ateom/actor ID split: Clean up purpose from MintActorCertificate (#1810)

The purpose field in MintActorCertificate (and the certs it issues) is
no longer needed. The distinction between actors and ateoms-for-actors
is now built into the SPIFFE URI.

Stacked over #1809

cmd/ateapi/internal/controlapi/actor.go

@@ -18,7 +18,6 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/x509"
-	"crypto/x509/pkix"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -703,26 +702,17 @@ func (s *RPCService) MintActorCertificate(ctx context.Context, req *ateapipb.Min
 		return nil, status.Errorf(codes.InvalidArgument, "Failed to verify CSR signature")
 	}
 
-	var template *x509.Certificate
-	switch req.GetPurpose() {
-	case ateapipb.ActorCertificatePurpose_ACTOR_CERTIFICATE_PURPOSE_ATUNNEL:
-		template = &x509.Certificate{
-			URIs: []*url.URL{resources.ActorSPIFFEID(resources.ActorRef{
-				Atespace: dbActor.GetMetadata().GetAtespace(),
-				Name:     dbActor.GetMetadata().GetName(),
-			})},
-			NotBefore:             time.Now().Add(-5 * time.Minute),
-			NotAfter:              time.Now().Add(time.Hour),
-			KeyUsage:              x509.KeyUsageDigitalSignature,
-			ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
-			BasicConstraintsValid: true,
-			IsCA:                  false,
-			Issuer: pkix.Name{
-				CommonName: "api.ate-system.svc.cluster.local",
-			},
-		}
-	default:
-		return nil, status.Errorf(codes.InvalidArgument, "certificate purpose must be specified")
+	template := &x509.Certificate{
+		URIs: []*url.URL{resources.ActorSPIFFEID(resources.ActorRef{
+			Atespace: dbActor.GetMetadata().GetAtespace(),
+			Name:     dbActor.GetMetadata().GetName(),
+		})},
+		NotBefore:             time.Now().Add(-5 * time.Minute),
+		NotAfter:              time.Now().Add(time.Hour),
+		KeyUsage:              x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+		IsCA:                  false,
 	}
 
 	err = substratex509.AddActorIdentityToCertificate(
@@ -730,7 +720,6 @@ func (s *RPCService) MintActorCertificate(ctx context.Context, req *ateapipb.Min
 			Atespace:  dbActor.GetMetadata().GetAtespace(),
 			ActorName: dbActor.GetMetadata().GetName(),
 			ActorUid:  dbActor.GetMetadata().GetUid(),
-			Purpose:   substratex509.ActorIdentityPurposeAtunnel,
 		},
 		template,
 	)

cmd/ateapi/internal/controlapi/actor_test.go

@@ -16,16 +16,26 @@ package controlapi
 
 import (
 	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
 	"fmt"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/agent-substrate/substrate/cmd/ateapi/internal/store"
 	"github.com/agent-substrate/substrate/cmd/ateapi/internal/store/storetest"
+	"github.com/agent-substrate/substrate/internal/localca"
 	"github.com/agent-substrate/substrate/internal/resources"
+	"github.com/agent-substrate/substrate/internal/substratex509"
 	"github.com/agent-substrate/substrate/pkg/proto/ateapipb"
 	"github.com/google/go-cmp/cmp"
 	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -1639,3 +1649,144 @@ func TestCreateActor_GoldenTagDefault(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateMintActorCertificateRequest(t *testing.T) {
+	validUID := "3b9f1e77-2c4d-4a80-91be-6d5c8f0a7e21"
+	tests := []struct {
+		name string
+		req  *ateapipb.MintActorCertificateRequest
+		want field.ErrorList
+	}{{
+		"valid",
+		&ateapipb.MintActorCertificateRequest{
+			Actor:                     &ateapipb.ObjectRef{Atespace: "ns1", Name: "id1"},
+			ActorUid:                  validUID,
+			CertificateSigningRequest: []byte("csr"),
+		},
+		nil,
+	}, {
+		"missing actor",
+		&ateapipb.MintActorCertificateRequest{
+			ActorUid:                  validUID,
+			CertificateSigningRequest: []byte("csr"),
+		},
+		field.ErrorList{field.Required(field.NewPath("actor"), "")},
+	}, {
+		"missing actor_uid",
+		&ateapipb.MintActorCertificateRequest{
+			Actor:                     &ateapipb.ObjectRef{Atespace: "ns1", Name: "id1"},
+			CertificateSigningRequest: []byte("csr"),
+		},
+		field.ErrorList{field.Required(field.NewPath("actor_uid"), "")},
+	}, {
+		"missing csr",
+		&ateapipb.MintActorCertificateRequest{
+			Actor:    &ateapipb.ObjectRef{Atespace: "ns1", Name: "id1"},
+			ActorUid: validUID,
+		},
+		field.ErrorList{field.Required(field.NewPath("certificate_signing_request"), "")},
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assertValidateErr(t, validateMintActorCertificateRequest(context.Background(), tt.req), tt.want)
+		})
+	}
+}
+
+type fakeActorServiceStore struct {
+	serviceStore
+	actors map[resources.ActorRef]*ateapipb.Actor
+}
+
+func (f *fakeActorServiceStore) GetActor(_ context.Context, actorRef resources.ActorRef) (*ateapipb.Actor, error) {
+	a, ok := f.actors[actorRef]
+	if !ok {
+		return nil, store.ErrNotFound
+	}
+	return a, nil
+}
+
+func TestMintActorCertificate(t *testing.T) {
+	ctx := peer.NewContext(context.Background(), &peer.Peer{
+		AuthInfo: credentials.TLSInfo{
+			State: tls.ConnectionState{
+				PeerCertificates: []*x509.Certificate{{}},
+			},
+		},
+	})
+
+	actorUID := "3b9f1e77-2c4d-4a80-91be-6d5c8f0a7e21"
+	created := &ateapipb.Actor{
+		Metadata:      &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: testActorID, Uid: actorUID},
+		ActorTemplate: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "tmpl-1"},
+		Status:        &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_RUNNING},
+	}
+	fakeStore := &fakeActorServiceStore{
+		actors: map[resources.ActorRef]*ateapipb.Actor{
+			{Atespace: testAtespace, Name: testActorID}: created,
+		},
+	}
+
+	ca, err := localca.GenerateCA("1", localca.KeyTypeECDSAP256, 24*time.Hour)
+	if err != nil {
+		t.Fatalf("GenerateCA: %v", err)
+	}
+	caPool := &localca.ConcretePool{
+		CAs:              []*localca.CA{ca},
+		ActiveForSigning: "1",
+	}
+
+	svc := &RPCService{
+		impl:          fakeStore,
+		actorIDCAPool: caPool,
+	}
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("GenerateKey: %v", err)
+	}
+	csr, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{}, key)
+	if err != nil {
+		t.Fatalf("CreateCertificateRequest: %v", err)
+	}
+
+	resp, err := svc.MintActorCertificate(ctx, &ateapipb.MintActorCertificateRequest{
+		Actor:                     &ateapipb.ObjectRef{Atespace: testAtespace, Name: testActorID},
+		ActorUid:                  created.GetMetadata().GetUid(),
+		CertificateSigningRequest: csr,
+	})
+	if err != nil {
+		t.Fatalf("MintActorCertificate() failed: %v", err)
+	}
+
+	chain := resp.GetActorCertificates()
+	if len(chain) == 0 {
+		t.Fatal("MintActorCertificate() returned empty chain")
+	}
+
+	leaf, err := x509.ParseCertificate(chain[0])
+	if err != nil {
+		t.Fatalf("ParseCertificate: %v", err)
+	}
+	if !key.PublicKey.Equal(leaf.PublicKey) {
+		t.Error("leaf public key does not match CSR key")
+	}
+
+	wantURI := fmt.Sprintf("spiffe://substrate-actor.local/actor/%s/%s", testAtespace, testActorID)
+	if len(leaf.URIs) != 1 || leaf.URIs[0].String() != wantURI {
+		t.Errorf("leaf URIs = %v, want [%s]", leaf.URIs, wantURI)
+	}
+
+	identity, err := substratex509.ActorIdentityFromCertificate(leaf)
+	if err != nil {
+		t.Fatalf("ActorIdentityFromCertificate: %v", err)
+	}
+	wantIdentity := &substratex509.ActorIdentity{
+		Atespace:  testAtespace,
+		ActorName: testActorID,
+		ActorUid:  created.GetMetadata().GetUid(),
+	}
+	if diff := cmp.Diff(wantIdentity, identity); diff != "" {
+		t.Errorf("ActorIdentity mismatch (-want +got):\n%s", diff)
+	}
+}

cmd/ateapi/internal/controlapi/zz_generated.validation.go

@@ -5035,41 +5035,6 @@ func Validate_MintActorCertificateRequest(
 		errs = append(errs, fn(fldPath.Child("certificate_signing_request"), obj.CertificateSigningRequest, oldVal, oldObj != nil)...)
 	}
 
