From fdf43fc4fe2c7b7b4421a77ccd6a2dfb9eab3885 Mon Sep 17 00:00:00 2001
From: Jim <jlambert@hashicorp.com>
Date: Tue, 7 Jun 2022 11:50:30 -0400
Subject: [PATCH] feature (worker): add CreateWorker(...) service (aka API)
 (#2143)

---
 globals/fields.go                             |   2 +
 .../handlers/scopes/scope_service_test.go     |   2 +-
 .../handlers/workers/worker_service.go        | 117 ++++-
 .../handlers/workers/worker_service_test.go   | 399 ++++++++++++++++++
 internal/gen/controller.swagger.json          |  58 +--
 .../api/services/worker_service.pb.go         | 250 +++++------
 .../api/services/worker_service.pb.gw.go      |  38 +-
 .../api/services/worker_service_grpc.pb.go    |  32 +-
 internal/perms/acl_test.go                    |   6 +-
 .../api/resources/workers/v1/worker.proto     |   6 +-
 .../api/services/v1/worker_service.proto      |  10 +-
 internal/types/action/action.go               |   6 +-
 internal/types/action/action_test.go          |   4 +-
 .../api/resources/workers/worker.pb.go        |  76 ++--
 14 files changed, 773 insertions(+), 233 deletions(-)

diff --git a/globals/fields.go b/globals/fields.go
index 3d8d352c2..4fd02ee4d 100644
--- a/globals/fields.go
+++ b/globals/fields.go
@@ -79,4 +79,6 @@ const (
 	TagsField                            = "tags"
 	CanonicalTagsField                   = "canonical_tags"
 	ConfigurationField                   = "configuration"
+	WorkerAuthTokenField                 = "worker_auth_token"
+	WorkerConfigField                    = "worker_config"
 )
diff --git a/internal/daemon/controller/handlers/scopes/scope_service_test.go b/internal/daemon/controller/handlers/scopes/scope_service_test.go
index 0e1a82d37..470df83a6 100644
--- a/internal/daemon/controller/handlers/scopes/scope_service_test.go
+++ b/internal/daemon/controller/handlers/scopes/scope_service_test.go
@@ -97,7 +97,7 @@ var globalAuthorizedCollectionActions = map[string]*structpb.ListValue{
 	},
 	"workers": {
 		Values: []*structpb.Value{
-			structpb.NewStringValue("create:worker-request"),
+			structpb.NewStringValue("create:worker-led"),
 			structpb.NewStringValue("list"),
 		},
 	},
diff --git a/internal/daemon/controller/handlers/workers/worker_service.go b/internal/daemon/controller/handlers/workers/worker_service.go
index 933201425..bb82d654b 100644
--- a/internal/daemon/controller/handlers/workers/worker_service.go
+++ b/internal/daemon/controller/handlers/workers/worker_service.go
@@ -19,7 +19,10 @@ import (
 	"github.com/hashicorp/boundary/internal/types/resource"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/workers"
+	"github.com/hashicorp/nodeenrollment/types"
+	"github.com/mr-tron/base58"
 	"google.golang.org/grpc/codes"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/structpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
@@ -39,7 +42,7 @@ var (
 	// CollectionActions contains the set of actions that can be performed on
 	// this collection
 	CollectionActions = action.ActionSet{
-		action.CreateWorkerRequest,
+		action.CreateWorkerLed,
 		action.List,
 	}
 )
@@ -186,6 +189,53 @@ func (s Service) GetWorker(ctx context.Context, req *pbs.GetWorkerRequest) (*pbs
 	return &pbs.GetWorkerResponse{Item: item}, nil
 }
 
+// CreateWorker implements the interface pbs.WorkerServiceServer.
+func (s Service) CreateWorkerLed(ctx context.Context, req *pbs.CreateWorkerLedRequest) (*pbs.CreateWorkerLedResponse, error) {
+	const op = "workers.(Service).CreateWorkerLed"
+
+	if err := validateCreateRequest(req); err != nil {
+		return nil, err
+	}
+	authResults := s.authResult(ctx, req.GetItem().GetScopeId(), action.CreateWorkerLed)
+	if authResults.Error != nil {
+		return nil, authResults.Error
+	}
+	reqBytes, err := base58.FastBase58Decoding(req.GetItem().WorkerAuthToken.GetValue())
+	if err != nil {
+		return nil, fmt.Errorf("%s: error decoding node_credentials_token: %w", op, err)
+	}
+	// Decode the proto into the request
+	creds := new(types.FetchNodeCredentialsRequest)
+	if err := proto.Unmarshal(reqBytes, creds); err != nil {
+		return nil, fmt.Errorf("%s: error unmarshaling node_credentials_token: %w", op, err)
+	}
+	created, err := s.createInRepo(ctx, req.GetItem(), creds)
+	if err != nil {
+		return nil, fmt.Errorf("%s: error creating worker: %w", op, err)
+	}
+
+	outputFields, ok := requests.OutputFields(ctx)
+	if !ok {
+		return nil, errors.New(ctx, errors.Internal, op, "no request context found")
+	}
+
+	outputOpts := make([]handlers.Option, 0, 3)
+	outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
+	if outputFields.Has(globals.ScopeField) {
+		outputOpts = append(outputOpts, handlers.WithScope(authResults.Scope))
+	}
+	if outputFields.Has(globals.AuthorizedActionsField) {
+		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, created.GetPublicId(), IdActions).Strings()))
+	}
+
+	item, err := toProto(ctx, created, outputOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return &pbs.CreateWorkerLedResponse{Item: item}, nil
+}
+
 // DeleteWorker implements the interface pbs.WorkerServiceServer.
 func (s Service) DeleteWorker(ctx context.Context, req *pbs.DeleteWorkerRequest) (*pbs.DeleteWorkerResponse, error) {
 	if err := validateDeleteRequest(req); err != nil {
@@ -270,6 +320,25 @@ func (s Service) getFromRepo(ctx context.Context, id string) (*servers.Worker, e
 	return w, nil
 }
 
+func (s Service) createInRepo(ctx context.Context, worker *pb.Worker, creds *types.FetchNodeCredentialsRequest) (*servers.Worker, error) {
+	const op = "workers.(Service).createInRepo"
+	repo, err := s.repoFn()
+	if err != nil {
+		return nil, err
+	}
+	newWorker := servers.NewWorker(
+		worker.GetScopeId(),
+		servers.WithName(worker.GetName().GetValue()),
+		servers.WithDescription(worker.GetDescription().GetValue()),
+		servers.WithAddress(worker.GetAddress().GetValue()),
+	)
+	retWorker, err := repo.CreateWorker(ctx, newWorker, servers.WithFetchNodeCredentialsRequest(creds))
+	if err != nil {
+		return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to create worker"))
+	}
+	return retWorker, nil
+}
+
 func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
 	const op = "workers.(Service).deleteFromRepo"
 	repo, err := s.repoFn()
@@ -329,7 +398,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 	var parentId string
 	opts := []auth.Option{auth.WithType(resource.Worker), auth.WithAction(a)}
 	switch a {
-	case action.List, action.Create:
+	case action.List, action.CreateWorkerLed:
 		parentId = id
 	default:
 		w, err := repo.LookupWorker(ctx, id)
@@ -420,8 +489,10 @@ func toProto(ctx context.Context, in *servers.Worker, opt ...handlers.Option) (*
 				return nil, errors.Wrap(ctx, err, op, errors.WithMsg("error preparing config tags proto"))
 			}
 		}
-		out.GetWorkerConfig().Address = in.GetWorkerReportedAddress()
-		out.GetWorkerConfig().Name = in.GetWorkerReportedName()
+		if out.WorkerConfig != nil {
+			out.GetWorkerConfig().Address = in.GetWorkerReportedAddress()
+			out.GetWorkerConfig().Name = in.GetWorkerReportedName()
+		}
 	}
 
