetPublicId(),
+		ScopeId:           pkiWorker.GetScopeId(),
+		Scope:             &scopes.ScopeInfo{Id: pkiWorker.GetScopeId(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
+		CreatedTime:       pkiWorker.CreateTime.GetTimestamp(),
+		UpdatedTime:       pkiWorker.UpdateTime.GetTimestamp(),
+		Version:           pkiWorker.GetVersion(),
+		Name:              wrapperspb.String(pkiWorker.GetName()),
+		Description:       wrapperspb.String(pkiWorker.GetDescription()),
+		Address:           pkiWorker.GetAddress(),
 		AuthorizedActions: testAuthorizedActions,
-		CanonicalAddress:  worker.CanonicalAddress(),
-		LastStatusTime:    worker.GetLastStatusTime().GetTimestamp(),
+		LastStatusTime:    pkiWorker.GetLastStatusTime().GetTimestamp(),
 		CanonicalTags: map[string]*structpb.ListValue{
-			"key":    structListValue(t, "val"),
 			"config": structListValue(t, "test"),
 		},
-		Tags: map[string]*structpb.ListValue{
-			"key": structListValue(t, "val"),
-		},
-		WorkerProvidedConfiguration: &pb.WorkerProvidedConfiguration{
-			Address: worker.GetWorkerReportedAddress(),
-			Name:    worker.GetWorkerReportedName(),
-			Tags: map[string]*structpb.ListValue{
-				"config": structListValue(t, "test"),
-			},
+		ConfigTags: map[string]*structpb.ListValue{
+			"config": structListValue(t, "test"),
 		},
+		Type: PkiWorkerType,
 	}
 
 	cases := []struct {
@@ -118,10 +142,16 @@ func TestGet(t *testing.T) {
 		err     error
 	}{
 		{
-			name:    "Get an Existing Worker",
-			scopeId: worker.GetScopeId(),
-			req:     &pbs.GetWorkerRequest{Id: worker.GetPublicId()},
-			res:     &pbs.GetWorkerResponse{Item: wantWorker},
+			name:    "Get an Existing KMS Worker",
+			scopeId: kmsWorker.GetScopeId(),
+			req:     &pbs.GetWorkerRequest{Id: kmsWorker.GetPublicId()},
+			res:     &pbs.GetWorkerResponse{Item: wantKmsWorker},
+		},
+		{
+			name:    "Get an Existing PKI Worker",
+			scopeId: pkiWorker.GetScopeId(),
+			req:     &pbs.GetWorkerRequest{Id: pkiWorker.GetPublicId()},
+			res:     &pbs.GetWorkerResponse{Item: wantPkiWorker},
 		},
 		{
 			name: "Get a non-existent Worker",
@@ -172,10 +202,30 @@ func TestList(t *testing.T) {
 		return servers.NewRepository(rw, rw, kms)
 	}
 
