diff --git a/.drone.yml b/.drone.yml
index 0dda1d453ce88..d96eb94e0e1b4 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -39,7 +39,7 @@ name: push-build-linux-amd64
 environment:
   BUILDBOX_VERSION: teleport14
   GID: "1000"
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
   UID: "1000"
 trigger:
   event:
@@ -155,7 +155,7 @@ name: push-build-linux-386
 environment:
   BUILDBOX_VERSION: teleport14
   GID: "1000"
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
   UID: "1000"
 trigger:
   event:
@@ -269,7 +269,7 @@ name: push-build-linux-amd64-fips
 environment:
   BUILDBOX_VERSION: teleport14
   GID: "1000"
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
   UID: "1000"
 trigger:
   event:
@@ -387,7 +387,7 @@ name: push-build-windows-amd64
 environment:
   BUILDBOX_VERSION: teleport14
   GID: "1000"
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
   UID: "1000"
 trigger:
   event:
@@ -1042,7 +1042,7 @@ name: push-build-linux-arm
 environment:
   BUILDBOX_VERSION: teleport14
   GID: "1000"
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
   UID: "1000"
 trigger:
   event:
@@ -1479,7 +1479,7 @@ type: kubernetes
 name: build-linux-amd64-centos7
 environment:
   BUILDBOX_VERSION: teleport14
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
 trigger:
   event:
     include:
@@ -1688,7 +1688,7 @@ type: kubernetes
 name: build-linux-amd64-centos7-fips
 environment:
   BUILDBOX_VERSION: teleport14
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
 trigger:
   event:
     include:
@@ -1896,7 +1896,7 @@ type: kubernetes
 name: build-linux-amd64
 environment:
   BUILDBOX_VERSION: teleport14
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
 trigger:
   event:
     include:
@@ -2111,7 +2111,7 @@ type: kubernetes
 name: build-linux-amd64-fips
 environment:
   BUILDBOX_VERSION: teleport14
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
 trigger:
   event:
     include:
@@ -3411,7 +3411,7 @@ type: kubernetes
 name: build-linux-386
 environment:
   BUILDBOX_VERSION: teleport14
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
 trigger:
   event:
     include:
@@ -4237,7 +4237,7 @@ type: kubernetes
 name: build-linux-arm
 environment:
   BUILDBOX_VERSION: teleport14
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
 trigger:
   event:
     include:
@@ -5566,7 +5566,7 @@ type: kubernetes
 name: build-windows-amd64
 environment:
   BUILDBOX_VERSION: teleport14
-  RUNTIME: go1.20.4
+  RUNTIME: go1.20.5
 trigger:
   event:
     include:
@@ -6236,29 +6236,6 @@ steps:
     path: /var/run
   - name: dockerconfig
     path: /root/.docker
-- name: Build and push buildbox-fips
-  image: docker
-  pull: if-not-exists
-  commands:
-  - apk add --no-cache make aws-cli
-  - chown -R $UID:$GID /go
-  - aws ecr get-login-password --profile staging --region=us-west-2 | docker login
-    -u="AWS" --password-stdin 146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - make -C build.assets buildbox-fips
-  - docker tag public.ecr.aws/gravitational/teleport-buildbox-fips:$BUILDBOX_VERSION
-    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-buildbox-fips:$BUILDBOX_VERSION-$DRONE_COMMIT_SHA
-  - docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-buildbox-fips:$BUILDBOX_VERSION-$DRONE_COMMIT_SHA
-  - docker logout 146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - aws ecr-public get-login-password --profile production --region=us-east-1 | docker
-    login -u="AWS" --password-stdin public.ecr.aws
-  - docker push public.ecr.aws/gravitational/teleport-buildbox-fips:$BUILDBOX_VERSION
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  - name: dockerconfig
-    path: /root/.docker
 - name: Build and push buildbox-arm
   image: docker
   pull: if-not-exists
@@ -7051,6 +7028,66 @@ image_pull_secrets:
 # Generated at dronegen/gha.go (main.ghaMultiBuildPipeline)
 ################################################
 
+kind: pipeline
+type: kubernetes
+name: promote-teleport-hardened-amis
+trigger:
+  event:
+    include:
+    - promote
+  target:
+    include:
+    - production
+    - promote-hardened-amis
+  repo:
+    include:
+    - gravitational/*
+workspace:
+  path: /go
+clone:
+  disable: true
+steps:
+- name: Check out code
+  image: docker:git
+  pull: if-not-exists
+  commands:
+  - mkdir -pv "/go/src/github.com/gravitational/teleport"
+  - cd "/go/src/github.com/gravitational/teleport"
+  - git init
+  - git remote add origin ${DRONE_REMOTE_URL}
+  - git fetch origin --tags
+  - git checkout -qf "${DRONE_COMMIT_SHA}"
+  - mkdir -m 0700 /root/.ssh && echo "$GITHUB_PRIVATE_KEY" > /root/.ssh/id_rsa &&
+    chmod 600 /root/.ssh/id_rsa
+  - ssh-keyscan -H github.com > /root/.ssh/known_hosts 2>/dev/null && chmod 600 /root/.ssh/known_hosts
+  - git submodule update --init e
+  - mkdir -pv /go/cache
+  - rm -f /root/.ssh/id_rsa
+  environment:
+    GITHUB_PRIVATE_KEY:
+      from_secret: GITHUB_PRIVATE_KEY
+- name: Delegate build to GitHub
+  image: golang:1.18-alpine
+  pull: if-not-exists
+  commands:
+  - cd "/go/src/github.com/gravitational/teleport/build.assets/tooling"
+  - 'go run ./cmd/gh-trigger-workflow -owner ${DRONE_REPO_OWNER} -repo teleport.e
+    -tag-workflow -timeout 2h30m0s -workflow promote-teleport-hardened-amis.yaml -workflow-ref=${DRONE_TAG}
+    -input oss-teleport-repo=${DRONE_REPO} -input oss-teleport-ref=${DRONE_TAG} -input
+    "release-source-tag=${DRONE_TAG}" '
+  environment:
+    GHA_APP_KEY:
+      from_secret: GITHUB_WORKFLOW_APP_PRIVATE_KEY
+image_pull_secrets:
+- DOCKERHUB_CREDENTIALS
+
+---
+################################################
+# Generated using dronegen, do not edit by hand!
+# Use 'make dronegen' to update.
+# Generated at dronegen/gha.go (main.ghaMultiBuildPipeline)
+################################################
+
 kind: pipeline
 type: kubernetes
 name: promote-teleport-kube-agent-updater-oci-images
@@ -8420,7 +8457,9 @@ clone:
 depends_on:
 - clean-up-previous-build
 - build-linux-amd64-deb
+- build-linux-amd64-fips-deb
 - build-linux-arm64-deb
+- build-linux-arm-deb
 steps:
 - name: Check out code
   image: docker:git
@@ -8462,6 +8501,68 @@ image_pull_secrets:
 # Generated at dronegen/gha.go (main.ghaMultiBuildPipeline)
 ################################################
 
+kind: pipeline
+type: kubernetes
+name: build-teleport-hardened-amis
+trigger:
+  event:
+    include:
+    - tag
+  ref:
+    include:
+    - refs/tags/v*
+  repo:
+    include:
+    - gravitational/*
+workspace:
+  path: /go
+clone:
+  disable: true
+depends_on:
+- clean-up-previous-build
+- build-linux-amd64-deb
+- build-linux-amd64-fips-deb
+steps:
+- name: Check out code
+  image: docker:git
+  pull: if-not-exists
+  commands:
+  - mkdir -pv "/go/src/github.com/gravitational/teleport"
+  - cd "/go/src/github.com/gravitational/teleport"
+  - git init
+  - git remote add origin ${DRONE_REMOTE_URL}
+  - git fetch origin --tags
+  - git checkout -qf "${DRONE_COMMIT_SHA}"
+  - mkdir -m 0700 /root/.ssh && echo "$GITHUB_PRIVATE_KEY" > /root/.ssh/id_rsa &&
+    chmod 600 /root/.ssh/id_rsa
+  - ssh-keyscan -H github.com > /root/.ssh/known_hosts 2>/dev/null && chmod 600 /root/.ssh/known_hosts
+  - git submodule update --init e
+  - mkdir -pv /go/cache
+  - rm -f /root/.ssh/id_rsa
+  environment:
+    GITHUB_PRIVATE_KEY:
+      from_secret: GITHUB_PRIVATE_KEY
+- name: Delegate build to GitHub
+  image: golang:1.18-alpine
+  pull: if-not-exists
+  commands:
+  - cd "/go/src/github.com/gravitational/teleport/build.assets/tooling"
+  - 'go run ./cmd/gh-trigger-workflow -owner ${DRONE_REPO_OWNER} -repo teleport.e
+    -tag-workflow -timeout 2h30m0s -workflow release-teleport-hardened-amis.yaml -workflow-ref=${DRONE_TAG}
+    -input oss-teleport-repo=${DRONE_REPO} -input oss-teleport-ref=${DRONE_TAG} '
+  environment:
+    GHA_APP_KEY:
+      from_secret: GITHUB_WORKFLOW_APP_PRIVATE_KEY
+image_pull_secrets:
+- DOCKERHUB_CREDENTIALS
+
+---
+################################################
+# Generated using dronegen, do not edit by hand!
+# Use 'make dronegen' to update.
+# Generated at dronegen/gha.go (main.ghaMultiBuildPipeline)
+################################################
+
 kind: pipeline
 type: kubernetes
 name: build-teleport-kube-agent-updater-oci-images
@@ -16996,6 +17097,7 @@ depends_on:
 - teleport-container-images-branch-promote
 - publish-os-package-repos
 - promote-teleport-oci-distroless-images
+- promote-teleport-hardened-amis
 - promote-teleport-kube-agent-updater-oci-images
 steps:
 - name: Check if commit is tagged
@@ -17106,6 +17208,6 @@ image_pull_secrets:
 - DOCKERHUB_CREDENTIALS
 ---
 kind: signature
-hmac: c12537f0b20719e1d7b3247410ec676e00d60db9c892bdaf02b08f13b0c224d0
+hmac: d3185434ba38b96a9cbf435a59a3ab0d7e4d3ef6ef39a198164e0e2198f1286d
 
 ...
diff --git a/.github/ISSUE_TEMPLATE/webtestplan.md b/.github/ISSUE_TEMPLATE/webtestplan.md
index 898e1b34ea158..6a6791fefb40e 100644
--- a/.github/ISSUE_TEMPLATE/webtestplan.md
+++ b/.github/ISSUE_TEMPLATE/webtestplan.md
@@ -572,8 +572,6 @@ Use Discover Wizard to enroll new resources and access them:
       - Run the program: `$ mc`
       - Resize Teleport Connect to see if the panels resize with it
    - [ ] Verify that the tab automatically closes on `$ exit` command.
-   - [ ] Execute `tsh ssh nonexistent-node` in the command bar. Verify that you see a new tab with an
-     error from tsh ssh.
 - Kubernetes access
    - [ ] Open a new kubernetes tab, run `echo $KUBECONFIG` and check if it points to the file within Connect's app data directory.
    - [ ] Close the tab and open it again (to the same resource). Verify if the kubeconfig path didn't change.
@@ -634,23 +632,24 @@ Use Discover Wizard to enroll new resources and access them:
    - [ ] Click "Add another cluster", provide an address to a new cluster and submit the form. Close
      the modal when asked for credentials. Verify that the cluster was still added and is visible in
      the profile selector.
-- Command bar & autocomplete
-   - Do the steps for the root cluster, then switch to a leaf cluster and repeat them.
-   - [ ] Verify that the autocomplete for tsh ssh filters SSH logins and autocompletes them.
-   - [ ] Verify that the autocomplete for tsh ssh filters SSH hosts by name and label and
-     autocompletes them.
-   - [ ] Verify that launching an invalid tsh ssh command shows the error in a new tab.
-   - [ ] Verify that launching a valid tsh ssh command opens a new tab with the session opened.
-   - [ ] Verify that the autocomplete for tsh proxy db filters databases by name and label and
-     autocompletes them.
-   - [ ] Verify that launching a tsh proxy db command opens a new local shell with the command
-     running.
-   - [ ] Verify that the autocomplete for tsh ssh doesn't break when you cut/paste commands in
-     various points.
-   - [ ] Verify that manually typing out what the autocomplete would suggest doesn't break the
-     command bar.
-   - [ ] Verify that launching any other command that's not supported by the autocomplete opens a
-     new local shell with that command running.
+- Search bar
+   - [ ] Verify that you can connect to all three resources types on root clusters and leaf
+     clusters.
+   - [ ] Verify that picking a resource filter and a cluster filter at the same time works as
+     expected.
+   - [ ] Verify that connecting to a resource from a different root cluster switches to the
+     workspace of that root cluster.
+   - Shut down a root cluster.
+      - [ ] Verify that attempting to search returns "Some of the search results are incomplete" in
+        the search bar.
+      - [ ] Verify that clicking "Show details" next to the error message and then closing the modal
+        by clicking one of the buttons or by pressing Escape does not close the search bar.
+   - Log in as a user with a short TTL. Make sure you're not logged in to any other cluster. Wait for
+     the cert to expire. Enter a search term that usually returns some results.
+      - [ ] Relogin when asked. Verify that the search bar is not collapsed and shows search
+        results.
+      - [ ] Close the login modal instead of logging in. Verify that the search bar is not collapsed
+        and shows "No matching results found".
 - Resilience when resources become unavailable
    - DocumentCluster
       - For each scenario, create at least one DocumentCluster tab for each available resource kind.
@@ -701,7 +700,8 @@ Use Discover Wizard to enroll new resources and access them:
       - [ ] Verify that closing the login modal without logging in shows an appropriate error.
    - Log in, create a db connection, then remove access to that db server for that user; wait for
      the cert to expire, then attempt to make a connection through the proxy; log in.
-      - [ ] Verify that the db tab shows an appropriate error.
+      - [ ] Verify that psql shows an appropriate access denied error ("access to db denied. User
+        does not have permissions. Confirm database user and name").
    - Log in, open a cluster tab, wait for the cert to expire. Switch from a servers view to
      databases view.
       - [ ] Verify that a login modal was shown.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5fc42240a6a7f..eb408b1227096 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,8 +11,6 @@ updates:
       - dependency-name: github.com/gravitational/ttlmap
       # Breaks backwards compatibility
       - dependency-name: github.com/go-webauthn/webauthn
-      # TODO(greedy52): Update mongo-driver and fix API changes.
-      - dependency-name: go.mongodb.org/mongo-driver
       # Must be kept in-sync with libbpf
       - dependency-name: github.com/aquasecurity/libbpfgo
       # Forked/replaced dependencies
diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 0000000000000..cca83e1e3482a
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,122 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base"
+  ],
+  "enabledManagers": ["gomod", "cargo"],
+  "reviewers": ["codingllama", "jentfoo", "rosstimothy", "zmb3"],
+  "branchConcurrentLimit": 10,
+  "prConcurrentLimit": 10,
+  "prHourlyLimit": 0,
+  "packageRules": [
+    {
+      "matchManagers": ["gomod"],
+      "postUpdateOptions": ["gomodTidy"],
+      "enabled": true,
+      "matchFiles": ["go.mod"],
+      "groupName": "Teleport - Go"
+    },
+    {
+      "matchManagers": ["gomod"],
+      "enabled": false,
+      "matchFiles": ["go.mod"],
+      "groupName": "Teleport - Go",
+      "packageNames": [
+        "github.com/alecthomas/kingpin/v2",
+        "github.com/aquasecurity/libbpfgo",
+        "github.com/coreos/go-oidc",
+        "github.com/go-mysql-org/go-mysql",
+        "github.com/go-redis/redis/v9",
+        "github.com/go-webauthn/webauthn",
+        "github.com/gogo/protobuf",
+        "github.com/gravitational/ttlmap",
+        "github.com/julienschmidt/httprouter",
+        "github.com/keys-pub/go-libfido2",
+        "github.com/microsoft/go-mssqldb",
+        "github.com/vulcand/predicate",
+        "go.mongodb.org/mongo-driver",
+        "golang.org/x/crypto"
+      ]
+    },
+    {
+      "matchManagers": ["gomod"],
+      "postUpdateOptions": ["gomodTidy"],
+      "enabled": true,
+      "matchFiles": ["api/go.mod"],
+      "groupName": "Teleport API"
+    },
+    {
+      "matchManagers": ["cargo"],
+      "enabled": true,
+      "matchFiles": ["Cargo.toml"],
+      "groupName": "Teleport - Rust"
+    },
+    {
+      "matchManagers": ["cargo"],
+      "enabled": true,
+      "matchFiles": ["lib/srv/desktop/rdp/rdpclient/Cargo.toml"],
+      "groupName": "RDP Client"
+    },
+    {
+      "matchManagers": ["gomod"],
+      "postUpdateOptions": ["gomodTidy"],
+      "enabled": true,
+      "matchFiles": ["assets/aws/go.mod"],
+      "groupName": "Assets - AWS ",
+      "excludePackageNames": [
+        "github.com/alecthomas/kingpin/v2"
+      ]
+    },
+    {
+      "matchManagers": ["gomod"],
+      "enabled": false,
+      "matchFiles": ["assets/aws/go.mod"],
+      "groupName": "Assets - AWS ",
+      "packageNames": [
+        "github.com/alecthomas/kingpin/v2"
+      ]
+    },
+    {
+      "matchManagers": ["gomod"],
+      "postUpdateOptions": ["gomodTidy"],
+      "enabled": true,
+      "matchFiles": ["assets/backport/go.mod"],
+      "groupName": "Assets - Backport"
+    },
+    {
+      "matchManagers": ["gomod"],
+      "postUpdateOptions": ["gomodTidy"],
+      "enabled": true,
+      "matchFiles": ["build.assets/tooling/go.mod"],
+      "groupName": "Build Assets - Tooling"
+    },
+    {
+      "matchManagers": ["gomod"],
+      "enabled": false,
+      "matchFiles": ["build.assets/tooling/go.mod"],
+      "groupName": "Build Assets - Tooling",
+      "packageNames": [
+        "github.com/alecthomas/kingpin/v2"
+      ]
+    },
+    {
+      "matchManagers": ["gomod"],
+      "postUpdateOptions": ["gomodTidy"],
+      "enabled": true,
+      "matchFiles": ["integrations/kube-agent-updater/go.mod"],
+      "groupName": "Integrations - Kube Updater"
+    }
+  ],
+  "ignoreDeps": ["dockerfile"],
+  "ignorePaths": [
+    ".drone.yml",
+    ".github/actions",
+    ".github/services",
+    ".github/workflows",
+    "assets/loadtest",
+    "docker",
+    "examples",
+    "package.json",
+    "web"
+  ]
+}
diff --git a/.github/workflows/check-devbox-bypass.yaml b/.github/workflows/check-devbox-bypass.yaml
new file mode 100644
index 0000000000000..24db1964cc9cf
--- /dev/null
+++ b/.github/workflows/check-devbox-bypass.yaml
@@ -0,0 +1,26 @@
+name: Check Devbox
+run-name: Check Devbox - ${{ github.run_id }} - @${{ github.actor }}
+
+on:
+  pull_request:
+    paths-ignore:
+      - 'devbox.json'
+      - 'devbox.lock'
+      - 'build.assets/flake/**'
+  merge_group:
+    paths-ignore:
+      - 'devbox.json'
+      - 'devbox.lock'
+      - 'build.assets/flake/**'
+
+jobs:
+  check-devbox:
+    if: ${{ !startsWith(github.head_ref, 'dependabot/') }}
+    name: Check Devbox
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: none
+
+    steps:
+      - run: 'echo "No changes to verify"'
diff --git a/.github/workflows/check-devbox.yaml b/.github/workflows/check-devbox.yaml
new file mode 100644
index 0000000000000..88e6cb43496a3
--- /dev/null
+++ b/.github/workflows/check-devbox.yaml
@@ -0,0 +1,34 @@
+name: Check Devbox
+run-name: Check Devbox - ${{ github.run_id }} - @${{ github.actor }}
+
+on:
+  pull_request:
+    paths:
+      - 'devbox.json'
+      - 'devbox.lock'
+      - 'build.assets/flake/**'
+  merge_group:
+    paths:
+      - 'devbox.json'
+      - 'devbox.lock'
+      - 'build.assets/flake/**'
+
+jobs:
+  check-devbox:
+    if: ${{ !startsWith(github.head_ref, 'dependabot/') }}
+    name: Check Devbox
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Install devbox
+        run: curl -fsSL https://get.jetpack.io/devbox | FORCE=1 bash
+
+      - name: Install devbox dependencies
+        run: |
+          devbox install
\ No newline at end of file
diff --git a/.github/workflows/doc-tests-bypass.yaml b/.github/workflows/doc-tests-bypass.yaml
index 4cc3171dc9ca2..dafae0fc02f13 100644
--- a/.github/workflows/doc-tests-bypass.yaml
+++ b/.github/workflows/doc-tests-bypass.yaml
@@ -16,10 +16,12 @@ on:
     paths-ignore:
       - 'docs/**'
       - 'examples/**'
+      - 'CHANGELOG.md'
   merge_group:
     paths-ignore:
       - 'docs/**'
-      - 'examples/**'      
+      - 'examples/**'
+      - 'CHANGELOG.md'
 
 jobs:
   lint:
diff --git a/.github/workflows/doc-tests.yaml b/.github/workflows/doc-tests.yaml
index 35517775248da..fa64ce32a32d2 100644
--- a/.github/workflows/doc-tests.yaml
+++ b/.github/workflows/doc-tests.yaml
@@ -3,12 +3,14 @@ run-name: Lint (Docs)
 on:
   pull_request:
     paths:
+      - 'CHANGELOG.md'
       - 'docs/**'
       - 'examples/**'
   merge_group:
     paths:
       - 'docs/**'
       - 'examples/**'
+      - 'CHANGELOG.md'
 
 jobs:
   doc-tests:
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
new file mode 100644
index 0000000000000..494c86a92dfd5
--- /dev/null
+++ b/.github/workflows/renovate.yaml
@@ -0,0 +1,94 @@
+name: Renovate
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 21 * * 0' # At 9:00 PM every Sunday UTC
+jobs:
+  renovate:
+    name: 'Renovate'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get token
+        id: get_token
+        uses: tibdex/github-app-token@v1
+        with:
+          APP_ID: ${{ vars.PUBLIC_RENOVATE_GHA_APP_ID }}
+          PRIVATE_KEY: ${{ secrets.PUBLIC_RENOVATE_GHA_PRIVATE_KEY }}
+
+      - name: Checkout
+        uses: actions/checkout@v3.3.0
+
+      # This script/action will be moved to a separate action in my work
+      # immediately following this project. For now it lives here to
+      # avoid scope creep.
+      #
+      # Github can be notoriously difficult to authenticate and talk with.
+      # There are four different types of authentication. This step
+      # generates an app JWT token, and an app installation token, for
+      # other steps that need a specific one.
+      - name: Install NPM dependencies
+        run: npm install '@octokit/auth-app' '@actions/github' --force
+      - name: Generate Github access tokens
+        uses: actions/github-script@v6.4.1
+        id: generate-tokens
+        env:
+          APP_ID: ${{ vars.PUBLIC_RENOVATE_GHA_APP_ID }}
+          PRIVATE_KEY: ${{ secrets.PUBLIC_RENOVATE_GHA_PRIVATE_KEY }}
+        with:
+          script: |
+            const { createAppAuth } = require("@octokit/auth-app");
+            const { getOctokit } = require("@actions/github");
+            // App authentication, which uses a JWT
+            const appAuthFunction = createAppAuth({appId: process.env.APP_ID, privateKey: process.env.PRIVATE_KEY});
+            const appAuth = await appAuthFunction({ type: "app" });
+            // TODO export token via `appAuth.token`
+            core.setSecret(appAuth.token)
+            core.setOutput("app-jwt-token", appAuth.token)
+            const appOctokit = getOctokit(appAuth.token);
+            // Installation authentication, which uses an installation token
+            let installationId = process.env["INSTALLATION_ID"];
+            if (installationId === undefined) {
+              try {
+                // Repo can be specified via `GITHUB_REPOSITORY` env variable
+                installationId = (await appOctokit.rest.apps.getRepoInstallation(context.repo)).data.id;
+              } catch (error) {
+                throw new Error(
+                  "Could not get repo installation to find ID. Is the app installed on this repo?",
+                  { cause: error },
+                );
+              }
+            }
+            const installationToken = (await appOctokit.rest.apps.createInstallationAccessToken({installation_id: installationId})).data.token;
+            core.setSecret(installationToken)
+            core.setOutput("app-installation-token", installationToken)
+      # These two actions will also be moved out to a separate repo after this project is complete
+      - name: Get app JWT information
+        uses: actions/github-script@v6.4.1
+        id: app-jwt-info
+        with:
+          github-token: ${{ steps.generate-tokens.outputs.app-jwt-token }}
+          script: |
+            const appSlug = (await github.rest.apps.getAuthenticated()).data.slug;
+            const appUserName = `${appSlug}[bot]`
+            core.setOutput("app-username", appUserName);
+      - name: Get app installation information
+        uses: actions/github-script@v6.4.1
+        id: app-installation-info
+        env:
+          APP_USERNAME: ${{ steps.app-jwt-info.outputs.app-username }}
+        with:
+          github-token: ${{ steps.generate-tokens.outputs.app-installation-token }}
+          script: |
+            const userId = (await github.rest.users.getByUsername({username: process.env.APP_USERNAME})).data.id
+            core.setOutput("user-id", userId);
+            core.setOutput("user-email", `${userId}+${process.env.APP_USERNAME}@users.noreply.github.com`);
+      - name: Renovate
+        uses: renovatebot/github-action@v36.0.0
+        env:
+          LOG_LEVEL: 'debug'
+          RENOVATE_USERNAME: ${{ steps.app-jwt-info.outputs.app-username }}
+          RENOVATE_GIT_AUTHOR: "${{ steps.app-jwt-info.outputs.app-username }} <${{ steps.app-installation-info.outputs.user-email }}>"
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+        with:
+          token: ${{ steps.generate-tokens.outputs.app-installation-token }}
+          configurationFile: .github/renovate.json
diff --git a/.github/workflows/unit-tests-integrations-bypass.yaml b/.github/workflows/unit-tests-integrations-bypass.yaml
index 9cefbd4867465..22b1559a4272c 100644
--- a/.github/workflows/unit-tests-integrations-bypass.yaml
+++ b/.github/workflows/unit-tests-integrations-bypass.yaml
@@ -1,5 +1,5 @@
 # This workflow is required to ensure that required Github check passes even if
-# the actual "Unit Tests (Operator)" workflow skipped due to path filtering. Otherwise
+# the actual "Unit Tests (Integrations)" workflow skipped due to path filtering. Otherwise
 # it will stay forever pending.
 #
 # See "Handling skipped but required checks" for more info:
diff --git a/.github/workflows/unit-tests-integrations.yaml b/.github/workflows/unit-tests-integrations.yaml
index 2c00c1d4c4082..4202481f69f5e 100644
--- a/.github/workflows/unit-tests-integrations.yaml
+++ b/.github/workflows/unit-tests-integrations.yaml
@@ -43,9 +43,6 @@ jobs:
     container:
       image: ghcr.io/gravitational/teleport-buildbox:teleport14
       options: --cap-add=SYS_ADMIN --privileged
-      env: 
-        TELEPORT_GET_VERSION: v12.1.0
-        TELEPORT_ENTERPRISE_LICENSE: ${{ secrets.TELEPORT_ENTERPRISE_LICENSE }}
 
     steps:
       - name: Checkout Teleport
@@ -54,6 +51,9 @@ jobs:
       - name: Prepare workspace
         uses: ./.github/actions/prepare-workspace
 
+      - name: Build teleport binaries
+        run: make build/tctl build/teleport build/tsh && echo "$PWD/build" >> "$GITHUB_PATH"
+
       - name: Run access plugin tests
         run: make test-access-integrations
         timeout-minutes: 5
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 707ea6248beb4..ae61d5339f549 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -102,7 +102,8 @@ cluster.
 This will allow users to view the OpenSSH nodes in Web UI and using `tsh ls`
 and use RBAC to control access to them.
 
-See updated OpenSSH integration guide: https://goteleport.com/docs/ver/13.x/server-access/guides/openssh/.
+See the updated [OpenSSH integration
+guide](docs/pages/server-access/guides/openssh.mdx).
 
 ### Cross-cluster search for Teleport Connect
 
@@ -194,7 +195,8 @@ create users and assign them invalid roles. In Teleport 13 this is a hard error.
 Quay.io registry was deprecated in Teleport 11 and starting with Teleport 13,
 Teleport container images are no longer being published to it.
 
-Users should use the public ECR registry: https://goteleport.com/docs/installation/#docker.
+Users should use the [public ECR
+registry](https://gallery.ecr.aws/gravitational).
 
 #### Helm chart uses `distroless`-based container image by default
 
@@ -234,7 +236,7 @@ This release of Teleport contains multiple improvements and bug fixes.
   * Fixed issue where Github SSO would fail if a user is a part of more than 30 teams. [#25098](https://github.com/gravitational/teleport/pull/25098)
   * Fixed issue with `tsh login` with "required" hardware key policy returning "policy not met" error. [#24956](https://github.com/gravitational/teleport/pull/24956)
   * Improved device trust logging and error reporting. [#24912](https://github.com/gravitational/teleport/pull/24912)
-  * Detect and warn about RPID changes when using webautn. [#25289](https://github.com/gravitational/teleport/pull/25289)
+  * Detect and warn about RPID changes when using WebAuthn. [#25289](https://github.com/gravitational/teleport/pull/25289)
 * Access Management
   * Fixed issue with running install script on macOS for enterprise clusters. [#25076](https://github.com/gravitational/teleport/pull/25076)
 * Server Access
@@ -502,7 +504,7 @@ This release of Teleport contains multiple security fixes, improvements and bug
 * Added support for assuming roles in `tsh proxy aws`. [#21990](https://github.com/gravitational/teleport/pull/21990)
 * Added early feedback for successful security key taps in `tsh`. [#21780](https://github.com/gravitational/teleport/pull/21780)
 * Added device lock support. [#21751](https://github.com/gravitational/teleport/pull/21751)
-* Added suppport for security contexts in `teleport-kube-agent` Helm chart. [#21535](https://github.com/gravitational/teleport/pull/21535)
+* Added support for security contexts in `teleport-kube-agent` Helm chart. [#21535](https://github.com/gravitational/teleport/pull/21535)
 * Updated `tsh version` command to display client version only via `--client` flag. [#22167](https://github.com/gravitational/teleport/pull/22167)
 * Updated install script to use enterprise packages for enterprise clusters. [#22109](https://github.com/gravitational/teleport/pull/22109)
 * Updated install script to use deb/rpm repositories. [#22108](https://github.com/gravitational/teleport/pull/22108)
@@ -529,7 +531,7 @@ This release of Teleport contains a security fix as well as multiple improvement
 * Fixed issue with invalid role template namespaces leading to cluster lockouts. [#21573](https://github.com/gravitational/teleport/pull/21573)
 * Fixed issue with Teleport Connect failing to recognize logged in user sometimes. [#21467](https://github.com/gravitational/teleport/pull/21467)
 * Fixed issue with the back button not working in Web UI navigation. [#21236](https://github.com/gravitational/teleport/pull/21236)
-* Fixed issue with Web UI SSH player having scrollbars. [#20868](https://github.com/gravitational/teleport/pull/20868)
+* Fixed issue with Web UI SSH player having scroll bars. [#20868](https://github.com/gravitational/teleport/pull/20868)
 * Added support for `tsh request search --kind=pod` command. [#21456](https://github.com/gravitational/teleport/pull/21456)
 * Updated `tsh db configure create` to require flag for dynamic resources matching. [#21395](https://github.com/gravitational/teleport/pull/21395)
 * Improved reconnect stability after Database Service restart. [#21635](https://github.com/gravitational/teleport/pull/21635)
@@ -605,9 +607,8 @@ The “teleport-cluster” Helm chart underwent significant refactoring in Telep
 deployments and the new “scratch” chart mode makes it easier to provide a custom
 Teleport config.
 
-“Custom” mode users should follow the migration guide:
-
-https://goteleport.com/docs/deploy-a-cluster/helm-deployments/migration-v12/
+“Custom” mode users should follow the [migration
+guide](./docs/pages/deploy-a-cluster/helm-deployments/migration-v12.mdx).
 
 ### Dropped support for SHA1 in Server Access
 
@@ -632,10 +633,9 @@ Teleport 12 before upgrading.
 #### Helm charts
 
 The teleport-cluster Helm chart underwent significant changes in Teleport 12. To
-upgrade from an older version of the Helm chart deployed in “custom” mode, use
-the following migration guide:
-
-https://goteleport.com/docs/ver/12.x/deploy-a-cluster/helm-deployments/migration-v12/
+upgrade from an older version of the Helm chart deployed in “custom” mode,
+follow
+the [migration guide](./docs/pages/deploy-a-cluster/helm-deployments/migration-v12.mdx).
 
 Additionally, PSPs are removed from the chart when installing on Kubernetes 1.23
 and higher to account for the deprecation/removal of PSPs by Kubernetes.
@@ -751,8 +751,9 @@ Visit the individual repositories to find out more and see usage examples:
 - https://github.com/teleport-actions/auth
 - https://github.com/teleport-actions/auth-k8s
 
-For a more in-depth guide, see our refreshed documentation for using Teleport with
-GitHub Actions at https://goteleport.com/docs/machine-id/guides/github-actions/
+For a more in-depth guide, see our
+[documentation](./docs/pages/machine-id/guides/github-actions.mdx) for using
+Teleport with GitHub Actions.
 
 ### Secure certificate mapping for Desktop Access
 
@@ -853,7 +854,7 @@ window.
 * Fixed issue with using desktop access with Windows 10. [#19504](https://github.com/gravitational/teleport/pull/19504)
 * Fixed issue with `session.start` events being overwritten by `session.exec` events. [#19497](https://github.com/gravitational/teleport/pull/19497)
 * Fixed issue with `tsh login --format kubernetes` not setting SNI info. [#19433](https://github.com/gravitational/teleport/pull/19433)
-* Fixed issue with websockets not working via app access if the upstream web server is using HTTP/2. [#19423](https://github.com/gravitational/teleport/pull/19423)
+* Fixed issue with WebSockets not working via app access if the upstream web server is using HTTP/2. [#19423](https://github.com/gravitational/teleport/pull/19423)
 * Fixed TLS routing in insecure mode. [#19410](https://github.com/gravitational/teleport/pull/19410)
 * Fixed issue with connecting to ElastiCache 7.0.4 in database access. [#19400](https://github.com/gravitational/teleport/pull/19400)
 * Fixed issue with SAML connector validation calling descriptor URL prior to authz checks. [#19317](https://github.com/gravitational/teleport/pull/19317)
@@ -1005,9 +1006,8 @@ Teleport 11 clients (such as tsh or Connect) support storing their private key
 material on Yubikey devices instead of filesystem which helps prevent
 credentials exfiltration attacks.
 
-See how to enable it in this guide:
-
-https://goteleport.com/docs/access-controls/guides/hardware-key-support/
+See how to enable it in the
+[documentation](./docs/pages/access-controls/guides/hardware-key-support.mdx):
 
 Hardware-backed private keys is an enterprise only feature, and is currently
 supported for server access only.
@@ -1021,8 +1021,8 @@ editing files on remote systems.
 The following guides explain how to use IDEs to connect to a remote machine via
 Teleport:
 
-https://goteleport.com/docs/server-access/guides/vscode/
-https://goteleport.com/docs/server-access/guides/jetbrains-sftp/
+- [VS Code](./docs/pages/server-access/guides/vscode.mdx)
+- [JetBrains](./docs/pages/server-access/guides/jetbrains-sftp.mdx)
 
 In addition, Teleport 11 clients will use SFTP protocol for file transfer under
 the hood instead of the obsolete scp protocol. Server-side scp is still
@@ -1051,8 +1051,9 @@ Teleport agents running on Azure VMs will now automatically import Azure tags to
 label resources.
 
 Teleport database access now supports auto-discovery for Azure-hosted PostgreSQL
-and MySQL databases. See the updated Azure guide for more details:
-https://goteleport.com/docs/ver/11.0/database-access/guides/azure-postgres-mysql/.
+and MySQL databases. See the [Azure
+guide](docs/pages/database-access/guides/azure-postgres-mysql.mdx) for more
+details.
 
 In addition, Teleport database access will now use Azure AD managed identity
 authentication for Azure-hosted SQL Server databases.
@@ -1112,8 +1113,8 @@ redirect_url = [ "http://example.com" ]
 #### Deprecated Quay.io registry
 
 Starting with Teleport 11, Quay.io as a container registry has been deprecated.
-Customers should use the new AWS ECR registry to pull Teleport Docker images:
-https://goteleport.com/docs/installation/#docker.
+Customers should use the new AWS ECR registry to pull [Teleport Docker
+images](./docs/pages/installation.mdx#docker).
 
 Quay.io registry support will be removed in a future release.
 
@@ -1122,7 +1123,7 @@ Quay.io registry support will be removed in a future release.
 In Teleport 11, old deb/rpm repositories (deb.releases.teleport.dev and
 rpm.releases.teleport.dev) have been deprecated. Customers should use the new
 repositories (apt.releases.teleport.dev and yum.releases.teleport.dev) to
-install Teleport: https://goteleport.com/docs/installation/#linux.
+[install Teleport](docs/pages/installation.mdx#linux).
 
 Support for our old deb/rpm repositories will be removed in a future release.
 
@@ -1186,7 +1187,7 @@ Teleport 10 introduces passwordless support to your clusters. To use passwordles
 users may register a security key with resident credentials or use a built-in
 authenticator, like Touch ID.
 
-See https://goteleport.com/docs/access-controls/guides/passwordless/.
+See the [documentation](./docs/pages/access-controls/guides/passwordless.mdx).
 
 ### Resource Access Requests (Preview)
 
@@ -1238,8 +1239,8 @@ Teleport 10 can be configured to automatically create Linux host users upon
 login without having to use Teleport's PAM integration. Users can be added to specific
 Linux groups and assigned appropriate “sudoer” privileges.
 
-To learn more about configuring automatic user provisioning read the guide:
-https://goteleport.com/docs/server-access/guides/host-user-creation/.
+To learn more about configuring automatic user provisioning read the
+[documentation](docs/pages/server-access/guides/host-user-creation.mdx).
 
 ### Audit Logging for Microsoft SQL Server database access
 
@@ -1251,8 +1252,8 @@ to other supported database protocols.
 Teleport database access for SQL Server remains in Preview mode with more UX
 improvements coming in future releases.
 
-Refer to the guide to set up access to a SQL Server with Active Directory
-authentication: https://goteleport.com/docs/database-access/guides/sql-server-ad/.
+Refer to [the guide](docs/pages/database-access/guides/sql-server-ad.mdx) to set
+up access to a SQL Server with Active Directory authentication.
 
 ### Snowflake database access (Preview)
 
@@ -1261,8 +1262,8 @@ set up access to Snowflake databases through Teleport for their users with
 standard database access features like role-based access control and audit
 logging, including query activity.
 
-Connect your Snowflake database to Teleport following this guide:
-https://goteleport.com/docs/database-access/guides/snowflake/.
+Connect your Snowflake database to Teleport following the
+[documentation](docs/pages/database-access/guides/snowflake.mdx).
 
 ### Elasticache/MemoryDB database access (Preview)
 
@@ -1271,8 +1272,8 @@ this integration by adding native support for AWS-hosted Elasticache and
 MemoryDB, including auto-discovery and automatic credential management in some
 deployment configurations.
 
-Learn more about it in this guide:
-https://goteleport.com/docs/database-access/guides/redis-aws/.
+Learn more about it in the [documentation](
+docs/pages/database-access/guides/redis-aws.mdx).
 
 ### Teleport Connect for server and database access (Preview)
 
@@ -1288,8 +1289,8 @@ https://goteleport.com/download/.
 In Teleport 10 we’ve added database access support to Machine ID. Applications
 can use Machine ID to access databases protected by Teleport.
 
-You can find Machine ID guide for database access in the documentation:
-https://goteleport.com/docs/machine-id/guides/databases/.
+You can find Machine ID guide for database access in the
+[documentation](docs/pages/machine-id/guides/databases.mdx).
 
 ### Breaking changes
 
@@ -1302,8 +1303,8 @@ Teleport 10 agents will now refuse to start if they detect that the Auth Service
 is more than one major version behind them. You can use the `--skip-version-check` flag to
 bypass the version check.
 
-Take a look at component compatibility guarantees in the documentation:
-https://goteleport.com/docs/setup/operations/upgrading/#component-compatibility.
+Take a look at component compatibility guarantees in the
+[documentation](docs/pages/management/operations/upgrading.mdx).
 
 #### HTTP_PROXY for reverse tunnels
 
@@ -1312,8 +1313,9 @@ This may result in reverse tunnel agents not being able to re-establish
 connections if the HTTP proxy is set in their environment and does not allow
 connections to the Teleport Proxy Service.
 
-Refer to the following documentation section for more details:
-https://goteleport.com/docs/setup/reference/networking/#http-connect-proxies.
+Refer to the
+[documentation](docs/pages/reference/networking.mdx#http-connect-proxies)
+for more details.
 
 #### New APT repos
 
@@ -1323,8 +1325,8 @@ repositories have been backfilled with Teleport versions starting from 6.2.31
 and we recommend upgrading to them. The old repositories will be maintained for
 the foreseeable future.
 
-See updated installation instructions:
-https://goteleport.com/docs/server-access/getting-started/#step-14-install-teleport-on-your-linux-host.
+See the [installation
+instructions](docs/pages/server-access/getting-started.mdx#step-14-install-teleport-on-your-linux-host).
 
 #### Removed “tctl access ls”
 
@@ -1339,8 +1341,9 @@ pod in order to join a session. Teleport 10 relaxes this requirement. Joining
 sessions remains deny-by-default but now only `join_sessions` statements are
 checked for session join RBAC.
 
-See the Moderated Sessions guide for more details:
-https://goteleport.com/docs/access-controls/guides/moderated-sessions/.
+See the [Moderated Sessions
+guide](docs/pages/access-controls/guides/moderated-sessions.mdx) for more
+details.
 
