ateapipb

type AccessPolicy struct {

	// Standard resource metadata. Atespace must match the parent resource (empty
	// for global-scoped parents like Global and Atespace) and name must be
	// "default". Both are caller-specified on create and immutable. UID, version,
	// create_time, and update_time are server-managed.
	//
	// +k8s:required
	// +k8s:customValidation # name must be "default"
	Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// Role bindings granting permissions on the parent resource.
	//
	// +k8s:optional
	// +k8s:listType=atomic
	// +k8s:maxItems=100
	Bindings []*Binding `protobuf:"bytes,2,rep,name=bindings,proto3" json:"bindings,omitempty"`
	// contains filtered or unexported fields
}

type Actor struct {

	// Common resource metadata: atespace, name, uid, version, timestamps.
	//
	// +k8s:required
	// +k8s:subfield(atespace)=+k8s:required
	Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// TODO: replace with full actor_template spec if we decide to make each Actor self-contained.
	// +k8s:required
	// +k8s:subfield(atespace)=+k8s:required
	// +k8s:mutable
	ActorTemplate *ObjectRef `protobuf:"bytes,4,opt,name=actor_template,json=actorTemplate,proto3" json:"actor_template,omitempty"`
	// worker_selector is the per-actor placement constraint. The scheduler
	// evaluates the AND of this selector and the template's workerSelector to
	// find eligible pools.
	// Changes take effect on the next ResumeActor call.
	//
	// +k8s:optional
	WorkerSelector *Selector `protobuf:"bytes,5,opt,name=worker_selector,json=workerSelector,proto3" json:"worker_selector,omitempty"`
	// The tag specified by the caller at CreateActor to seed this Actor from an
	// ActorSnapshot. Unset if the Actor was not created from a snapshot. Set
	// once at creation and immutable afterward.
	//
	// +k8s:optional
	// +k8s:subfield(atespace)=+k8s:required
	// +k8s:immutable
	SourceTag *ObjectRef `protobuf:"bytes,6,opt,name=source_tag,json=sourceTag,proto3" json:"source_tag,omitempty"`
	// status is the system-managed state of the Actor. It is updated by the
	// server and ignored on input. It is always present in output.
	//
	// +k8s:optional
	Status *ActorStatus `protobuf:"bytes,7,opt,name=status,proto3" json:"status,omitempty"`
	// contains filtered or unexported fields
}

type ActorAssignment struct {

	// Metadata about the assignment.
	//
	// The atespace field is always empty, since it corresponds to a Worker, and
	// Workers are not atespaced. The name field is the Actor's UID, so the Actor
	// that caused an assignment is what addresses it.
	//
	// +k8s:required
	// +k8s:beta(since: "0.0")=+k8s:subfield(atespace)=+k8s:forbidden # TODO: get rid of beta prefix
	Metadata *ResourceMetadata `protobuf:"bytes,6,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// actor is the Actor that is assigned to the Worker.
	//
	// +k8s:required
	// +k8s:subfield(atespace)=+k8s:required
	Actor *ObjectRef `protobuf:"bytes,2,opt,name=actor,proto3" json:"actor,omitempty"`
	// +k8s:required
	// +k8s:format=k8s-uuid
	ActorUid string `protobuf:"bytes,3,opt,name=actor_uid,json=actorUid,proto3" json:"actor_uid,omitempty"`
	// The resources allocated to the Actor when it was assigned.
	//
	// +k8s:optional
	Resources *Resources `protobuf:"bytes,5,opt,name=resources,proto3" json:"resources,omitempty"`
	// worker_epoch is the Worker's epoch when the Actor was bound.
	//
	// +k8s:optional
	// +k8s:minimum=0
	WorkerEpoch int64 `protobuf:"varint,7,opt,name=worker_epoch,json=workerEpoch,proto3" json:"worker_epoch,omitempty"`
	// contains filtered or unexported fields
}

type ActorCrash struct {

	// message is a human-readable description of the failure.
	//
	// +k8s:optional
	// +k8s:maxLength=4096
	Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
	// crash_time is when the Actor entered CRASHED.
	//
	// +k8s:optional
	CrashTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=crash_time,json=crashTime,proto3" json:"crash_time,omitempty"`
	// contains filtered or unexported fields
}

type ActorJwtSource struct {

	// The audiences the JWT is bound to, which become its aud claim.
	//
	// +k8s:required
	// +k8s:maxItems=16
	// +k8s:listType=set
	// +k8s:eachVal=+k8s:minLength=1
	// +k8s:eachVal=+k8s:maxLength=512
	Audiences []string `protobuf:"bytes,1,rep,name=audiences,proto3" json:"audiences,omitempty"`
	// Lifetime of each JWT, in seconds.
	//
	// +k8s:required
	// +k8s:minimum=300
	// +k8s:maximum=3600
	ExpirationSeconds int64 `protobuf:"varint,2,opt,name=expiration_seconds,json=expirationSeconds,proto3" json:"expiration_seconds,omitempty"`
	// contains filtered or unexported fields
}

type ActorMetadataDataSource struct {

	// items must not project the same field twice, and item paths must be
	// unique.
	//
	// +k8s:required
	// +k8s:minItems=1
	// +k8s:maxItems=8
	// +k8s:listType=atomic
	// +k8s:unique=map
	// +k8s:listMapKey=field
	Items []*ActorMetadataItem `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	// contains filtered or unexported fields
}