-	var wantWorkers []*pb.Worker
+	var wantKmsWorkers []*pb.Worker
 	for i := 0; i < 10; i++ {
-		w := servers.TestWorker(t, conn, wrap, servers.WithName(fmt.Sprintf("worker%d", i)))
-		wantWorkers = append(wantWorkers, &pb.Worker{
+		w := servers.TestKmsWorker(t, conn, wrap, servers.WithName(fmt.Sprintf("kms-worker%d", i)))
+		kmsAuthzActions := make([]string, len(testAuthorizedActions))
+		copy(kmsAuthzActions, testAuthorizedActions)
+		wantKmsWorkers = append(wantKmsWorkers, &pb.Worker{
+			Id:                w.GetPublicId(),
+			ScopeId:           w.GetScopeId(),
+			Scope:             &scopes.ScopeInfo{Id: w.GetScopeId(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
+			CreatedTime:       w.CreateTime.GetTimestamp(),
+			UpdatedTime:       w.UpdateTime.GetTimestamp(),
+			Version:           w.GetVersion(),
+			Name:              wrapperspb.String(w.GetName()),
+			AuthorizedActions: strutil.StrListDelete(kmsAuthzActions, action.Update.String()),
+			Address:           w.GetAddress(),
+			Type:              KmsWorkerType,
+			LastStatusTime:    w.GetLastStatusTime().GetTimestamp(),
+		})
+	}
+
+	var wantPkiWorkers []*pb.Worker
+	for i := 0; i < 10; i++ {
+		w := servers.TestPkiWorker(t, conn, wrap, servers.WithName(fmt.Sprintf("pki-worker%d", i)))
+		wantPkiWorkers = append(wantPkiWorkers, &pb.Worker{
 			Id:                w.GetPublicId(),
 			ScopeId:           w.GetScopeId(),
 			Scope:             &scopes.ScopeInfo{Id: w.GetScopeId(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
@@ -184,12 +234,9 @@ func TestList(t *testing.T) {
 			Version:           w.GetVersion(),
 			Name:              wrapperspb.String(w.GetName()),
 			AuthorizedActions: testAuthorizedActions,
-			CanonicalAddress:  w.CanonicalAddress(),
+			Address:           w.GetAddress(),
+			Type:              PkiWorkerType,
 			LastStatusTime:    w.GetLastStatusTime().GetTimestamp(),
-			WorkerProvidedConfiguration: &pb.WorkerProvidedConfiguration{
-				Address: w.GetWorkerReportedAddress(),
-				Name:    w.GetWorkerReportedName(),
-			},
 		})
 	}
 
@@ -202,27 +249,27 @@ func TestList(t *testing.T) {
 		{
 			name: "List All Workers",
 			req:  &pbs.ListWorkersRequest{ScopeId: scope.Global.String()},
-			res:  &pbs.ListWorkersResponse{Items: wantWorkers},
+			res:  &pbs.ListWorkersResponse{Items: append(wantKmsWorkers, wantPkiWorkers...)},
 		},
 		{
 			name: "List global workers recursively",
 			req:  &pbs.ListWorkersRequest{ScopeId: "global", Recursive: true},
 			res: &pbs.ListWorkersResponse{
-				Items: wantWorkers,
+				Items: append(wantKmsWorkers, wantPkiWorkers...),
 			},
 		},
 		{
-			name: "Filter to a single workers",
-			req:  &pbs.ListWorkersRequest{ScopeId: "global", Recursive: true, Filter: `"/item/name"=="worker2"`},
+			name: "Filter to a single worker of each type",
+			req:  &pbs.ListWorkersRequest{ScopeId: "global", Recursive: true, Filter: `"/item/name"=="kms-worker2" or "/item/name"=="pki-worker2"`},
 			res: &pbs.ListWorkersResponse{
-				Items: wantWorkers[2:3],
+				Items: []*pb.Worker{wantKmsWorkers[2], wantPkiWorkers[2]},
 			},
 		},
 		{
-			name: "Filter to 2 workers",
-			req:  &pbs.ListWorkersRequest{ScopeId: "global", Recursive: true, Filter: `"/item/name" matches "worker[23]"`},
+			name: "Filter to 2 workers of each type",
+			req:  &pbs.ListWorkersRequest{ScopeId: "global", Recursive: true, Filter: `"/item/name" matches "kms-worker[23]" or "/item/name" matches "pki-worker[23]"`},
 			res: &pbs.ListWorkersResponse{
-				Items: wantWorkers[2:4],
+				Items: []*pb.Worker{wantKmsWorkers[2], wantKmsWorkers[3], wantPkiWorkers[2], wantPkiWorkers[3]},
 			},
 		},
 		{
@@ -253,6 +300,10 @@ func TestList(t *testing.T) {
 			sort.Slice(got.Items, func(i, j int) bool {
 				return got.Items[i].GetName().GetValue() < got.Items[j].GetName().GetValue()
 			})
+			require.NoError(gErr)
+			sort.Slice(tc.res.Items, func(i, j int) bool {
+				return tc.res.Items[i].GetName().GetValue() < tc.res.Items[j].GetName().GetValue()
+			})
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListWorkers(%q) got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res)
 
 			// Test the anon case
@@ -285,7 +336,7 @@ func TestDelete(t *testing.T) {
 	s, err := NewService(ctx, repoFn, iamRepoFn)
 	require.NoError(t, err, "Error when getting new worker service.")
 
