Migrate target host sets -> host sources (#1424)

This follows the same model as https://github.com/hashicorp/boundary/pull/1413

See there and CHANGELOG for more details.

CHANGELOG.md

@@ -6,22 +6,34 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ### Deprecations/Changes
 
-* With respect to Target resources, _credential libraries_ that are attached to
-  the targets are being renamed to the more abstract _credential sources_. In
-  the future Boundary will gain the ability to internally store static
-  credentials that are not generated or fetched dynamically, and the _sources_
-  terminology better reflects that the IDs provided are a source of credentials,
-  whether via dynamic generation or via the credentials themselves. This will
-  allow a paradigm similar to `principals` with roles, where the principal IDs
-  can be a users, groups, and managed groups, rather than having them split out,
-  and should result in an easier user experience once those features roll out
-  compared to having separate flags and fields. In this 0.5 release the Boundary
-  CLI has gained parallel `application-credential-source` flags to the existing
-  `application-credential-library` flags, as well as `boundary targets
-  add/remove/set-credential-sources` commands that parallel `boundary targets
-  add/remove/set-credential-libraries` commands. This parallelism extends to the
-  API actions and the grants system. In 0.6, the _library_ versions of these
-  commands, flags, and actions will be removed.
+* With respect to Target resources, two naming changes are taking place. Note
+  that these are not affecting the resources themselves, only the fields on
+  Target resources that map them to targets:
+* * _Credential Libraries_: In Target definitions, the field referring to
+    attached credential libraries is being renamed to the more abstract
+    _credential sources_. In the future Boundary will gain the ability to
+    internally store static credentials that are not generated or fetched
+    dynamically, and the _sources_ terminology better reflects that the IDs
+    provided are a source of credentials, whether via dynamic generation or via
+    the credentials themselves. This will allow a paradigm similar to
+    `principals` with roles, where the principal IDs can be a users, groups, and
+    managed groups, rather than having them split out, and should result in an
+    easier user experience once those features roll out compared to having
+    separate flags and fields. In this 0.5 release the Boundary CLI has gained
+    parallel `application-credential-source` flags to the existing
+    `application-credential-library` flags, as well as `boundary targets
+    add/remove/set-credential-sources` commands that parallel `boundary targets
+    add/remove/set-credential-libraries` commands. This parallelism extends to
+    the API actions and the grants system. In 0.6, the _library_ versions of
+    these commands, flags, and actions will be removed.
+* * _Host Sets_: Similarly, in Target definitions, the field referring to
+    attached host sets is being renamed to the more abstract _host sources_. In
+    the future Boundary will allow attaching some host types directly, and
+    possibly other mechanisms for gathering hosts for targets, so the _sources_
+    terminology better reflects that the IDs provided are a source of hosts,
+    whether via sets or via the hosts themselves. Like with credential sources,
+    in this 0.5 release the Boundary CLI and API have gained parallel API
+    actions and fields, and the _set_ versions of these will be removed in 0.6.
 
 ### New and Improved
 

api/targets/host_source.gen.go

@@ -0,0 +1,7 @@
+// Code generated by "make api"; DO NOT EDIT.
+package targets
+
+type HostSource struct {
+	Id            string `json:"id,omitempty"`
+	HostCatalogId string `json:"host_catalog_id,omitempty"`
+}

api/targets/target.gen.go

@@ -24,6 +24,8 @@ type Target struct {
 	Type                            string                 `json:"type,omitempty"`
 	HostSetIds                      []string               `json:"host_set_ids,omitempty"`
 	HostSets                        []*HostSet             `json:"host_sets,omitempty"`
+	HostSourceIds                   []string               `json:"host_source_ids,omitempty"`
+	HostSources                     []*HostSource          `json:"host_sources,omitempty"`
 	SessionMaxSeconds               uint32                 `json:"session_max_seconds,omitempty"`
 	SessionConnectionLimit          int32                  `json:"session_connection_limit,omitempty"`
 	WorkerFilter                    string                 `json:"worker_filter,omitempty"`
@@ -533,6 +535,76 @@ func (c *Client) AddHostSets(ctx context.Context, id string, version uint32, hos
 	return target, nil
 }
 
+func (c *Client) AddHostSources(ctx context.Context, id string, version uint32, hostSourceIds []string, opt ...Option) (*TargetUpdateResult, error) {
+	if id == "" {
+		return nil, fmt.Errorf("empty id value passed into AddHostSources request")
+	}
+
+	if len(hostSourceIds) == 0 {
+		return nil, errors.New("empty hostSourceIds passed into AddHostSources request")
+	}
+
+	if c.client == nil {
+		return nil, errors.New("nil client")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	if version == 0 {
+		if !opts.withAutomaticVersioning {
+			return nil, errors.New("zero version number passed into AddHostSources request")
+		}
+		existingTarget, existingErr := c.Read(ctx, id, append([]Option{WithSkipCurlOutput(true)}, opt...)...)
+		if existingErr != nil {
+			if api.AsServerError(existingErr) != nil {
+				return nil, fmt.Errorf("error from controller when performing initial check-and-set read: %w", existingErr)
+			}
+			return nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
+		}
+		if existingTarget == nil {
+			return nil, errors.New("nil resource response found when performing initial check-and-set read")
+		}
+		if existingTarget.Item == nil {
+			return nil, errors.New("nil resource found when performing initial check-and-set read")
+		}
+		version = existingTarget.Item.Version
+	}
+
+	opts.postMap["version"] = version
+
+	opts.postMap["host_source_ids"] = hostSourceIds
+
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-host-sources", id), opts.postMap, apiOpts...)
+	if err != nil {
+		return nil, fmt.Errorf("error creating AddHostSources request: %w", err)
+	}
+
+	if len(opts.queryMap) > 0 {
+		q := url.Values{}
+		for k, v := range opts.queryMap {
+			q.Add(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("error performing client request during AddHostSources call: %w", err)
+	}
+
+	target := new(TargetUpdateResult)
+	target.Item = new(Target)
+	apiErr, err := resp.Decode(target.Item)
+	if err != nil {
+		return nil, fmt.Errorf("error decoding AddHostSources response: %w", err)
+	}
+	if apiErr != nil {
+		return nil, apiErr
+	}
+	target.response = resp
+	return target, nil
+}
+
 func (c *Client) SetCredentialLibraries(ctx context.Context, id string, version uint32, opt ...Option) (*TargetUpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into SetCredentialLibraries request")
@@ -727,6 +799,72 @@ func (c *Client) SetHostSets(ctx context.Context, id string, version uint32, hos
 	return target, nil
 }
 
+func (c *Client) SetHostSources(ctx context.Context, id string, version uint32, hostSourceIds []string, opt ...Option) (*TargetUpdateResult, error) {
+	if id == "" {
+		return nil, fmt.Errorf("empty id value passed into SetHostSources request")
+	}
+
+	if c.client == nil {
+		return nil, errors.New("nil client")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	if version == 0 {
+		if !opts.withAutomaticVersioning {
+			return nil, errors.New("zero version number passed into SetHostSources request")
+		}
+		existingTarget, existingErr := c.Read(ctx, id, append([]Option{WithSkipCurlOutput(true)}, opt...)...)
+		if existingErr != nil {
+			if api.AsServerError(existingErr) != nil {
+				return nil, fmt.Errorf("error from controller when performing initial check-and-set read: %w", existingErr)
+			}
+			return nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
+		}
+		if existingTarget == nil {
+			return nil, errors.New("nil resource response found when performing initial check-and-set read")
+		}
+		if existingTarget.Item == nil {
+			return nil, errors.New("nil resource found when performing initial check-and-set read")
+		}
+		version = existingTarget.Item.Version
+	}
+
+	opts.postMap["version"] = version
+
+	opts.postMap["host_source_ids"] = hostSourceIds
+
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-host-sources", id), opts.postMap, apiOpts...)
+	if err != nil {
+		return nil, fmt.Errorf("error creating SetHostSources request: %w", err)
+	}
+
+	if len(opts.queryMap) > 0 {
+		q := url.Values{}
+		for k, v := range opts.queryMap {
+			q.Add(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("error performing client request during SetHostSources call: %w", err)
+	}
+
+	target := new(TargetUpdateResult)
+	target.Item = new(Target)
+	apiErr, err := resp.Decode(target.Item)
+	if err != nil {
+		return nil, fmt.Errorf("error decoding SetHostSources response: %w", err)
+	}
+	if apiErr != nil {
+		return nil, apiErr
+	}
+	target.response = resp
+	return target, nil
+}
+
 func (c *Client) RemoveCredentialLibraries(ctx context.Context, id string, version uint32, opt ...Option) (*TargetUpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into RemoveCredentialLibraries request")
@@ -924,3 +1062,73 @@ func (c *Client) RemoveHostSets(ctx context.Context, id string, version uint32,
 	target.response = resp
 	return target, nil
 }
+
+func (c *Client) RemoveHostSources(ctx context.Context, id string, version uint32, hostSourceIds []string, opt ...Option) (*TargetUpdateResult, error) {
+	if id == "" {
+		return nil, fmt.Errorf("empty id value passed into RemoveHostSources request")
+	}
+
+	if len(hostSourceIds) == 0 {
+		return nil, errors.New("empty hostSourceIds passed into RemoveHostSources request")
+	}
+
+	if c.client == nil {
+		return nil, errors.New("nil client")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	if version == 0 {
+		if !opts.withAutomaticVersioning {
+			return nil, errors.New("zero version number passed into RemoveHostSources request")
+		}
+		existingTarget, existingErr := c.Read(ctx, id, append([]Option{WithSkipCurlOutput(true)}, opt...)...)
+		if existingErr != nil {
+			if api.AsServerError(existingErr) != nil {
+				return nil, fmt.Errorf("error from controller when performing initial check-and-set read: %w", existingErr)
+			}
+			return nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
+		}
+		if existingTarget == nil {
+			return nil, errors.New("nil resource response found when performing initial check-and-set read")
+		}
+		if existingTarget.Item == nil {
+			return nil, errors.New("nil resource found when performing initial check-and-set read")
+		}
+		version = existingTarget.Item.Version
+	}
+
+	opts.postMap["version"] = version
+
+	opts.postMap["host_source_ids"] = hostSourceIds
+
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-host-sources", id), opts.postMap, apiOpts...)
+	if err != nil {
+		return nil, fmt.Errorf("error creating RemoveHostSources request: %w", err)
+	}
+
+	if len(opts.queryMap) > 0 {
+		q := url.Values{}
+		for k, v := range opts.queryMap {
+			q.Add(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("error performing client request during RemoveHostSources call: %w", err)
+	}
+
+	target := new(TargetUpdateResult)
+	target.Item = new(Target)
+	apiErr, err := resp.Decode(target.Item)
+	if err != nil {
+		return nil, fmt.Errorf("error decoding RemoveHostSources response: %w", err)
+	}
+	if apiErr != nil {
+		return nil, apiErr
+	}
+	target.response = resp
+	return target, nil
+}

globals/fields.go

@@ -23,6 +23,7 @@ const (
 	MemberIdsField                       = "member_ids"
 	HostCatalogIdField                   = "host_catalog_id"
 	HostSetIdsField                      = "host_set_ids"
+	HostSourceIdsField                   = "host_source_ids"
 	HostIdsField                         = "host_ids"
 	PrincipalIdsField                    = "principal_ids"
 	PrincipalsField                      = "principals"
@@ -34,6 +35,7 @@ const (
 	HostIdField                          = "host_id"
 	HostSetIdField                       = "host_set_id"
 	HostSetsField                        = "host_sets"
+	HostSourcesField                     = "host_sources"
 	AuthTokenIdField                     = "auth_token_id"
 	EndpointField                        = "endpoint"
 	CertificateField                     = "certificate"

internal/api/genapi/input.go

@@ -555,6 +555,10 @@ var inputStructs = []*structInfo{
 		inProto: &targets.HostSet{},
 		outFile: "targets/host_set.gen.go",
 	},
+	{
+		inProto: &targets.HostSource{},
+		outFile: "targets/host_source.gen.go",
+	},
 	{
 		inProto: &targets.CredentialLibrary{},
 		outFile: "targets/credential_library.gen.go",
@@ -609,6 +613,10 @@ var inputStructs = []*structInfo{
 				SliceType: "[]string",
 				VarName:   "hostSetIds",
 			},
+			"HostSources": {
+				SliceType: "[]string",
+				VarName:   "hostSourceIds",
+			},
 			"CredentialLibraries": {},
 			"CredentialSources":   {},
 		},

internal/cmd/base/initial_resources.go

@@ -507,7 +507,7 @@ func (b *Server) CreateInitialTarget(ctx context.Context) (target.Target, error)
 		target.WithName("Generated target"),
 		target.WithDescription("Provides an initial target in Boundary"),
 		target.WithDefaultPort(uint32(b.DevTargetDefaultPort)),
-		target.WithHostSets([]string{b.DevHostSetId}),
+		target.WithHostSources([]string{b.DevHostSetId}),
 		target.WithSessionMaxSeconds(uint32(b.DevTargetSessionMaxSeconds)),
 		target.WithSessionConnectionLimit(int32(b.DevTargetSessionConnectionLimit)),
 		target.WithPublicId(b.DevTargetId),

internal/cmd/commands.go

@@ -896,6 +896,24 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) {
 				Func:    "set-host-sets",
 			}, nil
 		},
+		"targets add-host-sources": func() (cli.Command, error) {
+			return &targetscmd.Command{
+				Command: base.NewCommand(ui),
+				Func:    "add-host-sources",
+			}, nil
+		},
+		"targets remove-host-sources": func() (cli.Command, error) {
+			return &targetscmd.Command{
+				Command: base.NewCommand(ui),
+				Func:    "remove-host-sources",
+			}, nil
+		},
+		"targets set-host-sources": func() (cli.Command, error) {
+			return &targetscmd.Command{
+				Command: base.NewCommand(ui),
+				Func:    "set-host-sources",
+			}, nil
+		},
 		"targets add-credential-libraries": func() (cli.Command, error) {
 			return &targetscmd.Command{
 				Command: base.NewCommand(ui),

internal/cmd/commands/targetscmd/funcs.go

@@ -30,6 +30,7 @@ func init() {
 
 type extraCmdVars struct {
 	flagHostSets                       []string
+	flagHostSources                    []string
 	flagApplicationCredentialLibraries []string
 	flagApplicationCredentialSources   []string
 	flagHostId                         string
@@ -42,6 +43,9 @@ func extraActionsFlagsMapFuncImpl() map[string][]string {
 		"add-host-sets":               {"id", "host-set", "version"},
 		"remove-host-sets":            {"id", "host-set", "version"},
 		"set-host-sets":               {"id", "host-set", "version"},
+		"add-host-sources":            {"id", "host-source", "version"},
+		"remove-host-sources":         {"id", "host-source", "version"},
+		"set-host-sources":            {"id", "host-source", "version"},
 		"add-credential-libraries":    {"id", "application-credential-library", "version"},
 		"remove-credential-libraries": {"id", "application-credential-library", "version"},
 		"set-credential-libraries":    {"id", "application-credential-library", "version"},
@@ -65,6 +69,18 @@ func extraSynopsisFuncImpl(c *Command) string {
 		}
 		return wordwrap.WrapString(fmt.Sprintf("%s a target", in), base.TermWidth)
 
+	case "add-host-sources", "set-host-sources", "remove-host-sources":
+		var in string
+		switch {
+		case strings.HasPrefix(c.Func, "add"):
+			in = "Add host sources to"
+		case strings.HasPrefix(c.Func, "set"):
+			in = "Set the full contents of the host sources on"
+		case strings.HasPrefix(c.Func, "remove"):
+			in = "Remove host sources from"
+		}
+		return wordwrap.WrapString(fmt.Sprintf("%s a target", in), base.TermWidth)
+
 	case "add-credential-libraries", "set-credential-libraries", "remove-credential-libraries":
 		var in string
 		switch {
@@ -140,6 +156,8 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 		helpStr = base.WrapForHelpText([]string{
 			"Usage: boundary target add-host-sets [options] [args]",
 			"",
+			"  DEPRECATED: Use add-host-sources instead.",
+			"",
 			"  This command allows adding host-set resources to target resources. Example:",
 			"",
 			"    Add host-set resources to a tcp-type target:",
@@ -152,11 +170,13 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 		helpStr = base.WrapForHelpText([]string{
 			"Usage: boundary target remove-host-sets [options] [args]",
 			"",
+			"  DEPRECATED: Use remove-host-sources instead.",
+			"",
 			"  This command allows removing host-set resources from target resources. Example:",
 			"",
 			"    Remove host-set resources from a tcp-type target:",
 			"",
-			`      $ boundary targets add-host-sets -id ttcp_1234567890 -host hsst_1234567890 -host-set hsst_0987654321`,
+			`      $ boundary targets remove-host-sets -id ttcp_1234567890 -host hsst_1234567890 -host-set hsst_0987654321`,
 			"",
 			"",
 		})
@@ -164,6 +184,8 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 		helpStr = base.WrapForHelpText([]string{
 			"Usage: boundary target set-host-sets [options] [args]",
 			"",
+			"  DEPRECATED: Use set-host-sources instead.",
+			"",
 			"  This command allows setting the complete set of host-set resources on a target resource. Example:",
 			"",
 			"    Set host-set resources on a tcp-type target:",
@@ -172,6 +194,42 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 			"",
 			"",
 		})
+	case "add-host-sources":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary target add-host-sources [options] [args]",
+			"",
+			"  This command allows adding host sources to target resources. Example:",
+			"",
+			"    Add host sources to a tcp-type target:",
+			"",
+			`      $ boundary targets add-host-sources -id ttcp_1234567890 -host-source hsst_1234567890 -host-source hsst_0987654321`,
+			"",
+			"",
+		})
+	case "remove-host-sources":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary target remove-host-sources [options] [args]",
+			"",
+			"  This command allows removing host sources from target resources. Example:",
+			"",
+			"    Remove host sources from a tcp-type target:",
+			"",
+			`      $ boundary targets remove-host-sources -id ttcp_1234567890 -host-source hsst_1234567890 -host-source hsst_0987654321`,
+			"",
+			"",
+		})
+	case "set-host-sources":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary target set-host-sources [options] [args]",
+			"",
+			"  This command allows setting the complete set of host sources on a target resource. Example:",
+			"",
+			"    Set host sources on a tcp-type target:",
+			"",
+			`      $ boundary targets set-host-sources -id ttcp_1234567890 -host-source hsst_1234567890`,
+			"",
+			"",
+		})
 	case "add-credential-libraries":
 		helpStr = base.WrapForHelpText([]string{
 			"Usage: boundary target add-credential-libraries [options] [args]",
@@ -279,6 +337,12 @@ func extraFlagsFuncImpl(c *Command, _ *base.FlagSets, f *base.FlagSet) {
 				Target: &c.flagHostSets,
 				Usage:  "The host-set resources to add, remove, or set. May be specified multiple times.",
 			})
+		case "host-source":
+			f.StringSliceVar(&base.StringSliceVar{
+				Name:   "host-source",
+				Target: &c.flagHostSources,
+				Usage:  "The host sources to add, remove, or set. May be specified multiple times.",
+			})
 		case "host-id":
 			f.StringVar(&base.StringVar{
 				Name:   "host-id",
@@ -367,6 +431,12 @@ func extraFlagsHandlingFuncImpl(c *Command, _ *base.FlagSets, opts *[]targets.Op
 			return false
 		}
 
+	case "add-host-sources", "remove-host-sources":
+		if len(c.flagHostSources) == 0 {
+			c.UI.Error("No host sources supplied via -host-source")
+			return false
+		}
+
 	case "set-host-sets":
 		switch len(c.flagHostSets) {
 		case 0:
@@ -378,6 +448,17 @@ func extraFlagsHandlingFuncImpl(c *Command, _ *base.FlagSets, opts *[]targets.Op
 			}
 		}
 
+	case "set-host-sources":
+		switch len(c.flagHostSources) {
+		case 0:
+			c.UI.Error("No host sources supplied via -host-source")
+			return false
+		case 1:
+			if c.flagHostSources[0] == "null" {
+				c.flagHostSources = nil
+			}
+		}
+
 	case "add-credential-libraries", "remove-credential-libraries":
 		// TODO: As we add other purposes, add them to this check
 		if len(c.flagApplicationCredentialLibraries) == 0 {
@@ -443,6 +524,12 @@ func executeExtraActionsImpl(c *Command, origResult api.GenericResult, origError
 		return targetClient.RemoveHostSets(c.Context, c.FlagId, version, c.flagHostSets, opts...)
 	case "set-host-sets":
 		return targetClient.SetHostSets(c.Context, c.FlagId, version, c.flagHostSets, opts...)
+	case "add-host-sources":
+		return targetClient.AddHostSources(c.Context, c.FlagId, version, c.flagHostSources, opts...)
+	case "remove-host-sources":
+		return targetClient.RemoveHostSources(c.Context, c.FlagId, version, c.flagHostSources, opts...)
+	case "set-host-sources":
+		return targetClient.SetHostSources(c.Context, c.FlagId, version, c.flagHostSources, opts...)
 	case "add-credential-libraries":
 		return targetClient.AddCredentialLibraries(c.Context, c.FlagId, version, opts...)
 	case "remove-credential-libraries":
@@ -560,14 +647,26 @@ func printItemTable(result api.GenericResult) string {
 
 	maxLength := base.MaxAttributesLength(nonAttributeMap, item.Attributes, keySubstMap)
 
-	var hostSetMaps []map[string]interface{}
+	var hostSourceMaps []map[string]interface{}
+	if len(item.HostSources) > 0 {
+		for _, set := range item.HostSources {
+			m := map[string]interface{}{
+				"ID":              set.Id,
+				"Host Catalog ID": set.HostCatalogId,
+			}
+			hostSourceMaps = append(hostSourceMaps, m)
+		}
+		if l := len("Host Catalog ID"); l > maxLength {
+			maxLength = l
+		}
+	}
 	if len(item.HostSets) > 0 {
 		for _, set := range item.HostSets {
 			m := map[string]interface{}{
 				"ID":              set.Id,
 				"Host Catalog ID": set.HostCatalogId,
 			}
-			hostSetMaps = append(hostSetMaps, m)
+			hostSourceMaps = append(hostSourceMaps, m)
 		}
 		if l := len("Host Catalog ID"); l > maxLength {
 			maxLength = l
@@ -636,11 +735,11 @@ func printItemTable(result api.GenericResult) string {
 		"",
 	)
 
-	if len(item.HostSets) > 0 {
+	if len(hostSourceMaps) > 0 {
 		ret = append(ret,
-			"  Host Sets:",
+			"  Host Sources:",
 		)
-		for _, m := range hostSetMaps {
+		for _, m := range hostSourceMaps {
 			ret = append(ret,
 				base.WrapMap(4, maxLength, m),
 				"",

internal/cmd/commands/targetscmd/targets.gen.go

@@ -213,6 +213,30 @@ func (c *Command) Run(args []string) int {
 			version = uint32(c.FlagVersion)
 		}
 