-	{ // field ateapipb.MintActorCertificateRequest.Purpose
-		fn := func(
-			fldPath *field.Path,
-			obj, oldObj *ateapipb.ActorCertificatePurpose,
-			oldValueCorrelated bool) (errs field.ErrorList) {
-			// don't revalidate unchanged data
-			if oldValueCorrelated && op.Type == operation.Update {
-				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
-					return nil
-				}
-			}
-			// call field-attached validations
-			earlyReturn := false
-			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
-				errs = append(errs, e...)
-				earlyReturn = true
-			}
-			if earlyReturn {
-				return // do not proceed
-			}
-			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
-				errs = append(errs, e...)
-			}
-			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
-				errs = append(errs, e...)
-			}
-			return
-		}
-		oldVal := safe.Field(oldObj,
-			func(oldObj *ateapipb.MintActorCertificateRequest) *ateapipb.ActorCertificatePurpose {
-				return &oldObj.Purpose
-			})
-		errs = append(errs, fn(fldPath.Child("purpose"), &obj.Purpose, oldVal, oldObj != nil)...)
-	}
-
 	return errs
 }
 

internal/substratex509/substratex509.go

@@ -136,15 +136,10 @@ func validatePodIdentity(pod *PodIdentity) error {
 
 // ActorIdentity is the Substrate Actor Identity of an Actor, as embedded in the
 // oidActorIdentity extension of its certificate.
-type ActorIdentityPurpose string
-
-const ActorIdentityPurposeAtunnel ActorIdentityPurpose = "atunnel"
-
 type ActorIdentity struct {
 	Atespace  string
 	ActorName string
 	ActorUid  string
-	Purpose   ActorIdentityPurpose
 }
 
 func AddActorIdentityToCertificate(actor *ActorIdentity, template *x509.Certificate) error {
@@ -205,14 +200,8 @@ func validateActorIdentity(actor *ActorIdentity) error {
 	if actor.ActorUid == "" {
 		empty = append(empty, "ActorUid")
 	}
-	if actor.Purpose == "" {
-		empty = append(empty, "Purpose")
-	}
 	if len(empty) > 0 {
 		return fmt.Errorf("empty fields: %s", strings.Join(empty, ", "))
 	}
-	if actor.Purpose != ActorIdentityPurposeAtunnel {
-		return fmt.Errorf("unsupported Purpose %q", actor.Purpose)
-	}
 	return nil
 }

internal/substratex509/substratex509_test.go

@@ -224,7 +224,6 @@ func TestActorIdentityFromCertificate(t *testing.T) {
 		Atespace:  "team-a",
 		ActorName: "researcher",
 		ActorUid:  "actor-uid",
-		Purpose:   ActorIdentityPurposeAtunnel,
 	}
 	for _, tc := range []struct {
 		name    string
@@ -289,7 +288,6 @@ func TestActorIdentityFromCertificate(t *testing.T) {
 				actor := ActorIdentity{
 					Atespace:  "team-a",
 					ActorName: "researcher",
-					Purpose:   ActorIdentityPurposeAtunnel,
 				}
 				value, err := json.Marshal(actor)
 				if err != nil {
@@ -337,7 +335,6 @@ func TestAddActorIdentityToCertificateEmptyField(t *testing.T) {
 		{"Atespace", func(a *ActorIdentity) { a.Atespace = "" }},
 		{"ActorName", func(a *ActorIdentity) { a.ActorName = "" }},
 		{"ActorUid", func(a *ActorIdentity) { a.ActorUid = "" }},
-		{"Purpose", func(a *ActorIdentity) { a.Purpose = "" }},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -346,7 +343,6 @@ func TestAddActorIdentityToCertificateEmptyField(t *testing.T) {
 				Atespace:  "team-a",
 				ActorName: "researcher",
 				ActorUid:  "actor-uid",
-				Purpose:   ActorIdentityPurposeAtunnel,
 			}
 			tc.mutate(&actor)
 			err := AddActorIdentityToCertificate(&actor, &x509.Certificate{})
@@ -376,7 +372,6 @@ func TestExtensionValueIsJSON(t *testing.T) {
 		Atespace:  "team-a",
 		ActorName: "researcher",
 		ActorUid:  "actor-uid",
-		Purpose:   ActorIdentityPurposeAtunnel,
 	}
 	template := &x509.Certificate{}
 	if err := AddPodIdentityToCertificate(&pod, template); err != nil {

pkg/proto/ateapipb/ateapi.pb.go

@@ -371,57 +371,6 @@ func (ActorMetadataField) EnumDescriptor() ([]byte, []int) {
 	return file_ateapi_proto_rawDescGZIP(), []int{5}
 }
 
-// Purpose of the certificate.  Used to distinguish between system components
-// acting on behalf of an actor, and the actor itself taking action.
-//
-// TODO(identity): This should be removed once ateom/atunnel certs are separated
-// from plain actor certs.
-type ActorCertificatePurpose int32
-
-const (
-	ActorCertificatePurpose_ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED ActorCertificatePurpose = 0
-	ActorCertificatePurpose_ACTOR_CERTIFICATE_PURPOSE_ATUNNEL     ActorCertificatePurpose = 1 // Keep this in sync with MintCertRequest.purpose's maximum.
-)
-
-// Enum value maps for ActorCertificatePurpose.
-var (
-	ActorCertificatePurpose_name = map[int32]string{
-		0: "ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED",
-		1: "ACTOR_CERTIFICATE_PURPOSE_ATUNNEL",
-	}
-	ActorCertificatePurpose_value = map[string]int32{
-		"ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED": 0,
-		"ACTOR_CERTIFICATE_PURPOSE_ATUNNEL":     1,
-	}
-)
-
-func (x ActorCertificatePurpose) Enum() *ActorCertificatePurpose {
-	p := new(ActorCertificatePurpose)
-	*p = x
-	return p
-}
-
-func (x ActorCertificatePurpose) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (ActorCertificatePurpose) Descriptor() protoreflect.EnumDescriptor {
-	return file_ateapi_proto_enumTypes[6].Descriptor()
-}
-
-func (ActorCertificatePurpose) Type() protoreflect.EnumType {
-	return &file_ateapi_proto_enumTypes[6]
-}
-
-func (x ActorCertificatePurpose) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Use ActorCertificatePurpose.Descriptor instead.
-func (ActorCertificatePurpose) EnumDescriptor() ([]byte, []int) {
-	return file_ateapi_proto_rawDescGZIP(), []int{6}
-}
-
 type WorkerState int32
 
 const (
@@ -457,11 +406,11 @@ func (x WorkerState) String() string {
 }
 
 func (WorkerState) Descriptor() protoreflect.EnumDescriptor {
-	return file_ateapi_proto_enumTypes[7].Descriptor()
+	return file_ateapi_proto_enumTypes[6].Descriptor()
 }
 
 func (WorkerState) Type() protoreflect.EnumType {
-	return &file_ateapi_proto_enumTypes[7]
+	return &file_ateapi_proto_enumTypes[6]
 }
 
 func (x WorkerState) Number() protoreflect.EnumNumber {
@@ -470,7 +419,7 @@ func (x WorkerState) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use WorkerState.Descriptor instead.
 func (WorkerState) EnumDescriptor() ([]byte, []int) {
-	return file_ateapi_proto_rawDescGZIP(), []int{7}
+	return file_ateapi_proto_rawDescGZIP(), []int{6}
 }
 
 type ExternalVolume_Status int32
@@ -512,11 +461,11 @@ func (x ExternalVolume_Status) String() string {
 }
 
 func (ExternalVolume_Status) Descriptor() protoreflect.EnumDescriptor {
-	return file_ateapi_proto_enumTypes[8].Descriptor()
+	return file_ateapi_proto_enumTypes[7].Descriptor()
 }
 
 func (ExternalVolume_Status) Type() protoreflect.EnumType {
-	return &file_ateapi_proto_enumTypes[8]
+	return &file_ateapi_proto_enumTypes[7]
 }
 
 func (x ExternalVolume_Status) Number() protoreflect.EnumNumber {
@@ -5350,15 +5299,8 @@ type MintActorCertificateRequest struct {
 	// +k8s:required
 	// +k8s:maxBytes=16384
 	CertificateSigningRequest []byte `protobuf:"bytes,2,opt,name=certificate_signing_request,json=certificateSigningRequest,proto3" json:"certificate_signing_request,omitempty"`
-	// Purpose of the certificate.  Used to distinguish between system components
-	// acting on behalf of an actor, and the actor itself taking action.
-	//
-	// +k8s:required
-	// +k8s:minimum=1
-	// +k8s:maximum=1 # keep this in sync with the ActorCertificatePurpose enum
-	Purpose       ActorCertificatePurpose `protobuf:"varint,4,opt,name=purpose,proto3,enum=ateapi.ActorCertificatePurpose" json:"purpose,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	unknownFields             protoimpl.UnknownFields
+	sizeCache                 protoimpl.SizeCache
 }
 
 func (x *MintActorCertificateRequest) Reset() {
@@ -5412,13 +5354,6 @@ func (x *MintActorCertificateRequest) GetCertificateSigningRequest() []byte {
 	return nil
 }
 
-func (x *MintActorCertificateRequest) GetPurpose() ActorCertificatePurpose {
-	if x != nil {
-		return x.Purpose
-	}
-	return ActorCertificatePurpose_ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED
-}
-
 // Response message for MintActorCertificate.
 type MintActorCertificateResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -7511,12 +7446,11 @@ const file_ateapi_proto_rawDesc = "" +
 	"\tactor_uid\x18\a \x01(\tR\bactorUid\x12\x1a\n" +
 	"\baudience\x18\x01 \x03(\tR\baudience\"8\n" +
 	"\x14MintActorJWTResponse\x12 \n" +
-	"\tactor_jwt\x18\x01 \x01(\tB\x03\x80\x01\x01R\bactorJwt\"\xde\x01\n" +
+	"\tactor_jwt\x18\x01 \x01(\tB\x03\x80\x01\x01R\bactorJwt\"\xb2\x01\n" +
 	"\x1bMintActorCertificateRequest\x12'\n" +
 	"\x05actor\x18\x06 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\x12\x1b\n" +
 	"\tactor_uid\x18\a \x01(\tR\bactorUid\x12>\n" +
-	"\x1bcertificate_signing_request\x18\x02 \x01(\fR\x19certificateSigningRequest\x129\n" +
-	"\apurpose\x18\x04 \x01(\x0e2\x1f.ateapi.ActorCertificatePurposeR\apurpose\"M\n" +
+	"\x1bcertificate_signing_request\x18\x02 \x01(\fR\x19certificateSigningRequestJ\x04\b\x04\x10\x05R\apurpose\"M\n" +
 	"\x1cMintActorCertificateResponse\x12-\n" +
 	"\x12actor_certificates\x18\x01 \x03(\fR\x11actorCertificates\"i\n" +
 	"\x0fListTagsRequest\x12\x1a\n" +
@@ -7649,10 +7583,7 @@ const file_ateapi_proto_rawDesc = "" +
 	" ACTOR_METADATA_FIELD_UNSPECIFIED\x10\x00\x12\x1d\n" +
 	"\x19ACTOR_METADATA_FIELD_NAME\x10\x01\x12!\n" +
 	"\x1dACTOR_METADATA_FIELD_ATESPACE\x10\x02\x12\x1c\n" +
-	"\x18ACTOR_METADATA_FIELD_UID\x10\x03*k\n" +
-	"\x17ActorCertificatePurpose\x12)\n" +
-	"%ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED\x10\x00\x12%\n" +
-	"!ACTOR_CERTIFICATE_PURPOSE_ATUNNEL\x10\x01*_\n" +
+	"\x18ACTOR_METADATA_FIELD_UID\x10\x03*_\n" +
 	"\vWorkerState\x12\x1c\n" +
 	"\x18WORKER_STATE_UNSPECIFIED\x10\x00\x12\x17\n" +
 	"\x13WORKER_STATE_ACTIVE\x10\x01\x12\x19\n" +
@@ -7712,7 +7643,7 @@ func file_ateapi_proto_rawDescGZIP() []byte {
 	return file_ateapi_proto_rawDescData
 }
 