-	w := servers.TestWorker(t, conn, wrap)
+	w := servers.TestKmsWorker(t, conn, wrap)
 
 	cases := []struct {
 		name    string
@@ -349,16 +400,15 @@ func TestUpdate(t *testing.T) {
 		return repo, nil
 	}
 
-	wkr := servers.TestWorker(t, conn, wrapper,
+	wkr := servers.TestPkiWorker(t, conn, wrapper,
 		servers.WithName("default"),
-		servers.WithDescription("default"),
-		servers.WithAddress("default"))
+		servers.WithDescription("default"))
 
 	version := wkr.GetVersion()
 
 	resetWorker := func() {
 		version++
-		_, _, err = repo.UpdateWorker(context.Background(), wkr, version, []string{"Name", "Description", "Address"})
+		_, _, err = repo.UpdateWorker(context.Background(), wkr, version, []string{"Name", "Description"})
 		require.NoError(t, err, "Failed to reset worker.")
 		version++
 	}
@@ -370,10 +420,6 @@ func TestUpdate(t *testing.T) {
 	workerService, err := NewService(ctx, repoFn, iamRepoFn)
 	require.NoError(t, err)
 	expectedScope := &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"}
-	expectedConfig := &pb.WorkerProvidedConfiguration{
-		Address: wkr.GetWorkerReportedAddress(),
-		Name:    wkr.GetWorkerReportedName(),
-	}
 
