diff --git a/api/credentialstores/option.gen.go b/api/credentialstores/option.gen.go
index 60d32bbd27..d025a7ec74 100644
--- a/api/credentialstores/option.gen.go
+++ b/api/credentialstores/option.gen.go
@@ -290,3 +290,27 @@ func WithVaultCredentialStoreToken(inToken string) Option {
 		o.postMap["attributes"] = val
 	}
 }
+
+func WithVaultCredentialStoreWorkerFilter(inWorkerFilter string) Option {
+	return func(o *options) {
+		raw, ok := o.postMap["attributes"]
+		if !ok {
+			raw = interface{}(map[string]interface{}{})
+		}
+		val := raw.(map[string]interface{})
+		val["worker_filter"] = inWorkerFilter
+		o.postMap["attributes"] = val
+	}
+}
+
+func DefaultVaultCredentialStoreWorkerFilter() Option {
+	return func(o *options) {
+		raw, ok := o.postMap["attributes"]
+		if !ok {
+			raw = interface{}(map[string]interface{}{})
+		}
+		val := raw.(map[string]interface{})
+		val["worker_filter"] = nil
+		o.postMap["attributes"] = val
+	}
+}
diff --git a/api/credentialstores/vault_credential_store_attributes.gen.go b/api/credentialstores/vault_credential_store_attributes.gen.go
index 81ce70dc9a..a3a27a7138 100644
--- a/api/credentialstores/vault_credential_store_attributes.gen.go
+++ b/api/credentialstores/vault_credential_store_attributes.gen.go
@@ -12,4 +12,5 @@ type VaultCredentialStoreAttributes struct {
 	ClientCertificate        string `json:"client_certificate,omitempty"`
 	ClientCertificateKey     string `json:"client_certificate_key,omitempty"`
 	ClientCertificateKeyHmac string `json:"client_certificate_key_hmac,omitempty"`
+	WorkerFilter             string `json:"worker_filter,omitempty"`
 }
diff --git a/internal/cmd/commands/credentialstorescmd/funcs.go b/internal/cmd/commands/credentialstorescmd/funcs.go
index 5c3e7c7a05..11b0e74c29 100644
--- a/internal/cmd/commands/credentialstorescmd/funcs.go
+++ b/internal/cmd/commands/credentialstorescmd/funcs.go
@@ -207,4 +207,5 @@ var keySubstMap = map[string]string{
 	"token_hmac":                  "Token HMAC",
 	"client_certificate":          "Client Certificate",
 	"client_certificate_key_hmac": "Client Certificate Key HMAC",
+	"worker_filter":               "Worker Filter",
 }
diff --git a/internal/cmd/commands/credentialstorescmd/vault_funcs.go b/internal/cmd/commands/credentialstorescmd/vault_funcs.go
index 897bd3db7a..1b7e17e5f3 100644
--- a/internal/cmd/commands/credentialstorescmd/vault_funcs.go
+++ b/internal/cmd/commands/credentialstorescmd/vault_funcs.go
@@ -1,8 +1,11 @@
 package credentialstorescmd
 
 import (
+	"fmt"
+
 	"github.com/hashicorp/boundary/api/credentialstores"
 	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/go-bexpr"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 )
 
@@ -21,6 +24,7 @@ const (
 	vaultTokenFlagName           = "vault-token"
 	clientCertificateFlagName    = "vault-client-certificate"
 	clientCertificateKeyFlagName = "vault-client-certificate-key"
+	workerFilterFlagName         = "vault-worker-filter"
 )
 
 type extraVaultCmdVars struct {
@@ -32,6 +36,7 @@ type extraVaultCmdVars struct {
 	flagClientCertKey string
 	flagTlsServerName string
 	flagTlsSkipVerify bool
+	flagWorkerFilter  string
 }
 
 func extraVaultActionsFlagsMapFuncImpl() map[string][]string {
@@ -45,6 +50,7 @@ func extraVaultActionsFlagsMapFuncImpl() map[string][]string {
 			vaultTokenFlagName,
 			clientCertificateFlagName,
 			clientCertificateKeyFlagName,
+			workerFilterFlagName,
 		},
 	}
 	flags["update"] = flags["create"]
@@ -104,6 +110,12 @@ func extraVaultFlagsFuncImpl(c *VaultCommand, set *base.FlagSets, _ *base.FlagSe
 				Target: &c.flagClientCertKey,
 				Usage:  `The client certificate's private key to use when boundary connects to vault for this store. This can be the value itself, refer to a file on disk (file://) from which the value will be read, or an env var (env://) from which the value will be read.`,
 			})
+		case workerFilterFlagName:
+			f.StringVar(&base.StringVar{
+				Name:   workerFilterFlagName,
+				Target: &c.flagWorkerFilter,
+				Usage:  `A boolean expression to filter which workers can handle Vault commands for this credential store.`,
+			})
 		}
 	}
 }
@@ -150,6 +162,17 @@ func extraVaultFlagHandlingFuncImpl(c *VaultCommand, f *base.FlagSets, opts *[]c
 		cer, _ := parseutil.ParsePath(c.flagClientCert)
 		*opts = append(*opts, credentialstores.WithVaultCredentialStoreClientCertificateKey(cer))
 	}
+	switch c.flagWorkerFilter {
+	case "":
+	case "null":
+		*opts = append(*opts, credentialstores.DefaultVaultCredentialStoreWorkerFilter())
+	default:
+		if _, err := bexpr.CreateEvaluator(c.flagWorkerFilter); err != nil {
+			c.UI.Error(fmt.Sprintf("Unable to successfully parse filter expression: %s", err))
+			return false
+		}
+		*opts = append(*opts, credentialstores.WithVaultCredentialStoreWorkerFilter(c.flagWorkerFilter))
+	}
 	if c.flagTlsSkipVerify {
 		*opts = append(*opts, credentialstores.WithVaultCredentialStoreTlsSkipVerify(c.flagTlsSkipVerify))
 	}
diff --git a/internal/credential/vault/credential_store.go b/internal/credential/vault/credential_store.go
index 3809cce211..b792e59616 100644
--- a/internal/credential/vault/credential_store.go
+++ b/internal/credential/vault/credential_store.go
@@ -25,7 +25,7 @@ type CredentialStore struct {
 
 // NewCredentialStore creates a new in memory CredentialStore for a Vault
 // server at vaultAddress assigned to scopeId. Name, description, CA cert,
-// client cert, namespace, TLS server name, and TLS skip verify are the
+// client cert, namespace, TLS server name, worker filter, and TLS skip verify are the
 // only valid options. All other options are ignored.
 func NewCredentialStore(scopeId string, vaultAddress string, token TokenSecret, opt ...Option) (*CredentialStore, error) {
 	opts := getOpts(opt...)
@@ -41,6 +41,7 @@ func NewCredentialStore(scopeId string, vaultAddress string, token TokenSecret,
 			Namespace:     opts.withNamespace,
 			TlsServerName: opts.withTlsServerName,
 			TlsSkipVerify: opts.withTlsSkipVerify,
+			WorkerFilter:  opts.withWorkerFilter,
 		},
 	}
 	return cs, nil
@@ -109,6 +110,8 @@ func (cs *CredentialStore) applyUpdate(new *CredentialStore, fieldMaskPaths []st
 			cp.TlsSkipVerify = new.TlsSkipVerify
 		case strings.EqualFold(tokenField, f):
 			cp.inputToken = new.inputToken
+		case strings.EqualFold(workerFilterField, f):
+			cp.WorkerFilter = new.WorkerFilter
 		}
 	}
 	return cp
diff --git a/internal/credential/vault/fields.go b/internal/credential/vault/fields.go
index 42826fdb6a..a3fab73000 100644
--- a/internal/credential/vault/fields.go
+++ b/internal/credential/vault/fields.go
@@ -17,6 +17,7 @@ const (
 	tlsServerNameField  = "TlsServerName"
 	tlsSkipVerifyField  = "TlsSkipVerify"
 	tokenField          = "Token"
+	workerFilterField   = "WorkerFilter"
 
