v2tenancy: add optional LicenseFeature to type Registration struct (#20673)

Makefile

@@ -11,7 +11,7 @@ GO_MODULES := $(shell find . -name go.mod -exec dirname {} \; | grep -v "proto-g
 # or the string @DEV to imply use what is currently installed locally.
 ###
 GOLANGCI_LINT_VERSION='v1.55.2'
-MOCKERY_VERSION='v2.37.1'
+MOCKERY_VERSION='v2.41.0'
 BUF_VERSION='v1.26.0'
 
 PROTOC_GEN_GO_GRPC_VERSION='v1.2.0'

agent/consul/server_ce.go

@@ -18,8 +18,11 @@ import (
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/consul/reporting"
+	resourcegrpc "github.com/hashicorp/consul/agent/grpc-external/services/resource"
 	"github.com/hashicorp/consul/agent/structs"
+	"github.com/hashicorp/consul/internal/resource"
 	"github.com/hashicorp/consul/lib"
+	"github.com/hashicorp/consul/logging"
 )
 
 // runEnterpriseRateLimiterConfigEntryController start the rate limiter config controller
@@ -193,3 +196,15 @@ func getEnterpriseReportingDeps(deps Deps) reporting.EntDeps {
 	// no-op
 	return reporting.EntDeps{}
 }
+
+// CE version without LicenseManager
+func (s *Server) newResourceServiceConfig(typeRegistry resource.Registry, resolver resourcegrpc.ACLResolver, tenancyBridge resourcegrpc.TenancyBridge) resourcegrpc.Config {
+	return resourcegrpc.Config{
+		Registry:      typeRegistry,
+		Backend:       s.storageBackend,
+		ACLResolver:   resolver,
+		Logger:        s.loggers.Named(logging.GRPCAPI).Named(logging.Resource),
+		TenancyBridge: tenancyBridge,
+		UseV2Tenancy:  s.useV2Tenancy,
+	}
+}

agent/consul/server_grpc.go

@@ -360,14 +360,7 @@ func (s *Server) registerResourceServiceServer(typeRegistry resource.Registry, r
 	}
 
 	// Create the Resource Service Server
-	srv := resourcegrpc.NewServer(resourcegrpc.Config{
-		Registry:      typeRegistry,
-		Backend:       s.storageBackend,
-		ACLResolver:   resolver,
-		Logger:        s.loggers.Named(logging.GRPCAPI).Named(logging.Resource),
-		TenancyBridge: tenancyBridge,
-		UseV2Tenancy:  s.useV2Tenancy,
-	})
+	srv := resourcegrpc.NewServer(s.newResourceServiceConfig(typeRegistry, resolver, tenancyBridge))
 
 	// Register the server to all the desired interfaces
 	for _, reg := range registrars {

agent/grpc-external/services/resource/delete.go

@@ -28,6 +28,7 @@ import (
 // - Delete of a previously deleted or non-existent resource is a no-op to support idempotency.
 // - Errors with Aborted if the requested Version does not match the stored Version.
 // - Errors with PermissionDenied if ACL check fails
+// - Errors with PermissionDenied if a license feature tied to the resource type is not allowed.
 func (s *Server) Delete(ctx context.Context, req *pbresource.DeleteRequest) (*pbresource.DeleteResponse, error) {
 	reg, err := s.ensureDeleteRequestValid(req)
 	if err != nil {
@@ -195,6 +196,10 @@ func (s *Server) ensureDeleteRequestValid(req *pbresource.DeleteRequest) (*resou
 		return nil, err
 	}
 
+	if err = s.FeatureCheck(reg); err != nil {
+		return nil, err
+	}
+
 	if err = checkV2Tenancy(s.UseV2Tenancy, req.Id.Type); err != nil {
 		return nil, err
 	}

agent/grpc-external/services/resource/list.go

@@ -100,6 +100,10 @@ func (s *Server) ensureListRequestValid(req *pbresource.ListRequest) (*resource.
 		return nil, err
 	}
 
+	// Ignore return value since read ops are allowed but will log a warning if the feature is
+	// not enabled in the license.
+	_ = s.FeatureCheck(reg)
+
 	if err = checkV2Tenancy(s.UseV2Tenancy, req.Type); err != nil {
 		return nil, err
 	}

agent/grpc-external/services/resource/mock_Registry.go

@@ -43,6 +43,22 @@ func (_m *MockRegistry) Resolve(typ *pbresource.Type) (internalresource.Registra
 	return r0, r1
 }
 
+// Types provides a mock function with given fields:
+func (_m *MockRegistry) Types() []internalresource.Registration {
+	ret := _m.Called()
+
+	var r0 []internalresource.Registration
+	if rf, ok := ret.Get(0).(func() []internalresource.Registration); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]internalresource.Registration)
+		}
+	}
+
+	return r0
+}
+
 type mockConstructorTestingTNewMockRegistry interface {
 	mock.TestingT
 	Cleanup(func())

agent/grpc-external/services/resource/mutate_and_validate.go

@@ -16,7 +16,7 @@ import (
 )
 
 func (s *Server) MutateAndValidate(ctx context.Context, req *pbresource.MutateAndValidateRequest) (*pbresource.MutateAndValidateResponse, error) {
-	tenancyMarkedForDeletion, err := s.mutateAndValidate(ctx, req.Resource)
+	tenancyMarkedForDeletion, err := s.mutateAndValidate(ctx, req.Resource, false)
 	if err != nil {
 		return nil, err
 	}
@@ -33,8 +33,8 @@ func (s *Server) MutateAndValidate(ctx context.Context, req *pbresource.MutateAn
 }
 