 	cases := []struct {
 		name string
@@ -385,27 +431,24 @@ func TestUpdate(t *testing.T) {
 			name: "Update an Existing Worker",
 			req: &pbs.UpdateWorkerRequest{
 				UpdateMask: &field_mask.FieldMask{
-					Paths: []string{"name", "description", "address"},
+					Paths: []string{"name", "description"},
 				},
 				Item: &pb.Worker{
 					Name:        wrapperspb.String("name"),
 					Description: wrapperspb.String("desc"),
-					Address:     wrapperspb.String("address"),
 				},
 			},
 			res: &pbs.UpdateWorkerResponse{
 				Item: &pb.Worker{
-					Id:                          wkr.GetPublicId(),
-					ScopeId:                     wkr.GetScopeId(),
-					Scope:                       expectedScope,
-					Name:                        wrapperspb.String("name"),
-					Description:                 wrapperspb.String("desc"),
-					Address:                     wrapperspb.String("address"),
-					CanonicalAddress:            "address",
-					CreatedTime:                 wkr.GetCreateTime().GetTimestamp(),
-					LastStatusTime:              wkr.GetLastStatusTime().GetTimestamp(),
-					WorkerProvidedConfiguration: expectedConfig,
-					AuthorizedActions:           testAuthorizedActions,
+					Id:                wkr.GetPublicId(),
+					ScopeId:           wkr.GetScopeId(),
+					Scope:             expectedScope,
+					Name:              wrapperspb.String("name"),
+					Description:       wrapperspb.String("desc"),
+					CreatedTime:       wkr.GetCreateTime().GetTimestamp(),
+					LastStatusTime:    wkr.GetLastStatusTime().GetTimestamp(),
+					AuthorizedActions: testAuthorizedActions,
+					Type:              PkiWorkerType,
 				},
 			},
 		},
@@ -422,20 +465,30 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateWorkerResponse{
 				Item: &pb.Worker{
-					Id:                          wkr.GetPublicId(),
-					ScopeId:                     wkr.GetScopeId(),
-					Scope:                       expectedScope,
-					Name:                        wrapperspb.String("name"),
-					Description:                 wrapperspb.String("desc"),
-					Address:                     wrapperspb.String("default"),
-					CanonicalAddress:            "default",
-					CreatedTime:                 wkr.GetCreateTime().GetTimestamp(),
-					LastStatusTime:              wkr.GetLastStatusTime().GetTimestamp(),
-					WorkerProvidedConfiguration: expectedConfig,
-					AuthorizedActions:           testAuthorizedActions,
+					Id:                wkr.GetPublicId(),
+					ScopeId:           wkr.GetScopeId(),
+					Scope:             expectedScope,
+					Name:              wrapperspb.String("name"),
+					Description:       wrapperspb.String("desc"),
+					CreatedTime:       wkr.GetCreateTime().GetTimestamp(),
+					LastStatusTime:    wkr.GetLastStatusTime().GetTimestamp(),
+					AuthorizedActions: testAuthorizedActions,
+					Type:              PkiWorkerType,
 				},
 			},
 		},
+		{
+			name: "cant update address",
+			req: &pbs.UpdateWorkerRequest{
+				UpdateMask: &field_mask.FieldMask{
+					Paths: []string{"address"},
+				},
+				Item: &pb.Worker{
+					Address: "updated",
+				},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
 		{
 			name: "No Update Mask",
 			req: &pbs.UpdateWorkerRequest{
@@ -457,14 +510,6 @@ func TestUpdate(t *testing.T) {
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
-		{
-			name: "Update port to 0",
-			req: &pbs.UpdateWorkerRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"default_port"}},
-				Item:       &pb.Worker{},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
 		{
 			name: "Only non-existant paths in Mask",
 			req: &pbs.UpdateWorkerRequest{
@@ -488,16 +533,14 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateWorkerResponse{
 				Item: &pb.Worker{
-					Id:                          wkr.GetPublicId(),
-					ScopeId:                     wkr.GetScopeId(),
-					Scope:                       expectedScope,
-					Description:                 wrapperspb.String("default"),
-					Address:                     wrapperspb.String("default"),
-					CanonicalAddress:            "default",
-					CreatedTime:                 wkr.GetCreateTime().GetTimestamp(),
-					LastStatusTime:              wkr.GetLastStatusTime().GetTimestamp(),
-					WorkerProvidedConfiguration: expectedConfig,
-					AuthorizedActions:           testAuthorizedActions,
+					Id:                wkr.GetPublicId(),
+					ScopeId:           wkr.GetScopeId(),
+					Scope:             expectedScope,
+					Description:       wrapperspb.String("default"),
+					CreatedTime:       wkr.GetCreateTime().GetTimestamp(),
+					LastStatusTime:    wkr.GetLastStatusTime().GetTimestamp(),
+					AuthorizedActions: testAuthorizedActions,
+					Type:              PkiWorkerType,
 				},
 			},
 		},
@@ -513,16 +556,14 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateWorkerResponse{
 				Item: &pb.Worker{
-					Id:                          wkr.GetPublicId(),
-					ScopeId:                     wkr.GetScopeId(),
-					Scope:                       expectedScope,
-					Name:                        wrapperspb.String("default"),
-					Address:                     wrapperspb.String("default"),
-					CanonicalAddress:            "default",
-					CreatedTime:                 wkr.GetCreateTime().GetTimestamp(),
-					LastStatusTime:              wkr.GetLastStatusTime().GetTimestamp(),
-					WorkerProvidedConfiguration: expectedConfig,
-					AuthorizedActions:           testAuthorizedActions,
+					Id:                wkr.GetPublicId(),
+					ScopeId:           wkr.GetScopeId(),
+					Scope:             expectedScope,