 	return &out, nil
@@ -492,3 +563,41 @@ func validateUpdateRequest(req *pbs.UpdateWorkerRequest) error {
 		return badFields
 	}, servers.WorkerPrefix)
 }
+
+func validateCreateRequest(req *pbs.CreateWorkerLedRequest) error {
+	return handlers.ValidateCreateRequest(req.GetItem(), func() map[string]string {
+		const (
+			mustBeGlobalMsg  = "Must be 'global'"
+			cannotBeEmptyMsg = "Cannot be empty."
+			readOnlyFieldMsg = "This is a read only field."
+		)
+		badFields := map[string]string{}
+		if scope.Global.String() != req.GetItem().GetScopeId() {
+			badFields[globals.ScopeIdField] = mustBeGlobalMsg
+		}
+		// FIXME: in the future, we won't require this token since we'll support
+		// the server led flow where a token is returned when a worker is created.
+		if req.GetItem().WorkerAuthToken == nil {
+			badFields[globals.WorkerAuthTokenField] = cannotBeEmptyMsg
+		}
+		if req.GetItem().CanonicalAddress != "" {
+			badFields[globals.CanonicalAddressField] = readOnlyFieldMsg
+		}
+		if req.GetItem().Tags != nil {
+			badFields[globals.TagsField] = readOnlyFieldMsg
+		}
+		if req.GetItem().CanonicalTags != nil {
+			badFields[globals.CanonicalTagsField] = readOnlyFieldMsg
+		}
+		if req.GetItem().LastStatusTime != nil {
+			badFields[globals.LastStatusTimeField] = readOnlyFieldMsg
+		}
+		if req.GetItem().WorkerConfig != nil {
+			badFields[globals.WorkerConfigField] = readOnlyFieldMsg
+		}
+		if req.GetItem().AuthorizedActions != nil {
+			badFields[globals.AuthorizedActionsField] = readOnlyFieldMsg
+		}
+		return badFields
+	})
+}
diff --git a/internal/daemon/controller/handlers/workers/worker_service_test.go b/internal/daemon/controller/handlers/workers/worker_service_test.go
index 0613997bc..f6e200d61 100644
--- a/internal/daemon/controller/handlers/workers/worker_service_test.go
+++ b/internal/daemon/controller/handlers/workers/worker_service_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"github.com/hashicorp/boundary/internal/db"
@@ -17,7 +18,12 @@ import (
 	"github.com/hashicorp/boundary/internal/servers"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/workers"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/workers"
+	"github.com/hashicorp/nodeenrollment/rotation"
+	"github.com/hashicorp/nodeenrollment/storage/file"
+	"github.com/hashicorp/nodeenrollment/types"
+	"github.com/mr-tron/base58"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/genproto/protobuf/field_mask"
@@ -775,3 +781,396 @@ func TestUpdate_BadVersion(t *testing.T) {
 	assert.Error(t, err)
 	assert.True(t, errors.Is(err, handlers.NotFoundError()), "Got %v, wanted not found error.", err)
 }
+
+func TestCreateWorkerLed(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	testRootWrapper := db.TestWrapper(t)
+	iamRepo := iam.TestRepo(t, conn, testRootWrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+	rw := db.New(conn)
+	testKms := kms.TestKms(t, conn, testRootWrapper)
+	repoFn := func() (*servers.Repository, error) {
+		return servers.NewRepository(rw, rw, testKms)
+	}
+	testCtx := context.Background()
+
+	testSrv, err := NewService(testCtx, repoFn, iamRepoFn)
+	require.NoError(t, err, "Error when getting new worker service.")
+
+	// Get an initial set of authorized node credentials
+	rootStorage, err := servers.NewRepositoryStorage(testCtx, rw, rw, testKms)
+	require.NoError(t, err)
+	_, err = rotation.RotateRootCertificates(testCtx, rootStorage)
+	require.NoError(t, err)
+
+	fetchReqFn := func() string {
+		// This happens on the worker
+		fileStorage, err := file.New(testCtx)
+		require.NoError(t, err)
+		defer fileStorage.Cleanup()
+
+		nodeCreds, err := types.NewNodeCredentials(testCtx, fileStorage)
+		require.NoError(t, err)
+		// Create request using worker id
+		fetchReq, err := nodeCreds.CreateFetchNodeCredentialsRequest(testCtx)
+		require.NoError(t, err)
+
+		fetchEncoded, err := proto.Marshal(fetchReq)
+		require.NoError(t, err)
+
+		return base58.Encode(fetchEncoded)
+	}
+
+	tests := []struct {
+		name            string
+		scopeId         string
+		service         Service
+		req             *pbs.CreateWorkerLedRequest
+		res             *pbs.CreateWorkerLedResponse
+		wantErr         bool
+		wantErrIs       error
+		wantErrContains string
+	}{
+		{
+			name:    "invalid-scope",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         "invalid-scope",
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: "Must be 'global'",
+		},
+		{
+			name:    "missing-node-credentials-token",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId: scope.Global.String(),
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: globals.WorkerAuthTokenField,
+		},
+		{
+			name:    "invalid-id",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+					Id:              "invalid-id",
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: globals.IdField,
+		},
+		{
+			name:    "invalid-canonical-address",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:          scope.Global.String(),
+					WorkerAuthToken:  &wrapperspb.StringValue{Value: fetchReqFn()},
+					CanonicalAddress: "invalid-canonical-address",
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: globals.CanonicalAddressField,
+		},
+		{
+			name:    "invalid-tags",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+					Tags: map[string]*structpb.ListValue{
+						"invalid": {Values: []*structpb.Value{
+							structpb.NewStringValue("invalid-tags"),
+						}},
+					},
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: globals.TagsField,
+		},
+		{
+			name:    "invalid-canonical-tags",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+					CanonicalTags: map[string]*structpb.ListValue{
+						"invalid": {Values: []*structpb.Value{
+							structpb.NewStringValue("invalid-canonical-tags"),
+						}},
+					},
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: globals.CanonicalTagsField,
+		},
+		{
+			name:    "invalid-last-status-time",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+					LastStatusTime:  timestamppb.Now(),
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: globals.LastStatusTimeField,
+		},
+		{
+			name:    "invalid-worker-config",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+					WorkerConfig:    &pb.WorkerConfig{},
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: globals.WorkerConfigField,
+		},
+		{
+			name:    "invalid-authorized-actions",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:           scope.Global.String(),
+					WorkerAuthToken:   &wrapperspb.StringValue{Value: fetchReqFn()},
+					AuthorizedActions: []string{"invalid-authorized-actions"},
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: globals.AuthorizedActionsField,
+		},
+		{
+			name:    "invalid-create-time",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+					CreatedTime:     timestamppb.Now(),
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: globals.CreatedTimeField,
+		},
+		{
+			name:    "invalid-update-time",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+					UpdatedTime:     timestamppb.Now(),
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: globals.UpdatedTimeField,
+		},
+		{
+			name:    "invalid-version",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+					Version:         1,
+				},
+			},
+			wantErr:         true,
+			wantErrIs:       handlers.ApiErrorWithCode(codes.InvalidArgument),
+			wantErrContains: globals.VersionField,
+		},
+		{
+			name:    "invalid-auth",
+			service: testSrv,
+			scopeId: "splat-auth-scope",
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+				},
+			},
+			wantErr:         true,
+			wantErrContains: "non-existent scope \"splat-auth-scope\"",
+		},
+		{
+			name:    "invalid-base58-encoding",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					WorkerAuthToken: &wrapperspb.StringValue{Value: "invalid;semicolon"},
+				},
+			},
+			wantErr:         true,
+			wantErrContains: "error decoding node_credentials_token",
+		},
+		{
+			name:    "invalid-marshal",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					WorkerAuthToken: &wrapperspb.StringValue{Value: "notNodeCreds"},
+				},
+			},
+			wantErr:         true,
+			wantErrContains: "error unmarshaling node_credentials_token",
+		},
+		{
+			name: "create-error",
+			service: func() Service {
+				repoFn := func() (*servers.Repository, error) {
+					return servers.NewRepository(rw, &db.Db{}, testKms)
+				}
+				testSrv, err := NewService(testCtx, repoFn, iamRepoFn)
+				require.NoError(t, err, "Error when getting new worker service.")
+				return testSrv
+			}(),
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					Name:            &wrapperspb.StringValue{Value: "success"},
+					Description:     &wrapperspb.StringValue{Value: "success-description"},
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+				},
+			},
+			wantErr:         true,
+			wantErrContains: "error creating worker",
+		},
+		{
+			name: "bad-repo-function-in-create",
+			service: func() Service {
+				// var cnt gives us a way for the repoFn to fail the 2nd time
+				// it's called so we can get past the AuthRequest check in
+				// CreateWorker(...) and test the createInRepo(...) failure
+				// path if the repoFn returns and err.
+				cnt := 0
+				repoFn := func() (*servers.Repository, error) {
+					cnt = cnt + 1
+					switch {
+					case cnt > 1:
+						return nil, errors.New(testCtx, errors.Internal, "bad-repo-function", "error creating repo")
+					default:
+						return servers.NewRepository(rw, rw, testKms)
+					}
+				}
+				testSrv, err := NewService(testCtx, repoFn, iamRepoFn)
+				require.NoError(t, err, "Error when getting new worker service.")
+				return testSrv
+			}(),
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					Name:            &wrapperspb.StringValue{Value: "success"},
+					Description:     &wrapperspb.StringValue{Value: "success-description"},
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+				},
+			},
+			wantErr:         true,
+			wantErrContains: "error creating worker: bad-repo-function: error creating repo",
+		},
+		{
+			name:    "success",
+			service: testSrv,
+			scopeId: scope.Global.String(),
+			req: &pbs.CreateWorkerLedRequest{
+				Item: &workers.Worker{
+					ScopeId:         scope.Global.String(),
+					Name:            &wrapperspb.StringValue{Value: "success"},
+					Description:     &wrapperspb.StringValue{Value: "success-description"},
+					WorkerAuthToken: &wrapperspb.StringValue{Value: fetchReqFn()},
+				},
+			},
+			res: &pbs.CreateWorkerLedResponse{
+				Item: &workers.Worker{
+					ScopeId:     scope.Global.String(),
+					Name:        &wrapperspb.StringValue{Value: "success"},
+					Description: &wrapperspb.StringValue{Value: "success-description"},
+					Version:     1,
+				},
+			},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			got, err := tc.service.CreateWorkerLed(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
+			if tc.wantErr {
+				require.Error(err)
+				assert.Nil(got)
+				if tc.wantErrIs != nil {
+					assert.ErrorIs(err, tc.wantErrIs)
+				}
+				if tc.wantErrContains != "" {
+					assert.Contains(err.Error(), tc.wantErrContains)
+				}
+				return
+			}
+			require.NoError(err)
+			require.NotNil(got)
+			{
+				// we only need to check that these "read-only" fields were set
+				// outbound. Other portions of the domain is responsible for
+				// testing that these values are correct and there's no reason
+				// to repeat those tests here.
+				assert.NotEmpty(got.GetItem().GetId())
+				assert.NotEmpty(got.GetItem().CreatedTime)
+				assert.NotEmpty(got.GetItem().UpdatedTime)
+				assert.NotEmpty(got.GetItem().Scope)
+				assert.NotEmpty(got.GetItem().AuthorizedActions)
+				{
+					tc.res.Item.Id = got.GetItem().GetId()
+					tc.res.Item.CreatedTime = got.GetItem().GetCreatedTime()
+					tc.res.Item.UpdatedTime = got.GetItem().GetUpdatedTime()
+					tc.res.Item.Scope = got.GetItem().Scope
+					tc.res.Item.AuthorizedActions = got.GetItem().GetAuthorizedActions()
+				}
+			}
+			assert.Equal(tc.res, got)
+		})
+	}
+}
diff --git a/internal/gen/controller.swagger.json b/internal/gen/controller.swagger.json
index abbb46a40..c86653d6e 100644
--- a/internal/gen/controller.swagger.json
+++ b/internal/gen/controller.swagger.json
@@ -3688,31 +3688,6 @@
         "tags": [
           "controller.api.services.v1.WorkerService"
         ]
-      },
-      "post": {
-        "summary": "Creates a single Worker.",
-        "operationId": "WorkerService_CreateWorker",
-        "responses": {
-          "200": {
-            "description": "",
-            "schema": {
-              "$ref": "#/definitions/controller.api.resources.workers.v1.Worker"
-            }
-          }
-        },
-        "parameters": [
-          {
-            "name": "item",
-            "in": "body",
-            "required": true,
-            "schema": {
-              "$ref": "#/definitions/controller.api.resources.workers.v1.Worker"
-            }
-          }
-        ],
-        "tags": [
-          "controller.api.services.v1.WorkerService"
-        ]
       }
     },
     "/v1/workers/{id}": {
@@ -3799,6 +3774,33 @@
           "controller.api.services.v1.WorkerService"
         ]
       }
+    },
+    "/v1/workers:create:worker-led": {
+      "post": {
+        "summary": "Creates a single Worker.",
+        "operationId": "WorkerService_CreateWorkerLed",
+        "responses": {
+          "200": {
+            "description": "",
+            "schema": {
+              "$ref": "#/definitions/controller.api.resources.workers.v1.Worker"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "item",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/controller.api.resources.workers.v1.Worker"
+            }
+          }
+        ],
+        "tags": [
+          "controller.api.services.v1.WorkerService"
+        ]
+      }
     }
   },
   "definitions": {
@@ -5580,6 +5582,10 @@
           "description": "Output only. The set of information the worker daemon has reported about\nitself.",
           "readOnly": true
         },
+        "worker_auth_token": {
+          "type": "string",
+          "title": "worker_auth_token is input only. Supports the worker led node\nenrollment flow where this credentials token is produced by a worker. This\ntoken is a base58 encoded types.FetchNodeCredentialsRequest from\nhttps://github.com/hashicorp/nodeenrollment"
+        },
         "authorized_actions": {
           "type": "array",
           "items": {
@@ -5882,7 +5888,7 @@
         }
       }
     },
-    "controller.api.services.v1.CreateWorkerResponse": {
+    "controller.api.services.v1.CreateWorkerLedResponse": {
       "type": "object",
       "properties": {
         "uri": {
diff --git a/internal/gen/controller/api/services/worker_service.pb.go b/internal/gen/controller/api/services/worker_service.pb.go
index bff4323ee..3f698b141 100644
--- a/internal/gen/controller/api/services/worker_service.pb.go
+++ b/internal/gen/controller/api/services/worker_service.pb.go
@@ -228,7 +228,7 @@ func (x *ListWorkersResponse) GetItems() []*workers.Worker {
 	return nil
 }
 