 // private DRY impl that is used by both the Write and MutateAndValidate RPCs.
-func (s *Server) mutateAndValidate(ctx context.Context, res *pbresource.Resource) (tenancyMarkedForDeletion bool, err error) {
-	reg, err := s.ensureResourceValid(res)
+func (s *Server) mutateAndValidate(ctx context.Context, res *pbresource.Resource, enforceLicenseCheck bool) (tenancyMarkedForDeletion bool, err error) {
+	reg, err := s.ensureResourceValid(res, enforceLicenseCheck)
 	if err != nil {
 		return false, err
 	}
@@ -92,7 +92,7 @@ func (s *Server) mutateAndValidate(ctx context.Context, res *pbresource.Resource
 	return false, nil
 }
 
-func (s *Server) ensureResourceValid(res *pbresource.Resource) (*resource.Registration, error) {
+func (s *Server) ensureResourceValid(res *pbresource.Resource, enforceLicenseCheck bool) (*resource.Registration, error) {
 	var field string
 	switch {
 	case res == nil:
@@ -121,6 +121,12 @@ func (s *Server) ensureResourceValid(res *pbresource.Resource) (*resource.Regist
 		return nil, err
 	}
 
+	// Since this is shared by Write and MutateAndValidate, only fail the operation
+	// if it's a write operation and the feature is not allowed by the license.
+	if err = s.FeatureCheck(reg); err != nil && enforceLicenseCheck {
+		return nil, err
+	}
+
 	if err = checkV2Tenancy(s.UseV2Tenancy, res.Id.Type); err != nil {
 		return nil, err
 	}

agent/grpc-external/services/resource/read.go

@@ -24,7 +24,7 @@ func (s *Server) Read(ctx context.Context, req *pbresource.ReadRequest) (*pbreso
 	}
 
 	// acl.EnterpriseMeta acl.AuthorizerContext follow rules for V1 resources since they integrate with the V1 acl subsystem.
-	// pbresource.Tenacy follows rules for V2 resources and the Resource service.
+	// pbresource.Tenancy follows rules for V2 resources and the Resource service.
 	// Example:
 	//
 	//    A CE namespace scoped resource:
@@ -102,6 +102,10 @@ func (s *Server) ensureReadRequestValid(req *pbresource.ReadRequest) (*resource.
 		return nil, err
 	}
 
+	// Ignore return value since read ops are allowed but will log a warning if the feature is
+	// not enabled in the license.
+	_ = s.FeatureCheck(reg)
+
 	if err = checkV2Tenancy(s.UseV2Tenancy, req.Id.Type); err != nil {
 		return nil, err
 	}

agent/grpc-external/services/resource/server.go

@@ -15,8 +15,6 @@ import (
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
 
-	"github.com/hashicorp/go-hclog"
-
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/acl/resolver"
 	"github.com/hashicorp/consul/internal/resource"
@@ -29,23 +27,6 @@ type Server struct {
 	Config
 }
 
-type Config struct {
-	Logger   hclog.Logger
-	Registry Registry
-
-	// Backend is the storage backend that will be used for resource persistence.
-	Backend     Backend
-	ACLResolver ACLResolver
-	// TenancyBridge temporarily allows us to use V1 implementations of
-	// partitions and namespaces until V2 implementations are available.
-	TenancyBridge TenancyBridge
-
-	// UseV2Tenancy is true if the "v2tenancy" experiement is active, false otherwise.
-	// Attempts to create v2 tenancy resources (partition or namespace) will fail when the
-	// flag is false.
-	UseV2Tenancy bool
-}
-
 //go:generate mockery --name Registry --inpackage
 type Registry interface {
 	resource.Registry
@@ -79,7 +60,7 @@ func (s *Server) Register(registrar grpc.ServiceRegistrar) {
 	pbresource.RegisterResourceServiceServer(registrar, s)
 }
 
-// Get token from grpc metadata or AnonymounsTokenId if not found
+// Get token from grpc metadata or AnonymousTokenId if not found
 func tokenFromContext(ctx context.Context) string {
 	md, ok := metadata.FromIncomingContext(ctx)
 	if !ok {

agent/grpc-external/services/resource/server_ce.go

@@ -9,6 +9,8 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
+	"github.com/hashicorp/go-hclog"
+
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/internal/resource"
 	"github.com/hashicorp/consul/proto-public/pbresource"
@@ -37,3 +39,25 @@ func checkV2Tenancy(useV2Tenancy bool, rtype *pbresource.Type) error {
 	}
 	return nil
 }
+
+type Config struct {
+	Logger   hclog.Logger
+	Registry Registry
+
+	// Backend is the storage backend that will be used for resource persistence.
+	Backend     Backend
+	ACLResolver ACLResolver
+	// TenancyBridge temporarily allows us to use V1 implementations of
+	// partitions and namespaces until V2 implementations are available.
+	TenancyBridge TenancyBridge
+
+	// UseV2Tenancy is true if the "v2tenancy" experiment is active, false otherwise.
+	// Attempts to create v2 tenancy resources (partition or namespace) will fail when the
+	// flag is false.
+	UseV2Tenancy bool
+}
+
+// FeatureCheck does not apply to the community edition.
+func (s *Server) FeatureCheck(reg *resource.Registration) error {
+	return nil
+}

agent/grpc-external/services/resource/server_test.go

@@ -244,7 +244,7 @@ func tenancyCases() map[string]func(artistId, recordlabelId *pbresource.ID) *pbr
 			id.Tenancy.Namespace = ""
 			return id
 		},
-		"namespaced resource inherits tokens partition and namespace when tenacy nil": func(artistId, _ *pbresource.ID) *pbresource.ID {
+		"namespaced resource inherits tokens partition and namespace when tenancy nil": func(artistId, _ *pbresource.ID) *pbresource.ID {
 			id := clone(artistId)
 			id.Tenancy = nil
 			return id

agent/grpc-external/services/resource/testing/builder.go

@@ -20,16 +20,6 @@ import (
 	"github.com/hashicorp/consul/sdk/testutil"
 )
 
