hcp.v2.TelemetryState resource and controller implementation (#20257)

* pbhcp: add TelemetryState resource * agent/hcp: add GetObservabilitySecrets to client * internal/hcp: add TelemetryState controller logic * hcp/telemetry-state: added config options for hcp sdk and debug key to skip deletion during reconcile * pbhcp: update proto documentation * hcp: address PR feedback, additional validations and code cleanup * internal/hcp: fix type sig change in test * update testdata/v2-resource-dependencies
10 months ago · 383d92e9ab
25 changed files with 1547 additions and 55 deletions
--- a/agent/consul/testdata/v2-resource-dependencies.md
+++ b/agent/consul/testdata/v2-resource-dependencies.md
@ -23,6 +23,7 @@ flowchart TD
  demo/v2/album
  demo/v2/artist
  hcp/v2/link
+  hcp/v2/telemetrystate --> hcp/v2/link
  internal/v1/tombstone
  mesh/v2beta1/apigateway
  mesh/v2beta1/computedexplicitdestinations --> catalog/v2beta1/service
--- a/agent/hcp/client/client.go
+++ b/agent/hcp/client/client.go
@ -35,6 +35,7 @@ const metricsGatewayPath = "/v1/metrics"
 type Client interface {
 	FetchBootstrap(ctx context.Context) (*BootstrapConfig, error)
 	FetchTelemetryConfig(ctx context.Context) (*TelemetryConfig, error)
+	GetObservabilitySecret(ctx context.Context) (clientID, clientSecret string, err error)
 	PushServerStatus(ctx context.Context, status *ServerStatus) error
 	DiscoverServers(ctx context.Context) ([]string, error)
 	GetCluster(ctx context.Context) (*Cluster, error)
@ -369,3 +370,22 @@ func decodeError(err error) error {

 	return err
 }
+
+func (c *hcpClient) GetObservabilitySecret(ctx context.Context) (string, string, error) {
+	params := hcpgnm.NewGetObservabilitySecretParamsWithContext(ctx).
+		WithID(c.resource.ID).
+		WithLocationOrganizationID(c.resource.Organization).
+		WithLocationProjectID(c.resource.Project)
+
+	resp, err := c.gnm.GetObservabilitySecret(params, nil)
+	if err != nil {
+		return "", "", err
+	}
+
+	if len(resp.GetPayload().Keys) == 0 {
+		return "", "", fmt.Errorf("no observability keys returned for cluster")
+	}
+
+	key := resp.GetPayload().Keys[len(resp.GetPayload().Keys)-1]
+	return key.ClientID, key.ClientSecret, nil
+}
--- a/agent/hcp/client/mock_Client.go
+++ b/agent/hcp/client/mock_Client.go
@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.39.2. DO NOT EDIT.

 package client

@ -25,6 +25,10 @@ func (_m *MockClient) EXPECT() *MockClient_Expecter {
 func (_m *MockClient) DiscoverServers(ctx context.Context) ([]string, error) {
 	ret := _m.Called(ctx)

+	if len(ret) == 0 {
+		panic("no return value specified for DiscoverServers")
+	}
+
 	var r0 []string
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context) ([]string, error)); ok {
@ -79,6 +83,10 @@ func (_c *MockClient_DiscoverServers_Call) RunAndReturn(run func(context.Context
 func (_m *MockClient) FetchBootstrap(ctx context.Context) (*BootstrapConfig, error) {
 	ret := _m.Called(ctx)

+	if len(ret) == 0 {
+		panic("no return value specified for FetchBootstrap")
+	}
+
 	var r0 *BootstrapConfig
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context) (*BootstrapConfig, error)); ok {
@ -133,6 +141,10 @@ func (_c *MockClient_FetchBootstrap_Call) RunAndReturn(run func(context.Context)
 func (_m *MockClient) FetchTelemetryConfig(ctx context.Context) (*TelemetryConfig, error) {
 	ret := _m.Called(ctx)

+	if len(ret) == 0 {
+		panic("no return value specified for FetchTelemetryConfig")
+	}
+
 	var r0 *TelemetryConfig
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context) (*TelemetryConfig, error)); ok {
@ -187,6 +199,10 @@ func (_c *MockClient_FetchTelemetryConfig_Call) RunAndReturn(run func(context.Co
 func (_m *MockClient) GetCluster(ctx context.Context) (*Cluster, error) {
 	ret := _m.Called(ctx)

+	if len(ret) == 0 {
+		panic("no return value specified for GetCluster")
+	}
+
 	var r0 *Cluster
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context) (*Cluster, error)); ok {
@ -237,10 +253,77 @@ func (_c *MockClient_GetCluster_Call) RunAndReturn(run func(context.Context) (*C
 	return _c
 }

+// GetObservabilitySecret provides a mock function with given fields: ctx
+func (_m *MockClient) GetObservabilitySecret(ctx context.Context) (string, string, error) {
+	ret := _m.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetObservabilitySecret")
+	}
+
+	var r0 string
+	var r1 string
+	var r2 error
+	if rf, ok := ret.Get(0).(func(context.Context) (string, string, error)); ok {
+		return rf(ctx)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) string); ok {
+		r0 = rf(ctx)
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) string); ok {
+		r1 = rf(ctx)
+	} else {
+		r1 = ret.Get(1).(string)
+	}
+
+	if rf, ok := ret.Get(2).(func(context.Context) error); ok {
+		r2 = rf(ctx)
+	} else {
+		r2 = ret.Error(2)
+	}
+
+	return r0, r1, r2
+}
+
+// MockClient_GetObservabilitySecret_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetObservabilitySecret'
+type MockClient_GetObservabilitySecret_Call struct {
+	*mock.Call
+}
+
+// GetObservabilitySecret is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockClient_Expecter) GetObservabilitySecret(ctx interface{}) *MockClient_GetObservabilitySecret_Call {
+	return &MockClient_GetObservabilitySecret_Call{Call: _e.mock.On("GetObservabilitySecret", ctx)}
+}
+
+func (_c *MockClient_GetObservabilitySecret_Call) Run(run func(ctx context.Context)) *MockClient_GetObservabilitySecret_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context))
+	})
+	return _c
+}
+
+func (_c *MockClient_GetObservabilitySecret_Call) Return(clientID string, clientSecret string, err error) *MockClient_GetObservabilitySecret_Call {
+	_c.Call.Return(clientID, clientSecret, err)
+	return _c
+}
+
+func (_c *MockClient_GetObservabilitySecret_Call) RunAndReturn(run func(context.Context) (string, string, error)) *MockClient_GetObservabilitySecret_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // PushServerStatus provides a mock function with given fields: ctx, status
 func (_m *MockClient) PushServerStatus(ctx context.Context, status *ServerStatus) error {
 	ret := _m.Called(ctx, status)

+	if len(ret) == 0 {
+		panic("no return value specified for PushServerStatus")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(context.Context, *ServerStatus) error); ok {
 		r0 = rf(ctx, status)
--- a/internal/hcp/internal/controllers/link/controller.go
+++ b/internal/hcp/internal/controllers/link/controller.go
@ -5,6 +5,7 @@ package link

 import (
 	"context"
+	"crypto/tls"
 	"strings"

 	gnmmod "github.com/hashicorp/hcp-sdk-go/clients/cloud-global-network-manager-service/preview/2022-02-15/models"
@ -149,11 +150,7 @@ func (r *linkReconciler) Reconcile(ctx context.Context, rt controller.Runtime, r
 	// 1. The HCP configuration (i.e., how to connect to HCP) is preserved
 	// 2. The Consul agent's node ID and node name are preserved
 	existingCfg := r.hcpManager.GetCloudConfig()
-	newCfg := config.CloudConfig{
-		ResourceID:   link.ResourceId,
-		ClientID:     link.ClientId,
-		ClientSecret: link.ClientSecret,
-	}
+	newCfg := CloudConfigFromLink(&link)
 	cfg := config.Merge(existingCfg, newCfg)
 	hcpClient, err := r.hcpClientFn(cfg)
 	if err != nil {
@ -274,3 +271,22 @@ func (i *linkInitializer) Initialize(ctx context.Context, rt controller.Runtime)

 	return nil
 }
+
+func CloudConfigFromLink(link *pbhcp.Link) config.CloudConfig {
+	var cfg config.CloudConfig
+	if link == nil {
+		return cfg
+	}
+	cfg = config.CloudConfig{
+		ResourceID:   link.GetResourceId(),
+		ClientID:     link.GetClientId(),
+		ClientSecret: link.GetClientSecret(),
+	}
+	if link.GetHcpConfig() != nil {
+		cfg.AuthURL = link.GetHcpConfig().GetAuthUrl()
+		cfg.ScadaAddress = link.GetHcpConfig().GetScadaAddress()
+		cfg.Hostname = link.GetHcpConfig().GetApiAddress()
+		cfg.TLSConfig = &tls.Config{InsecureSkipVerify: link.GetHcpConfig().GetTlsInsecureSkipVerify()}
+	}
+	return cfg
+}
--- a/internal/hcp/internal/controllers/link/status.go
+++ b/internal/hcp/internal/controllers/link/status.go
@ -11,6 +11,7 @@ import (
 	"github.com/hashicorp/consul/agent/hcp/client"
 	"github.com/hashicorp/consul/internal/controller"
 	"github.com/hashicorp/consul/internal/resource"
+	pbhcp "github.com/hashicorp/consul/proto-public/pbhcp/v2"
 	"github.com/hashicorp/consul/proto-public/pbresource"
 )