-var file_ateapi_proto_enumTypes = make([]protoimpl.EnumInfo, 9)
+var file_ateapi_proto_enumTypes = make([]protoimpl.EnumInfo, 8)
 var file_ateapi_proto_msgTypes = make([]protoimpl.MessageInfo, 104)
 var file_ateapi_proto_goTypes = []any{
 	(SnapshotContentScope)(0),                  // 0: ateapi.SnapshotContentScope
@@ -7721,331 +7652,329 @@ var file_ateapi_proto_goTypes = []any{
 	(SandboxClass)(0),                          // 3: ateapi.SandboxClass
 	(ResumeSource)(0),                          // 4: ateapi.ResumeSource
 	(ActorMetadataField)(0),                    // 5: ateapi.ActorMetadataField
-	(ActorCertificatePurpose)(0),               // 6: ateapi.ActorCertificatePurpose
-	(WorkerState)(0),                           // 7: ateapi.WorkerState
-	(ExternalVolume_Status)(0),                 // 8: ateapi.ExternalVolume.Status
-	(*ExternalSnapshot)(nil),                   // 9: ateapi.ExternalSnapshot
-	(*LocalSnapshot)(nil),                      // 10: ateapi.LocalSnapshot
-	(*Selector)(nil),                           // 11: ateapi.Selector
-	(*ResourceMetadata)(nil),                   // 12: ateapi.ResourceMetadata
-	(*ExternalVolume)(nil),                     // 13: ateapi.ExternalVolume
-	(*Actor)(nil),                              // 14: ateapi.Actor
-	(*EgressPolicy)(nil),                       // 15: ateapi.EgressPolicy
-	(*EgressRule)(nil),                         // 16: ateapi.EgressRule
-	(*HostnameRule)(nil),                       // 17: ateapi.HostnameRule
-	(*CIDRRule)(nil),                           // 18: ateapi.CIDRRule
-	(*EgressRuleEffects)(nil),                  // 19: ateapi.EgressRuleEffects
-	(*CredentialHeaderInjection)(nil),          // 20: ateapi.CredentialHeaderInjection
-	(*ActorStatus)(nil),                        // 21: ateapi.ActorStatus
-	(*ActorCrash)(nil),                         // 22: ateapi.ActorCrash
-	(*WorkerAssignment)(nil),                   // 23: ateapi.WorkerAssignment
-	(*TagStatus)(nil),                          // 24: ateapi.TagStatus
-	(*Tag)(nil),                                // 25: ateapi.Tag
-	(*Atespace)(nil),                           // 26: ateapi.Atespace
-	(*ObjectRef)(nil),                          // 27: ateapi.ObjectRef
-	(*ActorTemplate)(nil),                      // 28: ateapi.ActorTemplate
-	(*Resources)(nil),                          // 29: ateapi.Resources
-	(*Limits)(nil),                             // 30: ateapi.Limits
-	(*GoldenSnapshotStatus)(nil),               // 31: ateapi.GoldenSnapshotStatus
-	(*ActorTemplateStatus)(nil),                // 32: ateapi.ActorTemplateStatus
-	(*SandboxConfig)(nil),                      // 33: ateapi.SandboxConfig
-	(*SnapshotConfig)(nil),                     // 34: ateapi.SnapshotConfig
-	(*OnResumeConfig)(nil),                     // 35: ateapi.OnResumeConfig
-	(*Container)(nil),                          // 36: ateapi.Container
-	(*SecurityContext)(nil),                    // 37: ateapi.SecurityContext
-	(*Capabilities)(nil),                       // 38: ateapi.Capabilities
-	(*EnvVar)(nil),                             // 39: ateapi.EnvVar
-	(*ContainerWakeupProbe)(nil),               // 40: ateapi.ContainerWakeupProbe
-	(*HTTPGetAction)(nil),                      // 41: ateapi.HTTPGetAction
-	(*Volume)(nil),                             // 42: ateapi.Volume
-	(*ImageVolumeSource)(nil),                  // 43: ateapi.ImageVolumeSource
-	(*DurableDirVolumeSource)(nil),             // 44: ateapi.DurableDirVolumeSource
-	(*ExternalVolumeTemplate)(nil),             // 45: ateapi.ExternalVolumeTemplate
-	(*SystemInfoVolumeSource)(nil),             // 46: ateapi.SystemInfoVolumeSource
-	(*SystemInfoDataSource)(nil),               // 47: ateapi.SystemInfoDataSource
-	(*ActorMetadataDataSource)(nil),            // 48: ateapi.ActorMetadataDataSource
-	(*ActorMetadataItem)(nil),                  // 49: ateapi.ActorMetadataItem
-	(*TrustBundleDataSource)(nil),              // 50: ateapi.TrustBundleDataSource
-	(*VolumeMount)(nil),                        // 51: ateapi.VolumeMount
-	(*CreateAtespaceRequest)(nil),              // 52: ateapi.CreateAtespaceRequest
-	(*GetAtespaceRequest)(nil),                 // 53: ateapi.GetAtespaceRequest
-	(*ListAtespacesRequest)(nil),               // 54: ateapi.ListAtespacesRequest
-	(*ListAtespacesResponse)(nil),              // 55: ateapi.ListAtespacesResponse
-	(*DeleteAtespaceRequest)(nil),              // 56: ateapi.DeleteAtespaceRequest
-	(*CreateActorTemplateRequest)(nil),         // 57: ateapi.CreateActorTemplateRequest
-	(*GetActorTemplateRequest)(nil),            // 58: ateapi.GetActorTemplateRequest
-	(*ListActorTemplatesRequest)(nil),          // 59: ateapi.ListActorTemplatesRequest
-	(*ListActorTemplatesResponse)(nil),         // 60: ateapi.ListActorTemplatesResponse
-	(*DeleteActorTemplateRequest)(nil),         // 61: ateapi.DeleteActorTemplateRequest
-	(*GetActorRequest)(nil),                    // 62: ateapi.GetActorRequest
-	(*CreateActorRequest)(nil),                 // 63: ateapi.CreateActorRequest
-	(*UpdateActorRequest)(nil),                 // 64: ateapi.UpdateActorRequest
-	(*SuspendActorRequest)(nil),                // 65: ateapi.SuspendActorRequest
-	(*SuspendActorResponse)(nil),               // 66: ateapi.SuspendActorResponse
-	(*PauseActorRequest)(nil),                  // 67: ateapi.PauseActorRequest
-	(*PauseActorResponse)(nil),                 // 68: ateapi.PauseActorResponse
-	(*ResumeActorRequest)(nil),                 // 69: ateapi.ResumeActorRequest
-	(*ResumeActorResponse)(nil),                // 70: ateapi.ResumeActorResponse
-	(*RevertActorRequest)(nil),                 // 71: ateapi.RevertActorRequest
-	(*RevertActorResponse)(nil),                // 72: ateapi.RevertActorResponse
-	(*DeleteActorRequest)(nil),                 // 73: ateapi.DeleteActorRequest
-	(*GetActorEgressPolicyRequest)(nil),        // 74: ateapi.GetActorEgressPolicyRequest
-	(*CreateActorEgressPolicyRequest)(nil),     // 75: ateapi.CreateActorEgressPolicyRequest
-	(*UpdateActorEgressPolicyRequest)(nil),     // 76: ateapi.UpdateActorEgressPolicyRequest
-	(*DeleteActorEgressPolicyRequest)(nil),     // 77: ateapi.DeleteActorEgressPolicyRequest
-	(*GetTagRequest)(nil),                      // 78: ateapi.GetTagRequest
-	(*MintActorJWTRequest)(nil),                // 79: ateapi.MintActorJWTRequest
-	(*MintActorJWTResponse)(nil),               // 80: ateapi.MintActorJWTResponse
-	(*MintActorCertificateRequest)(nil),        // 81: ateapi.MintActorCertificateRequest
-	(*MintActorCertificateResponse)(nil),       // 82: ateapi.MintActorCertificateResponse
-	(*ListTagsRequest)(nil),                    // 83: ateapi.ListTagsRequest
-	(*ListTagsResponse)(nil),                   // 84: ateapi.ListTagsResponse
-	(*CreateTagRequest)(nil),                   // 85: ateapi.CreateTagRequest
-	(*UpdateTagRequest)(nil),                   // 86: ateapi.UpdateTagRequest
-	(*DeleteTagRequest)(nil),                   // 87: ateapi.DeleteTagRequest
-	(*DeleteOptions)(nil),                      // 88: ateapi.DeleteOptions
-	(*ListWorkerActorAssignmentsRequest)(nil),  // 89: ateapi.ListWorkerActorAssignmentsRequest
-	(*ListWorkerActorAssignmentsResponse)(nil), // 90: ateapi.ListWorkerActorAssignmentsResponse
-	(*ListWorkersRequest)(nil),                 // 91: ateapi.ListWorkersRequest
-	(*ListWorkersResponse)(nil),                // 92: ateapi.ListWorkersResponse
-	(*GetWorkerRequest)(nil),                   // 93: ateapi.GetWorkerRequest
-	(*CreateWorkerRequest)(nil),                // 94: ateapi.CreateWorkerRequest
-	(*UpdateWorkerRequest)(nil),                // 95: ateapi.UpdateWorkerRequest
-	(*DeleteWorkerRequest)(nil),                // 96: ateapi.DeleteWorkerRequest
-	(*DrainWorkerRequest)(nil),                 // 97: ateapi.DrainWorkerRequest
-	(*ListActorsRequest)(nil),                  // 98: ateapi.ListActorsRequest
-	(*ListActorsResponse)(nil),                 // 99: ateapi.ListActorsResponse
-	(*Worker)(nil),                             // 100: ateapi.Worker
-	(*WorkerStatus)(nil),                       // 101: ateapi.WorkerStatus
-	(*WorkerResources)(nil),                    // 102: ateapi.WorkerResources
-	(*ActorAssignment)(nil),                    // 103: ateapi.ActorAssignment
-	(*SetWorkerCapacityRequest)(nil),           // 104: ateapi.SetWorkerCapacityRequest
-	(*SetWorkerCapacityResponse)(nil),          // 105: ateapi.SetWorkerCapacityResponse
-	(*MintAteomActorCertificateRequest)(nil),   // 106: ateapi.MintAteomActorCertificateRequest
-	(*MintAteomActorCertificateResponse)(nil),  // 107: ateapi.MintAteomActorCertificateResponse
-	(*RequestActorSuspendRequest)(nil),         // 108: ateapi.RequestActorSuspendRequest
-	(*RequestActorSuspendResponse)(nil),        // 109: ateapi.RequestActorSuspendResponse
-	nil,                                        // 110: ateapi.Selector.MatchLabelsEntry
-	nil,                                        // 111: ateapi.ExternalVolume.VolumeContextEntry
-	nil,                                        // 112: ateapi.Worker.LabelsEntry
-	(*timestamppb.Timestamp)(nil),              // 113: google.protobuf.Timestamp
-	(*emptypb.Empty)(nil),                      // 114: google.protobuf.Empty
+	(WorkerState)(0),                           // 6: ateapi.WorkerState
+	(ExternalVolume_Status)(0),                 // 7: ateapi.ExternalVolume.Status
+	(*ExternalSnapshot)(nil),                   // 8: ateapi.ExternalSnapshot
+	(*LocalSnapshot)(nil),                      // 9: ateapi.LocalSnapshot
+	(*Selector)(nil),                           // 10: ateapi.Selector
+	(*ResourceMetadata)(nil),                   // 11: ateapi.ResourceMetadata
+	(*ExternalVolume)(nil),                     // 12: ateapi.ExternalVolume
+	(*Actor)(nil),                              // 13: ateapi.Actor
+	(*EgressPolicy)(nil),                       // 14: ateapi.EgressPolicy
+	(*EgressRule)(nil),                         // 15: ateapi.EgressRule
+	(*HostnameRule)(nil),                       // 16: ateapi.HostnameRule
+	(*CIDRRule)(nil),                           // 17: ateapi.CIDRRule