-type Builder struct {
-	registry     resource.Registry
-	registerFns  []func(resource.Registry)
-	useV2Tenancy bool
-	tenancies    []*pbresource.Tenancy
-	aclResolver  svc.ACLResolver
-	serviceImpl  *svc.Server
-	cloning      bool
-}
-
 // NewResourceServiceBuilder is the preferred way to configure and run
 // an isolated in-process instance of the resource service for unit
 // testing. The final call to `Run()` returns a client you can use for
@@ -61,7 +51,7 @@ func (b *Builder) Registry() resource.Registry {
 	return b.registry
 }
 
-// ServiceImpl provides access to the actual server side implemenation of the resource service. This should never be used
+// ServiceImpl provides access to the actual server side implementation of the resource service. This should never be
 // used/accessed without good reason. The current justifying use case is to monkeypatch the ACL resolver post-creation
 // to allow unfettered writes which some ACL related tests require to put test data in place.
 func (b *Builder) ServiceImpl() *svc.Server {
@@ -167,16 +157,12 @@ func (b *Builder) Run(t testutil.TestingTB) pbresource.ResourceServiceClient {
 		b.aclResolver = mockACLResolver
 	}
 
-	config := svc.Config{
-		Logger:        testutil.Logger(t),
-		Registry:      b.registry,
-		Backend:       backend,
-		ACLResolver:   b.aclResolver,
-		TenancyBridge: tenancyBridge,
-		UseV2Tenancy:  b.useV2Tenancy,
-	}
+	// ent only
+	b.ensureLicenseManager()
+
+	config := b.newConfig(testutil.Logger(t), backend, tenancyBridge)
 
-	b.serviceImpl = svc.NewServer(config)
+	b.serviceImpl = svc.NewServer(*config)
 	ch := &inprocgrpc.Channel{}
 	pbresource.RegisterResourceServiceServer(ch, b.serviceImpl)
 	client := pbresource.NewResourceServiceClient(ch)

agent/grpc-external/services/resource/testing/builder_ce.go

@@ -0,0 +1,38 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !consulent
+
+package testing
+
+import (
+	"github.com/hashicorp/go-hclog"
+
+	svc "github.com/hashicorp/consul/agent/grpc-external/services/resource"
+	"github.com/hashicorp/consul/internal/resource"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+type Builder struct {
+	registry     resource.Registry
+	registerFns  []func(resource.Registry)
+	useV2Tenancy bool
+	tenancies    []*pbresource.Tenancy
+	aclResolver  svc.ACLResolver
+	serviceImpl  *svc.Server
+	cloning      bool
+}
+
+func (b *Builder) ensureLicenseManager() {
+}
+
+func (b *Builder) newConfig(logger hclog.Logger, backend svc.Backend, tenancyBridge resource.TenancyBridge) *svc.Config {
+	return &svc.Config{
+		Logger:        logger,
+		Registry:      b.registry,
+		Backend:       backend,
+		ACLResolver:   b.aclResolver,
+		TenancyBridge: tenancyBridge,
+		UseV2Tenancy:  b.useV2Tenancy,
+	}
+}

agent/grpc-external/services/resource/watch.go

@@ -121,6 +121,10 @@ func (s *Server) ensureWatchListRequestValid(req *pbresource.WatchListRequest) (
 		return nil, err
 	}
 
+	// Ignore return value since read ops are allowed but will log a warning if the feature is
+	// not enabled in the license.
+	_ = s.FeatureCheck(reg)
+
 	// if no tenancy is passed defaults to wildcard
 	if req.Tenancy == nil {
 		req.Tenancy = wildcardTenancyFor(reg.Scope)

agent/grpc-external/services/resource/write.go

@@ -35,7 +35,7 @@ import (
 var errUseWriteStatus = status.Error(codes.InvalidArgument, "resource.status can only be set using the WriteStatus endpoint")
 
 func (s *Server) Write(ctx context.Context, req *pbresource.WriteRequest) (*pbresource.WriteResponse, error) {
-	tenancyMarkedForDeletion, err := s.mutateAndValidate(ctx, req.Resource)
+	tenancyMarkedForDeletion, err := s.mutateAndValidate(ctx, req.Resource, true)
 	if err != nil {
 		return nil, err
 	}

agent/grpc-external/services/resource/write_test.go

@@ -349,7 +349,7 @@ func TestWrite_Update_StatusModified(t *testing.T) {
 	require.NoError(t, err)
 	res = statusRsp.Resource
 
-	// Passing the staus unmodified should be fine.
+	// Passing the status unmodified should be fine.
 	rsp2, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
 	require.NoError(t, err)
 

grpcmocks/proto-public/pbacl/mock_ACLServiceClient.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbacl
 
@@ -36,6 +36,10 @@ func (_m *ACLServiceClient) Login(ctx context.Context, in *pbacl.LoginRequest, o
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Login")
+	}
+
 	var r0 *pbacl.LoginResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbacl.LoginRequest, ...grpc.CallOption) (*pbacl.LoginResponse, error)); ok {
@@ -106,6 +110,10 @@ func (_m *ACLServiceClient) Logout(ctx context.Context, in *pbacl.LogoutRequest,
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Logout")
+	}
+
 	var r0 *pbacl.LogoutResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbacl.LogoutRequest, ...grpc.CallOption) (*pbacl.LogoutResponse, error)); ok {

grpcmocks/proto-public/pbacl/mock_ACLServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbacl
 