+	case "add-host-sources":
+		switch c.FlagVersion {
+		case 0:
+			opts = append(opts, targets.WithAutomaticVersioning(true))
+		default:
+			version = uint32(c.FlagVersion)
+		}
+
+	case "remove-host-sources":
+		switch c.FlagVersion {
+		case 0:
+			opts = append(opts, targets.WithAutomaticVersioning(true))
+		default:
+			version = uint32(c.FlagVersion)
+		}
+
+	case "set-host-sources":
+		switch c.FlagVersion {
+		case 0:
+			opts = append(opts, targets.WithAutomaticVersioning(true))
+		default:
+			version = uint32(c.FlagVersion)
+		}
+
 	case "add-credential-libraries":
 		switch c.FlagVersion {
 		case 0:

internal/cmd/gencli/input.go

@@ -386,7 +386,7 @@ var inputStructs = map[string][]*cmdInfo{
 			HasName:             true,
 			HasDescription:      true,
 			Container:           "Scope",
-			VersionedActions:    []string{"add-host-sets", "remove-host-sets", "set-host-sets", "add-credential-libraries", "remove-credential-libraries", "set-credential-libraries", "add-credential-sources", "remove-credential-sources", "set-credential-sources"},
+			VersionedActions:    []string{"add-host-sets", "remove-host-sets", "set-host-sets", "add-host-sources", "remove-host-sources", "set-host-sources", "add-credential-libraries", "remove-credential-libraries", "set-credential-libraries", "add-credential-sources", "remove-credential-sources", "set-credential-sources"},
 		},
 		{
 			ResourceType:         resource.Target.String(),

internal/credential/vault/jobs_test.go

@@ -844,7 +844,7 @@ func TestTokenRevocationJob_Run(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	target.TestCredentialLibrary(t, conn, tar.GetPublicId(), cl.GetPublicId())
 	sess := session.TestSession(t, conn, wrapper, session.ComposedOf{
 		UserId:      uId,
@@ -1051,7 +1051,7 @@ func TestCredentialRenewalJob_RunLimits(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	target.TestCredentialLibrary(t, conn, tar.GetPublicId(), cl.GetPublicId())
 	sess := session.TestSession(t, conn, wrapper, session.ComposedOf{
 		UserId:      uId,
@@ -1160,7 +1160,7 @@ func TestCredentialRenewalJob_Run(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	sess := session.TestSession(t, conn, wrapper, session.ComposedOf{
 		UserId:      uId,
 		HostId:      h.GetPublicId(),
@@ -1266,7 +1266,7 @@ func TestCredentialRenewalJob_RunExpired(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	sess := session.TestSession(t, conn, wrapper, session.ComposedOf{
 		UserId:      uId,
 		HostId:      h.GetPublicId(),
@@ -1339,7 +1339,7 @@ func TestCredentialRenewalJob_NextRunIn(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	target.TestCredentialLibrary(t, conn, tar.GetPublicId(), cl.GetPublicId())
 	sess := session.TestSession(t, conn, wrapper, session.ComposedOf{
 		UserId:      uId,
@@ -1592,7 +1592,7 @@ func TestCredentialRevocationJob_RunLimits(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	target.TestCredentialLibrary(t, conn, tar.GetPublicId(), cl.GetPublicId())
 	sess := session.TestSession(t, conn, wrapper, session.ComposedOf{
 		UserId:      uId,
@@ -1703,7 +1703,7 @@ func TestCredentialRevocationJob_Run(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	sess := session.TestSession(t, conn, wrapper, session.ComposedOf{
 		UserId:      uId,
 		HostId:      h.GetPublicId(),
@@ -1793,7 +1793,7 @@ func TestCredentialRevocationJob_RunDeleted(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	sess := session.TestSession(t, conn, wrapper, session.ComposedOf{
 		UserId:      uId,
 		HostId:      h.GetPublicId(),
@@ -2185,7 +2185,7 @@ func TestCredentialCleanupJob_Run(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	sess1 := session.TestSession(t, conn, wrapper, session.ComposedOf{
 		UserId:      uId,
 		HostId:      h.GetPublicId(),

internal/credential/vault/repository_credentials_test.go

@@ -103,7 +103,7 @@ func TestRepository_IssueCredentials(t *testing.T) {
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
 
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 
 	rc2dc := func(rcs []credential.Request) []*session.DynamicCredential {
 		var dcs []*session.DynamicCredential
@@ -221,7 +221,7 @@ func TestRepository_Revoke(t *testing.T) {
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
 
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	target.TestCredentialLibrary(t, conn, tar.GetPublicId(), cl.GetPublicId())
 
 	const (
@@ -339,7 +339,7 @@ func Test_TerminateSession(t *testing.T) {
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
 
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	target.TestCredentialLibrary(t, conn, tar.GetPublicId(), cl.GetPublicId())
 
 	const (

internal/credential/vault/setup_manual_test.go

@@ -97,7 +97,7 @@ func TestSetupSleepyDevEnvironment(t *testing.T) {
 	defer w1.Shutdown()
 	addr := c1.ApiAddrs()[0]
 	t.Logf("Boundary ready\n"+
-		"boundary authenticate password -addr %q -auth-method-id ampw_1234567890 -login-name admin -password passpass\n"+
+		"boundary authenticate password -addr %q -auth-method-id ampw_1234567890 -login-name admin -password password\n"+
 		"boundary connect -addr %q -target-id ttcp_1234567890 -format json\n", addr, addr)
 	time.Sleep(time.Hour)
 }

internal/credential/vault/testing_external_test.go

@@ -34,7 +34,7 @@ func Test_TestCredentials(t *testing.T) {
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
 
-	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, prj.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 	target.TestCredentialLibrary(t, conn, tar.GetPublicId(), cl.GetPublicId())
 
 	at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())

internal/gen/controller.swagger.json

@@ -2650,6 +2650,39 @@
         ]
       }
     },
+    "/v1/targets/{id}:add-host-sources": {
+      "post": {
+        "summary": "Adds existing Host Sources to a Target.",
+        "operationId": "TargetService_AddTargetHostSources",
+        "responses": {
+          "200": {
+            "description": "",
+            "schema": {
+              "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/controller.api.services.v1.AddTargetHostSourcesRequest"
+            }
+          }
+        ],
+        "tags": [
+          "controller.api.services.v1.TargetService"
+        ]
+      }
+    },
     "/v1/targets/{id}:authorize-session": {
       "post": {
         "summary": "Authorizes a Session.",
@@ -2783,6 +2816,39 @@
         ]
       }
     },
+    "/v1/targets/{id}:remove-host-sources": {
+      "post": {
+        "summary": "Removes Host Sources from the Target.",
+        "operationId": "TargetService_RemoveTargetHostSources",
+        "responses": {
+          "200": {
+            "description": "",
+            "schema": {
+              "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/controller.api.services.v1.RemoveTargetHostSourcesRequest"
+            }
+          }
+        ],
+        "tags": [
+          "controller.api.services.v1.TargetService"
+        ]
+      }
+    },
     "/v1/targets/{id}:set-credential-libraries": {
       "post": {
         "summary": "Deprecated: use SetTargetCredentialSources instead.",
@@ -2882,6 +2948,39 @@
         ]
       }
     },
+    "/v1/targets/{id}:set-host-sources": {
+      "post": {
+        "summary": "Sources the Host Sources on the Target.",
+        "operationId": "TargetService_SetTargetHostSources",
+        "responses": {
+          "200": {
+            "description": "",
+            "schema": {
+              "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/controller.api.services.v1.SetTargetHostSourcesRequest"
+            }
+          }
+        ],
+        "tags": [
+          "controller.api.services.v1.TargetService"
+        ]
+      }
+    },
     "/v1/users": {
       "get": {
         "summary": "Lists all Users.",
@@ -4320,6 +4419,21 @@
         }
       }
     },
+    "controller.api.resources.targets.v1.HostSource": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "Output only. The ID of the Host Set.",
+          "readOnly": true
+        },
+        "host_catalog_id": {
+          "type": "string",
+          "description": "Output only. The Host Catalog to which this Host Source belongs.",
+          "readOnly": true
+        }
+      }
+    },
     "controller.api.resources.targets.v1.SessionAuthorization": {
       "type": "object",
       "properties": {
@@ -4483,6 +4597,21 @@
           "description": "Output only. The Host Sets associated with this Target.",
           "readOnly": true
         },
+        "host_source_ids": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The IDs of the Host Sources associated with this Target."
+        },
+        "host_sources": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/controller.api.resources.targets.v1.HostSource"
+          },
+          "description": "Output only. The Host Sources associated with this Target.",
+          "readOnly": true
+        },
         "session_max_seconds": {
           "type": "integer",
           "format": "int64",
@@ -4836,6 +4965,33 @@
         }
       }
     },
+    "controller.api.services.v1.AddTargetHostSourcesRequest": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "version": {
+          "type": "integer",
+          "format": "int64",
+          "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
+        },
+        "host_source_ids": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "controller.api.services.v1.AddTargetHostSourcesResponse": {
+      "type": "object",
+      "properties": {
+        "item": {
+          "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+        }
+      }
+    },
     "controller.api.services.v1.AddUserAccountsRequest": {
       "type": "object",
       "properties": {
@@ -5694,6 +5850,33 @@
         }
       }
     },
+    "controller.api.services.v1.RemoveTargetHostSourcesRequest": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "version": {
+          "type": "integer",
+          "format": "int64",
+          "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
+        },
+        "host_source_ids": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "controller.api.services.v1.RemoveTargetHostSourcesResponse": {
+      "type": "object",
+      "properties": {
+        "item": {
+          "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+        }
+      }
+    },
     "controller.api.services.v1.RemoveUserAccountsRequest": {
       "type": "object",
       "properties": {
@@ -5937,6 +6120,33 @@
         }
       }
     },
+    "controller.api.services.v1.SetTargetHostSourcesRequest": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "version": {
+          "type": "integer",
+          "format": "int64",
+          "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
+        },
+        "host_source_ids": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "controller.api.services.v1.SetTargetHostSourcesResponse": {
+      "type": "object",
+      "properties": {
+        "item": {
+          "$ref": "#/definitions/controller.api.resources.targets.v1.Target"
+        }
+      }
+    },
     "controller.api.services.v1.SetUserAccountsRequest": {
       "type": "object",
       "properties": {

internal/gen/controller/api/resources/targets/target.pb.go

@@ -25,6 +25,63 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type HostSource struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Output only. The ID of the Host Set.
+	Id string `protobuf:"bytes,10,opt,name=id,proto3" json:"id,omitempty"`
+	// Output only. The Host Catalog to which this Host Source belongs.
+	HostCatalogId string `protobuf:"bytes,20,opt,name=host_catalog_id,proto3" json:"host_catalog_id,omitempty"`
+}
+
+func (x *HostSource) Reset() {
+	*x = HostSource{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HostSource) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HostSource) ProtoMessage() {}
+
+func (x *HostSource) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HostSource.ProtoReflect.Descriptor instead.
+func (*HostSource) Descriptor() ([]byte, []int) {
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *HostSource) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *HostSource) GetHostCatalogId() string {
+	if x != nil {
+		return x.HostCatalogId
+	}
+	return ""
+}
+
 type HostSet struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -39,7 +96,7 @@ type HostSet struct {
 func (x *HostSet) Reset() {
 	*x = HostSet{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[0]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -52,7 +109,7 @@ func (x *HostSet) String() string {
 func (*HostSet) ProtoMessage() {}
 
 func (x *HostSet) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[0]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -65,7 +122,7 @@ func (x *HostSet) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use HostSet.ProtoReflect.Descriptor instead.
 func (*HostSet) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{0}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *HostSet) GetId() string {
@@ -102,7 +159,7 @@ type CredentialSource struct {
 func (x *CredentialSource) Reset() {
 	*x = CredentialSource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -115,7 +172,7 @@ func (x *CredentialSource) String() string {
 func (*CredentialSource) ProtoMessage() {}
 
 func (x *CredentialSource) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[1]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -128,7 +185,7 @@ func (x *CredentialSource) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CredentialSource.ProtoReflect.Descriptor instead.
 func (*CredentialSource) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{1}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *CredentialSource) GetId() string {
@@ -186,7 +243,7 @@ type CredentialLibrary struct {
 func (x *CredentialLibrary) Reset() {
 	*x = CredentialLibrary{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -199,7 +256,7 @@ func (x *CredentialLibrary) String() string {
 func (*CredentialLibrary) ProtoMessage() {}
 
 func (x *CredentialLibrary) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[2]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -212,7 +269,7 @@ func (x *CredentialLibrary) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CredentialLibrary.ProtoReflect.Descriptor instead.
 func (*CredentialLibrary) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{2}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *CredentialLibrary) GetId() string {
@@ -266,7 +323,7 @@ type SessionSecret struct {
 func (x *SessionSecret) Reset() {
 	*x = SessionSecret{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -279,7 +336,7 @@ func (x *SessionSecret) String() string {
 func (*SessionSecret) ProtoMessage() {}
 
 func (x *SessionSecret) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[3]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -292,7 +349,7 @@ func (x *SessionSecret) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionSecret.ProtoReflect.Descriptor instead.
 func (*SessionSecret) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{3}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *SessionSecret) GetRaw() string {
@@ -328,7 +385,7 @@ type SessionCredential struct {
 func (x *SessionCredential) Reset() {
 	*x = SessionCredential{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -341,7 +398,7 @@ func (x *SessionCredential) String() string {
 func (*SessionCredential) ProtoMessage() {}
 
 func (x *SessionCredential) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[4]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -354,7 +411,7 @@ func (x *SessionCredential) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionCredential.ProtoReflect.Descriptor instead.
 func (*SessionCredential) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{4}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *SessionCredential) GetCredentialSource() *CredentialSource {
@@ -408,6 +465,10 @@ type Target struct {
 	HostSetIds []string `protobuf:"bytes,100,rep,name=host_set_ids,proto3" json:"host_set_ids,omitempty"`
 	// Output only. The Host Sets associated with this Target.
 	HostSets []*HostSet `protobuf:"bytes,110,rep,name=host_sets,proto3" json:"host_sets,omitempty"`
+	// The IDs of the Host Sources associated with this Target.
+	HostSourceIds []string `protobuf:"bytes,420,rep,name=host_source_ids,proto3" json:"host_source_ids,omitempty"`
+	// Output only. The Host Sources associated with this Target.
+	HostSources []*HostSource `protobuf:"bytes,430,rep,name=host_sources,proto3" json:"host_sources,omitempty"`
 	// Maximum total lifetime of a created Session, in seconds.
 	SessionMaxSeconds *wrapperspb.UInt32Value `protobuf:"bytes,120,opt,name=session_max_seconds,proto3" json:"session_max_seconds,omitempty"`
 	// Maximum number of connections allowed in a Session.  Unlimited is indicated by the value -1.
@@ -435,7 +496,7 @@ type Target struct {
 func (x *Target) Reset() {
 	*x = Target{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -448,7 +509,7 @@ func (x *Target) String() string {
 func (*Target) ProtoMessage() {}
 
 func (x *Target) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[5]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -461,7 +522,7 @@ func (x *Target) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Target.ProtoReflect.Descriptor instead.
 func (*Target) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{5}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *Target) GetId() string {
@@ -541,6 +602,20 @@ func (x *Target) GetHostSets() []*HostSet {
 	return nil
 }
 
+func (x *Target) GetHostSourceIds() []string {
+	if x != nil {
+		return x.HostSourceIds
+	}
+	return nil
+}
+
+func (x *Target) GetHostSources() []*HostSource {
+	if x != nil {
+		return x.HostSources
+	}
+	return nil
+}
+
 func (x *Target) GetSessionMaxSeconds() *wrapperspb.UInt32Value {
 	if x != nil {
 		return x.SessionMaxSeconds
@@ -619,7 +694,7 @@ type TcpTargetAttributes struct {
 func (x *TcpTargetAttributes) Reset() {
 	*x = TcpTargetAttributes{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -632,7 +707,7 @@ func (x *TcpTargetAttributes) String() string {
 func (*TcpTargetAttributes) ProtoMessage() {}
 
 func (x *TcpTargetAttributes) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[6]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -645,7 +720,7 @@ func (x *TcpTargetAttributes) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TcpTargetAttributes.ProtoReflect.Descriptor instead.
 func (*TcpTargetAttributes) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{6}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *TcpTargetAttributes) GetDefaultPort() *wrapperspb.UInt32Value {
@@ -668,7 +743,7 @@ type WorkerInfo struct {
 func (x *WorkerInfo) Reset() {
 	*x = WorkerInfo{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -681,7 +756,7 @@ func (x *WorkerInfo) String() string {
 func (*WorkerInfo) ProtoMessage() {}
 
 func (x *WorkerInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[7]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -694,7 +769,7 @@ func (x *WorkerInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WorkerInfo.ProtoReflect.Descriptor instead.
 func (*WorkerInfo) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{7}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *WorkerInfo) GetAddress() string {
@@ -737,7 +812,7 @@ type SessionAuthorizationData struct {
 func (x *SessionAuthorizationData) Reset() {
 	*x = SessionAuthorizationData{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -750,7 +825,7 @@ func (x *SessionAuthorizationData) String() string {
 func (*SessionAuthorizationData) ProtoMessage() {}
 
 func (x *SessionAuthorizationData) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[8]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -763,7 +838,7 @@ func (x *SessionAuthorizationData) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionAuthorizationData.ProtoReflect.Descriptor instead.
 func (*SessionAuthorizationData) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{8}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *SessionAuthorizationData) GetSessionId() string {
@@ -876,7 +951,7 @@ type SessionAuthorization struct {
 func (x *SessionAuthorization) Reset() {
 	*x = SessionAuthorization{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[9]
+		mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -889,7 +964,7 @@ func (x *SessionAuthorization) String() string {
 func (*SessionAuthorization) ProtoMessage() {}
 