+	(*EgressRuleEffects)(nil),                  // 18: ateapi.EgressRuleEffects
+	(*CredentialHeaderInjection)(nil),          // 19: ateapi.CredentialHeaderInjection
+	(*ActorStatus)(nil),                        // 20: ateapi.ActorStatus
+	(*ActorCrash)(nil),                         // 21: ateapi.ActorCrash
+	(*WorkerAssignment)(nil),                   // 22: ateapi.WorkerAssignment
+	(*TagStatus)(nil),                          // 23: ateapi.TagStatus
+	(*Tag)(nil),                                // 24: ateapi.Tag
+	(*Atespace)(nil),                           // 25: ateapi.Atespace
+	(*ObjectRef)(nil),                          // 26: ateapi.ObjectRef
+	(*ActorTemplate)(nil),                      // 27: ateapi.ActorTemplate
+	(*Resources)(nil),                          // 28: ateapi.Resources
+	(*Limits)(nil),                             // 29: ateapi.Limits
+	(*GoldenSnapshotStatus)(nil),               // 30: ateapi.GoldenSnapshotStatus
+	(*ActorTemplateStatus)(nil),                // 31: ateapi.ActorTemplateStatus
+	(*SandboxConfig)(nil),                      // 32: ateapi.SandboxConfig
+	(*SnapshotConfig)(nil),                     // 33: ateapi.SnapshotConfig
+	(*OnResumeConfig)(nil),                     // 34: ateapi.OnResumeConfig
+	(*Container)(nil),                          // 35: ateapi.Container
+	(*SecurityContext)(nil),                    // 36: ateapi.SecurityContext
+	(*Capabilities)(nil),                       // 37: ateapi.Capabilities
+	(*EnvVar)(nil),                             // 38: ateapi.EnvVar
+	(*ContainerWakeupProbe)(nil),               // 39: ateapi.ContainerWakeupProbe
+	(*HTTPGetAction)(nil),                      // 40: ateapi.HTTPGetAction
+	(*Volume)(nil),                             // 41: ateapi.Volume
+	(*ImageVolumeSource)(nil),                  // 42: ateapi.ImageVolumeSource
+	(*DurableDirVolumeSource)(nil),             // 43: ateapi.DurableDirVolumeSource
+	(*ExternalVolumeTemplate)(nil),             // 44: ateapi.ExternalVolumeTemplate
+	(*SystemInfoVolumeSource)(nil),             // 45: ateapi.SystemInfoVolumeSource
+	(*SystemInfoDataSource)(nil),               // 46: ateapi.SystemInfoDataSource
+	(*ActorMetadataDataSource)(nil),            // 47: ateapi.ActorMetadataDataSource
+	(*ActorMetadataItem)(nil),                  // 48: ateapi.ActorMetadataItem
+	(*TrustBundleDataSource)(nil),              // 49: ateapi.TrustBundleDataSource
+	(*VolumeMount)(nil),                        // 50: ateapi.VolumeMount
+	(*CreateAtespaceRequest)(nil),              // 51: ateapi.CreateAtespaceRequest
+	(*GetAtespaceRequest)(nil),                 // 52: ateapi.GetAtespaceRequest
+	(*ListAtespacesRequest)(nil),               // 53: ateapi.ListAtespacesRequest
+	(*ListAtespacesResponse)(nil),              // 54: ateapi.ListAtespacesResponse
+	(*DeleteAtespaceRequest)(nil),              // 55: ateapi.DeleteAtespaceRequest
+	(*CreateActorTemplateRequest)(nil),         // 56: ateapi.CreateActorTemplateRequest
+	(*GetActorTemplateRequest)(nil),            // 57: ateapi.GetActorTemplateRequest
+	(*ListActorTemplatesRequest)(nil),          // 58: ateapi.ListActorTemplatesRequest
+	(*ListActorTemplatesResponse)(nil),         // 59: ateapi.ListActorTemplatesResponse
+	(*DeleteActorTemplateRequest)(nil),         // 60: ateapi.DeleteActorTemplateRequest
+	(*GetActorRequest)(nil),                    // 61: ateapi.GetActorRequest
+	(*CreateActorRequest)(nil),                 // 62: ateapi.CreateActorRequest
+	(*UpdateActorRequest)(nil),                 // 63: ateapi.UpdateActorRequest
+	(*SuspendActorRequest)(nil),                // 64: ateapi.SuspendActorRequest
+	(*SuspendActorResponse)(nil),               // 65: ateapi.SuspendActorResponse
+	(*PauseActorRequest)(nil),                  // 66: ateapi.PauseActorRequest
+	(*PauseActorResponse)(nil),                 // 67: ateapi.PauseActorResponse
+	(*ResumeActorRequest)(nil),                 // 68: ateapi.ResumeActorRequest
+	(*ResumeActorResponse)(nil),                // 69: ateapi.ResumeActorResponse
+	(*RevertActorRequest)(nil),                 // 70: ateapi.RevertActorRequest
+	(*RevertActorResponse)(nil),                // 71: ateapi.RevertActorResponse
+	(*DeleteActorRequest)(nil),                 // 72: ateapi.DeleteActorRequest
+	(*GetActorEgressPolicyRequest)(nil),        // 73: ateapi.GetActorEgressPolicyRequest
+	(*CreateActorEgressPolicyRequest)(nil),     // 74: ateapi.CreateActorEgressPolicyRequest
+	(*UpdateActorEgressPolicyRequest)(nil),     // 75: ateapi.UpdateActorEgressPolicyRequest
+	(*DeleteActorEgressPolicyRequest)(nil),     // 76: ateapi.DeleteActorEgressPolicyRequest
+	(*GetTagRequest)(nil),                      // 77: ateapi.GetTagRequest
+	(*MintActorJWTRequest)(nil),                // 78: ateapi.MintActorJWTRequest
+	(*MintActorJWTResponse)(nil),               // 79: ateapi.MintActorJWTResponse
+	(*MintActorCertificateRequest)(nil),        // 80: ateapi.MintActorCertificateRequest
+	(*MintActorCertificateResponse)(nil),       // 81: ateapi.MintActorCertificateResponse
+	(*ListTagsRequest)(nil),                    // 82: ateapi.ListTagsRequest
+	(*ListTagsResponse)(nil),                   // 83: ateapi.ListTagsResponse
+	(*CreateTagRequest)(nil),                   // 84: ateapi.CreateTagRequest
+	(*UpdateTagRequest)(nil),                   // 85: ateapi.UpdateTagRequest
+	(*DeleteTagRequest)(nil),                   // 86: ateapi.DeleteTagRequest
+	(*DeleteOptions)(nil),                      // 87: ateapi.DeleteOptions
+	(*ListWorkerActorAssignmentsRequest)(nil),  // 88: ateapi.ListWorkerActorAssignmentsRequest
+	(*ListWorkerActorAssignmentsResponse)(nil), // 89: ateapi.ListWorkerActorAssignmentsResponse
+	(*ListWorkersRequest)(nil),                 // 90: ateapi.ListWorkersRequest
+	(*ListWorkersResponse)(nil),                // 91: ateapi.ListWorkersResponse
+	(*GetWorkerRequest)(nil),                   // 92: ateapi.GetWorkerRequest
+	(*CreateWorkerRequest)(nil),                // 93: ateapi.CreateWorkerRequest
+	(*UpdateWorkerRequest)(nil),                // 94: ateapi.UpdateWorkerRequest
+	(*DeleteWorkerRequest)(nil),                // 95: ateapi.DeleteWorkerRequest
+	(*DrainWorkerRequest)(nil),                 // 96: ateapi.DrainWorkerRequest
+	(*ListActorsRequest)(nil),                  // 97: ateapi.ListActorsRequest
+	(*ListActorsResponse)(nil),                 // 98: ateapi.ListActorsResponse
+	(*Worker)(nil),                             // 99: ateapi.Worker
+	(*WorkerStatus)(nil),                       // 100: ateapi.WorkerStatus
+	(*WorkerResources)(nil),                    // 101: ateapi.WorkerResources
+	(*ActorAssignment)(nil),                    // 102: ateapi.ActorAssignment
+	(*SetWorkerCapacityRequest)(nil),           // 103: ateapi.SetWorkerCapacityRequest
+	(*SetWorkerCapacityResponse)(nil),          // 104: ateapi.SetWorkerCapacityResponse
+	(*MintAteomActorCertificateRequest)(nil),   // 105: ateapi.MintAteomActorCertificateRequest
+	(*MintAteomActorCertificateResponse)(nil),  // 106: ateapi.MintAteomActorCertificateResponse
+	(*RequestActorSuspendRequest)(nil),         // 107: ateapi.RequestActorSuspendRequest
+	(*RequestActorSuspendResponse)(nil),        // 108: ateapi.RequestActorSuspendResponse
+	nil,                                        // 109: ateapi.Selector.MatchLabelsEntry
+	nil,                                        // 110: ateapi.ExternalVolume.VolumeContextEntry
+	nil,                                        // 111: ateapi.Worker.LabelsEntry
+	(*timestamppb.Timestamp)(nil),              // 112: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),                      // 113: google.protobuf.Empty
 }
 var file_ateapi_proto_depIdxs = []int32{
 	0,   // 0: ateapi.ExternalSnapshot.content_scope:type_name -> ateapi.SnapshotContentScope
 	0,   // 1: ateapi.LocalSnapshot.content_scope:type_name -> ateapi.SnapshotContentScope
-	110, // 2: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry
-	113, // 3: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp
-	113, // 4: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp
-	8,   // 5: ateapi.ExternalVolume.status:type_name -> ateapi.ExternalVolume.Status
-	111, // 6: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry
-	12,  // 7: ateapi.Actor.metadata:type_name -> ateapi.ResourceMetadata
-	27,  // 8: ateapi.Actor.actor_template:type_name -> ateapi.ObjectRef
-	11,  // 9: ateapi.Actor.worker_selector:type_name -> ateapi.Selector
-	27,  // 10: ateapi.Actor.source_tag:type_name -> ateapi.ObjectRef
-	21,  // 11: ateapi.Actor.status:type_name -> ateapi.ActorStatus
-	12,  // 12: ateapi.EgressPolicy.metadata:type_name -> ateapi.ResourceMetadata
-	16,  // 13: ateapi.EgressPolicy.rules:type_name -> ateapi.EgressRule
-	17,  // 14: ateapi.EgressRule.hostnames:type_name -> ateapi.HostnameRule
-	18,  // 15: ateapi.EgressRule.cidrs:type_name -> ateapi.CIDRRule
-	114, // 16: ateapi.EgressRule.all:type_name -> google.protobuf.Empty
-	19,  // 17: ateapi.HostnameRule.effects:type_name -> ateapi.EgressRuleEffects
-	20,  // 18: ateapi.EgressRuleEffects.inject_static_headers:type_name -> ateapi.CredentialHeaderInjection
+	109, // 2: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry
+	112, // 3: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp
+	112, // 4: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp
+	7,   // 5: ateapi.ExternalVolume.status:type_name -> ateapi.ExternalVolume.Status
+	110, // 6: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry
+	11,  // 7: ateapi.Actor.metadata:type_name -> ateapi.ResourceMetadata
+	26,  // 8: ateapi.Actor.actor_template:type_name -> ateapi.ObjectRef
+	10,  // 9: ateapi.Actor.worker_selector:type_name -> ateapi.Selector
+	26,  // 10: ateapi.Actor.source_tag:type_name -> ateapi.ObjectRef
+	20,  // 11: ateapi.Actor.status:type_name -> ateapi.ActorStatus
+	11,  // 12: ateapi.EgressPolicy.metadata:type_name -> ateapi.ResourceMetadata
+	15,  // 13: ateapi.EgressPolicy.rules:type_name -> ateapi.EgressRule
+	16,  // 14: ateapi.EgressRule.hostnames:type_name -> ateapi.HostnameRule
+	17,  // 15: ateapi.EgressRule.cidrs:type_name -> ateapi.CIDRRule