 	// MappingOverrideField represents the field mask indicating a mapping override
 	// update has been requested.
diff --git a/internal/credential/vault/options.go b/internal/credential/vault/options.go
index 9c57ac8593..3e80c6f56e 100644
--- a/internal/credential/vault/options.go
+++ b/internal/credential/vault/options.go
@@ -23,6 +23,7 @@ type options struct {
 	withNamespace      string
 	withTlsServerName  string
 	withTlsSkipVerify  bool
+	withWorkerFilter   string
 	withClientCert     *ClientCertificate
 	withMethod         Method
 	withRequestBody    []byte
@@ -52,6 +53,13 @@ func WithName(name string) Option {
 	}
 }
 
+// WithWorkerFilter provides an optional worker filter.
+func WithWorkerFilter(filter string) Option {
+	return func(o *options) {
+		o.withWorkerFilter = filter
+	}
+}
+
 // WithLimit provides an option to provide a limit. Intentionally allowing
 // negative integers. If WithLimit < 0, then unlimited results are
 // returned. If WithLimit == 0, then default limits are used for results.
diff --git a/internal/credential/vault/options_test.go b/internal/credential/vault/options_test.go
index b2a13e48ba..ea6dd2ff73 100644
--- a/internal/credential/vault/options_test.go
+++ b/internal/credential/vault/options_test.go
@@ -22,6 +22,12 @@ func Test_GetOpts(t *testing.T) {
 		testOpts.withDescription = "test desc"
 		assert.Equal(t, opts, testOpts)
 	})
+	t.Run("WithWorkerFilter", func(t *testing.T) {
+		opts := getOpts(WithWorkerFilter("test filter"))
+		testOpts := getDefaultOptions()
+		testOpts.withWorkerFilter = "test filter"
+		assert.Equal(t, opts, testOpts)
+	})
 	t.Run("WithLimit", func(t *testing.T) {
 		opts := getOpts(WithLimit(5))
 		testOpts := getDefaultOptions()
diff --git a/internal/credential/vault/private_credential.go b/internal/credential/vault/private_credential.go
index 6b705a0531..a64fec5b95 100644
--- a/internal/credential/vault/private_credential.go
+++ b/internal/credential/vault/private_credential.go
@@ -39,6 +39,7 @@ type privateCredential struct {
 	CaCert               []byte
 	TlsServerName        string
 	TlsSkipVerify        bool
+	WorkerFilter         string
 	ClientCert           []byte
 	ClientKey            KeySecret
 	CtClientKey          []byte
diff --git a/internal/credential/vault/private_library.go b/internal/credential/vault/private_library.go
index f5a5b05940..75c83f7ea9 100644
--- a/internal/credential/vault/private_library.go
+++ b/internal/credential/vault/private_library.go
@@ -150,6 +150,7 @@ type privateLibrary struct {
 	CaCert              []byte
 	TlsServerName       string
 	TlsSkipVerify       bool
+	WorkerFilter        string
 	TokenHmac           []byte
 	Token               TokenSecret
 	CtToken             []byte
@@ -185,6 +186,7 @@ func (pl *privateLibrary) clone() *privateLibrary {
 		CaCert:              append(pl.CaCert[:0:0], pl.CaCert...),
 		TlsServerName:       pl.TlsServerName,
 		TlsSkipVerify:       pl.TlsSkipVerify,
+		WorkerFilter:        pl.WorkerFilter,
 		TokenHmac:           append(pl.TokenHmac[:0:0], pl.TokenHmac...),
 		Token:               append(pl.Token[:0:0], pl.Token...),
 		CtToken:             append(pl.CtToken[:0:0], pl.CtToken...),
diff --git a/internal/credential/vault/private_store.go b/internal/credential/vault/private_store.go
index a106a1f806..2ff3a433b8 100644
--- a/internal/credential/vault/private_store.go
+++ b/internal/credential/vault/private_store.go
@@ -78,6 +78,7 @@ type privateStore struct {
 	CaCert               []byte
 	TlsServerName        string
 	TlsSkipVerify        bool
+	WorkerFilter         string
 	StoreId              string
 	TokenHmac            []byte
 	Token                TokenSecret
@@ -115,6 +116,7 @@ func (ps *privateStore) toCredentialStore() *CredentialStore {
 	cs.CaCert = ps.CaCert
 	cs.TlsServerName = ps.TlsServerName
 	cs.TlsSkipVerify = ps.TlsSkipVerify
+	cs.WorkerFilter = ps.WorkerFilter
 	cs.privateToken = ps.token()
 	if ps.ClientCert != nil {
 		cert := allocClientCertificate()
diff --git a/internal/credential/vault/repository_credential_store.go b/internal/credential/vault/repository_credential_store.go
index 8ba3d3e27a..609bb884c2 100644
--- a/internal/credential/vault/repository_credential_store.go
+++ b/internal/credential/vault/repository_credential_store.go
@@ -273,6 +273,7 @@ type publicStore struct {
 	CaCert               []byte
 	TlsServerName        string
 	TlsSkipVerify        bool
+	WorkerFilter         string
 	TokenHmac            []byte
 	TokenCreateTime      *timestamp.Timestamp
 	TokenUpdateTime      *timestamp.Timestamp
@@ -300,6 +301,7 @@ func (ps *publicStore) toCredentialStore() *CredentialStore {
 	cs.CaCert = ps.CaCert
 	cs.TlsServerName = ps.TlsServerName
 	cs.TlsSkipVerify = ps.TlsSkipVerify
+	cs.WorkerFilter = ps.WorkerFilter
 
 	if ps.TokenHmac != nil {
 		tk := allocToken()
@@ -333,7 +335,7 @@ func (ps *publicStore) GetPublicId() string { return ps.PublicId }
 //
 // cs must contain a valid PublicId. Only Name, Description, Namespace,
 // TlsServerName, TlsSkipVerify, CaCert, VaultAddress, ClientCertificate,
-// ClientCertificateKey, and Token can be changed. If cs.Name is set to a
+// ClientCertificateKey, workerFilter, and Token can be changed. If cs.Name is set to a
 // non-empty string, it must be unique within cs.ScopeId. If Token is changed,
 // the new token must have the same properties defined in CreateCredentialStore
 // and UpdateCredentialStore calls the same Vault endpoints described in
@@ -368,6 +370,7 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
 		case strings.EqualFold(namespaceField, f):
 		case strings.EqualFold(tlsServerNameField, f):
 		case strings.EqualFold(tlsSkipVerifyField, f):
+		case strings.EqualFold(workerFilterField, f):
 		case strings.EqualFold(caCertField, f):
 		case strings.EqualFold(vaultAddressField, f):
 			validateToken = true
@@ -389,6 +392,7 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
 			namespaceField:     cs.Namespace,
 			tlsServerNameField: cs.TlsServerName,
 			tlsSkipVerifyField: cs.TlsSkipVerify,
+			workerFilterField:  cs.WorkerFilter,
 			caCertField:        cs.CaCert,
 			vaultAddressField:  cs.VaultAddress,
 			tokenField:         cs.inputToken,
diff --git a/internal/credential/vault/repository_credential_store_test.go b/internal/credential/vault/repository_credential_store_test.go
index 213aa68654..8336ac9fb6 100644
--- a/internal/credential/vault/repository_credential_store_test.go
+++ b/internal/credential/vault/repository_credential_store_test.go
@@ -358,6 +358,13 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
 		}
 	}
 