 func (x *SessionAuthorization) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[9]
+	mi := &file_controller_api_resources_targets_v1_target_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -902,7 +977,7 @@ func (x *SessionAuthorization) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SessionAuthorization.ProtoReflect.Descriptor instead.
 func (*SessionAuthorization) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{9}
+	return file_controller_api_resources_targets_v1_target_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *SessionAuthorization) GetSessionId() string {
@@ -1002,229 +1077,242 @@ var file_controller_api_resources_targets_v1_target_proto_rawDesc = []byte{
 	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2a, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
 	0x65, 0x72, 0x2f, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
 	0x73, 0x2f, 0x76, 0x31, 0x2f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x22, 0x43, 0x0a, 0x07, 0x48, 0x6f, 0x73, 0x74, 0x53, 0x65, 0x74, 0x12, 0x0e, 0x0a,
-	0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x28, 0x0a,
-	0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64,
-	0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61, 0x74,
-	0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x22, 0x9e, 0x01, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x64,
-	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x0e, 0x0a, 0x02,
-	0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18,
-	0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72,
-	0x65, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x3c, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x9f, 0x01, 0x0a, 0x11, 0x43, 0x72, 0x65,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x0e,
-	0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12,
-	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74,
-	0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x3c,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x54, 0x0a, 0x0d, 0x53, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x72,
-	0x61, 0x77, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x61, 0x77, 0x12, 0x31, 0x0a,
-	0x07, 0x64, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x07, 0x64, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x64,
-	0x22, 0xae, 0x02, 0x0a, 0x11, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64,
-	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x62, 0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72,
-	0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x10, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x69, 0x0a, 0x12, 0x63, 0x72,
-	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79,
-	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
-	0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x42, 0x02,
-	0x18, 0x01, 0x52, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69,
-	0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x4a, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18,
-	0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
-	0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
-	0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65,
-	0x74, 0x22, 0xe8, 0x0b, 0x0a, 0x06, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02,
-	0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08,
-	0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70,
-	0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
-	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f,
-	0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x46, 0x0a,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74,
-	0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x14, 0xa0, 0xda, 0x29, 0x01, 0xc2,
-	0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x62, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72,
-	0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x22, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd,
-	0x29, 0x1a, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12,
-	0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65,
-	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x75, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x46, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x75, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72,
-	0x73, 0x69, 0x6f, 0x6e, 0x18, 0x50, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x5a, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f,
-	0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x64, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x68,
-	0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x4a, 0x0a, 0x09, 0x68,
-	0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2c,
-	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74,
-	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x53, 0x65, 0x74, 0x52, 0x09, 0x68, 0x6f,
-	0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x12, 0x80, 0x01, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18,
-	0x78, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x42, 0x30, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x13, 0x73,
-	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e,
-	0x64, 0x73, 0x12, 0x11, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x78, 0x53, 0x65,
-	0x63, 0x6f, 0x6e, 0x64, 0x73, 0x52, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d,
-	0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x94, 0x01, 0x0a, 0x18, 0x73,
-	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x3a, 0xa0, 0xda, 0x29,
-	0x01, 0xc2, 0xdd, 0x29, 0x32, 0x0a, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12,
-	0x16, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x52, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69,
-	0x74, 0x12, 0x6a, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74,
-	0x65, 0x72, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69,
-	0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x25, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29,
-	0x1d, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72,
-	0x12, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0d,
-	0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x53, 0x0a,
-	0x22, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f,
-	0x69, 0x64, 0x73, 0x18, 0x96, 0x01, 0x20, 0x03, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x22,
-	0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64,
-	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69,
-	0x64, 0x73, 0x12, 0x87, 0x01, 0x0a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69,
-	0x62, 0x72, 0x61, 0x72, 0x69, 0x65, 0x73, 0x18, 0xb4, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36,
+	0x74, 0x6f, 0x22, 0x46, 0x0a, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x28, 0x0a, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67,
+	0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f,
+	0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x22, 0x43, 0x0a, 0x07, 0x48, 0x6f,
+	0x73, 0x74, 0x53, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x28, 0x0a, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61,
+	0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f,
+	0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x22,
+	0x9e, 0x01, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64,
+	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x13, 0x63, 0x72,
+	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65,
+	0x22, 0x9f, 0x01, 0x0a, 0x11, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c,
+	0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x13,
+	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65,
+	0x5f, 0x69, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x12,
+	0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79,
+	0x70, 0x65, 0x22, 0x54, 0x0a, 0x0d, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63,
+	0x72, 0x65, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x61, 0x77, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x72, 0x61, 0x77, 0x12, 0x31, 0x0a, 0x07, 0x64, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x64,
+	0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52,
+	0x07, 0x64, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x64, 0x22, 0xae, 0x02, 0x0a, 0x11, 0x53, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x62,
+	0x0a, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e,
+	0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x52, 0x10, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x12, 0x69, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
+	0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x36,
 	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e,
 	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74,
 	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c,
-	0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x42, 0x02, 0x18, 0x01, 0x52, 0x20, 0x61, 0x70, 0x70, 0x6c,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x69, 0x65, 0x73, 0x12, 0x4d, 0x0a, 0x21,
-	0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64,
-	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64,
-	0x73, 0x18, 0x90, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x21, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63,
+	0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x42, 0x02, 0x18, 0x01, 0x52, 0x11, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x4a, 0x0a,
+	0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73,
+	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x72, 0x65,
+	0x74, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x22, 0xe9, 0x0c, 0x0a, 0x06, 0x54, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64,
+	0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64,
+	0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65,
+	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05,
+	0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x46, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x28, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x42, 0x14, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x62, 0x0a,
+	0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x32, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x42, 0x22, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d,
+	0x65, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74,
+	0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d,
+	0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d,
+	0x65, 0x18, 0x46, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74,
+	0x61, 0x6d, 0x70, 0x52, 0x0c, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d,
+	0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x50, 0x20, 0x01,
+	0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74,
+	0x79, 0x70, 0x65, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12,
+	0x22, 0x0a, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x18,
+	0x64, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f,
+	0x69, 0x64, 0x73, 0x12, 0x4a, 0x0a, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73,
+	0x18, 0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
+	0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x6f, 0x73,
+	0x74, 0x53, 0x65, 0x74, 0x52, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x12,
+	0x29, 0x0a, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0xa4, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x54, 0x0a, 0x0c, 0x68, 0x6f,
+	0x73, 0x74, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0xae, 0x03, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72,
+	0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x53, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x52, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x12, 0x80, 0x01, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78,
+	0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x78, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x30, 0xa0, 0xda,
+	0x29, 0x01, 0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f,
+	0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x11, 0x53, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x78, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x52, 0x13,
+	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f,
+	0x6e, 0x64, 0x73, 0x12, 0x94, 0x01, 0x0a, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f,
+	0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74,
+	0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x42, 0x3a, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x32, 0x0a, 0x18,
+	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x16, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4c, 0x69, 0x6d, 0x69, 0x74,
+	0x52, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x6a, 0x0a, 0x0d, 0x77, 0x6f,
+	0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x8c, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x42, 0x25, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x1d, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b,
+	0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f,
+	0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x53, 0x0a, 0x22, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63,
 	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x7e, 0x0a, 0x1e, 0x61,
-	0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x9a, 0x03,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
-	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e,
-	0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x1e, 0x61, 0x70, 0x70,
-	0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x0a, 0x61,
-	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0xc8, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x42, 0x04, 0xa0, 0xda, 0x29, 0x01, 0x52,
-	0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x2f, 0x0a, 0x12, 0x61,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x18, 0xac, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x87, 0x01, 0x0a,
-	0x13, 0x54, 0x63, 0x70, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62,
-	0x75, 0x74, 0x65, 0x73, 0x12, 0x70, 0x0a, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f,
-	0x70, 0x6f, 0x72, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e,
-	0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x2e, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd,
-	0x29, 0x26, 0x0a, 0x17, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x64,
-	0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x0b, 0x44, 0x65, 0x66,
-	0x61, 0x75, 0x6c, 0x74, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c,
-	0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x22, 0x26, 0x0a, 0x0a, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72,
-	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18,
-	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x22, 0xed,
-	0x03, 0x0a, 0x18, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x12, 0x1e, 0x0a, 0x0a, 0x73,
-	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x74,
-	0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
-	0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f,
-	0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
-	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63,
-	0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x3e,
-	0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x12,
-	0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79,
-	0x70, 0x65, 0x12, 0x2a, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x05, 0x52, 0x10, 0x63, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x20,
-	0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x78, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x12, 0x21, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18,
-	0x82, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f,
-	0x6b, 0x65, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x8c,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x68, 0x6f, 0x73, 0x74, 0x49, 0x64, 0x12, 0x1b, 0x0a,
-	0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x8d, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x52, 0x0a, 0x0b, 0x77, 0x6f,
-	0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x96, 0x01, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67,
-	0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66,
-	0x6f, 0x52, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x22, 0xeb,
-	0x03, 0x0a, 0x14, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69,
-	0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65,
-	0x74, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x61, 0x72, 0x67,
-	0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
-	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e,
-	0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49,
-	0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x75, 0x73,
-	0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x75, 0x73, 0x65,
-	0x72, 0x5f, 0x69, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74,
-	0x5f, 0x69, 0x64, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f,
-	0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69,
-	0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64,
-	0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x74, 0x79, 0x70, 0x65, 0x12, 0x30, 0x0a, 0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x5a, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69,
-	0x6e, 0x74, 0x18, 0x64, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69,
-	0x6e, 0x74, 0x12, 0x58, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x73, 0x18, 0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x96, 0x01, 0x20,
+	0x03, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x22, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f,
+	0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x87, 0x01, 0x0a, 0x20,
+	0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x69, 0x65, 0x73,
+	0x18, 0xb4, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
 	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52,
-	0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x42, 0x55, 0x5a, 0x53,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69,
-	0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72,
-	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x73, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x3b, 0x74, 0x61, 0x72, 0x67,
-	0x65, 0x74, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72,
+	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x42,
+	0x02, 0x18, 0x01, 0x52, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72,
+	0x61, 0x72, 0x69, 0x65, 0x73, 0x12, 0x4d, 0x0a, 0x21, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x90, 0x03, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x21, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x5f, 0x69, 0x64, 0x73, 0x12, 0x7e, 0x0a, 0x1e, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x9a, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73,
+	0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x52, 0x1e, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x73, 0x18, 0xc8, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75,
+	0x63, 0x74, 0x42, 0x04, 0xa0, 0xda, 0x29, 0x01, 0x52, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
+	0x75, 0x74, 0x65, 0x73, 0x12, 0x2f, 0x0a, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
+	0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xac, 0x02, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x87, 0x01, 0x0a, 0x13, 0x54, 0x63, 0x70, 0x54, 0x61, 0x72,
+	0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x70, 0x0a,
+	0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x42, 0x2e, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x26, 0x0a, 0x17, 0x61, 0x74, 0x74,
+	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f,
+	0x70, 0x6f, 0x72, 0x74, 0x12, 0x0b, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x6f, 0x72,
+	0x74, 0x52, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x22,
+	0x26, 0x0a, 0x0a, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x18, 0x0a,
+	0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x22, 0xed, 0x03, 0x0a, 0x18, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x44, 0x61, 0x74, 0x61, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f,
+	0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x5f, 0x69, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69,
+	0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f,
+	0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f,
+	0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f,
+	0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x50, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x2a, 0x0a, 0x10, 0x63,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18,
+	0x5a, 0x20, 0x01, 0x28, 0x05, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x20, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x78, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x63, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x21, 0x0a, 0x0b, 0x70, 0x72, 0x69,
+	0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x12, 0x18, 0x0a, 0x07,
+	0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
+	0x68, 0x6f, 0x73, 0x74, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69,
+	0x6e, 0x74, 0x18, 0x8d, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f,
+	0x69, 0x6e, 0x74, 0x12, 0x52, 0x0a, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x6e,
+	0x66, 0x6f, 0x18, 0x96, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e,
+	0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0b, 0x77, 0x6f, 0x72, 0x6b,
+	0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x22, 0xeb, 0x03, 0x0a, 0x14, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64,
+	0x12, 0x1c, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x43,
+	0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63,
+	0x6f, 0x70, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74,
+	0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74,
+	0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x32,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x12, 0x20, 0x0a,
+	0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x3c, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12,
+	0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x30, 0x0a,
+	0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74,
+	0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x61, 0x75, 0x74, 0x68,
+	0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12,
+	0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x64, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x58, 0x0a, 0x0b, 0x63,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x18, 0x6e, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67,
+	0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72,
+	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x73, 0x42, 0x55, 0x5a, 0x53, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f,
+	0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f,
+	0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x74, 0x61, 0x72,
+	0x67, 0x65, 0x74, 0x73, 0x3b, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1239,54 +1327,56 @@ func file_controller_api_resources_targets_v1_target_proto_rawDescGZIP() []byte
 	return file_controller_api_resources_targets_v1_target_proto_rawDescData
 }
 
-var file_controller_api_resources_targets_v1_target_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_controller_api_resources_targets_v1_target_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_controller_api_resources_targets_v1_target_proto_goTypes = []interface{}{
-	(*HostSet)(nil),                  // 0: controller.api.resources.targets.v1.HostSet
-	(*CredentialSource)(nil),         // 1: controller.api.resources.targets.v1.CredentialSource
-	(*CredentialLibrary)(nil),        // 2: controller.api.resources.targets.v1.CredentialLibrary
-	(*SessionSecret)(nil),            // 3: controller.api.resources.targets.v1.SessionSecret
-	(*SessionCredential)(nil),        // 4: controller.api.resources.targets.v1.SessionCredential
-	(*Target)(nil),                   // 5: controller.api.resources.targets.v1.Target
-	(*TcpTargetAttributes)(nil),      // 6: controller.api.resources.targets.v1.TcpTargetAttributes
-	(*WorkerInfo)(nil),               // 7: controller.api.resources.targets.v1.WorkerInfo
-	(*SessionAuthorizationData)(nil), // 8: controller.api.resources.targets.v1.SessionAuthorizationData
-	(*SessionAuthorization)(nil),     // 9: controller.api.resources.targets.v1.SessionAuthorization
-	(*structpb.Struct)(nil),          // 10: google.protobuf.Struct
-	(*scopes.ScopeInfo)(nil),         // 11: controller.api.resources.scopes.v1.ScopeInfo
-	(*wrapperspb.StringValue)(nil),   // 12: google.protobuf.StringValue
-	(*timestamppb.Timestamp)(nil),    // 13: google.protobuf.Timestamp
-	(*wrapperspb.UInt32Value)(nil),   // 14: google.protobuf.UInt32Value
-	(*wrapperspb.Int32Value)(nil),    // 15: google.protobuf.Int32Value
+	(*HostSource)(nil),               // 0: controller.api.resources.targets.v1.HostSource
+	(*HostSet)(nil),                  // 1: controller.api.resources.targets.v1.HostSet
+	(*CredentialSource)(nil),         // 2: controller.api.resources.targets.v1.CredentialSource
+	(*CredentialLibrary)(nil),        // 3: controller.api.resources.targets.v1.CredentialLibrary
+	(*SessionSecret)(nil),            // 4: controller.api.resources.targets.v1.SessionSecret
+	(*SessionCredential)(nil),        // 5: controller.api.resources.targets.v1.SessionCredential
+	(*Target)(nil),                   // 6: controller.api.resources.targets.v1.Target
+	(*TcpTargetAttributes)(nil),      // 7: controller.api.resources.targets.v1.TcpTargetAttributes
+	(*WorkerInfo)(nil),               // 8: controller.api.resources.targets.v1.WorkerInfo
+	(*SessionAuthorizationData)(nil), // 9: controller.api.resources.targets.v1.SessionAuthorizationData
+	(*SessionAuthorization)(nil),     // 10: controller.api.resources.targets.v1.SessionAuthorization
+	(*structpb.Struct)(nil),          // 11: google.protobuf.Struct
+	(*scopes.ScopeInfo)(nil),         // 12: controller.api.resources.scopes.v1.ScopeInfo
+	(*wrapperspb.StringValue)(nil),   // 13: google.protobuf.StringValue
+	(*timestamppb.Timestamp)(nil),    // 14: google.protobuf.Timestamp
+	(*wrapperspb.UInt32Value)(nil),   // 15: google.protobuf.UInt32Value
+	(*wrapperspb.Int32Value)(nil),    // 16: google.protobuf.Int32Value
 }
 var file_controller_api_resources_targets_v1_target_proto_depIdxs = []int32{
-	10, // 0: controller.api.resources.targets.v1.SessionSecret.decoded:type_name -> google.protobuf.Struct
-	1,  // 1: controller.api.resources.targets.v1.SessionCredential.credential_source:type_name -> controller.api.resources.targets.v1.CredentialSource
-	2,  // 2: controller.api.resources.targets.v1.SessionCredential.credential_library:type_name -> controller.api.resources.targets.v1.CredentialLibrary
-	3,  // 3: controller.api.resources.targets.v1.SessionCredential.secret:type_name -> controller.api.resources.targets.v1.SessionSecret
-	11, // 4: controller.api.resources.targets.v1.Target.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	12, // 5: controller.api.resources.targets.v1.Target.name:type_name -> google.protobuf.StringValue
-	12, // 6: controller.api.resources.targets.v1.Target.description:type_name -> google.protobuf.StringValue
-	13, // 7: controller.api.resources.targets.v1.Target.created_time:type_name -> google.protobuf.Timestamp
-	13, // 8: controller.api.resources.targets.v1.Target.updated_time:type_name -> google.protobuf.Timestamp
-	0,  // 9: controller.api.resources.targets.v1.Target.host_sets:type_name -> controller.api.resources.targets.v1.HostSet
-	14, // 10: controller.api.resources.targets.v1.Target.session_max_seconds:type_name -> google.protobuf.UInt32Value
-	15, // 11: controller.api.resources.targets.v1.Target.session_connection_limit:type_name -> google.protobuf.Int32Value
-	12, // 12: controller.api.resources.targets.v1.Target.worker_filter:type_name -> google.protobuf.StringValue
-	2,  // 13: controller.api.resources.targets.v1.Target.application_credential_libraries:type_name -> controller.api.resources.targets.v1.CredentialLibrary
-	1,  // 14: controller.api.resources.targets.v1.Target.application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
-	10, // 15: controller.api.resources.targets.v1.Target.attributes:type_name -> google.protobuf.Struct
-	14, // 16: controller.api.resources.targets.v1.TcpTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
-	11, // 17: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	13, // 18: controller.api.resources.targets.v1.SessionAuthorizationData.created_time:type_name -> google.protobuf.Timestamp
-	7,  // 19: controller.api.resources.targets.v1.SessionAuthorizationData.worker_info:type_name -> controller.api.resources.targets.v1.WorkerInfo
-	11, // 20: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	13, // 21: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp
-	4,  // 22: controller.api.resources.targets.v1.SessionAuthorization.credentials:type_name -> controller.api.resources.targets.v1.SessionCredential
-	23, // [23:23] is the sub-list for method output_type
-	23, // [23:23] is the sub-list for method input_type
-	23, // [23:23] is the sub-list for extension type_name
-	23, // [23:23] is the sub-list for extension extendee
-	0,  // [0:23] is the sub-list for field type_name
+	11, // 0: controller.api.resources.targets.v1.SessionSecret.decoded:type_name -> google.protobuf.Struct
+	2,  // 1: controller.api.resources.targets.v1.SessionCredential.credential_source:type_name -> controller.api.resources.targets.v1.CredentialSource
+	3,  // 2: controller.api.resources.targets.v1.SessionCredential.credential_library:type_name -> controller.api.resources.targets.v1.CredentialLibrary
+	4,  // 3: controller.api.resources.targets.v1.SessionCredential.secret:type_name -> controller.api.resources.targets.v1.SessionSecret
+	12, // 4: controller.api.resources.targets.v1.Target.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	13, // 5: controller.api.resources.targets.v1.Target.name:type_name -> google.protobuf.StringValue
+	13, // 6: controller.api.resources.targets.v1.Target.description:type_name -> google.protobuf.StringValue
+	14, // 7: controller.api.resources.targets.v1.Target.created_time:type_name -> google.protobuf.Timestamp
+	14, // 8: controller.api.resources.targets.v1.Target.updated_time:type_name -> google.protobuf.Timestamp
+	1,  // 9: controller.api.resources.targets.v1.Target.host_sets:type_name -> controller.api.resources.targets.v1.HostSet
+	0,  // 10: controller.api.resources.targets.v1.Target.host_sources:type_name -> controller.api.resources.targets.v1.HostSource
+	15, // 11: controller.api.resources.targets.v1.Target.session_max_seconds:type_name -> google.protobuf.UInt32Value
+	16, // 12: controller.api.resources.targets.v1.Target.session_connection_limit:type_name -> google.protobuf.Int32Value
+	13, // 13: controller.api.resources.targets.v1.Target.worker_filter:type_name -> google.protobuf.StringValue
+	3,  // 14: controller.api.resources.targets.v1.Target.application_credential_libraries:type_name -> controller.api.resources.targets.v1.CredentialLibrary
+	2,  // 15: controller.api.resources.targets.v1.Target.application_credential_sources:type_name -> controller.api.resources.targets.v1.CredentialSource
+	11, // 16: controller.api.resources.targets.v1.Target.attributes:type_name -> google.protobuf.Struct
+	15, // 17: controller.api.resources.targets.v1.TcpTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
+	12, // 18: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	14, // 19: controller.api.resources.targets.v1.SessionAuthorizationData.created_time:type_name -> google.protobuf.Timestamp
+	8,  // 20: controller.api.resources.targets.v1.SessionAuthorizationData.worker_info:type_name -> controller.api.resources.targets.v1.WorkerInfo
+	12, // 21: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	14, // 22: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp
+	5,  // 23: controller.api.resources.targets.v1.SessionAuthorization.credentials:type_name -> controller.api.resources.targets.v1.SessionCredential
+	24, // [24:24] is the sub-list for method output_type
+	24, // [24:24] is the sub-list for method input_type
+	24, // [24:24] is the sub-list for extension type_name
+	24, // [24:24] is the sub-list for extension extendee
+	0,  // [0:24] is the sub-list for field type_name
 }
 
 func init() { file_controller_api_resources_targets_v1_target_proto_init() }
@@ -1296,7 +1386,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 	}
 	if !protoimpl.UnsafeEnabled {
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HostSet); i {
+			switch v := v.(*HostSource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1308,7 +1398,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CredentialSource); i {
+			switch v := v.(*HostSet); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1320,7 +1410,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CredentialLibrary); i {
+			switch v := v.(*CredentialSource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1332,7 +1422,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SessionSecret); i {
+			switch v := v.(*CredentialLibrary); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1344,7 +1434,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SessionCredential); i {
+			switch v := v.(*SessionSecret); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1356,7 +1446,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Target); i {
+			switch v := v.(*SessionCredential); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1368,7 +1458,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TcpTargetAttributes); i {
+			switch v := v.(*Target); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1380,7 +1470,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WorkerInfo); i {
+			switch v := v.(*TcpTargetAttributes); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1392,7 +1482,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SessionAuthorizationData); i {
+			switch v := v.(*WorkerInfo); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1404,6 +1494,18 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			}
 		}
 		file_controller_api_resources_targets_v1_target_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SessionAuthorizationData); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_controller_api_resources_targets_v1_target_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*SessionAuthorization); i {
 			case 0:
 				return &v.state
@@ -1422,7 +1524,7 @@ func file_controller_api_resources_targets_v1_target_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_controller_api_resources_targets_v1_target_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   10,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

internal/gen/controller/api/services/target_service.pb.gw.go

@@ -577,6 +577,210 @@ func local_request_TargetService_RemoveTargetHostSets_0(ctx context.Context, mar
 
 }
 
+func request_TargetService_AddTargetHostSources_0(ctx context.Context, marshaler runtime.Marshaler, client TargetServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq AddTargetHostSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := client.AddTargetHostSources(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_TargetService_AddTargetHostSources_0(ctx context.Context, marshaler runtime.Marshaler, server TargetServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq AddTargetHostSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := server.AddTargetHostSources(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_TargetService_SetTargetHostSources_0(ctx context.Context, marshaler runtime.Marshaler, client TargetServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SetTargetHostSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := client.SetTargetHostSources(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_TargetService_SetTargetHostSources_0(ctx context.Context, marshaler runtime.Marshaler, server TargetServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SetTargetHostSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := server.SetTargetHostSources(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_TargetService_RemoveTargetHostSources_0(ctx context.Context, marshaler runtime.Marshaler, client TargetServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq RemoveTargetHostSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := client.RemoveTargetHostSources(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_TargetService_RemoveTargetHostSources_0(ctx context.Context, marshaler runtime.Marshaler, server TargetServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq RemoveTargetHostSourcesRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := server.RemoveTargetHostSources(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
 func request_TargetService_AddTargetCredentialLibraries_0(ctx context.Context, marshaler runtime.Marshaler, client TargetServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq AddTargetCredentialLibrariesRequest
 	var metadata runtime.ServerMetadata
@@ -1198,6 +1402,75 @@ func RegisterTargetServiceHandlerServer(ctx context.Context, mux *runtime.ServeM
 
 	})
 
+	mux.Handle("POST", pattern_TargetService_AddTargetHostSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.TargetService/AddTargetHostSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_TargetService_AddTargetHostSources_0(rctx, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_AddTargetHostSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_AddTargetHostSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_TargetService_SetTargetHostSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.TargetService/SetTargetHostSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_TargetService_SetTargetHostSources_0(rctx, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_SetTargetHostSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_SetTargetHostSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_TargetService_RemoveTargetHostSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.TargetService/RemoveTargetHostSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_TargetService_RemoveTargetHostSources_0(rctx, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_RemoveTargetHostSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_RemoveTargetHostSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
 	mux.Handle("POST", pattern_TargetService_AddTargetCredentialLibraries_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -1557,6 +1830,66 @@ func RegisterTargetServiceHandlerClient(ctx context.Context, mux *runtime.ServeM
 
 	})
 
+	mux.Handle("POST", pattern_TargetService_AddTargetHostSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.TargetService/AddTargetHostSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_TargetService_AddTargetHostSources_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_AddTargetHostSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_AddTargetHostSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_TargetService_SetTargetHostSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.TargetService/SetTargetHostSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_TargetService_SetTargetHostSources_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_SetTargetHostSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_SetTargetHostSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_TargetService_RemoveTargetHostSources_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.TargetService/RemoveTargetHostSources")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_TargetService_RemoveTargetHostSources_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TargetService_RemoveTargetHostSources_0(ctx, mux, outboundMarshaler, w, req, response_TargetService_RemoveTargetHostSources_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
 	mux.Handle("POST", pattern_TargetService_AddTargetCredentialLibraries_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -1743,6 +2076,33 @@ func (m response_TargetService_RemoveTargetHostSets_0) XXX_ResponseBody() interf
 	return response.Item
 }
 
+type response_TargetService_AddTargetHostSources_0 struct {
+	proto.Message
+}
+
+func (m response_TargetService_AddTargetHostSources_0) XXX_ResponseBody() interface{} {
+	response := m.Message.(*AddTargetHostSourcesResponse)
+	return response.Item
+}
+
+type response_TargetService_SetTargetHostSources_0 struct {
+	proto.Message
+}
+
+func (m response_TargetService_SetTargetHostSources_0) XXX_ResponseBody() interface{} {
+	response := m.Message.(*SetTargetHostSourcesResponse)
+	return response.Item
+}
+
+type response_TargetService_RemoveTargetHostSources_0 struct {
+	proto.Message
+}
+
+func (m response_TargetService_RemoveTargetHostSources_0) XXX_ResponseBody() interface{} {
+	response := m.Message.(*RemoveTargetHostSourcesResponse)
+	return response.Item
+}
+
 type response_TargetService_AddTargetCredentialLibraries_0 struct {
 	proto.Message
 }
@@ -1816,6 +2176,12 @@ var (
 
 	pattern_TargetService_RemoveTargetHostSets_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "remove-host-sets"))
 