@ -102,3 +103,21 @@ func linkingFailed(ctx context.Context, rt controller.Runtime, res *pbresource.R

 	return nil
 }
+
+func IsLinked(res *pbresource.Resource) (linked bool, reason string) {
+	if !resource.EqualType(res.GetId().GetType(), pbhcp.LinkType) {
+		return false, "resource is not hcp.Link type"
+	}
+
+	linkStatus, ok := res.GetStatus()[StatusKey]
+	if !ok {
+		return false, "link status not set"
+	}
+
+	for _, cond := range linkStatus.GetConditions() {
+		if cond.Type == StatusLinked && cond.GetState() == pbresource.Condition_STATE_TRUE {
+			return true, ""
+		}
+	}
+	return false, "link status does not include positive linked condition"
+}
--- a/internal/hcp/internal/controllers/register.go
+++ b/internal/hcp/internal/controllers/register.go
@ -8,6 +8,7 @@ import (
 	"github.com/hashicorp/consul/agent/hcp/config"
 	"github.com/hashicorp/consul/internal/controller"
 	"github.com/hashicorp/consul/internal/hcp/internal/controllers/link"
+	"github.com/hashicorp/consul/internal/hcp/internal/controllers/telemetrystate"
 )

 type Dependencies struct {
@ -27,4 +28,6 @@ func Register(mgr *controller.Manager, deps Dependencies) {
 		deps.DataDir,
 		deps.HCPManager,
 	))
+
+	mgr.Register(telemetrystate.TelemetryStateController(link.DefaultHCPClientFn))
 }
--- a/internal/hcp/internal/controllers/telemetrystate/controller.go
+++ b/internal/hcp/internal/controllers/telemetrystate/controller.go
@ -0,0 +1,168 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package telemetrystate
+
+import (
+	"context"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/anypb"
+
+	"github.com/hashicorp/consul/internal/controller"
+	"github.com/hashicorp/consul/internal/controller/dependency"
+	"github.com/hashicorp/consul/internal/hcp/internal/controllers/link"
+	"github.com/hashicorp/consul/internal/hcp/internal/types"
+	"github.com/hashicorp/consul/internal/resource"
+	pbhcp "github.com/hashicorp/consul/proto-public/pbhcp/v2"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+var (
+	globalID = &pbresource.ID{
+		Name:    "global",
+		Type:    pbhcp.TelemetryStateType,
+		Tenancy: &pbresource.Tenancy{},
+	}
+)
+
+const MetaKeyDebugSkipDeletion = StatusKey + "/debug/skip-deletion"
+
+func TelemetryStateController(hcpClientFn link.HCPClientFn) *controller.Controller {
+	return controller.NewController(StatusKey, pbhcp.TelemetryStateType).
+		WithWatch(pbhcp.LinkType, dependency.ReplaceType(pbhcp.TelemetryStateType)).
+		WithReconciler(&telemetryStateReconciler{
+			hcpClientFn: hcpClientFn,
+		})
+}
+
+type telemetryStateReconciler struct {
+	hcpClientFn link.HCPClientFn
+}
+
+func (r *telemetryStateReconciler) Reconcile(ctx context.Context, rt controller.Runtime, req controller.Request) error {
+	// The runtime is passed by value so replacing it here for the remainder of this
+	// reconciliation request processing will not affect future invocations.
+	rt.Logger = rt.Logger.With("resource-id", req.ID, "controller", StatusKey)
+
+	rt.Logger.Trace("reconciling telemetry-state")
+
+	// First get the link resource in order to build a hcp client. If the link resource
+	// doesn't exist then the telemetry-state should not exist either.
+	res, err := getLinkResource(ctx, rt)
+	if err != nil {
+		rt.Logger.Error("failed to lookup Link resource", "error", err)
+		return err
+	}
+	if res == nil {
+		return ensureTelemetryStateDeleted(ctx, rt)
+	}
+
+	// Check that the link resource indicates the cluster is linked
+	// If the cluster is not linked, the telemetry-state resource should not exist
+	if linked, reason := link.IsLinked(res.GetResource()); !linked {
+		rt.Logger.Trace("cluster is not linked", "reason", reason)
+		return ensureTelemetryStateDeleted(ctx, rt)
+	}
+
+	hcpClient, err := r.hcpClientFn(link.CloudConfigFromLink(res.GetData()))
+	if err != nil {
+		rt.Logger.Error("error creating HCP Client", "error", err)
+		return err
+	}
+
+	// Get the telemetry configuration and observability scoped credentials from hcp
+	tCfg, err := hcpClient.FetchTelemetryConfig(ctx)
+	if err != nil {
+		rt.Logger.Error("error requesting telemetry config", "error", err)
+		return err
+	}
+	clientID, clientSecret, err := hcpClient.GetObservabilitySecret(ctx)
+	if err != nil {
+		rt.Logger.Error("error requesting telemetry credentials", "error", err)
+		return nil
+	}
+
+	// TODO allow hcp client config override from hcp TelemetryConfig
+	hcpCfg := res.GetData().GetHcpConfig()
+
+	// TODO implement proxy options from hcp
+	proxyCfg := &pbhcp.ProxyConfig{}
+
+	state := &pbhcp.TelemetryState{
+		ResourceId:   res.GetData().ResourceId,
+		ClientId:     clientID,
+		ClientSecret: clientSecret,
+		HcpConfig:    hcpCfg,
+		Proxy:        proxyCfg,
+		Metrics: &pbhcp.MetricsConfig{
+			Labels:   tCfg.MetricsConfig.Labels,
+			Disabled: tCfg.MetricsConfig.Disabled,
+		},
+	}
+
+	if tCfg.MetricsConfig.Endpoint != nil {
+		state.Metrics.Endpoint = tCfg.MetricsConfig.Endpoint.String()
+	}
+	if tCfg.MetricsConfig.Filters != nil {
+		state.Metrics.IncludeList = []string{tCfg.MetricsConfig.Filters.String()}
+	}
+
+	stateData, err := anypb.New(state)
+	if err != nil {
+		rt.Logger.Error("error marshalling telemetry-state data", "error", err)
+		return err
+	}
+
+	_, err = rt.Client.Write(ctx, &pbresource.WriteRequest{Resource: &pbresource.Resource{
+		Id: &pbresource.ID{
+			Name: "global",
+			Type: pbhcp.TelemetryStateType,
+		},
+		Data: stateData,
+	}})
+	if err != nil {
+		rt.Logger.Error("error updating telemetry-state", "error", err)
+		return err
+	}
+
+	return nil
+}
+
+func ensureTelemetryStateDeleted(ctx context.Context, rt controller.Runtime) error {
+	resp, err := rt.Client.Read(ctx, &pbresource.ReadRequest{Id: &pbresource.ID{Name: "global", Type: pbhcp.TelemetryStateType}})
+	switch {
+	case status.Code(err) == codes.NotFound:
+		return nil
+	case err != nil:
+		rt.Logger.Error("the resource service has returned an unexpected error", "error", err)
+		return err
+	}
+
+	rt.Logger.Trace("deleting telemetry-state")
+	if _, ok := resp.GetResource().Metadata[MetaKeyDebugSkipDeletion]; ok {