+					Name:              wrapperspb.String("default"),
+					CreatedTime:       wkr.GetCreateTime().GetTimestamp(),
+					LastStatusTime:    wkr.GetLastStatusTime().GetTimestamp(),
+					AuthorizedActions: testAuthorizedActions,
+					Type:              PkiWorkerType,
 				},
 			},
 		},
@@ -539,17 +580,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateWorkerResponse{
 				Item: &pb.Worker{
-					Id:                          wkr.GetPublicId(),
-					ScopeId:                     wkr.GetScopeId(),
-					Scope:                       expectedScope,
-					Name:                        wrapperspb.String("updated"),
-					Description:                 wrapperspb.String("default"),
-					Address:                     wrapperspb.String("default"),
-					CanonicalAddress:            "default",
-					CreatedTime:                 wkr.GetCreateTime().GetTimestamp(),
-					LastStatusTime:              wkr.GetLastStatusTime().GetTimestamp(),
-					WorkerProvidedConfiguration: expectedConfig,
-					AuthorizedActions:           testAuthorizedActions,
+					Id:                wkr.GetPublicId(),
+					ScopeId:           wkr.GetScopeId(),
+					Scope:             expectedScope,
+					Name:              wrapperspb.String("updated"),
+					Description:       wrapperspb.String("default"),
+					CreatedTime:       wkr.GetCreateTime().GetTimestamp(),
+					LastStatusTime:    wkr.GetLastStatusTime().GetTimestamp(),
+					AuthorizedActions: testAuthorizedActions,
+					Type:              PkiWorkerType,
 				},
 			},
 		},
@@ -566,17 +605,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateWorkerResponse{
 				Item: &pb.Worker{
-					Id:                          wkr.GetPublicId(),
-					ScopeId:                     wkr.GetScopeId(),
-					Scope:                       expectedScope,
-					Name:                        wrapperspb.String("default"),
-					Description:                 wrapperspb.String("notignored"),
-					Address:                     wrapperspb.String("default"),
-					CanonicalAddress:            "default",
-					CreatedTime:                 wkr.GetCreateTime().GetTimestamp(),
-					LastStatusTime:              wkr.GetLastStatusTime().GetTimestamp(),
-					WorkerProvidedConfiguration: expectedConfig,
-					AuthorizedActions:           testAuthorizedActions,
+					Id:                wkr.GetPublicId(),
+					ScopeId:           wkr.GetScopeId(),
+					Scope:             expectedScope,
+					Name:              wrapperspb.String("default"),
+					Description:       wrapperspb.String("notignored"),
+					CreatedTime:       wkr.GetCreateTime().GetTimestamp(),
+					LastStatusTime:    wkr.GetLastStatusTime().GetTimestamp(),
+					AuthorizedActions: testAuthorizedActions,
+					Type:              PkiWorkerType,
 				},
 			},
 		},
@@ -593,38 +630,6 @@ func TestUpdate(t *testing.T) {
 			},
 			err: handlers.ApiErrorWithCode(codes.NotFound),
 		},
-		{
-			name: "Cant change Worker Defined Name",
-			req: &pbs.UpdateWorkerRequest{
-				Id: wkr.GetPublicId(),
-				UpdateMask: &field_mask.FieldMask{
-					Paths: []string{"worker_provided_configuration.name"},
-				},
-				Item: &pb.Worker{
-					WorkerProvidedConfiguration: &pb.WorkerProvidedConfiguration{
-						Name: "name",
-					},
-				},
-			},
-			res: nil,
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-		{
-			name: "Cant change Worker Defined Address",
-			req: &pbs.UpdateWorkerRequest{
-				Id: wkr.GetPublicId(),
-				UpdateMask: &field_mask.FieldMask{
-					Paths: []string{"worker_provided_configuration.address"},
-				},
-				Item: &pb.Worker{
-					WorkerProvidedConfiguration: &pb.WorkerProvidedConfiguration{
-						Address: "address",
-					},
-				},
-			},
-			res: nil,
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
 		{
 			name: "Cant change Id",
 			req: &pbs.UpdateWorkerRequest{
@@ -672,7 +677,7 @@ func TestUpdate(t *testing.T) {
 					Paths: []string{"tags"},
 				},
 				Item: &pb.Worker{
-					Tags: map[string]*structpb.ListValue{
+					ConfigTags: map[string]*structpb.ListValue{
 						"foo": structListValue(t, "bar"),
 					},
 				},
@@ -696,13 +701,52 @@ func TestUpdate(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "Cant specify canonical address",
+			name: "Cant specify address",
 			req: &pbs.UpdateWorkerRequest{
 				UpdateMask: &field_mask.FieldMask{
-					Paths: []string{"canonical_address"},
+					Paths: []string{globals.AddressField},
 				},
 				Item: &pb.Worker{
-					CanonicalAddress: "should_fail",
+					Address: "should_fail",
+				},
+			},
+			res: nil,
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Invalid name- uppercase",
+			req: &pbs.UpdateWorkerRequest{
+				UpdateMask: &field_mask.FieldMask{
+					Paths: []string{"name", "description", "address"},
+				},
+				Item: &pb.Worker{
+					Name: wrapperspb.String("BADNAME"),
+				},
+			},
+			res: nil,
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Invalid name- non-printable",
+			req: &pbs.UpdateWorkerRequest{
+				UpdateMask: &field_mask.FieldMask{
+					Paths: []string{"name", "description", "address"},
+				},
+				Item: &pb.Worker{
+					Name: wrapperspb.String("\x00"),
+				},
+			},
+			res: nil,
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Invalid description- nonprintable",
+			req: &pbs.UpdateWorkerRequest{
+				UpdateMask: &field_mask.FieldMask{
+					Paths: []string{"name", "description", "address"},
+				},
+				Item: &pb.Worker{
+					Description: wrapperspb.String("\x00"),
 				},
 			},
 			res: nil,
@@ -743,6 +787,85 @@ func TestUpdate(t *testing.T) {
 	}
 }
 
