Worker status refactor (#5417)

* oss: feat(proto): statistics rpc added to server coordination service

* oss: feat(session): add update statistics status service

* oss: feat(handlers): add Statistics method to worker service server

* oss: feat(worker): add statistics ticking

* oss: internal/proto: define the new RoutingInfo RPC

* oss: internal/server: repository changes for RoutingInfo RPC

* oss: internal/daemon: add RoutingInfo handler to worker service

The new RoutingInfo RPC is used to get information from the worker
that is used to make routing decisions on the controller. It also
handles the initial request from the worker.

* oss: feat(db): server_worker_session_info table

* oss: feat(proto): session info rpc for server coordination service

* oss: feat(server): worker session info request data type

* oss: feat(worker): session info ticker

* oss: feat(handler): server coordination handler for session info

* oss: feat(session): utilize session info request time for session cleanup

* oss: proto: fix some gotags comments

Some of these fields were missing comments, while others had
incorrectly formatted comments.

* oss: worker: send connection status to server

This is required for the correct tracking of orphaned connections

* oss: internal/daemon/worker: add function to wait for Statistics RPC

* oss: internal/daemon/worker: add routing info RPC

The new RoutingInfo RPC replaces part of the Status RPC,
namely the part which is used by the controller and worker
to perform decisions around the establishment of new sessions
and new worker connections.

* oss: internal/daemon/worker: remove unnecessary error check

* oss: internal/daemon/worker: lock access to config and upstreams

The new confLock protects access to the conf value and to the
addressReceivers slice.

* oss: worker: replace Status RPC with RoutingInfo

* oss: worker: deprecate the Status RPC and related types

The Status RPC and related messages have been replaced
by the RoutingInfo/SessionInfo/Statistics RPCs. The controller
will continue to support the Status RPC until two new minor
versions have been released.

* oss: internal/event: add default deny for new worker RPCs

* oss: internal/daemon/worker: allow RPC interval to be set

The new SessionInfo/RoutingInfo/Statistics RPCs run at
long intervals, which make some of our cluster tests take
a long time to complete. This allows their interval to be
configured in tests.

* oss: all: use TestWorkerRPCInterval in slow tests

This should speed up these tests significantly.

* oss: internal/tests/cluster: reset sys eventer in test

---------

Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>

internal/server/job/jobs.go

@@ -23,7 +23,7 @@ func RegisterJobs(
 	w db.Writer,
 	kms *kms.Kms,
 	controllerExt globals.ControllerExtension,
-	workerStatusGracePeriod *atomic.Int64,
+	workerRPCGracePeriod *atomic.Int64,
 	opt ...Option,
 ) error {
 	const op = "server.(Jobs).RegisterJobs"
@@ -40,8 +40,8 @@ func RegisterJobs(
 	if kms == nil {
 		return errors.New(ctx, errors.InvalidParameter, op, "missing kms")
 	}
-	if isNil(workerStatusGracePeriod) {
-		return errors.New(ctx, errors.InvalidParameter, op, "missing worker status grace period")
+	if isNil(workerRPCGracePeriod) {
+		return errors.New(ctx, errors.InvalidParameter, op, "missing worker RPC grace period")
 	}
 
 	rotateRootsJob, err := newRotateRootsJob(ctx, r, w, kms, opt...)
@@ -52,7 +52,7 @@ func RegisterJobs(
 		return errors.Wrap(ctx, err, op)
 	}
 
-	usbJob, err := NewUpsertWorkerStorageBucketJobFn(ctx, r, w, kms, controllerExt, workerStatusGracePeriod, scheduler)
+	usbJob, err := NewUpsertWorkerStorageBucketJobFn(ctx, r, w, kms, controllerExt, workerRPCGracePeriod, scheduler)
 	if err != nil {
 		return errors.Wrap(ctx, err, op, errors.WithMsg("error creating upsert worker storage bucket job"))
 	}

