Port forwarding support (#30)

* Port forwarding support

* .golangci.yml: remove and replace deprecated and archived linters

* Client: pass credentials when calling WebSocket API methods

* API: require ServiceAccountRoleComputeWrite role for port forwarding

* Use Buf

* Rename Poll() RPC method to Watch()

* Split Rendezvous into two parts: Watcher and Proxy (#32)

* Split Rendezvous into two parts: Watcher and Proxy

* Implement Proxy cancellation

* Use Protocol Buffers structure directly in Watcher

* Fix TestWatcher after switching to Protocol Buffers structure

* portForwardVM(): ensure we also check for gin's context

.cirrus.yml

@@ -0,0 +1,7 @@
+task:
+  name: Test (macOS)
+  persistent_worker:
+    labels:
+      name: dev-mini
+  test_script:
+    - go test -v ./...

.golangci.yml

@@ -12,12 +12,12 @@ linters:
   enable:
     - asciicheck
     - bodyclose
-    - deadcode
     - depguard
     - dupl
     - errcheck
     - exhaustive
     - exportloopref
+    - exportloopref
     - gochecknoinits
     - gocognit
     - goconst
@@ -28,15 +28,12 @@ linters:
     - goerr113
     - gofmt
     - goheader
-    - golint
     - gomodguard
     - goprintffuncname
     - gosec
     - gosimple
     - govet
-    - ifshort
     - ineffassign
-    - interfacer
     - lll
     - makezero
     - misspell
@@ -46,10 +43,8 @@ linters:
     - nolintlint
     - predeclared
     - rowserrcheck
-    - scopelint
     - sqlclosecheck
     - staticcheck
-    - structcheck
     - stylecheck
     - testpackage
     - tparallel
@@ -57,7 +52,7 @@ linters:
     - unconvert
     - unparam
     - unused
-    - varcheck
+    - unused
     - whitespace
 
   disable:

README.md

@@ -29,3 +29,11 @@ Check a list of VM resources to see if the Virtual Machine we've created above i
 ```shell
 orchard list vms
 ```
+
+## Development
+
+Development is done as one would normally develop any Golang package, however, if you did modify any `*.proto` files in the `rpc/` directory, install [Buf](https://buf.build/) and run the following command from the project's root directory to re-generate the code:
+
+```shell
+buf generate
+```

api/openapi.yaml

@@ -220,6 +220,35 @@ paths:
                 $ref: '#components/schemas/Events'
         '404':
           description: VM resource with the given name doesn't exist
+  /vms/{name}/port-forward:
+    get:
+      summary: "Port-forward to a VM using WebSocket protocol"
+      tags:
+        - vms
+      parameters:
+        - in: query
+          name: port
+          description: VM's TCP port number to connect to
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 65535
+          required: true
+        - in: header
+          name: Connection
+          description: WebSocket protocol required header
+          required: true
+        - in: header
+          name: Upgrade
+          description: WebSocket protocol required header
+          required: true
+      responses:
+        '400':
+          description: Invalid port specified
+        '404':
+          description: VM resource with the given name doesn't exist
+        '503':
+          description: Failed to establish connection with the worker responsible for the specified VM
 components:
   schemas:
     Worker:

buf.gen.yaml

@@ -0,0 +1,8 @@
+version: v1
+plugins:
+  - plugin: go
+    out: rpc
+    opt: paths=source_relative
+  - plugin: go-grpc
+    out: rpc
+    opt: paths=source_relative

buf.work.yaml

@@ -0,0 +1,3 @@
+version: v1
+directories:
+  - rpc

buf.yaml

@@ -0,0 +1,7 @@
+version: v1
+breaking:
+  use:
+    - FILE
+lint:
+  use:
+    - DEFAULT

go.mod

@@ -3,63 +3,70 @@ module github.com/cirruslabs/orchard
 go 1.19
 
 require (
+	github.com/avast/retry-go/v4 v4.3.3
 	github.com/deckarep/golang-set/v2 v2.1.0
 	github.com/dgraph-io/badger/v3 v3.2103.5
-	github.com/dustin/go-humanize v1.0.0
+	github.com/dustin/go-humanize v1.0.1
-	github.com/gin-gonic/gin v1.8.2
+	github.com/gin-gonic/gin v1.9.0
 	github.com/gofrs/flock v0.8.1
+	github.com/golang/protobuf v1.5.2
 	github.com/google/uuid v1.3.0
 	github.com/gosuri/uitable v0.0.4
+	github.com/hashicorp/go-multierror v1.1.1
 	github.com/manifoldco/promptui v0.9.0
-	github.com/spf13/cobra v1.6.0
+	github.com/mitchellh/go-grpc-net-conn v0.0.0-20200427190222-eb030e4876f0
-	github.com/stretchr/testify v1.8.1
+	github.com/spf13/cobra v1.6.1
+	github.com/stretchr/testify v1.8.2
 	go.uber.org/zap v1.24.0
+	golang.org/x/net v0.7.0
+	google.golang.org/grpc v1.53.0
+	google.golang.org/protobuf v1.28.1
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
+	github.com/bytedance/sonic v1.8.3 // indirect
 	github.com/cespare/xxhash v1.1.0 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e // indirect
+	github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
+	github.com/chzyer/readline v1.5.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgraph-io/ristretto v0.1.1 // indirect
-	github.com/fatih/color v1.13.0 // indirect
+	github.com/fatih/color v1.14.1 // indirect
 	github.com/gin-contrib/sse v0.1.0 // indirect
-	github.com/go-playground/locales v0.14.0 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
-	github.com/go-playground/universal-translator v0.18.0 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.11.1 // indirect
+	github.com/go-playground/validator/v10 v10.11.2 // indirect
-	github.com/goccy/go-json v0.9.11 // indirect
+	github.com/goccy/go-json v0.10.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b // indirect
+	github.com/golang/glog v1.1.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/snappy v0.0.4 // indirect
-	github.com/golang/snappy v0.0.3 // indirect
+	github.com/google/flatbuffers v23.3.3+incompatible // indirect
-	github.com/google/flatbuffers v1.12.1 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/hashicorp/errwrap v1.0.0 // indirect
-	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.12.3 // indirect
+	github.com/klauspost/compress v1.16.0 // indirect
-	github.com/leodido/go-urn v1.2.1 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.4 // indirect
-	github.com/mattn/go-colorable v0.1.9 // indirect
+	github.com/leodido/go-urn v1.2.2 // indirect
-	github.com/mattn/go-isatty v0.0.16 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.17 // indirect
 	github.com/mattn/go-runewidth v0.0.14 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.7 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/rivo/uniseg v0.2.0 // indirect
+	github.com/rivo/uniseg v0.4.4 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/ugorji/go/codec v1.2.7 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	go.opencensus.io v0.22.5 // indirect
+	github.com/ugorji/go/codec v1.2.10 // indirect
+	go.opencensus.io v0.24.0 // indirect
 	go.uber.org/atomic v1.10.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3 // indirect
+	golang.org/x/arch v0.2.0 // indirect
-	golang.org/x/net v0.5.0 // indirect
+	golang.org/x/crypto v0.6.0 // indirect
-	golang.org/x/sys v0.4.0 // indirect
+	golang.org/x/sys v0.5.0 // indirect
-	golang.org/x/text v0.6.0 // indirect
+	golang.org/x/text v0.7.0 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 )