+		rt.Logger.Debug("skip-deletion metadata key found, skipping deletion of telemetry-state resource")
+		return nil
+	}
+
+	if _, err := rt.Client.Delete(ctx, &pbresource.DeleteRequest{Id: resp.GetResource().GetId()}); err != nil {
+		rt.Logger.Error("error deleting telemetry-state resource", "error", err)
+		return err
+	}
+	return nil
+}
+
+// getLinkResource returns the cluster scoped pbhcp.Link resource. If the resource is not found a nil
+// pointer and no error will be returned.
+func getLinkResource(ctx context.Context, rt controller.Runtime) (*types.DecodedLink, error) {
+	resp, err := rt.Client.Read(ctx, &pbresource.ReadRequest{Id: &pbresource.ID{Name: "global", Type: pbhcp.LinkType}})
+	switch {
+	case status.Code(err) == codes.NotFound:
+		return nil, nil
+	case err != nil:
+		return nil, err
+	}
+
+	return resource.Decode[*pbhcp.Link](resp.GetResource())
+}
--- a/internal/hcp/internal/controllers/telemetrystate/controller_test.go
+++ b/internal/hcp/internal/controllers/telemetrystate/controller_test.go
@ -0,0 +1,140 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package telemetrystate
+
+import (
+	"context"
+	"net/url"
+	"regexp"
+	"testing"
+
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	svctest "github.com/hashicorp/consul/agent/grpc-external/services/resource/testing"
+	hcpclient "github.com/hashicorp/consul/agent/hcp/client"
+	"github.com/hashicorp/consul/agent/hcp/config"
+	"github.com/hashicorp/consul/internal/controller"
+	"github.com/hashicorp/consul/internal/hcp/internal/controllers/link"
+	"github.com/hashicorp/consul/internal/hcp/internal/types"
+	"github.com/hashicorp/consul/internal/resource"
+	rtest "github.com/hashicorp/consul/internal/resource/resourcetest"
+	pbhcp "github.com/hashicorp/consul/proto-public/pbhcp/v2"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/consul/sdk/testutil"
+)
+
+type controllerSuite struct {
+	suite.Suite
+
+	ctx    context.Context
+	client *rtest.Client
+	rt     controller.Runtime
+
+	ctl       telemetryStateReconciler
+	tenancies []*pbresource.Tenancy
+}
+
+func mockHcpClientFn(t *testing.T) (*hcpclient.MockClient, link.HCPClientFn) {
+	mockClient := hcpclient.NewMockClient(t)
+
+	mockClientFunc := func(link config.CloudConfig) (hcpclient.Client, error) {
+		return mockClient, nil
+	}
+
+	return mockClient, mockClientFunc
+}
+
+func (suite *controllerSuite) SetupTest() {
+	suite.ctx = testutil.TestContext(suite.T())
+	suite.tenancies = rtest.TestTenancies()
+	client := svctest.NewResourceServiceBuilder().
+		WithRegisterFns(types.Register).
+		WithTenancies(suite.tenancies...).
+		Run(suite.T())
+
+	suite.rt = controller.Runtime{
+		Client: client,
+		Logger: testutil.Logger(suite.T()),
+	}
+	suite.client = rtest.NewClient(client)
+}
+
+func TestTelemetryStateController(t *testing.T) {
+	suite.Run(t, new(controllerSuite))
+}
+
+func (suite *controllerSuite) deleteResourceFunc(id *pbresource.ID) func() {
+	return func() {
+		suite.client.MustDelete(suite.T(), id)
+	}
+}
+
+func (suite *controllerSuite) TestController_Ok() {
+	// Run the controller manager
+	mgr := controller.NewManager(suite.client, suite.rt.Logger)
+	mockClient, mockClientFn := mockHcpClientFn(suite.T())
+	mockClient.EXPECT().FetchTelemetryConfig(mock.Anything).Return(&hcpclient.TelemetryConfig{
+		MetricsConfig: &hcpclient.MetricsConfig{
+			Endpoint: &url.URL{
+				Scheme: "http",
+				Host:   "localhost",
+				Path:   "/test",
+			},
+			Labels:  map[string]string{"foo": "bar"},
+			Filters: regexp.MustCompile(".*"),
+		},
+		RefreshConfig: &hcpclient.RefreshConfig{},
+	}, nil)
+	mockClient.EXPECT().GetObservabilitySecret(mock.Anything).Return("xxx", "yyy", nil)
+	mgr.Register(TelemetryStateController(mockClientFn))
+	mgr.SetRaftLeader(true)
+	go mgr.Run(suite.ctx)
+
+	linkData := &pbhcp.Link{
+		ClientId:     "abc",
+		ClientSecret: "abc",
+		ResourceId:   types.GenerateTestResourceID(suite.T()),
+	}
+
+	link := rtest.Resource(pbhcp.LinkType, "global").
+		WithData(suite.T(), linkData).
+		WithStatus(link.StatusKey, &pbresource.Status{Conditions: []*pbresource.Condition{link.ConditionLinked(linkData.ResourceId)}}).
+		Write(suite.T(), suite.client)
+
+	suite.T().Cleanup(suite.deleteResourceFunc(link.Id))
+
+	tsRes := suite.client.WaitForResourceExists(suite.T(), &pbresource.ID{Name: "global", Type: pbhcp.TelemetryStateType})
+	decodedState, err := resource.Decode[*pbhcp.TelemetryState](tsRes)
+	require.NoError(suite.T(), err)
+	require.Equal(suite.T(), linkData.ResourceId, decodedState.GetData().ResourceId)
+	require.Equal(suite.T(), "xxx", decodedState.GetData().ClientId)
+	require.Equal(suite.T(), "http://localhost/test", decodedState.GetData().Metrics.Endpoint)
+
+	suite.client.MustDelete(suite.T(), link.Id)
+	suite.client.WaitForDeletion(suite.T(), tsRes.Id)
+}
+
+func (suite *controllerSuite) TestController_LinkingDisabled() {
+	// Run the controller manager
+	mgr := controller.NewManager(suite.client, suite.rt.Logger)
+	_, mockClientFn := mockHcpClientFn(suite.T())
+	mgr.Register(TelemetryStateController(mockClientFn))
+	mgr.SetRaftLeader(true)
+	go mgr.Run(suite.ctx)
+
+	linkData := &pbhcp.Link{
+		ClientId:     "abc",
+		ClientSecret: "abc",
+		ResourceId:   types.GenerateTestResourceID(suite.T()),
+	}
+
+	rtest.Resource(pbhcp.LinkType, "global").
+		WithData(suite.T(), linkData).
+		WithStatus(link.StatusKey, &pbresource.Status{Conditions: []*pbresource.Condition{link.ConditionDisabled}}).
+		Write(suite.T(), suite.client)
+
+	suite.client.WaitForDeletion(suite.T(), &pbresource.ID{Name: "global", Type: pbhcp.TelemetryStateType})
+}
--- a/internal/hcp/internal/controllers/telemetrystate/status.go
+++ b/internal/hcp/internal/controllers/telemetrystate/status.go
@ -0,0 +1,8 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package telemetrystate
+
+const (
+	StatusKey = "consul.io/hcp/telemetry-state"
+)
--- a/internal/hcp/internal/types/link.go
+++ b/internal/hcp/internal/types/link.go
@ -6,12 +6,13 @@ package types
 import (
 	"errors"