+	113, // 16: ateapi.EgressRule.all:type_name -> google.protobuf.Empty
+	18,  // 17: ateapi.HostnameRule.effects:type_name -> ateapi.EgressRuleEffects
+	19,  // 18: ateapi.EgressRuleEffects.inject_static_headers:type_name -> ateapi.CredentialHeaderInjection
 	2,   // 19: ateapi.ActorStatus.state:type_name -> ateapi.ActorState
-	23,  // 20: ateapi.ActorStatus.worker_assignment:type_name -> ateapi.WorkerAssignment
-	9,   // 21: ateapi.ActorStatus.external_snapshot:type_name -> ateapi.ExternalSnapshot
-	10,  // 22: ateapi.ActorStatus.local_snapshot:type_name -> ateapi.LocalSnapshot
-	13,  // 23: ateapi.ActorStatus.actor_volumes:type_name -> ateapi.ExternalVolume
-	22,  // 24: ateapi.ActorStatus.crash:type_name -> ateapi.ActorCrash
-	113, // 25: ateapi.ActorCrash.crash_time:type_name -> google.protobuf.Timestamp
-	27,  // 26: ateapi.WorkerAssignment.worker:type_name -> ateapi.ObjectRef
-	9,   // 27: ateapi.TagStatus.snapshot:type_name -> ateapi.ExternalSnapshot
-	12,  // 28: ateapi.Tag.metadata:type_name -> ateapi.ResourceMetadata
-	24,  // 29: ateapi.Tag.status:type_name -> ateapi.TagStatus
+	22,  // 20: ateapi.ActorStatus.worker_assignment:type_name -> ateapi.WorkerAssignment
+	8,   // 21: ateapi.ActorStatus.external_snapshot:type_name -> ateapi.ExternalSnapshot
+	9,   // 22: ateapi.ActorStatus.local_snapshot:type_name -> ateapi.LocalSnapshot
+	12,  // 23: ateapi.ActorStatus.actor_volumes:type_name -> ateapi.ExternalVolume
+	21,  // 24: ateapi.ActorStatus.crash:type_name -> ateapi.ActorCrash
+	112, // 25: ateapi.ActorCrash.crash_time:type_name -> google.protobuf.Timestamp
+	26,  // 26: ateapi.WorkerAssignment.worker:type_name -> ateapi.ObjectRef
+	8,   // 27: ateapi.TagStatus.snapshot:type_name -> ateapi.ExternalSnapshot
+	11,  // 28: ateapi.Tag.metadata:type_name -> ateapi.ResourceMetadata
+	23,  // 29: ateapi.Tag.status:type_name -> ateapi.TagStatus
 	1,   // 30: ateapi.Tag.scope:type_name -> ateapi.TagScope
-	27,  // 31: ateapi.Tag.source_actor:type_name -> ateapi.ObjectRef
-	12,  // 32: ateapi.Atespace.metadata:type_name -> ateapi.ResourceMetadata
-	12,  // 33: ateapi.ActorTemplate.metadata:type_name -> ateapi.ResourceMetadata
-	11,  // 34: ateapi.ActorTemplate.worker_selector:type_name -> ateapi.Selector
-	36,  // 35: ateapi.ActorTemplate.containers:type_name -> ateapi.Container
-	42,  // 36: ateapi.ActorTemplate.volumes:type_name -> ateapi.Volume
-	34,  // 37: ateapi.ActorTemplate.snapshot_config:type_name -> ateapi.SnapshotConfig
-	33,  // 38: ateapi.ActorTemplate.sandbox_config:type_name -> ateapi.SandboxConfig
-	29,  // 39: ateapi.ActorTemplate.resources:type_name -> ateapi.Resources
-	32,  // 40: ateapi.ActorTemplate.status:type_name -> ateapi.ActorTemplateStatus
-	30,  // 41: ateapi.Resources.limits:type_name -> ateapi.Limits
-	27,  // 42: ateapi.GoldenSnapshotStatus.golden_tag:type_name -> ateapi.ObjectRef
-	113, // 43: ateapi.GoldenSnapshotStatus.take_golden_snapshot_at:type_name -> google.protobuf.Timestamp
-	31,  // 44: ateapi.ActorTemplateStatus.golden_snapshot_status:type_name -> ateapi.GoldenSnapshotStatus
+	26,  // 31: ateapi.Tag.source_actor:type_name -> ateapi.ObjectRef
+	11,  // 32: ateapi.Atespace.metadata:type_name -> ateapi.ResourceMetadata
+	11,  // 33: ateapi.ActorTemplate.metadata:type_name -> ateapi.ResourceMetadata
+	10,  // 34: ateapi.ActorTemplate.worker_selector:type_name -> ateapi.Selector
+	35,  // 35: ateapi.ActorTemplate.containers:type_name -> ateapi.Container
+	41,  // 36: ateapi.ActorTemplate.volumes:type_name -> ateapi.Volume
+	33,  // 37: ateapi.ActorTemplate.snapshot_config:type_name -> ateapi.SnapshotConfig
+	32,  // 38: ateapi.ActorTemplate.sandbox_config:type_name -> ateapi.SandboxConfig
+	28,  // 39: ateapi.ActorTemplate.resources:type_name -> ateapi.Resources
+	31,  // 40: ateapi.ActorTemplate.status:type_name -> ateapi.ActorTemplateStatus
+	29,  // 41: ateapi.Resources.limits:type_name -> ateapi.Limits
+	26,  // 42: ateapi.GoldenSnapshotStatus.golden_tag:type_name -> ateapi.ObjectRef
+	112, // 43: ateapi.GoldenSnapshotStatus.take_golden_snapshot_at:type_name -> google.protobuf.Timestamp
+	30,  // 44: ateapi.ActorTemplateStatus.golden_snapshot_status:type_name -> ateapi.GoldenSnapshotStatus
 	3,   // 45: ateapi.SandboxConfig.sandbox_class:type_name -> ateapi.SandboxClass
 	0,   // 46: ateapi.SnapshotConfig.on_pause:type_name -> ateapi.SnapshotContentScope
 	0,   // 47: ateapi.SnapshotConfig.on_commit:type_name -> ateapi.SnapshotContentScope
-	35,  // 48: ateapi.SnapshotConfig.on_resume:type_name -> ateapi.OnResumeConfig
+	34,  // 48: ateapi.SnapshotConfig.on_resume:type_name -> ateapi.OnResumeConfig
 	4,   // 49: ateapi.OnResumeConfig.from_data:type_name -> ateapi.ResumeSource
-	39,  // 50: ateapi.Container.env:type_name -> ateapi.EnvVar
-	40,  // 51: ateapi.Container.wakeup_probe:type_name -> ateapi.ContainerWakeupProbe
-	51,  // 52: ateapi.Container.volume_mounts:type_name -> ateapi.VolumeMount
-	37,  // 53: ateapi.Container.security_context:type_name -> ateapi.SecurityContext
-	29,  // 54: ateapi.Container.resources:type_name -> ateapi.Resources
-	38,  // 55: ateapi.SecurityContext.capabilities:type_name -> ateapi.Capabilities
-	41,  // 56: ateapi.ContainerWakeupProbe.http_get:type_name -> ateapi.HTTPGetAction
-	44,  // 57: ateapi.Volume.durable_dir:type_name -> ateapi.DurableDirVolumeSource
-	45,  // 58: ateapi.Volume.external_volume_template:type_name -> ateapi.ExternalVolumeTemplate
-	46,  // 59: ateapi.Volume.system_info:type_name -> ateapi.SystemInfoVolumeSource
-	43,  // 60: ateapi.Volume.image:type_name -> ateapi.ImageVolumeSource
-	47,  // 61: ateapi.SystemInfoVolumeSource.data_sources:type_name -> ateapi.SystemInfoDataSource
-	48,  // 62: ateapi.SystemInfoDataSource.actor_metadata:type_name -> ateapi.ActorMetadataDataSource
-	50,  // 63: ateapi.SystemInfoDataSource.trust_bundle:type_name -> ateapi.TrustBundleDataSource
-	49,  // 64: ateapi.ActorMetadataDataSource.items:type_name -> ateapi.ActorMetadataItem
+	38,  // 50: ateapi.Container.env:type_name -> ateapi.EnvVar
+	39,  // 51: ateapi.Container.wakeup_probe:type_name -> ateapi.ContainerWakeupProbe
+	50,  // 52: ateapi.Container.volume_mounts:type_name -> ateapi.VolumeMount
+	36,  // 53: ateapi.Container.security_context:type_name -> ateapi.SecurityContext
+	28,  // 54: ateapi.Container.resources:type_name -> ateapi.Resources
+	37,  // 55: ateapi.SecurityContext.capabilities:type_name -> ateapi.Capabilities
+	40,  // 56: ateapi.ContainerWakeupProbe.http_get:type_name -> ateapi.HTTPGetAction
+	43,  // 57: ateapi.Volume.durable_dir:type_name -> ateapi.DurableDirVolumeSource
+	44,  // 58: ateapi.Volume.external_volume_template:type_name -> ateapi.ExternalVolumeTemplate
+	45,  // 59: ateapi.Volume.system_info:type_name -> ateapi.SystemInfoVolumeSource
+	42,  // 60: ateapi.Volume.image:type_name -> ateapi.ImageVolumeSource
+	46,  // 61: ateapi.SystemInfoVolumeSource.data_sources:type_name -> ateapi.SystemInfoDataSource
+	47,  // 62: ateapi.SystemInfoDataSource.actor_metadata:type_name -> ateapi.ActorMetadataDataSource
+	49,  // 63: ateapi.SystemInfoDataSource.trust_bundle:type_name -> ateapi.TrustBundleDataSource
+	48,  // 64: ateapi.ActorMetadataDataSource.items:type_name -> ateapi.ActorMetadataItem
 	5,   // 65: ateapi.ActorMetadataItem.field:type_name -> ateapi.ActorMetadataField
-	26,  // 66: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace
-	27,  // 67: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef
-	26,  // 68: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace
-	27,  // 69: ateapi.DeleteAtespaceRequest.atespace:type_name -> ateapi.ObjectRef
-	88,  // 70: ateapi.DeleteAtespaceRequest.options:type_name -> ateapi.DeleteOptions
-	28,  // 71: ateapi.CreateActorTemplateRequest.actor_template:type_name -> ateapi.ActorTemplate
-	27,  // 72: ateapi.GetActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef
-	28,  // 73: ateapi.ListActorTemplatesResponse.actor_templates:type_name -> ateapi.ActorTemplate
-	27,  // 74: ateapi.DeleteActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef
-	88,  // 75: ateapi.DeleteActorTemplateRequest.options:type_name -> ateapi.DeleteOptions
-	27,  // 76: ateapi.GetActorRequest.actor:type_name -> ateapi.ObjectRef
-	14,  // 77: ateapi.CreateActorRequest.actor:type_name -> ateapi.Actor
-	14,  // 78: ateapi.UpdateActorRequest.actor:type_name -> ateapi.Actor
-	27,  // 79: ateapi.SuspendActorRequest.actor:type_name -> ateapi.ObjectRef
-	14,  // 80: ateapi.SuspendActorResponse.actor:type_name -> ateapi.Actor
-	27,  // 81: ateapi.PauseActorRequest.actor:type_name -> ateapi.ObjectRef
-	14,  // 82: ateapi.PauseActorResponse.actor:type_name -> ateapi.Actor
-	27,  // 83: ateapi.ResumeActorRequest.actor:type_name -> ateapi.ObjectRef
-	14,  // 84: ateapi.ResumeActorResponse.actor:type_name -> ateapi.Actor
-	27,  // 85: ateapi.RevertActorRequest.actor:type_name -> ateapi.ObjectRef
-	14,  // 86: ateapi.RevertActorResponse.actor:type_name -> ateapi.Actor
-	27,  // 87: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef
-	88,  // 88: ateapi.DeleteActorRequest.options:type_name -> ateapi.DeleteOptions
-	27,  // 89: ateapi.GetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef
-	27,  // 90: ateapi.CreateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef
-	15,  // 91: ateapi.CreateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy
-	27,  // 92: ateapi.UpdateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef
-	15,  // 93: ateapi.UpdateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy
-	27,  // 94: ateapi.DeleteActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef
-	88,  // 95: ateapi.DeleteActorEgressPolicyRequest.options:type_name -> ateapi.DeleteOptions
-	27,  // 96: ateapi.GetTagRequest.tag:type_name -> ateapi.ObjectRef
-	27,  // 97: ateapi.MintActorJWTRequest.actor:type_name -> ateapi.ObjectRef
-	27,  // 98: ateapi.MintActorCertificateRequest.actor:type_name -> ateapi.ObjectRef
-	6,   // 99: ateapi.MintActorCertificateRequest.purpose:type_name -> ateapi.ActorCertificatePurpose
-	25,  // 100: ateapi.ListTagsResponse.tags:type_name -> ateapi.Tag
-	25,  // 101: ateapi.CreateTagRequest.tag:type_name -> ateapi.Tag