+	changeWorkerFilter := func(wf string) func(*CredentialStore) *CredentialStore {
+		return func(cs *CredentialStore) *CredentialStore {
+			cs.WorkerFilter = wf
+			return cs
+		}
+	}
+
 	makeNil := func() func(*CredentialStore) *CredentialStore {
 		return func(cs *CredentialStore) *CredentialStore {
 			return nil
@@ -505,19 +512,37 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
 			wantCount: 1,
 		},
 		{
-			name: "change-name-and-description",
+			name: "change-worker-filter",
 			orig: &CredentialStore{
 				CredentialStore: &store.CredentialStore{
-					Name:        "test-name-repo",
-					Description: "test-description-repo",
+					WorkerFilter: "test-workerfilter",
 				},
 			},
-			chgFn: combine(changeDescription("test-update-description-repo"), changeName("test-update-name-repo")),
+			chgFn: changeWorkerFilter("test-update-worker-filter"),
+			masks: []string{"WorkerFilter"},
+			want: &CredentialStore{
+				CredentialStore: &store.CredentialStore{
+					WorkerFilter: "test-update-worker-filter",
+				},
+			},
+			wantCount: 1,
+		},
+		{
+			name: "change-name-and-description-and-workerfilter",
+			orig: &CredentialStore{
+				CredentialStore: &store.CredentialStore{
+					Name:         "test-name-repo",
+					Description:  "test-description-repo",
+					WorkerFilter: "test-workerfilter",
+				},
+			},
+			chgFn: combine(changeDescription("test-update-description-repo"), changeName("test-update-name-repo"), changeWorkerFilter("test-update-worker-filter")),
 			masks: []string{"Name", "Description"},
 			want: &CredentialStore{
 				CredentialStore: &store.CredentialStore{
-					Name:        "test-update-name-repo",
-					Description: "test-update-description-repo",
+					Name:         "test-update-name-repo",
+					Description:  "test-update-description-repo",
+					WorkerFilter: "test-update-worker-filter",
 				},
 			},
 			wantCount: 1,
@@ -526,8 +551,9 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
 			name: "delete-name",
 			orig: &CredentialStore{
 				CredentialStore: &store.CredentialStore{
-					Name:        "test-name-repo",
-					Description: "test-description-repo",
+					Name:         "test-name-repo",
+					Description:  "test-description-repo",
+					WorkerFilter: "test-workerfilter",
 				},
 			},
 			masks: []string{"Name"},
@@ -543,8 +569,9 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
 			name: "delete-description",
 			orig: &CredentialStore{
 				CredentialStore: &store.CredentialStore{
-					Name:        "test-name-repo",
-					Description: "test-description-repo",
+					Name:         "test-name-repo",
+					Description:  "test-description-repo",
+					WorkerFilter: "test-workerfilter",
 				},
 			},
 			masks: []string{"Description"},
@@ -556,6 +583,26 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
 			},
 			wantCount: 1,
 		},
+		{
+			name: "delete-workerfilter",
+			orig: &CredentialStore{
+				CredentialStore: &store.CredentialStore{
+					Name:         "test-name-repo",
+					Description:  "test-description-repo",
+					WorkerFilter: "test-workerfilter",
+				},
+			},
+			masks: []string{"WorkerFilter"},
+			chgFn: combine(changeDescription("test-update-description-repo"), changeName("test-update-name-repo"),
+				changeWorkerFilter("")),
+			want: &CredentialStore{
+				CredentialStore: &store.CredentialStore{
+					Name:        "test-name-repo",
+					Description: "test-description-repo",
+				},
+			},
+			wantCount: 1,
+		},
 		{
 			name: "do-not-delete-name",
 			orig: &CredentialStore{
diff --git a/internal/credential/vault/store/vault.pb.go b/internal/credential/vault/store/vault.pb.go
index d327687f3c..b0629d3820 100644
--- a/internal/credential/vault/store/vault.pb.go
+++ b/internal/credential/vault/store/vault.pb.go
@@ -79,6 +79,9 @@ type CredentialStore struct {
 	// transmissions to and from the Vault server.
 	// @inject_tag: `gorm:"default:false"`
 	TlsSkipVerify bool `protobuf:"varint,13,opt,name=tls_skip_verify,json=tlsSkipVerify,proto3" json:"tls_skip_verify,omitempty" gorm:"default:false"`
+	// worker_filter is optional. Filters to the worker(s) who can handle Vault requests for this cred store
+	// @inject_tag: `gorm:"default:null"`
+	WorkerFilter string `protobuf:"bytes,14,opt,name=worker_filter,json=workerFilter,proto3" json:"worker_filter,omitempty" gorm:"default:null"`
 }
 
 func (x *CredentialStore) Reset() {
@@ -204,6 +207,13 @@ func (x *CredentialStore) GetTlsSkipVerify() bool {
 	return false
 }
 