 #### GitHub connectors
 
@@ -1358,8 +1361,8 @@ for example:
 s3://bucket/path?region=us-east-1&use_fips_endpoint=false
 ```
 
-See the S3/DynamoDB backends documentation for more information:
-https://goteleport.com/docs/setup/reference/backends/#s3.
+See the [S3/DynamoDB backend
+documentation](docs/pages/reference/backends.mdx) for more information.
 
 ## 9.3.9
 
@@ -1373,7 +1376,7 @@ order roles are received from the backend.
 
 ### Other improvements and fixes
 
-* Fixed issue with per-session MFA swallowing keypresses. [#13822](https://github.com/gravitational/teleport/pull/13822)
+* Fixed issue with per-session MFA swallowing key presses. [#13822](https://github.com/gravitational/teleport/pull/13822)
 * Fixed issue with `tsh db ls -R` now showing allowed users. [#13626](https://github.com/gravitational/teleport/pull/13626)
 * Fixed vertical and horizontal scroll in desktop access. [#13905](https://github.com/gravitational/teleport/pull/13905)
 * Fixed issue with invalid query filters forcing `tsh` relogin. [#13747](https://github.com/gravitational/teleport/pull/13747)
@@ -1432,7 +1435,7 @@ When setting up agent forwarding on the node, Teleport did not handle unix socke
 
 This could have given a potential attacker an opportunity to get Teleport to change arbitrary file permissions to the attacker’s user.
 
-### Websockets CSRF
+### WebSockets CSRF
 
 When handling websocket requests, Teleport did not verify that the provided Bearer token was generated for the correct user.
 
@@ -1490,9 +1493,9 @@ Teleport 9.3.0 reduces the minimum GLIBC requirement to 2.18 and enforces more
 secure cipher suites for desktop access.
 
 As a result of these changes, desktop access users with desktops running Windows
-Server 2012R2 will need to perform
-[additional configuration](https://goteleport.com/docs/desktop-access/getting-started/#step-47-configure-a-certificate-for-rdp-connections)
-to force Windows to use compatible cipher suites.
+Server 2012R2 will need to perform [additional
+configuration](docs/pages/desktop-access/getting-started.mdx) to force Windows
+to use compatible cipher suites.
 
 Windows desktops running Windows Server 2016 and newer will continue to operate
 normally - no additional configuration is required.
@@ -1598,9 +1601,7 @@ Teleport build infrastructure was updated to use Go v1.17.9 to fix CVE-2022-2467
 
 Teleport users can now use PostgreSQL or CockroachDB for storing auth server data.
 
-See the documentation for more information:
-
-https://goteleport.com/docs/setup/reference/backends/#postgresqlcockroachdb-preview
+See the [documentation](docs/pages/reference/backends.mdx) for more information.
 
 ### Server-side filtering and pagination
 
@@ -2138,7 +2139,13 @@ Teleport 6.1 contains multiple new features, improvements, and bug fixes.
 
 Added support for U2F authentication on every SSH and Kubernetes "connection" (a single `tsh ssh` or `kubectl` call). This is an advanced security feature that protects users against compromises of their on-disk Teleport certificates. Per-session MFA can be enforced cluster-wide or only for some specific roles.
 
-For more details see [Per-Session MFA](https://goteleport.com/docs/access-controls/guides/per-session-mfa) documentation or [RFD 14](https://github.com/gravitational/teleport/blob/master/rfd/0014-session-2FA.md) and [RFD 15](https://github.com/gravitational/teleport/blob/master/rfd/0015-2fa-management.md) for technical details.
+For more details see [Per-Session
+MFA](docs/pages/access-controls/guides/per-session-mfa.mdx) documentation or
+[RFD
+14](https://github.com/gravitational/teleport/blob/master/rfd/0014-session-2FA.md)
+and [RFD
+15](https://github.com/gravitational/teleport/blob/master/rfd/0015-2fa-management.md)
+for technical details.
 
 #### Dual Authorization Workflows
 
@@ -2210,13 +2217,13 @@ Configure database access following the [Getting Started](./docs/pages/database-
 * [AWS RDS/Aurora MySQL](./docs/pages/database-access/guides/rds.mdx)
 * [Self-hosted PostgreSQL](./docs/pages/database-access/guides/postgres-self-hosted.mdx)
 * [Self-hosted MySQL](./docs/pages/database-access/guides/mysql-self-hosted.mdx)
-* [GUI clients](https://goteleport.com/docs/connect-your-client/gui-clients/)
+* [GUI clients](docs/pages/connect-your-client/gui-clients.mdx)
 
 ##### Resources
 
-To learn more about configuring role-based access control for database access, check out the [RBAC](./docs/pages/database-access/introduction.mdx/) section.
+To learn more about configuring role-based access control for database access, check out the [RBAC](./docs/pages/database-access/introduction.mdx) section.
 
-[Architecture](./docs/pages/database-access/introduction.mdx/) provides a more in-depth look at database access internals such as networking and security.
+[Architecture](./docs/pages/database-access/introduction.mdx) provides a more in-depth look at database access internals such as networking and security.
 
 See [Reference](./docs/pages/database-access/reference.mdx) for an overview of database access related configuration and CLI commands.
 
@@ -2565,7 +2572,7 @@ Enterprise Only:
 
 #### Documentation
 
-We've added an [API Reference](https://goteleport.com/docs/api-reference/) to simply developing applications against Teleport.
+We've added an [API Guide](docs/pages/api/introduction.mdx) to simply developing applications against Teleport.
 
 #### Upgrade Notes
 
@@ -2945,7 +2952,7 @@ To mitigate this issue, upgrade and restart all Teleport proxy processes.
 
 This release of Teleport contains a bug fix.
 
-* Fixed a regression in certificate reissuance that could cause nodes to not start. [#3449](https://github.com/gravitational/teleport/pull/3449)
+* Fixed a regression in reissuing certificate that could cause nodes to not start. [#3449](https://github.com/gravitational/teleport/pull/3449)
 
 ## 4.2.5
 
@@ -3434,7 +3441,7 @@ Teleport 3.1.1 contains a security fix. We strongly encourage anyone running Tel
 This is a major Teleport release with a focus on backwards compatibility, stability, and bug fixes. Some of the improvements:
 
 * Added support for regular expressions in RBAC label keys and values. [#2161](https://github.com/gravitational/teleport/issues/2161)
-* Added support for configurable server side keep-alives. [#2334](https://github.com/gravitational/teleport/issues/2334)
+* Added support for configurable server side keepalives. [#2334](https://github.com/gravitational/teleport/issues/2334)
 * Added support for some `-o` to improve OpenSSH interoperability. [#2330](https://github.com/gravitational/teleport/issues/2330)
 * Added i386 binaries as well as binaries built with older version of Go to support legacy systems. [#2277](https://github.com/gravitational/teleport/issues/2277)
 * Added SOCKS5 support to `tsh`. [#1693](https://github.com/gravitational/teleport/issues/1693)
diff --git a/Cargo.lock b/Cargo.lock
index 60b63a0245704..e6053f451fe97 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -41,7 +41,7 @@ checksum = "726535892e8eae7e70657b4c8ea93d26b8553afb1ce617caee529ef96d7dee6c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.107",
  "synstructure",
 ]
 
@@ -53,7 +53,7 @@ checksum = "2777730b2039ac0f95f093556e61b6d26cebed5393ca6f152717777cec3a42ed"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.107",
 ]
 
 [[package]]
@@ -121,9 +121,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.3.1"
+version = "2.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6776fc96284a0bb647b615056fc496d1fe1644a7ab01829818a6d91cae888b84"
+checksum = "630be753d4e58660abd17930c71b647fe46c27ea6b63cc59e1e3851406972e42"
 
 [[package]]
 name = "block-buffer"
@@ -195,9 +195,9 @@ checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
 
 [[package]]
 name = "cbindgen"
-version = "0.24.3"
+version = "0.24.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6358dedf60f4d9b8db43ad187391afe959746101346fe51bb978126bec61dfb"
+checksum = "4b922faaf31122819ec80c4047cc684c6979a087366c069611e33649bf98e18d"
 dependencies = [
  "clap",
  "heck",
@@ -207,7 +207,7 @@ dependencies = [
  "quote",
  "serde",
  "serde_json",
- "syn",
+ "syn 1.0.107",
  "tempfile",
  "toml",
 ]
@@ -403,7 +403,7 @@ checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.107",
 ]
 
 [[package]]
@@ -433,7 +433,7 @@ checksum = "3bf95dc3f046b9da4f2d51833c0d3547d8564ef6910f5c1ed130306a75b92886"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.107",
 ]
 
 [[package]]
@@ -462,13 +462,13 @@ dependencies = [
 
 [[package]]
 name = "errno"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d6a0976c999d473fe89ad888d5a284e55366d9dc9038b1ba2aa15128c4afa0"
+checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
 dependencies = [
  "errno-dragonfly",
  "libc",
- "windows-sys 0.45.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -533,7 +533,7 @@ checksum = "c8469d0d40519bc608ec6863f1cc88f3f1deee15913f2f3b3e573d81ed38cccc"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.107",
 ]
 
 [[package]]
@@ -651,6 +651,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "hermit-abi"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
+
 [[package]]
 name = "hmac"
 version = "0.7.1"
@@ -697,12 +703,13 @@ dependencies = [
 
 [[package]]
 name = "io-lifetimes"
-version = "1.0.3"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46112a93252b123d31a119a8d1a1ac19deac4fac6e0e8b0df58f0d4e5870e63c"
+checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
 dependencies = [
+ "hermit-abi 0.3.1",
  "libc",
- "windows-sys 0.42.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -768,9 +775,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.144"
+version = "0.2.147"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b00cc1c228a6782d0f076e7b232802e0c5689d41bb5df366f2a6b6621cfdfe1"
+checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
 
 [[package]]
 name = "libloading"
@@ -796,9 +803,9 @@ checksum = "f051f77a7c8e6957c0696eac88f26b0117e54f52d3fc682ab19397a8812846a4"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.3.0"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd550e73688e6d578f0ac2119e32b797a327631a42f9433e59d02e139c8df60d"
+checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
 
 [[package]]
 name = "lock_api"
@@ -812,9 +819,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.18"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "518ef76f2f87365916b142844c16d8fefd85039bc5699050210a7778ee1cd1de"
+checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
 
 [[package]]
 name = "md-5"
@@ -921,13 +928,13 @@ dependencies = [
 
 [[package]]
 name = "num-derive"
-version = "0.3.3"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "876a53fff98e03a936a674b29568b0e605f06b29372c2489ff4de23f1949743d"
+checksum = "9e6a0fd4f737c707bd9086cc16c925f294943eb62eb71499e9fd4cf71f8b9f4e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.23",
 ]
 
 [[package]]
@@ -980,7 +987,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.107",
 ]
 
 [[package]]
@@ -1079,9 +1086,9 @@ dependencies = [
 
 [[package]]
 name = "png"
-version = "0.17.8"
+version = "0.17.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aaeebc51f9e7d2c150d3f3bfeb667f2aa985db5ef1e3d212847bdedb488beeaa"
+checksum = "59871cc5b6cce7eaccca5a802b4173377a1c2ba90654246789a8fa2334426d11"
 dependencies = [
  "bitflags 1.3.2",
  "crc32fast",
@@ -1107,18 +1114,18 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.49"
+version = "1.0.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57a8eca9f9c4ffde41714334dee777596264c7825420f521abc92b5b5deb63a5"
+checksum = "7b368fba921b0dce7e60f5e04ec15e565b3303972b42bcfde1d0713b881959eb"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.23"
+version = "1.0.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b"
+checksum = "573015e8ab27661678357f27dc26460738fd2b6c86e46f386fde94cb5d913105"
 dependencies = [
  "proc-macro2",
 ]
@@ -1207,7 +1214,7 @@ dependencies = [
 name = "rdp-client"
 version = "0.1.0"
 dependencies = [
- "bitflags 2.3.1",
+ "bitflags 2.3.3",
  "byteorder",
  "cbindgen",
  "env_logger",
@@ -1375,16 +1382,16 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.37.4"
+version = "0.37.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c348b5dc624ecee40108aa2922fed8bad89d7fcc2b9f8cb18f632898ac4a37f9"
+checksum = "acf8729d8542766f1b2cf77eb034d52f40d375bb8b615d0b147089946e16613d"
 dependencies = [
  "bitflags 1.3.2",
- "errno 0.3.0",
+ "errno 0.3.1",
  "io-lifetimes",
  "libc",
- "linux-raw-sys 0.3.0",
- "windows-sys 0.45.0",
+ "linux-raw-sys 0.3.8",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -1444,7 +1451,7 @@ checksum = "255abe9a125a985c05190d687b320c12f9b1f0b99445e608c21ba0782c719ad8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.107",
 ]
 
 [[package]]
@@ -1556,6 +1563,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "2.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59fb7d6d8281a51045d62b8eb3a7d1ce347b76f312af50cd3dc0af39c87c1737"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "synstructure"
 version = "0.12.6"
@@ -1564,21 +1582,22 @@ checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.107",
  "unicode-xid",
 ]
 
 [[package]]
 name = "tempfile"
-version = "3.5.0"
+version = "3.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9fbec84f381d5795b08656e4912bec604d162bff9291d6189a78f4c8ab87998"
+checksum = "31c0432476357e58790aaa47a8efb0c5138f137343f3b5f23bd36a27e3b0a6d6"
 dependencies = [
+ "autocfg",
  "cfg-if",
  "fastrand",
  "redox_syscall",
- "rustix 0.37.4",
- "windows-sys 0.45.0",
+ "rustix 0.37.19",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -1613,7 +1632,7 @@ checksum = "1fb327af4685e4d03fa8cbcf1716380da910eeb2bb8be417e7f9fd3fb164f36f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.107",
 ]
 
 [[package]]
@@ -1693,9 +1712,9 @@ dependencies = [
 
 [[package]]
 name = "uuid"
-version = "1.3.3"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "345444e32442451b267fc254ae85a209c64be56d2890e601a0c37ff0c3c5ecd2"
+checksum = "d023da39d1fde5a8a3fe1f3e01ca9632ada0a63e9797de55a879d6e2236277be"
 dependencies = [
  "getrandom 0.2.8",
 ]
@@ -1739,7 +1758,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.107",
  "wasm-bindgen-shared",
 ]
 
@@ -1761,7 +1780,7 @@ checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.107",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -1829,37 +1848,37 @@ version = "0.42.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
 ]
 
 [[package]]
 name = "windows-sys"
-version = "0.45.0"
+version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
  "windows-targets",
 ]
 
 [[package]]
 name = "windows-targets"
-version = "0.42.2"
+version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+checksum = "7b1eb6f0cd7c80c79759c929114ef071b87354ce476d9d94271031c0497adfd5"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_aarch64_gnullvm 0.48.0",
+ "windows_aarch64_msvc 0.48.0",
+ "windows_i686_gnu 0.48.0",
+ "windows_i686_msvc 0.48.0",
+ "windows_x86_64_gnu 0.48.0",
+ "windows_x86_64_gnullvm 0.48.0",
+ "windows_x86_64_msvc 0.48.0",
 ]
 
 [[package]]
@@ -1868,42 +1887,84 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
+
 [[package]]
 name = "x509-parser"
 version = "0.14.0"
diff --git a/Makefile b/Makefile
index 8552cdcaebf77..b4e699fe01aef 100644
--- a/Makefile
+++ b/Makefile
@@ -648,6 +648,10 @@ DIFF_TEST := $(TOOLINGDIR)/bin/difftest
 $(DIFF_TEST): $(wildcard $(TOOLINGDIR)/cmd/difftest/*.go)
 	cd $(TOOLINGDIR) && go build -o "$@" ./cmd/difftest
 
+RERUN := $(TOOLINGDIR)/bin/rerun
+$(RERUN): $(wildcard $(TOOLINGDIR)/cmd/rerun/*.go)
+	cd $(TOOLINGDIR) && go build -o "$@" ./cmd/rerun
+
 .PHONY: tooling
 tooling: $(RENDER_TESTS) $(DIFF_TEST)
 
@@ -663,7 +667,7 @@ $(TEST_LOG_DIR):
 .PHONY: helmunit/installed
 helmunit/installed:
 	@if ! helm unittest -h >/dev/null; then \
-		echo 'Helm unittest plugin is required to test Helm charts. Run `helm plugin install https://github.com/quintush/helm-unittest` to install it'; \
+		echo 'Helm unittest plugin is required to test Helm charts. Run `helm plugin install https://github.com/quintush/helm-unittest --version 0.2.11` to install it'; \
 		exit 1; \
 	fi
 
@@ -730,7 +734,7 @@ endif
 # Runs ci tsh tests
 .PHONY: test-go-tsh
 test-go-tsh: FLAGS ?= -race -shuffle on
-test-go-tsh: SUBJECT ?= github.com/gravitational/teleport/tool/tsh
+test-go-tsh: SUBJECT ?= github.com/gravitational/teleport/tool/tsh/...
 test-go-tsh:
 	$(CGOFLAG_TSH) go test -cover -json -tags "$(PAM_TAG) $(FIPS_TAG) $(LIBFIDO2_TEST_TAG) $(TOUCHID_TAG) $(PIV_TEST_TAG)" $(PACKAGES) $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
 		| tee $(TEST_LOG_DIR)/unit.json \
@@ -808,6 +812,24 @@ test-teleport-usage:
 		| tee $(TEST_LOG_DIR)/teleport-usage.json \
 		| ${RENDER_TESTS}
 
+#
+# Flaky test detection. Usually run from CI nightly, overriding these default parameters
+# This runs the same tests as test-go-unit but repeatedly to try to detect flaky tests.
+#
+.PHONY: test-go-flaky
+FLAKY_RUNS ?= 3
+FLAKY_TIMEOUT ?= 1h
+FLAKY_TOP_N ?= 20
+FLAKY_SUMMARY_FILE ?= /tmp/flaky-report.txt
+test-go-flaky: FLAGS ?= -race -shuffle on
+test-go-flaky: SUBJECT ?= $(shell go list ./... | grep -v -e integration -e tool/tsh -e integrations/operator -e integrations/access -e integrations/lib )
+test-go-flaky: GO_BUILD_TAGS ?= $(PAM_TAG) $(FIPS_TAG) $(BPF_TAG) $(RDPCLIENT_TAG) $(TOUCHID_TAG) $(PIV_TEST_TAG)
+test-go-flaky: RENDER_FLAGS ?= -report-by flakiness -summary-file $(FLAKY_SUMMARY_FILE) -top $(FLAKY_TOP_N)
+test-go-flaky: test-go-prepare $(RERUN)
+	$(CGOFLAG) $(RERUN) -n $(FLAKY_RUNS) -t $(FLAKY_TIMEOUT) \
+		go test -count=1 -cover -json -tags "$(GO_BUILD_TAGS)" $(SUBJECT) $(FLAGS) $(ADDFLAGS) \
+		| $(RENDER_TESTS) $(RENDER_FLAGS)
+
 #
 # Runs cargo test on our Rust modules.
 # (a no-op if cargo and rustc are not installed)
@@ -911,7 +933,11 @@ lint-go:
 
 .PHONY: fix-imports
 fix-imports:
-	make -C build.assets/ fix-imports
+ifndef TELEPORT_DEVBOX
+	$(MAKE) -C build.assets/ fix-imports
+else
+	$(MAKE) fix-imports/host
+endif
 
 .PHONY: fix-imports/host
 fix-imports/host:
@@ -949,6 +975,7 @@ lint-sh:
 	find . -type f \( -name '*.sh' -or -name '*.sh.tmpl' \) -not -path "*/node_modules/*" | xargs \
 		shellcheck \
 		--exclude=SC2086 \
+		--exclude=SC1091 \
 		$(SH_LINT_FLAGS)
 
 	# lint AWS AMI scripts
@@ -1164,7 +1191,11 @@ buf/installed:
 # This target runs in the buildbox container.
 .PHONY: grpc
 grpc:
+ifndef TELEPORT_DEVBOX
 	$(MAKE) -C build.assets grpc
+else
+	$(MAKE) grpc/host
+endif
 
 # grpc/host generates GRPC stubs.
 # Unlike grpc, this target runs locally.
@@ -1176,7 +1207,11 @@ grpc/host: protos/all
 # This target runs in the buildbox container.
 .PHONY: protos-up-to-date
 protos-up-to-date:
+ifndef TELEPORT_DEVBOX
 	$(MAKE) -C build.assets protos-up-to-date
+else
+	$(MAKE) protos-up-to-date/host
+endif
 
 # protos-up-to-date/host checks if the generated GRPC stubs are up to date.
 # Unlike protos-up-to-date, this target runs locally.
diff --git a/README.md b/README.md
index 2d168344f131b..811598681418e 100644
--- a/README.md
+++ b/README.md
@@ -107,8 +107,8 @@ Teleport Team
 
 If you wish to deploy Teleport inside a Docker container:
 ```
-# This command will pull the Teleport container image for version 8
-docker pull public.ecr.aws/gravitational/teleport:8
+# This command will pull the Teleport container image for version 13
+docker pull public.ecr.aws/gravitational/teleport:13
 ```
 View latest tags on [Amazon ECR Public | gravitational/teleport](https://gallery.ecr.aws/gravitational/teleport)
 
@@ -128,7 +128,7 @@ If your intention is to build and deploy for use in a production infrastructure
 a released tag should be used.  The default branch, `master`, is the current
 development branch for an upcoming major version.  Get the latest release tags
 listed at https://goteleport.com/download/ and then use that tag in the `git clone`.
-For example `git clone https://github.com/gravitational/teleport.git -b v9.1.2` gets release v9.1.2.
+For example `git clone https://github.com/gravitational/teleport.git -b v13.0.0` gets release v13.0.0.
 
 ### Dockerized Build
 
@@ -245,18 +245,6 @@ DEBUG=1 ./build/teleport start -d
 Keep the server running in this mode, and make your UI changes in `/dist` directory.
 For instructions about how to update the Web UI, read [the `web` README](web#readme).
 
-#### Updating Web UI assets
-
-After you commit a change to [the `webapps`
-repo](https://github.com/gravitational/webapps), you need to update the Web UI
-assets in the `webassets/` git submodule.
-
-Run `make update-webassets` to update the `webassets` repo and create a PR for
-`teleport` to update its git submodule.
-
-You will need to have the `gh` utility installed on your system for the script
-to work. For installation instructions, read the [GitHub CLI installation](https://github.com/cli/cli/releases/latest) documentation.
-
 ### Managing dependencies
 
 All dependencies are managed using [Go modules](https://blog.golang.org/using-go-modules). Here are the instructions for some common tasks:
@@ -306,6 +294,28 @@ Why is a specific version of a module imported?
 
 `go mod graph | grep $modname`
 
+### Devbox Build (experimental)
+
+**Note**: Devbox support is still experimental. It's very possible things make not work as intended.
+
+Teleport can be built using [devbox](https://www.jetpack.io/devbox). To use devbox, follow
+the instructions to install devbox [here](https://www.jetpack.io/devbox/docs/quickstart/) and
+then run:
+
+`devbox shell`
+
+This will install Teleport's various build dependencies and drop you into a shell with these
+dependencies. From here, you can build Teleport normally.
+
+#### flake.nix
+
+A nix flake is located in `build.assets/flake` that allows for installation of Teleport's less
+common build tooling. If this flake is updated, run:
+
+`devbox install`
+
+in order to make sure the changes in the flake are reflected in the local devbox shell.
+
 ## Why did We Build Teleport?
 
 The Teleport creators used to work together at Rackspace. We noticed that most cloud computing users struggle with setting up and configuring infrastructure security because popular tools, while flexible, are complex to understand and expensive to maintain. Additionally, most organizations use multiple infrastructure form factors such as several cloud providers, multiple cloud accounts, servers in colocation, and even smart devices. Some of those devices run on untrusted networks, behind third-party firewalls. This only magnifies complexity and increases operational overhead.
@@ -345,4 +355,4 @@ You can see the list of companies who use Teleport in production on the Teleport
 
 Teleport was created by [Gravitational, Inc.](https://goteleport.com). We have
 built Teleport by borrowing from our previous experiences at Rackspace. [Learn more
-about Teleport and our history](https://goteleport.com/about/).
+about Teleport and our history](https://goteleport.com/about/).
\ No newline at end of file
diff --git a/api/client/alpn.go b/api/client/alpn.go
index 4ccaa402f7e8d..4e94b35e7366c 100644
--- a/api/client/alpn.go
+++ b/api/client/alpn.go
@@ -63,8 +63,7 @@ type ALPNDialerConfig struct {
 // ALPNDialer is a ContextDialer that dials a connection to the Proxy Service
 // with ALPN and SNI configured in the provided TLSConfig. An ALPN connection
 // upgrade is also performed at the initial connection, if an upgrade is
-// required. If the negotiated protocol is a Ping protocol, it will return the
-// de-multiplexed connection without the Ping.
+// required.
 type ALPNDialer struct {
 	cfg ALPNDialerConfig
 }
diff --git a/api/client/alpn_conn_upgrade.go b/api/client/alpn_conn_upgrade.go
index 4ce254df95548..92c04ef3a0400 100644
--- a/api/client/alpn_conn_upgrade.go
+++ b/api/client/alpn_conn_upgrade.go
@@ -26,6 +26,7 @@ import (
 	"net/url"
 	"os"
 	"strings"
+	"time"
 
 	"github.com/gravitational/trace"
 	"github.com/sirupsen/logrus"
@@ -48,19 +49,28 @@ import (
 // In those cases, the Teleport client should make a HTTP "upgrade" call to the
 // Proxy Service to establish a tunnel for the originally planned traffic to
 // preserve the ALPN and SNI information.
-func IsALPNConnUpgradeRequired(addr string, insecure bool) bool {
+func IsALPNConnUpgradeRequired(ctx context.Context, addr string, insecure bool, opts ...DialOption) bool {
 	if result, ok := OverwriteALPNConnUpgradeRequirementByEnv(addr); ok {
 		return result
 	}
 
-	netDialer := &net.Dialer{
-		Timeout: defaults.DefaultIOTimeout,
-	}
+	// Use NewDialer which takes care of ProxyURL, and use a shorter I/O
+	// timeout to avoid blocking caller.
+	baseDialer := NewDialer(
+		ctx,
+		defaults.DefaultIdleTimeout,
+		5*time.Second,
+		append(opts,
+			WithInsecureSkipVerify(insecure),
+			WithALPNConnUpgrade(false),
+		)...,
+	)
+
 	tlsConfig := &tls.Config{
 		NextProtos:         []string{string(constants.ALPNSNIProtocolReverseTunnel)},
 		InsecureSkipVerify: insecure,
 	}
-	testConn, err := tls.DialWithDialer(netDialer, "tcp", addr, tlsConfig)
+	testConn, err := tlsutils.TLSDial(ctx, baseDialer, "tcp", addr, tlsConfig)
 	if err != nil {
 		if isRemoteNoALPNError(err) {
 			logrus.Debugf("ALPN connection upgrade required for %q: %v. No ALPN protocol is negotiated by the server.", addr, true)
diff --git a/api/client/alpn_conn_upgrade_test.go b/api/client/alpn_conn_upgrade_test.go
index 56a5bce36a2c1..e51239019b179 100644
--- a/api/client/alpn_conn_upgrade_test.go
+++ b/api/client/alpn_conn_upgrade_test.go
@@ -32,6 +32,7 @@ import (
 
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/fixtures"
+	"github.com/gravitational/teleport/api/testhelpers"
 	"github.com/gravitational/teleport/api/utils/pingconn"
 )
 
@@ -70,10 +71,21 @@ func TestIsALPNConnUpgradeRequired(t *testing.T) {
 		},
 	}
 
+	ctx := context.Background()
+	forwardProxy, forwardProxyURL := mustStartForwardProxy(t)
+
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			server := mustStartMockALPNServer(t, test.serverProtos)
-			require.Equal(t, test.expectedResult, IsALPNConnUpgradeRequired(server.Addr().String(), test.insecure))
+			t.Run("direct", func(t *testing.T) {
+				require.Equal(t, test.expectedResult, IsALPNConnUpgradeRequired(ctx, server.Addr().String(), test.insecure))
+			})
+
+			t.Run("with ProxyURL", func(t *testing.T) {
+				countBeforeTest := forwardProxy.Count()
+				require.Equal(t, test.expectedResult, IsALPNConnUpgradeRequired(ctx, server.Addr().String(), test.insecure, withProxyURL(forwardProxyURL)))
+				require.Equal(t, countBeforeTest+1, forwardProxy.Count())
+			})
 		})
 	}
 }
@@ -160,24 +172,50 @@ func TestALPNConnUpgradeDialer(t *testing.T) {
 			pool.AddCert(server.Certificate())
 
 			tlsConfig := &tls.Config{RootCAs: pool}
-			preDialer := newDirectDialer(0, 5*time.Second)
-			dialer := newALPNConnUpgradeDialer(preDialer, tlsConfig, test.withPing)
-			conn, err := dialer.DialContext(ctx, "tcp", addr.Host)
-			if test.wantError {
-				require.Error(t, err)
-				return
-			}
-			require.NoError(t, err)
-			defer conn.Close()
-
-			data := make([]byte, 100)
-			n, err := conn.Read(data)
-			require.NoError(t, err)
-			require.Equal(t, string(data[:n]), "hello")
+			directDialer := newDirectDialer(0, 5*time.Second)
+
+			t.Run("direct", func(t *testing.T) {
+				dialer := newALPNConnUpgradeDialer(directDialer, tlsConfig, test.withPing)
+				conn, err := dialer.DialContext(ctx, "tcp", addr.Host)
+				if test.wantError {
+					require.Error(t, err)
+					return
+				}
+				require.NoError(t, err)
+				defer conn.Close()
+
+				mustReadConnData(t, conn, "hello")
+			})
+
+			t.Run("with ProxyURL", func(t *testing.T) {
+				forwardProxy, forwardProxyURL := mustStartForwardProxy(t)
+				countBeforeTest := forwardProxy.Count()
+
+				proxyURLDialer := newProxyURLDialer(forwardProxyURL, directDialer)
+				dialer := newALPNConnUpgradeDialer(proxyURLDialer, tlsConfig, test.withPing)
+				conn, err := dialer.DialContext(ctx, "tcp", addr.Host)
+				if test.wantError {
+					require.Error(t, err)
+					return
+				}
+				require.NoError(t, err)
+				defer conn.Close()
+
+				mustReadConnData(t, conn, "hello")
+				require.Equal(t, countBeforeTest+1, forwardProxy.Count())
+			})
 		})
 	}
 }
 
+func mustReadConnData(t *testing.T, conn net.Conn, wantText string) {
+	data := make([]byte, len(wantText)*2)
+	n, err := conn.Read(data)
+	require.NoError(t, err)
+	require.Equal(t, len(wantText), n)
+	require.Equal(t, string(data[:n]), wantText)
+}
+
 type mockALPNServer struct {
 	net.Listener
 	cert            tls.Certificate
@@ -273,3 +311,20 @@ func mockConnUpgradeHandler(t *testing.T, upgradeType string, write []byte) http
 		}
 	})
 }
+
+func mustStartForwardProxy(t *testing.T) (*testhelpers.ProxyHandler, *url.URL) {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "localhost:0")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		listener.Close()
+	})
+
+	url, err := url.Parse("http://" + listener.Addr().String())
+	require.NoError(t, err)
+
+	handler := &testhelpers.ProxyHandler{}
+	go http.Serve(listener, handler)
+	return handler, url
+}
diff --git a/api/client/client.go b/api/client/client.go
index 46ab883723ae2..41ac90e30bbdf 100644
--- a/api/client/client.go
+++ b/api/client/client.go
@@ -57,6 +57,7 @@ import (
 	pluginspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
 	samlidppb "github.com/gravitational/teleport/api/gen/proto/go/teleport/samlidp/v1"
 	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
+	userpreferencespb "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1"
 	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/observability/tracing"
@@ -79,6 +80,7 @@ type AuthServiceClient struct {
 	proto.AuthServiceClient
 	assist.AssistServiceClient
 	auditlogpb.AuditLogServiceClient
+	userpreferencespb.UserPreferencesServiceClient
 }
 
 // Client is a gRPC Client that connects to a Teleport Auth server either
@@ -470,9 +472,10 @@ func (c *Client) dialGRPC(ctx context.Context, addr string) error {
 
 	c.conn = conn
 	c.grpc = AuthServiceClient{
-		AuthServiceClient:     proto.NewAuthServiceClient(c.conn),
-		AssistServiceClient:   assist.NewAssistServiceClient(c.conn),
-		AuditLogServiceClient: auditlogpb.NewAuditLogServiceClient(c.conn),
+		AuthServiceClient:            proto.NewAuthServiceClient(c.conn),
+		AssistServiceClient:          assist.NewAssistServiceClient(c.conn),
+		AuditLogServiceClient:        auditlogpb.NewAuditLogServiceClient(c.conn),
+		UserPreferencesServiceClient: userpreferencespb.NewUserPreferencesServiceClient(c.conn),
 	}
 	c.JoinServiceClient = NewJoinServiceClient(proto.NewJoinServiceClient(c.conn))
 
@@ -752,6 +755,12 @@ func (c *Client) TrustClient() trustpb.TrustServiceClient {
 	return trustpb.NewTrustServiceClient(c.conn)
 }
 
+// EmbeddingClient returns an unadorned Embedding client, using the underlying
+// Auth gRPC connection.
+func (c *Client) EmbeddingClient() assist.AssistEmbeddingServiceClient {
+	return assist.NewAssistEmbeddingServiceClient(c.conn)
+}
+
 // Ping gets basic info about the auth server.
 func (c *Client) Ping(ctx context.Context) (proto.PingResponse, error) {
 	rsp, err := c.grpc.Ping(ctx, &proto.PingRequest{})
@@ -3903,6 +3912,24 @@ func (c *Client) GetHeadlessAuthentication(ctx context.Context, id string) (*typ
 	return headlessAuthn, nil
 }
 
+// WatchPendingHeadlessAuthentications creates a watcher for pending headless authentication for the current user.
+func (c *Client) WatchPendingHeadlessAuthentications(ctx context.Context) (types.Watcher, error) {
+	cancelCtx, cancel := context.WithCancel(ctx)
+	stream, err := c.grpc.WatchPendingHeadlessAuthentications(cancelCtx, &emptypb.Empty{})
+	if err != nil {
+		cancel()
+		return nil, trail.FromGRPC(err)
+	}
+	w := &streamWatcher{
+		stream:  stream,
+		ctx:     cancelCtx,
+		cancel:  cancel,
+		eventsC: make(chan types.Event),
+	}
+	go w.receiveEvents()
+	return w, nil
+}
+
 // CreateAssistantConversation creates a new conversation entry in the backend.
 func (c *Client) CreateAssistantConversation(ctx context.Context, req *assist.CreateAssistantConversationRequest) (*assist.CreateAssistantConversationResponse, error) {
 	resp, err := c.grpc.CreateAssistantConversation(ctx, req)
@@ -3966,3 +3993,29 @@ func (c *Client) UpdateAssistantConversationInfo(ctx context.Context, in *assist
 	}
 	return nil
 }
+
+func (c *Client) GetAssistantEmbeddings(ctx context.Context, in *assist.GetAssistantEmbeddingsRequest) (*assist.GetAssistantEmbeddingsResponse, error) {
+	result, err := c.EmbeddingClient().GetAssistantEmbeddings(ctx, in)
+	if err != nil {
+		return nil, trail.FromGRPC(err)
+	}
+	return result, nil
+}
+
+// GetUserPreferences returns the user preferences for a given user.
+func (c *Client) GetUserPreferences(ctx context.Context, in *userpreferencespb.GetUserPreferencesRequest) (*userpreferencespb.GetUserPreferencesResponse, error) {
+	resp, err := c.grpc.GetUserPreferences(ctx, in)
+	if err != nil {
+		return nil, trail.FromGRPC(err)
+	}
+	return resp, nil
+}
+
+// UpsertUserPreferences creates or updates user preferences for a given username.
+func (c *Client) UpsertUserPreferences(ctx context.Context, in *userpreferencespb.UpsertUserPreferencesRequest) error {
+	_, err := c.grpc.UpsertUserPreferences(ctx, in)
+	if err != nil {
+		return trail.FromGRPC(err)
+	}
+	return nil
+}
diff --git a/api/client/contextdialer.go b/api/client/contextdialer.go
index 5dc11b63b74e6..e28227c98f9e5 100644
--- a/api/client/contextdialer.go
+++ b/api/client/contextdialer.go
@@ -48,6 +48,18 @@ type dialConfig struct {
 	// proxyHeaderGetter is used if present to get signed PROXY headers to propagate client's IP.
 	// Used by proxy's web server to make calls on behalf of connected clients.
 	proxyHeaderGetter PROXYHeaderGetter
+	// proxyURLFunc is a function used to get ProxyURL. Defaults to
+	// utils.GetProxyURL if not specified. Currently only used in tests to
+	// overwrite the ProxyURL as httpproxy.FromEnvironment skips localhost
+	// proxies.
+	proxyURLFunc func(dialAddr string) *url.URL
+}
+
+func (c *dialConfig) getProxyURL(dialAddr string) *url.URL {
+	if c.proxyURLFunc != nil {
+		return c.proxyURLFunc(dialAddr)
+	}
+	return utils.GetProxyURL(dialAddr)
 }
 
 // WithInsecureSkipVerify specifies if dialing insecure when using an HTTPS proxy.
@@ -74,6 +86,14 @@ func WithALPNConnUpgradePing(alpnConnUpgradeWithPing bool) DialOption {
 	}
 }
 
+func withProxyURL(proxyURL *url.URL) DialProxyOption {
+	return func(cfg *dialProxyConfig) {
+		cfg.proxyURLFunc = func(_ string) *url.URL {
+			return proxyURL
+		}
+	}
+}
+
 // WithPROXYHeaderGetter provides PROXY headers signer so client's real IP could be propagated.
 // Used by proxy's web server to make calls on behalf of connected clients.
 func WithPROXYHeaderGetter(proxyHeaderGetter PROXYHeaderGetter) DialProxyOption {
@@ -172,6 +192,12 @@ func NewDialer(ctx context.Context, keepAlivePeriod, dialTimeout time.Duration,
 		// Base direct dialer.
 		var dialer ContextDialer = netDialer
 
+		// Currently there is no use case where both cfg.proxyHeaderGetter and
+		// cfg.alpnConnUpgradeRequired are set.
+		if cfg.proxyHeaderGetter != nil && cfg.alpnConnUpgradeRequired {
+			return nil, trace.NotImplemented("ALPN connection upgrade does not support multiplexer header")
+		}
+
 		// Wrap with PROXY header dialer if getter is present.
 		// Used by Proxy's web server to propagate real client IP when making calls on behalf of connected clients
 		if cfg.proxyHeaderGetter != nil {
@@ -179,7 +205,7 @@ func NewDialer(ctx context.Context, keepAlivePeriod, dialTimeout time.Duration,
 		}
 
 		// Wrap with proxy URL dialer if proxy URL is detected.
-		if proxyURL := utils.GetProxyURL(addr); proxyURL != nil {
+		if proxyURL := cfg.getProxyURL(addr); proxyURL != nil {
 			dialer = newProxyURLDialer(proxyURL, dialer, opts...)
 		}
 
@@ -327,7 +353,7 @@ func newTLSRoutingWithConnUpgradeDialer(ssh ssh.ClientConfig, params connectPara
 				InsecureSkipVerify: insecure,
 				ServerName:         host,
 			},
-			ALPNConnUpgradeRequired: IsALPNConnUpgradeRequired(params.addr, insecure),
+			ALPNConnUpgradeRequired: IsALPNConnUpgradeRequired(ctx, params.addr, insecure),
 			GetClusterCAs: func(_ context.Context) (*x509.CertPool, error) {
 				tlsConfig, err := params.cfg.Credentials[0].TLSConfig()
 				if err != nil {
diff --git a/api/client/events.go b/api/client/events.go
index e4e838eb85473..de96aa411cf59 100644
--- a/api/client/events.go
+++ b/api/client/events.go
@@ -206,6 +206,10 @@ func EventToGRPC(in types.Event) (*proto.Event, error) {
 		out.Resource = &proto.Event_Integration{
 			Integration: r,
 		}
+	case *types.HeadlessAuthentication:
+		out.Resource = &proto.Event_HeadlessAuthentication{
+			HeadlessAuthentication: r,
+		}
 	default:
 		return nil, trace.BadParameter("resource type %T is not supported", in.Resource)
 	}
@@ -358,6 +362,9 @@ func EventFromGRPC(in proto.Event) (*types.Event, error) {
 	} else if r := in.GetIntegration(); r != nil {
 		out.Resource = r
 		return &out, nil
+	} else if r := in.GetHeadlessAuthentication(); r != nil {
+		out.Resource = r
+		return &out, nil
 	} else {
 		return nil, trace.BadParameter("received unsupported resource %T", in.Resource)
 	}
diff --git a/api/client/proto/authservice.pb.go b/api/client/proto/authservice.pb.go
index cf0014eae5399..226968572086f 100644
--- a/api/client/proto/authservice.pb.go
+++ b/api/client/proto/authservice.pb.go
@@ -413,6 +413,7 @@ type Event struct {
 	//	*Event_OktaAssignment
 	//	*Event_Integration
 	//	*Event_WatchStatus
+	//	*Event_HeadlessAuthentication
 	Resource             isEvent_Resource `protobuf_oneof:"Resource"`
 	XXX_NoUnkeyedLiteral struct{}         `json:"-"`
 	XXX_unrecognized     []byte           `json:"-"`
@@ -581,6 +582,9 @@ type Event_Integration struct {
 type Event_WatchStatus struct {
 	WatchStatus *types.WatchStatusV1 `protobuf:"bytes,43,opt,name=WatchStatus,proto3,oneof" json:"watch_status,omitempty"`
 }
+type Event_HeadlessAuthentication struct {
+	HeadlessAuthentication *types.HeadlessAuthentication `protobuf:"bytes,44,opt,name=HeadlessAuthentication,proto3,oneof" json:"headless_authentication,omitempty"`
+}
 
 func (*Event_ResourceHeader) isEvent_Resource()          {}
 func (*Event_CertAuthority) isEvent_Resource()           {}
@@ -623,6 +627,7 @@ func (*Event_OktaImportRule) isEvent_Resource()          {}
 func (*Event_OktaAssignment) isEvent_Resource()          {}
 func (*Event_Integration) isEvent_Resource()             {}
 func (*Event_WatchStatus) isEvent_Resource()             {}
+func (*Event_HeadlessAuthentication) isEvent_Resource()  {}
 
 func (m *Event) GetResource() isEvent_Resource {
 	if m != nil {
@@ -925,6 +930,13 @@ func (m *Event) GetWatchStatus() *types.WatchStatusV1 {
 	return nil
 }
 
+func (m *Event) GetHeadlessAuthentication() *types.HeadlessAuthentication {
+	if x, ok := m.GetResource().(*Event_HeadlessAuthentication); ok {
+		return x.HeadlessAuthentication
+	}
+	return nil
+}
+
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*Event) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -969,6 +981,7 @@ func (*Event) XXX_OneofWrappers() []interface{} {
 		(*Event_OktaAssignment)(nil),
 		(*Event_Integration)(nil),
 		(*Event_WatchStatus)(nil),
+		(*Event_HeadlessAuthentication)(nil),
 	}
 }
 
@@ -14553,853 +14566,855 @@ func init() {
 }
 
 var fileDescriptor_0ffcffcda38ae159 = []byte{
-	// 13522 bytes of a gzipped FileDescriptorProto
+	// 13568 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xc4, 0xbd, 0x5d, 0x6c, 0x1c, 0x59,
-	0x76, 0x18, 0xac, 0x6e, 0xfe, 0x1f, 0xfe, 0xb5, 0xae, 0xf8, 0xd3, 0x6a, 0x52, 0x6c, 0xa9, 0x34,
-	0xd2, 0x68, 0xb4, 0x3b, 0xfa, 0xa1, 0xe6, 0x7f, 0x66, 0x67, 0xb6, 0x9b, 0xa4, 0x44, 0x4a, 0x14,
-	0xc9, 0xa9, 0x26, 0x9b, 0xb3, 0xbb, 0xb3, 0xdb, 0x5b, 0xec, 0xbe, 0x22, 0xeb, 0x53, 0xb3, 0xab,
-	0xb7, 0xaa, 0x28, 0x8d, 0x6c, 0xf8, 0xfb, 0x3e, 0xdb, 0xb1, 0x1f, 0x12, 0x24, 0x71, 0x00, 0x3b,
-	0x88, 0xe1, 0x07, 0x07, 0x48, 0x5e, 0x12, 0x20, 0x40, 0x5e, 0x0c, 0xbf, 0x04, 0x08, 0x8c, 0x04,
-	0xc8, 0x26, 0x80, 0x81, 0x00, 0xb1, 0x11, 0x20, 0x0f, 0x74, 0xbc, 0x0f, 0x79, 0x20, 0x90, 0x00,
-	0x41, 0x90, 0x3c, 0x2c, 0x10, 0x20, 0xb8, 0xbf, 0x75, 0x6f, 0xd5, 0xad, 0x6a, 0x52, 0xe2, 0x4e,
-	0x5e, 0x24, 0xf6, 0xbd, 0xe7, 0x9c, 0xfb, 0x7f, 0xea, 0x9c, 0x73, 0xcf, 0x3d, 0x07, 0xee, 0x84,
-	0xb8, 0x8d, 0xbb, 0x9e, 0x1f, 0xde, 0x6d, 0xe3, 0x7d, 0xa7, 0xf9, 0xea, 0x6e, 0xb3, 0xed, 0xe2,
-	0x4e, 0x78, 0xb7, 0xeb, 0x7b, 0xa1, 0x77, 0xd7, 0x39, 0x0a, 0x0f, 0x02, 0xec, 0xbf, 0x70, 0x9b,
-	0xf8, 0x0e, 0x2d, 0x41, 0x03, 0xf4, 0xbf, 0xd2, 0xd4, 0xbe, 0xb7, 0xef, 0x31, 0x18, 0xf2, 0x17,
-	0xab, 0x2c, 0xcd, 0xed, 0x7b, 0xde, 0x7e, 0x1b, 0x33, 0xe4, 0xbd, 0xa3, 0x67, 0x77, 0xf1, 0x61,
-	0x37, 0x7c, 0xc5, 0x2b, 0xcb, 0xf1, 0xca, 0xd0, 0x3d, 0xc4, 0x41, 0xe8, 0x1c, 0x76, 0x39, 0xc0,
-	0x3b, 0xb2, 0x2b, 0x4e, 0x18, 0x92, 0x9a, 0xd0, 0xf5, 0x3a, 0x77, 0x5f, 0xdc, 0x57, 0x7f, 0x72,
-	0xd0, 0x5b, 0x99, 0xbd, 0x6e, 0x62, 0x3f, 0x0c, 0x12, 0x44, 0x39, 0x64, 0xf8, 0xaa, 0x8b, 0x83,
-	0xbb, 0xf8, 0x05, 0xee, 0x84, 0xe2, 0x3f, 0x0e, 0x7a, 0xcd, 0x0c, 0x4a, 0xff, 0xe5, 0x20, 0xef,
-	0x9a, 0x41, 0x5e, 0xe2, 0x3d, 0x32, 0x53, 0x1d, 0xf9, 0x47, 0x0f, 0x70, 0xdf, 0xe9, 0x76, 0xb1,
-	0x1f, 0xfd, 0x91, 0xe8, 0xeb, 0x51, 0xe0, 0xec, 0x63, 0xde, 0xc7, 0x17, 0xf7, 0xd5, 0x9f, 0x0c,
-	0xd4, 0xfa, 0xdd, 0x05, 0x18, 0x58, 0x21, 0x05, 0xe8, 0x23, 0xe8, 0xdf, 0x7e, 0xd5, 0xc5, 0xc5,
-	0xdc, 0xd5, 0xdc, 0xad, 0x89, 0xc5, 0x02, 0xab, 0xbf, 0xb3, 0xd9, 0xc5, 0x3e, 0x9d, 0xb0, 0x2a,
-	0x3a, 0x39, 0x2e, 0x4f, 0x90, 0x76, 0xbf, 0xeb, 0x1d, 0xba, 0x21, 0x5d, 0x10, 0x9b, 0x62, 0xa0,
-	0x5d, 0x98, 0xb0, 0x71, 0xe0, 0x1d, 0xf9, 0x4d, 0xbc, 0x8a, 0x9d, 0x16, 0xf6, 0x8b, 0xf9, 0xab,
-	0xb9, 0x5b, 0xa3, 0x8b, 0xd3, 0x77, 0xd8, 0x90, 0xf5, 0xca, 0xea, 0xcc, 0xc9, 0x71, 0x19, 0xf9,
-	0xbc, 0x2c, 0x22, 0xb6, 0x7a, 0xc1, 0x8e, 0x91, 0x41, 0x5f, 0xc3, 0xf8, 0x12, 0xf6, 0xc3, 0xca,
-	0x51, 0x78, 0xe0, 0xf9, 0x6e, 0xf8, 0xaa, 0xd8, 0x47, 0xe9, 0xce, 0x70, 0xba, 0x5a, 0x5d, 0x7d,
-	0xb1, 0x3a, 0x7f, 0x72, 0x5c, 0x2e, 0x92, 0x35, 0x6b, 0x38, 0xa2, 0x54, 0x23, 0xaf, 0x13, 0x43,
-	0x5f, 0xc1, 0x58, 0x8d, 0x6c, 0x86, 0xe6, 0xb6, 0xf7, 0x1c, 0x77, 0x82, 0x62, 0xbf, 0xd6, 0x69,
-	0xb5, 0xaa, 0xbe, 0x58, 0x9d, 0x3b, 0x39, 0x2e, 0xcf, 0xd2, 0xbd, 0xd3, 0x6c, 0x84, 0xb4, 0x50,
-	0x23, 0xad, 0x51, 0x42, 0x3f, 0x85, 0x89, 0x2d, 0xdf, 0x7b, 0xe1, 0x06, 0xae, 0xd7, 0xa1, 0x45,
-	0xc5, 0x01, 0x4a, 0x7b, 0x96, 0xd3, 0xd6, 0x2b, 0xeb, 0x8b, 0xd5, 0x2b, 0x27, 0xc7, 0xe5, 0xcb,
-	0x5d, 0x51, 0xca, 0x1a, 0xd0, 0x67, 0x46, 0x47, 0x41, 0xdb, 0x30, 0xba, 0xd4, 0x3e, 0x0a, 0x42,
-	0xec, 0x6f, 0x38, 0x87, 0xb8, 0x38, 0x48, 0xc9, 0x4f, 0x89, 0x79, 0x89, 0x6a, 0xea, 0x8b, 0xd5,
-	0xd2, 0xc9, 0x71, 0x79, 0xa6, 0xc9, 0x8a, 0x1a, 0x1d, 0xe7, 0x50, 0x9f, 0x72, 0x95, 0x0c, 0xfa,
-	0x10, 0xfa, 0x77, 0x02, 0xec, 0x17, 0x87, 0x29, 0xb9, 0x71, 0x4e, 0x8e, 0x14, 0xd5, 0x17, 0xd9,
-	0xfa, 0x1f, 0x05, 0xd8, 0xd7, 0xf0, 0x29, 0x02, 0x41, 0xb4, 0xbd, 0x36, 0x2e, 0x8e, 0x68, 0x88,
-	0xa4, 0xa8, 0xfe, 0x01, 0x43, 0xf4, 0xbd, 0xb6, 0xde, 0x30, 0x45, 0x40, 0x6b, 0x30, 0x42, 0x5a,
-	0x0e, 0xba, 0x4e, 0x13, 0x17, 0x81, 0x62, 0x17, 0x38, 0xb6, 0x2c, 0xaf, 0xce, 0x9e, 0x1c, 0x97,
-	0x2f, 0x75, 0xc4, 0x4f, 0x8d, 0x4a, 0x84, 0x8d, 0xbe, 0x80, 0xc1, 0x1a, 0xf6, 0x5f, 0x60, 0xbf,
-	0x38, 0x4a, 0xe9, 0x4c, 0x8a, 0x85, 0xa4, 0x85, 0xf5, 0xc5, 0xea, 0xd4, 0xc9, 0x71, 0xb9, 0x10,
-	0xd0, 0x5f, 0x1a, 0x0d, 0x8e, 0x46, 0x76, 0x9b, 0x8d, 0x5f, 0x60, 0x3f, 0xc0, 0xdb, 0x47, 0x9d,
-	0x0e, 0x6e, 0x17, 0xc7, 0xb4, 0xdd, 0xa6, 0xd5, 0x89, 0xdd, 0xe6, 0xb3, 0xc2, 0x46, 0x48, 0x4b,
-	0xf5, 0xdd, 0xa6, 0x21, 0xa0, 0x03, 0x28, 0xb0, 0xbf, 0x96, 0xbc, 0x4e, 0x07, 0x37, 0xc9, 0x91,
-	0x2a, 0x8e, 0xd3, 0x06, 0x2e, 0xf3, 0x06, 0xe2, 0xd5, 0xf5, 0xc5, 0x6a, 0xf9, 0xe4, 0xb8, 0x3c,
-	0xc7, 0x68, 0x37, 0x9a, 0xb2, 0x42, 0x6b, 0x26, 0x41, 0x95, 0x8c, 0xa3, 0xd2, 0x6c, 0xe2, 0x20,
-	0xb0, 0xf1, 0xcf, 0x8e, 0x70, 0x10, 0x16, 0x27, 0xb4, 0x71, 0x68, 0x75, 0xf5, 0x07, 0x6c, 0x1c,
-	0x0e, 0x2d, 0x6c, 0xf8, 0xac, 0x54, 0x1f, 0x87, 0x86, 0x80, 0xb6, 0x00, 0x2a, 0xdd, 0x6e, 0x0d,
-	0x07, 0x64, 0x33, 0x16, 0x27, 0x29, 0xe9, 0x4b, 0x9c, 0xf4, 0x2e, 0xde, 0xe3, 0x15, 0xf5, 0xc5,
-	0xea, 0xe5, 0x93, 0xe3, 0xf2, 0xb4, 0xd3, 0xed, 0x36, 0x02, 0x56, 0xa4, 0x11, 0x55, 0x68, 0xb0,
-	0x79, 0x3f, 0xf4, 0x42, 0xcc, 0xb7, 0x62, 0xb1, 0x10, 0x9b, 0x77, 0xa5, 0x4e, 0xf4, 0xd7, 0xa7,
-	0x85, 0x0d, 0xbe, 0xad, 0xe3, 0xf3, 0xae, 0x20, 0x90, 0xb3, 0xb8, 0xec, 0x84, 0xce, 0x9e, 0x13,
-	0x60, 0xbe, 0x3d, 0x2e, 0x6a, 0x67, 0x51, 0xaf, 0xac, 0x3f, 0x60, 0x67, 0xb1, 0xc5, 0x4b, 0x1b,
-	0x86, 0xfd, 0x12, 0xa3, 0x47, 0x66, 0x24, 0x1a, 0x78, 0x11, 0xf5, 0x98, 0x91, 0x97, 0x78, 0xcf,
-	0x3c, 0x23, 0x11, 0x28, 0x5a, 0x85, 0xe1, 0x5d, 0xbc, 0xc7, 0x38, 0xc7, 0x25, 0x4a, 0xef, 0x62,
-	0x44, 0x8f, 0xf1, 0x8c, 0x07, 0xec, 0x54, 0x10, 0x6a, 0x49, 0x6e, 0x21, 0xb1, 0xd1, 0xef, 0xe4,
-	0x60, 0x56, 0x9c, 0x70, 0x1c, 0xbe, 0xf4, 0xfc, 0xe7, 0x6e, 0x67, 0x7f, 0xc9, 0xeb, 0x3c, 0x73,
-	0xf7, 0x8b, 0x53, 0x94, 0xf2, 0xd5, 0x18, 0xd3, 0x88, 0x41, 0xd5, 0x17, 0xab, 0x6f, 0x9f, 0x1c,
-	0x97, 0xaf, 0x4b, 0x06, 0x22, 0xeb, 0xc9, 0x86, 0x7c, 0xe6, 0xee, 0x6b, 0x0d, 0xa7, 0xb5, 0x85,
-	0x7e, 0x33, 0x07, 0x33, 0x7c, 0x74, 0x36, 0x6e, 0x7a, 0x7e, 0x2b, 0xea, 0xc6, 0x34, 0xed, 0x46,
-	0x59, 0x9e, 0x56, 0x13, 0x50, 0x7d, 0xb1, 0x7a, 0xf3, 0xe4, 0xb8, 0x6c, 0xf1, 0x89, 0x6b, 0xf8,
-	0xa2, 0xda, 0xd4, 0x89, 0x94, 0x86, 0xc8, 0x4e, 0x20, 0xcc, 0x7f, 0xcb, 0xc7, 0xcf, 0xb0, 0x8f,
-	0x3b, 0x4d, 0x5c, 0x9c, 0xd1, 0x76, 0x82, 0x5e, 0x29, 0xb8, 0x32, 0xf9, 0x94, 0x34, 0xba, 0xb2,
-	0x58, 0xdf, 0x09, 0x3a, 0x0a, 0xfa, 0x19, 0x20, 0x3e, 0x01, 0x95, 0xa3, 0x96, 0x1b, 0xf2, 0x01,
-	0xce, 0xd2, 0x56, 0xe6, 0xf4, 0x79, 0x56, 0x00, 0xea, 0x8b, 0x55, 0xeb, 0xe4, 0xb8, 0xbc, 0x20,
-	0xa6, 0xd8, 0x21, 0x55, 0xa6, 0x81, 0x19, 0x88, 0x13, 0xce, 0xbb, 0xee, 0x35, 0x9f, 0x17, 0x8b,
-	0x1a, 0xe7, 0x25, 0x45, 0x82, 0x65, 0xb7, 0xbd, 0xe6, 0x73, 0x9d, 0xf3, 0x92, 0x5a, 0x14, 0xc2,
-	0x25, 0xbe, 0x4a, 0x36, 0x0e, 0x42, 0xdf, 0xa5, 0xbc, 0x23, 0x28, 0x5e, 0xa6, 0x74, 0xe6, 0x05,
-	0x0f, 0x4e, 0x42, 0xd4, 0xdf, 0x63, 0xbd, 0xe5, 0x1b, 0xa1, 0xe1, 0x2b, 0x75, 0x5a, 0x33, 0x26,
-	0xf2, 0xe8, 0x37, 0x60, 0x7a, 0xd7, 0xed, 0xb4, 0xbc, 0x97, 0xc1, 0x32, 0x0e, 0x9e, 0x87, 0x5e,
-	0xb7, 0xc6, 0x84, 0xc2, 0x62, 0x89, 0xb6, 0xbb, 0x20, 0xb6, 0xb9, 0x09, 0xa6, 0xfe, 0xa0, 0x7a,
-	0xe3, 0xe4, 0xb8, 0x7c, 0xed, 0x25, 0xab, 0x6c, 0xb4, 0x58, 0x6d, 0x83, 0xcb, 0x95, 0x5a, 0xe3,
-	0xe6, 0x56, 0xc8, 0x16, 0xd0, 0x2b, 0x8a, 0x73, 0xda, 0x16, 0xd0, 0x2b, 0x05, 0x33, 0x88, 0x35,
-	0xa8, 0x6f, 0x01, 0x1d, 0x05, 0x3d, 0x82, 0x61, 0xc1, 0x1e, 0x8a, 0xf3, 0xda, 0xd1, 0x15, 0xc5,
-	0xf5, 0x07, 0x4c, 0x02, 0x12, 0x2c, 0x46, 0x3f, 0xb9, 0x02, 0x0a, 0xad, 0xc3, 0x08, 0xe5, 0x91,
-	0x94, 0x65, 0x5d, 0xa1, 0x94, 0x90, 0xd8, 0xa8, 0xa2, 0xbc, 0xfe, 0xa0, 0x5a, 0x3c, 0x39, 0x2e,
-	0x4f, 0x31, 0x2e, 0x9b, 0x60, 0x54, 0x11, 0x01, 0xf4, 0x00, 0xfa, 0x2a, 0xdd, 0x6e, 0x71, 0x81,
-	0xd2, 0x19, 0x8b, 0xe8, 0xd4, 0x1f, 0x54, 0x2f, 0x9e, 0x1c, 0x97, 0xc7, 0x9d, 0xae, 0x3e, 0x2c,
-	0x02, 0x8d, 0xf6, 0xa0, 0x50, 0xeb, 0x78, 0x2f, 0x9f, 0xb5, 0x9d, 0xe7, 0x58, 0xb0, 0xb7, 0x72,
-	0x3a, 0x7b, 0xa3, 0x1f, 0xab, 0x40, 0x20, 0x18, 0x99, 0x5c, 0x82, 0x1e, 0xf9, 0x2c, 0x3e, 0x39,
-	0xda, 0xc3, 0x7e, 0x07, 0x87, 0x38, 0xe0, 0xa3, 0xbd, 0xaa, 0x7d, 0x16, 0xe3, 0xd5, 0xf5, 0x07,
-	0xac, 0xa5, 0xe7, 0xb2, 0xdc, 0x34, 0xf6, 0x04, 0x55, 0xd4, 0x86, 0x8b, 0x51, 0x99, 0xf8, 0xd4,
-	0x5c, 0xa3, 0x4d, 0x95, 0x12, 0x4d, 0x45, 0x9f, 0x9b, 0xab, 0x27, 0xc7, 0xe5, 0x79, 0xa5, 0x2d,
-	0xd3, 0x27, 0x27, 0x49, 0x18, 0x3d, 0x81, 0x91, 0xb5, 0x4e, 0x10, 0x3a, 0xed, 0x36, 0xf6, 0x8b,
-	0x96, 0xb6, 0x7c, 0xb2, 0xbc, 0x7e, 0x9f, 0x31, 0x71, 0x57, 0x14, 0xe8, 0xab, 0x27, 0xe1, 0x50,
-	0x0b, 0x26, 0xd5, 0x6f, 0x0e, 0x39, 0x2f, 0xd7, 0x29, 0xc9, 0xa2, 0xe1, 0x23, 0x46, 0x4e, 0xca,
-	0xfd, 0xea, 0xc2, 0xc9, 0x71, 0xb9, 0xa4, 0x7d, 0xc5, 0xe2, 0x47, 0x24, 0x4e, 0x12, 0xfd, 0x16,
-	0xe1, 0xd1, 0x95, 0xa7, 0xeb, 0x6b, 0xad, 0x2d, 0x5e, 0x44, 0x85, 0x4e, 0x22, 0xcf, 0xbf, 0xa5,
-	0xf3, 0x68, 0x23, 0x50, 0xfd, 0x3e, 0xfb, 0x52, 0x04, 0xce, 0x61, 0xbb, 0xe1, 0xb6, 0xe4, 0xb9,
-	0x6c, 0x74, 0x39, 0x40, 0x8c, 0x49, 0x1b, 0x89, 0xa0, 0x1f, 0xc3, 0x84, 0xac, 0x61, 0x3b, 0xee,
-	0x46, 0xfa, 0x8e, 0xa3, 0x83, 0x54, 0xda, 0x4b, 0x6e, 0xb8, 0x18, 0x31, 0x72, 0xaa, 0x88, 0xc0,
-	0xfa, 0xc8, 0xf7, 0x8e, 0xba, 0xc5, 0x9b, 0xda, 0xb2, 0xc8, 0xf2, 0xfa, 0x7d, 0x76, 0xaa, 0x88,
-	0xac, 0xdb, 0xd8, 0x27, 0x25, 0xfa, 0xba, 0x48, 0x40, 0xf2, 0x9d, 0xde, 0x59, 0xe3, 0x5c, 0xfe,
-	0x6d, 0xed, 0xb0, 0x8b, 0x62, 0xb1, 0xc4, 0x47, 0xae, 0x89, 0xa1, 0x4b, 0x6c, 0xe4, 0xc0, 0xc4,
-	0xe6, 0xf3, 0xd0, 0x59, 0x3b, 0x24, 0x5a, 0x9b, 0x7d, 0xd4, 0xc6, 0xc5, 0x5b, 0x1a, 0x63, 0xd2,
-	0x2b, 0xc5, 0xfa, 0x7a, 0xcf, 0x43, 0xa7, 0xe1, 0xd2, 0xe2, 0x86, 0x7f, 0x14, 0x13, 0xb0, 0x63,
-	0x04, 0x09, 0xef, 0x23, 0x25, 0x95, 0x20, 0x70, 0xf7, 0x3b, 0x87, 0xb8, 0x13, 0x16, 0xdf, 0x49,
-	0x34, 0x11, 0x55, 0xd6, 0xef, 0x33, 0xde, 0x47, 0x9b, 0x70, 0x64, 0x71, 0xb2, 0x85, 0x08, 0x05,
-	0xd5, 0x60, 0x74, 0xad, 0x13, 0xe2, 0x7d, 0xa6, 0x30, 0x16, 0x6f, 0x6b, 0x4a, 0x89, 0x52, 0x53,
-	0xbf, 0xcf, 0x44, 0x21, 0x37, 0x2a, 0xd2, 0x75, 0x12, 0x05, 0x96, 0x68, 0x3a, 0xbb, 0x4e, 0xd8,
-	0x3c, 0x20, 0x0a, 0xd6, 0x51, 0x50, 0xfc, 0x8e, 0x46, 0x54, 0xa9, 0xa9, 0xdf, 0x67, 0x9a, 0xce,
-	0x4b, 0x52, 0xd4, 0x08, 0x68, 0x99, 0x4e, 0x55, 0x01, 0xae, 0x02, 0x0c, 0x0b, 0x5d, 0xf3, 0x71,
-	0xff, 0xf0, 0x50, 0x61, 0xd8, 0xfa, 0xe3, 0x1c, 0x0c, 0x50, 0x08, 0xf4, 0x05, 0x0c, 0x3c, 0x71,
-	0x3b, 0xad, 0xa0, 0x98, 0xbb, 0xda, 0xa7, 0xe8, 0x23, 0xb4, 0x92, 0x54, 0x54, 0x67, 0x7f, 0x7e,
-	0x5c, 0xbe, 0x70, 0x72, 0x5c, 0x9e, 0x7c, 0x4e, 0xc0, 0x14, 0x75, 0x98, 0xe1, 0xa1, 0x1d, 0xb8,
-	0x54, 0x69, 0xb7, 0xbd, 0x97, 0x5b, 0x8e, 0x1f, 0xba, 0x4e, 0xbb, 0x76, 0x44, 0x05, 0x68, 0xaa,
-	0x14, 0x0f, 0x57, 0xaf, 0x9f, 0x1c, 0x97, 0xcb, 0x0e, 0xa9, 0x6e, 0x74, 0x59, 0x7d, 0x23, 0x60,
-	0x00, 0x0a, 0x21, 0x13, 0xbe, 0xf5, 0x27, 0x83, 0x50, 0x58, 0xf5, 0x82, 0x90, 0x68, 0xb1, 0x52,
-	0x1c, 0xbf, 0x0e, 0x83, 0xa4, 0x6c, 0x6d, 0x99, 0xea, 0xed, 0x23, 0xd5, 0xd1, 0x93, 0xe3, 0xf2,
-	0xd0, 0x81, 0x17, 0x84, 0x0d, 0xb7, 0x65, 0xf3, 0x2a, 0xf4, 0x0e, 0x0c, 0x6f, 0x78, 0x2d, 0x4c,
-	0x55, 0xc5, 0x3c, 0x05, 0x1b, 0x3f, 0x39, 0x2e, 0x8f, 0x74, 0xbc, 0x16, 0xa6, 0x1a, 0xa1, 0x2d,
-	0xab, 0x51, 0x9d, 0x6b, 0x72, 0x7d, 0x14, 0xac, 0x7a, 0x72, 0x5c, 0xee, 0x27, 0xaa, 0xdb, 0x2f,
-	0x8f, 0xcb, 0x1f, 0xec, 0xbb, 0xe1, 0xc1, 0xd1, 0xde, 0x9d, 0xa6, 0x77, 0x78, 0x77, 0xdf, 0x77,
-	0x5e, 0xb8, 0xcc, 0x90, 0xe2, 0xb4, 0xef, 0x46, 0xe6, 0x96, 0xae, 0xcb, 0xad, 0x1c, 0xb5, 0x57,
-	0x41, 0x88, 0x0f, 0x09, 0x25, 0xae, 0xe8, 0xed, 0xc2, 0x54, 0xa5, 0xd5, 0x72, 0x19, 0xc6, 0x96,
-	0xef, 0x76, 0x9a, 0x6e, 0xd7, 0x69, 0x13, 0xa5, 0xbb, 0xef, 0xd6, 0x08, 0x9f, 0x14, 0x59, 0xdf,
-	0xe8, 0x4a, 0x00, 0x65, 0x52, 0x8c, 0x04, 0xd0, 0x03, 0x18, 0x5e, 0xde, 0xa8, 0x51, 0x35, 0xb0,
-	0x38, 0x40, 0x89, 0xd1, 0x03, 0xd7, 0xea, 0x04, 0x74, 0x68, 0x2a, 0x01, 0x09, 0x88, 0x3e, 0x80,
-	0xb1, 0xad, 0xa3, 0xbd, 0xb6, 0xdb, 0xdc, 0x5e, 0xaf, 0x3d, 0xc1, 0xaf, 0xa8, 0xfe, 0x3c, 0xc6,
-	0xc4, 0xa5, 0x2e, 0x2d, 0x6f, 0x84, 0xed, 0xa0, 0xf1, 0x1c, 0xbf, 0xb2, 0x35, 0xb8, 0x08, 0xaf,
-	0x56, 0x5b, 0x25, 0x78, 0x43, 0x09, 0xbc, 0x20, 0x38, 0x50, 0xf1, 0x18, 0x1c, 0xba, 0x0b, 0xc0,
-	0xb4, 0x92, 0x4a, 0xab, 0xc5, 0xd4, 0xeb, 0x91, 0xea, 0xe4, 0xc9, 0x71, 0x79, 0x94, 0xeb, 0x31,
-	0x4e, 0xab, 0xe5, 0xdb, 0x0a, 0x08, 0x5a, 0x82, 0x61, 0xdb, 0x63, 0x13, 0xcc, 0x95, 0xea, 0x49,
-	0xa9, 0x54, 0xb3, 0x62, 0x6e, 0x46, 0xe1, 0xbf, 0xd4, 0x51, 0x0a, 0x08, 0x54, 0x86, 0xa1, 0x0d,
-	0x6f, 0xc9, 0x69, 0x1e, 0x30, 0xd5, 0x7a, 0xb8, 0x3a, 0x70, 0x72, 0x5c, 0xce, 0xbd, 0x6b, 0x8b,
-	0x52, 0xf4, 0x02, 0x46, 0xa3, 0x85, 0x0a, 0x8a, 0xa3, 0x74, 0xfa, 0xb6, 0xc9, 0x29, 0x0a, 0x68,
-	0x71, 0x83, 0x2c, 0xbd, 0x32, 0x83, 0x6f, 0xb0, 0x0b, 0xd4, 0x86, 0x50, 0x1b, 0xae, 0xec, 0x90,
-	0x8f, 0xdb, 0x5e, 0x1b, 0x47, 0xc5, 0x95, 0x20, 0xc0, 0x3e, 0xa1, 0xb5, 0xb6, 0x4c, 0x35, 0xef,
-	0x11, 0x2e, 0xf2, 0x47, 0x3d, 0x21, 0x7c, 0x88, 0x81, 0x34, 0xdc, 0x96, 0x32, 0xe2, 0x6c, 0x62,
-	0xd6, 0xff, 0xce, 0x01, 0xda, 0xec, 0xe2, 0x4e, 0xad, 0xb6, 0x4a, 0x8e, 0x8e, 0x38, 0x39, 0xdf,
-	0x85, 0x11, 0xb6, 0x46, 0x64, 0x21, 0xf3, 0x74, 0x21, 0x27, 0x4e, 0x8e, 0xcb, 0xc0, 0x17, 0x92,
-	0x2c, 0x62, 0x04, 0x80, 0x6e, 0x40, 0xdf, 0xf6, 0xf6, 0x3a, 0x3d, 0x16, 0x7d, 0xd5, 0x4b, 0x27,
-	0xc7, 0xe5, 0xbe, 0x30, 0x6c, 0xff, 0xf2, 0xb8, 0x3c, 0xbc, 0x7c, 0xc4, 0x18, 0x95, 0x4d, 0xea,
-	0xd1, 0x0d, 0x18, 0x12, 0xa2, 0x45, 0x7f, 0x74, 0x1e, 0xb9, 0xcc, 0x60, 0x8b, 0x3a, 0xf4, 0x1d,
-	0x6e, 0x68, 0x19, 0x30, 0x19, 0x5a, 0x86, 0xc9, 0xa1, 0x23, 0x1f, 0x1f, 0x6e, 0x5c, 0xb9, 0x03,
-	0x03, 0x6c, 0x7d, 0x06, 0x29, 0x3f, 0x8a, 0x59, 0x57, 0x46, 0x4e, 0x8e, 0xcb, 0x03, 0x74, 0x9d,
-	0x6c, 0x06, 0xf6, 0xb8, 0x7f, 0x38, 0x57, 0xc8, 0xdb, 0xc3, 0x04, 0x97, 0x9c, 0x00, 0xeb, 0x3b,
-	0x30, 0xaa, 0x0c, 0x1f, 0xcd, 0x43, 0x3f, 0xf9, 0x9f, 0xf2, 0x8b, 0x31, 0xd6, 0x58, 0x93, 0x4c,
-	0x0b, 0x2d, 0xb5, 0xfe, 0x64, 0x1c, 0x0a, 0x04, 0x53, 0x63, 0x32, 0xda, 0x54, 0xe5, 0x7a, 0x4d,
-	0xd5, 0x2d, 0x90, 0x6d, 0x73, 0x6e, 0x33, 0x76, 0x72, 0x5c, 0x1e, 0x3e, 0xe2, 0x65, 0x51, 0xcf,
-	0x50, 0x0d, 0x86, 0x56, 0xbe, 0xe9, 0xba, 0x3e, 0x0e, 0xb8, 0x65, 0xaf, 0x74, 0x87, 0xd9, 0x76,
-	0xef, 0x08, 0xdb, 0xee, 0x9d, 0x6d, 0x61, 0xdb, 0xad, 0x5e, 0xe1, 0x5c, 0xf7, 0x22, 0x66, 0x28,
-	0xd1, 0x06, 0xf8, 0xbd, 0xbf, 0x2a, 0xe7, 0x6c, 0x41, 0x09, 0x7d, 0x17, 0x06, 0x1f, 0x7a, 0xfe,
-	0xa1, 0x13, 0xf2, 0x15, 0xa0, 0x66, 0x9f, 0x67, 0xb4, 0x44, 0xd9, 0x33, 0x1c, 0x06, 0x3d, 0x84,
-	0x09, 0xdb, 0x3b, 0x0a, 0xf1, 0xb6, 0x27, 0xd6, 0x6d, 0x80, 0x62, 0xd1, 0xef, 0xab, 0x4f, 0x6a,
-	0x1a, 0xa1, 0x97, 0x14, 0xfa, 0xec, 0x18, 0x16, 0x5a, 0x81, 0x09, 0xcd, 0x4e, 0xc2, 0x56, 0x6b,
-	0x84, 0xeb, 0x90, 0x9a, 0x75, 0x45, 0x65, 0x49, 0x31, 0x24, 0xb4, 0x61, 0x12, 0x52, 0x87, 0x68,
-	0x8f, 0x7a, 0x0a, 0xa2, 0x26, 0x31, 0x14, 0xc3, 0x24, 0xef, 0xa8, 0xd4, 0x4a, 0x86, 0xb9, 0x75,
-	0x85, 0xd9, 0x77, 0x63, 0xb5, 0xd5, 0xeb, 0x7c, 0x96, 0xe7, 0xe4, 0xd8, 0x93, 0x7a, 0x8a, 0x1d,
-	0xa7, 0x49, 0x98, 0xb0, 0xfc, 0xc0, 0x8c, 0xd0, 0xde, 0x32, 0x9b, 0x9d, 0xf8, 0xc0, 0xa8, 0xec,
-	0x49, 0x7e, 0x6a, 0xd6, 0x61, 0x60, 0x27, 0x70, 0xf6, 0x19, 0x73, 0x9a, 0x58, 0xbc, 0xc6, 0x7b,
-	0x14, 0xdf, 0x7d, 0xd4, 0xcc, 0x4b, 0x01, 0xe9, 0xb9, 0x9b, 0xa4, 0x36, 0x6c, 0xf5, 0xa3, 0x4b,
-	0xeb, 0xd0, 0x97, 0x00, 0xbc, 0x57, 0x44, 0xd1, 0x19, 0xe5, 0xd2, 0x98, 0x36, 0xc8, 0x4a, 0xb7,
-	0x5b, 0x5d, 0xe0, 0xe3, 0x9b, 0x91, 0xe3, 0xd3, 0x54, 0x1f, 0x5b, 0x21, 0x82, 0xbe, 0x80, 0x31,
-	0xca, 0xbb, 0xc4, 0x8a, 0x8e, 0xd1, 0x15, 0xa5, 0x96, 0x60, 0xca, 0x8e, 0x0c, 0xeb, 0xa9, 0x21,
-	0xa0, 0xff, 0x17, 0xa6, 0x39, 0xb9, 0x98, 0xd6, 0x39, 0xce, 0xb5, 0x6c, 0xad, 0x7b, 0x3a, 0x4c,
-	0xf5, 0x36, 0xef, 0xa9, 0x25, 0x7b, 0x9a, 0xaa, 0x87, 0xda, 0xe6, 0x66, 0xd0, 0x1a, 0x4c, 0xee,
-	0x04, 0x58, 0x1b, 0xc3, 0x04, 0xfd, 0x10, 0x50, 0x05, 0xea, 0x28, 0xc0, 0x8d, 0xb4, 0x71, 0xc4,
-	0xf1, 0x90, 0x0d, 0x68, 0xd9, 0xf7, 0xba, 0xb1, 0x3d, 0x3e, 0x49, 0x67, 0x84, 0xda, 0x03, 0x5a,
-	0xbe, 0xd7, 0x6d, 0xa4, 0x6f, 0x74, 0x03, 0x36, 0xfa, 0x09, 0xcc, 0x44, 0x66, 0xcb, 0x65, 0xd7,
-	0xd9, 0xef, 0x78, 0x41, 0xe8, 0x36, 0xd7, 0x96, 0xa9, 0x05, 0x90, 0xf3, 0xff, 0xc8, 0xec, 0xd9,
-	0x68, 0x49, 0x10, 0x9d, 0xff, 0xa7, 0x50, 0x41, 0x3f, 0x82, 0x71, 0xde, 0x16, 0x37, 0x93, 0x5f,
-	0xcc, 0xde, 0x68, 0x12, 0x98, 0x9b, 0xac, 0xc5, 0x4f, 0x26, 0x23, 0xe9, 0xb4, 0xd0, 0xd7, 0x30,
-	0xfa, 0xf4, 0x61, 0xc5, 0xc6, 0x41, 0xd7, 0xeb, 0x04, 0x98, 0x9b, 0xfd, 0x16, 0x38, 0xe9, 0xa7,
-	0x0f, 0x2b, 0x95, 0xa3, 0xf0, 0x00, 0x77, 0x42, 0xb7, 0xe9, 0x84, 0x58, 0x40, 0x31, 0x09, 0xf5,
-	0xf0, 0x99, 0xd3, 0xf0, 0x79, 0x89, 0x32, 0x0a, 0x95, 0x1c, 0x2a, 0xc1, 0x70, 0xad, 0xb6, 0xba,
-	0xee, 0xed, 0xbb, 0xcc, 0x02, 0x38, 0x62, 0xcb, 0xdf, 0x68, 0x0f, 0xa6, 0x95, 0x8b, 0x2c, 0x2a,
-	0xea, 0x62, 0x2a, 0xcf, 0x33, 0x83, 0xde, 0xbb, 0xf2, 0x26, 0xee, 0x8e, 0x7a, 0xdf, 0xf5, 0xe2,
-	0xfe, 0x9d, 0x4a, 0xf4, 0xb3, 0x26, 0x90, 0xec, 0x29, 0xc7, 0x50, 0x6a, 0x7d, 0x05, 0x23, 0xf2,
-	0xd8, 0xa1, 0x21, 0xe8, 0xab, 0xb4, 0xdb, 0x85, 0x0b, 0xe4, 0x8f, 0x5a, 0x6d, 0xb5, 0x90, 0x43,
-	0x13, 0x00, 0x11, 0xaf, 0x29, 0xe4, 0xd1, 0x58, 0x64, 0xf5, 0x28, 0xf4, 0x51, 0xf8, 0x6e, 0xb7,
-	0xd0, 0x8f, 0x50, 0xdc, 0xdc, 0x52, 0x18, 0xb0, 0x76, 0x60, 0x44, 0x4e, 0x24, 0x9a, 0x84, 0xd1,
-	0x9d, 0x8d, 0xda, 0xd6, 0xca, 0xd2, 0xda, 0xc3, 0xb5, 0x95, 0xe5, 0xc2, 0x05, 0x74, 0x05, 0x2e,
-	0x6f, 0xd7, 0x56, 0x1b, 0xcb, 0xd5, 0xc6, 0xfa, 0xe6, 0x52, 0x65, 0xbd, 0xb1, 0x65, 0x6f, 0x7e,
-	0xf5, 0x83, 0xc6, 0xf6, 0xce, 0xc6, 0xc6, 0xca, 0x7a, 0x21, 0x87, 0x8a, 0x30, 0x45, 0xaa, 0x9f,
-	0xec, 0x54, 0x57, 0x54, 0x80, 0x42, 0xde, 0xfa, 0x8f, 0xb9, 0x04, 0xa7, 0x43, 0x8b, 0x30, 0xca,
-	0xd5, 0x4b, 0xba, 0xfa, 0x4c, 0x40, 0x2e, 0x9c, 0x1c, 0x97, 0xc7, 0x84, 0x6a, 0x4a, 0x17, 0x56,
-	0x05, 0x22, 0x1f, 0xaf, 0x2d, 0xb2, 0x84, 0x4d, 0xaf, 0xad, 0x7e, 0xbc, 0xba, 0xbc, 0xcc, 0x96,
-	0xb5, 0x68, 0x51, 0xf9, 0xcc, 0x31, 0x69, 0x99, 0x4a, 0x64, 0xe2, 0x33, 0xa7, 0xb2, 0x3c, 0xf9,
-	0xc1, 0x5b, 0x54, 0xac, 0x43, 0xfd, 0x11, 0x8e, 0x81, 0xc5, 0x4a, 0x38, 0xeb, 0x28, 0x85, 0x89,
-	0xa0, 0x4f, 0x13, 0xc6, 0x2c, 0x36, 0x42, 0xca, 0x25, 0x63, 0xbc, 0x22, 0x61, 0xa7, 0x2a, 0xc3,
-	0x00, 0xdb, 0x5d, 0x6c, 0x90, 0x54, 0x8a, 0x68, 0x93, 0x02, 0x9b, 0x95, 0x5b, 0x7f, 0xa7, 0x4f,
-	0x65, 0xa8, 0x44, 0x6a, 0x50, 0x26, 0x91, 0x4a, 0x0d, 0x74, 0xf2, 0x68, 0x29, 0x11, 0x10, 0xb8,
-	0x86, 0xbd, 0xb6, 0xcc, 0x29, 0x52, 0x01, 0x41, 0xd8, 0x6b, 0xdd, 0x96, 0x1d, 0x01, 0x10, 0x69,
-	0x98, 0x49, 0x0b, 0x54, 0x1a, 0xee, 0x8b, 0xa4, 0x61, 0x2e, 0x4f, 0x30, 0x69, 0x38, 0x02, 0x21,
-	0x0b, 0xa9, 0xde, 0x76, 0xf5, 0x47, 0x0b, 0xa9, 0xde, 0x6b, 0xe9, 0x77, 0x59, 0x9f, 0x00, 0x54,
-	0x76, 0x6b, 0x54, 0x16, 0xb4, 0x37, 0xf8, 0x47, 0x9d, 0x1e, 0x3f, 0xe7, 0x65, 0xc0, 0xa5, 0x49,
-	0x5f, 0x15, 0x9b, 0x15, 0x68, 0x54, 0x85, 0xf1, 0xca, 0xaf, 0x1d, 0xf9, 0x78, 0xad, 0x45, 0x4e,
-	0x70, 0xc8, 0xf4, 0x83, 0x11, 0x7e, 0x53, 0x42, 0x2a, 0x1a, 0x2e, 0xaf, 0x51, 0x08, 0xe8, 0x28,
-	0x68, 0x13, 0x2e, 0x3e, 0x5a, 0x12, 0xe6, 0x8d, 0x4a, 0xb3, 0xe9, 0x1d, 0x75, 0x42, 0xfe, 0x25,
-	0xbf, 0x76, 0x72, 0x5c, 0xbe, 0xb2, 0xdf, 0x8c, 0x2c, 0x24, 0x0e, 0xab, 0x56, 0x3f, 0xe5, 0x09,
-	0x5c, 0xab, 0x0d, 0x13, 0x8f, 0x70, 0x48, 0xb6, 0x92, 0x10, 0xcb, 0xb2, 0xd7, 0xe4, 0x33, 0x18,
-	0xdd, 0x75, 0xc3, 0x83, 0x1a, 0x6e, 0xfa, 0x38, 0x14, 0xda, 0x27, 0x53, 0x91, 0xdd, 0xf0, 0xa0,
-	0x11, 0xb0, 0x72, 0x95, 0x01, 0x29, 0xe0, 0xd6, 0x0a, 0x4c, 0xf2, 0xd6, 0xa4, 0x14, 0xb8, 0xa8,
-	0x13, 0xcc, 0x51, 0x82, 0x74, 0x15, 0x54, 0x82, 0x3a, 0x99, 0x3f, 0xc9, 0xc3, 0xf4, 0xd2, 0x81,
-	0xd3, 0xd9, 0xc7, 0x5b, 0x4e, 0x10, 0xbc, 0xf4, 0xfc, 0x96, 0xd2, 0x79, 0x2a, 0x02, 0x27, 0x3a,
-	0x4f, 0x65, 0xde, 0x45, 0x18, 0xdd, 0x6c, 0xb7, 0x04, 0x0e, 0x17, 0xcf, 0x69, 0x5b, 0x5e, 0xbb,
-	0xd5, 0xe8, 0x0a, 0x5a, 0x2a, 0x10, 0xc1, 0xd9, 0xc0, 0x2f, 0x25, 0x4e, 0x5f, 0x84, 0xd3, 0xc1,
-	0x2f, 0x15, 0x1c, 0x05, 0x08, 0xad, 0xc0, 0xc5, 0x1a, 0x6e, 0x7a, 0x9d, 0xd6, 0x43, 0xa7, 0x19,
-	0x7a, 0x3e, 0xbb, 0x72, 0xe9, 0x8f, 0x24, 0x98, 0x80, 0x56, 0x36, 0x9e, 0xd1, 0x5a, 0x76, 0xd3,
-	0x62, 0x27, 0x31, 0xd0, 0x26, 0xbd, 0xb0, 0xa1, 0x37, 0xf6, 0x5c, 0xa6, 0xbf, 0x71, 0x47, 0x5e,
-	0xe1, 0x2f, 0xf9, 0x98, 0x6e, 0x0a, 0xa7, 0x2d, 0xb5, 0x12, 0xf9, 0x41, 0xa0, 0xcc, 0x45, 0x40,
-	0xda, 0x92, 0x88, 0xb5, 0x03, 0xe3, 0x5b, 0xed, 0xa3, 0x7d, 0xb7, 0x43, 0xd8, 0x40, 0x0d, 0xff,
-	0x0c, 0x2d, 0x03, 0x44, 0x05, 0xdc, 0x32, 0x21, 0x6c, 0x62, 0x51, 0x45, 0xfd, 0x01, 0x3f, 0x48,
-	0xb4, 0x84, 0x8a, 0x6e, 0xb6, 0x82, 0x67, 0xfd, 0xcd, 0x3e, 0x40, 0x7c, 0x01, 0x28, 0xaf, 0xaf,
-	0xe1, 0x90, 0xb0, 0xe1, 0x19, 0xc8, 0x4b, 0x03, 0xc2, 0xe0, 0xc9, 0x71, 0x39, 0xef, 0xb6, 0xec,
-	0xfc, 0xda, 0x32, 0x7a, 0x0f, 0x06, 0x28, 0x18, 0x9d, 0xff, 0x09, 0xd9, 0x9e, 0x4a, 0x81, 0x71,
-	0x0e, 0xfa, 0x0d, 0xb2, 0x19, 0x30, 0x7a, 0x1f, 0x46, 0x96, 0x71, 0x1b, 0xef, 0x3b, 0xa1, 0x27,
-	0x4e, 0x37, 0x53, 0xc9, 0x45, 0xa1, 0xb2, 0xe7, 0x22, 0x48, 0x22, 0xb7, 0xdb, 0xd8, 0x09, 0xbc,
-	0x8e, 0x2a, 0xb7, 0xfb, 0xb4, 0x44, 0x95, 0xdb, 0x19, 0x0c, 0xfa, 0x83, 0x1c, 0x8c, 0x56, 0x3a,
-	0x1d, 0xae, 0xea, 0x06, 0x7c, 0xd6, 0xa7, 0xef, 0x48, 0x4f, 0x88, 0x75, 0x67, 0x0f, 0xb7, 0xeb,
-	0x4e, 0xfb, 0x08, 0x07, 0xd5, 0xaf, 0x89, 0x28, 0xf5, 0x9f, 0x8e, 0xcb, 0x9f, 0x9e, 0x41, 0x79,
-	0x8d, 0x7c, 0x2a, 0xb6, 0x7d, 0xc7, 0x0d, 0x03, 0x7a, 0x9b, 0x19, 0x35, 0xa8, 0x9e, 0x1b, 0xa5,
-	0x1f, 0xe8, 0x1d, 0x55, 0x59, 0xe3, 0xbc, 0x38, 0xa6, 0x45, 0x73, 0x3d, 0xcd, 0xba, 0x2e, 0xbf,
-	0x84, 0x6b, 0xcb, 0x69, 0x4b, 0x60, 0x2d, 0xc1, 0xfc, 0x23, 0x1c, 0xda, 0x38, 0xc0, 0xa1, 0xd8,
-	0xb4, 0x74, 0xcb, 0x45, 0xf6, 0x9f, 0x21, 0xfa, 0x5b, 0x22, 0xd3, 0xf5, 0x60, 0x1b, 0x55, 0xd4,
-	0x58, 0x7f, 0x23, 0x07, 0xe5, 0x25, 0x1f, 0x33, 0x49, 0x24, 0x85, 0x50, 0x36, 0x33, 0x99, 0xe7,
-	0xce, 0x21, 0xf9, 0xa8, 0x96, 0xcc, 0x12, 0x77, 0x00, 0x39, 0x9d, 0x72, 0x6c, 0x3d, 0x83, 0x69,
-	0x1b, 0x77, 0xf0, 0x4b, 0xa2, 0xaa, 0x6b, 0xfa, 0x65, 0x19, 0x06, 0xd8, 0xc9, 0x4b, 0x0c, 0x81,
-	0x95, 0x9f, 0x4d, 0x57, 0xb7, 0xfe, 0x49, 0x1e, 0x0a, 0x6c, 0xb8, 0x55, 0x2f, 0x3c, 0xdd, 0xf8,
-	0xf8, 0x08, 0xf2, 0x3d, 0xd4, 0xfb, 0x9b, 0xd1, 0x6c, 0xf7, 0x45, 0xc2, 0x01, 0xed, 0x2a, 0xf9,
-	0xc6, 0x89, 0x4a, 0x32, 0x20, 0xb6, 0x0b, 0x98, 0x79, 0x2b, 0xa1, 0xa3, 0xa3, 0xdf, 0xcd, 0xc1,
-	0x20, 0xdb, 0x57, 0xd9, 0x3b, 0x77, 0xf7, 0x7c, 0x76, 0x6e, 0x21, 0xa4, 0x7f, 0xa9, 0xe7, 0x88,
-	0xd5, 0x59, 0xff, 0x2c, 0x0f, 0x17, 0x95, 0xb9, 0xe2, 0xe2, 0xe7, 0x3b, 0x4c, 0xb6, 0x51, 0x26,
-	0x8c, 0x1a, 0x0c, 0xa9, 0x45, 0x3c, 0xd2, 0xe1, 0xe9, 0xcc, 0xbd, 0x03, 0xc3, 0x64, 0x48, 0x71,
-	0xdb, 0x22, 0xfd, 0xc2, 0x32, 0x50, 0x51, 0x7d, 0xea, 0xd9, 0xbb, 0x0b, 0xc3, 0xf4, 0x4f, 0xb2,
-	0x22, 0xfd, 0xe9, 0x2b, 0x22, 0x81, 0x90, 0x0b, 0xf0, 0xd8, 0x73, 0x3b, 0x4f, 0x71, 0x78, 0xe0,
-	0xb5, 0xf8, 0xb7, 0x7e, 0x8d, 0xf0, 0xc1, 0xff, 0xc7, 0x73, 0x3b, 0x8d, 0x43, 0x5a, 0x7c, 0x56,
-	0xdb, 0x55, 0x44, 0xd0, 0x56, 0x88, 0x5b, 0xf7, 0xa0, 0x40, 0x58, 0xd6, 0xe9, 0xb7, 0x96, 0x35,
-	0x05, 0xe8, 0x11, 0x0e, 0xab, 0x9e, 0xf6, 0x31, 0xb5, 0xc6, 0x61, 0x74, 0xcb, 0xed, 0xec, 0x8b,
-	0x9f, 0xff, 0xbc, 0x0f, 0xc6, 0xd8, 0x6f, 0xbe, 0x02, 0x31, 0x91, 0x27, 0x77, 0x1a, 0x91, 0xe7,
-	0x23, 0x18, 0xe7, 0x57, 0x64, 0xd8, 0xa7, 0x57, 0x27, 0x6c, 0x3d, 0xa8, 0x32, 0xc3, 0xae, 0xc8,
-	0x1a, 0x2f, 0x58, 0x8d, 0xad, 0x03, 0xa2, 0x75, 0x98, 0x60, 0x05, 0x0f, 0xb1, 0x13, 0x1e, 0x45,
-	0xf6, 0x98, 0x49, 0xae, 0xcf, 0x88, 0x62, 0xc6, 0xcf, 0x38, 0xad, 0x67, 0xbc, 0xd0, 0x8e, 0xe1,
-	0xa2, 0x2f, 0x60, 0x72, 0xcb, 0xf7, 0xbe, 0x79, 0xa5, 0x08, 0x79, 0x8c, 0xa5, 0x4f, 0x9f, 0x1c,
-	0x97, 0x2f, 0x76, 0x49, 0x55, 0x43, 0x15, 0xf5, 0xe2, 0xd0, 0x64, 0x4f, 0xad, 0x05, 0x55, 0xcf,
-	0x77, 0x3b, 0xfb, 0x74, 0x35, 0x87, 0xd9, 0x9e, 0x72, 0x83, 0xc6, 0x1e, 0x2d, 0xb4, 0x65, 0x75,
-	0xcc, 0xb2, 0x3a, 0xd4, 0xdb, 0xb2, 0x7a, 0x0f, 0x60, 0xdd, 0x73, 0x5a, 0x95, 0x76, 0x7b, 0xa9,
-	0x12, 0x50, 0x63, 0x08, 0x17, 0x62, 0xda, 0x9e, 0xd3, 0x6a, 0x38, 0xed, 0x76, 0xa3, 0xe9, 0x04,
-	0xb6, 0x02, 0xf3, 0xb8, 0x7f, 0x78, 0xb0, 0x30, 0x64, 0x4f, 0xae, 0xbb, 0x4d, 0xdc, 0x09, 0xf0,
-	0xae, 0xe3, 0x77, 0xdc, 0xce, 0x7e, 0x60, 0xfd, 0xe9, 0x00, 0x0c, 0xcb, 0x21, 0xdf, 0x51, 0x15,
-	0x22, 0x2e, 0x1a, 0x51, 0x0e, 0x15, 0x19, 0x6c, 0x6c, 0x05, 0x02, 0x5d, 0x66, 0xf7, 0xb1, 0x4c,
-	0x28, 0x1b, 0x22, 0xbb, 0xdb, 0xe9, 0x76, 0xd9, 0xad, 0xeb, 0x0c, 0xe4, 0x97, 0xab, 0x74, 0xfe,
-	0x87, 0xd9, 0x97, 0xa0, 0xb5, 0x67, 0xe7, 0x97, 0xab, 0x64, 0x97, 0x6d, 0xae, 0x2d, 0x2f, 0xd1,
-	0xa9, 0x1c, 0x66, 0xbb, 0xcc, 0x73, 0x5b, 0x4d, 0x9b, 0x96, 0x92, 0xda, 0x5a, 0xe5, 0xe9, 0x3a,
-	0x9f, 0x2e, 0x5a, 0x1b, 0x38, 0x87, 0x6d, 0x9b, 0x96, 0x12, 0x55, 0x81, 0xe9, 0xde, 0x4b, 0x5e,
-	0x27, 0xf4, 0xbd, 0x76, 0x40, 0x25, 0xda, 0x61, 0xb6, 0x9c, 0x5c, 0x69, 0x6f, 0xf2, 0x2a, 0x3b,
-	0x06, 0x8a, 0x76, 0x61, 0xb6, 0xd2, 0x7a, 0xe1, 0x74, 0x9a, 0xb8, 0xc5, 0x6a, 0x76, 0x3d, 0xff,
-	0xf9, 0xb3, 0xb6, 0xf7, 0x32, 0xa0, 0xf3, 0x3d, 0xcc, 0x6d, 0x5c, 0x1c, 0x44, 0xd8, 0x00, 0x5e,
-	0x0a, 0x20, 0x3b, 0x0d, 0x9b, 0x70, 0xc9, 0xa5, 0xb6, 0x77, 0xd4, 0xe2, 0xab, 0x40, 0xb9, 0x64,
-	0x93, 0x14, 0xd8, 0xac, 0x9c, 0xcc, 0xd2, 0x6a, 0xed, 0x29, 0xb5, 0x28, 0xf1, 0x59, 0x3a, 0x08,
-	0x0e, 0x6d, 0x52, 0x86, 0x6e, 0xc0, 0x90, 0xd0, 0x7a, 0x98, 0x6d, 0x9b, 0x1a, 0x5a, 0x85, 0xb6,
-	0x23, 0xea, 0xc8, 0x91, 0xb0, 0x71, 0xd3, 0x7b, 0x81, 0xfd, 0x57, 0x4b, 0x5e, 0x0b, 0x0b, 0xfb,
-	0x07, 0xd7, 0xef, 0x59, 0x45, 0xa3, 0x49, 0x6a, 0x6c, 0x1d, 0x90, 0x34, 0xc0, 0x04, 0xa7, 0x80,
-	0x3a, 0x39, 0xf1, 0x06, 0x98, 0x60, 0x15, 0xd8, 0xa2, 0x0e, 0x2d, 0xc3, 0xc5, 0xca, 0x51, 0xe8,
-	0x1d, 0x3a, 0xa1, 0xdb, 0xdc, 0xe9, 0xee, 0xfb, 0x0e, 0x69, 0xa4, 0x40, 0x11, 0xa8, 0x6a, 0xe7,
-	0x88, 0xca, 0xc6, 0x11, 0xaf, 0xb5, 0x93, 0x08, 0xe8, 0x03, 0x18, 0x5b, 0x0b, 0x98, 0x8d, 0xcb,
-	0x09, 0x70, 0x8b, 0x1a, 0x2a, 0x78, 0x2f, 0xdd, 0xa0, 0x41, 0x2d, 0x5e, 0x0d, 0xa2, 0x0c, 0xb6,
-	0x6c, 0x0d, 0x0e, 0x59, 0x30, 0x58, 0x09, 0x02, 0x37, 0x08, 0xa9, 0xfd, 0x61, 0xb8, 0x0a, 0x27,
-	0xc7, 0xe5, 0x41, 0x87, 0x96, 0xd8, 0xbc, 0xe6, 0x71, 0xff, 0xf0, 0x68, 0x61, 0xec, 0x71, 0xff,
-	0xf0, 0x58, 0x61, 0xfc, 0x71, 0xff, 0xf0, 0x78, 0x61, 0xc2, 0xba, 0x0f, 0x17, 0x19, 0x0f, 0x3b,
-	0xb5, 0x32, 0x61, 0x6d, 0x01, 0xd4, 0xf0, 0xa1, 0xd3, 0x3d, 0xf0, 0xc8, 0x6e, 0xaf, 0xaa, 0xbf,
-	0xb8, 0x30, 0x8a, 0xa4, 0x03, 0x0f, 0xaf, 0xa8, 0x3f, 0x10, 0x3a, 0xa0, 0x80, 0xb4, 0x15, 0x2c,
-	0xeb, 0xcf, 0xf3, 0x80, 0xa8, 0x23, 0x4b, 0x2d, 0xf4, 0xb1, 0x73, 0x28, 0xba, 0xf1, 0x31, 0x8c,
-	0xb1, 0xcf, 0x11, 0x2b, 0xa6, 0xdd, 0x21, 0x92, 0x2e, 0xe3, 0x43, 0x6a, 0xd5, 0xea, 0x05, 0x5b,
-	0x03, 0x25, 0xa8, 0x36, 0x0e, 0x8e, 0x0e, 0x05, 0x6a, 0x5e, 0x43, 0x55, 0xab, 0x08, 0xaa, 0xfa,
-	0x1b, 0x7d, 0x01, 0x13, 0x4b, 0xde, 0x61, 0x97, 0xcc, 0x09, 0x47, 0xee, 0xe3, 0x5f, 0x65, 0xde,
-	0xae, 0x56, 0xb9, 0x7a, 0xc1, 0x8e, 0x81, 0xa3, 0x0d, 0xb8, 0xf4, 0xb0, 0x7d, 0x14, 0x1c, 0x54,
-	0x3a, 0xad, 0xa5, 0xb6, 0x17, 0x08, 0x2a, 0xfd, 0xdc, 0xaa, 0xcd, 0xb9, 0x68, 0x12, 0x62, 0xf5,
-	0x82, 0x6d, 0x42, 0x44, 0x37, 0xb8, 0x57, 0xae, 0xbc, 0x21, 0xe0, 0x4e, 0xbb, 0x9b, 0x1d, 0xbc,
-	0xf9, 0x6c, 0xf5, 0x82, 0xcd, 0x6a, 0xab, 0x23, 0x30, 0x24, 0xbe, 0x20, 0x77, 0xc9, 0x46, 0x94,
-	0xd3, 0xc9, 0xae, 0x39, 0x51, 0x09, 0x86, 0x77, 0xba, 0x84, 0xb1, 0x09, 0xf1, 0xd0, 0x96, 0xbf,
-	0xad, 0xef, 0xea, 0x33, 0x8d, 0xe6, 0x55, 0x1d, 0x9e, 0x01, 0x47, 0x05, 0xd6, 0xaa, 0x3e, 0xb9,
-	0xd9, 0xd0, 0x5a, 0xbb, 0xf9, 0x58, 0xbb, 0x85, 0xf8, 0x5c, 0x5b, 0xd3, 0xc6, 0xc9, 0xb3, 0xbe,
-	0x82, 0x85, 0x9d, 0x2e, 0x51, 0x98, 0x2a, 0xdd, 0x6e, 0xdb, 0x6d, 0x32, 0x0b, 0x15, 0xfd, 0xd2,
-	0x88, 0xcd, 0xf2, 0x81, 0x74, 0xf9, 0xcc, 0xa5, 0x3a, 0xc8, 0xd0, 0x23, 0xc1, 0xbe, 0x58, 0xc2,
-	0xd3, 0xd3, 0xfa, 0xbd, 0x1c, 0x2c, 0xb0, 0x13, 0x90, 0x4a, 0xfa, 0x3b, 0xaa, 0x63, 0xaa, 0x22,
-	0x02, 0x49, 0x37, 0x54, 0xd5, 0xf5, 0x34, 0xba, 0x84, 0xcd, 0xa7, 0x5f, 0xc2, 0x8a, 0x03, 0xd6,
-	0x67, 0x3c, 0x60, 0x5f, 0x82, 0xc5, 0x7b, 0xd4, 0x6e, 0x27, 0x3a, 0x15, 0xbc, 0x4e, 0xaf, 0xac,
-	0xff, 0x9a, 0x87, 0xd9, 0x47, 0xb8, 0x83, 0x7d, 0x87, 0x8e, 0x53, 0x93, 0xf6, 0xd5, 0x3b, 0x9a,
-	0x5c, 0xe6, 0x1d, 0x8d, 0x14, 0x65, 0xf3, 0x29, 0xa2, 0xec, 0x65, 0xe8, 0xdb, 0xb1, 0xd7, 0xf8,
-	0xb0, 0x28, 0x93, 0x3e, 0xf2, 0x5d, 0x9b, 0x94, 0xa1, 0xb5, 0xe8, 0x7e, 0xa7, 0xbf, 0xe7, 0xfd,
-	0xce, 0x25, 0x6e, 0xef, 0x1e, 0xe2, 0xf7, 0x3b, 0xfa, 0xad, 0xce, 0x86, 0x22, 0x2f, 0x13, 0x76,
-	0x73, 0x9b, 0x9f, 0xa9, 0x94, 0x01, 0x72, 0xd1, 0x77, 0xa5, 0x13, 0xfa, 0xaf, 0xd8, 0x16, 0x60,
-	0x12, 0xb0, 0x90, 0x7b, 0x4b, 0x5f, 0xc2, 0xa8, 0x02, 0x82, 0x0a, 0xd0, 0xf7, 0x9c, 0xdf, 0x6d,
-	0x8d, 0xd8, 0xe4, 0x4f, 0xf4, 0x5d, 0x18, 0x78, 0x41, 0x64, 0x70, 0xce, 0x46, 0x66, 0x22, 0xf9,
-	0xbc, 0x16, 0x12, 0xc9, 0x83, 0x09, 0xe8, 0x36, 0x03, 0xfa, 0x24, 0xff, 0x51, 0xce, 0xfa, 0x14,
-	0x8a, 0xc9, 0xde, 0x70, 0x71, 0xae, 0x97, 0x86, 0x63, 0x2d, 0xc3, 0xd4, 0x23, 0x1c, 0x46, 0x5e,
-	0xb1, 0xca, 0xd5, 0x5b, 0xec, 0x9c, 0x65, 0x58, 0xd6, 0xac, 0x1a, 0x4c, 0xc7, 0xa8, 0xf0, 0xf6,
-	0x3f, 0x81, 0x21, 0xe1, 0x4f, 0x93, 0x4b, 0xf7, 0xa7, 0xa1, 0xfb, 0x96, 0x53, 0xb6, 0x05, 0x82,
-	0xb5, 0x0b, 0x33, 0x1a, 0xd1, 0x40, 0x52, 0xfd, 0x1e, 0x0c, 0x8b, 0xb2, 0x98, 0x49, 0x42, 0x23,
-	0x4b, 0xb7, 0x56, 0x20, 0x90, 0x25, 0x8a, 0x75, 0x00, 0x33, 0xeb, 0x6e, 0xa0, 0x53, 0x66, 0xa3,
-	0x9e, 0x83, 0x91, 0x2e, 0xf9, 0xe6, 0x05, 0xee, 0xaf, 0xb1, 0xfd, 0x39, 0x60, 0x0f, 0x93, 0x82,
-	0x9a, 0xfb, 0x6b, 0x18, 0x5d, 0x01, 0xa0, 0x95, 0x74, 0xfe, 0x38, 0x7b, 0xa1, 0xe0, 0x4c, 0x57,
-	0x44, 0x40, 0x2f, 0x4f, 0xd9, 0x86, 0xb4, 0xe9, 0xdf, 0x96, 0x0f, 0xb3, 0x89, 0x96, 0xf8, 0x18,
-	0xee, 0x82, 0xec, 0x5a, 0xc6, 0x18, 0x6c, 0x09, 0x84, 0x6e, 0xc2, 0x64, 0x07, 0x7f, 0x13, 0x36,
-	0x12, 0x7d, 0x18, 0x27, 0xc5, 0x5b, 0xa2, 0x1f, 0xd6, 0x8f, 0xa9, 0xe6, 0x1e, 0x77, 0x78, 0x3b,
-	0xb7, 0xc9, 0x6b, 0x43, 0x89, 0x0c, 0x49, 0xf7, 0x6f, 0xfa, 0x95, 0x4d, 0xe0, 0x0b, 0x98, 0x33,
-	0xb6, 0xf6, 0xab, 0x9e, 0xc4, 0xbf, 0xce, 0xc3, 0x2c, 0xfb, 0x4a, 0x25, 0x8f, 0xc6, 0xe9, 0x79,
-	0xd8, 0xb7, 0x62, 0x70, 0xbe, 0x67, 0x30, 0x38, 0x53, 0x14, 0xd5, 0xe0, 0xac, 0x99, 0x99, 0x3f,
-	0x32, 0x9b, 0x99, 0xa9, 0xd8, 0xa7, 0x9b, 0x99, 0xe3, 0xc6, 0xe5, 0x95, 0x74, 0xe3, 0x32, 0x35,
-	0xb5, 0x19, 0x8c, 0xcb, 0x06, 0x93, 0xf2, 0xe3, 0xfe, 0xe1, 0x7c, 0xa1, 0xcf, 0xaa, 0x43, 0x31,
-	0x39, 0xc5, 0xe7, 0xc0, 0x37, 0xfe, 0x34, 0x07, 0x57, 0xb8, 0x84, 0x11, 0x3b, 0x04, 0x67, 0x5f,
-	0xc1, 0xf7, 0x61, 0x8c, 0xe3, 0x6e, 0x47, 0x9b, 0x85, 0xb9, 0xae, 0x0a, 0x4e, 0xc8, 0xd8, 0xa9,
-	0x06, 0x86, 0xde, 0x57, 0x2c, 0x09, 0xcc, 0x3a, 0x75, 0x99, 0x7c, 0x2e, 0x99, 0xc9, 0x21, 0xd5,
-	0x9e, 0x60, 0x7d, 0x0d, 0x0b, 0x69, 0x1d, 0x3f, 0x87, 0x79, 0xf9, 0xb3, 0x1c, 0xcc, 0x71, 0xf2,
-	0xda, 0x71, 0x7a, 0x2d, 0x96, 0x7f, 0x06, 0x6f, 0x8b, 0xc7, 0x30, 0x4a, 0x1a, 0x14, 0xfd, 0xd6,
-	0xdf, 0x52, 0x29, 0x35, 0xcb, 0x4e, 0xe8, 0xf0, 0x6b, 0x32, 0xe7, 0xb0, 0x2d, 0xdc, 0x2a, 0x6d,
-	0x15, 0xd9, 0xfa, 0x21, 0xcc, 0x9b, 0x87, 0x70, 0x0e, 0xf3, 0xf3, 0x18, 0x4a, 0x06, 0xc6, 0xf9,
-	0x7a, 0x1f, 0xc4, 0x1f, 0xc0, 0x9c, 0x91, 0xd6, 0x39, 0x74, 0x73, 0x95, 0x7c, 0xee, 0xc3, 0x73,
-	0x58, 0x42, 0x6b, 0x17, 0x2e, 0x1b, 0x28, 0x9d, 0x43, 0x17, 0x1f, 0xc1, 0xac, 0x14, 0x73, 0xdf,
-	0xa8, 0x87, 0x4f, 0xe1, 0x0a, 0x23, 0x74, 0x3e, 0xab, 0xf2, 0x04, 0xe6, 0x38, 0xb9, 0x73, 0x98,
-	0xbd, 0x55, 0x98, 0x8f, 0xb4, 0x59, 0x83, 0x2c, 0x71, 0x6a, 0x26, 0x63, 0xad, 0xc3, 0xd5, 0x88,
-	0x52, 0xca, 0x87, 0xf5, 0xf4, 0xd4, 0x98, 0x2c, 0x16, 0xad, 0xd2, 0x39, 0xca, 0x62, 0x11, 0xe0,
-	0xb9, 0x89, 0x13, 0x6b, 0x70, 0x89, 0x11, 0xd6, 0xe5, 0xd6, 0x45, 0x55, 0x6e, 0x35, 0x3e, 0x43,
-	0x4a, 0x8a, 0xb2, 0x4f, 0xa9, 0x28, 0x2b, 0x40, 0xa2, 0x1e, 0xbe, 0x0f, 0x83, 0xfc, 0xa5, 0x25,
-	0xeb, 0x9f, 0x81, 0x18, 0x93, 0xd4, 0x19, 0x1a, 0x07, 0xb6, 0x7e, 0x02, 0x57, 0x98, 0x1a, 0x18,
-	0xf7, 0xe8, 0x17, 0x4b, 0xf2, 0xbd, 0x98, 0x16, 0x98, 0xf1, 0x70, 0xc0, 0xa4, 0x0c, 0xee, 0x89,
-	0xbd, 0x9d, 0x46, 0xff, 0x54, 0x2e, 0xb6, 0x42, 0xbb, 0xcb, 0x1b, 0xb5, 0xbb, 0xeb, 0x70, 0x4d,
-	0x6a, 0x77, 0xf1, 0x66, 0xa4, 0x49, 0xf8, 0x87, 0x30, 0xc7, 0x06, 0xaa, 0xbf, 0x2f, 0x13, 0xdd,
-	0xf8, 0x34, 0x36, 0xcc, 0xd4, 0x07, 0x6c, 0xa6, 0x41, 0xfe, 0xed, 0x9c, 0x38, 0x72, 0x66, 0xe2,
-	0xdf, 0xb6, 0xba, 0xbb, 0x01, 0x65, 0x39, 0x21, 0x7a, 0x8f, 0x5e, 0x4f, 0xd7, 0x7d, 0x0a, 0xd3,
-	0x89, 0x37, 0x10, 0x44, 0x60, 0x45, 0xef, 0x91, 0x63, 0x41, 0x0b, 0xc4, 0xb6, 0x4b, 0x7d, 0x33,
-	0x61, 0x4b, 0x48, 0xab, 0x01, 0xf3, 0xc9, 0xa5, 0x70, 0x9b, 0xc2, 0x1d, 0x0a, 0x7d, 0x41, 0x8e,
-	0x30, 0x7b, 0x88, 0x91, 0xeb, 0xf1, 0x10, 0x83, 0x9f, 0x63, 0x86, 0x2e, 0xb0, 0x2c, 0x4b, 0xb0,
-	0x9a, 0xd8, 0xf8, 0x49, 0xeb, 0x62, 0x3f, 0xfc, 0x06, 0x20, 0x51, 0xb5, 0x54, 0xb3, 0x45, 0xd3,
-	0x97, 0xa1, 0x6f, 0xa9, 0x66, 0x73, 0x2f, 0x4c, 0xaa, 0x6e, 0x37, 0x03, 0xdf, 0x26, 0x65, 0x71,
-	0xa9, 0x35, 0x7f, 0x0a, 0xa9, 0xf5, 0x71, 0xff, 0x70, 0x5f, 0xa1, 0xdf, 0x46, 0x35, 0x77, 0xbf,
-	0xb3, 0xeb, 0x86, 0x07, 0xb2, 0xc1, 0x8a, 0xf5, 0x23, 0xb8, 0xa4, 0x35, 0xcf, 0x4f, 0x71, 0xa6,
-	0xfb, 0x28, 0xba, 0x09, 0x43, 0x4b, 0x15, 0x7a, 0xb7, 0x47, 0xed, 0x05, 0x63, 0x8c, 0xdf, 0x34,
-	0x9d, 0x06, 0x7d, 0x4a, 0x6f, 0x8b, 0x4a, 0xeb, 0x1f, 0xf7, 0x2b, 0xd4, 0x15, 0xa7, 0xdc, 0x8c,
-	0xd1, 0xdd, 0x07, 0x60, 0x3b, 0x44, 0x19, 0x1c, 0x11, 0x00, 0x47, 0xf9, 0x75, 0x04, 0x63, 0xc9,
-	0xb6, 0x02, 0x74, 0x5a, 0xa7, 0x5d, 0xee, 0x27, 0xc4, 0x90, 0xc4, 0x9d, 0x9d, 0xf4, 0x13, 0xe2,
-	0xa4, 0x03, 0x5b, 0x05, 0x42, 0x3f, 0x89, 0xfb, 0x96, 0x0d, 0xd0, 0x2b, 0xf2, 0xb7, 0xb8, 0x59,
-	0xc2, 0x30, 0xb6, 0xb3, 0xb9, 0x97, 0xbd, 0x84, 0x69, 0x82, 0xeb, 0x3e, 0xa3, 0x0e, 0x64, 0x2b,
-	0xdf, 0x84, 0xb8, 0xc3, 0x78, 0xfb, 0x20, 0x6d, 0xe7, 0x46, 0x46, 0x3b, 0x11, 0x30, 0x7f, 0xfb,
-	0x1d, 0xd1, 0x69, 0x60, 0x59, 0x67, 0x9b, 0xe9, 0xd3, 0x4d, 0x64, 0xaf, 0xaf, 0x74, 0x5a, 0x5d,
-	0xcf, 0x95, 0x4a, 0x05, 0xdb, 0x44, 0x7e, 0xbb, 0x81, 0x79, 0xb9, 0xad, 0x02, 0x59, 0x37, 0x33,
-	0x7d, 0xba, 0x86, 0xa1, 0x7f, 0x7b, 0x69, 0x7b, 0xbd, 0x90, 0xb3, 0xee, 0x02, 0x28, 0x2d, 0x01,
-	0x0c, 0x6e, 0x6c, 0xda, 0x4f, 0x2b, 0xeb, 0x85, 0x0b, 0x68, 0x1a, 0x2e, 0xee, 0xae, 0x6d, 0x2c,
-	0x6f, 0xee, 0xd6, 0x1a, 0xb5, 0xa7, 0x15, 0x7b, 0x7b, 0xa9, 0x62, 0x2f, 0x17, 0x72, 0xd6, 0xd7,
-	0x30, 0xa5, 0x8f, 0xf0, 0x5c, 0x37, 0x61, 0x08, 0x97, 0xa4, 0x3c, 0xf3, 0x78, 0x77, 0x5b, 0xf1,
-	0x73, 0xe1, 0x0a, 0x52, 0xfc, 0xea, 0x8d, 0xab, 0x52, 0xfc, 0x18, 0x29, 0x40, 0xda, 0x85, 0x69,
-	0x3e, 0xf3, 0xc2, 0xd4, 0xfa, 0x10, 0xa6, 0xf4, 0x56, 0x4f, 0x6b, 0x22, 0x7a, 0x8b, 0x3a, 0x00,
-	0x29, 0x5e, 0x99, 0x44, 0x53, 0x8f, 0xba, 0xc8, 0x39, 0xeb, 0x87, 0x50, 0xe0, 0x50, 0xd1, 0x97,
-	0xf7, 0xba, 0xb0, 0xe1, 0xe5, 0x0c, 0x1e, 0xe4, 0xc2, 0x1d, 0xe1, 0x6d, 0x71, 0x2b, 0xd0, 0xab,
-	0x85, 0x3f, 0xcf, 0x41, 0x31, 0xe6, 0xe0, 0xb8, 0x74, 0xe0, 0xb4, 0xdb, 0xb8, 0xb3, 0x8f, 0xd1,
-	0x2d, 0xe8, 0xdf, 0xde, 0xdc, 0xde, 0xe2, 0x56, 0xb3, 0x29, 0xbe, 0x4d, 0x49, 0x91, 0x84, 0xb1,
-	0x29, 0x04, 0x7a, 0x02, 0x17, 0x85, 0xbb, 0x8b, 0xac, 0xe2, 0x4a, 0xc9, 0x95, 0x6c, 0xe7, 0x99,
-	0x24, 0x1e, 0x7a, 0x8f, 0x7b, 0x63, 0xfe, 0xec, 0xc8, 0xf5, 0x71, 0x8b, 0x2a, 0xec, 0x13, 0x8b,
-	0x28, 0xf2, 0xc6, 0x14, 0x35, 0xb6, 0x0a, 0xc6, 0x3c, 0xe5, 0xad, 0x3f, 0xc8, 0xc1, 0x6c, 0x8a,
-	0xc3, 0x26, 0x7a, 0x47, 0x1b, 0xce, 0x25, 0x65, 0x38, 0x02, 0x64, 0xf5, 0x02, 0x1f, 0xcf, 0x92,
-	0xe2, 0x03, 0xd4, 0x77, 0x06, 0x1f, 0x20, 0xfe, 0x5e, 0x9b, 0xc2, 0xf1, 0x77, 0x49, 0xb4, 0xdc,
-	0x9a, 0x84, 0x71, 0x6d, 0xde, 0x2c, 0x0b, 0xc6, 0xd4, 0x96, 0xc9, 0xe2, 0x2c, 0x79, 0x2d, 0xb9,
-	0x38, 0xe4, 0x6f, 0xeb, 0xef, 0xe5, 0x60, 0x8a, 0x0e, 0x71, 0xdf, 0x25, 0xa7, 0x31, 0x9a, 0xa1,
-	0x45, 0x6d, 0x24, 0xf3, 0xda, 0x48, 0x62, 0xb0, 0x72, 0x48, 0x9f, 0x24, 0x86, 0x34, 0x6f, 0x1a,
-	0x12, 0xd5, 0x04, 0x5d, 0xaf, 0xa3, 0x8d, 0x44, 0xb9, 0x9a, 0xf8, 0x07, 0x39, 0xb8, 0xa4, 0xf4,
-	0x49, 0xf6, 0xff, 0xbe, 0xd6, 0xa5, 0x39, 0x43, 0x97, 0x12, 0x93, 0x5c, 0x4d, 0xf4, 0xe8, 0xad,
-	0xac, 0x1e, 0xf5, 0x9c, 0xe3, 0xbf, 0xcc, 0xc1, 0xb4, 0x71, 0x0e, 0xd0, 0x0c, 0x11, 0xb7, 0x9a,
-	0x3e, 0x0e, 0xf9, 0xf4, 0xf2, 0x5f, 0xa4, 0x7c, 0x2d, 0x08, 0x8e, 0x78, 0x90, 0x93, 0x11, 0x9b,
-	0xff, 0x42, 0x6f, 0xc1, 0xf8, 0x16, 0xf6, 0x5d, 0xaf, 0xc5, 0xbc, 0xc3, 0xd8, 0x0d, 0xfa, 0xb8,
-	0xad, 0x17, 0xa2, 0x79, 0x18, 0xa9, 0xb4, 0xf7, 0x3d, 0xdf, 0x0d, 0x0f, 0xd8, 0xed, 0xd0, 0x88,
-	0x1d, 0x15, 0x10, 0xda, 0xcb, 0xee, 0xbe, 0x70, 0x0a, 0x19, 0xb7, 0xf9, 0x2f, 0x54, 0x84, 0x21,
-	0x61, 0xe4, 0xa1, 0x26, 0x22, 0x5b, 0xfc, 0x24, 0x18, 0x5f, 0xda, 0x74, 0x13, 0xd0, 0xa7, 0x48,
-	0x36, 0xff, 0x65, 0xdd, 0x86, 0x29, 0xd3, 0x3c, 0x1a, 0xb7, 0xcc, 0xff, 0x9f, 0x87, 0x4b, 0x95,
-	0x56, 0xeb, 0xe9, 0xc3, 0xca, 0x32, 0x56, 0x85, 0x9c, 0xf7, 0xa0, 0x7f, 0xad, 0xe3, 0x86, 0x5c,
-	0xc2, 0x11, 0xae, 0xcd, 0x06, 0x48, 0x02, 0x45, 0x56, 0x88, 0xfc, 0x8f, 0x6c, 0xb8, 0xb4, 0xf2,
-	0x8d, 0x1b, 0x84, 0x6e, 0x67, 0x5f, 0xf5, 0x8f, 0xce, 0x9f, 0xc6, 0x3f, 0x7a, 0xf5, 0x82, 0x6d,
-	0x42, 0x46, 0xdb, 0x30, 0xb3, 0x81, 0x5f, 0x1a, 0xb6, 0x90, 0x7c, 0x36, 0xa2, 0x1c, 0xf4, 0xc4,
-	0xce, 0x49, 0xc1, 0x55, 0x77, 0xe8, 0xef, 0xe6, 0xe9, 0xf3, 0x34, 0x65, 0x60, 0xbc, 0xe5, 0x1d,
-	0x98, 0x52, 0x3a, 0x14, 0xf1, 0xa9, 0x1c, 0x7f, 0x10, 0x6b, 0x1c, 0x8e, 0x7a, 0x90, 0x8c, 0xe8,
-	0x68, 0x17, 0x66, 0xf5, 0x4e, 0x45, 0x94, 0xf5, 0xc3, 0x60, 0x02, 0x59, 0xbd, 0x60, 0xa7, 0x61,
-	0xa3, 0x45, 0xe8, 0xab, 0x34, 0x9f, 0xf3, 0x69, 0x31, 0x2f, 0x19, 0x1b, 0x59, 0xa5, 0xf9, 0x9c,
-	0x3e, 0xf3, 0x6e, 0x3e, 0xd7, 0xce, 0xc3, 0xbf, 0xce, 0xc1, 0x6c, 0xca, 0x0a, 0xa3, 0x05, 0x00,
-	0x56, 0xa8, 0x7c, 0x11, 0x94, 0x12, 0x22, 0xa0, 0xb1, 0x5f, 0xd4, 0x53, 0xac, 0x8f, 0xb2, 0x60,
-	0xf1, 0x02, 0x23, 0xaa, 0xb0, 0x15, 0x20, 0xb4, 0x05, 0xa3, 0xec, 0x17, 0x7b, 0x08, 0xa2, 0xb3,
-	0x6d, 0xa5, 0x86, 0x09, 0x32, 0x2d, 0x5a, 0xd0, 0x88, 0x3f, 0x00, 0x51, 0x49, 0x70, 0x93, 0xe6,
-	0x52, 0x7c, 0x14, 0x72, 0xd0, 0xe8, 0x16, 0x0c, 0xb2, 0x42, 0xbe, 0x86, 0xe2, 0x79, 0x67, 0x04,
-	0xcc, 0xeb, 0xad, 0x7f, 0x98, 0x83, 0x19, 0xf6, 0x45, 0x4c, 0x1c, 0x8d, 0x0f, 0xb5, 0xa3, 0x71,
-	0x4d, 0x76, 0xd8, 0x04, 0xac, 0x9d, 0x8e, 0xaa, 0xfe, 0x6a, 0xe0, 0xb4, 0xa7, 0x42, 0x45, 0x52,
-	0xf7, 0xed, 0x3f, 0xca, 0x09, 0x0b, 0x4f, 0x72, 0xeb, 0xae, 0xc0, 0xd8, 0xeb, 0x6d, 0x59, 0x0d,
-	0x0d, 0xbd, 0xcf, 0x76, 0x54, 0x3e, 0x7b, 0xa4, 0x99, 0x9b, 0xea, 0x33, 0x28, 0xa5, 0x4f, 0x4d,
-	0xaf, 0x6d, 0x65, 0x3d, 0x34, 0x60, 0xbf, 0xce, 0x72, 0x1e, 0x25, 0xe8, 0xd4, 0x5e, 0x75, 0x9a,
-	0x62, 0x45, 0x6f, 0xc6, 0xfd, 0x28, 0x53, 0x7d, 0xd3, 0xd4, 0xde, 0xe6, 0xa3, 0xab, 0x04, 0xbe,
-	0x39, 0xa9, 0xb0, 0xa7, 0x76, 0xff, 0x5f, 0xe4, 0xf5, 0xbd, 0xf8, 0x3a, 0x8d, 0x2e, 0xc1, 0xf8,
-	0x06, 0x7e, 0x99, 0x68, 0x97, 0xfa, 0xdd, 0x74, 0xf0, 0xcb, 0x86, 0xd2, 0xb6, 0xea, 0x90, 0xae,
-	0xe1, 0xa0, 0x3d, 0x98, 0x10, 0x5c, 0xe3, 0xb4, 0xcc, 0x93, 0xbd, 0x82, 0x23, 0x2d, 0xa4, 0xbc,
-	0x59, 0x89, 0x51, 0x3c, 0xff, 0xf3, 0x6c, 0x6d, 0x41, 0x31, 0x39, 0x7b, 0xbc, 0xb5, 0xf7, 0x7a,
-	0xad, 0x3d, 0x33, 0x85, 0xb4, 0xf4, 0x7d, 0xb0, 0x4a, 0xcd, 0x53, 0x12, 0x46, 0xda, 0x1b, 0xee,
-	0xc5, 0x17, 0x83, 0xfa, 0xef, 0x88, 0xc5, 0x50, 0xfa, 0x27, 0xdd, 0x6a, 0x97, 0xa8, 0x85, 0x4f,
-	0xa5, 0xc4, 0x3b, 0x76, 0x1b, 0x86, 0x78, 0x51, 0xec, 0x0d, 0x79, 0xb4, 0x2b, 0x05, 0x80, 0xf5,
-	0x87, 0x39, 0xb8, 0x4c, 0xed, 0x8d, 0x6e, 0x67, 0xbf, 0x8d, 0x77, 0x02, 0xdd, 0x33, 0xf6, 0x5d,
-	0x8d, 0xd1, 0xcc, 0xa6, 0xbc, 0x5c, 0xfa, 0x55, 0xb1, 0x97, 0x3f, 0xce, 0x41, 0xc9, 0xd4, 0xb7,
-	0xf3, 0xe5, 0x30, 0x77, 0xb8, 0x32, 0x97, 0xe7, 0x96, 0x14, 0x86, 0x2e, 0xdb, 0x14, 0x83, 0x25,
-	0x83, 0x24, 0xff, 0x6b, 0xac, 0xe5, 0x7f, 0xe5, 0x60, 0x6a, 0x2d, 0x50, 0x05, 0x7c, 0x3e, 0x71,
-	0x77, 0x4c, 0x0f, 0x29, 0xe9, 0xba, 0x9a, 0xe3, 0x75, 0xbc, 0xa7, 0xbc, 0xcc, 0xc9, 0x67, 0xbd,
-	0x90, 0xd4, 0x82, 0xb4, 0xdc, 0x84, 0xfe, 0x0d, 0x22, 0x4e, 0xf5, 0xf1, 0xfd, 0xc7, 0x30, 0x48,
-	0x11, 0x7d, 0x44, 0x43, 0xba, 0x4c, 0x7e, 0xa0, 0x87, 0x89, 0xa7, 0x3a, 0xfd, 0xbd, 0x5f, 0x00,
-	0x26, 0xa3, 0xcb, 0x54, 0x87, 0x61, 0x70, 0xdb, 0xf1, 0xf7, 0x71, 0x68, 0xfd, 0x10, 0x4a, 0xdc,
-	0xd3, 0x87, 0x59, 0x70, 0xa9, 0x3f, 0x50, 0x10, 0x39, 0x73, 0x65, 0x79, 0xe7, 0x2c, 0x00, 0xd4,
-	0x42, 0xc7, 0x0f, 0xd7, 0x3a, 0x2d, 0xfc, 0x0d, 0x1d, 0xed, 0x80, 0xad, 0x94, 0x58, 0xef, 0xc3,
-	0x88, 0x1c, 0x02, 0xd5, 0x00, 0x15, 0x89, 0x91, 0x0e, 0x67, 0x4a, 0x7b, 0x3c, 0x24, 0x5e, 0x0c,
-	0x3d, 0x80, 0xe9, 0xd8, 0x52, 0x44, 0x8f, 0xd9, 0xa4, 0x66, 0x46, 0x5d, 0x23, 0x6d, 0xf9, 0xdb,
-	0x5a, 0x82, 0x8b, 0x89, 0x95, 0x46, 0x88, 0xbe, 0x33, 0x63, 0xda, 0x3d, 0xf9, 0xa0, 0xd4, 0x6a,
-	0xab, 0xa4, 0x6c, 0x7b, 0xbd, 0xc6, 0x9c, 0xbf, 0x49, 0xd9, 0xf6, 0x7a, 0xad, 0x3a, 0xc8, 0x76,
-	0x8e, 0xf5, 0x4f, 0xf3, 0x54, 0xe9, 0x4d, 0xcc, 0x41, 0xcc, 0x7e, 0xa8, 0xda, 0x30, 0xab, 0x30,
-	0x42, 0x47, 0xbc, 0x2c, 0x9e, 0x37, 0x64, 0x3b, 0xa7, 0x0c, 0xff, 0xfc, 0xb8, 0x7c, 0x81, 0x7a,
-	0xa4, 0x44, 0x68, 0xe8, 0x73, 0x18, 0x5a, 0xe9, 0xb4, 0x28, 0x85, 0xbe, 0x33, 0x50, 0x10, 0x48,
-	0x64, 0x1d, 0x68, 0x97, 0x89, 0x28, 0xc4, 0xcd, 0x4e, 0xb6, 0x52, 0x42, 0xa7, 0xd9, 0x3d, 0x74,
-	0x99, 0x13, 0xd8, 0x80, 0xcd, 0x7e, 0xd0, 0xa7, 0x81, 0xa4, 0x0b, 0x22, 0x6e, 0xc1, 0x88, 0x2d,
-	0x7f, 0x23, 0x0b, 0x06, 0x36, 0xfd, 0x16, 0x7f, 0x32, 0x3c, 0xb1, 0x38, 0x26, 0x82, 0x38, 0x92,
-	0x32, 0x9b, 0x55, 0x59, 0xff, 0x23, 0x07, 0xb3, 0x8f, 0x70, 0x68, 0xdc, 0x37, 0xda, 0xac, 0xe4,
-	0xde, 0x78, 0x56, 0xf2, 0xaf, 0x33, 0x2b, 0x72, 0xd4, 0x7d, 0x69, 0xa3, 0xee, 0x4f, 0x1b, 0xf5,
-	0x40, 0xfa, 0xa8, 0x1f, 0xc1, 0x20, 0x1b, 0x2a, 0xba, 0x0e, 0x03, 0x6b, 0x21, 0x3e, 0x8c, 0x8c,
-	0x21, 0xaa, 0x6b, 0x9d, 0xcd, 0xea, 0x88, 0xc6, 0xb5, 0xee, 0x04, 0xa1, 0x78, 0x6e, 0x30, 0x62,
-	0x8b, 0x9f, 0xd6, 0x4f, 0xe9, 0xc3, 0xa8, 0x75, 0xaf, 0xf9, 0x5c, 0xb1, 0x54, 0x0f, 0xb1, 0x53,
-	0x19, 0xbf, 0xd9, 0x20, 0x50, 0xac, 0xc6, 0x16, 0x10, 0xe8, 0x2a, 0x8c, 0xae, 0x75, 0x1e, 0x7a,
-	0x7e, 0x13, 0x6f, 0x76, 0xda, 0x8c, 0xfa, 0xb0, 0xad, 0x16, 0x71, 0x0b, 0x0e, 0x6f, 0x21, 0xb2,
-	0xe0, 0xd0, 0x82, 0x98, 0x05, 0x87, 0xc5, 0xf9, 0xb2, 0x59, 0x1d, 0x37, 0x10, 0x91, 0xbf, 0xb3,
-	0xcc, 0x37, 0xd2, 0xce, 0xd3, 0x0b, 0x70, 0x0f, 0x2e, 0xdb, 0xb8, 0xdb, 0x76, 0x88, 0xc0, 0x75,
-	0xe8, 0x31, 0x78, 0x39, 0xe6, 0xab, 0x06, 0xff, 0x74, 0xdd, 0x1f, 0x42, 0x76, 0x39, 0x9f, 0xd1,
-	0xe5, 0x43, 0xb8, 0xf6, 0x08, 0x87, 0xc6, 0x60, 0x5d, 0xd1, 0xe0, 0x57, 0x61, 0x38, 0xd0, 0x6d,
-	0xf8, 0xbd, 0xe2, 0x84, 0xf1, 0x5b, 0x2e, 0x4e, 0x47, 0xfe, 0x65, 0x7d, 0x01, 0xe5, 0xb4, 0xe6,
-	0x4e, 0xe7, 0x07, 0xeb, 0xc2, 0xd5, 0x74, 0x02, 0xf2, 0xb3, 0x28, 0xec, 0xfd, 0x52, 0x75, 0xce,
-	0xee, 0xad, 0x7e, 0x45, 0xc0, 0xff, 0xb0, 0xaa, 0xc2, 0x23, 0xf0, 0x0d, 0xba, 0xdb, 0xa0, 0x57,
-	0xe9, 0x3a, 0x81, 0x68, 0x5e, 0x2b, 0x30, 0x2c, 0xca, 0xf8, 0xbc, 0xa6, 0xc6, 0x41, 0xa3, 0x13,
-	0xda, 0x12, 0x04, 0x24, 0x9a, 0xf5, 0x53, 0x71, 0xad, 0xa4, 0x63, 0x9c, 0xee, 0xd1, 0xcd, 0x69,
-	0xee, 0x91, 0x2c, 0x0f, 0x2e, 0xeb, 0xb4, 0xd5, 0xeb, 0x82, 0x82, 0x72, 0x5d, 0xc0, 0x6e, 0x09,