go.sum

@@ -3,25 +3,37 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
+github.com/avast/retry-go/v4 v4.3.3 h1:G56Bp6mU0b5HE1SkaoVjscZjlQb0oy4mezwY/cGH19w=
+github.com/avast/retry-go/v4 v4.3.3/go.mod h1:rg6XFaiuFYII0Xu3RDbZQkxCofFwruZKW8oEF1jpWiU=
 github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
+github.com/bytedance/sonic v1.5.0/go.mod h1:ED5hyg4y6t3/9Ku1R6dU/4KyJ48DZ4jPhfY1O2AihPM=
+github.com/bytedance/sonic v1.8.3 h1:pf6fGl5eqWYKkx1RcD4qpuX+BIUaduv/wTm5ekWJ80M=
+github.com/bytedance/sonic v1.8.3/go.mod h1:i736AoUSYt75HyZLoJW9ERYxcy6eaN6h4BZXU064P/U=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
-github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chzyer/logex v1.1.10 h1:Swpa1K6QvQznwJRcfTfQJmTE72DqScAa40E+fbHEXEE=
+github.com/chenzhuoyu/base64x v0.0.0-20211019084208-fb5309c8db06/go.mod h1:DH46F32mSOjUmXrMHnKwZdA8wcEefY7UVqBKYGjpdQY=
+github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 h1:qSGYFH7+jGhDF8vLC+iwCD4WpbV1EBDSzWkJODFLams=
+github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311/go.mod h1:b583jCggY9gE99b6G5LEC39OIiVsWj+R97kbl5odCEk=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e h1:fY5BOSpyZCqRo5OhCuC+XN+r/bBCmeuuJtjz+bCNIf8=
+github.com/chzyer/logex v1.2.1 h1:XHDu3E6q+gdHgsdTPH6ImJMIp436vR6MPtH8gP05QzM=
+github.com/chzyer/logex v1.2.1/go.mod h1:JLbx6lG2kDbNRFnfkgvh4eRJRPX1QCoOIWomwysCBrQ=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1 h1:q763qf9huN11kDQavWsoZXJNW3xEE4JJyHa5Q25/sd8=
+github.com/chzyer/readline v1.5.1 h1:upd/6fQk4src78LMRzh5vItIt361/o4uq553V8B5sGI=
+github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObkaSkeBlk=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
+github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -33,50 +45,72 @@ github.com/dgraph-io/ristretto v0.1.1 h1:6CWw5tJNgpegArSHpNHJKldNeq03FQCwYvfMVWa
 github.com/dgraph-io/ristretto v0.1.1/go.mod h1:S1GPSBCYCIhmVNfcth17y2zZtQT6wzkzgwUve0VDWWA=
 github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2 h1:tdlZCpZ/P9DhczCTSixgIKmwPv6+wP5DGjqLYw5SUiA=
 github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
-github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
-github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
+github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
-github.com/gin-gonic/gin v1.8.2 h1:UzKToD9/PoFj/V4rvlKqTRKnQYyz8Sc1MJlv4JHPtvY=
+github.com/gin-gonic/gin v1.9.0 h1:OjyFBKICoexlu99ctXNR2gg+c5pKrKMuyjgARg9qeY8=
-github.com/gin-gonic/gin v1.8.2/go.mod h1:qw5AYuDrzRTnhvusDsrov+fDIxp9Dleuu12h8nfB398=
+github.com/gin-gonic/gin v1.9.0/go.mod h1:W1Me9+hsUSyj3CePGrd1/QrKJMSJ1Tu/0hFEH89961k=
-github.com/go-playground/assert/v2 v2.0.1 h1:MsBgLAaY856+nPRTKrp3/OZK38U/wa0CcBYNjji3q3A=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
-github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
-github.com/go-playground/locales v0.14.0 h1:u50s323jtVGugKlcYeyzC0etD1HifMjqmJqb8WugfUU=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
-github.com/go-playground/locales v0.14.0/go.mod h1:sawfccIbzZTqEDETgFXqTho0QybSa7l++s0DH+LDiLs=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
-github.com/go-playground/universal-translator v0.18.0 h1:82dyy6p4OuJq4/CByFNOn/jYrnRPArHwAcmLoJZxyho=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/universal-translator v0.18.0/go.mod h1:UvRDBj+xPUEGrFYl+lu/H90nyDXpg0fqeB/AQUGNTVA=
+github.com/go-playground/validator/v10 v10.11.2 h1:q3SHpufmypg+erIExEKUmsgmhDTyhcJ38oeKGACXohU=
-github.com/go-playground/validator/v10 v10.11.1 h1:prmOlTVv+YjZjmRmNSF3VmspqJIxJWXmqUsHwfTRRkQ=
+github.com/go-playground/validator/v10 v10.11.2/go.mod h1:NieE624vt4SCTJtD87arVLvdmjPAeV8BQlHtMnw9D7s=
-github.com/go-playground/validator/v10 v10.11.1/go.mod h1:i+3WkQ1FvaUjjxh1kSvIA4dMGDBiPU55YFDl0WbKdWU=
+github.com/goccy/go-json v0.10.0 h1:mXKd9Qw4NuzShiRlOXKews24ufknHO7gx30lsDyokKA=
-github.com/goccy/go-json v0.9.11 h1:/pAaQDLHEoCq/5FFmSKBswWmK6H0e8g4159Kc/X/nqk=
+github.com/goccy/go-json v0.10.0/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
-github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
 github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/glog v1.1.0 h1:/d3pCKDPWNnvIWe0vVUpNP32qc8U3PDVxySP/y360qE=
+github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/snappy v0.0.3 h1:fHPg5GQYlCeLIPB9BZqMVR5nR9A+IM5zcgeTdjMYmLA=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/flatbuffers v1.12.1 h1:MVlul7pQNoDzWRLTw5imwYsl+usrS1TXG2H4jg6ImGw=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/flatbuffers v1.12.1/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/flatbuffers v23.3.3+incompatible h1:5PJI/WbJkaMTvpGxsHVKG/LurN/KnWXNyGpwSCDgen0=
+github.com/google/flatbuffers v23.3.3+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
@@ -87,35 +121,38 @@ github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+l
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
 github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.12.3 h1:G5AfA94pHPysR56qqrkO2pxEexdDzrpFJ6yt/VqWxVU=
 github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
+github.com/klauspost/compress v1.16.0 h1:iULayQNOReoYUe+1qtKOqw9CwJv3aNQu8ivo7lw1HU4=
+github.com/klauspost/compress v1.16.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.2.4 h1:acbojRNwl3o09bUq+yDCtZFc1aiwaAAxtcn8YkZXnvk=
+github.com/klauspost/cpuid/v2 v2.2.4/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/leodido/go-urn v1.2.2 h1:7z68G0FCGvDk646jz1AelTYNYWrTNm0bEcFAo147wt4=
-github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
+github.com/leodido/go-urn v1.2.2/go.mod h1:kUaIbLZWttglzwNuG0pgsh5vuV6u2YcGBYz1hIPjtOQ=
-github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/manifoldco/promptui v0.9.0 h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=
 github.com/manifoldco/promptui v0.9.0/go.mod h1:ka04sppxSGFAtxX0qhlYQjISsg9mR4GWtQEhdbn6Pgg=
-github.com/mattn/go-colorable v0.1.9 h1:sqDoxXbdeALODt0DAeJCVp38ps9ZogZEAXjus69YV3U=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
+github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
 github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mitchellh/go-grpc-net-conn v0.0.0-20200427190222-eb030e4876f0 h1:oZuel4h7224ILBLg2SlTxdaMYXDyqcVfL4Cg1PJQHZs=
+github.com/mitchellh/go-grpc-net-conn v0.0.0-20200427190222-eb030e4876f0/go.mod h1:ZCzL0JMR6qfm7VrDC8HGwVtPA8D2Ijc/edUSBw58x94=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -124,28 +161,28 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml/v2 v2.0.6 h1:nrzqCb7j9cDFj2coyLNLaZuJTLjWjlaz6nvTvIwycIU=
+github.com/pelletier/go-toml/v2 v2.0.7 h1:muncTPStnKRos5dpVKULv2FVd4bMOhNePj9CjgDb8Us=
-github.com/pelletier/go-toml/v2 v2.0.6/go.mod h1:eumQOmlWiOPt5WriQQqoM5y18pDHwha2N+QD+EUNTek=
+github.com/pelletier/go-toml/v2 v2.0.7/go.mod h1:eumQOmlWiOPt5WriQQqoM5y18pDHwha2N+QD+EUNTek=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
+github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8=
-github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/rwtodd/Go.Sed v0.0.0-20210816025313-55464686f9ef/go.mod h1:8AEUvGVi2uQ5b24BIhcr0GCcpd/RNAFWaN2CJFrWIIQ=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
 github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
-github.com/spf13/cobra v1.6.0 h1:42a0n6jwCot1pUmomAp4T7DeMD+20LFv4Q54pxLf2LI=
+github.com/spf13/cobra v1.6.1 h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA=
-github.com/spf13/cobra v1.6.0/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
+github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
@@ -157,21 +194,24 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/ugorji/go v1.2.7/go.mod h1:nF9osbDWLy6bDVv/Rtoh6QgnvNDpmCalQV5urGCCS6M=
+github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
+github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
-github.com/ugorji/go/codec v1.2.7 h1:YPXUKf7fYbp/y8xloBqZOw2qaVggbfwMlI8WM3wZUJ0=
+github.com/ugorji/go/codec v1.2.10 h1:eimT6Lsr+2lzmSZxPhLFoOWFmQqwk0fllJJ5hEbTXtQ=
-github.com/ugorji/go/codec v1.2.7/go.mod h1:WGN1fab3R1fzQlVQTkfxVtIBhWDRqOviHU95kRgeqEY=
+github.com/ugorji/go/codec v1.2.10/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opencensus.io v0.22.5 h1:dntmOdLpSpHlVqbW5Eay97DelsZHe+55D+xC6i0dDS0=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
 go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.1.11 h1:wy28qYRKZgnJTxGxvye5/wgWr1EKjmUDGYox5mGlRlI=
@@ -179,12 +219,15 @@ go.uber.org/multierr v1.9.0 h1:7fIwc/ZtS0q++VgcfqFDxSBZVv/Xo49/SYnDFupUwlI=
 go.uber.org/multierr v1.9.0/go.mod h1:X2jQV1h+kxSjClGpnseKVIxpmcjrj7MNnI0bnlfKTVQ=
 go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
 go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
+golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
+golang.org/x/arch v0.2.0 h1:W1sUEHXiJTfjaFJ5SLo0N6lZn+0eO5gWD1MFeTGqQEY=
+golang.org/x/arch v0.2.0/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3 h1:0es+/5331RGQPcXlMfP+WrnIIS6dNnNRe0WB02W0F4M=
+golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
-golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
@@ -199,9 +242,9 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.5.0 h1:GyT4nK/YDHSqa1c4753ouYCDajOYKTja9Xb/OHtgvSw=
+golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
-golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -215,29 +258,22 @@ golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20221010170243-090e33056c14/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.4.0 h1:Zr2JFtRQNX3BCZ8YtxRE9hNJYC8J6I1MVbMg6owUp18=
+golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
-golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.6.0 h1:3XmdazWV+ubf7QgHSTWeykHOci5oeekaGJBLkrkaw4k=
-golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
@@ -249,23 +285,39 @@ google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9Ywl
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 h1:QQF+HdiI4iocoxUjjpLgvTYDHKm99C/VtTBFnfiCJos=
+google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488/go.mod h1:TvhZT5f700eVlTNwND1xoEZQeWTB2RY/65kplwl/bFA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.28.1/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.53.0 h1:LAv2ds7cmFV/XTS3XG1NneeENYrXGmorPxsBbptIjNc=
+google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
 google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=

internal/command/context/create.go

@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"github.com/cirruslabs/orchard/internal/bootstraptoken"
 	"github.com/cirruslabs/orchard/internal/config"
-	"github.com/cirruslabs/orchard/internal/controller"
+	"github.com/cirruslabs/orchard/internal/netconstants"
 	"github.com/cirruslabs/orchard/pkg/client"
 	"github.com/manifoldco/promptui"
 	"github.com/spf13/cobra"
@@ -60,7 +60,7 @@ func runCreate(cmd *cobra.Command, args []string) error {
 	}
 
 	if controllerURL.Port() == "" {
-		controllerURL.Host += fmt.Sprintf(":%d", controller.DefaultPort)
+		controllerURL.Host += fmt.Sprintf(":%d", netconstants.DefaultControllerPort)
 	}
 
 	// Establish trust
@@ -89,7 +89,7 @@ func runCreate(cmd *cobra.Command, args []string) error {
 	tlsConfig := &tls.Config{
 		MinVersion: tls.VersionTLS13,
 		RootCAs:    privatePool,
-		ServerName: controller.DefaultServerName,
+		ServerName: netconstants.DefaultControllerServerName,
 	}
 
 	client, err := client.New(
@@ -131,7 +131,7 @@ func probeControllerCertificate(controllerURL *url.URL) (*x509.Certificate, erro
 	insecureTLSConfig := &tls.Config{
 		MinVersion:         tls.VersionTLS13,
 		RootCAs:            emptyPool,
-		ServerName:         controller.DefaultServerName,
+		ServerName:         netconstants.DefaultControllerServerName,
 		InsecureSkipVerify: true,
 	}
 