-	25,  // 102: ateapi.UpdateTagRequest.tag:type_name -> ateapi.Tag
-	27,  // 103: ateapi.DeleteTagRequest.tag:type_name -> ateapi.ObjectRef
-	88,  // 104: ateapi.DeleteTagRequest.options:type_name -> ateapi.DeleteOptions
-	27,  // 105: ateapi.ListWorkerActorAssignmentsRequest.worker:type_name -> ateapi.ObjectRef
-	103, // 106: ateapi.ListWorkerActorAssignmentsResponse.actor_assignments:type_name -> ateapi.ActorAssignment
-	100, // 107: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker
-	27,  // 108: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef
-	100, // 109: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker
-	100, // 110: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker
-	27,  // 111: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef
-	88,  // 112: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions
-	27,  // 113: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef
-	14,  // 114: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor
-	12,  // 115: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata
-	112, // 116: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry
-	101, // 117: ateapi.Worker.status:type_name -> ateapi.WorkerStatus
-	7,   // 118: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState
-	102, // 119: ateapi.WorkerStatus.capacity:type_name -> ateapi.WorkerResources
-	102, // 120: ateapi.WorkerStatus.allocated:type_name -> ateapi.WorkerResources
-	29,  // 121: ateapi.WorkerResources.resources:type_name -> ateapi.Resources
-	12,  // 122: ateapi.ActorAssignment.metadata:type_name -> ateapi.ResourceMetadata
-	27,  // 123: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef
-	27,  // 124: ateapi.ActorAssignment.actor_template_ref:type_name -> ateapi.ObjectRef
-	29,  // 125: ateapi.ActorAssignment.resources:type_name -> ateapi.Resources
-	27,  // 126: ateapi.SetWorkerCapacityRequest.worker:type_name -> ateapi.ObjectRef
-	102, // 127: ateapi.SetWorkerCapacityRequest.capacity:type_name -> ateapi.WorkerResources
-	100, // 128: ateapi.SetWorkerCapacityResponse.worker:type_name -> ateapi.Worker
-	27,  // 129: ateapi.MintAteomActorCertificateRequest.actor:type_name -> ateapi.ObjectRef
-	27,  // 130: ateapi.RequestActorSuspendRequest.worker:type_name -> ateapi.ObjectRef
-	27,  // 131: ateapi.RequestActorSuspendRequest.actor:type_name -> ateapi.ObjectRef
-	14,  // 132: ateapi.RequestActorSuspendResponse.actor:type_name -> ateapi.Actor
-	62,  // 133: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest
-	63,  // 134: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest
-	64,  // 135: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest
-	65,  // 136: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest
-	67,  // 137: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest
-	69,  // 138: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest
-	71,  // 139: ateapi.Control.RevertActor:input_type -> ateapi.RevertActorRequest
-	73,  // 140: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest
-	74,  // 141: ateapi.Control.GetActorEgressPolicy:input_type -> ateapi.GetActorEgressPolicyRequest
-	75,  // 142: ateapi.Control.CreateActorEgressPolicy:input_type -> ateapi.CreateActorEgressPolicyRequest
-	76,  // 143: ateapi.Control.UpdateActorEgressPolicy:input_type -> ateapi.UpdateActorEgressPolicyRequest
-	77,  // 144: ateapi.Control.DeleteActorEgressPolicy:input_type -> ateapi.DeleteActorEgressPolicyRequest
-	79,  // 145: ateapi.Control.MintActorJWT:input_type -> ateapi.MintActorJWTRequest
-	81,  // 146: ateapi.Control.MintActorCertificate:input_type -> ateapi.MintActorCertificateRequest
-	85,  // 147: ateapi.Control.CreateTag:input_type -> ateapi.CreateTagRequest
-	78,  // 148: ateapi.Control.GetTag:input_type -> ateapi.GetTagRequest
-	83,  // 149: ateapi.Control.ListTags:input_type -> ateapi.ListTagsRequest
-	86,  // 150: ateapi.Control.UpdateTag:input_type -> ateapi.UpdateTagRequest
-	87,  // 151: ateapi.Control.DeleteTag:input_type -> ateapi.DeleteTagRequest
-	91,  // 152: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest
-	93,  // 153: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest
-	94,  // 154: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest
-	95,  // 155: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest
-	96,  // 156: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest
-	97,  // 157: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest
-	89,  // 158: ateapi.Control.ListWorkerActorAssignments:input_type -> ateapi.ListWorkerActorAssignmentsRequest
-	98,  // 159: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest
-	52,  // 160: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest
-	53,  // 161: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest
-	54,  // 162: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest
-	56,  // 163: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest
-	57,  // 164: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest
-	58,  // 165: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest
-	59,  // 166: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest
-	61,  // 167: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest
-	104, // 168: ateapi.WorkerService.SetWorkerCapacity:input_type -> ateapi.SetWorkerCapacityRequest
-	106, // 169: ateapi.WorkerService.MintAteomActorCertificate:input_type -> ateapi.MintAteomActorCertificateRequest
-	108, // 170: ateapi.WorkerService.RequestActorSuspend:input_type -> ateapi.RequestActorSuspendRequest
-	14,  // 171: ateapi.Control.GetActor:output_type -> ateapi.Actor
-	14,  // 172: ateapi.Control.CreateActor:output_type -> ateapi.Actor
-	14,  // 173: ateapi.Control.UpdateActor:output_type -> ateapi.Actor
-	66,  // 174: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse
-	68,  // 175: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse
-	70,  // 176: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse
-	72,  // 177: ateapi.Control.RevertActor:output_type -> ateapi.RevertActorResponse
-	14,  // 178: ateapi.Control.DeleteActor:output_type -> ateapi.Actor
-	15,  // 179: ateapi.Control.GetActorEgressPolicy:output_type -> ateapi.EgressPolicy
-	15,  // 180: ateapi.Control.CreateActorEgressPolicy:output_type -> ateapi.EgressPolicy
-	15,  // 181: ateapi.Control.UpdateActorEgressPolicy:output_type -> ateapi.EgressPolicy
-	15,  // 182: ateapi.Control.DeleteActorEgressPolicy:output_type -> ateapi.EgressPolicy
-	80,  // 183: ateapi.Control.MintActorJWT:output_type -> ateapi.MintActorJWTResponse
-	82,  // 184: ateapi.Control.MintActorCertificate:output_type -> ateapi.MintActorCertificateResponse
-	25,  // 185: ateapi.Control.CreateTag:output_type -> ateapi.Tag
-	25,  // 186: ateapi.Control.GetTag:output_type -> ateapi.Tag
-	84,  // 187: ateapi.Control.ListTags:output_type -> ateapi.ListTagsResponse
-	25,  // 188: ateapi.Control.UpdateTag:output_type -> ateapi.Tag
-	25,  // 189: ateapi.Control.DeleteTag:output_type -> ateapi.Tag
-	92,  // 190: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse
-	100, // 191: ateapi.Control.GetWorker:output_type -> ateapi.Worker
-	100, // 192: ateapi.Control.CreateWorker:output_type -> ateapi.Worker
-	100, // 193: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker
-	100, // 194: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker
-	100, // 195: ateapi.Control.DrainWorker:output_type -> ateapi.Worker
-	90,  // 196: ateapi.Control.ListWorkerActorAssignments:output_type -> ateapi.ListWorkerActorAssignmentsResponse
-	99,  // 197: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse
-	26,  // 198: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace
-	26,  // 199: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace
-	55,  // 200: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse
-	26,  // 201: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace
-	28,  // 202: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate
-	28,  // 203: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate
-	60,  // 204: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse
-	28,  // 205: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate
-	105, // 206: ateapi.WorkerService.SetWorkerCapacity:output_type -> ateapi.SetWorkerCapacityResponse
-	107, // 207: ateapi.WorkerService.MintAteomActorCertificate:output_type -> ateapi.MintAteomActorCertificateResponse
-	109, // 208: ateapi.WorkerService.RequestActorSuspend:output_type -> ateapi.RequestActorSuspendResponse
-	171, // [171:209] is the sub-list for method output_type
-	133, // [133:171] is the sub-list for method input_type
-	133, // [133:133] is the sub-list for extension type_name
-	133, // [133:133] is the sub-list for extension extendee
-	0,   // [0:133] is the sub-list for field type_name
+	25,  // 66: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace
+	26,  // 67: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef
+	25,  // 68: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace
+	26,  // 69: ateapi.DeleteAtespaceRequest.atespace:type_name -> ateapi.ObjectRef
+	87,  // 70: ateapi.DeleteAtespaceRequest.options:type_name -> ateapi.DeleteOptions
+	27,  // 71: ateapi.CreateActorTemplateRequest.actor_template:type_name -> ateapi.ActorTemplate
+	26,  // 72: ateapi.GetActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef
+	27,  // 73: ateapi.ListActorTemplatesResponse.actor_templates:type_name -> ateapi.ActorTemplate
+	26,  // 74: ateapi.DeleteActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef
+	87,  // 75: ateapi.DeleteActorTemplateRequest.options:type_name -> ateapi.DeleteOptions
+	26,  // 76: ateapi.GetActorRequest.actor:type_name -> ateapi.ObjectRef
+	13,  // 77: ateapi.CreateActorRequest.actor:type_name -> ateapi.Actor
+	13,  // 78: ateapi.UpdateActorRequest.actor:type_name -> ateapi.Actor
+	26,  // 79: ateapi.SuspendActorRequest.actor:type_name -> ateapi.ObjectRef
+	13,  // 80: ateapi.SuspendActorResponse.actor:type_name -> ateapi.Actor
+	26,  // 81: ateapi.PauseActorRequest.actor:type_name -> ateapi.ObjectRef
+	13,  // 82: ateapi.PauseActorResponse.actor:type_name -> ateapi.Actor