+	"github.com/hashicorp/go-multierror"
+	hcpresource "github.com/hashicorp/hcp-sdk-go/resource"
+
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/internal/resource"
 	pbhcp "github.com/hashicorp/consul/proto-public/pbhcp/v2"
 	"github.com/hashicorp/consul/proto-public/pbresource"
-	"github.com/hashicorp/go-multierror"
-	hcpresource "github.com/hashicorp/hcp-sdk-go/resource"
 )

 type DecodedLink = resource.DecodedResource[*pbhcp.Link]
--- a/internal/hcp/internal/types/telemetry_state.go
+++ b/internal/hcp/internal/types/telemetry_state.go
@ -0,0 +1,85 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package types
+
+import (
+	"errors"
+
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/hashicorp/consul/internal/resource"
+	pbhcp "github.com/hashicorp/consul/proto-public/pbhcp/v2"
+)
+
+type DecodedTelemetryState = resource.DecodedResource[*pbhcp.TelemetryState]
+
+var (
+	telemetryStateConfigurationNameError = errors.New("only a single Telemetry resource is allowed and it must be named global")
+)
+
+func RegisterTelemetryState(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     pbhcp.TelemetryStateType,
+		Proto:    &pbhcp.TelemetryState{},
+		Scope:    resource.ScopeCluster,
+		Validate: ValidateTelemetryState,
+	})
+}
+
+var ValidateTelemetryState = resource.DecodeAndValidate(validateTelemetryState)
+
+func validateTelemetryState(res *DecodedTelemetryState) error {
+	var err error
+
+	if res.GetId().GetName() != "global" {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "name",
+			Wrapped: telemetryStateConfigurationNameError,
+		})
+	}
+
+	if res.GetData().GetClientId() == "" {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "client_id",
+			Wrapped: resource.ErrMissing,
+		})
+	}
+
+	if res.GetData().GetClientSecret() == "" {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "client_secret",
+			Wrapped: resource.ErrMissing,
+		})
+	}
+
+	if res.GetData().GetResourceId() == "" {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "resource_id",
+			Wrapped: resource.ErrMissing,
+		})
+	}
+
+	if res.GetData().GetMetrics().GetEndpoint() == "" {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "metrics.endpoint",
+			Wrapped: resource.ErrMissing,
+		})
+	}
+
+	if res.GetData().GetMetrics().GetIncludeList() == nil {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "metrics.include_list",
+			Wrapped: resource.ErrMissing,
+		})
+	}
+
+	if res.GetData().GetMetrics().GetLabels() == nil {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "metrics.labels",
+			Wrapped: resource.ErrMissing,
+		})
+	}
+
+	return err
+}
--- a/internal/hcp/internal/types/types.go
+++ b/internal/hcp/internal/types/types.go
@ -7,4 +7,5 @@ import "github.com/hashicorp/consul/internal/resource"

 func Register(r resource.Registry) {
 	RegisterLink(r)
+	RegisterTelemetryState(r)
 }
--- a/proto-public/pbhcp/v2/hcp_config.pb.binary.go
+++ b/proto-public/pbhcp/v2/hcp_config.pb.binary.go
@ -0,0 +1,18 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbhcp/v2/hcp_config.proto
+
+package hcpv2
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *HCPConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *HCPConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
--- a/proto-public/pbhcp/v2/hcp_config.pb.go
+++ b/proto-public/pbhcp/v2/hcp_config.pb.go
@ -0,0 +1,199 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
+// source: pbhcp/v2/hcp_config.proto
+
+package hcpv2
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// HCPConfig is used to configure the HCP SDK for communicating with
+// the HashiCorp Cloud Platform. All configuration is optional with default
+// values provided by the SDK.
+type HCPConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// AuthUrl is the URL which will be used to authenticate.
+	AuthUrl string `protobuf:"bytes,1,opt,name=auth_url,json=authUrl,proto3" json:"auth_url,omitempty"`
+	// ApiAddress is the address (<hostname>[:port]) of the HCP api.
+	ApiAddress string `protobuf:"bytes,2,opt,name=api_address,json=apiAddress,proto3" json:"api_address,omitempty"`
+	// ScadaAddress is the address (<hostname>[:port]) of the HCP SCADA endpoint.
+	ScadaAddress string `protobuf:"bytes,3,opt,name=scada_address,json=scadaAddress,proto3" json:"scada_address,omitempty"`
+	// TlsInsecureSkipVerify if true will ignore server name verification when making HTTPS requests
+	TlsInsecureSkipVerify bool `protobuf:"varint,4,opt,name=tls_insecure_skip_verify,json=tlsInsecureSkipVerify,proto3" json:"tls_insecure_skip_verify,omitempty"`
+}
+
+func (x *HCPConfig) Reset() {
+	*x = HCPConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbhcp_v2_hcp_config_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HCPConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HCPConfig) ProtoMessage() {}
+
+func (x *HCPConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_pbhcp_v2_hcp_config_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HCPConfig.ProtoReflect.Descriptor instead.
+func (*HCPConfig) Descriptor() ([]byte, []int) {
+	return file_pbhcp_v2_hcp_config_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *HCPConfig) GetAuthUrl() string {
+	if x != nil {
+		return x.AuthUrl
+	}
+	return ""
+}
+
+func (x *HCPConfig) GetApiAddress() string {
+	if x != nil {
+		return x.ApiAddress
+	}
+	return ""
+}
+
+func (x *HCPConfig) GetScadaAddress() string {
+	if x != nil {
+		return x.ScadaAddress
+	}
+	return ""
+}
+
+func (x *HCPConfig) GetTlsInsecureSkipVerify() bool {
+	if x != nil {
+		return x.TlsInsecureSkipVerify
+	}
+	return false
+}
+
+var File_pbhcp_v2_hcp_config_proto protoreflect.FileDescriptor
+
+var file_pbhcp_v2_hcp_config_proto_rawDesc = []byte{
+	0x0a, 0x19, 0x70, 0x62, 0x68, 0x63, 0x70, 0x2f, 0x76, 0x32, 0x2f, 0x68, 0x63, 0x70, 0x5f, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x17, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63,
+	0x70, 0x2e, 0x76, 0x32, 0x22, 0xa5, 0x01, 0x0a, 0x09, 0x48, 0x43, 0x50, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68, 0x55, 0x72, 0x6c, 0x12, 0x1f, 0x0a,