internal/server/repository_worker.go

@@ -284,8 +284,8 @@ func (r *Repository) UpsertWorkerStatus(ctx context.Context, worker *Worker, opt
 		return "", errors.New(ctx, errors.InvalidParameter, op, "scope id is empty")
 	case worker.PublicId != "":
 		return "", errors.New(ctx, errors.InvalidParameter, op, "worker id is not empty")
-	case worker.GetName() == "" && opts.withKeyId == "":
-		return "", errors.New(ctx, errors.InvalidParameter, op, "worker keyId and reported name are both empty; one is required")
+	case worker.GetName() == "" && opts.withKeyId == "" && opts.withPublicId == "":
+		return "", errors.New(ctx, errors.InvalidParameter, op, "worker keyId, name and public are all empty; one is required")
 	case worker.OperationalState == "":
 		return "", errors.New(ctx, errors.InvalidParameter, op, "worker operational state is empty")
 	case worker.LocalStorageState == "":
@@ -898,7 +898,7 @@ func (r *Repository) DeleteWorkerTags(ctx context.Context, workerId string, work
 // Additionally, it returns the data for the the protocol-aware worker that can
 // handle recording operations, if enabled.
 func (r *Repository) SelectSessionWorkers(ctx context.Context,
-	workerStatusGracePeriod time.Duration,
+	workerRPCGracePeriod time.Duration,
 	t target.Target,
 	host string,
 	ce globals.ControllerExtension,
@@ -907,12 +907,12 @@ func (r *Repository) SelectSessionWorkers(ctx context.Context,
 ) ([]WorkerAddress, string, error) {
 	const op = "server.(Repository).SelectSessionWorkers"
 
-	if workerStatusGracePeriod <= 0 {
-		workerStatusGracePeriod = DefaultLiveness
+	if workerRPCGracePeriod <= 0 {
+		workerRPCGracePeriod = DefaultLiveness
 	}
-	workerStatusGracePeriod = workerStatusGracePeriod.Truncate(time.Second)
+	workerRPCGracePeriod = workerRPCGracePeriod.Truncate(time.Second)
 
-	query := fmt.Sprintf(listSelectSessionWorkers, uint32(workerStatusGracePeriod.Seconds()))
+	query := fmt.Sprintf(listSelectSessionWorkers, uint32(workerRPCGracePeriod.Seconds()))
 	var livingWorkers []*Worker
 	_, err := r.writer.DoTx(
 		ctx,

internal/server/repository_worker_session_info.go

@@ -0,0 +1,37 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package server
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/errors"
+)
+
+// UpsertSessionInfo will update the session info latest request time to the current time for the given worker.
+func (r *Repository) UpsertSessionInfo(ctx context.Context, workerId string, _ ...Option) error {
+	const op = "server.(Repository).UpsertSessionInfo"
+	if workerId == "" {
+		return errors.New(ctx, errors.InvalidParameter, op, "missing worker id")
+	}
+	sessionInfo := NewWorkerSessionInfoRequest(workerId)
+	_, err := r.writer.DoTx(
+		ctx,
+		db.StdRetryCnt,
+		db.ExpBackoff{},
+		func(_ db.Reader, w db.Writer) error {
+			upsert := db.WithOnConflict(&db.OnConflict{
+				Target: db.Columns{"worker_id"},
+				Action: db.SetColumns([]string{"last_request_time"}),
+			})
+			return w.Create(ctx, sessionInfo, upsert)
+		},
+	)
+	if err != nil {
+		return errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("failed for %s", workerId)))
+	}
+	return nil
+}