-type CreateWorkerRequest struct {
+type CreateWorkerLedRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -236,8 +236,8 @@ type CreateWorkerRequest struct {
 	Item *workers.Worker `protobuf:"bytes,1,opt,name=item,proto3" json:"item,omitempty"`
 }
 
-func (x *CreateWorkerRequest) Reset() {
-	*x = CreateWorkerRequest{}
+func (x *CreateWorkerLedRequest) Reset() {
+	*x = CreateWorkerLedRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_controller_api_services_v1_worker_service_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -245,13 +245,13 @@ func (x *CreateWorkerRequest) Reset() {
 	}
 }
 
-func (x *CreateWorkerRequest) String() string {
+func (x *CreateWorkerLedRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*CreateWorkerRequest) ProtoMessage() {}
+func (*CreateWorkerLedRequest) ProtoMessage() {}
 
-func (x *CreateWorkerRequest) ProtoReflect() protoreflect.Message {
+func (x *CreateWorkerLedRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_controller_api_services_v1_worker_service_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -263,19 +263,19 @@ func (x *CreateWorkerRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use CreateWorkerRequest.ProtoReflect.Descriptor instead.
-func (*CreateWorkerRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use CreateWorkerLedRequest.ProtoReflect.Descriptor instead.
+func (*CreateWorkerLedRequest) Descriptor() ([]byte, []int) {
 	return file_controller_api_services_v1_worker_service_proto_rawDescGZIP(), []int{4}
 }
 