+	0x0b, 0x61, 0x70, 0x69, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0a, 0x61, 0x70, 0x69, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x23,
+	0x0a, 0x0d, 0x73, 0x63, 0x61, 0x64, 0x61, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x63, 0x61, 0x64, 0x61, 0x41, 0x64, 0x64, 0x72,
+	0x65, 0x73, 0x73, 0x12, 0x37, 0x0a, 0x18, 0x74, 0x6c, 0x73, 0x5f, 0x69, 0x6e, 0x73, 0x65, 0x63,
+	0x75, 0x72, 0x65, 0x5f, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x15, 0x74, 0x6c, 0x73, 0x49, 0x6e, 0x73, 0x65, 0x63, 0x75,
+	0x72, 0x65, 0x53, 0x6b, 0x69, 0x70, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x42, 0xe5, 0x01, 0x0a,
+	0x1b, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63, 0x70, 0x2e, 0x76, 0x32, 0x42, 0x0e, 0x48, 0x63,
+	0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x37,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x68, 0x63, 0x70, 0x2f, 0x76,
+	0x32, 0x3b, 0x68, 0x63, 0x70, 0x76, 0x32, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x48, 0xaa, 0x02, 0x17,
+	0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x48, 0x63, 0x70, 0x2e, 0x56, 0x32, 0xca, 0x02, 0x17, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x48, 0x63, 0x70, 0x5c, 0x56,
+	0x32, 0xe2, 0x02, 0x23, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x48, 0x63, 0x70, 0x5c, 0x56, 0x32, 0x5c, 0x47, 0x50, 0x42, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x1a, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x48, 0x63, 0x70,
+	0x3a, 0x3a, 0x56, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbhcp_v2_hcp_config_proto_rawDescOnce sync.Once
+	file_pbhcp_v2_hcp_config_proto_rawDescData = file_pbhcp_v2_hcp_config_proto_rawDesc
+)
+
+func file_pbhcp_v2_hcp_config_proto_rawDescGZIP() []byte {
+	file_pbhcp_v2_hcp_config_proto_rawDescOnce.Do(func() {
+		file_pbhcp_v2_hcp_config_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbhcp_v2_hcp_config_proto_rawDescData)
+	})
+	return file_pbhcp_v2_hcp_config_proto_rawDescData
+}
+
+var file_pbhcp_v2_hcp_config_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_pbhcp_v2_hcp_config_proto_goTypes = []interface{}{
+	(*HCPConfig)(nil), // 0: hashicorp.consul.hcp.v2.HCPConfig
+}
+var file_pbhcp_v2_hcp_config_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_pbhcp_v2_hcp_config_proto_init() }
+func file_pbhcp_v2_hcp_config_proto_init() {
+	if File_pbhcp_v2_hcp_config_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbhcp_v2_hcp_config_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HCPConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbhcp_v2_hcp_config_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbhcp_v2_hcp_config_proto_goTypes,
+		DependencyIndexes: file_pbhcp_v2_hcp_config_proto_depIdxs,
+		MessageInfos:      file_pbhcp_v2_hcp_config_proto_msgTypes,
+	}.Build()
+	File_pbhcp_v2_hcp_config_proto = out.File
+	file_pbhcp_v2_hcp_config_proto_rawDesc = nil
+	file_pbhcp_v2_hcp_config_proto_goTypes = nil
+	file_pbhcp_v2_hcp_config_proto_depIdxs = nil
+}
--- a/proto-public/pbhcp/v2/hcp_config.proto
+++ b/proto-public/pbhcp/v2/hcp_config.proto
@ -0,0 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.hcp.v2;
+
+// HCPConfig is used to configure the HCP SDK for communicating with
+// the HashiCorp Cloud Platform. All configuration is optional with default
+// values provided by the SDK.
+message HCPConfig {
+  // AuthUrl is the URL which will be used to authenticate.
+  string auth_url = 1;
+
+  // ApiAddress is the address (<hostname>[:port]) of the HCP api.
+  string api_address = 2;
+
+  // ScadaAddress is the address (<hostname>[:port]) of the HCP SCADA endpoint.
+  string scada_address = 3;
+
+  // TlsInsecureSkipVerify if true will ignore server name verification when making HTTPS requests
+  bool tls_insecure_skip_verify = 4;
+}
--- a/proto-public/pbhcp/v2/hcp_config_deepcopy.gen.go
+++ b/proto-public/pbhcp/v2/hcp_config_deepcopy.gen.go
@ -0,0 +1,27 @@
+// Code generated by protoc-gen-deepcopy. DO NOT EDIT.
+package hcpv2
+
+import (
+	proto "google.golang.org/protobuf/proto"
+)
+
+// DeepCopyInto supports using HCPConfig within kubernetes types, where deepcopy-gen is used.
+func (in *HCPConfig) DeepCopyInto(out *HCPConfig) {
+	proto.Reset(out)
+	proto.Merge(out, proto.Clone(in))
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HCPConfig. Required by controller-gen.
+func (in *HCPConfig) DeepCopy() *HCPConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(HCPConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new HCPConfig. Required by controller-gen.
+func (in *HCPConfig) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
--- a/proto-public/pbhcp/v2/hcp_config_json.gen.go
+++ b/proto-public/pbhcp/v2/hcp_config_json.gen.go
@ -0,0 +1,22 @@
+// Code generated by protoc-json-shim. DO NOT EDIT.
+package hcpv2
+
+import (
+	protojson "google.golang.org/protobuf/encoding/protojson"
+)
+
+// MarshalJSON is a custom marshaler for HCPConfig
+func (this *HCPConfig) MarshalJSON() ([]byte, error) {
+	str, err := HcpConfigMarshaler.Marshal(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for HCPConfig
+func (this *HCPConfig) UnmarshalJSON(b []byte) error {
+	return HcpConfigUnmarshaler.Unmarshal(b, this)
+}
+
+var (
+	HcpConfigMarshaler   = &protojson.MarshalOptions{}
+	HcpConfigUnmarshaler = &protojson.UnmarshalOptions{DiscardUnknown: false}
+)
--- a/proto-public/pbhcp/v2/link.pb.go
+++ b/proto-public/pbhcp/v2/link.pb.go
@ -83,6 +83,7 @@ type Link struct {
 	ClientSecret  string      `protobuf:"bytes,3,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
 	HcpClusterUrl string      `protobuf:"bytes,4,opt,name=hcp_cluster_url,json=hcpClusterUrl,proto3" json:"hcp_cluster_url,omitempty"`
 	AccessLevel   AccessLevel `protobuf:"varint,5,opt,name=access_level,json=accessLevel,proto3,enum=hashicorp.consul.hcp.v2.AccessLevel" json:"access_level,omitempty"`
+	HcpConfig     *HCPConfig  `protobuf:"bytes,6,opt,name=hcp_config,json=hcpConfig,proto3" json:"hcp_config,omitempty"`
 }