-	0xae, 0xea, 0xe6, 0xeb, 0x3c, 0xdf, 0x97, 0x51, 0x11, 0x5a, 0x50, 0x2f, 0x05, 0xc6, 0x92, 0xaf,
-	0x94, 0xee, 0x41, 0xc9, 0xd4, 0xa0, 0x62, 0x40, 0x91, 0x96, 0x67, 0x1e, 0x33, 0xe3, 0x37, 0x73,
-	0x60, 0x69, 0xde, 0x51, 0x5a, 0x48, 0x2b, 0x79, 0x64, 0xde, 0x11, 0x8c, 0x8d, 0xfa, 0x63, 0x31,
-	0xdf, 0xfb, 0x36, 0x29, 0x50, 0x9f, 0x86, 0x31, 0x6e, 0x77, 0x0f, 0x86, 0x36, 0xf0, 0x37, 0x11,
-	0xfb, 0x61, 0xb2, 0x28, 0xf5, 0x98, 0x7a, 0x8e, 0xd5, 0x47, 0xa7, 0x02, 0x8c, 0x08, 0x42, 0xd7,
-	0x33, 0xfb, 0xc0, 0xfb, 0xbf, 0x07, 0x85, 0x78, 0x1d, 0x5f, 0xfb, 0x9e, 0xd1, 0xbd, 0xe8, 0xeb,
-	0x8d, 0x78, 0x50, 0xaf, 0xc0, 0x4e, 0xd0, 0x3b, 0x7b, 0xef, 0xd1, 0xc7, 0x00, 0xdb, 0x5e, 0xe8,
-	0xb4, 0x97, 0xa8, 0x8d, 0x8b, 0x32, 0x7e, 0x16, 0x22, 0x2a, 0x24, 0xa5, 0x8d, 0xf8, 0xeb, 0x58,
-	0x05, 0xd8, 0xfa, 0x3e, 0x3d, 0x91, 0xe6, 0x4e, 0x9f, 0xee, 0x90, 0x2c, 0xc1, 0xf5, 0x98, 0x37,
-	0xc2, 0x6b, 0x10, 0x09, 0x61, 0x9a, 0x4c, 0xbf, 0x8c, 0x0d, 0xf6, 0xed, 0xac, 0xfa, 0xbf, 0xcb,
-	0x31, 0x17, 0x4a, 0xb5, 0x59, 0xbe, 0xd0, 0x4b, 0x00, 0x51, 0x69, 0xcc, 0x47, 0x5f, 0x0d, 0x75,
-	0x46, 0x95, 0xd7, 0x28, 0xd4, 0x59, 0x60, 0x2b, 0x68, 0xdf, 0xee, 0x4a, 0x3e, 0xa0, 0x2e, 0x08,
-	0xb2, 0xf5, 0xd3, 0xcd, 0xfb, 0x07, 0xc2, 0x46, 0x73, 0x46, 0xbc, 0x03, 0x98, 0xd2, 0xa2, 0x41,
-	0x47, 0xe1, 0x6d, 0xa3, 0x28, 0xd8, 0x23, 0xd5, 0xcf, 0x7e, 0x79, 0x5c, 0xfe, 0xe8, 0x2c, 0xaf,
-	0xc6, 0x04, 0xcd, 0x6d, 0xf9, 0x38, 0xd2, 0x9a, 0x85, 0xbe, 0x25, 0x7b, 0x9d, 0xb2, 0x2a, 0x7b,
-	0x5d, 0xb2, 0x2a, 0x7b, 0xdd, 0xfa, 0xef, 0x79, 0x28, 0xb3, 0xb7, 0xd1, 0xd4, 0x73, 0x25, 0xd2,
-	0x95, 0x14, 0x57, 0x98, 0xd3, 0x5a, 0x08, 0x62, 0x6f, 0x9f, 0xf3, 0xa7, 0x79, 0xfb, 0xfc, 0xeb,
-	0xaf, 0x6f, 0x55, 0x65, 0x91, 0xfe, 0x22, 0xc3, 0x00, 0xab, 0x35, 0x59, 0x08, 0x52, 0x9a, 0x48,
-	0x9a, 0x34, 0xfa, 0x5f, 0xc3, 0xa4, 0x71, 0x0f, 0x86, 0xa8, 0xea, 0xb1, 0xb6, 0xc5, 0xfd, 0x2d,
-	0xe9, 0xf6, 0xa4, 0x61, 0x0c, 0x1a, 0xae, 0x1a, 0x1f, 0x45, 0x80, 0x59, 0x7f, 0x3f, 0x0f, 0x57,
-	0xd3, 0xe7, 0x9c, 0xf7, 0x6d, 0x59, 0x0b, 0xe8, 0x9b, 0xe1, 0xa3, 0x43, 0xcf, 0x8e, 0x12, 0xd0,
-	0x37, 0x1e, 0xc4, 0x57, 0xbc, 0x28, 0x8a, 0xdd, 0x86, 0x69, 0x0f, 0x8d, 0x44, 0x38, 0x74, 0x56,
-	0xa4, 0xc5, 0xf1, 0xe2, 0x65, 0x68, 0x0f, 0x66, 0xb7, 0x7c, 0xf7, 0x85, 0x13, 0xe2, 0x27, 0xf8,
-	0xd5, 0x96, 0xd7, 0x76, 0x9b, 0xaf, 0x56, 0x3a, 0xce, 0x5e, 0x1b, 0xb7, 0xf8, 0x33, 0xb1, 0x5b,
-	0x27, 0xc7, 0xe5, 0xb7, 0xba, 0x0c, 0x84, 0x1c, 0xcc, 0x46, 0x97, 0x02, 0x35, 0x30, 0x83, 0x52,
-	0x88, 0xa6, 0x11, 0xb2, 0xfe, 0x6d, 0x0e, 0xe6, 0xa8, 0x40, 0xcd, 0x6f, 0x16, 0x44, 0xe3, 0xaf,
-	0xe5, 0xaa, 0xa9, 0x0e, 0x90, 0xef, 0x45, 0xea, 0xaa, 0xa9, 0xbd, 0xb8, 0xb2, 0x35, 0x30, 0xb4,
-	0x06, 0xa3, 0xfc, 0xb7, 0x62, 0x3e, 0x9e, 0x56, 0x18, 0x16, 0xdd, 0xea, 0xcc, 0x7a, 0x44, 0x37,
-	0x36, 0x27, 0xd6, 0xa0, 0xef, 0x90, 0x55, 0x5c, 0xeb, 0x17, 0x79, 0x98, 0xaf, 0x63, 0xdf, 0x7d,
-	0xf6, 0x2a, 0x65, 0x30, 0x9b, 0x30, 0x25, 0x8a, 0xe8, 0x98, 0xf5, 0x23, 0xc6, 0x02, 0xfc, 0x88,
-	0xae, 0x06, 0x04, 0xa0, 0x21, 0x4f, 0x9c, 0x11, 0xf1, 0x0c, 0x4e, 0x98, 0xef, 0xc1, 0x70, 0x2c,
-	0x42, 0x01, 0x5d, 0x7f, 0x71, 0x42, 0xf5, 0xf0, 0x90, 0xf2, 0xa8, 0xfe, 0x76, 0xfa, 0x15, 0x25,
-	0xb7, 0x24, 0xf4, 0x8a, 0x3c, 0x43, 0x0f, 0x2c, 0x39, 0xac, 0x8e, 0x52, 0x6b, 0x38, 0xb0, 0xab,
-	0x17, 0xec, 0xb4, 0x96, 0xaa, 0xa3, 0x30, 0x52, 0xa1, 0xd7, 0xae, 0x44, 0x71, 0xff, 0x9f, 0x79,
-	0x58, 0x10, 0xef, 0x78, 0x52, 0xa6, 0xf9, 0x2b, 0x98, 0x15, 0x45, 0x95, 0x2e, 0x11, 0x18, 0x70,
-	0x4b, 0x9f, 0x69, 0x16, 0x64, 0x4b, 0xcc, 0xb4, 0xc3, 0x61, 0xa2, 0xc9, 0x4e, 0x43, 0x3f, 0x1f,
-	0x83, 0xe8, 0xe7, 0xa6, 0x78, 0x11, 0xd4, 0x30, 0xa9, 0xf2, 0x4c, 0x3d, 0x86, 0xa4, 0xca, 0x3f,
-	0x5b, 0x09, 0x83, 0x6a, 0xff, 0x9b, 0x1a, 0x54, 0x57, 0x2f, 0xc4, 0x4d, 0xaa, 0xd5, 0x09, 0x18,
-	0xdb, 0xc0, 0x2f, 0xa3, 0x79, 0xff, 0x9d, 0x5c, 0xec, 0x49, 0x23, 0x91, 0x30, 0xd8, 0xdb, 0xc6,
-	0x5c, 0x14, 0x72, 0x80, 0x3e, 0x69, 0x54, 0x25, 0x0c, 0x06, 0xba, 0x06, 0x43, 0xcc, 0x6d, 0xb7,
-	0x75, 0x0a, 0xdd, 0x5c, 0x3e, 0xc8, 0x69, 0x32, 0x14, 0xa6, 0xa6, 0x73, 0x7c, 0xeb, 0x09, 0x5c,
-	0xe3, 0x5e, 0xe3, 0xfa, 0xe2, 0xd3, 0x86, 0xce, 0xf8, 0xf9, 0xb2, 0x1c, 0x58, 0x78, 0x84, 0xe3,
-	0xac, 0x47, 0x7b, 0xb0, 0xf4, 0x05, 0x4c, 0x6a, 0xe5, 0x92, 0x22, 0x95, 0x4a, 0xe5, 0x1e, 0x92,
-	0xa4, 0xe3, 0xd0, 0xd6, 0x55, 0x53, 0x13, 0x6a, 0x67, 0x2d, 0x4c, 0xa3, 0x65, 0xf9, 0xd1, 0x2d,
-	0x72, 0x70, 0x06, 0xae, 0x77, 0x4b, 0x39, 0xd7, 0x8c, 0xe3, 0xb1, 0xb8, 0x41, 0xe2, 0xcb, 0x2b,
-	0x6b, 0xad, 0x71, 0x18, 0x5d, 0xf2, 0x3a, 0x21, 0xfe, 0x86, 0x8a, 0x3a, 0xd6, 0x04, 0x8c, 0x89,
-	0xaa, 0x36, 0x0e, 0x02, 0xeb, 0x8f, 0xfa, 0xc0, 0xe2, 0x13, 0x6b, 0xb2, 0x9e, 0x8a, 0xf9, 0xd8,
-	0x4b, 0x74, 0x96, 0x7f, 0xa8, 0x66, 0x54, 0x1b, 0x71, 0x54, 0xcb, 0x76, 0x1e, 0x95, 0xf3, 0x9a,
-	0x51, 0xa9, 0x1e, 0x10, 0x38, 0x3e, 0xfa, 0x1f, 0xa5, 0xb0, 0x49, 0x76, 0xd8, 0x68, 0x2c, 0xee,
-	0x14, 0x36, 0xa9, 0xd1, 0x35, 0xb3, 0x4c, 0x5b, 0x9b, 0x06, 0x2e, 0x72, 0x20, 0xf9, 0xde, 0x52,
-	0xd6, 0x70, 0x1f, 0x26, 0x56, 0xd0, 0x48, 0xe4, 0x9f, 0x50, 0x89, 0xa0, 0x1d, 0x7d, 0x2e, 0xf9,
-	0x79, 0x14, 0x5e, 0x1b, 0x6a, 0x15, 0xa3, 0xda, 0x55, 0x4a, 0xf4, 0x74, 0x1e, 0x1a, 0xac, 0x62,
-	0x11, 0xff, 0x7d, 0xe9, 0xbb, 0x4f, 0x3e, 0xa4, 0x6e, 0x1b, 0xf3, 0x87, 0x2a, 0x62, 0x59, 0x8e,
-	0xcc, 0xb7, 0xdf, 0xb9, 0x53, 0xf1, 0x68, 0x1a, 0x05, 0x15, 0x73, 0xf4, 0xb4, 0x2b, 0x17, 0x13,
-	0x7d, 0xeb, 0x38, 0x27, 0x5e, 0x2c, 0x24, 0xae, 0x84, 0xcf, 0x2a, 0x49, 0x56, 0xb5, 0x5b, 0xdc,
-	0x7c, 0xca, 0x2d, 0xae, 0x76, 0xe7, 0x15, 0xf6, 0xb8, 0xd6, 0xed, 0x7b, 0xf3, 0x6b, 0xa0, 0x7f,
-	0x39, 0x08, 0x17, 0xb7, 0x9c, 0x7d, 0xb7, 0x43, 0x78, 0x8f, 0x88, 0xdc, 0x8b, 0x2a, 0x89, 0xdc,
-	0x0e, 0xd9, 0xae, 0xb1, 0x86, 0xe4, 0x0d, 0x8b, 0x6a, 0x98, 0xf5, 0x7c, 0xda, 0x2b, 0x52, 0x3d,
-	0x98, 0xfa, 0xc7, 0x9a, 0xd5, 0x3f, 0x91, 0x67, 0x84, 0x7a, 0xf7, 0x75, 0xbc, 0x56, 0x2c, 0xdf,
-	0x09, 0xb5, 0x9c, 0x27, 0x03, 0xd0, 0x0f, 0x9c, 0x73, 0x00, 0xfa, 0x1f, 0xc2, 0xe8, 0x93, 0xa3,
-	0x3d, 0x99, 0x4b, 0x63, 0xb0, 0x67, 0x80, 0x73, 0xba, 0x06, 0xcf, 0x8f, 0xf6, 0xcc, 0xd9, 0x34,
-	0x54, 0x62, 0xc6, 0x60, 0xed, 0x43, 0xbf, 0x92, 0x60, 0xed, 0xa9, 0x79, 0x02, 0x86, 0xbf, 0x95,
-	0x3c, 0x01, 0x86, 0x80, 0xeb, 0x23, 0xe7, 0x1f, 0x70, 0x5d, 0x0b, 0x46, 0x0e, 0x6f, 0x18, 0x8c,
-	0xbc, 0x0a, 0x30, 0xec, 0x47, 0x21, 0xad, 0xfb, 0x0b, 0x03, 0x6c, 0xed, 0x84, 0xc7, 0xf1, 0xbf,
-	0x1a, 0x82, 0xa9, 0x75, 0x37, 0x08, 0xc5, 0xe1, 0x09, 0xa2, 0x2f, 0xeb, 0x98, 0x28, 0x53, 0x34,
-	0x5f, 0x2e, 0x04, 0xb3, 0xf2, 0x46, 0x2c, 0xed, 0x93, 0x86, 0x80, 0xde, 0x57, 0x2f, 0x5a, 0xf2,
-	0x4a, 0xf4, 0xcf, 0x64, 0xc6, 0x1e, 0xf5, 0x06, 0xe6, 0x1d, 0xcd, 0xce, 0x9f, 0x69, 0x18, 0x79,
-	0x10, 0x37, 0xfe, 0xf3, 0xe0, 0x5c, 0xf4, 0x9b, 0xa3, 0x1b, 0x22, 0xa2, 0x5b, 0x81, 0x1d, 0x18,
-	0xa4, 0x91, 0x74, 0xc4, 0x8b, 0xe1, 0xb7, 0x39, 0xff, 0x31, 0x4d, 0x02, 0x8b, 0xb9, 0xc3, 0x9f,
-	0x0b, 0xd3, 0xc0, 0x53, 0x6d, 0x5a, 0xa0, 0x06, 0xcc, 0x61, 0x20, 0x68, 0x1b, 0x2e, 0x6d, 0xf9,
-	0xb8, 0xc5, 0xdd, 0x66, 0xbb, 0x3e, 0xd7, 0x12, 0xd9, 0xd3, 0x3d, 0x1a, 0x09, 0xb3, 0x2b, 0xaa,
-	0x1b, 0x58, 0xd6, 0xab, 0x0c, 0xdc, 0x80, 0x8e, 0x56, 0x60, 0xa2, 0x86, 0x1d, 0xbf, 0x79, 0xf0,
-	0x04, 0xbf, 0x22, 0xdf, 0x9d, 0xa0, 0x38, 0x14, 0x85, 0x8f, 0x0d, 0x68, 0x0d, 0x19, 0x28, 0xad,
-	0x52, 0xef, 0xdf, 0x75, 0x24, 0xf4, 0x7d, 0x18, 0xac, 0x79, 0x7e, 0x58, 0x7d, 0x15, 0x4b, 0xe1,
-	0xc4, 0x0a, 0xab, 0x97, 0x45, 0x08, 0xdd, 0xc0, 0xf3, 0xc3, 0xc6, 0x9e, 0x3a, 0x6f, 0x1c, 0x0f,
-	0x3d, 0x24, 0x42, 0x2d, 0x11, 0xb4, 0xa5, 0x0d, 0x87, 0x45, 0xdf, 0xe0, 0x82, 0x2b, 0x95, 0xce,
-	0x4d, 0x86, 0x9c, 0x18, 0x16, 0x7a, 0x05, 0x53, 0xfa, 0xd1, 0x7a, 0xe8, 0xb6, 0x09, 0x3f, 0x02,
-	0x2d, 0x19, 0x8a, 0x09, 0xa4, 0x7a, 0x8b, 0xf7, 0xf2, 0x6a, 0xfc, 0x00, 0x3f, 0xa3, 0xf5, 0x6a,
-	0x44, 0x70, 0x13, 0x3e, 0x7a, 0x4a, 0x23, 0x18, 0xb3, 0x99, 0xa9, 0x04, 0x22, 0xb4, 0x35, 0x19,
-	0x04, 0x0d, 0xbc, 0x77, 0x44, 0x8f, 0x27, 0x9d, 0x51, 0x27, 0x88, 0x47, 0xb8, 0xb6, 0x13, 0xa8,
-	0x68, 0x0b, 0x2e, 0xee, 0x04, 0x78, 0xcb, 0xc7, 0x2f, 0x5c, 0xfc, 0x52, 0xd0, 0x1b, 0xa3, 0xf4,
-	0xe8, 0x72, 0x13, 0x7a, 0x5d, 0x56, 0x6b, 0x22, 0x98, 0x44, 0x2e, 0x7d, 0x0c, 0xa3, 0xca, 0x7e,
-	0x33, 0xbc, 0x3d, 0x9f, 0x52, 0xdf, 0x9e, 0x8f, 0xa8, 0x6f, 0xcc, 0xff, 0x32, 0xc7, 0xec, 0x8c,
-	0xca, 0x06, 0xe6, 0x46, 0x8b, 0x4d, 0x18, 0x91, 0x85, 0xf2, 0xa5, 0x83, 0x10, 0x7c, 0x62, 0x1f,
-	0x4e, 0x76, 0x7c, 0xc4, 0xe9, 0x56, 0x7b, 0x1b, 0xd1, 0xf8, 0x76, 0x6d, 0x7f, 0xbf, 0x1d, 0xbd,
-	0x89, 0xe4, 0xef, 0x37, 0x7d, 0xa7, 0xf9, 0x3c, 0x32, 0xbe, 0xfe, 0x84, 0x9c, 0x0f, 0xb5, 0x82,
-	0x67, 0x9e, 0x9a, 0xd5, 0xd3, 0x06, 0xf1, 0x4a, 0x91, 0xbc, 0x40, 0x3e, 0x0d, 0x65, 0xc5, 0xfa,
-	0xc1, 0x51, 0x11, 0xa8, 0x27, 0xf0, 0xa4, 0x65, 0xb3, 0x27, 0x7d, 0xc6, 0x1e, 0x7c, 0x90, 0x7c,
-	0x94, 0x46, 0x19, 0x73, 0xf4, 0x28, 0x4d, 0x9d, 0xc6, 0xe8, 0x79, 0xda, 0x0e, 0xcc, 0xd9, 0xf8,
-	0xd0, 0x7b, 0x81, 0xcf, 0x97, 0xec, 0x8f, 0xe0, 0xb2, 0x4e, 0x70, 0xa7, 0xdb, 0xa2, 0xb1, 0x3c,
-	0xd8, 0x15, 0xac, 0x31, 0x6e, 0x1f, 0x47, 0x60, 0x71, 0xfb, 0x58, 0x24, 0x27, 0xf2, 0xa7, 0xca,
-	0x6f, 0x69, 0x9d, 0xe5, 0xc1, 0xbc, 0x4e, 0xbc, 0xd2, 0x6a, 0xd1, 0x64, 0x04, 0x4d, 0xb7, 0xeb,
-	0x74, 0x42, 0xb4, 0x09, 0xa3, 0xca, 0xcf, 0x98, 0xd8, 0xa4, 0xd4, 0xb0, 0xd5, 0xef, 0x46, 0x05,
-	0xaa, 0x78, 0xa7, 0xc0, 0x59, 0x18, 0xca, 0xf1, 0xe9, 0x21, 0x53, 0xa6, 0xb6, 0x59, 0x85, 0x71,
-	0xe5, 0xa7, 0xd4, 0x42, 0x68, 0x4c, 0x4e, 0xa5, 0x05, 0x7d, 0xc2, 0x74, 0x14, 0xab, 0x09, 0x25,
-	0xd3, 0xa4, 0xd1, 0x18, 0x13, 0xaf, 0xd0, 0x4a, 0x14, 0xad, 0xa2, 0xf7, 0xd5, 0xf7, 0x64, 0x5a,
-	0xa4, 0x0a, 0xeb, 0xef, 0xf6, 0xc3, 0x1c, 0x5f, 0x8c, 0xf3, 0x5c, 0x71, 0xf4, 0x53, 0x18, 0x55,
-	0xd6, 0x98, 0x4f, 0xfa, 0x55, 0xe1, 0x2d, 0x93, 0xb6, 0x17, 0x98, 0x78, 0x77, 0x44, 0x0b, 0x1a,
-	0xb1, 0xe5, 0x26, 0xe2, 0x9d, 0xba, 0x6d, 0xda, 0x30, 0xa1, 0x2f, 0x34, 0x97, 0x70, 0xaf, 0x1b,
-	0x1b, 0xd1, 0x41, 0x45, 0x10, 0xa8, 0x56, 0xc3, 0xb8, 0xdc, 0x34, 0x59, 0x96, 0xbe, 0x89, 0xbe,
-	0x81, 0x8b, 0x89, 0x55, 0xe6, 0x1a, 0xdb, 0x4d, 0x63, 0x83, 0x09, 0x68, 0x16, 0x12, 0xdd, 0xa7,
-	0xc5, 0xa9, 0xcd, 0x26, 0x1b, 0x41, 0x2d, 0x18, 0x53, 0x17, 0x9e, 0x8b, 0xe0, 0xd7, 0x32, 0xa6,
-	0x92, 0x01, 0x32, 0xa1, 0x88, 0xcf, 0x25, 0x5d, 0x7b, 0x3d, 0xbf, 0xa4, 0x46, 0xb5, 0x3a, 0x0c,
-	0x83, 0xec, 0x37, 0x61, 0x01, 0x5b, 0x3e, 0x0e, 0x70, 0xa7, 0x89, 0x55, 0xc7, 0xa7, 0x37, 0x65,
-	0x01, 0xff, 0x26, 0x07, 0x45, 0x13, 0xdd, 0x1a, 0xee, 0xb4, 0xd0, 0x16, 0x14, 0xe2, 0x0d, 0xf1,
-	0x5d, 0x6d, 0x89, 0xaf, 0x42, 0x7a, 0x97, 0x88, 0x48, 0x9e, 0xe8, 0xe6, 0x06, 0x5c, 0x54, 0xca,
-	0xce, 0xe8, 0x61, 0x96, 0x44, 0x55, 0xb5, 0xea, 0x55, 0xea, 0x48, 0xb7, 0xec, 0x1d, 0x3a, 0x6e,
-	0x87, 0x08, 0x88, 0x4a, 0x5c, 0x09, 0x88, 0x4a, 0xf9, 0xdc, 0x30, 0xcd, 0x93, 0x96, 0x0a, 0x6f,
-	0x4b, 0x09, 0x62, 0x7d, 0x46, 0x39, 0x38, 0xd7, 0x57, 0xd8, 0x3b, 0x1f, 0x49, 0xec, 0x2a, 0x0c,
-	0x6c, 0xaf, 0xd7, 0x96, 0x2a, 0xfc, 0xd5, 0x10, 0x7b, 0x6b, 0xda, 0x0e, 0x1a, 0x4d, 0xc7, 0x66,
-	0x15, 0xd6, 0xa7, 0x34, 0x54, 0x1f, 0x0f, 0xf4, 0x26, 0xf1, 0x6e, 0xc0, 0x10, 0x2f, 0xe2, 0x98,
-	0xf4, 0x9e, 0xba, 0xcd, 0xa1, 0x44, 0x9d, 0xb5, 0x25, 0xe4, 0xeb, 0x36, 0x76, 0x02, 0xe5, 0xc3,
-	0xfc, 0x11, 0x91, 0xcb, 0x59, 0x19, 0xff, 0x2e, 0x4f, 0xc8, 0x38, 0xaa, 0xb4, 0x98, 0x69, 0xe2,
-	0x02, 0xc6, 0x96, 0x7f, 0x59, 0x7f, 0x96, 0x87, 0x29, 0x11, 0x51, 0x46, 0xb3, 0x32, 0xf4, 0x8c,
-	0x97, 0xf9, 0x03, 0x3d, 0x68, 0xcf, 0x92, 0x0c, 0xda, 0xf3, 0x06, 0x19, 0x3c, 0x78, 0xb8, 0x9f,
-	0x53, 0xbe, 0xa9, 0x7b, 0x22, 0xa5, 0xef, 0x7e, 0x4d, 0xfa, 0x36, 0x8d, 0x47, 0x93, 0xbe, 0xe9,
-	0xb2, 0x30, 0xe9, 0x5b, 0xc8, 0xdc, 0x6f, 0x22, 0x30, 0x7d, 0x44, 0xb6, 0x96, 0xd6, 0xe4, 0x69,
-	0x9f, 0x5b, 0xad, 0xd3, 0x57, 0xf9, 0x9b, 0x6b, 0xcb, 0x4b, 0x64, 0x4f, 0xf3, 0xae, 0x8a, 0x15,
-	0xb8, 0x4b, 0x5d, 0xe8, 0x38, 0x4d, 0x75, 0x63, 0x52, 0x16, 0xcb, 0x63, 0x51, 0x28, 0x20, 0xd6,
-	0x03, 0xf9, 0xc6, 0xdf, 0x40, 0x2d, 0x2d, 0xf8, 0xeb, 0x06, 0x8d, 0x5e, 0xf0, 0x88, 0xae, 0xd7,
-	0x79, 0x74, 0xe2, 0x0f, 0x73, 0x2c, 0x1c, 0x42, 0x6d, 0x53, 0x89, 0x93, 0xdf, 0x79, 0xe6, 0x29,
-	0x46, 0x56, 0xa5, 0x99, 0x27, 0x6e, 0xa7, 0xa5, 0x1a, 0x59, 0x69, 0x26, 0x44, 0xfe, 0x6a, 0xb1,
-	0xf1, 0xdc, 0xed, 0xb4, 0xec, 0x38, 0x34, 0xfa, 0x18, 0xc6, 0x95, 0x22, 0xf9, 0x91, 0x66, 0x61,
-	0x06, 0x55, 0x74, 0xb7, 0x65, 0xeb, 0x90, 0xd6, 0xef, 0xe4, 0x61, 0x2e, 0x23, 0x8f, 0x0b, 0xd5,
-	0x01, 0xa9, 0x6d, 0x40, 0xce, 0x14, 0x0f, 0xd0, 0x4c, 0x5f, 0x68, 0x6a, 0x3c, 0x52, 0x02, 0xa2,
-	0xcf, 0x60, 0x54, 0x4d, 0x2b, 0x93, 0x57, 0xa2, 0x80, 0x9b, 0x53, 0xc9, 0xa8, 0xe0, 0x28, 0x00,
-	0x88, 0x7a, 0xc2, 0x1f, 0x32, 0xd7, 0x88, 0x44, 0xa3, 0xe4, 0xa4, 0x39, 0x97, 0xe4, 0x38, 0x4a,
-	0x33, 0xd6, 0xdf, 0xca, 0xc3, 0x42, 0xc6, 0x3c, 0xd4, 0x70, 0xf8, 0x7f, 0x63, 0x2a, 0x62, 0x99,
-	0x82, 0xfa, 0xbe, 0xa5, 0x4c, 0x41, 0xd6, 0xef, 0xe7, 0x61, 0x66, 0xa7, 0x1b, 0x50, 0x4f, 0xd7,
-	0xb5, 0xce, 0x0b, 0xdc, 0x09, 0x3d, 0xff, 0x15, 0xf5, 0xd4, 0x43, 0xef, 0xc3, 0xc0, 0x2a, 0x6e,
-	0xb7, 0x3d, 0xfe, 0x59, 0xbb, 0x22, 0xec, 0xde, 0x71, 0x68, 0x0a, 0xb4, 0x7a, 0xc1, 0x66, 0xd0,
-	0xe8, 0x63, 0x18, 0x59, 0xc5, 0x8e, 0x1f, 0xee, 0x61, 0x47, 0x48, 0xae, 0x97, 0x39, 0xaa, 0x82,
-	0xc2, 0x01, 0x56, 0x2f, 0xd8, 0x11, 0x34, 0x5a, 0x84, 0xfe, 0x2d, 0xaf, 0xb3, 0x2f, 0x9f, 0xc2,
-	0xa5, 0x34, 0x48, 0x60, 0x56, 0x2f, 0xd8, 0x14, 0x16, 0x3d, 0x85, 0xf1, 0xca, 0x3e, 0xee, 0x84,
-	0x4f, 0x71, 0xe8, 0xb4, 0x9c, 0xd0, 0xe1, 0x12, 0xce, 0x8d, 0x34, 0x64, 0x0d, 0x98, 0x66, 0xdf,
-	0x55, 0x0b, 0xaa, 0x03, 0xd0, 0xf7, 0x34, 0xd8, 0xb7, 0x8e, 0x73, 0x50, 0x5c, 0xf6, 0x5e, 0x76,
-	0x8c, 0x13, 0xf3, 0xa1, 0x3e, 0x31, 0xc2, 0x1f, 0xdb, 0x00, 0x1f, 0x9b, 0x9a, 0xf7, 0xa0, 0x7f,
-	0xcb, 0xed, 0xec, 0xc7, 0x3e, 0xea, 0x06, 0x3c, 0x02, 0x45, 0x47, 0xe8, 0x76, 0xf6, 0xd1, 0xba,
-	0x90, 0xa6, 0x38, 0xbf, 0xef, 0xd3, 0x44, 0x38, 0x03, 0xb6, 0x0a, 0x1d, 0x49, 0x4d, 0xec, 0xb7,
-	0x18, 0xe0, 0x3b, 0x30, 0x9b, 0xd2, 0x2e, 0x9a, 0x90, 0xcc, 0xb2, 0x9f, 0x32, 0xc9, 0xb7, 0x61,
-	0xda, 0xb8, 0x04, 0x09, 0xc0, 0xff, 0x96, 0x33, 0xec, 0x25, 0x36, 0xf2, 0x22, 0x0c, 0x89, 0x98,
-	0xb9, 0xec, 0xab, 0x22, 0x7e, 0x52, 0xbf, 0x53, 0x71, 0xd6, 0x78, 0x24, 0x43, 0x79, 0xa4, 0xea,
-	0x4a, 0x6c, 0x01, 0x76, 0x22, 0x3e, 0x79, 0x83, 0x7d, 0x2f, 0x69, 0x91, 0x36, 0x57, 0xbd, 0x20,
-	0xec, 0x48, 0xb7, 0x08, 0x5b, 0xfe, 0x46, 0xb7, 0xa1, 0xb0, 0xf2, 0x4d, 0x88, 0xfd, 0x8e, 0xd3,
-	0xe6, 0xd1, 0x43, 0x79, 0xc6, 0x22, 0x3b, 0x51, 0x6e, 0xfd, 0x45, 0x9e, 0x46, 0x50, 0xcc, 0xd8,
-	0x60, 0x64, 0x8e, 0x36, 0x6b, 0x7c, 0xcc, 0xf9, 0xcd, 0x1a, 0x9a, 0x87, 0x91, 0xcd, 0x9a, 0x16,
-	0x3e, 0xd8, 0x8e, 0x0a, 0x48, 0xe3, 0xa4, 0x23, 0x15, 0xbf, 0x79, 0xe0, 0x86, 0xb8, 0x19, 0x1e,
-	0xf9, 0x9c, 0x2d, 0xda, 0x89, 0x72, 0x64, 0xc1, 0xd8, 0xa3, 0xb6, 0xbb, 0xd7, 0x14, 0xc4, 0xd8,
-	0x40, 0xb4, 0x32, 0x74, 0x13, 0x26, 0x78, 0x92, 0x4b, 0x16, 0x5d, 0x99, 0x67, 0x70, 0xb3, 0x63,
-	0xa5, 0xa4, 0xdd, 0x25, 0xaf, 0x13, 0x3a, 0x6e, 0x07, 0xfb, 0xf6, 0x51, 0x27, 0x74, 0x79, 0xca,
-	0xf3, 0x11, 0x3b, 0x51, 0x8e, 0xde, 0x83, 0x69, 0x59, 0xb6, 0xe9, 0x37, 0x0f, 0x70, 0x10, 0xfa,
-	0x34, 0x12, 0x3d, 0x7d, 0xc9, 0x6e, 0x9b, 0x2b, 0x69, 0x0b, 0x6d, 0xef, 0xa8, 0xb5, 0xd2, 0x79,
-	0xe1, 0xfa, 0x1e, 0x4b, 0x8f, 0x38, 0xcc, 0x5b, 0x88, 0x95, 0x5b, 0x5b, 0xc6, 0xb3, 0xf7, 0x06,
-	0x1b, 0xc9, 0x3a, 0xc9, 0xc1, 0xbc, 0xf1, 0x78, 0x88, 0x0f, 0x73, 0x29, 0xce, 0xf1, 0x95, 0x5d,
-	0x78, 0x1b, 0xfa, 0xe9, 0x97, 0x9a, 0xe9, 0xfa, 0xe2, 0xfa, 0x8f, 0xe2, 0x33, 0x52, 0xa4, 0xd6,
-	0xa6, 0x30, 0xe8, 0x91, 0x94, 0xca, 0xfa, 0xa8, 0x54, 0x76, 0x37, 0xce, 0xf9, 0x0c, 0x8d, 0xab,
-	0xd2, 0xd9, 0x79, 0x48, 0x64, 0x7f, 0x91, 0x83, 0x72, 0x0f, 0xae, 0x20, 0xc7, 0x94, 0x3b, 0xc5,
-	0x98, 0x1e, 0xcb, 0x31, 0x31, 0x47, 0xe3, 0xc5, 0xd3, 0x71, 0x9e, 0xf3, 0x1e, 0xd6, 0x12, 0xa0,
-	0xe4, 0xf7, 0x03, 0xbd, 0x0b, 0x23, 0xb5, 0xda, 0xaa, 0x76, 0x39, 0x15, 0xbf, 0x2f, 0xb2, 0x23,
-	0x08, 0xeb, 0x03, 0x98, 0x91, 0x44, 0x58, 0x08, 0x57, 0xe5, 0x35, 0x03, 0xcf, 0x72, 0x24, 0x1f,
-	0x51, 0x44, 0x05, 0xd6, 0x8f, 0x12, 0x78, 0xb5, 0xa3, 0xc3, 0x43, 0xc7, 0x7f, 0x85, 0x2a, 0x3a,
-	0x5e, 0x5f, 0xcf, 0x2f, 0x65, 0xb5, 0xff, 0xe7, 0xc7, 0xe5, 0x0b, 0x2a, 0xf1, 0x5b, 0x70, 0x53,
-	0x82, 0xc8, 0x52, 0xce, 0xac, 0xa8, 0xf5, 0x4e, 0xde, 0xa0, 0xff, 0x66, 0x1e, 0xca, 0x3d, 0x40,
-	0xd1, 0x1f, 0xe5, 0x58, 0x94, 0x72, 0x59, 0xc2, 0x7b, 0xf5, 0x71, 0x7c, 0x2b, 0x9a, 0xf1, 0xef,
-	0x68, 0xbf, 0x98, 0xca, 0xf0, 0xc9, 0x6f, 0xfd, 0xd5, 0x6b, 0x73, 0x5d, 0xbd, 0x2f, 0xa5, 0xef,
-	0x03, 0x4a, 0x36, 0xd0, 0x6b, 0x1f, 0xf4, 0xab, 0xfb, 0xc0, 0x86, 0x29, 0xed, 0x7b, 0x75, 0x9a,
-	0x23, 0xbc, 0x00, 0xc0, 0xa3, 0x6d, 0xaf, 0x7b, 0xfb, 0xfc, 0x49, 0x80, 0x52, 0x62, 0x3d, 0x84,
-	0xe9, 0x18, 0x4d, 0xae, 0xc4, 0xbc, 0x0b, 0x52, 0xed, 0xa2, 0x44, 0xfb, 0xaa, 0x17, 0x7f, 0x79,
-	0x5c, 0x1e, 0x27, 0x8c, 0xf0, 0x4e, 0x14, 0xd7, 0x4e, 0xfc, 0x65, 0x3d, 0x55, 0xb5, 0xe3, 0x4a,
-	0x5b, 0x7b, 0xcc, 0x75, 0x1f, 0x06, 0x59, 0x49, 0x2c, 0x7a, 0x94, 0x0a, 0xcd, 0xf7, 0x06, 0x07,
-	0xb4, 0xa6, 0xa9, 0xc3, 0x26, 0xfd, 0x51, 0x89, 0x9e, 0x06, 0x58, 0x3b, 0x2c, 0x94, 0x69, 0x54,
-	0x2c, 0x23, 0x54, 0xf5, 0x57, 0xa2, 0x27, 0x0c, 0xe2, 0x0a, 0x40, 0xc0, 0x75, 0xbc, 0x97, 0x6d,
-	0xdc, 0xda, 0xa7, 0xe9, 0xa7, 0xaa, 0x63, 0xfc, 0x0a, 0xa0, 0xdf, 0x21, 0x04, 0x28, 0x9a, 0xf5,
-	0x05, 0x4c, 0x2f, 0xb5, 0xb1, 0xe3, 0xc7, 0xdb, 0x43, 0x37, 0x61, 0x88, 0x96, 0xe9, 0x37, 0xdb,
-	0x0e, 0x29, 0xa2, 0x37, 0xdb, 0xbc, 0x92, 0x28, 0x74, 0x2c, 0xa8, 0x8f, 0x3a, 0xa4, 0x48, 0x97,
-	0x1a, 0xa0, 0xbf, 0x63, 0xee, 0x7e, 0x86, 0xd1, 0x33, 0x38, 0xeb, 0x73, 0xea, 0x4f, 0x62, 0xca,
-	0x3c, 0x76, 0x3a, 0x07, 0xd4, 0xff, 0x0f, 0xe6, 0x2b, 0xdd, 0x2e, 0xee, 0xb4, 0x22, 0xc4, 0x6d,
-	0xdf, 0x39, 0xa5, 0x63, 0x3f, 0xaa, 0xc0, 0x00, 0x85, 0x96, 0x66, 0x40, 0xde, 0x5d, 0x43, 0x77,
-	0x28, 0x1c, 0xd7, 0x6f, 0x69, 0x03, 0x0c, 0xd3, 0x6a, 0xc1, 0x6c, 0xed, 0x68, 0xef, 0xd0, 0x65,
-	0x49, 0xbe, 0xe8, 0xe3, 0x18, 0xd1, 0xf6, 0x9a, 0x88, 0x3e, 0xcd, 0x26, 0xe3, 0x56, 0x94, 0x51,
-	0x8c, 0x5e, 0xd2, 0xf3, 0x07, 0x33, 0x2f, 0xee, 0xdf, 0x89, 0x50, 0xa9, 0xe8, 0xc9, 0x5a, 0xa1,
-	0xd5, 0x3c, 0x42, 0xb5, 0x75, 0x09, 0x2e, 0xaa, 0x26, 0x15, 0xb6, 0x43, 0xa6, 0xe1, 0x92, 0x6e,
-	0x2a, 0x61, 0xc5, 0x5f, 0xc3, 0x14, 0xbb, 0x03, 0x60, 0xe1, 0xc0, 0x16, 0xa3, 0xc8, 0x57, 0xf9,
-	0xfa, 0x62, 0xec, 0x6a, 0x9f, 0x7a, 0x67, 0xcb, 0x40, 0x8f, 0xf5, 0x45, 0xe6, 0x13, 0xf8, 0x62,
-	0x51, 0x33, 0xc8, 0xe5, 0xeb, 0x8b, 0xd5, 0x21, 0xae, 0xe7, 0x13, 0xea, 0x6c, 0xf9, 0x7f, 0x25,
-	0xd4, 0x17, 0xa9, 0x1b, 0xfa, 0x2a, 0x76, 0xa8, 0xcb, 0x88, 0xd9, 0x99, 0x77, 0x02, 0xf2, 0x6e,
-	0x4b, 0x08, 0x5b, 0x6e, 0xcb, 0xfa, 0xd3, 0x1c, 0xdc, 0x62, 0x9f, 0x24, 0x33, 0x1e, 0xd5, 0xdc,
-	0x53, 0x90, 0xd1, 0x47, 0xc0, 0xb2, 0xee, 0xf0, 0xef, 0xbe, 0xc5, 0x7b, 0x9e, 0x45, 0x89, 0x21,
-	0xa0, 0x0a, 0x8c, 0xa9, 0xbe, 0x25, 0xb1, 0x60, 0x01, 0x29, 0x36, 0x3c, 0x7b, 0xf4, 0xf0, 0x99,
-	0x23, 0xfd, 0x4d, 0x9e, 0xc3, 0xdc, 0xca, 0x37, 0x64, 0x43, 0x70, 0x59, 0x93, 0xdf, 0xc3, 0x45,
-	0xce, 0xa2, 0x93, 0xdb, 0x7c, 0xc7, 0xe8, 0xd2, 0x50, 0xbc, 0x98, 0x48, 0x89, 0x42, 0x5c, 0x95,
-	0x42, 0xcc, 0x88, 0xad, 0x95, 0x59, 0xff, 0x21, 0x07, 0xf3, 0xe6, 0xd6, 0x38, 0x63, 0x59, 0x83,
-	0x8b, 0x4b, 0x4e, 0xc7, 0xeb, 0xb8, 0x4d, 0xa7, 0x5d, 0x6b, 0x1e, 0xe0, 0xd6, 0x51, 0x5b, 0xb8,
-	0xdc, 0x48, 0x2e, 0x43, 0xa4, 0x5e, 0x8e, 0x2e, 0x40, 0xec, 0x24, 0x16, 0xfa, 0x00, 0x66, 0xa8,
-	0xc3, 0x03, 0xe3, 0xbd, 0x6d, 0xec, 0x4b, 0x7a, 0xac, 0x67, 0x29, 0xb5, 0xe8, 0x1e, 0x5c, 0x62,
-	0x1f, 0x95, 0xd6, 0x4e, 0xc7, 0x0d, 0x25, 0x12, 0x13, 0x8e, 0x4d, 0x55, 0xb7, 0x6f, 0xc3, 0xc8,
-	0x66, 0x17, 0xf3, 0x24, 0xd7, 0xc3, 0xd0, 0xbf, 0xb6, 0xb1, 0xb6, 0xcd, 0x52, 0xec, 0x6d, 0xed,
-	0x6c, 0x17, 0x72, 0x08, 0x60, 0x70, 0x79, 0x65, 0x7d, 0x65, 0x7b, 0xa5, 0x90, 0xbf, 0xdd, 0x50,
-	0x7d, 0x72, 0xd0, 0x1c, 0xcc, 0x2e, 0xaf, 0xd4, 0xd7, 0x96, 0x56, 0x1a, 0xdb, 0x3f, 0xd8, 0x5a,
-	0x69, 0xe8, 0xc1, 0x96, 0xa6, 0xa0, 0xa0, 0x56, 0x6e, 0x6f, 0x6e, 0x6f, 0xb1, 0xbc, 0x79, 0x6a,
-	0xe9, 0xee, 0x4a, 0xb5, 0xb2, 0xb3, 0xbd, 0xba, 0x51, 0xe8, 0xb3, 0xfa, 0x87, 0xf3, 0x85, 0xfc,
-	0xed, 0x9f, 0x6a, 0x0e, 0x3b, 0x68, 0x1e, 0x8a, 0x1c, 0x7c, 0xa7, 0x56, 0x79, 0x94, 0xde, 0x04,
-	0xab, 0x7d, 0xfa, 0xb0, 0x52, 0xc8, 0xa1, 0x2b, 0x70, 0x59, 0x2b, 0xdd, 0xaa, 0xd4, 0x6a, 0xbb,
-	0x9b, 0xf6, 0xf2, 0xfa, 0x4a, 0xad, 0x56, 0xc8, 0xdf, 0xae, 0x6b, 0x01, 0x7a, 0x48, 0x0b, 0x4f,
-	0x1f, 0x56, 0x1a, 0xf6, 0xca, 0x97, 0x3b, 0x6b, 0xf6, 0xca, 0x72, 0xb2, 0x05, 0xad, 0xf6, 0x07,
-	0x2b, 0xb5, 0x42, 0x0e, 0x5d, 0x82, 0x49, 0xad, 0x74, 0x63, 0xb3, 0x90, 0xbf, 0x7d, 0x93, 0xbf,
-	0xfd, 0x43, 0x13, 0x00, 0xcb, 0x2b, 0xb5, 0xa5, 0x95, 0x8d, 0xe5, 0xb5, 0x8d, 0x47, 0x85, 0x0b,
-	0x68, 0x1c, 0x46, 0x2a, 0xf2, 0x67, 0xee, 0xf6, 0x55, 0x98, 0x8c, 0x89, 0x8f, 0x04, 0x42, 0x4a,
-	0x5e, 0x85, 0x0b, 0x8b, 0xff, 0xe5, 0xf7, 0x72, 0x30, 0x4a, 0xb6, 0xbe, 0x70, 0xcf, 0xf8, 0x5a,
-	0x11, 0xaa, 0xf8, 0x92, 0xf3, 0xe0, 0xf7, 0xa9, 0x12, 0x14, 0xe5, 0x82, 0xa5, 0x0c, 0x8d, 0x9b,
-	0x02, 0xdc, 0xca, 0xdd, 0xcb, 0x21, 0x9b, 0xda, 0x9a, 0x63, 0x52, 0x9b, 0xa4, 0x6c, 0x96, 0x02,
-	0x4b, 0x29, 0xd5, 0x42, 0xd8, 0xfb, 0x75, 0xb0, 0x54, 0x9a, 0x29, 0x12, 0xd8, 0xbb, 0xa7, 0x93,
-	0xb4, 0x44, 0x9b, 0x37, 0x4f, 0x07, 0x8e, 0x1e, 0xc3, 0x38, 0x91, 0x4d, 0x24, 0x18, 0x9a, 0x8b,
-	0x23, 0x2a, 0xe2, 0x50, 0x69, 0xde, 0x5c, 0x29, 0x43, 0x64, 0x8e, 0xd1, 0x81, 0x04, 0xa1, 0xd3,
-	0x21, 0x1a, 0xf1, 0xb4, 0x4c, 0x22, 0xcf, 0x4a, 0xd8, 0x4d, 0x7f, 0xe9, 0x62, 0xac, 0xb8, 0x7e,
-	0xff, 0x5e, 0x0e, 0xd5, 0xe8, 0xf3, 0x49, 0x4d, 0xc8, 0x41, 0xc2, 0x5f, 0x28, 0x29, 0xfd, 0xb0,
-	0xde, 0x94, 0xa5, 0x75, 0x3a, 0x45, 0x3a, 0xda, 0x00, 0x94, 0x94, 0x1d, 0xd0, 0xd5, 0x68, 0x1f,
-	0x98, 0xc5, 0x8a, 0xd2, 0x4c, 0xe2, 0x0a, 0x71, 0x85, 0x7c, 0x3d, 0xd0, 0x0a, 0x4c, 0x70, 0x27,
-	0x4f, 0x2e, 0xcd, 0xa0, 0x2c, 0x79, 0x28, 0x95, 0xcc, 0x23, 0x3a, 0x4f, 0x52, 0x22, 0x42, 0xa5,
-	0x68, 0x1c, 0x71, 0x31, 0xa9, 0x34, 0x67, 0xac, 0xe3, 0xe3, 0x7b, 0x08, 0x13, 0xba, 0x70, 0x85,
-	0xc4, 0x02, 0x19, 0x65, 0xae, 0xd4, 0x0e, 0x35, 0x60, 0xf6, 0xa9, 0xe3, 0x52, 0x0d, 0x9b, 0x5f,
-	0x54, 0x89, 0x6b, 0x26, 0x54, 0xce, 0xb8, 0x77, 0xaa, 0xe1, 0x4e, 0xab, 0xd4, 0x2b, 0x70, 0x00,
-	0x3d, 0x36, 0x35, 0x21, 0x23, 0xe8, 0xd7, 0x74, 0xc8, 0xd2, 0x33, 0x84, 0x98, 0x6e, 0x5e, 0x4b,
-	0x69, 0xce, 0x02, 0xe8, 0x29, 0x15, 0x52, 0x62, 0x14, 0x95, 0x3d, 0x71, 0x66, 0x72, 0x45, 0xea,
-	0x6a, 0x1c, 0xba, 0xf1, 0x5b, 0xff, 0x00, 0xa5, 0x4c, 0x5c, 0x2a, 0xb1, 0x7b, 0x39, 0xf4, 0x35,
-	0x3d, 0xd5, 0x46, 0x72, 0xbb, 0x6e, 0x78, 0xc0, 0xbd, 0x5e, 0xe6, 0x8c, 0x04, 0xf8, 0x41, 0xc9,
-	0xa0, 0x6e, 0xc3, 0x94, 0xc9, 0x3f, 0x41, 0x4e, 0x68, 0x86, 0xf3, 0x42, 0xea, 0x2e, 0xb0, 0x89,
-	0xa8, 0xd5, 0x4a, 0x5f, 0xa4, 0x8c, 0xeb, 0xf1, 0x54, 0x9a, 0x9f, 0xc1, 0x04, 0xd9, 0x25, 0x4f,
-	0x30, 0xee, 0x56, 0xda, 0xee, 0x0b, 0x1c, 0x20, 0x11, 0x54, 0x43, 0x16, 0xa5, 0xe1, 0xde, 0xca,
-	0xa1, 0xef, 0xc0, 0xe8, 0xae, 0x13, 0x36, 0x0f, 0xf8, 0x1b, 0x70, 0xf1, 0x44, 0x9c, 0x96, 0x95,
-	0xc4, 0x2f, 0x5a, 0x79, 0x2f, 0x87, 0xbe, 0x07, 0x43, 0x8f, 0x70, 0x48, 0xfd, 0x35, 0xaf, 0xc9,
-	0xab, 0x3a, 0xe6, 0x16, 0xb3, 0xd6, 0x91, 0x0e, 0x6c, 0xa2, 0xc3, 0x71, 0x7d, 0x1e, 0xdd, 0x05,
-	0x60, 0x0c, 0x81, 0x52, 0x88, 0x57, 0x97, 0x12, 0xdd, 0x46, 0x8f, 0xc8, 0xe7, 0xbd, 0x8d, 0x43,
-	0x7c, 0xda, 0x26, 0xd3, 0xe6, 0x68, 0x1d, 0x26, 0x64, 0x54, 0xd1, 0x0d, 0xea, 0xf0, 0x6f, 0xc5,
-	0x88, 0x05, 0x67, 0xa0, 0xf6, 0x09, 0x39, 0x15, 0xec, 0xea, 0x4c, 0x06, 0x1c, 0x41, 0x69, 0x21,
-	0x48, 0xe4, 0x24, 0x32, 0x30, 0x05, 0x77, 0xd5, 0x0b, 0x42, 0x1d, 0x57, 0x96, 0x98, 0x71, 0x31,
-	0x94, 0xd4, 0x76, 0xf5, 0xe0, 0x23, 0x11, 0xcf, 0x4d, 0x8b, 0x99, 0x52, 0xba, 0x96, 0x01, 0xc1,
-	0xd8, 0x1d, 0xe5, 0x24, 0xcb, 0x44, 0x7b, 0x65, 0xcd, 0xa8, 0xe9, 0xf1, 0xc5, 0x65, 0x80, 0x52,
-	0x26, 0x08, 0xa3, 0x64, 0x15, 0xf9, 0xea, 0x69, 0x41, 0x2f, 0xa2, 0xaf, 0x9e, 0x21, 0x2a, 0x49,
-	0xf4, 0xd5, 0x33, 0xc6, 0xc9, 0x78, 0xc2, 0xf4, 0x69, 0x2d, 0x49, 0x76, 0x7d, 0x11, 0x09, 0xe7,
-	0x5d, 0xad, 0x82, 0x1f, 0xec, 0x19, 0x53, 0x5d, 0xfd, 0xc1, 0xbd, 0x1c, 0x5a, 0x81, 0x4b, 0xf2,
-	0x7d, 0x46, 0x54, 0x85, 0x52, 0x10, 0x52, 0x37, 0xc1, 0x17, 0x70, 0x89, 0x6f, 0x29, 0x8d, 0x4c,
-	0x41, 0x72, 0x07, 0x7e, 0x7f, 0x97, 0x4a, 0xe0, 0x31, 0x4c, 0xd7, 0x62, 0x83, 0x62, 0xde, 0x26,
-	0x97, 0x75, 0x12, 0x4a, 0x3e, 0xd2, 0x54, 0x5a, 0x4f, 0x00, 0x31, 0x95, 0x55, 0x90, 0x7b, 0xe1,
-	0xe2, 0x97, 0xe8, 0x4a, 0x6c, 0x48, 0xa4, 0x90, 0x82, 0x51, 0xf6, 0x92, 0x36, 0x45, 0x68, 0x9b,
-	0xe5, 0x4a, 0x61, 0xb9, 0xce, 0x9c, 0xae, 0xb3, 0xe7, 0xb6, 0xdd, 0xd0, 0xc5, 0x64, 0x87, 0xa9,
-	0x08, 0x6a, 0x95, 0x58, 0xc6, 0xcb, 0xa9, 0x10, 0xe8, 0x73, 0x18, 0x7f, 0x84, 0xc3, 0x28, 0xe5,
-	0x2a, 0x9a, 0x4d, 0x24, 0x69, 0xe5, 0x4b, 0x27, 0x5e, 0x03, 0xea, 0x79, 0x5e, 0xd7, 0xa0, 0xc0,
-	0xb8, 0xa3, 0x42, 0xe2, 0x4a, 0x82, 0x04, 0x07, 0x71, 0x7c, 0xe7, 0x30, 0x48, 0x9d, 0xad, 0xbb,
-	0xec, 0x3a, 0x07, 0x89, 0x6d, 0xab, 0x8a, 0x5f, 0x97, 0xb4, 0x32, 0x19, 0xbd, 0x69, 0xda, 0x98,
-	0x6b, 0x14, 0x5d, 0x8f, 0x3e, 0x85, 0xa9, 0x09, 0x44, 0x4b, 0x28, 0xfe, 0x56, 0xaf, 0xfe, 0x00,
-	0xc9, 0xd4, 0x12, 0x06, 0xa2, 0x37, 0xb5, 0x2f, 0xf6, 0xd9, 0xe8, 0x7e, 0x0e, 0x23, 0x32, 0x69,
-	0xa5, 0x64, 0x2b, 0xf1, 0x94, 0x9f, 0xa5, 0x62, 0xb2, 0x82, 0x8f, 0xf4, 0x33, 0x96, 0xa2, 0x56,
-	0xc7, 0x8f, 0xe7, 0x75, 0x4c, 0x9d, 0xd8, 0x8f, 0x61, 0x54, 0xc9, 0xe8, 0x28, 0x37, 0x72, 0x32,
-	0xcb, 0x63, 0x69, 0x5c, 0xe9, 0x7b, 0x7d, 0xf1, 0x5e, 0x0e, 0xdd, 0xa5, 0x9f, 0x16, 0xfa, 0x58,
-	0x65, 0x3a, 0x42, 0x53, 0xf2, 0xb0, 0xc5, 0x50, 0xd0, 0x87, 0x34, 0xa6, 0xc7, 0xd2, 0x91, 0xef,
-	0x13, 0x05, 0x96, 0xe0, 0xa5, 0x49, 0x10, 0x31, 0xc4, 0xcf, 0x29, 0x33, 0x51, 0x10, 0x99, 0xfb,
-	0x46, 0x2f, 0x6c, 0x16, 0x13, 0xf6, 0x5e, 0x0e, 0x3d, 0x80, 0x61, 0x91, 0x00, 0x1a, 0xcd, 0xe8,
-	0x5d, 0x4d, 0x1f, 0xde, 0x03, 0x00, 0x36, 0xd9, 0xb4, 0xa7, 0x7a, 0x75, 0xea, 0x74, 0x3e, 0x20,
-	0xdf, 0xcb, 0xd6, 0x19, 0x91, 0x3e, 0x17, 0xdf, 0x4c, 0x8a, 0x54, 0xd4, 0x96, 0x50, 0x9d, 0xce,
-	0x34, 0x7c, 0x22, 0xf0, 0x6a, 0x79, 0xa9, 0x23, 0x81, 0xd7, 0x94, 0xae, 0x3a, 0x95, 0xce, 0x1a,
-	0x14, 0x2a, 0x4d, 0xca, 0xc7, 0x65, 0x6e, 0x3b, 0xa9, 0x6d, 0xc4, 0x2b, 0x04, 0xad, 0xe9, 0x78,
-	0xaa, 0xbc, 0x75, 0xec, 0xd0, 0x30, 0x27, 0xb3, 0x52, 0x26, 0x88, 0x55, 0x99, 0x31, 0x32, 0xb4,
-	0x8b, 0xa9, 0x25, 0xa2, 0x0f, 0xb5, 0xdf, 0x8c, 0xcc, 0x27, 0x94, 0x97, 0x29, 0x79, 0xff, 0x66,
-	0xe2, 0xf8, 0x52, 0x0f, 0x13, 0xae, 0x73, 0x12, 0xb4, 0x02, 0x93, 0x3c, 0xa8, 0x82, 0x9c, 0x96,
-	0x34, 0xec, 0xb4, 0xe6, 0x3f, 0x84, 0x89, 0x15, 0xc2, 0xeb, 0x8f, 0x5a, 0x2e, 0x0b, 0xed, 0x84,
-	0xf4, 0x58, 0x3d, 0xa9, 0x88, 0xab, 0x22, 0xa5, 0xad, 0x92, 0x10, 0x4f, 0x9e, 0xd2, 0x64, 0xce,
-	0xc1, 0xd2, 0x94, 0x20, 0xab, 0xe6, 0xce, 0xe3, 0x4a, 0xfa, 0x6c, 0x4a, 0x0a, 0x3a, 0x74, 0x43,
-	0xd3, 0xfd, 0xd2, 0xf2, 0xc8, 0x19, 0xa4, 0xbd, 0xaf, 0x94, 0xa4, 0x1c, 0x29, 0x34, 0xb3, 0x73,
-	0xd3, 0xa5, 0x8e, 0x5b, 0x06, 0x63, 0x31, 0xe6, 0x90, 0x43, 0xef, 0xe8, 0xd4, 0x33, 0xf2, 0xcc,
-	0xa5, 0xb6, 0x40, 0x75, 0x6b, 0x3d, 0xc5, 0x19, 0x5a, 0xc8, 0xce, 0xc4, 0xa6, 0xe8, 0xd6, 0x29,
-	0xb9, 0xd1, 0x1e, 0xd3, 0x6d, 0x16, 0x65, 0xee, 0x40, 0xaa, 0xa6, 0x1a, 0x4f, 0x5c, 0x22, 0x45,
-	0x28, 0x73, 0x9e, 0xb3, 0x47, 0x94, 0x5d, 0x2a, 0x59, 0x40, 0x52, 0x19, 0xde, 0x15, 0x13, 0x9d,
-	0x40, 0xf9, 0x16, 0x4e, 0xc6, 0x32, 0x86, 0x49, 0xdb, 0x8c, 0x39, 0x67, 0x59, 0x69, 0x21, 0xad,
-	0x9a, 0x53, 0xac, 0x89, 0xa4, 0xd4, 0xca, 0x48, 0x17, 0xb4, 0x2f, 0x54, 0x72, 0xb0, 0xe5, 0xd4,
-	0x7a, 0x39, 0x77, 0x85, 0x78, 0x86, 0x17, 0x49, 0x34, 0x25, 0xf5, 0x4b, 0x06, 0x4b, 0x9c, 0x52,
-	0xb7, 0x46, 0xcf, 0x19, 0x4c, 0xa3, 0xb3, 0x0d, 0xd3, 0xc6, 0x84, 0x2c, 0x52, 0x8c, 0xc8, 0x4a,
-	0xd7, 0x92, 0x4a, 0x15, 0xc3, 0x8c, 0x39, 0x27, 0x13, 0x7a, 0x4b, 0x57, 0xfd, 0xcd, 0x19, 0x6a,
-	0x4a, 0x37, 0x7a, 0x40, 0xf1, 0x09, 0xfd, 0x9a, 0x7e, 0x36, 0x13, 0x6d, 0x5c, 0x53, 0x8c, 0x01,
-	0x29, 0x0d, 0x58, 0x59, 0x20, 0x72, 0x0f, 0x4c, 0x99, 0x72, 0xc2, 0xa5, 0x4e, 0xf1, 0xf5, 0x74,
-	0x9a, 0xd1, 0xc6, 0xaa, 0x8b, 0x10, 0x28, 0xa9, 0x33, 0x93, 0x99, 0xbb, 0x27, 0x43, 0x9b, 0x2c,
-	0xc9, 0xfd, 0x70, 0xfa, 0x2e, 0xa7, 0x5b, 0x86, 0xa6, 0x4c, 0x19, 0xa3, 0xe2, 0x86, 0x1b, 0x53,
-	0x42, 0x20, 0x39, 0x0d, 0x99, 0x29, 0xa7, 0xea, 0xcc, 0x88, 0xa3, 0x53, 0x57, 0x8d, 0x38, 0x46,
-	0xd2, 0x57, 0xd3, 0x01, 0xa2, 0x1d, 0x61, 0x48, 0x7d, 0x27, 0x77, 0x44, 0x7a, 0x12, 0x3e, 0xb9,
-	0x23, 0xb2, 0x32, 0xe7, 0xd9, 0xe2, 0xd0, 0xa5, 0x4c, 0x4b, 0x46, 0x9e, 0xa4, 0x0c, 0x95, 0xab,
-	0x18, 0x2d, 0x5c, 0xac, 0xdb, 0x67, 0x5d, 0xb6, 0xaf, 0xe1, 0x72, 0x6a, 0x4e, 0x24, 0xf4, 0x76,
-	0xe2, 0x40, 0xa7, 0xcc, 0x44, 0x7a, 0x4f, 0xc7, 0xb5, 0x74, 0x46, 0xd2, 0x8a, 0x15, 0xcb, 0x9c,
-	0x94, 0x60, 0xfd, 0x86, 0xb4, 0x4a, 0x8c, 0xf5, 0x2b, 0xa9, 0x91, 0x4e, 0xc3, 0xfa, 0x4d, 0x99,
-	0x94, 0x24, 0x4f, 0x55, 0xfa, 0x25, 0x44, 0xba, 0x78, 0xc5, 0x59, 0x78, 0xea, 0x69, 0xba, 0x96,
-	0x46, 0x67, 0x99, 0xaa, 0x1c, 0x22, 0x53, 0x12, 0xba, 0xac, 0x4d, 0x93, 0xf6, 0xb9, 0x2d, 0x69,
-	0x83, 0xd3, 0xbf, 0xb4, 0x4b, 0xd4, 0x5c, 0x2c, 0x33, 0x33, 0xa5, 0xf6, 0x62, 0x2e, 0x49, 0x43,
-	0x33, 0x15, 0xcb, 0x59, 0x60, 0xbd, 0x99, 0x8f, 0x4f, 0x8e, 0xd6, 0xa1, 0xf4, 0x21, 0x21, 0x75,
-	0x6a, 0x7a, 0x74, 0x29, 0x5d, 0xd4, 0xbd, 0xc4, 0x94, 0x07, 0x16, 0xa3, 0x50, 0xbc, 0x54, 0x9e,
-	0x91, 0x76, 0x2f, 0xa5, 0x34, 0xc3, 0xcc, 0xb1, 0x45, 0x5d, 0x03, 0x0d, 0x49, 0xa6, 0x24, 0x0f,
-	0xcd, 0xcc, 0x41, 0x65, 0x10, 0xf3, 0x24, 0x57, 0x4e, 0xa5, 0x98, 0x99, 0x75, 0x2a, 0xb5, 0xa7,
-	0x3f, 0x51, 0xb8, 0x72, 0x22, 0x95, 0x14, 0xba, 0x15, 0x97, 0xf1, 0xd2, 0xb2, 0x4d, 0x65, 0x70,
-	0xfd, 0x29, 0x53, 0x16, 0x2a, 0xc5, 0x76, 0x9b, 0x9a, 0xa2, 0xca, 0x30, 0x0b, 0x92, 0xbd, 0xa5,
-	0x50, 0xcb, 0xc8, 0x49, 0x95, 0xda, 0xc3, 0x1f, 0x2a, 0xec, 0x2d, 0x96, 0x3b, 0x4a, 0x1a, 0x15,
-	0x7a, 0x24, 0x97, 0x4a, 0xa5, 0xbd, 0x41, 0x9d, 0x49, 0x93, 0x89, 0x9f, 0xa4, 0xec, 0x92, 0x95,
-	0x16, 0xca, 0x68, 0xda, 0x9d, 0x4e, 0x0e, 0x91, 0xd0, 0x9b, 0x89, 0x19, 0x66, 0x7b, 0x75, 0x4c,
-	0xf2, 0x61, 0x43, 0xc2, 0xa8, 0x18, 0x1f, 0x4e, 0x4f, 0x29, 0x95, 0xa1, 0x31, 0x4d, 0xd6, 0xdc,
-	0xfd, 0x8e, 0x92, 0xef, 0x49, 0xea, 0x4b, 0xc9, 0x14, 0x54, 0x92, 0xc5, 0x98, 0xd2, 0x43, 0x6d,
-	0x46, 0x4f, 0x56, 0xd4, 0xcc, 0x3d, 0xa8, 0x94, 0x9e, 0xb0, 0x48, 0xb2, 0x1b, 0x63, 0xaa, 0x1f,
-	0x85, 0xa0, 0x9a, 0x36, 0x47, 0x12, 0x34, 0x64, 0xf0, 0x91, 0x04, 0x8d, 0x79, 0x76, 0x98, 0x09,
-	0xc6, 0xf6, 0xda, 0x58, 0x35, 0xc1, 0x28, 0x49, 0x6f, 0x62, 0xb6, 0x10, 0xf4, 0x29, 0xb5, 0x84,
-	0x64, 0x9b, 0x4f, 0x66, 0x75, 0x4a, 0x11, 0xb7, 0x7c, 0x20, 0x2e, 0x03, 0x68, 0x83, 0x3a, 0xe5,
-	0xde, 0xc6, 0x0d, 0x8a, 0xa4, 0x1b, 0x37, 0xd4, 0x8e, 0xa6, 0xdb, 0x49, 0xc7, 0xd4, 0xa0, 0xe9,
-	0x72, 0xae, 0x0c, 0x99, 0x1d, 0xe4, 0x5c, 0x99, 0xf2, 0x25, 0x50, 0x1d, 0x78, 0x5b, 0x68, 0xf2,
-	0x11, 0xbd, 0x2b, 0x99, 0x09, 0x0f, 0x4a, 0x0b, 0xd9, 0x59, 0x02, 0xf8, 0x3d, 0x5e, 0x21, 0x1e,
-	0xd7, 0x1d, 0x99, 0xf2, 0x55, 0x28, 0xe1, 0xf2, 0xa5, 0x36, 0x94, 0x1a, 0x10, 0x7e, 0x4b, 0x18,
-	0xab, 0x75, 0xba, 0x29, 0x59, 0x0b, 0x54, 0xd2, 0xd9, 0x02, 0x4a, 0x14, 0xe2, 0x5d, 0xd5, 0x4d,
-	0x13, 0x21, 0xe4, 0x55, 0x01, 0xc5, 0x10, 0x15, 0xde, 0x15, 0x4f, 0x9c, 0xcd, 0x99, 0x93, 0xde,
-	0xd1, 0x75, 0xbd, 0x8c, 0xe0, 0x3f, 0x3d, 0x6f, 0x4a, 0xd1, 0x8f, 0x45, 0xd6, 0xe4, 0x64, 0x86,
-	0x90, 0x1b, 0x31, 0xb3, 0xab, 0x39, 0x5c, 0x4c, 0x29, 0x2b, 0x01, 0x09, 0x7a, 0x4a, 0xaf, 0xd8,
-	0x37, 0xd7, 0x96, 0x97, 0xb8, 0x2f, 0x80, 0xe7, 0x27, 0xae, 0xad, 0x76, 0xdd, 0xf0, 0x80, 0xa5,
-	0xcc, 0x51, 0xb8, 0x0f, 0x03, 0xd1, 0x10, 0xeb, 0x0f, 0x50, 0x8d, 0x4a, 0xee, 0x5a, 0xa9, 0xe1,
-	0xe6, 0xca, 0x40, 0xb0, 0x64, 0x26, 0x48, 0x13, 0xff, 0x51, 0xc1, 0x80, 0x1c, 0x3c, 0xbd, 0x9b,
-	0x29, 0x7d, 0xc8, 0x92, 0x2f, 0xd8, 0xb6, 0x31, 0x93, 0x39, 0x2d, 0xfb, 0x7e, 0x04, 0xd3, 0x6c,
-	0xc2, 0x63, 0xef, 0xc9, 0xb4, 0xfe, 0x28, 0xe5, 0xa5, 0x94, 0x72, 0xb4, 0x41, 0xdd, 0x46, 0xe2,
-	0xa5, 0x8a, 0x16, 0x63, 0x7e, 0xb0, 0x96, 0x4a, 0x8f, 0x2d, 0x25, 0x11, 0xdb, 0x5f, 0x6b, 0x29,
-	0x35, 0xc4, 0xfa, 0x22, 0x5f, 0x4a, 0xad, 0xf4, 0x6c, 0x4b, 0x19, 0x23, 0xa8, 0x2f, 0xa5, 0xde,
-	0xcd, 0x94, 0x3e, 0xf4, 0x5e, 0x4a, 0x33, 0x99, 0x33, 0x2f, 0x65, 0xec, 0x31, 0x9f, 0xd6, 0x1f,
-	0xd3, 0x52, 0xc6, 0xe1, 0xd9, 0x52, 0xc6, 0x4b, 0x63, 0x0a, 0x69, 0xc6, 0x52, 0xc6, 0x31, 0xbf,
-	0xa4, 0xf4, 0xd8, 0x6b, 0xc1, 0x33, 0x2d, 0xa6, 0x08, 0x6a, 0x13, 0x43, 0xad, 0x3f, 0x40, 0xbb,
-	0xd4, 0x1a, 0x12, 0x2b, 0x3f, 0xdd, 0x82, 0xce, 0xa7, 0x11, 0xa5, 0x4b, 0xba, 0x26, 0xe4, 0xac,
-	0x78, 0x77, 0x53, 0xfb, 0x92, 0xb5, 0x1e, 0x6c, 0x59, 0xe3, 0xa4, 0xce, 0xba, 0xb0, 0x4f, 0x05,
-	0xd3, 0x4c, 0x3c, 0xb8, 0x8c, 0xf5, 0x4a, 0x5d, 0xdc, 0xd4, 0x1a, 0xb4, 0x4d, 0x6d, 0x3d, 0xc9,
-	0x72, 0xc5, 0x4e, 0x94, 0xf6, 0xb2, 0xb3, 0x27, 0xd5, 0xc4, 0x0b, 0x4e, 0x95, 0x6a, 0xda, 0xf3,
-	0x4e, 0x49, 0x35, 0x89, 0xfd, 0x05, 0xd5, 0x9d, 0xb9, 0x3f, 0x7a, 0xe7, 0x99, 0x97, 0x2e, 0xe8,
-	0x5c, 0xd2, 0xdc, 0x19, 0x08, 0x2c, 0xf5, 0x22, 0xf9, 0x8c, 0x5f, 0x15, 0x88, 0xc2, 0xd4, 0xc9,
-	0x37, 0xe1, 0xa3, 0x2f, 0xa0, 0xc0, 0x0f, 0x78, 0x44, 0xc0, 0x04, 0x98, 0xba, 0x74, 0x55, 0xa1,
-	0xb2, 0x9f, 0xa2, 0x07, 0xa7, 0x51, 0xd5, 0x4f, 0x33, 0x13, 0xe9, 0x7a, 0x2d, 0x61, 0x81, 0xdb,
-	0x3e, 0x51, 0x39, 0x5b, 0x49, 0x7d, 0x54, 0xef, 0x8c, 0xb8, 0x1d, 0xd6, 0xc1, 0xeb, 0x8b, 0x68,
-	0x8d, 0x1e, 0x66, 0xbd, 0x38, 0x4b, 0x61, 0x37, 0x93, 0xa1, 0x67, 0x6d, 0x55, 0x3a, 0x3e, 0xeb,
-	0x7d, 0x4a, 0x6b, 0x3b, 0xbd, 0x53, 0x72, 0x8a, 0x4e, 0x39, 0xba, 0xb4, 0x29, 0x62, 0x12, 0x35,
-	0x33, 0x1e, 0xf4, 0x9a, 0x99, 0xb8, 0x2b, 0x36, 0xfa, 0x3e, 0x8c, 0x08, 0xe4, 0xde, 0x13, 0x12,
-	0xc7, 0xa6, 0x13, 0xf2, 0x39, 0x8c, 0x2a, 0x9e, 0xe0, 0x28, 0xad, 0xa5, 0x0c, 0xf1, 0x7c, 0x54,
-	0xf1, 0x53, 0x3f, 0x3b, 0xfe, 0x32, 0x8c, 0x6b, 0x7e, 0xee, 0x52, 0xa8, 0x34, 0x79, 0xbf, 0x67,
-	0x51, 0xd1, 0xfc, 0xd9, 0x25, 0x15, 0x93, 0x97, 0x7b, 0xb6, 0x80, 0xab, 0xbc, 0x8f, 0x57, 0x04,
-	0xdc, 0xe4, 0x43, 0x7d, 0x45, 0xc0, 0x35, 0x3d, 0xa9, 0xff, 0x1e, 0x8c, 0xf2, 0xed, 0x91, 0xb9,
-	0xb2, 0xe9, 0x96, 0x87, 0x69, 0xc5, 0xff, 0xf2, 0xa8, 0xe5, 0x86, 0x4b, 0x5e, 0xe7, 0x99, 0xbb,
-	0xdf, 0x73, 0x91, 0x93, 0x28, 0xf5, 0x45, 0x54, 0xa7, 0xa9, 0x0f, 0x44, 0x42, 0x0a, 0x1c, 0xbe,
-	0xf4, 0xfc, 0xe7, 0x6e, 0x67, 0xbf, 0x07, 0xc9, 0xab, 0x3a, 0xc9, 0x38, 0x1e, 0xa3, 0x5b, 0x4b,
-	0xa7, 0xdb, 0x13, 0x3f, 0xc3, 0xf2, 0x30, 0x4f, 0x7d, 0x20, 0xce, 0xda, 0xe3, 0xf4, 0x5b, 0x98,
-	0xcb, 0x91, 0xe7, 0xa2, 0x8d, 0x9b, 0x9e, 0xdf, 0xea, 0x4d, 0xac, 0xac, 0xfb, 0x09, 0xc6, 0xd0,
-	0xea, 0x8b, 0x84, 0x6a, 0x2d, 0x95, 0x6a, 0x2f, 0xec, 0x8c, 0x2f, 0xef, 0x1c, 0x1d, 0xfb, 0x19,
-	0x7b, 0x9b, 0xcd, 0x81, 0xc9, 0x57, 0x73, 0xcb, 0xc7, 0xcf, 0xb0, 0x4f, 0xdd, 0x4f, 0x7b, 0x39,
-	0x5e, 0xea, 0xe0, 0xf5, 0x45, 0x42, 0xa5, 0x96, 0xa0, 0x92, 0x06, 0x9d, 0x25, 0x74, 0xd2, 0xa1,
-	0x9d, 0xb2, 0x37, 0x69, 0x64, 0x3e, 0xa2, 0xf6, 0xdf, 0x9d, 0xb5, 0x1e, 0x33, 0x22, 0x1c, 0xa2,
-	0x05, 0x60, 0xfd, 0x3e, 0xc1, 0xac, 0x29, 0x98, 0x49, 0x88, 0xd4, 0x36, 0xbf, 0x2f, 0x0c, 0xbd,
-	0x3d, 0x9b, 0x4d, 0xf7, 0xec, 0x18, 0x91, 0x69, 0x99, 0x90, 0x62, 0x22, 0xd1, 0x92, 0x0e, 0x95,
-	0xc6, 0x55, 0xf7, 0xcb, 0x00, 0x55, 0x98, 0x46, 0xa2, 0xa6, 0x27, 0x52, 0xee, 0x98, 0x8d, 0x79,
-	0x8b, 0xe2, 0x24, 0x98, 0x89, 0x67, 0xdd, 0x6b, 0x3e, 0x57, 0x4d, 0x3c, 0x4a, 0xbe, 0x9b, 0x92,
-	0x9e, 0x8d, 0x86, 0x7f, 0x90, 0x68, 0x4a, 0x1a, 0xd5, 0xd9, 0x45, 0xcd, 0x78, 0xa3, 0x9a, 0x78,
-	0xf4, 0xdc, 0x3c, 0xd2, 0xc4, 0x43, 0x1b, 0xd4, 0x29, 0xf7, 0x36, 0xf1, 0x50, 0x24, 0xdd, 0xc4,
-	0xa3, 0x76, 0x34, 0x9d, 0x5d, 0xa0, 0x64, 0x72, 0x1e, 0xa9, 0x3c, 0xa4, 0xe6, 0xed, 0xc9, 0xf0,
-	0x63, 0xb9, 0x64, 0xc8, 0x27, 0x26, 0x4d, 0x27, 0xe9, 0xb9, 0xc6, 0x4a, 0xba, 0x53, 0xc6, 0xbd,
-	0x1c, 0xda, 0x80, 0x99, 0x47, 0x38, 0xe4, 0x0c, 0xcc, 0xc6, 0x41, 0xe8, 0xbb, 0xf4, 0x49, 0x5a,
-	0xfa, 0xd7, 0x5a, 0xe8, 0x0a, 0x06, 0x9c, 0xfa, 0x7b, 0x84, 0x5e, 0xcd, 0x4c, 0x2f, 0x13, 0x2f,
-	0xc3, 0x3a, 0xc6, 0x4d, 0xa9, 0x67, 0xe9, 0x62, 0xfa, 0x16, 0x1f, 0x62, 0x1e, 0x04, 0xe9, 0xa8,
-	0x85, 0x28, 0x9e, 0x2c, 0xd7, 0x7e, 0xee, 0xc0, 0x20, 0x43, 0x4a, 0xfd, 0x46, 0x8e, 0xa9, 0x38,
-	0xe8, 0xbe, 0x70, 0x77, 0x23, 0x28, 0x5a, 0x55, 0x6a, 0xbf, 0xee, 0xc3, 0x08, 0xbb, 0x17, 0x39,
-	0x3d, 0xca, 0xa7, 0xc2, 0x29, 0x2e, 0xab, 0x63, 0xe9, 0x7e, 0xa2, 0xe3, 0xaa, 0xf3, 0xc0, 0xd9,
-	0x27, 0xf2, 0x7b, 0xf4, 0x6e, 0x4a, 0x98, 0x80, 0xd3, 0xf1, 0xa7, 0x63, 0x11, 0x58, 0xf9, 0x94,
-	0x32, 0x06, 0x29, 0x13, 0xf3, 0xa5, 0x75, 0xff, 0x62, 0x02, 0x1b, 0x7d, 0x2a, 0x9e, 0x62, 0x48,
-	0xe4, 0x24, 0x50, 0xc6, 0x9c, 0x4d, 0xb0, 0x69, 0x7e, 0x1d, 0x64, 0xc9, 0x60, 0x7b, 0x76, 0xfb,
-	0x34, 0x77, 0x68, 0xbd, 0xa7, 0x2e, 0x8d, 0xca, 0x26, 0x15, 0xbc, 0x12, 0xb1, 0x81, 0xd3, 0x09,
-	0x2d, 0xa4, 0x87, 0x13, 0xa6, 0x8b, 0xf1, 0x98, 0x2a, 0xa9, 0xc9, 0x24, 0x8b, 0x69, 0xc3, 0xcb,
-	0x08, 0x4f, 0x1c, 0x69, 0xe5, 0x49, 0x72, 0x19, 0x68, 0x59, 0x4a, 0x3e, 0x7f, 0x02, 0x76, 0x2e,
-	0xe4, 0xd6, 0x84, 0x33, 0xd7, 0xe9, 0x07, 0x9b, 0x21, 0x04, 0x19, 0x6e, 0xed, 0x7a, 0xae, 0x45,
-	0x1a, 0xb9, 0x1f, 0x53, 0xf9, 0xcf, 0x9c, 0x59, 0x2d, 0x95, 0xd8, 0x2d, 0xe5, 0xe2, 0x37, 0x3b,
-	0x27, 0xdb, 0x73, 0xfa, 0xc6, 0xc5, 0x1c, 0x3d, 0xf9, 0x66, 0x0f, 0x2a, 0x62, 0x26, 0xde, 0xee,
-	0x09, 0x27, 0xef, 0x80, 0xe6, 0xd8, 0x17, 0xd6, 0xdc, 0x5e, 0x8f, 0x68, 0xd0, 0x86, 0x6b, 0xb9,
-	0x94, 0xb4, 0x65, 0x82, 0xa0, 0xee, 0x29, 0x97, 0x39, 0x86, 0xb4, 0xe9, 0xff, 0x12, 0xca, 0xd1,
-	0xed, 0xf6, 0xd9, 0x16, 0x21, 0x5d, 0xa2, 0x47, 0xc9, 0x64, 0x6e, 0x28, 0x2b, 0x94, 0x6e, 0xe9,
-	0x5a, 0xda, 0x0c, 0x07, 0x8a, 0xdb, 0x04, 0xf7, 0xcb, 0x89, 0xc5, 0x11, 0x4f, 0x8b, 0x48, 0x9e,
-	0x61, 0x87, 0xe3, 0x8f, 0x7e, 0xce, 0x85, 0x50, 0x72, 0xb5, 0xcf, 0x4e, 0x48, 0x5e, 0x3e, 0xc7,
-	0x08, 0x59, 0x19, 0xcb, 0x7b, 0x16, 0xdf, 0x9a, 0xf8, 0x52, 0x9c, 0x75, 0x41, 0x9d, 0xe8, 0xa1,
-	0x4b, 0x32, 0xe3, 0x9c, 0x94, 0xe5, 0x52, 0xb3, 0xdf, 0xc9, 0xd5, 0xcd, 0x48, 0x57, 0xb7, 0x44,
-	0x8e, 0x29, 0x6b, 0x42, 0x4b, 0x77, 0xb5, 0x64, 0xaf, 0x47, 0x56, 0x07, 0x43, 0x1e, 0xac, 0x12,
-	0x88, 0x4a, 0x7b, 0x1d, 0xd5, 0xa0, 0xc4, 0xb6, 0x88, 0x29, 0xbc, 0x80, 0x7c, 0x9d, 0x60, 0xaa,
-	0xcc, 0xd0, 0x2e, 0x6a, 0x50, 0x62, 0xdb, 0xe5, 0x3c, 0x89, 0x36, 0x68, 0x6a, 0x53, 0x23, 0xc5,
-	0x1b, 0xca, 0x13, 0xcf, 0xf4, 0xa0, 0x0d, 0xa5, 0xec, 0x86, 0xd1, 0x8f, 0x60, 0xda, 0x18, 0xb5,
-	0x41, 0xfa, 0x07, 0x64, 0xc5, 0x74, 0xe8, 0x45, 0xfc, 0x39, 0x14, 0xd3, 0x72, 0x53, 0x45, 0xaf,
-	0x25, 0xb2, 0x13, 0x86, 0x49, 0x9e, 0xda, 0x33, 0xc9, 0xd5, 0x06, 0x4c, 0x99, 0xf2, 0x3d, 0xc9,
-	0xc3, 0x91, 0x91, 0x0c, 0xca, 0xf8, 0x24, 0x63, 0x0b, 0xa6, 0x8d, 0x39, 0x97, 0xe4, 0xcc, 0x64,
-	0x65, 0x64, 0x32, 0x52, 0xfc, 0x0a, 0x66, 0x53, 0x12, 0x0c, 0x45, 0x97, 0x98, 0x99, 0x09, 0x88,
-	0x32, 0x9c, 0x29, 0x4a, 0xe9, 0xb9, 0x6b, 0xa4, 0x0f, 0x4d, 0xcf, 0xf4, 0x36, 0x25, 0x63, 0x42,
-	0x2f, 0xb4, 0x4d, 0x37, 0xa1, 0x29, 0x99, 0x8d, 0xba, 0x09, 0x33, 0x92, 0xdd, 0xa4, 0x3c, 0xa5,
-	0x99, 0x4d, 0xc9, 0x5f, 0x93, 0x41, 0xf5, 0x14, 0xbd, 0xdd, 0x10, 0xfc, 0x5f, 0x4f, 0x68, 0x12,
-	0xf3, 0xcb, 0x34, 0x66, 0x3b, 0x31, 0xf6, 0x53, 0x79, 0xba, 0xdd, 0x6e, 0x67, 0x88, 0x41, 0x48,
-	0x7d, 0xbb, 0x4d, 0x20, 0xe9, 0x3d, 0xc0, 0xb8, 0x8a, 0x9b, 0xc5, 0x51, 0x13, 0xc8, 0x54, 0xf0,
-	0xfc, 0x04, 0xc6, 0x6a, 0x6a, 0xe3, 0x86, 0x46, 0x52, 0x37, 0x85, 0x7c, 0xb1, 0xd0, 0xbb, 0xef,
-	0x3d, 0x6f, 0x18, 0x2b, 0xed, 0xf6, 0xa9, 0x46, 0x91, 0x6a, 0x93, 0xd5, 0x62, 0xbc, 0x4b, 0x4e,
-	0x6d, 0x4a, 0x5d, 0x20, 0x6d, 0xb2, 0xe6, 0xb0, 0xf0, 0x2b, 0x74, 0x4a, 0xa3, 0x08, 0xb9, 0x19,
-	0x3a, 0xb8, 0xdc, 0x44, 0x86, 0x40, 0xbc, 0x4f, 0xd4, 0x47, 0xf5, 0x2c, 0xae, 0x6e, 0x86, 0x11,
-	0x31, 0xfe, 0x98, 0x3e, 0x16, 0x88, 0xb7, 0x0e, 0x45, 0x11, 0xe1, 0x92, 0xc5, 0x98, 0x8c, 0xe2,
-	0x31, 0x45, 0x6e, 0x66, 0xe9, 0x21, 0x30, 0x33, 0xe6, 0xad, 0x10, 0x8f, 0x68, 0x23, 0x2d, 0x47,
-	0x29, 0xa1, 0x6e, 0x32, 0x76, 0x03, 0x44, 0x71, 0x6b, 0xa4, 0x7d, 0x26, 0x11, 0xca, 0xa6, 0x74,
-	0xd9, 0x50, 0x23, 0x25, 0xab, 0x31, 0x35, 0xca, 0x8d, 0xf4, 0xc2, 0x31, 0x84, 0xbe, 0x29, 0xcd,
-	0x19, 0xeb, 0x38, 0xa1, 0x10, 0xe6, 0x32, 0x52, 0xbb, 0x4a, 0x69, 0xb5, 0x77, 0x0a, 0xda, 0xd2,
-	0xed, 0xd3, 0x80, 0xf2, 0x56, 0xb1, 0x8c, 0x58, 0x9b, 0x84, 0x42, 0x6f, 0x1b, 0xdc, 0xa6, 0x4d,
-	0x59, 0x53, 0x4b, 0xbd, 0xb2, 0xca, 0xa2, 0x5d, 0x98, 0x8f, 0xb9, 0x75, 0xeb, 0x2d, 0xf5, 0x22,
-	0x90, 0xba, 0x82, 0xbb, 0x30, 0xcf, 0xdf, 0x99, 0x9f, 0x33, 0xe1, 0x3d, 0x98, 0xcf, 0xca, 0x17,
-	0x8b, 0x6e, 0x9b, 0x5d, 0xb7, 0x8d, 0xd3, 0x93, 0x2e, 0xba, 0x5e, 0x4d, 0xba, 0x70, 0xc7, 0xd6,
-	0xfd, 0xac, 0x6c, 0xe5, 0x29, 0x4c, 0xe8, 0xb9, 0x62, 0x91, 0xca, 0x3a, 0x12, 0x99, 0x6b, 0x4b,
-	0x57, 0x52, 0x6a, 0xf9, 0xfe, 0xf8, 0x9c, 0x32, 0x7a, 0x59, 0xa1, 0xc6, 0x9e, 0x88, 0xe7, 0x62,
-	0x2d, 0x19, 0xd2, 0xda, 0xa0, 0xef, 0xc1, 0x64, 0xf4, 0x56, 0x90, 0x91, 0x30, 0x80, 0x65, 0xd8,
-	0x8b, 0x26, 0xa3, 0x57, 0x83, 0x67, 0x47, 0x5f, 0x15, 0xdc, 0x3e, 0x42, 0xbf, 0x92, 0xf0, 0x66,
-	0xd7, 0xc6, 0x70, 0x1a, 0xa6, 0xaf, 0xcc, 0xed, 0x59, 0x57, 0xa7, 0x49, 0x8f, 0x9b, 0x39, 0x7c,
-	0x93, 0x7a, 0xdc, 0x32, 0x43, 0x4c, 0x49, 0x09, 0x33, 0x85, 0x4e, 0x1b, 0xae, 0xf5, 0x0c, 0x38,
-	0x85, 0xee, 0x6a, 0x51, 0x1a, 0x7a, 0x87, 0xa6, 0xca, 0x7a, 0xf2, 0x61, 0x8a, 0xdb, 0x24, 0x79,
-	0x7c, 0x46, 0x08, 0x29, 0xf9, 0xe4, 0x23, 0x33, 0xf0, 0xd3, 0x57, 0x34, 0x9c, 0x35, 0xff, 0xc8,
-	0xd0, 0xb8, 0x23, 0xb8, 0xe3, 0x74, 0x9a, 0xb8, 0xc7, 0x75, 0xc5, 0x35, 0xfd, 0x92, 0x2e, 0x81,
-	0x48, 0xe5, 0xfc, 0x05, 0xae, 0x9d, 0xa4, 0x11, 0xef, 0x4d, 0x24, 0x6d, 0x5e, 0xaa, 0xcb, 0x3f,
-	0xff, 0xeb, 0x85, 0xdc, 0xcf, 0x7f, 0xb1, 0x90, 0xfb, 0xf7, 0xbf, 0x58, 0xc8, 0xfd, 0xe7, 0x5f,
-	0x2c, 0xe4, 0x7e, 0xb8, 0x78, 0xba, 0xe8, 0x85, 0xcd, 0xb6, 0x8b, 0x3b, 0xe1, 0x5d, 0x46, 0x6e,
-	0x90, 0xfe, 0xf7, 0xe0, 0xff, 0x04, 0x00, 0x00, 0xff, 0xff, 0x2c, 0x1a, 0x2f, 0xd9, 0x79, 0xd5,
-	0x00, 0x00,
+	0x76, 0x18, 0xac, 0x6e, 0x92, 0x22, 0x79, 0xf8, 0xd7, 0xba, 0xe2, 0x4f, 0xab, 0x45, 0xa9, 0xa5,
+	0xd2, 0x4a, 0xa3, 0xd1, 0xee, 0xea, 0x87, 0x9a, 0x99, 0x9d, 0xbf, 0x9d, 0xd9, 0x6e, 0x92, 0x12,
+	0x29, 0x51, 0x24, 0xa7, 0x9a, 0x6c, 0xce, 0xee, 0xce, 0x6e, 0x6f, 0xb1, 0xfb, 0x8a, 0xac, 0x4f,
+	0xcd, 0xaa, 0xde, 0xaa, 0xa2, 0x34, 0xb2, 0x61, 0x7f, 0xb1, 0x1d, 0xfb, 0x21, 0x41, 0x12, 0x1b,
+	0xb0, 0x83, 0x18, 0x7e, 0x70, 0x80, 0xe4, 0x25, 0x01, 0x02, 0xe4, 0x65, 0xe1, 0x97, 0x00, 0x81,
+	0x91, 0x00, 0xd9, 0x04, 0x30, 0x10, 0x20, 0x36, 0x02, 0xe4, 0x81, 0x8e, 0xf7, 0x91, 0x40, 0x02,
+	0x04, 0x41, 0xf2, 0xb0, 0x40, 0x80, 0xe0, 0xfe, 0xd6, 0xbd, 0x55, 0xb7, 0xaa, 0x49, 0x0d, 0x77,
+	0xf2, 0x22, 0xb1, 0xef, 0x3d, 0xe7, 0xdc, 0xff, 0x53, 0xe7, 0x9c, 0x7b, 0xee, 0x39, 0x70, 0x37,
+	0xc2, 0x5d, 0xdc, 0xf3, 0x83, 0xe8, 0x5e, 0x17, 0xef, 0x39, 0xed, 0xd7, 0xf7, 0xda, 0x5d, 0x17,
+	0x7b, 0xd1, 0xbd, 0x5e, 0xe0, 0x47, 0xfe, 0x3d, 0xe7, 0x30, 0xda, 0x0f, 0x71, 0xf0, 0xd2, 0x6d,
+	0xe3, 0xbb, 0xb4, 0x04, 0x0d, 0xd1, 0xff, 0x2a, 0xd3, 0x7b, 0xfe, 0x9e, 0xcf, 0x60, 0xc8, 0x5f,
+	0xac, 0xb2, 0x72, 0x79, 0xcf, 0xf7, 0xf7, 0xba, 0x98, 0x21, 0xef, 0x1e, 0x3e, 0xbf, 0x87, 0x0f,
+	0x7a, 0xd1, 0x6b, 0x5e, 0x59, 0x4d, 0x56, 0x46, 0xee, 0x01, 0x0e, 0x23, 0xe7, 0xa0, 0xc7, 0x01,
+	0xde, 0x96, 0x5d, 0x71, 0xa2, 0x88, 0xd4, 0x44, 0xae, 0xef, 0xdd, 0x7b, 0xf9, 0x40, 0xfd, 0xc9,
+	0x41, 0x6f, 0xe7, 0xf6, 0xba, 0x8d, 0x83, 0x28, 0x4c, 0x11, 0xe5, 0x90, 0xd1, 0xeb, 0x1e, 0x0e,
+	0xef, 0xe1, 0x97, 0xd8, 0x8b, 0xc4, 0x7f, 0x1c, 0xf4, 0xba, 0x19, 0x94, 0xfe, 0xcb, 0x41, 0xbe,
+	0x6d, 0x06, 0x79, 0x85, 0x77, 0xc9, 0x4c, 0x79, 0xf2, 0x8f, 0x3e, 0xe0, 0x81, 0xd3, 0xeb, 0xe1,
+	0x20, 0xfe, 0x23, 0xd5, 0xd7, 0xc3, 0xd0, 0xd9, 0xc3, 0xbc, 0x8f, 0x2f, 0x1f, 0xa8, 0x3f, 0x19,
+	0xa8, 0xf5, 0x7b, 0x55, 0x18, 0x5a, 0x26, 0x05, 0xe8, 0x7d, 0x18, 0xdc, 0x7a, 0xdd, 0xc3, 0xe5,
+	0xc2, 0xb5, 0xc2, 0xed, 0xc9, 0x85, 0x12, 0xab, 0xbf, 0xbb, 0xd1, 0xc3, 0x01, 0x9d, 0xb0, 0x3a,
+	0x3a, 0x3e, 0xaa, 0x4e, 0x92, 0x76, 0xbf, 0xe5, 0x1f, 0xb8, 0x11, 0x5d, 0x10, 0x9b, 0x62, 0xa0,
+	0x1d, 0x98, 0xb4, 0x71, 0xe8, 0x1f, 0x06, 0x6d, 0xbc, 0x82, 0x9d, 0x0e, 0x0e, 0xca, 0xc5, 0x6b,
+	0x85, 0xdb, 0x63, 0x0b, 0x33, 0x77, 0xd9, 0x90, 0xf5, 0xca, 0xfa, 0xec, 0xf1, 0x51, 0x15, 0x05,
+	0xbc, 0x2c, 0x26, 0xb6, 0x72, 0xce, 0x4e, 0x90, 0x41, 0x5f, 0xc0, 0xc4, 0x22, 0x0e, 0xa2, 0xda,
+	0x61, 0xb4, 0xef, 0x07, 0x6e, 0xf4, 0xba, 0x3c, 0x40, 0xe9, 0xce, 0x72, 0xba, 0x5a, 0x5d, 0x73,
+	0xa1, 0x3e, 0x7f, 0x7c, 0x54, 0x2d, 0x93, 0x35, 0x6b, 0x39, 0xa2, 0x54, 0x23, 0xaf, 0x13, 0x43,
+	0x9f, 0xc3, 0x78, 0x83, 0x6c, 0x86, 0xf6, 0x96, 0xff, 0x02, 0x7b, 0x61, 0x79, 0x50, 0xeb, 0xb4,
+	0x5a, 0xd5, 0x5c, 0xa8, 0x5f, 0x3e, 0x3e, 0xaa, 0xce, 0xd1, 0xbd, 0xd3, 0x6e, 0x45, 0xb4, 0x50,
+	0x23, 0xad, 0x51, 0x42, 0x3f, 0x81, 0xc9, 0xcd, 0xc0, 0x7f, 0xe9, 0x86, 0xae, 0xef, 0xd1, 0xa2,
+	0xf2, 0x10, 0xa5, 0x3d, 0xc7, 0x69, 0xeb, 0x95, 0xcd, 0x85, 0xfa, 0x95, 0xe3, 0xa3, 0xea, 0xa5,
+	0x9e, 0x28, 0x65, 0x0d, 0xe8, 0x33, 0xa3, 0xa3, 0xa0, 0x2d, 0x18, 0x5b, 0xec, 0x1e, 0x86, 0x11,
+	0x0e, 0xd6, 0x9d, 0x03, 0x5c, 0x3e, 0x4f, 0xc9, 0x4f, 0x8b, 0x79, 0x89, 0x6b, 0x9a, 0x0b, 0xf5,
+	0xca, 0xf1, 0x51, 0x75, 0xb6, 0xcd, 0x8a, 0x5a, 0x9e, 0x73, 0xa0, 0x4f, 0xb9, 0x4a, 0x06, 0x7d,
+	0x07, 0x06, 0xb7, 0x43, 0x1c, 0x94, 0x47, 0x28, 0xb9, 0x09, 0x4e, 0x8e, 0x14, 0x35, 0x17, 0xd8,
+	0xfa, 0x1f, 0x86, 0x38, 0xd0, 0xf0, 0x29, 0x02, 0x41, 0xb4, 0xfd, 0x2e, 0x2e, 0x8f, 0x6a, 0x88,
+	0xa4, 0xa8, 0xf9, 0x1e, 0x43, 0x0c, 0xfc, 0xae, 0xde, 0x30, 0x45, 0x40, 0xab, 0x30, 0x4a, 0x5a,
+	0x0e, 0x7b, 0x4e, 0x1b, 0x97, 0x81, 0x62, 0x97, 0x38, 0xb6, 0x2c, 0xaf, 0xcf, 0x1d, 0x1f, 0x55,
+	0x2f, 0x7a, 0xe2, 0xa7, 0x46, 0x25, 0xc6, 0x46, 0x9f, 0xc2, 0xf9, 0x06, 0x0e, 0x5e, 0xe2, 0xa0,
+	0x3c, 0x46, 0xe9, 0x4c, 0x89, 0x85, 0xa4, 0x85, 0xcd, 0x85, 0xfa, 0xf4, 0xf1, 0x51, 0xb5, 0x14,
+	0xd2, 0x5f, 0x1a, 0x0d, 0x8e, 0x46, 0x76, 0x9b, 0x8d, 0x5f, 0xe2, 0x20, 0xc4, 0x5b, 0x87, 0x9e,
+	0x87, 0xbb, 0xe5, 0x71, 0x6d, 0xb7, 0x69, 0x75, 0x62, 0xb7, 0x05, 0xac, 0xb0, 0x15, 0xd1, 0x52,
+	0x7d, 0xb7, 0x69, 0x08, 0x68, 0x1f, 0x4a, 0xec, 0xaf, 0x45, 0xdf, 0xf3, 0x70, 0x9b, 0x1c, 0xa9,
+	0xf2, 0x04, 0x6d, 0xe0, 0x12, 0x6f, 0x20, 0x59, 0xdd, 0x5c, 0xa8, 0x57, 0x8f, 0x8f, 0xaa, 0x97,
+	0x19, 0xed, 0x56, 0x5b, 0x56, 0x68, 0xcd, 0xa4, 0xa8, 0x92, 0x71, 0xd4, 0xda, 0x6d, 0x1c, 0x86,
+	0x36, 0xfe, 0xe9, 0x21, 0x0e, 0xa3, 0xf2, 0xa4, 0x36, 0x0e, 0xad, 0xae, 0xf9, 0x90, 0x8d, 0xc3,
+	0xa1, 0x85, 0xad, 0x80, 0x95, 0xea, 0xe3, 0xd0, 0x10, 0xd0, 0x26, 0x40, 0xad, 0xd7, 0x6b, 0xe0,
+	0x90, 0x6c, 0xc6, 0xf2, 0x14, 0x25, 0x7d, 0x91, 0x93, 0xde, 0xc1, 0xbb, 0xbc, 0xa2, 0xb9, 0x50,
+	0xbf, 0x74, 0x7c, 0x54, 0x9d, 0x71, 0x7a, 0xbd, 0x56, 0xc8, 0x8a, 0x34, 0xa2, 0x0a, 0x0d, 0x36,
+	0xef, 0x07, 0x7e, 0x84, 0xf9, 0x56, 0x2c, 0x97, 0x12, 0xf3, 0xae, 0xd4, 0x89, 0xfe, 0x06, 0xb4,
+	0xb0, 0xc5, 0xb7, 0x75, 0x72, 0xde, 0x15, 0x04, 0x72, 0x16, 0x97, 0x9c, 0xc8, 0xd9, 0x75, 0x42,
+	0xcc, 0xb7, 0xc7, 0x05, 0xed, 0x2c, 0xea, 0x95, 0xcd, 0x87, 0xec, 0x2c, 0x76, 0x78, 0x69, 0xcb,
+	0xb0, 0x5f, 0x12, 0xf4, 0xc8, 0x8c, 0xc4, 0x03, 0x2f, 0xa3, 0x3e, 0x33, 0xf2, 0x0a, 0xef, 0x9a,
+	0x67, 0x24, 0x06, 0x45, 0x2b, 0x30, 0xb2, 0x83, 0x77, 0x19, 0xe7, 0xb8, 0x48, 0xe9, 0x5d, 0x88,
+	0xe9, 0x31, 0x9e, 0xf1, 0x90, 0x9d, 0x0a, 0x42, 0x2d, 0xcd, 0x2d, 0x24, 0x36, 0xfa, 0xdd, 0x02,
+	0xcc, 0x89, 0x13, 0x8e, 0xa3, 0x57, 0x7e, 0xf0, 0xc2, 0xf5, 0xf6, 0x16, 0x7d, 0xef, 0xb9, 0xbb,
+	0x57, 0x9e, 0xa6, 0x94, 0xaf, 0x25, 0x98, 0x46, 0x02, 0xaa, 0xb9, 0x50, 0x7f, 0xeb, 0xf8, 0xa8,
+	0x7a, 0x43, 0x32, 0x10, 0x59, 0x4f, 0x36, 0xe4, 0x73, 0x77, 0x4f, 0x6b, 0x38, 0xab, 0x2d, 0xf4,
+	0x5b, 0x05, 0x98, 0xe5, 0xa3, 0xb3, 0x71, 0xdb, 0x0f, 0x3a, 0x71, 0x37, 0x66, 0x68, 0x37, 0xaa,
+	0xf2, 0xb4, 0x9a, 0x80, 0x9a, 0x0b, 0xf5, 0x5b, 0xc7, 0x47, 0x55, 0x8b, 0x4f, 0x5c, 0x2b, 0x10,
+	0xd5, 0xa6, 0x4e, 0x64, 0x34, 0x44, 0x76, 0x02, 0x61, 0xfe, 0x9b, 0x01, 0x7e, 0x8e, 0x03, 0xec,
+	0xb5, 0x71, 0x79, 0x56, 0xdb, 0x09, 0x7a, 0xa5, 0xe0, 0xca, 0xe4, 0x53, 0xd2, 0xea, 0xc9, 0x62,
+	0x7d, 0x27, 0xe8, 0x28, 0xe8, 0xa7, 0x80, 0xf8, 0x04, 0xd4, 0x0e, 0x3b, 0x6e, 0xc4, 0x07, 0x38,
+	0x47, 0x5b, 0xb9, 0xac, 0xcf, 0xb3, 0x02, 0xd0, 0x5c, 0xa8, 0x5b, 0xc7, 0x47, 0xd5, 0xab, 0x62,
+	0x8a, 0x1d, 0x52, 0x65, 0x1a, 0x98, 0x81, 0x38, 0xe1, 0xbc, 0x6b, 0x7e, 0xfb, 0x45, 0xb9, 0xac,
+	0x71, 0x5e, 0x52, 0x24, 0x58, 0x76, 0xd7, 0x6f, 0xbf, 0xd0, 0x39, 0x2f, 0xa9, 0x45, 0x11, 0x5c,
+	0xe4, 0xab, 0x64, 0xe3, 0x30, 0x0a, 0x5c, 0xca, 0x3b, 0xc2, 0xf2, 0x25, 0x4a, 0x67, 0x5e, 0xf0,
+	0xe0, 0x34, 0x44, 0xf3, 0x1d, 0xd6, 0x5b, 0xbe, 0x11, 0x5a, 0x81, 0x52, 0xa7, 0x35, 0x63, 0x22,
+	0x8f, 0x7e, 0x03, 0x66, 0x76, 0x5c, 0xaf, 0xe3, 0xbf, 0x0a, 0x97, 0x70, 0xf8, 0x22, 0xf2, 0x7b,
+	0x0d, 0x26, 0x14, 0x96, 0x2b, 0xb4, 0xdd, 0xab, 0x62, 0x9b, 0x9b, 0x60, 0x9a, 0x0f, 0xeb, 0x37,
+	0x8f, 0x8f, 0xaa, 0xd7, 0x5f, 0xb1, 0xca, 0x56, 0x87, 0xd5, 0xb6, 0xb8, 0x5c, 0xa9, 0x35, 0x6e,
+	0x6e, 0x85, 0x6c, 0x01, 0xbd, 0xa2, 0x7c, 0x59, 0xdb, 0x02, 0x7a, 0xa5, 0x60, 0x06, 0x89, 0x06,
+	0xf5, 0x2d, 0xa0, 0xa3, 0xa0, 0xc7, 0x30, 0x22, 0xd8, 0x43, 0x79, 0x5e, 0x3b, 0xba, 0xa2, 0xb8,
+	0xf9, 0x90, 0x49, 0x40, 0x82, 0xc5, 0xe8, 0x27, 0x57, 0x40, 0xa1, 0x35, 0x18, 0xa5, 0x3c, 0x92,
+	0xb2, 0xac, 0x2b, 0x94, 0x12, 0x12, 0x1b, 0x55, 0x94, 0x37, 0x1f, 0xd6, 0xcb, 0xc7, 0x47, 0xd5,
+	0x69, 0xc6, 0x65, 0x53, 0x8c, 0x2a, 0x26, 0x80, 0x1e, 0xc2, 0x40, 0xad, 0xd7, 0x2b, 0x5f, 0xa5,
+	0x74, 0xc6, 0x63, 0x3a, 0xcd, 0x87, 0xf5, 0x0b, 0xc7, 0x47, 0xd5, 0x09, 0xa7, 0xa7, 0x0f, 0x8b,
+	0x40, 0xa3, 0x5d, 0x28, 0x35, 0x3c, 0xff, 0xd5, 0xf3, 0xae, 0xf3, 0x02, 0x0b, 0xf6, 0x56, 0xcd,
+	0x66, 0x6f, 0xf4, 0x63, 0x15, 0x0a, 0x04, 0x23, 0x93, 0x4b, 0xd1, 0x23, 0x9f, 0xc5, 0xa7, 0x87,
+	0xbb, 0x38, 0xf0, 0x70, 0x84, 0x43, 0x3e, 0xda, 0x6b, 0xda, 0x67, 0x31, 0x59, 0xdd, 0x7c, 0xc8,
+	0x5a, 0x7a, 0x21, 0xcb, 0x4d, 0x63, 0x4f, 0x51, 0x45, 0x5d, 0xb8, 0x10, 0x97, 0x89, 0x4f, 0xcd,
+	0x75, 0xda, 0x54, 0x25, 0xd5, 0x54, 0xfc, 0xb9, 0xb9, 0x76, 0x7c, 0x54, 0x9d, 0x57, 0xda, 0x32,
+	0x7d, 0x72, 0xd2, 0x84, 0xd1, 0x53, 0x18, 0x5d, 0xf5, 0xc2, 0xc8, 0xe9, 0x76, 0x71, 0x50, 0xb6,
+	0xb4, 0xe5, 0x93, 0xe5, 0xcd, 0x07, 0x8c, 0x89, 0xbb, 0xa2, 0x40, 0x5f, 0x3d, 0x09, 0x87, 0x3a,
+	0x30, 0xa5, 0x7e, 0x73, 0xc8, 0x79, 0xb9, 0x41, 0x49, 0x96, 0x0d, 0x1f, 0x31, 0x72, 0x52, 0x1e,
+	0xd4, 0xaf, 0x1e, 0x1f, 0x55, 0x2b, 0xda, 0x57, 0x2c, 0x79, 0x44, 0x92, 0x24, 0xd1, 0x6f, 0x13,
+	0x1e, 0x5d, 0x7b, 0xb6, 0xb6, 0xda, 0xd9, 0xe4, 0x45, 0x54, 0xe8, 0x24, 0xf2, 0xfc, 0x37, 0x74,
+	0x1e, 0x6d, 0x04, 0x6a, 0x3e, 0x60, 0x5f, 0x8a, 0xd0, 0x39, 0xe8, 0xb6, 0xdc, 0x8e, 0x3c, 0x97,
+	0xad, 0x1e, 0x07, 0x48, 0x30, 0x69, 0x23, 0x11, 0xf4, 0x23, 0x98, 0x94, 0x35, 0x6c, 0xc7, 0xdd,
+	0xcc, 0xde, 0x71, 0x74, 0x90, 0x4a, 0x7b, 0xe9, 0x0d, 0x97, 0x20, 0x46, 0x4e, 0x15, 0x11, 0x58,
+	0x1f, 0x07, 0xfe, 0x61, 0xaf, 0x7c, 0x4b, 0x5b, 0x16, 0x59, 0xde, 0x7c, 0xc0, 0x4e, 0x15, 0x91,
+	0x75, 0x5b, 0x7b, 0xa4, 0x44, 0x5f, 0x17, 0x09, 0x48, 0xbe, 0xd3, 0xdb, 0xab, 0x9c, 0xcb, 0xbf,
+	0xa5, 0x1d, 0x76, 0x51, 0x2c, 0x96, 0xf8, 0xd0, 0x35, 0x31, 0x74, 0x89, 0x8d, 0x1c, 0x98, 0xdc,
+	0x78, 0x11, 0x39, 0xab, 0x07, 0x44, 0x6b, 0xb3, 0x0f, 0xbb, 0xb8, 0x7c, 0x5b, 0x63, 0x4c, 0x7a,
+	0xa5, 0x58, 0x5f, 0xff, 0x45, 0xe4, 0xb4, 0x5c, 0x5a, 0xdc, 0x0a, 0x0e, 0x13, 0x02, 0x76, 0x82,
+	0x20, 0xe1, 0x7d, 0xa4, 0xa4, 0x16, 0x86, 0xee, 0x9e, 0x77, 0x80, 0xbd, 0xa8, 0xfc, 0x76, 0xaa,
+	0x89, 0xb8, 0xb2, 0xf9, 0x80, 0xf1, 0x3e, 0xda, 0x84, 0x23, 0x8b, 0xd3, 0x2d, 0xc4, 0x28, 0xa8,
+	0x01, 0x63, 0xab, 0x5e, 0x84, 0xf7, 0x98, 0xc2, 0x58, 0xbe, 0xa3, 0x29, 0x25, 0x4a, 0x4d, 0xf3,
+	0x01, 0x13, 0x85, 0xdc, 0xb8, 0x48, 0xd7, 0x49, 0x14, 0x58, 0xa2, 0xe9, 0xec, 0x38, 0x51, 0x7b,
+	0x9f, 0x28, 0x58, 0x87, 0x61, 0xf9, 0x9b, 0x1a, 0x51, 0xa5, 0xa6, 0xf9, 0x80, 0x69, 0x3a, 0xaf,
+	0x48, 0x51, 0x2b, 0xa4, 0x65, 0x3a, 0x55, 0x05, 0x18, 0xfd, 0x26, 0xcc, 0x12, 0x1d, 0xb3, 0x8b,
+	0xc3, 0x90, 0x7c, 0xc3, 0xb1, 0x17, 0xb9, 0x6d, 0xd6, 0xeb, 0x6f, 0xd1, 0x06, 0xae, 0xf0, 0x06,
+	0xcc, 0x40, 0xec, 0x3b, 0xb4, 0xcf, 0xeb, 0xa8, 0xb6, 0x19, 0x57, 0xea, 0xdb, 0x3c, 0x83, 0x00,
+	0xc0, 0x88, 0xd0, 0x75, 0x9f, 0x0c, 0x8e, 0x0c, 0x97, 0x46, 0xac, 0x3f, 0x2d, 0xc0, 0x10, 0xed,
+	0x21, 0xfa, 0x14, 0x86, 0x9e, 0xba, 0x5e, 0x27, 0x2c, 0x17, 0xae, 0x0d, 0x28, 0xfa, 0x10, 0xad,
+	0x24, 0x15, 0xf5, 0xb9, 0x9f, 0x1f, 0x55, 0xcf, 0x1d, 0x1f, 0x55, 0xa7, 0x5e, 0x10, 0x30, 0x45,
+	0x1d, 0x67, 0x78, 0x68, 0x1b, 0x2e, 0xd6, 0xba, 0x5d, 0xff, 0xd5, 0xa6, 0x13, 0x44, 0xae, 0xd3,
+	0x6d, 0x1c, 0x52, 0x01, 0x9e, 0x2a, 0xe5, 0x23, 0xf5, 0x1b, 0xc7, 0x47, 0xd5, 0xaa, 0x43, 0xaa,
+	0x5b, 0x3d, 0x56, 0xdf, 0x0a, 0x19, 0x80, 0x42, 0xc8, 0x84, 0x6f, 0xfd, 0xec, 0x3c, 0x94, 0x56,
+	0xfc, 0x30, 0x22, 0x5a, 0xb4, 0x54, 0x07, 0x6e, 0xc0, 0x79, 0x52, 0xb6, 0xba, 0x44, 0xed, 0x06,
+	0xa3, 0xf5, 0xb1, 0xe3, 0xa3, 0xea, 0xf0, 0xbe, 0x1f, 0x46, 0x2d, 0xb7, 0x63, 0xf3, 0x2a, 0xf4,
+	0x36, 0x8c, 0xac, 0xfb, 0x1d, 0x4c, 0x55, 0xd5, 0x22, 0x05, 0x9b, 0x38, 0x3e, 0xaa, 0x8e, 0x7a,
+	0x7e, 0x07, 0x53, 0x8d, 0xd4, 0x96, 0xd5, 0xa8, 0xc9, 0x35, 0xc9, 0x01, 0x0a, 0x56, 0x3f, 0x3e,
+	0xaa, 0x0e, 0x12, 0xd5, 0xf1, 0x97, 0x47, 0xd5, 0xf7, 0xf6, 0xdc, 0x68, 0xff, 0x70, 0xf7, 0x6e,
+	0xdb, 0x3f, 0xb8, 0xb7, 0x17, 0x38, 0x2f, 0x5d, 0x66, 0xc8, 0x71, 0xba, 0xf7, 0x62, 0x73, 0x4f,
+	0xcf, 0xe5, 0x56, 0x96, 0xc6, 0xeb, 0x30, 0xc2, 0x07, 0x84, 0x12, 0x57, 0x34, 0x77, 0x60, 0xba,
+	0xd6, 0xe9, 0xb8, 0x0c, 0x63, 0x33, 0x70, 0xbd, 0xb6, 0xdb, 0x73, 0xba, 0x44, 0xe9, 0x1f, 0xb8,
+	0x3d, 0xca, 0x27, 0x45, 0xd6, 0xb7, 0x7a, 0x12, 0x40, 0x99, 0x14, 0x23, 0x01, 0xf4, 0x10, 0x46,
+	0x96, 0xd6, 0x1b, 0x54, 0x0d, 0x2d, 0x0f, 0x51, 0x62, 0xf4, 0xc0, 0x77, 0xbc, 0x90, 0x0e, 0x4d,
+	0x25, 0x20, 0x01, 0xd1, 0x7b, 0x30, 0xbe, 0x79, 0xb8, 0xdb, 0x75, 0xdb, 0x5b, 0x6b, 0x8d, 0xa7,
+	0xf8, 0x35, 0xd5, 0xdf, 0xc7, 0x99, 0xb8, 0xd6, 0xa3, 0xe5, 0xad, 0xa8, 0x1b, 0xb6, 0x5e, 0xe0,
+	0xd7, 0xb6, 0x06, 0x17, 0xe3, 0x35, 0x1a, 0x2b, 0x04, 0x6f, 0x38, 0x85, 0x17, 0x86, 0xfb, 0x2a,
+	0x1e, 0x83, 0x43, 0xf7, 0x00, 0x98, 0x56, 0x54, 0xeb, 0x74, 0x98, 0x7a, 0x3f, 0x5a, 0x9f, 0x3a,
+	0x3e, 0xaa, 0x8e, 0x71, 0x3d, 0xca, 0xe9, 0x74, 0x02, 0x5b, 0x01, 0x41, 0x8b, 0x30, 0x62, 0xfb,
+	0x6c, 0x82, 0xb9, 0x52, 0x3f, 0x25, 0x95, 0x7a, 0x56, 0xcc, 0xcd, 0x38, 0xfc, 0x97, 0x3a, 0x4a,
+	0x01, 0x81, 0xaa, 0x30, 0xbc, 0xee, 0x2f, 0x3a, 0xed, 0x7d, 0xa6, 0xda, 0x8f, 0xd4, 0x87, 0x8e,
+	0x8f, 0xaa, 0x85, 0x6f, 0xdb, 0xa2, 0x14, 0xbd, 0x84, 0xb1, 0x78, 0xa1, 0xc2, 0xf2, 0x18, 0x9d,
+	0xbe, 0x2d, 0x72, 0x8a, 0x43, 0x5a, 0xdc, 0x22, 0x4b, 0xaf, 0xcc, 0xe0, 0x57, 0xd8, 0x05, 0x6a,
+	0x43, 0xa8, 0x0b, 0x57, 0xb6, 0xc9, 0xc7, 0x75, 0xb7, 0x8b, 0xe3, 0xe2, 0x5a, 0x18, 0xe2, 0x80,
+	0xd0, 0x5a, 0x5d, 0xa2, 0x9a, 0xff, 0x28, 0x57, 0x39, 0xe2, 0x9e, 0x10, 0x3e, 0xc8, 0x40, 0x5a,
+	0x6e, 0x47, 0x19, 0x71, 0x3e, 0x31, 0xeb, 0xff, 0x14, 0x00, 0x6d, 0xf4, 0xb0, 0xd7, 0x68, 0xac,
+	0x90, 0xa3, 0x23, 0x4e, 0xce, 0xb7, 0x60, 0x94, 0xad, 0x11, 0x59, 0xc8, 0x22, 0x5d, 0xc8, 0xc9,
+	0xe3, 0xa3, 0x2a, 0xf0, 0x85, 0x24, 0x8b, 0x18, 0x03, 0xa0, 0x9b, 0x30, 0xb0, 0xb5, 0xb5, 0x46,
+	0x8f, 0xc5, 0x40, 0xfd, 0xe2, 0xf1, 0x51, 0x75, 0x20, 0x8a, 0xba, 0xbf, 0x3c, 0xaa, 0x8e, 0x2c,
+	0x1d, 0x32, 0x46, 0x69, 0x93, 0x7a, 0x74, 0x13, 0x86, 0x85, 0x68, 0x33, 0x18, 0x9f, 0x47, 0x2e,
+	0xb3, 0xd8, 0xa2, 0x0e, 0x7d, 0x93, 0x1b, 0x7a, 0x86, 0x4c, 0x86, 0x9e, 0x11, 0x72, 0xe8, 0xc8,
+	0xc7, 0x8f, 0x1b, 0x77, 0xee, 0xc2, 0x10, 0x5b, 0x9f, 0xf3, 0x94, 0x1f, 0x25, 0xac, 0x3b, 0xa3,
+	0xc7, 0x47, 0xd5, 0x21, 0xba, 0x4e, 0x36, 0x03, 0x7b, 0x32, 0x38, 0x52, 0x28, 0x15, 0xed, 0x11,
+	0x82, 0x4b, 0x4e, 0x80, 0xf5, 0x4d, 0x18, 0x53, 0x86, 0x8f, 0xe6, 0x61, 0x90, 0xfc, 0x4f, 0xf9,
+	0xc5, 0x38, 0x6b, 0xac, 0x4d, 0xa6, 0x85, 0x96, 0x5a, 0x3f, 0x9b, 0x80, 0x12, 0xc1, 0xd4, 0x98,
+	0x8c, 0x36, 0x55, 0x85, 0x7e, 0x53, 0x75, 0x1b, 0x64, 0xdb, 0x9c, 0xdb, 0x8c, 0x1f, 0x1f, 0x55,
+	0x47, 0x0e, 0x79, 0x59, 0xdc, 0x33, 0xd4, 0x80, 0xe1, 0xe5, 0x2f, 0x7b, 0x6e, 0x80, 0x43, 0x6e,
+	0x59, 0xac, 0xdc, 0x65, 0xb6, 0xe5, 0xbb, 0xc2, 0xb6, 0x7c, 0x77, 0x4b, 0xd8, 0x96, 0xeb, 0x57,
+	0x38, 0xd7, 0xbd, 0x80, 0x19, 0x4a, 0xbc, 0x01, 0x7e, 0xff, 0xaf, 0xab, 0x05, 0x5b, 0x50, 0x42,
+	0xdf, 0x82, 0xf3, 0x8f, 0xfc, 0xe0, 0xc0, 0x89, 0xf8, 0x0a, 0x50, 0xb3, 0xd3, 0x73, 0x5a, 0xa2,
+	0xec, 0x19, 0x0e, 0x83, 0x1e, 0xc1, 0xa4, 0xed, 0x1f, 0x46, 0x78, 0xcb, 0x17, 0xeb, 0x36, 0x44,
+	0xb1, 0xe8, 0xf7, 0x3d, 0x20, 0x35, 0xad, 0xc8, 0x4f, 0x0b, 0x9d, 0x76, 0x02, 0x0b, 0x2d, 0xc3,
+	0xa4, 0x66, 0xa7, 0x61, 0xab, 0x35, 0xca, 0x75, 0x58, 0xcd, 0xba, 0xa3, 0xb2, 0xa4, 0x04, 0x12,
+	0x5a, 0x37, 0x09, 0xc9, 0xc3, 0xb4, 0x47, 0x7d, 0x05, 0x61, 0x93, 0x18, 0x8c, 0x61, 0x8a, 0x77,
+	0x54, 0x6a, 0x45, 0x23, 0xdc, 0xba, 0xc3, 0xec, 0xcb, 0x89, 0xda, 0xfa, 0x0d, 0x3e, 0xcb, 0x97,
+	0xe5, 0xd8, 0xd3, 0x7a, 0x92, 0x9d, 0xa4, 0x49, 0x98, 0xb0, 0xfc, 0xc0, 0x8c, 0xd2, 0xde, 0x32,
+	0x9b, 0xa1, 0xf8, 0xc0, 0xa8, 0xec, 0x49, 0x7e, 0x6a, 0xd6, 0x60, 0x68, 0x3b, 0x74, 0xf6, 0x18,
+	0x73, 0x9a, 0x5c, 0xb8, 0xce, 0x7b, 0x94, 0xdc, 0x7d, 0xd4, 0xcc, 0x4c, 0x01, 0xe9, 0xb9, 0x9b,
+	0xa2, 0x36, 0x74, 0xf5, 0xa3, 0x4b, 0xeb, 0xd0, 0x67, 0x00, 0xbc, 0x57, 0x44, 0xd1, 0x1a, 0xe3,
+	0xd2, 0xa0, 0x36, 0xc8, 0x5a, 0xaf, 0x57, 0xbf, 0xca, 0xc7, 0x37, 0x2b, 0xc7, 0xa7, 0xa9, 0x5e,
+	0xb6, 0x42, 0x04, 0x7d, 0x0a, 0xe3, 0x94, 0x77, 0x89, 0x15, 0x1d, 0xa7, 0x2b, 0x4a, 0x2d, 0xd1,
+	0x94, 0x1d, 0x19, 0xd6, 0x53, 0x43, 0x40, 0xbf, 0x09, 0x33, 0x9c, 0x5c, 0x42, 0xeb, 0x9d, 0xe0,
+	0x5a, 0xbe, 0xd6, 0x3d, 0x1d, 0xa6, 0x7e, 0x87, 0xf7, 0xd4, 0x92, 0x3d, 0xcd, 0xd4, 0x83, 0x6d,
+	0x73, 0x33, 0x68, 0x15, 0xa6, 0xb6, 0x43, 0xac, 0x8d, 0x61, 0x92, 0x7e, 0x08, 0xa8, 0x02, 0x77,
+	0x18, 0xe2, 0x56, 0xd6, 0x38, 0x92, 0x78, 0xc8, 0x06, 0xb4, 0x14, 0xf8, 0xbd, 0xc4, 0x1e, 0x9f,
+	0xa2, 0x33, 0x42, 0xed, 0x11, 0x9d, 0xc0, 0xef, 0xb5, 0xb2, 0x37, 0xba, 0x01, 0x1b, 0xfd, 0x18,
+	0x66, 0x63, 0xb3, 0xe9, 0x92, 0xeb, 0xec, 0x79, 0x7e, 0x18, 0xb9, 0xed, 0xd5, 0x25, 0x6a, 0x81,
+	0xe4, 0xfc, 0x3f, 0x36, 0xbb, 0xb6, 0x3a, 0x12, 0x44, 0xe7, 0xff, 0x19, 0x54, 0xd0, 0x0f, 0x61,
+	0x82, 0xb7, 0xc5, 0xcd, 0xf4, 0x17, 0xf2, 0x37, 0x9a, 0x04, 0xe6, 0x26, 0x73, 0xf1, 0x93, 0xc9,
+	0x48, 0x3a, 0x2d, 0xf4, 0x05, 0x8c, 0x3d, 0x7b, 0x54, 0xb3, 0x71, 0xd8, 0xf3, 0xbd, 0x10, 0x73,
+	0xb3, 0xe3, 0x55, 0x4e, 0xfa, 0xd9, 0xa3, 0x9a, 0x22, 0x70, 0x62, 0x01, 0xc5, 0x24, 0xe4, 0x83,
+	0xe7, 0x4e, 0x2b, 0xe0, 0x25, 0xca, 0x28, 0x54, 0x72, 0xa8, 0x02, 0x23, 0x8d, 0xc6, 0xca, 0x9a,
+	0xbf, 0xe7, 0x32, 0x0b, 0xe4, 0xa8, 0x2d, 0x7f, 0xa3, 0x5d, 0x98, 0x51, 0x2e, 0xd2, 0xa8, 0xa8,
+	0x8d, 0xa9, 0x3e, 0xc1, 0x0c, 0x8a, 0xdf, 0x96, 0x37, 0x81, 0x77, 0xd5, 0xfb, 0xb6, 0x97, 0x0f,
+	0xee, 0xd6, 0xe2, 0x9f, 0x0d, 0x81, 0x64, 0x4f, 0x3b, 0x86, 0x52, 0xeb, 0x73, 0x18, 0x95, 0xc7,
+	0x0e, 0x0d, 0xc3, 0x40, 0xad, 0xdb, 0x2d, 0x9d, 0x23, 0x7f, 0x34, 0x1a, 0x2b, 0xa5, 0x02, 0x9a,
+	0x04, 0x88, 0x79, 0x4d, 0xa9, 0x88, 0xc6, 0x63, 0xab, 0x4b, 0x69, 0x80, 0xc2, 0xf7, 0x7a, 0xa5,
+	0x41, 0x84, 0x92, 0xe6, 0x9e, 0xd2, 0x90, 0xb5, 0x0d, 0xa3, 0x72, 0x22, 0xd1, 0x14, 0x8c, 0x6d,
+	0xaf, 0x37, 0x36, 0x97, 0x17, 0x57, 0x1f, 0xad, 0x2e, 0x2f, 0x95, 0xce, 0xa1, 0x2b, 0x70, 0x69,
+	0xab, 0xb1, 0xd2, 0x5a, 0xaa, 0xb7, 0xd6, 0x36, 0x16, 0x6b, 0x6b, 0xad, 0x4d, 0x7b, 0xe3, 0xf3,
+	0xef, 0xb7, 0xb6, 0xb6, 0xd7, 0xd7, 0x97, 0xd7, 0x4a, 0x05, 0x54, 0x86, 0x69, 0x52, 0xfd, 0x74,
+	0xbb, 0xbe, 0xac, 0x02, 0x94, 0x8a, 0xd6, 0x7f, 0x2e, 0xa4, 0x38, 0x1d, 0x5a, 0x80, 0x31, 0xae,
+	0xde, 0xd2, 0xd5, 0x67, 0x02, 0x72, 0xe9, 0xf8, 0xa8, 0x3a, 0x2e, 0x54, 0x63, 0xba, 0xb0, 0x2a,
+	0x10, 0xf9, 0x78, 0x6d, 0x92, 0x25, 0x6c, 0xfb, 0x5d, 0xf5, 0xe3, 0xd5, 0xe3, 0x65, 0xb6, 0xac,
+	0x45, 0x0b, 0xca, 0x67, 0x8e, 0x49, 0xcb, 0x54, 0x22, 0x13, 0x9f, 0x39, 0x95, 0xe5, 0xc9, 0x0f,
+	0xde, 0x82, 0x62, 0x9d, 0x1a, 0x8c, 0x71, 0x0c, 0x2c, 0x56, 0xc2, 0x59, 0x87, 0x19, 0x4c, 0x04,
+	0x7d, 0x94, 0x32, 0xa6, 0xb1, 0x11, 0x52, 0x2e, 0x99, 0xe0, 0x15, 0x29, 0x3b, 0x59, 0x15, 0x86,
+	0xd8, 0xee, 0x62, 0x83, 0xa4, 0x52, 0x44, 0x97, 0x14, 0xd8, 0xac, 0xdc, 0xfa, 0xfb, 0x03, 0x2a,
+	0x43, 0x25, 0x52, 0x83, 0x32, 0x89, 0x54, 0x6a, 0xa0, 0x93, 0x47, 0x4b, 0x89, 0x80, 0xc0, 0x35,
+	0xfc, 0xd5, 0x25, 0x4e, 0x91, 0x0a, 0x08, 0xc2, 0x5e, 0xec, 0x76, 0xec, 0x18, 0x80, 0x48, 0xc3,
+	0x4c, 0x5a, 0xa0, 0xd2, 0xf0, 0x40, 0x2c, 0x0d, 0x73, 0x79, 0x82, 0x49, 0xc3, 0x31, 0x08, 0x59,
+	0x48, 0xf5, 0xb6, 0x6d, 0x30, 0x5e, 0x48, 0xf5, 0x5e, 0x4d, 0xbf, 0x4b, 0xfb, 0x10, 0xa0, 0xb6,
+	0xd3, 0xa0, 0xb2, 0xa0, 0xbd, 0xce, 0x3f, 0xea, 0xf4, 0xf8, 0x39, 0xaf, 0x42, 0x2e, 0x4d, 0x06,
+	0xaa, 0xd8, 0xac, 0x40, 0xa3, 0x3a, 0x4c, 0xd4, 0x7e, 0xed, 0x30, 0xc0, 0xab, 0x1d, 0x72, 0x82,
+	0x23, 0xa6, 0x1f, 0x8c, 0xf2, 0x9b, 0x1a, 0x52, 0xd1, 0x72, 0x79, 0x8d, 0x42, 0x40, 0x47, 0x41,
+	0x1b, 0x70, 0xe1, 0xf1, 0xa2, 0x30, 0xaf, 0xd4, 0xda, 0x6d, 0xff, 0xd0, 0x8b, 0xf8, 0x97, 0xfc,
+	0xfa, 0xf1, 0x51, 0xf5, 0xca, 0x5e, 0x3b, 0xb6, 0xd0, 0x38, 0xac, 0x5a, 0xfd, 0x94, 0xa7, 0x70,
+	0xad, 0x2e, 0x4c, 0x3e, 0xc6, 0x11, 0xd9, 0x4a, 0x42, 0x2c, 0xcb, 0x5f, 0x93, 0x8f, 0x61, 0x6c,
+	0xc7, 0x8d, 0xf6, 0x1b, 0xb8, 0x1d, 0xe0, 0x48, 0x68, 0x9f, 0x4c, 0x45, 0x77, 0xa3, 0xfd, 0x56,
+	0xc8, 0xca, 0x55, 0x06, 0xa4, 0x80, 0x5b, 0xcb, 0x30, 0xc5, 0x5b, 0x93, 0x52, 0xe0, 0x82, 0x4e,
+	0xb0, 0x40, 0x09, 0xd2, 0x55, 0x50, 0x09, 0xea, 0x64, 0x7e, 0x56, 0x84, 0x99, 0xc5, 0x7d, 0xc7,
+	0xdb, 0xc3, 0x9b, 0x4e, 0x18, 0xbe, 0xf2, 0x83, 0x8e, 0xd2, 0x79, 0x2a, 0x02, 0xa7, 0x3a, 0x4f,
+	0x65, 0xde, 0x05, 0x18, 0xdb, 0xe8, 0x76, 0x04, 0x0e, 0x17, 0xcf, 0x69, 0x5b, 0x7e, 0xb7, 0xd3,
+	0xea, 0x09, 0x5a, 0x2a, 0x10, 0xc1, 0x59, 0xc7, 0xaf, 0x24, 0xce, 0x40, 0x8c, 0xe3, 0xe1, 0x57,
+	0x0a, 0x8e, 0x02, 0x84, 0x96, 0xe1, 0x42, 0x03, 0xb7, 0x7d, 0xaf, 0xf3, 0xc8, 0x69, 0x47, 0x7e,
+	0xc0, 0xae, 0x7c, 0x06, 0x63, 0x09, 0x26, 0xa4, 0x95, 0xad, 0xe7, 0xb4, 0x96, 0xdd, 0xf4, 0xd8,
+	0x69, 0x0c, 0xb4, 0x41, 0x2f, 0x8c, 0xa8, 0xc7, 0x00, 0x97, 0xe9, 0x6f, 0xde, 0x95, 0x2e, 0x04,
+	0x8b, 0x01, 0xa6, 0x9b, 0xc2, 0xe9, 0x4a, 0xad, 0x44, 0x7e, 0x10, 0x28, 0x73, 0x11, 0x90, 0xb6,
+	0x24, 0x62, 0x6d, 0xc3, 0xc4, 0x66, 0xf7, 0x70, 0xcf, 0xf5, 0x08, 0x1b, 0x68, 0xe0, 0x9f, 0xa2,
+	0x25, 0x80, 0xb8, 0x80, 0x5b, 0x26, 0x84, 0x4d, 0x2e, 0xae, 0x68, 0x3e, 0xe4, 0x07, 0x89, 0x96,
+	0x50, 0xd1, 0xcd, 0x56, 0xf0, 0xac, 0xbf, 0x33, 0x00, 0x88, 0x2f, 0x00, 0xe5, 0xf5, 0x0d, 0x1c,
+	0x11, 0x36, 0x3c, 0x0b, 0x45, 0x69, 0x40, 0x38, 0x7f, 0x7c, 0x54, 0x2d, 0xba, 0x1d, 0xbb, 0xb8,
+	0xba, 0x84, 0xde, 0x81, 0x21, 0x0a, 0x46, 0xe7, 0x7f, 0x52, 0xb6, 0xa7, 0x52, 0x60, 0x9c, 0x83,
+	0x7e, 0x83, 0x6c, 0x06, 0x8c, 0xde, 0x85, 0xd1, 0x25, 0xdc, 0xc5, 0x7b, 0x4e, 0xe4, 0x8b, 0xd3,
+	0xcd, 0x54, 0x72, 0x51, 0xa8, 0xec, 0xb9, 0x18, 0x92, 0xc8, 0xed, 0x36, 0x76, 0x42, 0xdf, 0x53,
+	0xe5, 0xf6, 0x80, 0x96, 0xa8, 0x72, 0x3b, 0x83, 0x41, 0x7f, 0x54, 0x80, 0xb1, 0x9a, 0xe7, 0x71,
+	0x55, 0x37, 0xe4, 0xb3, 0x3e, 0x73, 0x57, 0x7a, 0x62, 0xac, 0x39, 0xbb, 0xb8, 0xdb, 0x74, 0xba,
+	0x87, 0x38, 0xac, 0x7f, 0x41, 0x44, 0xa9, 0xff, 0x72, 0x54, 0xfd, 0xe8, 0x14, 0xca, 0x6b, 0xec,
+	0xd3, 0xb1, 0x15, 0x38, 0x6e, 0x14, 0xd2, 0xdb, 0xd4, 0xb8, 0x41, 0xf5, 0xdc, 0x28, 0xfd, 0x40,
+	0x6f, 0xab, 0xca, 0x1a, 0xe7, 0xc5, 0x09, 0x2d, 0x9a, 0xeb, 0x69, 0xd6, 0x0d, 0xf9, 0x25, 0x5c,
+	0x5d, 0xca, 0x5a, 0x02, 0x6b, 0x11, 0xe6, 0x1f, 0xe3, 0xc8, 0xc6, 0x21, 0x8e, 0xc4, 0xa6, 0xa5,
+	0x5b, 0x2e, 0xb6, 0xff, 0x0c, 0xd3, 0xdf, 0x12, 0x99, 0xae, 0x07, 0xdb, 0xa8, 0xa2, 0xc6, 0xfa,
+	0xdb, 0x05, 0xa8, 0x2e, 0x06, 0x98, 0x49, 0x22, 0x19, 0x84, 0xf2, 0x99, 0xc9, 0x3c, 0x77, 0x4e,
+	0x29, 0xc6, 0xb5, 0x64, 0x96, 0xb8, 0x03, 0xca, 0xc9, 0x94, 0x63, 0xeb, 0x39, 0xcc, 0xd8, 0xd8,
+	0xc3, 0xaf, 0x88, 0xaa, 0xae, 0xe9, 0x97, 0x55, 0x18, 0x62, 0x27, 0x2f, 0x35, 0x04, 0x56, 0x7e,
+	0x3a, 0x5d, 0xdd, 0xfa, 0x67, 0x45, 0x28, 0xb1, 0xe1, 0xd6, 0xfd, 0xe8, 0x64, 0xe3, 0xe3, 0x23,
+	0x28, 0xf6, 0x51, 0xef, 0x6f, 0xc5, 0xb3, 0x3d, 0x10, 0x0b, 0x07, 0xb4, 0xab, 0xe4, 0x1b, 0x27,
+	0x2a, 0xc9, 0x80, 0xd8, 0x2e, 0x60, 0xe6, 0xad, 0x94, 0x8e, 0x8e, 0x7e, 0xaf, 0x00, 0xe7, 0xd9,
+	0xbe, 0xca, 0xdf, 0xb9, 0x3b, 0x67, 0xb3, 0x73, 0x4b, 0x11, 0xfd, 0x4b, 0x3d, 0x47, 0xac, 0xce,
+	0xfa, 0x17, 0x45, 0xb8, 0xa0, 0xcc, 0x15, 0x17, 0x3f, 0xdf, 0x66, 0xb2, 0x8d, 0x32, 0x61, 0xd4,
+	0x60, 0x48, 0x2d, 0xf2, 0xb1, 0x0e, 0x4f, 0x67, 0xee, 0x6d, 0x18, 0x21, 0x43, 0x4a, 0xda, 0x16,
+	0xe9, 0x17, 0x96, 0x81, 0x8a, 0xea, 0x13, 0xcf, 0xde, 0x3d, 0x18, 0xa1, 0x7f, 0x92, 0x15, 0x19,
+	0xcc, 0x5e, 0x11, 0x09, 0x84, 0x5c, 0x80, 0x27, 0xbe, 0xeb, 0x3d, 0xc3, 0xd1, 0xbe, 0xdf, 0xe1,
+	0xdf, 0xfa, 0x55, 0xc2, 0x07, 0xff, 0x3f, 0xdf, 0xf5, 0x5a, 0x07, 0xb4, 0xf8, 0xb4, 0xb6, 0xab,
+	0x98, 0xa0, 0xad, 0x10, 0xb7, 0xee, 0x43, 0x89, 0xb0, 0xac, 0x93, 0x6f, 0x2d, 0x6b, 0x1a, 0xd0,
+	0x63, 0x1c, 0xd5, 0x7d, 0xed, 0x63, 0x6a, 0x4d, 0xc0, 0xd8, 0xa6, 0xeb, 0xed, 0x89, 0x9f, 0xff,
+	0x72, 0x00, 0xc6, 0xd9, 0x6f, 0xbe, 0x02, 0x09, 0x91, 0xa7, 0x70, 0x12, 0x91, 0xe7, 0x7d, 0x98,
+	0xe0, 0x57, 0x74, 0x38, 0xa0, 0x57, 0x37, 0x6c, 0x3d, 0xa8, 0x32, 0xc3, 0xae, 0xe8, 0x5a, 0x2f,
+	0x59, 0x8d, 0xad, 0x03, 0xa2, 0x35, 0x98, 0x64, 0x05, 0x8f, 0xb0, 0x13, 0x1d, 0xc6, 0xf6, 0x98,
+	0x29, 0xae, 0xcf, 0x88, 0x62, 0xc6, 0xcf, 0x38, 0xad, 0xe7, 0xbc, 0xd0, 0x4e, 0xe0, 0xa2, 0x4f,
+	0x61, 0x6a, 0x33, 0xf0, 0xbf, 0x7c, 0xad, 0x08, 0x79, 0x8c, 0xa5, 0xcf, 0x1c, 0x1f, 0x55, 0x2f,
+	0xf4, 0x48, 0x55, 0x4b, 0x15, 0xf5, 0x92, 0xd0, 0x64, 0x4f, 0xad, 0x86, 0x75, 0x3f, 0x70, 0xbd,
+	0x3d, 0xba, 0x9a, 0x23, 0x6c, 0x4f, 0xb9, 0x61, 0x6b, 0x97, 0x16, 0xda, 0xb2, 0x3a, 0x61, 0x59,
+	0x1d, 0xee, 0x6f, 0x59, 0xbd, 0x0f, 0xb0, 0xe6, 0x3b, 0x9d, 0x5a, 0xb7, 0xbb, 0x58, 0x0b, 0xa9,
+	0x31, 0x84, 0x0b, 0x31, 0x5d, 0xdf, 0xe9, 0xb4, 0x9c, 0x6e, 0xb7, 0xd5, 0x76, 0x42, 0x5b, 0x81,
+	0x79, 0x32, 0x38, 0x72, 0xbe, 0x34, 0x6c, 0x4f, 0xad, 0xb9, 0x6d, 0xec, 0x85, 0x78, 0xc7, 0x09,
+	0x3c, 0xd7, 0xdb, 0x0b, 0xad, 0x3f, 0x1b, 0x82, 0x11, 0x39, 0xe4, 0xbb, 0xaa, 0x42, 0xc4, 0x45,
+	0x23, 0xca, 0xa1, 0x62, 0x83, 0x8d, 0xad, 0x40, 0xa0, 0x4b, 0xec, 0x3e, 0x98, 0x09, 0x65, 0xc3,
+	0x64, 0x77, 0x3b, 0xbd, 0x1e, 0xbb, 0xf5, 0x9d, 0x85, 0xe2, 0x52, 0x9d, 0xce, 0xff, 0x08, 0xfb,
+	0x12, 0x74, 0x76, 0xed, 0xe2, 0x52, 0x9d, 0xec, 0xb2, 0x8d, 0xd5, 0xa5, 0x45, 0x3a, 0x95, 0x23,
+	0x6c, 0x97, 0xf9, 0x6e, 0xa7, 0x6d, 0xd3, 0x52, 0x52, 0xdb, 0xa8, 0x3d, 0x5b, 0xe3, 0xd3, 0x45,
+	0x6b, 0x43, 0xe7, 0xa0, 0x6b, 0xd3, 0x52, 0xa2, 0x2a, 0x30, 0xdd, 0x7b, 0xd1, 0xf7, 0xa2, 0xc0,
+	0xef, 0x86, 0x54, 0xa2, 0x1d, 0x61, 0xcb, 0xc9, 0x95, 0xf6, 0x36, 0xaf, 0xb2, 0x13, 0xa0, 0x68,
+	0x07, 0xe6, 0x6a, 0x9d, 0x97, 0x8e, 0xd7, 0xc6, 0x1d, 0x56, 0xb3, 0xe3, 0x07, 0x2f, 0x9e, 0x77,
+	0xfd, 0x57, 0x21, 0x9d, 0xef, 0x11, 0x6e, 0xe3, 0xe2, 0x20, 0xc2, 0x06, 0xf0, 0x4a, 0x00, 0xd9,
+	0x59, 0xd8, 0x84, 0x4b, 0x2e, 0x76, 0xfd, 0xc3, 0x0e, 0x5f, 0x05, 0xca, 0x25, 0xdb, 0xa4, 0xc0,
+	0x66, 0xe5, 0x64, 0x96, 0x56, 0x1a, 0xcf, 0xa8, 0x45, 0x89, 0xcf, 0xd2, 0x7e, 0x78, 0x60, 0x93,
+	0x32, 0x74, 0x13, 0x86, 0x85, 0xd6, 0xc3, 0x6c, 0xdb, 0xd4, 0xd0, 0x2a, 0xb4, 0x1d, 0x51, 0x47,
+	0x8e, 0x84, 0x8d, 0xdb, 0xfe, 0x4b, 0x1c, 0xbc, 0x5e, 0xf4, 0x3b, 0x58, 0xd8, 0x3f, 0xb8, 0x7e,
+	0xcf, 0x2a, 0x5a, 0x6d, 0x52, 0x63, 0xeb, 0x80, 0xa4, 0x01, 0x26, 0x38, 0x85, 0xd4, 0xc9, 0x8a,
+	0x37, 0xc0, 0x04, 0xab, 0xd0, 0x16, 0x75, 0x68, 0x09, 0x2e, 0xd4, 0x0e, 0x23, 0xff, 0xc0, 0x89,
+	0xdc, 0xf6, 0x76, 0x6f, 0x2f, 0x70, 0x48, 0x23, 0x25, 0x8a, 0x40, 0x55, 0x3b, 0x47, 0x54, 0xb6,
+	0x0e, 0x79, 0xad, 0x9d, 0x46, 0x40, 0xef, 0xc1, 0xf8, 0x6a, 0xc8, 0x6c, 0x5c, 0x4e, 0x88, 0x3b,
+	0xd4, 0x50, 0xc1, 0x7b, 0xe9, 0x86, 0x2d, 0x6a, 0xf1, 0x6a, 0x11, 0x65, 0xb0, 0x63, 0x6b, 0x70,
+	0xc8, 0x82, 0xf3, 0xb5, 0x30, 0x74, 0xc3, 0x88, 0xda, 0x1f, 0x46, 0xea, 0x70, 0x7c, 0x54, 0x3d,
+	0xef, 0xd0, 0x12, 0x9b, 0xd7, 0x3c, 0x19, 0x1c, 0x19, 0x2b, 0x8d, 0x3f, 0x19, 0x1c, 0x19, 0x2f,
+	0x4d, 0x3c, 0x19, 0x1c, 0x99, 0x28, 0x4d, 0x5a, 0x0f, 0xe0, 0x02, 0xe3, 0x61, 0x27, 0x56, 0x26,
+	0xac, 0x4d, 0x80, 0x06, 0x3e, 0x70, 0x7a, 0xfb, 0x3e, 0xd9, 0xed, 0x75, 0xf5, 0x17, 0x17, 0x46,
+	0x91, 0x74, 0x20, 0xe2, 0x15, 0xcd, 0x87, 0x42, 0x07, 0x14, 0x90, 0xb6, 0x82, 0x65, 0xfd, 0x45,
+	0x11, 0x10, 0x75, 0xa4, 0x69, 0x44, 0x01, 0x76, 0x0e, 0x44, 0x37, 0x3e, 0x80, 0x71, 0xf6, 0x39,
+	0x62, 0xc5, 0xb4, 0x3b, 0x44, 0xd2, 0x65, 0x7c, 0x48, 0xad, 0x5a, 0x39, 0x67, 0x6b, 0xa0, 0x04,
+	0xd5, 0xc6, 0xe1, 0xe1, 0x81, 0x40, 0x2d, 0x6a, 0xa8, 0x6a, 0x15, 0x41, 0x55, 0x7f, 0xa3, 0x4f,
+	0x61, 0x72, 0xd1, 0x3f, 0xe8, 0x91, 0x39, 0xe1, 0xc8, 0x03, 0xfc, 0xab, 0xcc, 0xdb, 0xd5, 0x2a,
+	0x57, 0xce, 0xd9, 0x09, 0x70, 0xb4, 0x0e, 0x17, 0x1f, 0x75, 0x0f, 0xc3, 0xfd, 0x9a, 0xd7, 0x59,
+	0xec, 0xfa, 0xa1, 0xa0, 0x32, 0xc8, 0xad, 0xda, 0x9c, 0x8b, 0xa6, 0x21, 0x56, 0xce, 0xd9, 0x26,
+	0x44, 0x74, 0x93, 0x7b, 0x05, 0xcb, 0x1b, 0x02, 0xee, 0x34, 0xbc, 0xe1, 0xe1, 0x8d, 0xe7, 0x2b,
+	0xe7, 0x6c, 0x56, 0x5b, 0x1f, 0x85, 0x61, 0xf1, 0x05, 0xb9, 0x47, 0x36, 0xa2, 0x9c, 0x4e, 0x7e,
+	0xcd, 0x5a, 0x81, 0x91, 0xed, 0x1e, 0x61, 0x6c, 0x42, 0x3c, 0xb4, 0xe5, 0x6f, 0xeb, 0x5b, 0xfa,
+	0x4c, 0xa3, 0x79, 0x55, 0x87, 0x67, 0xc0, 0x71, 0x81, 0xb5, 0xa2, 0x4f, 0x6e, 0x3e, 0xb4, 0xd6,
+	0x6e, 0x31, 0xd1, 0x6e, 0x29, 0x39, 0xd7, 0xd6, 0x8c, 0x71, 0xf2, 0xac, 0xcf, 0xe1, 0xea, 0x76,
+	0x8f, 0x28, 0x4c, 0xb5, 0x5e, 0xaf, 0xcb, 0x2f, 0x6e, 0xd9, 0x97, 0x46, 0x6c, 0x96, 0xf7, 0xa4,
+	0xcb, 0x69, 0x21, 0xd3, 0x41, 0x87, 0x1e, 0x09, 0xf6, 0xc5, 0x12, 0x9e, 0xa6, 0xd6, 0xef, 0x17,
+	0xe0, 0x2a, 0x3b, 0x01, 0x99, 0xa4, 0xbf, 0xa9, 0x3a, 0xc6, 0x2a, 0x22, 0x90, 0x74, 0x83, 0x55,
+	0x5d, 0x5f, 0xe3, 0x4b, 0xd8, 0x62, 0xf6, 0x25, 0xac, 0x38, 0x60, 0x03, 0xc6, 0x03, 0xf6, 0x19,
+	0x58, 0xbc, 0x47, 0xdd, 0x6e, 0xaa, 0x53, 0xe1, 0x9b, 0xf4, 0xca, 0xfa, 0x6f, 0x45, 0x98, 0x7b,
+	0x8c, 0x3d, 0x1c, 0x38, 0x74, 0x9c, 0x9a, 0xb4, 0xaf, 0xde, 0xd1, 0x14, 0x72, 0xef, 0x68, 0xa4,
+	0x28, 0x5b, 0xcc, 0x10, 0x65, 0x2f, 0xc1, 0xc0, 0xb6, 0xbd, 0xca, 0x87, 0x45, 0x99, 0xf4, 0x61,
+	0xe0, 0xda, 0xa4, 0x0c, 0xad, 0xc6, 0xf7, 0x3b, 0x83, 0x7d, 0xef, 0x77, 0x2e, 0x72, 0x7b, 0xf7,
+	0x30, 0xbf, 0xdf, 0xd1, 0x6f, 0x75, 0xd6, 0x15, 0x79, 0x99, 0xb0, 0x9b, 0x3b, 0xfc, 0x4c, 0x65,
+	0x0c, 0x90, 0x8b, 0xbe, 0xcb, 0x5e, 0x14, 0xbc, 0x66, 0x5b, 0x80, 0x49, 0xc0, 0x42, 0xee, 0xad,
+	0x7c, 0x06, 0x63, 0x0a, 0x08, 0x2a, 0xc1, 0xc0, 0x0b, 0x7e, 0xb7, 0x35, 0x6a, 0x93, 0x3f, 0xd1,
+	0xb7, 0x60, 0xe8, 0x25, 0x91, 0xc1, 0x39, 0x1b, 0x99, 0x8d, 0xe5, 0xf3, 0x46, 0x44, 0x24, 0x0f,
+	0x26, 0xa0, 0xdb, 0x0c, 0xe8, 0xc3, 0xe2, 0xfb, 0x05, 0xeb, 0x23, 0x28, 0xa7, 0x7b, 0xc3, 0xc5,
+	0xb9, 0x7e, 0x1a, 0x8e, 0xb5, 0x04, 0xd3, 0x8f, 0x71, 0x14, 0x7b, 0xe5, 0x2a, 0x57, 0x6f, 0x89,
+	0x73, 0x96, 0x63, 0x59, 0xb3, 0x1a, 0x30, 0x93, 0xa0, 0xc2, 0xdb, 0xff, 0x10, 0x86, 0x85, 0x3f,
+	0x4f, 0x21, 0xdb, 0x9f, 0x87, 0xee, 0x5b, 0x4e, 0xd9, 0x16, 0x08, 0xd6, 0x0e, 0xcc, 0x6a, 0x44,
+	0x43, 0x49, 0xf5, 0xbb, 0x30, 0x22, 0xca, 0x12, 0x26, 0x09, 0x8d, 0x2c, 0xdd, 0x5a, 0xa1, 0x40,
+	0x96, 0x28, 0xd6, 0x3e, 0xcc, 0xae, 0xb9, 0xa1, 0x4e, 0x99, 0x8d, 0xfa, 0x32, 0x8c, 0xf6, 0xc8,
+	0x37, 0x2f, 0x74, 0x7f, 0x8d, 0xed, 0xcf, 0x21, 0x7b, 0x84, 0x14, 0x34, 0xdc, 0x5f, 0xc3, 0xe8,
+	0x0a, 0x00, 0xad, 0xa4, 0xf3, 0xc7, 0xd9, 0x0b, 0x05, 0x67, 0xba, 0x22, 0x02, 0x7a, 0x79, 0xca,
+	0x36, 0xa4, 0x4d, 0xff, 0xb6, 0x02, 0x98, 0x4b, 0xb5, 0xc4, 0xc7, 0x70, 0x0f, 0x64, 0xd7, 0x72,
+	0xc6, 0x60, 0x4b, 0x20, 0x74, 0x0b, 0xa6, 0x3c, 0xfc, 0x65, 0xd4, 0x4a, 0xf5, 0x61, 0x82, 0x14,
+	0x6f, 0x8a, 0x7e, 0x58, 0x3f, 0xa2, 0x9a, 0x7b, 0xd2, 0xe1, 0xee, 0xcc, 0x26, 0xaf, 0x0b, 0x15,
+	0x32, 0x24, 0xdd, 0xbf, 0xea, 0x57, 0x36, 0x81, 0x2f, 0xe1, 0xb2, 0xb1, 0xb5, 0x5f, 0xf5, 0x24,
+	0xfe, 0x4d, 0x11, 0xe6, 0xd8, 0x57, 0x2a, 0x7d, 0x34, 0x4e, 0xce, 0xc3, 0xbe, 0x16, 0x83, 0xf3,
+	0x7d, 0x83, 0xc1, 0x99, 0xa2, 0xa8, 0x06, 0x67, 0xcd, 0xcc, 0xfc, 0xbe, 0xd9, 0xcc, 0x4c, 0xc5,
+	0x3e, 0xdd, 0xcc, 0x9c, 0x34, 0x2e, 0x2f, 0x67, 0x1b, 0x97, 0xa9, 0xa9, 0xcd, 0x60, 0x5c, 0x36,
+	0x98, 0x94, 0x9f, 0x0c, 0x8e, 0x14, 0x4b, 0x03, 0x56, 0x13, 0xca, 0xe9, 0x29, 0x3e, 0x03, 0xbe,
+	0xf1, 0x67, 0x05, 0xb8, 0xc2, 0x25, 0x8c, 0xc4, 0x21, 0x38, 0xfd, 0x0a, 0xbe, 0x0b, 0xe3, 0x1c,
+	0x77, 0x2b, 0xde, 0x2c, 0xcc, 0x75, 0x56, 0x70, 0x42, 0xc6, 0x4e, 0x35, 0x30, 0xf4, 0xae, 0x62,
+	0x49, 0x60, 0xd6, 0xa9, 0x4b, 0xe4, 0x73, 0xc9, 0x4c, 0x0e, 0x99, 0xf6, 0x04, 0xeb, 0x0b, 0xb8,
+	0x9a, 0xd5, 0xf1, 0x33, 0x98, 0x97, 0x3f, 0x2f, 0xc0, 0x65, 0x4e, 0x5e, 0x3b, 0x4e, 0x6f, 0xc4,
+	0xf2, 0x4f, 0xe1, 0x6d, 0xf1, 0x04, 0xc6, 0x48, 0x83, 0xa2, 0xdf, 0xfa, 0x5b, 0x2e, 0xa5, 0x66,
+	0xc9, 0x89, 0x1c, 0x7e, 0x4d, 0xe6, 0x1c, 0x74, 0x85, 0x5b, 0xa7, 0xad, 0x22, 0x5b, 0x3f, 0x80,
+	0x79, 0xf3, 0x10, 0xce, 0x60, 0x7e, 0x9e, 0x40, 0xc5, 0xc0, 0x38, 0xdf, 0xec, 0x83, 0xf8, 0x7d,
+	0xb8, 0x6c, 0xa4, 0x75, 0x06, 0xdd, 0x5c, 0x21, 0x9f, 0xfb, 0xe8, 0x0c, 0x96, 0xd0, 0xda, 0x81,
+	0x4b, 0x06, 0x4a, 0x67, 0xd0, 0xc5, 0xc7, 0x30, 0x27, 0xc5, 0xdc, 0xaf, 0xd4, 0xc3, 0x67, 0x70,
+	0x85, 0x11, 0x3a, 0x9b, 0x55, 0x79, 0x0a, 0x97, 0x39, 0xb9, 0x33, 0x98, 0xbd, 0x15, 0x98, 0x8f,
+	0xb5, 0x59, 0x83, 0x2c, 0x71, 0x62, 0x26, 0x63, 0xad, 0xc1, 0xb5, 0x98, 0x52, 0xc6, 0x87, 0xf5,
+	0xe4, 0xd4, 0x98, 0x2c, 0x16, 0xaf, 0xd2, 0x19, 0xca, 0x62, 0x31, 0xe0, 0x99, 0x89, 0x13, 0xab,
+	0x70, 0x91, 0x11, 0xd6, 0xe5, 0xd6, 0x05, 0x55, 0x6e, 0x35, 0x3e, 0x83, 0x4a, 0x8b, 0xb2, 0xcf,
+	0xa8, 0x28, 0x2b, 0x40, 0xe2, 0x1e, 0xbe, 0x0b, 0xe7, 0xf9, 0x4b, 0x4f, 0xd6, 0x3f, 0x03, 0x31,
+	0x26, 0xa9, 0x33, 0x34, 0x0e, 0x6c, 0xfd, 0x18, 0xae, 0x30, 0x35, 0x30, 0xf9, 0xa2, 0x40, 0x2c,
+	0xc9, 0x77, 0x13, 0x5a, 0x60, 0xce, 0xc3, 0x05, 0x93, 0x32, 0xb8, 0x2b, 0xf6, 0x76, 0x16, 0xfd,
+	0x13, 0xb9, 0xd8, 0x0a, 0xed, 0xae, 0x68, 0xd4, 0xee, 0x6e, 0xc0, 0x75, 0xa9, 0xdd, 0x25, 0x9b,
+	0x91, 0x26, 0xe1, 0x1f, 0xc0, 0x65, 0x36, 0x50, 0xfd, 0x7d, 0x9b, 0xe8, 0xc6, 0x47, 0x89, 0x61,
+	0x66, 0x3e, 0xa0, 0x33, 0x0d, 0xf2, 0xef, 0x15, 0xc4, 0x91, 0x33, 0x13, 0xff, 0xba, 0xd5, 0xdd,
+	0x75, 0xa8, 0xca, 0x09, 0xd1, 0x7b, 0xf4, 0x66, 0xba, 0xee, 0x33, 0x98, 0x49, 0xbd, 0xc1, 0x20,
+	0x02, 0x2b, 0x7a, 0x87, 0x1c, 0x0b, 0x5a, 0x20, 0xb6, 0x5d, 0xe6, 0x9b, 0x0d, 0x5b, 0x42, 0x5a,
+	0x2d, 0x98, 0x4f, 0x2f, 0x85, 0xdb, 0x16, 0xee, 0x50, 0xe8, 0x53, 0x72, 0x84, 0xd9, 0x43, 0x90,
+	0x42, 0x9f, 0x87, 0x20, 0xfc, 0x1c, 0x33, 0x74, 0x81, 0x65, 0x59, 0x82, 0xd5, 0x24, 0xc6, 0x4f,
+	0x5a, 0x17, 0xfb, 0xe1, 0x37, 0x00, 0x89, 0xaa, 0xc5, 0x86, 0x2d, 0x9a, 0xbe, 0x04, 0x03, 0x8b,
+	0x0d, 0x9b, 0x7b, 0x61, 0x52, 0x75, 0xbb, 0x1d, 0x06, 0x36, 0x29, 0x4b, 0x4a, 0xad, 0xc5, 0x13,
+	0x48, 0xad, 0x4f, 0x06, 0x47, 0x06, 0x4a, 0x83, 0x36, 0x6a, 0xb8, 0x7b, 0xde, 0x8e, 0x1b, 0xed,
+	0xcb, 0x06, 0x6b, 0xd6, 0x0f, 0xe1, 0xa2, 0xd6, 0x3c, 0x3f, 0xc5, 0xb9, 0xee, 0xa3, 0xe8, 0x16,
+	0x0c, 0x2f, 0xd6, 0xe8, 0xdd, 0x1e, 0xb5, 0x17, 0x8c, 0x33, 0x7e, 0xd3, 0x76, 0x5a, 0xf4, 0x29,
+	0xbf, 0x2d, 0x2a, 0xad, 0x7f, 0x3a, 0xa8, 0x50, 0x57, 0x9c, 0x72, 0x73, 0x46, 0xf7, 0x00, 0x80,
+	0xed, 0x10, 0x65, 0x70, 0x44, 0x00, 0x1c, 0xe3, 0xd7, 0x11, 0x8c, 0x25, 0xdb, 0x0a, 0xd0, 0x49,
+	0x9d, 0x76, 0xb9, 0x9f, 0x10, 0x43, 0x12, 0x77, 0x76, 0xd2, 0x4f, 0x88, 0x93, 0x0e, 0x6d, 0x15,
+	0x08, 0xfd, 0x38, 0xe9, 0x5b, 0x36, 0x44, 0xaf, 0xc8, 0xbf, 0xc1, 0xcd, 0x12, 0x86, 0xb1, 0x9d,
+	0xce, 0xbd, 0xec, 0x15, 0xcc, 0x10, 0x5c, 0xf7, 0x39, 0x75, 0x20, 0x5b, 0xfe, 0x32, 0xc2, 0x1e,
+	0xe3, 0xed, 0xe7, 0x69, 0x3b, 0x37, 0x73, 0xda, 0x89, 0x81, 0xf9, 0xdb, 0xf3, 0x98, 0x4e, 0x0b,
+	0xcb, 0x3a, 0xdb, 0x4c, 0x9f, 0x6e, 0x22, 0x7b, 0x6d, 0xd9, 0xeb, 0xf4, 0x7c, 0x57, 0x2a, 0x15,
+	0x6c, 0x13, 0x05, 0xdd, 0x16, 0xe6, 0xe5, 0xb6, 0x0a, 0x64, 0xdd, 0xca, 0xf5, 0xe9, 0x1a, 0x81,
+	0xc1, 0xad, 0xc5, 0xad, 0xb5, 0x52, 0xc1, 0xba, 0x07, 0xa0, 0xb4, 0x04, 0x70, 0x7e, 0x7d, 0xc3,
+	0x7e, 0x56, 0x5b, 0x2b, 0x9d, 0x43, 0x33, 0x70, 0x61, 0x67, 0x75, 0x7d, 0x69, 0x63, 0xa7, 0xd1,
+	0x6a, 0x3c, 0xab, 0xd9, 0x5b, 0x8b, 0x35, 0x7b, 0xa9, 0x54, 0xb0, 0xbe, 0x80, 0x69, 0x7d, 0x84,
+	0x67, 0xba, 0x09, 0x23, 0xb8, 0x28, 0xe5, 0x99, 0x27, 0x3b, 0x5b, 0x8a, 0x9f, 0x0b, 0x57, 0x90,
+	0x92, 0x57, 0x6f, 0x5c, 0x95, 0xe2, 0xc7, 0x48, 0x01, 0xd2, 0x2e, 0x4c, 0x8b, 0xb9, 0x17, 0xa6,
+	0xd6, 0x77, 0x60, 0x5a, 0x6f, 0xf5, 0xa4, 0x26, 0xa2, 0x6f, 0x50, 0x07, 0x20, 0xc5, 0x2b, 0x93,
+	0x68, 0xea, 0x71, 0x17, 0x39, 0x67, 0xfd, 0x0e, 0x94, 0x38, 0x54, 0xfc, 0xe5, 0xbd, 0x21, 0x6c,
+	0x78, 0x05, 0x83, 0x07, 0xb9, 0x70, 0x47, 0x78, 0x4b, 0xdc, 0x0a, 0xf4, 0x6b, 0xe1, 0x2f, 0x0a,
+	0x50, 0x4e, 0x38, 0x38, 0x2e, 0xee, 0x3b, 0xdd, 0x2e, 0xf6, 0xf6, 0x30, 0xba, 0x0d, 0x83, 0x5b,
+	0x1b, 0x5b, 0x9b, 0xdc, 0x6a, 0x36, 0xcd, 0xb7, 0x29, 0x29, 0x92, 0x30, 0x36, 0x85, 0x40, 0x4f,
+	0xe1, 0x82, 0x70, 0x77, 0x91, 0x55, 0x5c, 0x29, 0xb9, 0x92, 0xef, 0x3c, 0x93, 0xc6, 0x43, 0xef,
+	0x70, 0x6f, 0xcc, 0x9f, 0x1e, 0xba, 0x01, 0xee, 0x50, 0x85, 0x7d, 0x72, 0x01, 0xc5, 0xde, 0x98,
+	0xa2, 0xc6, 0x56, 0xc1, 0x98, 0xa7, 0xbc, 0xf5, 0x47, 0x05, 0x98, 0xcb, 0x70, 0xd8, 0x44, 0x6f,
+	0x6b, 0xc3, 0xb9, 0xa8, 0x0c, 0x47, 0x80, 0xac, 0x9c, 0xe3, 0xe3, 0x59, 0x54, 0x7c, 0x80, 0x06,
+	0x4e, 0xe1, 0x03, 0xc4, 0xdf, 0x8b, 0x53, 0x38, 0xfe, 0x2e, 0x89, 0x96, 0x5b, 0x53, 0x30, 0xa1,
+	0xcd, 0x9b, 0x65, 0xc1, 0xb8, 0xda, 0x32, 0x59, 0x9c, 0x45, 0xbf, 0x23, 0x17, 0x87, 0xfc, 0x6d,
+	0xfd, 0x41, 0x01, 0xa6, 0xe9, 0x10, 0xf7, 0x5c, 0x72, 0x1a, 0xe3, 0x19, 0x5a, 0xd0, 0x46, 0x32,
+	0xaf, 0x8d, 0x24, 0x01, 0x2b, 0x87, 0xf4, 0x61, 0x6a, 0x48, 0xf3, 0xa6, 0x21, 0x51, 0x4d, 0xd0,
+	0xf5, 0x3d, 0x6d, 0x24, 0xca, 0xd5, 0xc4, 0x3f, 0x2a, 0xc0, 0x45, 0xa5, 0x4f, 0xb2, 0xff, 0x0f,
+	0xb4, 0x2e, 0x5d, 0x36, 0x74, 0x29, 0x35, 0xc9, 0xf5, 0x54, 0x8f, 0xbe, 0x91, 0xd7, 0xa3, 0xbe,
+	0x73, 0xfc, 0x57, 0x05, 0x98, 0x31, 0xce, 0x01, 0x9a, 0x25, 0xe2, 0x56, 0x3b, 0xc0, 0x11, 0x9f,
+	0x5e, 0xfe, 0x8b, 0x94, 0xaf, 0x86, 0xe1, 0x21, 0x0f, 0xb2, 0x32, 0x6a, 0xf3, 0x5f, 0xe8, 0x1b,
+	0x30, 0xb1, 0x89, 0x03, 0xd7, 0xef, 0x30, 0xef, 0x30, 0x76, 0x83, 0x3e, 0x61, 0xeb, 0x85, 0x68,
+	0x1e, 0x46, 0x6b, 0xdd, 0x3d, 0x3f, 0x70, 0xa3, 0x7d, 0x76, 0x3b, 0x34, 0x6a, 0xc7, 0x05, 0x84,
+	0xf6, 0x92, 0xbb, 0x27, 0x9c, 0x42, 0x26, 0x6c, 0xfe, 0x0b, 0x95, 0x61, 0x58, 0x18, 0x79, 0xa8,
+	0x89, 0xc8, 0x16, 0x3f, 0x09, 0xc6, 0x67, 0x36, 0xdd, 0x04, 0xf4, 0x29, 0x92, 0xcd, 0x7f, 0x59,
+	0x77, 0x60, 0xda, 0x34, 0x8f, 0xc6, 0x2d, 0xf3, 0xb7, 0x8a, 0x70, 0xb1, 0xd6, 0xe9, 0x3c, 0x7b,
+	0x54, 0x5b, 0xc2, 0xaa, 0x90, 0xf3, 0x0e, 0x0c, 0xae, 0x7a, 0x6e, 0xc4, 0x25, 0x1c, 0xe1, 0xda,
+	0x6c, 0x80, 0x24, 0x50, 0x64, 0x85, 0xc8, 0xff, 0xc8, 0x86, 0x8b, 0xcb, 0x5f, 0xba, 0x61, 0xe4,
+	0x7a, 0x7b, 0xaa, 0x7f, 0x74, 0xf1, 0x24, 0xfe, 0xd1, 0x2b, 0xe7, 0x6c, 0x13, 0x32, 0xda, 0x82,
+	0xd9, 0x75, 0xfc, 0xca, 0xb0, 0x85, 0xe4, 0xb3, 0x11, 0xe5, 0xa0, 0xa7, 0x76, 0x4e, 0x06, 0xae,
+	0xba, 0x43, 0x7f, 0xaf, 0x48, 0x9f, 0xa7, 0x29, 0x03, 0xe3, 0x2d, 0x6f, 0xc3, 0xb4, 0xd2, 0xa1,
+	0x98, 0x4f, 0x15, 0xf8, 0x83, 0x5c, 0xe3, 0x70, 0xd4, 0x83, 0x64, 0x44, 0x47, 0x3b, 0x30, 0xa7,
+	0x77, 0x2a, 0xa6, 0xac, 0x1f, 0x06, 0x13, 0xc8, 0xca, 0x39, 0x3b, 0x0b, 0x1b, 0x2d, 0xc0, 0x40,
+	0xad, 0xfd, 0x82, 0x4f, 0x8b, 0x79, 0xc9, 0xd8, 0xc8, 0x6a, 0xed, 0x17, 0xf4, 0x99, 0x79, 0xfb,
+	0x85, 0x76, 0x1e, 0xfe, 0x6d, 0x01, 0xe6, 0x32, 0x56, 0x18, 0x5d, 0x05, 0x60, 0x85, 0xca, 0x17,
+	0x41, 0x29, 0x21, 0x02, 0x1a, 0xfb, 0x45, 0x3d, 0xc5, 0x06, 0x28, 0x0b, 0x16, 0x2f, 0x30, 0xe2,
+	0x0a, 0x5b, 0x01, 0x42, 0x9b, 0x30, 0xc6, 0x7e, 0xb1, 0x87, 0x20, 0x3a, 0xdb, 0x56, 0x6a, 0x98,
+	0x20, 0xd3, 0xa1, 0x05, 0xad, 0xe4, 0x03, 0x10, 0x95, 0x04, 0x37, 0x69, 0x2e, 0x26, 0x47, 0x21,
+	0x07, 0x8d, 0x6e, 0xc3, 0x79, 0x56, 0xc8, 0xd7, 0x50, 0x3c, 0xef, 0x8c, 0x81, 0x79, 0xbd, 0xf5,
+	0x8f, 0x0b, 0x30, 0xcb, 0xbe, 0x88, 0xa9, 0xa3, 0xf1, 0x1d, 0xed, 0x68, 0x5c, 0x97, 0x1d, 0x36,
+	0x01, 0x6b, 0xa7, 0xa3, 0xae, 0xbf, 0x1a, 0x38, 0xe9, 0xa9, 0x50, 0x91, 0xd4, 0x7d, 0xfb, 0x4f,
+	0x0a, 0xc2, 0xc2, 0x93, 0xde, 0xba, 0xcb, 0x30, 0xfe, 0x66, 0x5b, 0x56, 0x43, 0x43, 0xef, 0xb2,
+	0x1d, 0x55, 0xcc, 0x1f, 0x69, 0xee, 0xa6, 0xfa, 0x18, 0x2a, 0xd9, 0x53, 0xd3, 0x6f, 0x5b, 0x59,
+	0x8f, 0x0c, 0xd8, 0x6f, 0xb2, 0x9c, 0x87, 0x29, 0x3a, 0x8d, 0xd7, 0x5e, 0x5b, 0xac, 0xe8, 0xad,
+	0xa4, 0x1f, 0x65, 0xa6, 0x6f, 0x9a, 0xda, 0xdb, 0x62, 0x7c, 0x95, 0xc0, 0x37, 0x27, 0x15, 0xf6,
+	0xd4, 0xee, 0xff, 0xab, 0xa2, 0xbe, 0x17, 0xdf, 0xa4, 0xd1, 0x45, 0x98, 0x58, 0xc7, 0xaf, 0x52,
+	0xed, 0x52, 0xbf, 0x1b, 0x0f, 0xbf, 0x6a, 0x29, 0x6d, 0xab, 0x0e, 0xe9, 0x1a, 0x0e, 0xda, 0x85,
+	0x49, 0xc1, 0x35, 0x4e, 0xca, 0x3c, 0xd9, 0x2b, 0x38, 0xd2, 0x42, 0xc6, 0x9b, 0x95, 0x04, 0xc5,
+	0xb3, 0x3f, 0xcf, 0xd6, 0x26, 0x94, 0xd3, 0xb3, 0xc7, 0x5b, 0x7b, 0xa7, 0xdf, 0xda, 0x33, 0x53,
+	0x48, 0x47, 0xdf, 0x07, 0x2b, 0xd4, 0x3c, 0x25, 0x61, 0xa4, 0xbd, 0xe1, 0x7e, 0x72, 0x31, 0xa8,
+	0xff, 0x8e, 0x58, 0x0c, 0xa5, 0x7f, 0xd2, 0xad, 0x76, 0x91, 0x5a, 0xf8, 0x54, 0x4a, 0xbc, 0x63,
+	0x77, 0x60, 0x98, 0x17, 0x25, 0xde, 0x90, 0xc7, 0xbb, 0x52, 0x00, 0x58, 0x7f, 0x5c, 0x80, 0x4b,
+	0xd4, 0xde, 0xe8, 0x7a, 0x7b, 0x5d, 0xbc, 0x1d, 0xea, 0x9e, 0xb1, 0xdf, 0xd6, 0x18, 0xcd, 0x5c,
+	0xc6, 0xcb, 0xa5, 0x5f, 0x15, 0x7b, 0xf9, 0xd3, 0x02, 0x54, 0x4c, 0x7d, 0x3b, 0x5b, 0x0e, 0x73,
+	0x97, 0x2b, 0x73, 0x45, 0x6e, 0x49, 0x61, 0xe8, 0xb2, 0x4d, 0x31, 0x58, 0x32, 0x48, 0xf2, 0xbf,
+	0xc6, 0x5a, 0xfe, 0x77, 0x01, 0xa6, 0x57, 0x43, 0x55, 0xc0, 0xe7, 0x13, 0x77, 0xd7, 0xf4, 0x90,
+	0x92, 0xae, 0xab, 0x39, 0x5e, 0xc8, 0x3b, 0xca, 0xcb, 0x9c, 0x62, 0xde, 0x0b, 0x49, 0x2d, 0x48,
+	0xcc, 0x2d, 0x18, 0x5c, 0x27, 0xe2, 0xd4, 0x00, 0xdf, 0x7f, 0x0c, 0x83, 0x14, 0xd1, 0x47, 0x34,
+	0xa4, 0xcb, 0xe4, 0x07, 0x7a, 0x94, 0x7a, 0xaa, 0x33, 0xd8, 0xff, 0x05, 0x60, 0x3a, 0xba, 0x4d,
+	0x7d, 0x04, 0xce, 0x6f, 0x39, 0xc1, 0x1e, 0x8e, 0xac, 0x1f, 0x40, 0x85, 0x7b, 0xfa, 0x30, 0x0b,
+	0x2e, 0xf5, 0x07, 0x0a, 0x63, 0x67, 0xae, 0x3c, 0xef, 0x9c, 0xab, 0x00, 0x8d, 0xc8, 0x09, 0xa2,
+	0x55, 0xaf, 0x83, 0xbf, 0xa4, 0xa3, 0x1d, 0xb2, 0x95, 0x12, 0xeb, 0x5d, 0x18, 0x95, 0x43, 0xa0,
+	0x1a, 0xa0, 0x22, 0x31, 0xd2, 0xe1, 0x4c, 0x6b, 0x8f, 0x87, 0xc4, 0x8b, 0xa1, 0x87, 0x30, 0x93,
+	0x58, 0x8a, 0xf8, 0x31, 0x9b, 0xd4, 0xcc, 0xa8, 0x6b, 0xa4, 0x2d, 0x7f, 0x5b, 0x8b, 0x70, 0x21,
+	0xb5, 0xd2, 0x08, 0xd1, 0x77, 0x66, 0x4c, 0xbb, 0x27, 0x1f, 0x94, 0x46, 0x63, 0x85, 0x94, 0x6d,
+	0xad, 0x35, 0x98, 0xf3, 0x37, 0x29, 0xdb, 0x5a, 0x6b, 0xd4, 0xcf, 0xb3, 0x9d, 0x63, 0xfd, 0xf3,
+	0x22, 0x55, 0x7a, 0x53, 0x73, 0x90, 0xb0, 0x1f, 0xaa, 0x36, 0xcc, 0x3a, 0x8c, 0xd2, 0x11, 0x2f,
+	0x89, 0xe7, 0x0d, 0xf9, 0xce, 0x29, 0x23, 0x3f, 0x3f, 0xaa, 0x9e, 0xa3, 0x1e, 0x29, 0x31, 0x1a,
+	0xfa, 0x04, 0x86, 0x97, 0xbd, 0x0e, 0xa5, 0x30, 0x70, 0x0a, 0x0a, 0x02, 0x89, 0xac, 0x03, 0xed,
+	0x32, 0x11, 0x85, 0xb8, 0xd9, 0xc9, 0x56, 0x4a, 0xe8, 0x34, 0xbb, 0x07, 0x2e, 0x73, 0x02, 0x1b,
+	0xb2, 0xd9, 0x0f, 0xfa, 0x34, 0x90, 0x74, 0x41, 0xc4, 0x2d, 0x18, 0xb5, 0xe5, 0x6f, 0x64, 0xc1,
+	0xd0, 0x46, 0xd0, 0xe1, 0x4f, 0x86, 0x27, 0x17, 0xc6, 0x45, 0x10, 0x49, 0x52, 0x66, 0xb3, 0x2a,