+func (x *CredentialStore) GetWorkerFilter() string {
+	if x != nil {
+		return x.WorkerFilter
+	}
+	return ""
+}
+
 type Token struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -964,7 +974,7 @@ var file_controller_storage_credential_vault_store_v1_vault_proto_rawDesc = []by
 	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
 	0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
 	0x6d, 0x70, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xb1, 0x06, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x84, 0x07, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e,
 	0x74, 0x69, 0x61, 0x6c, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62,
 	0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75,
 	0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
@@ -1015,162 +1025,167 @@ var file_controller_storage_credential_vault_store_v1_vault_proto_rawDesc = []by
 	0x0d, 0x54, 0x6c, 0x73, 0x53, 0x6b, 0x69, 0x70, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x12, 0x1a,
 	0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x74, 0x6c, 0x73, 0x5f, 0x73,
 	0x6b, 0x69, 0x70, 0x5f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x52, 0x0d, 0x74, 0x6c, 0x73, 0x53,
-	0x6b, 0x69, 0x70, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x22, 0x87, 0x04, 0x0a, 0x05, 0x54, 0x6f,
-	0x6b, 0x65, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x68, 0x6d, 0x61,
-	0x63, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x48, 0x6d,
-	0x61, 0x63, 0x12, 0x33, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0c, 0x42, 0x1d, 0xc2, 0xdd, 0x29, 0x19, 0x0a, 0x05, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x10,
-	0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
-	0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x63, 0x74, 0x5f, 0x74, 0x6f,
-	0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x63, 0x74, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x4b, 0x0a,
-	0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01,
+	0x6b, 0x69, 0x70, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x12, 0x51, 0x0a, 0x0d, 0x77, 0x6f, 0x72,
+	0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x09,
+	0x42, 0x2c, 0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69,
+	0x6c, 0x74, 0x65, 0x72, 0x12, 0x18, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
+	0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0c,
+	0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x22, 0x87, 0x04, 0x0a,
+	0x05, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f,
+	0x68, 0x6d, 0x61, 0x63, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x33, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0c, 0x42, 0x1d, 0xc2, 0xdd, 0x29, 0x19, 0x0a, 0x05, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x12, 0x10, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x63, 0x74,
+	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x63, 0x74,
+	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64,
+	0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
+	0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a,
+	0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01,
 	0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
 	0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
 	0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a,
-	0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f,
-	0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76,
-	0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x56, 0x0a, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x5f,
-	0x72, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
-	0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
-	0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0f,
-	0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c, 0x54, 0x69, 0x6d, 0x65, 0x12,
-	0x53, 0x0a, 0x0f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x69,
-	0x6d, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
-	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x52, 0x0e, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x54, 0x69, 0x6d, 0x65, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x0a,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x73,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61,
-	0x74, 0x75, 0x73, 0x22, 0xdc, 0x02, 0x0a, 0x11, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65,
-	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x49, 0x64, 0x12, 0x52, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
-	0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x30, 0xc2, 0xdd, 0x29, 0x2c, 0x0a,
-	0x0b, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x1d, 0x61, 0x74,
-	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f,
-	0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x0b, 0x63, 0x65, 0x72,
-	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x60, 0x0a, 0x0f, 0x63, 0x65, 0x72, 0x74,
-	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0c, 0x42, 0x37, 0xc2, 0xdd, 0x29, 0x33, 0x0a, 0x0e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
-	0x74, 0x65, 0x73, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69,
-	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x52, 0x0e, 0x63, 0x65, 0x72, 0x74,
-	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x74,
-	0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x10, 0x63, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x31, 0x0a, 0x14, 0x63, 0x65, 0x72, 0x74,
-	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x68, 0x6d, 0x61, 0x63,
-	0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x12, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x15, 0x0a, 0x06, 0x6b,
-	0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79,
-	0x49, 0x64, 0x22, 0xfd, 0x04, 0x0a, 0x11, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
-	0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c,
-	0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f,
-	0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e,
+	0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x56, 0x0a, 0x11, 0x6c, 0x61,
+	0x73, 0x74, 0x5f, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18,
+	0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
+	0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x52, 0x0f, 0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c, 0x54, 0x69,
+	0x6d, 0x65, 0x12, 0x53, 0x0a, 0x0f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
+	0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0e, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69,
+	0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x16,
+	0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xdc, 0x02, 0x0a, 0x11, 0x43, 0x6c, 0x69, 0x65, 0x6e,
+	0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x19, 0x0a, 0x08,
+	0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x52, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x30, 0xc2, 0xdd,
+	0x29, 0x2c, 0x0a, 0x0b, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12,
+	0x1d, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x0b,
+	0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x60, 0x0a, 0x0f, 0x63,
+	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0c, 0x42, 0x37, 0xc2, 0xdd, 0x29, 0x33, 0x0a, 0x0e, 0x43, 0x65, 0x72, 0x74,
+	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x61, 0x74, 0x74, 0x72,
+	0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x52, 0x0e, 0x63,
+	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x2c, 0x0a,
+	0x12, 0x63, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f,
+	0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x10, 0x63, 0x74, 0x43, 0x65, 0x72,
+	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x31, 0x0a, 0x14, 0x63,
+	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x68,
+	0x6d, 0x61, 0x63, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x12, 0x63, 0x65, 0x72, 0x74,
+	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x15,
+	0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x6b, 0x65, 0x79, 0x49, 0x64, 0x22, 0xfd, 0x04, 0x0a, 0x11, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x70,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61,
+	0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f,
+	0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e,
 	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e,
 	0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d,
-	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69,
-	0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d,
-	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
-	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d,
-	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74,
-	0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12,
-	0x24, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x42, 0x10, 0xc2,
-	0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x40, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x42, 0x1e, 0xc2, 0xdd, 0x29, 0x1a,
-	0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64,
-	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63,
-	0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20,
-	0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x3f, 0x0a, 0x0a,
-	0x76, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09,
-	0x42, 0x20, 0xc2, 0xdd, 0x29, 0x1c, 0x0a, 0x09, 0x56, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x61, 0x74,
-	0x68, 0x12, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x61,
-	0x74, 0x68, 0x52, 0x09, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x61, 0x74, 0x68, 0x12, 0x49, 0x0a,
-	0x0b, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x09, 0x20, 0x01,
-	0x28, 0x09, 0x42, 0x28, 0xc2, 0xdd, 0x29, 0x24, 0x0a, 0x0a, 0x48, 0x74, 0x74, 0x70, 0x4d, 0x65,
-	0x74, 0x68, 0x6f, 0x64, 0x12, 0x16, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
-	0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52, 0x0a, 0x68, 0x74,
-	0x74, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x5f, 0x0a, 0x11, 0x68, 0x74, 0x74, 0x70,
-	0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x62, 0x6f, 0x64, 0x79, 0x18, 0x0a, 0x20,
-	0x01, 0x28, 0x0c, 0x42, 0x33, 0xc2, 0xdd, 0x29, 0x2f, 0x0a, 0x0f, 0x48, 0x74, 0x74, 0x70, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x1c, 0x61, 0x74, 0x74, 0x72,
-	0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x72, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x5f, 0x62, 0x6f, 0x64, 0x79, 0x52, 0x0f, 0x68, 0x74, 0x74, 0x70, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x72, 0x65,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x0b, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x54, 0x79,
-	0x70, 0x65, 0x22, 0xc3, 0x04, 0x0a, 0x0a, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
-	0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x1d,
-	0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x49, 0x64, 0x12, 0x1d, 0x0a,
-	0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x09, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x4b, 0x0a, 0x0b, 0x63,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x69,
+	0x6d, 0x65, 0x12, 0x24, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
+	0x42, 0x10, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x40, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x42, 0x1e, 0xc2,
+	0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64,
+	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x74,
+	0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x74,
+	0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x3f, 0x0a, 0x0a, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x08, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0x20, 0xc2, 0xdd, 0x29, 0x1c, 0x0a, 0x09, 0x56, 0x61, 0x75, 0x6c, 0x74,
+	0x50, 0x61, 0x74, 0x68, 0x12, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
+	0x2e, 0x70, 0x61, 0x74, 0x68, 0x52, 0x09, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x61, 0x74, 0x68,
+	0x12, 0x49, 0x0a, 0x0b, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x09, 0x42, 0x28, 0xc2, 0xdd, 0x29, 0x24, 0x0a, 0x0a, 0x48, 0x74, 0x74,
+	0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x16, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
+	0x74, 0x65, 0x73, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52,
+	0x0a, 0x68, 0x74, 0x74, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x5f, 0x0a, 0x11, 0x68,
+	0x74, 0x74, 0x70, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x62, 0x6f, 0x64, 0x79,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x33, 0xc2, 0xdd, 0x29, 0x2f, 0x0a, 0x0f, 0x48, 0x74,
+	0x74, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x1c, 0x61,
+	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x72,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x62, 0x6f, 0x64, 0x79, 0x52, 0x0f, 0x68, 0x74, 0x74,
+	0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x27, 0x0a, 0x0f,
+	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x54, 0x79, 0x70, 0x65, 0x22, 0xc3, 0x04, 0x0a, 0x0a, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49,
+	0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x49, 0x64,
+	0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12,
+	0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x09, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x4b,
+	0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
+	0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
+	0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74,
 	0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e,
-	0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61,
-	0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e,
-	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61,
-	0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e,
-	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
-	0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
-	0x1f, 0x0a, 0x0b, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x08,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x49, 0x64,
-	0x12, 0x56, 0x0a, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c,
-	0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
-	0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0f, 0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x6e,
-	0x65, 0x77, 0x61, 0x6c, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x53, 0x0a, 0x0f, 0x65, 0x78, 0x70, 0x69,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73,
-	0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0e, 0x65,
-	0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x21, 0x0a,
-	0x0c, 0x69, 0x73, 0x5f, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x0b, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x62, 0x6c, 0x65,
-	0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x97, 0x01, 0x0a, 0x18, 0x55, 0x73, 0x65,
-	0x72, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x4f, 0x76, 0x65,
-	0x72, 0x72, 0x69, 0x64, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79,
-	0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x62, 0x72, 0x61,
-	0x72, 0x79, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x12, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
-	0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x11, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62,
-	0x75, 0x74, 0x65, 0x12, 0x2d, 0x0a, 0x12, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x5f,
-	0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x11, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
-	0x74, 0x65, 0x22, 0x99, 0x01, 0x0a, 0x15, 0x53, 0x73, 0x68, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74,
-	0x65, 0x4b, 0x65, 0x79, 0x4f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x12, 0x1d, 0x0a, 0x0a,
-	0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x09, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x12, 0x75,
-	0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
-	0x65, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x32, 0x0a, 0x15, 0x70, 0x72,
-	0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
-	0x75, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x70, 0x72, 0x69, 0x76, 0x61,
-	0x74, 0x65, 0x4b, 0x65, 0x79, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x42, 0x45,
-	0x5a, 0x43, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73,
-	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f,
-	0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x61, 0x6c, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x69,
+	0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
+	0x6c, 0x49, 0x64, 0x12, 0x56, 0x0a, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x6e, 0x65,
+	0x77, 0x61, 0x6c, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72,
+	0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31,
+	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0f, 0x6c, 0x61, 0x73, 0x74,
+	0x52, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x53, 0x0a, 0x0f, 0x65,
+	0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74,
+	0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x52, 0x0e, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65,
+	0x12, 0x21, 0x0a, 0x0c, 0x69, 0x73, 0x5f, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x62, 0x6c, 0x65,
+	0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x61,
+	0x62, 0x6c, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0c, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x97, 0x01, 0x0a, 0x18,
+	0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x4f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72,
+	0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69,
+	0x62, 0x72, 0x61, 0x72, 0x79, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x12, 0x75, 0x73, 0x65, 0x72, 0x6e,
+	0x61, 0x6d, 0x65, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x11, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x41, 0x74, 0x74,
+	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x2d, 0x0a, 0x12, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x11, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x41, 0x74, 0x74, 0x72,
+	0x69, 0x62, 0x75, 0x74, 0x65, 0x22, 0x99, 0x01, 0x0a, 0x15, 0x53, 0x73, 0x68, 0x50, 0x72, 0x69,
+	0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x4f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x12,
+	0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x49, 0x64, 0x12, 0x2d,
+	0x0a, 0x12, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69,
+	0x62, 0x75, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x75, 0x73, 0x65, 0x72,
+	0x6e, 0x61, 0x6d, 0x65, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x32, 0x0a,
+	0x15, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x61, 0x74, 0x74,
+	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x70, 0x72,
+	0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x42, 0x45, 0x5a, 0x43, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61,
+	0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x74, 0x6f,
+	0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/internal/daemon/controller/handlers/credentialstores/credentialstore_service.go b/internal/daemon/controller/handlers/credentialstores/credentialstore_service.go
index 2a687e433d..6d192b3e6c 100644
--- a/internal/daemon/controller/handlers/credentialstores/credentialstore_service.go
+++ b/internal/daemon/controller/handlers/credentialstores/credentialstore_service.go
@@ -32,13 +32,14 @@ import (
 )
 