type ActorMetadataField int32

type ActorMetadataItem struct {

	// +k8s:required
	// +k8s:minimum=1
	// +k8s:maximum=3 # keep this in sync with the ActorMetadataField enum
	Field ActorMetadataField `protobuf:"varint,1,opt,name=field,proto3,enum=ateapi.ActorMetadataField" json:"field,omitempty"`
	// path must be a clean relative Unix path: at most 16 '/'-separated
	// segments, none of them empty, '.' or '..', and no NUL byte.
	//
	// +k8s:required
	// +k8s:minLength=1
	// +k8s:maxLength=255
	// +k8s:customValidation # projected-path rule shared with atelet, see internal/volumepath
	Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
	// contains filtered or unexported fields
}

type ActorSnapshotState struct {

	// The snapshot atelet restores the Actor from locally. Unset once a detach
	// has made the snapshot durable and begun deleting it; latest_durable is
	// then the Actor's latest snapshot.
	//
	// +k8s:optional
	LatestLocal *SnapshotReport `protobuf:"bytes,1,opt,name=latest_local,json=latestLocal,proto3" json:"latest_local,omitempty"`
	// The snapshot an in-flight upload is reading, if any.
	//
	// +k8s:optional
	Uploading *SnapshotReport `protobuf:"bytes,2,opt,name=uploading,proto3" json:"uploading,omitempty"`
	// The newest snapshot atelet knows is durable, whether or not the control
	// plane has recorded it. Unset says nothing about older durable snapshots.
	//
	// +k8s:optional
	LatestDurable *SnapshotReport `protobuf:"bytes,3,opt,name=latest_durable,json=latestDurable,proto3" json:"latest_durable,omitempty"`
	// When atelet next plans to upload latest_local. Advisory: a promote or
	// detach can upload it sooner.
	//
	// +k8s:optional
	UploadDueTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=upload_due_time,json=uploadDueTime,proto3" json:"upload_due_time,omitempty"`
	// contains filtered or unexported fields
}

type ActorState int32

type ActorStatus struct {

	// state is the Actor's current lifecycle state.
	//
	// +k8s:required
	// +k8s:minimum=1
	// +k8s:maximum=9 # keep this in sync with the ActorState enum
	State ActorState `protobuf:"varint,1,opt,name=state,proto3,enum=ateapi.ActorState" json:"state,omitempty"`
	// worker_assignment points at the worker currently hosting this Actor.
	// Unset whenever the Actor has no worker (SUSPENDED, CRASHED).
	//
	// +k8s:optional
	// +k8s:update=NoModify # can be set and cleared, but not changed in place
	WorkerAssignment *WorkerAssignment `protobuf:"bytes,2,opt,name=worker_assignment,json=workerAssignment,proto3" json:"worker_assignment,omitempty"`
	// Volumes attached to the actor. These volumes only live as long as the actor.
	// They are deleted when the actor is deleted. Each template volume
	// appears at most once.
	//
	// +k8s:optional
	// +k8s:maxItems=32 # matches the template's volumes bound
	// +k8s:listType=map
	// +k8s:listMapKey=name
	ExternalVolumes []*ExternalVolume `protobuf:"bytes,7,rep,name=external_volumes,json=externalVolumes,proto3" json:"external_volumes,omitempty"`
	// crash records why and when the Actor entered CRASHED. It is set with the
	// CRASHED state and cleared when a revert returns the Actor to SUSPENDED.
	//
	// +k8s:optional
	Crash *ActorCrash `protobuf:"bytes,9,opt,name=crash,proto3" json:"crash,omitempty"`
	// assigned_node is the Kubernetes node the Actor is currently attached to
	// (hosting its active worker or its node-local snapshots). Unset when the
	// Actor is detached from any node.
	//
	// +k8s:optional
	// +k8s:format=k8s-long-name
	AssignedNode string `protobuf:"bytes,10,opt,name=assigned_node,json=assignedNode,proto3" json:"assigned_node,omitempty"`
	// snapshots holds the Actor's active and in-progress snapshot generations.
	//
	// +k8s:optional
	// +k8s:maxItems=16
	// +k8s:listType=atomic
	// +k8s:unique=map
	// +k8s:listMapKey=generation
	Snapshots []*Snapshot `protobuf:"bytes,11,rep,name=snapshots,proto3" json:"snapshots,omitempty"`
	// last_assigned_generation tracks the last snapshot generation assigned for
	// this Actor during a Suspend or Pause request.
	// Even during Revert, the generation is not decreased to keep track of snapshots
	// that have become stale and need to be cleaned up.
	//
	// +k8s:optional
	// +k8s:alpha(since: "0.0")=+k8s:monotonic # TODO: get rid of alpha prefix
	// +k8s:minimum=0
	// +k8s:update=NoUnset
	LastAssignedGeneration int32 `` /* 131-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ActorTemplate struct {

	// Common resource metadata: atespace, name, uid, version, timestamps.
	//
	// +k8s:required
	// +k8s:subfield(atespace)=+k8s:required
	Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// worker_selector restricts which worker pools actors from this template
	// may use.
	//
	// +k8s:optional
	WorkerSelector *Selector `protobuf:"bytes,2,opt,name=worker_selector,json=workerSelector,proto3" json:"worker_selector,omitempty"`
	// +k8s:required # at least one container
	// +k8s:maxItems=10
	// +k8s:listType=map
	// +k8s:listMapKey=name
	Containers []*Container `protobuf:"bytes,3,rep,name=containers,proto3" json:"containers,omitempty"`
	// +k8s:optional
	// +k8s:maxItems=32
	// +k8s:listType=map
	// +k8s:listMapKey=name
	Volumes []*Volume `protobuf:"bytes,4,rep,name=volumes,proto3" json:"volumes,omitempty"`
	// +k8s:required
	SnapshotConfig *SnapshotConfig `protobuf:"bytes,5,opt,name=snapshot_config,json=snapshotConfig,proto3" json:"snapshot_config,omitempty"`
	// sandbox_config selects the sandbox runtime this version's actors run on.
	//
	// +k8s:required
	SandboxConfig *SandboxConfig `protobuf:"bytes,6,opt,name=sandbox_config,json=sandboxConfig,proto3" json:"sandbox_config,omitempty"`
	// Resource usage configuration.
	//
	// +k8s:optional
	Resources *Resources `protobuf:"bytes,7,opt,name=resources,proto3" json:"resources,omitempty"`
	// +k8s:optional
	Status *ActorTemplateStatus `protobuf:"bytes,8,opt,name=status,proto3" json:"status,omitempty"`
	// contains filtered or unexported fields
}