+	26,  // 83: ateapi.ResumeActorRequest.actor:type_name -> ateapi.ObjectRef
+	13,  // 84: ateapi.ResumeActorResponse.actor:type_name -> ateapi.Actor
+	26,  // 85: ateapi.RevertActorRequest.actor:type_name -> ateapi.ObjectRef
+	13,  // 86: ateapi.RevertActorResponse.actor:type_name -> ateapi.Actor
+	26,  // 87: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef
+	87,  // 88: ateapi.DeleteActorRequest.options:type_name -> ateapi.DeleteOptions
+	26,  // 89: ateapi.GetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef
+	26,  // 90: ateapi.CreateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef
+	14,  // 91: ateapi.CreateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy
+	26,  // 92: ateapi.UpdateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef
+	14,  // 93: ateapi.UpdateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy
+	26,  // 94: ateapi.DeleteActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef
+	87,  // 95: ateapi.DeleteActorEgressPolicyRequest.options:type_name -> ateapi.DeleteOptions
+	26,  // 96: ateapi.GetTagRequest.tag:type_name -> ateapi.ObjectRef
+	26,  // 97: ateapi.MintActorJWTRequest.actor:type_name -> ateapi.ObjectRef
+	26,  // 98: ateapi.MintActorCertificateRequest.actor:type_name -> ateapi.ObjectRef
+	24,  // 99: ateapi.ListTagsResponse.tags:type_name -> ateapi.Tag
+	24,  // 100: ateapi.CreateTagRequest.tag:type_name -> ateapi.Tag
+	24,  // 101: ateapi.UpdateTagRequest.tag:type_name -> ateapi.Tag
+	26,  // 102: ateapi.DeleteTagRequest.tag:type_name -> ateapi.ObjectRef
+	87,  // 103: ateapi.DeleteTagRequest.options:type_name -> ateapi.DeleteOptions
+	26,  // 104: ateapi.ListWorkerActorAssignmentsRequest.worker:type_name -> ateapi.ObjectRef
+	102, // 105: ateapi.ListWorkerActorAssignmentsResponse.actor_assignments:type_name -> ateapi.ActorAssignment
+	99,  // 106: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker
+	26,  // 107: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef
+	99,  // 108: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker
+	99,  // 109: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker
+	26,  // 110: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef
+	87,  // 111: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions
+	26,  // 112: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef
+	13,  // 113: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor
+	11,  // 114: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata
+	111, // 115: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry
+	100, // 116: ateapi.Worker.status:type_name -> ateapi.WorkerStatus
+	6,   // 117: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState
+	101, // 118: ateapi.WorkerStatus.capacity:type_name -> ateapi.WorkerResources
+	101, // 119: ateapi.WorkerStatus.allocated:type_name -> ateapi.WorkerResources
+	28,  // 120: ateapi.WorkerResources.resources:type_name -> ateapi.Resources
+	11,  // 121: ateapi.ActorAssignment.metadata:type_name -> ateapi.ResourceMetadata
+	26,  // 122: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef
+	26,  // 123: ateapi.ActorAssignment.actor_template_ref:type_name -> ateapi.ObjectRef
+	28,  // 124: ateapi.ActorAssignment.resources:type_name -> ateapi.Resources
+	26,  // 125: ateapi.SetWorkerCapacityRequest.worker:type_name -> ateapi.ObjectRef
+	101, // 126: ateapi.SetWorkerCapacityRequest.capacity:type_name -> ateapi.WorkerResources
+	99,  // 127: ateapi.SetWorkerCapacityResponse.worker:type_name -> ateapi.Worker
+	26,  // 128: ateapi.MintAteomActorCertificateRequest.actor:type_name -> ateapi.ObjectRef
+	26,  // 129: ateapi.RequestActorSuspendRequest.worker:type_name -> ateapi.ObjectRef
+	26,  // 130: ateapi.RequestActorSuspendRequest.actor:type_name -> ateapi.ObjectRef
+	13,  // 131: ateapi.RequestActorSuspendResponse.actor:type_name -> ateapi.Actor
+	61,  // 132: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest
+	62,  // 133: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest
+	63,  // 134: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest
+	64,  // 135: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest
+	66,  // 136: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest
+	68,  // 137: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest
+	70,  // 138: ateapi.Control.RevertActor:input_type -> ateapi.RevertActorRequest
+	72,  // 139: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest
+	73,  // 140: ateapi.Control.GetActorEgressPolicy:input_type -> ateapi.GetActorEgressPolicyRequest
+	74,  // 141: ateapi.Control.CreateActorEgressPolicy:input_type -> ateapi.CreateActorEgressPolicyRequest
+	75,  // 142: ateapi.Control.UpdateActorEgressPolicy:input_type -> ateapi.UpdateActorEgressPolicyRequest
+	76,  // 143: ateapi.Control.DeleteActorEgressPolicy:input_type -> ateapi.DeleteActorEgressPolicyRequest
+	78,  // 144: ateapi.Control.MintActorJWT:input_type -> ateapi.MintActorJWTRequest
+	80,  // 145: ateapi.Control.MintActorCertificate:input_type -> ateapi.MintActorCertificateRequest
+	84,  // 146: ateapi.Control.CreateTag:input_type -> ateapi.CreateTagRequest
+	77,  // 147: ateapi.Control.GetTag:input_type -> ateapi.GetTagRequest
+	82,  // 148: ateapi.Control.ListTags:input_type -> ateapi.ListTagsRequest
+	85,  // 149: ateapi.Control.UpdateTag:input_type -> ateapi.UpdateTagRequest
+	86,  // 150: ateapi.Control.DeleteTag:input_type -> ateapi.DeleteTagRequest
+	90,  // 151: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest
+	92,  // 152: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest
+	93,  // 153: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest
+	94,  // 154: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest
+	95,  // 155: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest
+	96,  // 156: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest
+	88,  // 157: ateapi.Control.ListWorkerActorAssignments:input_type -> ateapi.ListWorkerActorAssignmentsRequest
+	97,  // 158: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest
+	51,  // 159: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest
+	52,  // 160: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest
+	53,  // 161: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest
+	55,  // 162: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest
+	56,  // 163: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest
+	57,  // 164: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest
+	58,  // 165: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest
+	60,  // 166: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest
+	103, // 167: ateapi.WorkerService.SetWorkerCapacity:input_type -> ateapi.SetWorkerCapacityRequest
+	105, // 168: ateapi.WorkerService.MintAteomActorCertificate:input_type -> ateapi.MintAteomActorCertificateRequest
+	107, // 169: ateapi.WorkerService.RequestActorSuspend:input_type -> ateapi.RequestActorSuspendRequest
+	13,  // 170: ateapi.Control.GetActor:output_type -> ateapi.Actor
+	13,  // 171: ateapi.Control.CreateActor:output_type -> ateapi.Actor
+	13,  // 172: ateapi.Control.UpdateActor:output_type -> ateapi.Actor
+	65,  // 173: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse
+	67,  // 174: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse
+	69,  // 175: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse
+	71,  // 176: ateapi.Control.RevertActor:output_type -> ateapi.RevertActorResponse
+	13,  // 177: ateapi.Control.DeleteActor:output_type -> ateapi.Actor
+	14,  // 178: ateapi.Control.GetActorEgressPolicy:output_type -> ateapi.EgressPolicy
+	14,  // 179: ateapi.Control.CreateActorEgressPolicy:output_type -> ateapi.EgressPolicy
+	14,  // 180: ateapi.Control.UpdateActorEgressPolicy:output_type -> ateapi.EgressPolicy
+	14,  // 181: ateapi.Control.DeleteActorEgressPolicy:output_type -> ateapi.EgressPolicy
+	79,  // 182: ateapi.Control.MintActorJWT:output_type -> ateapi.MintActorJWTResponse
+	81,  // 183: ateapi.Control.MintActorCertificate:output_type -> ateapi.MintActorCertificateResponse
+	24,  // 184: ateapi.Control.CreateTag:output_type -> ateapi.Tag
+	24,  // 185: ateapi.Control.GetTag:output_type -> ateapi.Tag
+	83,  // 186: ateapi.Control.ListTags:output_type -> ateapi.ListTagsResponse
+	24,  // 187: ateapi.Control.UpdateTag:output_type -> ateapi.Tag
+	24,  // 188: ateapi.Control.DeleteTag:output_type -> ateapi.Tag
+	91,  // 189: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse
+	99,  // 190: ateapi.Control.GetWorker:output_type -> ateapi.Worker
+	99,  // 191: ateapi.Control.CreateWorker:output_type -> ateapi.Worker
+	99,  // 192: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker
+	99,  // 193: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker
+	99,  // 194: ateapi.Control.DrainWorker:output_type -> ateapi.Worker
+	89,  // 195: ateapi.Control.ListWorkerActorAssignments:output_type -> ateapi.ListWorkerActorAssignmentsResponse
+	98,  // 196: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse
+	25,  // 197: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace
+	25,  // 198: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace
+	54,  // 199: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse
+	25,  // 200: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace
+	27,  // 201: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate
+	27,  // 202: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate
+	59,  // 203: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse
+	27,  // 204: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate
+	104, // 205: ateapi.WorkerService.SetWorkerCapacity:output_type -> ateapi.SetWorkerCapacityResponse
+	106, // 206: ateapi.WorkerService.MintAteomActorCertificate:output_type -> ateapi.MintAteomActorCertificateResponse
+	108, // 207: ateapi.WorkerService.RequestActorSuspend:output_type -> ateapi.RequestActorSuspendResponse
+	170, // [170:208] is the sub-list for method output_type
+	132, // [132:170] is the sub-list for method input_type
+	132, // [132:132] is the sub-list for extension type_name
+	132, // [132:132] is the sub-list for extension extendee
+	0,   // [0:132] is the sub-list for field type_name
 }
 