-func (x *CreateWorkerRequest) GetItem() *workers.Worker {
+func (x *CreateWorkerLedRequest) GetItem() *workers.Worker {
 	if x != nil {
 		return x.Item
 	}
 	return nil
 }
 
-type CreateWorkerResponse struct {
+type CreateWorkerLedResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -284,8 +284,8 @@ type CreateWorkerResponse struct {
 	Item *workers.Worker `protobuf:"bytes,2,opt,name=item,proto3" json:"item,omitempty"`
 }
 
-func (x *CreateWorkerResponse) Reset() {
-	*x = CreateWorkerResponse{}
+func (x *CreateWorkerLedResponse) Reset() {
+	*x = CreateWorkerLedResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_controller_api_services_v1_worker_service_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -293,13 +293,13 @@ func (x *CreateWorkerResponse) Reset() {
 	}
 }
 
-func (x *CreateWorkerResponse) String() string {
+func (x *CreateWorkerLedResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*CreateWorkerResponse) ProtoMessage() {}
+func (*CreateWorkerLedResponse) ProtoMessage() {}
 
-func (x *CreateWorkerResponse) ProtoReflect() protoreflect.Message {
+func (x *CreateWorkerLedResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_controller_api_services_v1_worker_service_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -311,19 +311,19 @@ func (x *CreateWorkerResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use CreateWorkerResponse.ProtoReflect.Descriptor instead.
-func (*CreateWorkerResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use CreateWorkerLedResponse.ProtoReflect.Descriptor instead.
+func (*CreateWorkerLedResponse) Descriptor() ([]byte, []int) {
 	return file_controller_api_services_v1_worker_service_proto_rawDescGZIP(), []int{5}
 }
 
-func (x *CreateWorkerResponse) GetUri() string {
+func (x *CreateWorkerLedResponse) GetUri() string {
 	if x != nil {
 		return x.Uri
 	}
 	return ""
 }
 
-func (x *CreateWorkerResponse) GetItem() *workers.Worker {
+func (x *CreateWorkerLedResponse) GetItem() *workers.Worker {
 	if x != nil {
 		return x.Item
 	}
@@ -562,98 +562,100 @@ var file_controller_api_services_v1_worker_service_proto_rawDesc = []byte{
 	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
 	0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
 	0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72,
-	0x6b, 0x65, 0x72, 0x52, 0x05, 0x69, 0x74, 0x65, 0x6d, 0x73, 0x22, 0x56, 0x0a, 0x13, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x3f, 0x0a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x2b, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65,
-	0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x04, 0x69, 0x74,
-	0x65, 0x6d, 0x22, 0x69, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b,
-	0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72,
-	0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x3f, 0x0a, 0x04,
-	0x69, 0x74, 0x65, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x22, 0xa4, 0x01,
-	0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x3f, 0x0a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77,
-	0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72,
-	0x52, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x12, 0x3c, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65,
-	0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69,
-	0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73, 0x6b, 0x52, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f,
-	0x6d, 0x61, 0x73, 0x6b, 0x22, 0x57, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x57, 0x6f,
-	0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x04,
-	0x69, 0x74, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x22, 0x25, 0x0a,
-	0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x02, 0x69, 0x64, 0x22, 0x16, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x6f,
-	0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0xd7, 0x06, 0x0a,
-	0x0d, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0xa2,
-	0x01, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x12, 0x2c, 0x2e, 0x63,
-	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x57, 0x6f, 0x72,
-	0x6b, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2d, 0x2e, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x65,
-	0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x38, 0x92, 0x41, 0x17, 0x12, 0x15,
-	0x47, 0x65, 0x74, 0x73, 0x20, 0x61, 0x20, 0x73, 0x69, 0x6e, 0x67, 0x6c, 0x65, 0x20, 0x57, 0x6f,
-	0x72, 0x6b, 0x65, 0x72, 0x2e, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x18, 0x12, 0x10, 0x2f, 0x76, 0x31,
-	0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x62, 0x04, 0x69,
-	0x74, 0x65, 0x6d, 0x12, 0x9a, 0x01, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x57, 0x6f, 0x72, 0x6b,
-	0x65, 0x72, 0x73, 0x12, 0x2e, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2a, 0x92, 0x41, 0x14, 0x12, 0x12, 0x4c, 0x69, 0x73, 0x74, 0x73,
-	0x20, 0x61, 0x6c, 0x6c, 0x20, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x82, 0xd3, 0xe4,
-	0x93, 0x02, 0x0d, 0x12, 0x0b, 0x2f, 0x76, 0x31, 0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73,
-	0x12, 0xaf, 0x01, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65,
-	0x72, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
+	0x6b, 0x65, 0x72, 0x52, 0x05, 0x69, 0x74, 0x65, 0x6d, 0x73, 0x22, 0x59, 0x0a, 0x16, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x4c, 0x65, 0x64, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x3f, 0x0a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f,
+	0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52,
+	0x04, 0x69, 0x74, 0x65, 0x6d, 0x22, 0x6c, 0x0a, 0x17, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x57,
+	0x6f, 0x72, 0x6b, 0x65, 0x72, 0x4c, 0x65, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75,
+	0x72, 0x69, 0x12, 0x3f, 0x0a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x2b, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b,
+	0x65, 0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x04, 0x69,
+	0x74, 0x65, 0x6d, 0x22, 0xa4, 0x01, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x57, 0x6f,
+	0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x3f, 0x0a, 0x04, 0x69,
+	0x74, 0x65, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e,
+	0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x12, 0x3c, 0x0a, 0x0b,
+	0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73, 0x6b, 0x52, 0x0b, 0x75,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x22, 0x57, 0x0a, 0x14, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x3f, 0x0a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x2b, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b,
+	0x65, 0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x04, 0x69,
+	0x74, 0x65, 0x6d, 0x22, 0x25, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x6f, 0x72,
+	0x6b, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x16, 0x0a, 0x14, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x32, 0xf2, 0x06, 0x0a, 0x0d, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0xa2, 0x01, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x57, 0x6f, 0x72, 0x6b,
+	0x65, 0x72, 0x12, 0x2c, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
 	0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x3c, 0x92, 0x41, 0x1a, 0x12, 0x18, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x73, 0x20, 0x61, 0x20, 0x73, 0x69, 0x6e, 0x67, 0x6c, 0x65, 0x20, 0x57, 0x6f, 0x72, 0x6b,
-	0x65, 0x72, 0x2e, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x19, 0x22, 0x0b, 0x2f, 0x76, 0x31, 0x2f, 0x77,
-	0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x3a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x62, 0x04, 0x69, 0x74,
-	0x65, 0x6d, 0x12, 0xad, 0x01, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72,
-	0x6b, 0x65, 0x72, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x47, 0x65, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65,
+	0x74, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x38, 0x92, 0x41, 0x17, 0x12, 0x15, 0x47, 0x65, 0x74, 0x73, 0x20, 0x61, 0x20, 0x73, 0x69, 0x6e,
+	0x67, 0x6c, 0x65, 0x20, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x2e, 0x82, 0xd3, 0xe4, 0x93, 0x02,
+	0x18, 0x12, 0x10, 0x2f, 0x76, 0x31, 0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2f, 0x7b,
+	0x69, 0x64, 0x7d, 0x62, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x12, 0x9a, 0x01, 0x0a, 0x0b, 0x4c, 0x69,
+	0x73, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2a, 0x92, 0x41, 0x14, 0x12,
+	0x12, 0x4c, 0x69, 0x73, 0x74, 0x73, 0x20, 0x61, 0x6c, 0x6c, 0x20, 0x57, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x73, 0x2e, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x0d, 0x12, 0x0b, 0x2f, 0x76, 0x31, 0x2f, 0x77,
+	0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x12, 0xca, 0x01, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x4c, 0x65, 0x64, 0x12, 0x32, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x57, 0x6f,
+	0x72, 0x6b, 0x65, 0x72, 0x4c, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x33,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x4c, 0x65, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x4e, 0x92, 0x41, 0x1a, 0x12, 0x18, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x73, 0x20, 0x61, 0x20, 0x73, 0x69, 0x6e, 0x67, 0x6c, 0x65, 0x20, 0x57, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x2e, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x2b, 0x22, 0x1d, 0x2f, 0x76, 0x31, 0x2f, 0x77, 0x6f,
+	0x72, 0x6b, 0x65, 0x72, 0x73, 0x3a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x3a, 0x77, 0x6f, 0x72,
+	0x6b, 0x65, 0x72, 0x2d, 0x6c, 0x65, 0x64, 0x3a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x62, 0x04, 0x69,
+	0x74, 0x65, 0x6d, 0x12, 0xad, 0x01, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x57, 0x6f,
+	0x72, 0x6b, 0x65, 0x72, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
 	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76,
 	0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x3a, 0x92, 0x41, 0x13, 0x12, 0x11, 0x55, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x73, 0x20, 0x61, 0x20, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x2e, 0x82, 0xd3,
-	0xe4, 0x93, 0x02, 0x1e, 0x32, 0x10, 0x2f, 0x76, 0x31, 0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72,
-	0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x3a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x62, 0x04, 0x69, 0x74,
-	0x65, 0x6d, 0x12, 0xa1, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x6f, 0x72,
-	0x6b, 0x65, 0x72, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
+	0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x3a, 0x92, 0x41, 0x13, 0x12, 0x11, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x73, 0x20, 0x61, 0x20, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x2e, 0x82,
+	0xd3, 0xe4, 0x93, 0x02, 0x1e, 0x32, 0x10, 0x2f, 0x76, 0x31, 0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x3a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x62, 0x04, 0x69,
+	0x74, 0x65, 0x6d, 0x12, 0xa1, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x6f,
+	0x72, 0x6b, 0x65, 0x72, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
 	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76,
 	0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2e, 0x92, 0x41, 0x13, 0x12, 0x11, 0x44, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x73, 0x20, 0x61, 0x20, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x2e, 0x82, 0xd3,
-	0xe4, 0x93, 0x02, 0x12, 0x2a, 0x10, 0x2f, 0x76, 0x31, 0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72,
-	0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x42, 0x4d, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62,
-	0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
-	0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f,
-	0x61, 0x70, 0x69, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x3b, 0x73, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
+	0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2e, 0x92, 0x41, 0x13, 0x12, 0x11, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x73, 0x20, 0x61, 0x20, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x2e, 0x82,
+	0xd3, 0xe4, 0x93, 0x02, 0x12, 0x2a, 0x10, 0x2f, 0x76, 0x31, 0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x42, 0x4d, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f,
+	0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61,
+	0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
+	0x2f, 0x61, 0x70, 0x69, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x3b, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -670,35 +672,35 @@ func file_controller_api_services_v1_worker_service_proto_rawDescGZIP() []byte {
 