 func (x *Link) Reset() {
@ -152,50 +153,63 @@ func (x *Link) GetAccessLevel() AccessLevel {
 	return AccessLevel_ACCESS_LEVEL_UNSPECIFIED
 }

+func (x *Link) GetHcpConfig() *HCPConfig {
+	if x != nil {
+		return x.HcpConfig
+	}
+	return nil
+}
+
 var File_pbhcp_v2_link_proto protoreflect.FileDescriptor

 var file_pbhcp_v2_link_proto_rawDesc = []byte{
 	0x0a, 0x13, 0x70, 0x62, 0x68, 0x63, 0x70, 0x2f, 0x76, 0x32, 0x2f, 0x6c, 0x69, 0x6e, 0x6b, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x17, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
-	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63, 0x70, 0x2e, 0x76, 0x32, 0x1a, 0x1c,
-	0x70, 0x62, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe2, 0x01, 0x0a,
-	0x04, 0x4c, 0x69, 0x6e, 0x6b, 0x12, 0x1f, 0x0a, 0x0b, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x49, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x65,
-	0x63, 0x72, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x26, 0x0a, 0x0f, 0x68, 0x63, 0x70, 0x5f,
-	0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0d, 0x68, 0x63, 0x70, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x6c,
-	0x12, 0x47, 0x0a, 0x0c, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x24, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
-	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63, 0x70, 0x2e, 0x76, 0x32,
-	0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x0b, 0x61, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x3a, 0x06, 0xa2, 0x93, 0x04, 0x02, 0x08,
-	0x01, 0x2a, 0x72, 0x0a, 0x0b, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x65, 0x76, 0x65, 0x6c,
-	0x12, 0x1c, 0x0a, 0x18, 0x41, 0x43, 0x43, 0x45, 0x53, 0x53, 0x5f, 0x4c, 0x45, 0x56, 0x45, 0x4c,
-	0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x22,
-	0x0a, 0x1e, 0x41, 0x43, 0x43, 0x45, 0x53, 0x53, 0x5f, 0x4c, 0x45, 0x56, 0x45, 0x4c, 0x5f, 0x47,
-	0x4c, 0x4f, 0x42, 0x41, 0x4c, 0x5f, 0x52, 0x45, 0x41, 0x44, 0x5f, 0x57, 0x52, 0x49, 0x54, 0x45,
-	0x10, 0x01, 0x12, 0x21, 0x0a, 0x1d, 0x41, 0x43, 0x43, 0x45, 0x53, 0x53, 0x5f, 0x4c, 0x45, 0x56,
-	0x45, 0x4c, 0x5f, 0x47, 0x4c, 0x4f, 0x42, 0x41, 0x4c, 0x5f, 0x52, 0x45, 0x41, 0x44, 0x5f, 0x4f,
-	0x4e, 0x4c, 0x59, 0x10, 0x02, 0x42, 0xe0, 0x01, 0x0a, 0x1b, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61,
-	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68,
-	0x63, 0x70, 0x2e, 0x76, 0x32, 0x42, 0x09, 0x4c, 0x69, 0x6e, 0x6b, 0x50, 0x72, 0x6f, 0x74, 0x6f,
-	0x50, 0x01, 0x5a, 0x37, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x68,
-	0x63, 0x70, 0x2f, 0x76, 0x32, 0x3b, 0x68, 0x63, 0x70, 0x76, 0x32, 0xa2, 0x02, 0x03, 0x48, 0x43,
-	0x48, 0xaa, 0x02, 0x17, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x48, 0x63, 0x70, 0x2e, 0x56, 0x32, 0xca, 0x02, 0x17, 0x48, 0x61,
-	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x48,
-	0x63, 0x70, 0x5c, 0x56, 0x32, 0xe2, 0x02, 0x23, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
-	0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x48, 0x63, 0x70, 0x5c, 0x56, 0x32, 0x5c,
-	0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x1a, 0x48, 0x61,
-	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a,
-	0x3a, 0x48, 0x63, 0x70, 0x3a, 0x3a, 0x56, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63, 0x70, 0x2e, 0x76, 0x32, 0x1a, 0x19,
+	0x70, 0x62, 0x68, 0x63, 0x70, 0x2f, 0x76, 0x32, 0x2f, 0x68, 0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1c, 0x70, 0x62, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa5, 0x02, 0x0a, 0x04, 0x4c, 0x69, 0x6e, 0x6b,
+	0x12, 0x1f, 0x0a, 0x0b, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49,
+	0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x23,
+	0x0a, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63,
+	0x72, 0x65, 0x74, 0x12, 0x26, 0x0a, 0x0f, 0x68, 0x63, 0x70, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x68, 0x63,
+	0x70, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x12, 0x47, 0x0a, 0x0c, 0x61,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x24, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63, 0x70, 0x2e, 0x76, 0x32, 0x2e, 0x41, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x0b, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c,
+	0x65, 0x76, 0x65, 0x6c, 0x12, 0x41, 0x0a, 0x0a, 0x68, 0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63, 0x70, 0x2e,
+	0x76, 0x32, 0x2e, 0x48, 0x43, 0x50, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x68, 0x63,
+	0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x3a, 0x06, 0xa2, 0x93, 0x04, 0x02, 0x08, 0x01, 0x2a,
+	0x72, 0x0a, 0x0b, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x1c,
+	0x0a, 0x18, 0x41, 0x43, 0x43, 0x45, 0x53, 0x53, 0x5f, 0x4c, 0x45, 0x56, 0x45, 0x4c, 0x5f, 0x55,
+	0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x22, 0x0a, 0x1e,
+	0x41, 0x43, 0x43, 0x45, 0x53, 0x53, 0x5f, 0x4c, 0x45, 0x56, 0x45, 0x4c, 0x5f, 0x47, 0x4c, 0x4f,
+	0x42, 0x41, 0x4c, 0x5f, 0x52, 0x45, 0x41, 0x44, 0x5f, 0x57, 0x52, 0x49, 0x54, 0x45, 0x10, 0x01,
+	0x12, 0x21, 0x0a, 0x1d, 0x41, 0x43, 0x43, 0x45, 0x53, 0x53, 0x5f, 0x4c, 0x45, 0x56, 0x45, 0x4c,
+	0x5f, 0x47, 0x4c, 0x4f, 0x42, 0x41, 0x4c, 0x5f, 0x52, 0x45, 0x41, 0x44, 0x5f, 0x4f, 0x4e, 0x4c,
+	0x59, 0x10, 0x02, 0x42, 0xe0, 0x01, 0x0a, 0x1b, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63, 0x70,
+	0x2e, 0x76, 0x32, 0x42, 0x09, 0x4c, 0x69, 0x6e, 0x6b, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
+	0x5a, 0x37, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x68, 0x63, 0x70,
+	0x2f, 0x76, 0x32, 0x3b, 0x68, 0x63, 0x70, 0x76, 0x32, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x48, 0xaa,
+	0x02, 0x17, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x48, 0x63, 0x70, 0x2e, 0x56, 0x32, 0xca, 0x02, 0x17, 0x48, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x48, 0x63, 0x70,
+	0x5c, 0x56, 0x32, 0xe2, 0x02, 0x23, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c,
+	0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x48, 0x63, 0x70, 0x5c, 0x56, 0x32, 0x5c, 0x47, 0x50,
+	0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x1a, 0x48, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x48,
+	0x63, 0x70, 0x3a, 0x3a, 0x56, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@ -213,16 +227,18 @@ func file_pbhcp_v2_link_proto_rawDescGZIP() []byte {
 var file_pbhcp_v2_link_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
 var file_pbhcp_v2_link_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
 var file_pbhcp_v2_link_proto_goTypes = []interface{}{
-	(AccessLevel)(0), // 0: hashicorp.consul.hcp.v2.AccessLevel
-	(*Link)(nil),     // 1: hashicorp.consul.hcp.v2.Link
+	(AccessLevel)(0),  // 0: hashicorp.consul.hcp.v2.AccessLevel
+	(*Link)(nil),      // 1: hashicorp.consul.hcp.v2.Link
+	(*HCPConfig)(nil), // 2: hashicorp.consul.hcp.v2.HCPConfig
 }
 var file_pbhcp_v2_link_proto_depIdxs = []int32{
 	0, // 0: hashicorp.consul.hcp.v2.Link.access_level:type_name -> hashicorp.consul.hcp.v2.AccessLevel
-	1, // [1:1] is the sub-list for method output_type
-	1, // [1:1] is the sub-list for method input_type
-	1, // [1:1] is the sub-list for extension type_name
-	1, // [1:1] is the sub-list for extension extendee
-	0, // [0:1] is the sub-list for field type_name
+	2, // 1: hashicorp.consul.hcp.v2.Link.hcp_config:type_name -> hashicorp.consul.hcp.v2.HCPConfig
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
 }

 func init() { file_pbhcp_v2_link_proto_init() }
@ -230,6 +246,7 @@ func file_pbhcp_v2_link_proto_init() {
 	if File_pbhcp_v2_link_proto != nil {
 		return
 	}
+	file_pbhcp_v2_hcp_config_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_pbhcp_v2_link_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Link); i {
--- a/proto-public/pbhcp/v2/link.proto
+++ b/proto-public/pbhcp/v2/link.proto
@ -5,6 +5,7 @@ syntax = "proto3";

 package hashicorp.consul.hcp.v2;

+import "pbhcp/v2/hcp_config.proto";
 import "pbresource/annotations.proto";

 enum AccessLevel {
@ -21,4 +22,5 @@ message Link {
  string client_secret = 3;
  string hcp_cluster_url = 4;
  AccessLevel access_level = 5;
+  HCPConfig hcp_config = 6;
 }
--- a/proto-public/pbhcp/v2/resources.rtypes.go
+++ b/proto-public/pbhcp/v2/resources.rtypes.go
@ -10,7 +10,8 @@ const (
 	GroupName = "hcp"
 	Version   = "v2"

-	LinkKind = "Link"
+	LinkKind           = "Link"
+	TelemetryStateKind = "TelemetryState"
 )