@@ -153,7 +153,7 @@ func probeControllerCertificate(controllerURL *url.URL) (*x509.Certificate, erro
 		formattedControllerCertFingerprint := formatFingerprint(controllerCertFingerprint[:])
 
 		shortControllerName := controllerURL.Hostname()
-		if controllerURL.Port() != strconv.FormatUint(controller.DefaultPort, 10) {
+		if controllerURL.Port() != strconv.FormatUint(netconstants.DefaultControllerPort, 10) {
 			shortControllerName += ":" + controllerURL.Port()
 		}
 

internal/command/controller/init.go

@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"github.com/cirruslabs/orchard/internal/controller"
+	"github.com/cirruslabs/orchard/internal/netconstants"
 	v1 "github.com/cirruslabs/orchard/pkg/resource/v1"
 	"github.com/spf13/cobra"
 	"math/big"
@@ -142,7 +143,7 @@ func GenerateSelfSignedControllerCertificate() (tls.Certificate, error) {
 		BasicConstraintsValid: true,
 		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
-		DNSNames:              []string{controller.DefaultServerName},
+		DNSNames:              []string{netconstants.DefaultControllerServerName},
 	}
 
 	certBytes, err := x509.CreateCertificate(cryptorand.Reader, cert, cert, privateKey.Public(), privateKey)

internal/command/portforward/portforward.go

@@ -0,0 +1,83 @@
+package portforward
+
+import (
+	"fmt"
+	"github.com/cirruslabs/orchard/internal/proxy"
+	"github.com/cirruslabs/orchard/pkg/client"
+	"github.com/spf13/cobra"
+	"net"
+)
+
+func NewCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use:   "port-forward <VM name> [<local port>]:<remote port>",
+		Short: "Forward TCP port to the VM",
+		Args:  cobra.ExactArgs(2),
+		RunE:  runPortForward,
+	}
+
+	return command
+}
+
+func runPortForward(cmd *cobra.Command, args []string) (err error) {
+	name := args[0]
+	portSpecRaw := args[1]
+
+	portSpec, err := NewPortSpec(portSpecRaw)
+	if err != nil {
+		return err
+	}
+
+	client, err := client.New()
+	if err != nil {
+		return err
+	}
+
+	listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", portSpec.LocalPort))
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if listenerErr := listener.Close(); listenerErr != nil && err == nil {
+			err = listenerErr
+		}
+	}()
+
+	fmt.Printf("forwarding %s -> %s:%d...\n", listener.Addr(), name, portSpec.RemotePort)
+
+	errCh := make(chan error, 1)
+
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				errCh <- err
+
+				return
+			}
+
+			go func() {
+				defer conn.Close()
+
+				wsConn, err := client.VMs().PortForward(cmd.Context(), name, portSpec.RemotePort)
+				if err != nil {
+					fmt.Printf("failed to forward port: %v\n", err)
+
+					return
+				}
+				defer wsConn.Close()
+
+				if err := proxy.Connections(wsConn, conn); err != nil {
+					fmt.Printf("failed to forward port: %v\n", err)
+				}
+			}()
+		}
+	}()
+
+	select {
+	case <-cmd.Context().Done():
+		return cmd.Context().Err()
+	case err := <-errCh:
+		return err
+	}
+}

internal/command/portforward/portspec.go

@@ -0,0 +1,47 @@
+package portforward
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+var ErrInvalidPortSpec = errors.New("invalid port-forwarding specification")
+
+type PortSpec struct {
+	LocalPort  uint16
+	RemotePort uint16
+}
+
+func NewPortSpec(portSpecRaw string) (*PortSpec, error) {
+	splits := strings.Split(portSpecRaw, ":")
+
+	if len(splits) > 2 {
+		return nil, fmt.Errorf("%w: expected no more than 2 components delimited by \":\", found %d",
+			ErrInvalidPortSpec, len(splits))
+	}
+
+	localPort, err := strconv.ParseUint(splits[0], 10, 16)
+	if err != nil {
+		return nil, err
+	}
+
+	remotePort := localPort
+
+	if len(splits) > 1 {
+		remotePort, err = strconv.ParseUint(splits[1], 10, 16)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if localPort < 1 || remotePort < 1 || localPort > 65535 || remotePort > 65535 {
+		return nil, fmt.Errorf("%w: only ports in range [1, 65535] are allowed", ErrInvalidPortSpec)
+	}
+
+	return &PortSpec{
+		LocalPort:  uint16(localPort),
+		RemotePort: uint16(remotePort),
+	}, nil
+}

internal/command/portforward/portspec_test.go

@@ -0,0 +1,28 @@
+package portforward_test
+
+import (
+	"github.com/cirruslabs/orchard/internal/command/portforward"
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestPortSpecNormal(t *testing.T) {
+	portSpec, err := portforward.NewPortSpec("5555")
+	require.NoError(t, err)
+	require.Equal(t, &portforward.PortSpec{LocalPort: 5555, RemotePort: 5555}, portSpec)
+
+	portSpec, err = portforward.NewPortSpec("8000:80")
+	require.NoError(t, err)
+	require.Equal(t, &portforward.PortSpec{LocalPort: 8000, RemotePort: 80}, portSpec)
+}
+
+func TestPortSpecInvalid(t *testing.T) {
+	_, err := portforward.NewPortSpec("")
+	require.Error(t, err)
+
+	_, err = portforward.NewPortSpec("0")
+	require.Error(t, err)
+
+	_, err = portforward.NewPortSpec("1:2:3")
+	require.Error(t, err)
+}

internal/command/root.go

@@ -8,6 +8,7 @@ import (
 	"github.com/cirruslabs/orchard/internal/command/dev"
 	"github.com/cirruslabs/orchard/internal/command/get"
 	"github.com/cirruslabs/orchard/internal/command/list"
+	"github.com/cirruslabs/orchard/internal/command/portforward"
 	"github.com/cirruslabs/orchard/internal/command/stop"
 	"github.com/cirruslabs/orchard/internal/command/worker"
 	"github.com/spf13/cobra"
@@ -24,6 +25,7 @@ func NewRootCmd() *cobra.Command {
 		create.NewCommand(),
 		get.NewCommand(),
 		list.NewCommand(),
+		portforward.NewCommand(),
 		deletepkg.NewCommand(),
 		stop.NewCommand(),
 	)

internal/config/context.go

@@ -4,7 +4,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
-	"github.com/cirruslabs/orchard/internal/controller"
+	"github.com/cirruslabs/orchard/internal/netconstants"
 )
 
 type Context struct {
@@ -27,7 +27,7 @@ func (context *Context) TLSConfig() (*tls.Config, error) {
 
 	return &tls.Config{
 		MinVersion: tls.VersionTLS13,
-		ServerName: controller.DefaultServerName,
+		ServerName: netconstants.DefaultControllerServerName,
 		RootCAs:    privatePool,
 	}, nil
 }

internal/config/handle.go

@@ -3,7 +3,7 @@ package config
 import (
 	"errors"
 	"fmt"
-	"github.com/cirruslabs/orchard/internal/controller"
+	"github.com/cirruslabs/orchard/internal/netconstants"
 	"github.com/cirruslabs/orchard/internal/orchardhome"
 	"github.com/gofrs/flock"
 	"gopkg.in/yaml.v3"
@@ -106,7 +106,7 @@ func (handle *Handle) DefaultContext() (Context, error) {
 	defaultContext, ok := config.RetrieveDefaultContext()
 	if !ok {
 		defaultContext = Context{
-			URL: fmt.Sprintf("http://127.0.0.1:%d", controller.DefaultPort),
+			URL: fmt.Sprintf("http://127.0.0.1:%d", netconstants.DefaultControllerPort),
 		}
 
 		config.SetContext("default", defaultContext)

internal/controller/api.go

@@ -1,17 +1,23 @@
 package controller
 
 import (
+	"context"
 	"crypto/subtle"
+	"errors"
 	storepkg "github.com/cirruslabs/orchard/internal/controller/store"
 	"github.com/cirruslabs/orchard/internal/responder"
+	"github.com/cirruslabs/orchard/pkg/client"
 	v1pkg "github.com/cirruslabs/orchard/pkg/resource/v1"
 	"github.com/deckarep/golang-set/v2"
 	"github.com/gin-gonic/gin"
+	"google.golang.org/grpc/metadata"
 	"net/http"
 )
 
 const ctxServiceAccountKey = "service-account"
 
+var ErrUnauthorized = errors.New("unauthorized")
+
 func (controller *Controller) initAPI() *gin.Engine {
 	gin.SetMode(gin.DebugMode)
 	ginEngine := gin.Default()
@@ -74,6 +80,9 @@ func (controller *Controller) initAPI() *gin.Engine {
 	v1.GET("/vms", func(c *gin.Context) {
 		controller.listVMs(c).Respond(c)
 	})
+	v1.GET("/vms/:name/port-forward", func(c *gin.Context) {
+		controller.portForwardVM(c).Respond(c)
+	})
 	v1.DELETE("/vms/:name", func(c *gin.Context) {
 		controller.deleteVM(c).Respond(c)
 	})
@@ -87,6 +96,33 @@ func (controller *Controller) initAPI() *gin.Engine {
 	return ginEngine
 }
 
+func (controller *Controller) fetchServiceAccount(name string, token string) (*v1pkg.ServiceAccount, error) {
+	var serviceAccount *v1pkg.ServiceAccount
+	var err error
+
+	err = controller.store.View(func(txn storepkg.Transaction) error {
+		serviceAccount, err = txn.GetServiceAccount(name)
+		if err != nil {
+			return err
+		}
+
+		return nil
+	})
+	if err != nil {
+		if errors.Is(err, storepkg.ErrNotFound) {
+			return nil, ErrUnauthorized
+		}
+
+		return nil, err
+	}
+
+	if subtle.ConstantTimeCompare([]byte(serviceAccount.Token), []byte(token)) == 0 {
+		return nil, ErrUnauthorized
+	}
+
+	return serviceAccount, nil
+}
+
 func (controller *Controller) authenticateMiddleware(c *gin.Context) {
 	// Retrieve presented credentials (if any)
 	user, password, ok := c.Request.BasicAuth()
@@ -96,35 +132,14 @@ func (controller *Controller) authenticateMiddleware(c *gin.Context) {
 		return
 	}
 
-	// Authenticate
+	serviceAccount, err := controller.fetchServiceAccount(user, password)
-	var serviceAccount *v1pkg.ServiceAccount
-	var err error
-
-	err = controller.store.View(func(txn storepkg.Transaction) error {
-		serviceAccount, err = txn.GetServiceAccount(user)
-		if err != nil {
-			return err
-		}
-
-		return nil
-	})
 	if err != nil {
+		if errors.Is(err, ErrUnauthorized) {
+			responder.Code(http.StatusUnauthorized).Respond(c)
+		} else {
 			responder.Error(err).Respond(c)
-
-		return
 		}
 
-	// No such service account found
-	if serviceAccount == nil {
-		responder.Code(http.StatusUnauthorized).Respond(c)
-
-		return
-	}
-
-	// Service account's token provided is not valid
-	if subtle.ConstantTimeCompare([]byte(serviceAccount.Token), []byte(password)) == 0 {
-		responder.Code(http.StatusUnauthorized).Respond(c)
-
 		return
 	}
 
@@ -149,6 +164,28 @@ func (controller *Controller) authorize(ctx *gin.Context, scopes ...v1pkg.Servic
 	return mapset.NewSet[v1pkg.ServiceAccountRole](serviceAccount.Roles...).Contains(scopes...)
 }
 