type ActorTemplateStatus struct {

	// +k8s:optional
	GoldenSnapshotStatus *GoldenSnapshotStatus `protobuf:"bytes,1,opt,name=golden_snapshot_status,json=goldenSnapshotStatus,proto3" json:"golden_snapshot_status,omitempty"`
	// contains filtered or unexported fields
}

type AllPorts struct {
	// contains filtered or unexported fields
}

type Atespace struct {

	// Common resource metadata: name, uid, version, timestamps.
	//
	// +k8s:required
	// +k8s:beta(since: "0.0")=+k8s:subfield(atespace)=+k8s:forbidden # TODO: get rid of beta prefix
	Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// contains filtered or unexported fields
}

type AttributeEntry struct {

	// Attribute name (e.g. "architecture", "cpu_features", "gvisor_asset_hash").
	//
	// +k8s:required
	// +k8s:maxLength=128
	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	// Attribute value corresponding to key.
	//
	// +k8s:required
	// +k8s:maxLength=256
	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
	// contains filtered or unexported fields
}

type Binding struct {

	// The role name for the parent resource type (e.g., "owner", "editor",
	// "viewer").
	//
	// +k8s:required
	// +k8s:maxLength=64
	Role string `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
	// Principal identities granted this role.
	// Examples:
	//   - "user:alice@example.com"
	//   - "user:sa-ci-runner"
	//
	// +k8s:required
	// +k8s:listType=set
	// +k8s:maxItems=1500
	// +k8s:eachVal=+k8s:maxLength=512
	Members []string `protobuf:"bytes,2,rep,name=members,proto3" json:"members,omitempty"`
	// contains filtered or unexported fields
}

type Capabilities struct {

	// add lists capabilities to grant on top of the default set. "ALL" is
	// rejected: name the individual capabilities the container needs.
	//
	// +k8s:optional
	// +k8s:maxItems=64
	// +k8s:listType=set
	// +k8s:customValidation # capability grammar; "ALL" not accepted
	Add []string `protobuf:"bytes,1,rep,name=add,proto3" json:"add,omitempty"`
	// drop lists capabilities to remove from the default set. "ALL" drops the
	// whole set, so drop+add expresses an exact set rather than a relative one.
	//
	// +k8s:optional
	// +k8s:maxItems=64
	// +k8s:listType=set
	// +k8s:customValidation # capability grammar
	Drop []string `protobuf:"bytes,2,rep,name=drop,proto3" json:"drop,omitempty"`
	// contains filtered or unexported fields
}

type Container struct {

	// +k8s:required
	// +k8s:format=k8s-short-name
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// image is the OCI image reference the container runs:
	// [registry/]repository[:tag]@digest. Must be pinned by digest
	// (e.g. "name@sha256:...").
	//
	// +k8s:required
	// +k8s:maxLength=512 # matches ImageVolumeSource.reference's bound
	// +k8s:customValidation # must be a well-formed image reference, pinned by digest
	Image string `protobuf:"bytes,2,opt,name=image,proto3" json:"image,omitempty"`
	// Entrypoint array; when set, the image's ENTRYPOINT and CMD are both
	// ignored and the process argv is command + args. Unlike Kubernetes,
	// $(VAR_NAME) references are NOT expanded.
	//
	// +k8s:optional
	// +k8s:maxItems=64
	// +k8s:listType=atomic
	// +k8s:eachVal=+k8s:maxLength=4096 # argv strings; guardrail, not a contract
	Command []string `protobuf:"bytes,3,rep,name=command,proto3" json:"command,omitempty"`
	// Arguments to the entrypoint; the image's CMD is used if unset (unless
	// command is set, which discards the image's CMD).
	//
	// +k8s:optional
	// +k8s:maxItems=64
	// +k8s:listType=atomic
	// +k8s:eachVal=+k8s:maxLength=4096 # argv strings; guardrail, not a contract
	Args []string `protobuf:"bytes,4,rep,name=args,proto3" json:"args,omitempty"`
	// Env variables to set in the container's process environment. Unlike
	// Kubernetes, $(VAR_NAME) references are NOT expanded in this field.
	//
	// +k8s:optional
	// +k8s:maxItems=32
	// +k8s:listType=map # each variable is set at most once
	// +k8s:listMapKey=name
	Env []*EnvVar `protobuf:"bytes,5,rep,name=env,proto3" json:"env,omitempty"`
	// wakeup_probe gates each wakeup on this container: ResumeActor returns
	// only after the probe answers HTTP 200. Without it, ResumeActor returns
	// as soon as the container has started, which may be before it listens.
	//
	// +k8s:optional
	WakeupProbe *WakeupProbe `protobuf:"bytes,6,opt,name=wakeup_probe,json=wakeupProbe,proto3" json:"wakeup_probe,omitempty"`
	// Keyed by mount_path: each path hosts exactly one mount, while a volume
	// may be mounted at multiple paths.
	//
	// +k8s:optional
	// +k8s:maxItems=32
	// +k8s:listType=map
	// +k8s:listMapKey=mount_path
	// +k8s:customValidation # mounts must not nest
	VolumeMounts []*VolumeMount `protobuf:"bytes,7,rep,name=volume_mounts,json=volumeMounts,proto3" json:"volume_mounts,omitempty"`
	// security_context adjusts the container's security settings. Unset leaves
	// the default capability set.
	//
	// +k8s:optional
	SecurityContext *SecurityContext `protobuf:"bytes,8,opt,name=security_context,json=securityContext,proto3" json:"security_context,omitempty"`
	// resources carries this container's compute limits, enforced inside the
	// actor's sandbox. Only cpu and memory limits are supported.
	//
	// +k8s:optional
	Resources *Resources `protobuf:"bytes,9,opt,name=resources,proto3" json:"resources,omitempty"`
	// contains filtered or unexported fields
}