+func TestUpdate_KMS(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	kms := kms.TestKms(t, conn, wrapper)
+	ctx := context.Background()
+	rw := db.New(conn)
+
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+	repo, err := servers.NewRepository(rw, rw, kms)
+	require.NoError(t, err)
+	repoFn := func() (*servers.Repository, error) {
+		return repo, nil
+	}
+
+	wkr := servers.TestKmsWorker(t, conn, wrapper,
+		servers.WithName("default"),
+		servers.WithDescription("default"))
+
+	toMerge := &pbs.UpdateWorkerRequest{
+		Id: wkr.GetPublicId(),
+	}
+	workerService, err := NewService(ctx, repoFn, iamRepoFn)
+	require.NoError(t, err)
+
+	cases := []struct {
+		name string
+		req  *pbs.UpdateWorkerRequest
+		res  *pbs.UpdateWorkerResponse
+		err  error
+	}{
+		{
+			name: "Cant set name",
+			req: &pbs.UpdateWorkerRequest{
+				UpdateMask: &field_mask.FieldMask{
+					Paths: []string{"name"},
+				},
+				Item: &pb.Worker{
+					Name: wrapperspb.String("name"),
+				},
+			},
+		},
+		{
+			name: "Cant set description",
+			req: &pbs.UpdateWorkerRequest{
+				UpdateMask: &field_mask.FieldMask{
+					Paths: []string{"description"},
+				},
+				Item: &pb.Worker{
+					Description: wrapperspb.String("description"),
+				},
+			},
+		},
+		{
+			name: "Cant set address",
+			req: &pbs.UpdateWorkerRequest{
+				UpdateMask: &field_mask.FieldMask{
+					Paths: []string{"address"},
+				},
+				Item: &pb.Worker{
+					Address: "address",
+				},
+			},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := proto.Clone(toMerge).(*pbs.UpdateWorkerRequest)
+			proto.Merge(req, tc.req)
+			got, gErr := workerService.UpdateWorker(auth.DisabledAuthTestContext(iamRepoFn, scope.Global.String()), req)
+			assert.Error(t, gErr)
+			assert.Nil(t, got)
+		})
+	}
+}
+
 func TestUpdate_BadVersion(t *testing.T) {
 	t.Parallel()
 	conn, _ := db.TestSetup(t, "postgres")
@@ -767,7 +890,7 @@ func TestUpdate_BadVersion(t *testing.T) {
 	workerService, err := NewService(ctx, repoFn, iamRepoFn)
 	require.NoError(t, err, "Failed to create a new host set service.")
 