+func (controller *Controller) authorizeGRPC(ctx context.Context, scopes ...v1pkg.ServiceAccountRole) bool {
+	if controller.insecureAuthDisabled {
+		return true
+	}
+
+	name := metadata.ValueFromIncomingContext(ctx, client.MetadataServiceAccountNameKey)
+	if len(name) != 1 {
+		return false
+	}
+	token := metadata.ValueFromIncomingContext(ctx, client.MetadataServiceAccountTokenKey)
+	if len(token) != 1 {
+		return false
+	}
+
+	serviceAccount, err := controller.fetchServiceAccount(name[0], token[0])
+	if err != nil {
+		return false
+	}
+
+	return mapset.NewSet[v1pkg.ServiceAccountRole](serviceAccount.Roles...).Contains(scopes...)
+}
+
 type storeTransactionFunc func(operation func(txn storepkg.Transaction) error) error
 
 func (controller *Controller) storeView(view func(txn storepkg.Transaction) responder.Responder) responder.Responder {

internal/controller/api_vms_portforward.go

@@ -0,0 +1,85 @@
+package controller
+
+import (
+	storepkg "github.com/cirruslabs/orchard/internal/controller/store"
+	"github.com/cirruslabs/orchard/internal/proxy"
+	"github.com/cirruslabs/orchard/internal/responder"
+	v1 "github.com/cirruslabs/orchard/pkg/resource/v1"
+	"github.com/cirruslabs/orchard/rpc"
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"golang.org/x/net/websocket"
+	"net/http"
+	"strconv"
+)
+
+func (controller *Controller) portForwardVM(ctx *gin.Context) responder.Responder {
+	if !controller.authorize(ctx, v1.ServiceAccountRoleComputeWrite) {
+		return responder.Code(http.StatusUnauthorized)
+	}
+
+	// Retrieve and parse path and query parameters
+	name := ctx.Param("name")
+
+	portRaw := ctx.Query("port")
+	port, err := strconv.ParseUint(portRaw, 10, 16)
+	if err != nil {
+		return responder.Code(http.StatusBadRequest)
+	}
+	if port < 1 || port > 65535 {
+		return responder.Code(http.StatusBadRequest)
+	}
+
+	// Look-up the VM
+	var vm *v1.VM
+
+	if responder := controller.storeView(func(txn storepkg.Transaction) responder.Responder {
+		vm, err = txn.GetVM(name)
+		if err != nil {
+			return responder.Error(err)
+		}
+
+		return nil
+	}); responder != nil {
+		return responder
+	}
+
+	// Sanity-check
+	if vm.Worker == "" {
+		return responder.Code(http.StatusServiceUnavailable)
+	}
+
+	// Request and wait for a rendez-vous with a worker
+	token := uuid.New().String()
+
+	rendezvousConnCh, cancel := controller.proxy.Request(ctx, token)
+	defer cancel()
+
+	err = controller.watcher.Notify(ctx, vm.Worker, &rpc.WatchFromController{
+		Action: &rpc.WatchFromController_PortForwardAction{
+			PortForwardAction: &rpc.WatchFromController_PortForward{
+				Token:  token,
+				VmUid:  vm.UID,
+				VmPort: uint32(port),
+			},
+		},
+	})
+	if err != nil {
+		controller.logger.Warnf("failed to rendez-vous with the worker %s: %v", vm.Worker, err)
+
+		return responder.Code(http.StatusServiceUnavailable)
+	}
+
+	select {
+	case rendezvousConn := <-rendezvousConnCh:
+		websocket.Handler(func(wsConn *websocket.Conn) {
+			if err := proxy.Connections(wsConn, rendezvousConn); err != nil {
+				controller.logger.Warnf("failed to port-forward: %v", err)
+			}
+		}).ServeHTTP(ctx.Writer, ctx.Request)
+
+		return responder.Empty()
+	case <-ctx.Done():
+		return responder.Error(ctx.Err())
+	}
+}

internal/controller/controller.go

@@ -5,21 +5,23 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
+	"github.com/cirruslabs/orchard/internal/controller/rendezvous"
 	storepkg "github.com/cirruslabs/orchard/internal/controller/store"
 	"github.com/cirruslabs/orchard/internal/controller/store/badger"
+	"github.com/cirruslabs/orchard/internal/netconstants"
 	v1 "github.com/cirruslabs/orchard/pkg/resource/v1"
+	"github.com/cirruslabs/orchard/rpc"
 	"github.com/google/uuid"
 	"go.uber.org/zap"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/h2c"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/keepalive"
 	"net"
 	"net/http"
 	"time"
 )
 
-const (
-	DefaultPort       = 6120
-	DefaultServerName = "orchard-controller"
-)
-
 var (
 	ErrInitFailed      = errors.New("controller initialization failed")
 	ErrAdminTaskFailed = errors.New("controller administrative task failed")
@@ -34,10 +36,18 @@ type Controller struct {
 	insecureAuthDisabled bool
 	store                storepkg.Store
 	logger               *zap.SugaredLogger
+	grpcServer           *grpc.Server
+	watcher              *rendezvous.Watcher
+	proxy                *rendezvous.Proxy
+
+	rpc.UnimplementedControllerServer
 }
 
 func New(opts ...Option) (*Controller, error) {
-	controller := &Controller{}
+	controller := &Controller{
+		watcher: rendezvous.NewWatcher(),
+		proxy:   rendezvous.NewProxy(),
+	}
 
 	// Apply options
 	for _, opt := range opts {
@@ -50,7 +60,7 @@ func New(opts ...Option) (*Controller, error) {
 			ErrInitFailed)
 	}
 	if controller.listenAddr == "" {
-		controller.listenAddr = fmt.Sprintf(":%d", DefaultPort)
+		controller.listenAddr = fmt.Sprintf(":%d", netconstants.DefaultControllerPort)
 	}
 	if controller.logger == nil {
 		controller.logger = zap.NewNop().Sugar()
@@ -73,9 +83,26 @@ func New(opts ...Option) (*Controller, error) {
 		controller.listener = listener
 	}
 
+	apiServer := controller.initAPI()
+
+	controller.grpcServer = grpc.NewServer(
+		grpc.KeepaliveParams(keepalive.ServerParameters{
+			Time: 30 * time.Second,
+		}),
+	)
+	rpc.RegisterControllerServer(controller.grpcServer, controller)
+
+	handler := http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		if request.Header.Get("Content-Type") == "application/grpc" {
+			controller.grpcServer.ServeHTTP(writer, request)
+		} else {
+			apiServer.ServeHTTP(writer, request)
+		}
+	})
+
 	controller.httpServer = &http.Server{
-		Handler:     controller.initAPI(),
+		Handler:     h2c.NewHandler(handler, &http2.Server{}),
-		ReadTimeout: 5 * time.Second,
+		ReadTimeout: 60 * time.Second,
 	}
 
 	return controller, nil

internal/controller/rendezvous/concurrentmap/concurrentmap.go

@@ -0,0 +1,39 @@
+package concurrentmap
+
+import (
+	"sync"
+)
+
+type ConcurrentMap[T any] struct {
+	nonConcurrentMap map[any]T
+	mtx              sync.Mutex
+}
+
+func NewConcurrentMap[T any]() *ConcurrentMap[T] {
+	return &ConcurrentMap[T]{
+		nonConcurrentMap: map[any]T{},
+	}
+}
+
+func (cmap *ConcurrentMap[T]) Load(key any) (T, bool) {
+	cmap.mtx.Lock()
+	defer cmap.mtx.Unlock()
+
+	result, ok := cmap.nonConcurrentMap[key]
+
+	return result, ok
+}
+
+func (cmap *ConcurrentMap[T]) Store(id any, value T) {
+	cmap.mtx.Lock()
+	defer cmap.mtx.Unlock()
+
+	cmap.nonConcurrentMap[id] = value
+}
+
+func (cmap *ConcurrentMap[T]) Delete(key any) {
+	cmap.mtx.Lock()
+	defer cmap.mtx.Unlock()
+
+	delete(cmap.nonConcurrentMap, key)
+}

internal/controller/rendezvous/proxy.go

@@ -0,0 +1,49 @@
+package rendezvous
+
+import (
+	"context"
+	"errors"
+	"github.com/cirruslabs/orchard/internal/controller/rendezvous/concurrentmap"
+	"net"
+)
+
+var ErrInvalidToken = errors.New("invalid proxy token")
+
+type Proxy struct {
+	tokens *concurrentmap.ConcurrentMap[*TokenSlot]
+}
+
+type TokenSlot struct {
+	ctx context.Context
+	ch  chan net.Conn
+}
+
+func NewProxy() *Proxy {
+	return &Proxy{
+		tokens: concurrentmap.NewConcurrentMap[*TokenSlot](),
+	}
+}
+
+func (proxy *Proxy) Request(ctx context.Context, token string) (chan net.Conn, func()) {
+	tokenSlot := &TokenSlot{
+		ctx: ctx,
+		ch:  make(chan net.Conn),
+	}
+
+	proxy.tokens.Store(token, tokenSlot)
+
+	return tokenSlot.ch, func() {
+		proxy.tokens.Delete(token)
+	}
+}
+
+func (proxy *Proxy) Respond(token string, conn net.Conn) (context.Context, error) {
+	tokenSlot, ok := proxy.tokens.Load(token)
+	if !ok {
+		return nil, ErrInvalidToken
+	}
+
+	tokenSlot.ch <- conn
+
+	return tokenSlot.ctx, nil
+}

internal/controller/rendezvous/proxy_test.go

@@ -0,0 +1,39 @@
+package rendezvous_test
+
+import (
+	"context"
+	"github.com/cirruslabs/orchard/internal/controller/rendezvous"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+	"net"
+	"sync"
+	"testing"
+)
+
+func TestProxy(t *testing.T) {
+	ctx := context.Background()
+
+	expectedConn, _ := net.Pipe()
+
+	proxy := rendezvous.NewProxy()
+
+	token := uuid.New().String()
+
+	connCh, cancel := proxy.Request(ctx, token)
+	defer cancel()
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+
+	go func() {
+		_, err := proxy.Respond(token, expectedConn)
+		require.NoError(t, err)
+
+		wg.Done()
+	}()
+
+	actualConn := <-connCh
+	require.Equal(t, expectedConn, actualConn)
+
+	wg.Wait()
+}

internal/controller/rendezvous/watcher.go

@@ -0,0 +1,57 @@
+package rendezvous
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"github.com/cirruslabs/orchard/internal/controller/rendezvous/concurrentmap"
+	"github.com/cirruslabs/orchard/rpc"
+)
+
+var ErrNoWorker = errors.New("no worker registered with this name")
+
+type Watcher struct {
+	workers *concurrentmap.ConcurrentMap[*WorkerSlot]
+}
+
+type WorkerSlot struct {
+	ctx context.Context
+	ch  chan *rpc.WatchFromController
+}
+
+func NewWatcher() *Watcher {
+	return &Watcher{
+		workers: concurrentmap.NewConcurrentMap[*WorkerSlot](),
+	}
+}
+
+func (watcher *Watcher) Subscribe(ctx context.Context, worker string) (chan *rpc.WatchFromController, func()) {
+	subCtx, cancel := context.WithCancel(ctx)
+	workerCh := make(chan *rpc.WatchFromController)
+
+	watcher.workers.Store(worker, &WorkerSlot{
+		ctx: subCtx,
+		ch:  workerCh,
+	})
+
+	return workerCh, func() {
+		watcher.workers.Delete(worker)
+		cancel()
+	}
+}
+
+func (watcher *Watcher) Notify(ctx context.Context, topic string, msg *rpc.WatchFromController) error {
+	slot, ok := watcher.workers.Load(topic)
+	if !ok {
+		return fmt.Errorf("%w: %s", ErrNoWorker, topic)
+	}
+
+	select {
+	case slot.ch <- msg:
+		return nil
+	case <-slot.ctx.Done():
+		return slot.ctx.Err()
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}