type ControlClient interface {
	// Get an Actor.
	GetActor(ctx context.Context, in *GetActorRequest, opts ...grpc.CallOption) (*Actor, error)
	// Create a new Actor deriving from a given ActorTemplate.
	CreateActor(ctx context.Context, in *CreateActorRequest, opts ...grpc.CallOption) (*Actor, error)
	// Update mutable fields on an existing Actor.
	UpdateActor(ctx context.Context, in *UpdateActorRequest, opts ...grpc.CallOption) (*Actor, error)
	// Suspend a given actor to a new snapshot. A running actor is checkpointed
	// on its worker; a paused actor's node-local snapshot is uploaded, narrowed
	// to the template's commit scope where required (Full capture, Data commit).
	SuspendActor(ctx context.Context, in *SuspendActorRequest, opts ...grpc.CallOption) (*SuspendActorResponse, error)
	// Pause a given actor: checkpoint it to its worker's node and leave it
	// SUSPENDED with that node-local snapshot, pinned to the node. A paused
	// actor is told from a suspended one by its snapshots, not its state.
	PauseActor(ctx context.Context, in *PauseActorRequest, opts ...grpc.CallOption) (*PauseActorResponse, error)
	// Resume an actor from its latest snapshot.
	ResumeActor(ctx context.Context, in *ResumeActorRequest, opts ...grpc.CallOption) (*ResumeActorResponse, error)
	// Revert an actor to SUSPENDED state at its durable snapshot.
	// Only crashed, running or paused actors can be reverted.
	RevertActor(ctx context.Context, in *RevertActorRequest, opts ...grpc.CallOption) (*RevertActorResponse, error)
	// Delete an actor. Only suspended or crashed actors can be deleted unless
	// any_state is set.
	DeleteActor(ctx context.Context, in *DeleteActorRequest, opts ...grpc.CallOption) (*Actor, error)
	// Get the egress policy resource nested under an Actor.
	GetActorEgressPolicy(ctx context.Context, in *GetActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error)
	// Create the egress policy resource nested under an Actor.
	CreateActorEgressPolicy(ctx context.Context, in *CreateActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error)
	// Replace the egress policy resource nested under an Actor.
	UpdateActorEgressPolicy(ctx context.Context, in *UpdateActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error)
	// Delete the egress policy resource nested under an Actor.
	DeleteActorEgressPolicy(ctx context.Context, in *DeleteActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error)
	// Create a Substrate-issued JWT asserting the actor identity.
	//
	// * Called by the egress gateway when actor JWT injection is configured for outbound requests.
	MintActorJwt(ctx context.Context, in *MintActorJwtRequest, opts ...grpc.CallOption) (*MintActorJwtResponse, error)
	// Create a Substrate-issued SPIFFE certificate asserting the actor identity.
	//
	// SPIFFE URI: spiffe://${trustdomain}/actor/${atespace}/${actor}
	//
	// * Called by the egress gateway when actor client certificate injection is
	//   configured for outbound requests.
	MintActorCertificate(ctx context.Context, in *MintActorCertificateRequest, opts ...grpc.CallOption) (*MintActorCertificateResponse, error)
	// Tag the external snapshot a suspended Actor holds. The tag gets its own
	// copy of that snapshot, so suspending or deleting the Actor afterwards
	// cannot collect it.
	CreateTag(ctx context.Context, in *CreateTagRequest, opts ...grpc.CallOption) (*Tag, error)
	// Get a Tag.
	GetTag(ctx context.Context, in *GetTagRequest, opts ...grpc.CallOption) (*Tag, error)
	// List Tags.
	ListTags(ctx context.Context, in *ListTagsRequest, opts ...grpc.CallOption) (*ListTagsResponse, error)
	// Publish or unpublish a Tag without changing its address.
	UpdateTag(ctx context.Context, in *UpdateTagRequest, opts ...grpc.CallOption) (*Tag, error)
	// Delete a Tag and the external snapshot it owns. Actors created from the
	// tag that have not yet been suspended still point at that external snapshot
	// and become unrecoverable, so do not delete a tag while such Actors exist.
	DeleteTag(ctx context.Context, in *DeleteTagRequest, opts ...grpc.CallOption) (*Tag, error)
	// List Workers.
	ListWorkers(ctx context.Context, in *ListWorkersRequest, opts ...grpc.CallOption) (*ListWorkersResponse, error)
	// Get a Worker.
	GetWorker(ctx context.Context, in *GetWorkerRequest, opts ...grpc.CallOption) (*Worker, error)
	// Register a Worker. Called once its Pod has an IP. A Worker is registered
	// UNAVAILABLE and takes no Actors until MarkWorkerAvailable.
	CreateWorker(ctx context.Context, in *CreateWorkerRequest, opts ...grpc.CallOption) (*Worker, error)
	// Update observed pool state on a Worker.
	UpdateWorker(ctx context.Context, in *UpdateWorkerRequest, opts ...grpc.CallOption) (*Worker, error)