@@ -26,6 +26,10 @@ func (_m *ACLServiceServer) EXPECT() *ACLServiceServer_Expecter {
 func (_m *ACLServiceServer) Login(_a0 context.Context, _a1 *pbacl.LoginRequest) (*pbacl.LoginResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Login")
+	}
+
 	var r0 *pbacl.LoginResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbacl.LoginRequest) (*pbacl.LoginResponse, error)); ok {
@@ -81,6 +85,10 @@ func (_c *ACLServiceServer_Login_Call) RunAndReturn(run func(context.Context, *p
 func (_m *ACLServiceServer) Logout(_a0 context.Context, _a1 *pbacl.LogoutRequest) (*pbacl.LogoutResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Logout")
+	}
+
 	var r0 *pbacl.LogoutResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbacl.LogoutRequest) (*pbacl.LogoutResponse, error)); ok {

grpcmocks/proto-public/pbacl/mock_UnsafeACLServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbacl
 

grpcmocks/proto-public/pbconnectca/mock_ConnectCAServiceClient.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbconnectca
 
@@ -36,6 +36,10 @@ func (_m *ConnectCAServiceClient) Sign(ctx context.Context, in *pbconnectca.Sign
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Sign")
+	}
+
 	var r0 *pbconnectca.SignResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbconnectca.SignRequest, ...grpc.CallOption) (*pbconnectca.SignResponse, error)); ok {
@@ -106,6 +110,10 @@ func (_m *ConnectCAServiceClient) WatchRoots(ctx context.Context, in *pbconnectc
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for WatchRoots")
+	}
+
 	var r0 pbconnectca.ConnectCAService_WatchRootsClient
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbconnectca.WatchRootsRequest, ...grpc.CallOption) (pbconnectca.ConnectCAService_WatchRootsClient, error)); ok {

grpcmocks/proto-public/pbconnectca/mock_ConnectCAServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbconnectca
 
@@ -26,6 +26,10 @@ func (_m *ConnectCAServiceServer) EXPECT() *ConnectCAServiceServer_Expecter {
 func (_m *ConnectCAServiceServer) Sign(_a0 context.Context, _a1 *pbconnectca.SignRequest) (*pbconnectca.SignResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Sign")
+	}
+
 	var r0 *pbconnectca.SignResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbconnectca.SignRequest) (*pbconnectca.SignResponse, error)); ok {
@@ -81,6 +85,10 @@ func (_c *ConnectCAServiceServer_Sign_Call) RunAndReturn(run func(context.Contex
 func (_m *ConnectCAServiceServer) WatchRoots(_a0 *pbconnectca.WatchRootsRequest, _a1 pbconnectca.ConnectCAService_WatchRootsServer) error {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for WatchRoots")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(*pbconnectca.WatchRootsRequest, pbconnectca.ConnectCAService_WatchRootsServer) error); ok {
 		r0 = rf(_a0, _a1)

grpcmocks/proto-public/pbconnectca/mock_ConnectCAService_WatchRootsClient.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbconnectca
 
@@ -28,6 +28,10 @@ func (_m *ConnectCAService_WatchRootsClient) EXPECT() *ConnectCAService_WatchRoo
 func (_m *ConnectCAService_WatchRootsClient) CloseSend() error {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for CloseSend")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func() error); ok {
 		r0 = rf()
@@ -69,6 +73,10 @@ func (_c *ConnectCAService_WatchRootsClient_CloseSend_Call) RunAndReturn(run fun
 func (_m *ConnectCAService_WatchRootsClient) Context() context.Context {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Context")
+	}
+
 	var r0 context.Context
 	if rf, ok := ret.Get(0).(func() context.Context); ok {
 		r0 = rf()
@@ -112,6 +120,10 @@ func (_c *ConnectCAService_WatchRootsClient_Context_Call) RunAndReturn(run func(
 func (_m *ConnectCAService_WatchRootsClient) Header() (metadata.MD, error) {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Header")
+	}
+
 	var r0 metadata.MD
 	var r1 error
 	if rf, ok := ret.Get(0).(func() (metadata.MD, error)); ok {
@@ -165,6 +177,10 @@ func (_c *ConnectCAService_WatchRootsClient_Header_Call) RunAndReturn(run func()
 func (_m *ConnectCAService_WatchRootsClient) Recv() (*pbconnectca.WatchRootsResponse, error) {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Recv")
+	}
+
 	var r0 *pbconnectca.WatchRootsResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func() (*pbconnectca.WatchRootsResponse, error)); ok {
@@ -218,6 +234,10 @@ func (_c *ConnectCAService_WatchRootsClient_Recv_Call) RunAndReturn(run func() (
 func (_m *ConnectCAService_WatchRootsClient) RecvMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for RecvMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -260,6 +280,10 @@ func (_c *ConnectCAService_WatchRootsClient_RecvMsg_Call) RunAndReturn(run func(
 func (_m *ConnectCAService_WatchRootsClient) SendMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SendMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -302,6 +326,10 @@ func (_c *ConnectCAService_WatchRootsClient_SendMsg_Call) RunAndReturn(run func(
 func (_m *ConnectCAService_WatchRootsClient) Trailer() metadata.MD {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Trailer")
+	}
+
 	var r0 metadata.MD
 	if rf, ok := ret.Get(0).(func() metadata.MD); ok {
 		r0 = rf()

grpcmocks/proto-public/pbconnectca/mock_ConnectCAService_WatchRootsServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbconnectca
 