+	pattern_TargetService_AddTargetHostSources_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "add-host-sources"))
+
+	pattern_TargetService_SetTargetHostSources_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "set-host-sources"))
+
+	pattern_TargetService_RemoveTargetHostSources_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "remove-host-sources"))
+
 	pattern_TargetService_AddTargetCredentialLibraries_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "add-credential-libraries"))
 
 	pattern_TargetService_SetTargetCredentialLibraries_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "targets", "id"}, "set-credential-libraries"))
@@ -1848,6 +2214,12 @@ var (
 
 	forward_TargetService_RemoveTargetHostSets_0 = runtime.ForwardResponseMessage
 
+	forward_TargetService_AddTargetHostSources_0 = runtime.ForwardResponseMessage
+
+	forward_TargetService_SetTargetHostSources_0 = runtime.ForwardResponseMessage
+
+	forward_TargetService_RemoveTargetHostSources_0 = runtime.ForwardResponseMessage
+
 	forward_TargetService_AddTargetCredentialLibraries_0 = runtime.ForwardResponseMessage
 
 	forward_TargetService_SetTargetCredentialLibraries_0 = runtime.ForwardResponseMessage

internal/gen/controller/api/services/target_service_grpc.pb.go

@@ -71,6 +71,29 @@ type TargetServiceClient interface {
 	// returned.  An error is returned if a Host Set is attempted to be
 	// removed from the Target when the Target does not have the Host Set.
 	RemoveTargetHostSets(ctx context.Context, in *RemoveTargetHostSetsRequest, opts ...grpc.CallOption) (*RemoveTargetHostSetsResponse, error)
+	// AddTargetHostSources adds Host Sources to this Target. The provided request
+	// must include the Target ID to which the Host Sources will be added. All
+	// Host Sources added to the provided Target must be a child of a Catalog that
+	// is a child of the same scope as this Target. If the scope or Target IDs are
+	// missing, malformed, or reference non-existing resources, an error is
+	// returned. An error is returned if a Host Source is attempted to be added to a
+	// target that is already present on the Target.
+	AddTargetHostSources(ctx context.Context, in *AddTargetHostSourcesRequest, opts ...grpc.CallOption) (*AddTargetHostSourcesResponse, error)
+	// SetTargetHostSources sets the Target's Host Sources. Any existing Host
+	// Sources on the Target are deleted if they are not included in this request.
+	// The provided request must include the scope, and the Target ID on which the
+	// Host Sources will be set. All Host Sources in the request must be a child
+	// of a Catalog that is in the same scope as the provided Target. If any IDs
+	// are missing, malformed, or references a non-existing resource, an error is
+	// returned.
+	SetTargetHostSources(ctx context.Context, in *SetTargetHostSourcesRequest, opts ...grpc.CallOption) (*SetTargetHostSourcesResponse, error)
+	// RemoveTargetHostSources removes the Host Sources from the specified Target.
+	// The provided request must include the Target ID for the Target from which
+	// the Host Sources will be removed. If the ID is missing, malformed, or
+	// references a non-existing scope or Catalog, an error is returned.  An error
+	// is returned if a Host Source is attempted to be removed from the Target
+	// when the Target does not have the Host Set.
+	RemoveTargetHostSources(ctx context.Context, in *RemoveTargetHostSourcesRequest, opts ...grpc.CallOption) (*RemoveTargetHostSourcesResponse, error)
 	// Deprecated: Do not use.
 	// AddTargetCredentialLibraries adds Credential Libraries to this Target.
 	// The provided request must include the Target ID to which the Credential
@@ -119,7 +142,7 @@ type TargetServiceClient interface {
 	// specified Target. The provided request must include the Target ID for the
 	// Target from which the Credential Sources will be removed. If the ID is
 	// missing, or malformed, an error is returned.  An error is returned if a
-	// Credential Library is attempted to be removed from the Target when the
+	// Credential Source is attempted to be removed from the Target when the
 	// Target does not have the Credential Source.
 	RemoveTargetCredentialSources(ctx context.Context, in *RemoveTargetCredentialSourcesRequest, opts ...grpc.CallOption) (*RemoveTargetCredentialSourcesResponse, error)
 }
@@ -213,6 +236,33 @@ func (c *targetServiceClient) RemoveTargetHostSets(ctx context.Context, in *Remo
 	return out, nil
 }
 
+func (c *targetServiceClient) AddTargetHostSources(ctx context.Context, in *AddTargetHostSourcesRequest, opts ...grpc.CallOption) (*AddTargetHostSourcesResponse, error) {
+	out := new(AddTargetHostSourcesResponse)
+	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/AddTargetHostSources", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *targetServiceClient) SetTargetHostSources(ctx context.Context, in *SetTargetHostSourcesRequest, opts ...grpc.CallOption) (*SetTargetHostSourcesResponse, error) {
+	out := new(SetTargetHostSourcesResponse)
+	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/SetTargetHostSources", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *targetServiceClient) RemoveTargetHostSources(ctx context.Context, in *RemoveTargetHostSourcesRequest, opts ...grpc.CallOption) (*RemoveTargetHostSourcesResponse, error) {
+	out := new(RemoveTargetHostSourcesResponse)
+	err := c.cc.Invoke(ctx, "/controller.api.services.v1.TargetService/RemoveTargetHostSources", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // Deprecated: Do not use.
 func (c *targetServiceClient) AddTargetCredentialLibraries(ctx context.Context, in *AddTargetCredentialLibrariesRequest, opts ...grpc.CallOption) (*AddTargetCredentialLibrariesResponse, error) {
 	out := new(AddTargetCredentialLibrariesResponse)
@@ -327,6 +377,29 @@ type TargetServiceServer interface {
 	// returned.  An error is returned if a Host Set is attempted to be
 	// removed from the Target when the Target does not have the Host Set.
 	RemoveTargetHostSets(context.Context, *RemoveTargetHostSetsRequest) (*RemoveTargetHostSetsResponse, error)
+	// AddTargetHostSources adds Host Sources to this Target. The provided request
+	// must include the Target ID to which the Host Sources will be added. All
+	// Host Sources added to the provided Target must be a child of a Catalog that
+	// is a child of the same scope as this Target. If the scope or Target IDs are
+	// missing, malformed, or reference non-existing resources, an error is
+	// returned. An error is returned if a Host Source is attempted to be added to a
+	// target that is already present on the Target.
+	AddTargetHostSources(context.Context, *AddTargetHostSourcesRequest) (*AddTargetHostSourcesResponse, error)
+	// SetTargetHostSources sets the Target's Host Sources. Any existing Host
+	// Sources on the Target are deleted if they are not included in this request.
+	// The provided request must include the scope, and the Target ID on which the
+	// Host Sources will be set. All Host Sources in the request must be a child
+	// of a Catalog that is in the same scope as the provided Target. If any IDs
+	// are missing, malformed, or references a non-existing resource, an error is
+	// returned.
+	SetTargetHostSources(context.Context, *SetTargetHostSourcesRequest) (*SetTargetHostSourcesResponse, error)
+	// RemoveTargetHostSources removes the Host Sources from the specified Target.
+	// The provided request must include the Target ID for the Target from which
+	// the Host Sources will be removed. If the ID is missing, malformed, or
+	// references a non-existing scope or Catalog, an error is returned.  An error
+	// is returned if a Host Source is attempted to be removed from the Target
+	// when the Target does not have the Host Set.
+	RemoveTargetHostSources(context.Context, *RemoveTargetHostSourcesRequest) (*RemoveTargetHostSourcesResponse, error)
 	// Deprecated: Do not use.
 	// AddTargetCredentialLibraries adds Credential Libraries to this Target.
 	// The provided request must include the Target ID to which the Credential
@@ -375,7 +448,7 @@ type TargetServiceServer interface {
 	// specified Target. The provided request must include the Target ID for the
 	// Target from which the Credential Sources will be removed. If the ID is
 	// missing, or malformed, an error is returned.  An error is returned if a
-	// Credential Library is attempted to be removed from the Target when the
+	// Credential Source is attempted to be removed from the Target when the
 	// Target does not have the Credential Source.
 	RemoveTargetCredentialSources(context.Context, *RemoveTargetCredentialSourcesRequest) (*RemoveTargetCredentialSourcesResponse, error)
 	mustEmbedUnimplementedTargetServiceServer()
@@ -412,6 +485,15 @@ func (UnimplementedTargetServiceServer) SetTargetHostSets(context.Context, *SetT
 func (UnimplementedTargetServiceServer) RemoveTargetHostSets(context.Context, *RemoveTargetHostSetsRequest) (*RemoveTargetHostSetsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RemoveTargetHostSets not implemented")
 }
+func (UnimplementedTargetServiceServer) AddTargetHostSources(context.Context, *AddTargetHostSourcesRequest) (*AddTargetHostSourcesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AddTargetHostSources not implemented")
+}
+func (UnimplementedTargetServiceServer) SetTargetHostSources(context.Context, *SetTargetHostSourcesRequest) (*SetTargetHostSourcesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SetTargetHostSources not implemented")
+}
+func (UnimplementedTargetServiceServer) RemoveTargetHostSources(context.Context, *RemoveTargetHostSourcesRequest) (*RemoveTargetHostSourcesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveTargetHostSources not implemented")
+}
 func (UnimplementedTargetServiceServer) AddTargetCredentialLibraries(context.Context, *AddTargetCredentialLibrariesRequest) (*AddTargetCredentialLibrariesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method AddTargetCredentialLibraries not implemented")
 }
@@ -605,6 +687,60 @@ func _TargetService_RemoveTargetHostSets_Handler(srv interface{}, ctx context.Co
 	return interceptor(ctx, in, info, handler)
 }
 
+func _TargetService_AddTargetHostSources_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AddTargetHostSourcesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TargetServiceServer).AddTargetHostSources(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/controller.api.services.v1.TargetService/AddTargetHostSources",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TargetServiceServer).AddTargetHostSources(ctx, req.(*AddTargetHostSourcesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TargetService_SetTargetHostSources_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetTargetHostSourcesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TargetServiceServer).SetTargetHostSources(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/controller.api.services.v1.TargetService/SetTargetHostSources",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TargetServiceServer).SetTargetHostSources(ctx, req.(*SetTargetHostSourcesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TargetService_RemoveTargetHostSources_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveTargetHostSourcesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TargetServiceServer).RemoveTargetHostSources(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/controller.api.services.v1.TargetService/RemoveTargetHostSources",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TargetServiceServer).RemoveTargetHostSources(ctx, req.(*RemoveTargetHostSourcesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _TargetService_AddTargetCredentialLibraries_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(AddTargetCredentialLibrariesRequest)
 	if err := dec(in); err != nil {
@@ -756,6 +892,18 @@ var TargetService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "RemoveTargetHostSets",
 			Handler:    _TargetService_RemoveTargetHostSets_Handler,
 		},
+		{
+			MethodName: "AddTargetHostSources",
+			Handler:    _TargetService_AddTargetHostSources_Handler,
+		},
+		{
+			MethodName: "SetTargetHostSources",
+			Handler:    _TargetService_SetTargetHostSources_Handler,
+		},
+		{
+			MethodName: "RemoveTargetHostSources",
+			Handler:    _TargetService_RemoveTargetHostSources_Handler,
+		},
 		{
 			MethodName: "AddTargetCredentialLibraries",
 			Handler:    _TargetService_AddTargetCredentialLibraries_Handler,

internal/proto/local/controller/api/resources/targets/v1/target.proto

@@ -10,6 +10,14 @@ import "google/protobuf/struct.proto";
 import "controller/api/resources/scopes/v1/scope.proto";
 import "controller/custom_options/v1/options.proto";
 
+message HostSource {
+	// Output only. The ID of the Host Set.
+	string id = 10;
+
+	// Output only. The Host Catalog to which this Host Source belongs.
+	string host_catalog_id = 20 [json_name="host_catalog_id"];
+}
+
 message HostSet {
 	// Output only. The ID of the Host Set.
 	string id = 10;
@@ -110,6 +118,12 @@ message Target {
 	// Output only. The Host Sets associated with this Target.
 	repeated HostSet host_sets = 110 [json_name="host_sets"];
 
+	// The IDs of the Host Sources associated with this Target.
+	repeated string host_source_ids = 420 [json_name="host_source_ids"];
+
+	// Output only. The Host Sources associated with this Target.
+	repeated HostSource host_sources = 430 [json_name="host_sources"];
+
 	// Maximum total lifetime of a created Session, in seconds.
 	google.protobuf.UInt32Value session_max_seconds = 120 [json_name="session_max_seconds", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this: "session_max_seconds" that: "SessionMaxSeconds"}];
 

internal/proto/local/controller/api/services/v1/target_service.proto

@@ -149,6 +149,60 @@ service TargetService {
     };
   }
 
+  // AddTargetHostSources adds Host Sources to this Target. The provided request
+  // must include the Target ID to which the Host Sources will be added. All
+  // Host Sources added to the provided Target must be a child of a Catalog that
+  // is a child of the same scope as this Target. If the scope or Target IDs are
+  // missing, malformed, or reference non-existing resources, an error is
+  // returned. An error is returned if a Host Source is attempted to be added to a
+  // target that is already present on the Target.
+  rpc AddTargetHostSources(AddTargetHostSourcesRequest) returns (AddTargetHostSourcesResponse) {
+    option (google.api.http) = {
+      post: "/v1/targets/{id}:add-host-sources"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Adds existing Host Sources to a Target."
+    };
+  }
+
+  // SetTargetHostSources sets the Target's Host Sources. Any existing Host
+  // Sources on the Target are deleted if they are not included in this request.
+  // The provided request must include the scope, and the Target ID on which the
+  // Host Sources will be set. All Host Sources in the request must be a child
+  // of a Catalog that is in the same scope as the provided Target. If any IDs
+  // are missing, malformed, or references a non-existing resource, an error is
+  // returned.
+  rpc SetTargetHostSources(SetTargetHostSourcesRequest) returns (SetTargetHostSourcesResponse) {
+    option (google.api.http) = {
+      post: "/v1/targets/{id}:set-host-sources"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Sources the Host Sources on the Target."
+    };
+  }
+
+  // RemoveTargetHostSources removes the Host Sources from the specified Target.
+  // The provided request must include the Target ID for the Target from which
+  // the Host Sources will be removed. If the ID is missing, malformed, or
+  // references a non-existing scope or Catalog, an error is returned.  An error
+  // is returned if a Host Source is attempted to be removed from the Target
+  // when the Target does not have the Host Set.
+  rpc RemoveTargetHostSources(RemoveTargetHostSourcesRequest) returns (RemoveTargetHostSourcesResponse) {
+    option (google.api.http) = {
+      post: "/v1/targets/{id}:remove-host-sources"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Removes Host Sources from the Target."
+    };
+  }
+
+
   // AddTargetCredentialLibraries adds Credential Libraries to this Target.
   // The provided request must include the Target ID to which the Credential
   // Libraries will be added. All Credential Libraries added to the provided
@@ -340,6 +394,42 @@ message RemoveTargetHostSetsResponse {
   api.resources.targets.v1.Target item = 1;
 }
 
+message AddTargetHostSourcesRequest {
+  string id = 1;
+  // Version is used to ensure this resource has not changed.
+  // The mutation will fail if the version does not match the latest known good version.
+  uint32 version = 2;
+  repeated string host_source_ids = 3 [json_name="host_source_ids"];
+}
+
+message AddTargetHostSourcesResponse {
+  api.resources.targets.v1.Target item = 1;
+}
+
+message SetTargetHostSourcesRequest {
+  string id = 1;
+  // Version is used to ensure this resource has not changed.
+  // The mutation will fail if the version does not match the latest known good version.
+  uint32 version = 2;
+  repeated string host_source_ids = 3 [json_name="host_source_ids"];
+}
+
+message SetTargetHostSourcesResponse {
+  api.resources.targets.v1.Target item = 1;
+}
+
+message RemoveTargetHostSourcesRequest {
+  string id = 1;
+  // Version is used to ensure this resource has not changed.
+  // The mutation will fail if the version does not match the latest known good version.
+  uint32 version = 2;
+  repeated string host_source_ids = 3 [json_name="host_source_ids"];
+}
+
+message RemoveTargetHostSourcesResponse {
+  api.resources.targets.v1.Target item = 1;
+}
+
 message AddTargetCredentialLibrariesRequest {
   string id = 1;
   // Version is used to ensure this resource has not changed.

internal/servers/controller/handlers/sessions/session_service_test.go

@@ -58,7 +58,7 @@ func TestGetSession(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, p.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, p.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 
 	sess := session.TestSession(t, conn, wrap, session.ComposedOf{
 		UserId:      uId,
@@ -176,7 +176,7 @@ func TestList_Self(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, pWithSessions.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, pWithSessions.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 
 	// By default a user can read/cancel their own sessions.
 	session.TestSession(t, conn, wrap, session.ComposedOf{
@@ -260,13 +260,13 @@ func TestList(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, pWithSessions.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, pWithSessions.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 
 	hcOther := static.TestCatalogs(t, conn, pWithOtherSessions.GetPublicId(), 1)[0]
 	hsOther := static.TestSets(t, conn, hcOther.GetPublicId(), 1)[0]
 	hOther := static.TestHosts(t, conn, hcOther.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hsOther.GetPublicId(), []*static.Host{hOther})
-	tarOther := target.TestTcpTarget(t, conn, pWithOtherSessions.GetPublicId(), "test", target.WithHostSets([]string{hsOther.GetPublicId()}))
+	tarOther := target.TestTcpTarget(t, conn, pWithOtherSessions.GetPublicId(), "test", target.WithHostSources([]string{hsOther.GetPublicId()}))
 
 	var wantSession []*pb.Session
 	var totalSession []*pb.Session
@@ -471,7 +471,7 @@ func TestCancel(t *testing.T) {
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 1)[0]
 	h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
 	static.TestSetMembers(t, conn, hs.GetPublicId(), []*static.Host{h})
-	tar := target.TestTcpTarget(t, conn, p.GetPublicId(), "test", target.WithHostSets([]string{hs.GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, p.GetPublicId(), "test", target.WithHostSources([]string{hs.GetPublicId()}))
 
 	sess := session.TestSession(t, conn, wrap, session.ComposedOf{
 		UserId:      uId,

internal/servers/controller/handlers/targets/target_service.go

@@ -351,7 +351,7 @@ func (s Service) AddTargetHostSets(ctx context.Context, req *pbs.AddTargetHostSe
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}
-	t, ts, cl, err := s.addSetsInRepo(ctx, req.GetId(), req.GetHostSetIds(), req.GetVersion())
+	t, ts, cl, err := s.addHostSourcesInRepo(ctx, req.GetId(), req.GetHostSetIds(), req.GetVersion())
 	if err != nil {
 		return nil, err
 	}
@@ -389,7 +389,7 @@ func (s Service) SetTargetHostSets(ctx context.Context, req *pbs.SetTargetHostSe
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}
-	t, ts, cl, err := s.setSetsInRepo(ctx, req.GetId(), req.GetHostSetIds(), req.GetVersion())
+	t, ts, cl, err := s.setHostSourcesInRepo(ctx, req.GetId(), req.GetHostSetIds(), req.GetVersion())
 	if err != nil {
 		return nil, err
 	}
@@ -427,7 +427,7 @@ func (s Service) RemoveTargetHostSets(ctx context.Context, req *pbs.RemoveTarget
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}
-	t, ts, cl, err := s.removeSetsInRepo(ctx, req.GetId(), req.GetHostSetIds(), req.GetVersion())
+	t, ts, cl, err := s.removeHostSourcesInRepo(ctx, req.GetId(), req.GetHostSetIds(), req.GetVersion())
 	if err != nil {
 		return nil, err
 	}
@@ -454,6 +454,120 @@ func (s Service) RemoveTargetHostSets(ctx context.Context, req *pbs.RemoveTarget
 	return &pbs.RemoveTargetHostSetsResponse{Item: item}, nil
 }
 
+// AddTargetHostSources implements the interface pbs.TargetServiceServer.
+func (s Service) AddTargetHostSources(ctx context.Context, req *pbs.AddTargetHostSourcesRequest) (*pbs.AddTargetHostSourcesResponse, error) {
+	const op = "targets.(Service).AddTargetHostSources"
+
+	if err := validateAddHostSourcesRequest(req); err != nil {
+		return nil, err
+	}
+	authResults := s.authResult(ctx, req.GetId(), action.AddHostSets)
+	if authResults.Error != nil {
+		return nil, authResults.Error
+	}
+	t, ts, cl, err := s.addHostSourcesInRepo(ctx, req.GetId(), req.GetHostSourceIds(), req.GetVersion())
+	if err != nil {
+		return nil, err
+	}
+
+	outputFields, ok := requests.OutputFields(ctx)
+	if !ok {
+		return nil, errors.New(ctx, errors.Internal, op, "no request context found")
+	}
+
+	outputOpts := make([]handlers.Option, 0, 3)
+	outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
+	if outputFields.Has(globals.ScopeField) {
+		outputOpts = append(outputOpts, handlers.WithScope(authResults.Scope))
+	}
+	if outputFields.Has(globals.AuthorizedActionsField) {
+		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, t.GetPublicId(), IdActions).Strings()))
+	}
+
+	item, err := toProto(ctx, t, ts, cl, outputOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return &pbs.AddTargetHostSourcesResponse{Item: item}, nil
+}
+
+// SetTargetHostSources implements the interface pbs.TargetServiceServer.
+func (s Service) SetTargetHostSources(ctx context.Context, req *pbs.SetTargetHostSourcesRequest) (*pbs.SetTargetHostSourcesResponse, error) {
+	const op = "targets.(Service).SetTargetHostSources"
+
+	if err := validateSetHostSourcesRequest(req); err != nil {
+		return nil, err
+	}
+	authResults := s.authResult(ctx, req.GetId(), action.SetHostSets)
+	if authResults.Error != nil {
+		return nil, authResults.Error
+	}
+	t, ts, cl, err := s.setHostSourcesInRepo(ctx, req.GetId(), req.GetHostSourceIds(), req.GetVersion())
+	if err != nil {
+		return nil, err
+	}
+
+	outputFields, ok := requests.OutputFields(ctx)
+	if !ok {
+		return nil, errors.New(ctx, errors.Internal, op, "no request context found")
+	}
+
+	outputOpts := make([]handlers.Option, 0, 3)
+	outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
+	if outputFields.Has(globals.ScopeField) {
+		outputOpts = append(outputOpts, handlers.WithScope(authResults.Scope))
+	}
+	if outputFields.Has(globals.AuthorizedActionsField) {
+		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, t.GetPublicId(), IdActions).Strings()))
+	}
+
+	item, err := toProto(ctx, t, ts, cl, outputOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return &pbs.SetTargetHostSourcesResponse{Item: item}, nil
+}
+
+// RemoveTargetHostSources implements the interface pbs.TargetServiceServer.
+func (s Service) RemoveTargetHostSources(ctx context.Context, req *pbs.RemoveTargetHostSourcesRequest) (*pbs.RemoveTargetHostSourcesResponse, error) {
+	const op = "targets.(Service).RemoveTargetHostSets"
+
+	if err := validateRemoveHostSourcesRequest(req); err != nil {
+		return nil, err
+	}
+	authResults := s.authResult(ctx, req.GetId(), action.RemoveHostSets)
+	if authResults.Error != nil {
+		return nil, authResults.Error
+	}
+	t, ts, cl, err := s.removeHostSourcesInRepo(ctx, req.GetId(), req.GetHostSourceIds(), req.GetVersion())
+	if err != nil {
+		return nil, err
+	}
+
+	outputFields, ok := requests.OutputFields(ctx)
+	if !ok {
+		return nil, errors.New(ctx, errors.Internal, op, "no request context found")
+	}
+
+	outputOpts := make([]handlers.Option, 0, 3)
+	outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
+	if outputFields.Has(globals.ScopeField) {
+		outputOpts = append(outputOpts, handlers.WithScope(authResults.Scope))
+	}
+	if outputFields.Has(globals.AuthorizedActionsField) {
+		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, t.GetPublicId(), IdActions).Strings()))
+	}
+
+	item, err := toProto(ctx, t, ts, cl, outputOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return &pbs.RemoveTargetHostSourcesResponse{Item: item}, nil
+}
+
 // DEPRECATED: AddTargetCredentialLibraries implements the interface pbs.TargetServiceServer.
 func (s Service) AddTargetCredentialLibraries(ctx context.Context, req *pbs.AddTargetCredentialLibrariesRequest) (*pbs.AddTargetCredentialLibrariesResponse, error) {
 	const op = "targets.(Service).AddTargetCredentialLibraries"
@@ -730,7 +844,7 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
 	if err != nil {
 		return nil, err
 	}
-	t, hostSets, libs, err := repo.LookupTarget(ctx, t.GetPublicId())
+	t, hostSources, libs, err := repo.LookupTarget(ctx, t.GetPublicId())
 	if err != nil {
 		if errors.IsNotFoundError(err) {
 			return nil, handlers.NotFoundErrorf("Target %q not found.", t.GetPublicId())
@@ -838,11 +952,11 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
 		return nil, err
 	}
 