	// Deregister a Worker. Does not cascade: the caller is responsible for
	// cleaning up related resources first.
	DeleteWorker(ctx context.Context, in *DeleteWorkerRequest, opts ...grpc.CallOption) (*Worker, error)
	// Mark a Worker as terminating so the scheduler stops routing new Actors to
	// it. Idempotent; one-way. Deliberately leaves any bound Actor alone.
	// Returns ABORTED if another write lands on the Worker first; retry.
	DrainWorker(ctx context.Context, in *DrainWorkerRequest, opts ...grpc.CallOption) (*DrainWorkerResponse, error)
	// Mark an UNAVAILABLE Worker ACTIVE so the scheduler places Actors on it.
	// Idempotent. Returns FAILED_PRECONDITION for a DRAINING Worker, and ABORTED
	// if another write lands on the Worker first; retry.
	//
	// Every Actor placed after this call is stamped with the Worker's epoch as
	// it stands then, so a caller raises epoch for a restarted ateom first.
	MarkWorkerAvailable(ctx context.Context, in *MarkWorkerAvailableRequest, opts ...grpc.CallOption) (*MarkWorkerAvailableResponse, error)
	// Mark an ACTIVE Worker UNAVAILABLE so the scheduler stops placing Actors on
	// it, as while its Pod is not Ready. Idempotent. Leaves any bound Actor
	// alone. Returns FAILED_PRECONDITION for a DRAINING Worker, and ABORTED if
	// another write lands on the Worker first; retry.
	MarkWorkerUnavailable(ctx context.Context, in *MarkWorkerUnavailableRequest, opts ...grpc.CallOption) (*MarkWorkerUnavailableResponse, error)
	// List the Actors hosted by a given Worker.
	ListWorkerActorAssignments(ctx context.Context, in *ListWorkerActorAssignmentsRequest, opts ...grpc.CallOption) (*ListWorkerActorAssignmentsResponse, error)
	// List Actors.
	ListActors(ctx context.Context, in *ListActorsRequest, opts ...grpc.CallOption) (*ListActorsResponse, error)
	// Create a new Atespace. Substrate-native, stored in database.
	CreateAtespace(ctx context.Context, in *CreateAtespaceRequest, opts ...grpc.CallOption) (*Atespace, error)
	// Get an Atespace by name.
	GetAtespace(ctx context.Context, in *GetAtespaceRequest, opts ...grpc.CallOption) (*Atespace, error)
	// List Atespaces.
	ListAtespaces(ctx context.Context, in *ListAtespacesRequest, opts ...grpc.CallOption) (*ListAtespacesResponse, error)
	// Delete an empty Atespace. Rejects (FailedPrecondition) if any Actors or
	// Tags remain.
	DeleteAtespace(ctx context.Context, in *DeleteAtespaceRequest, opts ...grpc.CallOption) (*Atespace, error)
	CreateActorTemplate(ctx context.Context, in *CreateActorTemplateRequest, opts ...grpc.CallOption) (*ActorTemplate, error)
	GetActorTemplate(ctx context.Context, in *GetActorTemplateRequest, opts ...grpc.CallOption) (*ActorTemplate, error)
	ListActorTemplates(ctx context.Context, in *ListActorTemplatesRequest, opts ...grpc.CallOption) (*ListActorTemplatesResponse, error)
	// Delete an ActorTemplate together with its golden actor and golden
	// tag in the reserved ate-golden atespace.
	DeleteActorTemplate(ctx context.Context, in *DeleteActorTemplateRequest, opts ...grpc.CallOption) (*ActorTemplate, error)
	// Get the deployment-wide global access policy singleton. Returns NotFound
	// until the policy has been created.
	GetGlobalAccessPolicy(ctx context.Context, in *GetGlobalAccessPolicyRequest, opts ...grpc.CallOption) (*AccessPolicy, error)
	// Create the deployment-wide global access policy singleton. The server's
	// configured bootstrap owners are global owners whether or not this policy
	// exists, so they can create it.
	CreateGlobalAccessPolicy(ctx context.Context, in *CreateGlobalAccessPolicyRequest, opts ...grpc.CallOption) (*AccessPolicy, error)
	// Replace the deployment-wide global access policy singleton. Empty
	// bindings revoke every grant held through the policy; bootstrap owners
	// keep access.
	UpdateGlobalAccessPolicy(ctx context.Context, in *UpdateGlobalAccessPolicyRequest, opts ...grpc.CallOption) (*AccessPolicy, error)
	// Get the access policy resource nested under an Atespace.
	GetAtespaceAccessPolicy(ctx context.Context, in *GetAtespaceAccessPolicyRequest, opts ...grpc.CallOption) (*AccessPolicy, error)
	// Create the access policy resource nested under an Atespace.
	CreateAtespaceAccessPolicy(ctx context.Context, in *CreateAtespaceAccessPolicyRequest, opts ...grpc.CallOption) (*AccessPolicy, error)
	// Replace the access policy resource nested under an Atespace.
	UpdateAtespaceAccessPolicy(ctx context.Context, in *UpdateAtespaceAccessPolicyRequest, opts ...grpc.CallOption) (*AccessPolicy, error)
	// Delete the access policy resource nested under an Atespace.
	DeleteAtespaceAccessPolicy(ctx context.Context, in *DeleteAtespaceAccessPolicyRequest, opts ...grpc.CallOption) (*AccessPolicy, error)
}