internal/controller/rendezvous/watcher_test.go

@@ -0,0 +1,48 @@
+package rendezvous_test
+
+import (
+	"context"
+	"fmt"
+	"github.com/cirruslabs/orchard/internal/controller/rendezvous"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestWatcher(t *testing.T) {
+	ctx := context.Background()
+
+	watcher := rendezvous.NewWatcher()
+
+	var topic = uuid.New().String()
+
+	msgCh, cancel := watcher.Subscribe(context.Background(), topic)
+	defer cancel()
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+
+	go func() {
+		require.NoError(t, watcher.Notify(ctx, topic, nil))
+
+		time.Sleep(time.Second)
+
+		require.NoError(t, watcher.Notify(ctx, topic, nil))
+
+		wg.Done()
+	}()
+
+	fmt.Println("waiting for the message...")
+
+	<-msgCh
+
+	fmt.Println("received first message")
+
+	<-msgCh
+
+	fmt.Println("received second message")
+
+	wg.Wait()
+}

internal/controller/rpc.go

@@ -0,0 +1,93 @@
+package controller
+
+import (
+	v1pkg "github.com/cirruslabs/orchard/pkg/resource/v1"
+	"github.com/cirruslabs/orchard/rpc"
+	//nolint:staticcheck // https://github.com/mitchellh/go-grpc-net-conn/pull/1
+	"github.com/golang/protobuf/proto"
+	grpc_net_conn "github.com/mitchellh/go-grpc-net-conn"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func (controller *Controller) Watch(stream rpc.Controller_WatchServer) error {
+	if !controller.authorizeGRPC(stream.Context(), v1pkg.ServiceAccountRoleWorker) {
+		return status.Errorf(codes.Unauthenticated, "auth failed")
+	}
+
+	// The first message is always an initialization
+	watchFromWorker, err := stream.Recv()
+	if err != nil {
+		return err
+	}
+
+	initAction, ok := watchFromWorker.Action.(*rpc.WatchFromWorker_InitAction)
+	if !ok {
+		return status.Errorf(codes.FailedPrecondition, "expected an initialization message")
+	}
+
+	// Subscribe to rendez-vous requests from the API for this worker
+	workerCh, cancel := controller.watcher.Subscribe(stream.Context(), initAction.InitAction.WorkerUid)
+	defer cancel()
+
+	for {
+		select {
+		case msg := <-workerCh:
+			if err := stream.Send(msg); err != nil {
+				return err
+			}
+		case <-stream.Context().Done():
+			return stream.Context().Err()
+		}
+	}
+}
+
+func (controller *Controller) PortForward(stream rpc.Controller_PortForwardServer) error {
+	if !controller.authorizeGRPC(stream.Context(), v1pkg.ServiceAccountRoleWorker) {
+		return status.Errorf(codes.Unauthenticated, "auth failed")
+	}
+
+	// The first message is always an initialization
+	portForwardFromWorker, err := stream.Recv()
+	if err != nil {
+		return err
+	}
+
+	initAction, ok := portForwardFromWorker.Action.(*rpc.PortForwardFromWorker_InitAction)
+	if !ok {
+		return status.Errorf(codes.FailedPrecondition, "expected an initialization message")
+	}
+
+	// Satisfy the rendez-vous request
+	conn := &grpc_net_conn.Conn{
+		Stream: stream,
+		Request: &rpc.PortForwardFromController{
+			Action: &rpc.PortForwardFromController_DataAction{
+				DataAction: &rpc.PortForwardFromController_Data{},
+			},
+		},
+		Response: &rpc.PortForwardFromWorker{
+			Action: &rpc.PortForwardFromWorker_DataAction{
+				DataAction: &rpc.PortForwardFromWorker_Data{},
+			},
+		},
+		Encode: grpc_net_conn.SimpleEncoder(func(message proto.Message) *[]byte {
+			return &message.(*rpc.PortForwardFromController).Action.(*rpc.PortForwardFromController_DataAction).DataAction.Data
+		}),
+		Decode: grpc_net_conn.SimpleDecoder(func(message proto.Message) *[]byte {
+			return &message.(*rpc.PortForwardFromWorker).Action.(*rpc.PortForwardFromWorker_DataAction).DataAction.Data
+		}),
+	}
+
+	proxyCtx, err := controller.proxy.Respond(initAction.InitAction.Token, conn)
+	if err != nil {
+		return err
+	}
+
+	select {
+	case <-proxyCtx.Done():
+		return proxyCtx.Err()
+	case <-stream.Context().Done():
+		return stream.Context().Err()
+	}
+}

internal/netconstants/netconstants.go

@@ -0,0 +1,6 @@
+package netconstants
+
+const (
+	DefaultControllerPort       = 6120
+	DefaultControllerServerName = "orchard-controller"
+)

internal/proxy/proxy.go

@@ -0,0 +1,34 @@
+package proxy
+
+import (
+	"io"
+	"net"
+)
+
+func Connections(left net.Conn, right net.Conn) error {
+	errCh := make(chan error, 2)
+
+	go func() {
+		_, err := io.Copy(left, right)
+		errCh <- err
+	}()
+
+	go func() {
+		_, err := io.Copy(right, left)
+		errCh <- err
+	}()
+
+	firstErr := <-errCh
+
+	// Force connection closure to unlock the other goroutine
+	left.Close()
+	right.Close()
+
+	secondErr := <-errCh
+
+	if firstErr != nil {
+		return firstErr
+	}
+
+	return secondErr
+}

internal/responder/empty.go

@@ -0,0 +1,13 @@
+package responder
+
+import "github.com/gin-gonic/gin"
+
+type EmptyResponder struct{}
+
+func Empty() *EmptyResponder {
+	return &EmptyResponder{}
+}
+
+func (responder *EmptyResponder) Respond(c *gin.Context) {
+	// do nothing
+}

internal/worker/rpc.go

@@ -0,0 +1,140 @@
+package worker
+
+import (
+	"context"
+	"fmt"
+	"github.com/cirruslabs/orchard/internal/proxy"
+	v1 "github.com/cirruslabs/orchard/pkg/resource/v1"
+	"github.com/cirruslabs/orchard/rpc"
+	"google.golang.org/grpc/keepalive"
+	"time"
+
+	//nolint:staticcheck // https://github.com/mitchellh/go-grpc-net-conn/pull/1
+	"github.com/golang/protobuf/proto"
+	grpc_net_conn "github.com/mitchellh/go-grpc-net-conn"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+	"net"
+)
+
+func (worker *Worker) watchRPC(ctx context.Context) error {
+	conn, err := grpc.Dial(worker.client.GRPCTarget(),
+		grpc.WithTransportCredentials(worker.client.GRPCTransportCredentials()),
+		grpc.WithKeepaliveParams(keepalive.ClientParameters{
+			Time: 30 * time.Second,
+		}),
+	)
+	if err != nil {
+		return err
+	}
+
+	client := rpc.NewControllerClient(conn)
+
+	ctxWithMetadata := metadata.NewOutgoingContext(ctx, worker.client.GPRCMetadata())
+
+	stream, err := client.Watch(ctxWithMetadata)
+	if err != nil {
+		return err
+	}
+
+	if err := stream.Send(&rpc.WatchFromWorker{
+		Action: &rpc.WatchFromWorker_InitAction{
+			InitAction: &rpc.WatchFromWorker_Init{
+				WorkerUid: worker.name,
+			},
+		},
+	}); err != nil {
+		return err
+	}
+
+	for {
+		watchFromController, err := stream.Recv()
+		if err != nil {
+			return err
+		}
+
+		portForwardAction, ok := watchFromController.Action.(*rpc.WatchFromController_PortForwardAction)
+		if !ok {
+			continue
+		}
+
+		go worker.handlePortForward(ctxWithMetadata, client, portForwardAction.PortForwardAction)
+	}
+}
+
+func (worker *Worker) handlePortForward(
+	ctx context.Context,
+	client rpc.ControllerClient,
+	portForwardAction *rpc.WatchFromController_PortForward,
+) {
+	subCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	stream, err := client.PortForward(subCtx)
+	if err != nil {
+		worker.logger.Warnf("port forwarding failed: failed to call PortForward() RPC method: %v", err)
+
+		return
+	}
+
+	if err := stream.Send(&rpc.PortForwardFromWorker{
+		Action: &rpc.PortForwardFromWorker_InitAction{
+			InitAction: &rpc.PortForwardFromWorker_Init{
+				Token: portForwardAction.Token,
+			},
+		},
+	}); err != nil {
+		return
+	}
+
+	// Obtain VM
+	vm, err := worker.vmm.Get(v1.VM{
+		Meta: v1.Meta{
+			UID: portForwardAction.VmUid,
+		},
+	})
+	if err != nil {
+		worker.logger.Warnf("port forwarding failed: failed to get the VM: %v", err)
+
+		return
+	}
+
+	// Obtain VM's IP address
+	ip, err := vm.IP(ctx)
+	if err != nil {
+		worker.logger.Warnf("port forwarding failed: failed to get VM's IP: %v", err)
+
+		return
+	}
+
+	// Connect to the VM's port
+	vmConn, err := net.Dial("tcp", fmt.Sprintf("%s:%d", ip, portForwardAction.VmPort))
+	if err != nil {
+		worker.logger.Warnf("port forwarding failed: failed to connect to the VM: %v", err)
+
+		return
+	}
+
+	// Proxy bytes
+	grpcConn := &grpc_net_conn.Conn{
+		Stream: stream,
+		Request: &rpc.PortForwardFromWorker{
+			Action: &rpc.PortForwardFromWorker_DataAction{
+				DataAction: &rpc.PortForwardFromWorker_Data{},
+			},
+		},
+		Response: &rpc.PortForwardFromController{
+			Action: &rpc.PortForwardFromController_DataAction{
+				DataAction: &rpc.PortForwardFromController_Data{},
+			},
+		},
+		Encode: grpc_net_conn.SimpleEncoder(func(message proto.Message) *[]byte {
+			return &message.(*rpc.PortForwardFromWorker).Action.(*rpc.PortForwardFromWorker_DataAction).DataAction.Data
+		}),
+		Decode: grpc_net_conn.SimpleDecoder(func(message proto.Message) *[]byte {
+			return &message.(*rpc.PortForwardFromController).Action.(*rpc.PortForwardFromController_DataAction).DataAction.Data
+		}),
+	}
+
+	_ = proxy.Connections(vmConn, grpcConn)
+}

internal/worker/vmmanager/vm.go

@@ -6,6 +6,7 @@ import (
 	"github.com/cirruslabs/orchard/pkg/resource/v1"
 	"go.uber.org/zap"
 	"strconv"
+	"strings"
 	"sync"
 )
 
@@ -89,6 +90,15 @@ func (vm *VM) run(ctx context.Context) error {
 	return nil
 }
 