-	hostIds := make([]compoundHost, 0, len(hostSets)*10)
+	hostIds := make([]compoundHost, 0, len(hostSources)*10)
 
-HostSetIterationLoop:
-	for _, tSet := range hostSets {
-		hsId := tSet.PublicId
+HostSourceIterationLoop:
+	for _, hSource := range hostSources {
+		hsId := hSource.Id()
 		switch host.SubtypeFromId(hsId) {
 		case static.Subtype:
 			_, hosts, err := staticHostRepo.LookupSet(ctx, hsId)
@@ -854,7 +968,7 @@ HostSetIterationLoop:
 				hostIds = append(hostIds, compoundId)
 				if host.PublicId == requestedId {
 					chosenId = &compoundId
-					break HostSetIterationLoop
+					break HostSourceIterationLoop
 				}
 			}
 		}
@@ -870,7 +984,7 @@ HostSetIterationLoop:
 	if chosenId == nil {
 		if len(hostIds) == 0 {
 			// No hosts were found, error
-			return nil, handlers.NotFoundErrorf("No hosts found from available target host sets.")
+			return nil, handlers.NotFoundErrorf("No hosts found from available target host sources.")
 		}
 		chosenId = &hostIds[rand.Intn(len(hostIds))]
 	}
@@ -1026,7 +1140,7 @@ HostSetIterationLoop:
 	return &pbs.AuthorizeSessionResponse{Item: ret}, nil
 }
 
-func (s Service) getFromRepo(ctx context.Context, id string) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
+func (s Service) getFromRepo(ctx context.Context, id string) (target.Target, []target.HostSource, []target.CredentialSource, error) {
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
@@ -1044,7 +1158,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (target.Target, []*
 	return u, hs, cl, nil
 }
 
-func (s Service) createInRepo(ctx context.Context, item *pb.Target) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
+func (s Service) createInRepo(ctx context.Context, item *pb.Target) (target.Target, []target.HostSource, []target.CredentialSource, error) {
 	const op = "targets.(Service).createInRepo"
 	opts := []target.Option{target.WithName(item.GetName().GetValue())}
 	if item.GetDescription() != nil {
@@ -1084,7 +1198,7 @@ func (s Service) createInRepo(ctx context.Context, item *pb.Target) (target.Targ
 	return out, hs, cl, nil
 }
 
-func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []string, item *pb.Target) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
+func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []string, item *pb.Target) (target.Target, []target.HostSource, []target.CredentialSource, error) {
 	const op = "targets.(Service).updateInRepo"
 	var opts []target.Option
 	if desc := item.GetDescription(); desc != nil {
@@ -1161,66 +1275,66 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string) ([]target.
 	return ul, nil
 }
 
-func (s Service) addSetsInRepo(ctx context.Context, targetId string, hostSetId []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
+func (s Service) addHostSourcesInRepo(ctx context.Context, targetId string, hostSourceIds []string, version uint32) (target.Target, []target.HostSource, []target.CredentialSource, error) {
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	out, hs, cl, err := repo.AddTargetHostSets(ctx, targetId, version, strutil.RemoveDuplicates(hostSetId, false))
+	out, hs, cl, err := repo.AddTargetHostSources(ctx, targetId, version, strutil.RemoveDuplicates(hostSourceIds, false))
 	if err != nil {
 		// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to add host sets to target: %v.", err)
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to add host sources to target: %v.", err)
 	}
 	if out == nil {
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after adding host sets to it.")
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after adding host sources to it.")
 	}
 	return out, hs, cl, nil
 }
 
-func (s Service) setSetsInRepo(ctx context.Context, targetId string, hostSetIds []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
-	const op = "targets.(Service).setSetsInRepo"
+func (s Service) setHostSourcesInRepo(ctx context.Context, targetId string, hostSourceIds []string, version uint32) (target.Target, []target.HostSource, []target.CredentialSource, error) {
+	const op = "targets.(Service).setSourcesInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	_, _, _, err = repo.SetTargetHostSets(ctx, targetId, version, strutil.RemoveDuplicates(hostSetIds, false))
+	_, _, _, err = repo.SetTargetHostSources(ctx, targetId, version, strutil.RemoveDuplicates(hostSourceIds, false))
 	if err != nil {
 		// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to set host sets in target: %v.", err)
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to set host sources in target: %v.", err)
 	}
 
 	out, hs, cl, err := repo.LookupTarget(ctx, targetId)
 	if err != nil {
-		return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to look up target after setting host sets"))
+		return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to look up target after setting host sources"))
 	}
 	if out == nil {
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after setting host sets for it.")
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after setting host sources for it.")
 	}
 	return out, hs, cl, nil
 }
 
-func (s Service) removeSetsInRepo(ctx context.Context, targetId string, hostSetIds []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
-	const op = "targets.(Service).removeSetsInRepo"
+func (s Service) removeHostSourcesInRepo(ctx context.Context, targetId string, hostSourceIds []string, version uint32) (target.Target, []target.HostSource, []target.CredentialSource, error) {
+	const op = "targets.(Service).removeHostSourcesInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	_, err = repo.DeleteTargeHostSets(ctx, targetId, version, strutil.RemoveDuplicates(hostSetIds, false))
+	_, err = repo.DeleteTargetHostSources(ctx, targetId, version, strutil.RemoveDuplicates(hostSourceIds, false))
 	if err != nil {
 		// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to remove host sets from target: %v.", err)
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to remove host sources from target: %v.", err)
 	}
 	out, hs, cl, err := repo.LookupTarget(ctx, targetId)
 	if err != nil {
-		return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to look up target after removing host sets"))
+		return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to look up target after removing host sources"))
 	}
 	if out == nil {
-		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after removing host sets from it.")
+		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after removing host sources from it.")
 	}
 	return out, hs, cl, nil
 }
 
-func (s Service) addCredentialSourcesInRepo(ctx context.Context, targetId string, ids []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
+func (s Service) addCredentialSourcesInRepo(ctx context.Context, targetId string, ids []string, version uint32) (target.Target, []target.HostSource, []target.CredentialSource, error) {
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
@@ -1236,7 +1350,7 @@ func (s Service) addCredentialSourcesInRepo(ctx context.Context, targetId string
 	return out, hs, credSources, nil
 }
 
-func (s Service) setCredentialSourcesInRepo(ctx context.Context, targetId string, ids []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
+func (s Service) setCredentialSourcesInRepo(ctx context.Context, targetId string, ids []string, version uint32) (target.Target, []target.HostSource, []target.CredentialSource, error) {
 	const op = "targets.(Service).setCredentialSourcesInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
@@ -1258,7 +1372,7 @@ func (s Service) setCredentialSourcesInRepo(ctx context.Context, targetId string
 	return out, hs, credSources, nil
 }
 
-func (s Service) removeCredentialSourcesInRepo(ctx context.Context, targetId string, ids []string, version uint32) (target.Target, []*target.TargetSet, []target.CredentialSource, error) {
+func (s Service) removeCredentialSourcesInRepo(ctx context.Context, targetId string, ids []string, version uint32) (target.Target, []target.HostSource, []target.CredentialSource, error) {
 	const op = "targets.(Service).removeCredentialSourcesInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
@@ -1332,7 +1446,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type, looku
 	return ret
 }
 
-func toProto(ctx context.Context, in target.Target, m []*target.TargetSet, credSources []target.CredentialSource, opt ...handlers.Option) (*pb.Target, error) {
+func toProto(ctx context.Context, in target.Target, hostSources []target.HostSource, credSources []target.CredentialSource, opt ...handlers.Option) (*pb.Target, error) {
 	const op = "target_service.toProto"
 	opts := handlers.GetOpts(opt...)
 	if opts.WithOutputFields == nil {
@@ -1381,15 +1495,28 @@ func toProto(ctx context.Context, in target.Target, m []*target.TargetSet, credS
 		out.AuthorizedActions = opts.WithAuthorizedActions
 	}
 	if outputFields.Has(globals.HostSetIdsField) {
-		for _, hs := range m {
-			out.HostSetIds = append(out.HostSetIds, hs.GetPublicId())
+		for _, hs := range hostSources {
+			out.HostSetIds = append(out.HostSetIds, hs.Id())
+		}
+	}
+	if outputFields.Has(globals.HostSourceIdsField) {
+		for _, hs := range hostSources {
+			out.HostSourceIds = append(out.HostSourceIds, hs.Id())
 		}
 	}
 	if outputFields.Has(globals.HostSetsField) {
-		for _, hs := range m {
+		for _, hs := range hostSources {
 			out.HostSets = append(out.HostSets, &pb.HostSet{
-				Id:            hs.GetPublicId(),
-				HostCatalogId: hs.GetCatalogId(),
+				Id:            hs.Id(),
+				HostCatalogId: hs.HostCatalogId(),
+			})
+		}
+	}
+	if outputFields.Has(globals.HostSourcesField) {
+		for _, hs := range hostSources {
+			out.HostSources = append(out.HostSources, &pb.HostSource{
+				Id:            hs.Id(),
+				HostCatalogId: hs.HostCatalogId(),
 			})
 		}
 	}
@@ -1628,6 +1755,72 @@ func validateRemoveSetsRequest(req *pbs.RemoveTargetHostSetsRequest) error {
 	return nil
 }
 
+func validateAddHostSourcesRequest(req *pbs.AddTargetHostSourcesRequest) error {
+	badFields := map[string]string{}
+	if !handlers.ValidId(handlers.Id(req.GetId()), target.TcpTargetPrefix) {
+		badFields[globals.IdField] = "Incorrectly formatted identifier."
+	}
+	if req.GetVersion() == 0 {
+		badFields[globals.VersionField] = "Required field."
+	}
+	if len(req.GetHostSourceIds()) == 0 {
+		badFields[globals.HostSourceIdsField] = "Must be non-empty."
+	}
+	for _, id := range req.GetHostSourceIds() {
+		if !handlers.ValidId(handlers.Id(id), static.HostSetPrefix) {
+			badFields[globals.HostSourceIdsField] = fmt.Sprintf("Incorrectly formatted host source identifier %q.", id)
+			break
+		}
+	}
+	if len(badFields) > 0 {
+		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)
+	}
+	return nil
+}
+
+func validateSetHostSourcesRequest(req *pbs.SetTargetHostSourcesRequest) error {
+	badFields := map[string]string{}
+	if !handlers.ValidId(handlers.Id(req.GetId()), target.TcpTargetPrefix) {
+		badFields[globals.IdField] = "Incorrectly formatted identifier."
+	}
+	if req.GetVersion() == 0 {
+		badFields[globals.VersionField] = "Required field."
+	}
+	for _, id := range req.GetHostSourceIds() {
+		if !handlers.ValidId(handlers.Id(id), static.HostSetPrefix) {
+			badFields[globals.HostSourceIdsField] = fmt.Sprintf("Incorrectly formatted host source identifier %q.", id)
+			break
+		}
+	}
+	if len(badFields) > 0 {
+		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)
+	}
+	return nil
+}
+
+func validateRemoveHostSourcesRequest(req *pbs.RemoveTargetHostSourcesRequest) error {
+	badFields := map[string]string{}
+	if !handlers.ValidId(handlers.Id(req.GetId()), target.TcpTargetPrefix) {
+		badFields[globals.IdField] = "Incorrectly formatted identifier."
+	}
+	if req.GetVersion() == 0 {
+		badFields[globals.VersionField] = "Required field."
+	}
+	if len(req.GetHostSourceIds()) == 0 {
+		badFields[globals.HostSourceIdsField] = "Must be non-empty."
+	}
+	for _, id := range req.GetHostSourceIds() {
+		if !handlers.ValidId(handlers.Id(id), static.HostSetPrefix) {
+			badFields[globals.HostSourceIdsField] = fmt.Sprintf("Incorrectly formatted host source identifier %q.", id)
+			break
+		}
+	}
+	if len(badFields) > 0 {
+		return handlers.InvalidArgumentErrorf("Errors in provided fields.", badFields)
+	}
+	return nil
+}
+
 func validateAddLibrariesRequest(req *pbs.AddTargetCredentialLibrariesRequest) error {
 	badFields := map[string]string{}
 	if !handlers.ValidId(handlers.Id(req.GetId()), target.TcpTargetPrefix) {

internal/servers/controller/handlers/targets/target_service_test.go

@@ -108,7 +108,7 @@ func TestGet(t *testing.T) {
 	hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 2)
 
-	tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), "test", target.WithHostSets([]string{hs[0].GetPublicId(), hs[1].GetPublicId()}))
+	tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), "test", target.WithHostSources([]string{hs[0].GetPublicId(), hs[1].GetPublicId()}))
 
 	pTar := &pb.Target{
 		Id:                     tar.GetPublicId(),
@@ -119,6 +119,7 @@ func TestGet(t *testing.T) {
 		Scope:                  &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: o.GetPublicId()},
 		Type:                   target.TcpTargetType.String(),
 		HostSetIds:             []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
+		HostSourceIds:          []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
 		Attributes:             new(structpb.Struct),
 		SessionMaxSeconds:      wrapperspb.UInt32(28800),
 		SessionConnectionLimit: wrapperspb.Int32(1),
@@ -126,6 +127,7 @@ func TestGet(t *testing.T) {
 	}
 	for _, ihs := range hs {
 		pTar.HostSets = append(pTar.HostSets, &pb.HostSet{Id: ihs.GetPublicId(), HostCatalogId: ihs.GetCatalogId()})
+		pTar.HostSources = append(pTar.HostSources, &pb.HostSource{Id: ihs.GetPublicId(), HostCatalogId: ihs.GetCatalogId()})
 	}
 
 	cases := []struct {
@@ -201,7 +203,7 @@ func TestList(t *testing.T) {
 	var totalTars []*pb.Target
 	for i := 0; i < 5; i++ {
 		name := fmt.Sprintf("tar%d", i)
-		tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), name, target.WithHostSets([]string{hss[0].GetPublicId(), hss[1].GetPublicId()}))
+		tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), name, target.WithHostSources([]string{hss[0].GetPublicId(), hss[1].GetPublicId()}))
 		wantTars = append(wantTars, &pb.Target{
 			Id:                     tar.GetPublicId(),
 			ScopeId:                proj.GetPublicId(),
@@ -217,7 +219,7 @@ func TestList(t *testing.T) {
 			AuthorizedActions:      testAuthorizedActions,
 		})
 		totalTars = append(totalTars, wantTars[i])
-		tar = target.TestTcpTarget(t, conn, otherProj.GetPublicId(), name, target.WithHostSets([]string{otherHss[0].GetPublicId(), otherHss[1].GetPublicId()}))
+		tar = target.TestTcpTarget(t, conn, otherProj.GetPublicId(), name, target.WithHostSources([]string{otherHss[0].GetPublicId(), otherHss[1].GetPublicId()}))
 		totalTars = append(totalTars, &pb.Target{
 			Id:                     tar.GetPublicId(),
 			ScopeId:                otherProj.GetPublicId(),
@@ -564,11 +566,16 @@ func TestUpdate(t *testing.T) {
 		{Id: hs[0].GetPublicId(), HostCatalogId: hs[0].GetCatalogId()},
 		{Id: hs[1].GetPublicId(), HostCatalogId: hs[1].GetCatalogId()},
 	}
+	hostSourceIds := []string{hs[0].GetPublicId(), hs[1].GetPublicId()}
+	hostSources := []*pb.HostSource{
+		{Id: hs[0].GetPublicId(), HostCatalogId: hs[0].GetCatalogId()},
+		{Id: hs[1].GetPublicId(), HostCatalogId: hs[1].GetCatalogId()},
+	}
 
 	tar, err := target.NewTcpTarget(proj.GetPublicId(), target.WithName("default"), target.WithDescription("default"))
 	tar.DefaultPort = 2
 	require.NoError(t, err)
-	gtar, _, _, err := repo.CreateTcpTarget(context.Background(), tar, target.WithHostSets([]string{hs[0].GetPublicId(), hs[1].GetPublicId()}))
+	gtar, _, _, err := repo.CreateTcpTarget(context.Background(), tar, target.WithHostSources([]string{hs[0].GetPublicId(), hs[1].GetPublicId()}))
 	require.NoError(t, err)
 	tar = gtar.(*target.TcpTarget)
 
@@ -623,6 +630,8 @@ func TestUpdate(t *testing.T) {
 					CreatedTime:            tar.GetCreateTime().GetTimestamp(),
 					HostSetIds:             hsIds,
 					HostSets:               hostSets,
+					HostSourceIds:          hostSourceIds,
+					HostSources:            hostSources,
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
 					SessionConnectionLimit: wrapperspb.Int32(5),
 					AuthorizedActions:      testAuthorizedActions,
@@ -655,6 +664,8 @@ func TestUpdate(t *testing.T) {
 					}},
 					HostSetIds:             hsIds,
 					HostSets:               hostSets,
+					HostSourceIds:          hostSourceIds,
+					HostSources:            hostSources,
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
 					SessionConnectionLimit: wrapperspb.Int32(5),
 					AuthorizedActions:      testAuthorizedActions,
@@ -740,6 +751,8 @@ func TestUpdate(t *testing.T) {
 					}},
 					HostSetIds:             hsIds,
 					HostSets:               hostSets,
+					HostSourceIds:          hostSourceIds,
+					HostSources:            hostSources,
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
 					SessionConnectionLimit: wrapperspb.Int32(5),
 					AuthorizedActions:      testAuthorizedActions,
@@ -771,6 +784,8 @@ func TestUpdate(t *testing.T) {
 					}},
 					HostSetIds:             hsIds,
 					HostSets:               hostSets,
+					HostSourceIds:          hostSourceIds,
+					HostSources:            hostSources,
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
 					SessionConnectionLimit: wrapperspb.Int32(5),
 					AuthorizedActions:      testAuthorizedActions,
@@ -802,6 +817,8 @@ func TestUpdate(t *testing.T) {
 					Type:                   target.TcpTargetType.String(),
 					HostSetIds:             hsIds,
 					HostSets:               hostSets,
+					HostSourceIds:          hostSourceIds,
+					HostSources:            hostSources,
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
 					SessionConnectionLimit: wrapperspb.Int32(5),
 					AuthorizedActions:      testAuthorizedActions,
@@ -977,13 +994,13 @@ func TestAddTargetHostSets(t *testing.T) {
 		},
 		{
 			name:           "Add set on populated target",
-			tar:            target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithHostSets([]string{hs[0].GetPublicId()})),
+			tar:            target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithHostSources([]string{hs[0].GetPublicId()})),
 			addHostSets:    []string{hs[1].GetPublicId()},
 			resultHostSets: []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
 		},
 		{
 			name:           "Add duplicated sets on populated target",
-			tar:            target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated", target.WithHostSets([]string{hs[0].GetPublicId()})),
+			tar:            target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated", target.WithHostSources([]string{hs[0].GetPublicId()})),
 			addHostSets:    []string{hs[1].GetPublicId(), hs[1].GetPublicId()},
 			resultHostSets: []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
 		},
@@ -1093,19 +1110,19 @@ func TestSetTargetHostSets(t *testing.T) {
 		},
 		{
 			name:           "Set on populated target",
-			tar:            target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithHostSets([]string{hs[0].GetPublicId()})),
+			tar:            target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithHostSources([]string{hs[0].GetPublicId()})),
 			setHostSets:    []string{hs[1].GetPublicId()},
 			resultHostSets: []string{hs[1].GetPublicId()},
 		},
 		{
 			name:           "Set duplicate host set on populated target",
-			tar:            target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicate", target.WithHostSets([]string{hs[0].GetPublicId()})),
+			tar:            target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicate", target.WithHostSources([]string{hs[0].GetPublicId()})),
 			setHostSets:    []string{hs[1].GetPublicId(), hs[1].GetPublicId()},
 			resultHostSets: []string{hs[1].GetPublicId()},
 		},
 		{
 			name:           "Set empty on populated target",
-			tar:            target.TestTcpTarget(t, conn, proj.GetPublicId(), "another populated", target.WithHostSets([]string{hs[0].GetPublicId()})),
+			tar:            target.TestTcpTarget(t, conn, proj.GetPublicId(), "another populated", target.WithHostSources([]string{hs[0].GetPublicId()})),
 			setHostSets:    []string{},
 			resultHostSets: nil,
 		},
@@ -1204,19 +1221,19 @@ func TestRemoveTargetHostSets(t *testing.T) {
 		},
 		{
 			name:        "Remove 1 of 2 sets",
-			tar:         target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove partial", target.WithHostSets([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
+			tar:         target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove partial", target.WithHostSources([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
 			removeHosts: []string{hs[1].GetPublicId()},
 			resultHosts: []string{hs[0].GetPublicId()},
 		},
 		{
 			name:        "Remove 1 duplicate set of 2 sets",
-			tar:         target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove duplicate", target.WithHostSets([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
+			tar:         target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove duplicate", target.WithHostSources([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
 			removeHosts: []string{hs[1].GetPublicId(), hs[1].GetPublicId()},
 			resultHosts: []string{hs[0].GetPublicId()},
 		},
 		{
 			name:        "Remove all hosts from set",
-			tar:         target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove all", target.WithHostSets([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
+			tar:         target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove all", target.WithHostSources([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
 			removeHosts: []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
 			resultHosts: []string{},
 		},
@@ -1299,6 +1316,360 @@ func TestRemoveTargetHostSets(t *testing.T) {
 	}
 }
 