@@ -28,6 +28,10 @@ func (_m *ConnectCAService_WatchRootsServer) EXPECT() *ConnectCAService_WatchRoo
 func (_m *ConnectCAService_WatchRootsServer) Context() context.Context {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Context")
+	}
+
 	var r0 context.Context
 	if rf, ok := ret.Get(0).(func() context.Context); ok {
 		r0 = rf()
@@ -71,6 +75,10 @@ func (_c *ConnectCAService_WatchRootsServer_Context_Call) RunAndReturn(run func(
 func (_m *ConnectCAService_WatchRootsServer) RecvMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for RecvMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -113,6 +121,10 @@ func (_c *ConnectCAService_WatchRootsServer_RecvMsg_Call) RunAndReturn(run func(
 func (_m *ConnectCAService_WatchRootsServer) Send(_a0 *pbconnectca.WatchRootsResponse) error {
 	ret := _m.Called(_a0)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Send")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(*pbconnectca.WatchRootsResponse) error); ok {
 		r0 = rf(_a0)
@@ -155,6 +167,10 @@ func (_c *ConnectCAService_WatchRootsServer_Send_Call) RunAndReturn(run func(*pb
 func (_m *ConnectCAService_WatchRootsServer) SendHeader(_a0 metadata.MD) error {
 	ret := _m.Called(_a0)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SendHeader")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(metadata.MD) error); ok {
 		r0 = rf(_a0)
@@ -197,6 +213,10 @@ func (_c *ConnectCAService_WatchRootsServer_SendHeader_Call) RunAndReturn(run fu
 func (_m *ConnectCAService_WatchRootsServer) SendMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SendMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -239,6 +259,10 @@ func (_c *ConnectCAService_WatchRootsServer_SendMsg_Call) RunAndReturn(run func(
 func (_m *ConnectCAService_WatchRootsServer) SetHeader(_a0 metadata.MD) error {
 	ret := _m.Called(_a0)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SetHeader")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(metadata.MD) error); ok {
 		r0 = rf(_a0)

grpcmocks/proto-public/pbconnectca/mock_UnsafeConnectCAServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbconnectca
 

grpcmocks/proto-public/pbdataplane/mock_DataplaneServiceClient.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbdataplane
 
@@ -36,6 +36,10 @@ func (_m *DataplaneServiceClient) GetEnvoyBootstrapParams(ctx context.Context, i
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for GetEnvoyBootstrapParams")
+	}
+
 	var r0 *pbdataplane.GetEnvoyBootstrapParamsResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbdataplane.GetEnvoyBootstrapParamsRequest, ...grpc.CallOption) (*pbdataplane.GetEnvoyBootstrapParamsResponse, error)); ok {
@@ -106,6 +110,10 @@ func (_m *DataplaneServiceClient) GetSupportedDataplaneFeatures(ctx context.Cont
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for GetSupportedDataplaneFeatures")
+	}
+
 	var r0 *pbdataplane.GetSupportedDataplaneFeaturesResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbdataplane.GetSupportedDataplaneFeaturesRequest, ...grpc.CallOption) (*pbdataplane.GetSupportedDataplaneFeaturesResponse, error)); ok {

grpcmocks/proto-public/pbdataplane/mock_DataplaneServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbdataplane
 
@@ -26,6 +26,10 @@ func (_m *DataplaneServiceServer) EXPECT() *DataplaneServiceServer_Expecter {
 func (_m *DataplaneServiceServer) GetEnvoyBootstrapParams(_a0 context.Context, _a1 *pbdataplane.GetEnvoyBootstrapParamsRequest) (*pbdataplane.GetEnvoyBootstrapParamsResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for GetEnvoyBootstrapParams")
+	}
+
 	var r0 *pbdataplane.GetEnvoyBootstrapParamsResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbdataplane.GetEnvoyBootstrapParamsRequest) (*pbdataplane.GetEnvoyBootstrapParamsResponse, error)); ok {
@@ -81,6 +85,10 @@ func (_c *DataplaneServiceServer_GetEnvoyBootstrapParams_Call) RunAndReturn(run
 func (_m *DataplaneServiceServer) GetSupportedDataplaneFeatures(_a0 context.Context, _a1 *pbdataplane.GetSupportedDataplaneFeaturesRequest) (*pbdataplane.GetSupportedDataplaneFeaturesResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for GetSupportedDataplaneFeatures")
+	}
+
 	var r0 *pbdataplane.GetSupportedDataplaneFeaturesResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbdataplane.GetSupportedDataplaneFeaturesRequest) (*pbdataplane.GetSupportedDataplaneFeaturesResponse, error)); ok {

grpcmocks/proto-public/pbdataplane/mock_UnsafeDataplaneServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbdataplane
 

grpcmocks/proto-public/pbdataplane/mock_isGetEnvoyBootstrapParamsRequest_NodeSpec.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbdataplane
 

grpcmocks/proto-public/pbdns/mock_DNSServiceClient.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbdns
 
@@ -36,6 +36,10 @@ func (_m *DNSServiceClient) Query(ctx context.Context, in *pbdns.QueryRequest, o
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Query")
+	}
+
 	var r0 *pbdns.QueryResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbdns.QueryRequest, ...grpc.CallOption) (*pbdns.QueryResponse, error)); ok {

grpcmocks/proto-public/pbdns/mock_DNSServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbdns
 
@@ -26,6 +26,10 @@ func (_m *DNSServiceServer) EXPECT() *DNSServiceServer_Expecter {
 func (_m *DNSServiceServer) Query(_a0 context.Context, _a1 *pbdns.QueryRequest) (*pbdns.QueryResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Query")
+	}
+
 	var r0 *pbdns.QueryResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbdns.QueryRequest) (*pbdns.QueryResponse, error)); ok {

grpcmocks/proto-public/pbdns/mock_UnsafeDNSServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbdns
 

grpcmocks/proto-public/pbresource/mock_ResourceServiceClient.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbresource
 