 var file_controller_api_services_v1_worker_service_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
 var file_controller_api_services_v1_worker_service_proto_goTypes = []interface{}{
-	(*GetWorkerRequest)(nil),      // 0: controller.api.services.v1.GetWorkerRequest
-	(*GetWorkerResponse)(nil),     // 1: controller.api.services.v1.GetWorkerResponse
-	(*ListWorkersRequest)(nil),    // 2: controller.api.services.v1.ListWorkersRequest
-	(*ListWorkersResponse)(nil),   // 3: controller.api.services.v1.ListWorkersResponse
-	(*CreateWorkerRequest)(nil),   // 4: controller.api.services.v1.CreateWorkerRequest
-	(*CreateWorkerResponse)(nil),  // 5: controller.api.services.v1.CreateWorkerResponse
-	(*UpdateWorkerRequest)(nil),   // 6: controller.api.services.v1.UpdateWorkerRequest
-	(*UpdateWorkerResponse)(nil),  // 7: controller.api.services.v1.UpdateWorkerResponse
-	(*DeleteWorkerRequest)(nil),   // 8: controller.api.services.v1.DeleteWorkerRequest
-	(*DeleteWorkerResponse)(nil),  // 9: controller.api.services.v1.DeleteWorkerResponse
-	(*workers.Worker)(nil),        // 10: controller.api.resources.workers.v1.Worker
-	(*fieldmaskpb.FieldMask)(nil), // 11: google.protobuf.FieldMask
+	(*GetWorkerRequest)(nil),        // 0: controller.api.services.v1.GetWorkerRequest
+	(*GetWorkerResponse)(nil),       // 1: controller.api.services.v1.GetWorkerResponse
+	(*ListWorkersRequest)(nil),      // 2: controller.api.services.v1.ListWorkersRequest
+	(*ListWorkersResponse)(nil),     // 3: controller.api.services.v1.ListWorkersResponse
+	(*CreateWorkerLedRequest)(nil),  // 4: controller.api.services.v1.CreateWorkerLedRequest
+	(*CreateWorkerLedResponse)(nil), // 5: controller.api.services.v1.CreateWorkerLedResponse
+	(*UpdateWorkerRequest)(nil),     // 6: controller.api.services.v1.UpdateWorkerRequest
+	(*UpdateWorkerResponse)(nil),    // 7: controller.api.services.v1.UpdateWorkerResponse
+	(*DeleteWorkerRequest)(nil),     // 8: controller.api.services.v1.DeleteWorkerRequest
+	(*DeleteWorkerResponse)(nil),    // 9: controller.api.services.v1.DeleteWorkerResponse
+	(*workers.Worker)(nil),          // 10: controller.api.resources.workers.v1.Worker
+	(*fieldmaskpb.FieldMask)(nil),   // 11: google.protobuf.FieldMask
 }
 var file_controller_api_services_v1_worker_service_proto_depIdxs = []int32{
 	10, // 0: controller.api.services.v1.GetWorkerResponse.item:type_name -> controller.api.resources.workers.v1.Worker
 	10, // 1: controller.api.services.v1.ListWorkersResponse.items:type_name -> controller.api.resources.workers.v1.Worker
-	10, // 2: controller.api.services.v1.CreateWorkerRequest.item:type_name -> controller.api.resources.workers.v1.Worker
-	10, // 3: controller.api.services.v1.CreateWorkerResponse.item:type_name -> controller.api.resources.workers.v1.Worker
+	10, // 2: controller.api.services.v1.CreateWorkerLedRequest.item:type_name -> controller.api.resources.workers.v1.Worker
+	10, // 3: controller.api.services.v1.CreateWorkerLedResponse.item:type_name -> controller.api.resources.workers.v1.Worker
 	10, // 4: controller.api.services.v1.UpdateWorkerRequest.item:type_name -> controller.api.resources.workers.v1.Worker
 	11, // 5: controller.api.services.v1.UpdateWorkerRequest.update_mask:type_name -> google.protobuf.FieldMask
 	10, // 6: controller.api.services.v1.UpdateWorkerResponse.item:type_name -> controller.api.resources.workers.v1.Worker
 	0,  // 7: controller.api.services.v1.WorkerService.GetWorker:input_type -> controller.api.services.v1.GetWorkerRequest
 	2,  // 8: controller.api.services.v1.WorkerService.ListWorkers:input_type -> controller.api.services.v1.ListWorkersRequest
-	4,  // 9: controller.api.services.v1.WorkerService.CreateWorker:input_type -> controller.api.services.v1.CreateWorkerRequest
+	4,  // 9: controller.api.services.v1.WorkerService.CreateWorkerLed:input_type -> controller.api.services.v1.CreateWorkerLedRequest
 	6,  // 10: controller.api.services.v1.WorkerService.UpdateWorker:input_type -> controller.api.services.v1.UpdateWorkerRequest
 	8,  // 11: controller.api.services.v1.WorkerService.DeleteWorker:input_type -> controller.api.services.v1.DeleteWorkerRequest
 	1,  // 12: controller.api.services.v1.WorkerService.GetWorker:output_type -> controller.api.services.v1.GetWorkerResponse
 	3,  // 13: controller.api.services.v1.WorkerService.ListWorkers:output_type -> controller.api.services.v1.ListWorkersResponse
-	5,  // 14: controller.api.services.v1.WorkerService.CreateWorker:output_type -> controller.api.services.v1.CreateWorkerResponse
+	5,  // 14: controller.api.services.v1.WorkerService.CreateWorkerLed:output_type -> controller.api.services.v1.CreateWorkerLedResponse
 	7,  // 15: controller.api.services.v1.WorkerService.UpdateWorker:output_type -> controller.api.services.v1.UpdateWorkerResponse
 	9,  // 16: controller.api.services.v1.WorkerService.DeleteWorker:output_type -> controller.api.services.v1.DeleteWorkerResponse
 	12, // [12:17] is the sub-list for method output_type
@@ -763,7 +765,7 @@ func file_controller_api_services_v1_worker_service_proto_init() {
 			}
 		}
 		file_controller_api_services_v1_worker_service_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateWorkerRequest); i {
+			switch v := v.(*CreateWorkerLedRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -775,7 +777,7 @@ func file_controller_api_services_v1_worker_service_proto_init() {
 			}
 		}
 		file_controller_api_services_v1_worker_service_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateWorkerResponse); i {
+			switch v := v.(*CreateWorkerLedResponse); i {
 			case 0:
 				return &v.state
 			case 1:
diff --git a/internal/gen/controller/api/services/worker_service.pb.gw.go b/internal/gen/controller/api/services/worker_service.pb.gw.go
index 7a5e1897a..a9bfb14f3 100644
--- a/internal/gen/controller/api/services/worker_service.pb.gw.go
+++ b/internal/gen/controller/api/services/worker_service.pb.gw.go
@@ -119,8 +119,8 @@ func local_request_WorkerService_ListWorkers_0(ctx context.Context, marshaler ru
 