+func TestAddTargetHostSources(t *testing.T) {
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	kms := kms.TestKms(t, conn, wrapper)
+
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
+
+	s, err := testService(t, conn, kms, wrapper)
+	require.NoError(t, err, "Error when getting new target service.")
+
+	hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
+	hs := static.TestSets(t, conn, hc.GetPublicId(), 2)
+
+	addCases := []struct {
+		name              string
+		tar               *target.TcpTarget
+		addHostSources    []string
+		resultHostSources []string
+	}{
+		{
+			name:              "Add set on empty target",
+			tar:               target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty"),
+			addHostSources:    []string{hs[1].GetPublicId()},
+			resultHostSources: []string{hs[1].GetPublicId()},
+		},
+		{
+			name:              "Add set on populated target",
+			tar:               target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithHostSources([]string{hs[0].GetPublicId()})),
+			addHostSources:    []string{hs[1].GetPublicId()},
+			resultHostSources: []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
+		},
+		{
+			name:              "Add duplicated sets on populated target",
+			tar:               target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated", target.WithHostSources([]string{hs[0].GetPublicId()})),
+			addHostSources:    []string{hs[1].GetPublicId(), hs[1].GetPublicId()},
+			resultHostSources: []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
+		},
+	}
+
+	for _, tc := range addCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := &pbs.AddTargetHostSourcesRequest{
+				Id:            tc.tar.GetPublicId(),
+				Version:       tc.tar.GetVersion(),
+				HostSourceIds: tc.addHostSources,
+			}
+
+			got, err := s.AddTargetHostSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
+			s, ok := status.FromError(err)
+			require.True(t, ok)
+			require.NoError(t, err, "Got error: %v", s)
+
+			assert.ElementsMatch(t, tc.resultHostSources, got.GetItem().GetHostSourceIds())
+		})
+	}
+
+	tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), "test")
+
+	failCases := []struct {
+		name string
+		req  *pbs.AddTargetHostSourcesRequest
+		err  error
+	}{
+		{
+			name: "Bad Set Id",
+			req: &pbs.AddTargetHostSourcesRequest{
+				Id:            "bad id",
+				Version:       tar.GetVersion(),
+				HostSourceIds: []string{hs[0].GetPublicId()},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Bad version",
+			req: &pbs.AddTargetHostSourcesRequest{
+				Id:            tar.GetPublicId(),
+				Version:       tar.GetVersion() + 2,
+				HostSourceIds: []string{hs[0].GetPublicId()},
+			},
+			err: handlers.ApiErrorWithCode(codes.Internal),
+		},
+		{
+			name: "Empty host set list",
+			req: &pbs.AddTargetHostSourcesRequest{
+				Id:      tar.GetPublicId(),
+				Version: tar.GetVersion(),
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Incorrect host set ids",
+			req: &pbs.AddTargetHostSourcesRequest{
+				Id:            tar.GetPublicId(),
+				Version:       tar.GetVersion(),
+				HostSourceIds: []string{"incorrect"},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+	}
+	for _, tc := range failCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			_, gErr := s.AddTargetHostSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
+			if tc.err != nil {
+				require.Error(gErr)
+				assert.True(errors.Is(gErr, tc.err), "AddTargetHostSources(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
+			}
+		})
+	}
+}
+
+func TestSetTargetHostSources(t *testing.T) {
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	kms := kms.TestKms(t, conn, wrapper)
+
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
+
+	s, err := testService(t, conn, kms, wrapper)
+	require.NoError(t, err, "Error when getting new host set service.")
+
+	hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
+	hs := static.TestSets(t, conn, hc.GetPublicId(), 2)
+
+	setCases := []struct {
+		name              string
+		tar               *target.TcpTarget
+		setHostSources    []string
+		resultHostSources []string
+	}{
+		{
+			name:              "Set on empty target",
+			tar:               target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty"),
+			setHostSources:    []string{hs[1].GetPublicId()},
+			resultHostSources: []string{hs[1].GetPublicId()},
+		},
+		{
+			name:              "Set on populated target",
+			tar:               target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithHostSources([]string{hs[0].GetPublicId()})),
+			setHostSources:    []string{hs[1].GetPublicId()},
+			resultHostSources: []string{hs[1].GetPublicId()},
+		},
+		{
+			name:              "Set duplicate host set on populated target",
+			tar:               target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicate", target.WithHostSources([]string{hs[0].GetPublicId()})),
+			setHostSources:    []string{hs[1].GetPublicId(), hs[1].GetPublicId()},
+			resultHostSources: []string{hs[1].GetPublicId()},
+		},
+		{
+			name:              "Set empty on populated target",
+			tar:               target.TestTcpTarget(t, conn, proj.GetPublicId(), "another populated", target.WithHostSources([]string{hs[0].GetPublicId()})),
+			setHostSources:    []string{},
+			resultHostSources: nil,
+		},
+	}
+	for _, tc := range setCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := &pbs.SetTargetHostSourcesRequest{
+				Id:            tc.tar.GetPublicId(),
+				Version:       tc.tar.GetVersion(),
+				HostSourceIds: tc.setHostSources,
+			}
+
+			got, err := s.SetTargetHostSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
+			require.NoError(t, err, "Got error: %v", s)
+			assert.ElementsMatch(t, tc.resultHostSources, got.GetItem().GetHostSourceIds())
+		})
+	}
+
+	tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), "test name")
+
+	failCases := []struct {
+		name string
+		req  *pbs.SetTargetHostSourcesRequest
+		err  error
+	}{
+		{
+			name: "Bad target Id",
+			req: &pbs.SetTargetHostSourcesRequest{
+				Id:            "bad id",
+				Version:       tar.GetVersion(),
+				HostSourceIds: []string{hs[0].GetPublicId()},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Bad version",
+			req: &pbs.SetTargetHostSourcesRequest{
+				Id:            tar.GetPublicId(),
+				Version:       tar.GetVersion() + 3,
+				HostSourceIds: []string{hs[0].GetPublicId()},
+			},
+			err: handlers.ApiErrorWithCode(codes.Internal),
+		},
+		{
+			name: "Bad host set id",
+			req: &pbs.SetTargetHostSourcesRequest{
+				Id:            tar.GetPublicId(),
+				Version:       tar.GetVersion(),
+				HostSourceIds: []string{"invalid"},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+	}
+	for _, tc := range failCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			_, gErr := s.SetTargetHostSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
+			if tc.err != nil {
+				require.Error(gErr)
+				assert.True(errors.Is(gErr, tc.err), "SetTargetHostSources(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
+			}
+		})
+	}
+}
+
+func TestRemoveTargetHostSources(t *testing.T) {
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	kms := kms.TestKms(t, conn, wrapper)
+
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
+
+	s, err := testService(t, conn, kms, wrapper)
+	require.NoError(t, err, "Error when getting new host set service.")
+
+	hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
+	hs := static.TestSets(t, conn, hc.GetPublicId(), 2)
+
+	removeCases := []struct {
+		name              string
+		tar               *target.TcpTarget
+		removeHostSources []string
+		resultHostSources []string
+		wantErr           bool
+	}{
+		{
+			name:              "Remove from empty",
+			tar:               target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty"),
+			removeHostSources: []string{hs[1].GetPublicId()},
+			wantErr:           true,
+		},
+		{
+			name:              "Remove 1 of 2 sets",
+			tar:               target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove partial", target.WithHostSources([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
+			removeHostSources: []string{hs[1].GetPublicId()},
+			resultHostSources: []string{hs[0].GetPublicId()},
+		},
+		{
+			name:              "Remove 1 duplicate set of 2 sets",
+			tar:               target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove duplicate", target.WithHostSources([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
+			removeHostSources: []string{hs[1].GetPublicId(), hs[1].GetPublicId()},
+			resultHostSources: []string{hs[0].GetPublicId()},
+		},
+		{
+			name:              "Remove all hosts from set",
+			tar:               target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove all", target.WithHostSources([]string{hs[0].GetPublicId(), hs[1].GetPublicId()})),
+			removeHostSources: []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
+			resultHostSources: []string{},
+		},
+	}
+
+	for _, tc := range removeCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := &pbs.RemoveTargetHostSourcesRequest{
+				Id:            tc.tar.GetPublicId(),
+				Version:       tc.tar.GetVersion(),
+				HostSourceIds: tc.removeHostSources,
+			}
+
+			got, err := s.RemoveTargetHostSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
+			if tc.wantErr {
+				assert.Error(t, err)
+				return
+			}
+			s, ok := status.FromError(err)
+			require.True(t, ok)
+			require.NoError(t, err, "Got error: %v", s)
+
+			assert.ElementsMatch(t, tc.resultHostSources, got.GetItem().GetHostSourceIds())
+		})
+	}
+
+	tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), "testing")
+
+	failCases := []struct {
+		name string
+		req  *pbs.RemoveTargetHostSourcesRequest
+		err  error
+	}{
+		{
+			name: "Bad version",
+			req: &pbs.RemoveTargetHostSourcesRequest{
+				Id:            tar.GetPublicId(),
+				Version:       tar.GetVersion() + 3,
+				HostSourceIds: []string{hs[0].GetPublicId()},
+			},
+			err: handlers.ApiErrorWithCode(codes.Internal),
+		},
+		{
+			name: "Bad target Id",
+			req: &pbs.RemoveTargetHostSourcesRequest{
+				Id:            "bad id",
+				Version:       tar.GetVersion(),
+				HostSourceIds: []string{hs[0].GetPublicId()},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "empty sets",
+			req: &pbs.RemoveTargetHostSourcesRequest{
+				Id:            tar.GetPublicId(),
+				Version:       tar.GetVersion(),
+				HostSourceIds: []string{},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+		{
+			name: "Invalid set ids",
+			req: &pbs.RemoveTargetHostSourcesRequest{
+				Id:            tar.GetPublicId(),
+				Version:       tar.GetVersion(),
+				HostSourceIds: []string{"invalid"},
+			},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
+	}
+	for _, tc := range failCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			_, gErr := s.RemoveTargetHostSources(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
+			if tc.err != nil {
+				require.Error(gErr)
+				assert.True(errors.Is(gErr, tc.err), "RemoveTargetHostSets(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
+			}
+		})
+	}
+}
+
 func TestAddTargetLibraries(t *testing.T) {
 	conn, _ := db.TestSetup(t, "postgres")
 	wrapper := db.TestWrapper(t)

internal/session/testing.go

@@ -138,7 +138,7 @@ func TestSessionParams(t *testing.T, conn *gorm.DB, wrapper wrapping.Wrapper, ia
 	kms := kms.TestKms(t, conn, wrapper)
 	targetRepo, err := target.NewRepository(rw, rw, kms)
 	require.NoError(err)
-	_, _, _, err = targetRepo.AddTargetHostSets(ctx, tcpTarget.GetPublicId(), tcpTarget.GetVersion(), []string{sets[0].PublicId})
+	_, _, _, err = targetRepo.AddTargetHostSources(ctx, tcpTarget.GetPublicId(), tcpTarget.GetVersion(), []string{sets[0].PublicId})
 	require.NoError(err)
 
 	authMethod := password.TestAuthMethods(t, conn, org.PublicId, 1)[0]

internal/target/host_set.go

@@ -12,6 +12,8 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
+var _ HostSource = (*TargetSet)(nil)
+
 const (
 	DefaultTargetHostSetTableName = "target_host_set"
 )
@@ -105,3 +107,13 @@ type TargetSet struct {
 func (ts *TargetSet) TableName() string {
 	return "target_set"
 }
+
+// Id returns the ID of the host set
+func (ts *TargetSet) Id() string {
+	return ts.PublicId
+}
+
+// HostCatalogId returns the ID of the catalog containing the set
+func (ts *TargetSet) HostCatalogId() string {
+	return ts.CatalogId
+}

internal/target/host_source.go

@@ -0,0 +1,8 @@
+package target
+
+// HostSource is an interface that can be implemented by both a set and a
+// singular host.
+type HostSource interface {
+	HostCatalogId() string
+	Id() string
+}

internal/target/immutable_fields_test.go

@@ -169,10 +169,10 @@ func TestTargetHostSet_ImmutableFields(t *testing.T) {
 	updateTarget := TestTcpTarget(t, conn, proj.PublicId, testId(t))
 	updateHset := hsets[1]
 
-	_, gotHostSets, _, err := repo.AddTargetHostSets(context.Background(), projTarget.PublicId, 1, []string{hsets[0].PublicId})
+	_, gotHostSources, _, err := repo.AddTargetHostSources(context.Background(), projTarget.PublicId, 1, []string{hsets[0].PublicId})
 	require.NoError(t, err)
-	require.Equal(t, 1, len(gotHostSets))
-	new, err := NewTargetHostSet(projTarget.PublicId, gotHostSets[0].PublicId)
+	require.Equal(t, 1, len(gotHostSources))
+	new, err := NewTargetHostSet(projTarget.PublicId, gotHostSources[0].Id())
 	require.NoError(t, err)
 
 	tests := []struct {

internal/target/options.go

@@ -25,7 +25,7 @@ type options struct {
 	withScopeName              string
 	withUserId                 string
 	withTargetType             *TargetType
-	withHostSets               []string
+	withHostSources            []string
 	withCredentialSources      []string
 	withSessionMaxSeconds      uint32
 	withSessionConnectionLimit int32
@@ -44,7 +44,7 @@ func getDefaultOptions() options {
 		withScopeName:              "",
 		withUserId:                 "",
 		withTargetType:             nil,
-		withHostSets:               nil,
+		withHostSources:            nil,
 		withCredentialSources:      nil,
 		withSessionMaxSeconds:      uint32((8 * time.Hour).Seconds()),
 		withSessionConnectionLimit: 1,
@@ -118,10 +118,10 @@ func WithTargetType(t TargetType) Option {
 	}
 }
 
-// WithHostSets provides an option for providing a list of host set ids
-func WithHostSets(hs []string) Option {
+// WithHostSources provides an option for providing a list of host source ids
+func WithHostSources(hs []string) Option {
 	return func(o *options) {
-		o.withHostSets = hs
+		o.withHostSources = hs
 	}
 }
 

internal/target/options_test.go

@@ -90,11 +90,11 @@ func Test_GetOpts(t *testing.T) {
 		testOpts.withTargetType = &target
 		assert.Equal(opts, testOpts)
 	})
-	t.Run("WithHostSets", func(t *testing.T) {
+	t.Run("WithHostSources", func(t *testing.T) {
 		assert := assert.New(t)
-		opts := getOpts(WithHostSets([]string{"alice", "bob"}))
+		opts := getOpts(WithHostSources([]string{"alice", "bob"}))
 		testOpts := getDefaultOptions()
-		testOpts.withHostSets = []string{"alice", "bob"}
+		testOpts.withHostSources = []string{"alice", "bob"}
 		assert.Equal(opts, testOpts)
 	})
 	t.Run("WithWorkerFilter", func(t *testing.T) {

internal/target/repository.go

@@ -53,10 +53,9 @@ func NewRepository(r db.Reader, w db.Writer, kms *kms.Kms, opt ...Option) (*Repo
 }
 
 // LookupTarget will look up a target in the repository and return the target
-// with its host set ids and credential source ids.  If the target is not found,
-// it will return nil, nil, nil, nil.
-// No options are currently supported.
-func (r *Repository) LookupTarget(ctx context.Context, publicIdOrName string, opt ...Option) (Target, []*TargetSet, []CredentialSource, error) {
+// with its host source ids and credential source ids.  If the target is not
+// found, it will return nil, nil, nil, nil. No options are currently supported.
+func (r *Repository) LookupTarget(ctx context.Context, publicIdOrName string, opt ...Option) (Target, []HostSource, []CredentialSource, error) {
 	const op = "target.(Repository).LookupTarget"
 	opts := getOpts(opt...)
 
@@ -97,7 +96,7 @@ func (r *Repository) LookupTarget(ctx context.Context, publicIdOrName string, op
 
 	target := allocTargetView()
 	target.PublicId = publicIdOrName
-	var hostSets []*TargetSet
+	var hostSources []HostSource
 	var credSources []CredentialSource
 	_, err := r.writer.DoTx(
 		ctx,
@@ -116,7 +115,7 @@ func (r *Repository) LookupTarget(ctx context.Context, publicIdOrName string, op
 				return errors.Wrap(ctx, lookupErr, op, errors.WithMsg(fmt.Sprintf("failed for %s", publicIdOrName)))
 			}
 			var err error
-			if hostSets, err = fetchSets(ctx, read, target.PublicId); err != nil {
+			if hostSources, err = fetchHostSources(ctx, read, target.PublicId); err != nil {
 				return errors.Wrap(ctx, err, op)
 			}
 			if credSources, err = fetchCredentialSources(ctx, read, target.PublicId); err != nil {
@@ -135,7 +134,7 @@ func (r *Repository) LookupTarget(ctx context.Context, publicIdOrName string, op
 	if err != nil {
 		return nil, nil, nil, errors.Wrap(ctx, err, op)
 	}
-	return subtype, hostSets, credSources, nil
+	return subtype, hostSources, credSources, nil
 }
 
 // ListTargets in targets in a scope.  Supports the WithScopeId, WithLimit, WithTargetType options.
@@ -250,7 +249,7 @@ func (r *Repository) DeleteTarget(ctx context.Context, publicId string, _ ...Opt
 
 // update a target in the db repository with an oplog entry.
 // It currently supports no options.
-func (r *Repository) update(ctx context.Context, target Target, version uint32, fieldMaskPaths []string, setToNullPaths []string, _ ...Option) (Target, []*TargetSet, []CredentialSource, int, error) {
+func (r *Repository) update(ctx context.Context, target Target, version uint32, fieldMaskPaths []string, setToNullPaths []string, _ ...Option) (Target, []HostSource, []CredentialSource, int, error) {
 	const op = "target.(Repository).update"
 	if version == 0 {
 		return nil, nil, nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing version")
@@ -283,7 +282,7 @@ func (r *Repository) update(ctx context.Context, target Target, version uint32,
 
 	var rowsUpdated int
 	var returnedTarget interface{}
-	var hostSets []*TargetSet
+	var hostSources []HostSource
 	var credSources []CredentialSource
 	_, err = r.writer.DoTx(
 		ctx,
@@ -306,7 +305,7 @@ func (r *Repository) update(ctx context.Context, target Target, version uint32,
 				return errors.New(ctx, errors.MultipleRecords, op, "more than 1 resource would have been updated")
 			}
 
-			if hostSets, err = fetchSets(ctx, reader, target.GetPublicId()); err != nil {
+			if hostSources, err = fetchHostSources(ctx, reader, target.GetPublicId()); err != nil {
 				return errors.Wrap(ctx, err, op)
 			}
 
@@ -319,5 +318,5 @@ func (r *Repository) update(ctx context.Context, target Target, version uint32,
 	if err != nil {
 		return nil, nil, nil, db.NoRowsAffected, errors.Wrap(ctx, err, op)
 	}
-	return returnedTarget.(Target), hostSets, credSources, rowsUpdated, nil
+	return returnedTarget.(Target), hostSources, credSources, rowsUpdated, nil
 }

internal/target/repository_credential_source.go

@@ -15,7 +15,7 @@ import (
 // and the list of credential sources attached to the target, after cIds are added,
 // will be returned on success.
 // The targetVersion must match the current version of the targetId in the repository.
-func (r *Repository) AddTargetCredentialSources(ctx context.Context, targetId string, targetVersion uint32, cIds []string, _ ...Option) (Target, []*TargetSet, []CredentialSource, error) {
+func (r *Repository) AddTargetCredentialSources(ctx context.Context, targetId string, targetVersion uint32, cIds []string, _ ...Option) (Target, []HostSource, []CredentialSource, error) {
 	const op = "target.(Repository).AddTargetCredentialSources"
 	if targetId == "" {
 		return nil, nil, nil, errors.New(ctx, errors.InvalidParameter, op, "missing target id")
@@ -60,7 +60,7 @@ func (r *Repository) AddTargetCredentialSources(ctx context.Context, targetId st
 		return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
 	}
 
-	var hostSets []*TargetSet
+	var hostSources []HostSource
 	var credSources []CredentialSource
 	var updatedTarget interface{}
 	_, err = r.writer.DoTx(
@@ -96,9 +96,9 @@ func (r *Repository) AddTargetCredentialSources(ctx context.Context, targetId st
 			if err := w.WriteOplogEntryWith(ctx, oplogWrapper, targetTicket, metadata, msgs); err != nil {
 				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to write oplog"))
 			}
-			hostSets, err = fetchSets(ctx, reader, targetId)
+			hostSources, err = fetchHostSources(ctx, reader, targetId)
 			if err != nil {
-				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to retrieve credential sources after adding"))
+				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to retrieve host sources after adding"))
 			}
 			credSources, err = fetchCredentialSources(ctx, reader, targetId)
 			if err != nil {
@@ -110,7 +110,7 @@ func (r *Repository) AddTargetCredentialSources(ctx context.Context, targetId st
 	if err != nil {
 		return nil, nil, nil, errors.Wrap(ctx, err, op)
 	}
-	return updatedTarget.(Target), hostSets, credSources, nil
+	return updatedTarget.(Target), hostSources, credSources, nil
 }
 
 // DeleteTargetCredentialSources deletes credential sources from a target in the repository.
@@ -210,7 +210,7 @@ func (r *Repository) DeleteTargetCredentialSources(ctx context.Context, targetId
 // SetTargetCredentialSources will set the target's credential sources. Set will add
 // and/or delete credential sources as need to reconcile the existing credential sources
 // with the request. If clIds is empty, all the credential sources will be cleared from the target.
-func (r *Repository) SetTargetCredentialSources(ctx context.Context, targetId string, targetVersion uint32, csIds []string, _ ...Option) ([]*TargetSet, []CredentialSource, int, error) {
+func (r *Repository) SetTargetCredentialSources(ctx context.Context, targetId string, targetVersion uint32, csIds []string, _ ...Option) ([]HostSource, []CredentialSource, int, error) {
 	const op = "target.(Repository).SetTargetCredentialSources"
 	if targetId == "" {
 		return nil, nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing target id")
@@ -225,7 +225,7 @@ func (r *Repository) SetTargetCredentialSources(ctx context.Context, targetId st
 	}
 	if len(changes) == 0 {
 		// Nothing needs to be changed, return early
-		hostSets, err := fetchSets(ctx, r.reader, targetId)
+		hostSets, err := fetchHostSources(ctx, r.reader, targetId)
 		if err != nil {
 			return nil, nil, db.NoRowsAffected, errors.Wrap(ctx, err, op)
 		}
@@ -273,7 +273,7 @@ func (r *Repository) SetTargetCredentialSources(ctx context.Context, targetId st
 	}
 
 	var rowsAffected int
-	var hostSets []*TargetSet
+	var hostSources []HostSource
 	var credSources []CredentialSource
 	_, err = r.writer.DoTx(
 		ctx,
@@ -328,7 +328,7 @@ func (r *Repository) SetTargetCredentialSources(ctx context.Context, targetId st
 				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to write oplog"))
 			}
 
-			hostSets, err = fetchSets(ctx, reader, targetId)
+			hostSources, err = fetchHostSources(ctx, reader, targetId)
 			if err != nil {
 				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to retrieve current target host sets after add/delete"))
 			}
@@ -342,7 +342,7 @@ func (r *Repository) SetTargetCredentialSources(ctx context.Context, targetId st
 	if err != nil {
 		return nil, nil, db.NoRowsAffected, errors.Wrap(ctx, err, op)
 	}
-	return hostSets, credSources, rowsAffected, nil
+	return hostSources, credSources, rowsAffected, nil
 }
 
 type change struct {

internal/target/repository_host_source.go

@@ -10,29 +10,29 @@ import (
 	"github.com/hashicorp/boundary/internal/oplog"
 )
 