@@ -36,6 +36,10 @@ func (_m *ResourceServiceClient) Delete(ctx context.Context, in *pbresource.Dele
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Delete")
+	}
+
 	var r0 *pbresource.DeleteResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.DeleteRequest, ...grpc.CallOption) (*pbresource.DeleteResponse, error)); ok {
@@ -106,6 +110,10 @@ func (_m *ResourceServiceClient) List(ctx context.Context, in *pbresource.ListRe
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for List")
+	}
+
 	var r0 *pbresource.ListResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.ListRequest, ...grpc.CallOption) (*pbresource.ListResponse, error)); ok {
@@ -176,6 +184,10 @@ func (_m *ResourceServiceClient) ListByOwner(ctx context.Context, in *pbresource
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for ListByOwner")
+	}
+
 	var r0 *pbresource.ListByOwnerResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.ListByOwnerRequest, ...grpc.CallOption) (*pbresource.ListByOwnerResponse, error)); ok {
@@ -246,6 +258,10 @@ func (_m *ResourceServiceClient) MutateAndValidate(ctx context.Context, in *pbre
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for MutateAndValidate")
+	}
+
 	var r0 *pbresource.MutateAndValidateResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.MutateAndValidateRequest, ...grpc.CallOption) (*pbresource.MutateAndValidateResponse, error)); ok {
@@ -316,6 +332,10 @@ func (_m *ResourceServiceClient) Read(ctx context.Context, in *pbresource.ReadRe
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Read")
+	}
+
 	var r0 *pbresource.ReadResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.ReadRequest, ...grpc.CallOption) (*pbresource.ReadResponse, error)); ok {
@@ -386,6 +406,10 @@ func (_m *ResourceServiceClient) WatchList(ctx context.Context, in *pbresource.W
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for WatchList")
+	}
+
 	var r0 pbresource.ResourceService_WatchListClient
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.WatchListRequest, ...grpc.CallOption) (pbresource.ResourceService_WatchListClient, error)); ok {
@@ -456,6 +480,10 @@ func (_m *ResourceServiceClient) Write(ctx context.Context, in *pbresource.Write
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Write")
+	}
+
 	var r0 *pbresource.WriteResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.WriteRequest, ...grpc.CallOption) (*pbresource.WriteResponse, error)); ok {
@@ -526,6 +554,10 @@ func (_m *ResourceServiceClient) WriteStatus(ctx context.Context, in *pbresource
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for WriteStatus")
+	}
+
 	var r0 *pbresource.WriteStatusResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.WriteStatusRequest, ...grpc.CallOption) (*pbresource.WriteStatusResponse, error)); ok {

grpcmocks/proto-public/pbresource/mock_ResourceServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbresource
 
@@ -26,6 +26,10 @@ func (_m *ResourceServiceServer) EXPECT() *ResourceServiceServer_Expecter {
 func (_m *ResourceServiceServer) Delete(_a0 context.Context, _a1 *pbresource.DeleteRequest) (*pbresource.DeleteResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Delete")
+	}
+
 	var r0 *pbresource.DeleteResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.DeleteRequest) (*pbresource.DeleteResponse, error)); ok {
@@ -81,6 +85,10 @@ func (_c *ResourceServiceServer_Delete_Call) RunAndReturn(run func(context.Conte
 func (_m *ResourceServiceServer) List(_a0 context.Context, _a1 *pbresource.ListRequest) (*pbresource.ListResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for List")
+	}
+
 	var r0 *pbresource.ListResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.ListRequest) (*pbresource.ListResponse, error)); ok {
@@ -136,6 +144,10 @@ func (_c *ResourceServiceServer_List_Call) RunAndReturn(run func(context.Context
 func (_m *ResourceServiceServer) ListByOwner(_a0 context.Context, _a1 *pbresource.ListByOwnerRequest) (*pbresource.ListByOwnerResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for ListByOwner")
+	}
+
 	var r0 *pbresource.ListByOwnerResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.ListByOwnerRequest) (*pbresource.ListByOwnerResponse, error)); ok {
@@ -191,6 +203,10 @@ func (_c *ResourceServiceServer_ListByOwner_Call) RunAndReturn(run func(context.
 func (_m *ResourceServiceServer) MutateAndValidate(_a0 context.Context, _a1 *pbresource.MutateAndValidateRequest) (*pbresource.MutateAndValidateResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for MutateAndValidate")
+	}
+
 	var r0 *pbresource.MutateAndValidateResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.MutateAndValidateRequest) (*pbresource.MutateAndValidateResponse, error)); ok {
@@ -246,6 +262,10 @@ func (_c *ResourceServiceServer_MutateAndValidate_Call) RunAndReturn(run func(co
 func (_m *ResourceServiceServer) Read(_a0 context.Context, _a1 *pbresource.ReadRequest) (*pbresource.ReadResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Read")
+	}
+
 	var r0 *pbresource.ReadResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.ReadRequest) (*pbresource.ReadResponse, error)); ok {
@@ -301,6 +321,10 @@ func (_c *ResourceServiceServer_Read_Call) RunAndReturn(run func(context.Context
 func (_m *ResourceServiceServer) WatchList(_a0 *pbresource.WatchListRequest, _a1 pbresource.ResourceService_WatchListServer) error {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for WatchList")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(*pbresource.WatchListRequest, pbresource.ResourceService_WatchListServer) error); ok {
 		r0 = rf(_a0, _a1)
@@ -344,6 +368,10 @@ func (_c *ResourceServiceServer_WatchList_Call) RunAndReturn(run func(*pbresourc
 func (_m *ResourceServiceServer) Write(_a0 context.Context, _a1 *pbresource.WriteRequest) (*pbresource.WriteResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Write")
+	}
+
 	var r0 *pbresource.WriteResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.WriteRequest) (*pbresource.WriteResponse, error)); ok {
@@ -399,6 +427,10 @@ func (_c *ResourceServiceServer_Write_Call) RunAndReturn(run func(context.Contex
 func (_m *ResourceServiceServer) WriteStatus(_a0 context.Context, _a1 *pbresource.WriteStatusRequest) (*pbresource.WriteStatusResponse, error) {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for WriteStatus")
+	}
+
 	var r0 *pbresource.WriteStatusResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.WriteStatusRequest) (*pbresource.WriteStatusResponse, error)); ok {

grpcmocks/proto-public/pbresource/mock_ResourceService_WatchListClient.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbresource
 