+func (vm *VM) IP(ctx context.Context) (string, error) {
+	stdout, _, err := Tart(ctx, "ip", vm.id)
+	if err != nil {
+		return "", err
+	}
+
+	return strings.TrimSpace(stdout), nil
+}
+
 func (vm *VM) Stop() error {
 	_, _, _ = Tart(context.Background(), "stop", vm.id)
 

internal/worker/worker.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"github.com/avast/retry-go/v4"
 	"github.com/cirruslabs/orchard/internal/worker/vmmanager"
 	"github.com/cirruslabs/orchard/pkg/client"
 	v1 "github.com/cirruslabs/orchard/pkg/resource/v1"
@@ -62,6 +63,14 @@ func New(opts ...Option) (*Worker, error) {
 func (worker *Worker) Run(ctx context.Context) error {
 	tickCh := time.NewTicker(pollInterval)
 
+	go func() {
+		_ = retry.Do(func() error {
+			return worker.watchRPC(ctx)
+		}, retry.OnRetry(func(n uint, err error) {
+			worker.logger.Warnf("failed to watch RPC: %v", err)
+		}), retry.Context(ctx), retry.Attempts(0))
+	}()
+
 	for {
 		if err := worker.registerWorker(ctx); err != nil {
 			worker.logger.Warnf("failed to register worker: %v", err)

pkg/client/client.go

@@ -4,15 +4,25 @@ import (
 	"bytes"
 	"context"
 	"crypto/tls"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"github.com/cirruslabs/orchard/internal/config"
+	"golang.org/x/net/websocket"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
 	"io"
 	"net/http"
 	"net/url"
 )
 
+const MetadataServiceAccountNameKey = "x-orchard-service-account-name"
+
+//nolint:gosec // G101 check yields a false-positive here, this is not a hard-coded credential
+const MetadataServiceAccountTokenKey = "x-orchard-service-account-token"
+
 var (
 	ErrFailed       = errors.New("API client failed")
 	ErrInvalidState = errors.New("invalid state")
@@ -20,6 +30,7 @@ var (
 
 type Client struct {
 	address   string
+	insecure  bool
 	tlsConfig *tls.Config
 
 	httpClient *http.Client
@@ -78,9 +89,46 @@ func New(opts ...Option) (*Client, error) {
 	}
 	client.baseURL = url
 
+	// Figure out if HTTP (insecure) or HTTPS (secure) was requested,
+	// so we can further adapt for gRPC and WebSocket usage patterns
+	switch client.baseURL.Scheme {
+	case "http":
+		client.insecure = true
+	case "https":
+		// do nothing, we're secure by default
+	default:
+		return nil, fmt.Errorf("%w: only http https schemes are supported, got %s",
+			ErrFailed, client.baseURL.Scheme)
+	}
+
 	return client, nil
 }
 
+func (client *Client) GRPCTarget() string {
+	return client.baseURL.Host
+}
+
+func (client *Client) GRPCTransportCredentials() credentials.TransportCredentials {
+	if client.insecure {
+		return insecure.NewCredentials()
+	}
+
+	return credentials.NewTLS(client.tlsConfig)
+}
+
+func (client *Client) GPRCMetadata() metadata.MD {
+	result := map[string]string{}
+
+	if client.serviceAccountName != "" && client.serviceAccountToken != "" {
+		result = map[string]string{
+			MetadataServiceAccountNameKey:  client.serviceAccountName,
+			MetadataServiceAccountTokenKey: client.serviceAccountToken,
+		}
+	}
+
+	return metadata.New(result)
+}
+
 func (client *Client) request(
 	ctx context.Context,
 	method string,
@@ -100,17 +148,9 @@ func (client *Client) request(
 		body = bytes.NewBuffer(jsonBytes)
 	}
 
-	endpointURL, err := url.Parse("v1/" + path)
+	endpointURL, err := client.parsePath(path)
 	if err != nil {
-		return fmt.Errorf("%w to parse API endpoint path: %v", ErrFailed, err)
+		return err
-	}
-
-	endpointURL = &url.URL{
-		Scheme:  client.baseURL.Scheme,
-		User:    client.baseURL.User,
-		Host:    client.baseURL.Host,
-		Path:    endpointURL.Path,
-		RawPath: endpointURL.RawPath,
 	}
 
 	values := endpointURL.Query()
@@ -155,6 +195,60 @@ func (client *Client) request(
 	return nil
 }
 
+func (client *Client) wsRequest(
+	_ context.Context,
+	path string,
+	params map[string]string,
+) (*websocket.Conn, error) {
+	endpointURL, err := client.parsePath(path)
+	if err != nil {
+		return nil, err
+	}
+
+	// Adapt HTTP scheme to WebSocket scheme
+	if client.insecure {
+		endpointURL.Scheme = "ws"
+	} else {
+		endpointURL.Scheme = "wss"
+	}
+
+	values := endpointURL.Query()
+	for key, value := range params {
+		values.Set(key, value)
+	}
+	endpointURL.RawQuery = values.Encode()
+
+	config, err := websocket.NewConfig(endpointURL.String(), "http://127.0.0.1/")
+	if err != nil {
+		return nil, fmt.Errorf("%w to create WebSocket configuration: %v", ErrFailed, err)
+	}
+
+	if client.serviceAccountName != "" && client.serviceAccountToken != "" {
+		authPlain := fmt.Sprintf("%s:%s", client.serviceAccountName, client.serviceAccountToken)
+		authEncoded := base64.StdEncoding.EncodeToString([]byte(authPlain))
+		config.Header.Add("Authorization", fmt.Sprintf("Basic %s", authEncoded))
+	}
+
+	config.TlsConfig = client.tlsConfig
+
+	return websocket.DialConfig(config)
+}
+
+func (client *Client) parsePath(path string) (*url.URL, error) {
+	endpointURL, err := url.Parse("v1/" + path)
+	if err != nil {
+		return nil, fmt.Errorf("%w to parse API endpoint path: %v", ErrFailed, err)
+	}
+
+	return &url.URL{
+		Scheme:  client.baseURL.Scheme,
+		User:    client.baseURL.User,
+		Host:    client.baseURL.Host,
+		Path:    endpointURL.Path,
+		RawPath: endpointURL.RawPath,
+	}, nil
+}
+
 func (client *Client) Check(ctx context.Context) error {
 	return client.request(ctx, http.MethodGet, "/", nil, nil, nil)
 }

pkg/client/vms.go

@@ -4,7 +4,9 @@ import (
 	"context"
 	"fmt"
 	"github.com/cirruslabs/orchard/pkg/resource/v1"
+	"golang.org/x/net/websocket"
 	"net/http"
+	"strconv"
 )
 
 type VMsService struct {
@@ -96,3 +98,8 @@ func (service *VMsService) Delete(ctx context.Context, name string) error {
 
 	return nil
 }
+
+func (service *VMsService) PortForward(ctx context.Context, name string, port uint16) (*websocket.Conn, error) {
+	return service.client.wsRequest(ctx, fmt.Sprintf("vms/%s/port-forward", name),
+		map[string]string{"port": strconv.FormatUint(uint64(port), 10)})
+}