-// AddTargetHostSets provides the ability to add host sets (hostSetIds) to a
-// target (targetId).  The target's current db version must match the
-// targetVersion or an error will be returned.   The target and a list of
-// current host set ids will be returned on success. Zero is not a valid value
-// for the WithVersion option and will return an error.
-func (r *Repository) AddTargetHostSets(ctx context.Context, targetId string, targetVersion uint32, hostSetIds []string, _ ...Option) (Target, []*TargetSet, []CredentialSource, error) {
-	const op = "target.(Repository).AddTargetHostSets"
+// AddTargetHostSources provides the ability to add host sources (hostSourceIds)
+// to a target (targetId). The target's current db version must match the
+// targetVersion or an error will be returned.  The target and a list of current
+// host source ids will be returned on success. Zero is not a valid value for the
+// WithVersion option and will return an error.
+func (r *Repository) AddTargetHostSources(ctx context.Context, targetId string, targetVersion uint32, hostSourceIds []string, _ ...Option) (Target, []HostSource, []CredentialSource, error) {
+	const op = "target.(Repository).AddTargetHostSources"
 	if targetId == "" {
 		return nil, nil, nil, errors.New(ctx, errors.InvalidParameter, op, "missing target id")
 	}
 	if targetVersion == 0 {
 		return nil, nil, nil, errors.New(ctx, errors.InvalidParameter, op, "missing version")
 	}
-	if len(hostSetIds) == 0 {
-		return nil, nil, nil, errors.New(ctx, errors.InvalidParameter, op, "missing host set ids")
+	if len(hostSourceIds) == 0 {
+		return nil, nil, nil, errors.New(ctx, errors.InvalidParameter, op, "missing host source ids")
 	}
-	newHostSets := make([]interface{}, 0, len(hostSetIds))
-	for _, id := range hostSetIds {
+	newHostSources := make([]interface{}, 0, len(hostSourceIds))
+	for _, id := range hostSourceIds {
 		ths, err := NewTargetHostSet(targetId, id)
 		if err != nil {
 			return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory target host set"))
 		}
-		newHostSets = append(newHostSets, ths)
+		newHostSources = append(newHostSources, ths)
 	}
 	t := allocTargetView()
 	t.PublicId = targetId
@@ -56,7 +56,7 @@ func (r *Repository) AddTargetHostSets(ctx context.Context, targetId string, tar
 	if err != nil {
 		return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
 	}
-	var currentHostSets []*TargetSet
+	var currentHostSources []HostSource
 	var currentCredSources []CredentialSource
 	var updatedTarget interface{}
 	_, err = r.writer.DoTx(
@@ -80,18 +80,18 @@ func (r *Repository) AddTargetHostSets(ctx context.Context, targetId string, tar
 			}
 			msgs = append(msgs, &targetOplogMsg)
 
-			hostSetsOplogMsgs := make([]*oplog.Message, 0, len(newHostSets))
-			if err := w.CreateItems(ctx, newHostSets, db.NewOplogMsgs(&hostSetsOplogMsgs)); err != nil {
-				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to add target host sets"))
+			hostSourcesOplogMsgs := make([]*oplog.Message, 0, len(newHostSources))
+			if err := w.CreateItems(ctx, newHostSources, db.NewOplogMsgs(&hostSourcesOplogMsgs)); err != nil {
+				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to add target host sources"))
 			}
-			msgs = append(msgs, hostSetsOplogMsgs...)
+			msgs = append(msgs, hostSourcesOplogMsgs...)
 
 			if err := w.WriteOplogEntryWith(ctx, oplogWrapper, targetTicket, metadata, msgs); err != nil {
 				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to write oplog"))
 			}
-			currentHostSets, err = fetchSets(ctx, reader, targetId)
+			currentHostSources, err = fetchHostSources(ctx, reader, targetId)
 			if err != nil {
-				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to retrieve current host sets after adds"))
+				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to retrieve current host sources after adds"))
 			}
 			currentCredSources, err = fetchCredentialSources(ctx, reader, targetId)
 			if err != nil {
@@ -103,31 +103,31 @@ func (r *Repository) AddTargetHostSets(ctx context.Context, targetId string, tar
 	if err != nil {
 		return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("error creating sets"))
 	}
-	return updatedTarget.(Target), currentHostSets, currentCredSources, nil
+	return updatedTarget.(Target), currentHostSources, currentCredSources, nil
 }
 
-// DeleteTargeHostSets deletes host sets from a target (targetId). The target's
-// current db version must match the targetVersion or an error will be returned.
-// Zero is not a valid value for the WithVersion option and will return an
-// error.
-func (r *Repository) DeleteTargeHostSets(ctx context.Context, targetId string, targetVersion uint32, hostSetIds []string, _ ...Option) (int, error) {
-	const op = "target.(Repository).DeleteTargeHostSets"
+// DeleteTargeHostSources deletes host sources from a target (targetId). The
+// target's current db version must match the targetVersion or an error will be
+// returned. Zero is not a valid value for the WithVersion option and will
+// return an error.
+func (r *Repository) DeleteTargetHostSources(ctx context.Context, targetId string, targetVersion uint32, hostSourceIds []string, _ ...Option) (int, error) {
+	const op = "target.(Repository).DeleteTargetHostSources"
 	if targetId == "" {
 		return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing target id")
 	}
 	if targetVersion == 0 {
 		return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing version")
 	}
-	if len(hostSetIds) == 0 {
-		return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing host set ids")
+	if len(hostSourceIds) == 0 {
+		return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing host source ids")
 	}
-	deleteTargeHostSets := make([]interface{}, 0, len(hostSetIds))
-	for _, id := range hostSetIds {
+	deleteTargetHostSources := make([]interface{}, 0, len(hostSourceIds))
+	for _, id := range hostSourceIds {
 		ths, err := NewTargetHostSet(targetId, id)
 		if err != nil {
 			return db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory target host set"))
 		}
-		deleteTargeHostSets = append(deleteTargeHostSets, ths)
+		deleteTargetHostSources = append(deleteTargetHostSources, ths)
 	}
 
 	t := allocTargetView()
@@ -176,16 +176,16 @@ func (r *Repository) DeleteTargeHostSets(ctx context.Context, targetId string, t
 			}
 			msgs = append(msgs, &targetOplogMsg)
 
-			hostSetsOplogMsgs := make([]*oplog.Message, 0, len(deleteTargeHostSets))
-			rowsDeleted, err := w.DeleteItems(ctx, deleteTargeHostSets, db.NewOplogMsgs(&hostSetsOplogMsgs))
+			hostSourcesOplogMsgs := make([]*oplog.Message, 0, len(deleteTargetHostSources))
+			rowsDeleted, err := w.DeleteItems(ctx, deleteTargetHostSources, db.NewOplogMsgs(&hostSourcesOplogMsgs))
 			if err != nil {
-				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to delete target host sets"))
+				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to delete target host sources"))
 			}
-			if rowsDeleted != len(deleteTargeHostSets) {
-				return errors.New(ctx, errors.MultipleRecords, op, fmt.Sprintf("target host sets deleted %d did not match request for %d", rowsDeleted, len(deleteTargeHostSets)))
+			if rowsDeleted != len(deleteTargetHostSources) {
+				return errors.New(ctx, errors.MultipleRecords, op, fmt.Sprintf("target host sources deleted %d did not match request for %d", rowsDeleted, len(deleteTargetHostSources)))
 			}
 			totalRowsDeleted += rowsDeleted
-			msgs = append(msgs, hostSetsOplogMsgs...)
+			msgs = append(msgs, hostSourcesOplogMsgs...)
 
 			if err := w.WriteOplogEntryWith(ctx, oplogWrapper, targetTicket, metadata, msgs); err != nil {
 				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to write oplog"))
@@ -199,12 +199,12 @@ func (r *Repository) DeleteTargeHostSets(ctx context.Context, targetId string, t
 	return totalRowsDeleted, nil
 }
 
-// SetTargetHostSets will set the target's host sets. Set add and/or delete
-// target host sets as need to reconcile the existing sets with the sets
-// requested. If hostSetIds is empty, the target host sets will be cleared. Zero
+// SetTargetHostSources will set the target's host sources. Set add and/or delete
+// target host sources as need to reconcile the existing sets with the sets
+// requested. If hostSourceIds is empty, the target host sources will be cleared. Zero
 // is not a valid value for the WithVersion option and will return an error.
-func (r *Repository) SetTargetHostSets(ctx context.Context, targetId string, targetVersion uint32, hostSetIds []string, _ ...Option) ([]*TargetSet, []CredentialSource, int, error) {
-	const op = "target.(Repository).SetTargetHostSets"
+func (r *Repository) SetTargetHostSources(ctx context.Context, targetId string, targetVersion uint32, hostSourceIds []string, _ ...Option) ([]HostSource, []CredentialSource, int, error) {
+	const op = "target.(Repository).SetTargetHostSources"
 	if targetId == "" {
 		return nil, nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing target id")
 	}
@@ -223,16 +223,16 @@ func (r *Repository) SetTargetHostSets(ctx context.Context, targetId string, tar
 	// set.
 
 	// TODO(mgaffney) 08/2020: Use SQL to calculate changes.
-	foundThs, err := fetchSets(ctx, r.reader, targetId)
+	foundThs, err := fetchHostSources(ctx, r.reader, targetId)
 	if err != nil {
-		return nil, nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to search for existing target host sets"))
+		return nil, nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to search for existing target host sources"))
 	}
-	found := map[string]*TargetSet{}
+	found := map[string]HostSource{}
 	for _, s := range foundThs {
-		found[s.PublicId] = s
+		found[s.Id()] = s
 	}
-	addHostSets := make([]interface{}, 0, len(hostSetIds))
-	for _, id := range hostSetIds {
+	addHostSources := make([]interface{}, 0, len(hostSourceIds))
+	for _, id := range hostSourceIds {
 		if _, ok := found[id]; ok {
 			// found a match, so do nothing (we want to keep it), but remove it
 			// from found
@@ -243,19 +243,19 @@ func (r *Repository) SetTargetHostSets(ctx context.Context, targetId string, tar
 		if err != nil {
 			return nil, nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory target host set"))
 		}
-		addHostSets = append(addHostSets, hs)
+		addHostSources = append(addHostSources, hs)
 	}
-	deleteHostSets := make([]interface{}, 0, len(hostSetIds))
+	deleteHostSources := make([]interface{}, 0, len(hostSourceIds))
 	if len(found) > 0 {
 		for _, s := range found {
-			hs, err := NewTargetHostSet(targetId, s.PublicId)
+			hs, err := NewTargetHostSet(targetId, s.Id())
 			if err != nil {
 				return nil, nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg(" unable to create in memory target host set"))
 			}
-			deleteHostSets = append(deleteHostSets, hs)
+			deleteHostSources = append(deleteHostSources, hs)
 		}
 	}
-	if len(addHostSets) == 0 && len(deleteHostSets) == 0 {
+	if len(addHostSources) == 0 && len(deleteHostSources) == 0 {
 		return foundThs, nil, db.NoRowsAffected, nil
 	}
 
@@ -277,7 +277,7 @@ func (r *Repository) SetTargetHostSets(ctx context.Context, targetId string, tar
 	}
 
 	var totalRowsAffected int
-	var currentHostSets []*TargetSet
+	var currentHostSources []HostSource
 	var currentCredSources []CredentialSource
 	_, err = r.writer.DoTx(
 		ctx,
@@ -296,42 +296,42 @@ func (r *Repository) SetTargetHostSets(ctx context.Context, targetId string, tar
 				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to update target version"))
 			}
 			if rowsUpdated != 1 {
-				return errors.New(ctx, errors.MultipleRecords, op, fmt.Sprintf("set target host sets: updated target and %d rows updated", rowsUpdated))
+				return errors.New(ctx, errors.MultipleRecords, op, fmt.Sprintf("set target host sources: updated target and %d rows updated", rowsUpdated))
 			}
 			msgs = append(msgs, &targetOplogMsg)
 
 			// Write the new ones in
-			if len(addHostSets) > 0 {
-				hostSetOplogMsgs := make([]*oplog.Message, 0, len(addHostSets))
-				if err := w.CreateItems(ctx, addHostSets, db.NewOplogMsgs(&hostSetOplogMsgs)); err != nil {
-					return errors.Wrap(ctx, err, op, errors.WithMsg("unable to add target host sets"))
+			if len(addHostSources) > 0 {
+				hostSourceOplogMsgs := make([]*oplog.Message, 0, len(addHostSources))
+				if err := w.CreateItems(ctx, addHostSources, db.NewOplogMsgs(&hostSourceOplogMsgs)); err != nil {
+					return errors.Wrap(ctx, err, op, errors.WithMsg("unable to add target host sources"))
 				}
-				totalRowsAffected += len(addHostSets)
-				msgs = append(msgs, hostSetOplogMsgs...)
+				totalRowsAffected += len(addHostSources)
+				msgs = append(msgs, hostSourceOplogMsgs...)
 				metadata["op-type"] = append(metadata["op-type"], oplog.OpType_OP_TYPE_CREATE.String())
 			}
 
 			// Anything we didn't take out of found needs to be removed
-			if len(deleteHostSets) > 0 {
-				hostSetOplogMsgs := make([]*oplog.Message, 0, len(deleteHostSets))
-				rowsDeleted, err := w.DeleteItems(ctx, deleteHostSets, db.NewOplogMsgs(&hostSetOplogMsgs))
+			if len(deleteHostSources) > 0 {
+				hostSourceOplogMsgs := make([]*oplog.Message, 0, len(deleteHostSources))
+				rowsDeleted, err := w.DeleteItems(ctx, deleteHostSources, db.NewOplogMsgs(&hostSourceOplogMsgs))
 				if err != nil {
-					return errors.Wrap(ctx, err, op, errors.WithMsg("unable to delete target host set"))
+					return errors.Wrap(ctx, err, op, errors.WithMsg("unable to delete target host source"))
 				}
-				if rowsDeleted != len(deleteHostSets) {
-					return errors.New(ctx, errors.MultipleRecords, op, fmt.Sprintf("target host sets deleted %d did not match request for %d", rowsDeleted, len(deleteHostSets)))
+				if rowsDeleted != len(deleteHostSources) {
+					return errors.New(ctx, errors.MultipleRecords, op, fmt.Sprintf("target host sources deleted %d did not match request for %d", rowsDeleted, len(deleteHostSources)))
 				}
 				totalRowsAffected += rowsDeleted
-				msgs = append(msgs, hostSetOplogMsgs...)
+				msgs = append(msgs, hostSourceOplogMsgs...)
 				metadata["op-type"] = append(metadata["op-type"], oplog.OpType_OP_TYPE_DELETE.String())
 			}
 			if err := w.WriteOplogEntryWith(ctx, oplogWrapper, targetTicket, metadata, msgs); err != nil {
 				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to write oplog"))
 			}
 
-			currentHostSets, err = fetchSets(ctx, reader, targetId)
+			currentHostSources, err = fetchHostSources(ctx, reader, targetId)
 			if err != nil {
-				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to retrieve current target host sets after set"))
+				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to retrieve current target host sources after set"))
 			}
 			currentCredSources, err = fetchCredentialSources(ctx, reader, targetId)
 			if err != nil {
@@ -344,17 +344,24 @@ func (r *Repository) SetTargetHostSets(ctx context.Context, targetId string, tar
 	if err != nil {
 		return nil, nil, db.NoRowsAffected, errors.Wrap(ctx, err, op)
 	}
-	return currentHostSets, currentCredSources, totalRowsAffected, nil
+	return currentHostSources, currentCredSources, totalRowsAffected, nil
 }
 
-func fetchSets(ctx context.Context, r db.Reader, targetId string) ([]*TargetSet, error) {
-	const op = "target.fetchSets"
+func fetchHostSources(ctx context.Context, r db.Reader, targetId string) ([]HostSource, error) {
+	const op = "target.fetchHostSources"
 	var hostSets []*TargetSet
 	if err := r.SearchWhere(ctx, &hostSets, "target_id = ?", []interface{}{targetId}); err != nil {
 		return nil, errors.Wrap(ctx, err, op)
 	}
+	// FIXME: When we have direct host additions, there will need to be an
+	// updated view that unions between sets and hosts, at which point the type
+	// above will change. For now we just take the libraries and wrap them.
 	if len(hostSets) == 0 {
 		return nil, nil
 	}
-	return hostSets, nil
+	ret := make([]HostSource, len(hostSets))
+	for i, lib := range hostSets {
+		ret[i] = lib
+	}
+	return ret, nil
 }

internal/target/repository_host_source_test.go

@@ -94,16 +94,16 @@ func TestRepository_AddTargetHostSets(t *testing.T) {
 
 			projTarget := TestTcpTarget(t, conn, staticProj.PublicId, "static-proj")
 
-			var hostSetIds []string
+			var hostSourceIds []string
 			origTarget, origHostSet, _, err := repo.LookupTarget(context.Background(), projTarget.PublicId)
 			require.NoError(err)
 			require.Equal(0, len(origHostSet))
 
 			if tt.args.wantTargetIds {
-				hostSetIds = createHostSetsFn([]string{staticOrg.PublicId}, []string{staticProj.PublicId})
+				hostSourceIds = createHostSetsFn([]string{staticOrg.PublicId}, []string{staticProj.PublicId})
 			}
 
-			gotTarget, gotHostSets, _, err := repo.AddTargetHostSets(context.Background(), projTarget.PublicId, tt.args.targetVersion, hostSetIds, tt.args.opt...)
+			gotTarget, gotHostSources, _, err := repo.AddTargetHostSources(context.Background(), projTarget.PublicId, tt.args.targetVersion, hostSourceIds, tt.args.opt...)
 			if tt.wantErr {
 				require.Error(err)
 				if tt.wantErrIs != nil {
@@ -124,9 +124,9 @@ func TestRepository_AddTargetHostSets(t *testing.T) {
 				return
 			}
 			require.NoError(err)
-			gotHostSet := map[string]*TargetSet{}
-			for _, s := range gotHostSets {
-				gotHostSet[s.PublicId] = s
+			gotHostSet := map[string]HostSource{}
+			for _, s := range gotHostSources {
+				gotHostSet[s.Id()] = s
 			}
 
 			// TODO (jimlambrt 9/2020) - unfortunately, we can currently
@@ -141,17 +141,17 @@ func TestRepository_AddTargetHostSets(t *testing.T) {
 			err = db.TestVerifyOplog(t, rw, projTarget.PublicId, db.WithOperation(oplog.OpType_OP_TYPE_UPDATE), db.WithCreateNotBefore(10*time.Second))
 			assert.NoError(err)
 
-			foundHostSets, err := fetchSets(context.Background(), rw, projTarget.PublicId)
+			foundHostSources, err := fetchHostSources(context.Background(), rw, projTarget.PublicId)
 			require.NoError(err)
-			for _, s := range foundHostSets {
-				assert.NotEmpty(gotHostSet[s.PublicId])
+			for _, s := range foundHostSources {
+				assert.NotEmpty(gotHostSet[s.Id()])
 			}
 
 			target, ths, _, err := repo.LookupTarget(context.Background(), projTarget.PublicId)
 			require.NoError(err)
 			assert.Equal(tt.args.targetVersion+1, target.GetVersion())
 			assert.Equal(origTarget.GetVersion(), target.GetVersion()-1)
-			assert.Equal(gotHostSets, ths)
+			assert.Equal(gotHostSources, ths)
 			assert.True(proto.Equal(gotTarget.(*TcpTarget), target.(*TcpTarget)))
 		})
 	}
@@ -165,26 +165,26 @@ func TestRepository_AddTargetHostSets(t *testing.T) {
 		hs3 := hsets[2]
 
 		projTarget := TestTcpTarget(t, conn, staticProj.PublicId, "add-existing")
-		_, gotHostSets, _, err := repo.AddTargetHostSets(context.Background(), projTarget.PublicId, 1, []string{hs1.PublicId})
+		_, gotHostSources, _, err := repo.AddTargetHostSources(context.Background(), projTarget.PublicId, 1, []string{hs1.PublicId})
 		require.NoError(err)
-		assert.Len(gotHostSets, 1)
-		assert.Equal(hs1.PublicId, gotHostSets[0].PublicId)
+		assert.Len(gotHostSources, 1)
+		assert.Equal(hs1.PublicId, gotHostSources[0].Id())
 
 		// Adding hs1 again should error
-		_, _, _, err = repo.AddTargetHostSets(context.Background(), projTarget.PublicId, 2, []string{hs1.PublicId})
+		_, _, _, err = repo.AddTargetHostSources(context.Background(), projTarget.PublicId, 2, []string{hs1.PublicId})
 		require.Error(err)
 		assert.True(errors.Match(errors.T(errors.NotUnique), err))
 
 		// Adding multiple with hs1 in set should error
-		_, _, _, err = repo.AddTargetHostSets(context.Background(), projTarget.PublicId, 2, []string{hs3.PublicId, hs2.PublicId, hs1.PublicId})
+		_, _, _, err = repo.AddTargetHostSources(context.Background(), projTarget.PublicId, 2, []string{hs3.PublicId, hs2.PublicId, hs1.PublicId})
 		require.Error(err)
 		assert.True(errors.Match(errors.T(errors.NotUnique), err))
 
 		// Previous transactions should have been rolled back and only hs1 should be associated
-		gotHostSets, err = fetchSets(context.Background(), rw, projTarget.PublicId)
+		gotHostSources, err = fetchHostSources(context.Background(), rw, projTarget.PublicId)
 		require.NoError(err)
-		assert.Len(gotHostSets, 1)
-		assert.Equal(hs1.PublicId, gotHostSets[0].PublicId)
+		assert.Len(gotHostSources, 1)
+		assert.Equal(hs1.PublicId, gotHostSources[0].Id())
 	})
 }
 
@@ -302,13 +302,13 @@ func TestRepository_DeleteTargetHosts(t *testing.T) {
 					hsIds = append(hsIds, hsets[0].PublicId)
 				}
 			}
-			_, addedHostSets, _, err := repo.AddTargetHostSets(context.Background(), tt.args.target.GetPublicId(), 1, hsIds, tt.args.opt...)
+			_, addedHostSources, _, err := repo.AddTargetHostSources(context.Background(), tt.args.target.GetPublicId(), 1, hsIds, tt.args.opt...)
 			require.NoError(err)
-			assert.Equal(tt.args.createCnt, len(addedHostSets))
+			assert.Equal(tt.args.createCnt, len(addedHostSources))
 
-			deleteHostSets := make([]string, 0, tt.args.deleteCnt)
+			deleteHostSources := make([]string, 0, tt.args.deleteCnt)
 			for i := 0; i < tt.args.deleteCnt; i++ {
-				deleteHostSets = append(deleteHostSets, hsIds[i])
+				deleteHostSources = append(deleteHostSources, hsIds[i])
 			}
 			var targetId string
 			switch {
@@ -324,7 +324,7 @@ func TestRepository_DeleteTargetHosts(t *testing.T) {
 			default:
 				targetVersion = 2
 			}
-			deletedRows, err := repo.DeleteTargeHostSets(context.Background(), targetId, targetVersion, deleteHostSets, tt.args.opt...)
+			deletedRows, err := repo.DeleteTargetHostSources(context.Background(), targetId, targetVersion, deleteHostSources, tt.args.opt...)
 			if tt.wantErr {
 				assert.Error(err)
 				assert.Equal(0, deletedRows)
@@ -368,27 +368,27 @@ func TestRepository_DeleteTargetHosts(t *testing.T) {
 		hs3 := hsets[2]
 
 		projTarget := TestTcpTarget(t, conn, proj.PublicId, "delete-unassociated")
-		_, gotHostSets, _, err := repo.AddTargetHostSets(context.Background(), projTarget.PublicId, 1, []string{hs1.PublicId, hs2.PublicId})
+		_, gotHostSources, _, err := repo.AddTargetHostSources(context.Background(), projTarget.PublicId, 1, []string{hs1.PublicId, hs2.PublicId})
 		require.NoError(err)
-		assert.Len(gotHostSets, 2)
-		assert.Equal(hs1.PublicId, gotHostSets[0].PublicId)
+		assert.Len(gotHostSources, 2)
+		assert.Equal(hs1.PublicId, gotHostSources[0].Id())
 