@@ -28,6 +28,10 @@ func (_m *ResourceService_WatchListClient) EXPECT() *ResourceService_WatchListCl
 func (_m *ResourceService_WatchListClient) CloseSend() error {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for CloseSend")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func() error); ok {
 		r0 = rf()
@@ -69,6 +73,10 @@ func (_c *ResourceService_WatchListClient_CloseSend_Call) RunAndReturn(run func(
 func (_m *ResourceService_WatchListClient) Context() context.Context {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Context")
+	}
+
 	var r0 context.Context
 	if rf, ok := ret.Get(0).(func() context.Context); ok {
 		r0 = rf()
@@ -112,6 +120,10 @@ func (_c *ResourceService_WatchListClient_Context_Call) RunAndReturn(run func()
 func (_m *ResourceService_WatchListClient) Header() (metadata.MD, error) {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Header")
+	}
+
 	var r0 metadata.MD
 	var r1 error
 	if rf, ok := ret.Get(0).(func() (metadata.MD, error)); ok {
@@ -165,6 +177,10 @@ func (_c *ResourceService_WatchListClient_Header_Call) RunAndReturn(run func() (
 func (_m *ResourceService_WatchListClient) Recv() (*pbresource.WatchEvent, error) {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Recv")
+	}
+
 	var r0 *pbresource.WatchEvent
 	var r1 error
 	if rf, ok := ret.Get(0).(func() (*pbresource.WatchEvent, error)); ok {
@@ -218,6 +234,10 @@ func (_c *ResourceService_WatchListClient_Recv_Call) RunAndReturn(run func() (*p
 func (_m *ResourceService_WatchListClient) RecvMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for RecvMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -260,6 +280,10 @@ func (_c *ResourceService_WatchListClient_RecvMsg_Call) RunAndReturn(run func(in
 func (_m *ResourceService_WatchListClient) SendMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SendMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -302,6 +326,10 @@ func (_c *ResourceService_WatchListClient_SendMsg_Call) RunAndReturn(run func(in
 func (_m *ResourceService_WatchListClient) Trailer() metadata.MD {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Trailer")
+	}
+
 	var r0 metadata.MD
 	if rf, ok := ret.Get(0).(func() metadata.MD); ok {
 		r0 = rf()

grpcmocks/proto-public/pbresource/mock_ResourceService_WatchListServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbresource
 
@@ -28,6 +28,10 @@ func (_m *ResourceService_WatchListServer) EXPECT() *ResourceService_WatchListSe
 func (_m *ResourceService_WatchListServer) Context() context.Context {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Context")
+	}
+
 	var r0 context.Context
 	if rf, ok := ret.Get(0).(func() context.Context); ok {
 		r0 = rf()
@@ -71,6 +75,10 @@ func (_c *ResourceService_WatchListServer_Context_Call) RunAndReturn(run func()
 func (_m *ResourceService_WatchListServer) RecvMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for RecvMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -113,6 +121,10 @@ func (_c *ResourceService_WatchListServer_RecvMsg_Call) RunAndReturn(run func(in
 func (_m *ResourceService_WatchListServer) Send(_a0 *pbresource.WatchEvent) error {
 	ret := _m.Called(_a0)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Send")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(*pbresource.WatchEvent) error); ok {
 		r0 = rf(_a0)
@@ -155,6 +167,10 @@ func (_c *ResourceService_WatchListServer_Send_Call) RunAndReturn(run func(*pbre
 func (_m *ResourceService_WatchListServer) SendHeader(_a0 metadata.MD) error {
 	ret := _m.Called(_a0)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SendHeader")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(metadata.MD) error); ok {
 		r0 = rf(_a0)
@@ -197,6 +213,10 @@ func (_c *ResourceService_WatchListServer_SendHeader_Call) RunAndReturn(run func
 func (_m *ResourceService_WatchListServer) SendMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SendMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -239,6 +259,10 @@ func (_c *ResourceService_WatchListServer_SendMsg_Call) RunAndReturn(run func(in
 func (_m *ResourceService_WatchListServer) SetHeader(_a0 metadata.MD) error {
 	ret := _m.Called(_a0)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SetHeader")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(metadata.MD) error); ok {
 		r0 = rf(_a0)

grpcmocks/proto-public/pbresource/mock_UnsafeResourceServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbresource
 

grpcmocks/proto-public/pbresource/mock_isWatchEvent_Event.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbresource
 

grpcmocks/proto-public/pbserverdiscovery/mock_ServerDiscoveryServiceClient.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbserverdiscovery
 
@@ -36,6 +36,10 @@ func (_m *ServerDiscoveryServiceClient) WatchServers(ctx context.Context, in *pb
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
 
+	if len(ret) == 0 {
+		panic("no return value specified for WatchServers")
+	}
+
 	var r0 pbserverdiscovery.ServerDiscoveryService_WatchServersClient
 	var r1 error
 	if rf, ok := ret.Get(0).(func(context.Context, *pbserverdiscovery.WatchServersRequest, ...grpc.CallOption) (pbserverdiscovery.ServerDiscoveryService_WatchServersClient, error)); ok {

grpcmocks/proto-public/pbserverdiscovery/mock_ServerDiscoveryServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbserverdiscovery
 
@@ -24,6 +24,10 @@ func (_m *ServerDiscoveryServiceServer) EXPECT() *ServerDiscoveryServiceServer_E
 func (_m *ServerDiscoveryServiceServer) WatchServers(_a0 *pbserverdiscovery.WatchServersRequest, _a1 pbserverdiscovery.ServerDiscoveryService_WatchServersServer) error {
 	ret := _m.Called(_a0, _a1)
 
+	if len(ret) == 0 {
+		panic("no return value specified for WatchServers")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(*pbserverdiscovery.WatchServersRequest, pbserverdiscovery.ServerDiscoveryService_WatchServersServer) error); ok {
 		r0 = rf(_a0, _a1)

grpcmocks/proto-public/pbserverdiscovery/mock_ServerDiscoveryService_WatchServersClient.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbserverdiscovery
 