internal/server/repository_worker_session_info_test.go

@@ -0,0 +1,71 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package server
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpsertSessionInfo(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	conn, _ := db.TestSetup(t, "postgres")
+	rw := db.New(conn)
+	wrapper := db.TestWrapper(t)
+	testKms := kms.TestKms(t, conn, wrapper)
+	testRepo, err := NewRepository(ctx, rw, rw, testKms)
+	require.NoError(t, err)
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iam.TestScopes(t, iamRepo)
+
+	tests := []struct {
+		name           string
+		workerId       string
+		expectedErrMsg string
+	}{
+		{
+			name:           "empty worker id",
+			expectedErrMsg: "missing worker id",
+		},
+		{
+			name:           "worker does not exist",
+			workerId:       "w_dne",
+			expectedErrMsg: "server.(Repository).UpsertSessionInfo: failed for w_dne: db.DoTx: db.Create: wt_public_id_check constraint failed: check constraint violated: integrity violation: error #1000",
+		},
+		{
+			name: "success",
+			workerId: func() string {
+				return TestPkiWorker(t, conn, wrapper).PublicId
+			}(),
+		},
+		{
+			name: "upsert on conflict",
+			workerId: func() string {
+				workerId := TestPkiWorker(t, conn, wrapper).PublicId
+				require.NoError(t, testRepo.UpsertSessionInfo(context.Background(), workerId))
+				return workerId
+			}(),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			err := testRepo.UpsertSessionInfo(context.Background(), tt.workerId)
+			if tt.expectedErrMsg != "" {
+				require.Error(err)
+				assert.ErrorContains(err, tt.expectedErrMsg)
+				return
+			}
+			require.NoError(err)
+		})
+	}
+}

internal/server/repository_worker_test.go

@@ -1661,7 +1661,7 @@ func TestSelectSessionWorkers(t *testing.T) {
 		require.ErrorContains(t, err, "No workers are available to handle this session.")
 	})
 
-	t.Run("invalidWorkerStatusGracePeriod", func(t *testing.T) {
+	t.Run("invalidWorkerRPCGracePeriod", func(t *testing.T) {
 		w1 := server.TestKmsWorker(t, conn, wrapper, server.WithWorkerTags(&server.Tag{Key: "type", Value: "worker1"}))
 		require.NotNil(t, w1)
 		t.Cleanup(func() {
@@ -1688,7 +1688,7 @@ func TestSelectSessionWorkers(t *testing.T) {
 		require.Equal(t, w1.GetAddress(), was[0].Address)
 	})
 
-	t.Run("validWorkerStatusGracePeriod", func(t *testing.T) {
+	t.Run("validWorkerRPCGracePeriod", func(t *testing.T) {
 		w1 := server.TestKmsWorker(t, conn, wrapper, server.WithWorkerTags(&server.Tag{Key: "type", Value: "prod"}))
 		require.NotNil(t, w1)
 		t.Cleanup(func() {

internal/server/service_verified_workers.go

@@ -0,0 +1,52 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package server
+
+import (
+	"context"
+
+	"github.com/hashicorp/boundary/internal/errors"
+	"github.com/hashicorp/boundary/internal/util"
+)
+
+// AuthorizedWorkers contain authorized worker
+// public ids and unmapped worker key ids
+type AuthorizedWorkers struct {
+	WorkerPublicIds      []string
+	UnmappedWorkerKeyIds []string
+}
+
+// VerifyKnownAndUnmappedWorkers verifies the connected worker ids and unmapped worker key ids are known to the controller
+func VerifyKnownAndUnmappedWorkers(
+	ctx context.Context,
+	repo *Repository,
+	workerAuthRepo *WorkerAuthRepositoryStorage,
+	connectedWorkerIds,
+	unmappedWorkerKeyIds []string,
+) (*AuthorizedWorkers, error) {
+	const op = "server.VerifyKnownAndUnmappedWorkers"
+	switch {
+	case util.IsNil(repo):
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "repository is required")
+	case util.IsNil(workerAuthRepo):
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "worker auth repository is required")
+	}
+	var authorizedDownstreams AuthorizedWorkers
+	if len(connectedWorkerIds) > 0 {
+		knownConnectedWorkers, err := repo.VerifyKnownWorkers(ctx, connectedWorkerIds)
+		if err != nil {
+			return nil, errors.Wrap(ctx, err, op, errors.WithMsg("error getting known connected worker ids"))
+		}
+		authorizedDownstreams.WorkerPublicIds = knownConnectedWorkers
+	}
+
+	if len(unmappedWorkerKeyIds) > 0 {
+		authorizedKeyIds, err := workerAuthRepo.FilterToAuthorizedWorkerKeyIds(ctx, unmappedWorkerKeyIds)
+		if err != nil {
+			return nil, errors.Wrap(ctx, err, op, errors.WithMsg("error getting authorized unmapped worker key ids"))
+		}
+		authorizedDownstreams.UnmappedWorkerKeyIds = authorizedKeyIds
+	}
+	return &authorizedDownstreams, nil
+}