 		// Deleting an unassociated host set should return an error
-		delCount, err := repo.DeleteTargeHostSets(context.Background(), projTarget.PublicId, 2, []string{hs3.PublicId})
+		delCount, err := repo.DeleteTargetHostSources(context.Background(), projTarget.PublicId, 2, []string{hs3.PublicId})
 		require.Error(err)
 		assert.True(errors.Match(errors.T(errors.MultipleRecords), err))
 		assert.Equal(0, delCount)
 
 		// Deleting host sets which includes an unassociated host set should return an error
-		delCount, err = repo.DeleteTargeHostSets(context.Background(), projTarget.PublicId, 2, []string{hs1.PublicId, hs2.PublicId, hs3.PublicId})
+		delCount, err = repo.DeleteTargetHostSources(context.Background(), projTarget.PublicId, 2, []string{hs1.PublicId, hs2.PublicId, hs3.PublicId})
 		require.Error(err)
 		assert.True(errors.Match(errors.T(errors.MultipleRecords), err))
 		assert.Equal(0, delCount)
 
 		// Previous transactions should have been rolled back
-		gotHostSets, err = fetchSets(context.Background(), rw, projTarget.PublicId)
+		gotHostSources, err = fetchHostSources(context.Background(), rw, projTarget.PublicId)
 		require.NoError(err)
-		assert.Len(gotHostSets, 2)
+		assert.Len(gotHostSources, 2)
 	})
 }
 
@@ -421,23 +421,23 @@ func TestRepository_SetTargetHostSets(t *testing.T) {
 		return results
 	}
 
-	setupFn := func(target Target) []*TargetSet {
+	setupFn := func(target Target) []HostSource {
 		hs := createHostSetsFn()
-		_, created, _, err := repo.AddTargetHostSets(context.Background(), target.GetPublicId(), 1, hs)
+		_, created, _, err := repo.AddTargetHostSources(context.Background(), target.GetPublicId(), 1, hs)
 		require.NoError(t, err)
 		require.Equal(t, 10, len(created))
 		return created
 	}
 	type args struct {
-		target            Target
-		targetVersion     uint32
-		hostSetIds        []string
-		addToOrigHostSets bool
-		opt               []Option
+		target               Target
+		targetVersion        uint32
+		hostSourceIds        []string
+		addToOrigHostSources bool
+		opt                  []Option
 	}
 	tests := []struct {
 		name             string
-		setup            func(Target) []*TargetSet
+		setup            func(Target) []HostSource
 		args             args
 		wantAffectedRows int
 		wantErr          bool
@@ -448,7 +448,7 @@ func TestRepository_SetTargetHostSets(t *testing.T) {
 			args: args{
 				target:        TestTcpTarget(t, conn, proj.PublicId, "clear"),
 				targetVersion: 2, // yep, since setupFn will increment it to 2
-				hostSetIds:    []string{},
+				hostSourceIds: []string{},
 			},
 			wantErr:          false,
 			wantAffectedRows: 10,
@@ -457,10 +457,10 @@ func TestRepository_SetTargetHostSets(t *testing.T) {
 			name:  "no-change",
 			setup: setupFn,
 			args: args{
-				target:            TestTcpTarget(t, conn, proj.PublicId, "no-change"),
-				targetVersion:     2, // yep, since setupFn will increment it to 2
-				hostSetIds:        []string{},
-				addToOrigHostSets: true,
+				target:               TestTcpTarget(t, conn, proj.PublicId, "no-change"),
+				targetVersion:        2, // yep, since setupFn will increment it to 2
+				hostSourceIds:        []string{},
+				addToOrigHostSources: true,
 			},
 			wantErr:          false,
 			wantAffectedRows: 0,
@@ -469,10 +469,10 @@ func TestRepository_SetTargetHostSets(t *testing.T) {
 			name:  "add-sets",
 			setup: setupFn,
 			args: args{
-				target:            TestTcpTarget(t, conn, proj.PublicId, "add-sets"),
-				targetVersion:     2, // yep, since setupFn will increment it to 2
-				hostSetIds:        []string{testHostSetIds[0], testHostSetIds[1]},
-				addToOrigHostSets: true,
+				target:               TestTcpTarget(t, conn, proj.PublicId, "add-sets"),
+				targetVersion:        2, // yep, since setupFn will increment it to 2
+				hostSourceIds:        []string{testHostSetIds[0], testHostSetIds[1]},
+				addToOrigHostSources: true,
 			},
 			wantErr:          false,
 			wantAffectedRows: 2,
@@ -481,10 +481,10 @@ func TestRepository_SetTargetHostSets(t *testing.T) {
 			name:  "add host sets with zero version",
 			setup: setupFn,
 			args: args{
-				target:            TestTcpTarget(t, conn, proj.PublicId, "add host sets with zero version"),
-				targetVersion:     0,
-				hostSetIds:        []string{testHostSetIds[0], testHostSetIds[1]},
-				addToOrigHostSets: true,
+				target:               TestTcpTarget(t, conn, proj.PublicId, "add host sets with zero version"),
+				targetVersion:        0,
+				hostSourceIds:        []string{testHostSetIds[0], testHostSetIds[1]},
+				addToOrigHostSources: true,
 			},
 			wantErr: true,
 		},
@@ -492,10 +492,10 @@ func TestRepository_SetTargetHostSets(t *testing.T) {
 			name:  "remove existing and add users and grps",
 			setup: setupFn,
 			args: args{
-				target:            TestTcpTarget(t, conn, proj.PublicId, "remove existing and add host sets"),
-				targetVersion:     2, // yep, since setupFn will increment it to 2
-				hostSetIds:        []string{testHostSetIds[0], testHostSetIds[1]},
-				addToOrigHostSets: false,
+				target:               TestTcpTarget(t, conn, proj.PublicId, "remove existing and add host sets"),
+				targetVersion:        2, // yep, since setupFn will increment it to 2
+				hostSourceIds:        []string{testHostSetIds[0], testHostSetIds[1]},
+				addToOrigHostSources: false,
 			},
 			wantErr:          false,
 			wantAffectedRows: 12,
@@ -504,22 +504,22 @@ func TestRepository_SetTargetHostSets(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			var origHostSets []*TargetSet
+			var origHostSources []HostSource
 			if tt.setup != nil {
-				origHostSets = tt.setup(tt.args.target)
+				origHostSources = tt.setup(tt.args.target)
 			}
-			if tt.args.addToOrigHostSets {
-				origIds := make([]string, 0, len(origHostSets))
-				for _, s := range origHostSets {
-					origIds = append(origIds, s.PublicId)
+			if tt.args.addToOrigHostSources {
+				origIds := make([]string, 0, len(origHostSources))
+				for _, s := range origHostSources {
+					origIds = append(origIds, s.Id())
 				}
-				tt.args.hostSetIds = append(tt.args.hostSetIds, origIds...)
+				tt.args.hostSourceIds = append(tt.args.hostSourceIds, origIds...)
 			}
 			origTarget, lookedUpHs, _, err := repo.LookupTarget(context.Background(), tt.args.target.GetPublicId())
 			require.NoError(err)
-			assert.Equal(len(origHostSets), len(lookedUpHs))
+			assert.Equal(len(origHostSources), len(lookedUpHs))
 
-			got, _, affectedRows, err := repo.SetTargetHostSets(context.Background(), tt.args.target.GetPublicId(), tt.args.targetVersion, tt.args.hostSetIds, tt.args.opt...)
+			got, _, affectedRows, err := repo.SetTargetHostSources(context.Background(), tt.args.target.GetPublicId(), tt.args.targetVersion, tt.args.hostSourceIds, tt.args.opt...)
 			if tt.wantErr {
 				require.Error(err)
 				t.Log(err)
@@ -528,17 +528,17 @@ func TestRepository_SetTargetHostSets(t *testing.T) {
 			t.Log(err)
 			require.NoError(err)
 			assert.Equal(tt.wantAffectedRows, affectedRows)
-			assert.Equal(len(tt.args.hostSetIds), len(got))
+			assert.Equal(len(tt.args.hostSourceIds), len(got))
 
 			var wantIds []string
-			wantIds = append(wantIds, tt.args.hostSetIds...)
+			wantIds = append(wantIds, tt.args.hostSourceIds...)
 			sort.Strings(wantIds)
 
 			var gotIds []string
 			if len(got) > 0 {
 				gotIds = make([]string, 0, len(got))
 				for _, s := range got {
-					gotIds = append(gotIds, s.PublicId)
+					gotIds = append(gotIds, s.Id())
 				}
 			}
 			sort.Strings(gotIds)

internal/target/repository_tcp_target.go

@@ -14,8 +14,8 @@ import (
 
 // CreateTcpTarget inserts into the repository and returns the new Target with
 // its list of host sets and credential libraries.
-// WithHostSets and WithCredentialSources are the only supported option.
-func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt ...Option) (Target, []*TargetSet, []CredentialSource, error) {
+// WithHostSources and WithCredentialSources are the only supported option.
+func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt ...Option) (Target, []HostSource, []CredentialSource, error) {
 	const op = "target.(Repository).CreateTcpTarget"
 	opts := getOpts(opt...)
 	if target == nil {
@@ -54,8 +54,8 @@ func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt
 		return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
 	}
 
-	newHostSets := make([]interface{}, 0, len(opts.withHostSets))
-	for _, hsId := range opts.withHostSets {
+	newHostSets := make([]interface{}, 0, len(opts.withHostSources))
+	for _, hsId := range opts.withHostSources {
 		hostSet, err := NewTargetHostSet(t.PublicId, hsId)
 		if err != nil {
 			return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory target host set"))
@@ -74,7 +74,7 @@ func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt
 
 	metadata := t.oplog(oplog.OpType_OP_TYPE_CREATE)
 	var returnedTarget interface{}
-	var returnedHostSet []*TargetSet
+	var returnedHostSources []HostSource
 	var returnedCredSources []CredentialSource
 	_, err = r.writer.DoTx(
 		ctx,
@@ -97,8 +97,8 @@ func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt
 				if err := w.CreateItems(ctx, newHostSets, db.NewOplogMsgs(&hostSetOplogMsgs)); err != nil {
 					return errors.Wrap(ctx, err, op, errors.WithMsg("unable to add host sets"))
 				}
-				if returnedHostSet, err = fetchSets(ctx, read, t.PublicId); err != nil {
-					return errors.Wrap(ctx, err, op, errors.WithMsg("unable to read host sets"))
+				if returnedHostSources, err = fetchHostSources(ctx, read, t.PublicId); err != nil {
+					return errors.Wrap(ctx, err, op, errors.WithMsg("unable to read host sources"))
 				}
 				msgs = append(msgs, hostSetOplogMsgs...)
 			}
@@ -122,7 +122,7 @@ func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt
 	if err != nil {
 		return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("failed for %s target id", t.PublicId)))
 	}
-	return returnedTarget.(*TcpTarget), returnedHostSet, returnedCredSources, nil
+	return returnedTarget.(*TcpTarget), returnedHostSources, returnedCredSources, nil
 }
 
 // UpdateTcpTarget will update a target in the repository and return the written
@@ -131,7 +131,7 @@ func (r *Repository) CreateTcpTarget(ctx context.Context, target *TcpTarget, opt
 // included in fieldMask. Name, Description, and WorkerFilter are the only
 // updatable fields. If no updatable fields are included in the fieldMaskPaths,
 // then an error is returned.
-func (r *Repository) UpdateTcpTarget(ctx context.Context, target *TcpTarget, version uint32, fieldMaskPaths []string, _ ...Option) (Target, []*TargetSet, []CredentialSource, int, error) {
+func (r *Repository) UpdateTcpTarget(ctx context.Context, target *TcpTarget, version uint32, fieldMaskPaths []string, _ ...Option) (Target, []HostSource, []CredentialSource, int, error) {
 	const op = "target.(Repository).UpdateTcpTarget"
 	if target == nil {
 		return nil, nil, nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing target")
@@ -172,7 +172,7 @@ func (r *Repository) UpdateTcpTarget(ctx context.Context, target *TcpTarget, ver
 	}
 	var returnedTarget Target
 	var rowsUpdated int
-	var targetSets []*TargetSet
+	var hostSources []HostSource
 	var credSources []CredentialSource
 	_, err := r.writer.DoTx(
 		ctx,
@@ -181,7 +181,7 @@ func (r *Repository) UpdateTcpTarget(ctx context.Context, target *TcpTarget, ver
 		func(read db.Reader, w db.Writer) error {
 			var err error
 			t := target.Clone().(*TcpTarget)
-			returnedTarget, targetSets, credSources, rowsUpdated, err = r.update(ctx, t, version, dbMask, nullFields)
+			returnedTarget, hostSources, credSources, rowsUpdated, err = r.update(ctx, t, version, dbMask, nullFields)
 			if err != nil {
 				return errors.Wrap(ctx, err, op)
 			}
@@ -194,5 +194,5 @@ func (r *Repository) UpdateTcpTarget(ctx context.Context, target *TcpTarget, ver
 		}
 		return nil, nil, nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("failed for %s", target.PublicId)))
 	}
-	return returnedTarget, targetSets, credSources, rowsUpdated, nil
+	return returnedTarget, hostSources, credSources, rowsUpdated, nil
 }

internal/target/repository_tcp_target_test.go

@@ -47,12 +47,12 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 		opt    []Option
 	}
 	tests := []struct {
-		name         string
-		args         args
-		wantHostSets []string
-		wantCredLibs []string
-		wantErr      bool
-		wantIsError  errors.Code
+		name            string
+		args            args
+		wantHostSources []string
+		wantCredLibs    []string
+		wantErr         bool
+		wantIsError     errors.Code
 	}{
 		{
 			name: "valid-org",
@@ -66,9 +66,9 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 					return target
 				}(),
 			},
-			wantErr:      false,
-			wantCredLibs: []string{},
-			wantHostSets: []string{},
+			wantErr:         false,
+			wantCredLibs:    []string{},
+			wantHostSources: []string{},
 		},
 		{
 			name: "valid-org-with-host-sets",
@@ -81,11 +81,11 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 					require.NoError(t, err)
 					return target
 				}(),
-				opt: []Option{WithHostSets(sets)},
+				opt: []Option{WithHostSources(sets)},
 			},
-			wantErr:      false,
-			wantHostSets: sets,
-			wantCredLibs: []string{},
+			wantErr:         false,
+			wantHostSources: sets,
+			wantCredLibs:    []string{},
 		},
 		{
 			name: "valid-org-with-cred-libs",
@@ -100,9 +100,9 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 				}(),
 				opt: []Option{WithCredentialSources(clIds)},
 			},
-			wantErr:      false,
-			wantCredLibs: clIds,
-			wantHostSets: []string{},
+			wantErr:         false,
+			wantCredLibs:    clIds,
+			wantHostSources: []string{},
 		},
 		{
 			name: "valid-org-with-cred-libs-and-host-sets",
@@ -116,13 +116,13 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 					return target
 				}(),
 				opt: []Option{
-					WithHostSets(sets),
+					WithHostSources(sets),
 					WithCredentialSources(clIds),
 				},
 			},
-			wantErr:      false,
-			wantCredLibs: clIds,
-			wantHostSets: sets,
+			wantErr:         false,
+			wantCredLibs:    clIds,
+			wantHostSources: sets,
 		},
 		{
 			name: "nil-target",
@@ -175,7 +175,7 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			target, hostSets, credSources, err := repo.CreateTcpTarget(context.Background(), tt.args.target, tt.args.opt...)
+			target, hostSources, credSources, err := repo.CreateTcpTarget(context.Background(), tt.args.target, tt.args.opt...)
 			if tt.wantErr {
 				assert.Error(err)
 				assert.Nil(target)
@@ -184,11 +184,11 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 			}
 			require.NoError(err)
 			assert.NotNil(target.GetPublicId())
-			hsIds := make([]string, 0, len(hostSets))
-			for _, s := range hostSets {
-				hsIds = append(hsIds, s.PublicId)
+			hsIds := make([]string, 0, len(hostSources))
+			for _, s := range hostSources {
+				hsIds = append(hsIds, s.Id())
 			}
-			assert.Equal(tt.wantHostSets, hsIds)
+			assert.Equal(tt.wantHostSources, hsIds)
 
 			clIds := make([]string, 0, len(credSources))
 			for _, cl := range credSources {
@@ -196,10 +196,10 @@ func TestRepository_CreateTcpTarget(t *testing.T) {
 			}
 			assert.Equal(tt.wantCredLibs, clIds)
 
-			foundTarget, foundHostSets, foundCredLibs, err := repo.LookupTarget(context.Background(), target.GetPublicId())
+			foundTarget, foundHostSources, foundCredLibs, err := repo.LookupTarget(context.Background(), target.GetPublicId())
 			assert.NoError(err)
 			assert.True(proto.Equal(target.(*TcpTarget), foundTarget.(*TcpTarget)))
-			assert.Equal(hostSets, foundHostSets)
+			assert.Equal(hostSources, foundHostSources)
 			assert.Equal(credSources, foundCredLibs)
 
 			err = db.TestVerifyOplog(t, rw, target.GetPublicId(), db.WithOperation(oplog.OpType_OP_TYPE_CREATE), db.WithCreateNotBefore(10*time.Second))
@@ -439,7 +439,7 @@ func TestRepository_UpdateTcpTarget(t *testing.T) {
 				testClIds = append(testClIds, cl.PublicId)
 			}
 
-			tt.newTargetOpts = append(tt.newTargetOpts, WithHostSets(testHostSetIds), WithCredentialSources(testClIds))
+			tt.newTargetOpts = append(tt.newTargetOpts, WithHostSources(testHostSetIds), WithCredentialSources(testClIds))
 			name := tt.newName
 			if name == "" {
 				name = testId(t)
@@ -455,7 +455,7 @@ func TestRepository_UpdateTcpTarget(t *testing.T) {
 			updateTarget.Description = tt.args.description
 			updateTarget.DefaultPort = tt.args.port
 
-			targetAfterUpdate, hostSets, credSources, updatedRows, err := repo.UpdateTcpTarget(context.Background(), &updateTarget, target.Version, tt.args.fieldMaskPaths, tt.args.opt...)
+			targetAfterUpdate, hostSources, credSources, updatedRows, err := repo.UpdateTcpTarget(context.Background(), &updateTarget, target.Version, tt.args.fieldMaskPaths, tt.args.opt...)
 			if tt.wantErr {
 				assert.Error(err)
 				assert.True(errors.Match(errors.T(tt.wantIsError), err))
@@ -470,9 +470,9 @@ func TestRepository_UpdateTcpTarget(t *testing.T) {
 			require.NoError(err)
 			require.NotNil(targetAfterUpdate)
 			assert.Equal(tt.wantRowsUpdate, updatedRows)
-			afterUpdateIds := make([]string, 0, len(hostSets))
-			for _, hs := range hostSets {
-				afterUpdateIds = append(afterUpdateIds, hs.PublicId)
+			afterUpdateIds := make([]string, 0, len(hostSources))
+			for _, hs := range hostSources {
+				afterUpdateIds = append(afterUpdateIds, hs.Id())
 			}
 			assert.Equal(testHostSetIds, afterUpdateIds)
 

internal/target/testing.go

@@ -25,9 +25,9 @@ func TestTcpTarget(t *testing.T, conn *gorm.DB, scopeId, name string, opt ...Opt
 	err = rw.Create(context.Background(), target)
 	require.NoError(err)
 
-	if len(opts.withHostSets) > 0 {
-		newHostSets := make([]interface{}, 0, len(opts.withHostSets))
-		for _, s := range opts.withHostSets {
+	if len(opts.withHostSources) > 0 {
+		newHostSets := make([]interface{}, 0, len(opts.withHostSources))
+		for _, s := range opts.withHostSources {
 			hostSet, err := NewTargetHostSet(target.PublicId, s)
 			require.NoError(err)
 			newHostSets = append(newHostSets, hostSet)

internal/target/testing_test.go

@@ -24,17 +24,17 @@ func Test_TestTcpTarget(t *testing.T) {
 		sets = append(sets, s.PublicId)
 	}
 	name := testTargetName(t, proj.PublicId)
-	target := TestTcpTarget(t, conn, proj.PublicId, name, WithHostSets(sets))
+	target := TestTcpTarget(t, conn, proj.PublicId, name, WithHostSources(sets))
 	require.NotNil(t)
 	require.NotEmpty(target.PublicId)
 	require.Equal(name, target.Name)
 
 	rw := db.New(conn)
-	foundSets, err := fetchSets(context.Background(), rw, target.PublicId)
+	foundSources, err := fetchHostSources(context.Background(), rw, target.PublicId)
 	require.NoError(err)
-	foundIds := make([]string, 0, len(foundSets))
-	for _, s := range foundSets {
-		foundIds = append(foundIds, s.PublicId)
+	foundIds := make([]string, 0, len(foundSources))
+	for _, s := range foundSources {
+		foundIds = append(foundIds, s.Id())
 	}
 	require.Equal(sets, foundIds)
 }

internal/types/action/action.go

@@ -32,9 +32,9 @@ const (
 	AddHosts                  Type = 21
 	SetHosts                  Type = 22
 	RemoveHosts               Type = 23
-	AddHostSets               Type = 24
-	SetHostSets               Type = 25
-	RemoveHostSets            Type = 26
+	AddHostSets               Type = 24 // DEPRECATED
+	SetHostSets               Type = 25 // DEPRECATED
+	RemoveHostSets            Type = 26 // DEPRECATED
 	Cancel                    Type = 27
 	AddAccounts               Type = 28
 	SetAccounts               Type = 29
@@ -50,6 +50,9 @@ const (
 	AddCredentialSources      Type = 39
 	SetCredentialSources      Type = 40
 	RemoveCredentialSources   Type = 41
+	AddHostSources            Type = 42
+	SetHostSources            Type = 43
+	RemoveHostSources         Type = 44
 )
 
 var Map = map[string]Type{
@@ -94,6 +97,9 @@ var Map = map[string]Type{
 	AddCredentialSources.String():      AddCredentialSources,
 	SetCredentialSources.String():      SetCredentialSources,
 	RemoveCredentialSources.String():   RemoveCredentialSources,
+	AddHostSources.String():            AddHostSources,
+	SetHostSources.String():            SetHostSources,
+	RemoveHostSources.String():         RemoveHostSources,
 }
 
 func (a Type) String() string {
@@ -140,6 +146,9 @@ func (a Type) String() string {
 		"add-credential-sources",
 		"set-credential-sources",
 		"remove-credential-sources",
+		"add-host-sources",
+		"set-host-sources",
+		"remove-host-sources",
 	}[a]
 }