 }
 
-func request_WorkerService_CreateWorker_0(ctx context.Context, marshaler runtime.Marshaler, client WorkerServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq CreateWorkerRequest
+func request_WorkerService_CreateWorkerLed_0(ctx context.Context, marshaler runtime.Marshaler, client WorkerServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CreateWorkerLedRequest
 	var metadata runtime.ServerMetadata
 
 	newReader, berr := utilities.IOReaderFactory(req.Body)
@@ -131,13 +131,13 @@ func request_WorkerService_CreateWorker_0(ctx context.Context, marshaler runtime
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 
-	msg, err := client.CreateWorker(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	msg, err := client.CreateWorkerLed(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 
 }
 
-func local_request_WorkerService_CreateWorker_0(ctx context.Context, marshaler runtime.Marshaler, server WorkerServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var protoReq CreateWorkerRequest
+func local_request_WorkerService_CreateWorkerLed_0(ctx context.Context, marshaler runtime.Marshaler, server WorkerServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CreateWorkerLedRequest
 	var metadata runtime.ServerMetadata
 
 	newReader, berr := utilities.IOReaderFactory(req.Body)
@@ -148,7 +148,7 @@ func local_request_WorkerService_CreateWorker_0(ctx context.Context, marshaler r
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
 
-	msg, err := server.CreateWorker(ctx, &protoReq)
+	msg, err := server.CreateWorkerLed(ctx, &protoReq)
 	return msg, metadata, err
 
 }
@@ -359,19 +359,19 @@ func RegisterWorkerServiceHandlerServer(ctx context.Context, mux *runtime.ServeM
 
 	})
 
-	mux.Handle("POST", pattern_WorkerService_CreateWorker_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+	mux.Handle("POST", pattern_WorkerService_CreateWorkerLed_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
 		var stream runtime.ServerTransportStream
 		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
 		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
 		var err error
-		ctx, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.WorkerService/CreateWorker", runtime.WithHTTPPathPattern("/v1/workers"))
+		ctx, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.WorkerService/CreateWorkerLed", runtime.WithHTTPPathPattern("/v1/workers:create:worker-led"))
 		if err != nil {
 			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
 			return
 		}
-		resp, md, err := local_request_WorkerService_CreateWorker_0(ctx, inboundMarshaler, server, req, pathParams)
+		resp, md, err := local_request_WorkerService_CreateWorkerLed_0(ctx, inboundMarshaler, server, req, pathParams)
 		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
 		ctx = runtime.NewServerMetadataContext(ctx, md)
 		if err != nil {
@@ -379,7 +379,7 @@ func RegisterWorkerServiceHandlerServer(ctx context.Context, mux *runtime.ServeM
 			return
 		}
 
-		forward_WorkerService_CreateWorker_0(ctx, mux, outboundMarshaler, w, req, response_WorkerService_CreateWorker_0{resp}, mux.GetForwardResponseOptions()...)
+		forward_WorkerService_CreateWorkerLed_0(ctx, mux, outboundMarshaler, w, req, response_WorkerService_CreateWorkerLed_0{resp}, mux.GetForwardResponseOptions()...)
 
 	})
 
@@ -514,24 +514,24 @@ func RegisterWorkerServiceHandlerClient(ctx context.Context, mux *runtime.ServeM
 
 	})
 
-	mux.Handle("POST", pattern_WorkerService_CreateWorker_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+	mux.Handle("POST", pattern_WorkerService_CreateWorkerLed_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
 		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
 		var err error
-		ctx, err = runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.WorkerService/CreateWorker", runtime.WithHTTPPathPattern("/v1/workers"))
+		ctx, err = runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.WorkerService/CreateWorkerLed", runtime.WithHTTPPathPattern("/v1/workers:create:worker-led"))
 		if err != nil {
 			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
 			return
 		}
-		resp, md, err := request_WorkerService_CreateWorker_0(ctx, inboundMarshaler, client, req, pathParams)
+		resp, md, err := request_WorkerService_CreateWorkerLed_0(ctx, inboundMarshaler, client, req, pathParams)
 		ctx = runtime.NewServerMetadataContext(ctx, md)
 		if err != nil {
 			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
 			return
 		}
 
-		forward_WorkerService_CreateWorker_0(ctx, mux, outboundMarshaler, w, req, response_WorkerService_CreateWorker_0{resp}, mux.GetForwardResponseOptions()...)
+		forward_WorkerService_CreateWorkerLed_0(ctx, mux, outboundMarshaler, w, req, response_WorkerService_CreateWorkerLed_0{resp}, mux.GetForwardResponseOptions()...)
 
 	})
 
@@ -589,12 +589,12 @@ func (m response_WorkerService_GetWorker_0) XXX_ResponseBody() interface{} {
 	return response.Item
 }
 
-type response_WorkerService_CreateWorker_0 struct {
+type response_WorkerService_CreateWorkerLed_0 struct {
 	proto.Message
 }
 
-func (m response_WorkerService_CreateWorker_0) XXX_ResponseBody() interface{} {
-	response := m.Message.(*CreateWorkerResponse)
+func (m response_WorkerService_CreateWorkerLed_0) XXX_ResponseBody() interface{} {
+	response := m.Message.(*CreateWorkerLedResponse)
 	return response.Item
 }
 
@@ -612,7 +612,7 @@ var (
 
 	pattern_WorkerService_ListWorkers_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"v1", "workers"}, ""))
 
-	pattern_WorkerService_CreateWorker_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"v1", "workers"}, ""))
+	pattern_WorkerService_CreateWorkerLed_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"v1", "workers:create"}, "worker-led"))
 
 	pattern_WorkerService_UpdateWorker_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 4, 1, 5, 2}, []string{"v1", "workers", "id"}, ""))
 