-	wkr := servers.TestWorker(t, conn, wrapper)
+	wkr := servers.TestKmsWorker(t, conn, wrapper)
 
 	upTar, err := workerService.UpdateWorker(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), &pbs.UpdateWorkerRequest{
 		Id: wkr.GetPublicId(),
@@ -877,29 +1000,29 @@ func TestCreateWorkerLed(t *testing.T) {
 			wantErrContains: globals.IdField,
 		},
 		{
-			name:    "invalid-canonical-address",
+			name:    "invalid-address",
 			service: testSrv,
 			scopeId: scope.Global.String(),
 			req: &pbs.CreateWorkerLedRequest{
 				Item: &workers.Worker{
 					ScopeId:                  scope.Global.String(),
 					WorkerGeneratedAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
-					CanonicalAddress:         "invalid-canonical-address",
+					Address:                  "invalid-address",
 				},
 			},
 			wantErr:         true,
 			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
-			wantErrContains: globals.CanonicalAddressField,
+			wantErrContains: globals.AddressField,
 		},
 		{
-			name:    "invalid-tags",
+			name:    "invalid-config-tags",
 			service: testSrv,
 			scopeId: scope.Global.String(),
 			req: &pbs.CreateWorkerLedRequest{
 				Item: &workers.Worker{
 					ScopeId:                  scope.Global.String(),
 					WorkerGeneratedAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
-					Tags: map[string]*structpb.ListValue{
+					ConfigTags: map[string]*structpb.ListValue{
 						"invalid": {Values: []*structpb.Value{
 							structpb.NewStringValue("invalid-tags"),
 						}},
@@ -908,7 +1031,7 @@ func TestCreateWorkerLed(t *testing.T) {
 			},
 			wantErr:         true,
 			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
-			wantErrContains: globals.TagsField,
+			wantErrContains: globals.ConfigTagsField,
 		},
 		{
 			name:    "invalid-canonical-tags",
@@ -944,21 +1067,6 @@ func TestCreateWorkerLed(t *testing.T) {
 			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
 			wantErrContains: globals.LastStatusTimeField,
 		},
-		{
-			name:    "invalid-worker-config",
-			service: testSrv,
-			scopeId: scope.Global.String(),
-			req: &pbs.CreateWorkerLedRequest{
-				Item: &workers.Worker{
-					ScopeId:                     scope.Global.String(),
-					WorkerGeneratedAuthToken:    &wrapperspb.StringValue{Value: fetchReqFn()},
-					WorkerProvidedConfiguration: &pb.WorkerProvidedConfiguration{},
-				},
-			},
-			wantErr:         true,
-			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
-			wantErrContains: globals.WorkerProvidedConfigurationField,
-		},
 		{
 			name:    "invalid-authorized-actions",
 			service: testSrv,
@@ -1131,6 +1239,7 @@ func TestCreateWorkerLed(t *testing.T) {
 					Name:        &wrapperspb.StringValue{Value: "success"},
 					Description: &wrapperspb.StringValue{Value: "success-description"},
 					Version:     1,
+					Type:        PkiWorkerType,
 				},
 			},
 		},