internal/server/service_verified_workers_ext_test.go

@@ -0,0 +1,61 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package server_test
+
+import (
+	"context"
+	"crypto/rand"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/server"
+	"github.com/hashicorp/boundary/internal/types/scope"
+	"github.com/stretchr/testify/require"
+)
+
+func TestVerifyUnknownAndUnmappedWorkers(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	conn, _ := db.TestSetup(t, "postgres")
+	rw := db.New(conn)
+	wrapper := db.TestWrapper(t)
+	kmsCache := kms.TestKms(t, conn, wrapper)
+	require.NoError(t, kmsCache.CreateKeys(context.Background(), scope.Global.String(), kms.WithRandomReader(rand.Reader)))
+
+	serverRepo, err := server.NewRepository(ctx, rw, rw, kmsCache)
+	require.NoError(t, err)
+	workerAuthRepo, err := server.NewRepositoryStorage(ctx, rw, rw, kmsCache)
+	require.NoError(t, err)
+
+	// Set up resources
+	var w1KeyId, w2KeyId string
+	w1 := server.TestPkiWorker(t, conn, wrapper, server.WithTestPkiWorkerAuthorizedKeyId(&w1KeyId))
+	_ = server.TestPkiWorker(t, conn, wrapper, server.WithTestPkiWorkerAuthorizedKeyId(&w2KeyId))
+	w3 := server.TestKmsWorker(t, conn, wrapper)
+
+	t.Run("With 1 PKI, 1 KMS and 1 unmapped worker", func(t *testing.T) {
+		t.Parallel()
+		authzWorkers, err := server.VerifyKnownAndUnmappedWorkers(ctx, serverRepo, workerAuthRepo, []string{w1.PublicId, w3.PublicId, "invalid-worker-id"}, []string{w2KeyId, "invalid-worker-key-id"})
+		require.NoError(t, err)
+		require.Empty(t, cmp.Diff(authzWorkers.WorkerPublicIds, []string{w1.PublicId, w3.PublicId}))
+		require.Empty(t, cmp.Diff(authzWorkers.UnmappedWorkerKeyIds, []string{w2KeyId}))
+	})
+
+	t.Run("missing repository", func(t *testing.T) {
+		t.Parallel()
+		authzWorkers, err := server.VerifyKnownAndUnmappedWorkers(ctx, nil, workerAuthRepo, []string{w1.PublicId, w3.PublicId}, []string{w2KeyId})
+		require.ErrorContains(t, err, "repository is required")
+		require.Nil(t, authzWorkers)
+	})
+
+	t.Run("missing worker auth repository", func(t *testing.T) {
+		t.Parallel()
+		authzWorkers, err := server.VerifyKnownAndUnmappedWorkers(ctx, serverRepo, nil, []string{w1.PublicId, w3.PublicId}, []string{w2KeyId})
+		require.ErrorContains(t, err, "worker auth repository is required")
+		require.Nil(t, authzWorkers)
+	})
+}

internal/server/store/worker.pb.go

@@ -528,6 +528,66 @@ func (x *WorkerStorageBucketCredentialState) GetCheckedAt() *timestamp.Timestamp
 	return nil
 }
 
+// WorkerSessionInfoRequest contains information about a worker and its SessionInfo requests.
+type WorkerSessionInfoRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// worker_id is the public id of the worker.
+	// @inject_tag: `gorm:"primary_key"`
+	WorkerId string `protobuf:"bytes,10,opt,name=worker_id,json=workerId,proto3" json:"worker_id,omitempty" gorm:"primary_key"`
+	// The last_request_time is the last time a worker has reported its session information.
+	// @inject_tag: `gorm:"default:null"`
+	LastRequestTime *timestamp.Timestamp `protobuf:"bytes,20,opt,name=last_request_time,json=lastRequestTime,proto3" json:"last_request_time,omitempty" gorm:"default:null"`
+}
+
+func (x *WorkerSessionInfoRequest) Reset() {
+	*x = WorkerSessionInfoRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_storage_servers_store_v1_worker_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WorkerSessionInfoRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WorkerSessionInfoRequest) ProtoMessage() {}
+
+func (x *WorkerSessionInfoRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_storage_servers_store_v1_worker_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WorkerSessionInfoRequest.ProtoReflect.Descriptor instead.
+func (*WorkerSessionInfoRequest) Descriptor() ([]byte, []int) {
+	return file_controller_storage_servers_store_v1_worker_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *WorkerSessionInfoRequest) GetWorkerId() string {
+	if x != nil {
+		return x.WorkerId
+	}
+	return ""
+}
+
+func (x *WorkerSessionInfoRequest) GetLastRequestTime() *timestamp.Timestamp {
+	if x != nil {
+		return x.LastRequestTime
+	}
+	return nil
+}
+
 var File_controller_storage_servers_store_v1_worker_proto protoreflect.FileDescriptor
 