+	0xeb, 0x7f, 0x16, 0x60, 0xee, 0x31, 0x8e, 0x8c, 0xfb, 0x46, 0x9b, 0x95, 0xc2, 0x57, 0x9e, 0x95,
+	0xe2, 0x9b, 0xcc, 0x8a, 0x1c, 0xf5, 0x40, 0xd6, 0xa8, 0x07, 0xb3, 0x46, 0x3d, 0x94, 0x3d, 0xea,
+	0xc7, 0x70, 0x9e, 0x0d, 0x15, 0xdd, 0x80, 0xa1, 0xd5, 0x08, 0x1f, 0xc4, 0xc6, 0x10, 0xd5, 0xb5,
+	0xce, 0x66, 0x75, 0x44, 0xe3, 0x5a, 0x73, 0xc2, 0x48, 0x3c, 0x37, 0x18, 0xb5, 0xc5, 0x4f, 0xeb,
+	0x27, 0xf4, 0x61, 0xd4, 0x9a, 0xdf, 0x7e, 0xa1, 0x58, 0xaa, 0x87, 0xd9, 0xa9, 0x4c, 0xde, 0x6c,
+	0x10, 0x28, 0x56, 0x63, 0x0b, 0x08, 0x74, 0x0d, 0xc6, 0x56, 0xbd, 0x47, 0x7e, 0xd0, 0xc6, 0x1b,
+	0x5e, 0x97, 0x51, 0x1f, 0xb1, 0xd5, 0x22, 0x6e, 0xc1, 0xe1, 0x2d, 0xc4, 0x16, 0x1c, 0x5a, 0x90,
+	0xb0, 0xe0, 0xb0, 0x38, 0x63, 0x36, 0xab, 0xe3, 0x06, 0x22, 0xf2, 0x77, 0x9e, 0xf9, 0x46, 0xda,
+	0x79, 0xfa, 0x01, 0xee, 0xc2, 0x25, 0x1b, 0xf7, 0xba, 0x0e, 0x11, 0xb8, 0x0e, 0x7c, 0x06, 0x2f,
+	0xc7, 0x7c, 0xcd, 0xe0, 0x9f, 0xae, 0xfb, 0x43, 0xc8, 0x2e, 0x17, 0x73, 0xba, 0x7c, 0x00, 0xd7,
+	0x1f, 0xe3, 0xc8, 0x18, 0x2c, 0x2c, 0x1e, 0xfc, 0x0a, 0x8c, 0x84, 0xba, 0x0d, 0xbf, 0x5f, 0x9c,
+	0x32, 0x7e, 0xcb, 0xc5, 0xe9, 0xc8, 0xbf, 0xac, 0x4f, 0xa1, 0x9a, 0xd5, 0xdc, 0xc9, 0xfc, 0x60,
+	0x5d, 0xb8, 0x96, 0x4d, 0x40, 0x7e, 0x16, 0x85, 0xbd, 0x5f, 0xaa, 0xce, 0xf9, 0xbd, 0xd5, 0xaf,
+	0x08, 0xf8, 0x1f, 0x56, 0x5d, 0x78, 0x04, 0x7e, 0x85, 0xee, 0xb6, 0xe8, 0x55, 0xba, 0x4e, 0x20,
+	0x9e, 0xd7, 0x1a, 0x8c, 0x88, 0x32, 0x3e, 0xaf, 0x99, 0x71, 0xd8, 0xe8, 0x84, 0x76, 0x04, 0x01,
+	0x89, 0x66, 0xfd, 0x44, 0x5c, 0x2b, 0xe9, 0x18, 0x27, 0x7b, 0x74, 0x73, 0x92, 0x7b, 0x24, 0xcb,
+	0x87, 0x4b, 0x3a, 0x6d, 0xf5, 0xba, 0xa0, 0xa4, 0x5c, 0x17, 0xb0, 0x5b, 0x82, 0x6b, 0xba, 0xf9,
+	0xba, 0xc8, 0xf7, 0x65, 0x5c, 0x84, 0xae, 0xaa, 0x97, 0x02, 0xe3, 0xe9, 0x57, 0x4a, 0xf7, 0xa1,
+	0x62, 0x6a, 0x50, 0x31, 0xa0, 0x48, 0xcb, 0x33, 0x8f, 0x99, 0xf1, 0x5b, 0x05, 0xb0, 0x34, 0xef,
+	0x28, 0x2d, 0xa4, 0x96, 0x3c, 0x32, 0x6f, 0x0b, 0xc6, 0x46, 0xfd, 0xb1, 0x98, 0xef, 0x7d, 0x97,
+	0x14, 0xa8, 0x4f, 0xc3, 0x18, 0xb7, 0xbb, 0x0f, 0xc3, 0xeb, 0xf8, 0xcb, 0x98, 0xfd, 0x30, 0x59,
+	0x94, 0x7a, 0x4c, 0xbd, 0xc0, 0xea, 0xa3, 0x53, 0x01, 0x46, 0x04, 0xa1, 0x1b, 0xb9, 0x7d, 0xe0,
+	0xfd, 0xdf, 0x85, 0x52, 0xb2, 0x8e, 0xaf, 0x7d, 0xdf, 0xe8, 0x62, 0xf4, 0xf5, 0x46, 0x32, 0xa8,
+	0x58, 0x68, 0xa7, 0xe8, 0x9d, 0xbe, 0xf7, 0xe8, 0x03, 0x80, 0x2d, 0x3f, 0x72, 0xba, 0x8b, 0xd4,
+	0xc6, 0x45, 0x19, 0x3f, 0x0b, 0x51, 0x15, 0x91, 0xd2, 0x56, 0xf2, 0x75, 0xac, 0x02, 0x6c, 0x7d,
+	0x8f, 0x9e, 0x48, 0x73, 0xa7, 0x4f, 0x76, 0x48, 0x16, 0xe1, 0x46, 0xc2, 0x1b, 0xe1, 0x0d, 0x88,
+	0x44, 0x30, 0x43, 0xa6, 0x5f, 0xc6, 0x26, 0xfb, 0x7a, 0x56, 0xfd, 0x3f, 0x14, 0x98, 0x0b, 0xa5,
+	0xda, 0x2c, 0x5f, 0xe8, 0x45, 0x80, 0xb8, 0x34, 0xe1, 0xa3, 0xaf, 0x86, 0x5a, 0xa3, 0xca, 0x6b,
+	0x1c, 0x6a, 0x2d, 0xb4, 0x15, 0xb4, 0xaf, 0x77, 0x25, 0x1f, 0x52, 0x17, 0x04, 0xd9, 0xfa, 0xc9,
+	0xe6, 0xfd, 0x3d, 0x61, 0xa3, 0x39, 0x25, 0xde, 0x3e, 0x4c, 0x6b, 0xd1, 0xa8, 0xe3, 0xf0, 0xba,
+	0x71, 0x14, 0xee, 0xd1, 0xfa, 0xc7, 0xbf, 0x3c, 0xaa, 0xbe, 0x7f, 0x9a, 0x57, 0x63, 0x82, 0xe6,
+	0x96, 0x7c, 0x1c, 0x69, 0xcd, 0xc1, 0xc0, 0xa2, 0xbd, 0x46, 0x59, 0x95, 0xbd, 0x26, 0x59, 0x95,
+	0xbd, 0x66, 0xfd, 0x8f, 0x22, 0x54, 0xd9, 0xdb, 0x68, 0xea, 0xb9, 0xa2, 0x05, 0x28, 0x3b, 0xad,
+	0x85, 0x20, 0xf1, 0xf6, 0xb9, 0x78, 0x92, 0xb7, 0xcf, 0xbf, 0xfe, 0xe6, 0x56, 0x55, 0x16, 0x69,
+	0x30, 0x36, 0x0c, 0xb0, 0x5a, 0x93, 0x85, 0x20, 0xa3, 0x89, 0xb4, 0x49, 0x63, 0xf0, 0x0d, 0x4c,
+	0x1a, 0xf7, 0x61, 0x98, 0xaa, 0x1e, 0xab, 0x9b, 0xdc, 0xdf, 0x92, 0x6e, 0x4f, 0x1a, 0xc6, 0xa0,
+	0xe5, 0xaa, 0xf1, 0x51, 0x04, 0x98, 0xf5, 0x0f, 0x8b, 0x70, 0x2d, 0x7b, 0xce, 0x79, 0xdf, 0x96,
+	0xb4, 0x80, 0xc2, 0x39, 0x3e, 0x3a, 0xf4, 0xec, 0x28, 0x01, 0x85, 0x93, 0x41, 0x84, 0xc5, 0x8b,
+	0xa2, 0xc4, 0x6d, 0x98, 0xf6, 0xd0, 0x48, 0x84, 0x63, 0x67, 0x45, 0x5a, 0x1c, 0x2f, 0x5e, 0x86,
+	0x76, 0x61, 0x6e, 0x33, 0x70, 0x5f, 0x3a, 0x11, 0x7e, 0x8a, 0x5f, 0x6f, 0xfa, 0x5d, 0xb7, 0xfd,
+	0x7a, 0xd9, 0x73, 0x76, 0xbb, 0xb8, 0xc3, 0x9f, 0x89, 0xdd, 0x3e, 0x3e, 0xaa, 0x7e, 0xa3, 0xc7,
+	0x40, 0xc8, 0xc1, 0x6c, 0xf5, 0x28, 0x50, 0x0b, 0x33, 0x28, 0x85, 0x68, 0x16, 0x21, 0xeb, 0xdf,
+	0x17, 0xe0, 0x32, 0x15, 0xa8, 0xf9, 0xcd, 0x82, 0x68, 0xfc, 0x8d, 0x5c, 0x35, 0xd5, 0x01, 0xf2,
+	0xbd, 0x48, 0x5d, 0x35, 0xb5, 0x17, 0x57, 0xb6, 0x06, 0x86, 0x56, 0x61, 0x8c, 0xff, 0x56, 0xcc,
+	0xc7, 0x33, 0x0a, 0xc3, 0xa2, 0x5b, 0x9d, 0x59, 0x8f, 0xe8, 0xc6, 0xe6, 0xc4, 0x5a, 0xf4, 0x1d,
+	0xb2, 0x8a, 0x6b, 0xfd, 0xa2, 0x08, 0xf3, 0x4d, 0x1c, 0xb8, 0xcf, 0x5f, 0x67, 0x0c, 0x66, 0x03,
+	0xa6, 0x45, 0x11, 0x1d, 0xb3, 0x7e, 0xc4, 0x58, 0x80, 0x1f, 0xd1, 0xd5, 0x90, 0x00, 0xb4, 0xe4,
+	0x89, 0x33, 0x22, 0x9e, 0xc2, 0x09, 0xf3, 0x1d, 0x18, 0x49, 0x44, 0x28, 0xa0, 0xeb, 0x2f, 0x4e,
+	0xa8, 0x1e, 0x9e, 0x52, 0x1e, 0xd5, 0xdf, 0xc9, 0xbe, 0xa2, 0xe4, 0x96, 0x84, 0x7e, 0x91, 0x67,
+	0xe8, 0x81, 0x25, 0x87, 0x55, 0x09, 0x96, 0x88, 0x0d, 0x07, 0x76, 0xe5, 0x9c, 0x9d, 0xd5, 0x52,
+	0x7d, 0x0c, 0x46, 0x6b, 0xf4, 0xda, 0x95, 0x28, 0xee, 0xff, 0xab, 0x08, 0x57, 0xc5, 0x3b, 0x9e,
+	0x8c, 0x69, 0xfe, 0x1c, 0xe6, 0x44, 0x51, 0xad, 0x47, 0x04, 0x06, 0xdc, 0xd1, 0x67, 0x9a, 0x05,
+	0xd9, 0x12, 0x33, 0xed, 0x70, 0x98, 0x78, 0xb2, 0xb3, 0xd0, 0xcf, 0xc6, 0x20, 0xfa, 0x89, 0x29,
+	0x5e, 0x04, 0x35, 0x4c, 0xaa, 0x3c, 0x53, 0x8f, 0x61, 0xa9, 0xf2, 0xcf, 0x4e, 0xca, 0xa0, 0x3a,
+	0xf8, 0x55, 0x0d, 0xaa, 0x2b, 0xe7, 0x92, 0x26, 0xd5, 0xfa, 0x24, 0x8c, 0xaf, 0xe3, 0x57, 0xf1,
+	0xbc, 0xff, 0x6e, 0x21, 0xf1, 0xa4, 0x91, 0x48, 0x18, 0xec, 0x6d, 0x63, 0x21, 0x0e, 0x39, 0x40,
+	0x9f, 0x34, 0xaa, 0x12, 0x06, 0x03, 0x5d, 0x85, 0x61, 0xe6, 0xb6, 0xdb, 0x39, 0x81, 0x6e, 0x2e,
+	0x1f, 0xe4, 0xb4, 0x19, 0x0a, 0x53, 0xd3, 0x39, 0xbe, 0xf5, 0x14, 0xae, 0x73, 0xaf, 0x71, 0x7d,
+	0xf1, 0x69, 0x43, 0xa7, 0xfc, 0x7c, 0x59, 0x0e, 0x5c, 0x7d, 0x8c, 0x93, 0xac, 0x47, 0x7b, 0xb0,
+	0xf4, 0x29, 0x4c, 0x69, 0xe5, 0x92, 0x22, 0x95, 0x4a, 0xe5, 0x1e, 0x92, 0xa4, 0x93, 0xd0, 0xd6,
+	0x35, 0x53, 0x13, 0x6a, 0x67, 0x2d, 0x4c, 0xa3, 0x65, 0x05, 0xf1, 0x2d, 0x72, 0x78, 0x0a, 0xae,
+	0x77, 0x5b, 0x39, 0xd7, 0x8c, 0xe3, 0xb1, 0xb8, 0x41, 0xe2, 0xcb, 0x2b, 0x6b, 0xad, 0x09, 0x18,
+	0x5b, 0xf4, 0xbd, 0x08, 0x7f, 0x49, 0x45, 0x1d, 0x6b, 0x12, 0xc6, 0x45, 0x55, 0x17, 0x87, 0xa1,
+	0xf5, 0x27, 0x03, 0x60, 0xf1, 0x89, 0x35, 0x59, 0x4f, 0xc5, 0x7c, 0xec, 0xa6, 0x3a, 0xcb, 0x3f,
+	0x54, 0xb3, 0xaa, 0x8d, 0x38, 0xae, 0x65, 0x3b, 0x8f, 0xca, 0x79, 0xed, 0xb8, 0x54, 0x0f, 0x48,
+	0x9c, 0x1c, 0xfd, 0x0f, 0x33, 0xd8, 0x24, 0x3b, 0x6c, 0x34, 0x06, 0x6b, 0x06, 0x9b, 0xd4, 0xe8,
+	0x9a, 0x59, 0xa6, 0xad, 0x4d, 0x03, 0x17, 0x39, 0x90, 0x7c, 0x6f, 0x29, 0x6b, 0xb8, 0x0f, 0x13,
+	0x2b, 0x68, 0xa5, 0xf2, 0x5f, 0xa8, 0x44, 0xd0, 0xb6, 0x3e, 0x97, 0xfc, 0x3c, 0x0a, 0xaf, 0x0d,
+	0xb5, 0x8a, 0x51, 0xed, 0x29, 0x25, 0x7a, 0x3a, 0x11, 0x0d, 0x56, 0xb1, 0x88, 0xff, 0xa1, 0xf4,
+	0xdd, 0x27, 0x1f, 0x52, 0xb7, 0x8b, 0xf9, 0x43, 0x15, 0xb1, 0x2c, 0x87, 0xe6, 0xdb, 0xef, 0xc2,
+	0x89, 0x78, 0x34, 0x8d, 0x82, 0x8a, 0x39, 0x7a, 0xd6, 0x95, 0x8b, 0x89, 0xbe, 0x75, 0x54, 0x10,
+	0x2f, 0x16, 0x52, 0x57, 0xc2, 0xa7, 0x95, 0x24, 0xeb, 0xda, 0x2d, 0x6e, 0x31, 0xe3, 0x16, 0x57,
+	0xbb, 0xf3, 0x8a, 0xfa, 0x5c, 0xeb, 0x0e, 0x7c, 0xf5, 0x6b, 0xa0, 0x7f, 0x7d, 0x1e, 0x2e, 0x6c,
+	0x3a, 0x7b, 0xae, 0x47, 0x78, 0x8f, 0x88, 0xdc, 0x8b, 0x6a, 0xa9, 0xdc, 0x12, 0xf9, 0xae, 0xb1,
+	0x86, 0xe4, 0x11, 0x0b, 0x6a, 0x98, 0xf7, 0x62, 0xd6, 0x2b, 0x52, 0x3d, 0x98, 0xfb, 0x07, 0x9a,
+	0xd5, 0x3f, 0x95, 0xe7, 0x84, 0x7a, 0xf7, 0x79, 0x7e, 0x27, 0x91, 0x6f, 0x85, 0x5a, 0xce, 0xd3,
+	0x01, 0xf0, 0x87, 0xce, 0x38, 0x00, 0xfe, 0x0f, 0x60, 0xec, 0xe9, 0xe1, 0xae, 0xcc, 0xe5, 0x71,
+	0xbe, 0x6f, 0x80, 0x75, 0xba, 0x06, 0x2f, 0x0e, 0x77, 0xcd, 0xd9, 0x3c, 0x54, 0x62, 0xc6, 0x60,
+	0xf1, 0xc3, 0xbf, 0x92, 0x60, 0xf1, 0x99, 0x79, 0x0a, 0x46, 0xbe, 0x96, 0x3c, 0x05, 0x86, 0x80,
+	0xef, 0xa3, 0x67, 0x1f, 0xf0, 0x5d, 0x0b, 0x86, 0x0e, 0x5f, 0x31, 0x18, 0x7a, 0x1d, 0x60, 0x24,
+	0x88, 0x43, 0x5a, 0x0f, 0x96, 0x86, 0xd8, 0xda, 0x09, 0x8f, 0xe3, 0x7f, 0x33, 0x0c, 0xd3, 0x6b,
+	0x6e, 0x18, 0x89, 0xc3, 0x13, 0xc6, 0x5f, 0xd6, 0x71, 0x51, 0xa6, 0x68, 0xbe, 0x5c, 0x08, 0x66,
+	0xe5, 0xad, 0x44, 0xda, 0x29, 0x0d, 0x01, 0xbd, 0xab, 0x5e, 0xb4, 0x14, 0x95, 0xe8, 0x9f, 0xe9,
+	0x8c, 0x41, 0xea, 0x0d, 0xcc, 0xdb, 0x9a, 0x9d, 0x3f, 0xd7, 0x30, 0xf2, 0x30, 0x69, 0xfc, 0xe7,
+	0xc1, 0xb9, 0xe8, 0x37, 0x47, 0x37, 0x44, 0xc4, 0xb7, 0x02, 0xdb, 0x70, 0x9e, 0x46, 0xd2, 0x11,
+	0x2f, 0x86, 0xdf, 0xe2, 0xfc, 0xc7, 0x34, 0x09, 0x2c, 0xe6, 0x0e, 0x7f, 0x2e, 0x4c, 0x03, 0x4f,
+	0x75, 0x69, 0x81, 0x1a, 0x30, 0x87, 0x81, 0xa0, 0x2d, 0xb8, 0xb8, 0x19, 0xe0, 0x0e, 0x77, 0x9b,
+	0xed, 0x05, 0x5c, 0x4b, 0x64, 0x4f, 0xf7, 0x68, 0x24, 0xcc, 0x9e, 0xa8, 0x6e, 0x61, 0x59, 0xaf,
+	0x32, 0x70, 0x03, 0x3a, 0x5a, 0x86, 0xc9, 0x06, 0x76, 0x82, 0xf6, 0xfe, 0x53, 0xfc, 0x9a, 0x7c,
+	0x77, 0xc2, 0xf2, 0x70, 0x1c, 0x3e, 0x36, 0xa4, 0x35, 0x64, 0xa0, 0xb4, 0x4a, 0xbd, 0x7f, 0xd7,
+	0x91, 0xd0, 0xf7, 0xe0, 0x7c, 0xc3, 0x0f, 0xa2, 0xfa, 0xeb, 0x44, 0x0a, 0x29, 0x56, 0x58, 0xbf,
+	0x24, 0x42, 0xe8, 0x86, 0x7e, 0x10, 0xb5, 0x76, 0xd5, 0x79, 0xe3, 0x78, 0xe8, 0x11, 0x11, 0x6a,
+	0x89, 0xa0, 0x2d, 0x6d, 0x38, 0x2c, 0xfa, 0x06, 0x17, 0x5c, 0xa9, 0x74, 0x6e, 0x32, 0xe4, 0x24,
+	0xb0, 0xd0, 0x6b, 0x98, 0xd6, 0x8f, 0xd6, 0x23, 0xb7, 0x4b, 0xf8, 0x11, 0x68, 0xc9, 0x58, 0x4c,
+	0x20, 0xf5, 0xdb, 0xbc, 0x97, 0xd7, 0x92, 0x07, 0xf8, 0x39, 0xad, 0x57, 0x23, 0x82, 0x9b, 0xf0,
+	0xd1, 0x33, 0x1a, 0xc1, 0x98, 0xcd, 0x4c, 0x2d, 0x14, 0xa1, 0xad, 0xc9, 0x20, 0x68, 0xe0, 0xbd,
+	0x43, 0x7a, 0x3c, 0xe9, 0x8c, 0x3a, 0x61, 0x32, 0xc2, 0xb5, 0x9d, 0x42, 0x45, 0x9b, 0x70, 0x61,
+	0x3b, 0xc4, 0x9b, 0x01, 0x7e, 0xe9, 0xe2, 0x57, 0x82, 0xde, 0x38, 0xa5, 0x47, 0x97, 0x9b, 0xd0,
+	0xeb, 0xb1, 0x5a, 0x13, 0xc1, 0x34, 0x72, 0xe5, 0x03, 0x18, 0x53, 0xf6, 0x9b, 0xe1, 0xed, 0xf9,
+	0xb4, 0xfa, 0xf6, 0x7c, 0x54, 0x7d, 0x63, 0xfe, 0x57, 0x05, 0x66, 0x67, 0x54, 0x36, 0x30, 0x37,
+	0x5a, 0x6c, 0xc0, 0xa8, 0x2c, 0x94, 0x2f, 0x1d, 0x84, 0xe0, 0x93, 0xf8, 0x70, 0xb2, 0xe3, 0x23,
+	0x4e, 0xb7, 0xda, 0xdb, 0x98, 0xc6, 0xd7, 0x6b, 0xfb, 0xfb, 0x9d, 0xf8, 0x4d, 0x24, 0x7f, 0xbf,
+	0x19, 0x38, 0xed, 0x17, 0xb1, 0xf1, 0xf5, 0xc7, 0xe4, 0x7c, 0xa8, 0x15, 0x3c, 0xf3, 0xd5, 0x9c,
+	0x9e, 0xb6, 0x88, 0x57, 0x8a, 0xe4, 0x09, 0xf2, 0x69, 0x28, 0x2b, 0xd6, 0x0f, 0x8e, 0x8a, 0x40,
+	0x3d, 0x81, 0xa7, 0x2c, 0x9b, 0x3d, 0xe9, 0x33, 0xf6, 0xe0, 0xbd, 0xf4, 0xa3, 0x34, 0xca, 0x98,
+	0xe3, 0x47, 0x69, 0xea, 0x34, 0xc6, 0xcf, 0xd3, 0xb6, 0xe1, 0xb2, 0x8d, 0x0f, 0xfc, 0x97, 0xf8,
+	0x6c, 0xc9, 0xfe, 0x10, 0x2e, 0xe9, 0x04, 0xb7, 0x7b, 0x1d, 0x1a, 0xcb, 0x83, 0x5d, 0xc1, 0x1a,
+	0xe3, 0xf6, 0x71, 0x04, 0x16, 0xb7, 0x8f, 0x45, 0x72, 0x22, 0x7f, 0xaa, 0xfc, 0x96, 0xd6, 0x59,
+	0x3e, 0xcc, 0xeb, 0xc4, 0x6b, 0x9d, 0x0e, 0x4d, 0x46, 0xd0, 0x76, 0x7b, 0x8e, 0x17, 0xa1, 0x0d,
+	0x18, 0x53, 0x7e, 0x26, 0xc4, 0x26, 0xa5, 0x86, 0xad, 0x7e, 0x2f, 0x2e, 0x50, 0xc5, 0x3b, 0x05,
+	0xce, 0xc2, 0x50, 0x4d, 0x4e, 0x0f, 0x99, 0x32, 0xb5, 0xcd, 0x3a, 0x4c, 0x28, 0x3f, 0xa5, 0x16,
+	0x42, 0x63, 0x72, 0x2a, 0x2d, 0xe8, 0x13, 0xa6, 0xa3, 0x58, 0x6d, 0xa8, 0x98, 0x26, 0x8d, 0xc6,
+	0x98, 0x78, 0x8d, 0x96, 0xe3, 0x68, 0x15, 0xfd, 0xaf, 0xbe, 0xa7, 0xb2, 0x22, 0x55, 0x58, 0xff,
+	0x60, 0x10, 0x2e, 0xf3, 0xc5, 0x38, 0xcb, 0x15, 0x47, 0x3f, 0x81, 0x31, 0x65, 0x8d, 0xf9, 0xa4,
+	0x5f, 0x13, 0xde, 0x32, 0x59, 0x7b, 0x81, 0x89, 0x77, 0x87, 0xb4, 0xa0, 0x95, 0x58, 0x6e, 0x22,
+	0xde, 0xa9, 0xdb, 0xa6, 0x0b, 0x93, 0xfa, 0x42, 0x73, 0x09, 0xf7, 0x86, 0xb1, 0x11, 0x1d, 0x54,
+	0x04, 0x81, 0xea, 0xb4, 0x8c, 0xcb, 0x4d, 0x93, 0x75, 0xe9, 0x9b, 0xe8, 0x4b, 0xb8, 0x90, 0x5a,
+	0x65, 0xae, 0xb1, 0xdd, 0x32, 0x36, 0x98, 0x82, 0x66, 0x21, 0xd1, 0x03, 0x5a, 0x9c, 0xd9, 0x6c,
+	0xba, 0x11, 0xd4, 0x81, 0x71, 0x75, 0xe1, 0xb9, 0x08, 0x7e, 0x3d, 0x67, 0x2a, 0x19, 0x20, 0x13,
+	0x8a, 0xf8, 0x5c, 0xd2, 0xb5, 0xd7, 0xf3, 0x5b, 0x6a, 0x54, 0xeb, 0x23, 0x70, 0x9e, 0xfd, 0x26,
+	0x2c, 0x60, 0x33, 0xc0, 0x21, 0xf6, 0xda, 0x58, 0x75, 0x7c, 0xfa, 0xaa, 0x2c, 0xe0, 0xdf, 0x15,
+	0xa0, 0x6c, 0xa2, 0xdb, 0xc0, 0x5e, 0x07, 0x6d, 0x42, 0x29, 0xd9, 0x10, 0xdf, 0xd5, 0x96, 0xf8,
+	0x2a, 0x64, 0x77, 0x89, 0x88, 0xe4, 0xa9, 0x6e, 0xae, 0xc3, 0x05, 0xa5, 0xec, 0x94, 0x1e, 0x66,
+	0x69, 0x54, 0x55, 0xab, 0x5e, 0xa1, 0x8e, 0x74, 0x4b, 0xfe, 0x81, 0xe3, 0x7a, 0x44, 0x40, 0x54,
+	0xe2, 0x4a, 0x40, 0x5c, 0xca, 0xe7, 0x86, 0x69, 0x9e, 0xb4, 0x54, 0x78, 0x5b, 0x4a, 0x10, 0xeb,
+	0x63, 0xca, 0xc1, 0xb9, 0xbe, 0xc2, 0xde, 0xf9, 0x48, 0x62, 0xd7, 0x60, 0x68, 0x6b, 0xad, 0xb1,
+	0x58, 0xe3, 0xaf, 0x86, 0xd8, 0x5b, 0xd3, 0x6e, 0xd8, 0x6a, 0x3b, 0x36, 0xab, 0xb0, 0x3e, 0xa2,
+	0xa1, 0xfa, 0x78, 0xa0, 0x37, 0x89, 0x77, 0x13, 0x86, 0x79, 0x11, 0xc7, 0xa4, 0xf7, 0xd4, 0x5d,
+	0x0e, 0x25, 0xea, 0xac, 0x4d, 0x21, 0x5f, 0x77, 0xb1, 0x13, 0x2a, 0x1f, 0xe6, 0xf7, 0x89, 0x5c,
+	0xce, 0xca, 0xf8, 0x77, 0x79, 0x52, 0xc6, 0x51, 0xa5, 0xc5, 0x4c, 0x13, 0x17, 0x30, 0xb6, 0xfc,
+	0xcb, 0xfa, 0xf3, 0x22, 0x4c, 0x8b, 0x88, 0x32, 0x9a, 0x95, 0xa1, 0x6f, 0xbc, 0xcc, 0xef, 0xeb,
+	0x41, 0x7b, 0x16, 0x65, 0xd0, 0x9e, 0xaf, 0x90, 0xc1, 0x83, 0x87, 0xfb, 0x39, 0xe1, 0x9b, 0xba,
+	0xa7, 0x52, 0xfa, 0x1e, 0xd4, 0xa4, 0x6f, 0xd3, 0x78, 0x34, 0xe9, 0x9b, 0x2e, 0x0b, 0x93, 0xbe,
+	0x85, 0xcc, 0xfd, 0x55, 0x04, 0xa6, 0xf7, 0xc9, 0xd6, 0xd2, 0x9a, 0x3c, 0xe9, 0x73, 0xab, 0x35,
+	0xfa, 0x2a, 0x7f, 0x63, 0x75, 0x69, 0x91, 0xec, 0x69, 0xde, 0x55, 0xb1, 0x02, 0xf7, 0xa8, 0x0b,
+	0x1d, 0xa7, 0xa9, 0x6e, 0x4c, 0xca, 0x62, 0x79, 0x2c, 0x0a, 0x05, 0xc4, 0x7a, 0x28, 0xdf, 0xf8,
+	0x1b, 0xa8, 0x65, 0x05, 0x7f, 0x5d, 0xa7, 0xd1, 0x0b, 0x1e, 0xd3, 0xf5, 0x3a, 0x8b, 0x4e, 0xfc,
+	0x71, 0x81, 0x85, 0x43, 0x68, 0x6c, 0x28, 0x71, 0xf2, 0xbd, 0xe7, 0xbe, 0x62, 0x64, 0x55, 0x9a,
+	0x79, 0xea, 0x7a, 0x1d, 0xd5, 0xc8, 0x4a, 0x33, 0x31, 0xf2, 0x57, 0x8b, 0xad, 0x17, 0xae, 0xd7,
+	0xb1, 0x93, 0xd0, 0xe8, 0x03, 0x98, 0x50, 0x8a, 0xe4, 0x47, 0x9a, 0x85, 0x19, 0x54, 0xd1, 0xdd,
+	0x8e, 0xad, 0x43, 0x5a, 0xbf, 0x5b, 0x84, 0xcb, 0x39, 0x79, 0x5c, 0xa8, 0x0e, 0x48, 0x6d, 0x03,
+	0x72, 0xa6, 0x78, 0x80, 0x66, 0xfa, 0x42, 0x53, 0xe3, 0x91, 0x12, 0x10, 0x7d, 0x0c, 0x63, 0x6a,
+	0x5a, 0x99, 0xa2, 0x12, 0x05, 0xdc, 0x9c, 0x4a, 0x46, 0x05, 0x47, 0x21, 0x40, 0xdc, 0x13, 0xfe,
+	0x90, 0xb9, 0x41, 0x24, 0x1a, 0x25, 0x27, 0xcd, 0x99, 0x24, 0xc7, 0x51, 0x9a, 0xb1, 0xfe, 0x6e,
+	0x11, 0xae, 0xe6, 0xcc, 0x43, 0x03, 0x47, 0xff, 0x2f, 0xa6, 0x22, 0x91, 0x29, 0x68, 0xe0, 0x6b,
+	0xca, 0x14, 0x64, 0xfd, 0x61, 0x11, 0x66, 0xb7, 0x7b, 0x21, 0xf5, 0x74, 0x5d, 0xf5, 0x5e, 0x62,
+	0x2f, 0xf2, 0x83, 0xd7, 0xd4, 0x53, 0x0f, 0xbd, 0x0b, 0x43, 0x2b, 0xb8, 0xdb, 0xf5, 0xf9, 0x67,
+	0xed, 0x8a, 0xb0, 0x7b, 0x27, 0xa1, 0x29, 0xd0, 0xca, 0x39, 0x9b, 0x41, 0xa3, 0x0f, 0x60, 0x74,
+	0x05, 0x3b, 0x41, 0xb4, 0x8b, 0x1d, 0x21, 0xb9, 0x5e, 0xe2, 0xa8, 0x0a, 0x0a, 0x07, 0x58, 0x39,
+	0x67, 0xc7, 0xd0, 0x68, 0x01, 0x06, 0x37, 0x7d, 0x6f, 0x4f, 0x3e, 0x85, 0xcb, 0x68, 0x90, 0xc0,
+	0xac, 0x9c, 0xb3, 0x29, 0x2c, 0x7a, 0x06, 0x13, 0xb5, 0x3d, 0xec, 0x45, 0xcf, 0x70, 0xe4, 0x74,
+	0x9c, 0xc8, 0xe1, 0x12, 0xce, 0xcd, 0x2c, 0x64, 0x0d, 0x98, 0x66, 0xff, 0x55, 0x0b, 0xea, 0x43,
+	0x30, 0xf0, 0x2c, 0xdc, 0xb3, 0x8e, 0x0a, 0x50, 0x5e, 0xf2, 0x5f, 0x79, 0xc6, 0x89, 0xf9, 0x8e,
+	0x3e, 0x31, 0xc2, 0x1f, 0xdb, 0x00, 0x9f, 0x98, 0x9a, 0x77, 0x60, 0x70, 0xd3, 0xf5, 0xf6, 0x12,
+	0x1f, 0x75, 0x03, 0x1e, 0x81, 0xa2, 0x23, 0x74, 0xbd, 0x3d, 0xb4, 0x26, 0xa4, 0x29, 0xce, 0xef,
+	0x07, 0x34, 0x11, 0xce, 0x80, 0xad, 0x42, 0xc7, 0x52, 0x13, 0xfb, 0x2d, 0x06, 0xf8, 0x36, 0xcc,
+	0x65, 0xb4, 0x8b, 0x26, 0x25, 0xb3, 0x1c, 0xa4, 0x4c, 0xf2, 0x2d, 0x98, 0x31, 0x2e, 0x41, 0x0a,
+	0xf0, 0xbf, 0x17, 0x0c, 0x7b, 0x89, 0x8d, 0xbc, 0x0c, 0xc3, 0x22, 0x66, 0x2e, 0xfb, 0xaa, 0x88,
+	0x9f, 0xd4, 0xef, 0x54, 0x9c, 0x35, 0x1e, 0xc9, 0x50, 0x1e, 0xa9, 0xa6, 0x12, 0x5b, 0x80, 0x9d,
+	0x88, 0x0f, 0xbf, 0xc2, 0xbe, 0x97, 0xb4, 0x48, 0x9b, 0x2b, 0x7e, 0x18, 0x79, 0xd2, 0x2d, 0xc2,
+	0x96, 0xbf, 0xd1, 0x1d, 0x28, 0x2d, 0x7f, 0x19, 0xe1, 0xc0, 0x73, 0xba, 0x3c, 0x7a, 0x28, 0xcf,
+	0x58, 0x64, 0xa7, 0xca, 0xad, 0xbf, 0x2c, 0xd2, 0x08, 0x8a, 0x39, 0x1b, 0x8c, 0xcc, 0xd1, 0x46,
+	0x83, 0x8f, 0xb9, 0xb8, 0xd1, 0x40, 0xf3, 0x30, 0xba, 0xd1, 0xd0, 0xc2, 0x07, 0xdb, 0x71, 0x01,
+	0x69, 0x9c, 0x74, 0xa4, 0x16, 0xb4, 0xf7, 0xdd, 0x08, 0xb7, 0xa3, 0xc3, 0x80, 0xb3, 0x45, 0x3b,
+	0x55, 0x8e, 0x2c, 0x18, 0x7f, 0xdc, 0x75, 0x77, 0xdb, 0x82, 0x18, 0x1b, 0x88, 0x56, 0x86, 0x6e,
+	0xc1, 0x24, 0x4f, 0xb2, 0xc9, 0xa2, 0x2b, 0xf3, 0x0c, 0x6e, 0x76, 0xa2, 0x94, 0xb4, 0xbb, 0xe8,
+	0x7b, 0x91, 0xe3, 0x7a, 0x38, 0xb0, 0x0f, 0xbd, 0xc8, 0xe5, 0x29, 0xd7, 0x47, 0xed, 0x54, 0x39,
+	0x7a, 0x07, 0x66, 0x64, 0xd9, 0x46, 0xd0, 0xde, 0xc7, 0x61, 0x14, 0xd0, 0x48, 0xf4, 0xf4, 0x25,
+	0xbb, 0x6d, 0xae, 0xa4, 0x2d, 0x74, 0xfd, 0xc3, 0xce, 0xb2, 0xf7, 0xd2, 0x0d, 0x7c, 0x96, 0x9e,
+	0x71, 0x84, 0xb7, 0x90, 0x28, 0xb7, 0x36, 0x8d, 0x67, 0xef, 0x2b, 0x6c, 0x24, 0xeb, 0xb8, 0x00,
+	0xf3, 0xc6, 0xe3, 0x21, 0x3e, 0xcc, 0x95, 0x24, 0xc7, 0x57, 0x76, 0xe1, 0x1d, 0x18, 0xa4, 0x5f,
+	0x6a, 0xa6, 0xeb, 0x8b, 0xeb, 0x3f, 0x8a, 0xcf, 0x48, 0x91, 0x5a, 0x9b, 0xc2, 0xa0, 0xc7, 0x52,
+	0x2a, 0x1b, 0xa0, 0x52, 0xd9, 0xbd, 0x24, 0xe7, 0x33, 0x34, 0xae, 0x4a, 0x67, 0x67, 0x21, 0x91,
+	0xfd, 0x65, 0x01, 0xaa, 0x7d, 0xb8, 0x82, 0x1c, 0x53, 0xe1, 0x04, 0x63, 0x7a, 0x22, 0xc7, 0xc4,
+	0x1c, 0x8d, 0x17, 0x4e, 0xc6, 0x79, 0xce, 0x7a, 0x58, 0x8b, 0x80, 0xd2, 0xdf, 0x0f, 0xf4, 0x6d,
+	0x18, 0x6d, 0x34, 0x56, 0xb4, 0xcb, 0xa9, 0xe4, 0x7d, 0x91, 0x1d, 0x43, 0x58, 0xef, 0xc1, 0xac,
+	0x24, 0xc2, 0x42, 0xb8, 0x2a, 0xaf, 0x19, 0x78, 0x96, 0x23, 0xf9, 0x88, 0x22, 0x2e, 0xb0, 0x7e,
+	0x98, 0xc2, 0x6b, 0x1c, 0x1e, 0x1c, 0x38, 0xc1, 0x6b, 0x54, 0xd3, 0xf1, 0x06, 0xfa, 0x7e, 0x29,
+	0xeb, 0x83, 0x3f, 0x3f, 0xaa, 0x9e, 0x53, 0x89, 0xdf, 0x86, 0x5b, 0x12, 0x44, 0x96, 0x72, 0x66,
+	0x45, 0xad, 0x77, 0xf2, 0x06, 0xfd, 0xb7, 0x8a, 0x50, 0xed, 0x03, 0x8a, 0xfe, 0xa4, 0xc0, 0xa2,
+	0x94, 0xcb, 0x12, 0xde, 0xab, 0x0f, 0x92, 0x5b, 0xd1, 0x8c, 0x7f, 0x57, 0xfb, 0xc5, 0x54, 0x86,
+	0x0f, 0x7f, 0xfb, 0xaf, 0xdf, 0x98, 0xeb, 0xea, 0x7d, 0xa9, 0x7c, 0x0f, 0x50, 0xba, 0x81, 0x7e,
+	0xfb, 0x60, 0x50, 0xdd, 0x07, 0x36, 0x4c, 0x6b, 0xdf, 0xab, 0x93, 0x1c, 0xe1, 0xab, 0x00, 0x3c,
+	0xda, 0xf6, 0x9a, 0xbf, 0xc7, 0x9f, 0x04, 0x28, 0x25, 0xd6, 0x23, 0x98, 0x49, 0xd0, 0xe4, 0x4a,
+	0xcc, 0xb7, 0x41, 0xaa, 0x5d, 0x94, 0xe8, 0x40, 0xfd, 0xc2, 0x2f, 0x8f, 0xaa, 0x13, 0x84, 0x11,
+	0xde, 0x8d, 0xe3, 0xda, 0x89, 0xbf, 0xac, 0x67, 0xaa, 0x76, 0x5c, 0xeb, 0x6a, 0x8f, 0xb9, 0x1e,
+	0xc0, 0x79, 0x56, 0x92, 0x88, 0x1e, 0xa5, 0x42, 0xf3, 0xbd, 0xc1, 0x01, 0xad, 0x19, 0xea, 0xb0,
+	0x49, 0x7f, 0xd4, 0xe2, 0xa7, 0x01, 0xd6, 0x36, 0x0b, 0x65, 0x1a, 0x17, 0xcb, 0x08, 0x55, 0x83,
+	0xb5, 0xf8, 0x09, 0x83, 0xb8, 0x02, 0x10, 0x70, 0x9e, 0xff, 0xaa, 0x8b, 0x3b, 0x7b, 0x34, 0xfd,
+	0x54, 0x7d, 0x9c, 0x5f, 0x01, 0x0c, 0x3a, 0x84, 0x00, 0x45, 0xb3, 0x3e, 0x85, 0x99, 0xc5, 0x2e,
+	0x76, 0x82, 0x64, 0x7b, 0xe8, 0x16, 0x0c, 0xd3, 0x32, 0xfd, 0x66, 0xdb, 0x21, 0x45, 0xf4, 0x66,
+	0x9b, 0x57, 0x12, 0x85, 0x8e, 0x05, 0xf5, 0x51, 0x87, 0x14, 0xeb, 0x52, 0x43, 0xf4, 0x77, 0xc2,
+	0xdd, 0xcf, 0x30, 0x7a, 0x06, 0x67, 0x7d, 0x42, 0xfd, 0x49, 0x4c, 0x99, 0xc7, 0x4e, 0xe6, 0x80,
+	0xfa, 0xff, 0xc3, 0x7c, 0xad, 0xd7, 0xc3, 0x5e, 0x27, 0x46, 0xdc, 0x0a, 0x9c, 0x13, 0x3a, 0xf6,
+	0xa3, 0x1a, 0x0c, 0x51, 0x68, 0x69, 0x06, 0xe4, 0xdd, 0x35, 0x74, 0x87, 0xc2, 0x71, 0xfd, 0x96,
+	0x36, 0xc0, 0x30, 0xad, 0x0e, 0xcc, 0x35, 0x0e, 0x77, 0x0f, 0x5c, 0x96, 0xe4, 0x8b, 0x3e, 0x8e,
+	0x11, 0x6d, 0xaf, 0x8a, 0xe8, 0xd3, 0x6c, 0x32, 0x6e, 0xc7, 0x19, 0xc5, 0xe8, 0x25, 0x3d, 0x7f,
+	0x30, 0xf3, 0xf2, 0xc1, 0xdd, 0x18, 0x95, 0x8a, 0x9e, 0xac, 0x15, 0x5a, 0xcd, 0x23, 0x54, 0x5b,
+	0x17, 0xe1, 0x82, 0x6a, 0x52, 0x61, 0x3b, 0x64, 0x06, 0x2e, 0xea, 0xa6, 0x12, 0x56, 0xfc, 0x05,
+	0x4c, 0xb3, 0x3b, 0x00, 0x16, 0x0e, 0x6c, 0x21, 0x8e, 0x7c, 0x55, 0x6c, 0x2e, 0x24, 0xae, 0xf6,
+	0xa9, 0x77, 0xb6, 0x0c, 0xf4, 0xd8, 0x5c, 0x60, 0x3e, 0x81, 0x2f, 0x17, 0x34, 0x83, 0x5c, 0xb1,
+	0xb9, 0x50, 0x1f, 0xe6, 0x7a, 0x3e, 0xa1, 0xce, 0x96, 0xff, 0x57, 0x42, 0x7d, 0x81, 0xba, 0xa1,
+	0x9b, 0xb3, 0x0d, 0x8b, 0x96, 0x26, 0xa1, 0xe8, 0x76, 0x84, 0xb0, 0xe5, 0x76, 0xac, 0x3f, 0x2b,
+	0xc0, 0x6d, 0xf6, 0x49, 0x32, 0xe3, 0x51, 0xcd, 0x3d, 0x03, 0x19, 0xbd, 0x0f, 0x2c, 0xeb, 0x0e,
+	0xff, 0xee, 0x5b, 0xb9, 0x09, 0x93, 0x19, 0x25, 0x86, 0x80, 0x6a, 0x30, 0xae, 0xfa, 0x96, 0x24,
+	0x82, 0x05, 0x64, 0xd8, 0xf0, 0xec, 0xb1, 0x83, 0xe7, 0x8e, 0xf4, 0x37, 0x79, 0x01, 0x97, 0x97,
+	0xbf, 0x24, 0x1b, 0x82, 0xcb, 0x9a, 0xfc, 0x1e, 0x2e, 0x76, 0x16, 0x9d, 0xda, 0xe2, 0x3b, 0x46,
+	0x97, 0x86, 0x92, 0xc5, 0x44, 0x4a, 0x14, 0xe2, 0xaa, 0x14, 0x62, 0x46, 0x6d, 0xad, 0xcc, 0xfa,
+	0x4f, 0x05, 0x98, 0x37, 0xb7, 0xc6, 0x19, 0xcb, 0x2a, 0x5c, 0x58, 0x74, 0x3c, 0xdf, 0x73, 0xdb,
+	0x4e, 0xb7, 0xd1, 0xde, 0xc7, 0x9d, 0xc3, 0xae, 0x70, 0xb9, 0x91, 0x5c, 0x86, 0x48, 0xbd, 0x1c,
+	0x5d, 0x80, 0xd8, 0x69, 0x2c, 0xf4, 0x1e, 0xcc, 0x52, 0x87, 0x07, 0xc6, 0x7b, 0xbb, 0x38, 0x90,
+	0xf4, 0x58, 0xcf, 0x32, 0x6a, 0xd1, 0x7d, 0xb8, 0xc8, 0x3e, 0x2a, 0x9d, 0x6d, 0xcf, 0x8d, 0x24,
+	0x12, 0x13, 0x8e, 0x4d, 0x55, 0x77, 0xee, 0xc0, 0xe8, 0x46, 0x0f, 0xf3, 0x24, 0xdb, 0x23, 0x30,
+	0xb8, 0xba, 0xbe, 0xba, 0xc5, 0x52, 0xec, 0x6d, 0x6e, 0x6f, 0x95, 0x0a, 0x08, 0xe0, 0xfc, 0xd2,
+	0xf2, 0xda, 0xf2, 0xd6, 0x72, 0xa9, 0x78, 0xa7, 0xa5, 0xfa, 0xe4, 0xa0, 0xcb, 0x30, 0xb7, 0xb4,
+	0xdc, 0x5c, 0x5d, 0x5c, 0x6e, 0x6d, 0x7d, 0x7f, 0x73, 0xb9, 0xa5, 0x07, 0x5b, 0x9a, 0x86, 0x92,
+	0x5a, 0xb9, 0xb5, 0xb1, 0xb5, 0xc9, 0xf2, 0xe6, 0xa9, 0xa5, 0x3b, 0xcb, 0xf5, 0xda, 0xf6, 0xd6,
+	0xca, 0x7a, 0x69, 0xc0, 0x1a, 0x1c, 0x29, 0x96, 0x8a, 0x77, 0x7e, 0xa2, 0x39, 0xec, 0xa0, 0x79,
+	0x28, 0x73, 0xf0, 0xed, 0x46, 0xed, 0x71, 0x76, 0x13, 0xac, 0xf6, 0xd9, 0xa3, 0x5a, 0xa9, 0x80,
+	0xae, 0xc0, 0x25, 0xad, 0x74, 0xb3, 0xd6, 0x68, 0xec, 0x6c, 0xd8, 0x4b, 0x6b, 0xcb, 0x8d, 0x46,
+	0xa9, 0x78, 0xa7, 0xa9, 0x05, 0xe8, 0x21, 0x2d, 0x3c, 0x7b, 0x54, 0x6b, 0xd9, 0xcb, 0x9f, 0x6d,
+	0xaf, 0xda, 0xcb, 0x4b, 0xe9, 0x16, 0xb4, 0xda, 0xef, 0x2f, 0x37, 0x4a, 0x05, 0x74, 0x11, 0xa6,
+	0xb4, 0xd2, 0xf5, 0x8d, 0x52, 0xf1, 0xce, 0x2d, 0xfe, 0xf6, 0x0f, 0x4d, 0x02, 0x2c, 0x2d, 0x37,
+	0x16, 0x97, 0xd7, 0x97, 0x56, 0xd7, 0x1f, 0x97, 0xce, 0xa1, 0x09, 0x18, 0xad, 0xc9, 0x9f, 0x85,
+	0x3b, 0xd7, 0x60, 0x2a, 0x21, 0x3e, 0x12, 0x08, 0x29, 0x79, 0x95, 0xce, 0x2d, 0xfc, 0xec, 0x0f,
+	0x0a, 0x30, 0x46, 0xb6, 0xbe, 0x70, 0xcf, 0xf8, 0x42, 0x11, 0xaa, 0xf8, 0x92, 0xf3, 0xe0, 0xf7,
+	0x99, 0x12, 0x14, 0xe5, 0x82, 0x95, 0x1c, 0x8d, 0x9b, 0x02, 0xdc, 0x2e, 0xdc, 0x2f, 0x20, 0x9b,
+	0xda, 0x9a, 0x13, 0x52, 0x9b, 0xa4, 0x6c, 0x96, 0x02, 0x2b, 0x19, 0xd5, 0x42, 0xd8, 0xfb, 0x75,
+	0xb0, 0x54, 0x9a, 0x19, 0x12, 0xd8, 0xb7, 0x4f, 0x26, 0x69, 0x89, 0x36, 0x6f, 0x9d, 0x0c, 0x1c,
+	0x3d, 0x81, 0x09, 0x22, 0x9b, 0x48, 0x30, 0x74, 0x39, 0x89, 0xa8, 0x88, 0x43, 0x95, 0x79, 0x73,
+	0xa5, 0x0c, 0x91, 0x39, 0x4e, 0x07, 0x12, 0x46, 0x8e, 0x47, 0x34, 0xe2, 0x19, 0x99, 0xc4, 0x9e,
+	0x95, 0xb0, 0x9b, 0xfe, 0xca, 0x85, 0x44, 0x71, 0xf3, 0xc1, 0xfd, 0x02, 0x6a, 0xd0, 0xe7, 0x93,
+	0x9a, 0x90, 0x83, 0x84, 0xbf, 0x50, 0x5a, 0xfa, 0x61, 0xbd, 0xa9, 0x4a, 0xeb, 0x74, 0x86, 0x74,
+	0xb4, 0x0e, 0x28, 0x2d, 0x3b, 0xa0, 0x6b, 0xf1, 0x3e, 0x30, 0x8b, 0x15, 0x95, 0xd9, 0xd4, 0x15,
+	0xe2, 0x32, 0xf9, 0x7a, 0xa0, 0x65, 0x98, 0xe4, 0x4e, 0x9e, 0x5c, 0x9a, 0x41, 0x79, 0xf2, 0x50,
+	0x26, 0x99, 0xc7, 0x74, 0x9e, 0xa4, 0x44, 0x84, 0x2a, 0xf1, 0x38, 0x92, 0x62, 0x52, 0xe5, 0xb2,
+	0xb1, 0x8e, 0x8f, 0xef, 0x11, 0x4c, 0xea, 0xc2, 0x15, 0x12, 0x0b, 0x64, 0x94, 0xb9, 0x32, 0x3b,
+	0xd4, 0x82, 0xb9, 0x67, 0x8e, 0x4b, 0x35, 0x6c, 0x7e, 0x51, 0x25, 0xae, 0x99, 0x50, 0x35, 0xe7,
+	0xde, 0xa9, 0x81, 0xbd, 0x4e, 0xa5, 0x5f, 0xe0, 0x00, 0x7a, 0x6c, 0x1a, 0x42, 0x46, 0xd0, 0xaf,
+	0xe9, 0x90, 0xa5, 0x67, 0x08, 0x31, 0xdd, 0xbc, 0x56, 0xb2, 0x9c, 0x05, 0xd0, 0x33, 0x2a, 0xa4,
+	0x24, 0x28, 0x2a, 0x7b, 0xe2, 0xd4, 0xe4, 0xca, 0xd4, 0xd5, 0x38, 0x72, 0x93, 0xb7, 0xfe, 0x21,
+	0xca, 0x98, 0xb8, 0x4c, 0x62, 0xf7, 0x0b, 0xe8, 0x0b, 0x7a, 0xaa, 0x8d, 0xe4, 0x76, 0xdc, 0x68,
+	0x9f, 0x7b, 0xbd, 0x5c, 0x36, 0x12, 0xe0, 0x07, 0x25, 0x87, 0xba, 0x0d, 0xd3, 0x26, 0xff, 0x04,
+	0x39, 0xa1, 0x39, 0xce, 0x0b, 0x99, 0xbb, 0xc0, 0x26, 0xa2, 0x56, 0x27, 0x7b, 0x91, 0x72, 0xae,
+	0xc7, 0x33, 0x69, 0x7e, 0x0c, 0x93, 0x64, 0x97, 0x3c, 0xc5, 0xb8, 0x57, 0xeb, 0xba, 0x2f, 0x71,
+	0x88, 0x44, 0x50, 0x0d, 0x59, 0x94, 0x85, 0x7b, 0xbb, 0x80, 0xbe, 0x09, 0x63, 0x3b, 0x4e, 0xd4,
+	0xde, 0xe7, 0x6f, 0xc0, 0xc5, 0x13, 0x71, 0x5a, 0x56, 0x11, 0xbf, 0x68, 0xe5, 0xfd, 0x02, 0xfa,
+	0x2e, 0x0c, 0x3f, 0xc6, 0x11, 0xf5, 0xd7, 0xbc, 0x2e, 0xaf, 0xea, 0x98, 0x5b, 0xcc, 0xaa, 0x27,
+	0x1d, 0xd8, 0x44, 0x87, 0x93, 0xfa, 0x3c, 0xba, 0x07, 0xc0, 0x18, 0x02, 0xa5, 0x90, 0xac, 0xae,
+	0xa4, 0xba, 0x8d, 0x1e, 0x93, 0xcf, 0x7b, 0x17, 0x47, 0xf8, 0xa4, 0x4d, 0x66, 0xcd, 0xd1, 0x1a,
+	0x4c, 0xca, 0xa8, 0xa2, 0xeb, 0xd4, 0xe1, 0xdf, 0x4a, 0x10, 0x0b, 0x4f, 0x41, 0xed, 0x43, 0x72,
+	0x2a, 0xd8, 0xd5, 0x99, 0x0c, 0x38, 0x82, 0xb2, 0x42, 0x90, 0xc8, 0x49, 0x64, 0x60, 0x0a, 0xee,
+	0x8a, 0x1f, 0x46, 0x3a, 0xae, 0x2c, 0x31, 0xe3, 0x62, 0xa8, 0xa8, 0xed, 0xea, 0xc1, 0x47, 0x62,
+	0x9e, 0x9b, 0x15, 0x33, 0xa5, 0x72, 0x3d, 0x07, 0x82, 0xb1, 0x3b, 0xca, 0x49, 0x96, 0x88, 0xf6,
+	0xca, 0x9a, 0x51, 0xd3, 0xe3, 0x8b, 0xcb, 0x00, 0xa5, 0x4c, 0x10, 0x46, 0xe9, 0x2a, 0xf2, 0xd5,
+	0xd3, 0x82, 0x5e, 0xc4, 0x5f, 0x3d, 0x43, 0x54, 0x92, 0xf8, 0xab, 0x67, 0x8c, 0x93, 0xf1, 0x94,
+	0xe9, 0xd3, 0x5a, 0x92, 0xec, 0xe6, 0x02, 0x12, 0xce, 0xbb, 0x5a, 0x05, 0x3f, 0xd8, 0xb3, 0xa6,
+	0xba, 0xe6, 0xc3, 0xfb, 0x05, 0xb4, 0x0c, 0x17, 0xe5, 0xfb, 0x8c, 0xb8, 0x0a, 0x65, 0x20, 0x64,
+	0x6e, 0x82, 0x4f, 0xe1, 0x22, 0xdf, 0x52, 0x1a, 0x99, 0x92, 0xe4, 0x0e, 0xfc, 0xfe, 0x2e, 0x93,
+	0xc0, 0x13, 0x98, 0x69, 0x24, 0x06, 0xc5, 0xbc, 0x4d, 0x2e, 0xe9, 0x24, 0x94, 0x7c, 0xa4, 0x99,
+	0xb4, 0x9e, 0x02, 0x62, 0x2a, 0xab, 0x20, 0xf7, 0xd2, 0xc5, 0xaf, 0xd0, 0x95, 0xc4, 0x90, 0x48,
+	0x21, 0x05, 0xa3, 0xec, 0x25, 0x6b, 0x8a, 0xd0, 0x16, 0xcb, 0x95, 0xc2, 0x72, 0x9d, 0x39, 0x3d,
+	0x67, 0xd7, 0xed, 0xba, 0x91, 0x8b, 0xc9, 0x0e, 0x53, 0x11, 0xd4, 0x2a, 0xb1, 0x8c, 0x97, 0x32,
+	0x21, 0xd0, 0x27, 0x30, 0xf1, 0x18, 0x47, 0x71, 0xca, 0x55, 0x34, 0x97, 0x4a, 0xd2, 0xca, 0x97,
+	0x4e, 0xbc, 0x06, 0xd4, 0xf3, 0xbc, 0xae, 0x42, 0x89, 0x71, 0x47, 0x85, 0xc4, 0x95, 0x14, 0x09,
+	0x0e, 0xe2, 0x04, 0xce, 0x41, 0x98, 0x39, 0x5b, 0xf7, 0xd8, 0x75, 0x0e, 0x12, 0xdb, 0x56, 0x15,
+	0xbf, 0x2e, 0x6a, 0x65, 0x32, 0x7a, 0xd3, 0x8c, 0x31, 0xd7, 0x28, 0xba, 0x11, 0x7f, 0x0a, 0x33,
+	0x13, 0x88, 0x56, 0x50, 0xf2, 0xad, 0x5e, 0xf3, 0x21, 0x92, 0xa9, 0x25, 0x0c, 0x44, 0x6f, 0x69,
+	0x5f, 0xec, 0xd3, 0xd1, 0xfd, 0x04, 0x46, 0x65, 0xd2, 0x4a, 0xc9, 0x56, 0x92, 0x29, 0x3f, 0x2b,
+	0xe5, 0x74, 0x05, 0x1f, 0xe9, 0xc7, 0x2c, 0x45, 0xad, 0x8e, 0x9f, 0xcc, 0xeb, 0x98, 0x39, 0xb1,
+	0x1f, 0xc0, 0x98, 0x92, 0xd1, 0x51, 0x6e, 0xe4, 0x74, 0x96, 0xc7, 0xca, 0x84, 0xd2, 0xf7, 0xe6,
+	0xc2, 0xfd, 0x02, 0xba, 0x47, 0x3f, 0x2d, 0xf4, 0xb1, 0xca, 0x4c, 0x8c, 0xa6, 0xe4, 0x61, 0x4b,
+	0xa0, 0xa0, 0xef, 0xd0, 0x98, 0x1e, 0x8b, 0x87, 0x41, 0x40, 0x14, 0x58, 0x82, 0x97, 0x25, 0x41,
+	0x24, 0x10, 0x3f, 0xa1, 0xcc, 0x44, 0x41, 0x64, 0xee, 0x1b, 0xfd, 0xb0, 0x59, 0x4c, 0xd8, 0xfb,
+	0x05, 0xf4, 0x10, 0x46, 0x44, 0x02, 0x68, 0x34, 0xab, 0x77, 0x35, 0x7b, 0x78, 0x0f, 0x01, 0xd8,
+	0x64, 0xd3, 0x9e, 0xea, 0xd5, 0x99, 0xd3, 0xf9, 0x90, 0x7c, 0x2f, 0x3b, 0xa7, 0x44, 0xfa, 0x44,
+	0x7c, 0x33, 0x29, 0x52, 0x59, 0x5b, 0x42, 0x75, 0x3a, 0xb3, 0xf0, 0x89, 0xc0, 0xab, 0xe5, 0xa5,
+	0x8e, 0x05, 0x5e, 0x53, 0xba, 0xea, 0x4c, 0x3a, 0xab, 0x50, 0xaa, 0xb5, 0x29, 0x1f, 0x97, 0xb9,
+	0xed, 0xa4, 0xb6, 0x91, 0xac, 0x10, 0xb4, 0x66, 0x92, 0xa9, 0xf2, 0xd6, 0xb0, 0x43, 0xc3, 0x9c,
+	0xcc, 0x49, 0x99, 0x20, 0x51, 0x65, 0xc6, 0xc8, 0xd1, 0x2e, 0xa6, 0x17, 0x89, 0x3e, 0xd4, 0xfd,
+	0x6a, 0x64, 0x3e, 0xa4, 0xbc, 0x4c, 0xc9, 0xfb, 0x37, 0x9b, 0xc4, 0x97, 0x7a, 0x98, 0x70, 0x9d,
+	0x93, 0xa0, 0x35, 0x98, 0xe2, 0x41, 0x15, 0xe4, 0xb4, 0x64, 0x61, 0x67, 0x35, 0xff, 0x1d, 0x98,
+	0x5c, 0x26, 0xbc, 0xfe, 0xb0, 0xe3, 0xb2, 0xd0, 0x4e, 0x48, 0x8f, 0xd5, 0x93, 0x89, 0xb8, 0x22,
+	0x52, 0xda, 0x2a, 0x09, 0xf1, 0xe4, 0x29, 0x4d, 0xe7, 0x1c, 0xac, 0x4c, 0x0b, 0xb2, 0x6a, 0xee,
+	0x3c, 0xae, 0xa4, 0xcf, 0x65, 0xa4, 0xa0, 0x43, 0x37, 0x35, 0xdd, 0x2f, 0x2b, 0x8f, 0x9c, 0x41,
+	0xda, 0xfb, 0x5c, 0x49, 0xca, 0x91, 0x41, 0x33, 0x3f, 0x37, 0x5d, 0xe6, 0xb8, 0x65, 0x30, 0x16,
+	0x63, 0x0e, 0x39, 0xf4, 0xb6, 0x4e, 0x3d, 0x27, 0xcf, 0x5c, 0x66, 0x0b, 0x54, 0xb7, 0xd6, 0x53,
+	0x9c, 0xa1, 0xab, 0xf9, 0x99, 0xd8, 0x14, 0xdd, 0x3a, 0x23, 0x37, 0xda, 0x13, 0xba, 0xcd, 0xe2,
+	0xcc, 0x1d, 0x48, 0xd5, 0x54, 0x93, 0x89, 0x4b, 0xa4, 0x08, 0x65, 0xce, 0x73, 0xf6, 0x98, 0xb2,
+	0x4b, 0x25, 0x0b, 0x48, 0x26, 0xc3, 0xbb, 0x62, 0xa2, 0x13, 0x2a, 0xdf, 0xc2, 0xa9, 0x44, 0xc6,
+	0x30, 0x69, 0x9b, 0x31, 0xe7, 0x2c, 0xab, 0x5c, 0xcd, 0xaa, 0xe6, 0x14, 0x1b, 0x22, 0x29, 0xb5,
+	0x32, 0xd2, 0xab, 0xda, 0x17, 0x2a, 0x3d, 0xd8, 0x6a, 0x66, 0xbd, 0x9c, 0xbb, 0x52, 0x32, 0xc3,
+	0x8b, 0x24, 0x9a, 0x91, 0xfa, 0x25, 0x87, 0x25, 0x4e, 0xab, 0x5b, 0xa3, 0xef, 0x0c, 0x66, 0xd1,
+	0xd9, 0x82, 0x19, 0x63, 0x42, 0x16, 0x29, 0x46, 0xe4, 0xa5, 0x6b, 0xc9, 0xa4, 0x8a, 0x61, 0xd6,
+	0x9c, 0x93, 0x09, 0x7d, 0x43, 0x57, 0xfd, 0xcd, 0x19, 0x6a, 0x2a, 0x37, 0xfb, 0x40, 0xf1, 0x09,
+	0xfd, 0x82, 0x7e, 0x36, 0x53, 0x6d, 0x5c, 0x57, 0x8c, 0x01, 0x19, 0x0d, 0x58, 0x79, 0x20, 0x72,
+	0x0f, 0x4c, 0x9b, 0x72, 0xc2, 0x65, 0x4e, 0xf1, 0x8d, 0x6c, 0x9a, 0xf1, 0xc6, 0x6a, 0x8a, 0x10,
+	0x28, 0x99, 0x33, 0x93, 0x9b, 0xbb, 0x27, 0x47, 0x9b, 0xac, 0xc8, 0xfd, 0x70, 0xf2, 0x2e, 0x67,
+	0x5b, 0x86, 0xa6, 0x4d, 0x19, 0xa3, 0x92, 0x86, 0x1b, 0x53, 0x42, 0x20, 0x39, 0x0d, 0xb9, 0x29,
+	0xa7, 0x9a, 0xcc, 0x88, 0xa3, 0x53, 0x57, 0x8d, 0x38, 0x46, 0xd2, 0xd7, 0xb2, 0x01, 0xe2, 0x1d,
+	0x61, 0x48, 0x7d, 0x27, 0x77, 0x44, 0x76, 0x12, 0x3e, 0xb9, 0x23, 0xf2, 0x32, 0xe7, 0xd9, 0xe2,
+	0xd0, 0x65, 0x4c, 0x4b, 0x4e, 0x9e, 0xa4, 0x1c, 0x95, 0xab, 0x1c, 0x2f, 0x5c, 0xa2, 0xdb, 0xa7,
+	0x5d, 0xb6, 0x2f, 0xe0, 0x52, 0x66, 0x4e, 0x24, 0xf4, 0x56, 0xea, 0x40, 0x67, 0xcc, 0x44, 0x76,
+	0x4f, 0x27, 0xb4, 0x74, 0x46, 0xd2, 0x8a, 0x95, 0xc8, 0x9c, 0x94, 0x62, 0xfd, 0x86, 0xb4, 0x4a,
+	0x8c, 0xf5, 0x2b, 0xa9, 0x91, 0x4e, 0xc2, 0xfa, 0x4d, 0x99, 0x94, 0x24, 0x4f, 0x55, 0xfa, 0x25,
+	0x44, 0xba, 0x64, 0xc5, 0x69, 0x78, 0xea, 0x49, 0xba, 0x96, 0x45, 0x67, 0x89, 0xaa, 0x1c, 0x22,
+	0x53, 0x12, 0xba, 0xa4, 0x4d, 0x93, 0xf6, 0xb9, 0xad, 0x68, 0x83, 0xd3, 0xbf, 0xb4, 0x8b, 0xd4,
+	0x5c, 0x2c, 0x33, 0x33, 0x65, 0xf6, 0xe2, 0x72, 0x9a, 0x86, 0x66, 0x2a, 0x96, 0xb3, 0xc0, 0x7a,
+	0x33, 0x9f, 0x9c, 0x1c, 0xad, 0x43, 0xd9, 0x43, 0x42, 0xea, 0xd4, 0xf4, 0xe9, 0x52, 0xb6, 0xa8,
+	0x7b, 0x91, 0x29, 0x0f, 0x2c, 0x46, 0xa1, 0x78, 0xa9, 0x3c, 0x2b, 0xed, 0x5e, 0x4a, 0x69, 0x8e,
+	0x99, 0x63, 0x93, 0xba, 0x06, 0x1a, 0x92, 0x4c, 0x49, 0x1e, 0x9a, 0x9b, 0x83, 0xca, 0x20, 0xe6,
+	0x49, 0xae, 0x9c, 0x49, 0x31, 0x37, 0xeb, 0x54, 0x66, 0x4f, 0x7f, 0xac, 0x70, 0xe5, 0x54, 0x2a,
+	0x29, 0x74, 0x3b, 0x29, 0xe3, 0x65, 0x65, 0x9b, 0xca, 0xe1, 0xfa, 0xd3, 0xa6, 0x2c, 0x54, 0x8a,
+	0xed, 0x36, 0x33, 0x45, 0x95, 0x61, 0x16, 0x24, 0x7b, 0xcb, 0xa0, 0x96, 0x93, 0x93, 0x2a, 0xb3,
+	0x87, 0x3f, 0x50, 0xd8, 0x5b, 0x22, 0x77, 0x94, 0x34, 0x2a, 0xf4, 0x49, 0x2e, 0x95, 0x49, 0x7b,
+	0x9d, 0x3a, 0x93, 0xa6, 0x13, 0x3f, 0x49, 0xd9, 0x25, 0x2f, 0x2d, 0x94, 0xd1, 0xb4, 0x3b, 0x93,
+	0x1e, 0x22, 0xa1, 0x37, 0x9b, 0x30, 0xcc, 0xf6, 0xeb, 0x98, 0xe4, 0xc3, 0x86, 0x84, 0x51, 0x09,
+	0x3e, 0x9c, 0x9d, 0x52, 0x2a, 0x47, 0x63, 0x9a, 0x6a, 0xb8, 0x7b, 0x9e, 0x92, 0xef, 0x49, 0xea,
+	0x4b, 0xe9, 0x14, 0x54, 0x92, 0xc5, 0x98, 0xd2, 0x43, 0x6d, 0xc4, 0x4f, 0x56, 0xd4, 0xcc, 0x3d,
+	0xa8, 0x92, 0x9d, 0xb0, 0x48, 0xb2, 0x1b, 0x63, 0xaa, 0x1f, 0x85, 0xa0, 0x9a, 0x36, 0x47, 0x12,
+	0x34, 0x64, 0xf0, 0x91, 0x04, 0x8d, 0x79, 0x76, 0x98, 0x09, 0xc6, 0xf6, 0xbb, 0x58, 0x35, 0xc1,
+	0x28, 0x49, 0x6f, 0x12, 0xb6, 0x10, 0xf4, 0x11, 0xb5, 0x84, 0xe4, 0x9b, 0x4f, 0xe6, 0x74, 0x4a,
+	0x31, 0xb7, 0x7c, 0x28, 0x2e, 0x03, 0x68, 0x83, 0x3a, 0xe5, 0xfe, 0xc6, 0x0d, 0x8a, 0xa4, 0x1b,
+	0x37, 0xd4, 0x8e, 0x66, 0xdb, 0x49, 0xc7, 0xd5, 0xa0, 0xe9, 0x72, 0xae, 0x0c, 0x99, 0x1d, 0xe4,
+	0x5c, 0x99, 0xf2, 0x25, 0x50, 0x1d, 0x78, 0x4b, 0x68, 0xf2, 0x31, 0xbd, 0x2b, 0xb9, 0x09, 0x0f,
+	0x2a, 0x57, 0xf3, 0xb3, 0x04, 0xf0, 0x7b, 0xbc, 0x52, 0x32, 0xae, 0x3b, 0x32, 0xe5, 0xab, 0x50,
+	0xc2, 0xe5, 0x4b, 0x6d, 0x28, 0x33, 0x20, 0xfc, 0xa6, 0x30, 0x56, 0xeb, 0x74, 0x33, 0xb2, 0x16,
+	0xa8, 0xa4, 0xf3, 0x05, 0x94, 0x38, 0xc4, 0xbb, 0xaa, 0x9b, 0xa6, 0x42, 0xc8, 0xab, 0x02, 0x8a,
+	0x21, 0x2a, 0xbc, 0x2b, 0x9e, 0x38, 0x9b, 0x33, 0x27, 0xbd, 0xad, 0xeb, 0x7a, 0x39, 0xc1, 0x7f,
+	0xfa, 0xde, 0x94, 0xa2, 0x1f, 0x89, 0xac, 0xc9, 0xe9, 0x0c, 0x21, 0x37, 0x13, 0x66, 0x57, 0x73,
+	0xb8, 0x98, 0x4a, 0x5e, 0x02, 0x12, 0xf4, 0x8c, 0x5e, 0xb1, 0x6f, 0xac, 0x2e, 0x2d, 0x72, 0x5f,
+	0x00, 0x3f, 0x48, 0x5d, 0x5b, 0xed, 0xb8, 0xd1, 0x3e, 0x4b, 0x99, 0xa3, 0x70, 0x1f, 0x06, 0xa2,
+	0x21, 0x36, 0x1f, 0xa2, 0x06, 0x95, 0xdc, 0xb5, 0x52, 0xc3, 0xcd, 0x95, 0x81, 0x60, 0xc5, 0x4c,
+	0x90, 0x26, 0xfe, 0xa3, 0x82, 0x01, 0x39, 0x78, 0x7a, 0x37, 0x33, 0xfa, 0x90, 0x27, 0x5f, 0xb0,
+	0x6d, 0x63, 0x26, 0x73, 0x52, 0xf6, 0xfd, 0x18, 0x66, 0xd8, 0x84, 0x27, 0xde, 0x93, 0x69, 0xfd,
+	0x51, 0xca, 0x2b, 0x19, 0xe5, 0x68, 0x9d, 0xba, 0x8d, 0x24, 0x4b, 0x15, 0x2d, 0xc6, 0xfc, 0x60,
+	0x2d, 0x93, 0x1e, 0x5b, 0x4a, 0x22, 0xb6, 0xbf, 0xd1, 0x52, 0x6a, 0x88, 0xcd, 0x05, 0xbe, 0x94,
+	0x5a, 0xe9, 0xe9, 0x96, 0x32, 0x41, 0x50, 0x5f, 0x4a, 0xbd, 0x9b, 0x19, 0x7d, 0xe8, 0xbf, 0x94,
+	0x66, 0x32, 0xa7, 0x5e, 0xca, 0xc4, 0x63, 0x3e, 0xad, 0x3f, 0xa6, 0xa5, 0x4c, 0xc2, 0xb3, 0xa5,
+	0x4c, 0x96, 0x26, 0x14, 0xd2, 0x9c, 0xa5, 0x4c, 0x62, 0x7e, 0x46, 0xe9, 0xb1, 0xd7, 0x82, 0xa7,
+	0x5a, 0x4c, 0x11, 0xd4, 0x26, 0x81, 0xda, 0x7c, 0x88, 0x76, 0xa8, 0x35, 0x24, 0x51, 0x7e, 0xb2,
+	0x05, 0x9d, 0xcf, 0x22, 0x4a, 0x97, 0x74, 0x55, 0xc8, 0x59, 0xc9, 0xee, 0x66, 0xf6, 0x25, 0x6f,
+	0x3d, 0xd8, 0xb2, 0x26, 0x49, 0x9d, 0x76, 0x61, 0x9f, 0x09, 0xa6, 0x99, 0x7a, 0x70, 0x99, 0xe8,
+	0x95, 0xba, 0xb8, 0x99, 0x35, 0x68, 0x8b, 0xda, 0x7a, 0xd2, 0xe5, 0x8a, 0x9d, 0x28, 0xeb, 0x65,
+	0x67, 0x5f, 0xaa, 0xa9, 0x17, 0x9c, 0x2a, 0xd5, 0xac, 0xe7, 0x9d, 0x92, 0x6a, 0x1a, 0xfb, 0x53,
+	0xaa, 0x3b, 0x73, 0x7f, 0x74, 0xef, 0xb9, 0x9f, 0x2d, 0xe8, 0x5c, 0xd4, 0xdc, 0x19, 0x08, 0x2c,
+	0xf5, 0x22, 0xf9, 0x98, 0x5f, 0x15, 0x88, 0xc2, 0xcc, 0xc9, 0x37, 0xe1, 0xa3, 0x4f, 0xa1, 0xc4,
+	0x0f, 0x78, 0x4c, 0xc0, 0x04, 0x98, 0xb9, 0x74, 0x75, 0xa1, 0xb2, 0x9f, 0xa0, 0x07, 0x27, 0x51,
+	0xd5, 0x4f, 0x32, 0x13, 0xd9, 0x7a, 0x2d, 0x61, 0x81, 0x5b, 0x01, 0x51, 0x39, 0x3b, 0x69, 0x7d,
+	0x54, 0xef, 0x8c, 0xb8, 0x1d, 0xd6, 0xc1, 0x9b, 0x0b, 0x68, 0x95, 0x1e, 0x66, 0xbd, 0x38, 0x4f,
+	0x61, 0x37, 0x93, 0xa1, 0x67, 0x6d, 0x45, 0x3a, 0x3e, 0xeb, 0x7d, 0xca, 0x6a, 0x3b, 0xbb, 0x53,
+	0x72, 0x8a, 0x4e, 0x38, 0xba, 0xac, 0x29, 0x62, 0x12, 0x35, 0x33, 0x1e, 0xf4, 0x9b, 0x99, 0xa4,
+	0x2b, 0x36, 0xfa, 0x1e, 0x8c, 0x0a, 0xe4, 0xfe, 0x13, 0x92, 0xc4, 0xa6, 0x13, 0xf2, 0x09, 0x8c,
+	0x29, 0x9e, 0xe0, 0x28, 0xab, 0xa5, 0x1c, 0xf1, 0x7c, 0x4c, 0xf1, 0x53, 0x3f, 0x3d, 0xfe, 0x12,
+	0x4c, 0x68, 0x7e, 0xee, 0x52, 0xa8, 0x34, 0x79, 0xbf, 0xe7, 0x51, 0xd1, 0xfc, 0xd9, 0x25, 0x15,
+	0x93, 0x97, 0x7b, 0xbe, 0x80, 0xab, 0xbc, 0x8f, 0x57, 0x04, 0xdc, 0xf4, 0x43, 0x7d, 0x45, 0xc0,
+	0x35, 0x3d, 0xa9, 0xff, 0x2e, 0x8c, 0xf1, 0xed, 0x91, 0xbb, 0xb2, 0xd9, 0x96, 0x87, 0x19, 0xc5,
+	0xff, 0xf2, 0xb0, 0xe3, 0x46, 0x8b, 0xbe, 0xf7, 0xdc, 0xdd, 0xeb, 0xbb, 0xc8, 0x69, 0x94, 0xe6,
+	0x02, 0x6a, 0xd2, 0xd4, 0x07, 0x22, 0x21, 0x05, 0x8e, 0x5e, 0xf9, 0xc1, 0x0b, 0xd7, 0xdb, 0xeb,
+	0x43, 0xf2, 0x9a, 0x4e, 0x32, 0x89, 0xc7, 0xe8, 0x36, 0xb2, 0xe9, 0xf6, 0xc5, 0xcf, 0xb1, 0x3c,
+	0xcc, 0x53, 0x1f, 0x88, 0xd3, 0xf6, 0x38, 0xfb, 0x16, 0xe6, 0x52, 0xec, 0xb9, 0x68, 0xe3, 0xb6,
+	0x1f, 0x74, 0xfa, 0x13, 0xab, 0xea, 0x7e, 0x82, 0x09, 0xb4, 0xe6, 0x02, 0xa1, 0xda, 0xc8, 0xa4,
+	0xda, 0x0f, 0x3b, 0xe7, 0xcb, 0x7b, 0x99, 0x8e, 0xfd, 0x94, 0xbd, 0xcd, 0xe7, 0xc0, 0xe4, 0xab,
+	0xb9, 0x19, 0xe0, 0xe7, 0x38, 0xa0, 0xee, 0xa7, 0xfd, 0x1c, 0x2f, 0x75, 0xf0, 0xe6, 0x02, 0xa1,
+	0xd2, 0x48, 0x51, 0xc9, 0x82, 0xce, 0x13, 0x3a, 0xe9, 0xd0, 0x4e, 0xd8, 0x9b, 0x2c, 0x32, 0xef,
+	0x53, 0xfb, 0xef, 0xf6, 0x6a, 0x9f, 0x19, 0x11, 0x0e, 0xd1, 0x02, 0xb0, 0xf9, 0x80, 0x60, 0x36,
+	0x14, 0xcc, 0x34, 0x44, 0x66, 0x9b, 0xdf, 0x13, 0x86, 0xde, 0xbe, 0xcd, 0x66, 0x7b, 0x76, 0x8c,
+	0xca, 0xb4, 0x4c, 0x48, 0x31, 0x91, 0x68, 0x49, 0x87, 0x2a, 0x13, 0xaa, 0xfb, 0x65, 0x88, 0x6a,
+	0x4c, 0x23, 0x51, 0xd3, 0x13, 0x29, 0x77, 0xcc, 0xc6, 0xbc, 0x45, 0x49, 0x12, 0xcc, 0xc4, 0xb3,
+	0xe6, 0xb7, 0x5f, 0xa8, 0x26, 0x1e, 0x25, 0xdf, 0x4d, 0x45, 0xcf, 0x46, 0xc3, 0x3f, 0x48, 0x34,
+	0x25, 0x8d, 0xea, 0xec, 0xa2, 0x66, 0xbc, 0x51, 0x4d, 0x3c, 0x7a, 0x6e, 0x1e, 0x69, 0xe2, 0xa1,
+	0x0d, 0xea, 0x94, 0xfb, 0x9b, 0x78, 0x28, 0x92, 0x6e, 0xe2, 0x51, 0x3b, 0x9a, 0xcd, 0x2e, 0x50,
+	0x3a, 0x39, 0x8f, 0x54, 0x1e, 0x32, 0xf3, 0xf6, 0xe4, 0xf8, 0xb1, 0x5c, 0x34, 0xe4, 0x13, 0x93,
+	0xa6, 0x93, 0xec, 0x5c, 0x63, 0x15, 0xdd, 0x29, 0xe3, 0x7e, 0x01, 0xad, 0xc3, 0xec, 0x63, 0x1c,
+	0x71, 0x06, 0x66, 0xe3, 0x30, 0x0a, 0x5c, 0xfa, 0x24, 0x2d, 0xfb, 0x6b, 0x2d, 0x74, 0x05, 0x03,
+	0x4e, 0xf3, 0x1d, 0x42, 0xaf, 0x61, 0xa6, 0x97, 0x8b, 0x97, 0x63, 0x1d, 0xe3, 0xa6, 0xd4, 0xd3,
+	0x74, 0x31, 0x7b, 0x8b, 0x0f, 0x33, 0x0f, 0x82, 0x6c, 0xd4, 0x52, 0x1c, 0x4f, 0x96, 0x6b, 0x3f,
+	0x77, 0xe1, 0x3c, 0x43, 0xca, 0xfc, 0x46, 0x8e, 0xab, 0x38, 0xe8, 0x81, 0x70, 0x77, 0x23, 0x28,
+	0x5a, 0x55, 0x66, 0xbf, 0x1e, 0xc0, 0x28, 0xbb, 0x17, 0x39, 0x39, 0xca, 0x47, 0xc2, 0x29, 0x2e,
+	0xaf, 0x63, 0xd9, 0x7e, 0xa2, 0x13, 0xaa, 0xf3, 0xc0, 0xe9, 0x27, 0xf2, 0xbb, 0xf4, 0x6e, 0x4a,
+	0x98, 0x80, 0xb3, 0xf1, 0x67, 0x12, 0x11, 0x58, 0xf9, 0x94, 0x32, 0x06, 0x29, 0x13, 0xf3, 0x65,
+	0x75, 0xff, 0x42, 0x0a, 0x1b, 0x7d, 0x24, 0x9e, 0x62, 0x48, 0xe4, 0x34, 0x50, 0xce, 0x9c, 0x4d,
+	0xb2, 0x69, 0x7e, 0x13, 0x64, 0xc9, 0x60, 0xfb, 0x76, 0xfb, 0x24, 0x77, 0x68, 0xfd, 0xa7, 0x2e,
+	0x8b, 0xca, 0x06, 0x15, 0xbc, 0x52, 0xb1, 0x81, 0xb3, 0x09, 0x5d, 0xcd, 0x0e, 0x27, 0x4c, 0x17,
+	0xe3, 0x09, 0x55, 0x52, 0xd3, 0x49, 0x16, 0xb3, 0x86, 0x97, 0x13, 0x9e, 0x38, 0xd6, 0xca, 0xd3,
+	0xe4, 0x72, 0xd0, 0xf2, 0x94, 0x7c, 0xfe, 0x04, 0xec, 0x4c, 0xc8, 0xad, 0x0a, 0x67, 0xae, 0x93,
+	0x0f, 0x36, 0x47, 0x08, 0x32, 0xdc, 0xda, 0xf5, 0x5d, 0x8b, 0x2c, 0x72, 0x3f, 0xa2, 0xf2, 0x9f,
+	0x39, 0xb3, 0x5a, 0x26, 0xb1, 0xdb, 0xca, 0xc5, 0x6f, 0x7e, 0x4e, 0xb6, 0x17, 0xf4, 0x8d, 0x8b,
+	0x39, 0x7a, 0xf2, 0xad, 0x3e, 0x54, 0xc4, 0x4c, 0xbc, 0xd5, 0x17, 0x4e, 0xde, 0x01, 0x5d, 0x66,
+	0x5f, 0x58, 0x73, 0x7b, 0x7d, 0xa2, 0x41, 0x1b, 0xae, 0xe5, 0x32, 0xd2, 0x96, 0x09, 0x82, 0xba,
+	0xa7, 0x5c, 0xee, 0x18, 0xb2, 0xa6, 0xff, 0x33, 0xa8, 0xc6, 0xb7, 0xdb, 0xa7, 0x5b, 0x84, 0x6c,
+	0x89, 0x1e, 0xa5, 0x93, 0xb9, 0xa1, 0xbc, 0x50, 0xba, 0x95, 0xeb, 0x59, 0x33, 0x1c, 0x2a, 0x6e,
+	0x13, 0xdc, 0x2f, 0x27, 0x11, 0x47, 0x3c, 0x2b, 0x22, 0x79, 0x8e, 0x1d, 0x8e, 0x3f, 0xfa, 0x39,
+	0x13, 0x42, 0xe9, 0xd5, 0x3e, 0x3d, 0x21, 0x79, 0xf9, 0x9c, 0x20, 0x64, 0xe5, 0x2c, 0xef, 0x69,
+	0x7c, 0x6b, 0x92, 0x4b, 0x71, 0xda, 0x05, 0x75, 0xe2, 0x87, 0x2e, 0xe9, 0x8c, 0x73, 0x52, 0x96,
+	0xcb, 0xcc, 0x7e, 0x27, 0x57, 0x37, 0x27, 0x5d, 0xdd, 0x22, 0x39, 0xa6, 0xac, 0x09, 0x2d, 0xdd,
+	0xd5, 0xa2, 0xbd, 0x16, 0x5b, 0x1d, 0x0c, 0x79, 0xb0, 0x2a, 0x20, 0x2a, 0xed, 0x35, 0xd4, 0x80,
+	0x0a, 0xdb, 0x22, 0xa6, 0xf0, 0x02, 0xf2, 0x75, 0x82, 0xa9, 0x32, 0x47, 0xbb, 0x68, 0x40, 0x85,
+	0x6d, 0x97, 0xb3, 0x24, 0xda, 0xa2, 0xa9, 0x4d, 0x8d, 0x14, 0x6f, 0x2a, 0x4f, 0x3c, 0xb3, 0x83,
+	0x36, 0x54, 0xf2, 0x1b, 0x46, 0x3f, 0x84, 0x19, 0x63, 0xd4, 0x06, 0xe9, 0x1f, 0x90, 0x17, 0xd3,
+	0xa1, 0x1f, 0xf1, 0x17, 0x50, 0xce, 0xca, 0x4d, 0x15, 0xbf, 0x96, 0xc8, 0x4f, 0x18, 0x26, 0x79,
+	0x6a, 0xdf, 0x24, 0x57, 0xeb, 0x30, 0x6d, 0xca, 0xf7, 0x24, 0x0f, 0x47, 0x4e, 0x32, 0x28, 0xe3,
+	0x93, 0x8c, 0x4d, 0x98, 0x31, 0xe6, 0x5c, 0x92, 0x33, 0x93, 0x97, 0x91, 0xc9, 0x48, 0xf1, 0x73,
+	0x98, 0xcb, 0x48, 0x30, 0x14, 0x5f, 0x62, 0xe6, 0x26, 0x20, 0xca, 0x71, 0xa6, 0xa8, 0x64, 0xe7,
+	0xae, 0x91, 0x3e, 0x34, 0x7d, 0xd3, 0xdb, 0x54, 0x8c, 0x09, 0xbd, 0xd0, 0x16, 0xdd, 0x84, 0xa6,
+	0x64, 0x36, 0xea, 0x26, 0xcc, 0x49, 0x76, 0x93, 0xf1, 0x94, 0x66, 0x2e, 0x23, 0x7f, 0x4d, 0x0e,
+	0xd5, 0x13, 0xf4, 0x76, 0x5d, 0xf0, 0x7f, 0x3d, 0xa1, 0x49, 0xc2, 0x2f, 0xd3, 0x98, 0xed, 0xc4,
+	0xd8, 0x4f, 0xe5, 0xe9, 0x76, 0xb7, 0x9b, 0x23, 0x06, 0x21, 0xf5, 0xed, 0x36, 0x81, 0xa4, 0xf7,
+	0x00, 0x13, 0x2a, 0x6e, 0x1e, 0x47, 0x4d, 0x21, 0x53, 0xc1, 0xf3, 0x43, 0x18, 0x6f, 0xa8, 0x8d,
+	0x1b, 0x1a, 0xc9, 0xdc, 0x14, 0xf2, 0xc5, 0x42, 0xff, 0xbe, 0xf7, 0xbd, 0x61, 0xac, 0x75, 0xbb,
+	0x27, 0x1a, 0x45, 0xa6, 0x4d, 0x56, 0x8b, 0xf1, 0x2e, 0x39, 0xb5, 0x29, 0x75, 0x81, 0xb4, 0xc9,
+	0x9a, 0xc3, 0xc2, 0x2f, 0xd3, 0x29, 0x8d, 0x23, 0xe4, 0xe6, 0xe8, 0xe0, 0x72, 0x13, 0x19, 0x02,
+	0xf1, 0x3e, 0x55, 0x1f, 0xd5, 0xb3, 0xb8, 0xba, 0x39, 0x46, 0xc4, 0xe4, 0x63, 0xfa, 0x44, 0x20,
+	0xde, 0x26, 0x94, 0x45, 0x84, 0x4b, 0x16, 0x63, 0x32, 0x8e, 0xc7, 0x14, 0xbb, 0x99, 0x65, 0x87,
+	0xc0, 0xcc, 0x99, 0xb7, 0x52, 0x32, 0xa2, 0x8d, 0xb4, 0x1c, 0x65, 0x84, 0xba, 0xc9, 0xd9, 0x0d,
+	0x10, 0xc7, 0xad, 0x91, 0xf6, 0x99, 0x54, 0x28, 0x9b, 0xca, 0x25, 0x43, 0x8d, 0x94, 0xac, 0xc6,
+	0xd5, 0x28, 0x37, 0xd2, 0x0b, 0xc7, 0x10, 0xfa, 0xa6, 0x72, 0xd9, 0x58, 0xc7, 0x09, 0x45, 0x70,
+	0x39, 0x27, 0xb5, 0xab, 0x94, 0x56, 0xfb, 0xa7, 0xa0, 0xad, 0xdc, 0x39, 0x09, 0x28, 0x6f, 0x15,
+	0xcb, 0x88, 0xb5, 0x69, 0x28, 0xf4, 0x96, 0xc1, 0x6d, 0xda, 0x94, 0x35, 0xb5, 0xd2, 0x2f, 0xab,
+	0x2c, 0xda, 0x81, 0xf9, 0x84, 0x5b, 0xb7, 0xde, 0x52, 0x3f, 0x02, 0x99, 0x2b, 0xb8, 0x03, 0xf3,
+	0xfc, 0x9d, 0xf9, 0x19, 0x13, 0xde, 0x85, 0xf9, 0xbc, 0x7c, 0xb1, 0xe8, 0x8e, 0xd9, 0x75, 0xdb,
+	0x38, 0x3d, 0xd9, 0xa2, 0xeb, 0xb5, 0xb4, 0x0b, 0x77, 0x62, 0xdd, 0x4f, 0xcb, 0x56, 0x9e, 0xc1,
+	0xa4, 0x9e, 0x2b, 0x16, 0xa9, 0xac, 0x23, 0x95, 0xb9, 0xb6, 0x72, 0x25, 0xa3, 0x96, 0xef, 0x8f,
+	0x4f, 0x28, 0xa3, 0x97, 0x15, 0x6a, 0xec, 0x89, 0x64, 0x2e, 0xd6, 0x8a, 0x21, 0xad, 0x0d, 0xfa,
+	0x2e, 0x4c, 0xc5, 0x6f, 0x05, 0x19, 0x09, 0x03, 0x58, 0x8e, 0xbd, 0x68, 0x2a, 0x7e, 0x35, 0x78,
+	0x7a, 0xf4, 0x15, 0xc1, 0xed, 0x63, 0xf4, 0x2b, 0x29, 0x6f, 0x76, 0x6d, 0x0c, 0x27, 0x61, 0xfa,
+	0xca, 0xdc, 0x9e, 0x76, 0x75, 0xda, 0xf4, 0xb8, 0x99, 0xc3, 0x37, 0xa9, 0xc7, 0x2d, 0x37, 0xc4,
+	0x94, 0x94, 0x30, 0x33, 0xe8, 0x3c, 0x83, 0x1b, 0x34, 0xe4, 0xc1, 0x26, 0xf6, 0x3a, 0xae, 0xb7,
+	0x67, 0x86, 0xca, 0xee, 0x7b, 0x32, 0x50, 0x42, 0x17, 0xae, 0xf7, 0x8d, 0x5f, 0x85, 0xee, 0x69,
+	0x41, 0x1f, 0xfa, 0x47, 0xba, 0xca, 0x7b, 0x41, 0x62, 0x0a, 0x03, 0x25, 0x3f, 0x19, 0x39, 0x11,
+	0xa9, 0xe4, 0x0b, 0x92, 0xdc, 0x38, 0x52, 0x9f, 0xd3, 0xe8, 0xd8, 0xfc, 0x9b, 0x45, 0xc3, 0x98,
+	0x60, 0xcf, 0xf1, 0xda, 0xb8, 0xcf, 0xed, 0xc7, 0x75, 0xfd, 0xce, 0x2f, 0x85, 0x48, 0xd5, 0x86,
+	0xab, 0x5c, 0xd9, 0xc9, 0x22, 0xde, 0x9f, 0x48, 0xd6, 0xbc, 0xd4, 0x97, 0x7e, 0xfe, 0x37, 0x57,
+	0x0b, 0x3f, 0xff, 0xc5, 0xd5, 0xc2, 0x7f, 0xfc, 0xc5, 0xd5, 0xc2, 0x7f, 0xfd, 0xc5, 0xd5, 0xc2,
+	0x0f, 0x16, 0x4e, 0x16, 0x0c, 0xb1, 0xdd, 0x75, 0xb1, 0x17, 0xdd, 0x63, 0xe4, 0xce, 0xd3, 0xff,
+	0x1e, 0xfe, 0xdf, 0x00, 0x00, 0x00, 0xff, 0xff, 0xf7, 0x8c, 0xb6, 0x67, 0x48, 0xd6, 0x00, 0x00,
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -15983,6 +15998,8 @@ type AuthServiceClient interface {
 	DeleteAllUserGroups(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// GetHeadlessAuthentication is a request to retrieve a headless authentication from the backend.
 	GetHeadlessAuthentication(ctx context.Context, in *GetHeadlessAuthenticationRequest, opts ...grpc.CallOption) (*types.HeadlessAuthentication, error)
+	// WatchPendingHeadlessAuthentications watches the backend for pending headless authentication requests for the user.
+	WatchPendingHeadlessAuthentications(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (AuthService_WatchPendingHeadlessAuthenticationsClient, error)
 	// UpdateHeadlessAuthenticationState is a request to update a headless authentication's state.
 	UpdateHeadlessAuthenticationState(ctx context.Context, in *UpdateHeadlessAuthenticationStateRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	// ExportUpgradeWindows is used to load derived maintenance window values for agents that
@@ -18540,6 +18557,38 @@ func (c *authServiceClient) GetHeadlessAuthentication(ctx context.Context, in *G
 	return out, nil
 }
 
+func (c *authServiceClient) WatchPendingHeadlessAuthentications(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (AuthService_WatchPendingHeadlessAuthenticationsClient, error) {
+	stream, err := c.cc.NewStream(ctx, &_AuthService_serviceDesc.Streams[17], "/proto.AuthService/WatchPendingHeadlessAuthentications", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &authServiceWatchPendingHeadlessAuthenticationsClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type AuthService_WatchPendingHeadlessAuthenticationsClient interface {
+	Recv() (*Event, error)
+	grpc.ClientStream
+}
+
+type authServiceWatchPendingHeadlessAuthenticationsClient struct {
+	grpc.ClientStream
+}
+
+func (x *authServiceWatchPendingHeadlessAuthenticationsClient) Recv() (*Event, error) {
+	m := new(Event)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
 func (c *authServiceClient) UpdateHeadlessAuthenticationState(ctx context.Context, in *UpdateHeadlessAuthenticationStateRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
 	out := new(emptypb.Empty)
 	err := c.cc.Invoke(ctx, "/proto.AuthService/UpdateHeadlessAuthenticationState", in, out, opts...)
@@ -19147,6 +19196,8 @@ type AuthServiceServer interface {
 	DeleteAllUserGroups(context.Context, *emptypb.Empty) (*emptypb.Empty, error)
 	// GetHeadlessAuthentication is a request to retrieve a headless authentication from the backend.
 	GetHeadlessAuthentication(context.Context, *GetHeadlessAuthenticationRequest) (*types.HeadlessAuthentication, error)
+	// WatchPendingHeadlessAuthentications watches the backend for pending headless authentication requests for the user.
+	WatchPendingHeadlessAuthentications(*emptypb.Empty, AuthService_WatchPendingHeadlessAuthenticationsServer) error
 	// UpdateHeadlessAuthenticationState is a request to update a headless authentication's state.
 	UpdateHeadlessAuthenticationState(context.Context, *UpdateHeadlessAuthenticationStateRequest) (*emptypb.Empty, error)
 	// ExportUpgradeWindows is used to load derived maintenance window values for agents that
@@ -19879,6 +19930,9 @@ func (*UnimplementedAuthServiceServer) DeleteAllUserGroups(ctx context.Context,
 func (*UnimplementedAuthServiceServer) GetHeadlessAuthentication(ctx context.Context, req *GetHeadlessAuthenticationRequest) (*types.HeadlessAuthentication, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetHeadlessAuthentication not implemented")
 }
+func (*UnimplementedAuthServiceServer) WatchPendingHeadlessAuthentications(req *emptypb.Empty, srv AuthService_WatchPendingHeadlessAuthenticationsServer) error {
+	return status.Errorf(codes.Unimplemented, "method WatchPendingHeadlessAuthentications not implemented")
+}
 func (*UnimplementedAuthServiceServer) UpdateHeadlessAuthenticationState(ctx context.Context, req *UpdateHeadlessAuthenticationStateRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateHeadlessAuthenticationState not implemented")
 }
@@ -24284,6 +24338,27 @@ func _AuthService_GetHeadlessAuthentication_Handler(srv interface{}, ctx context
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_WatchPendingHeadlessAuthentications_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(emptypb.Empty)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(AuthServiceServer).WatchPendingHeadlessAuthentications(m, &authServiceWatchPendingHeadlessAuthenticationsServer{stream})
+}
+
+type AuthService_WatchPendingHeadlessAuthenticationsServer interface {
+	Send(*Event) error
+	grpc.ServerStream
+}
+
+type authServiceWatchPendingHeadlessAuthenticationsServer struct {
+	grpc.ServerStream
+}
+
+func (x *authServiceWatchPendingHeadlessAuthenticationsServer) Send(m *Event) error {
+	return x.ServerStream.SendMsg(m)
+}
+
 func _AuthService_UpdateHeadlessAuthenticationState_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(UpdateHeadlessAuthenticationStateRequest)
 	if err := dec(in); err != nil {
@@ -25357,6 +25432,11 @@ var _AuthService_serviceDesc = grpc.ServiceDesc{
 			Handler:       _AuthService_StreamSessionEvents_Handler,
 			ServerStreams: true,
 		},
+		{
+			StreamName:    "WatchPendingHeadlessAuthentications",
+			Handler:       _AuthService_WatchPendingHeadlessAuthentications_Handler,
+			ServerStreams: true,
+		},
 	},
 	Metadata: "teleport/legacy/client/proto/authservice.proto",
 }
@@ -26319,6 +26399,29 @@ func (m *Event_WatchStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	return len(dAtA) - i, nil
 }
+func (m *Event_HeadlessAuthentication) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Event_HeadlessAuthentication) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.HeadlessAuthentication != nil {
+		{
+			size, err := m.HeadlessAuthentication.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintAuthservice(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xe2
+	}
+	return len(dAtA) - i, nil
+}
 func (m *Watch) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -26778,12 +26881,12 @@ func (m *UserCertsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x22
 	}
-	n49, err49 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err49 != nil {
-		return 0, err49
+	n50, err50 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err50 != nil {
+		return 0, err50
 	}
-	i -= n49
-	i = encodeVarintAuthservice(dAtA, i, uint64(n49))
+	i -= n50
+	i = encodeVarintAuthservice(dAtA, i, uint64(n50))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.Username) > 0 {
@@ -28424,12 +28527,12 @@ func (m *GenerateAppTokenRequest) MarshalToSizedBuffer(dAtA []byte) (int, error)
 			dAtA[i] = 0x2a
 		}
 	}
-	n61, err61 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err61 != nil {
-		return 0, err61
+	n62, err62 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err62 != nil {
+		return 0, err62
 	}
-	i -= n61
-	i = encodeVarintAuthservice(dAtA, i, uint64(n61))
+	i -= n62
+	i = encodeVarintAuthservice(dAtA, i, uint64(n62))
 	i--
 	dAtA[i] = 0x22
 	if len(m.URI) > 0 {
@@ -31998,21 +32101,21 @@ func (m *GetEventsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0x22
 		}
 	}
-	n103, err103 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndDate):])
-	if err103 != nil {
-		return 0, err103
-	}
-	i -= n103
-	i = encodeVarintAuthservice(dAtA, i, uint64(n103))
-	i--
-	dAtA[i] = 0x1a
-	n104, err104 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartDate):])
+	n104, err104 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndDate):])
 	if err104 != nil {
 		return 0, err104
 	}
 	i -= n104
 	i = encodeVarintAuthservice(dAtA, i, uint64(n104))
 	i--
+	dAtA[i] = 0x1a
+	n105, err105 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartDate):])
+	if err105 != nil {
+		return 0, err105
+	}
+	i -= n105
+	i = encodeVarintAuthservice(dAtA, i, uint64(n105))
+	i--
 	dAtA[i] = 0x12
 	if len(m.Namespace) > 0 {
 		i -= len(m.Namespace)
@@ -32065,21 +32168,21 @@ func (m *GetSessionEventsRequest) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i--
 		dAtA[i] = 0x18
 	}
-	n105, err105 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndDate):])
-	if err105 != nil {
-		return 0, err105
-	}
-	i -= n105
-	i = encodeVarintAuthservice(dAtA, i, uint64(n105))
-	i--
-	dAtA[i] = 0x12
-	n106, err106 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartDate):])
+	n106, err106 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.EndDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.EndDate):])
 	if err106 != nil {
 		return 0, err106
 	}
 	i -= n106
 	i = encodeVarintAuthservice(dAtA, i, uint64(n106))
 	i--
+	dAtA[i] = 0x12
+	n107, err107 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.StartDate, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.StartDate):])
+	if err107 != nil {
+		return 0, err107
+	}
+	i -= n107
+	i = encodeVarintAuthservice(dAtA, i, uint64(n107))
+	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
@@ -33410,12 +33513,12 @@ func (m *RecoveryCodes) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n113, err113 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err113 != nil {
-		return 0, err113
+	n114, err114 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err114 != nil {
+		return 0, err114
 	}
-	i -= n113
-	i = encodeVarintAuthservice(dAtA, i, uint64(n113))
+	i -= n114
+	i = encodeVarintAuthservice(dAtA, i, uint64(n114))
 	i--
 	dAtA[i] = 0x12
 	if len(m.Codes) > 0 {
@@ -34469,12 +34572,12 @@ func (m *SessionTrackerUpdateExpiry) MarshalToSizedBuffer(dAtA []byte) (int, err
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if m.Expires != nil {
-		n131, err131 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
-		if err131 != nil {
-			return 0, err131
+		n132, err132 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
+		if err132 != nil {
+			return 0, err132
 		}
-		i -= n131
-		i = encodeVarintAuthservice(dAtA, i, uint64(n131))
+		i -= n132
+		i = encodeVarintAuthservice(dAtA, i, uint64(n132))
 		i--
 		dAtA[i] = 0xa
 	}
@@ -37218,6 +37321,18 @@ func (m *Event_WatchStatus) Size() (n int) {
 	}
 	return n
 }
+func (m *Event_HeadlessAuthentication) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.HeadlessAuthentication != nil {
+		l = m.HeadlessAuthentication.Size()
+		n += 2 + l + sovAuthservice(uint64(l))
+	}
+	return n
+}
 func (m *Watch) Size() (n int) {
 	if m == nil {
 		return 0
@@ -43602,6 +43717,41 @@ func (m *Event) Unmarshal(dAtA []byte) error {
 			}
 			m.Resource = &Event_WatchStatus{v}
 			iNdEx = postIndex
+		case 44:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HeadlessAuthentication", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &types.HeadlessAuthentication{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &Event_HeadlessAuthentication{v}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
diff --git a/api/client/proto/types.go b/api/client/proto/types.go
index de8a094dcadd0..931f64b8c2c99 100644
--- a/api/client/proto/types.go
+++ b/api/client/proto/types.go
@@ -53,9 +53,13 @@ func (req *ListResourcesRequest) CheckAndSetDefaults() error {
 	if req.Namespace == "" {
 		req.Namespace = apidefaults.Namespace
 	}
+	// If the Limit parameter was not provided instead of returning an error fallback to the default limit.
+	if req.Limit == 0 {
+		req.Limit = apidefaults.DefaultChunkSize
+	}
 
-	if req.Limit <= 0 {
-		return trace.BadParameter("nonpositive parameter limit")
+	if req.Limit < 0 {
+		return trace.BadParameter("negative parameter limit")
 	}
 
 	return nil
diff --git a/api/client/webclient/webclient.go b/api/client/webclient/webclient.go
index fe4cbb14b1d3e..084bce25838c2 100644
--- a/api/client/webclient/webclient.go
+++ b/api/client/webclient/webclient.go
@@ -41,6 +41,7 @@ import (
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/observability/tracing"
 	tracehttp "github.com/gravitational/teleport/api/observability/tracing/http"
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keys"
 )
@@ -409,6 +410,9 @@ type AuthenticationSettings struct {
 	HasMessageOfTheDay bool `json:"has_motd"`
 	// LoadAllCAs tells tsh to load CAs for all clusters when trying to ssh into a node.
 	LoadAllCAs bool `json:"load_all_cas,omitempty"`
+	// DefaultSessionTTL is the TTL requested for user certs if
+	// a TTL is not otherwise specified.
+	DefaultSessionTTL types.Duration `json:"default_session_ttl"`
 }
 
 // LocalSettings holds settings for local authentication.
diff --git a/api/client/webclient/webconfig.go b/api/client/webclient/webconfig.go
index d3de07bac26f1..cdedc2abd2281 100644
--- a/api/client/webclient/webconfig.go
+++ b/api/client/webclient/webconfig.go
@@ -63,6 +63,10 @@ type WebConfig struct {
 	IsDashboard bool `json:"isDashboard,omitempty"`
 	// IsUsageBasedBilling determines if the cloud user subscription is usage-based (pay-as-you-go).
 	IsUsageBasedBilling bool `json:"isUsageBasedBilling,omitempty"`
+	// AutomaticUpgrades describes whether agents should automatically upgrade.
+	AutomaticUpgrades bool `json:"automaticUpgrades"`
+	// AssistEnabled is true when Teleport Assist is enabled.
+	AssistEnabled bool `json:"assistEnabled"`
 }
 
 // UIConfig provides config options for the web UI served by the proxy service.
@@ -103,4 +107,6 @@ type WebConfigAuthSettings struct {
 	LocalConnectorName string `json:"localConnectorName,omitempty"`
 	// PrivateKeyPolicy is the configured private key policy for the cluster.
 	PrivateKeyPolicy keys.PrivateKeyPolicy `json:"privateKeyPolicy,omitempty"`
+	// MOTD is message of the day. MOTD is displayed to users before login.
+	MOTD string `json:"motd"`
 }
diff --git a/api/gen/proto/go/accesslist/v1/accesslist.pb.go b/api/gen/proto/go/accesslist/v1/accesslist.pb.go
new file mode 100644
index 0000000000000..8cc33053be757
--- /dev/null
+++ b/api/gen/proto/go/accesslist/v1/accesslist.pb.go
@@ -0,0 +1,769 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: teleport/accesslist/v1/accesslist.proto
+
+package accesslist
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/header/v1"
+	v11 "github.com/gravitational/teleport/api/gen/proto/go/trait/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// AccessList describes the basic building block of access grants, which are
+// similar to access requests but for longer lived permissions that need to be
+// regularly audited.
+type AccessList struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// header is the header for the resource.
+	Header *v1.ResourceHeader `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"`
+	// spec is the specification for the access list.
+	Spec *AccessListSpec `protobuf:"bytes,2,opt,name=spec,proto3" json:"spec,omitempty"`
+}
+
+func (x *AccessList) Reset() {
+	*x = AccessList{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessList) ProtoMessage() {}
+
+func (x *AccessList) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessList.ProtoReflect.Descriptor instead.
+func (*AccessList) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *AccessList) GetHeader() *v1.ResourceHeader {
+	if x != nil {
+		return x.Header
+	}
+	return nil
+}
+
+func (x *AccessList) GetSpec() *AccessListSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+// AccessListSpec is the specification for an access list.
+type AccessListSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// description is a plaintext description of the access list.
+	Description string `protobuf:"bytes,1,opt,name=description,proto3" json:"description,omitempty"`
+	// owners is a list of owners of the access list.
+	Owners []*AccessListOwner `protobuf:"bytes,2,rep,name=owners,proto3" json:"owners,omitempty"`
+	// audit describes the frequency that this access list must be audited.
+	Audit *AccessListAudit `protobuf:"bytes,3,opt,name=audit,proto3" json:"audit,omitempty"`
+	// membership_requires describes the requirements for a user to be a member of the access list.
+	// For a membership to an access list to be effective, the user must meet the requirements of
+	// Membership_requires and must be in the members list.
+	MembershipRequires *AccessListRequires `protobuf:"bytes,4,opt,name=membership_requires,json=membershipRequires,proto3" json:"membership_requires,omitempty"`
+	// ownership_requires describes the requirements for a user to be an owner of the access list.
+	// For ownership of an access list to be effective, the user must meet the requirements of
+	// ownership_requires and must be in the owners list.
+	OwnershipRequires *AccessListRequires `protobuf:"bytes,5,opt,name=ownership_requires,json=ownershipRequires,proto3" json:"ownership_requires,omitempty"`
+	// grants describes the access granted by membership to this access list.
+	Grants *AccessListGrants `protobuf:"bytes,6,opt,name=grants,proto3" json:"grants,omitempty"`
+	// members describes the current members of the access list.
+	Members []*AccessListMember `protobuf:"bytes,7,rep,name=members,proto3" json:"members,omitempty"`
+}
+
+func (x *AccessListSpec) Reset() {
+	*x = AccessListSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessListSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessListSpec) ProtoMessage() {}
+
+func (x *AccessListSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessListSpec.ProtoReflect.Descriptor instead.
+func (*AccessListSpec) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *AccessListSpec) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *AccessListSpec) GetOwners() []*AccessListOwner {
+	if x != nil {
+		return x.Owners
+	}
+	return nil
+}
+
+func (x *AccessListSpec) GetAudit() *AccessListAudit {
+	if x != nil {
+		return x.Audit
+	}
+	return nil
+}
+
+func (x *AccessListSpec) GetMembershipRequires() *AccessListRequires {
+	if x != nil {
+		return x.MembershipRequires
+	}
+	return nil
+}
+
+func (x *AccessListSpec) GetOwnershipRequires() *AccessListRequires {
+	if x != nil {
+		return x.OwnershipRequires
+	}
+	return nil
+}
+
+func (x *AccessListSpec) GetGrants() *AccessListGrants {
+	if x != nil {
+		return x.Grants
+	}
+	return nil
+}
+
+func (x *AccessListSpec) GetMembers() []*AccessListMember {
+	if x != nil {
+		return x.Members
+	}
+	return nil
+}
+
+// AccessListOwner is an owner of an access list.
+type AccessListOwner struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// name is the username of the owner.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// description is the plaintext description of the owner and why they are an owner.
+	Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
+}
+
+func (x *AccessListOwner) Reset() {
+	*x = AccessListOwner{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessListOwner) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessListOwner) ProtoMessage() {}
+
+func (x *AccessListOwner) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessListOwner.ProtoReflect.Descriptor instead.
+func (*AccessListOwner) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *AccessListOwner) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *AccessListOwner) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+// AccessListAudit describes the audit configuration for an access list.
+type AccessListAudit struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// frequency is a duration that describes how often an access list must be audited.
+	Frequency *durationpb.Duration `protobuf:"bytes,1,opt,name=frequency,proto3" json:"frequency,omitempty"`
+}
+
+func (x *AccessListAudit) Reset() {
+	*x = AccessListAudit{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessListAudit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessListAudit) ProtoMessage() {}
+
+func (x *AccessListAudit) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessListAudit.ProtoReflect.Descriptor instead.
+func (*AccessListAudit) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *AccessListAudit) GetFrequency() *durationpb.Duration {
+	if x != nil {
+		return x.Frequency
+	}
+	return nil
+}
+
+// AccessListRequires describes a requirement section for an access list. A user must
+// meet the following criteria to obtain the specific access to the list.
+type AccessListRequires struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// roles are the user roles that must be present for the user to obtain access.
+	Roles []string `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
+	// traits are the traits that must be present for the user to obtain access.
+	Traits []*v11.Trait `protobuf:"bytes,2,rep,name=traits,proto3" json:"traits,omitempty"`
+}
+
+func (x *AccessListRequires) Reset() {
+	*x = AccessListRequires{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessListRequires) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessListRequires) ProtoMessage() {}
+
+func (x *AccessListRequires) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessListRequires.ProtoReflect.Descriptor instead.
+func (*AccessListRequires) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *AccessListRequires) GetRoles() []string {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
+func (x *AccessListRequires) GetTraits() []*v11.Trait {
+	if x != nil {
+		return x.Traits
+	}
+	return nil
+}
+
+// AccessListGrants describes what access is granted by membership to the access list.
+type AccessListGrants struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// roles are the roles that are granted to users who are members of the access list.
+	Roles []string `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
+	// traits are the traits that are granted to users who are members of the access list.
+	Traits []*v11.Trait `protobuf:"bytes,2,rep,name=traits,proto3" json:"traits,omitempty"`
+}
+
+func (x *AccessListGrants) Reset() {
+	*x = AccessListGrants{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessListGrants) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessListGrants) ProtoMessage() {}
+
+func (x *AccessListGrants) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessListGrants.ProtoReflect.Descriptor instead.
+func (*AccessListGrants) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *AccessListGrants) GetRoles() []string {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
+func (x *AccessListGrants) GetTraits() []*v11.Trait {
+	if x != nil {
+		return x.Traits
+	}
+	return nil
+}
+
+// AccessListMember describes a member of an access list.
+type AccessListMember struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// name is the name of the member of the access list.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// joined is when the user joined the access list.
+	Joined *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=joined,proto3" json:"joined,omitempty"`
+	// expires is when the user's membership to the access list expires.
+	Expires *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expires,proto3" json:"expires,omitempty"`
+	// reason is the reason this user was added to the access list.
+	Reason string `protobuf:"bytes,4,opt,name=reason,proto3" json:"reason,omitempty"`
+	// added_by is the user that added this user to the access list.
+	AddedBy string `protobuf:"bytes,5,opt,name=added_by,json=addedBy,proto3" json:"added_by,omitempty"`
+}
+
+func (x *AccessListMember) Reset() {
+	*x = AccessListMember{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessListMember) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessListMember) ProtoMessage() {}
+
+func (x *AccessListMember) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_accesslist_v1_accesslist_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessListMember.ProtoReflect.Descriptor instead.
+func (*AccessListMember) Descriptor() ([]byte, []int) {
+	return file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *AccessListMember) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *AccessListMember) GetJoined() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Joined
+	}
+	return nil
+}
+
+func (x *AccessListMember) GetExpires() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Expires
+	}
+	return nil
+}
+
+func (x *AccessListMember) GetReason() string {
+	if x != nil {
+		return x.Reason
+	}
+	return ""
+}
+
+func (x *AccessListMember) GetAddedBy() string {
+	if x != nil {
+		return x.AddedBy
+	}
+	return ""
+}
+
+var File_teleport_accesslist_v1_accesslist_proto protoreflect.FileDescriptor
+
+var file_teleport_accesslist_v1_accesslist_proto_rawDesc = []byte{
+	0x0a, 0x27, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x6c, 0x69, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6c,
+	0x69, 0x73, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x16, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x2e, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6c, 0x69, 0x73, 0x74, 0x2e, 0x76,
+	0x31, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x1a, 0x27, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x68,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1d, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x74, 0x72, 0x61, 0x69, 0x74, 0x2f, 0x76, 0x31, 0x2f, 0x74,
+	0x72, 0x61, 0x69, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x84, 0x01, 0x0a, 0x0a, 0x41,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x3a, 0x0a, 0x06, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x2e, 0x76, 0x31, 0x2e, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x52, 0x06, 0x68,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x3a, 0x0a, 0x04, 0x73, 0x70, 0x65, 0x63, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x6c, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x70, 0x65, 0x63, 0x52, 0x04, 0x73, 0x70, 0x65,
+	0x63, 0x22, 0xf0, 0x03, 0x0a, 0x0e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74,
+	0x53, 0x70, 0x65, 0x63, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3f, 0x0a, 0x06, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73,
+	0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6c, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e,
+	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52,
+	0x06, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x3d, 0x0a, 0x05, 0x61, 0x75, 0x64, 0x69, 0x74,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6c, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e,
+	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x64, 0x69, 0x74, 0x52,
+	0x05, 0x61, 0x75, 0x64, 0x69, 0x74, 0x12, 0x5b, 0x0a, 0x13, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72,
+	0x73, 0x68, 0x69, 0x70, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x6c, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x52,
+	0x12, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x68, 0x69, 0x70, 0x52, 0x65, 0x71, 0x75, 0x69,
+	0x72, 0x65, 0x73, 0x12, 0x59, 0x0a, 0x12, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x68, 0x69, 0x70,
+	0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x2a, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x6c, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c,
+	0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x52, 0x11, 0x6f, 0x77, 0x6e,
+	0x65, 0x72, 0x73, 0x68, 0x69, 0x70, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x12, 0x40,
+	0x0a, 0x06, 0x67, 0x72, 0x61, 0x6e, 0x74, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28,
+	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x6c, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69,
+	0x73, 0x74, 0x47, 0x72, 0x61, 0x6e, 0x74, 0x73, 0x52, 0x06, 0x67, 0x72, 0x61, 0x6e, 0x74, 0x73,
+	0x12, 0x42, 0x0a, 0x07, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x6c, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x52, 0x07, 0x6d, 0x65, 0x6d,
+	0x62, 0x65, 0x72, 0x73, 0x22, 0x47, 0x0a, 0x0f, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69,
+	0x73, 0x74, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64,
+	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x4a, 0x0a,
+	0x0f, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x64, 0x69, 0x74,
+	0x12, 0x37, 0x0a, 0x09, 0x66, 0x72, 0x65, 0x71, 0x75, 0x65, 0x6e, 0x63, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09,
+	0x66, 0x72, 0x65, 0x71, 0x75, 0x65, 0x6e, 0x63, 0x79, 0x22, 0x5c, 0x0a, 0x12, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x12,
+	0x14, 0x0a, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05,
+	0x72, 0x6f, 0x6c, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x06, 0x74, 0x72, 0x61, 0x69, 0x74, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x2e, 0x74, 0x72, 0x61, 0x69, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x72, 0x61, 0x69, 0x74, 0x52,
+	0x06, 0x74, 0x72, 0x61, 0x69, 0x74, 0x73, 0x22, 0x5a, 0x0a, 0x10, 0x41, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x4c, 0x69, 0x73, 0x74, 0x47, 0x72, 0x61, 0x6e, 0x74, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x72,
+	0x6f, 0x6c, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x72, 0x6f, 0x6c, 0x65,
+	0x73, 0x12, 0x30, 0x0a, 0x06, 0x74, 0x72, 0x61, 0x69, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x18, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x72, 0x61,
+	0x69, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x72, 0x61, 0x69, 0x74, 0x52, 0x06, 0x74, 0x72, 0x61,
+	0x69, 0x74, 0x73, 0x22, 0xc3, 0x01, 0x0a, 0x10, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69,
+	0x73, 0x74, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x32, 0x0a, 0x06,
+	0x6a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x06, 0x6a, 0x6f, 0x69, 0x6e, 0x65, 0x64,
+	0x12, 0x34, 0x0a, 0x07, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x07, 0x65,
+	0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x19,
+	0x0a, 0x08, 0x61, 0x64, 0x64, 0x65, 0x64, 0x5f, 0x62, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x61, 0x64, 0x64, 0x65, 0x64, 0x42, 0x79, 0x42, 0x4d, 0x5a, 0x4b, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f,
+	0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6c, 0x69, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x3b, 0x61, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x6c, 0x69, 0x73, 0x74, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_teleport_accesslist_v1_accesslist_proto_rawDescOnce sync.Once
+	file_teleport_accesslist_v1_accesslist_proto_rawDescData = file_teleport_accesslist_v1_accesslist_proto_rawDesc
+)
+
+func file_teleport_accesslist_v1_accesslist_proto_rawDescGZIP() []byte {
+	file_teleport_accesslist_v1_accesslist_proto_rawDescOnce.Do(func() {
+		file_teleport_accesslist_v1_accesslist_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_accesslist_v1_accesslist_proto_rawDescData)
+	})
+	return file_teleport_accesslist_v1_accesslist_proto_rawDescData
+}
+
+var file_teleport_accesslist_v1_accesslist_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_teleport_accesslist_v1_accesslist_proto_goTypes = []interface{}{
+	(*AccessList)(nil),            // 0: teleport.accesslist.v1.AccessList
+	(*AccessListSpec)(nil),        // 1: teleport.accesslist.v1.AccessListSpec
+	(*AccessListOwner)(nil),       // 2: teleport.accesslist.v1.AccessListOwner
+	(*AccessListAudit)(nil),       // 3: teleport.accesslist.v1.AccessListAudit
+	(*AccessListRequires)(nil),    // 4: teleport.accesslist.v1.AccessListRequires
+	(*AccessListGrants)(nil),      // 5: teleport.accesslist.v1.AccessListGrants
+	(*AccessListMember)(nil),      // 6: teleport.accesslist.v1.AccessListMember
+	(*v1.ResourceHeader)(nil),     // 7: teleport.header.v1.ResourceHeader
+	(*durationpb.Duration)(nil),   // 8: google.protobuf.Duration
+	(*v11.Trait)(nil),             // 9: teleport.trait.v1.Trait
+	(*timestamppb.Timestamp)(nil), // 10: google.protobuf.Timestamp
+}
+var file_teleport_accesslist_v1_accesslist_proto_depIdxs = []int32{
+	7,  // 0: teleport.accesslist.v1.AccessList.header:type_name -> teleport.header.v1.ResourceHeader
+	1,  // 1: teleport.accesslist.v1.AccessList.spec:type_name -> teleport.accesslist.v1.AccessListSpec
+	2,  // 2: teleport.accesslist.v1.AccessListSpec.owners:type_name -> teleport.accesslist.v1.AccessListOwner
+	3,  // 3: teleport.accesslist.v1.AccessListSpec.audit:type_name -> teleport.accesslist.v1.AccessListAudit
+	4,  // 4: teleport.accesslist.v1.AccessListSpec.membership_requires:type_name -> teleport.accesslist.v1.AccessListRequires
+	4,  // 5: teleport.accesslist.v1.AccessListSpec.ownership_requires:type_name -> teleport.accesslist.v1.AccessListRequires
+	5,  // 6: teleport.accesslist.v1.AccessListSpec.grants:type_name -> teleport.accesslist.v1.AccessListGrants
+	6,  // 7: teleport.accesslist.v1.AccessListSpec.members:type_name -> teleport.accesslist.v1.AccessListMember
+	8,  // 8: teleport.accesslist.v1.AccessListAudit.frequency:type_name -> google.protobuf.Duration
+	9,  // 9: teleport.accesslist.v1.AccessListRequires.traits:type_name -> teleport.trait.v1.Trait
+	9,  // 10: teleport.accesslist.v1.AccessListGrants.traits:type_name -> teleport.trait.v1.Trait
+	10, // 11: teleport.accesslist.v1.AccessListMember.joined:type_name -> google.protobuf.Timestamp
+	10, // 12: teleport.accesslist.v1.AccessListMember.expires:type_name -> google.protobuf.Timestamp
+	13, // [13:13] is the sub-list for method output_type
+	13, // [13:13] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
+}
+
+func init() { file_teleport_accesslist_v1_accesslist_proto_init() }
+func file_teleport_accesslist_v1_accesslist_proto_init() {
+	if File_teleport_accesslist_v1_accesslist_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_teleport_accesslist_v1_accesslist_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessList); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_accesslist_v1_accesslist_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessListSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_accesslist_v1_accesslist_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessListOwner); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_accesslist_v1_accesslist_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessListAudit); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_accesslist_v1_accesslist_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessListRequires); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_accesslist_v1_accesslist_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessListGrants); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_accesslist_v1_accesslist_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessListMember); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_accesslist_v1_accesslist_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   7,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_accesslist_v1_accesslist_proto_goTypes,
+		DependencyIndexes: file_teleport_accesslist_v1_accesslist_proto_depIdxs,
+		MessageInfos:      file_teleport_accesslist_v1_accesslist_proto_msgTypes,
+	}.Build()
+	File_teleport_accesslist_v1_accesslist_proto = out.File
+	file_teleport_accesslist_v1_accesslist_proto_rawDesc = nil
+	file_teleport_accesslist_v1_accesslist_proto_goTypes = nil
+	file_teleport_accesslist_v1_accesslist_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/assist/v1/assist.pb.go b/api/gen/proto/go/assist/v1/assist.pb.go
index cbc94ac60bcd3..a4d8f30d25dfd 100644
--- a/api/gen/proto/go/assist/v1/assist.pb.go
+++ b/api/gen/proto/go/assist/v1/assist.pb.go
@@ -765,6 +765,199 @@ func (x *DeleteAssistantConversationRequest) GetUsername() string {
 	return ""
 }
 
+// GetAssistantEmbeddingsRequest is a request to get embeddings.
+type GetAssistantEmbeddingsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// username is a username of the user who requested the embeddings.
+	Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	// query is the query used for similarity search.
+	Query string `protobuf:"bytes,2,opt,name=query,proto3" json:"query,omitempty"`
+	// limit is the number of embeddings to return (also known as k).
+	Limit uint32 `protobuf:"varint,3,opt,name=limit,proto3" json:"limit,omitempty"`
+	// kind is the kind of embeddings to return (ex, node).
+	Kind string `protobuf:"bytes,4,opt,name=kind,proto3" json:"kind,omitempty"`
+}
+
+func (x *GetAssistantEmbeddingsRequest) Reset() {
+	*x = GetAssistantEmbeddingsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_assist_v1_assist_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetAssistantEmbeddingsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetAssistantEmbeddingsRequest) ProtoMessage() {}
+
+func (x *GetAssistantEmbeddingsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_assist_v1_assist_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetAssistantEmbeddingsRequest.ProtoReflect.Descriptor instead.
+func (*GetAssistantEmbeddingsRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_assist_v1_assist_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *GetAssistantEmbeddingsRequest) GetUsername() string {
+	if x != nil {
+		return x.Username
+	}
+	return ""
+}
+
+func (x *GetAssistantEmbeddingsRequest) GetQuery() string {
+	if x != nil {
+		return x.Query
+	}
+	return ""
+}
+
+func (x *GetAssistantEmbeddingsRequest) GetLimit() uint32 {
+	if x != nil {
+		return x.Limit
+	}
+	return 0
+}
+
+func (x *GetAssistantEmbeddingsRequest) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+// EmbeddingDocument is a document with an embedding.
+type EmbeddedDocument struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// id is the id of the document.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// content is the content of the document.
+	Content string `protobuf:"bytes,2,opt,name=content,proto3" json:"content,omitempty"`
+	// similarityScore is the similarity score of the document.
+	SimilarityScore float32 `protobuf:"fixed32,3,opt,name=similarity_score,json=similarityScore,proto3" json:"similarity_score,omitempty"`
+}
+
+func (x *EmbeddedDocument) Reset() {
+	*x = EmbeddedDocument{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_assist_v1_assist_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EmbeddedDocument) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EmbeddedDocument) ProtoMessage() {}
+
+func (x *EmbeddedDocument) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_assist_v1_assist_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EmbeddedDocument.ProtoReflect.Descriptor instead.
+func (*EmbeddedDocument) Descriptor() ([]byte, []int) {
+	return file_teleport_assist_v1_assist_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *EmbeddedDocument) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *EmbeddedDocument) GetContent() string {
+	if x != nil {