@@ -624,7 +624,7 @@ var (
 
 	forward_WorkerService_ListWorkers_0 = runtime.ForwardResponseMessage
 
-	forward_WorkerService_CreateWorker_0 = runtime.ForwardResponseMessage
+	forward_WorkerService_CreateWorkerLed_0 = runtime.ForwardResponseMessage
 
 	forward_WorkerService_UpdateWorker_0 = runtime.ForwardResponseMessage
 
diff --git a/internal/gen/controller/api/services/worker_service_grpc.pb.go b/internal/gen/controller/api/services/worker_service_grpc.pb.go
index 6002ef699..ee1a181b2 100644
--- a/internal/gen/controller/api/services/worker_service_grpc.pb.go
+++ b/internal/gen/controller/api/services/worker_service_grpc.pb.go
@@ -28,12 +28,12 @@ type WorkerServiceClient interface {
 	// If the scope ID is missing, malformed, or reference a non existing scope,
 	// an error is returned.
 	ListWorkers(ctx context.Context, in *ListWorkersRequest, opts ...grpc.CallOption) (*ListWorkersResponse, error)
-	// CreateWorker creates and stores a Worker in boundary.  The provided
+	// CreateWorkerLed creates and stores a Worker in boundary.  The provided
 	// request must include the Scope id in which the Worker will be created.
 	// If the Scope id is missing, malformed or references a non existing
 	// resource, an error is returned.  If a name is provided that is in
 	// use in another Worker in the same scope, an error is returned.
-	CreateWorker(ctx context.Context, in *CreateWorkerRequest, opts ...grpc.CallOption) (*CreateWorkerResponse, error)
+	CreateWorkerLed(ctx context.Context, in *CreateWorkerLedRequest, opts ...grpc.CallOption) (*CreateWorkerLedResponse, error)
 	// UpdateWorker updates an existing Worker in boundary.  The provided
 	// Worker must not have any read only fields set.  The update mask must be
 	// included in the request and contain at least 1 mutable field.  To unset
@@ -74,9 +74,9 @@ func (c *workerServiceClient) ListWorkers(ctx context.Context, in *ListWorkersRe
 	return out, nil
 }
 
-func (c *workerServiceClient) CreateWorker(ctx context.Context, in *CreateWorkerRequest, opts ...grpc.CallOption) (*CreateWorkerResponse, error) {
-	out := new(CreateWorkerResponse)
-	err := c.cc.Invoke(ctx, "/controller.api.services.v1.WorkerService/CreateWorker", in, out, opts...)
+func (c *workerServiceClient) CreateWorkerLed(ctx context.Context, in *CreateWorkerLedRequest, opts ...grpc.CallOption) (*CreateWorkerLedResponse, error) {
+	out := new(CreateWorkerLedResponse)
+	err := c.cc.Invoke(ctx, "/controller.api.services.v1.WorkerService/CreateWorkerLed", in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -115,12 +115,12 @@ type WorkerServiceServer interface {
 	// If the scope ID is missing, malformed, or reference a non existing scope,
 	// an error is returned.
 	ListWorkers(context.Context, *ListWorkersRequest) (*ListWorkersResponse, error)
-	// CreateWorker creates and stores a Worker in boundary.  The provided
+	// CreateWorkerLed creates and stores a Worker in boundary.  The provided
 	// request must include the Scope id in which the Worker will be created.
 	// If the Scope id is missing, malformed or references a non existing
 	// resource, an error is returned.  If a name is provided that is in
 	// use in another Worker in the same scope, an error is returned.
-	CreateWorker(context.Context, *CreateWorkerRequest) (*CreateWorkerResponse, error)
+	CreateWorkerLed(context.Context, *CreateWorkerLedRequest) (*CreateWorkerLedResponse, error)
 	// UpdateWorker updates an existing Worker in boundary.  The provided
 	// Worker must not have any read only fields set.  The update mask must be
 	// included in the request and contain at least 1 mutable field.  To unset
@@ -146,8 +146,8 @@ func (UnimplementedWorkerServiceServer) GetWorker(context.Context, *GetWorkerReq
 func (UnimplementedWorkerServiceServer) ListWorkers(context.Context, *ListWorkersRequest) (*ListWorkersResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListWorkers not implemented")
 }
-func (UnimplementedWorkerServiceServer) CreateWorker(context.Context, *CreateWorkerRequest) (*CreateWorkerResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method CreateWorker not implemented")
+func (UnimplementedWorkerServiceServer) CreateWorkerLed(context.Context, *CreateWorkerLedRequest) (*CreateWorkerLedResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateWorkerLed not implemented")
 }
 func (UnimplementedWorkerServiceServer) UpdateWorker(context.Context, *UpdateWorkerRequest) (*UpdateWorkerResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateWorker not implemented")
@@ -204,20 +204,20 @@ func _WorkerService_ListWorkers_Handler(srv interface{}, ctx context.Context, de
 	return interceptor(ctx, in, info, handler)
 }
 
-func _WorkerService_CreateWorker_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(CreateWorkerRequest)
+func _WorkerService_CreateWorkerLed_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateWorkerLedRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(WorkerServiceServer).CreateWorker(ctx, in)
+		return srv.(WorkerServiceServer).CreateWorkerLed(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/controller.api.services.v1.WorkerService/CreateWorker",
+		FullMethod: "/controller.api.services.v1.WorkerService/CreateWorkerLed",
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(WorkerServiceServer).CreateWorker(ctx, req.(*CreateWorkerRequest))
+		return srv.(WorkerServiceServer).CreateWorkerLed(ctx, req.(*CreateWorkerLedRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -274,8 +274,8 @@ var WorkerService_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _WorkerService_ListWorkers_Handler,
 		},
 		{
-			MethodName: "CreateWorker",
-			Handler:    _WorkerService_CreateWorker_Handler,
+			MethodName: "CreateWorkerLed",
+			Handler:    _WorkerService_CreateWorkerLed_Handler,
 		},
 		{
 			MethodName: "UpdateWorker",
diff --git a/internal/perms/acl_test.go b/internal/perms/acl_test.go
index d32845112..194bb5904 100644
--- a/internal/perms/acl_test.go
+++ b/internal/perms/acl_test.go
@@ -328,7 +328,7 @@ func Test_ACLAllowed(t *testing.T) {
 				},
 			},
 			actionsAuthorized: []actionAuthorized{
-				{action: action.CreateWorkerRequest, authorized: true},
+				{action: action.CreateWorkerLed, authorized: true},
 			},
 		},
 		{
@@ -338,12 +338,12 @@ func Test_ACLAllowed(t *testing.T) {
 				{
 					scope: scope.Global.String(),
 					grants: []string{
-						"type=worker;actions=create:worker-request",
+						"type=worker;actions=create:worker-led",
 					},
 				},
 			},
 			actionsAuthorized: []actionAuthorized{
-				{action: action.CreateWorkerRequest, authorized: true},
+				{action: action.CreateWorkerLed, authorized: true},
 			},
 		},
 	}
diff --git a/internal/proto/controller/api/resources/workers/v1/worker.proto b/internal/proto/controller/api/resources/workers/v1/worker.proto
index 68a81b9da..a7c16253e 100644
--- a/internal/proto/controller/api/resources/workers/v1/worker.proto
+++ b/internal/proto/controller/api/resources/workers/v1/worker.proto
@@ -90,7 +90,11 @@ message Worker {
   // itself.
   WorkerConfig worker_config = 140 [json_name = "worker_config"];
 
-  // TODO: Add worker auth related fields.
+  // worker_auth_token is input only. Supports the worker led node
+  // enrollment flow where this credentials token is produced by a worker. This
+  // token is a base58 encoded types.FetchNodeCredentialsRequest from
+  // https://github.com/hashicorp/nodeenrollment
+  google.protobuf.StringValue worker_auth_token = 150 [json_name = "worker_auth_token"]; // @gotags: `class:"public"`
 
   // Output only. The available actions on this resource for the requester.
   repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`
diff --git a/internal/proto/controller/api/services/v1/worker_service.proto b/internal/proto/controller/api/services/v1/worker_service.proto
index fea2c3d9a..f1aac2936 100644
--- a/internal/proto/controller/api/services/v1/worker_service.proto
+++ b/internal/proto/controller/api/services/v1/worker_service.proto
@@ -37,14 +37,14 @@ service WorkerService {
     };
   }
 
-  // CreateWorker creates and stores a Worker in boundary.  The provided
+  // CreateWorkerLed creates and stores a Worker in boundary.  The provided
   // request must include the Scope id in which the Worker will be created.
   // If the Scope id is missing, malformed or references a non existing
   // resource, an error is returned.  If a name is provided that is in
   // use in another Worker in the same scope, an error is returned.
-  rpc CreateWorker(CreateWorkerRequest) returns (CreateWorkerResponse) {
+  rpc CreateWorkerLed(CreateWorkerLedRequest) returns (CreateWorkerLedResponse) {
     option (google.api.http) = {
-      post: "/v1/workers"
+      post: "/v1/workers:create:worker-led"
       body: "item"
       response_body: "item"
     };
@@ -102,11 +102,11 @@ message ListWorkersResponse {
   repeated resources.workers.v1.Worker items = 1;
 }
 