type ControlServer interface {
	// Get an Actor.
	GetActor(context.Context, *GetActorRequest) (*Actor, error)
	// Create a new Actor deriving from a given ActorTemplate.
	CreateActor(context.Context, *CreateActorRequest) (*Actor, error)
	// Update mutable fields on an existing Actor.
	UpdateActor(context.Context, *UpdateActorRequest) (*Actor, error)
	// Suspend a given actor to a new snapshot. A running actor is checkpointed
	// on its worker; a paused actor's node-local snapshot is uploaded, narrowed
	// to the template's commit scope where required (Full capture, Data commit).
	SuspendActor(context.Context, *SuspendActorRequest) (*SuspendActorResponse, error)
	// Pause a given actor: checkpoint it to its worker's node and leave it
	// SUSPENDED with that node-local snapshot, pinned to the node. A paused
	// actor is told from a suspended one by its snapshots, not its state.
	PauseActor(context.Context, *PauseActorRequest) (*PauseActorResponse, error)
	// Resume an actor from its latest snapshot.
	ResumeActor(context.Context, *ResumeActorRequest) (*ResumeActorResponse, error)
	// Revert an actor to SUSPENDED state at its durable snapshot.
	// Only crashed, running or paused actors can be reverted.
	RevertActor(context.Context, *RevertActorRequest) (*RevertActorResponse, error)
	// Delete an actor. Only suspended or crashed actors can be deleted unless
	// any_state is set.
	DeleteActor(context.Context, *DeleteActorRequest) (*Actor, error)
	// Get the egress policy resource nested under an Actor.
	GetActorEgressPolicy(context.Context, *GetActorEgressPolicyRequest) (*EgressPolicy, error)
	// Create the egress policy resource nested under an Actor.
	CreateActorEgressPolicy(context.Context, *CreateActorEgressPolicyRequest) (*EgressPolicy, error)
	// Replace the egress policy resource nested under an Actor.
	UpdateActorEgressPolicy(context.Context, *UpdateActorEgressPolicyRequest) (*EgressPolicy, error)
	// Delete the egress policy resource nested under an Actor.
	DeleteActorEgressPolicy(context.Context, *DeleteActorEgressPolicyRequest) (*EgressPolicy, error)
	// Create a Substrate-issued JWT asserting the actor identity.
	//
	// * Called by the egress gateway when actor JWT injection is configured for outbound requests.
	MintActorJwt(context.Context, *MintActorJwtRequest) (*MintActorJwtResponse, error)
	// Create a Substrate-issued SPIFFE certificate asserting the actor identity.
	//
	// SPIFFE URI: spiffe://${trustdomain}/actor/${atespace}/${actor}
	//
	// * Called by the egress gateway when actor client certificate injection is
	//   configured for outbound requests.
	MintActorCertificate(context.Context, *MintActorCertificateRequest) (*MintActorCertificateResponse, error)
	// Tag the external snapshot a suspended Actor holds. The tag gets its own
	// copy of that snapshot, so suspending or deleting the Actor afterwards
	// cannot collect it.
	CreateTag(context.Context, *CreateTagRequest) (*Tag, error)
	// Get a Tag.
	GetTag(context.Context, *GetTagRequest) (*Tag, error)
	// List Tags.
	ListTags(context.Context, *ListTagsRequest) (*ListTagsResponse, error)
	// Publish or unpublish a Tag without changing its address.
	UpdateTag(context.Context, *UpdateTagRequest) (*Tag, error)
	// Delete a Tag and the external snapshot it owns. Actors created from the
	// tag that have not yet been suspended still point at that external snapshot
	// and become unrecoverable, so do not delete a tag while such Actors exist.
	DeleteTag(context.Context, *DeleteTagRequest) (*Tag, error)
	// List Workers.
	ListWorkers(context.Context, *ListWorkersRequest) (*ListWorkersResponse, error)
	// Get a Worker.
	GetWorker(context.Context, *GetWorkerRequest) (*Worker, error)
	// Register a Worker. Called once its Pod has an IP. A Worker is registered
	// UNAVAILABLE and takes no Actors until MarkWorkerAvailable.
	CreateWorker(context.Context, *CreateWorkerRequest) (*Worker, error)
	// Update observed pool state on a Worker.
	UpdateWorker(context.Context, *UpdateWorkerRequest) (*Worker, error)
	// Deregister a Worker. Does not cascade: the caller is responsible for
	// cleaning up related resources first.
	DeleteWorker(context.Context, *DeleteWorkerRequest) (*Worker, error)
	// Mark a Worker as terminating so the scheduler stops routing new Actors to
	// it. Idempotent; one-way. Deliberately leaves any bound Actor alone.
	// Returns ABORTED if another write lands on the Worker first; retry.
	DrainWorker(context.Context, *DrainWorkerRequest) (*DrainWorkerResponse, error)
	// Mark an UNAVAILABLE Worker ACTIVE so the scheduler places Actors on it.
	// Idempotent. Returns FAILED_PRECONDITION for a DRAINING Worker, and ABORTED
	// if another write lands on the Worker first; retry.
	//
	// Every Actor placed after this call is stamped with the Worker's epoch as
	// it stands then, so a caller raises epoch for a restarted ateom first.
	MarkWorkerAvailable(context.Context, *MarkWorkerAvailableRequest) (*MarkWorkerAvailableResponse, error)
	// Mark an ACTIVE Worker UNAVAILABLE so the scheduler stops placing Actors on
	// it, as while its Pod is not Ready. Idempotent. Leaves any bound Actor
	// alone. Returns FAILED_PRECONDITION for a DRAINING Worker, and ABORTED if
	// another write lands on the Worker first; retry.
	MarkWorkerUnavailable(context.Context, *MarkWorkerUnavailableRequest) (*MarkWorkerUnavailableResponse, error)
	// List the Actors hosted by a given Worker.
	ListWorkerActorAssignments(context.Context, *ListWorkerActorAssignmentsRequest) (*ListWorkerActorAssignmentsResponse, error)
	// List Actors.
	ListActors(context.Context, *ListActorsRequest) (*ListActorsResponse, error)
	// Create a new Atespace. Substrate-native, stored in database.
	CreateAtespace(context.Context, *CreateAtespaceRequest) (*Atespace, error)
	// Get an Atespace by name.
	GetAtespace(context.Context, *GetAtespaceRequest) (*Atespace, error)
	// List Atespaces.
	ListAtespaces(context.Context, *ListAtespacesRequest) (*ListAtespacesResponse, error)
	// Delete an empty Atespace. Rejects (FailedPrecondition) if any Actors or
	// Tags remain.
	DeleteAtespace(context.Context, *DeleteAtespaceRequest) (*Atespace, error)
	CreateActorTemplate(context.Context, *CreateActorTemplateRequest) (*ActorTemplate, error)
	GetActorTemplate(context.Context, *GetActorTemplateRequest) (*ActorTemplate, error)
	ListActorTemplates(context.Context, *ListActorTemplatesRequest) (*ListActorTemplatesResponse, error)
	// Delete an ActorTemplate together with its golden actor and golden
	// tag in the reserved ate-golden atespace.
	DeleteActorTemplate(context.Context, *DeleteActorTemplateRequest) (*ActorTemplate, error)
	// Get the deployment-wide global access policy singleton. Returns NotFound
	// until the policy has been created.
	GetGlobalAccessPolicy(context.Context, *GetGlobalAccessPolicyRequest) (*AccessPolicy, error)
	// Create the deployment-wide global access policy singleton. The server's
	// configured bootstrap owners are global owners whether or not this policy
	// exists, so they can create it.
	CreateGlobalAccessPolicy(context.Context, *CreateGlobalAccessPolicyRequest) (*AccessPolicy, error)
	// Replace the deployment-wide global access policy singleton. Empty
	// bindings revoke every grant held through the policy; bootstrap owners
	// keep access.
	UpdateGlobalAccessPolicy(context.Context, *UpdateGlobalAccessPolicyRequest) (*AccessPolicy, error)
	// Get the access policy resource nested under an Atespace.
	GetAtespaceAccessPolicy(context.Context, *GetAtespaceAccessPolicyRequest) (*AccessPolicy, error)
	// Create the access policy resource nested under an Atespace.
	CreateAtespaceAccessPolicy(context.Context, *CreateAtespaceAccessPolicyRequest) (*AccessPolicy, error)
	// Replace the access policy resource nested under an Atespace.
	UpdateAtespaceAccessPolicy(context.Context, *UpdateAtespaceAccessPolicyRequest) (*AccessPolicy, error)
	// Delete the access policy resource nested under an Atespace.
	DeleteAtespaceAccessPolicy(context.Context, *DeleteAtespaceAccessPolicyRequest) (*AccessPolicy, error)
	// contains filtered or unexported methods
}