+		return x.Content
+	}
+	return ""
+}
+
+func (x *EmbeddedDocument) GetSimilarityScore() float32 {
+	if x != nil {
+		return x.SimilarityScore
+	}
+	return 0
+}
+
+// GetAssistantEmbeddingsResponse is a response from the assistant service.
+type GetAssistantEmbeddingsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// embeddings is the list of embeddings.
+	// The list is sorted by similarity score in descending order.
+	Embeddings []*EmbeddedDocument `protobuf:"bytes,1,rep,name=embeddings,proto3" json:"embeddings,omitempty"`
+}
+
+func (x *GetAssistantEmbeddingsResponse) Reset() {
+	*x = GetAssistantEmbeddingsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_assist_v1_assist_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetAssistantEmbeddingsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetAssistantEmbeddingsResponse) ProtoMessage() {}
+
+func (x *GetAssistantEmbeddingsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_assist_v1_assist_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetAssistantEmbeddingsResponse.ProtoReflect.Descriptor instead.
+func (*GetAssistantEmbeddingsResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_assist_v1_assist_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *GetAssistantEmbeddingsResponse) GetEmbeddings() []*EmbeddedDocument {
+	if x != nil {
+		return x.Embeddings
+	}
+	return nil
+}
+
 var File_teleport_assist_v1_assist_proto protoreflect.FileDescriptor
 
 var file_teleport_assist_v1_assist_proto_rawDesc = []byte{
@@ -856,66 +1049,96 @@ var file_teleport_assist_v1_assist_proto_rawDesc = []byte{
 	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73,
 	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e,
 	0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e,
-	0x61, 0x6d, 0x65, 0x32, 0xdd, 0x06, 0x0a, 0x0d, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x53, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x8e, 0x01, 0x0a, 0x1b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x36, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
-	0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72,
-	0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x37, 0x2e,
-	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e,
-	0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61,
-	0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x88, 0x01, 0x0a, 0x19, 0x47, 0x65, 0x74, 0x41, 0x73,
+	0x61, 0x6d, 0x65, 0x22, 0x7b, 0x0a, 0x1d, 0x47, 0x65, 0x74, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74,
+	0x61, 0x6e, 0x74, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
+	0x12, 0x14, 0x0a, 0x05, 0x71, 0x75, 0x65, 0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x71, 0x75, 0x65, 0x72, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x12, 0x0a, 0x04,
+	0x6b, 0x69, 0x6e, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64,
+	0x22, 0x67, 0x0a, 0x10, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x44, 0x6f, 0x63, 0x75,
+	0x6d, 0x65, 0x6e, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x12, 0x29,
+	0x0a, 0x10, 0x73, 0x69, 0x6d, 0x69, 0x6c, 0x61, 0x72, 0x69, 0x74, 0x79, 0x5f, 0x73, 0x63, 0x6f,
+	0x72, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x02, 0x52, 0x0f, 0x73, 0x69, 0x6d, 0x69, 0x6c, 0x61,
+	0x72, 0x69, 0x74, 0x79, 0x53, 0x63, 0x6f, 0x72, 0x65, 0x22, 0x66, 0x0a, 0x1e, 0x47, 0x65, 0x74,
+	0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x69,
+	0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x44, 0x0a, 0x0a, 0x65,
+	0x6d, 0x62, 0x65, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73,
+	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x44, 0x6f, 0x63,
+	0x75, 0x6d, 0x65, 0x6e, 0x74, 0x52, 0x0a, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x69, 0x6e, 0x67,
+	0x73, 0x32, 0xdd, 0x06, 0x0a, 0x0d, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x8e, 0x01, 0x0a, 0x1b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x73,
 	0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x12, 0x34, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
-	0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x73, 0x73,
-	0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x35, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e,
-	0x47, 0x65, 0x74, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76,
-	0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x6d, 0x0a, 0x1b, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x73, 0x73, 0x69, 0x73,
-	0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x36, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73, 0x73, 0x69,
-	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x73, 0x73, 0x69,
+	0x69, 0x6f, 0x6e, 0x12, 0x36, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61,
+	0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
+	0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x37, 0x2e, 0x74, 0x65,
+	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31,
+	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74,
+	0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x88, 0x01, 0x0a, 0x19, 0x47, 0x65, 0x74, 0x41, 0x73, 0x73, 0x69,
 	0x73, 0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
-	0x12, 0x79, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74,
-	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x12, 0x2f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6e, 0x73, 0x12, 0x34, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73,
+	0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x73, 0x73, 0x69, 0x73,
+	0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x35, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
 	0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65,
-	0x74, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
-	0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x74, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72,
+	0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x6d, 0x0a, 0x1b, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61,
+	0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x36,
+	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74,
+	0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74,
+	0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x79,
+	0x0a, 0x14, 0x47, 0x65, 0x74, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x12, 0x2f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41,
+	0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74,
+	0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x16, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x12, 0x31, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61,
+	0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
+	0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x75,
+	0x0a, 0x1f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e,
+	0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66,
+	0x6f, 0x12, 0x3a, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73, 0x73,
+	0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x73, 0x73,
+	0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x6a, 0x0a, 0x0f, 0x49, 0x73, 0x41, 0x73, 0x73, 0x69, 0x73,
+	0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2a, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x49, 0x73,
+	0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
+	0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x49, 0x73, 0x41, 0x73, 0x73, 0x69,
+	0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x32, 0x99, 0x01, 0x0a, 0x16, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x45, 0x6d, 0x62, 0x65,
+	0x64, 0x64, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x7f, 0x0a, 0x16,
+	0x47, 0x65, 0x74, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x45, 0x6d, 0x62, 0x65,
+	0x64, 0x64, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x31, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41,
+	0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x69, 0x6e,
+	0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x32, 0x2e, 0x74, 0x65, 0x6c, 0x65,
 	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x47,
-	0x65, 0x74, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x16, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4d, 0x65,
-	0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x31, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
-	0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
-	0x12, 0x75, 0x0a, 0x1f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74,
-	0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49,
-	0x6e, 0x66, 0x6f, 0x12, 0x3a, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61,
-	0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41,
-	0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x6a, 0x0a, 0x0f, 0x49, 0x73, 0x41, 0x73, 0x73,
-	0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2a, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e,
-	0x49, 0x73, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
-	0x74, 0x2e, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x49, 0x73, 0x41, 0x73,
-	0x73, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x42, 0x45, 0x5a, 0x43, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
-	0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f,
-	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e,
-	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74,
-	0x2f, 0x76, 0x31, 0x3b, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x65, 0x74, 0x41, 0x73, 0x73, 0x69, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x45, 0x6d, 0x62, 0x65, 0x64,
+	0x64, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x45, 0x5a,
+	0x43, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76,
+	0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2f, 0x67, 0x6f, 0x2f, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x3b, 0x61, 0x73,
+	0x73, 0x69, 0x73, 0x74, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -930,7 +1153,7 @@ func file_teleport_assist_v1_assist_proto_rawDescGZIP() []byte {
 	return file_teleport_assist_v1_assist_proto_rawDescData
 }
 
-var file_teleport_assist_v1_assist_proto_msgTypes = make([]protoimpl.MessageInfo, 13)
+var file_teleport_assist_v1_assist_proto_msgTypes = make([]protoimpl.MessageInfo, 16)
 var file_teleport_assist_v1_assist_proto_goTypes = []interface{}{
 	(*GetAssistantMessagesRequest)(nil),            // 0: teleport.assist.v1.GetAssistantMessagesRequest
 	(*AssistantMessage)(nil),                       // 1: teleport.assist.v1.AssistantMessage
@@ -945,35 +1168,41 @@ var file_teleport_assist_v1_assist_proto_goTypes = []interface{}{
 	(*IsAssistEnabledRequest)(nil),                 // 10: teleport.assist.v1.IsAssistEnabledRequest
 	(*IsAssistEnabledResponse)(nil),                // 11: teleport.assist.v1.IsAssistEnabledResponse
 	(*DeleteAssistantConversationRequest)(nil),     // 12: teleport.assist.v1.DeleteAssistantConversationRequest
-	(*timestamppb.Timestamp)(nil),                  // 13: google.protobuf.Timestamp
-	(*emptypb.Empty)(nil),                          // 14: google.protobuf.Empty
+	(*GetAssistantEmbeddingsRequest)(nil),          // 13: teleport.assist.v1.GetAssistantEmbeddingsRequest
+	(*EmbeddedDocument)(nil),                       // 14: teleport.assist.v1.EmbeddedDocument
+	(*GetAssistantEmbeddingsResponse)(nil),         // 15: teleport.assist.v1.GetAssistantEmbeddingsResponse
+	(*timestamppb.Timestamp)(nil),                  // 16: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),                          // 17: google.protobuf.Empty
 }
 var file_teleport_assist_v1_assist_proto_depIdxs = []int32{
-	13, // 0: teleport.assist.v1.AssistantMessage.created_time:type_name -> google.protobuf.Timestamp
+	16, // 0: teleport.assist.v1.AssistantMessage.created_time:type_name -> google.protobuf.Timestamp
 	1,  // 1: teleport.assist.v1.CreateAssistantMessageRequest.message:type_name -> teleport.assist.v1.AssistantMessage
 	1,  // 2: teleport.assist.v1.GetAssistantMessagesResponse.messages:type_name -> teleport.assist.v1.AssistantMessage
-	13, // 3: teleport.assist.v1.ConversationInfo.created_time:type_name -> google.protobuf.Timestamp
+	16, // 3: teleport.assist.v1.ConversationInfo.created_time:type_name -> google.protobuf.Timestamp
 	5,  // 4: teleport.assist.v1.GetAssistantConversationsResponse.conversations:type_name -> teleport.assist.v1.ConversationInfo
-	13, // 5: teleport.assist.v1.CreateAssistantConversationRequest.created_time:type_name -> google.protobuf.Timestamp
-	7,  // 6: teleport.assist.v1.AssistService.CreateAssistantConversation:input_type -> teleport.assist.v1.CreateAssistantConversationRequest
-	4,  // 7: teleport.assist.v1.AssistService.GetAssistantConversations:input_type -> teleport.assist.v1.GetAssistantConversationsRequest
-	12, // 8: teleport.assist.v1.AssistService.DeleteAssistantConversation:input_type -> teleport.assist.v1.DeleteAssistantConversationRequest
-	0,  // 9: teleport.assist.v1.AssistService.GetAssistantMessages:input_type -> teleport.assist.v1.GetAssistantMessagesRequest
-	2,  // 10: teleport.assist.v1.AssistService.CreateAssistantMessage:input_type -> teleport.assist.v1.CreateAssistantMessageRequest
-	9,  // 11: teleport.assist.v1.AssistService.UpdateAssistantConversationInfo:input_type -> teleport.assist.v1.UpdateAssistantConversationInfoRequest
-	10, // 12: teleport.assist.v1.AssistService.IsAssistEnabled:input_type -> teleport.assist.v1.IsAssistEnabledRequest
-	8,  // 13: teleport.assist.v1.AssistService.CreateAssistantConversation:output_type -> teleport.assist.v1.CreateAssistantConversationResponse
-	6,  // 14: teleport.assist.v1.AssistService.GetAssistantConversations:output_type -> teleport.assist.v1.GetAssistantConversationsResponse
-	14, // 15: teleport.assist.v1.AssistService.DeleteAssistantConversation:output_type -> google.protobuf.Empty
-	3,  // 16: teleport.assist.v1.AssistService.GetAssistantMessages:output_type -> teleport.assist.v1.GetAssistantMessagesResponse
-	14, // 17: teleport.assist.v1.AssistService.CreateAssistantMessage:output_type -> google.protobuf.Empty
-	14, // 18: teleport.assist.v1.AssistService.UpdateAssistantConversationInfo:output_type -> google.protobuf.Empty
-	11, // 19: teleport.assist.v1.AssistService.IsAssistEnabled:output_type -> teleport.assist.v1.IsAssistEnabledResponse
-	13, // [13:20] is the sub-list for method output_type
-	6,  // [6:13] is the sub-list for method input_type
-	6,  // [6:6] is the sub-list for extension type_name
-	6,  // [6:6] is the sub-list for extension extendee
-	0,  // [0:6] is the sub-list for field type_name
+	16, // 5: teleport.assist.v1.CreateAssistantConversationRequest.created_time:type_name -> google.protobuf.Timestamp
+	14, // 6: teleport.assist.v1.GetAssistantEmbeddingsResponse.embeddings:type_name -> teleport.assist.v1.EmbeddedDocument
+	7,  // 7: teleport.assist.v1.AssistService.CreateAssistantConversation:input_type -> teleport.assist.v1.CreateAssistantConversationRequest
+	4,  // 8: teleport.assist.v1.AssistService.GetAssistantConversations:input_type -> teleport.assist.v1.GetAssistantConversationsRequest
+	12, // 9: teleport.assist.v1.AssistService.DeleteAssistantConversation:input_type -> teleport.assist.v1.DeleteAssistantConversationRequest
+	0,  // 10: teleport.assist.v1.AssistService.GetAssistantMessages:input_type -> teleport.assist.v1.GetAssistantMessagesRequest
+	2,  // 11: teleport.assist.v1.AssistService.CreateAssistantMessage:input_type -> teleport.assist.v1.CreateAssistantMessageRequest
+	9,  // 12: teleport.assist.v1.AssistService.UpdateAssistantConversationInfo:input_type -> teleport.assist.v1.UpdateAssistantConversationInfoRequest
+	10, // 13: teleport.assist.v1.AssistService.IsAssistEnabled:input_type -> teleport.assist.v1.IsAssistEnabledRequest
+	13, // 14: teleport.assist.v1.AssistEmbeddingService.GetAssistantEmbeddings:input_type -> teleport.assist.v1.GetAssistantEmbeddingsRequest
+	8,  // 15: teleport.assist.v1.AssistService.CreateAssistantConversation:output_type -> teleport.assist.v1.CreateAssistantConversationResponse
+	6,  // 16: teleport.assist.v1.AssistService.GetAssistantConversations:output_type -> teleport.assist.v1.GetAssistantConversationsResponse
+	17, // 17: teleport.assist.v1.AssistService.DeleteAssistantConversation:output_type -> google.protobuf.Empty
+	3,  // 18: teleport.assist.v1.AssistService.GetAssistantMessages:output_type -> teleport.assist.v1.GetAssistantMessagesResponse
+	17, // 19: teleport.assist.v1.AssistService.CreateAssistantMessage:output_type -> google.protobuf.Empty
+	17, // 20: teleport.assist.v1.AssistService.UpdateAssistantConversationInfo:output_type -> google.protobuf.Empty
+	11, // 21: teleport.assist.v1.AssistService.IsAssistEnabled:output_type -> teleport.assist.v1.IsAssistEnabledResponse
+	15, // 22: teleport.assist.v1.AssistEmbeddingService.GetAssistantEmbeddings:output_type -> teleport.assist.v1.GetAssistantEmbeddingsResponse
+	15, // [15:23] is the sub-list for method output_type
+	7,  // [7:15] is the sub-list for method input_type
+	7,  // [7:7] is the sub-list for extension type_name
+	7,  // [7:7] is the sub-list for extension extendee
+	0,  // [0:7] is the sub-list for field type_name
 }
 
 func init() { file_teleport_assist_v1_assist_proto_init() }
@@ -1138,6 +1367,42 @@ func file_teleport_assist_v1_assist_proto_init() {
 				return nil
 			}
 		}
+		file_teleport_assist_v1_assist_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetAssistantEmbeddingsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_assist_v1_assist_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EmbeddedDocument); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_assist_v1_assist_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetAssistantEmbeddingsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -1145,9 +1410,9 @@ func file_teleport_assist_v1_assist_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_teleport_assist_v1_assist_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   13,
+			NumMessages:   16,
 			NumExtensions: 0,
-			NumServices:   1,
+			NumServices:   2,
 		},
 		GoTypes:           file_teleport_assist_v1_assist_proto_goTypes,
 		DependencyIndexes: file_teleport_assist_v1_assist_proto_depIdxs,
diff --git a/api/gen/proto/go/assist/v1/assist_grpc.pb.go b/api/gen/proto/go/assist/v1/assist_grpc.pb.go
index ccf7a2eef4df0..cb399e7316958 100644
--- a/api/gen/proto/go/assist/v1/assist_grpc.pb.go
+++ b/api/gen/proto/go/assist/v1/assist_grpc.pb.go
@@ -358,3 +358,96 @@ var AssistService_ServiceDesc = grpc.ServiceDesc{
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "teleport/assist/v1/assist.proto",
 }
+
+const (
+	AssistEmbeddingService_GetAssistantEmbeddings_FullMethodName = "/teleport.assist.v1.AssistEmbeddingService/GetAssistantEmbeddings"
+)
+
+// AssistEmbeddingServiceClient is the client API for AssistEmbeddingService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type AssistEmbeddingServiceClient interface {
+	// AssistantGetEmbeddings returns the embeddings for the given query.
+	GetAssistantEmbeddings(ctx context.Context, in *GetAssistantEmbeddingsRequest, opts ...grpc.CallOption) (*GetAssistantEmbeddingsResponse, error)
+}
+
+type assistEmbeddingServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewAssistEmbeddingServiceClient(cc grpc.ClientConnInterface) AssistEmbeddingServiceClient {
+	return &assistEmbeddingServiceClient{cc}
+}
+
+func (c *assistEmbeddingServiceClient) GetAssistantEmbeddings(ctx context.Context, in *GetAssistantEmbeddingsRequest, opts ...grpc.CallOption) (*GetAssistantEmbeddingsResponse, error) {
+	out := new(GetAssistantEmbeddingsResponse)
+	err := c.cc.Invoke(ctx, AssistEmbeddingService_GetAssistantEmbeddings_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// AssistEmbeddingServiceServer is the server API for AssistEmbeddingService service.
+// All implementations must embed UnimplementedAssistEmbeddingServiceServer
+// for forward compatibility
+type AssistEmbeddingServiceServer interface {
+	// AssistantGetEmbeddings returns the embeddings for the given query.
+	GetAssistantEmbeddings(context.Context, *GetAssistantEmbeddingsRequest) (*GetAssistantEmbeddingsResponse, error)
+	mustEmbedUnimplementedAssistEmbeddingServiceServer()
+}
+
+// UnimplementedAssistEmbeddingServiceServer must be embedded to have forward compatible implementations.
+type UnimplementedAssistEmbeddingServiceServer struct {
+}
+
+func (UnimplementedAssistEmbeddingServiceServer) GetAssistantEmbeddings(context.Context, *GetAssistantEmbeddingsRequest) (*GetAssistantEmbeddingsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetAssistantEmbeddings not implemented")
+}
+func (UnimplementedAssistEmbeddingServiceServer) mustEmbedUnimplementedAssistEmbeddingServiceServer() {
+}
+
+// UnsafeAssistEmbeddingServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to AssistEmbeddingServiceServer will
+// result in compilation errors.
+type UnsafeAssistEmbeddingServiceServer interface {
+	mustEmbedUnimplementedAssistEmbeddingServiceServer()
+}
+
+func RegisterAssistEmbeddingServiceServer(s grpc.ServiceRegistrar, srv AssistEmbeddingServiceServer) {
+	s.RegisterService(&AssistEmbeddingService_ServiceDesc, srv)
+}
+
+func _AssistEmbeddingService_GetAssistantEmbeddings_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetAssistantEmbeddingsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AssistEmbeddingServiceServer).GetAssistantEmbeddings(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AssistEmbeddingService_GetAssistantEmbeddings_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AssistEmbeddingServiceServer).GetAssistantEmbeddings(ctx, req.(*GetAssistantEmbeddingsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// AssistEmbeddingService_ServiceDesc is the grpc.ServiceDesc for AssistEmbeddingService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var AssistEmbeddingService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.assist.v1.AssistEmbeddingService",
+	HandlerType: (*AssistEmbeddingServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetAssistantEmbeddings",
+			Handler:    _AssistEmbeddingService_GetAssistantEmbeddings_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "teleport/assist/v1/assist.proto",
+}
diff --git a/api/gen/proto/go/header/v1/metadata.pb.go b/api/gen/proto/go/header/v1/metadata.pb.go
new file mode 100644
index 0000000000000..de5469c1fabf4
--- /dev/null
+++ b/api/gen/proto/go/header/v1/metadata.pb.go
@@ -0,0 +1,233 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: teleport/header/v1/metadata.proto
+
+package header
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Metadata is resource metadata.
+type Metadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// name is an object name.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// namespace is object namespace. The field should be called "namespace"
+	// when it returns in Teleport 2.4.
+	Namespace string `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	// description is object description.
+	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+	// labels is a set of labels.
+	Labels map[string]string `protobuf:"bytes,5,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// expires is a global expiry time header can be set on any resource in the
+	// system.
+	Expires *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=expires,proto3" json:"expires,omitempty"`
+	// ID is a record ID
+	Id int64 `protobuf:"varint,7,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *Metadata) Reset() {
+	*x = Metadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_header_v1_metadata_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Metadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Metadata) ProtoMessage() {}
+
+func (x *Metadata) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_header_v1_metadata_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Metadata.ProtoReflect.Descriptor instead.
+func (*Metadata) Descriptor() ([]byte, []int) {
+	return file_teleport_header_v1_metadata_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Metadata) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Metadata) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *Metadata) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *Metadata) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *Metadata) GetExpires() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Expires
+	}
+	return nil
+}
+
+func (x *Metadata) GetId() int64 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+var File_teleport_header_v1_metadata_proto protoreflect.FileDescriptor
+
+var file_teleport_header_v1_metadata_proto_rawDesc = []byte{
+	0x0a, 0x21, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x68, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x12, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x68, 0x65,
+	0x61, 0x64, 0x65, 0x72, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa1, 0x02, 0x0a, 0x08, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d,
+	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61,
+	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x40, 0x0a, 0x06, 0x6c, 0x61, 0x62,
+	0x65, 0x6c, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x2e, 0x76, 0x31, 0x2e, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x12, 0x34, 0x0a, 0x07, 0x65,
+	0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x07, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65,
+	0x73, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x02, 0x69,
+	0x64, 0x1a, 0x39, 0x0a, 0x0b, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x45, 0x5a, 0x43,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69,
+	0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
+	0x67, 0x6f, 0x2f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x2f, 0x76, 0x31, 0x3b, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_teleport_header_v1_metadata_proto_rawDescOnce sync.Once
+	file_teleport_header_v1_metadata_proto_rawDescData = file_teleport_header_v1_metadata_proto_rawDesc
+)
+
+func file_teleport_header_v1_metadata_proto_rawDescGZIP() []byte {
+	file_teleport_header_v1_metadata_proto_rawDescOnce.Do(func() {
+		file_teleport_header_v1_metadata_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_header_v1_metadata_proto_rawDescData)
+	})
+	return file_teleport_header_v1_metadata_proto_rawDescData
+}
+
+var file_teleport_header_v1_metadata_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_teleport_header_v1_metadata_proto_goTypes = []interface{}{
+	(*Metadata)(nil),              // 0: teleport.header.v1.Metadata
+	nil,                           // 1: teleport.header.v1.Metadata.LabelsEntry
+	(*timestamppb.Timestamp)(nil), // 2: google.protobuf.Timestamp
+}
+var file_teleport_header_v1_metadata_proto_depIdxs = []int32{
+	1, // 0: teleport.header.v1.Metadata.labels:type_name -> teleport.header.v1.Metadata.LabelsEntry
+	2, // 1: teleport.header.v1.Metadata.expires:type_name -> google.protobuf.Timestamp
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_teleport_header_v1_metadata_proto_init() }
+func file_teleport_header_v1_metadata_proto_init() {
+	if File_teleport_header_v1_metadata_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_teleport_header_v1_metadata_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Metadata); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_header_v1_metadata_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_header_v1_metadata_proto_goTypes,
+		DependencyIndexes: file_teleport_header_v1_metadata_proto_depIdxs,
+		MessageInfos:      file_teleport_header_v1_metadata_proto_msgTypes,
+	}.Build()
+	File_teleport_header_v1_metadata_proto = out.File
+	file_teleport_header_v1_metadata_proto_rawDesc = nil
+	file_teleport_header_v1_metadata_proto_goTypes = nil
+	file_teleport_header_v1_metadata_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/header/v1/resourceheader.pb.go b/api/gen/proto/go/header/v1/resourceheader.pb.go
new file mode 100644
index 0000000000000..21fabebb417ad
--- /dev/null
+++ b/api/gen/proto/go/header/v1/resourceheader.pb.go
@@ -0,0 +1,203 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: teleport/header/v1/resourceheader.proto
+
+package header
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// ResourceHeader is a shared resource header.
+type ResourceHeader struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// kind is a resource kind.
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// sub_kind is an optional resource sub kind, used in some resources.
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// version is version.
+	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	// metadata is resource metadata.
+	Metadata *Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+}
+
+func (x *ResourceHeader) Reset() {
+	*x = ResourceHeader{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_header_v1_resourceheader_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResourceHeader) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResourceHeader) ProtoMessage() {}
+
+func (x *ResourceHeader) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_header_v1_resourceheader_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResourceHeader.ProtoReflect.Descriptor instead.
+func (*ResourceHeader) Descriptor() ([]byte, []int) {
+	return file_teleport_header_v1_resourceheader_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ResourceHeader) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *ResourceHeader) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *ResourceHeader) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *ResourceHeader) GetMetadata() *Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+var File_teleport_header_v1_resourceheader_proto protoreflect.FileDescriptor
+
+var file_teleport_header_v1_resourceheader_proto_rawDesc = []byte{
+	0x0a, 0x27, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x68, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x2e, 0x76, 0x31, 0x1a, 0x21, 0x74,
+	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x2f, 0x76,
+	0x31, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x22, 0x93, 0x01, 0x0a, 0x0e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x48, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x75, 0x62, 0x5f, 0x6b,
+	0x69, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x75, 0x62, 0x4b, 0x69,
+	0x6e, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x38, 0x0a, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c,
+	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72,
+	0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x42, 0x45, 0x5a, 0x43, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x2f, 0x76, 0x31, 0x3b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_teleport_header_v1_resourceheader_proto_rawDescOnce sync.Once
+	file_teleport_header_v1_resourceheader_proto_rawDescData = file_teleport_header_v1_resourceheader_proto_rawDesc
+)
+
+func file_teleport_header_v1_resourceheader_proto_rawDescGZIP() []byte {
+	file_teleport_header_v1_resourceheader_proto_rawDescOnce.Do(func() {
+		file_teleport_header_v1_resourceheader_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_header_v1_resourceheader_proto_rawDescData)
+	})
+	return file_teleport_header_v1_resourceheader_proto_rawDescData
+}
+
+var file_teleport_header_v1_resourceheader_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_teleport_header_v1_resourceheader_proto_goTypes = []interface{}{
+	(*ResourceHeader)(nil), // 0: teleport.header.v1.ResourceHeader
+	(*Metadata)(nil),       // 1: teleport.header.v1.Metadata
+}
+var file_teleport_header_v1_resourceheader_proto_depIdxs = []int32{
+	1, // 0: teleport.header.v1.ResourceHeader.metadata:type_name -> teleport.header.v1.Metadata
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_teleport_header_v1_resourceheader_proto_init() }
+func file_teleport_header_v1_resourceheader_proto_init() {
+	if File_teleport_header_v1_resourceheader_proto != nil {
+		return
+	}
+	file_teleport_header_v1_metadata_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_teleport_header_v1_resourceheader_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResourceHeader); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_header_v1_resourceheader_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_header_v1_resourceheader_proto_goTypes,
+		DependencyIndexes: file_teleport_header_v1_resourceheader_proto_depIdxs,
+		MessageInfos:      file_teleport_header_v1_resourceheader_proto_msgTypes,
+	}.Build()
+	File_teleport_header_v1_resourceheader_proto = out.File
+	file_teleport_header_v1_resourceheader_proto_rawDesc = nil
+	file_teleport_header_v1_resourceheader_proto_goTypes = nil
+	file_teleport_header_v1_resourceheader_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/device_collected_data.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/device_collected_data.pb.go
index fb5410b913327..44c405f0a12d7 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/device_collected_data.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/device_collected_data.pb.go
@@ -87,6 +87,19 @@ type DeviceCollectedData struct {
 	// The serial number of the "base board" as reported by BIOS DMI Type 2.
 	// This field can be empty if no value has been configured.
 	BaseBoardSerialNumber string `protobuf:"bytes,13,opt,name=base_board_serial_number,json=baseBoardSerialNumber,proto3" json:"base_board_serial_number,omitempty"`
+	// If during the collection of this device data, the device performed a TPM
+	// platform attestation (e.g during enrollment or authentication), then this
+	// field holds the record of this attestation. This allows the state of the
+	// device to be compared to historical state, and allows for the platform
+	// attestations to be revalidated at a later date.
+	//
+	// This field is not explicitly sent up by the client, and any DCD sent by a
+	// client including this field should be rejected. The server should inject
+	// this field once verifying that the submitted platform attestation during
+	// the enrollment or authentication.
+	//
+	// System managed.
+	TpmPlatformAttestation *TPMPlatformAttestation `protobuf:"bytes,14,opt,name=tpm_platform_attestation,json=tpmPlatformAttestation,proto3" json:"tpm_platform_attestation,omitempty"`
 }
 
 func (x *DeviceCollectedData) Reset() {
@@ -212,6 +225,13 @@ func (x *DeviceCollectedData) GetBaseBoardSerialNumber() string {
 	return ""
 }
 
+func (x *DeviceCollectedData) GetTpmPlatformAttestation() *TPMPlatformAttestation {
+	if x != nil {
+		return x.TpmPlatformAttestation
+	}
+	return nil
+}
+
 var File_teleport_devicetrust_v1_device_collected_data_proto protoreflect.FileDescriptor
 
 var file_teleport_devicetrust_v1_device_collected_data_proto_rawDesc = []byte{
@@ -224,53 +244,62 @@ var file_teleport_devicetrust_v1_device_collected_data_proto_rawDesc = []byte{
 	0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
 	0x25, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
 	0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x2f, 0x6f, 0x73, 0x5f, 0x74, 0x79, 0x70, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xfb, 0x04, 0x0a, 0x13, 0x44, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61, 0x12, 0x3d,
-	0x0a, 0x0c, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x52, 0x0b, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x3b, 0x0a,
-	0x0b, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a,
-	0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x38, 0x0a, 0x07, 0x6f, 0x73,
-	0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1f, 0x2e, 0x74, 0x65,
-	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75,
-	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x4f, 0x53, 0x54, 0x79, 0x70, 0x65, 0x52, 0x06, 0x6f, 0x73,
-	0x54, 0x79, 0x70, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x5f, 0x6e,
-	0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x72,
-	0x69, 0x61, 0x6c, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x29, 0x0a, 0x10, 0x6d, 0x6f, 0x64,
-	0x65, 0x6c, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x66, 0x69, 0x65, 0x72, 0x12, 0x1d, 0x0a, 0x0a, 0x6f, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69,
-	0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6f, 0x73, 0x56, 0x65, 0x72, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x6f, 0x73, 0x5f, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6f, 0x73, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x12, 0x1f,
-	0x0a, 0x0b, 0x6f, 0x73, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x08, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0a, 0x6f, 0x73, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12,
-	0x2e, 0x0a, 0x13, 0x6a, 0x61, 0x6d, 0x66, 0x5f, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x5f, 0x76,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x6a, 0x61,
-	0x6d, 0x66, 0x42, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
-	0x3a, 0x0a, 0x19, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x5f, 0x65, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x6d,
-	0x65, 0x6e, 0x74, 0x5f, 0x70, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x17, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x6d,
-	0x65, 0x6e, 0x74, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x72,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x73, 0x73, 0x65, 0x74, 0x5f, 0x74, 0x61,
-	0x67, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x72, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x65,
-	0x64, 0x41, 0x73, 0x73, 0x65, 0x74, 0x54, 0x61, 0x67, 0x12, 0x30, 0x0a, 0x14, 0x73, 0x79, 0x73,
-	0x74, 0x65, 0x6d, 0x5f, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65,
-	0x72, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x53,
-	0x65, 0x72, 0x69, 0x61, 0x6c, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x37, 0x0a, 0x18, 0x62,
-	0x61, 0x73, 0x65, 0x5f, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c,
-	0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x62,
-	0x61, 0x73, 0x65, 0x42, 0x6f, 0x61, 0x72, 0x64, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x4e, 0x75,
-	0x6d, 0x62, 0x65, 0x72, 0x42, 0x5a, 0x5a, 0x58, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c,
-	0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65,
-	0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x2f, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2f,
-	0x76, 0x31, 0x3b, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x76, 0x31,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x21, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x2f, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x2f,
+	0x74, 0x70, 0x6d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe6, 0x05, 0x0a, 0x13, 0x44, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x44, 0x61, 0x74,
+	0x61, 0x12, 0x3d, 0x0a, 0x0c, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x5f, 0x74, 0x69, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74,
+	0x61, 0x6d, 0x70, 0x52, 0x0b, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x54, 0x69, 0x6d, 0x65,
+	0x12, 0x3b, 0x0a, 0x0b, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x52, 0x0a, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x38, 0x0a,
+	0x07, 0x6f, 0x73, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1f,
+	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x4f, 0x53, 0x54, 0x79, 0x70, 0x65, 0x52,
+	0x06, 0x6f, 0x73, 0x54, 0x79, 0x70, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x72, 0x69, 0x61,
+	0x6c, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
+	0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x29, 0x0a, 0x10,
+	0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x49, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x1d, 0x0a, 0x0a, 0x6f, 0x73, 0x5f, 0x76, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6f, 0x73, 0x56,
+	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x6f, 0x73, 0x5f, 0x62, 0x75, 0x69,
+	0x6c, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6f, 0x73, 0x42, 0x75, 0x69, 0x6c,
+	0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x6f, 0x73, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6f, 0x73, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x2e, 0x0a, 0x13, 0x6a, 0x61, 0x6d, 0x66, 0x5f, 0x62, 0x69, 0x6e, 0x61, 0x72,
+	0x79, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x11, 0x6a, 0x61, 0x6d, 0x66, 0x42, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x56, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x12, 0x3a, 0x0a, 0x19, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x5f, 0x65, 0x6e, 0x72, 0x6f,
+	0x6c, 0x6c, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x70, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x73, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x17, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x45, 0x6e, 0x72, 0x6f,
+	0x6c, 0x6c, 0x6d, 0x65, 0x6e, 0x74, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x73, 0x12, 0x2c,
+	0x0a, 0x12, 0x72, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x73, 0x73, 0x65, 0x74,
+	0x5f, 0x74, 0x61, 0x67, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x72, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x65, 0x64, 0x41, 0x73, 0x73, 0x65, 0x74, 0x54, 0x61, 0x67, 0x12, 0x30, 0x0a, 0x14,
+	0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x5f, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x5f, 0x6e, 0x75,
+	0x6d, 0x62, 0x65, 0x72, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x73, 0x79, 0x73, 0x74,
+	0x65, 0x6d, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x37,
+	0x0a, 0x18, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f, 0x73, 0x65, 0x72,
+	0x69, 0x61, 0x6c, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x15, 0x62, 0x61, 0x73, 0x65, 0x42, 0x6f, 0x61, 0x72, 0x64, 0x53, 0x65, 0x72, 0x69, 0x61,
+	0x6c, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x69, 0x0a, 0x18, 0x74, 0x70, 0x6d, 0x5f, 0x70,
+	0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74,
+	0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x41,
+	0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x16, 0x74, 0x70, 0x6d, 0x50,
+	0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x42, 0x5a, 0x5a, 0x58, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74,
+	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2f, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31,
+	0x3b, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x76, 0x31, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -287,19 +316,21 @@ func file_teleport_devicetrust_v1_device_collected_data_proto_rawDescGZIP() []by
 
 var file_teleport_devicetrust_v1_device_collected_data_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
 var file_teleport_devicetrust_v1_device_collected_data_proto_goTypes = []interface{}{
-	(*DeviceCollectedData)(nil),   // 0: teleport.devicetrust.v1.DeviceCollectedData
-	(*timestamppb.Timestamp)(nil), // 1: google.protobuf.Timestamp
-	(OSType)(0),                   // 2: teleport.devicetrust.v1.OSType
+	(*DeviceCollectedData)(nil),    // 0: teleport.devicetrust.v1.DeviceCollectedData
+	(*timestamppb.Timestamp)(nil),  // 1: google.protobuf.Timestamp
+	(OSType)(0),                    // 2: teleport.devicetrust.v1.OSType
+	(*TPMPlatformAttestation)(nil), // 3: teleport.devicetrust.v1.TPMPlatformAttestation
 }
 var file_teleport_devicetrust_v1_device_collected_data_proto_depIdxs = []int32{
 	1, // 0: teleport.devicetrust.v1.DeviceCollectedData.collect_time:type_name -> google.protobuf.Timestamp
 	1, // 1: teleport.devicetrust.v1.DeviceCollectedData.record_time:type_name -> google.protobuf.Timestamp
 	2, // 2: teleport.devicetrust.v1.DeviceCollectedData.os_type:type_name -> teleport.devicetrust.v1.OSType
-	3, // [3:3] is the sub-list for method output_type
-	3, // [3:3] is the sub-list for method input_type
-	3, // [3:3] is the sub-list for extension type_name
-	3, // [3:3] is the sub-list for extension extendee
-	0, // [0:3] is the sub-list for field type_name
+	3, // 3: teleport.devicetrust.v1.DeviceCollectedData.tpm_platform_attestation:type_name -> teleport.devicetrust.v1.TPMPlatformAttestation
+	4, // [4:4] is the sub-list for method output_type
+	4, // [4:4] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
 }
 
 func init() { file_teleport_devicetrust_v1_device_collected_data_proto_init() }
@@ -308,6 +339,7 @@ func file_teleport_devicetrust_v1_device_collected_data_proto_init() {
 		return
 	}
 	file_teleport_devicetrust_v1_os_type_proto_init()
+	file_teleport_devicetrust_v1_tpm_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_teleport_devicetrust_v1_device_collected_data_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*DeviceCollectedData); i {
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/device_profile.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/device_profile.pb.go
index 36a2553e4a583..9f19843c48127 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/device_profile.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/device_profile.pb.go
@@ -60,6 +60,8 @@ type DeviceProfile struct {
 	// Jamf binary version, without the leading 'v'.
 	// Example: "9.27" or "10.44.1-t1677509507".
 	JamfBinaryVersion string `protobuf:"bytes,6,opt,name=jamf_binary_version,json=jamfBinaryVersion,proto3" json:"jamf_binary_version,omitempty"`
+	// External device identifier, for example the Jamf or Intune ID.
+	ExternalId string `protobuf:"bytes,7,opt,name=external_id,json=externalId,proto3" json:"external_id,omitempty"`
 }
 
 func (x *DeviceProfile) Reset() {
@@ -136,6 +138,13 @@ func (x *DeviceProfile) GetJamfBinaryVersion() string {
 	return ""
 }
 
+func (x *DeviceProfile) GetExternalId() string {
+	if x != nil {
+		return x.ExternalId
+	}
+	return ""
+}
+
 var File_teleport_devicetrust_v1_device_profile_proto protoreflect.FileDescriptor
 
 var file_teleport_devicetrust_v1_device_profile_proto_rawDesc = []byte{
@@ -145,7 +154,7 @@ var file_teleport_devicetrust_v1_device_profile_proto_rawDesc = []byte{
 	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74,
 	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x84, 0x02, 0x0a, 0x0d, 0x44, 0x65, 0x76,
+	0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa5, 0x02, 0x0a, 0x0d, 0x44, 0x65, 0x76,
 	0x69, 0x63, 0x65, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x12, 0x3b, 0x0a, 0x0b, 0x75, 0x70,
 	0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
@@ -161,14 +170,16 @@ var file_teleport_devicetrust_v1_device_profile_proto_rawDesc = []byte{
 	0x28, 0x09, 0x52, 0x0b, 0x6f, 0x73, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x12,
 	0x2e, 0x0a, 0x13, 0x6a, 0x61, 0x6d, 0x66, 0x5f, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x5f, 0x76,
 	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x6a, 0x61,
-	0x6d, 0x66, 0x42, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x42,
-	0x5a, 0x5a, 0x58, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72,
-	0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65,
-	0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x64,
-	0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x3b, 0x64, 0x65,
-	0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x33,
+	0x6d, 0x66, 0x42, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x1f, 0x0a, 0x0b, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x07,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x49, 0x64,
+	0x42, 0x5a, 0x5a, 0x58, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67,
+	0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f,
+	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x3b, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service.pb.go
index 8e04676f83122..332a710aa7920 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service.pb.go
@@ -91,115 +91,6 @@ func (DeviceView) EnumDescriptor() ([]byte, []int) {
 	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{0}
 }
 
-// Mode of sync for SyncInventory.
-type SyncInventoryMode int32
-
-const (
-	SyncInventoryMode_SYNC_INVENTORY_MODE_UNSPECIFIED SyncInventoryMode = 0
-	// Partial inventory sync; not all devices in the external inventory are sent
-	// to the stream.
-	// Partial sync precludes inventory cleanup.
-	SyncInventoryMode_SYNC_INVENTORY_MODE_PARTIAL SyncInventoryMode = 1
-	// Full inventory sync; all devices in the external inventory must be sent to
-	// the stream.
-	// Full sync allows for handling of missing devices.
-	SyncInventoryMode_SYNC_INVENTORY_MODE_FULL SyncInventoryMode = 2
-)
-
-// Enum value maps for SyncInventoryMode.
-var (
-	SyncInventoryMode_name = map[int32]string{
-		0: "SYNC_INVENTORY_MODE_UNSPECIFIED",
-		1: "SYNC_INVENTORY_MODE_PARTIAL",
-		2: "SYNC_INVENTORY_MODE_FULL",
-	}
-	SyncInventoryMode_value = map[string]int32{
-		"SYNC_INVENTORY_MODE_UNSPECIFIED": 0,
-		"SYNC_INVENTORY_MODE_PARTIAL":     1,
-		"SYNC_INVENTORY_MODE_FULL":        2,
-	}
-)
-
-func (x SyncInventoryMode) Enum() *SyncInventoryMode {
-	p := new(SyncInventoryMode)
-	*p = x
-	return p
-}
-
-func (x SyncInventoryMode) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (SyncInventoryMode) Descriptor() protoreflect.EnumDescriptor {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_enumTypes[1].Descriptor()
-}
-
-func (SyncInventoryMode) Type() protoreflect.EnumType {
-	return &file_teleport_devicetrust_v1_devicetrust_service_proto_enumTypes[1]
-}
-
-func (x SyncInventoryMode) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Use SyncInventoryMode.Descriptor instead.
-func (SyncInventoryMode) EnumDescriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{1}
-}
-
-// Device action for SyncInventory.
-// Typically triggered at the end of FULL syncs..
-type SyncInventoryDeviceAction int32
-
-const (
-	SyncInventoryDeviceAction_SYNC_INVENTORY_DEVICE_ACTION_UNSPECIFIED SyncInventoryDeviceAction = 0
-	// Noop is a no-action.
-	SyncInventoryDeviceAction_SYNC_INVENTORY_DEVICE_ACTION_NOOP SyncInventoryDeviceAction = 1
-	// Deletes the device if the action condition is met.
-	SyncInventoryDeviceAction_SYNC_INVENTORY_DEVICE_ACTION_DELETE SyncInventoryDeviceAction = 2
-)
-
-// Enum value maps for SyncInventoryDeviceAction.
-var (
-	SyncInventoryDeviceAction_name = map[int32]string{
-		0: "SYNC_INVENTORY_DEVICE_ACTION_UNSPECIFIED",
-		1: "SYNC_INVENTORY_DEVICE_ACTION_NOOP",
-		2: "SYNC_INVENTORY_DEVICE_ACTION_DELETE",
-	}
-	SyncInventoryDeviceAction_value = map[string]int32{
-		"SYNC_INVENTORY_DEVICE_ACTION_UNSPECIFIED": 0,
-		"SYNC_INVENTORY_DEVICE_ACTION_NOOP":        1,
-		"SYNC_INVENTORY_DEVICE_ACTION_DELETE":      2,
-	}
-)
-
-func (x SyncInventoryDeviceAction) Enum() *SyncInventoryDeviceAction {
-	p := new(SyncInventoryDeviceAction)
-	*p = x
-	return p
-}
-
-func (x SyncInventoryDeviceAction) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (SyncInventoryDeviceAction) Descriptor() protoreflect.EnumDescriptor {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_enumTypes[2].Descriptor()
-}
-
-func (SyncInventoryDeviceAction) Type() protoreflect.EnumType {
-	return &file_teleport_devicetrust_v1_devicetrust_service_proto_enumTypes[2]
-}
-
-func (x SyncInventoryDeviceAction) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Use SyncInventoryDeviceAction.Descriptor instead.
-func (SyncInventoryDeviceAction) EnumDescriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{2}
-}
-
 // Request for CreateDevice.
 type CreateDeviceRequest struct {
 	state         protoimpl.MessageState
@@ -1815,200 +1706,6 @@ func (x *TPMEnrollChallengeResponse) GetPlatformParameters() *TPMPlatformParamet
 	return nil
 }
 
-// Encapsulates the value of a PCR at a point at time.
-// See https://pkg.go.dev/github.com/google/go-attestation/attest#PCR
-type TPMPCR struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// the PCR index in the PCR bank
-	Index int32 `protobuf:"varint,1,opt,name=index,proto3" json:"index,omitempty"`
-	// the digest currently held in the PCR
-	Digest []byte `protobuf:"bytes,2,opt,name=digest,proto3" json:"digest,omitempty"`
-	// the hash algorithm used to produce the digest in this PCR bank. This value
-	// is the underlying value of the Go crypto.Hash type.
-	DigestAlg uint64 `protobuf:"varint,3,opt,name=digest_alg,json=digestAlg,proto3" json:"digest_alg,omitempty"`
-}
-
-func (x *TPMPCR) Reset() {
-	*x = TPMPCR{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[25]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *TPMPCR) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*TPMPCR) ProtoMessage() {}
-
-func (x *TPMPCR) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[25]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use TPMPCR.ProtoReflect.Descriptor instead.
-func (*TPMPCR) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{25}
-}
-
-func (x *TPMPCR) GetIndex() int32 {
-	if x != nil {
-		return x.Index
-	}
-	return 0
-}
-
-func (x *TPMPCR) GetDigest() []byte {
-	if x != nil {
-		return x.Digest
-	}
-	return nil
-}
-
-func (x *TPMPCR) GetDigestAlg() uint64 {
-	if x != nil {
-		return x.DigestAlg
-	}
-	return 0
-}
-
-// Encapsulates the result of a quote operation against the TPM over a PCR
-// using an attestation key.
-// See https://pkg.go.dev/github.com/google/go-attestation/attest#Quote
-type TPMQuote struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Quote     []byte `protobuf:"bytes,1,opt,name=quote,proto3" json:"quote,omitempty"`
-	Signature []byte `protobuf:"bytes,2,opt,name=signature,proto3" json:"signature,omitempty"`
-}
-
-func (x *TPMQuote) Reset() {
-	*x = TPMQuote{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[26]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *TPMQuote) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*TPMQuote) ProtoMessage() {}
-
-func (x *TPMQuote) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[26]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use TPMQuote.ProtoReflect.Descriptor instead.
-func (*TPMQuote) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{26}
-}
-
-func (x *TPMQuote) GetQuote() []byte {
-	if x != nil {
-		return x.Quote
-	}
-	return nil
-}
-
-func (x *TPMQuote) GetSignature() []byte {
-	if x != nil {
-		return x.Signature
-	}
-	return nil
-}
-
-// The quotes, PCRs and event log from a TPM that attest to the booted state
-// of the machine.
-// See https://pkg.go.dev/github.com/google/go-attestation/attest#PlatformParameters
-// Excludes TPMVersion and Public since these are already known values.
-type TPMPlatformParameters struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Quotes   []*TPMQuote `protobuf:"bytes,1,rep,name=quotes,proto3" json:"quotes,omitempty"`
-	Pcrs     []*TPMPCR   `protobuf:"bytes,2,rep,name=pcrs,proto3" json:"pcrs,omitempty"`
-	EventLog []byte      `protobuf:"bytes,3,opt,name=event_log,json=eventLog,proto3" json:"event_log,omitempty"`
-}
-
-func (x *TPMPlatformParameters) Reset() {
-	*x = TPMPlatformParameters{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[27]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *TPMPlatformParameters) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*TPMPlatformParameters) ProtoMessage() {}
-
-func (x *TPMPlatformParameters) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[27]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use TPMPlatformParameters.ProtoReflect.Descriptor instead.
-func (*TPMPlatformParameters) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{27}
-}
-
-func (x *TPMPlatformParameters) GetQuotes() []*TPMQuote {
-	if x != nil {
-		return x.Quotes
-	}
-	return nil
-}
-
-func (x *TPMPlatformParameters) GetPcrs() []*TPMPCR {
-	if x != nil {
-		return x.Pcrs
-	}
-	return nil
-}
-
-func (x *TPMPlatformParameters) GetEventLog() []byte {
-	if x != nil {
-		return x.EventLog
-	}
-	return nil
-}
-
 // Request for AuthenticateDevice.
 //
 // Authentication ceremony flow:
@@ -2032,7 +1729,7 @@ type AuthenticateDeviceRequest struct {
 func (x *AuthenticateDeviceRequest) Reset() {
 	*x = AuthenticateDeviceRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[28]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[25]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2045,7 +1742,7 @@ func (x *AuthenticateDeviceRequest) String() string {
 func (*AuthenticateDeviceRequest) ProtoMessage() {}
 
 func (x *AuthenticateDeviceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[28]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[25]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2058,7 +1755,7 @@ func (x *AuthenticateDeviceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthenticateDeviceRequest.ProtoReflect.Descriptor instead.
 func (*AuthenticateDeviceRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{28}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{25}
 }
 
 func (m *AuthenticateDeviceRequest) GetPayload() isAuthenticateDeviceRequest_Payload {
@@ -2128,7 +1825,7 @@ type AuthenticateDeviceResponse struct {
 func (x *AuthenticateDeviceResponse) Reset() {
 	*x = AuthenticateDeviceResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[29]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[26]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2141,7 +1838,7 @@ func (x *AuthenticateDeviceResponse) String() string {
 func (*AuthenticateDeviceResponse) ProtoMessage() {}
 
 func (x *AuthenticateDeviceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[29]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[26]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2154,7 +1851,7 @@ func (x *AuthenticateDeviceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthenticateDeviceResponse.ProtoReflect.Descriptor instead.
 func (*AuthenticateDeviceResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{29}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{26}
 }
 
 func (m *AuthenticateDeviceResponse) GetPayload() isAuthenticateDeviceResponse_Payload {
@@ -2233,7 +1930,7 @@ type AuthenticateDeviceInit struct {
 func (x *AuthenticateDeviceInit) Reset() {
 	*x = AuthenticateDeviceInit{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[30]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[27]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2246,7 +1943,7 @@ func (x *AuthenticateDeviceInit) String() string {
 func (*AuthenticateDeviceInit) ProtoMessage() {}
 
 func (x *AuthenticateDeviceInit) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[30]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[27]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2259,7 +1956,7 @@ func (x *AuthenticateDeviceInit) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthenticateDeviceInit.ProtoReflect.Descriptor instead.
 func (*AuthenticateDeviceInit) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{30}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *AuthenticateDeviceInit) GetUserCertificates() *UserCertificates {
@@ -2298,7 +1995,7 @@ type TPMAuthenticateDeviceChallenge struct {
 func (x *TPMAuthenticateDeviceChallenge) Reset() {
 	*x = TPMAuthenticateDeviceChallenge{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[31]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[28]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2311,7 +2008,7 @@ func (x *TPMAuthenticateDeviceChallenge) String() string {
 func (*TPMAuthenticateDeviceChallenge) ProtoMessage() {}
 
 func (x *TPMAuthenticateDeviceChallenge) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[31]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[28]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2324,7 +2021,7 @@ func (x *TPMAuthenticateDeviceChallenge) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TPMAuthenticateDeviceChallenge.ProtoReflect.Descriptor instead.
 func (*TPMAuthenticateDeviceChallenge) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{31}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *TPMAuthenticateDeviceChallenge) GetAttestationNonce() []byte {
@@ -2349,7 +2046,7 @@ type TPMAuthenticateDeviceChallengeResponse struct {
 func (x *TPMAuthenticateDeviceChallengeResponse) Reset() {
 	*x = TPMAuthenticateDeviceChallengeResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[32]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[29]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2362,7 +2059,7 @@ func (x *TPMAuthenticateDeviceChallengeResponse) String() string {
 func (*TPMAuthenticateDeviceChallengeResponse) ProtoMessage() {}
 
 func (x *TPMAuthenticateDeviceChallengeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[32]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[29]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2375,7 +2072,7 @@ func (x *TPMAuthenticateDeviceChallengeResponse) ProtoReflect() protoreflect.Mes
 
 // Deprecated: Use TPMAuthenticateDeviceChallengeResponse.ProtoReflect.Descriptor instead.
 func (*TPMAuthenticateDeviceChallengeResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{32}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *TPMAuthenticateDeviceChallengeResponse) GetPlatformParameters() *TPMPlatformParameters {
@@ -2398,7 +2095,7 @@ type AuthenticateDeviceChallenge struct {
 func (x *AuthenticateDeviceChallenge) Reset() {
 	*x = AuthenticateDeviceChallenge{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[33]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[30]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2411,7 +2108,7 @@ func (x *AuthenticateDeviceChallenge) String() string {
 func (*AuthenticateDeviceChallenge) ProtoMessage() {}
 
 func (x *AuthenticateDeviceChallenge) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[33]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[30]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2424,7 +2121,7 @@ func (x *AuthenticateDeviceChallenge) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthenticateDeviceChallenge.ProtoReflect.Descriptor instead.
 func (*AuthenticateDeviceChallenge) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{33}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *AuthenticateDeviceChallenge) GetChallenge() []byte {
@@ -2448,7 +2145,7 @@ type AuthenticateDeviceChallengeResponse struct {
 func (x *AuthenticateDeviceChallengeResponse) Reset() {
 	*x = AuthenticateDeviceChallengeResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[34]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[31]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2461,7 +2158,7 @@ func (x *AuthenticateDeviceChallengeResponse) String() string {
 func (*AuthenticateDeviceChallengeResponse) ProtoMessage() {}
 
 func (x *AuthenticateDeviceChallengeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[34]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[31]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2474,7 +2171,7 @@ func (x *AuthenticateDeviceChallengeResponse) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use AuthenticateDeviceChallengeResponse.ProtoReflect.Descriptor instead.
 func (*AuthenticateDeviceChallengeResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{34}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *AuthenticateDeviceChallengeResponse) GetSignature() []byte {
@@ -2496,8 +2193,10 @@ func (x *AuthenticateDeviceChallengeResponse) GetSignature() []byte {
 // (end loop)
 // -> SyncInventoryEnd
 // (loop until server closes the stream, zero or more times)
-// <- SyncInventoryResult (deleted/missing devices)
-// (end)
+// <- SyncInventoryMissingDevices
+// -> SyncInventoryDevices (removals only)
+// <- SyncInventoryResult
+// (end loop)
 type SyncInventoryRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2515,7 +2214,7 @@ type SyncInventoryRequest struct {
 func (x *SyncInventoryRequest) Reset() {
 	*x = SyncInventoryRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[35]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[32]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2528,7 +2227,7 @@ func (x *SyncInventoryRequest) String() string {
 func (*SyncInventoryRequest) ProtoMessage() {}
 
 func (x *SyncInventoryRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[35]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[32]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2541,7 +2240,7 @@ func (x *SyncInventoryRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SyncInventoryRequest.ProtoReflect.Descriptor instead.
 func (*SyncInventoryRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{35}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{32}
 }
 
 func (m *SyncInventoryRequest) GetPayload() isSyncInventoryRequest_Payload {
@@ -2617,13 +2316,14 @@ type SyncInventoryResponse struct {
 	//
 	//	*SyncInventoryResponse_Ack
 	//	*SyncInventoryResponse_Result
+	//	*SyncInventoryResponse_MissingDevices
 	Payload isSyncInventoryResponse_Payload `protobuf_oneof:"payload"`
 }
 
 func (x *SyncInventoryResponse) Reset() {
 	*x = SyncInventoryResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[36]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[33]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2636,7 +2336,7 @@ func (x *SyncInventoryResponse) String() string {
 func (*SyncInventoryResponse) ProtoMessage() {}
 
 func (x *SyncInventoryResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[36]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[33]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2649,7 +2349,7 @@ func (x *SyncInventoryResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SyncInventoryResponse.ProtoReflect.Descriptor instead.
 func (*SyncInventoryResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{36}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{33}
 }
 
 func (m *SyncInventoryResponse) GetPayload() isSyncInventoryResponse_Payload {
@@ -2673,6 +2373,13 @@ func (x *SyncInventoryResponse) GetResult() *SyncInventoryResult {
 	return nil
 }
 
+func (x *SyncInventoryResponse) GetMissingDevices() *SyncInventoryMissingDevices {
+	if x, ok := x.GetPayload().(*SyncInventoryResponse_MissingDevices); ok {
+		return x.MissingDevices
+	}
+	return nil
+}
+
 type isSyncInventoryResponse_Payload interface {
 	isSyncInventoryResponse_Payload()
 }
@@ -2685,10 +2392,16 @@ type SyncInventoryResponse_Result struct {
 	Result *SyncInventoryResult `protobuf:"bytes,2,opt,name=result,proto3,oneof"`
 }
 
+type SyncInventoryResponse_MissingDevices struct {
+	MissingDevices *SyncInventoryMissingDevices `protobuf:"bytes,3,opt,name=missing_devices,json=missingDevices,proto3,oneof"`
+}
+
 func (*SyncInventoryResponse_Ack) isSyncInventoryResponse_Payload() {}
 
 func (*SyncInventoryResponse_Result) isSyncInventoryResponse_Payload() {}
 
+func (*SyncInventoryResponse_MissingDevices) isSyncInventoryResponse_Payload() {}
+
 // SyncInventoryStart starts the inventory sync.
 type SyncInventoryStart struct {
 	state         protoimpl.MessageState
@@ -2699,20 +2412,18 @@ type SyncInventoryStart struct {
 	// Used for all devices. The `source` field in individual devices is ignored
 	// by this RPC.
 	Source *DeviceSource `protobuf:"bytes,1,opt,name=source,proto3" json:"source,omitempty"`
-	// Mode of syncing.
-	// Required.
-	Mode SyncInventoryMode `protobuf:"varint,2,opt,name=mode,proto3,enum=teleport.devicetrust.v1.SyncInventoryMode" json:"mode,omitempty"`
-	// Action for devices missing from the external inventory, but present in
-	// Teleport.
-	// Only executed if mode is FULL and external_sync_successful is set to true
-	// in the SyncInventoryEnd message.
-	OnMissingAction SyncInventoryDeviceAction `protobuf:"varint,3,opt,name=on_missing_action,json=onMissingAction,proto3,enum=teleport.devicetrust.v1.SyncInventoryDeviceAction" json:"on_missing_action,omitempty"`
+	// If true, the server keeps track of the devices upserted during the sync.
+	// After receiving the [SyncInventoryEnd] message, the server informs the
+	// client of all devices that are present in storage but not observed in the
+	// upserts.
+	// See [SyncInventoryRequest] and [SyncInventoryMissingDevices] for details.
+	TrackMissingDevices bool `protobuf:"varint,4,opt,name=track_missing_devices,json=trackMissingDevices,proto3" json:"track_missing_devices,omitempty"`
 }
 
 func (x *SyncInventoryStart) Reset() {
 	*x = SyncInventoryStart{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[37]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[34]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2725,7 +2436,7 @@ func (x *SyncInventoryStart) String() string {
 func (*SyncInventoryStart) ProtoMessage() {}
 
 func (x *SyncInventoryStart) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[37]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[34]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2738,7 +2449,7 @@ func (x *SyncInventoryStart) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SyncInventoryStart.ProtoReflect.Descriptor instead.
 func (*SyncInventoryStart) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{37}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{34}
 }
 
 func (x *SyncInventoryStart) GetSource() *DeviceSource {
@@ -2748,18 +2459,11 @@ func (x *SyncInventoryStart) GetSource() *DeviceSource {
 	return nil
 }
 
-func (x *SyncInventoryStart) GetMode() SyncInventoryMode {
+func (x *SyncInventoryStart) GetTrackMissingDevices() bool {
 	if x != nil {
-		return x.Mode
+		return x.TrackMissingDevices
 	}
-	return SyncInventoryMode_SYNC_INVENTORY_MODE_UNSPECIFIED
-}
-
-func (x *SyncInventoryStart) GetOnMissingAction() SyncInventoryDeviceAction {
-	if x != nil {
-		return x.OnMissingAction
-	}
-	return SyncInventoryDeviceAction_SYNC_INVENTORY_DEVICE_ACTION_UNSPECIFIED
+	return false
 }
 
 // SyncInventoryEnd ends the inventory sync, signaling that no more
@@ -2768,17 +2472,12 @@ type SyncInventoryEnd struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
-
-	// True if the external sync was fully successful (for example, all reads from
-	// an MDM API were successful).
-	// If false the sync's on_missing_action is skipped.
-	ExternalSyncSuccessful bool `protobuf:"varint,1,opt,name=external_sync_successful,json=externalSyncSuccessful,proto3" json:"external_sync_successful,omitempty"`
 }
 
 func (x *SyncInventoryEnd) Reset() {
 	*x = SyncInventoryEnd{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[38]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[35]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2791,7 +2490,7 @@ func (x *SyncInventoryEnd) String() string {
 func (*SyncInventoryEnd) ProtoMessage() {}
 
 func (x *SyncInventoryEnd) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[38]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[35]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2804,14 +2503,7 @@ func (x *SyncInventoryEnd) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SyncInventoryEnd.ProtoReflect.Descriptor instead.
 func (*SyncInventoryEnd) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{38}
-}
-
-func (x *SyncInventoryEnd) GetExternalSyncSuccessful() bool {
-	if x != nil {
-		return x.ExternalSyncSuccessful
-	}
-	return false
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{35}
 }
 
 // SyncInventoryDevices transports devices to add/update/remove.
@@ -2828,7 +2520,7 @@ type SyncInventoryDevices struct {
 func (x *SyncInventoryDevices) Reset() {
 	*x = SyncInventoryDevices{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[39]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[36]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2841,7 +2533,7 @@ func (x *SyncInventoryDevices) String() string {
 func (*SyncInventoryDevices) ProtoMessage() {}
 
 func (x *SyncInventoryDevices) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[39]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[36]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2854,7 +2546,7 @@ func (x *SyncInventoryDevices) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SyncInventoryDevices.ProtoReflect.Descriptor instead.
 func (*SyncInventoryDevices) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{39}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *SyncInventoryDevices) GetDevices() []*Device {
@@ -2875,7 +2567,7 @@ type SyncInventoryAck struct {
 func (x *SyncInventoryAck) Reset() {
 	*x = SyncInventoryAck{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[40]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[37]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2888,7 +2580,7 @@ func (x *SyncInventoryAck) String() string {
 func (*SyncInventoryAck) ProtoMessage() {}
 
 func (x *SyncInventoryAck) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[40]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[37]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2901,7 +2593,7 @@ func (x *SyncInventoryAck) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SyncInventoryAck.ProtoReflect.Descriptor instead.
 func (*SyncInventoryAck) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{40}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{37}
 }
 
 // SyncInventoryResult is the response for SyncInventoryDevices or
@@ -2919,7 +2611,7 @@ type SyncInventoryResult struct {
 func (x *SyncInventoryResult) Reset() {
 	*x = SyncInventoryResult{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[41]
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[38]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2932,7 +2624,7 @@ func (x *SyncInventoryResult) String() string {
 func (*SyncInventoryResult) ProtoMessage() {}
 
 func (x *SyncInventoryResult) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[41]
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[38]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2945,7 +2637,7 @@ func (x *SyncInventoryResult) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SyncInventoryResult.ProtoReflect.Descriptor instead.
 func (*SyncInventoryResult) Descriptor() ([]byte, []int) {
-	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{41}
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *SyncInventoryResult) GetDevices() []*DeviceOrStatus {
@@ -2955,6 +2647,64 @@ func (x *SyncInventoryResult) GetDevices() []*DeviceOrStatus {
 	return nil
 }
 
+// SyncInventoryMissingDevices informs the sync client of all stored devices
+// that were not observed in upserts during the sync.
+//
+// Requires `track_missing_devices` to be set in the [SyncInventoryStart]
+// message.
+//
+// The client must follow up with a [SyncInventoryDevices] message, including
+// any devices to be deleted.
+type SyncInventoryMissingDevices struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Devices missing from the client-side sync.
+	// Guaranteed to have the following fields: id, os_type, asset_tag and
+	// profile.external_id.
+	Devices []*Device `protobuf:"bytes,1,rep,name=devices,proto3" json:"devices,omitempty"`
+}
+
+func (x *SyncInventoryMissingDevices) Reset() {
+	*x = SyncInventoryMissingDevices{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[39]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SyncInventoryMissingDevices) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SyncInventoryMissingDevices) ProtoMessage() {}
+
+func (x *SyncInventoryMissingDevices) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[39]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SyncInventoryMissingDevices.ProtoReflect.Descriptor instead.
+func (*SyncInventoryMissingDevices) Descriptor() ([]byte, []int) {
+	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP(), []int{39}
+}
+
+func (x *SyncInventoryMissingDevices) GetDevices() []*Device {
+	if x != nil {
+		return x.Devices
+	}
+	return nil
+}
+
 var File_teleport_devicetrust_v1_devicetrust_service_proto protoreflect.FileDescriptor
 
 var file_teleport_devicetrust_v1_devicetrust_service_proto_rawDesc = []byte{
@@ -2980,492 +2730,462 @@ var file_teleport_devicetrust_v1_devicetrust_service_proto_rawDesc = []byte{
 	0x74, 0x6f, 0x1a, 0x2b, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x64, 0x65, 0x76,
 	0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x2f, 0x64, 0x65, 0x76, 0x69,
 	0x63, 0x65, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
-	0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x63, 0x65,
-	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x22, 0xac, 0x01, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x37, 0x0a, 0x06, 0x64, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
-	0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x06, 0x64, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x12, 0x2e, 0x0a, 0x13, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x65, 0x6e, 0x72, 0x6f,
-	0x6c, 0x6c, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11,
-	0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x61, 0x73, 0x5f, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x63,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22,
-	0x8b, 0x01, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x21, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x70, 0x6d, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x1a, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x64, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72,
+	0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x22, 0xac, 0x01, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x37, 0x0a, 0x06, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65,
+	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75,
+	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x06, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x2e, 0x0a, 0x13, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x65,
+	0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x11, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x54,
+	0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x61,
+	0x73, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x10, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x22, 0x8b, 0x01, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x37, 0x0a, 0x06, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73,
+	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x06, 0x64, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x3b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x6d, 0x61,
+	0x73, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64,
+	0x4d, 0x61, 0x73, 0x6b, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x73, 0x6b,
+	0x22, 0x7c, 0x0a, 0x13, 0x55, 0x70, 0x73, 0x65, 0x72, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
 	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x37, 0x0a, 0x06, 0x64, 0x65, 0x76, 0x69, 0x63,
 	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
 	0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76,
 	0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x06, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x12, 0x3b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73,
-	0x6b, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x73, 0x6b, 0x22, 0x7c, 0x0a,
-	0x13, 0x55, 0x70, 0x73, 0x65, 0x72, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x37, 0x0a, 0x06, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44,
-	0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x06, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x2c, 0x0a,
-	0x12, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x61, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x63, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x41, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x32, 0x0a, 0x13, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x22,
-	0x30, 0x0a, 0x12, 0x46, 0x69, 0x6e, 0x64, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x09, 0x69, 0x64, 0x5f, 0x6f, 0x72, 0x5f, 0x74,
-	0x61, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x69, 0x64, 0x4f, 0x72, 0x54, 0x61,
-	0x67, 0x22, 0x50, 0x0a, 0x13, 0x46, 0x69, 0x6e, 0x64, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a, 0x07, 0x64, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65,
-	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74,
-	0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x64, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x73, 0x22, 0x2f, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x49, 0x64, 0x22, 0x89, 0x01, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74, 0x44, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x70,
-	0x61, 0x67, 0x65, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x08,
-	0x70, 0x61, 0x67, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x65,
-	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x61,
-	0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x37, 0x0a, 0x04, 0x76, 0x69, 0x65, 0x77, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x12, 0x2c, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x61, 0x73, 0x5f, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x63, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x41, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x32,
+	0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x5f,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x49, 0x64, 0x22, 0x30, 0x0a, 0x12, 0x46, 0x69, 0x6e, 0x64, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x09, 0x69, 0x64, 0x5f, 0x6f,