 var (
@ -19,4 +20,10 @@ var (
 		GroupVersion: Version,
 		Kind:         LinkKind,
 	}
+
+	TelemetryStateType = &pbresource.Type{
+		Group:        GroupName,
+		GroupVersion: Version,
+		Kind:         TelemetryStateKind,
+	}
 )
--- a/proto-public/pbhcp/v2/telemetry_state.pb.binary.go
+++ b/proto-public/pbhcp/v2/telemetry_state.pb.binary.go
@ -0,0 +1,38 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbhcp/v2/telemetry_state.proto
+
+package hcpv2
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *TelemetryState) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *TelemetryState) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *MetricsConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *MetricsConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ProxyConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ProxyConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
--- a/proto-public/pbhcp/v2/telemetry_state.pb.go
+++ b/proto-public/pbhcp/v2/telemetry_state.pb.go
@ -0,0 +1,426 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
+// source: pbhcp/v2/telemetry_state.proto
+
+package hcpv2
+
+import (
+	_ "github.com/hashicorp/consul/proto-public/pbresource"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// TelemetryState describes configuration required to forward telemetry to the HashiCorp Cloud Platform.
+// This resource is managed internally and is only written if the cluster is linked to HCP. Any
+// manual changes to the resource will be reconciled and overwritten with the internally computed
+// state.
+type TelemetryState struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// ResourceId is the identifier for the cluster linked with HCP.
+	ResourceId string `protobuf:"bytes,1,opt,name=resource_id,json=resourceId,proto3" json:"resource_id,omitempty"`
+	// ClientId is the oauth client identifier for cluster.
+	// This client has capabilities limited to writing telemetry data for this cluster.
+	ClientId string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	// ClientSecret is the oauth secret used to authenticate requests to send telemetry data to HCP.
+	ClientSecret string         `protobuf:"bytes,3,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
+	HcpConfig    *HCPConfig     `protobuf:"bytes,4,opt,name=hcp_config,json=hcpConfig,proto3" json:"hcp_config,omitempty"`
+	Proxy        *ProxyConfig   `protobuf:"bytes,5,opt,name=proxy,proto3" json:"proxy,omitempty"`
+	Metrics      *MetricsConfig `protobuf:"bytes,6,opt,name=metrics,proto3" json:"metrics,omitempty"`
+}
+
+func (x *TelemetryState) Reset() {
+	*x = TelemetryState{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbhcp_v2_telemetry_state_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TelemetryState) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TelemetryState) ProtoMessage() {}
+
+func (x *TelemetryState) ProtoReflect() protoreflect.Message {
+	mi := &file_pbhcp_v2_telemetry_state_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TelemetryState.ProtoReflect.Descriptor instead.
+func (*TelemetryState) Descriptor() ([]byte, []int) {
+	return file_pbhcp_v2_telemetry_state_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *TelemetryState) GetResourceId() string {
+	if x != nil {
+		return x.ResourceId
+	}
+	return ""
+}
+
+func (x *TelemetryState) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *TelemetryState) GetClientSecret() string {
+	if x != nil {
+		return x.ClientSecret
+	}
+	return ""
+}
+
+func (x *TelemetryState) GetHcpConfig() *HCPConfig {
+	if x != nil {
+		return x.HcpConfig
+	}
+	return nil
+}
+
+func (x *TelemetryState) GetProxy() *ProxyConfig {
+	if x != nil {
+		return x.Proxy
+	}
+	return nil
+}
+
+func (x *TelemetryState) GetMetrics() *MetricsConfig {
+	if x != nil {
+		return x.Metrics
+	}
+	return nil
+}
+
+// MetricsConfig configures metric specific collection details
+type MetricsConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Endpoint is the HTTPS address and path to forward metrics to
+	Endpoint string `protobuf:"bytes,1,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
+	// IncludeList contains patterns to match against metric names. Only matched metrics are forwarded.
+	IncludeList []string `protobuf:"bytes,2,rep,name=include_list,json=includeList,proto3" json:"include_list,omitempty"`
+	// Labels contains key value pairs that are associated with all metrics collected and fowarded.
+	Labels map[string]string `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// Disabled toggles metric forwarding. If true, metric forwarding will stop until disabled is set to false.
+	Disabled bool `protobuf:"varint,4,opt,name=disabled,proto3" json:"disabled,omitempty"`
+}
+
+func (x *MetricsConfig) Reset() {
+	*x = MetricsConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbhcp_v2_telemetry_state_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MetricsConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MetricsConfig) ProtoMessage() {}
+
+func (x *MetricsConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_pbhcp_v2_telemetry_state_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MetricsConfig.ProtoReflect.Descriptor instead.
+func (*MetricsConfig) Descriptor() ([]byte, []int) {
+	return file_pbhcp_v2_telemetry_state_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *MetricsConfig) GetEndpoint() string {
+	if x != nil {
+		return x.Endpoint
+	}
+	return ""
+}
+
+func (x *MetricsConfig) GetIncludeList() []string {
+	if x != nil {
+		return x.IncludeList
+	}
+	return nil
+}
+
+func (x *MetricsConfig) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *MetricsConfig) GetDisabled() bool {
+	if x != nil {
+		return x.Disabled
+	}
+	return false
+}
+
+// ProxyConfig describes configuration for forwarding requests through an http proxy
+type ProxyConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// HttpProxy configures the http proxy to use for HTTP (non-TLS) requests.
+	HttpProxy string `protobuf:"bytes,1,opt,name=http_proxy,json=httpProxy,proto3" json:"http_proxy,omitempty"`
+	// HttpsProxy configures the http proxy to use for HTTPS (TLS) requests.
+	HttpsProxy string `protobuf:"bytes,2,opt,name=https_proxy,json=httpsProxy,proto3" json:"https_proxy,omitempty"`
+	// NoProxy can be configured to include domains which should NOT be forwarded through the configured http proxy
+	NoProxy []string `protobuf:"bytes,3,rep,name=no_proxy,json=noProxy,proto3" json:"no_proxy,omitempty"`
+}
+
+func (x *ProxyConfig) Reset() {
+	*x = ProxyConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbhcp_v2_telemetry_state_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ProxyConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProxyConfig) ProtoMessage() {}
+
+func (x *ProxyConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_pbhcp_v2_telemetry_state_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProxyConfig.ProtoReflect.Descriptor instead.
+func (*ProxyConfig) Descriptor() ([]byte, []int) {
+	return file_pbhcp_v2_telemetry_state_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ProxyConfig) GetHttpProxy() string {
+	if x != nil {
+		return x.HttpProxy
+	}
+	return ""
+}
+
+func (x *ProxyConfig) GetHttpsProxy() string {
+	if x != nil {
+		return x.HttpsProxy
+	}
+	return ""
+}
+
+func (x *ProxyConfig) GetNoProxy() []string {
+	if x != nil {
+		return x.NoProxy
+	}
+	return nil
+}
+
+var File_pbhcp_v2_telemetry_state_proto protoreflect.FileDescriptor
+
+var file_pbhcp_v2_telemetry_state_proto_rawDesc = []byte{
+	0x0a, 0x1e, 0x70, 0x62, 0x68, 0x63, 0x70, 0x2f, 0x76, 0x32, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x6d,
+	0x65, 0x74, 0x72, 0x79, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x17, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x68, 0x63, 0x70, 0x2e, 0x76, 0x32, 0x1a, 0x19, 0x70, 0x62, 0x68, 0x63, 0x70,
+	0x2f, 0x76, 0x32, 0x2f, 0x68, 0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1c, 0x70, 0x62, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x22, 0xbc, 0x02, 0x0a, 0x0e, 0x54, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e,
+	0x74, 0x49, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x65,
+	0x63, 0x72, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x41, 0x0a, 0x0a, 0x68, 0x63, 0x70, 0x5f,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x68, 0x63, 0x70, 0x2e, 0x76, 0x32, 0x2e, 0x48, 0x43, 0x50, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x09, 0x68, 0x63, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3a, 0x0a, 0x05, 0x70,
+	0x72, 0x6f, 0x78, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63,
+	0x70, 0x2e, 0x76, 0x32, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x05, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x12, 0x40, 0x0a, 0x07, 0x6d, 0x65, 0x74, 0x72, 0x69,
+	0x63, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63, 0x70, 0x2e,
+	0x76, 0x32, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x07, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x3a, 0x06, 0xa2, 0x93, 0x04, 0x02, 0x08,
+	0x01, 0x22, 0xf1, 0x01, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12,
+	0x21, 0x0a, 0x0c, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0b, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x4c, 0x69,
+	0x73, 0x74, 0x12, 0x4a, 0x0a, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x32, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63, 0x70, 0x2e, 0x76, 0x32, 0x2e, 0x4d, 0x65, 0x74,
+	0x72, 0x69, 0x63, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c,
+	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x12, 0x1a,
+	0x0a, 0x08, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x08, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x1a, 0x39, 0x0a, 0x0b, 0x4c, 0x61,
+	0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x68, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x1d, 0x0a, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x70, 0x72, 0x6f,