@@ -28,6 +28,10 @@ func (_m *ServerDiscoveryService_WatchServersClient) EXPECT() *ServerDiscoverySe
 func (_m *ServerDiscoveryService_WatchServersClient) CloseSend() error {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for CloseSend")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func() error); ok {
 		r0 = rf()
@@ -69,6 +73,10 @@ func (_c *ServerDiscoveryService_WatchServersClient_CloseSend_Call) RunAndReturn
 func (_m *ServerDiscoveryService_WatchServersClient) Context() context.Context {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Context")
+	}
+
 	var r0 context.Context
 	if rf, ok := ret.Get(0).(func() context.Context); ok {
 		r0 = rf()
@@ -112,6 +120,10 @@ func (_c *ServerDiscoveryService_WatchServersClient_Context_Call) RunAndReturn(r
 func (_m *ServerDiscoveryService_WatchServersClient) Header() (metadata.MD, error) {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Header")
+	}
+
 	var r0 metadata.MD
 	var r1 error
 	if rf, ok := ret.Get(0).(func() (metadata.MD, error)); ok {
@@ -165,6 +177,10 @@ func (_c *ServerDiscoveryService_WatchServersClient_Header_Call) RunAndReturn(ru
 func (_m *ServerDiscoveryService_WatchServersClient) Recv() (*pbserverdiscovery.WatchServersResponse, error) {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Recv")
+	}
+
 	var r0 *pbserverdiscovery.WatchServersResponse
 	var r1 error
 	if rf, ok := ret.Get(0).(func() (*pbserverdiscovery.WatchServersResponse, error)); ok {
@@ -218,6 +234,10 @@ func (_c *ServerDiscoveryService_WatchServersClient_Recv_Call) RunAndReturn(run
 func (_m *ServerDiscoveryService_WatchServersClient) RecvMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for RecvMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -260,6 +280,10 @@ func (_c *ServerDiscoveryService_WatchServersClient_RecvMsg_Call) RunAndReturn(r
 func (_m *ServerDiscoveryService_WatchServersClient) SendMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SendMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -302,6 +326,10 @@ func (_c *ServerDiscoveryService_WatchServersClient_SendMsg_Call) RunAndReturn(r
 func (_m *ServerDiscoveryService_WatchServersClient) Trailer() metadata.MD {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Trailer")
+	}
+
 	var r0 metadata.MD
 	if rf, ok := ret.Get(0).(func() metadata.MD); ok {
 		r0 = rf()

grpcmocks/proto-public/pbserverdiscovery/mock_ServerDiscoveryService_WatchServersServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbserverdiscovery
 
@@ -28,6 +28,10 @@ func (_m *ServerDiscoveryService_WatchServersServer) EXPECT() *ServerDiscoverySe
 func (_m *ServerDiscoveryService_WatchServersServer) Context() context.Context {
 	ret := _m.Called()
 
+	if len(ret) == 0 {
+		panic("no return value specified for Context")
+	}
+
 	var r0 context.Context
 	if rf, ok := ret.Get(0).(func() context.Context); ok {
 		r0 = rf()
@@ -71,6 +75,10 @@ func (_c *ServerDiscoveryService_WatchServersServer_Context_Call) RunAndReturn(r
 func (_m *ServerDiscoveryService_WatchServersServer) RecvMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for RecvMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -113,6 +121,10 @@ func (_c *ServerDiscoveryService_WatchServersServer_RecvMsg_Call) RunAndReturn(r
 func (_m *ServerDiscoveryService_WatchServersServer) Send(_a0 *pbserverdiscovery.WatchServersResponse) error {
 	ret := _m.Called(_a0)
 
+	if len(ret) == 0 {
+		panic("no return value specified for Send")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(*pbserverdiscovery.WatchServersResponse) error); ok {
 		r0 = rf(_a0)
@@ -155,6 +167,10 @@ func (_c *ServerDiscoveryService_WatchServersServer_Send_Call) RunAndReturn(run
 func (_m *ServerDiscoveryService_WatchServersServer) SendHeader(_a0 metadata.MD) error {
 	ret := _m.Called(_a0)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SendHeader")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(metadata.MD) error); ok {
 		r0 = rf(_a0)
@@ -197,6 +213,10 @@ func (_c *ServerDiscoveryService_WatchServersServer_SendHeader_Call) RunAndRetur
 func (_m *ServerDiscoveryService_WatchServersServer) SendMsg(m interface{}) error {
 	ret := _m.Called(m)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SendMsg")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(interface{}) error); ok {
 		r0 = rf(m)
@@ -239,6 +259,10 @@ func (_c *ServerDiscoveryService_WatchServersServer_SendMsg_Call) RunAndReturn(r
 func (_m *ServerDiscoveryService_WatchServersServer) SetHeader(_a0 metadata.MD) error {
 	ret := _m.Called(_a0)
 
+	if len(ret) == 0 {
+		panic("no return value specified for SetHeader")
+	}
+
 	var r0 error
 	if rf, ok := ret.Get(0).(func(metadata.MD) error); ok {
 		r0 = rf(_a0)

grpcmocks/proto-public/pbserverdiscovery/mock_UnsafeServerDiscoveryServiceServer.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.37.1. DO NOT EDIT.
+// Code generated by mockery v2.41.0. DO NOT EDIT.
 
 package mockpbserverdiscovery
 

internal/resource/registry.go

@@ -77,6 +77,11 @@ type Registration struct {
 
 	// Scope describes the tenancy scope of a resource.
 	Scope Scope
+
+	// LicenseFeature is an optional enterprise license feature that the
+	// resource type is associated with. A string form of license.Feature
+	// from the consul-licensing module is expected.
+	LicenseFeature string
 }
 
 var ErrNeedResource = errors.New("authorization check requires the entire resource")