+	0x72, 0x5f, 0x74, 0x61, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x69, 0x64, 0x4f,
+	0x72, 0x54, 0x61, 0x67, 0x22, 0x50, 0x0a, 0x13, 0x46, 0x69, 0x6e, 0x64, 0x44, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a, 0x07, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74,
+	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72,
+	0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x22, 0x2f, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x44, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x22, 0x89, 0x01, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74,
+	0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b,
+	0x0a, 0x09, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x08, 0x70, 0x61, 0x67, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x70,
+	0x61, 0x67, 0x65, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x70, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x37, 0x0a, 0x04, 0x76, 0x69,
+	0x65, 0x77, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
+	0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x56, 0x69, 0x65, 0x77, 0x52, 0x04, 0x76,
+	0x69, 0x65, 0x77, 0x22, 0x78, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a, 0x07, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65,
+	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75,
+	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x6e, 0x65, 0x78, 0x74, 0x5f, 0x70, 0x61,
+	0x67, 0x65, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d,
+	0x6e, 0x65, 0x78, 0x74, 0x50, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x83, 0x01,
+	0x0a, 0x18, 0x42, 0x75, 0x6c, 0x6b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x39, 0x0a, 0x07, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65,
+	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75,
+	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f,
+	0x61, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x10, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x22, 0x5e, 0x0a, 0x19, 0x42, 0x75, 0x6c, 0x6b, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x41, 0x0a, 0x07, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x27, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x4f, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x07, 0x64, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x22, 0x66, 0x0a, 0x0e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x72, 0x53,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72,
+	0x70, 0x63, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
+	0x64, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x07, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x22, 0x8c, 0x01, 0x0a, 0x1e,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x72, 0x6f,
+	0x6c, 0x6c, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b,
+	0x0a, 0x09, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x4d, 0x0a, 0x0b, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61, 0x52, 0x0a,
+	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x44, 0x61, 0x74, 0x61, 0x22, 0xc1, 0x02, 0x0a, 0x13, 0x45,
+	0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x3f, 0x0a, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x72, 0x6f, 0x6c,
+	0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52, 0x04, 0x69,
+	0x6e, 0x69, 0x74, 0x12, 0x71, 0x0a, 0x18, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x5f, 0x63, 0x68, 0x61,
+	0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
 	0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e,
-	0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x56, 0x69, 0x65, 0x77, 0x52, 0x04, 0x76, 0x69, 0x65, 0x77,
-	0x22, 0x78, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a, 0x07, 0x64, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x4d, 0x61, 0x63, 0x4f, 0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61, 0x6c, 0x6c,
+	0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x16,
+	0x6d, 0x61, 0x63, 0x6f, 0x73, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6b, 0x0a, 0x16, 0x74, 0x70, 0x6d, 0x5f, 0x63, 0x68,
+	0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31,
+	0x2e, 0x54, 0x50, 0x4d, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65,
+	0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x14, 0x74,
+	0x70, 0x6d, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0x99,
+	0x02, 0x0a, 0x14, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x48, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
 	0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
-	0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x64, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x6e, 0x65, 0x78, 0x74, 0x5f, 0x70, 0x61, 0x67, 0x65, 0x5f,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x6e, 0x65, 0x78,
-	0x74, 0x50, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x83, 0x01, 0x0a, 0x18, 0x42,
-	0x75, 0x6c, 0x6b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x39, 0x0a, 0x07, 0x64, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x76, 0x31, 0x2e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x53,
+	0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x48, 0x00, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x12, 0x58, 0x0a, 0x0f, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x5f, 0x63, 0x68, 0x61, 0x6c, 0x6c,
+	0x65, 0x6e, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73,
+	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x4f, 0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c,
+	0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x0e, 0x6d, 0x61, 0x63,
+	0x6f, 0x73, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x52, 0x0a, 0x0d, 0x74,
+	0x70, 0x6d, 0x5f, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d,
+	0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x48,
+	0x00, 0x52, 0x0c, 0x74, 0x70, 0x6d, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x42,
+	0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0x9c, 0x02, 0x0a, 0x10, 0x45,
+	0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x12,
+	0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72,
+	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x49, 0x64, 0x12, 0x4d, 0x0a, 0x0b, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61, 0x52, 0x0a, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x44, 0x61, 0x74, 0x61, 0x12, 0x41, 0x0a, 0x05, 0x6d, 0x61, 0x63,
+	0x6f, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
 	0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
-	0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x64, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x61, 0x73, 0x5f,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10,
-	0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x22, 0x5e, 0x0a, 0x19, 0x42, 0x75, 0x6c, 0x6b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65,
-	0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a,
-	0x07, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27,
-	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x4f,
-	0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x07, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x22, 0x66, 0x0a, 0x0e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x72, 0x53, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x12, 0x2a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x12, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63, 0x2e,
-	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x0e,
-	0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x18,
-	0x0a, 0x07, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x07, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x22, 0x8c, 0x01, 0x0a, 0x1e, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x54,
-	0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x64,
-	0x65, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x4d, 0x0a, 0x0b, 0x64, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e,
+	0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x4f, 0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x50, 0x61,
+	0x79, 0x6c, 0x6f, 0x61, 0x64, 0x52, 0x05, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x12, 0x3b, 0x0a, 0x03,
+	0x74, 0x70, 0x6d, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74,
+	0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x50, 0x61, 0x79,
+	0x6c, 0x6f, 0x61, 0x64, 0x52, 0x03, 0x74, 0x70, 0x6d, 0x22, 0x4e, 0x0a, 0x13, 0x45, 0x6e, 0x72,
+	0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x12, 0x37, 0x0a, 0x06, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x52, 0x06, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x22, 0x3a, 0x0a, 0x12, 0x4d, 0x61, 0x63,
+	0x4f, 0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12,
+	0x24, 0x0a, 0x0e, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x64, 0x65,
+	0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
+	0x65, 0x79, 0x44, 0x65, 0x72, 0x22, 0x34, 0x0a, 0x14, 0x4d, 0x61, 0x63, 0x4f, 0x53, 0x45, 0x6e,
+	0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x1c, 0x0a,
+	0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x22, 0x3c, 0x0a, 0x1c, 0x4d,
+	0x61, 0x63, 0x4f, 0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65,
+	0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x73,
+	0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09,
+	0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x22, 0xb6, 0x01, 0x0a, 0x10, 0x54, 0x50,
+	0x4d, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x19,
+	0x0a, 0x07, 0x65, 0x6b, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x48,
+	0x00, 0x52, 0x06, 0x65, 0x6b, 0x43, 0x65, 0x72, 0x74, 0x12, 0x17, 0x0a, 0x06, 0x65, 0x6b, 0x5f,
+	0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x05, 0x65, 0x6b, 0x4b,
+	0x65, 0x79, 0x12, 0x68, 0x0a, 0x16, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x31, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d,
+	0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x61, 0x72, 0x61, 0x6d,
+	0x65, 0x74, 0x65, 0x72, 0x73, 0x52, 0x15, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x42, 0x04, 0x0a, 0x02,
+	0x65, 0x6b, 0x22, 0xad, 0x01, 0x0a, 0x18, 0x54, 0x50, 0x4d, 0x41, 0x74, 0x74, 0x65, 0x73, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12,
+	0x16, 0x0a, 0x06, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x06, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x63, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x44, 0x61, 0x74, 0x61, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x5f, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x11, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x74, 0x74, 0x65,
+	0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x29, 0x0a, 0x10, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x5f, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x0f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75,
+	0x72, 0x65, 0x22, 0xa5, 0x01, 0x0a, 0x12, 0x54, 0x50, 0x4d, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c,
+	0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x62, 0x0a, 0x14, 0x65, 0x6e, 0x63,
+	0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76,
+	0x31, 0x2e, 0x54, 0x50, 0x4d, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x43, 0x72,
+	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x13, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70,
+	0x74, 0x65, 0x64, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x2b, 0x0a,
+	0x11, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x6f, 0x6e,
+	0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x10, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x6f, 0x6e, 0x63, 0x65, 0x22, 0x59, 0x0a, 0x16, 0x54, 0x50,
+	0x4d, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
+	0x61, 0x6c, 0x5f, 0x62, 0x6c, 0x6f, 0x62, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x63,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x42, 0x6c, 0x6f, 0x62, 0x12, 0x16, 0x0a,
+	0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x73,
+	0x65, 0x63, 0x72, 0x65, 0x74, 0x22, 0x99, 0x01, 0x0a, 0x1a, 0x54, 0x50, 0x4d, 0x45, 0x6e, 0x72,
+	0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x6f, 0x6c, 0x75, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x73, 0x6f, 0x6c, 0x75, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x5f, 0x0a, 0x13, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x70, 0x61, 0x72,
+	0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e,
 	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74,
-	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f,
-	0x6c, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61, 0x52, 0x0a, 0x64, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x44, 0x61, 0x74, 0x61, 0x22, 0xc1, 0x02, 0x0a, 0x13, 0x45, 0x6e, 0x72, 0x6f,
-	0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x3f, 0x0a, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e,
+	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x50, 0x6c, 0x61, 0x74, 0x66,
+	0x6f, 0x72, 0x6d, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x52, 0x12, 0x70,
+	0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72,
+	0x73, 0x22, 0xd5, 0x02, 0x0a, 0x19, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x45, 0x0a, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e,
 	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74,
-	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x44, 0x65,
-	0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52, 0x04, 0x69, 0x6e, 0x69, 0x74,
-	0x12, 0x71, 0x0a, 0x18, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x5f, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65,
+	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
+	0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00,
+	0x52, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x12, 0x6d, 0x0a, 0x12, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65,
 	0x6e, 0x67, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x35, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65,
-	0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63,
-	0x4f, 0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x16, 0x6d, 0x61, 0x63,
-	0x6f, 0x73, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x6b, 0x0a, 0x16, 0x74, 0x70, 0x6d, 0x5f, 0x63, 0x68, 0x61, 0x6c, 0x6c,
-	0x65, 0x6e, 0x67, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64,
-	0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50,
-	0x4d, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x14, 0x74, 0x70, 0x6d, 0x43,
+	0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74,
+	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43,
 	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0x99, 0x02, 0x0a, 0x14,
-	0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x48, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x48, 0x00, 0x52, 0x11, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x77, 0x0a, 0x16, 0x74, 0x70, 0x6d, 0x5f, 0x63, 0x68, 0x61,
+	0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x3f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
 	0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e,
-	0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x53, 0x75, 0x63, 0x63,
-	0x65, 0x73, 0x73, 0x48, 0x00, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x58,
-	0x0a, 0x0f, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x5f, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
-	0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76,
-	0x31, 0x2e, 0x4d, 0x61, 0x63, 0x4f, 0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61,
-	0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x0e, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x43,
-	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x52, 0x0a, 0x0d, 0x74, 0x70, 0x6d, 0x5f,
+	0x54, 0x50, 0x4d, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x14, 0x74, 0x70, 0x6d, 0x43, 0x68, 0x61,
+	0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x09,
+	0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0xb7, 0x02, 0x0a, 0x1a, 0x41, 0x75,
+	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x54, 0x0a, 0x09, 0x63, 0x68, 0x61, 0x6c,
+	0x6c, 0x65, 0x6e, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x74, 0x65,
+	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75,
+	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
+	0x65, 0x48, 0x00, 0x52, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x58,
+	0x0a, 0x11, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74,
+	0x2e, 0x76, 0x31, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x73, 0x48, 0x00, 0x52, 0x10, 0x75, 0x73, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74,
+	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x12, 0x5e, 0x0a, 0x0d, 0x74, 0x70, 0x6d, 0x5f,
 	0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x37, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x41, 0x75, 0x74,
+	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43,
+	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x0c, 0x74, 0x70, 0x6d, 0x43,
+	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c,
+	0x6f, 0x61, 0x64, 0x22, 0xe4, 0x01, 0x0a, 0x16, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
+	0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x12, 0x56,
+	0x0a, 0x11, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74,
+	0x2e, 0x76, 0x31, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x73, 0x52, 0x10, 0x75, 0x73, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x49, 0x64, 0x12, 0x4d, 0x0a, 0x0b, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61, 0x52, 0x0a,
+	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x44, 0x61, 0x74, 0x61, 0x22, 0x4d, 0x0a, 0x1e, 0x54, 0x50,
+	0x4d, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x2b, 0x0a, 0x11,
+	0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x6f, 0x6e, 0x63,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x10, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x6f, 0x6e, 0x63, 0x65, 0x22, 0x89, 0x01, 0x0a, 0x26, 0x54, 0x50,
+	0x4d, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5f, 0x0a, 0x13, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x2e, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x50,
+	0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72,
+	0x73, 0x52, 0x12, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x50, 0x61, 0x72, 0x61, 0x6d,
+	0x65, 0x74, 0x65, 0x72, 0x73, 0x22, 0x3b, 0x0a, 0x1b, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c,
+	0x65, 0x6e, 0x67, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e,
+	0x67, 0x65, 0x22, 0x43, 0x0a, 0x23, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x69, 0x67,
+	0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x69,
+	0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x22, 0xdf, 0x02, 0x0a, 0x14, 0x53, 0x79, 0x6e, 0x63,
+	0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x43, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x2b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x45, 0x6e, 0x72,
-	0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x0c,
-	0x74, 0x70, 0x6d, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x42, 0x09, 0x0a, 0x07,
-	0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0x9c, 0x02, 0x0a, 0x10, 0x45, 0x6e, 0x72, 0x6f,
-	0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x12, 0x14, 0x0a, 0x05,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x49, 0x64, 0x12, 0x4d, 0x0a, 0x0b, 0x64, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x74,
+	0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e,
+	0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x05,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x3d, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e,
+	0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52,
+	0x03, 0x65, 0x6e, 0x64, 0x12, 0x5b, 0x0a, 0x11, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x5f,
+	0x74, 0x6f, 0x5f, 0x75, 0x70, 0x73, 0x65, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x2d, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e,
+	0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x48, 0x00,
+	0x52, 0x0f, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x54, 0x6f, 0x55, 0x70, 0x73, 0x65, 0x72,
+	0x74, 0x12, 0x5b, 0x0a, 0x11, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x5f, 0x74, 0x6f, 0x5f,
+	0x72, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x74,
 	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72,
-	0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c,
-	0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61, 0x52, 0x0a, 0x64, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x44, 0x61, 0x74, 0x61, 0x12, 0x41, 0x0a, 0x05, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
-	0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e,
-	0x4d, 0x61, 0x63, 0x4f, 0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x50, 0x61, 0x79, 0x6c, 0x6f,
-	0x61, 0x64, 0x52, 0x05, 0x6d, 0x61, 0x63, 0x6f, 0x73, 0x12, 0x3b, 0x0a, 0x03, 0x74, 0x70, 0x6d,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
-	0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31,
-	0x2e, 0x54, 0x50, 0x4d, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61,
-	0x64, 0x52, 0x03, 0x74, 0x70, 0x6d, 0x22, 0x4e, 0x0a, 0x13, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c,
-	0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x37, 0x0a,
-	0x06, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
+	0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e,
+	0x74, 0x6f, 0x72, 0x79, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x48, 0x00, 0x52, 0x0f, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x54, 0x6f, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x42, 0x09,
+	0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0x8a, 0x02, 0x0a, 0x15, 0x53, 0x79,
+	0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x3d, 0x0a, 0x03, 0x61, 0x63, 0x6b, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49,
+	0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x41, 0x63, 0x6b, 0x48, 0x00, 0x52, 0x03, 0x61,
+	0x63, 0x6b, 0x12, 0x46, 0x0a, 0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e,
+	0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74,
+	0x48, 0x00, 0x52, 0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x12, 0x5f, 0x0a, 0x0f, 0x6d, 0x69,
+	0x73, 0x73, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79,
+	0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x4d, 0x69, 0x73, 0x73, 0x69,
+	0x6e, 0x67, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x48, 0x00, 0x52, 0x0e, 0x6d, 0x69, 0x73,
+	0x73, 0x69, 0x6e, 0x67, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x42, 0x09, 0x0a, 0x07, 0x70,
+	0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0xac, 0x01, 0x0a, 0x12, 0x53, 0x79, 0x6e, 0x63, 0x49,
+	0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x3d, 0x0a,
+	0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e,
 	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74,
-	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x06,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x22, 0x3a, 0x0a, 0x12, 0x4d, 0x61, 0x63, 0x4f, 0x53, 0x45,
-	0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x24, 0x0a, 0x0e,
-	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x64, 0x65, 0x72, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x44,
-	0x65, 0x72, 0x22, 0x34, 0x0a, 0x14, 0x4d, 0x61, 0x63, 0x4f, 0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c,
-	0x6c, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x68,
-	0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x63,
-	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x22, 0x3c, 0x0a, 0x1c, 0x4d, 0x61, 0x63, 0x4f,
-	0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x69, 0x67, 0x6e,
-	0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x69, 0x67,
-	0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x22, 0xb6, 0x01, 0x0a, 0x10, 0x54, 0x50, 0x4d, 0x45, 0x6e,
-	0x72, 0x6f, 0x6c, 0x6c, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x19, 0x0a, 0x07, 0x65,
-	0x6b, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x06,
-	0x65, 0x6b, 0x43, 0x65, 0x72, 0x74, 0x12, 0x17, 0x0a, 0x06, 0x65, 0x6b, 0x5f, 0x6b, 0x65, 0x79,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x05, 0x65, 0x6b, 0x4b, 0x65, 0x79, 0x12,
-	0x68, 0x0a, 0x16, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x70,
-	0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x31, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x41, 0x74, 0x74,
-	0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65,
-	0x72, 0x73, 0x52, 0x15, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50,
-	0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x42, 0x04, 0x0a, 0x02, 0x65, 0x6b, 0x22,
-	0xad, 0x01, 0x0a, 0x18, 0x54, 0x50, 0x4d, 0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12, 0x16, 0x0a, 0x06,
-	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x70, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x64,
-	0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x44, 0x61, 0x74, 0x61, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f,
-	0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x11, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x29, 0x0a, 0x10, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x73,
-	0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0f,
-	0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x22,
-	0xa5, 0x01, 0x0a, 0x12, 0x54, 0x50, 0x4d, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x68, 0x61,
-	0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x62, 0x0a, 0x14, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70,
-	0x74, 0x65, 0x64, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54,
-	0x50, 0x4d, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x43, 0x72, 0x65, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x13, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64,
-	0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x74,
-	0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x6f, 0x6e, 0x63, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x10, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x4e, 0x6f, 0x6e, 0x63, 0x65, 0x22, 0x59, 0x0a, 0x16, 0x54, 0x50, 0x4d, 0x45, 0x6e,
-	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
-	0x6c, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f,
-	0x62, 0x6c, 0x6f, 0x62, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x63, 0x72, 0x65, 0x64,
-	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x42, 0x6c, 0x6f, 0x62, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65,
-	0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72,
-	0x65, 0x74, 0x22, 0x99, 0x01, 0x0a, 0x1a, 0x54, 0x50, 0x4d, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c,
-	0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x6f, 0x6c, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x08, 0x73, 0x6f, 0x6c, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x5f, 0x0a,
-	0x13, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65,
-	0x74, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73,
-	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
-	0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x52, 0x12, 0x70, 0x6c, 0x61, 0x74,
-	0x66, 0x6f, 0x72, 0x6d, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x22, 0x55,
-	0x0a, 0x06, 0x54, 0x50, 0x4d, 0x50, 0x43, 0x52, 0x12, 0x14, 0x0a, 0x05, 0x69, 0x6e, 0x64, 0x65,
-	0x78, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x16,
-	0x0a, 0x06, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06,
-	0x64, 0x69, 0x67, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74,
-	0x5f, 0x61, 0x6c, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x64, 0x69, 0x67, 0x65,
-	0x73, 0x74, 0x41, 0x6c, 0x67, 0x22, 0x3e, 0x0a, 0x08, 0x54, 0x50, 0x4d, 0x51, 0x75, 0x6f, 0x74,
-	0x65, 0x12, 0x14, 0x0a, 0x05, 0x71, 0x75, 0x6f, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x05, 0x71, 0x75, 0x6f, 0x74, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61,
-	0x74, 0x75, 0x72, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x69, 0x67, 0x6e,
-	0x61, 0x74, 0x75, 0x72, 0x65, 0x22, 0xa4, 0x01, 0x0a, 0x15, 0x54, 0x50, 0x4d, 0x50, 0x6c, 0x61,
-	0x74, 0x66, 0x6f, 0x72, 0x6d, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12,
-	0x39, 0x0a, 0x06, 0x71, 0x75, 0x6f, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x21, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x51, 0x75, 0x6f,
-	0x74, 0x65, 0x52, 0x06, 0x71, 0x75, 0x6f, 0x74, 0x65, 0x73, 0x12, 0x33, 0x0a, 0x04, 0x70, 0x63,
-	0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
-	0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x50, 0x43, 0x52, 0x52, 0x04, 0x70, 0x63, 0x72, 0x73, 0x12,
-	0x1b, 0x0a, 0x09, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x6c, 0x6f, 0x67, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x08, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x6f, 0x67, 0x22, 0xd5, 0x02, 0x0a,
-	0x19, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x45, 0x0a, 0x04, 0x69, 0x6e,
-	0x69, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x53, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x52, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x32, 0x0a, 0x15,
+	0x74, 0x72, 0x61, 0x63, 0x6b, 0x5f, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x74, 0x72, 0x61,
+	0x63, 0x6b, 0x4d, 0x69, 0x73, 0x73, 0x69, 0x6e, 0x67, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73,
+	0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x52, 0x04, 0x6d, 0x6f,
+	0x64, 0x65, 0x52, 0x11, 0x6f, 0x6e, 0x5f, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6e, 0x67, 0x5f, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x32, 0x0a, 0x10, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76,
+	0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x45, 0x6e, 0x64, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x52,
+	0x18, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x73,
+	0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x66, 0x75, 0x6c, 0x22, 0x51, 0x0a, 0x14, 0x53, 0x79, 0x6e,
+	0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x73, 0x12, 0x39, 0x0a, 0x07, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x52, 0x07, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x22, 0x12, 0x0a, 0x10,
+	0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x41, 0x63, 0x6b,
+	0x22, 0x58, 0x0a, 0x13, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72,
+	0x79, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x12, 0x41, 0x0a, 0x07, 0x64, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
 	0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
-	0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44,
-	0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52, 0x04, 0x69, 0x6e, 0x69,
-	0x74, 0x12, 0x6d, 0x0a, 0x12, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x72,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x3c, 0x2e,
-	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74,
-	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65,
-	0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x11, 0x63,
-	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x77, 0x0a, 0x16, 0x74, 0x70, 0x6d, 0x5f, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
-	0x65, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x3f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x41, 0x75,
-	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x48, 0x00, 0x52, 0x14, 0x74, 0x70, 0x6d, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79,
-	0x6c, 0x6f, 0x61, 0x64, 0x22, 0xb7, 0x02, 0x0a, 0x1a, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x54, 0x0a, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
-	0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31,
-	0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x09,
-	0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x58, 0x0a, 0x11, 0x75, 0x73, 0x65,
-	0x72, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x55,
-	0x73, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x48,
-	0x00, 0x52, 0x10, 0x75, 0x73, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
-	0x74, 0x65, 0x73, 0x12, 0x5e, 0x0a, 0x0d, 0x74, 0x70, 0x6d, 0x5f, 0x63, 0x68, 0x61, 0x6c, 0x6c,
-	0x65, 0x6e, 0x67, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x37, 0x2e, 0x74, 0x65, 0x6c,
+	0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x52, 0x07, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x22, 0x58, 0x0a, 0x1b, 0x53, 0x79,
+	0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x4d, 0x69, 0x73, 0x73, 0x69,
+	0x6e, 0x67, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x39, 0x0a, 0x07, 0x64, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c,
 	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73,
-	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65,
-	0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x0c, 0x74, 0x70, 0x6d, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65,
-	0x6e, 0x67, 0x65, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0xe4,
-	0x01, 0x0a, 0x16, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44,
-	0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x12, 0x56, 0x0a, 0x11, 0x75, 0x73, 0x65,
-	0x72, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
+	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x64, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x2a, 0x59, 0x0a, 0x0a, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x56, 0x69,
+	0x65, 0x77, 0x12, 0x1b, 0x0a, 0x17, 0x44, 0x45, 0x56, 0x49, 0x43, 0x45, 0x5f, 0x56, 0x49, 0x45,
+	0x57, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
+	0x14, 0x0a, 0x10, 0x44, 0x45, 0x56, 0x49, 0x43, 0x45, 0x5f, 0x56, 0x49, 0x45, 0x57, 0x5f, 0x4c,
+	0x49, 0x53, 0x54, 0x10, 0x01, 0x12, 0x18, 0x0a, 0x14, 0x44, 0x45, 0x56, 0x49, 0x43, 0x45, 0x5f,
+	0x56, 0x49, 0x45, 0x57, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x10, 0x02, 0x32,
+	0x99, 0x0a, 0x0a, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x54, 0x72, 0x75, 0x73, 0x74, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5d, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31,
+	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
+	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5d, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x44,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x5d, 0x0a, 0x0c, 0x55, 0x70, 0x73, 0x65, 0x72, 0x74, 0x44, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
 	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x55,
-	0x73, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x52,
-	0x10, 0x75, 0x73, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x73, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f,
-	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x61, 0x6c, 0x49, 0x64, 0x12, 0x4d, 0x0a, 0x0b, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x74, 0x65,
-	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75,
-	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c,
-	0x65, 0x63, 0x74, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61, 0x52, 0x0a, 0x64, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x44, 0x61, 0x74, 0x61, 0x22, 0x4d, 0x0a, 0x1e, 0x54, 0x50, 0x4d, 0x41, 0x75, 0x74, 0x68,
-	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x68,
-	0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x74, 0x74, 0x65, 0x73,
-	0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x6f, 0x6e, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x10, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e,
-	0x6f, 0x6e, 0x63, 0x65, 0x22, 0x89, 0x01, 0x0a, 0x26, 0x54, 0x50, 0x4d, 0x41, 0x75, 0x74, 0x68,
-	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x68,
-	0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x5f, 0x0a, 0x13, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x70, 0x61, 0x72, 0x61,
-	0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x74,
-	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72,
-	0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f,
-	0x72, 0x6d, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x52, 0x12, 0x70, 0x6c,
-	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73,
-	0x22, 0x3b, 0x0a, 0x1b, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12,
-	0x1c, 0x0a, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x22, 0x43, 0x0a,
-	0x23, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75,
-	0x72, 0x65, 0x22, 0xdf, 0x02, 0x0a, 0x14, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e,
-	0x74, 0x6f, 0x72, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x43, 0x0a, 0x05, 0x73,
-	0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73,
-	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f,
-	0x72, 0x79, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74,
-	0x12, 0x3d, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e,
-	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74,
-	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65,
-	0x6e, 0x74, 0x6f, 0x72, 0x79, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x12,
-	0x5b, 0x0a, 0x11, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x5f, 0x74, 0x6f, 0x5f, 0x75, 0x70,
-	0x73, 0x65, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73,
-	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f,
-	0x72, 0x79, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x48, 0x00, 0x52, 0x0f, 0x64, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x73, 0x54, 0x6f, 0x55, 0x70, 0x73, 0x65, 0x72, 0x74, 0x12, 0x5b, 0x0a, 0x11,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x5f, 0x74, 0x6f, 0x5f, 0x72, 0x65, 0x6d, 0x6f, 0x76,
-	0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
-	0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76,
-	0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x44,
-	0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x48, 0x00, 0x52, 0x0f, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x73, 0x54, 0x6f, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79,
-	0x6c, 0x6f, 0x61, 0x64, 0x22, 0xa9, 0x01, 0x0a, 0x15, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76,
-	0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3d,
-	0x0a, 0x03, 0x61, 0x63, 0x6b, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x74, 0x65,
-	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75,
-	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74,
-	0x6f, 0x72, 0x79, 0x41, 0x63, 0x6b, 0x48, 0x00, 0x52, 0x03, 0x61, 0x63, 0x6b, 0x12, 0x46, 0x0a,
-	0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e,
-	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74,
-	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65,
-	0x6e, 0x74, 0x6f, 0x72, 0x79, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x48, 0x00, 0x52, 0x06, 0x72,
-	0x65, 0x73, 0x75, 0x6c, 0x74, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
-	0x22, 0xf3, 0x01, 0x0a, 0x12, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f,
-	0x72, 0x79, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x3d, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
-	0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76,
-	0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x06,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3e, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53,
-	0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x4d, 0x6f, 0x64, 0x65,
-	0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x5e, 0x0a, 0x11, 0x6f, 0x6e, 0x5f, 0x6d, 0x69, 0x73,
-	0x73, 0x69, 0x6e, 0x67, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x32, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63,
-	0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0f, 0x6f, 0x6e, 0x4d, 0x69, 0x73, 0x73, 0x69, 0x6e, 0x67,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x4c, 0x0a, 0x10, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e,
-	0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x45, 0x6e, 0x64, 0x12, 0x38, 0x0a, 0x18, 0x65, 0x78,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x73, 0x75, 0x63, 0x63,
-	0x65, 0x73, 0x73, 0x66, 0x75, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x16, 0x65, 0x78,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x79, 0x6e, 0x63, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x66, 0x75, 0x6c, 0x22, 0x51, 0x0a, 0x14, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65,
-	0x6e, 0x74, 0x6f, 0x72, 0x79, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x39, 0x0a, 0x07,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
-	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74,
-	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x22, 0x12, 0x0a, 0x10, 0x53, 0x79, 0x6e, 0x63, 0x49,
-	0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x41, 0x63, 0x6b, 0x22, 0x58, 0x0a, 0x13, 0x53,
-	0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x52, 0x65, 0x73, 0x75,
-	0x6c, 0x74, 0x12, 0x41, 0x0a, 0x07, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64,
+	0x70, 0x73, 0x65, 0x72, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x54, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x44, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64,
 	0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65,
-	0x76, 0x69, 0x63, 0x65, 0x4f, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x07, 0x64, 0x65,
-	0x76, 0x69, 0x63, 0x65, 0x73, 0x2a, 0x59, 0x0a, 0x0a, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x56,
-	0x69, 0x65, 0x77, 0x12, 0x1b, 0x0a, 0x17, 0x44, 0x45, 0x56, 0x49, 0x43, 0x45, 0x5f, 0x56, 0x49,
-	0x45, 0x57, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00,
-	0x12, 0x14, 0x0a, 0x10, 0x44, 0x45, 0x56, 0x49, 0x43, 0x45, 0x5f, 0x56, 0x49, 0x45, 0x57, 0x5f,
-	0x4c, 0x49, 0x53, 0x54, 0x10, 0x01, 0x12, 0x18, 0x0a, 0x14, 0x44, 0x45, 0x56, 0x49, 0x43, 0x45,
-	0x5f, 0x56, 0x49, 0x45, 0x57, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x10, 0x02,
-	0x2a, 0x77, 0x0a, 0x11, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72,
-	0x79, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x23, 0x0a, 0x1f, 0x53, 0x59, 0x4e, 0x43, 0x5f, 0x49, 0x4e,
-	0x56, 0x45, 0x4e, 0x54, 0x4f, 0x52, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x55, 0x4e, 0x53,
-	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1f, 0x0a, 0x1b, 0x53, 0x59,
-	0x4e, 0x43, 0x5f, 0x49, 0x4e, 0x56, 0x45, 0x4e, 0x54, 0x4f, 0x52, 0x59, 0x5f, 0x4d, 0x4f, 0x44,
-	0x45, 0x5f, 0x50, 0x41, 0x52, 0x54, 0x49, 0x41, 0x4c, 0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x53,
-	0x59, 0x4e, 0x43, 0x5f, 0x49, 0x4e, 0x56, 0x45, 0x4e, 0x54, 0x4f, 0x52, 0x59, 0x5f, 0x4d, 0x4f,
-	0x44, 0x45, 0x5f, 0x46, 0x55, 0x4c, 0x4c, 0x10, 0x02, 0x2a, 0x99, 0x01, 0x0a, 0x19, 0x53, 0x79,
-	0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x44, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2c, 0x0a, 0x28, 0x53, 0x59, 0x4e, 0x43, 0x5f,
-	0x49, 0x4e, 0x56, 0x45, 0x4e, 0x54, 0x4f, 0x52, 0x59, 0x5f, 0x44, 0x45, 0x56, 0x49, 0x43, 0x45,
-	0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
-	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x25, 0x0a, 0x21, 0x53, 0x59, 0x4e, 0x43, 0x5f, 0x49, 0x4e,
-	0x56, 0x45, 0x4e, 0x54, 0x4f, 0x52, 0x59, 0x5f, 0x44, 0x45, 0x56, 0x49, 0x43, 0x45, 0x5f, 0x41,
-	0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x4e, 0x4f, 0x4f, 0x50, 0x10, 0x01, 0x12, 0x27, 0x0a, 0x23,
-	0x53, 0x59, 0x4e, 0x43, 0x5f, 0x49, 0x4e, 0x56, 0x45, 0x4e, 0x54, 0x4f, 0x52, 0x59, 0x5f, 0x44,
-	0x45, 0x56, 0x49, 0x43, 0x45, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x4c,
-	0x45, 0x54, 0x45, 0x10, 0x02, 0x32, 0x99, 0x0a, 0x0a, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x54, 0x72, 0x75, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5d, 0x0a, 0x0c,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x2c, 0x2e, 0x74,
-	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72,
-	0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73,
-	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5d, 0x0a, 0x0c, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x2c, 0x2e, 0x74, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x68, 0x0a, 0x0b, 0x46, 0x69, 0x6e,
+	0x64, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x2b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
+	0x76, 0x31, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e,
+	0x46, 0x69, 0x6e, 0x64, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x57, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x12, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x74, 0x65,
 	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75,
-	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65,
-	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74,
-	0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5d, 0x0a, 0x0c, 0x55, 0x70,
-	0x73, 0x65, 0x72, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x2c, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73,
-	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x73, 0x65, 0x72, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x68, 0x0a, 0x0b,
+	0x4c, 0x69, 0x73, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x2b, 0x2e, 0x74, 0x65,
+	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75,
+	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
 	0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
-	0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x54, 0x0a, 0x0c, 0x44, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65,
-	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74,
-	0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12,
-	0x68, 0x0a, 0x0b, 0x46, 0x69, 0x6e, 0x64, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x2b,
-	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x44, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x74, 0x65,
+	0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x7a, 0x0a, 0x11, 0x42, 0x75, 0x6c, 0x6b, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x31, 0x2e, 0x74, 0x65,
 	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75,
-	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x57, 0x0a, 0x09, 0x47, 0x65, 0x74,
-	0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
-	0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31,
-	0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x12, 0x68, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x73, 0x12, 0x2b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74,
-	0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c,
+	0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75, 0x6c, 0x6b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x32,
 	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x44, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x7a, 0x0a, 0x11,
-	0x42, 0x75, 0x6c, 0x6b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x73, 0x12, 0x31, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75, 0x6c, 0x6b,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x32, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x42,
-	0x75, 0x6c, 0x6b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x7e, 0x0a, 0x17, 0x43, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x54, 0x6f,
-	0x6b, 0x65, 0x6e, 0x12, 0x37, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64,
-	0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2a, 0x2e, 0x74,
-	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72,
-	0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x72,
-	0x6f, 0x6c, 0x6c, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x6f, 0x0a, 0x0c, 0x45, 0x6e, 0x72, 0x6f,
-	0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
-	0x76, 0x31, 0x2e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2d, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75, 0x6c, 0x6b, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x7e, 0x0a, 0x17, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x37, 0x2e,
+	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74,
+	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2a, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
 	0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31,
-	0x2e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x12, 0x81, 0x01, 0x0a, 0x12, 0x41, 0x75,
-	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x12, 0x32, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65,
-	0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x33, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41,
-	0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x12, 0x72, 0x0a,
-	0x0d, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x2d,
+	0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x12, 0x6f, 0x0a, 0x0c, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x12, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x72,
+	0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x2d, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x72, 0x6f, 0x6c,
+	0x6c, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28,
+	0x01, 0x30, 0x01, 0x12, 0x81, 0x01, 0x0a, 0x12, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
+	0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x32, 0x2e, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73,
+	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x33,
 	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
-	0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76,
-	0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e,
-	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74,
-	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65,
-	0x6e, 0x74, 0x6f, 0x72, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30,
-	0x01, 0x42, 0x5a, 0x5a, 0x58, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
-	0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65,
-	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
-	0x2f, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x3b,
-	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x76, 0x31, 0x62, 0x06, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x12, 0x72, 0x0a, 0x0d, 0x53, 0x79, 0x6e, 0x63, 0x49,
+	0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x2d, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
+	0x76, 0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76,
+	0x31, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x49, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x42, 0x5a, 0x5a, 0x58, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67,
+	0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x64, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x3b, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x74, 0x72, 0x75, 0x73, 0x74, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -3480,139 +3200,134 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescGZIP() []byte
 	return file_teleport_devicetrust_v1_devicetrust_service_proto_rawDescData
 }
 
-var file_teleport_devicetrust_v1_devicetrust_service_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
-var file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes = make([]protoimpl.MessageInfo, 42)
+var file_teleport_devicetrust_v1_devicetrust_service_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes = make([]protoimpl.MessageInfo, 40)
 var file_teleport_devicetrust_v1_devicetrust_service_proto_goTypes = []interface{}{
 	(DeviceView)(0),                                // 0: teleport.devicetrust.v1.DeviceView
-	(SyncInventoryMode)(0),                         // 1: teleport.devicetrust.v1.SyncInventoryMode
-	(SyncInventoryDeviceAction)(0),                 // 2: teleport.devicetrust.v1.SyncInventoryDeviceAction
-	(*CreateDeviceRequest)(nil),                    // 3: teleport.devicetrust.v1.CreateDeviceRequest
-	(*UpdateDeviceRequest)(nil),                    // 4: teleport.devicetrust.v1.UpdateDeviceRequest
-	(*UpsertDeviceRequest)(nil),                    // 5: teleport.devicetrust.v1.UpsertDeviceRequest
-	(*DeleteDeviceRequest)(nil),                    // 6: teleport.devicetrust.v1.DeleteDeviceRequest
-	(*FindDevicesRequest)(nil),                     // 7: teleport.devicetrust.v1.FindDevicesRequest
-	(*FindDevicesResponse)(nil),                    // 8: teleport.devicetrust.v1.FindDevicesResponse
-	(*GetDeviceRequest)(nil),                       // 9: teleport.devicetrust.v1.GetDeviceRequest
-	(*ListDevicesRequest)(nil),                     // 10: teleport.devicetrust.v1.ListDevicesRequest
-	(*ListDevicesResponse)(nil),                    // 11: teleport.devicetrust.v1.ListDevicesResponse
-	(*BulkCreateDevicesRequest)(nil),               // 12: teleport.devicetrust.v1.BulkCreateDevicesRequest
-	(*BulkCreateDevicesResponse)(nil),              // 13: teleport.devicetrust.v1.BulkCreateDevicesResponse
-	(*DeviceOrStatus)(nil),                         // 14: teleport.devicetrust.v1.DeviceOrStatus
-	(*CreateDeviceEnrollTokenRequest)(nil),         // 15: teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest
-	(*EnrollDeviceRequest)(nil),                    // 16: teleport.devicetrust.v1.EnrollDeviceRequest
-	(*EnrollDeviceResponse)(nil),                   // 17: teleport.devicetrust.v1.EnrollDeviceResponse
-	(*EnrollDeviceInit)(nil),                       // 18: teleport.devicetrust.v1.EnrollDeviceInit
-	(*EnrollDeviceSuccess)(nil),                    // 19: teleport.devicetrust.v1.EnrollDeviceSuccess
-	(*MacOSEnrollPayload)(nil),                     // 20: teleport.devicetrust.v1.MacOSEnrollPayload
-	(*MacOSEnrollChallenge)(nil),                   // 21: teleport.devicetrust.v1.MacOSEnrollChallenge
-	(*MacOSEnrollChallengeResponse)(nil),           // 22: teleport.devicetrust.v1.MacOSEnrollChallengeResponse
-	(*TPMEnrollPayload)(nil),                       // 23: teleport.devicetrust.v1.TPMEnrollPayload
-	(*TPMAttestationParameters)(nil),               // 24: teleport.devicetrust.v1.TPMAttestationParameters
-	(*TPMEnrollChallenge)(nil),                     // 25: teleport.devicetrust.v1.TPMEnrollChallenge
-	(*TPMEncryptedCredential)(nil),                 // 26: teleport.devicetrust.v1.TPMEncryptedCredential
-	(*TPMEnrollChallengeResponse)(nil),             // 27: teleport.devicetrust.v1.TPMEnrollChallengeResponse
-	(*TPMPCR)(nil),                                 // 28: teleport.devicetrust.v1.TPMPCR
-	(*TPMQuote)(nil),                               // 29: teleport.devicetrust.v1.TPMQuote
-	(*TPMPlatformParameters)(nil),                  // 30: teleport.devicetrust.v1.TPMPlatformParameters
-	(*AuthenticateDeviceRequest)(nil),              // 31: teleport.devicetrust.v1.AuthenticateDeviceRequest
-	(*AuthenticateDeviceResponse)(nil),             // 32: teleport.devicetrust.v1.AuthenticateDeviceResponse
-	(*AuthenticateDeviceInit)(nil),                 // 33: teleport.devicetrust.v1.AuthenticateDeviceInit
-	(*TPMAuthenticateDeviceChallenge)(nil),         // 34: teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge
-	(*TPMAuthenticateDeviceChallengeResponse)(nil), // 35: teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse
-	(*AuthenticateDeviceChallenge)(nil),            // 36: teleport.devicetrust.v1.AuthenticateDeviceChallenge
-	(*AuthenticateDeviceChallengeResponse)(nil),    // 37: teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse
-	(*SyncInventoryRequest)(nil),                   // 38: teleport.devicetrust.v1.SyncInventoryRequest
-	(*SyncInventoryResponse)(nil),                  // 39: teleport.devicetrust.v1.SyncInventoryResponse
-	(*SyncInventoryStart)(nil),                     // 40: teleport.devicetrust.v1.SyncInventoryStart
-	(*SyncInventoryEnd)(nil),                       // 41: teleport.devicetrust.v1.SyncInventoryEnd
-	(*SyncInventoryDevices)(nil),                   // 42: teleport.devicetrust.v1.SyncInventoryDevices
-	(*SyncInventoryAck)(nil),                       // 43: teleport.devicetrust.v1.SyncInventoryAck
-	(*SyncInventoryResult)(nil),                    // 44: teleport.devicetrust.v1.SyncInventoryResult
-	(*Device)(nil),                                 // 45: teleport.devicetrust.v1.Device
-	(*fieldmaskpb.FieldMask)(nil),                  // 46: google.protobuf.FieldMask
-	(*status.Status)(nil),                          // 47: google.rpc.Status
-	(*DeviceCollectedData)(nil),                    // 48: teleport.devicetrust.v1.DeviceCollectedData
-	(*UserCertificates)(nil),                       // 49: teleport.devicetrust.v1.UserCertificates
-	(*DeviceSource)(nil),                           // 50: teleport.devicetrust.v1.DeviceSource
-	(*emptypb.Empty)(nil),                          // 51: google.protobuf.Empty
-	(*DeviceEnrollToken)(nil),                      // 52: teleport.devicetrust.v1.DeviceEnrollToken
+	(*CreateDeviceRequest)(nil),                    // 1: teleport.devicetrust.v1.CreateDeviceRequest
+	(*UpdateDeviceRequest)(nil),                    // 2: teleport.devicetrust.v1.UpdateDeviceRequest
+	(*UpsertDeviceRequest)(nil),                    // 3: teleport.devicetrust.v1.UpsertDeviceRequest
+	(*DeleteDeviceRequest)(nil),                    // 4: teleport.devicetrust.v1.DeleteDeviceRequest
+	(*FindDevicesRequest)(nil),                     // 5: teleport.devicetrust.v1.FindDevicesRequest
+	(*FindDevicesResponse)(nil),                    // 6: teleport.devicetrust.v1.FindDevicesResponse
+	(*GetDeviceRequest)(nil),                       // 7: teleport.devicetrust.v1.GetDeviceRequest
+	(*ListDevicesRequest)(nil),                     // 8: teleport.devicetrust.v1.ListDevicesRequest
+	(*ListDevicesResponse)(nil),                    // 9: teleport.devicetrust.v1.ListDevicesResponse
+	(*BulkCreateDevicesRequest)(nil),               // 10: teleport.devicetrust.v1.BulkCreateDevicesRequest
+	(*BulkCreateDevicesResponse)(nil),              // 11: teleport.devicetrust.v1.BulkCreateDevicesResponse
+	(*DeviceOrStatus)(nil),                         // 12: teleport.devicetrust.v1.DeviceOrStatus
+	(*CreateDeviceEnrollTokenRequest)(nil),         // 13: teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest
+	(*EnrollDeviceRequest)(nil),                    // 14: teleport.devicetrust.v1.EnrollDeviceRequest
+	(*EnrollDeviceResponse)(nil),                   // 15: teleport.devicetrust.v1.EnrollDeviceResponse
+	(*EnrollDeviceInit)(nil),                       // 16: teleport.devicetrust.v1.EnrollDeviceInit
+	(*EnrollDeviceSuccess)(nil),                    // 17: teleport.devicetrust.v1.EnrollDeviceSuccess
+	(*MacOSEnrollPayload)(nil),                     // 18: teleport.devicetrust.v1.MacOSEnrollPayload
+	(*MacOSEnrollChallenge)(nil),                   // 19: teleport.devicetrust.v1.MacOSEnrollChallenge
+	(*MacOSEnrollChallengeResponse)(nil),           // 20: teleport.devicetrust.v1.MacOSEnrollChallengeResponse
+	(*TPMEnrollPayload)(nil),                       // 21: teleport.devicetrust.v1.TPMEnrollPayload
+	(*TPMAttestationParameters)(nil),               // 22: teleport.devicetrust.v1.TPMAttestationParameters
+	(*TPMEnrollChallenge)(nil),                     // 23: teleport.devicetrust.v1.TPMEnrollChallenge
+	(*TPMEncryptedCredential)(nil),                 // 24: teleport.devicetrust.v1.TPMEncryptedCredential
+	(*TPMEnrollChallengeResponse)(nil),             // 25: teleport.devicetrust.v1.TPMEnrollChallengeResponse
+	(*AuthenticateDeviceRequest)(nil),              // 26: teleport.devicetrust.v1.AuthenticateDeviceRequest
+	(*AuthenticateDeviceResponse)(nil),             // 27: teleport.devicetrust.v1.AuthenticateDeviceResponse
+	(*AuthenticateDeviceInit)(nil),                 // 28: teleport.devicetrust.v1.AuthenticateDeviceInit
+	(*TPMAuthenticateDeviceChallenge)(nil),         // 29: teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge
+	(*TPMAuthenticateDeviceChallengeResponse)(nil), // 30: teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse
+	(*AuthenticateDeviceChallenge)(nil),            // 31: teleport.devicetrust.v1.AuthenticateDeviceChallenge
+	(*AuthenticateDeviceChallengeResponse)(nil),    // 32: teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse
+	(*SyncInventoryRequest)(nil),                   // 33: teleport.devicetrust.v1.SyncInventoryRequest
+	(*SyncInventoryResponse)(nil),                  // 34: teleport.devicetrust.v1.SyncInventoryResponse
+	(*SyncInventoryStart)(nil),                     // 35: teleport.devicetrust.v1.SyncInventoryStart
+	(*SyncInventoryEnd)(nil),                       // 36: teleport.devicetrust.v1.SyncInventoryEnd
+	(*SyncInventoryDevices)(nil),                   // 37: teleport.devicetrust.v1.SyncInventoryDevices
+	(*SyncInventoryAck)(nil),                       // 38: teleport.devicetrust.v1.SyncInventoryAck
+	(*SyncInventoryResult)(nil),                    // 39: teleport.devicetrust.v1.SyncInventoryResult
+	(*SyncInventoryMissingDevices)(nil),            // 40: teleport.devicetrust.v1.SyncInventoryMissingDevices
+	(*Device)(nil),                                 // 41: teleport.devicetrust.v1.Device
+	(*fieldmaskpb.FieldMask)(nil),                  // 42: google.protobuf.FieldMask
+	(*status.Status)(nil),                          // 43: google.rpc.Status
+	(*DeviceCollectedData)(nil),                    // 44: teleport.devicetrust.v1.DeviceCollectedData
+	(*TPMPlatformParameters)(nil),                  // 45: teleport.devicetrust.v1.TPMPlatformParameters
+	(*UserCertificates)(nil),                       // 46: teleport.devicetrust.v1.UserCertificates
+	(*DeviceSource)(nil),                           // 47: teleport.devicetrust.v1.DeviceSource
+	(*emptypb.Empty)(nil),                          // 48: google.protobuf.Empty
+	(*DeviceEnrollToken)(nil),                      // 49: teleport.devicetrust.v1.DeviceEnrollToken
 }
 var file_teleport_devicetrust_v1_devicetrust_service_proto_depIdxs = []int32{
-	45, // 0: teleport.devicetrust.v1.CreateDeviceRequest.device:type_name -> teleport.devicetrust.v1.Device
-	45, // 1: teleport.devicetrust.v1.UpdateDeviceRequest.device:type_name -> teleport.devicetrust.v1.Device
-	46, // 2: teleport.devicetrust.v1.UpdateDeviceRequest.update_mask:type_name -> google.protobuf.FieldMask
-	45, // 3: teleport.devicetrust.v1.UpsertDeviceRequest.device:type_name -> teleport.devicetrust.v1.Device
-	45, // 4: teleport.devicetrust.v1.FindDevicesResponse.devices:type_name -> teleport.devicetrust.v1.Device
+	41, // 0: teleport.devicetrust.v1.CreateDeviceRequest.device:type_name -> teleport.devicetrust.v1.Device
+	41, // 1: teleport.devicetrust.v1.UpdateDeviceRequest.device:type_name -> teleport.devicetrust.v1.Device
+	42, // 2: teleport.devicetrust.v1.UpdateDeviceRequest.update_mask:type_name -> google.protobuf.FieldMask
+	41, // 3: teleport.devicetrust.v1.UpsertDeviceRequest.device:type_name -> teleport.devicetrust.v1.Device
+	41, // 4: teleport.devicetrust.v1.FindDevicesResponse.devices:type_name -> teleport.devicetrust.v1.Device
 	0,  // 5: teleport.devicetrust.v1.ListDevicesRequest.view:type_name -> teleport.devicetrust.v1.DeviceView
-	45, // 6: teleport.devicetrust.v1.ListDevicesResponse.devices:type_name -> teleport.devicetrust.v1.Device
-	45, // 7: teleport.devicetrust.v1.BulkCreateDevicesRequest.devices:type_name -> teleport.devicetrust.v1.Device
-	14, // 8: teleport.devicetrust.v1.BulkCreateDevicesResponse.devices:type_name -> teleport.devicetrust.v1.DeviceOrStatus
-	47, // 9: teleport.devicetrust.v1.DeviceOrStatus.status:type_name -> google.rpc.Status
-	48, // 10: teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest.device_data:type_name -> teleport.devicetrust.v1.DeviceCollectedData
-	18, // 11: teleport.devicetrust.v1.EnrollDeviceRequest.init:type_name -> teleport.devicetrust.v1.EnrollDeviceInit
-	22, // 12: teleport.devicetrust.v1.EnrollDeviceRequest.macos_challenge_response:type_name -> teleport.devicetrust.v1.MacOSEnrollChallengeResponse
-	27, // 13: teleport.devicetrust.v1.EnrollDeviceRequest.tpm_challenge_response:type_name -> teleport.devicetrust.v1.TPMEnrollChallengeResponse
-	19, // 14: teleport.devicetrust.v1.EnrollDeviceResponse.success:type_name -> teleport.devicetrust.v1.EnrollDeviceSuccess
-	21, // 15: teleport.devicetrust.v1.EnrollDeviceResponse.macos_challenge:type_name -> teleport.devicetrust.v1.MacOSEnrollChallenge
-	25, // 16: teleport.devicetrust.v1.EnrollDeviceResponse.tpm_challenge:type_name -> teleport.devicetrust.v1.TPMEnrollChallenge
-	48, // 17: teleport.devicetrust.v1.EnrollDeviceInit.device_data:type_name -> teleport.devicetrust.v1.DeviceCollectedData
-	20, // 18: teleport.devicetrust.v1.EnrollDeviceInit.macos:type_name -> teleport.devicetrust.v1.MacOSEnrollPayload
-	23, // 19: teleport.devicetrust.v1.EnrollDeviceInit.tpm:type_name -> teleport.devicetrust.v1.TPMEnrollPayload
-	45, // 20: teleport.devicetrust.v1.EnrollDeviceSuccess.device:type_name -> teleport.devicetrust.v1.Device
-	24, // 21: teleport.devicetrust.v1.TPMEnrollPayload.attestation_parameters:type_name -> teleport.devicetrust.v1.TPMAttestationParameters
-	26, // 22: teleport.devicetrust.v1.TPMEnrollChallenge.encrypted_credential:type_name -> teleport.devicetrust.v1.TPMEncryptedCredential
-	30, // 23: teleport.devicetrust.v1.TPMEnrollChallengeResponse.platform_parameters:type_name -> teleport.devicetrust.v1.TPMPlatformParameters
-	29, // 24: teleport.devicetrust.v1.TPMPlatformParameters.quotes:type_name -> teleport.devicetrust.v1.TPMQuote
-	28, // 25: teleport.devicetrust.v1.TPMPlatformParameters.pcrs:type_name -> teleport.devicetrust.v1.TPMPCR
-	33, // 26: teleport.devicetrust.v1.AuthenticateDeviceRequest.init:type_name -> teleport.devicetrust.v1.AuthenticateDeviceInit
-	37, // 27: teleport.devicetrust.v1.AuthenticateDeviceRequest.challenge_response:type_name -> teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse
-	35, // 28: teleport.devicetrust.v1.AuthenticateDeviceRequest.tpm_challenge_response:type_name -> teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse
-	36, // 29: teleport.devicetrust.v1.AuthenticateDeviceResponse.challenge:type_name -> teleport.devicetrust.v1.AuthenticateDeviceChallenge
-	49, // 30: teleport.devicetrust.v1.AuthenticateDeviceResponse.user_certificates:type_name -> teleport.devicetrust.v1.UserCertificates
-	34, // 31: teleport.devicetrust.v1.AuthenticateDeviceResponse.tpm_challenge:type_name -> teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge
-	49, // 32: teleport.devicetrust.v1.AuthenticateDeviceInit.user_certificates:type_name -> teleport.devicetrust.v1.UserCertificates
-	48, // 33: teleport.devicetrust.v1.AuthenticateDeviceInit.device_data:type_name -> teleport.devicetrust.v1.DeviceCollectedData
-	30, // 34: teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse.platform_parameters:type_name -> teleport.devicetrust.v1.TPMPlatformParameters
-	40, // 35: teleport.devicetrust.v1.SyncInventoryRequest.start:type_name -> teleport.devicetrust.v1.SyncInventoryStart
-	41, // 36: teleport.devicetrust.v1.SyncInventoryRequest.end:type_name -> teleport.devicetrust.v1.SyncInventoryEnd
-	42, // 37: teleport.devicetrust.v1.SyncInventoryRequest.devices_to_upsert:type_name -> teleport.devicetrust.v1.SyncInventoryDevices
-	42, // 38: teleport.devicetrust.v1.SyncInventoryRequest.devices_to_remove:type_name -> teleport.devicetrust.v1.SyncInventoryDevices
-	43, // 39: teleport.devicetrust.v1.SyncInventoryResponse.ack:type_name -> teleport.devicetrust.v1.SyncInventoryAck
-	44, // 40: teleport.devicetrust.v1.SyncInventoryResponse.result:type_name -> teleport.devicetrust.v1.SyncInventoryResult
-	50, // 41: teleport.devicetrust.v1.SyncInventoryStart.source:type_name -> teleport.devicetrust.v1.DeviceSource
-	1,  // 42: teleport.devicetrust.v1.SyncInventoryStart.mode:type_name -> teleport.devicetrust.v1.SyncInventoryMode
-	2,  // 43: teleport.devicetrust.v1.SyncInventoryStart.on_missing_action:type_name -> teleport.devicetrust.v1.SyncInventoryDeviceAction
-	45, // 44: teleport.devicetrust.v1.SyncInventoryDevices.devices:type_name -> teleport.devicetrust.v1.Device
-	14, // 45: teleport.devicetrust.v1.SyncInventoryResult.devices:type_name -> teleport.devicetrust.v1.DeviceOrStatus
-	3,  // 46: teleport.devicetrust.v1.DeviceTrustService.CreateDevice:input_type -> teleport.devicetrust.v1.CreateDeviceRequest
-	4,  // 47: teleport.devicetrust.v1.DeviceTrustService.UpdateDevice:input_type -> teleport.devicetrust.v1.UpdateDeviceRequest
-	5,  // 48: teleport.devicetrust.v1.DeviceTrustService.UpsertDevice:input_type -> teleport.devicetrust.v1.UpsertDeviceRequest
-	6,  // 49: teleport.devicetrust.v1.DeviceTrustService.DeleteDevice:input_type -> teleport.devicetrust.v1.DeleteDeviceRequest
-	7,  // 50: teleport.devicetrust.v1.DeviceTrustService.FindDevices:input_type -> teleport.devicetrust.v1.FindDevicesRequest
-	9,  // 51: teleport.devicetrust.v1.DeviceTrustService.GetDevice:input_type -> teleport.devicetrust.v1.GetDeviceRequest
-	10, // 52: teleport.devicetrust.v1.DeviceTrustService.ListDevices:input_type -> teleport.devicetrust.v1.ListDevicesRequest
-	12, // 53: teleport.devicetrust.v1.DeviceTrustService.BulkCreateDevices:input_type -> teleport.devicetrust.v1.BulkCreateDevicesRequest
-	15, // 54: teleport.devicetrust.v1.DeviceTrustService.CreateDeviceEnrollToken:input_type -> teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest
-	16, // 55: teleport.devicetrust.v1.DeviceTrustService.EnrollDevice:input_type -> teleport.devicetrust.v1.EnrollDeviceRequest
-	31, // 56: teleport.devicetrust.v1.DeviceTrustService.AuthenticateDevice:input_type -> teleport.devicetrust.v1.AuthenticateDeviceRequest
-	38, // 57: teleport.devicetrust.v1.DeviceTrustService.SyncInventory:input_type -> teleport.devicetrust.v1.SyncInventoryRequest
-	45, // 58: teleport.devicetrust.v1.DeviceTrustService.CreateDevice:output_type -> teleport.devicetrust.v1.Device
-	45, // 59: teleport.devicetrust.v1.DeviceTrustService.UpdateDevice:output_type -> teleport.devicetrust.v1.Device
-	45, // 60: teleport.devicetrust.v1.DeviceTrustService.UpsertDevice:output_type -> teleport.devicetrust.v1.Device
-	51, // 61: teleport.devicetrust.v1.DeviceTrustService.DeleteDevice:output_type -> google.protobuf.Empty
-	8,  // 62: teleport.devicetrust.v1.DeviceTrustService.FindDevices:output_type -> teleport.devicetrust.v1.FindDevicesResponse
-	45, // 63: teleport.devicetrust.v1.DeviceTrustService.GetDevice:output_type -> teleport.devicetrust.v1.Device
-	11, // 64: teleport.devicetrust.v1.DeviceTrustService.ListDevices:output_type -> teleport.devicetrust.v1.ListDevicesResponse
-	13, // 65: teleport.devicetrust.v1.DeviceTrustService.BulkCreateDevices:output_type -> teleport.devicetrust.v1.BulkCreateDevicesResponse
-	52, // 66: teleport.devicetrust.v1.DeviceTrustService.CreateDeviceEnrollToken:output_type -> teleport.devicetrust.v1.DeviceEnrollToken
-	17, // 67: teleport.devicetrust.v1.DeviceTrustService.EnrollDevice:output_type -> teleport.devicetrust.v1.EnrollDeviceResponse
-	32, // 68: teleport.devicetrust.v1.DeviceTrustService.AuthenticateDevice:output_type -> teleport.devicetrust.v1.AuthenticateDeviceResponse
-	39, // 69: teleport.devicetrust.v1.DeviceTrustService.SyncInventory:output_type -> teleport.devicetrust.v1.SyncInventoryResponse
-	58, // [58:70] is the sub-list for method output_type
-	46, // [46:58] is the sub-list for method input_type
-	46, // [46:46] is the sub-list for extension type_name
-	46, // [46:46] is the sub-list for extension extendee
-	0,  // [0:46] is the sub-list for field type_name
+	41, // 6: teleport.devicetrust.v1.ListDevicesResponse.devices:type_name -> teleport.devicetrust.v1.Device
+	41, // 7: teleport.devicetrust.v1.BulkCreateDevicesRequest.devices:type_name -> teleport.devicetrust.v1.Device
+	12, // 8: teleport.devicetrust.v1.BulkCreateDevicesResponse.devices:type_name -> teleport.devicetrust.v1.DeviceOrStatus
+	43, // 9: teleport.devicetrust.v1.DeviceOrStatus.status:type_name -> google.rpc.Status
+	44, // 10: teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest.device_data:type_name -> teleport.devicetrust.v1.DeviceCollectedData
+	16, // 11: teleport.devicetrust.v1.EnrollDeviceRequest.init:type_name -> teleport.devicetrust.v1.EnrollDeviceInit
+	20, // 12: teleport.devicetrust.v1.EnrollDeviceRequest.macos_challenge_response:type_name -> teleport.devicetrust.v1.MacOSEnrollChallengeResponse
+	25, // 13: teleport.devicetrust.v1.EnrollDeviceRequest.tpm_challenge_response:type_name -> teleport.devicetrust.v1.TPMEnrollChallengeResponse
+	17, // 14: teleport.devicetrust.v1.EnrollDeviceResponse.success:type_name -> teleport.devicetrust.v1.EnrollDeviceSuccess
+	19, // 15: teleport.devicetrust.v1.EnrollDeviceResponse.macos_challenge:type_name -> teleport.devicetrust.v1.MacOSEnrollChallenge
+	23, // 16: teleport.devicetrust.v1.EnrollDeviceResponse.tpm_challenge:type_name -> teleport.devicetrust.v1.TPMEnrollChallenge
+	44, // 17: teleport.devicetrust.v1.EnrollDeviceInit.device_data:type_name -> teleport.devicetrust.v1.DeviceCollectedData
+	18, // 18: teleport.devicetrust.v1.EnrollDeviceInit.macos:type_name -> teleport.devicetrust.v1.MacOSEnrollPayload
+	21, // 19: teleport.devicetrust.v1.EnrollDeviceInit.tpm:type_name -> teleport.devicetrust.v1.TPMEnrollPayload
+	41, // 20: teleport.devicetrust.v1.EnrollDeviceSuccess.device:type_name -> teleport.devicetrust.v1.Device
+	22, // 21: teleport.devicetrust.v1.TPMEnrollPayload.attestation_parameters:type_name -> teleport.devicetrust.v1.TPMAttestationParameters
+	24, // 22: teleport.devicetrust.v1.TPMEnrollChallenge.encrypted_credential:type_name -> teleport.devicetrust.v1.TPMEncryptedCredential
+	45, // 23: teleport.devicetrust.v1.TPMEnrollChallengeResponse.platform_parameters:type_name -> teleport.devicetrust.v1.TPMPlatformParameters
+	28, // 24: teleport.devicetrust.v1.AuthenticateDeviceRequest.init:type_name -> teleport.devicetrust.v1.AuthenticateDeviceInit
+	32, // 25: teleport.devicetrust.v1.AuthenticateDeviceRequest.challenge_response:type_name -> teleport.devicetrust.v1.AuthenticateDeviceChallengeResponse
+	30, // 26: teleport.devicetrust.v1.AuthenticateDeviceRequest.tpm_challenge_response:type_name -> teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse
+	31, // 27: teleport.devicetrust.v1.AuthenticateDeviceResponse.challenge:type_name -> teleport.devicetrust.v1.AuthenticateDeviceChallenge
+	46, // 28: teleport.devicetrust.v1.AuthenticateDeviceResponse.user_certificates:type_name -> teleport.devicetrust.v1.UserCertificates
+	29, // 29: teleport.devicetrust.v1.AuthenticateDeviceResponse.tpm_challenge:type_name -> teleport.devicetrust.v1.TPMAuthenticateDeviceChallenge
+	46, // 30: teleport.devicetrust.v1.AuthenticateDeviceInit.user_certificates:type_name -> teleport.devicetrust.v1.UserCertificates
+	44, // 31: teleport.devicetrust.v1.AuthenticateDeviceInit.device_data:type_name -> teleport.devicetrust.v1.DeviceCollectedData
+	45, // 32: teleport.devicetrust.v1.TPMAuthenticateDeviceChallengeResponse.platform_parameters:type_name -> teleport.devicetrust.v1.TPMPlatformParameters
+	35, // 33: teleport.devicetrust.v1.SyncInventoryRequest.start:type_name -> teleport.devicetrust.v1.SyncInventoryStart
+	36, // 34: teleport.devicetrust.v1.SyncInventoryRequest.end:type_name -> teleport.devicetrust.v1.SyncInventoryEnd
+	37, // 35: teleport.devicetrust.v1.SyncInventoryRequest.devices_to_upsert:type_name -> teleport.devicetrust.v1.SyncInventoryDevices
+	37, // 36: teleport.devicetrust.v1.SyncInventoryRequest.devices_to_remove:type_name -> teleport.devicetrust.v1.SyncInventoryDevices
+	38, // 37: teleport.devicetrust.v1.SyncInventoryResponse.ack:type_name -> teleport.devicetrust.v1.SyncInventoryAck
+	39, // 38: teleport.devicetrust.v1.SyncInventoryResponse.result:type_name -> teleport.devicetrust.v1.SyncInventoryResult
+	40, // 39: teleport.devicetrust.v1.SyncInventoryResponse.missing_devices:type_name -> teleport.devicetrust.v1.SyncInventoryMissingDevices
+	47, // 40: teleport.devicetrust.v1.SyncInventoryStart.source:type_name -> teleport.devicetrust.v1.DeviceSource
+	41, // 41: teleport.devicetrust.v1.SyncInventoryDevices.devices:type_name -> teleport.devicetrust.v1.Device
+	12, // 42: teleport.devicetrust.v1.SyncInventoryResult.devices:type_name -> teleport.devicetrust.v1.DeviceOrStatus
+	41, // 43: teleport.devicetrust.v1.SyncInventoryMissingDevices.devices:type_name -> teleport.devicetrust.v1.Device
+	1,  // 44: teleport.devicetrust.v1.DeviceTrustService.CreateDevice:input_type -> teleport.devicetrust.v1.CreateDeviceRequest
+	2,  // 45: teleport.devicetrust.v1.DeviceTrustService.UpdateDevice:input_type -> teleport.devicetrust.v1.UpdateDeviceRequest
+	3,  // 46: teleport.devicetrust.v1.DeviceTrustService.UpsertDevice:input_type -> teleport.devicetrust.v1.UpsertDeviceRequest
+	4,  // 47: teleport.devicetrust.v1.DeviceTrustService.DeleteDevice:input_type -> teleport.devicetrust.v1.DeleteDeviceRequest
+	5,  // 48: teleport.devicetrust.v1.DeviceTrustService.FindDevices:input_type -> teleport.devicetrust.v1.FindDevicesRequest
+	7,  // 49: teleport.devicetrust.v1.DeviceTrustService.GetDevice:input_type -> teleport.devicetrust.v1.GetDeviceRequest
+	8,  // 50: teleport.devicetrust.v1.DeviceTrustService.ListDevices:input_type -> teleport.devicetrust.v1.ListDevicesRequest
+	10, // 51: teleport.devicetrust.v1.DeviceTrustService.BulkCreateDevices:input_type -> teleport.devicetrust.v1.BulkCreateDevicesRequest
+	13, // 52: teleport.devicetrust.v1.DeviceTrustService.CreateDeviceEnrollToken:input_type -> teleport.devicetrust.v1.CreateDeviceEnrollTokenRequest
+	14, // 53: teleport.devicetrust.v1.DeviceTrustService.EnrollDevice:input_type -> teleport.devicetrust.v1.EnrollDeviceRequest
+	26, // 54: teleport.devicetrust.v1.DeviceTrustService.AuthenticateDevice:input_type -> teleport.devicetrust.v1.AuthenticateDeviceRequest
+	33, // 55: teleport.devicetrust.v1.DeviceTrustService.SyncInventory:input_type -> teleport.devicetrust.v1.SyncInventoryRequest
+	41, // 56: teleport.devicetrust.v1.DeviceTrustService.CreateDevice:output_type -> teleport.devicetrust.v1.Device
+	41, // 57: teleport.devicetrust.v1.DeviceTrustService.UpdateDevice:output_type -> teleport.devicetrust.v1.Device
+	41, // 58: teleport.devicetrust.v1.DeviceTrustService.UpsertDevice:output_type -> teleport.devicetrust.v1.Device
+	48, // 59: teleport.devicetrust.v1.DeviceTrustService.DeleteDevice:output_type -> google.protobuf.Empty
+	6,  // 60: teleport.devicetrust.v1.DeviceTrustService.FindDevices:output_type -> teleport.devicetrust.v1.FindDevicesResponse
+	41, // 61: teleport.devicetrust.v1.DeviceTrustService.GetDevice:output_type -> teleport.devicetrust.v1.Device
+	9,  // 62: teleport.devicetrust.v1.DeviceTrustService.ListDevices:output_type -> teleport.devicetrust.v1.ListDevicesResponse
+	11, // 63: teleport.devicetrust.v1.DeviceTrustService.BulkCreateDevices:output_type -> teleport.devicetrust.v1.BulkCreateDevicesResponse
+	49, // 64: teleport.devicetrust.v1.DeviceTrustService.CreateDeviceEnrollToken:output_type -> teleport.devicetrust.v1.DeviceEnrollToken
+	15, // 65: teleport.devicetrust.v1.DeviceTrustService.EnrollDevice:output_type -> teleport.devicetrust.v1.EnrollDeviceResponse
+	27, // 66: teleport.devicetrust.v1.DeviceTrustService.AuthenticateDevice:output_type -> teleport.devicetrust.v1.AuthenticateDeviceResponse
+	34, // 67: teleport.devicetrust.v1.DeviceTrustService.SyncInventory:output_type -> teleport.devicetrust.v1.SyncInventoryResponse
+	56, // [56:68] is the sub-list for method output_type
+	44, // [44:56] is the sub-list for method input_type
+	44, // [44:44] is the sub-list for extension type_name
+	44, // [44:44] is the sub-list for extension extendee
+	0,  // [0:44] is the sub-list for field type_name
 }
 
 func init() { file_teleport_devicetrust_v1_devicetrust_service_proto_init() }
@@ -3624,6 +3339,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 	file_teleport_devicetrust_v1_device_collected_data_proto_init()
 	file_teleport_devicetrust_v1_device_enroll_token_proto_init()
 	file_teleport_devicetrust_v1_device_source_proto_init()
+	file_teleport_devicetrust_v1_tpm_proto_init()
 	file_teleport_devicetrust_v1_user_certificates_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
@@ -3927,7 +3643,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TPMPCR); i {
+			switch v := v.(*AuthenticateDeviceRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3939,7 +3655,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TPMQuote); i {
+			switch v := v.(*AuthenticateDeviceResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3951,7 +3667,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TPMPlatformParameters); i {
+			switch v := v.(*AuthenticateDeviceInit); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3963,7 +3679,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthenticateDeviceRequest); i {
+			switch v := v.(*TPMAuthenticateDeviceChallenge); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3975,7 +3691,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthenticateDeviceResponse); i {
+			switch v := v.(*TPMAuthenticateDeviceChallengeResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3987,7 +3703,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthenticateDeviceInit); i {