rpc/orchard.pb.go

@@ -0,0 +1,804 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: orchard.proto
+
+package rpc
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type WatchFromWorker struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Action:
+	//
+	//	*WatchFromWorker_InitAction
+	Action isWatchFromWorker_Action `protobuf_oneof:"action"`
+}
+
+func (x *WatchFromWorker) Reset() {
+	*x = WatchFromWorker{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_orchard_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WatchFromWorker) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WatchFromWorker) ProtoMessage() {}
+
+func (x *WatchFromWorker) ProtoReflect() protoreflect.Message {
+	mi := &file_orchard_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WatchFromWorker.ProtoReflect.Descriptor instead.
+func (*WatchFromWorker) Descriptor() ([]byte, []int) {
+	return file_orchard_proto_rawDescGZIP(), []int{0}
+}
+
+func (m *WatchFromWorker) GetAction() isWatchFromWorker_Action {
+	if m != nil {
+		return m.Action
+	}
+	return nil
+}
+
+func (x *WatchFromWorker) GetInitAction() *WatchFromWorker_Init {
+	if x, ok := x.GetAction().(*WatchFromWorker_InitAction); ok {
+		return x.InitAction
+	}
+	return nil
+}
+
+type isWatchFromWorker_Action interface {
+	isWatchFromWorker_Action()
+}
+
+type WatchFromWorker_InitAction struct {
+	InitAction *WatchFromWorker_Init `protobuf:"bytes,1,opt,name=init_action,json=initAction,proto3,oneof"`
+}
+
+func (*WatchFromWorker_InitAction) isWatchFromWorker_Action() {}
+
+type WatchFromController struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Action:
+	//
+	//	*WatchFromController_PortForwardAction
+	Action isWatchFromController_Action `protobuf_oneof:"action"`
+}
+
+func (x *WatchFromController) Reset() {
+	*x = WatchFromController{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_orchard_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WatchFromController) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WatchFromController) ProtoMessage() {}
+
+func (x *WatchFromController) ProtoReflect() protoreflect.Message {
+	mi := &file_orchard_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WatchFromController.ProtoReflect.Descriptor instead.
+func (*WatchFromController) Descriptor() ([]byte, []int) {
+	return file_orchard_proto_rawDescGZIP(), []int{1}
+}
+
+func (m *WatchFromController) GetAction() isWatchFromController_Action {
+	if m != nil {
+		return m.Action
+	}
+	return nil
+}
+
+func (x *WatchFromController) GetPortForwardAction() *WatchFromController_PortForward {
+	if x, ok := x.GetAction().(*WatchFromController_PortForwardAction); ok {
+		return x.PortForwardAction
+	}
+	return nil
+}
+
+type isWatchFromController_Action interface {
+	isWatchFromController_Action()
+}
+
+type WatchFromController_PortForwardAction struct {
+	PortForwardAction *WatchFromController_PortForward `protobuf:"bytes,1,opt,name=port_forward_action,json=portForwardAction,proto3,oneof"`
+}
+
+func (*WatchFromController_PortForwardAction) isWatchFromController_Action() {}
+
+type PortForwardFromWorker struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Action:
+	//
+	//	*PortForwardFromWorker_InitAction
+	//	*PortForwardFromWorker_DataAction
+	Action isPortForwardFromWorker_Action `protobuf_oneof:"action"`
+}
+
+func (x *PortForwardFromWorker) Reset() {
+	*x = PortForwardFromWorker{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_orchard_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PortForwardFromWorker) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PortForwardFromWorker) ProtoMessage() {}
+
+func (x *PortForwardFromWorker) ProtoReflect() protoreflect.Message {
+	mi := &file_orchard_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PortForwardFromWorker.ProtoReflect.Descriptor instead.
+func (*PortForwardFromWorker) Descriptor() ([]byte, []int) {
+	return file_orchard_proto_rawDescGZIP(), []int{2}
+}
+
+func (m *PortForwardFromWorker) GetAction() isPortForwardFromWorker_Action {
+	if m != nil {
+		return m.Action
+	}
+	return nil
+}
+
+func (x *PortForwardFromWorker) GetInitAction() *PortForwardFromWorker_Init {
+	if x, ok := x.GetAction().(*PortForwardFromWorker_InitAction); ok {
+		return x.InitAction
+	}
+	return nil
+}
+
+func (x *PortForwardFromWorker) GetDataAction() *PortForwardFromWorker_Data {
+	if x, ok := x.GetAction().(*PortForwardFromWorker_DataAction); ok {
+		return x.DataAction
+	}
+	return nil
+}
+
+type isPortForwardFromWorker_Action interface {
+	isPortForwardFromWorker_Action()
+}
+
+type PortForwardFromWorker_InitAction struct {
+	InitAction *PortForwardFromWorker_Init `protobuf:"bytes,1,opt,name=init_action,json=initAction,proto3,oneof"`
+}
+
+type PortForwardFromWorker_DataAction struct {
+	DataAction *PortForwardFromWorker_Data `protobuf:"bytes,2,opt,name=data_action,json=dataAction,proto3,oneof"`
+}
+
+func (*PortForwardFromWorker_InitAction) isPortForwardFromWorker_Action() {}
+
+func (*PortForwardFromWorker_DataAction) isPortForwardFromWorker_Action() {}
+
+type PortForwardFromController struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Action:
+	//
+	//	*PortForwardFromController_DataAction
+	Action isPortForwardFromController_Action `protobuf_oneof:"action"`
+}
+
+func (x *PortForwardFromController) Reset() {
+	*x = PortForwardFromController{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_orchard_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PortForwardFromController) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PortForwardFromController) ProtoMessage() {}
+
+func (x *PortForwardFromController) ProtoReflect() protoreflect.Message {
+	mi := &file_orchard_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PortForwardFromController.ProtoReflect.Descriptor instead.
+func (*PortForwardFromController) Descriptor() ([]byte, []int) {
+	return file_orchard_proto_rawDescGZIP(), []int{3}
+}
+
+func (m *PortForwardFromController) GetAction() isPortForwardFromController_Action {
+	if m != nil {
+		return m.Action
+	}
+	return nil
+}
+
+func (x *PortForwardFromController) GetDataAction() *PortForwardFromController_Data {
+	if x, ok := x.GetAction().(*PortForwardFromController_DataAction); ok {
+		return x.DataAction
+	}
+	return nil
+}
+
+type isPortForwardFromController_Action interface {
+	isPortForwardFromController_Action()
+}
+
+type PortForwardFromController_DataAction struct {
+	DataAction *PortForwardFromController_Data `protobuf:"bytes,1,opt,name=data_action,json=dataAction,proto3,oneof"`
+}
+
+func (*PortForwardFromController_DataAction) isPortForwardFromController_Action() {}
+
+type WatchFromWorker_Init struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	WorkerUid string `protobuf:"bytes,1,opt,name=worker_uid,json=workerUid,proto3" json:"worker_uid,omitempty"`
+}
+
+func (x *WatchFromWorker_Init) Reset() {
+	*x = WatchFromWorker_Init{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_orchard_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WatchFromWorker_Init) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WatchFromWorker_Init) ProtoMessage() {}
+
+func (x *WatchFromWorker_Init) ProtoReflect() protoreflect.Message {
+	mi := &file_orchard_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WatchFromWorker_Init.ProtoReflect.Descriptor instead.
+func (*WatchFromWorker_Init) Descriptor() ([]byte, []int) {
+	return file_orchard_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *WatchFromWorker_Init) GetWorkerUid() string {
+	if x != nil {
+		return x.WorkerUid
+	}
+	return ""
+}
+
+type WatchFromController_PortForward struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Token  string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+	VmUid  string `protobuf:"bytes,2,opt,name=vm_uid,json=vmUid,proto3" json:"vm_uid,omitempty"`
+	VmPort uint32 `protobuf:"varint,3,opt,name=vm_port,json=vmPort,proto3" json:"vm_port,omitempty"`
+}
+
+func (x *WatchFromController_PortForward) Reset() {
+	*x = WatchFromController_PortForward{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_orchard_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WatchFromController_PortForward) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WatchFromController_PortForward) ProtoMessage() {}
+
+func (x *WatchFromController_PortForward) ProtoReflect() protoreflect.Message {
+	mi := &file_orchard_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WatchFromController_PortForward.ProtoReflect.Descriptor instead.
+func (*WatchFromController_PortForward) Descriptor() ([]byte, []int) {
+	return file_orchard_proto_rawDescGZIP(), []int{1, 0}
+}
+
+func (x *WatchFromController_PortForward) GetToken() string {
+	if x != nil {
+		return x.Token
+	}
+	return ""
+}
+
+func (x *WatchFromController_PortForward) GetVmUid() string {
+	if x != nil {
+		return x.VmUid
+	}
+	return ""
+}
+
+func (x *WatchFromController_PortForward) GetVmPort() uint32 {
+	if x != nil {
+		return x.VmPort
+	}
+	return 0
+}
+
+type PortForwardFromWorker_Init struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+}
+
+func (x *PortForwardFromWorker_Init) Reset() {
+	*x = PortForwardFromWorker_Init{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_orchard_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PortForwardFromWorker_Init) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PortForwardFromWorker_Init) ProtoMessage() {}
+
+func (x *PortForwardFromWorker_Init) ProtoReflect() protoreflect.Message {
+	mi := &file_orchard_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PortForwardFromWorker_Init.ProtoReflect.Descriptor instead.
+func (*PortForwardFromWorker_Init) Descriptor() ([]byte, []int) {
+	return file_orchard_proto_rawDescGZIP(), []int{2, 0}
+}
+
+func (x *PortForwardFromWorker_Init) GetToken() string {
+	if x != nil {
+		return x.Token
+	}
+	return ""
+}
+
+type PortForwardFromWorker_Data struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *PortForwardFromWorker_Data) Reset() {
+	*x = PortForwardFromWorker_Data{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_orchard_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PortForwardFromWorker_Data) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PortForwardFromWorker_Data) ProtoMessage() {}
+
+func (x *PortForwardFromWorker_Data) ProtoReflect() protoreflect.Message {
+	mi := &file_orchard_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PortForwardFromWorker_Data.ProtoReflect.Descriptor instead.
+func (*PortForwardFromWorker_Data) Descriptor() ([]byte, []int) {
+	return file_orchard_proto_rawDescGZIP(), []int{2, 1}
+}
+
+func (x *PortForwardFromWorker_Data) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+type PortForwardFromController_Data struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *PortForwardFromController_Data) Reset() {
+	*x = PortForwardFromController_Data{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_orchard_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PortForwardFromController_Data) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PortForwardFromController_Data) ProtoMessage() {}
+
+func (x *PortForwardFromController_Data) ProtoReflect() protoreflect.Message {
+	mi := &file_orchard_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PortForwardFromController_Data.ProtoReflect.Descriptor instead.
+func (*PortForwardFromController_Data) Descriptor() ([]byte, []int) {
+	return file_orchard_proto_rawDescGZIP(), []int{3, 0}
+}
+
+func (x *PortForwardFromController_Data) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+var File_orchard_proto protoreflect.FileDescriptor
+
+var file_orchard_proto_rawDesc = []byte{
+	0x0a, 0x0d, 0x6f, 0x72, 0x63, 0x68, 0x61, 0x72, 0x64, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
+	0x7c, 0x0a, 0x0f, 0x57, 0x61, 0x74, 0x63, 0x68, 0x46, 0x72, 0x6f, 0x6d, 0x57, 0x6f, 0x72, 0x6b,
+	0x65, 0x72, 0x12, 0x38, 0x0a, 0x0b, 0x69, 0x6e, 0x69, 0x74, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x46,
+	0x72, 0x6f, 0x6d, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x2e, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00,
+	0x52, 0x0a, 0x69, 0x6e, 0x69, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0x25, 0x0a, 0x04,
+	0x49, 0x6e, 0x69, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x75,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72,
+	0x55, 0x69, 0x64, 0x42, 0x08, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xc8, 0x01,
+	0x0a, 0x13, 0x57, 0x61, 0x74, 0x63, 0x68, 0x46, 0x72, 0x6f, 0x6d, 0x43, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x12, 0x52, 0x0a, 0x13, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x66, 0x6f,
+	0x72, 0x77, 0x61, 0x72, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x20, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x46, 0x72, 0x6f, 0x6d, 0x43, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72,
+	0x77, 0x61, 0x72, 0x64, 0x48, 0x00, 0x52, 0x11, 0x70, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77,
+	0x61, 0x72, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0x53, 0x0a, 0x0b, 0x50, 0x6f, 0x72,
+	0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x15,
+	0x0a, 0x06, 0x76, 0x6d, 0x5f, 0x75, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x76, 0x6d, 0x55, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x76, 0x6d, 0x5f, 0x70, 0x6f, 0x72, 0x74,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x06, 0x76, 0x6d, 0x50, 0x6f, 0x72, 0x74, 0x42, 0x08,
+	0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xdb, 0x01, 0x0a, 0x15, 0x50, 0x6f, 0x72,
+	0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x46, 0x72, 0x6f, 0x6d, 0x57, 0x6f, 0x72, 0x6b,
+	0x65, 0x72, 0x12, 0x3e, 0x0a, 0x0b, 0x69, 0x6e, 0x69, 0x74, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f,
+	0x72, 0x77, 0x61, 0x72, 0x64, 0x46, 0x72, 0x6f, 0x6d, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x2e,
+	0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52, 0x0a, 0x69, 0x6e, 0x69, 0x74, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x12, 0x3e, 0x0a, 0x0b, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f,
+	0x72, 0x77, 0x61, 0x72, 0x64, 0x46, 0x72, 0x6f, 0x6d, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x2e,
+	0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x0a, 0x64, 0x61, 0x74, 0x61, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x1a, 0x1c, 0x0a, 0x04, 0x49, 0x6e, 0x69, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
+	0x1a, 0x1a, 0x0a, 0x04, 0x44, 0x61, 0x74, 0x61, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x42, 0x08, 0x0a, 0x06,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x85, 0x01, 0x0a, 0x19, 0x50, 0x6f, 0x72, 0x74, 0x46,
+	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x46, 0x72, 0x6f, 0x6d, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x6c, 0x6c, 0x65, 0x72, 0x12, 0x42, 0x0a, 0x0b, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x50, 0x6f, 0x72, 0x74,
+	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x46, 0x72, 0x6f, 0x6d, 0x43, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x0a, 0x64, 0x61,
+	0x74, 0x61, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0x1a, 0x0a, 0x04, 0x44, 0x61, 0x74, 0x61,
+	0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04,
+	0x64, 0x61, 0x74, 0x61, 0x42, 0x08, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x32, 0x88,
+	0x01, 0x0a, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x12, 0x33, 0x0a,
+	0x05, 0x57, 0x61, 0x74, 0x63, 0x68, 0x12, 0x10, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x46, 0x72,
+	0x6f, 0x6d, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x1a, 0x14, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68,
+	0x46, 0x72, 0x6f, 0x6d, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x28, 0x01,
+	0x30, 0x01, 0x12, 0x45, 0x0a, 0x0b, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72,
+	0x64, 0x12, 0x16, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x46,
+	0x72, 0x6f, 0x6d, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x1a, 0x1a, 0x2e, 0x50, 0x6f, 0x72, 0x74,
+	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x46, 0x72, 0x6f, 0x6d, 0x43, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x28, 0x01, 0x30, 0x01, 0x42, 0x23, 0x5a, 0x21, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x69, 0x72, 0x72, 0x75, 0x73, 0x6c, 0x61,
+	0x62, 0x73, 0x2f, 0x6f, 0x72, 0x63, 0x68, 0x61, 0x72, 0x64, 0x2f, 0x72, 0x70, 0x63, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_orchard_proto_rawDescOnce sync.Once
+	file_orchard_proto_rawDescData = file_orchard_proto_rawDesc
+)
+
+func file_orchard_proto_rawDescGZIP() []byte {
+	file_orchard_proto_rawDescOnce.Do(func() {
+		file_orchard_proto_rawDescData = protoimpl.X.CompressGZIP(file_orchard_proto_rawDescData)
+	})
+	return file_orchard_proto_rawDescData
+}
+
+var file_orchard_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_orchard_proto_goTypes = []interface{}{
+	(*WatchFromWorker)(nil),                 // 0: WatchFromWorker
+	(*WatchFromController)(nil),             // 1: WatchFromController
+	(*PortForwardFromWorker)(nil),           // 2: PortForwardFromWorker
+	(*PortForwardFromController)(nil),       // 3: PortForwardFromController
+	(*WatchFromWorker_Init)(nil),            // 4: WatchFromWorker.Init
+	(*WatchFromController_PortForward)(nil), // 5: WatchFromController.PortForward
+	(*PortForwardFromWorker_Init)(nil),      // 6: PortForwardFromWorker.Init
+	(*PortForwardFromWorker_Data)(nil),      // 7: PortForwardFromWorker.Data
+	(*PortForwardFromController_Data)(nil),  // 8: PortForwardFromController.Data
+}
+var file_orchard_proto_depIdxs = []int32{
+	4, // 0: WatchFromWorker.init_action:type_name -> WatchFromWorker.Init
+	5, // 1: WatchFromController.port_forward_action:type_name -> WatchFromController.PortForward
+	6, // 2: PortForwardFromWorker.init_action:type_name -> PortForwardFromWorker.Init
+	7, // 3: PortForwardFromWorker.data_action:type_name -> PortForwardFromWorker.Data
+	8, // 4: PortForwardFromController.data_action:type_name -> PortForwardFromController.Data
+	0, // 5: Controller.Watch:input_type -> WatchFromWorker
+	2, // 6: Controller.PortForward:input_type -> PortForwardFromWorker
+	1, // 7: Controller.Watch:output_type -> WatchFromController
+	3, // 8: Controller.PortForward:output_type -> PortForwardFromController
+	7, // [7:9] is the sub-list for method output_type
+	5, // [5:7] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_orchard_proto_init() }
+func file_orchard_proto_init() {
+	if File_orchard_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_orchard_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WatchFromWorker); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_orchard_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WatchFromController); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_orchard_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PortForwardFromWorker); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_orchard_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PortForwardFromController); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_orchard_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WatchFromWorker_Init); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_orchard_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WatchFromController_PortForward); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_orchard_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PortForwardFromWorker_Init); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_orchard_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PortForwardFromWorker_Data); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_orchard_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PortForwardFromController_Data); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_orchard_proto_msgTypes[0].OneofWrappers = []interface{}{
+		(*WatchFromWorker_InitAction)(nil),
+	}
+	file_orchard_proto_msgTypes[1].OneofWrappers = []interface{}{
+		(*WatchFromController_PortForwardAction)(nil),
+	}
+	file_orchard_proto_msgTypes[2].OneofWrappers = []interface{}{
+		(*PortForwardFromWorker_InitAction)(nil),
+		(*PortForwardFromWorker_DataAction)(nil),
+	}
+	file_orchard_proto_msgTypes[3].OneofWrappers = []interface{}{
+		(*PortForwardFromController_DataAction)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_orchard_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   9,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_orchard_proto_goTypes,
+		DependencyIndexes: file_orchard_proto_depIdxs,
+		MessageInfos:      file_orchard_proto_msgTypes,
+	}.Build()
+	File_orchard_proto = out.File
+	file_orchard_proto_rawDesc = nil
+	file_orchard_proto_goTypes = nil
+	file_orchard_proto_depIdxs = nil
+}