+	0x78, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x68, 0x74, 0x74, 0x70, 0x50, 0x72,
+	0x6f, 0x78, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x74, 0x74, 0x70, 0x73, 0x5f, 0x70, 0x72, 0x6f,
+	0x78, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x73, 0x50,
+	0x72, 0x6f, 0x78, 0x79, 0x12, 0x19, 0x0a, 0x08, 0x6e, 0x6f, 0x5f, 0x70, 0x72, 0x6f, 0x78, 0x79,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x6e, 0x6f, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x42,
+	0xea, 0x01, 0x0a, 0x1b, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x68, 0x63, 0x70, 0x2e, 0x76, 0x32, 0x42,
+	0x13, 0x54, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x50,
+	0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x37, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
+	0x2f, 0x70, 0x62, 0x68, 0x63, 0x70, 0x2f, 0x76, 0x32, 0x3b, 0x68, 0x63, 0x70, 0x76, 0x32, 0xa2,
+	0x02, 0x03, 0x48, 0x43, 0x48, 0xaa, 0x02, 0x17, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x48, 0x63, 0x70, 0x2e, 0x56, 0x32, 0xca,
+	0x02, 0x17, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x5c, 0x48, 0x63, 0x70, 0x5c, 0x56, 0x32, 0xe2, 0x02, 0x23, 0x48, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x48, 0x63, 0x70,
+	0x5c, 0x56, 0x32, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea,
+	0x02, 0x1a, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x48, 0x63, 0x70, 0x3a, 0x3a, 0x56, 0x32, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbhcp_v2_telemetry_state_proto_rawDescOnce sync.Once
+	file_pbhcp_v2_telemetry_state_proto_rawDescData = file_pbhcp_v2_telemetry_state_proto_rawDesc
+)
+
+func file_pbhcp_v2_telemetry_state_proto_rawDescGZIP() []byte {
+	file_pbhcp_v2_telemetry_state_proto_rawDescOnce.Do(func() {
+		file_pbhcp_v2_telemetry_state_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbhcp_v2_telemetry_state_proto_rawDescData)
+	})
+	return file_pbhcp_v2_telemetry_state_proto_rawDescData
+}
+
+var file_pbhcp_v2_telemetry_state_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_pbhcp_v2_telemetry_state_proto_goTypes = []interface{}{
+	(*TelemetryState)(nil), // 0: hashicorp.consul.hcp.v2.TelemetryState
+	(*MetricsConfig)(nil),  // 1: hashicorp.consul.hcp.v2.MetricsConfig
+	(*ProxyConfig)(nil),    // 2: hashicorp.consul.hcp.v2.ProxyConfig
+	nil,                    // 3: hashicorp.consul.hcp.v2.MetricsConfig.LabelsEntry
+	(*HCPConfig)(nil),      // 4: hashicorp.consul.hcp.v2.HCPConfig
+}
+var file_pbhcp_v2_telemetry_state_proto_depIdxs = []int32{
+	4, // 0: hashicorp.consul.hcp.v2.TelemetryState.hcp_config:type_name -> hashicorp.consul.hcp.v2.HCPConfig
+	2, // 1: hashicorp.consul.hcp.v2.TelemetryState.proxy:type_name -> hashicorp.consul.hcp.v2.ProxyConfig
+	1, // 2: hashicorp.consul.hcp.v2.TelemetryState.metrics:type_name -> hashicorp.consul.hcp.v2.MetricsConfig
+	3, // 3: hashicorp.consul.hcp.v2.MetricsConfig.labels:type_name -> hashicorp.consul.hcp.v2.MetricsConfig.LabelsEntry
+	4, // [4:4] is the sub-list for method output_type
+	4, // [4:4] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_pbhcp_v2_telemetry_state_proto_init() }
+func file_pbhcp_v2_telemetry_state_proto_init() {
+	if File_pbhcp_v2_telemetry_state_proto != nil {
+		return
+	}
+	file_pbhcp_v2_hcp_config_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_pbhcp_v2_telemetry_state_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TelemetryState); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbhcp_v2_telemetry_state_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MetricsConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbhcp_v2_telemetry_state_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ProxyConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbhcp_v2_telemetry_state_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbhcp_v2_telemetry_state_proto_goTypes,
+		DependencyIndexes: file_pbhcp_v2_telemetry_state_proto_depIdxs,
+		MessageInfos:      file_pbhcp_v2_telemetry_state_proto_msgTypes,
+	}.Build()
+	File_pbhcp_v2_telemetry_state_proto = out.File
+	file_pbhcp_v2_telemetry_state_proto_rawDesc = nil
+	file_pbhcp_v2_telemetry_state_proto_goTypes = nil
+	file_pbhcp_v2_telemetry_state_proto_depIdxs = nil
+}
--- a/proto-public/pbhcp/v2/telemetry_state.proto
+++ b/proto-public/pbhcp/v2/telemetry_state.proto
@ -0,0 +1,55 @@
+syntax = "proto3";
+
+package hashicorp.consul.hcp.v2;
+
+import "pbhcp/v2/hcp_config.proto";
+import "pbresource/annotations.proto";
+
+// TelemetryState describes configuration required to forward telemetry to the HashiCorp Cloud Platform.
+// This resource is managed internally and is only written if the cluster is linked to HCP. Any
+// manual changes to the resource will be reconciled and overwritten with the internally computed
+// state.
+message TelemetryState {
+  option (hashicorp.consul.resource.spec) = {scope: SCOPE_CLUSTER};
+
+  // ResourceId is the identifier for the cluster linked with HCP.
+  string resource_id = 1;
+
+  // ClientId is the oauth client identifier for cluster.
+  // This client has capabilities limited to writing telemetry data for this cluster.
+  string client_id = 2;
+
+  // ClientSecret is the oauth secret used to authenticate requests to send telemetry data to HCP.
+  string client_secret = 3;
+
+  HCPConfig hcp_config = 4;
+  ProxyConfig proxy = 5;
+  MetricsConfig metrics = 6;
+}
+
+// MetricsConfig configures metric specific collection details
+message MetricsConfig {
+  // Endpoint is the HTTPS address and path to forward metrics to
+  string endpoint = 1;
+
+  // IncludeList contains patterns to match against metric names. Only matched metrics are forwarded.
+  repeated string include_list = 2;
+
+  // Labels contains key value pairs that are associated with all metrics collected and fowarded.
+  map<string, string> labels = 3;
+
+  // Disabled toggles metric forwarding. If true, metric forwarding will stop until disabled is set to false.
+  bool disabled = 4;
+}
+
+// ProxyConfig describes configuration for forwarding requests through an http proxy
+message ProxyConfig {
+  // HttpProxy configures the http proxy to use for HTTP (non-TLS) requests.
+  string http_proxy = 1;
+
+  // HttpsProxy configures the http proxy to use for HTTPS (TLS) requests.
+  string https_proxy = 2;
+
+  // NoProxy can be configured to include domains which should NOT be forwarded through the configured http proxy
+  repeated string no_proxy = 3;
+}
--- a/proto-public/pbhcp/v2/telemetry_state_deepcopy.gen.go
+++ b/proto-public/pbhcp/v2/telemetry_state_deepcopy.gen.go
@ -0,0 +1,69 @@
+// Code generated by protoc-gen-deepcopy. DO NOT EDIT.
+package hcpv2
+
+import (
+	proto "google.golang.org/protobuf/proto"
+)
+
+// DeepCopyInto supports using TelemetryState within kubernetes types, where deepcopy-gen is used.
+func (in *TelemetryState) DeepCopyInto(out *TelemetryState) {
+	proto.Reset(out)
+	proto.Merge(out, proto.Clone(in))
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TelemetryState. Required by controller-gen.
+func (in *TelemetryState) DeepCopy() *TelemetryState {
+	if in == nil {
+		return nil
+	}
+	out := new(TelemetryState)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new TelemetryState. Required by controller-gen.
+func (in *TelemetryState) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using MetricsConfig within kubernetes types, where deepcopy-gen is used.
+func (in *MetricsConfig) DeepCopyInto(out *MetricsConfig) {
+	proto.Reset(out)
+	proto.Merge(out, proto.Clone(in))
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricsConfig. Required by controller-gen.
+func (in *MetricsConfig) DeepCopy() *MetricsConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(MetricsConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new MetricsConfig. Required by controller-gen.
+func (in *MetricsConfig) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using ProxyConfig within kubernetes types, where deepcopy-gen is used.
+func (in *ProxyConfig) DeepCopyInto(out *ProxyConfig) {
+	proto.Reset(out)
+	proto.Merge(out, proto.Clone(in))
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyConfig. Required by controller-gen.
+func (in *ProxyConfig) DeepCopy() *ProxyConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new ProxyConfig. Required by controller-gen.
+func (in *ProxyConfig) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
--- a/proto-public/pbhcp/v2/telemetry_state_json.gen.go
+++ b/proto-public/pbhcp/v2/telemetry_state_json.gen.go
@ -0,0 +1,44 @@
+// Code generated by protoc-json-shim. DO NOT EDIT.
+package hcpv2
+
+import (
+	protojson "google.golang.org/protobuf/encoding/protojson"
+)
+
+// MarshalJSON is a custom marshaler for TelemetryState
+func (this *TelemetryState) MarshalJSON() ([]byte, error) {
+	str, err := TelemetryStateMarshaler.Marshal(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for TelemetryState
+func (this *TelemetryState) UnmarshalJSON(b []byte) error {
+	return TelemetryStateUnmarshaler.Unmarshal(b, this)
+}
+
+// MarshalJSON is a custom marshaler for MetricsConfig
+func (this *MetricsConfig) MarshalJSON() ([]byte, error) {
+	str, err := TelemetryStateMarshaler.Marshal(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for MetricsConfig
+func (this *MetricsConfig) UnmarshalJSON(b []byte) error {
+	return TelemetryStateUnmarshaler.Unmarshal(b, this)
+}
+
+// MarshalJSON is a custom marshaler for ProxyConfig
+func (this *ProxyConfig) MarshalJSON() ([]byte, error) {
+	str, err := TelemetryStateMarshaler.Marshal(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for ProxyConfig
+func (this *ProxyConfig) UnmarshalJSON(b []byte) error {
+	return TelemetryStateUnmarshaler.Unmarshal(b, this)
+}
+
+var (
+	TelemetryStateMarshaler   = &protojson.MarshalOptions{}
+	TelemetryStateUnmarshaler = &protojson.UnmarshalOptions{DiscardUnknown: false}
+)