 const (
-	addressField        = "attributes.address"
-	vaultTokenField     = "attributes.token"
-	vaultTokenHmacField = "attributes.token_hmac"
-	caCertsField        = "attributes.ca_cert"
-	clientCertField     = "attributes.client_certificate"
-	clientCertKeyField  = "attributes.certificate_key"
-	domain              = "credential"
+	addressField           = "attributes.address"
+	vaultTokenField        = "attributes.token"
+	vaultTokenHmacField    = "attributes.token_hmac"
+	vaultWorkerFilterField = "attributes.worker_filter"
+	caCertsField           = "attributes.ca_cert"
+	clientCertField        = "attributes.client_certificate"
+	clientCertKeyField     = "attributes.certificate_key"
+	domain                 = "credential"
 )
 
 var (
@@ -66,8 +67,14 @@ var (
 	staticCollectionTypeMap = map[resource.Type]action.ActionSet{
 		resource.Credential: credentials.CollectionActions,
 	}
+	validateVaultWorkerFilterFn = vaultWorkerFilterUnsupported
+	vaultWorkerFilterToProto    = false
 )
 
+func vaultWorkerFilterUnsupported(string) error {
+	return fmt.Errorf("Worker Filter field is not supported in OSS")
+}
+
 func init() {
 	var err error
 	if maskManager, err = handlers.NewMaskManager(handlers.MaskDestination{&store.CredentialStore{}, &store.Token{}, &store.ClientCertificate{}},
@@ -668,6 +675,11 @@ func toProto(in credential.Store, opt ...handlers.Option) (*pb.CredentialStore,
 			if vaultIn.Token() != nil {
 				attrs.TokenHmac = base64.RawURLEncoding.EncodeToString(vaultIn.Token().GetTokenHmac())
 			}
+			if vaultIn.GetWorkerFilter() != "" {
+				if vaultWorkerFilterToProto {
+					attrs.WorkerFilter = wrapperspb.String(vaultIn.GetWorkerFilter())
+				}
+			}
 			if cc := vaultIn.ClientCertificate(); cc != nil {
 				if len(cc.GetCertificate()) != 0 {
 					attrs.ClientCertificate = wrapperspb.String(string(cc.GetCertificate()))
@@ -720,6 +732,9 @@ func toStorageVaultStore(scopeId string, in *pb.CredentialStore) (out *vault.Cre
 	if attrs.GetNamespace().GetValue() != "" {
 		opts = append(opts, vault.WithNamespace(attrs.GetNamespace().GetValue()))
 	}
+	if attrs.GetWorkerFilter().GetValue() != "" {
+		opts = append(opts, vault.WithWorkerFilter(attrs.GetWorkerFilter().GetValue()))
+	}
 
 	// TODO (ICU-1478 and ICU-1479): Update the vault's interface around ca cert to match oidc's,
 	//  accepting x509.Certificate instead of []byte
@@ -784,7 +799,12 @@ func validateCreateRequest(req *pbs.CreateCredentialStoreRequest) error {
 			if attrs.GetTokenHmac() != "" {
 				badFields[vaultTokenHmacField] = "This is a read only field."
 			}
-
+			if attrs.WorkerFilter.GetValue() != "" {
+				err := validateVaultWorkerFilterFn(attrs.WorkerFilter.GetValue())
+				if err != nil {
+					badFields[vaultWorkerFilterField] = err.Error()
+				}
+			}
 			// TODO(ICU-1478 and ICU-1479): Validate client and CA certificate payloads
 			_, err := decodePemBlocks(attrs.GetCaCert().GetValue())
 			if attrs.GetCaCert() != nil && err != nil {
@@ -831,6 +851,12 @@ func validateUpdateRequest(req *pbs.UpdateCredentialStoreRequest) error {
 				if attrs.GetTokenHmac() != "" {
 					badFields[vaultTokenHmacField] = "This is a read only field."
 				}
+				if attrs.WorkerFilter.GetValue() != "" {
+					err := validateVaultWorkerFilterFn(attrs.WorkerFilter.GetValue())
+					if err != nil {
+						badFields[vaultWorkerFilterField] = err.Error()
+					}
+				}
 