+			switch v := v.(*AuthenticateDeviceChallenge); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3999,7 +3715,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TPMAuthenticateDeviceChallenge); i {
+			switch v := v.(*AuthenticateDeviceChallengeResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4011,7 +3727,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TPMAuthenticateDeviceChallengeResponse); i {
+			switch v := v.(*SyncInventoryRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4023,7 +3739,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthenticateDeviceChallenge); i {
+			switch v := v.(*SyncInventoryResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4035,7 +3751,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthenticateDeviceChallengeResponse); i {
+			switch v := v.(*SyncInventoryStart); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4047,7 +3763,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SyncInventoryRequest); i {
+			switch v := v.(*SyncInventoryEnd); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4059,7 +3775,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SyncInventoryResponse); i {
+			switch v := v.(*SyncInventoryDevices); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4071,7 +3787,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SyncInventoryStart); i {
+			switch v := v.(*SyncInventoryAck); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4083,7 +3799,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SyncInventoryEnd); i {
+			switch v := v.(*SyncInventoryResult); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4095,31 +3811,7 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 			}
 		}
 		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[39].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SyncInventoryDevices); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[40].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SyncInventoryAck); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[41].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SyncInventoryResult); i {
+			switch v := v.(*SyncInventoryMissingDevices); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4145,33 +3837,34 @@ func file_teleport_devicetrust_v1_devicetrust_service_proto_init() {
 		(*TPMEnrollPayload_EkCert)(nil),
 		(*TPMEnrollPayload_EkKey)(nil),
 	}
-	file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[28].OneofWrappers = []interface{}{
+	file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[25].OneofWrappers = []interface{}{
 		(*AuthenticateDeviceRequest_Init)(nil),
 		(*AuthenticateDeviceRequest_ChallengeResponse)(nil),
 		(*AuthenticateDeviceRequest_TpmChallengeResponse)(nil),
 	}
-	file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[29].OneofWrappers = []interface{}{
+	file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[26].OneofWrappers = []interface{}{
 		(*AuthenticateDeviceResponse_Challenge)(nil),
 		(*AuthenticateDeviceResponse_UserCertificates)(nil),
 		(*AuthenticateDeviceResponse_TpmChallenge)(nil),
 	}
-	file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[35].OneofWrappers = []interface{}{
+	file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[32].OneofWrappers = []interface{}{
 		(*SyncInventoryRequest_Start)(nil),
 		(*SyncInventoryRequest_End)(nil),
 		(*SyncInventoryRequest_DevicesToUpsert)(nil),
 		(*SyncInventoryRequest_DevicesToRemove)(nil),
 	}
-	file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[36].OneofWrappers = []interface{}{
+	file_teleport_devicetrust_v1_devicetrust_service_proto_msgTypes[33].OneofWrappers = []interface{}{
 		(*SyncInventoryResponse_Ack)(nil),
 		(*SyncInventoryResponse_Result)(nil),
+		(*SyncInventoryResponse_MissingDevices)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_teleport_devicetrust_v1_devicetrust_service_proto_rawDesc,
-			NumEnums:      3,
-			NumMessages:   42,
+			NumEnums:      1,
+			NumMessages:   40,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/tpm.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/tpm.pb.go
new file mode 100644
index 0000000000000..d82a24ec325fd
--- /dev/null
+++ b/api/gen/proto/go/teleport/devicetrust/v1/tpm.pb.go
@@ -0,0 +1,438 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: teleport/devicetrust/v1/tpm.proto
+
+package devicetrustv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Encapsulates the value of a PCR at a point at time.
+// See https://pkg.go.dev/github.com/google/go-attestation/attest#PCR
+type TPMPCR struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// the PCR index in the PCR bank
+	Index int32 `protobuf:"varint,1,opt,name=index,proto3" json:"index,omitempty"`
+	// the digest currently held in the PCR
+	Digest []byte `protobuf:"bytes,2,opt,name=digest,proto3" json:"digest,omitempty"`
+	// the hash algorithm used to produce the digest in this PCR bank. This value
+	// is the underlying value of the Go crypto.Hash type.
+	DigestAlg uint64 `protobuf:"varint,3,opt,name=digest_alg,json=digestAlg,proto3" json:"digest_alg,omitempty"`
+}
+
+func (x *TPMPCR) Reset() {
+	*x = TPMPCR{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_devicetrust_v1_tpm_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TPMPCR) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TPMPCR) ProtoMessage() {}
+
+func (x *TPMPCR) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_devicetrust_v1_tpm_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TPMPCR.ProtoReflect.Descriptor instead.
+func (*TPMPCR) Descriptor() ([]byte, []int) {
+	return file_teleport_devicetrust_v1_tpm_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *TPMPCR) GetIndex() int32 {
+	if x != nil {
+		return x.Index
+	}
+	return 0
+}
+
+func (x *TPMPCR) GetDigest() []byte {
+	if x != nil {
+		return x.Digest
+	}
+	return nil
+}
+
+func (x *TPMPCR) GetDigestAlg() uint64 {
+	if x != nil {
+		return x.DigestAlg
+	}
+	return 0
+}
+
+// Encapsulates the result of a quote operation against the TPM over a PCR
+// using an attestation key.
+// See https://pkg.go.dev/github.com/google/go-attestation/attest#Quote
+type TPMQuote struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Quote     []byte `protobuf:"bytes,1,opt,name=quote,proto3" json:"quote,omitempty"`
+	Signature []byte `protobuf:"bytes,2,opt,name=signature,proto3" json:"signature,omitempty"`
+}
+
+func (x *TPMQuote) Reset() {
+	*x = TPMQuote{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_devicetrust_v1_tpm_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TPMQuote) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TPMQuote) ProtoMessage() {}
+
+func (x *TPMQuote) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_devicetrust_v1_tpm_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TPMQuote.ProtoReflect.Descriptor instead.
+func (*TPMQuote) Descriptor() ([]byte, []int) {
+	return file_teleport_devicetrust_v1_tpm_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *TPMQuote) GetQuote() []byte {
+	if x != nil {
+		return x.Quote
+	}
+	return nil
+}
+
+func (x *TPMQuote) GetSignature() []byte {
+	if x != nil {
+		return x.Signature
+	}
+	return nil
+}
+
+// The quotes, PCRs and event log from a TPM that attest to the booted state
+// of the machine.
+// See https://pkg.go.dev/github.com/google/go-attestation/attest#PlatformParameters
+// Excludes TPMVersion and Public since these are already known values.
+type TPMPlatformParameters struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Quotes   []*TPMQuote `protobuf:"bytes,1,rep,name=quotes,proto3" json:"quotes,omitempty"`
+	Pcrs     []*TPMPCR   `protobuf:"bytes,2,rep,name=pcrs,proto3" json:"pcrs,omitempty"`
+	EventLog []byte      `protobuf:"bytes,3,opt,name=event_log,json=eventLog,proto3" json:"event_log,omitempty"`
+}
+
+func (x *TPMPlatformParameters) Reset() {
+	*x = TPMPlatformParameters{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_devicetrust_v1_tpm_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TPMPlatformParameters) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TPMPlatformParameters) ProtoMessage() {}
+
+func (x *TPMPlatformParameters) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_devicetrust_v1_tpm_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TPMPlatformParameters.ProtoReflect.Descriptor instead.
+func (*TPMPlatformParameters) Descriptor() ([]byte, []int) {
+	return file_teleport_devicetrust_v1_tpm_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *TPMPlatformParameters) GetQuotes() []*TPMQuote {
+	if x != nil {
+		return x.Quotes
+	}
+	return nil
+}
+
+func (x *TPMPlatformParameters) GetPcrs() []*TPMPCR {
+	if x != nil {
+		return x.Pcrs
+	}
+	return nil
+}
+
+func (x *TPMPlatformParameters) GetEventLog() []byte {
+	if x != nil {
+		return x.EventLog
+	}
+	return nil
+}
+
+// Holds the record of a TPM platform attestation, including the platform
+// parameters sent by the device and the nonce the server generated. This allows
+// a historical platform attestation to be revalidated and allows us to compare
+// the incoming state of a device (e.g during authentication) against the
+// historical state in order to detect potentially malicious actions.
+type TPMPlatformAttestation struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Nonce              []byte                 `protobuf:"bytes,1,opt,name=nonce,proto3" json:"nonce,omitempty"`
+	PlatformParameters *TPMPlatformParameters `protobuf:"bytes,2,opt,name=platform_parameters,json=platformParameters,proto3" json:"platform_parameters,omitempty"`
+}
+
+func (x *TPMPlatformAttestation) Reset() {
+	*x = TPMPlatformAttestation{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_devicetrust_v1_tpm_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TPMPlatformAttestation) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TPMPlatformAttestation) ProtoMessage() {}
+
+func (x *TPMPlatformAttestation) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_devicetrust_v1_tpm_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TPMPlatformAttestation.ProtoReflect.Descriptor instead.
+func (*TPMPlatformAttestation) Descriptor() ([]byte, []int) {
+	return file_teleport_devicetrust_v1_tpm_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *TPMPlatformAttestation) GetNonce() []byte {
+	if x != nil {
+		return x.Nonce
+	}
+	return nil
+}
+
+func (x *TPMPlatformAttestation) GetPlatformParameters() *TPMPlatformParameters {
+	if x != nil {
+		return x.PlatformParameters
+	}
+	return nil
+}
+
+var File_teleport_devicetrust_v1_tpm_proto protoreflect.FileDescriptor
+
+var file_teleport_devicetrust_v1_tpm_proto_rawDesc = []byte{
+	0x0a, 0x21, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x64, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x70, 0x6d, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x17, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x22, 0x55, 0x0a, 0x06,
+	0x54, 0x50, 0x4d, 0x50, 0x43, 0x52, 0x12, 0x14, 0x0a, 0x05, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x16, 0x0a, 0x06,
+	0x64, 0x69, 0x67, 0x65, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x64, 0x69,
+	0x67, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74, 0x5f, 0x61,
+	0x6c, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74,
+	0x41, 0x6c, 0x67, 0x22, 0x3e, 0x0a, 0x08, 0x54, 0x50, 0x4d, 0x51, 0x75, 0x6f, 0x74, 0x65, 0x12,
+	0x14, 0x0a, 0x05, 0x71, 0x75, 0x6f, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05,
+	0x71, 0x75, 0x6f, 0x74, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75,
+	0x72, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74,
+	0x75, 0x72, 0x65, 0x22, 0xa4, 0x01, 0x0a, 0x15, 0x54, 0x50, 0x4d, 0x50, 0x6c, 0x61, 0x74, 0x66,
+	0x6f, 0x72, 0x6d, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12, 0x39, 0x0a,
+	0x06, 0x71, 0x75, 0x6f, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x21, 0x2e,
+	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74,
+	0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x51, 0x75, 0x6f, 0x74, 0x65,
+	0x52, 0x06, 0x71, 0x75, 0x6f, 0x74, 0x65, 0x73, 0x12, 0x33, 0x0a, 0x04, 0x70, 0x63, 0x72, 0x73,
+	0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x76, 0x31,
+	0x2e, 0x54, 0x50, 0x4d, 0x50, 0x43, 0x52, 0x52, 0x04, 0x70, 0x63, 0x72, 0x73, 0x12, 0x1b, 0x0a,
+	0x09, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x6c, 0x6f, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x08, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x6f, 0x67, 0x22, 0x8f, 0x01, 0x0a, 0x16, 0x54,
+	0x50, 0x4d, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x41, 0x74, 0x74, 0x65, 0x73, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x6f, 0x6e, 0x63, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x6e, 0x6f, 0x6e, 0x63, 0x65, 0x12, 0x5f, 0x0a, 0x13, 0x70,
+	0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65,
+	0x72, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x2e, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
+	0x76, 0x31, 0x2e, 0x54, 0x50, 0x4d, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x50, 0x61,
+	0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x52, 0x12, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f,
+	0x72, 0x6d, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x42, 0x5a, 0x5a, 0x58,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69,
+	0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
+	0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x64, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2f, 0x76, 0x31, 0x3b, 0x64, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x74, 0x72, 0x75, 0x73, 0x74, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_teleport_devicetrust_v1_tpm_proto_rawDescOnce sync.Once
+	file_teleport_devicetrust_v1_tpm_proto_rawDescData = file_teleport_devicetrust_v1_tpm_proto_rawDesc
+)
+
+func file_teleport_devicetrust_v1_tpm_proto_rawDescGZIP() []byte {
+	file_teleport_devicetrust_v1_tpm_proto_rawDescOnce.Do(func() {
+		file_teleport_devicetrust_v1_tpm_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_devicetrust_v1_tpm_proto_rawDescData)
+	})
+	return file_teleport_devicetrust_v1_tpm_proto_rawDescData
+}
+
+var file_teleport_devicetrust_v1_tpm_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_teleport_devicetrust_v1_tpm_proto_goTypes = []interface{}{
+	(*TPMPCR)(nil),                 // 0: teleport.devicetrust.v1.TPMPCR
+	(*TPMQuote)(nil),               // 1: teleport.devicetrust.v1.TPMQuote
+	(*TPMPlatformParameters)(nil),  // 2: teleport.devicetrust.v1.TPMPlatformParameters
+	(*TPMPlatformAttestation)(nil), // 3: teleport.devicetrust.v1.TPMPlatformAttestation
+}
+var file_teleport_devicetrust_v1_tpm_proto_depIdxs = []int32{
+	1, // 0: teleport.devicetrust.v1.TPMPlatformParameters.quotes:type_name -> teleport.devicetrust.v1.TPMQuote
+	0, // 1: teleport.devicetrust.v1.TPMPlatformParameters.pcrs:type_name -> teleport.devicetrust.v1.TPMPCR
+	2, // 2: teleport.devicetrust.v1.TPMPlatformAttestation.platform_parameters:type_name -> teleport.devicetrust.v1.TPMPlatformParameters
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_teleport_devicetrust_v1_tpm_proto_init() }
+func file_teleport_devicetrust_v1_tpm_proto_init() {
+	if File_teleport_devicetrust_v1_tpm_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_teleport_devicetrust_v1_tpm_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TPMPCR); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_devicetrust_v1_tpm_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TPMQuote); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_devicetrust_v1_tpm_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TPMPlatformParameters); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_devicetrust_v1_tpm_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TPMPlatformAttestation); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_devicetrust_v1_tpm_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_devicetrust_v1_tpm_proto_goTypes,
+		DependencyIndexes: file_teleport_devicetrust_v1_tpm_proto_depIdxs,
+		MessageInfos:      file_teleport_devicetrust_v1_tpm_proto_msgTypes,
+	}.Build()
+	File_teleport_devicetrust_v1_tpm_proto = out.File
+	file_teleport_devicetrust_v1_tpm_proto_rawDesc = nil
+	file_teleport_devicetrust_v1_tpm_proto_goTypes = nil
+	file_teleport_devicetrust_v1_tpm_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/embedding/v1/embedding.pb.go b/api/gen/proto/go/teleport/embedding/v1/embedding.pb.go
new file mode 100644
index 0000000000000..58f343c52306c
--- /dev/null
+++ b/api/gen/proto/go/teleport/embedding/v1/embedding.pb.go
@@ -0,0 +1,202 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: teleport/embedding/v1/embedding.proto
+
+package embeddingv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Embedding contains a Teleport resource embedding. Embeddings are small semantic
+// representations of larger and more complex data. Embeddings can be compared,
+// the smaller the distance between two vectors, the closer the concepts are.
+// Teleport Assist embeds resources to perform semantic search.
+type Embedding struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// EmbeddedKind is the kind of the embedded resource.
+	EmbeddedKind string `protobuf:"bytes,1,opt,name=embedded_kind,json=embeddedKind,proto3" json:"embedded_kind,omitempty"`
+	// EmbeddedId is the ID of the embedded resource.
+	EmbeddedId string `protobuf:"bytes,2,opt,name=embedded_id,json=embeddedId,proto3" json:"embedded_id,omitempty"`
+	// EmbeddedHash is the hash of the embedded resource after serialization.
+	// This helps checking if the resource has changed and needs a new embedding.
+	EmbeddedHash []byte `protobuf:"bytes,3,opt,name=embedded_hash,json=embeddedHash,proto3" json:"embedded_hash,omitempty"`
+	// Vector is the embedding itself, as provided by the model.
+	Vector []float64 `protobuf:"fixed64,4,rep,packed,name=vector,proto3" json:"vector,omitempty"`
+}
+
+func (x *Embedding) Reset() {
+	*x = Embedding{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_embedding_v1_embedding_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Embedding) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Embedding) ProtoMessage() {}
+
+func (x *Embedding) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_embedding_v1_embedding_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Embedding.ProtoReflect.Descriptor instead.
+func (*Embedding) Descriptor() ([]byte, []int) {
+	return file_teleport_embedding_v1_embedding_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Embedding) GetEmbeddedKind() string {
+	if x != nil {
+		return x.EmbeddedKind
+	}
+	return ""
+}
+
+func (x *Embedding) GetEmbeddedId() string {
+	if x != nil {
+		return x.EmbeddedId
+	}
+	return ""
+}
+
+func (x *Embedding) GetEmbeddedHash() []byte {
+	if x != nil {
+		return x.EmbeddedHash
+	}
+	return nil
+}
+
+func (x *Embedding) GetVector() []float64 {
+	if x != nil {
+		return x.Vector
+	}
+	return nil
+}
+
+var File_teleport_embedding_v1_embedding_proto protoreflect.FileDescriptor
+
+var file_teleport_embedding_v1_embedding_proto_rawDesc = []byte{
+	0x0a, 0x25, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x65, 0x6d, 0x62, 0x65, 0x64,
+	0x64, 0x69, 0x6e, 0x67, 0x2f, 0x76, 0x31, 0x2f, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x69, 0x6e,
+	0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x15, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x22, 0x8e,
+	0x01, 0x0a, 0x09, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x12, 0x23, 0x0a, 0x0d,
+	0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x5f, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x4b, 0x69, 0x6e,
+	0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64,
+	0x49, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x5f, 0x68,
+	0x61, 0x73, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x65, 0x6d, 0x62, 0x65, 0x64,
+	0x64, 0x65, 0x64, 0x48, 0x61, 0x73, 0x68, 0x12, 0x16, 0x0a, 0x06, 0x76, 0x65, 0x63, 0x74, 0x6f,
+	0x72, 0x18, 0x04, 0x20, 0x03, 0x28, 0x01, 0x52, 0x06, 0x76, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x42,
+	0x56, 0x5a, 0x54, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72,
+	0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x65,
+	0x6d, 0x62, 0x65, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x2f, 0x76, 0x31, 0x3b, 0x65, 0x6d, 0x62, 0x65,
+	0x64, 0x64, 0x69, 0x6e, 0x67, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_teleport_embedding_v1_embedding_proto_rawDescOnce sync.Once
+	file_teleport_embedding_v1_embedding_proto_rawDescData = file_teleport_embedding_v1_embedding_proto_rawDesc
+)
+
+func file_teleport_embedding_v1_embedding_proto_rawDescGZIP() []byte {
+	file_teleport_embedding_v1_embedding_proto_rawDescOnce.Do(func() {
+		file_teleport_embedding_v1_embedding_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_embedding_v1_embedding_proto_rawDescData)
+	})
+	return file_teleport_embedding_v1_embedding_proto_rawDescData
+}
+
+var file_teleport_embedding_v1_embedding_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_teleport_embedding_v1_embedding_proto_goTypes = []interface{}{
+	(*Embedding)(nil), // 0: teleport.embedding.v1.Embedding
+}
+var file_teleport_embedding_v1_embedding_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_teleport_embedding_v1_embedding_proto_init() }
+func file_teleport_embedding_v1_embedding_proto_init() {
+	if File_teleport_embedding_v1_embedding_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_teleport_embedding_v1_embedding_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Embedding); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_embedding_v1_embedding_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_embedding_v1_embedding_proto_goTypes,
+		DependencyIndexes: file_teleport_embedding_v1_embedding_proto_depIdxs,
+		MessageInfos:      file_teleport_embedding_v1_embedding_proto_msgTypes,
+	}.Build()
+	File_teleport_embedding_v1_embedding_proto = out.File
+	file_teleport_embedding_v1_embedding_proto_rawDesc = nil
+	file_teleport_embedding_v1_embedding_proto_goTypes = nil
+	file_teleport_embedding_v1_embedding_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/trait/v1/trait.pb.go b/api/gen/proto/go/trait/v1/trait.pb.go
new file mode 100644
index 0000000000000..431ba814986ba
--- /dev/null
+++ b/api/gen/proto/go/trait/v1/trait.pb.go
@@ -0,0 +1,173 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: teleport/trait/v1/trait.proto
+
+package trait
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Trait is a trait that can be use in various resources.
+type Trait struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// key is the name of the trait.
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	// values is the list of trait values.
+	Values []string `protobuf:"bytes,2,rep,name=values,proto3" json:"values,omitempty"`
+}
+
+func (x *Trait) Reset() {
+	*x = Trait{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_trait_v1_trait_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Trait) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Trait) ProtoMessage() {}
+
+func (x *Trait) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_trait_v1_trait_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Trait.ProtoReflect.Descriptor instead.
+func (*Trait) Descriptor() ([]byte, []int) {
+	return file_teleport_trait_v1_trait_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Trait) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *Trait) GetValues() []string {
+	if x != nil {
+		return x.Values
+	}
+	return nil
+}
+
+var File_teleport_trait_v1_trait_proto protoreflect.FileDescriptor
+
+var file_teleport_trait_v1_trait_proto_rawDesc = []byte{
+	0x0a, 0x1d, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x74, 0x72, 0x61, 0x69, 0x74,
+	0x2f, 0x76, 0x31, 0x2f, 0x74, 0x72, 0x61, 0x69, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
+	0x11, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x72, 0x61, 0x69, 0x74, 0x2e,
+	0x76, 0x31, 0x22, 0x31, 0x0a, 0x05, 0x54, 0x72, 0x61, 0x69, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b,
+	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x16, 0x0a,
+	0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x73, 0x42, 0x43, 0x5a, 0x41, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61,
+	0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67,
+	0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x72, 0x61, 0x69,
+	0x74, 0x2f, 0x76, 0x31, 0x3b, 0x74, 0x72, 0x61, 0x69, 0x74, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
+}
+
+var (
+	file_teleport_trait_v1_trait_proto_rawDescOnce sync.Once
+	file_teleport_trait_v1_trait_proto_rawDescData = file_teleport_trait_v1_trait_proto_rawDesc
+)
+
+func file_teleport_trait_v1_trait_proto_rawDescGZIP() []byte {
+	file_teleport_trait_v1_trait_proto_rawDescOnce.Do(func() {
+		file_teleport_trait_v1_trait_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_trait_v1_trait_proto_rawDescData)
+	})
+	return file_teleport_trait_v1_trait_proto_rawDescData
+}
+
+var file_teleport_trait_v1_trait_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_teleport_trait_v1_trait_proto_goTypes = []interface{}{
+	(*Trait)(nil), // 0: teleport.trait.v1.Trait
+}
+var file_teleport_trait_v1_trait_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_teleport_trait_v1_trait_proto_init() }
+func file_teleport_trait_v1_trait_proto_init() {
+	if File_teleport_trait_v1_trait_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_teleport_trait_v1_trait_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Trait); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_trait_v1_trait_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_trait_v1_trait_proto_goTypes,
+		DependencyIndexes: file_teleport_trait_v1_trait_proto_depIdxs,
+		MessageInfos:      file_teleport_trait_v1_trait_proto_msgTypes,
+	}.Build()
+	File_teleport_trait_v1_trait_proto = out.File
+	file_teleport_trait_v1_trait_proto_rawDesc = nil
+	file_teleport_trait_v1_trait_proto_goTypes = nil
+	file_teleport_trait_v1_trait_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/usageevents/v1/usageevents.pb.go b/api/gen/proto/go/usageevents/v1/usageevents.pb.go
index 7a584d16fcc9c..b7eea04b302f9 100644
--- a/api/gen/proto/go/usageevents/v1/usageevents.pb.go
+++ b/api/gen/proto/go/usageevents/v1/usageevents.pb.go
@@ -63,6 +63,7 @@ const (
 	DiscoverResource_DISCOVER_RESOURCE_DOC_DATABASE_RDS_PROXY                DiscoverResource = 34
 	DiscoverResource_DISCOVER_RESOURCE_DOC_DATABASE_HIGH_AVAILABILITY        DiscoverResource = 35
 	DiscoverResource_DISCOVER_RESOURCE_DOC_DATABASE_DYNAMIC_REGISTRATION     DiscoverResource = 36
+	DiscoverResource_DISCOVER_RESOURCE_SAML_APPLICATION                      DiscoverResource = 37
 )
 
 var DiscoverResource_name = map[int32]string{
@@ -103,6 +104,7 @@ var DiscoverResource_name = map[int32]string{
 	34: "DISCOVER_RESOURCE_DOC_DATABASE_RDS_PROXY",
 	35: "DISCOVER_RESOURCE_DOC_DATABASE_HIGH_AVAILABILITY",
 	36: "DISCOVER_RESOURCE_DOC_DATABASE_DYNAMIC_REGISTRATION",
+	37: "DISCOVER_RESOURCE_SAML_APPLICATION",
 }
 
 var DiscoverResource_value = map[string]int32{
@@ -143,6 +145,7 @@ var DiscoverResource_value = map[string]int32{
 	"DISCOVER_RESOURCE_DOC_DATABASE_RDS_PROXY":                34,
 	"DISCOVER_RESOURCE_DOC_DATABASE_HIGH_AVAILABILITY":        35,
 	"DISCOVER_RESOURCE_DOC_DATABASE_DYNAMIC_REGISTRATION":     36,
+	"DISCOVER_RESOURCE_SAML_APPLICATION":                      37,
 }
 
 func (x DiscoverResource) String() string {
@@ -209,6 +212,7 @@ const (
 	CTA_CTA_PREMIUM_SUPPORT CTA = 4
 	CTA_CTA_TRUSTED_DEVICES CTA = 5
 	CTA_CTA_UPGRADE_BANNER  CTA = 6
+	CTA_CTA_BILLING_SUMMARY CTA = 7
 )
 
 var CTA_name = map[int32]string{
@@ -219,6 +223,7 @@ var CTA_name = map[int32]string{
 	4: "CTA_PREMIUM_SUPPORT",
 	5: "CTA_TRUSTED_DEVICES",
 	6: "CTA_UPGRADE_BANNER",
+	7: "CTA_BILLING_SUMMARY",
 }
 
 var CTA_value = map[string]int32{
@@ -229,6 +234,7 @@ var CTA_value = map[string]int32{
 	"CTA_PREMIUM_SUPPORT": 4,
 	"CTA_TRUSTED_DEVICES": 5,
 	"CTA_UPGRADE_BANNER":  6,
+	"CTA_BILLING_SUMMARY": 7,
 }
 
 func (x CTA) String() string {
@@ -296,6 +302,74 @@ func (IntegrationEnrollKind) EnumDescriptor() ([]byte, []int) {
 	return fileDescriptor_94cf2ca1c69fd564, []int{3}
 }
 
+// DeployMethod describes the method used to deploy a service.
+type UIDiscoverDeployServiceEvent_DeployMethod int32
+
+const (
+	// DEPLOY_METHOD_UNSPECIFIED means there was an existing service
+	// so deploying step got skipped.
+	UIDiscoverDeployServiceEvent_DEPLOY_METHOD_UNSPECIFIED UIDiscoverDeployServiceEvent_DeployMethod = 0
+	// DEPLOY_METHOD_AUTO means Teleport deployed a service for the user.
+	UIDiscoverDeployServiceEvent_DEPLOY_METHOD_AUTO UIDiscoverDeployServiceEvent_DeployMethod = 1
+	// DEPLOY_METHOD_MANUAL means a user deployed a service by themselves.
+	UIDiscoverDeployServiceEvent_DEPLOY_METHOD_MANUAL UIDiscoverDeployServiceEvent_DeployMethod = 2
+)
+
+var UIDiscoverDeployServiceEvent_DeployMethod_name = map[int32]string{
+	0: "DEPLOY_METHOD_UNSPECIFIED",
+	1: "DEPLOY_METHOD_AUTO",
+	2: "DEPLOY_METHOD_MANUAL",
+}
+
+var UIDiscoverDeployServiceEvent_DeployMethod_value = map[string]int32{
+	"DEPLOY_METHOD_UNSPECIFIED": 0,
+	"DEPLOY_METHOD_AUTO":        1,
+	"DEPLOY_METHOD_MANUAL":      2,
+}
+
+func (x UIDiscoverDeployServiceEvent_DeployMethod) String() string {
+	return proto.EnumName(UIDiscoverDeployServiceEvent_DeployMethod_name, int32(x))
+}
+
+func (UIDiscoverDeployServiceEvent_DeployMethod) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor_94cf2ca1c69fd564, []int{18, 0}
+}
+
+// DeployType describes the type of deployment.
+type UIDiscoverDeployServiceEvent_DeployType int32
+
+const (
+	// DEPLOY_METHOD_UNSPECIFIED means there was an existing service
+	// so deploying step got skipped.
+	UIDiscoverDeployServiceEvent_DEPLOY_TYPE_UNSPECIFIED UIDiscoverDeployServiceEvent_DeployType = 0
+	// DEPLOY_TYPE_INSTALL_SCRIPT means service was deployed using an
+	// install script.
+	UIDiscoverDeployServiceEvent_DEPLOY_TYPE_INSTALL_SCRIPT UIDiscoverDeployServiceEvent_DeployType = 1
+	// DEPLOY_TYPE_AMAZON_ECS means service was deployed using amazon's
+	// elastic container service.
+	UIDiscoverDeployServiceEvent_DEPLOY_TYPE_AMAZON_ECS UIDiscoverDeployServiceEvent_DeployType = 2
+)
+
+var UIDiscoverDeployServiceEvent_DeployType_name = map[int32]string{
+	0: "DEPLOY_TYPE_UNSPECIFIED",
+	1: "DEPLOY_TYPE_INSTALL_SCRIPT",
+	2: "DEPLOY_TYPE_AMAZON_ECS",
+}
+
+var UIDiscoverDeployServiceEvent_DeployType_value = map[string]int32{
+	"DEPLOY_TYPE_UNSPECIFIED":    0,
+	"DEPLOY_TYPE_INSTALL_SCRIPT": 1,
+	"DEPLOY_TYPE_AMAZON_ECS":     2,
+}
+
+func (x UIDiscoverDeployServiceEvent_DeployType) String() string {
+	return proto.EnumName(UIDiscoverDeployServiceEvent_DeployType_name, int32(x))
+}
+
+func (UIDiscoverDeployServiceEvent_DeployType) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor_94cf2ca1c69fd564, []int{18, 1}
+}
+
 // UIBannerClickEvent is a usage event sent by the UI when the upgrade
 // banner is clicked.
 type UIBannerClickEvent struct {
@@ -532,6 +606,56 @@ func (m *UIOnboardSetCredentialSubmitEvent) GetUsername() string {
 	return ""
 }
 
+// UIOnboardQuestionnaireSubmitEvent is a UI event sent during registration when
+// the user submits their onboarding questionnaire.
+type UIOnboardQuestionnaireSubmitEvent struct {
+	// The event username. Not extracted from identity as this is pre-registration.
+	Username             string   `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *UIOnboardQuestionnaireSubmitEvent) Reset()         { *m = UIOnboardQuestionnaireSubmitEvent{} }
+func (m *UIOnboardQuestionnaireSubmitEvent) String() string { return proto.CompactTextString(m) }
+func (*UIOnboardQuestionnaireSubmitEvent) ProtoMessage()    {}
+func (*UIOnboardQuestionnaireSubmitEvent) Descriptor() ([]byte, []int) {
+	return fileDescriptor_94cf2ca1c69fd564, []int{5}
+}
+func (m *UIOnboardQuestionnaireSubmitEvent) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *UIOnboardQuestionnaireSubmitEvent) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_UIOnboardQuestionnaireSubmitEvent.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *UIOnboardQuestionnaireSubmitEvent) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_UIOnboardQuestionnaireSubmitEvent.Merge(m, src)
+}
+func (m *UIOnboardQuestionnaireSubmitEvent) XXX_Size() int {
+	return m.Size()
+}
+func (m *UIOnboardQuestionnaireSubmitEvent) XXX_DiscardUnknown() {
+	xxx_messageInfo_UIOnboardQuestionnaireSubmitEvent.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UIOnboardQuestionnaireSubmitEvent proto.InternalMessageInfo
+
+func (m *UIOnboardQuestionnaireSubmitEvent) GetUsername() string {
+	if m != nil {
+		return m.Username
+	}
+	return ""
+}
+
 // UIOnboardRegisterChallengeSubmitEvent is a UI event sent during registration
 // when the MFA challenge is completed.
 type UIOnboardRegisterChallengeSubmitEvent struct {
@@ -550,7 +674,7 @@ func (m *UIOnboardRegisterChallengeSubmitEvent) Reset()         { *m = UIOnboard
 func (m *UIOnboardRegisterChallengeSubmitEvent) String() string { return proto.CompactTextString(m) }
 func (*UIOnboardRegisterChallengeSubmitEvent) ProtoMessage()    {}
 func (*UIOnboardRegisterChallengeSubmitEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{5}
+	return fileDescriptor_94cf2ca1c69fd564, []int{6}
 }
 func (m *UIOnboardRegisterChallengeSubmitEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -614,7 +738,7 @@ func (m *UIRecoveryCodesContinueClickEvent) Reset()         { *m = UIRecoveryCod
 func (m *UIRecoveryCodesContinueClickEvent) String() string { return proto.CompactTextString(m) }
 func (*UIRecoveryCodesContinueClickEvent) ProtoMessage()    {}
 func (*UIRecoveryCodesContinueClickEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{6}
+	return fileDescriptor_94cf2ca1c69fd564, []int{7}
 }
 func (m *UIRecoveryCodesContinueClickEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -664,7 +788,7 @@ func (m *UIRecoveryCodesCopyClickEvent) Reset()         { *m = UIRecoveryCodesCo
 func (m *UIRecoveryCodesCopyClickEvent) String() string { return proto.CompactTextString(m) }
 func (*UIRecoveryCodesCopyClickEvent) ProtoMessage()    {}
 func (*UIRecoveryCodesCopyClickEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{7}
+	return fileDescriptor_94cf2ca1c69fd564, []int{8}
 }
 func (m *UIRecoveryCodesCopyClickEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -714,7 +838,7 @@ func (m *UIRecoveryCodesPrintClickEvent) Reset()         { *m = UIRecoveryCodesP
 func (m *UIRecoveryCodesPrintClickEvent) String() string { return proto.CompactTextString(m) }
 func (*UIRecoveryCodesPrintClickEvent) ProtoMessage()    {}
 func (*UIRecoveryCodesPrintClickEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{8}
+	return fileDescriptor_94cf2ca1c69fd564, []int{9}
 }
 func (m *UIRecoveryCodesPrintClickEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -764,7 +888,7 @@ func (m *DiscoverMetadata) Reset()         { *m = DiscoverMetadata{} }
 func (m *DiscoverMetadata) String() string { return proto.CompactTextString(m) }
 func (*DiscoverMetadata) ProtoMessage()    {}
 func (*DiscoverMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{9}
+	return fileDescriptor_94cf2ca1c69fd564, []int{10}
 }
 func (m *DiscoverMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -813,7 +937,7 @@ func (m *DiscoverResourceMetadata) Reset()         { *m = DiscoverResourceMetada
 func (m *DiscoverResourceMetadata) String() string { return proto.CompactTextString(m) }
 func (*DiscoverResourceMetadata) ProtoMessage()    {}
 func (*DiscoverResourceMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{10}
+	return fileDescriptor_94cf2ca1c69fd564, []int{11}
 }
 func (m *DiscoverResourceMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -866,7 +990,7 @@ func (m *DiscoverStepStatus) Reset()         { *m = DiscoverStepStatus{} }
 func (m *DiscoverStepStatus) String() string { return proto.CompactTextString(m) }
 func (*DiscoverStepStatus) ProtoMessage()    {}
 func (*DiscoverStepStatus) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{11}
+	return fileDescriptor_94cf2ca1c69fd564, []int{12}
 }
 func (m *DiscoverStepStatus) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -922,7 +1046,7 @@ func (m *UIDiscoverStartedEvent) Reset()         { *m = UIDiscoverStartedEvent{}
 func (m *UIDiscoverStartedEvent) String() string { return proto.CompactTextString(m) }
 func (*UIDiscoverStartedEvent) ProtoMessage()    {}
 func (*UIDiscoverStartedEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{12}
+	return fileDescriptor_94cf2ca1c69fd564, []int{13}
 }
 func (m *UIDiscoverStartedEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -980,7 +1104,7 @@ func (m *UIDiscoverResourceSelectionEvent) Reset()         { *m = UIDiscoverReso
 func (m *UIDiscoverResourceSelectionEvent) String() string { return proto.CompactTextString(m) }
 func (*UIDiscoverResourceSelectionEvent) ProtoMessage()    {}
 func (*UIDiscoverResourceSelectionEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{13}
+	return fileDescriptor_94cf2ca1c69fd564, []int{14}
 }
 func (m *UIDiscoverResourceSelectionEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1048,7 +1172,7 @@ func (m *UIDiscoverIntegrationAWSOIDCConnectEvent) Reset() {
 func (m *UIDiscoverIntegrationAWSOIDCConnectEvent) String() string { return proto.CompactTextString(m) }
 func (*UIDiscoverIntegrationAWSOIDCConnectEvent) ProtoMessage()    {}
 func (*UIDiscoverIntegrationAWSOIDCConnectEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{14}
+	return fileDescriptor_94cf2ca1c69fd564, []int{15}
 }
 func (m *UIDiscoverIntegrationAWSOIDCConnectEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1114,7 +1238,7 @@ func (m *UIDiscoverDatabaseRDSEnrollEvent) Reset()         { *m = UIDiscoverData
 func (m *UIDiscoverDatabaseRDSEnrollEvent) String() string { return proto.CompactTextString(m) }
 func (*UIDiscoverDatabaseRDSEnrollEvent) ProtoMessage()    {}
 func (*UIDiscoverDatabaseRDSEnrollEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{15}
+	return fileDescriptor_94cf2ca1c69fd564, []int{16}
 }
 func (m *UIDiscoverDatabaseRDSEnrollEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1183,7 +1307,7 @@ func (m *UICallToActionClickEvent) Reset()         { *m = UICallToActionClickEve
 func (m *UICallToActionClickEvent) String() string { return proto.CompactTextString(m) }
 func (*UICallToActionClickEvent) ProtoMessage()    {}
 func (*UICallToActionClickEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{16}
+	return fileDescriptor_94cf2ca1c69fd564, []int{17}
 }
 func (m *UICallToActionClickEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1227,19 +1351,21 @@ func (m *UICallToActionClickEvent) GetCta() CTA {
 // For Database Access this step is the installation of the teleport 'install-db' script.
 // It can be skipped if the cluster already has a Database Service capable of proxying the database.
 type UIDiscoverDeployServiceEvent struct {
-	Metadata             *DiscoverMetadata         `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
-	Resource             *DiscoverResourceMetadata `protobuf:"bytes,2,opt,name=resource,proto3" json:"resource,omitempty"`
-	Status               *DiscoverStepStatus       `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}                  `json:"-"`
-	XXX_unrecognized     []byte                    `json:"-"`
-	XXX_sizecache        int32                     `json:"-"`
+	Metadata             *DiscoverMetadata                         `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	Resource             *DiscoverResourceMetadata                 `protobuf:"bytes,2,opt,name=resource,proto3" json:"resource,omitempty"`
+	Status               *DiscoverStepStatus                       `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
+	DeployMethod         UIDiscoverDeployServiceEvent_DeployMethod `protobuf:"varint,4,opt,name=deploy_method,json=deployMethod,proto3,enum=teleport.usageevents.v1.UIDiscoverDeployServiceEvent_DeployMethod" json:"deploy_method,omitempty"`
+	DeployType           UIDiscoverDeployServiceEvent_DeployType   `protobuf:"varint,5,opt,name=deploy_type,json=deployType,proto3,enum=teleport.usageevents.v1.UIDiscoverDeployServiceEvent_DeployType" json:"deploy_type,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                                  `json:"-"`
+	XXX_unrecognized     []byte                                    `json:"-"`
+	XXX_sizecache        int32                                     `json:"-"`
 }
 
 func (m *UIDiscoverDeployServiceEvent) Reset()         { *m = UIDiscoverDeployServiceEvent{} }
 func (m *UIDiscoverDeployServiceEvent) String() string { return proto.CompactTextString(m) }
 func (*UIDiscoverDeployServiceEvent) ProtoMessage()    {}
 func (*UIDiscoverDeployServiceEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{17}
+	return fileDescriptor_94cf2ca1c69fd564, []int{18}
 }
 func (m *UIDiscoverDeployServiceEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1289,6 +1415,20 @@ func (m *UIDiscoverDeployServiceEvent) GetStatus() *DiscoverStepStatus {
 	return nil
 }
 
+func (m *UIDiscoverDeployServiceEvent) GetDeployMethod() UIDiscoverDeployServiceEvent_DeployMethod {
+	if m != nil {
+		return m.DeployMethod
+	}
+	return UIDiscoverDeployServiceEvent_DEPLOY_METHOD_UNSPECIFIED
+}
+
+func (m *UIDiscoverDeployServiceEvent) GetDeployType() UIDiscoverDeployServiceEvent_DeployType {
+	if m != nil {
+		return m.DeployType
+	}
+	return UIDiscoverDeployServiceEvent_DEPLOY_TYPE_UNSPECIFIED
+}
+
 // UIDiscoverDatabaseRegisterEvent is emitted when a user is finished with the step that registers a database resource.
 type UIDiscoverDatabaseRegisterEvent struct {
 	Metadata             *DiscoverMetadata         `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
@@ -1303,7 +1443,7 @@ func (m *UIDiscoverDatabaseRegisterEvent) Reset()         { *m = UIDiscoverDatab
 func (m *UIDiscoverDatabaseRegisterEvent) String() string { return proto.CompactTextString(m) }
 func (*UIDiscoverDatabaseRegisterEvent) ProtoMessage()    {}
 func (*UIDiscoverDatabaseRegisterEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{18}
+	return fileDescriptor_94cf2ca1c69fd564, []int{19}
 }
 func (m *UIDiscoverDatabaseRegisterEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1367,7 +1507,7 @@ func (m *UIDiscoverDatabaseConfigureMTLSEvent) Reset()         { *m = UIDiscover
 func (m *UIDiscoverDatabaseConfigureMTLSEvent) String() string { return proto.CompactTextString(m) }
 func (*UIDiscoverDatabaseConfigureMTLSEvent) ProtoMessage()    {}
 func (*UIDiscoverDatabaseConfigureMTLSEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{19}
+	return fileDescriptor_94cf2ca1c69fd564, []int{20}
 }
 func (m *UIDiscoverDatabaseConfigureMTLSEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1435,7 +1575,7 @@ func (m *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) String() string {
 }
 func (*UIDiscoverDesktopActiveDirectoryToolsInstallEvent) ProtoMessage() {}
 func (*UIDiscoverDesktopActiveDirectoryToolsInstallEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{20}
+	return fileDescriptor_94cf2ca1c69fd564, []int{21}
 }
 func (m *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1503,7 +1643,7 @@ func (m *UIDiscoverDesktopActiveDirectoryConfigureEvent) String() string {
 }
 func (*UIDiscoverDesktopActiveDirectoryConfigureEvent) ProtoMessage() {}
 func (*UIDiscoverDesktopActiveDirectoryConfigureEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{21}
+	return fileDescriptor_94cf2ca1c69fd564, []int{22}
 }
 func (m *UIDiscoverDesktopActiveDirectoryConfigureEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1571,7 +1711,7 @@ func (m *UIDiscoverAutoDiscoveredResourcesEvent) Reset() {
 func (m *UIDiscoverAutoDiscoveredResourcesEvent) String() string { return proto.CompactTextString(m) }
 func (*UIDiscoverAutoDiscoveredResourcesEvent) ProtoMessage()    {}
 func (*UIDiscoverAutoDiscoveredResourcesEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{22}
+	return fileDescriptor_94cf2ca1c69fd564, []int{23}
 }
 func (m *UIDiscoverAutoDiscoveredResourcesEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1646,7 +1786,7 @@ func (m *UIDiscoverDatabaseConfigureIAMPolicyEvent) String() string {
 }
 func (*UIDiscoverDatabaseConfigureIAMPolicyEvent) ProtoMessage() {}
 func (*UIDiscoverDatabaseConfigureIAMPolicyEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{23}
+	return fileDescriptor_94cf2ca1c69fd564, []int{24}
 }
 func (m *UIDiscoverDatabaseConfigureIAMPolicyEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1710,7 +1850,7 @@ func (m *UIDiscoverPrincipalsConfigureEvent) Reset()         { *m = UIDiscoverPr
 func (m *UIDiscoverPrincipalsConfigureEvent) String() string { return proto.CompactTextString(m) }
 func (*UIDiscoverPrincipalsConfigureEvent) ProtoMessage()    {}
 func (*UIDiscoverPrincipalsConfigureEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{24}
+	return fileDescriptor_94cf2ca1c69fd564, []int{25}
 }
 func (m *UIDiscoverPrincipalsConfigureEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1775,7 +1915,7 @@ func (m *UIDiscoverTestConnectionEvent) Reset()         { *m = UIDiscoverTestCon
 func (m *UIDiscoverTestConnectionEvent) String() string { return proto.CompactTextString(m) }
 func (*UIDiscoverTestConnectionEvent) ProtoMessage()    {}
 func (*UIDiscoverTestConnectionEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{25}
+	return fileDescriptor_94cf2ca1c69fd564, []int{26}
 }
 func (m *UIDiscoverTestConnectionEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1839,7 +1979,7 @@ func (m *UIDiscoverCompletedEvent) Reset()         { *m = UIDiscoverCompletedEve
 func (m *UIDiscoverCompletedEvent) String() string { return proto.CompactTextString(m) }
 func (*UIDiscoverCompletedEvent) ProtoMessage()    {}
 func (*UIDiscoverCompletedEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{26}
+	return fileDescriptor_94cf2ca1c69fd564, []int{27}
 }
 func (m *UIDiscoverCompletedEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1900,7 +2040,7 @@ func (m *UICreateNewRoleClickEvent) Reset()         { *m = UICreateNewRoleClickE
 func (m *UICreateNewRoleClickEvent) String() string { return proto.CompactTextString(m) }
 func (*UICreateNewRoleClickEvent) ProtoMessage()    {}
 func (*UICreateNewRoleClickEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{27}
+	return fileDescriptor_94cf2ca1c69fd564, []int{28}
 }
 func (m *UICreateNewRoleClickEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1940,7 +2080,7 @@ func (m *UICreateNewRoleSaveClickEvent) Reset()         { *m = UICreateNewRoleSa
 func (m *UICreateNewRoleSaveClickEvent) String() string { return proto.CompactTextString(m) }
 func (*UICreateNewRoleSaveClickEvent) ProtoMessage()    {}
 func (*UICreateNewRoleSaveClickEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{28}
+	return fileDescriptor_94cf2ca1c69fd564, []int{29}
 }
 func (m *UICreateNewRoleSaveClickEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1980,7 +2120,7 @@ func (m *UICreateNewRoleCancelClickEvent) Reset()         { *m = UICreateNewRole
 func (m *UICreateNewRoleCancelClickEvent) String() string { return proto.CompactTextString(m) }
 func (*UICreateNewRoleCancelClickEvent) ProtoMessage()    {}
 func (*UICreateNewRoleCancelClickEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{29}
+	return fileDescriptor_94cf2ca1c69fd564, []int{30}
 }
 func (m *UICreateNewRoleCancelClickEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2024,7 +2164,7 @@ func (m *UICreateNewRoleViewDocumentationClickEvent) String() string {
 }
 func (*UICreateNewRoleViewDocumentationClickEvent) ProtoMessage() {}
 func (*UICreateNewRoleViewDocumentationClickEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{30}
+	return fileDescriptor_94cf2ca1c69fd564, []int{31}
 }
 func (m *UICreateNewRoleViewDocumentationClickEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2072,7 +2212,7 @@ func (m *AssistCompletionEvent) Reset()         { *m = AssistCompletionEvent{} }
 func (m *AssistCompletionEvent) String() string { return proto.CompactTextString(m) }
 func (*AssistCompletionEvent) ProtoMessage()    {}
 func (*AssistCompletionEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{31}
+	return fileDescriptor_94cf2ca1c69fd564, []int{32}
 }
 func (m *AssistCompletionEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2148,7 +2288,7 @@ func (m *IntegrationEnrollMetadata) Reset()         { *m = IntegrationEnrollMeta
 func (m *IntegrationEnrollMetadata) String() string { return proto.CompactTextString(m) }
 func (*IntegrationEnrollMetadata) ProtoMessage()    {}
 func (*IntegrationEnrollMetadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{32}
+	return fileDescriptor_94cf2ca1c69fd564, []int{33}
 }
 func (m *IntegrationEnrollMetadata) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2211,7 +2351,7 @@ func (m *UIIntegrationEnrollStartEvent) Reset()         { *m = UIIntegrationEnro
 func (m *UIIntegrationEnrollStartEvent) String() string { return proto.CompactTextString(m) }
 func (*UIIntegrationEnrollStartEvent) ProtoMessage()    {}
 func (*UIIntegrationEnrollStartEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{33}
+	return fileDescriptor_94cf2ca1c69fd564, []int{34}
 }
 func (m *UIIntegrationEnrollStartEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2260,7 +2400,7 @@ func (m *UIIntegrationEnrollCompleteEvent) Reset()         { *m = UIIntegrationE
 func (m *UIIntegrationEnrollCompleteEvent) String() string { return proto.CompactTextString(m) }
 func (*UIIntegrationEnrollCompleteEvent) ProtoMessage()    {}
 func (*UIIntegrationEnrollCompleteEvent) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{34}
+	return fileDescriptor_94cf2ca1c69fd564, []int{35}
 }
 func (m *UIIntegrationEnrollCompleteEvent) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2332,6 +2472,7 @@ type UsageEventOneOf struct {
 	//	*UsageEventOneOf_AssistCompletion
 	//	*UsageEventOneOf_UiIntegrationEnrollStartEvent
 	//	*UsageEventOneOf_UiIntegrationEnrollCompleteEvent
+	//	*UsageEventOneOf_UiOnboardQuestionnaireSubmit
 	Event                isUsageEventOneOf_Event `protobuf_oneof:"event"`
 	XXX_NoUnkeyedLiteral struct{}                `json:"-"`
 	XXX_unrecognized     []byte                  `json:"-"`
@@ -2342,7 +2483,7 @@ func (m *UsageEventOneOf) Reset()         { *m = UsageEventOneOf{} }
 func (m *UsageEventOneOf) String() string { return proto.CompactTextString(m) }
 func (*UsageEventOneOf) ProtoMessage()    {}
 func (*UsageEventOneOf) Descriptor() ([]byte, []int) {
-	return fileDescriptor_94cf2ca1c69fd564, []int{35}
+	return fileDescriptor_94cf2ca1c69fd564, []int{36}
 }
 func (m *UsageEventOneOf) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2470,6 +2611,9 @@ type UsageEventOneOf_UiIntegrationEnrollStartEvent struct {
 type UsageEventOneOf_UiIntegrationEnrollCompleteEvent struct {
 	UiIntegrationEnrollCompleteEvent *UIIntegrationEnrollCompleteEvent `protobuf:"bytes,32,opt,name=ui_integration_enroll_complete_event,json=uiIntegrationEnrollCompleteEvent,proto3,oneof" json:"ui_integration_enroll_complete_event,omitempty"`
 }
+type UsageEventOneOf_UiOnboardQuestionnaireSubmit struct {
+	UiOnboardQuestionnaireSubmit *UIOnboardQuestionnaireSubmitEvent `protobuf:"bytes,33,opt,name=ui_onboard_questionnaire_submit,json=uiOnboardQuestionnaireSubmit,proto3,oneof" json:"ui_onboard_questionnaire_submit,omitempty"`
+}
 
 func (*UsageEventOneOf_UiBannerClick) isUsageEventOneOf_Event()                                     {}
 func (*UsageEventOneOf_UiOnboardCompleteGoToDashboardClick) isUsageEventOneOf_Event()               {}
@@ -2502,6 +2646,7 @@ func (*UsageEventOneOf_UiCallToActionClickEvent) isUsageEventOneOf_Event()
 func (*UsageEventOneOf_AssistCompletion) isUsageEventOneOf_Event()                                  {}
 func (*UsageEventOneOf_UiIntegrationEnrollStartEvent) isUsageEventOneOf_Event()                     {}
 func (*UsageEventOneOf_UiIntegrationEnrollCompleteEvent) isUsageEventOneOf_Event()                  {}
+func (*UsageEventOneOf_UiOnboardQuestionnaireSubmit) isUsageEventOneOf_Event()                      {}
 
 func (m *UsageEventOneOf) GetEvent() isUsageEventOneOf_Event {
 	if m != nil {
@@ -2727,6 +2872,13 @@ func (m *UsageEventOneOf) GetUiIntegrationEnrollCompleteEvent() *UIIntegrationEn
 	return nil
 }
 
+func (m *UsageEventOneOf) GetUiOnboardQuestionnaireSubmit() *UIOnboardQuestionnaireSubmitEvent {
+	if x, ok := m.GetEvent().(*UsageEventOneOf_UiOnboardQuestionnaireSubmit); ok {
+		return x.UiOnboardQuestionnaireSubmit
+	}
+	return nil
+}
+
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*UsageEventOneOf) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -2761,6 +2913,7 @@ func (*UsageEventOneOf) XXX_OneofWrappers() []interface{} {
 		(*UsageEventOneOf_AssistCompletion)(nil),
 		(*UsageEventOneOf_UiIntegrationEnrollStartEvent)(nil),
 		(*UsageEventOneOf_UiIntegrationEnrollCompleteEvent)(nil),
+		(*UsageEventOneOf_UiOnboardQuestionnaireSubmit)(nil),
 	}
 }
 
@@ -2769,11 +2922,14 @@ func init() {
 	proto.RegisterEnum("teleport.usageevents.v1.DiscoverStatus", DiscoverStatus_name, DiscoverStatus_value)
 	proto.RegisterEnum("teleport.usageevents.v1.CTA", CTA_name, CTA_value)
 	proto.RegisterEnum("teleport.usageevents.v1.IntegrationEnrollKind", IntegrationEnrollKind_name, IntegrationEnrollKind_value)
+	proto.RegisterEnum("teleport.usageevents.v1.UIDiscoverDeployServiceEvent_DeployMethod", UIDiscoverDeployServiceEvent_DeployMethod_name, UIDiscoverDeployServiceEvent_DeployMethod_value)
+	proto.RegisterEnum("teleport.usageevents.v1.UIDiscoverDeployServiceEvent_DeployType", UIDiscoverDeployServiceEvent_DeployType_name, UIDiscoverDeployServiceEvent_DeployType_value)
 	proto.RegisterType((*UIBannerClickEvent)(nil), "teleport.usageevents.v1.UIBannerClickEvent")
 	proto.RegisterType((*UIOnboardCompleteGoToDashboardClickEvent)(nil), "teleport.usageevents.v1.UIOnboardCompleteGoToDashboardClickEvent")
 	proto.RegisterType((*UIOnboardAddFirstResourceClickEvent)(nil), "teleport.usageevents.v1.UIOnboardAddFirstResourceClickEvent")
 	proto.RegisterType((*UIOnboardAddFirstResourceLaterClickEvent)(nil), "teleport.usageevents.v1.UIOnboardAddFirstResourceLaterClickEvent")
 	proto.RegisterType((*UIOnboardSetCredentialSubmitEvent)(nil), "teleport.usageevents.v1.UIOnboardSetCredentialSubmitEvent")
+	proto.RegisterType((*UIOnboardQuestionnaireSubmitEvent)(nil), "teleport.usageevents.v1.UIOnboardQuestionnaireSubmitEvent")
 	proto.RegisterType((*UIOnboardRegisterChallengeSubmitEvent)(nil), "teleport.usageevents.v1.UIOnboardRegisterChallengeSubmitEvent")
 	proto.RegisterType((*UIRecoveryCodesContinueClickEvent)(nil), "teleport.usageevents.v1.UIRecoveryCodesContinueClickEvent")
 	proto.RegisterType((*UIRecoveryCodesCopyClickEvent)(nil), "teleport.usageevents.v1.UIRecoveryCodesCopyClickEvent")
@@ -2812,188 +2968,201 @@ func init() {
 }
 
 var fileDescriptor_94cf2ca1c69fd564 = []byte{
-	// 2887 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe4, 0x5b, 0xdb, 0x6f, 0xdc, 0xc6,
-	0xd5, 0x5f, 0xee, 0xfa, 0x22, 0x8f, 0x6d, 0x99, 0x1e, 0xdf, 0x56, 0xd6, 0x7d, 0xe5, 0xab, 0x9c,
-	0x4f, 0x8a, 0x9d, 0x7c, 0x89, 0xbf, 0xcf, 0x69, 0x03, 0x8a, 0xa4, 0x44, 0x5a, 0xbb, 0xcb, 0xcd,
-	0x0c, 0xd7, 0xae, 0x02, 0x04, 0x03, 0x7a, 0x77, 0xac, 0x10, 0xa6, 0xc8, 0x05, 0xc9, 0x95, 0x2a,
-	0x14, 0x45, 0xd0, 0xa2, 0x2d, 0x0a, 0x24, 0x28, 0xda, 0xb7, 0x02, 0x05, 0x02, 0x14, 0x6d, 0x81,
-	0x3e, 0x14, 0x7d, 0x2b, 0xf2, 0xdc, 0xb7, 0x3e, 0x16, 0xfd, 0x0b, 0x8a, 0xbc, 0xf7, 0xb1, 0x0f,
-	0x2d, 0x5a, 0xb4, 0xe0, 0xf0, 0xb2, 0xdc, 0x1b, 0xc9, 0x04, 0xed, 0x8b, 0xf2, 0x26, 0x72, 0x7e,
-	0x67, 0xe6, 0x37, 0xe7, 0x9c, 0xb9, 0x9c, 0x1f, 0xb5, 0xe0, 0xbe, 0x4f, 0x2d, 0xda, 0x73, 0x5c,
-	0x7f, 0xb3, 0xef, 0x19, 0xfb, 0x94, 0x1e, 0x52, 0xdb, 0xf7, 0x36, 0x0f, 0x1f, 0xa6, 0x1f, 0x37,
-	0x7a, 0xae, 0xe3, 0x3b, 0xf0, 0x46, 0x0c, 0xdd, 0x48, 0xb7, 0x1d, 0x3e, 0xac, 0xad, 0x03, 0xd8,
-	0x56, 0xb7, 0x0c, 0xdb, 0xa6, 0xae, 0x68, 0x99, 0x9d, 0x57, 0x72, 0xd0, 0x02, 0xaf, 0x82, 0xd3,
-	0x86, 0x45, 0x5d, 0xbf, 0xca, 0xad, 0x70, 0xf7, 0xce, 0xa1, 0xf0, 0xa1, 0xb6, 0x0d, 0xee, 0xb5,
-	0x55, 0xcd, 0x7e, 0xe1, 0x18, 0x6e, 0x57, 0x74, 0x0e, 0x7a, 0x16, 0xf5, 0xe9, 0x8e, 0xa3, 0x3b,
-	0x92, 0xe1, 0x7d, 0x18, 0xbe, 0x1c, 0xf4, 0x70, 0x13, 0xcc, 0xf4, 0x3d, 0xea, 0xda, 0xc6, 0x01,
-	0x8d, 0x3a, 0x49, 0x9e, 0x6b, 0xb7, 0xc1, 0x5a, 0xd2, 0x8f, 0xd0, 0xed, 0x6e, 0x9b, 0xae, 0xe7,
-	0x23, 0xea, 0x39, 0x7d, 0xb7, 0x43, 0x07, 0x5d, 0xd4, 0xd6, 0x53, 0xc3, 0x8d, 0xc2, 0xea, 0x86,
-	0x9f, 0x26, 0x5c, 0x7b, 0x17, 0xac, 0x26, 0x58, 0x4c, 0x7d, 0xd1, 0xa5, 0x5d, 0x6a, 0xfb, 0xa6,
-	0x61, 0xe1, 0xfe, 0x8b, 0x03, 0xd3, 0xcf, 0xe7, 0xf4, 0x6d, 0x70, 0x3b, 0xe9, 0x00, 0xd1, 0x7d,
-	0xd3, 0x0b, 0xfa, 0xff, 0xd0, 0xb0, 0x2c, 0x6a, 0xef, 0xd3, 0x82, 0x9d, 0xc0, 0x39, 0x30, 0x73,
-	0xf0, 0xd2, 0x20, 0xfe, 0x71, 0x8f, 0x56, 0xcb, 0xac, 0xed, 0xec, 0xc1, 0x4b, 0x43, 0x3f, 0xee,
-	0x51, 0xb8, 0x08, 0x80, 0xe5, 0xec, 0x9b, 0x36, 0x79, 0x69, 0x39, 0x47, 0xd5, 0x0a, 0x6b, 0x3c,
-	0xc7, 0xde, 0x6c, 0x5b, 0xce, 0x51, 0xc8, 0x1f, 0xd1, 0x8e, 0x73, 0x48, 0xdd, 0x63, 0xd1, 0xe9,
-	0x52, 0x4f, 0x74, 0x6c, 0xdf, 0xb4, 0xfb, 0xb4, 0xa0, 0x4f, 0x9f, 0x80, 0xc5, 0xb1, 0x0e, 0x7a,
-	0xc7, 0x05, 0x8d, 0xdf, 0x01, 0x4b, 0x23, 0xc6, 0x2d, 0xd7, 0xb4, 0xfd, 0x82, 0xd6, 0x35, 0xc0,
-	0x4b, 0xa6, 0xc7, 0x8c, 0x1b, 0xd4, 0x37, 0xba, 0x86, 0x6f, 0xc0, 0x59, 0x50, 0x36, 0xbb, 0x11,
-	0xb2, 0x6c, 0x76, 0x6b, 0x06, 0xa8, 0xc6, 0x98, 0x38, 0x84, 0x09, 0x56, 0x06, 0x33, 0x6e, 0xf4,
-	0x8e, 0x59, 0xcc, 0x3e, 0xba, 0xbf, 0x31, 0x25, 0x5d, 0x37, 0x46, 0x3b, 0x41, 0x89, 0x69, 0xed,
-	0x15, 0x80, 0x71, 0x2b, 0xf6, 0x69, 0x0f, 0xfb, 0x86, 0xdf, 0xf7, 0xe0, 0xbb, 0xe0, 0x8c, 0xc7,
-	0xfe, 0x8a, 0xba, 0xbe, 0x9b, 0xdb, 0x75, 0x68, 0x88, 0x22, 0xb3, 0x60, 0x29, 0x50, 0xd7, 0x75,
-	0xdc, 0x28, 0xa0, 0xe1, 0x43, 0xed, 0x97, 0x1c, 0xb8, 0xde, 0x56, 0x53, 0x26, 0xae, 0x4f, 0xbb,
-	0xa1, 0xab, 0x64, 0x30, 0x73, 0x10, 0x4d, 0x8d, 0x8d, 0x79, 0xbe, 0xc0, 0x74, 0x62, 0x5f, 0xa0,
-	0xc4, 0x14, 0x8a, 0x09, 0xf1, 0x32, 0xeb, 0xe4, 0x41, 0x01, 0xe2, 0xf1, 0xac, 0x63, 0xf2, 0xb5,
-	0x7f, 0x72, 0x60, 0x65, 0x40, 0x33, 0x76, 0x1a, 0xa6, 0x16, 0xed, 0xf8, 0xa6, 0x63, 0xff, 0x47,
-	0x09, 0x37, 0x52, 0x61, 0x0c, 0x29, 0x3f, 0x2c, 0x1c, 0xc6, 0x41, 0x77, 0x71, 0x17, 0xa9, 0xf9,
-	0x57, 0xbe, 0xfc, 0xfc, 0xbf, 0x5f, 0x0e, 0xf6, 0x90, 0x18, 0xa0, 0xda, 0x3e, 0xdd, 0x77, 0x8d,
-	0x60, 0xe6, 0xc2, 0x73, 0xac, 0xa9, 0x92, 0x28, 0x3a, 0xb6, 0x4d, 0x3b, 0xfe, 0x89, 0xf7, 0xc3,
-	0x67, 0xe5, 0x74, 0x1e, 0x48, 0x86, 0x6f, 0xbc, 0x30, 0x3c, 0x8a, 0x24, 0x2c, 0xdb, 0xae, 0x63,
-	0x59, 0x27, 0x7d, 0xfe, 0xf0, 0x31, 0xa8, 0x7a, 0x2c, 0xe9, 0x69, 0x97, 0xc4, 0x3d, 0x7b, 0xa4,
-	0xe3, 0xf4, 0x6d, 0xbf, 0x7a, 0x6a, 0x85, 0xbb, 0x57, 0x41, 0xd7, 0xe3, 0xf6, 0x98, 0x8a, 0x27,
-	0x06, 0xad, 0xb5, 0xa7, 0xa0, 0xda, 0x56, 0x45, 0xc3, 0xb2, 0x74, 0x47, 0x60, 0x6b, 0x26, 0xb5,
-	0x29, 0x6e, 0x80, 0x4a, 0x27, 0xf2, 0xd5, 0xec, 0xa3, 0x85, 0xa9, 0xbc, 0x44, 0x5d, 0x40, 0x01,
-	0xb0, 0xf6, 0x37, 0x0e, 0x2c, 0xa4, 0xa2, 0x40, 0x7b, 0x96, 0x73, 0x8c, 0xa9, 0x7b, 0x68, 0x76,
-	0xe8, 0x89, 0xcf, 0xc0, 0x7f, 0x70, 0x60, 0x79, 0x42, 0x06, 0x46, 0x27, 0xed, 0x89, 0x9f, 0xfe,
-	0x77, 0xca, 0xe0, 0xd6, 0xf8, 0xf4, 0x45, 0xc7, 0x7e, 0x69, 0xee, 0xf7, 0x5d, 0xda, 0xd0, 0xeb,
-	0xf8, 0xc4, 0xfb, 0xe0, 0x47, 0x65, 0xf0, 0x30, 0x9d, 0xfe, 0xde, 0x2b, 0xdf, 0xe9, 0x05, 0x8b,
-	0xea, 0x90, 0x4a, 0xa6, 0x4b, 0x3b, 0xbe, 0xe3, 0x1e, 0xeb, 0x8e, 0x63, 0x79, 0xaa, 0xed, 0xf9,
-	0xc6, 0xc9, 0xdf, 0x95, 0x6a, 0x1f, 0x97, 0xc1, 0x46, 0x9e, 0x43, 0x92, 0x14, 0x39, 0xf1, 0xde,
-	0xf8, 0x4d, 0x19, 0xdc, 0x19, 0x78, 0x43, 0xe8, 0xfb, 0x4e, 0xfc, 0x77, 0x6a, 0x53, 0x3e, 0xf1,
-	0x27, 0xd5, 0x5d, 0x70, 0x69, 0xf2, 0x01, 0x35, 0xeb, 0x0e, 0x1f, 0x4c, 0x3f, 0x28, 0x83, 0xfb,
-	0x19, 0x3b, 0x8a, 0x2a, 0x34, 0x5a, 0x8e, 0x65, 0x76, 0x8e, 0x4f, 0x7c, 0xde, 0xfc, 0x8b, 0x03,
-	0xb5, 0x81, 0x23, 0x82, 0xc2, 0xa5, 0x63, 0xf6, 0x0c, 0xcb, 0xfb, 0xea, 0xac, 0x9c, 0xbf, 0x73,
-	0x41, 0xf1, 0x17, 0x03, 0x74, 0xea, 0xf9, 0xd1, 0xbd, 0xf6, 0xab, 0x70, 0xc5, 0xff, 0x2b, 0x17,
-	0xdc, 0xd0, 0x62, 0x40, 0x2c, 0x4b, 0x74, 0x4f, 0xfc, 0xbc, 0xe7, 0xc1, 0x5c, 0x5b, 0x15, 0x5d,
-	0x6a, 0xf8, 0xb4, 0x49, 0x8f, 0x90, 0x63, 0xa5, 0xa5, 0x93, 0xe5, 0x20, 0x21, 0x86, 0x1a, 0xb1,
-	0x71, 0x98, 0x06, 0xac, 0x06, 0xb7, 0xb1, 0x61, 0x6b, 0xc3, 0xee, 0x50, 0x2b, 0x05, 0x79, 0x0d,
-	0xac, 0x8f, 0x40, 0x9e, 0x99, 0xf4, 0x48, 0x72, 0x3a, 0xfd, 0x03, 0x6a, 0xfb, 0xc6, 0xf0, 0x5d,
-	0xb8, 0xf6, 0x3b, 0x0e, 0x5c, 0x13, 0x3c, 0xcf, 0x0c, 0x72, 0x8f, 0x85, 0x20, 0xc9, 0xbd, 0xbb,
-	0xe0, 0x52, 0xc7, 0xb1, 0x0f, 0xa9, 0xeb, 0x31, 0x1b, 0x92, 0xe8, 0x02, 0xb3, 0xe9, 0xd7, 0x6a,
-	0x17, 0xae, 0x82, 0x0b, 0xbe, 0xe3, 0x1b, 0x16, 0xf1, 0x9d, 0x57, 0xd4, 0x0e, 0xeb, 0xde, 0x0a,
-	0x3a, 0xcf, 0xde, 0xe9, 0xec, 0x15, 0x5c, 0x03, 0x17, 0x7b, 0xae, 0x73, 0xd0, 0xf3, 0x63, 0x4c,
-	0x85, 0x61, 0x2e, 0x84, 0x2f, 0x23, 0xd0, 0x03, 0x70, 0xb9, 0x93, 0x70, 0x88, 0x81, 0xe1, 0x26,
-	0xca, 0x0f, 0x1a, 0x42, 0x70, 0xed, 0x13, 0x0e, 0xcc, 0xa5, 0xea, 0xc2, 0xb0, 0x1e, 0x9a, 0x26,
-	0x63, 0xc0, 0x2d, 0x70, 0xea, 0x95, 0x69, 0x77, 0x19, 0xb5, 0xd9, 0x47, 0x1b, 0x53, 0xe3, 0x36,
-	0xd6, 0xe3, 0xae, 0x69, 0x77, 0x11, 0xb3, 0x85, 0xf3, 0xe0, 0x5c, 0xdf, 0xa3, 0x2e, 0x61, 0x5a,
-	0x4a, 0x65, 0xa0, 0xa5, 0x34, 0x8d, 0x03, 0x5a, 0x73, 0x82, 0xc0, 0x8d, 0x59, 0x33, 0x7d, 0x21,
-	0xf4, 0x66, 0x73, 0x2c, 0xa3, 0x1f, 0x15, 0x67, 0x31, 0x9e, 0xda, 0x35, 0x37, 0x28, 0x0c, 0xc7,
-	0x80, 0xf1, 0x32, 0xfa, 0xef, 0x8c, 0xf9, 0x69, 0x0d, 0x5c, 0x6a, 0x07, 0x66, 0xac, 0x7b, 0xcd,
-	0xa6, 0xda, 0x4b, 0xd8, 0x06, 0x97, 0xfa, 0x26, 0x79, 0xc1, 0x84, 0x48, 0xd2, 0x09, 0xf2, 0x2a,
-	0x1a, 0x6a, 0xfa, 0xe2, 0x18, 0xd7, 0x2d, 0x95, 0x12, 0xba, 0xd8, 0x37, 0x53, 0x6f, 0xe1, 0xcf,
-	0x38, 0x70, 0xbf, 0x6f, 0x12, 0x27, 0x14, 0xf6, 0x48, 0x14, 0x7e, 0x4a, 0xf6, 0x1d, 0xe2, 0x3b,
-	0xa4, 0x1b, 0x0b, 0x97, 0xd1, 0x88, 0xe1, 0x72, 0x14, 0x32, 0x46, 0x2c, 0xa6, 0x7e, 0x2a, 0x25,
-	0xb4, 0xd6, 0x37, 0x73, 0xb1, 0xf0, 0x63, 0x0e, 0xac, 0xa5, 0xd8, 0x19, 0xdd, 0x2e, 0x79, 0x69,
-	0xba, 0x9e, 0x9f, 0xd4, 0xa8, 0x11, 0xaf, 0x53, 0x8c, 0xd7, 0x3b, 0xf9, 0xbc, 0xa6, 0xab, 0xa9,
-	0x4a, 0x09, 0x2d, 0x25, 0x94, 0x26, 0xc2, 0x46, 0x7d, 0x35, 0x81, 0x8d, 0x65, 0xf8, 0x49, 0x74,
-	0x4e, 0x17, 0xf5, 0x55, 0x8e, 0x74, 0x3b, 0xe4, 0xab, 0xe9, 0x58, 0xf8, 0x3d, 0x0e, 0xac, 0xa4,
-	0xd8, 0x79, 0xd4, 0x27, 0x9d, 0x44, 0xe5, 0x25, 0x1e, 0x53, 0x68, 0xab, 0x67, 0x18, 0xa9, 0xff,
-	0xcf, 0x27, 0x35, 0x4d, 0x23, 0x56, 0x4a, 0x68, 0x21, 0x61, 0x33, 0x01, 0x04, 0x7f, 0xcc, 0x81,
-	0x5b, 0x29, 0x1a, 0x6e, 0x54, 0xc0, 0x92, 0x4e, 0xac, 0x15, 0xc7, 0x54, 0xce, 0x32, 0x2a, 0x5f,
-	0xcf, 0xa7, 0x92, 0xa5, 0x36, 0x2b, 0x25, 0xb4, 0x92, 0xd0, 0x99, 0x02, 0x8c, 0x3d, 0xe3, 0x46,
-	0xfa, 0x2d, 0xe9, 0x38, 0x5d, 0x76, 0x77, 0x0c, 0xf5, 0xe3, 0x28, 0x5c, 0x33, 0xb9, 0x9e, 0xc9,
-	0x51, 0x9f, 0x43, 0xcf, 0x4c, 0x07, 0xc1, 0x6f, 0x82, 0x85, 0x49, 0x2c, 0x7a, 0xc7, 0x11, 0x83,
-	0x73, 0x8c, 0xc1, 0x5b, 0xc5, 0x19, 0xa4, 0xe5, 0x6b, 0xa5, 0x84, 0xaa, 0x63, 0xa3, 0x47, 0x00,
-	0xf8, 0x2d, 0xb0, 0x38, 0x3e, 0x72, 0xcf, 0x35, 0x6d, 0x3f, 0x1a, 0x1a, 0xb0, 0xa1, 0xdf, 0x2e,
-	0x3a, 0xf4, 0x88, 0xf8, 0xad, 0x94, 0xd0, 0xdc, 0xc8, 0xd8, 0x03, 0x04, 0xb4, 0xc0, 0x5c, 0xdf,
-	0x24, 0xdd, 0xe8, 0xa0, 0x26, 0x5e, 0x28, 0x05, 0x13, 0xd6, 0x79, 0xf5, 0x3c, 0x1b, 0x78, 0x33,
-	0x63, 0xe0, 0x49, 0x12, 0xb2, 0x52, 0x42, 0xd7, 0xfb, 0xe6, 0x44, 0x71, 0xf9, 0xe3, 0x30, 0xfd,
-	0x92, 0xe1, 0x92, 0xa5, 0xe9, 0xc5, 0x9a, 0x6e, 0x34, 0xf2, 0x05, 0x36, 0xf2, 0xff, 0x15, 0x18,
-	0x79, 0xb2, 0x2a, 0x1c, 0x66, 0x5e, 0x8e, 0x72, 0xfc, 0x11, 0x4b, 0xbc, 0x84, 0x4c, 0x97, 0x29,
-	0x5a, 0xc4, 0x0b, 0x25, 0xad, 0x88, 0xc8, 0x45, 0x46, 0xe4, 0x7f, 0x0b, 0x10, 0x19, 0x17, 0xc4,
-	0xc2, 0x9c, 0xcb, 0x10, 0xcc, 0x7e, 0x18, 0x6e, 0xa0, 0x03, 0x06, 0x51, 0x19, 0x34, 0x58, 0x97,
-	0x21, 0x89, 0x59, 0x46, 0xe2, 0x71, 0x11, 0x12, 0x93, 0x94, 0x29, 0xa5, 0x84, 0x96, 0x53, 0x3c,
-	0x26, 0x8a, 0x57, 0x3f, 0x0d, 0x77, 0xcf, 0x71, 0x2a, 0x9d, 0xb8, 0x0e, 0x21, 0x07, 0xbe, 0xe5,
-	0x45, 0x84, 0x2e, 0x31, 0x42, 0x5f, 0xfb, 0x02, 0x84, 0xc6, 0xb5, 0x22, 0xa5, 0x84, 0x6e, 0x8d,
-	0xb3, 0x1a, 0xe0, 0x7c, 0x2b, 0x2a, 0x97, 0x7f, 0xcf, 0x81, 0xc7, 0xc3, 0x71, 0x62, 0x4a, 0x03,
-	0x31, 0x98, 0xd4, 0x40, 0xba, 0xb1, 0xd6, 0x40, 0x7c, 0xc7, 0xb1, 0x3c, 0x62, 0x86, 0xf2, 0x4b,
-	0xc4, 0x94, 0x67, 0x4c, 0x9f, 0x16, 0x8a, 0x5f, 0x21, 0x45, 0x47, 0x29, 0xa1, 0x87, 0xe9, 0xa0,
-	0x16, 0x93, 0x81, 0x3e, 0xe3, 0xc0, 0x9b, 0x85, 0xe6, 0x30, 0x70, 0x77, 0xc8, 0xff, 0x32, 0xe3,
-	0xbf, 0xf3, 0xa5, 0xf9, 0x0f, 0x97, 0x91, 0x4a, 0x09, 0x6d, 0xe4, 0x91, 0x1f, 0x29, 0x3c, 0x3f,
-	0xe5, 0xc0, 0x83, 0x34, 0x73, 0xa3, 0x1f, 0xdc, 0x3c, 0x12, 0x69, 0x23, 0xa5, 0x47, 0x87, 0x84,
-	0x21, 0x23, 0xfc, 0x6e, 0x01, 0xc2, 0x59, 0x1a, 0x89, 0x52, 0x42, 0x77, 0x06, 0x44, 0x33, 0xd5,
-	0x94, 0x5f, 0x73, 0x60, 0x33, 0x27, 0x73, 0x4d, 0xe3, 0x80, 0xf4, 0x98, 0x9c, 0x10, 0x91, 0xbc,
-	0xc2, 0x48, 0x6e, 0x7d, 0x99, 0xfc, 0x1d, 0x56, 0x26, 0x94, 0x12, 0xba, 0x9f, 0x91, 0xc4, 0xaa,
-	0x71, 0x90, 0x96, 0x31, 0x7e, 0xc2, 0x81, 0x3b, 0x69, 0xaa, 0xbd, 0xa4, 0xda, 0x1f, 0x8b, 0xfb,
-	0x55, 0xc6, 0xf0, 0x49, 0x01, 0x86, 0xd3, 0x24, 0x03, 0xa5, 0x84, 0x6a, 0x03, 0x6a, 0x53, 0x85,
-	0x85, 0xef, 0x72, 0x60, 0x35, 0xcd, 0xc9, 0xa7, 0x9e, 0x1f, 0xb0, 0xb1, 0x87, 0xf6, 0xe3, 0x6b,
-	0xb9, 0xa7, 0x5f, 0x46, 0xfd, 0xae, 0x94, 0xd0, 0xe2, 0x80, 0xc9, 0xa4, 0x02, 0xdf, 0x05, 0xf3,
-	0x69, 0x0e, 0xf1, 0x3d, 0x37, 0x3e, 0x87, 0xae, 0xe7, 0x14, 0xad, 0xd3, 0x0a, 0xe8, 0xf0, 0xd8,
-	0x9d, 0x52, 0x5c, 0x5b, 0xa0, 0xda, 0x37, 0x83, 0x4b, 0x98, 0xe1, 0x53, 0x62, 0xd3, 0x23, 0xe2,
-	0x3a, 0x56, 0x7c, 0xdd, 0xb8, 0x91, 0x53, 0x26, 0x4c, 0x2d, 0x5d, 0x95, 0x12, 0xba, 0xda, 0x37,
-	0xc7, 0x1b, 0xe1, 0x31, 0x3b, 0xe4, 0x47, 0x47, 0xf3, 0x8c, 0xc3, 0x78, 0xc8, 0x6a, 0xae, 0x87,
-	0x33, 0x0a, 0xe2, 0x70, 0xa2, 0x93, 0x01, 0xf0, 0x23, 0xb0, 0x3c, 0x69, 0xa2, 0xac, 0x60, 0x8e,
-	0x06, 0x9f, 0xcb, 0x3d, 0x60, 0x32, 0x8b, 0x6d, 0xa5, 0x84, 0x6e, 0x8e, 0xce, 0x7a, 0x00, 0x81,
-	0x3f, 0x0f, 0xb7, 0x90, 0x51, 0x06, 0x87, 0x26, 0x3d, 0x22, 0xdd, 0x74, 0x41, 0x1e, 0xb1, 0xb9,
-	0xc9, 0xd8, 0x88, 0x45, 0xd9, 0x64, 0xd4, 0xf5, 0x4a, 0x09, 0xdd, 0x1e, 0x21, 0x36, 0x19, 0x0d,
-	0x7f, 0xc5, 0x81, 0x8d, 0x74, 0x0a, 0x9a, 0x83, 0x42, 0x90, 0x18, 0x47, 0x1e, 0x71, 0xcc, 0x6e,
-	0x27, 0x5e, 0x16, 0x51, 0x56, 0xce, 0xe7, 0x96, 0x10, 0xc5, 0xbe, 0xdc, 0x2a, 0x25, 0x74, 0x6f,
-	0x90, 0xa5, 0x69, 0xec, 0x91, 0xa7, 0x99, 0xdd, 0xce, 0xd0, 0x57, 0xde, 0x4f, 0x38, 0x70, 0x7b,
-	0xf2, 0x95, 0xa1, 0xeb, 0x11, 0xca, 0x4a, 0xd6, 0x88, 0xde, 0x42, 0xe1, 0x2b, 0xd4, 0xe4, 0x0f,
-	0xaa, 0xc3, 0x57, 0xa8, 0x04, 0xd3, 0xf5, 0xd2, 0x1f, 0x5d, 0xfd, 0x30, 0xad, 0x83, 0xf3, 0xd6,
-	0x77, 0xd8, 0x69, 0x16, 0x47, 0x31, 0x62, 0xb1, 0x98, 0xbb, 0x74, 0x27, 0x7f, 0x9d, 0x8c, 0x32,
-	0x7a, 0xf2, 0x97, 0xcb, 0x0f, 0xc0, 0x65, 0x83, 0x89, 0x35, 0x64, 0x20, 0x88, 0x54, 0x97, 0xd8,
-	0x48, 0xd3, 0x45, 0x8d, 0x89, 0xf2, 0x8e, 0x52, 0x42, 0xbc, 0x31, 0xd2, 0x10, 0x6f, 0x89, 0xe9,
-	0x14, 0x88, 0x3c, 0xcb, 0xae, 0xc7, 0xd1, 0xcc, 0x96, 0x73, 0x17, 0x6c, 0x86, 0x10, 0x12, 0x6e,
-	0x89, 0x59, 0x4a, 0x49, 0x74, 0x55, 0x9e, 0x40, 0x22, 0x51, 0x01, 0x42, 0x1e, 0x2b, 0xb9, 0x71,
-	0xce, 0xd6, 0x47, 0xc2, 0x38, 0x67, 0x63, 0xb6, 0xce, 0x82, 0xd3, 0xac, 0xc7, 0xa7, 0xa7, 0x66,
-	0xca, 0x7c, 0x25, 0xb8, 0xd6, 0x26, 0x35, 0xe4, 0x3e, 0xf5, 0x93, 0xb2, 0x81, 0x45, 0x7e, 0xfd,
-	0x2f, 0x17, 0x07, 0xff, 0x52, 0x13, 0x1f, 0xd6, 0x70, 0x15, 0x2c, 0x4a, 0x2a, 0x16, 0xb5, 0x67,
-	0x32, 0x22, 0x48, 0xc6, 0x5a, 0x1b, 0x89, 0x32, 0x69, 0x37, 0x71, 0x4b, 0x16, 0xd5, 0x6d, 0x55,
-	0x96, 0xf8, 0x12, 0x5c, 0x00, 0xd5, 0x71, 0x08, 0x96, 0xd1, 0x33, 0x19, 0xf1, 0x1c, 0x5c, 0x01,
-	0x0b, 0xe3, 0xad, 0xbb, 0xed, 0x2d, 0x19, 0x35, 0x65, 0x5d, 0xc6, 0x7c, 0x19, 0xbe, 0x01, 0x36,
-	0xc7, 0x11, 0x92, 0xa0, 0x0b, 0x5b, 0x02, 0x96, 0x49, 0x4b, 0xc3, 0xfa, 0x0e, 0x92, 0x31, 0xc1,
-	0x72, 0x7d, 0x9b, 0x28, 0x1a, 0xd6, 0x65, 0x89, 0xaf, 0xc0, 0xd7, 0xc1, 0x6b, 0x19, 0x46, 0x8d,
-	0x3d, 0xfc, 0x5e, 0x7d, 0xc8, 0xe2, 0x14, 0x7c, 0x04, 0x36, 0xb2, 0x2c, 0xb4, 0xe6, 0x8e, 0x26,
-	0x6d, 0x0d, 0xd9, 0x9c, 0x86, 0x0f, 0xc0, 0xdd, 0x22, 0xd4, 0x90, 0x84, 0xf9, 0x33, 0xf0, 0x1e,
-	0xb8, 0x95, 0x4b, 0x29, 0x40, 0x9e, 0x85, 0x77, 0x40, 0x6d, 0x1c, 0x29, 0xb4, 0x5a, 0x75, 0x55,
-	0x14, 0x74, 0x55, 0x6b, 0x12, 0x45, 0xd7, 0x5b, 0xfc, 0x0c, 0xbc, 0x0d, 0x56, 0xb3, 0x71, 0xba,
-	0xd8, 0xe2, 0xcf, 0x4d, 0x86, 0x3d, 0x57, 0x9b, 0x92, 0xf6, 0x1c, 0x13, 0x49, 0xc6, 0xbb, 0xba,
-	0xd6, 0xe2, 0x01, 0x7c, 0x0d, 0xdc, 0xcb, 0xe0, 0x87, 0xdf, 0xab, 0x87, 0x31, 0x63, 0x1c, 0xcf,
-	0xe7, 0x38, 0x78, 0x30, 0x75, 0x59, 0xc2, 0x8a, 0xba, 0xad, 0xf3, 0x17, 0xe0, 0x9b, 0xe0, 0xf5,
-	0x42, 0xfd, 0xa7, 0x5d, 0x7c, 0x31, 0x67, 0x1c, 0x24, 0x4b, 0xea, 0x70, 0xe8, 0x67, 0x8b, 0x06,
-	0x65, 0x47, 0x6c, 0xf1, 0x97, 0x0a, 0x05, 0x25, 0x40, 0xf2, 0x85, 0xdd, 0x13, 0xa0, 0x2f, 0xc3,
-	0x27, 0xe0, 0xed, 0x2f, 0xe2, 0x9e, 0x68, 0x3d, 0xd4, 0x65, 0x8c, 0x79, 0x08, 0xff, 0x07, 0xdc,
-	0x2f, 0x62, 0x2c, 0xbc, 0xdf, 0x46, 0x32, 0x7f, 0x05, 0xde, 0x05, 0x6b, 0x19, 0x70, 0x69, 0xaf,
-	0x29, 0x34, 0x34, 0x69, 0x8b, 0xbf, 0x9a, 0x93, 0xe2, 0xa2, 0x80, 0xb1, 0xd0, 0x94, 0x90, 0x40,
-	0x76, 0xe5, 0x3d, 0xdc, 0x12, 0x44, 0x19, 0xf3, 0xd7, 0x72, 0xa2, 0x36, 0xb0, 0x49, 0xc7, 0xe0,
-	0x3a, 0x7c, 0x0c, 0xde, 0xcc, 0xb0, 0x92, 0xeb, 0x02, 0xd6, 0x55, 0x11, 0xcb, 0x02, 0x12, 0x95,
-	0x21, 0xcb, 0x1b, 0x85, 0xe2, 0x1d, 0xd9, 0x0b, 0xa2, 0x22, 0xf3, 0xd5, 0x1c, 0x6f, 0x85, 0x16,
-	0x0d, 0xb9, 0xa1, 0xa1, 0x3d, 0x69, 0x8b, 0x9f, 0x2b, 0x34, 0x00, 0xf3, 0x2c, 0x09, 0x07, 0xb8,
-	0x99, 0x33, 0x99, 0xd0, 0x42, 0xac, 0xb7, 0xb1, 0x3e, 0x92, 0xbc, 0xf3, 0x70, 0x1d, 0xdc, 0xc9,
-	0xcd, 0xae, 0x30, 0x8a, 0x0b, 0x70, 0x03, 0xac, 0x17, 0xca, 0xaf, 0x10, 0xbf, 0x98, 0x13, 0xcc,
-	0x01, 0xbe, 0xa1, 0x8a, 0x48, 0xc3, 0xda, 0xb6, 0xce, 0x2f, 0xc1, 0xb7, 0xc0, 0xa3, 0xac, 0x60,
-	0x6a, 0xe2, 0x2e, 0xd2, 0x04, 0x51, 0x19, 0xd9, 0xe7, 0x96, 0x73, 0x72, 0x3f, 0xde, 0x1b, 0x05,
-	0xbd, 0x2e, 0x60, 0x7e, 0x25, 0x67, 0x4d, 0xe1, 0xa6, 0xf6, 0x7c, 0xbb, 0x2e, 0xec, 0xca, 0xfc,
-	0xea, 0x94, 0x7e, 0x35, 0x31, 0xe5, 0x5d, 0x09, 0x93, 0x16, 0xd2, 0xbe, 0xb1, 0xc7, 0xd7, 0xa6,
-	0xa4, 0x62, 0x1a, 0xad, 0xa8, 0x3b, 0x0a, 0x11, 0x9e, 0x09, 0x6a, 0x5d, 0xd8, 0x52, 0xeb, 0xaa,
-	0xbe, 0xc7, 0xaf, 0xc1, 0xb7, 0xc1, 0x1b, 0x39, 0x56, 0x6c, 0x85, 0xa8, 0x22, 0x41, 0xf2, 0x8e,
-	0x8a, 0x75, 0xc4, 0xb6, 0x4e, 0xfe, 0xd6, 0xfa, 0x2f, 0x38, 0x30, 0x3b, 0xfc, 0xef, 0x97, 0x70,
-	0x19, 0xcc, 0x27, 0x7d, 0x61, 0x5d, 0xd0, 0xdb, 0x78, 0xe4, 0xac, 0x9b, 0x07, 0x37, 0x46, 0x01,
-	0xb8, 0x2d, 0x8a, 0xc1, 0xb2, 0xe6, 0x26, 0x36, 0xee, 0xaa, 0xad, 0x96, 0x2c, 0xf1, 0x65, 0x38,
-	0x07, 0xae, 0x8d, 0x36, 0xca, 0x08, 0x69, 0x88, 0xaf, 0x4c, 0xb2, 0x13, 0xb6, 0x34, 0xc4, 0x8e,
-	0xad, 0xf5, 0xdf, 0x72, 0xa0, 0x22, 0xea, 0x02, 0xbc, 0x02, 0x2e, 0x89, 0xba, 0x30, 0x42, 0xe7,
-	0x3a, 0x80, 0xc1, 0x4b, 0xa1, 0xad, 0x2b, 0x44, 0xd4, 0x9a, 0x4d, 0x59, 0xd4, 0xb5, 0xe0, 0xd0,
-	0xbd, 0x01, 0xae, 0xb0, 0xf7, 0xa2, 0xae, 0x3e, 0x0b, 0xce, 0x62, 0x8c, 0x55, 0xad, 0x19, 0x9c,
-	0xb5, 0x49, 0x43, 0x40, 0x99, 0x20, 0xf9, 0xbd, 0xb6, 0x8c, 0x75, 0xcc, 0x57, 0xe2, 0x86, 0x16,
-	0x92, 0x1b, 0x6a, 0xbb, 0x41, 0x70, 0xbb, 0xd5, 0xd2, 0x90, 0xce, 0x9f, 0x8a, 0x1b, 0x74, 0x14,
-	0xe4, 0xbf, 0x44, 0x24, 0xf9, 0x99, 0x1a, 0x6c, 0x1c, 0xa7, 0xe3, 0xb1, 0xdb, 0xad, 0x1d, 0x24,
-	0x48, 0x32, 0xd9, 0x12, 0x9a, 0x4d, 0x19, 0xf1, 0x67, 0xd6, 0xff, 0x54, 0x01, 0xd7, 0x26, 0x7e,
-	0x89, 0x0a, 0xf6, 0x31, 0xb5, 0xa9, 0xcb, 0x3b, 0x61, 0x04, 0x88, 0xdc, 0x44, 0x5a, 0xbd, 0x4e,
-	0x76, 0xd5, 0xa6, 0x34, 0x32, 0xad, 0x55, 0xb0, 0x38, 0x0d, 0x88, 0xeb, 0x82, 0xb8, 0xcb, 0x73,
-	0xf0, 0x16, 0x58, 0x99, 0x06, 0x11, 0x9e, 0x63, 0x12, 0x5c, 0xd6, 0xf9, 0x72, 0x70, 0x32, 0x4e,
-	0x43, 0xb5, 0x84, 0x1d, 0x19, 0x49, 0x6d, 0x7d, 0x8f, 0xaf, 0x64, 0x8d, 0x27, 0x37, 0x04, 0xb5,
-	0xce, 0x9f, 0x0a, 0xae, 0x31, 0xd3, 0x20, 0x4f, 0x55, 0x24, 0xf0, 0xa7, 0xe1, 0x1a, 0x58, 0x9e,
-	0x86, 0x60, 0xd1, 0x45, 0x12, 0x7f, 0x26, 0x38, 0xf9, 0xa7, 0x81, 0x1a, 0x82, 0xae, 0xcb, 0xa8,
-	0xa1, 0x61, 0x9d, 0x3f, 0x9b, 0x35, 0xbd, 0x06, 0x26, 0xba, 0x2c, 0x34, 0x30, 0x3f, 0x93, 0x85,
-	0xd2, 0x5a, 0x78, 0x47, 0x6e, 0xaa, 0x32, 0x7f, 0x2e, 0x8b, 0xba, 0xb6, 0xab, 0x0b, 0x3c, 0xc8,
-	0x9c, 0x9c, 0xd0, 0xd8, 0xe6, 0xcf, 0x6f, 0x7d, 0xf0, 0x87, 0xcf, 0x97, 0xb8, 0x3f, 0x7e, 0xbe,
-	0xc4, 0xfd, 0xf9, 0xf3, 0x25, 0xee, 0x7d, 0x6d, 0xdf, 0xf4, 0x3f, 0xec, 0xbf, 0xd8, 0xe8, 0x38,
-	0x07, 0x9b, 0xfb, 0xae, 0x71, 0x68, 0x86, 0x25, 0x99, 0x61, 0x6d, 0x26, 0xbf, 0x0d, 0x30, 0x7a,
-	0xe6, 0xe6, 0x3e, 0xb5, 0x37, 0xd9, 0x0f, 0x01, 0x36, 0xf7, 0x9d, 0x91, 0x1f, 0x0b, 0x3c, 0x49,
-	0x3d, 0x1e, 0x3e, 0x7c, 0x71, 0x86, 0xc1, 0xde, 0xf8, 0x77, 0x00, 0x00, 0x00, 0xff, 0xff, 0xa4,
-	0x95, 0xb6, 0x98, 0x5c, 0x30, 0x00, 0x00,
+	// 3092 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe4, 0x5b, 0xdb, 0x6f, 0xdc, 0x58,
+	0x19, 0x1f, 0x4f, 0x9a, 0x36, 0x3d, 0x6d, 0x53, 0xf7, 0xf4, 0x36, 0x69, 0xee, 0x93, 0x5e, 0xd3,
+	0x25, 0xd9, 0x76, 0x97, 0xdd, 0x42, 0x17, 0x16, 0x8f, 0xed, 0xc4, 0x6e, 0x66, 0xc6, 0xd3, 0x73,
+	0x3c, 0x2d, 0x59, 0x69, 0x75, 0xe4, 0xce, 0x9c, 0xa6, 0x56, 0x1d, 0x7b, 0xb0, 0x3d, 0x09, 0x11,
+	0x42, 0x2b, 0xae, 0x42, 0xda, 0x05, 0xc1, 0x03, 0x12, 0x12, 0x12, 0x12, 0x62, 0x91, 0x78, 0xe0,
+	0x15, 0xed, 0x33, 0x4f, 0xf0, 0x88, 0xf8, 0x0b, 0xd0, 0xfe, 0x0f, 0xbc, 0x20, 0x10, 0xc8, 0xc7,
+	0x97, 0xf1, 0x5c, 0xed, 0x2d, 0xf0, 0x92, 0x7d, 0xcb, 0xf8, 0xfc, 0xbe, 0xf3, 0xfd, 0xce, 0xf9,
+	0xbe, 0x73, 0xf9, 0x7e, 0x76, 0xc0, 0x1d, 0x9f, 0x5a, 0xb4, 0xe3, 0xb8, 0xfe, 0x66, 0xd7, 0x33,
+	0xf6, 0x28, 0x3d, 0xa0, 0xb6, 0xef, 0x6d, 0x1e, 0xdc, 0x4b, 0xff, 0xdc, 0xe8, 0xb8, 0x8e, 0xef,
+	0xc0, 0xab, 0x31, 0x74, 0x23, 0xdd, 0x76, 0x70, 0xaf, 0xbc, 0x0e, 0x60, 0x53, 0xad, 0x18, 0xb6,
+	0x4d, 0x5d, 0xd1, 0x32, 0x5b, 0x2f, 0xe5, 0xa0, 0x05, 0x5e, 0x02, 0xd3, 0x86, 0x45, 0x5d, 0xbf,
+	0xc4, 0xad, 0x70, 0xb7, 0x4f, 0xa3, 0xf0, 0x47, 0x79, 0x0b, 0xdc, 0x6e, 0xaa, 0x9a, 0xfd, 0xcc,
+	0x31, 0xdc, 0xb6, 0xe8, 0xec, 0x77, 0x2c, 0xea, 0xd3, 0x6d, 0x47, 0x77, 0x24, 0xc3, 0x7b, 0x11,
+	0x3e, 0xec, 0xf5, 0x70, 0x0d, 0xcc, 0x74, 0x3d, 0xea, 0xda, 0xc6, 0x3e, 0x8d, 0x3a, 0x49, 0x7e,
+	0x97, 0x6f, 0x80, 0xb5, 0xa4, 0x1f, 0xa1, 0xdd, 0xde, 0x32, 0x5d, 0xcf, 0x47, 0xd4, 0x73, 0xba,
+	0x6e, 0x8b, 0xf6, 0xba, 0x28, 0xaf, 0xa7, 0xdc, 0x0d, 0xc2, 0xaa, 0x86, 0x9f, 0x26, 0x5c, 0x7e,
+	0x17, 0xac, 0x26, 0x58, 0x4c, 0x7d, 0xd1, 0xa5, 0x6d, 0x6a, 0xfb, 0xa6, 0x61, 0xe1, 0xee, 0xb3,
+	0x7d, 0xd3, 0xcf, 0xe6, 0x94, 0xee, 0xe0, 0x71, 0x97, 0x7a, 0xbe, 0xe9, 0xd8, 0xb6, 0x61, 0xba,
+	0x34, 0x6f, 0x07, 0xdf, 0x06, 0x37, 0x92, 0x0e, 0x10, 0xdd, 0x33, 0xbd, 0x80, 0xe0, 0x0b, 0xc3,
+	0xb2, 0xa8, 0xbd, 0x97, 0xb7, 0x13, 0x38, 0x07, 0x66, 0xf6, 0x9f, 0x1b, 0xc4, 0x3f, 0xea, 0xd0,
+	0x52, 0x91, 0xb5, 0x9d, 0xda, 0x7f, 0x6e, 0xe8, 0x47, 0x1d, 0x0a, 0x17, 0x01, 0xb0, 0x9c, 0x3d,
+	0xd3, 0x26, 0xcf, 0x2d, 0xe7, 0xb0, 0x34, 0xc5, 0x1a, 0x4f, 0xb3, 0x27, 0x5b, 0x96, 0x73, 0x18,
+	0xf2, 0x47, 0xb4, 0xe5, 0x1c, 0x50, 0xf7, 0x48, 0x74, 0xda, 0xd4, 0x13, 0x1d, 0xdb, 0x37, 0xed,
+	0x2e, 0xcd, 0x19, 0x94, 0x87, 0x60, 0x71, 0xa8, 0x83, 0xce, 0x51, 0x4e, 0xe3, 0x77, 0xc0, 0xd2,
+	0x80, 0x71, 0xc3, 0x35, 0x6d, 0x3f, 0xa7, 0x75, 0x19, 0xf0, 0x92, 0xe9, 0x31, 0xe3, 0x1a, 0xf5,
+	0x8d, 0xb6, 0xe1, 0x1b, 0x70, 0x16, 0x14, 0xcd, 0x76, 0x84, 0x2c, 0x9a, 0xed, 0xb2, 0x01, 0x4a,
+	0x31, 0x26, 0xce, 0x81, 0x04, 0x2b, 0x83, 0x19, 0x37, 0x7a, 0xc6, 0x2c, 0x66, 0xef, 0xdf, 0xd9,
+	0x18, 0x93, 0xef, 0x1b, 0x83, 0x9d, 0xa0, 0xc4, 0xb4, 0xfc, 0x12, 0xc0, 0xb8, 0x15, 0xfb, 0xb4,
+	0x83, 0x7d, 0xc3, 0xef, 0x7a, 0xf0, 0x5d, 0x70, 0xd2, 0x63, 0x7f, 0x45, 0x5d, 0xdf, 0xca, 0xec,
+	0x3a, 0x34, 0x44, 0x91, 0x59, 0xb0, 0x96, 0xa8, 0xeb, 0x3a, 0x6e, 0x14, 0xd0, 0xf0, 0x47, 0xf9,
+	0x63, 0x0e, 0x5c, 0x69, 0xaa, 0x29, 0x13, 0xd7, 0xa7, 0xed, 0x70, 0xaa, 0x64, 0x30, 0xb3, 0x1f,
+	0x0d, 0x8d, 0xf9, 0x3c, 0x93, 0x63, 0x38, 0xf1, 0x5c, 0xa0, 0xc4, 0x14, 0x8a, 0x09, 0xf1, 0x22,
+	0xeb, 0xe4, 0x6e, 0x0e, 0xe2, 0xf1, 0xa8, 0x63, 0xf2, 0xe5, 0x7f, 0x71, 0x60, 0xa5, 0x47, 0x33,
+	0x9e, 0x34, 0x4c, 0x2d, 0xda, 0x0a, 0x56, 0xc8, 0xff, 0x94, 0x70, 0x2d, 0x15, 0xc6, 0x90, 0xf2,
+	0xbd, 0xdc, 0x61, 0xec, 0x75, 0x17, 0x77, 0x91, 0x1a, 0xff, 0xd4, 0xab, 0x8f, 0xff, 0x07, 0xc5,
+	0x60, 0x13, 0x8a, 0x01, 0xaa, 0xed, 0xd3, 0x3d, 0xd7, 0x08, 0x46, 0x2e, 0x3c, 0xc5, 0x9a, 0x2a,
+	0x89, 0xa2, 0x63, 0xdb, 0xb4, 0xe5, 0x1f, 0xfb, 0x79, 0xf8, 0xa4, 0x98, 0xce, 0x03, 0xc9, 0xf0,
+	0x8d, 0x67, 0x86, 0x47, 0x91, 0x84, 0x65, 0xdb, 0x75, 0x2c, 0xeb, 0xb8, 0x8f, 0x1f, 0x3e, 0x00,
+	0x25, 0x8f, 0x25, 0x3d, 0x6d, 0x93, 0xb8, 0x67, 0x8f, 0xb4, 0x9c, 0xae, 0xed, 0x97, 0x4e, 0xac,
+	0x70, 0xb7, 0xa7, 0xd0, 0x95, 0xb8, 0x3d, 0xa6, 0xe2, 0x89, 0x41, 0x6b, 0xf9, 0x11, 0x28, 0x35,
+	0x55, 0xd1, 0xb0, 0x2c, 0xdd, 0x11, 0xd8, 0x9a, 0x49, 0x6d, 0x8a, 0x1b, 0x60, 0xaa, 0x15, 0xcd,
+	0xd5, 0xec, 0xfd, 0x85, 0xb1, 0xbc, 0x44, 0x5d, 0x40, 0x01, 0xb0, 0xfc, 0xe3, 0x69, 0xb0, 0x90,
+	0x8a, 0x02, 0xed, 0x58, 0xce, 0x11, 0xa6, 0xee, 0x81, 0xd9, 0xa2, 0xc7, 0x3e, 0x02, 0x7b, 0xe0,
+	0x5c, 0x9b, 0x0d, 0x98, 0xec, 0x53, 0xff, 0x85, 0xd3, 0x66, 0xd3, 0x3e, 0x7b, 0xbf, 0x32, 0xb6,
+	0xaf, 0x49, 0x13, 0xb5, 0x11, 0x3e, 0xaa, 0xb1, 0x9e, 0xd0, 0xd9, 0x76, 0xea, 0x17, 0x34, 0xc0,
+	0x99, 0xc8, 0x11, 0x3b, 0x86, 0xa7, 0x99, 0x9b, 0xaf, 0xfd, 0x37, 0x6e, 0x82, 0xf3, 0x1b, 0x81,
+	0x76, 0xf2, 0x77, 0x99, 0x80, 0xb3, 0x69, 0x02, 0x70, 0x11, 0xcc, 0x49, 0x72, 0xa3, 0xaa, 0xed,
+	0x92, 0x9a, 0xac, 0x2b, 0x9a, 0x44, 0x9a, 0x75, 0xdc, 0x90, 0x45, 0x75, 0x4b, 0x95, 0x25, 0xbe,
+	0x00, 0xaf, 0x00, 0xd8, 0xdf, 0x2c, 0x34, 0x75, 0x8d, 0xe7, 0x60, 0x09, 0x5c, 0xea, 0x7f, 0x5e,
+	0x13, 0xea, 0x4d, 0xa1, 0xca, 0x17, 0xcb, 0x14, 0x80, 0x9e, 0x6b, 0x38, 0x0f, 0xae, 0x46, 0x38,
+	0x7d, 0xb7, 0x21, 0x0f, 0x74, 0xbe, 0x04, 0xae, 0xa5, 0x1b, 0xd5, 0x3a, 0xd6, 0x85, 0x6a, 0x95,
+	0x60, 0x11, 0xa9, 0x0d, 0x9d, 0xe7, 0xe0, 0x35, 0x70, 0x25, 0xdd, 0x2e, 0xd4, 0x84, 0xf7, 0xb4,
+	0x3a, 0x91, 0x45, 0xcc, 0x17, 0xcb, 0xff, 0xe4, 0xc0, 0xf2, 0x88, 0x5d, 0x21, 0xba, 0xfd, 0x1c,
+	0xfb, 0x4d, 0xf1, 0x3b, 0x45, 0x70, 0x7d, 0x78, 0xf8, 0xa2, 0x63, 0x3f, 0x37, 0xf7, 0xba, 0x2e,
+	0xad, 0xe9, 0x55, 0x7c, 0xec, 0xe7, 0xe0, 0x27, 0x45, 0x70, 0x2f, 0xbd, 0x04, 0xbc, 0x97, 0xbe,
+	0xd3, 0x09, 0x36, 0xba, 0x03, 0x2a, 0x99, 0x2e, 0x6d, 0xf9, 0x8e, 0x7b, 0xa4, 0x3b, 0x8e, 0xe5,
+	0xa9, 0xb6, 0xe7, 0x1b, 0xc7, 0xff, 0xa4, 0x28, 0x7f, 0x58, 0x04, 0x1b, 0x59, 0x13, 0x92, 0xa4,
+	0xc8, 0xb1, 0x9f, 0x8d, 0xdf, 0x17, 0xc1, 0xcd, 0xde, 0x6c, 0x08, 0x5d, 0xdf, 0x89, 0xff, 0x4e,
+	0x1d, 0x94, 0xc7, 0xfe, 0xec, 0xba, 0x05, 0xce, 0x8f, 0xbe, 0x34, 0xcc, 0xba, 0xfd, 0x97, 0x85,
+	0x1f, 0x16, 0xc1, 0x9d, 0x09, 0x3b, 0x8a, 0x2a, 0xd4, 0x1a, 0x8e, 0x65, 0xb6, 0x8e, 0x8e, 0x7d,
+	0xde, 0xfc, 0x9b, 0x03, 0xe5, 0xde, 0x44, 0x04, 0xc5, 0x64, 0xcb, 0xec, 0x18, 0x96, 0xf7, 0xf9,
+	0x59, 0x39, 0xff, 0xe0, 0x82, 0x82, 0x3c, 0x06, 0xe8, 0xd4, 0xf3, 0xa3, 0x5a, 0xe3, 0xf3, 0x50,
+	0x76, 0xfd, 0x9d, 0x0b, 0x6e, 0xcd, 0x31, 0x20, 0xd6, 0x9a, 0xda, 0xc7, 0x7e, 0xdc, 0xf3, 0x60,
+	0xae, 0xa9, 0x8a, 0x2e, 0x35, 0x7c, 0x5a, 0xa7, 0x87, 0xc8, 0xb1, 0xd2, 0x7a, 0xd8, 0x72, 0x90,
+	0x10, 0x7d, 0x8d, 0xd8, 0x38, 0x48, 0x03, 0x56, 0x83, 0xdb, 0x58, 0xbf, 0xb5, 0x61, 0xb7, 0xa8,
+	0x95, 0x82, 0xbc, 0x06, 0xd6, 0x07, 0x20, 0x4f, 0x4c, 0x7a, 0x28, 0x39, 0xad, 0xee, 0x3e, 0xb5,
+	0x7d, 0xa3, 0xbf, 0x3e, 0x29, 0xff, 0x81, 0x03, 0x97, 0x05, 0xcf, 0x33, 0x83, 0xdc, 0x63, 0x21,
+	0x48, 0x72, 0xef, 0x16, 0x38, 0xdf, 0x72, 0xec, 0x03, 0xea, 0x7a, 0xcc, 0x86, 0x24, 0x5a, 0xcd,
+	0x6c, 0xfa, 0xb1, 0xda, 0x86, 0xab, 0xe0, 0xac, 0xef, 0xf8, 0x86, 0x45, 0x7c, 0xe7, 0x25, 0xb5,
+	0x43, 0x2d, 0x62, 0x0a, 0x9d, 0x61, 0xcf, 0x74, 0xf6, 0x08, 0xae, 0x81, 0x73, 0x1d, 0xd7, 0xd9,
+	0xef, 0xf8, 0x31, 0x66, 0x8a, 0x61, 0xce, 0x86, 0x0f, 0x23, 0xd0, 0x5d, 0x70, 0xa1, 0x95, 0x70,
+	0x88, 0x81, 0xe1, 0x26, 0xca, 0xf7, 0x1a, 0x42, 0x70, 0xf9, 0x23, 0x0e, 0xcc, 0xa5, 0x6a, 0xf5,
+	0xb0, 0x46, 0x1d, 0x27, 0x2d, 0xc1, 0x0a, 0x38, 0xf1, 0xd2, 0xb4, 0xdb, 0x8c, 0xda, 0xec, 0xfd,
+	0x8d, 0xb1, 0x71, 0x1b, 0xea, 0x71, 0xc7, 0xb4, 0xdb, 0x88, 0xd9, 0xc2, 0x79, 0x70, 0xba, 0xeb,
+	0x51, 0x97, 0x30, 0x7d, 0x6b, 0xaa, 0xa7, 0x6f, 0xd5, 0x8d, 0x7d, 0x5a, 0x76, 0x82, 0xc0, 0x0d,
+	0x59, 0x33, 0xcd, 0x27, 0x9c, 0xcd, 0xfa, 0x50, 0x46, 0xdf, 0xcf, 0xcf, 0x62, 0x38, 0xb5, 0xcb,
+	0x6e, 0x50, 0xac, 0x0f, 0x01, 0xe3, 0x65, 0xf4, 0xff, 0xf1, 0xf9, 0xf1, 0x1a, 0x38, 0xdf, 0x0c,
+	0xcc, 0x58, 0xf7, 0x9a, 0x4d, 0xb5, 0xe7, 0xb0, 0x09, 0xce, 0x77, 0x4d, 0xf2, 0x8c, 0xa9, 0xcb,
+	0xa4, 0x15, 0xe4, 0x55, 0xe4, 0xea, 0xee, 0x84, 0x72, 0x6a, 0x50, 0x8c, 0x56, 0x0a, 0xe8, 0x5c,
+	0xd7, 0x4c, 0x3d, 0x85, 0xbf, 0xe4, 0xc0, 0x9d, 0xae, 0x49, 0x9c, 0x50, 0x6c, 0x25, 0x51, 0xf8,
+	0x29, 0xd9, 0x73, 0x88, 0xef, 0x90, 0x76, 0xac, 0x46, 0x47, 0x1e, 0xc3, 0xe5, 0x28, 0x4c, 0xf0,
+	0x98, 0x4f, 0xd2, 0x56, 0x0a, 0x68, 0xad, 0x6b, 0x66, 0x62, 0xe1, 0x87, 0x1c, 0x58, 0x4b, 0xb1,
+	0x33, 0xda, 0x6d, 0xf2, 0xdc, 0x74, 0x3d, 0x3f, 0xd1, 0x0d, 0x22, 0x5e, 0x27, 0x18, 0xaf, 0x77,
+	0xb2, 0x79, 0x8d, 0x97, 0xc8, 0x95, 0x02, 0x5a, 0x4a, 0x28, 0x8d, 0x84, 0x0d, 0xce, 0xd5, 0x08,
+	0x36, 0x96, 0xe1, 0x27, 0xd1, 0x99, 0xce, 0x3b, 0x57, 0x19, 0x7a, 0x7c, 0xdf, 0x5c, 0x8d, 0xc7,
+	0xc2, 0xef, 0x73, 0x60, 0x25, 0xc5, 0xce, 0xa3, 0x3e, 0x69, 0x25, 0xd2, 0x3d, 0xf1, 0x98, 0x6a,
+	0x5e, 0x3a, 0xc9, 0x48, 0x7d, 0x39, 0x9b, 0xd4, 0x38, 0xe1, 0x5f, 0x29, 0xa0, 0x85, 0x84, 0xcd,
+	0x08, 0x10, 0xfc, 0x29, 0x07, 0xae, 0xa7, 0x68, 0xb8, 0x51, 0x01, 0x4b, 0x5a, 0xb1, 0x7e, 0x1f,