-message CreateWorkerRequest {
+message CreateWorkerLedRequest {
   resources.workers.v1.Worker item = 1;
 }
 
-message CreateWorkerResponse {
+message CreateWorkerLedResponse {
   string uri = 1; // @gotags: `class:"public"`
   resources.workers.v1.Worker item = 2;
 }
diff --git a/internal/types/action/action.go b/internal/types/action/action.go
index dec8cfc43..010f3a699 100644
--- a/internal/types/action/action.go
+++ b/internal/types/action/action.go
@@ -53,7 +53,7 @@ const (
 	AddHostSources            Type = 42
 	SetHostSources            Type = 43
 	RemoveHostSources         Type = 44
-	CreateWorkerRequest       Type = 45
+	CreateWorkerLed           Type = 45
 )
 
 var Map = map[string]Type{
@@ -101,7 +101,7 @@ var Map = map[string]Type{
 	AddHostSources.String():            AddHostSources,
 	SetHostSources.String():            SetHostSources,
 	RemoveHostSources.String():         RemoveHostSources,
-	CreateWorkerRequest.String():       CreateWorkerRequest,
+	CreateWorkerLed.String():           CreateWorkerLed,
 }
 
 func (a Type) String() string {
@@ -151,7 +151,7 @@ func (a Type) String() string {
 		"add-host-sources",
 		"set-host-sources",
 		"remove-host-sources",
-		"create:worker-request",
+		"create:worker-led",
 	}[a]
 }
 
diff --git a/internal/types/action/action_test.go b/internal/types/action/action_test.go
index c5086248e..e644d3976 100644
--- a/internal/types/action/action_test.go
+++ b/internal/types/action/action_test.go
@@ -96,8 +96,8 @@ func TestAction(t *testing.T) {
 			want:   "no-op",
 		},
 		{
-			action: CreateWorkerRequest,
-			want:   "create:worker-request",
+			action: CreateWorkerLed,
+			want:   "create:worker-led",
 		},
 	}
 	for _, tt := range tests {
diff --git a/sdk/pbs/controller/api/resources/workers/worker.pb.go b/sdk/pbs/controller/api/resources/workers/worker.pb.go
index b11b1a93c..751e63812 100644
--- a/sdk/pbs/controller/api/resources/workers/worker.pb.go
+++ b/sdk/pbs/controller/api/resources/workers/worker.pb.go
@@ -132,6 +132,11 @@ type Worker struct {
 	// Output only. The set of information the worker daemon has reported about
 	// itself.
 	WorkerConfig *WorkerConfig `protobuf:"bytes,140,opt,name=worker_config,proto3" json:"worker_config,omitempty"`
+	// worker_auth_token is input only. Supports the worker led node
+	// enrollment flow where this credentials token is produced by a worker. This
+	// token is a base58 encoded types.FetchNodeCredentialsRequest from
+	// https://github.com/hashicorp/nodeenrollment
+	WorkerAuthToken *wrapperspb.StringValue `protobuf:"bytes,150,opt,name=worker_auth_token,proto3" json:"worker_auth_token,omitempty"` // @gotags: `class:"public"`
 	// Output only. The available actions on this resource for the requester.
 	AuthorizedActions []string `protobuf:"bytes,300,rep,name=authorized_actions,proto3" json:"authorized_actions,omitempty"` // @gotags: `class:"public"`
 }
@@ -266,6 +271,13 @@ func (x *Worker) GetWorkerConfig() *WorkerConfig {
 	return nil
 }
 
+func (x *Worker) GetWorkerAuthToken() *wrapperspb.StringValue {
+	if x != nil {
+		return x.WorkerAuthToken
+	}
+	return nil
+}
+
 func (x *Worker) GetAuthorizedActions() []string {
 	if x != nil {
 		return x.AuthorizedActions
@@ -307,7 +319,7 @@ var file_controller_api_resources_workers_v1_worker_proto_rawDesc = []byte{
 	0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
 	0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf9, 0x08, 0x0a, 0x06, 0x57, 0x6f, 0x72, 0x6b,
+	0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xc6, 0x09, 0x0a, 0x06, 0x57, 0x6f, 0x72, 0x6b,
 	0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
 	0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x14,
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x43,
@@ -365,26 +377,31 @@ var file_controller_api_resources_workers_v1_worker_proto_rawDesc = []byte{
 	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73,
 	0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
 	0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
-	0x2f, 0x0a, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xac, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x61, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x1a, 0x53, 0x0a, 0x09, 0x54, 0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
-	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
-	0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5c, 0x0a, 0x12, 0x43, 0x61, 0x6e, 0x6f, 0x6e, 0x69, 0x63,
-	0x61, 0x6c, 0x54, 0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b,
-	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c,
-	0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
-	0x02, 0x38, 0x01, 0x42, 0x50, 0x5a, 0x4e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
-	0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e,
-	0x64, 0x61, 0x72, 0x79, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x73, 0x2f, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x3b, 0x77, 0x6f,
-	0x72, 0x6b, 0x65, 0x72, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x4b, 0x0a, 0x11, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x74,
+	0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x96, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74,
+	0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x11, 0x77, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2f, 0x0a, 0x12,
+	0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x18, 0xac, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x53, 0x0a,
+	0x09, 0x54, 0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69,
+	0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
+	0x38, 0x01, 0x1a, 0x5c, 0x0a, 0x12, 0x43, 0x61, 0x6e, 0x6f, 0x6e, 0x69, 0x63, 0x61, 0x6c, 0x54,
+	0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
+	0x42, 0x50, 0x5a, 0x4e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72,
+	0x79, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x73, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x3b, 0x77, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -423,14 +440,15 @@ var file_controller_api_resources_workers_v1_worker_proto_depIdxs = []int32{
 	4,  // 8: controller.api.resources.workers.v1.Worker.canonical_tags:type_name -> controller.api.resources.workers.v1.Worker.CanonicalTagsEntry
 	7,  // 9: controller.api.resources.workers.v1.Worker.last_status_time:type_name -> google.protobuf.Timestamp
 	0,  // 10: controller.api.resources.workers.v1.Worker.worker_config:type_name -> controller.api.resources.workers.v1.WorkerConfig
-	8,  // 11: controller.api.resources.workers.v1.WorkerConfig.TagsEntry.value:type_name -> google.protobuf.ListValue
-	8,  // 12: controller.api.resources.workers.v1.Worker.TagsEntry.value:type_name -> google.protobuf.ListValue
-	8,  // 13: controller.api.resources.workers.v1.Worker.CanonicalTagsEntry.value:type_name -> google.protobuf.ListValue
-	14, // [14:14] is the sub-list for method output_type
-	14, // [14:14] is the sub-list for method input_type
-	14, // [14:14] is the sub-list for extension type_name
-	14, // [14:14] is the sub-list for extension extendee
-	0,  // [0:14] is the sub-list for field type_name
+	6,  // 11: controller.api.resources.workers.v1.Worker.worker_auth_token:type_name -> google.protobuf.StringValue
+	8,  // 12: controller.api.resources.workers.v1.WorkerConfig.TagsEntry.value:type_name -> google.protobuf.ListValue
+	8,  // 13: controller.api.resources.workers.v1.Worker.TagsEntry.value:type_name -> google.protobuf.ListValue
+	8,  // 14: controller.api.resources.workers.v1.Worker.CanonicalTagsEntry.value:type_name -> google.protobuf.ListValue
+	15, // [15:15] is the sub-list for method output_type
+	15, // [15:15] is the sub-list for method input_type
+	15, // [15:15] is the sub-list for extension type_name
+	15, // [15:15] is the sub-list for extension extendee
+	0,  // [0:15] is the sub-list for field type_name
 }
 
 func init() { file_controller_api_resources_workers_v1_worker_proto_init() }