 func init() { file_ateapi_proto_init() }
@@ -8058,7 +7987,7 @@ func file_ateapi_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_ateapi_proto_rawDesc), len(file_ateapi_proto_rawDesc)),
-			NumEnums:      9,
+			NumEnums:      8,
 			NumMessages:   104,
 			NumExtensions: 0,
 			NumServices:   2,

pkg/proto/ateapipb/ateapi.proto

@@ -70,9 +70,8 @@ service Control {
 
   // Create a Substrate-issued SPIFFE certificate asserting the actor identity.
   //
-  // * Called by atelet to provision an atunnel with a certificate for
-  //   communication with the egress gateway.  TODO(identity): Migrate this use
-  //   case to a distinct certificate to prevent actor/atunnel confusion.
+  // SPIFFE URI: spiffe://${trustdomain}/actor/${atespace}/${actor}
+  //
   // * Called by the egress gateway when actor client certificate injection is
   //   configured for outbound requests.
   rpc MintActorCertificate(MintActorCertificateRequest) returns (MintActorCertificateResponse) {}
@@ -1616,24 +1615,8 @@ message MintActorCertificateRequest {
   // +k8s:maxBytes=16384
   bytes certificate_signing_request = 2;
 
-  // Purpose of the certificate.  Used to distinguish between system components
-  // acting on behalf of an actor, and the actor itself taking action.
-  //
-  // +k8s:required
-  // +k8s:minimum=1
-  // +k8s:maximum=1 # keep this in sync with the ActorCertificatePurpose enum
-  ActorCertificatePurpose purpose = 4;
-}
-
-// Purpose of the certificate.  Used to distinguish between system components
-// acting on behalf of an actor, and the actor itself taking action.
-//
-// TODO(identity): This should be removed once ateom/atunnel certs are separated
-// from plain actor certs.
-enum ActorCertificatePurpose {
-  ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED = 0;
-  ACTOR_CERTIFICATE_PURPOSE_ATUNNEL = 1;
-  // Keep this in sync with MintCertRequest.purpose's maximum.
+  reserved 4;
+  reserved "purpose";
 }
 
 // Response message for MintActorCertificate.

pkg/proto/ateapipb/ateapi_grpc.pb.go

@@ -110,9 +110,8 @@ type ControlClient interface {
 	MintActorJWT(ctx context.Context, in *MintActorJWTRequest, opts ...grpc.CallOption) (*MintActorJWTResponse, error)
 	// Create a Substrate-issued SPIFFE certificate asserting the actor identity.
 	//
-	// * Called by atelet to provision an atunnel with a certificate for
-	//   communication with the egress gateway.  TODO(identity): Migrate this use
-	//   case to a distinct certificate to prevent actor/atunnel confusion.
+	// SPIFFE URI: spiffe://${trustdomain}/actor/${atespace}/${actor}
+	//
 	// * Called by the egress gateway when actor client certificate injection is
 	//   configured for outbound requests.
 	MintActorCertificate(ctx context.Context, in *MintActorCertificateRequest, opts ...grpc.CallOption) (*MintActorCertificateResponse, error)
@@ -564,9 +563,8 @@ type ControlServer interface {
 	MintActorJWT(context.Context, *MintActorJWTRequest) (*MintActorJWTResponse, error)
 	// Create a Substrate-issued SPIFFE certificate asserting the actor identity.
 	//
-	// * Called by atelet to provision an atunnel with a certificate for
-	//   communication with the egress gateway.  TODO(identity): Migrate this use
-	//   case to a distinct certificate to prevent actor/atunnel confusion.
+	// SPIFFE URI: spiffe://${trustdomain}/actor/${atespace}/${actor}
+	//
 	// * Called by the egress gateway when actor client certificate injection is
 	//   configured for outbound requests.
 	MintActorCertificate(context.Context, *MintActorCertificateRequest) (*MintActorCertificateResponse, error)