 				// TODO(ICU-1478 and ICU-1479): Validate client and CA certificate payloads
 				_, err := decodePemBlocks(attrs.GetCaCert().GetValue())
diff --git a/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go b/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go
index cda604e66c..95dbae61fb 100644
--- a/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go
+++ b/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go
@@ -229,6 +229,10 @@ func TestCreateVault(t *testing.T) {
 		}
 	}
 
+	// Ensure we're testing the OSS version of this function
+	currentVaultWorkerFilterFn := validateVaultWorkerFilterFn
+	validateVaultWorkerFilterFn = vaultWorkerFilterUnsupported
+
 	v := vault.NewTestVaultServer(t, vault.WithTestVaultTLS(vault.TestClientTLS))
 	newToken := func() string {
 		_, token := v.CreateToken(t)
@@ -378,6 +382,24 @@ func TestCreateVault(t *testing.T) {
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
+		{
+			name: "Can't specify worker filter",
+			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
+				ScopeId: prj.GetPublicId(),
+				Type:    vault.Subtype.String(),
+				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
+					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
+						Address:           wrapperspb.String(v.Addr),
+						Token:             wrapperspb.String(newToken()),
+						CaCert:            wrapperspb.String(string(v.CaCert)),
+						ClientCertificate: wrapperspb.String(string(v.ClientCert) + string(v.ClientKey)),
+						WorkerFilter:      wrapperspb.String(fmt.Sprintf(`"worker" in "/tags/name"`)),
+					},
+				},
+			}},
+			res: nil,
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
 		{
 			name: "Must specify type",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
@@ -550,6 +572,8 @@ func TestCreateVault(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, cmpOptions...), "CreateCredentialStore(%q) got response %q, wanted %q", tc.req, got, tc.res)
 		})
 	}
+	// Reset VaultWorkerFilterFn
+	validateVaultWorkerFilterFn = currentVaultWorkerFilterFn
 }
 
 func TestCreateStatic(t *testing.T) {
diff --git a/internal/db/schema/migrations/oss/postgres/10/04_vault_credential.up.sql b/internal/db/schema/migrations/oss/postgres/10/04_vault_credential.up.sql
index e47ece6843..0624e24fb8 100644
--- a/internal/db/schema/migrations/oss/postgres/10/04_vault_credential.up.sql
+++ b/internal/db/schema/migrations/oss/postgres/10/04_vault_credential.up.sql
@@ -496,6 +496,7 @@ begin;
     ('credential_vault_library', 1),
     ('credential_vault_credential', 1) ;
 
+  -- Replaced in 41/01_worker_filter_vault_cred_store.up.sql
      create view credential_vault_store_private as
      with
      active_tokens as (
@@ -550,6 +551,7 @@ begin;
     'The view returns a separate row for each current, maintaining and revoke token; maintaining tokens should only be used for token/credential renewal and revocation. '
     'Each row may contain encrypted data. This view should not be used to retrieve data which will be returned external to boundary.';
 
+  -- Replaced in 41/01_worker_filter_vault_cred_store.up.sql
      create view credential_vault_store_public as
      select public_id,
             scope_id,
@@ -609,6 +611,7 @@ begin;
     'credential_vault_library_private is a view where each row contains a credential library and the credential library''s data needed to connect to Vault. '
     'Each row may contain encrypted data. This view should not be used to retrieve data which will be returned external to boundary.';
 
+  -- Replaced in 41/01_worker_filter_vault_cred_store.up.sql
      create view credential_vault_credential_private as
      select credential.public_id         as public_id,
             credential.library_id        as library_id,
diff --git a/internal/db/schema/migrations/oss/postgres/39/02_vault_ssh_private_key_override.up.sql b/internal/db/schema/migrations/oss/postgres/39/02_vault_ssh_private_key_override.up.sql
index 7a054bdcf4..630aeee9d8 100644
--- a/internal/db/schema/migrations/oss/postgres/39/02_vault_ssh_private_key_override.up.sql
+++ b/internal/db/schema/migrations/oss/postgres/39/02_vault_ssh_private_key_override.up.sql
@@ -33,7 +33,7 @@ begin;
   create trigger delete_credential_vault_library_mapping_override_subtype after delete on credential_vault_library_ssh_private_key_mapping_override
     for each row execute procedure delete_credential_vault_library_mapping_override_subtype();
 
-  -- Replaces view from 36/02_vault_private_library.up.sql
+  -- Replaced in 41/01_worker_filter_vault_cred_store.up.sql
   drop view credential_vault_library_public;
   drop view credential_vault_library_private;
   create view credential_vault_library_private as
@@ -90,7 +90,7 @@ begin;
     'credential_vault_library_private is a view where each row contains a credential library and the credential library''s data needed to connect to Vault. '
     'Each row may contain encrypted data. This view should not be used to retrieve data which will be returned external to boundary.';
 