 var file_controller_storage_servers_store_v1_worker_proto_rawDesc = []byte{
@@ -617,11 +677,20 @@ var file_controller_storage_servers_store_v1_worker_proto_rawDesc = []byte{
 	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61,
 	0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e,
 	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x68, 0x65, 0x63, 0x6b,
-	0x65, 0x64, 0x41, 0x74, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75,
-	0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72,
-	0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x64, 0x41, 0x74, 0x22, 0x8f, 0x01, 0x0a, 0x18, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x53,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x1b, 0x0a, 0x09, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x0a,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x64, 0x12, 0x56,
+	0x0a, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x74,
+	0x69, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0f, 0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62,
+	0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
+	0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74,
+	0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -636,25 +705,27 @@ func file_controller_storage_servers_store_v1_worker_proto_rawDescGZIP() []byte
 	return file_controller_storage_servers_store_v1_worker_proto_rawDescData
 }
 
-var file_controller_storage_servers_store_v1_worker_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_controller_storage_servers_store_v1_worker_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_controller_storage_servers_store_v1_worker_proto_goTypes = []any{
 	(*Worker)(nil),    // 0: controller.storage.servers.store.v1.Worker
 	(*WorkerTag)(nil), // 1: controller.storage.servers.store.v1.WorkerTag
 	(*ApiTag)(nil),    // 2: controller.storage.servers.store.v1.ApiTag
 	(*ConfigTag)(nil), // 3: controller.storage.servers.store.v1.ConfigTag
 	(*WorkerStorageBucketCredentialState)(nil), // 4: controller.storage.servers.store.v1.WorkerStorageBucketCredentialState
-	(*timestamp.Timestamp)(nil),                // 5: controller.storage.timestamp.v1.Timestamp
+	(*WorkerSessionInfoRequest)(nil),           // 5: controller.storage.servers.store.v1.WorkerSessionInfoRequest
+	(*timestamp.Timestamp)(nil),                // 6: controller.storage.timestamp.v1.Timestamp
 }
 var file_controller_storage_servers_store_v1_worker_proto_depIdxs = []int32{
-	5, // 0: controller.storage.servers.store.v1.Worker.create_time:type_name -> controller.storage.timestamp.v1.Timestamp
-	5, // 1: controller.storage.servers.store.v1.Worker.update_time:type_name -> controller.storage.timestamp.v1.Timestamp
-	5, // 2: controller.storage.servers.store.v1.Worker.last_status_time:type_name -> controller.storage.timestamp.v1.Timestamp
-	5, // 3: controller.storage.servers.store.v1.WorkerStorageBucketCredentialState.checked_at:type_name -> controller.storage.timestamp.v1.Timestamp
-	4, // [4:4] is the sub-list for method output_type
-	4, // [4:4] is the sub-list for method input_type
-	4, // [4:4] is the sub-list for extension type_name
-	4, // [4:4] is the sub-list for extension extendee
-	0, // [0:4] is the sub-list for field type_name
+	6, // 0: controller.storage.servers.store.v1.Worker.create_time:type_name -> controller.storage.timestamp.v1.Timestamp
+	6, // 1: controller.storage.servers.store.v1.Worker.update_time:type_name -> controller.storage.timestamp.v1.Timestamp
+	6, // 2: controller.storage.servers.store.v1.Worker.last_status_time:type_name -> controller.storage.timestamp.v1.Timestamp
+	6, // 3: controller.storage.servers.store.v1.WorkerStorageBucketCredentialState.checked_at:type_name -> controller.storage.timestamp.v1.Timestamp
+	6, // 4: controller.storage.servers.store.v1.WorkerSessionInfoRequest.last_request_time:type_name -> controller.storage.timestamp.v1.Timestamp
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
 }
 