type CreateActorEgressPolicyRequest struct {

	// Parent Actor under which to create the policy resource.
	//
	// +k8s:required
	// +k8s:subfield(atespace)=+k8s:required
	Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"`
	// The policy to create. metadata.name must be "default" and
	// metadata.atespace must match actor.atespace.
	//
	// +k8s:required
	EgressPolicy *EgressPolicy `protobuf:"bytes,2,opt,name=egress_policy,json=egressPolicy,proto3" json:"egress_policy,omitempty"`
	// contains filtered or unexported fields
}

type CreateActorRequest struct {

	// The actor to create.
	//
	// +k8s:required
	Actor *Actor `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"`
	// contains filtered or unexported fields
}

type CreateActorTemplateRequest struct {

	// The actor template version to create. Server-assigned metadata (uid,
	// version, timestamps) is ignored, as are the status fields.
	//
	// +k8s:required
	// +k8s:customValidation # volume_mounts must reference declared volumes; ROOTFS fidelity requires the micro-VM sandbox class
	ActorTemplate *ActorTemplate `protobuf:"bytes,1,opt,name=actor_template,json=actorTemplate,proto3" json:"actor_template,omitempty"`
	// contains filtered or unexported fields
}

type CreateAtespaceAccessPolicyRequest struct {

	// Parent Atespace under which to create the policy resource.
	//
	// +k8s:required
	// +k8s:beta(since: "0.0")=+k8s:subfield(atespace)=+k8s:forbidden # TODO: get rid of beta prefix
	Atespace *ObjectRef `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"`
	// The policy to create. metadata.name must be "default" and
	// metadata.atespace must be empty.
	//
	// +k8s:required
	AccessPolicy *AccessPolicy `protobuf:"bytes,2,opt,name=access_policy,json=accessPolicy,proto3" json:"access_policy,omitempty"`
	// contains filtered or unexported fields
}

type CreateAtespaceRequest struct {

	// The atespace to create.
	//
	// +k8s:required
	Atespace *Atespace `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"`
	// contains filtered or unexported fields
}

type CreateGlobalAccessPolicyRequest struct {

	// The policy to create. metadata.name must be "default" and
	// metadata.atespace must be empty.
	//
	// +k8s:required
	AccessPolicy *AccessPolicy `protobuf:"bytes,1,opt,name=access_policy,json=accessPolicy,proto3" json:"access_policy,omitempty"`
	// contains filtered or unexported fields
}