-  -- Replaces view from 36/02_vault_private_library.up.sql
+  -- Replaced in 41/01_worker_filter_vault_cred_store.up.sql
   create view credential_vault_library_public as
      select public_id,
             store_id,
diff --git a/internal/db/schema/migrations/oss/postgres/41/01_worker_filter_vault_cred_store.up.sql b/internal/db/schema/migrations/oss/postgres/41/01_worker_filter_vault_cred_store.up.sql
new file mode 100644
index 0000000000..41c3070204
--- /dev/null
+++ b/internal/db/schema/migrations/oss/postgres/41/01_worker_filter_vault_cred_store.up.sql
@@ -0,0 +1,222 @@
+begin;
+
+-- Add worker_filter to vault cred store table and related views
+alter table credential_vault_store
+  add column worker_filter wt_bexprfilter;
+
+drop view credential_vault_library_public;
+drop view credential_vault_library_private;
+drop view credential_vault_store_public;
+drop view credential_vault_store_private;
+
+-- Replaces view from 10/04_vault_credential.up.sql
+create view credential_vault_store_private as
+with
+  active_tokens as (
+    select token_hmac,
+           token, -- encrypted
+           store_id,
+           create_time,
+           update_time,
+           last_renewal_time,
+           expiration_time,
+           -- renewal time is the midpoint between the last renewal time and the expiration time
+           last_renewal_time + (expiration_time - last_renewal_time) / 2 as renewal_time,
+           key_id,
+           status
+    from credential_vault_token
+    where status in ('current', 'maintaining', 'revoke')
+  )
+select store.public_id           as public_id,
+       store.scope_id            as scope_id,
+       store.name                as name,
+       store.description         as description,
+       store.create_time         as create_time,
+       store.update_time         as update_time,
+       store.delete_time         as delete_time,
+       store.version             as version,
+       store.vault_address       as vault_address,
+       store.namespace           as namespace,
+       store.ca_cert             as ca_cert,
+       store.tls_server_name     as tls_server_name,
+       store.tls_skip_verify     as tls_skip_verify,
+       store.public_id           as store_id,
+       store.worker_filter       as worker_filter,
+       token.token_hmac          as token_hmac,
+       token.token               as ct_token, -- encrypted
+       token.create_time         as token_create_time,
+       token.update_time         as token_update_time,
+       token.last_renewal_time   as token_last_renewal_time,
+       token.expiration_time     as token_expiration_time,
+       token.renewal_time        as token_renewal_time,
+       token.key_id              as token_key_id,
+       token.status              as token_status,
+       cert.certificate          as client_cert,
+       cert.certificate_key      as ct_client_key, -- encrypted
+       cert.certificate_key_hmac as client_cert_key_hmac,
+       cert.key_id               as client_key_id
+from credential_vault_store store
+       left join active_tokens token
+                 on store.public_id = token.store_id
+       left join credential_vault_client_certificate cert
+                 on store.public_id = cert.store_id;
+comment on view credential_vault_store_private is
+  'credential_vault_store_private is a view where each row contains a credential store and the credential store''s data needed to connect to Vault. '
+    'The view returns a separate row for each current, maintaining and revoke token; maintaining tokens should only be used for token/credential renewal and revocation. '
+    'Each row may contain encrypted data. This view should not be used to retrieve data which will be returned external to boundary.';
+
+-- Replaces view from 10/04_vault_credential.up.sql
+create view credential_vault_store_public as
+select public_id,
+       scope_id,
+       name,
+       description,
+       create_time,
+       update_time,
+       version,
+       vault_address,
+       namespace,
+       ca_cert,
+       tls_server_name,
+       tls_skip_verify,
+       worker_filter,
+       token_hmac,
+       token_create_time,
+       token_update_time,
+       token_last_renewal_time,
+       token_expiration_time,
+       client_cert,
+       client_cert_key_hmac
+from credential_vault_store_private
+where token_status = 'current'
+  and delete_time is null;
+comment on view credential_vault_store_public is
+  'credential_vault_store_public is a view where each row contains a credential store. '
+    'No encrypted data is returned. This view can be used to retrieve data which will be returned external to boundary.';
+
+-- Replaces view from 39/02_vault_ssh_private_key_override.up.sql
+create view credential_vault_library_private as
+with
+  password_override (library_id, username_attribute, password_attribute) as (
+    select library_id,
+           nullif(username_attribute, wt_to_sentinel('no override')),
+           nullif(password_attribute, wt_to_sentinel('no override'))
+    from credential_vault_library_username_password_mapping_override
+  ),
+  ssh_private_key_override (library_id, username_attribute, private_key_attribute) as (
+    select library_id,
+           nullif(username_attribute, wt_to_sentinel('no override')),
+           nullif(private_key_attribute, wt_to_sentinel('no override'))
+    from credential_vault_library_ssh_private_key_mapping_override
+  )
+select library.public_id         as public_id,
+       library.store_id          as store_id,
+       library.name              as name,
+       library.description       as description,
+       library.create_time       as create_time,
+       library.update_time       as update_time,
+       library.version           as version,
+       library.vault_path        as vault_path,
+       library.http_method       as http_method,
+       library.http_request_body as http_request_body,
+       library.credential_type   as credential_type,
+       store.scope_id            as scope_id,
+       store.vault_address       as vault_address,
+       store.namespace           as namespace,
+       store.ca_cert             as ca_cert,
+       store.tls_server_name     as tls_server_name,
+       store.tls_skip_verify     as tls_skip_verify,
+       store.worker_filter       as worker_filter,
+       store.token_hmac          as token_hmac,
+       store.ct_token            as ct_token, -- encrypted
+       store.token_key_id        as token_key_id,
+       store.client_cert         as client_cert,
+       store.ct_client_key       as ct_client_key, -- encrypted
+       store.client_key_id       as client_key_id,
+       coalesce(upasso.username_attribute,sshpk.username_attribute)
+                                 as username_attribute,
+       upasso.password_attribute    as password_attribute,
+       sshpk.private_key_attribute  as private_key_attribute
+from credential_vault_library library
+       join credential_vault_store_private store
+            on library.store_id = store.public_id
+       left join password_override upasso
+                 on library.public_id = upasso.library_id
+                   and store.token_status = 'current'
+       left join ssh_private_key_override sshpk
+                 on library.public_id = sshpk.library_id
+                   and store.token_status = 'current';
+comment on view credential_vault_library_private is
+  'credential_vault_library_private is a view where each row contains a credential library and the credential library''s data needed to connect to Vault. '
+    'Each row may contain encrypted data. This view should not be used to retrieve data which will be returned external to boundary.';
+
+-- Replaces view from 39/02_vault_ssh_private_key_override.up.sql
+create view credential_vault_library_public as
+select public_id,
+       store_id,
+       name,
+       description,
+       create_time,
+       update_time,
+       version,
+       vault_path,
+       http_method,
+       http_request_body,
+       credential_type,
+       worker_filter,
+       username_attribute,
+       password_attribute,
+       private_key_attribute
+from credential_vault_library_private;
+comment on view credential_vault_library_public is
+  'credential_vault_library_public is a view where each row contains a credential library and any of library''s credential mapping overrides. '
+    'No encrypted data is returned. This view can be used to retrieve data which will be returned external to boundary.';
+
+drop view credential_vault_credential_private;
+-- Replaces view from 10/04_vault_credential.up.sql
+create view credential_vault_credential_private as
+select credential.public_id         as public_id,
+       credential.library_id        as library_id,
+       credential.session_id        as session_id,
+       credential.create_time       as create_time,
+       credential.update_time       as update_time,
+       credential.version           as version,
+       credential.external_id       as external_id,
+       credential.last_renewal_time as last_renewal_time,
+       credential.expiration_time   as expiration_time,
+       credential.is_renewable      as is_renewable,
+       credential.status            as status,
+       credential.last_renewal_time + (credential.expiration_time - credential.last_renewal_time) / 2 as renewal_time,
+       token.token_hmac             as token_hmac,
+       token.token                  as ct_token, -- encrypted
+       token.create_time            as token_create_time,
+       token.update_time            as token_update_time,
+       token.last_renewal_time      as token_last_renewal_time,
+       token.expiration_time        as token_expiration_time,
+       token.key_id                 as token_key_id,
+       token.status                 as token_status,
+       store.scope_id               as scope_id,
+       store.vault_address          as vault_address,
+       store.namespace              as namespace,
+       store.ca_cert                as ca_cert,
+       store.tls_server_name        as tls_server_name,
+       store.tls_skip_verify        as tls_skip_verify,
+       store.worker_filter          as worker_filter,
+       cert.certificate             as client_cert,
+       cert.certificate_key         as ct_client_key, -- encrypted
+       cert.certificate_key_hmac    as client_cert_key_hmac,
+       cert.key_id                  as client_key_id
+from credential_vault_credential credential
+       join credential_vault_token token
+            on credential.token_hmac = token.token_hmac
+       join credential_vault_store store
+            on token.store_id = store.public_id
+       left join credential_vault_client_certificate cert
+                 on store.public_id = cert.store_id
+where credential.expiration_time != 'infinity'::date;
+comment on view credential_vault_credential_private is
+  'credential_vault_credential_private is a view where each row contains a credential, '
+    'the vault token used to issue the credential, and the credential store data needed to connect to Vault. '
+    'Each row may contain encrypted data. This view should not be used to retrieve data which will be returned external to boundary.';
+
+commit;
\ No newline at end of file
diff --git a/internal/proto/controller/api/resources/credentialstores/v1/credential_store.proto b/internal/proto/controller/api/resources/credentialstores/v1/credential_store.proto
index d683f8b12f..524838e633 100644
--- a/internal/proto/controller/api/resources/credentialstores/v1/credential_store.proto
+++ b/internal/proto/controller/api/resources/credentialstores/v1/credential_store.proto
@@ -163,4 +163,14 @@ message VaultCredentialStoreAttributes {
 