 func init() { file_controller_storage_servers_store_v1_worker_proto_init() }
@@ -723,6 +794,18 @@ func file_controller_storage_servers_store_v1_worker_proto_init() {
 				return nil
 			}
 		}
+		file_controller_storage_servers_store_v1_worker_proto_msgTypes[5].Exporter = func(v any, i int) any {
+			switch v := v.(*WorkerSessionInfoRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -730,7 +813,7 @@ func file_controller_storage_servers_store_v1_worker_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_controller_storage_servers_store_v1_worker_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   5,
+			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

internal/server/worker_session_info_request.go

@@ -0,0 +1,81 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package server
+
+import (
+	"context"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/db/timestamp"
+	"github.com/hashicorp/boundary/internal/errors"
+	"github.com/hashicorp/boundary/internal/oplog"
+	"github.com/hashicorp/boundary/internal/server/store"
+	"google.golang.org/protobuf/proto"
+)
+
+// Ensure WorkerSessionInfoRequest implements interfaces
+var (
+	_ db.VetForWriter         = (*WorkerSessionInfoRequest)(nil)
+	_ oplog.ReplayableMessage = (*WorkerSessionInfoRequest)(nil)
+)
+
+// WorkerSessionInfoRequest contains the last time a worker daemon sent a status update for session information.
+type WorkerSessionInfoRequest struct {
+	*store.WorkerSessionInfoRequest
+	tableName string `gorm:"-"`
+}
+
+// NewWorkerSessionInfoRequest create a new instance of a worker session information request.
+// The LastStatusTime field is set to the current time.
+func NewWorkerSessionInfoRequest(workerId string) *WorkerSessionInfoRequest {
+	return &WorkerSessionInfoRequest{
+		WorkerSessionInfoRequest: &store.WorkerSessionInfoRequest{
+			WorkerId:        workerId,
+			LastRequestTime: timestamp.Now(),
+		},
+	}
+}
+
+// WorkerSessionInfoRequest creates an empty in-memory instance of a worker session information request.
+func AllocWorkerSessionInfoRequest() *WorkerSessionInfoRequest {
+	return &WorkerSessionInfoRequest{
+		WorkerSessionInfoRequest: &store.WorkerSessionInfoRequest{},
+	}
+}
+
+func (w *WorkerSessionInfoRequest) Clone() *WorkerSessionInfoRequest {
+	cp := proto.Clone(w.WorkerSessionInfoRequest)
+	return &WorkerSessionInfoRequest{
+		WorkerSessionInfoRequest: cp.(*store.WorkerSessionInfoRequest),
+	}
+}
+
+// VetForWrite implements db.VetForWrite() interface and validates the worker storage bucket credential state
+func (w *WorkerSessionInfoRequest) VetForWrite(ctx context.Context, _ db.Reader, opType db.OpType, _ ...db.Option) error {
+	const op = "server.(WorkerSessionInfoRequest).VetForWrite"
+	switch {
+	case w == nil:
+		return errors.New(ctx, errors.InvalidParameter, op, "missing worker session info request")
+	case w.WorkerId == "":
+		return errors.New(ctx, errors.InvalidParameter, op, "missing worker id")
+	case w.LastRequestTime == nil:
+		return errors.New(ctx, errors.InvalidParameter, op, "missing last request timestamp")
+	}
+	return nil
+}
+
+// TableName returns the tablename to override the default gorm table name
+func (w *WorkerSessionInfoRequest) TableName() string {
+	if w.tableName != "" {
+		return w.tableName
+	}
+	return "server_worker_session_info_request"
+}
+
+// SetTableName sets the tablename and satisfies the ReplayableMessage
+// interface. If the caller attempts to set the name to "" the name will be
+// reset to the default name.
+func (w *WorkerSessionInfoRequest) SetTableName(n string) {
+	w.tableName = n
+}