type CreateTagRequest struct {

	// The tag to create. metadata.atespace, metadata.name, scope and source_actor
	// are honored; metadata.atespace must match source_actor's, and status is
	// ignored on write.
	//
	// +k8s:required
	Tag *Tag `protobuf:"bytes,1,opt,name=tag,proto3" json:"tag,omitempty"`
	// contains filtered or unexported fields
}

type CreateWorkerRequest struct {

	// The Worker to register.
	//
	// +k8s:required
	Worker *Worker `protobuf:"bytes,1,opt,name=worker,proto3" json:"worker,omitempty"`
	// contains filtered or unexported fields
}

type CredentialHeader struct {

	// The case-insensitive HTTP request header to replace when present.
	//
	// +k8s:required
	// +k8s:customValidation # format
	Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"`
	// Prepended verbatim to the credential value. Include any desired separator;
	// for example, use "Bearer " (including the space) for Authorization.
	//
	// +k8s:optional
	// +k8s:customValidation # format
	Prefix string `protobuf:"bytes,2,opt,name=prefix,proto3" json:"prefix,omitempty"`
	// Source-agnostic reference interpreted by a registered credential provider:
	// ate-secret://<provider-class>/<provider-name>/<provider-specific-tail>
	//
	// Exactly one of credential_uri and actor_jwt must be set.
	//
	// +k8s:optional
	// +k8s:unionMember
	// +k8s:customValidation # format
	CredentialUri string `protobuf:"bytes,3,opt,name=credential_uri,json=credentialUri,proto3" json:"credential_uri,omitempty"`
	// A Substrate-issued JWT asserting the identity of the Actor that sent the
	// request.
	//
	// +k8s:optional
	// +k8s:unionMember
	ActorJwt *ActorJwtSource `protobuf:"bytes,4,opt,name=actor_jwt,json=actorJwt,proto3" json:"actor_jwt,omitempty"`
	// contains filtered or unexported fields
}

type DeleteActorEgressPolicyRequest struct {

	// The parent Actor of the egress policy resource to delete.
	//
	// +k8s:required
	// +k8s:subfield(atespace)=+k8s:required
	Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"`
	// Name of the singleton egress policy. Must be "default".
	//
	// +k8s:required
	// +k8s:format=k8s-short-name
	// +k8s:customValidation # must be "default"
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// Optional per-delete preconditions.
	//
	// +k8s:optional
	Options *DeleteOptions `protobuf:"bytes,3,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}

type DeleteActorRequest struct {

	// +k8s:required
	// +k8s:subfield(atespace)=+k8s:required
	Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"`
	// If true, delete the actor regardless of its state.
	//
	// +k8s:optional
	AnyState bool `protobuf:"varint,2,opt,name=any_state,json=anyState,proto3" json:"any_state,omitempty"`
	// Optional per-delete preconditions.
	//
	// +k8s:optional
	Options *DeleteOptions `protobuf:"bytes,3,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}

type DeleteActorTemplateRequest struct {

	// +k8s:required
	// +k8s:subfield(atespace)=+k8s:required
	ActorTemplate *ObjectRef `protobuf:"bytes,1,opt,name=actor_template,json=actorTemplate,proto3" json:"actor_template,omitempty"`
	// Optional per-delete preconditions.
	//
	// +k8s:optional
	Options *DeleteOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}

type DeleteAtespaceAccessPolicyRequest struct {

	// The parent Atespace of the access policy resource to delete.
	//
	// +k8s:required
	// +k8s:beta(since: "0.0")=+k8s:subfield(atespace)=+k8s:forbidden # TODO: get rid of beta prefix
	Atespace *ObjectRef `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"`
	// Name of the singleton access policy. Must be "default".
	//
	// +k8s:required
	// +k8s:format=k8s-short-name
	// +k8s:customValidation # must be "default"
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// Optional per-delete preconditions.
	//
	// +k8s:optional
	Options *DeleteOptions `protobuf:"bytes,3,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}

type DeleteAtespaceRequest struct {

	// +k8s:required
	// +k8s:beta(since: "0.0")=+k8s:subfield(atespace)=+k8s:forbidden # TODO: get rid of beta prefix
	Atespace *ObjectRef `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"`
	// Optional per-delete preconditions.
	//
	// +k8s:optional
	Options *DeleteOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}

type DeleteOptions struct {

	// Delete only if the resource is still at this version, that is, unchanged
	// since the caller read it. Zero skips the check.
	//
	// +k8s:optional
	// +k8s:minimum=1
	Version int64 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// Delete only if the resource still has this uid, that is, it is the one
	// the caller read and not a later one created under the same name. Empty
	// skips the check.
	//
	// +k8s:optional
	// +k8s:format=k8s-uuid
	Uid string `protobuf:"bytes,2,opt,name=uid,proto3" json:"uid,omitempty"`
	// contains filtered or unexported fields
}

type DeleteTagRequest struct {

	// +k8s:required
	// +k8s:subfield(atespace)=+k8s:required
	Tag *ObjectRef `protobuf:"bytes,1,opt,name=tag,proto3" json:"tag,omitempty"`
	// Optional per-delete preconditions.
	//
	// +k8s:optional
	Options *DeleteOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}

type DeleteWorkerRequest struct {

	// The Worker to deregister.
	//
	// +k8s:required
	// +k8s:beta(since: "0.0")=+k8s:subfield(atespace)=+k8s:forbidden # TODO: get rid of beta prefix
	Worker *ObjectRef `protobuf:"bytes,1,opt,name=worker,proto3" json:"worker,omitempty"`
	// Optional per-delete preconditions.
	//
	// +k8s:optional
	Options *DeleteOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}