   // Output only. The hmac value of the private key used by the credential store.
   string client_certificate_key_hmac = 100 [json_name = "client_certificate_key_hmac"]; // @gotags: `class:"public"`
+
+  // worker_filter is optional. Filters to the worker(s) who can handle Vault requests for this cred store
+  google.protobuf.StringValue worker_filter = 110 [
+    json_name = "worker_filter",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.worker_filter"
+      that: "WorkerFilter"
+    }
+  ]; // @gotags: `class:"public"`
 }
diff --git a/internal/proto/controller/storage/credential/vault/store/v1/vault.proto b/internal/proto/controller/storage/credential/vault/store/v1/vault.proto
index dc8695b6c2..ce07d58c40 100644
--- a/internal/proto/controller/storage/credential/vault/store/v1/vault.proto
+++ b/internal/proto/controller/storage/credential/vault/store/v1/vault.proto
@@ -92,6 +92,13 @@ message CredentialStore {
     this: "TlsSkipVerify"
     that: "attributes.tls_skip_verify"
   }];
+
+  // worker_filter is optional. Filters to the worker(s) who can handle Vault requests for this cred store
+  // @inject_tag: `gorm:"default:null"`
+  string worker_filter = 14 [(custom_options.v1.mask_mapping) = {
+    this: "WorkerFilter"
+    that: "attributes.worker_filter"
+  }];
 }
 
 message Token {
diff --git a/sdk/pbs/controller/api/resources/credentialstores/credential_store.pb.go b/sdk/pbs/controller/api/resources/credentialstores/credential_store.pb.go
index d4855fea02..8174496280 100644
--- a/sdk/pbs/controller/api/resources/credentialstores/credential_store.pb.go
+++ b/sdk/pbs/controller/api/resources/credentialstores/credential_store.pb.go
@@ -237,6 +237,8 @@ type VaultCredentialStoreAttributes struct {
 	ClientCertificateKey *wrapperspb.StringValue `protobuf:"bytes,90,opt,name=client_certificate_key,proto3" json:"client_certificate_key,omitempty" class:"secret"` // @gotags: `class:"secret"`
 	// Output only. The hmac value of the private key used by the credential store.
 	ClientCertificateKeyHmac string `protobuf:"bytes,100,opt,name=client_certificate_key_hmac,proto3" json:"client_certificate_key_hmac,omitempty" class:"public"` // @gotags: `class:"public"`
+	// worker_filter is optional. Filters to the worker(s) who can handle Vault requests for this cred store
+	WorkerFilter *wrapperspb.StringValue `protobuf:"bytes,110,opt,name=worker_filter,proto3" json:"worker_filter,omitempty" class:"public"` // @gotags: `class:"public"`
 }
 
 func (x *VaultCredentialStoreAttributes) Reset() {
@@ -341,6 +343,13 @@ func (x *VaultCredentialStoreAttributes) GetClientCertificateKeyHmac() string {
 	return ""
 }
 
+func (x *VaultCredentialStoreAttributes) GetWorkerFilter() *wrapperspb.StringValue {
+	if x != nil {
+		return x.WorkerFilter
+	}
+	return nil
+}
+
 var File_controller_api_resources_credentialstores_v1_credential_store_proto protoreflect.FileDescriptor
 
 var file_controller_api_resources_credentialstores_v1_credential_store_proto_rawDesc = []byte{
@@ -432,7 +441,7 @@ var file_controller_api_resources_credentialstores_v1_credential_store_proto_raw
 	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
 	0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c,
 	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x07, 0x0a, 0x05, 0x61, 0x74, 0x74, 0x72, 0x73, 0x22,
-	0x93, 0x08, 0x0a, 0x1e, 0x56, 0x61, 0x75, 0x6c, 0x74, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x89, 0x09, 0x0a, 0x1e, 0x56, 0x61, 0x75, 0x6c, 0x74, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
 	0x69, 0x61, 0x6c, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
 	0x65, 0x73, 0x12, 0x62, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x0a, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
@@ -497,14 +506,21 @@ var file_controller_api_resources_credentialstores_v1_credential_store_proto_raw
 	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x68, 0x6d,
 	0x61, 0x63, 0x18, 0x64, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1b, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
 	0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79,
-	0x5f, 0x68, 0x6d, 0x61, 0x63, 0x42, 0x62, 0x5a, 0x60, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
-	0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f,
-	0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x73, 0x2f, 0x63,
-	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x73, 0x3b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x61, 0x6c, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
+	0x5f, 0x68, 0x6d, 0x61, 0x63, 0x12, 0x74, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f,
+	0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x6e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53,
+	0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x30, 0xa0, 0xda, 0x29, 0x01,
+	0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x18, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
+	0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x0c,
+	0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0d, 0x77, 0x6f,
+	0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x42, 0x62, 0x5a, 0x60, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x73, 0x64, 0x6b,
+	0x2f, 0x70, 0x62, 0x73, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f,
+	0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x63, 0x72,
+	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x73, 0x3b, 0x63,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x73, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -548,12 +564,13 @@ var file_controller_api_resources_credentialstores_v1_credential_store_proto_dep
 	4,  // 13: controller.api.resources.credentialstores.v1.VaultCredentialStoreAttributes.token:type_name -> google.protobuf.StringValue
 	4,  // 14: controller.api.resources.credentialstores.v1.VaultCredentialStoreAttributes.client_certificate:type_name -> google.protobuf.StringValue
 	4,  // 15: controller.api.resources.credentialstores.v1.VaultCredentialStoreAttributes.client_certificate_key:type_name -> google.protobuf.StringValue
-	8,  // 16: controller.api.resources.credentialstores.v1.CredentialStore.AuthorizedCollectionActionsEntry.value:type_name -> google.protobuf.ListValue
-	17, // [17:17] is the sub-list for method output_type
-	17, // [17:17] is the sub-list for method input_type
-	17, // [17:17] is the sub-list for extension type_name
-	17, // [17:17] is the sub-list for extension extendee
-	0,  // [0:17] is the sub-list for field type_name
+	4,  // 16: controller.api.resources.credentialstores.v1.VaultCredentialStoreAttributes.worker_filter:type_name -> google.protobuf.StringValue
+	8,  // 17: controller.api.resources.credentialstores.v1.CredentialStore.AuthorizedCollectionActionsEntry.value:type_name -> google.protobuf.ListValue
+	18, // [18:18] is the sub-list for method output_type
+	18, // [18:18] is the sub-list for method input_type
+	18, // [18:18] is the sub-list for extension type_name
+	18, // [18:18] is the sub-list for extension extendee
+	0,  // [0:18] is the sub-list for field type_name
 }
 
 func init() { file_controller_api_resources_credentialstores_v1_credential_store_proto_init() }