rpc/orchard.proto

@@ -0,0 +1,55 @@
+syntax = "proto3";
+
+option go_package = "github.com/cirruslabs/orchard/rpc";
+
+service Controller {
+  rpc Watch(stream WatchFromWorker) returns (stream WatchFromController);
+  rpc PortForward(stream PortForwardFromWorker) returns (stream PortForwardFromController);
+}
+
+message WatchFromWorker {
+  message Init {
+    string worker_uid = 1;
+  }
+
+  oneof action {
+    Init init_action = 1;
+  }
+}
+
+message WatchFromController {
+  message PortForward {
+    string token = 1;
+    string vm_uid = 2;
+    uint32 vm_port = 3;
+  }
+
+  oneof action {
+    PortForward port_forward_action = 1;
+  }
+}
+
+message PortForwardFromWorker {
+  message Init {
+    string token = 1;
+  }
+
+  message Data {
+    bytes data = 1;
+  }
+
+  oneof action {
+    Init init_action = 1;
+    Data data_action = 2;
+  }
+}
+
+message PortForwardFromController {
+  message Data {
+    bytes data = 1;
+  }
+
+  oneof action {
+    Data data_action = 1;
+  }
+}

rpc/orchard_grpc.pb.go

@@ -0,0 +1,210 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: orchard.proto
+
+package rpc
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	Controller_Watch_FullMethodName       = "/Controller/Watch"
+	Controller_PortForward_FullMethodName = "/Controller/PortForward"
+)
+
+// ControllerClient is the client API for Controller service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ControllerClient interface {
+	Watch(ctx context.Context, opts ...grpc.CallOption) (Controller_WatchClient, error)
+	PortForward(ctx context.Context, opts ...grpc.CallOption) (Controller_PortForwardClient, error)
+}
+
+type controllerClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewControllerClient(cc grpc.ClientConnInterface) ControllerClient {
+	return &controllerClient{cc}
+}
+
+func (c *controllerClient) Watch(ctx context.Context, opts ...grpc.CallOption) (Controller_WatchClient, error) {
+	stream, err := c.cc.NewStream(ctx, &Controller_ServiceDesc.Streams[0], Controller_Watch_FullMethodName, opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &controllerWatchClient{stream}
+	return x, nil
+}
+
+type Controller_WatchClient interface {
+	Send(*WatchFromWorker) error
+	Recv() (*WatchFromController, error)
+	grpc.ClientStream
+}
+
+type controllerWatchClient struct {
+	grpc.ClientStream
+}
+
+func (x *controllerWatchClient) Send(m *WatchFromWorker) error {
+	return x.ClientStream.SendMsg(m)
+}
+
+func (x *controllerWatchClient) Recv() (*WatchFromController, error) {
+	m := new(WatchFromController)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (c *controllerClient) PortForward(ctx context.Context, opts ...grpc.CallOption) (Controller_PortForwardClient, error) {
+	stream, err := c.cc.NewStream(ctx, &Controller_ServiceDesc.Streams[1], Controller_PortForward_FullMethodName, opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &controllerPortForwardClient{stream}
+	return x, nil
+}
+
+type Controller_PortForwardClient interface {
+	Send(*PortForwardFromWorker) error
+	Recv() (*PortForwardFromController, error)
+	grpc.ClientStream
+}
+
+type controllerPortForwardClient struct {
+	grpc.ClientStream
+}
+
+func (x *controllerPortForwardClient) Send(m *PortForwardFromWorker) error {
+	return x.ClientStream.SendMsg(m)
+}
+
+func (x *controllerPortForwardClient) Recv() (*PortForwardFromController, error) {
+	m := new(PortForwardFromController)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// ControllerServer is the server API for Controller service.
+// All implementations must embed UnimplementedControllerServer
+// for forward compatibility
+type ControllerServer interface {
+	Watch(Controller_WatchServer) error
+	PortForward(Controller_PortForwardServer) error
+	mustEmbedUnimplementedControllerServer()
+}
+
+// UnimplementedControllerServer must be embedded to have forward compatible implementations.
+type UnimplementedControllerServer struct {
+}
+
+func (UnimplementedControllerServer) Watch(Controller_WatchServer) error {
+	return status.Errorf(codes.Unimplemented, "method Watch not implemented")
+}
+func (UnimplementedControllerServer) PortForward(Controller_PortForwardServer) error {
+	return status.Errorf(codes.Unimplemented, "method PortForward not implemented")
+}
+func (UnimplementedControllerServer) mustEmbedUnimplementedControllerServer() {}
+
+// UnsafeControllerServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ControllerServer will
+// result in compilation errors.
+type UnsafeControllerServer interface {
+	mustEmbedUnimplementedControllerServer()
+}
+
+func RegisterControllerServer(s grpc.ServiceRegistrar, srv ControllerServer) {
+	s.RegisterService(&Controller_ServiceDesc, srv)
+}
+
+func _Controller_Watch_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(ControllerServer).Watch(&controllerWatchServer{stream})
+}
+
+type Controller_WatchServer interface {
+	Send(*WatchFromController) error
+	Recv() (*WatchFromWorker, error)
+	grpc.ServerStream
+}
+
+type controllerWatchServer struct {
+	grpc.ServerStream
+}
+
+func (x *controllerWatchServer) Send(m *WatchFromController) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+func (x *controllerWatchServer) Recv() (*WatchFromWorker, error) {
+	m := new(WatchFromWorker)
+	if err := x.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func _Controller_PortForward_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(ControllerServer).PortForward(&controllerPortForwardServer{stream})
+}
+
+type Controller_PortForwardServer interface {
+	Send(*PortForwardFromController) error
+	Recv() (*PortForwardFromWorker, error)
+	grpc.ServerStream
+}
+
+type controllerPortForwardServer struct {
+	grpc.ServerStream
+}
+
+func (x *controllerPortForwardServer) Send(m *PortForwardFromController) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+func (x *controllerPortForwardServer) Recv() (*PortForwardFromWorker, error) {
+	m := new(PortForwardFromWorker)
+	if err := x.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// Controller_ServiceDesc is the grpc.ServiceDesc for Controller service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Controller_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "Controller",
+	HandlerType: (*ControllerServer)(nil),
+	Methods:     []grpc.MethodDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "Watch",
+			Handler:       _Controller_Watch_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+		{
+			StreamName:    "PortForward",
+			Handler:       _Controller_PortForward_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+	},
+	Metadata: "orchard.proto",
+}