+	0x53, 0x39, 0xc5, 0xa8, 0x7c, 0x35, 0x9b, 0xca, 0xa4, 0x37, 0x00, 0x4a, 0x01, 0xad, 0x24, 0x74,
+	0xc6, 0x00, 0xe3, 0x99, 0x71, 0x23, 0x4d, 0x9d, 0xb4, 0x9c, 0x36, 0xbb, 0x3b, 0x86, 0x9a, 0x7e,
+	0x14, 0xae, 0x99, 0xcc, 0x99, 0xc9, 0x78, 0x23, 0x10, 0xce, 0xcc, 0x78, 0x10, 0xfc, 0x26, 0x58,
+	0x18, 0xc5, 0xa2, 0x73, 0x14, 0x31, 0x38, 0xcd, 0x18, 0xbc, 0x95, 0x9f, 0x41, 0xfa, 0x95, 0x82,
+	0x52, 0x40, 0xa5, 0x21, 0xef, 0x11, 0x00, 0x7e, 0x0b, 0x2c, 0x0e, 0x7b, 0xee, 0xb8, 0xa6, 0xed,
+	0x47, 0xae, 0x01, 0x73, 0xfd, 0x76, 0x5e, 0xd7, 0x03, 0x2f, 0x24, 0x94, 0x02, 0x9a, 0x1b, 0xf0,
+	0xdd, 0x43, 0x40, 0x0b, 0xcc, 0x75, 0x4d, 0xd2, 0x8e, 0x0e, 0x6a, 0xe2, 0x85, 0xf2, 0x3c, 0x61,
+	0x9d, 0x97, 0xce, 0x30, 0xc7, 0x9b, 0x39, 0x14, 0xa1, 0xb4, 0xac, 0xaf, 0x14, 0xd0, 0x95, 0xae,
+	0x39, 0x52, 0xf0, 0xff, 0x30, 0x4c, 0xbf, 0xc4, 0x5d, 0xb2, 0x34, 0xbd, 0x58, 0x67, 0x8f, 0x3c,
+	0x9f, 0x65, 0x9e, 0xbf, 0x94, 0xc3, 0xf3, 0x68, 0xa5, 0x3e, 0xcc, 0xbc, 0x0c, 0x35, 0xff, 0x03,
+	0x96, 0x78, 0x09, 0x99, 0x48, 0x0b, 0xf3, 0x42, 0x59, 0x2b, 0x22, 0x72, 0x8e, 0x11, 0xf9, 0xe2,
+	0x2b, 0x89, 0x62, 0x61, 0xce, 0x4d, 0x10, 0x31, 0x7f, 0x14, 0x6e, 0xa0, 0x3d, 0x06, 0x51, 0x19,
+	0xd4, 0x5b, 0x97, 0x21, 0x89, 0x59, 0x46, 0xe2, 0x41, 0x1e, 0x12, 0xa3, 0x94, 0x29, 0xa5, 0x80,
+	0x96, 0x53, 0x3c, 0x46, 0x8a, 0x57, 0xbf, 0x08, 0x77, 0xcf, 0x61, 0x2a, 0xad, 0xb8, 0x0e, 0x21,
+	0xfb, 0xbe, 0xe5, 0x45, 0x84, 0xce, 0x33, 0x42, 0x5f, 0xf9, 0x0c, 0x84, 0x86, 0xb5, 0x22, 0xa5,
+	0x80, 0xae, 0x0f, 0xb3, 0xea, 0xe1, 0x7c, 0x2b, 0x2a, 0x97, 0xff, 0xc8, 0x81, 0x07, 0xfd, 0x71,
+	0x62, 0x4a, 0x03, 0x31, 0x98, 0xd4, 0x40, 0xda, 0xb1, 0xd6, 0x40, 0x7c, 0xc7, 0xb1, 0x3c, 0x62,
+	0x86, 0xf2, 0x4b, 0xc4, 0x94, 0x67, 0x4c, 0x1f, 0xe5, 0x8a, 0x5f, 0x2e, 0x45, 0x47, 0x29, 0xa0,
+	0x7b, 0xe9, 0xa0, 0xe6, 0x93, 0x81, 0x3e, 0xe1, 0xc0, 0x9b, 0xb9, 0xc6, 0xd0, 0x9b, 0xee, 0x90,
+	0xff, 0x05, 0xc6, 0x7f, 0xfb, 0x95, 0xf9, 0xf7, 0x97, 0x91, 0x4a, 0x01, 0x6d, 0x64, 0x91, 0x1f,
+	0x28, 0x3c, 0x7f, 0xc5, 0x81, 0xbb, 0x69, 0xe6, 0x46, 0x37, 0xb8, 0x79, 0x24, 0xd2, 0x46, 0xea,
+	0x1d, 0x41, 0x48, 0x18, 0x32, 0xc2, 0xef, 0xe6, 0x20, 0x3c, 0x49, 0x23, 0x51, 0x0a, 0xe8, 0x66,
+	0x8f, 0xe8, 0x44, 0x35, 0xe5, 0x77, 0x1c, 0xd8, 0xcc, 0xc8, 0x5c, 0xd3, 0xd8, 0x27, 0x1d, 0x26,
+	0x27, 0x44, 0x24, 0x2f, 0x32, 0x92, 0x95, 0x57, 0xc9, 0xdf, 0x7e, 0x65, 0x42, 0x29, 0xa0, 0x3b,
+	0x13, 0x92, 0x58, 0x35, 0xf6, 0xd3, 0x32, 0xc6, 0xcf, 0x38, 0x70, 0x33, 0x4d, 0xb5, 0x93, 0x54,
+	0xfb, 0x43, 0x71, 0xbf, 0xc4, 0x18, 0x3e, 0xcc, 0xc1, 0x70, 0x9c, 0x64, 0xa0, 0x14, 0x50, 0xb9,
+	0x47, 0x6d, 0xac, 0xb0, 0xf0, 0x5d, 0x0e, 0xac, 0xa6, 0x39, 0xf9, 0xd4, 0xf3, 0x03, 0x36, 0x76,
+	0xdf, 0x7e, 0x7c, 0x39, 0xf3, 0xf4, 0x9b, 0x50, 0xbf, 0x2b, 0x05, 0xb4, 0xd8, 0x63, 0x32, 0xaa,
+	0xc0, 0x77, 0xc1, 0x7c, 0x9a, 0x43, 0x7c, 0xcf, 0x8d, 0xcf, 0xa1, 0x2b, 0x19, 0x45, 0xeb, 0xb8,
+	0x02, 0x3a, 0x3c, 0x76, 0xc7, 0x14, 0xd7, 0x16, 0x28, 0x75, 0xcd, 0xe0, 0x12, 0x66, 0xf8, 0x94,
+	0xd8, 0xf4, 0x90, 0xb8, 0x8e, 0x15, 0x5f, 0x37, 0xae, 0x66, 0x94, 0x09, 0x63, 0x4b, 0x57, 0xa5,
+	0x80, 0x2e, 0x75, 0xcd, 0xe1, 0x46, 0x78, 0xc4, 0x0e, 0xf9, 0x41, 0x6f, 0x9e, 0x71, 0x10, 0xbb,
+	0x2c, 0x65, 0xce, 0xf0, 0x84, 0x82, 0x38, 0x1c, 0xe8, 0x68, 0x00, 0xfc, 0x00, 0x2c, 0x8f, 0x1a,
+	0x28, 0x2b, 0x98, 0x23, 0xe7, 0x73, 0x99, 0x07, 0xcc, 0xc4, 0x62, 0x5b, 0x29, 0xa0, 0x6b, 0x83,
+	0xa3, 0xee, 0x41, 0xe0, 0xaf, 0xc3, 0x2d, 0x64, 0x90, 0xc1, 0x81, 0x49, 0x0f, 0x49, 0x3b, 0x5d,
+	0x90, 0x47, 0x6c, 0xae, 0x31, 0x36, 0x62, 0x5e, 0x36, 0x13, 0xea, 0x7a, 0xa5, 0x80, 0x6e, 0x0c,
+	0x10, 0x1b, 0x8d, 0x86, 0xbf, 0xe5, 0xc0, 0x46, 0x3a, 0x05, 0xcd, 0x5e, 0x21, 0x48, 0x8c, 0x43,
+	0x8f, 0x38, 0x66, 0xbb, 0x15, 0x2f, 0x8b, 0x28, 0x2b, 0xe7, 0x33, 0x4b, 0x88, 0x7c, 0x6f, 0xd3,
+	0x95, 0x02, 0xba, 0xdd, 0xcb, 0xd2, 0x34, 0xf6, 0xd0, 0xd3, 0xcc, 0x76, 0xab, 0xef, 0xcd, 0xfb,
+	0x47, 0x1c, 0xb8, 0x31, 0xfa, 0xca, 0xd0, 0xf6, 0x08, 0x65, 0x25, 0x6b, 0x44, 0x6f, 0x21, 0xf7,
+	0x15, 0x6a, 0xf4, 0x4b, 0xee, 0xfe, 0x2b, 0x54, 0x82, 0x69, 0x7b, 0xe9, 0x17, 0xe1, 0x7e, 0x98,
+	0xd6, 0xc1, 0x79, 0xeb, 0x3b, 0xec, 0x34, 0x8b, 0xa3, 0x18, 0xb1, 0x58, 0xcc, 0x5c, 0xba, 0xa3,
+	0xdf, 0x18, 0x47, 0x19, 0x3d, 0xfa, 0x6d, 0xf2, 0xfb, 0xe0, 0x82, 0xc1, 0xc4, 0x1a, 0xd2, 0x13,
+	0x44, 0x4a, 0x4b, 0xcc, 0xd3, 0x78, 0x51, 0x63, 0xa4, 0xbc, 0xa3, 0x14, 0x10, 0x6f, 0x0c, 0x34,
+	0xc4, 0x5b, 0x62, 0x3a, 0x05, 0xa2, 0x99, 0x65, 0xd7, 0xe3, 0x68, 0x64, 0xcb, 0x99, 0x0b, 0x76,
+	0x82, 0x10, 0x12, 0x6e, 0x89, 0x93, 0x94, 0x92, 0xe8, 0xaa, 0x3c, 0x82, 0x44, 0xa2, 0x02, 0x84,
+	0x3c, 0x56, 0x32, 0xe3, 0x3c, 0x59, 0x1f, 0x09, 0xe3, 0x9c, 0xa1, 0xa1, 0x7c, 0x8f, 0x63, 0x9b,
+	0x48, 0x5c, 0x37, 0x7e, 0x23, 0xfd, 0xdd, 0x58, 0x5c, 0x32, 0xae, 0xe6, 0xad, 0x5e, 0xc7, 0x7d,
+	0x75, 0xd6, 0x57, 0xbd, 0x8e, 0x00, 0x55, 0x4e, 0x81, 0x69, 0xd6, 0xdd, 0xa3, 0x13, 0x33, 0x45,
+	0x7e, 0x2a, 0x00, 0x27, 0x8c, 0xf6, 0xa8, 0x9f, 0x14, 0x2f, 0x2c, 0xff, 0xd6, 0x7f, 0x3e, 0xdb,
+	0xfb, 0xd8, 0x2a, 0xbe, 0x32, 0xc0, 0x55, 0xb0, 0x28, 0xa9, 0x58, 0xd4, 0x9e, 0xc8, 0x88, 0x20,
+	0x19, 0x6b, 0x4d, 0x24, 0x0e, 0xbe, 0x26, 0x5e, 0x00, 0xa5, 0x61, 0x08, 0x96, 0xd1, 0x13, 0x19,
+	0xf1, 0x1c, 0x5c, 0x01, 0x0b, 0xc3, 0xad, 0x3b, 0xcd, 0x8a, 0x8c, 0xea, 0xb2, 0x2e, 0x63, 0xbe,
+	0x08, 0xdf, 0x00, 0x9b, 0xc3, 0x08, 0x49, 0xd0, 0x85, 0x8a, 0x80, 0x65, 0xd2, 0xd0, 0xb0, 0xbe,
+	0x8d, 0x64, 0x4c, 0xb0, 0x5c, 0xdd, 0x22, 0x8a, 0x86, 0x75, 0x59, 0xe2, 0xa7, 0xe0, 0xeb, 0xe0,
+	0xb5, 0x09, 0x46, 0xb5, 0x5d, 0xfc, 0xb8, 0xda, 0x67, 0x71, 0x02, 0xde, 0x07, 0x1b, 0x93, 0x2c,
+	0xb4, 0xfa, 0xb6, 0x26, 0x55, 0xfa, 0x6c, 0xa6, 0xe1, 0x5d, 0x70, 0x2b, 0x0f, 0x35, 0x24, 0x61,
+	0xfe, 0x24, 0xbc, 0x0d, 0xae, 0x67, 0x52, 0x0a, 0x90, 0xa7, 0xe0, 0x4d, 0x50, 0x1e, 0x46, 0x0a,
+	0x8d, 0x46, 0x55, 0x15, 0x05, 0x5d, 0xd5, 0xea, 0x44, 0xd1, 0xf5, 0x06, 0x3f, 0x03, 0x6f, 0x80,
+	0xd5, 0xc9, 0x38, 0x5d, 0x6c, 0xf0, 0xa7, 0x47, 0xc3, 0x9e, 0xaa, 0x75, 0x49, 0x7b, 0x8a, 0x89,
+	0x24, 0xe3, 0x1d, 0x5d, 0x6b, 0xf0, 0x00, 0xbe, 0x06, 0x6e, 0x4f, 0xe0, 0x87, 0x1f, 0x57, 0xc3,
+	0x98, 0x31, 0x8e, 0x67, 0x32, 0x26, 0xb8, 0x37, 0x74, 0x59, 0xc2, 0x8a, 0xba, 0xa5, 0xf3, 0x67,
+	0xe1, 0x9b, 0xe0, 0xf5, 0x5c, 0xfd, 0xa7, 0xa7, 0xf8, 0x5c, 0x86, 0x1f, 0x24, 0x4b, 0x6a, 0x7f,
+	0xe8, 0x67, 0xf3, 0x06, 0x65, 0x5b, 0x6c, 0xf0, 0xe7, 0x73, 0x05, 0x25, 0x40, 0xf2, 0xb9, 0xa7,
+	0x27, 0x40, 0x5f, 0x80, 0x0f, 0xc1, 0xdb, 0x9f, 0x65, 0x7a, 0xa2, 0xf5, 0x50, 0x95, 0x31, 0xe6,
+	0x21, 0xfc, 0x02, 0xb8, 0x93, 0xc7, 0x58, 0x78, 0xaf, 0x89, 0x64, 0xfe, 0x22, 0xbc, 0x05, 0xd6,
+	0x26, 0xc0, 0xa5, 0xdd, 0xba, 0x50, 0xd3, 0xa4, 0x0a, 0x7f, 0x29, 0x23, 0xc5, 0x45, 0x01, 0x63,
+	0xa1, 0x2e, 0x21, 0x81, 0xec, 0xc8, 0xbb, 0xb8, 0x21, 0x88, 0x32, 0xe6, 0x2f, 0x67, 0x44, 0xad,
+	0x67, 0x93, 0x8e, 0xc1, 0x15, 0xf8, 0x00, 0xbc, 0x39, 0xc1, 0x4a, 0xae, 0x0a, 0x58, 0x57, 0x45,
+	0x2c, 0x0b, 0x48, 0x54, 0xfa, 0x2c, 0xaf, 0xe6, 0x8a, 0x77, 0x64, 0x2f, 0x88, 0x8a, 0xcc, 0x97,
+	0x32, 0x66, 0x2b, 0xb4, 0xa8, 0xc9, 0x35, 0x0d, 0xed, 0x4a, 0x15, 0x7e, 0x2e, 0x97, 0x03, 0x36,
+	0xb3, 0x24, 0x74, 0x70, 0x2d, 0x63, 0x30, 0xa1, 0x85, 0x58, 0x6d, 0x62, 0x7d, 0x20, 0x79, 0xe7,
+	0xe1, 0x3a, 0xb8, 0x99, 0x99, 0x5d, 0x61, 0x14, 0x17, 0xe0, 0x06, 0x58, 0xcf, 0x95, 0x5f, 0x21,
+	0x7e, 0x31, 0x23, 0x98, 0x3d, 0x7c, 0x4d, 0x15, 0x91, 0x86, 0xb5, 0x2d, 0x9d, 0x5f, 0x82, 0x6f,
+	0x81, 0xfb, 0x93, 0x82, 0xa9, 0x89, 0x3b, 0x48, 0x13, 0x44, 0x65, 0x60, 0x9f, 0x5b, 0xce, 0xc8,
+	0xfd, 0x78, 0x6f, 0x14, 0xf4, 0xaa, 0x80, 0xf9, 0x95, 0x8c, 0x35, 0x85, 0xeb, 0xda, 0xd3, 0xad,
+	0xaa, 0xb0, 0x23, 0xf3, 0xab, 0x63, 0xfa, 0xd5, 0xc4, 0xd4, 0xec, 0x4a, 0x98, 0x34, 0x90, 0xf6,
+	0xf5, 0x5d, 0xbe, 0x3c, 0x26, 0x15, 0xd3, 0x68, 0x45, 0xdd, 0x56, 0x88, 0xf0, 0x44, 0x50, 0xab,
+	0x42, 0x45, 0xad, 0xaa, 0xfa, 0x2e, 0xbf, 0x06, 0xdf, 0x06, 0x6f, 0x64, 0x58, 0xb1, 0x15, 0xa2,
+	0x8a, 0x04, 0xc9, 0xdb, 0x2a, 0xd6, 0x11, 0xdb, 0x3a, 0xf9, 0xeb, 0xa3, 0x77, 0x61, 0x2c, 0xd4,
+	0xaa, 0xe9, 0x2d, 0x96, 0xbf, 0xb1, 0xfe, 0x1b, 0x0e, 0xcc, 0xf6, 0x7f, 0xc0, 0x0b, 0x97, 0xc1,
+	0x7c, 0x62, 0x8a, 0x75, 0x41, 0x6f, 0xe2, 0x81, 0x33, 0x71, 0x1e, 0x5c, 0x1d, 0x04, 0xe0, 0xa6,
+	0x28, 0x06, 0xcb, 0x9f, 0x1b, 0xd9, 0xb8, 0xa3, 0x36, 0x1a, 0xb2, 0xc4, 0x17, 0xe1, 0x1c, 0xb8,
+	0x3c, 0xd8, 0x28, 0x23, 0xa4, 0x21, 0x7e, 0x6a, 0x94, 0x9d, 0x50, 0xd1, 0x10, 0x3b, 0xde, 0xd6,
+	0xff, 0xc4, 0x81, 0x29, 0x51, 0x17, 0xe0, 0x45, 0x70, 0x5e, 0xd4, 0x85, 0xe1, 0xcf, 0xc4, 0x82,
+	0x87, 0x42, 0x53, 0x57, 0x88, 0xa8, 0xd5, 0xeb, 0xb2, 0xa8, 0x6b, 0xc1, 0xe1, 0x7c, 0x15, 0x5c,
+	0x64, 0xcf, 0x45, 0x5d, 0x7d, 0x12, 0x9c, 0xd9, 0x18, 0xab, 0x5a, 0x3d, 0x38, 0x93, 0x93, 0x86,
+	0x80, 0x32, 0x41, 0xf2, 0xe3, 0xa6, 0x8c, 0x75, 0xcc, 0x4f, 0xc5, 0x0d, 0x0d, 0x24, 0xd7, 0xd4,
+	0x66, 0x8d, 0xe0, 0x66, 0xa3, 0xa1, 0x21, 0x9d, 0x3f, 0x11, 0x37, 0xe8, 0x28, 0x58, 0x27, 0x12,
+	0x91, 0xe4, 0x27, 0x6a, 0xb0, 0xc1, 0x4c, 0xc7, 0xbe, 0x9b, 0x8d, 0x6d, 0x24, 0x48, 0x32, 0xa9,
+	0x08, 0xf5, 0xba, 0x8c, 0xf8, 0x93, 0xb1, 0x41, 0x45, 0xad, 0x56, 0xd5, 0xfa, 0x36, 0xc1, 0xcd,
+	0x5a, 0x4d, 0x40, 0xbb, 0xfc, 0xa9, 0xf5, 0xbf, 0x4e, 0x81, 0xcb, 0x23, 0x5f, 0xa8, 0x05, 0x1b,
+	0xa1, 0x5a, 0xd7, 0xe5, 0xed, 0x30, 0x84, 0x44, 0xae, 0x23, 0xad, 0x5a, 0x25, 0x3b, 0x6a, 0x7d,
+	0xf0, 0xb3, 0xb8, 0x55, 0xb0, 0x38, 0x0e, 0x88, 0xab, 0x82, 0xb8, 0xc3, 0x73, 0xf0, 0x3a, 0x58,
+	0x19, 0x07, 0x11, 0x9e, 0x62, 0x12, 0xd4, 0x1c, 0x7c, 0x31, 0x38, 0x5a, 0xc7, 0xa1, 0x1a, 0xc2,
+	0xb6, 0x8c, 0xa4, 0xa6, 0xbe, 0xcb, 0x4f, 0x4d, 0xf2, 0x27, 0xd7, 0x04, 0xb5, 0xca, 0x9f, 0x08,
+	0xee, 0x41, 0xe3, 0x20, 0x8f, 0x54, 0x24, 0xf0, 0xd3, 0x70, 0x0d, 0x2c, 0x8f, 0x43, 0xb0, 0xb0,
+	0x23, 0x89, 0x3f, 0x19, 0x24, 0xed, 0x38, 0x50, 0x4d, 0xd0, 0x75, 0x19, 0xd5, 0x34, 0xac, 0xf3,
+	0xa7, 0x26, 0x0d, 0xaf, 0x86, 0x89, 0x2e, 0x0b, 0x35, 0xcc, 0xcf, 0x4c, 0x42, 0x69, 0x0d, 0xbc,
+	0x2d, 0xd7, 0x55, 0x99, 0x3f, 0x3d, 0x89, 0xba, 0xb6, 0xa3, 0x0b, 0x3c, 0x98, 0x38, 0x38, 0xa1,
+	0xb6, 0xc5, 0x9f, 0xa9, 0xbc, 0xff, 0xe7, 0x4f, 0x97, 0xb8, 0xbf, 0x7c, 0xba, 0xc4, 0xfd, 0xed,
+	0xd3, 0x25, 0xee, 0x3d, 0x6d, 0xcf, 0xf4, 0x5f, 0x74, 0x9f, 0x6d, 0xb4, 0x9c, 0xfd, 0xcd, 0x3d,
+	0xd7, 0x38, 0x30, 0xc3, 0xca, 0xd2, 0xb0, 0x36, 0x93, 0xff, 0x5b, 0x31, 0x3a, 0xe6, 0xe6, 0x1e,
+	0xb5, 0x37, 0xd9, 0x3f, 0xa9, 0x6c, 0xee, 0x39, 0x03, 0xff, 0xc8, 0xf2, 0x30, 0xf5, 0xf3, 0xe0,
+	0xde, 0xb3, 0x93, 0x0c, 0xf6, 0xc6, 0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0x12, 0x7b, 0xfa, 0xa1,
+	0xf8, 0x32, 0x00, 0x00,
 }
 
 func (m *UIBannerClickEvent) Marshal() (dAtA []byte, err error) {
@@ -3152,6 +3321,40 @@ func (m *UIOnboardSetCredentialSubmitEvent) MarshalToSizedBuffer(dAtA []byte) (i
 	return len(dAtA) - i, nil
 }
 
+func (m *UIOnboardQuestionnaireSubmitEvent) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UIOnboardQuestionnaireSubmitEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UIOnboardQuestionnaireSubmitEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Username) > 0 {
+		i -= len(m.Username)
+		copy(dAtA[i:], m.Username)
+		i = encodeVarintUsageevents(dAtA, i, uint64(len(m.Username)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *UIOnboardRegisterChallengeSubmitEvent) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -3708,6 +3911,16 @@ func (m *UIDiscoverDeployServiceEvent) MarshalToSizedBuffer(dAtA []byte) (int, e
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.DeployType != 0 {
+		i = encodeVarintUsageevents(dAtA, i, uint64(m.DeployType))
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.DeployMethod != 0 {
+		i = encodeVarintUsageevents(dAtA, i, uint64(m.DeployMethod))
+		i--
+		dAtA[i] = 0x20
+	}
 	if m.Status != nil {
 		{
 			size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
@@ -5321,6 +5534,29 @@ func (m *UsageEventOneOf_UiIntegrationEnrollCompleteEvent) MarshalToSizedBuffer(
 	}
 	return len(dAtA) - i, nil
 }
+func (m *UsageEventOneOf_UiOnboardQuestionnaireSubmit) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UsageEventOneOf_UiOnboardQuestionnaireSubmit) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.UiOnboardQuestionnaireSubmit != nil {
+		{
+			size, err := m.UiOnboardQuestionnaireSubmit.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintUsageevents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0x8a
+	}
+	return len(dAtA) - i, nil
+}
 func encodeVarintUsageevents(dAtA []byte, offset int, v uint64) int {
 	offset -= sovUsageevents(v)
 	base := offset
@@ -5404,6 +5640,22 @@ func (m *UIOnboardSetCredentialSubmitEvent) Size() (n int) {
 	return n
 }
 
+func (m *UIOnboardQuestionnaireSubmitEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Username)
+	if l > 0 {
+		n += 1 + l + sovUsageevents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *UIOnboardRegisterChallengeSubmitEvent) Size() (n int) {
 	if m == nil {
 		return 0
@@ -5654,6 +5906,12 @@ func (m *UIDiscoverDeployServiceEvent) Size() (n int) {
 		l = m.Status.Size()
 		n += 1 + l + sovUsageevents(uint64(l))
 	}
+	if m.DeployMethod != 0 {
+		n += 1 + sovUsageevents(uint64(m.DeployMethod))
+	}
+	if m.DeployType != 0 {
+		n += 1 + sovUsageevents(uint64(m.DeployType))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -6394,6 +6652,18 @@ func (m *UsageEventOneOf_UiIntegrationEnrollCompleteEvent) Size() (n int) {
 	}
 	return n
 }
+func (m *UsageEventOneOf_UiOnboardQuestionnaireSubmit) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.UiOnboardQuestionnaireSubmit != nil {
+		l = m.UiOnboardQuestionnaireSubmit.Size()
+		n += 2 + l + sovUsageevents(uint64(l))
+	}
+	return n
+}
 
 func sovUsageevents(x uint64) (n int) {
 	return (math_bits.Len64(x|1) + 6) / 7
@@ -6752,6 +7022,89 @@ func (m *UIOnboardSetCredentialSubmitEvent) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *UIOnboardQuestionnaireSubmitEvent) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowUsageevents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UIOnboardQuestionnaireSubmitEvent: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UIOnboardQuestionnaireSubmitEvent: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Username = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipUsageevents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *UIOnboardRegisterChallengeSubmitEvent) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -8229,6 +8582,44 @@ func (m *UIDiscoverDeployServiceEvent) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeployMethod", wireType)
+			}
+			m.DeployMethod = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DeployMethod |= UIDiscoverDeployServiceEvent_DeployMethod(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeployType", wireType)
+			}
+			m.DeployType = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DeployType |= UIDiscoverDeployServiceEvent_DeployType(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipUsageevents(dAtA[iNdEx:])
@@ -11467,6 +11858,41 @@ func (m *UsageEventOneOf) Unmarshal(dAtA []byte) error {
 			}
 			m.Event = &UsageEventOneOf_UiIntegrationEnrollCompleteEvent{v}
 			iNdEx = postIndex
+		case 33:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UiOnboardQuestionnaireSubmit", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowUsageevents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthUsageevents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &UIOnboardQuestionnaireSubmitEvent{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &UsageEventOneOf_UiOnboardQuestionnaireSubmit{v}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipUsageevents(dAtA[iNdEx:])
diff --git a/api/gen/proto/go/userpreferences/v1/assist.pb.go b/api/gen/proto/go/userpreferences/v1/assist.pb.go
new file mode 100644
index 0000000000000..31871fd3d91c0
--- /dev/null
+++ b/api/gen/proto/go/userpreferences/v1/assist.pb.go
@@ -0,0 +1,258 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: teleport/userpreferences/v1/assist.proto
+
+package userpreferencesv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// AssistViewMode is the way the assistant is displayed.
+type AssistViewMode int32
+
+const (
+	AssistViewMode_ASSIST_VIEW_MODE_UNSPECIFIED AssistViewMode = 0
+	// DOCKED is the assistant is docked to the right hand side of the screen.
+	AssistViewMode_ASSIST_VIEW_MODE_DOCKED AssistViewMode = 1
+	// POPUP is the assistant is displayed as a popup.
+	AssistViewMode_ASSIST_VIEW_MODE_POPUP AssistViewMode = 2
+	// POPUP_EXPANDED is the assistant is displayed as a popup and expanded.
+	AssistViewMode_ASSIST_VIEW_MODE_POPUP_EXPANDED AssistViewMode = 3
+	// POPUP_EXPANDED_SIDEBAR_VISIBLE is the assistant is displayed as a popup and expanded with the sidebar visible.
+	AssistViewMode_ASSIST_VIEW_MODE_POPUP_EXPANDED_SIDEBAR_VISIBLE AssistViewMode = 4
+)
+
+// Enum value maps for AssistViewMode.
+var (
+	AssistViewMode_name = map[int32]string{
+		0: "ASSIST_VIEW_MODE_UNSPECIFIED",
+		1: "ASSIST_VIEW_MODE_DOCKED",
+		2: "ASSIST_VIEW_MODE_POPUP",
+		3: "ASSIST_VIEW_MODE_POPUP_EXPANDED",
+		4: "ASSIST_VIEW_MODE_POPUP_EXPANDED_SIDEBAR_VISIBLE",
+	}
+	AssistViewMode_value = map[string]int32{
+		"ASSIST_VIEW_MODE_UNSPECIFIED":                    0,
+		"ASSIST_VIEW_MODE_DOCKED":                         1,
+		"ASSIST_VIEW_MODE_POPUP":                          2,
+		"ASSIST_VIEW_MODE_POPUP_EXPANDED":                 3,
+		"ASSIST_VIEW_MODE_POPUP_EXPANDED_SIDEBAR_VISIBLE": 4,
+	}
+)
+
+func (x AssistViewMode) Enum() *AssistViewMode {
+	p := new(AssistViewMode)
+	*p = x
+	return p
+}
+
+func (x AssistViewMode) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (AssistViewMode) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_userpreferences_v1_assist_proto_enumTypes[0].Descriptor()
+}
+
+func (AssistViewMode) Type() protoreflect.EnumType {
+	return &file_teleport_userpreferences_v1_assist_proto_enumTypes[0]
+}
+
+func (x AssistViewMode) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use AssistViewMode.Descriptor instead.
+func (AssistViewMode) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_userpreferences_v1_assist_proto_rawDescGZIP(), []int{0}
+}
+
+// AssistUserPreferences is the user preferences for Assist.
+type AssistUserPreferences struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// preferredLogins is an array of the logins a user would prefer to use when running a command, ordered by preference.
+	PreferredLogins []string `protobuf:"bytes,1,rep,name=preferred_logins,json=preferredLogins,proto3" json:"preferred_logins,omitempty"`
+	// viewMode is the way the assistant is displayed.
+	ViewMode AssistViewMode `protobuf:"varint,2,opt,name=view_mode,json=viewMode,proto3,enum=teleport.userpreferences.v1.AssistViewMode" json:"view_mode,omitempty"`
+}
+
+func (x *AssistUserPreferences) Reset() {
+	*x = AssistUserPreferences{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userpreferences_v1_assist_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AssistUserPreferences) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AssistUserPreferences) ProtoMessage() {}
+
+func (x *AssistUserPreferences) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userpreferences_v1_assist_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AssistUserPreferences.ProtoReflect.Descriptor instead.
+func (*AssistUserPreferences) Descriptor() ([]byte, []int) {
+	return file_teleport_userpreferences_v1_assist_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *AssistUserPreferences) GetPreferredLogins() []string {
+	if x != nil {
+		return x.PreferredLogins
+	}
+	return nil
+}
+
+func (x *AssistUserPreferences) GetViewMode() AssistViewMode {
+	if x != nil {
+		return x.ViewMode
+	}
+	return AssistViewMode_ASSIST_VIEW_MODE_UNSPECIFIED
+}
+
+var File_teleport_userpreferences_v1_assist_proto protoreflect.FileDescriptor
+
+var file_teleport_userpreferences_v1_assist_proto_rawDesc = []byte{
+	0x0a, 0x28, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x70,
+	0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x73,
+	0x73, 0x69, 0x73, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1b, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65,
+	0x6e, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x22, 0x8c, 0x01, 0x0a, 0x15, 0x41, 0x73, 0x73, 0x69,
+	0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65,
+	0x73, 0x12, 0x29, 0x0a, 0x10, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x72, 0x65, 0x64, 0x5f, 0x6c,
+	0x6f, 0x67, 0x69, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x70, 0x72, 0x65,
+	0x66, 0x65, 0x72, 0x72, 0x65, 0x64, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x73, 0x12, 0x48, 0x0a, 0x09,
+	0x76, 0x69, 0x65, 0x77, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x2b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70,
+	0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x73,
+	0x73, 0x69, 0x73, 0x74, 0x56, 0x69, 0x65, 0x77, 0x4d, 0x6f, 0x64, 0x65, 0x52, 0x08, 0x76, 0x69,
+	0x65, 0x77, 0x4d, 0x6f, 0x64, 0x65, 0x2a, 0xc5, 0x01, 0x0a, 0x0e, 0x41, 0x73, 0x73, 0x69, 0x73,
+	0x74, 0x56, 0x69, 0x65, 0x77, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x20, 0x0a, 0x1c, 0x41, 0x53, 0x53,
+	0x49, 0x53, 0x54, 0x5f, 0x56, 0x49, 0x45, 0x57, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x55, 0x4e,
+	0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1b, 0x0a, 0x17, 0x41,
+	0x53, 0x53, 0x49, 0x53, 0x54, 0x5f, 0x56, 0x49, 0x45, 0x57, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f,
+	0x44, 0x4f, 0x43, 0x4b, 0x45, 0x44, 0x10, 0x01, 0x12, 0x1a, 0x0a, 0x16, 0x41, 0x53, 0x53, 0x49,
+	0x53, 0x54, 0x5f, 0x56, 0x49, 0x45, 0x57, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x50, 0x4f, 0x50,
+	0x55, 0x50, 0x10, 0x02, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x53, 0x53, 0x49, 0x53, 0x54, 0x5f, 0x56,
+	0x49, 0x45, 0x57, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x50, 0x4f, 0x50, 0x55, 0x50, 0x5f, 0x45,
+	0x58, 0x50, 0x41, 0x4e, 0x44, 0x45, 0x44, 0x10, 0x03, 0x12, 0x33, 0x0a, 0x2f, 0x41, 0x53, 0x53,
+	0x49, 0x53, 0x54, 0x5f, 0x56, 0x49, 0x45, 0x57, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x50, 0x4f,
+	0x50, 0x55, 0x50, 0x5f, 0x45, 0x58, 0x50, 0x41, 0x4e, 0x44, 0x45, 0x44, 0x5f, 0x53, 0x49, 0x44,
+	0x45, 0x42, 0x41, 0x52, 0x5f, 0x56, 0x49, 0x53, 0x49, 0x42, 0x4c, 0x45, 0x10, 0x04, 0x42, 0x59,
+	0x5a, 0x57, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61,
+	0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65,
+	0x6e, 0x63, 0x65, 0x73, 0x2f, 0x76, 0x31, 0x3b, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66,
+	0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
+}
+
+var (
+	file_teleport_userpreferences_v1_assist_proto_rawDescOnce sync.Once
+	file_teleport_userpreferences_v1_assist_proto_rawDescData = file_teleport_userpreferences_v1_assist_proto_rawDesc
+)
+
+func file_teleport_userpreferences_v1_assist_proto_rawDescGZIP() []byte {
+	file_teleport_userpreferences_v1_assist_proto_rawDescOnce.Do(func() {
+		file_teleport_userpreferences_v1_assist_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_userpreferences_v1_assist_proto_rawDescData)
+	})
+	return file_teleport_userpreferences_v1_assist_proto_rawDescData
+}
+
+var file_teleport_userpreferences_v1_assist_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_teleport_userpreferences_v1_assist_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_teleport_userpreferences_v1_assist_proto_goTypes = []interface{}{
+	(AssistViewMode)(0),           // 0: teleport.userpreferences.v1.AssistViewMode
+	(*AssistUserPreferences)(nil), // 1: teleport.userpreferences.v1.AssistUserPreferences
+}
+var file_teleport_userpreferences_v1_assist_proto_depIdxs = []int32{
+	0, // 0: teleport.userpreferences.v1.AssistUserPreferences.view_mode:type_name -> teleport.userpreferences.v1.AssistViewMode
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_teleport_userpreferences_v1_assist_proto_init() }
+func file_teleport_userpreferences_v1_assist_proto_init() {
+	if File_teleport_userpreferences_v1_assist_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_teleport_userpreferences_v1_assist_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AssistUserPreferences); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_userpreferences_v1_assist_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_userpreferences_v1_assist_proto_goTypes,
+		DependencyIndexes: file_teleport_userpreferences_v1_assist_proto_depIdxs,
+		EnumInfos:         file_teleport_userpreferences_v1_assist_proto_enumTypes,
+		MessageInfos:      file_teleport_userpreferences_v1_assist_proto_msgTypes,
+	}.Build()
+	File_teleport_userpreferences_v1_assist_proto = out.File
+	file_teleport_userpreferences_v1_assist_proto_rawDesc = nil
+	file_teleport_userpreferences_v1_assist_proto_goTypes = nil
+	file_teleport_userpreferences_v1_assist_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/userpreferences/v1/onboard.pb.go b/api/gen/proto/go/userpreferences/v1/onboard.pb.go
new file mode 100644
index 0000000000000..1c81c44e4539e
--- /dev/null
+++ b/api/gen/proto/go/userpreferences/v1/onboard.pb.go
@@ -0,0 +1,244 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: teleport/userpreferences/v1/onboard.proto
+
+package userpreferencesv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Resources are the Resource options in the onboarding questionnaire
+type Resource int32
+
+const (
+	Resource_RESOURCE_UNSPECIFIED      Resource = 0
+	Resource_RESOURCE_WINDOWS_DESKTOPS Resource = 1
+	Resource_RESOURCE_SERVER_SSH       Resource = 2
+	Resource_RESOURCE_DATABASES        Resource = 3
+	Resource_RESOURCE_KUBERNETES       Resource = 4
+	Resource_RESOURCE_WEB_APPLICATIONS Resource = 5
+)
+
+// Enum value maps for Resource.
+var (
+	Resource_name = map[int32]string{
+		0: "RESOURCE_UNSPECIFIED",
+		1: "RESOURCE_WINDOWS_DESKTOPS",
+		2: "RESOURCE_SERVER_SSH",
+		3: "RESOURCE_DATABASES",
+		4: "RESOURCE_KUBERNETES",
+		5: "RESOURCE_WEB_APPLICATIONS",
+	}
+	Resource_value = map[string]int32{
+		"RESOURCE_UNSPECIFIED":      0,
+		"RESOURCE_WINDOWS_DESKTOPS": 1,
+		"RESOURCE_SERVER_SSH":       2,
+		"RESOURCE_DATABASES":        3,
+		"RESOURCE_KUBERNETES":       4,
+		"RESOURCE_WEB_APPLICATIONS": 5,
+	}
+)
+
+func (x Resource) Enum() *Resource {
+	p := new(Resource)
+	*p = x
+	return p
+}
+
+func (x Resource) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Resource) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_userpreferences_v1_onboard_proto_enumTypes[0].Descriptor()
+}
+
+func (Resource) Type() protoreflect.EnumType {
+	return &file_teleport_userpreferences_v1_onboard_proto_enumTypes[0]
+}
+
+func (x Resource) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Resource.Descriptor instead.
+func (Resource) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_userpreferences_v1_onboard_proto_rawDescGZIP(), []int{0}
+}
+
+// OnboardUserPreferences is the user preferences selected during onboarding.
+type OnboardUserPreferences struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// preferredResources is an array of the resources a user selected during their onboarding questionnaire.
+	PreferredResources []Resource `protobuf:"varint,1,rep,packed,name=preferred_resources,json=preferredResources,proto3,enum=teleport.userpreferences.v1.Resource" json:"preferred_resources,omitempty"`
+}
+
+func (x *OnboardUserPreferences) Reset() {
+	*x = OnboardUserPreferences{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userpreferences_v1_onboard_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *OnboardUserPreferences) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OnboardUserPreferences) ProtoMessage() {}
+
+func (x *OnboardUserPreferences) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userpreferences_v1_onboard_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OnboardUserPreferences.ProtoReflect.Descriptor instead.
+func (*OnboardUserPreferences) Descriptor() ([]byte, []int) {
+	return file_teleport_userpreferences_v1_onboard_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *OnboardUserPreferences) GetPreferredResources() []Resource {
+	if x != nil {
+		return x.PreferredResources
+	}
+	return nil
+}
+
+var File_teleport_userpreferences_v1_onboard_proto protoreflect.FileDescriptor
+
+var file_teleport_userpreferences_v1_onboard_proto_rawDesc = []byte{
+	0x0a, 0x29, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x70,
+	0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2f, 0x76, 0x31, 0x2f, 0x6f, 0x6e,
+	0x62, 0x6f, 0x61, 0x72, 0x64, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1b, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72,
+	0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x22, 0x70, 0x0a, 0x16, 0x4f, 0x6e, 0x62, 0x6f,
+	0x61, 0x72, 0x64, 0x55, 0x73, 0x65, 0x72, 0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63,
+	0x65, 0x73, 0x12, 0x56, 0x0a, 0x13, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x72, 0x65, 0x64, 0x5f,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0e, 0x32,
+	0x25, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70,
+	0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x12, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x72, 0x65,
+	0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2a, 0xac, 0x01, 0x0a, 0x08, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x52, 0x45, 0x53, 0x4f, 0x55,
+	0x52, 0x43, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
+	0x00, 0x12, 0x1d, 0x0a, 0x19, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x57, 0x49,
+	0x4e, 0x44, 0x4f, 0x57, 0x53, 0x5f, 0x44, 0x45, 0x53, 0x4b, 0x54, 0x4f, 0x50, 0x53, 0x10, 0x01,
+	0x12, 0x17, 0x0a, 0x13, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x53, 0x45, 0x52,
+	0x56, 0x45, 0x52, 0x5f, 0x53, 0x53, 0x48, 0x10, 0x02, 0x12, 0x16, 0x0a, 0x12, 0x52, 0x45, 0x53,
+	0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x53, 0x10,
+	0x03, 0x12, 0x17, 0x0a, 0x13, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x4b, 0x55,
+	0x42, 0x45, 0x52, 0x4e, 0x45, 0x54, 0x45, 0x53, 0x10, 0x04, 0x12, 0x1d, 0x0a, 0x19, 0x52, 0x45,
+	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x57, 0x45, 0x42, 0x5f, 0x41, 0x50, 0x50, 0x4c, 0x49,
+	0x43, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x53, 0x10, 0x05, 0x42, 0x59, 0x5a, 0x57, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f,
+	0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2f,
+	0x76, 0x31, 0x3b, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63,
+	0x65, 0x73, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_teleport_userpreferences_v1_onboard_proto_rawDescOnce sync.Once
+	file_teleport_userpreferences_v1_onboard_proto_rawDescData = file_teleport_userpreferences_v1_onboard_proto_rawDesc
+)
+
+func file_teleport_userpreferences_v1_onboard_proto_rawDescGZIP() []byte {
+	file_teleport_userpreferences_v1_onboard_proto_rawDescOnce.Do(func() {
+		file_teleport_userpreferences_v1_onboard_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_userpreferences_v1_onboard_proto_rawDescData)
+	})
+	return file_teleport_userpreferences_v1_onboard_proto_rawDescData
+}
+
+var file_teleport_userpreferences_v1_onboard_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_teleport_userpreferences_v1_onboard_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_teleport_userpreferences_v1_onboard_proto_goTypes = []interface{}{
+	(Resource)(0),                  // 0: teleport.userpreferences.v1.Resource
+	(*OnboardUserPreferences)(nil), // 1: teleport.userpreferences.v1.OnboardUserPreferences
+}
+var file_teleport_userpreferences_v1_onboard_proto_depIdxs = []int32{
+	0, // 0: teleport.userpreferences.v1.OnboardUserPreferences.preferred_resources:type_name -> teleport.userpreferences.v1.Resource
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_teleport_userpreferences_v1_onboard_proto_init() }
+func file_teleport_userpreferences_v1_onboard_proto_init() {
+	if File_teleport_userpreferences_v1_onboard_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_teleport_userpreferences_v1_onboard_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*OnboardUserPreferences); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_userpreferences_v1_onboard_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_userpreferences_v1_onboard_proto_goTypes,
+		DependencyIndexes: file_teleport_userpreferences_v1_onboard_proto_depIdxs,
+		EnumInfos:         file_teleport_userpreferences_v1_onboard_proto_enumTypes,
+		MessageInfos:      file_teleport_userpreferences_v1_onboard_proto_msgTypes,
+	}.Build()
+	File_teleport_userpreferences_v1_onboard_proto = out.File
+	file_teleport_userpreferences_v1_onboard_proto_rawDesc = nil
+	file_teleport_userpreferences_v1_onboard_proto_goTypes = nil
+	file_teleport_userpreferences_v1_onboard_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/userpreferences/v1/theme.pb.go b/api/gen/proto/go/userpreferences/v1/theme.pb.go
new file mode 100644
index 0000000000000..5706d90412c59
--- /dev/null
+++ b/api/gen/proto/go/userpreferences/v1/theme.pb.go
@@ -0,0 +1,156 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: teleport/userpreferences/v1/theme.proto
+
+package userpreferencesv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Theme is a frontend theme.
+type Theme int32
+
+const (
+	Theme_THEME_UNSPECIFIED Theme = 0
+	// THEME_LIGHT is the light theme.
+	Theme_THEME_LIGHT Theme = 1
+	// THEME_DARK is the dark theme.
+	Theme_THEME_DARK Theme = 2
+)
+
+// Enum value maps for Theme.
+var (
+	Theme_name = map[int32]string{
+		0: "THEME_UNSPECIFIED",
+		1: "THEME_LIGHT",
+		2: "THEME_DARK",
+	}
+	Theme_value = map[string]int32{
+		"THEME_UNSPECIFIED": 0,
+		"THEME_LIGHT":       1,
+		"THEME_DARK":        2,
+	}
+)
+
+func (x Theme) Enum() *Theme {
+	p := new(Theme)
+	*p = x
+	return p
+}
+
+func (x Theme) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Theme) Descriptor() protoreflect.EnumDescriptor {
+	return file_teleport_userpreferences_v1_theme_proto_enumTypes[0].Descriptor()
+}
+
+func (Theme) Type() protoreflect.EnumType {
+	return &file_teleport_userpreferences_v1_theme_proto_enumTypes[0]
+}
+
+func (x Theme) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Theme.Descriptor instead.
+func (Theme) EnumDescriptor() ([]byte, []int) {
+	return file_teleport_userpreferences_v1_theme_proto_rawDescGZIP(), []int{0}
+}
+
+var File_teleport_userpreferences_v1_theme_proto protoreflect.FileDescriptor
+
+var file_teleport_userpreferences_v1_theme_proto_rawDesc = []byte{
+	0x0a, 0x27, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x70,
+	0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x68,
+	0x65, 0x6d, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1b, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e,
+	0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2a, 0x3f, 0x0a, 0x05, 0x54, 0x68, 0x65, 0x6d, 0x65, 0x12,
+	0x15, 0x0a, 0x11, 0x54, 0x48, 0x45, 0x4d, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
+	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x48, 0x45, 0x4d, 0x45, 0x5f,
+	0x4c, 0x49, 0x47, 0x48, 0x54, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x48, 0x45, 0x4d, 0x45,
+	0x5f, 0x44, 0x41, 0x52, 0x4b, 0x10, 0x02, 0x42, 0x59, 0x5a, 0x57, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69,
+	0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x75, 0x73,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2f, 0x76, 0x31,
+	0x3b, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73,
+	0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_teleport_userpreferences_v1_theme_proto_rawDescOnce sync.Once
+	file_teleport_userpreferences_v1_theme_proto_rawDescData = file_teleport_userpreferences_v1_theme_proto_rawDesc
+)
+
+func file_teleport_userpreferences_v1_theme_proto_rawDescGZIP() []byte {
+	file_teleport_userpreferences_v1_theme_proto_rawDescOnce.Do(func() {
+		file_teleport_userpreferences_v1_theme_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_userpreferences_v1_theme_proto_rawDescData)
+	})
+	return file_teleport_userpreferences_v1_theme_proto_rawDescData
+}
+
+var file_teleport_userpreferences_v1_theme_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_teleport_userpreferences_v1_theme_proto_goTypes = []interface{}{
+	(Theme)(0), // 0: teleport.userpreferences.v1.Theme
+}
+var file_teleport_userpreferences_v1_theme_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_teleport_userpreferences_v1_theme_proto_init() }
+func file_teleport_userpreferences_v1_theme_proto_init() {
+	if File_teleport_userpreferences_v1_theme_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_userpreferences_v1_theme_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   0,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_userpreferences_v1_theme_proto_goTypes,
+		DependencyIndexes: file_teleport_userpreferences_v1_theme_proto_depIdxs,
+		EnumInfos:         file_teleport_userpreferences_v1_theme_proto_enumTypes,
+	}.Build()
+	File_teleport_userpreferences_v1_theme_proto = out.File
+	file_teleport_userpreferences_v1_theme_proto_rawDesc = nil
+	file_teleport_userpreferences_v1_theme_proto_goTypes = nil
+	file_teleport_userpreferences_v1_theme_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/userpreferences/v1/userpreferences.pb.go b/api/gen/proto/go/userpreferences/v1/userpreferences.pb.go
new file mode 100644
index 0000000000000..864f8130dc01f
--- /dev/null
+++ b/api/gen/proto/go/userpreferences/v1/userpreferences.pb.go
@@ -0,0 +1,454 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: teleport/userpreferences/v1/userpreferences.proto
+
+package userpreferencesv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// UserPreferences is a collection of different user changeable preferences for the frontend.
+type UserPreferences struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// assist is the preferences for the Teleport Assist.
+	Assist *AssistUserPreferences `protobuf:"bytes,1,opt,name=assist,proto3" json:"assist,omitempty"`
+	// theme is the theme of the frontend.
+	Theme Theme `protobuf:"varint,2,opt,name=theme,proto3,enum=teleport.userpreferences.v1.Theme" json:"theme,omitempty"`
+	// onboard is the preferences from the onboarding questionnaire.
+	Onboard *OnboardUserPreferences `protobuf:"bytes,3,opt,name=onboard,proto3" json:"onboard,omitempty"`
+}
+
+func (x *UserPreferences) Reset() {
+	*x = UserPreferences{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UserPreferences) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserPreferences) ProtoMessage() {}
+
+func (x *UserPreferences) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserPreferences.ProtoReflect.Descriptor instead.
+func (*UserPreferences) Descriptor() ([]byte, []int) {
+	return file_teleport_userpreferences_v1_userpreferences_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *UserPreferences) GetAssist() *AssistUserPreferences {
+	if x != nil {
+		return x.Assist
+	}
+	return nil
+}
+
+func (x *UserPreferences) GetTheme() Theme {
+	if x != nil {
+		return x.Theme
+	}
+	return Theme_THEME_UNSPECIFIED
+}
+
+func (x *UserPreferences) GetOnboard() *OnboardUserPreferences {
+	if x != nil {
+		return x.Onboard
+	}
+	return nil
+}
+
+// GetUserPreferencesRequest is a request to get the user preferences.
+type GetUserPreferencesRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// username is the username of the owner of the user preferences to get.
+	Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+}
+
+func (x *GetUserPreferencesRequest) Reset() {
+	*x = GetUserPreferencesRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetUserPreferencesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetUserPreferencesRequest) ProtoMessage() {}
+
+func (x *GetUserPreferencesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetUserPreferencesRequest.ProtoReflect.Descriptor instead.
+func (*GetUserPreferencesRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_userpreferences_v1_userpreferences_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetUserPreferencesRequest) GetUsername() string {
+	if x != nil {
+		return x.Username
+	}
+	return ""
+}
+
+// GetUserPreferencesResponse is a response to get the user preferences.
+type GetUserPreferencesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// preferences is the user preferences.
+	Preferences *UserPreferences `protobuf:"bytes,1,opt,name=preferences,proto3" json:"preferences,omitempty"`
+}
+
+func (x *GetUserPreferencesResponse) Reset() {
+	*x = GetUserPreferencesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetUserPreferencesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetUserPreferencesResponse) ProtoMessage() {}
+
+func (x *GetUserPreferencesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetUserPreferencesResponse.ProtoReflect.Descriptor instead.
+func (*GetUserPreferencesResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_userpreferences_v1_userpreferences_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *GetUserPreferencesResponse) GetPreferences() *UserPreferences {
+	if x != nil {
+		return x.Preferences
+	}
+	return nil
+}
+
+// UpsertUserPreferencesRequest is a request to create or update the user preferences.
+type UpsertUserPreferencesRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// preferences is the new user preferences to set.
+	Preferences *UserPreferences `protobuf:"bytes,1,opt,name=preferences,proto3" json:"preferences,omitempty"`
+	// username is the username of the owner of the user preferences to update.
+	Username string `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"`
+}
+
+func (x *UpsertUserPreferencesRequest) Reset() {
+	*x = UpsertUserPreferencesRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpsertUserPreferencesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertUserPreferencesRequest) ProtoMessage() {}
+
+func (x *UpsertUserPreferencesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertUserPreferencesRequest.ProtoReflect.Descriptor instead.
+func (*UpsertUserPreferencesRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_userpreferences_v1_userpreferences_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *UpsertUserPreferencesRequest) GetPreferences() *UserPreferences {
+	if x != nil {
+		return x.Preferences
+	}
+	return nil
+}
+
+func (x *UpsertUserPreferencesRequest) GetUsername() string {
+	if x != nil {
+		return x.Username
+	}
+	return ""
+}
+
+var File_teleport_userpreferences_v1_userpreferences_proto protoreflect.FileDescriptor
+
+var file_teleport_userpreferences_v1_userpreferences_proto_rawDesc = []byte{
+	0x0a, 0x31, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x70,
+	0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x1b, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31,
+	0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x28, 0x74,
+	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66,
+	0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x73, 0x73, 0x69, 0x73,
+	0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x29, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65,
+	0x73, 0x2f, 0x76, 0x31, 0x2f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x1a, 0x27, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x75, 0x73, 0x65,
+	0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2f, 0x76, 0x31, 0x2f,
+	0x74, 0x68, 0x65, 0x6d, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe6, 0x01, 0x0a, 0x0f,
+	0x55, 0x73, 0x65, 0x72, 0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x12,
+	0x4a, 0x0a, 0x06, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x32, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70,
+	0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x73,
+	0x73, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e,
+	0x63, 0x65, 0x73, 0x52, 0x06, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x12, 0x38, 0x0a, 0x05, 0x74,
+	0x68, 0x65, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72,
+	0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x68, 0x65, 0x6d, 0x65, 0x52, 0x05,
+	0x74, 0x68, 0x65, 0x6d, 0x65, 0x12, 0x4d, 0x0a, 0x07, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65,
+	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x55, 0x73, 0x65, 0x72,
+	0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x52, 0x07, 0x6f, 0x6e, 0x62,
+	0x6f, 0x61, 0x72, 0x64, 0x22, 0x37, 0x0a, 0x19, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x50,
+	0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x6c, 0x0a,
+	0x1a, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e,
+	0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4e, 0x0a, 0x0b, 0x70,
+	0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72,
+	0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x55,
+	0x73, 0x65, 0x72, 0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x52, 0x0b,
+	0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x22, 0x8a, 0x01, 0x0a, 0x1c,
+	0x55, 0x70, 0x73, 0x65, 0x72, 0x74, 0x55, 0x73, 0x65, 0x72, 0x50, 0x72, 0x65, 0x66, 0x65, 0x72,
+	0x65, 0x6e, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x4e, 0x0a, 0x0b,
+	0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65,
+	0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e,
+	0x55, 0x73, 0x65, 0x72, 0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x52,
+	0x0b, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x12, 0x1a, 0x0a, 0x08,
+	0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x32, 0x8c, 0x02, 0x0a, 0x16, 0x55, 0x73, 0x65,
+	0x72, 0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x85, 0x01, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x50,
+	0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x12, 0x36, 0x2e, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72,
+	0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72,
+	0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x37, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31,
+	0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e,
+	0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6a, 0x0a, 0x15, 0x55,
+	0x70, 0x73, 0x65, 0x72, 0x74, 0x55, 0x73, 0x65, 0x72, 0x50, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65,
+	0x6e, 0x63, 0x65, 0x73, 0x12, 0x39, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
+	0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x55, 0x70, 0x73, 0x65, 0x72, 0x74, 0x55, 0x73, 0x65, 0x72, 0x50, 0x72, 0x65,
+	0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x42, 0x59, 0x5a, 0x57, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69,
+	0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x75, 0x73,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2f, 0x76, 0x31,
+	0x3b, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73,
+	0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_teleport_userpreferences_v1_userpreferences_proto_rawDescOnce sync.Once
+	file_teleport_userpreferences_v1_userpreferences_proto_rawDescData = file_teleport_userpreferences_v1_userpreferences_proto_rawDesc
+)
+
+func file_teleport_userpreferences_v1_userpreferences_proto_rawDescGZIP() []byte {
+	file_teleport_userpreferences_v1_userpreferences_proto_rawDescOnce.Do(func() {
+		file_teleport_userpreferences_v1_userpreferences_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_userpreferences_v1_userpreferences_proto_rawDescData)
+	})
+	return file_teleport_userpreferences_v1_userpreferences_proto_rawDescData
+}
+
+var file_teleport_userpreferences_v1_userpreferences_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_teleport_userpreferences_v1_userpreferences_proto_goTypes = []interface{}{
+	(*UserPreferences)(nil),              // 0: teleport.userpreferences.v1.UserPreferences
+	(*GetUserPreferencesRequest)(nil),    // 1: teleport.userpreferences.v1.GetUserPreferencesRequest
+	(*GetUserPreferencesResponse)(nil),   // 2: teleport.userpreferences.v1.GetUserPreferencesResponse
+	(*UpsertUserPreferencesRequest)(nil), // 3: teleport.userpreferences.v1.UpsertUserPreferencesRequest
+	(*AssistUserPreferences)(nil),        // 4: teleport.userpreferences.v1.AssistUserPreferences
+	(Theme)(0),                           // 5: teleport.userpreferences.v1.Theme
+	(*OnboardUserPreferences)(nil),       // 6: teleport.userpreferences.v1.OnboardUserPreferences
+	(*emptypb.Empty)(nil),                // 7: google.protobuf.Empty
+}
+var file_teleport_userpreferences_v1_userpreferences_proto_depIdxs = []int32{
+	4, // 0: teleport.userpreferences.v1.UserPreferences.assist:type_name -> teleport.userpreferences.v1.AssistUserPreferences
+	5, // 1: teleport.userpreferences.v1.UserPreferences.theme:type_name -> teleport.userpreferences.v1.Theme
+	6, // 2: teleport.userpreferences.v1.UserPreferences.onboard:type_name -> teleport.userpreferences.v1.OnboardUserPreferences
+	0, // 3: teleport.userpreferences.v1.GetUserPreferencesResponse.preferences:type_name -> teleport.userpreferences.v1.UserPreferences
+	0, // 4: teleport.userpreferences.v1.UpsertUserPreferencesRequest.preferences:type_name -> teleport.userpreferences.v1.UserPreferences
+	1, // 5: teleport.userpreferences.v1.UserPreferencesService.GetUserPreferences:input_type -> teleport.userpreferences.v1.GetUserPreferencesRequest
+	3, // 6: teleport.userpreferences.v1.UserPreferencesService.UpsertUserPreferences:input_type -> teleport.userpreferences.v1.UpsertUserPreferencesRequest
+	2, // 7: teleport.userpreferences.v1.UserPreferencesService.GetUserPreferences:output_type -> teleport.userpreferences.v1.GetUserPreferencesResponse
+	7, // 8: teleport.userpreferences.v1.UserPreferencesService.UpsertUserPreferences:output_type -> google.protobuf.Empty
+	7, // [7:9] is the sub-list for method output_type
+	5, // [5:7] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_teleport_userpreferences_v1_userpreferences_proto_init() }
+func file_teleport_userpreferences_v1_userpreferences_proto_init() {
+	if File_teleport_userpreferences_v1_userpreferences_proto != nil {
+		return
+	}
+	file_teleport_userpreferences_v1_assist_proto_init()
+	file_teleport_userpreferences_v1_onboard_proto_init()
+	file_teleport_userpreferences_v1_theme_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UserPreferences); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetUserPreferencesRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetUserPreferencesResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_userpreferences_v1_userpreferences_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpsertUserPreferencesRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_userpreferences_v1_userpreferences_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_userpreferences_v1_userpreferences_proto_goTypes,
+		DependencyIndexes: file_teleport_userpreferences_v1_userpreferences_proto_depIdxs,
+		MessageInfos:      file_teleport_userpreferences_v1_userpreferences_proto_msgTypes,
+	}.Build()
+	File_teleport_userpreferences_v1_userpreferences_proto = out.File
+	file_teleport_userpreferences_v1_userpreferences_proto_rawDesc = nil
+	file_teleport_userpreferences_v1_userpreferences_proto_goTypes = nil
+	file_teleport_userpreferences_v1_userpreferences_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/userpreferences/v1/userpreferences_grpc.pb.go b/api/gen/proto/go/userpreferences/v1/userpreferences_grpc.pb.go
new file mode 100644
index 0000000000000..47fd6c6475447
--- /dev/null
+++ b/api/gen/proto/go/userpreferences/v1/userpreferences_grpc.pb.go
@@ -0,0 +1,166 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: teleport/userpreferences/v1/userpreferences.proto
+
+package userpreferencesv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	UserPreferencesService_GetUserPreferences_FullMethodName    = "/teleport.userpreferences.v1.UserPreferencesService/GetUserPreferences"
+	UserPreferencesService_UpsertUserPreferences_FullMethodName = "/teleport.userpreferences.v1.UserPreferencesService/UpsertUserPreferences"
+)
+
+// UserPreferencesServiceClient is the client API for UserPreferencesService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type UserPreferencesServiceClient interface {
+	// GetUserPreferences returns the user preferences for a given user.
+	GetUserPreferences(ctx context.Context, in *GetUserPreferencesRequest, opts ...grpc.CallOption) (*GetUserPreferencesResponse, error)
+	// UpsertUserPreferences creates or updates user preferences for a given username.
+	UpsertUserPreferences(ctx context.Context, in *UpsertUserPreferencesRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+}
+
+type userPreferencesServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewUserPreferencesServiceClient(cc grpc.ClientConnInterface) UserPreferencesServiceClient {
+	return &userPreferencesServiceClient{cc}
+}
+
+func (c *userPreferencesServiceClient) GetUserPreferences(ctx context.Context, in *GetUserPreferencesRequest, opts ...grpc.CallOption) (*GetUserPreferencesResponse, error) {
+	out := new(GetUserPreferencesResponse)
+	err := c.cc.Invoke(ctx, UserPreferencesService_GetUserPreferences_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *userPreferencesServiceClient) UpsertUserPreferences(ctx context.Context, in *UpsertUserPreferencesRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, UserPreferencesService_UpsertUserPreferences_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// UserPreferencesServiceServer is the server API for UserPreferencesService service.
+// All implementations must embed UnimplementedUserPreferencesServiceServer
+// for forward compatibility
+type UserPreferencesServiceServer interface {
+	// GetUserPreferences returns the user preferences for a given user.
+	GetUserPreferences(context.Context, *GetUserPreferencesRequest) (*GetUserPreferencesResponse, error)
+	// UpsertUserPreferences creates or updates user preferences for a given username.
+	UpsertUserPreferences(context.Context, *UpsertUserPreferencesRequest) (*emptypb.Empty, error)
+	mustEmbedUnimplementedUserPreferencesServiceServer()
+}
+
+// UnimplementedUserPreferencesServiceServer must be embedded to have forward compatible implementations.
+type UnimplementedUserPreferencesServiceServer struct {
+}
+
+func (UnimplementedUserPreferencesServiceServer) GetUserPreferences(context.Context, *GetUserPreferencesRequest) (*GetUserPreferencesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetUserPreferences not implemented")
+}
+func (UnimplementedUserPreferencesServiceServer) UpsertUserPreferences(context.Context, *UpsertUserPreferencesRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpsertUserPreferences not implemented")
+}
+func (UnimplementedUserPreferencesServiceServer) mustEmbedUnimplementedUserPreferencesServiceServer() {
+}
+
+// UnsafeUserPreferencesServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to UserPreferencesServiceServer will
+// result in compilation errors.
+type UnsafeUserPreferencesServiceServer interface {
+	mustEmbedUnimplementedUserPreferencesServiceServer()
+}
+
+func RegisterUserPreferencesServiceServer(s grpc.ServiceRegistrar, srv UserPreferencesServiceServer) {
+	s.RegisterService(&UserPreferencesService_ServiceDesc, srv)
+}
+
+func _UserPreferencesService_GetUserPreferences_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetUserPreferencesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(UserPreferencesServiceServer).GetUserPreferences(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: UserPreferencesService_GetUserPreferences_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(UserPreferencesServiceServer).GetUserPreferences(ctx, req.(*GetUserPreferencesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _UserPreferencesService_UpsertUserPreferences_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpsertUserPreferencesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(UserPreferencesServiceServer).UpsertUserPreferences(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: UserPreferencesService_UpsertUserPreferences_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(UserPreferencesServiceServer).UpsertUserPreferences(ctx, req.(*UpsertUserPreferencesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// UserPreferencesService_ServiceDesc is the grpc.ServiceDesc for UserPreferencesService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var UserPreferencesService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.userpreferences.v1.UserPreferencesService",
+	HandlerType: (*UserPreferencesServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetUserPreferences",
+			Handler:    _UserPreferencesService_GetUserPreferences_Handler,
+		},
+		{
+			MethodName: "UpsertUserPreferences",
+			Handler:    _UserPreferencesService_UpsertUserPreferences_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "teleport/userpreferences/v1/userpreferences.proto",
+}
diff --git a/api/go.mod b/api/go.mod
index da7ecda56a4f6..d1bbd1a01baf3 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -3,6 +3,7 @@ module github.com/gravitational/teleport/api
 go 1.19
 
 require (
+	cloud.google.com/go/compute/metadata v0.2.3
 	github.com/coreos/go-semver v0.3.1
 	github.com/go-piv/piv-go v1.11.0
 	github.com/gogo/protobuf v1.3.2
@@ -20,17 +21,18 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.16.0
 	go.opentelemetry.io/otel/sdk v1.16.0
 	go.opentelemetry.io/otel/trace v1.16.0
-	go.opentelemetry.io/proto/otlp v0.19.0
-	golang.org/x/crypto v0.9.0
+	go.opentelemetry.io/proto/otlp v0.20.0
+	golang.org/x/crypto v0.10.0
 	golang.org/x/exp v0.0.0-20221126150942-6ab00d035af9
-	golang.org/x/net v0.10.0
-	google.golang.org/genproto v0.0.0-20230327152035-dc694ad2151e
-	google.golang.org/grpc v1.55.0
+	golang.org/x/net v0.11.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc
+	google.golang.org/grpc v1.56.1
 	google.golang.org/protobuf v1.30.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
+	cloud.google.com/go/compute v1.19.1 // indirect
 	github.com/beevik/etree v1.1.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
@@ -38,14 +40,15 @@ require (
 	github.com/go-logr/logr v1.2.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/russellhaering/goxmldsig v1.3.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0 // indirect
 	go.opentelemetry.io/otel/metric v1.16.0 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/term v0.8.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/sys v0.9.0 // indirect
+	golang.org/x/term v0.9.0 // indirect
+	golang.org/x/text v0.10.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/api/go.sum b/api/go.sum
index f89f8cf481599..7b13e084864f9 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -1,61 +1,25 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.110.0 h1:Zc8gqp3+a9/Eyph2KDmcGaPtbKRIoqq4YTlL4NMD0Ys=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute v1.19.0 h1:+9zda3WGgW1ZSTlVppLCYFIr48Pa35q1uG2N1itbCEQ=
+cloud.google.com/go/compute v1.19.1 h1:am86mquDUgjGNWxiGn+5PGLbmgiWXlE/yNWpIpNvuXY=
+cloud.google.com/go/compute v1.19.1/go.mod h1:6ylj3a05WF8leseCdIf77NK0g1ey+nj5IKd5/kvShxE=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=
 github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
 github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 h1:/inchEIKaYC1Akx+H+gqO04wryn5h75LSazbRlnya1k=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -66,15 +30,12 @@ github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymF
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v0.10.1 h1:c0g45+xCJhdgFGw7a5QAfdS4byAbud7miNWJ1WwEVf8=
 github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
 github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
 github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -85,24 +46,11 @@ github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
 github.com/golang/glog v1.1.0 h1:/d3pCKDPWNnvIWe0vVUpNP32qc8U3PDVxySP/y360qE=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
@@ -112,57 +60,34 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/gravitational/trace v1.2.1 h1:Iaf43aqbKV5H8bdiRs1qByjEHgAfADJ0lt0JwRyu+q8=
 github.com/gravitational/trace v1.2.1/go.mod h1:n0ijrq6psJY0sOI/NzLp+xdd8xl79jjwzVOFHDY6+kQ=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 h1:BZHcxBETFHIdVyhyEfOvn/RdU/QGdLI4y34qQGjGWO0=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
 github.com/jonboulle/clockwork v0.3.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
 github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=
 github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -174,7 +99,6 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8=
 github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
@@ -185,24 +109,15 @@ github.com/russellhaering/goxmldsig v1.3.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWy
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0 h1:ZOLJc06r4CB42laIXg/7udr0pbZyuAihN10A/XuiQRY=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0/go.mod h1:5z+/ZWJQKXa9YT34fQNx5K8Hd1EoIhvtUygUQPqEOgQ=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.42.0 h1:pginetY7+onl4qN1vl0xW/V/v6OBZ0vVdH+esuJgvmM=
@@ -222,47 +137,21 @@ go.opentelemetry.io/otel/sdk v1.16.0/go.mod h1:tMsIuKXuuIWPBAOrH+eHtvhTL+SntFtXF
 go.opentelemetry.io/otel/trace v1.16.0 h1:8JRpaObFoW0pxuVPapkgH8UhHQj+bJW8jJsCZEu5MQs=
 go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLkqr2QVwea0ef0=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJPI1Nnw=
-go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
+go.opentelemetry.io/proto/otlp v0.20.0 h1:BLOA1cZBAGSbRiNuGCCKiFrCdYB7deeHDeD1SueyOfA=
+go.opentelemetry.io/proto/otlp v0.20.0/go.mod h1:3QgjzPALBIv9pcknj2EXGPXjYPFdUh/RQfF8Lz3+Vnw=
 go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
-golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
+golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
+golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/exp v0.0.0-20221126150942-6ab00d035af9 h1:yZNXmy+j/JpX19vZkVktWqAo7Gny4PBWYYK3zskGpx4=
 golang.org/x/exp v0.0.0-20221126150942-6ab00d035af9/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -271,223 +160,80 @@ golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU=
+golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw=
+golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
+golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28=
+golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58=
+golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20230327152035-dc694ad2151e h1:rRGPYd0STm9H4Ci+iGrSLG35mkAKY41/nzCcG7PQADw=
-google.golang.org/genproto v0.0.0-20230327152035-dc694ad2151e/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
+google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e h1:Ao9GzfUMPH3zjVfzXG5rlWlk+Q8MXWKwWpwVQE1MXfw=
+google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc h1:kVKPf/IiYSBWEWtkIn6wZXwWGCnLKcC8oWfZvXjsGnM=
+google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc h1:XSJ8Vk1SWuNr8S18z1NZSziL0CPIXLCCMDOEFtHBOFc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
-google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
+google.golang.org/grpc v1.56.1 h1:z0dNfjIl0VpaZ9iSVjA6daGatAYwPGstTjt5vkRMFkQ=
+google.golang.org/grpc v1.56.1/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -496,11 +242,9 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -517,12 +261,4 @@ gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/lib/fuzz/fuzz.go b/api/import_compute.go
similarity index 55%
rename from lib/fuzz/fuzz.go
rename to api/import_compute.go
index d83eaf2d9c3fc..b3978b19bbe42 100644
--- a/lib/fuzz/fuzz.go
+++ b/api/import_compute.go
@@ -1,4 +1,4 @@
-// Copyright 2021 Gravitational, Inc
+// Copyright 2023 Gravitational, Inc
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -12,28 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-//go:build gofuzz
-// +build gofuzz
-
-package fuzz
+package api
 
 import (
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/lib/utils/parse"
+	_ "cloud.google.com/go/compute/metadata" // fix tidy issues with otel
 )
-
-func FuzzParseProxyJump(data []byte) int {
-	_, err := utils.ParseProxyJump(string(data))
-	if err != nil {
-		return 0
-	}
-	return 1
-}
-
-func FuzzNewExpression(data []byte) int {
-	_, err := parse.NewExpression(string(data))
-	if err != nil {
-		return 0
-	}
-	return 1
-}
diff --git a/api/observability/tracing/tracing.go b/api/observability/tracing/tracing.go
index 6e6f848404135..6e33cb073c046 100644
--- a/api/observability/tracing/tracing.go
+++ b/api/observability/tracing/tracing.go
@@ -47,3 +47,9 @@ func WithPropagationContext(ctx context.Context, pc PropagationContext, opts ...
 func DefaultProvider() oteltrace.TracerProvider {
 	return otel.GetTracerProvider()
 }
+
+// NewTracer creates a new [oteltrace.Tracer] from the global default
+// [oteltrace.TracerProvider] with the provided name.
+func NewTracer(name string) oteltrace.Tracer {
+	return DefaultProvider().Tracer(name)
+}
diff --git a/api/profile/profile.go b/api/profile/profile.go
index a0564ef30dd10..abc8f45d16f6c 100644
--- a/api/profile/profile.go
+++ b/api/profile/profile.go
@@ -142,6 +142,12 @@ func (p *Profile) TLSConfig() (*tls.Config, error) {
 	}, nil
 }
 
+// RequireKubeLocalProxy returns true if this profile indicates a local proxy
+// is required for kube access.
+func (p *Profile) RequireKubeLocalProxy() bool {
+	return p.KubeProxyAddr == p.WebProxyAddr && p.TLSRoutingConnUpgradeRequired
+}
+
 func certPoolFromProfile(p *Profile) (*x509.CertPool, error) {
 	// Check if CAS dir exist if not try to load certs from legacy certs.pem file.
 	if _, err := os.Stat(p.TLSClusterCASDir()); err != nil {
diff --git a/api/profile/profile_test.go b/api/profile/profile_test.go
index 663e6fd9eafd4..5ef6181de2320 100644
--- a/api/profile/profile_test.go
+++ b/api/profile/profile_test.go
@@ -115,3 +115,58 @@ func TestProfilePath(t *testing.T) {
 	require.Equal(t, "/foo/bar", profile.FullProfilePath("/foo/bar"))
 	require.Equal(t, filepath.Join(dir, ".tsh"), profile.FullProfilePath(""))
 }
+
+func TestRequireKubeLocalProxy(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name         string
+		inputProfile *profile.Profile
+		checkResult  require.BoolAssertionFunc
+	}{
+		{
+			name: "kube not enabled",
+			inputProfile: &profile.Profile{
+				WebProxyAddr:                  "example.com:443",
+				TLSRoutingEnabled:             true,
+				TLSRoutingConnUpgradeRequired: true,
+			},
+			checkResult: require.False,
+		},
+		{
+			name: "ALPN connection upgrade not required",
+			inputProfile: &profile.Profile{
+				WebProxyAddr:      "example.com:443",
+				KubeProxyAddr:     "example.com:443",
+				TLSRoutingEnabled: true,
+			},
+			checkResult: require.False,
+		},
+		{
+			name: "kube uses separate listener",
+			inputProfile: &profile.Profile{
+				WebProxyAddr:                  "example.com:443",
+				KubeProxyAddr:                 "example.com:3026",
+				TLSRoutingEnabled:             false,
+				TLSRoutingConnUpgradeRequired: true,
+			},
+			checkResult: require.False,
+		},
+		{
+			name: "local proxy required",
+			inputProfile: &profile.Profile{
+				WebProxyAddr:                  "example.com:443",
+				KubeProxyAddr:                 "example.com:443",
+				TLSRoutingEnabled:             true,
+				TLSRoutingConnUpgradeRequired: true,
+			},
+			checkResult: require.True,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			test.checkResult(t, test.inputProfile.RequireKubeLocalProxy())
+		})
+	}
+}
diff --git a/api/proto/teleport/accesslist/v1/accesslist.proto b/api/proto/teleport/accesslist/v1/accesslist.proto
new file mode 100644
index 0000000000000..7745b35b30dc2
--- /dev/null
+++ b/api/proto/teleport/accesslist/v1/accesslist.proto
@@ -0,0 +1,115 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.accesslist.v1;
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/timestamp.proto";
+import "teleport/header/v1/resourceheader.proto";
+import "teleport/trait/v1/trait.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/accesslist/v1;accesslist";
+
+// AccessList describes the basic building block of access grants, which are
+// similar to access requests but for longer lived permissions that need to be
+// regularly audited.
+message AccessList {
+  // header is the header for the resource.
+  teleport.header.v1.ResourceHeader header = 1;
+
+  // spec is the specification for the access list.
+  AccessListSpec spec = 2;
+}
+
+// AccessListSpec is the specification for an access list.
+message AccessListSpec {
+  // description is a plaintext description of the access list.
+  string description = 1;
+
+  // owners is a list of owners of the access list.
+  repeated AccessListOwner owners = 2;
+
+  // audit describes the frequency that this access list must be audited.
+  AccessListAudit audit = 3;
+
+  // membership_requires describes the requirements for a user to be a member of the access list.
+  // For a membership to an access list to be effective, the user must meet the requirements of
+  // Membership_requires and must be in the members list.
+  AccessListRequires membership_requires = 4;
+
+  // ownership_requires describes the requirements for a user to be an owner of the access list.
+  // For ownership of an access list to be effective, the user must meet the requirements of
+  // ownership_requires and must be in the owners list.
+  AccessListRequires ownership_requires = 5;
+
+  // grants describes the access granted by membership to this access list.
+  AccessListGrants grants = 6;
+
+  // members describes the current members of the access list.
+  repeated AccessListMember members = 7;
+}
+
+// AccessListOwner is an owner of an access list.
+message AccessListOwner {
+  // name is the username of the owner.
+  string name = 1;
+
+  // description is the plaintext description of the owner and why they are an owner.
+  string description = 2;
+}
+
+// AccessListAudit describes the audit configuration for an access list.
+message AccessListAudit {
+  // frequency is a duration that describes how often an access list must be audited.
+  google.protobuf.Duration frequency = 1;
+}
+
+// AccessListRequires describes a requirement section for an access list. A user must
+// meet the following criteria to obtain the specific access to the list.
+message AccessListRequires {
+  // roles are the user roles that must be present for the user to obtain access.
+  repeated string roles = 1;
+
+  // traits are the traits that must be present for the user to obtain access.
+  repeated teleport.trait.v1.Trait traits = 2;
+}
+
+// AccessListGrants describes what access is granted by membership to the access list.
+message AccessListGrants {
+  // roles are the roles that are granted to users who are members of the access list.
+  repeated string roles = 1;
+
+  // traits are the traits that are granted to users who are members of the access list.
+  repeated teleport.trait.v1.Trait traits = 2;
+}
+
+// AccessListMember describes a member of an access list.
+message AccessListMember {
+  // name is the name of the member of the access list.
+  string name = 1;
+
+  // joined is when the user joined the access list.
+  google.protobuf.Timestamp joined = 2;
+
+  // expires is when the user's membership to the access list expires.
+  google.protobuf.Timestamp expires = 3;
+
+  // reason is the reason this user was added to the access list.
+  string reason = 4;
+
+  // added_by is the user that added this user to the access list.
+  string added_by = 5;
+}
diff --git a/api/proto/teleport/assist/v1/assist.proto b/api/proto/teleport/assist/v1/assist.proto
index d3065ff35214c..6157198d791c0 100644
--- a/api/proto/teleport/assist/v1/assist.proto
+++ b/api/proto/teleport/assist/v1/assist.proto
@@ -121,6 +121,35 @@ message DeleteAssistantConversationRequest {
   string username = 2;
 }
 
+// GetAssistantEmbeddingsRequest is a request to get embeddings.
+message GetAssistantEmbeddingsRequest {
+  // username is a username of the user who requested the embeddings.
+  string username = 1;
+  // query is the query used for similarity search.
+  string query = 2;
+  // limit is the number of embeddings to return (also known as k).
+  uint32 limit = 3;
+  // kind is the kind of embeddings to return (ex, node).
+  string kind = 4;
+}
+
+// EmbeddingDocument is a document with an embedding.
+message EmbeddedDocument {
+  // id is the id of the document.
+  string id = 1;
+  // content is the content of the document.
+  string content = 2;
+  // similarityScore is the similarity score of the document.
+  float similarity_score = 3;
+}
+
+// GetAssistantEmbeddingsResponse is a response from the assistant service.
+message GetAssistantEmbeddingsResponse {
+  // embeddings is the list of embeddings.
+  // The list is sorted by similarity score in descending order.
+  repeated EmbeddedDocument embeddings = 1;
+}
+
 // AssistService is a service that provides an ability to communicate with the Teleport Assist.
 service AssistService {
   // CreateNewConversation creates a new conversation and returns the UUID of it.
@@ -144,3 +173,9 @@ service AssistService {
   // IsAssistEnabled returns true if the assist is enabled or not on the auth level.
   rpc IsAssistEnabled(IsAssistEnabledRequest) returns (IsAssistEnabledResponse);
 }
+
+// AssistEmbeddingService is a service that provides an ability to communicate with the Assist Embedding service.
+service AssistEmbeddingService {
+  // AssistantGetEmbeddings returns the embeddings for the given query.
+  rpc GetAssistantEmbeddings(GetAssistantEmbeddingsRequest) returns (GetAssistantEmbeddingsResponse);
+}
diff --git a/api/proto/teleport/devicetrust/v1/device_collected_data.proto b/api/proto/teleport/devicetrust/v1/device_collected_data.proto
index 5a07a4f1eeebf..92a69e1d0d236 100644
--- a/api/proto/teleport/devicetrust/v1/device_collected_data.proto
+++ b/api/proto/teleport/devicetrust/v1/device_collected_data.proto
@@ -18,6 +18,7 @@ package teleport.devicetrust.v1;
 
 import "google/protobuf/timestamp.proto";
 import "teleport/devicetrust/v1/os_type.proto";
+import "teleport/devicetrust/v1/tpm.proto";
 
 option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
 
@@ -81,4 +82,18 @@ message DeviceCollectedData {
   // The serial number of the "base board" as reported by BIOS DMI Type 2.
   // This field can be empty if no value has been configured.
   string base_board_serial_number = 13;
+
+  // If during the collection of this device data, the device performed a TPM
+  // platform attestation (e.g during enrollment or authentication), then this
+  // field holds the record of this attestation. This allows the state of the
+  // device to be compared to historical state, and allows for the platform
+  // attestations to be revalidated at a later date.
+  //
+  // This field is not explicitly sent up by the client, and any DCD sent by a
+  // client including this field should be rejected. The server should inject
+  // this field once verifying that the submitted platform attestation during
+  // the enrollment or authentication.
+  //
+  // System managed.
+  TPMPlatformAttestation tpm_platform_attestation = 14;
 }
diff --git a/api/proto/teleport/devicetrust/v1/device_profile.proto b/api/proto/teleport/devicetrust/v1/device_profile.proto
index 0c474dc525418..f1fde92053ae4 100644
--- a/api/proto/teleport/devicetrust/v1/device_profile.proto
+++ b/api/proto/teleport/devicetrust/v1/device_profile.proto
@@ -46,4 +46,7 @@ message DeviceProfile {
   // Jamf binary version, without the leading 'v'.
   // Example: "9.27" or "10.44.1-t1677509507".
   string jamf_binary_version = 6;
+
+  // External device identifier, for example the Jamf or Intune ID.
+  string external_id = 7;
 }
diff --git a/api/proto/teleport/devicetrust/v1/devicetrust_service.proto b/api/proto/teleport/devicetrust/v1/devicetrust_service.proto
index e7dd695d1bb59..c081b395c0092 100644
--- a/api/proto/teleport/devicetrust/v1/devicetrust_service.proto
+++ b/api/proto/teleport/devicetrust/v1/devicetrust_service.proto
@@ -23,6 +23,7 @@ import "teleport/devicetrust/v1/device.proto";
 import "teleport/devicetrust/v1/device_collected_data.proto";
 import "teleport/devicetrust/v1/device_enroll_token.proto";
 import "teleport/devicetrust/v1/device_source.proto";
+import "teleport/devicetrust/v1/tpm.proto";
 import "teleport/devicetrust/v1/user_certificates.proto";
 
 option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
@@ -438,36 +439,6 @@ message TPMEnrollChallengeResponse {
   TPMPlatformParameters platform_parameters = 2;
 }
 
-// Encapsulates the value of a PCR at a point at time.
-// See https://pkg.go.dev/github.com/google/go-attestation/attest#PCR
-message TPMPCR {
-  // the PCR index in the PCR bank
-  int32 index = 1;
-  // the digest currently held in the PCR
-  bytes digest = 2;
-  // the hash algorithm used to produce the digest in this PCR bank. This value
-  // is the underlying value of the Go crypto.Hash type.
-  uint64 digest_alg = 3;
-}
-
-// Encapsulates the result of a quote operation against the TPM over a PCR
-// using an attestation key.
-// See https://pkg.go.dev/github.com/google/go-attestation/attest#Quote
-message TPMQuote {
-  bytes quote = 1;
-  bytes signature = 2;
-}
-
-// The quotes, PCRs and event log from a TPM that attest to the booted state
-// of the machine.
-// See https://pkg.go.dev/github.com/google/go-attestation/attest#PlatformParameters
-// Excludes TPMVersion and Public since these are already known values.
-message TPMPlatformParameters {
-  repeated TPMQuote quotes = 1;
-  repeated TPMPCR pcrs = 2;
-  bytes event_log = 3;
-}
-
 // Request for AuthenticateDevice.
 //
 // Authentication ceremony flow:
@@ -554,8 +525,10 @@ message AuthenticateDeviceChallengeResponse {
 // (end loop)
 // -> SyncInventoryEnd
 // (loop until server closes the stream, zero or more times)
-// <- SyncInventoryResult (deleted/missing devices)
-// (end)
+// <- SyncInventoryMissingDevices
+// -> SyncInventoryDevices (removals only)
+// <- SyncInventoryResult
+// (end loop)
 message SyncInventoryRequest {
   oneof payload {
     SyncInventoryStart start = 1;
@@ -570,6 +543,7 @@ message SyncInventoryResponse {
   oneof payload {
     SyncInventoryAck ack = 1;
     SyncInventoryResult result = 2;
+    SyncInventoryMissingDevices missing_devices = 3;
   }
 }
 
@@ -580,51 +554,25 @@ message SyncInventoryStart {
   // by this RPC.
   DeviceSource source = 1;
 
-  // Mode of syncing.
-  // Required.
-  SyncInventoryMode mode = 2;
-
-  // Action for devices missing from the external inventory, but present in
-  // Teleport.
-  // Only executed if mode is FULL and external_sync_successful is set to true
-  // in the SyncInventoryEnd message.
-  SyncInventoryDeviceAction on_missing_action = 3;
-}
+  reserved 2; // SyncInventoryMode mode
+  reserved "mode";
 
-// Mode of sync for SyncInventory.
-enum SyncInventoryMode {
-  SYNC_INVENTORY_MODE_UNSPECIFIED = 0;
+  reserved 3; // SyncInventoryDeviceAction on_missing_action
+  reserved "on_missing_action";
 
-  // Partial inventory sync; not all devices in the external inventory are sent
-  // to the stream.
-  // Partial sync precludes inventory cleanup.
-  SYNC_INVENTORY_MODE_PARTIAL = 1;
-
-  // Full inventory sync; all devices in the external inventory must be sent to
-  // the stream.
-  // Full sync allows for handling of missing devices.
-  SYNC_INVENTORY_MODE_FULL = 2;
-}
-
-// Device action for SyncInventory.
-// Typically triggered at the end of FULL syncs..
-enum SyncInventoryDeviceAction {
-  SYNC_INVENTORY_DEVICE_ACTION_UNSPECIFIED = 0;
-
-  // Noop is a no-action.
-  SYNC_INVENTORY_DEVICE_ACTION_NOOP = 1;
-
-  // Deletes the device if the action condition is met.
-  SYNC_INVENTORY_DEVICE_ACTION_DELETE = 2;
+  // If true, the server keeps track of the devices upserted during the sync.
+  // After receiving the [SyncInventoryEnd] message, the server informs the
+  // client of all devices that are present in storage but not observed in the
+  // upserts.
+  // See [SyncInventoryRequest] and [SyncInventoryMissingDevices] for details.
+  bool track_missing_devices = 4;
 }
 
 // SyncInventoryEnd ends the inventory sync, signaling that no more
 // SyncInventoryDevices messages will be sent by the client.
 message SyncInventoryEnd {
-  // True if the external sync was fully successful (for example, all reads from
-  // an MDM API were successful).
-  // If false the sync's on_missing_action is skipped.
-  bool external_sync_successful = 1;
+  reserved 1; // bool external_sync_successful
+  reserved "external_sync_successful";
 }
 
 // SyncInventoryDevices transports devices to add/update/remove.
@@ -645,3 +593,18 @@ message SyncInventoryResult {
   // Devices modified, in the same order as the input when applicable.
   repeated DeviceOrStatus devices = 1;
 }
+
+// SyncInventoryMissingDevices informs the sync client of all stored devices
+// that were not observed in upserts during the sync.
+//
+// Requires `track_missing_devices` to be set in the [SyncInventoryStart]
+// message.
+//
+// The client must follow up with a [SyncInventoryDevices] message, including
+// any devices to be deleted.
+message SyncInventoryMissingDevices {
+  // Devices missing from the client-side sync.
+  // Guaranteed to have the following fields: id, os_type, asset_tag and
+  // profile.external_id.
+  repeated Device devices = 1;
+}
diff --git a/api/proto/teleport/devicetrust/v1/tpm.proto b/api/proto/teleport/devicetrust/v1/tpm.proto
new file mode 100644
index 0000000000000..77b88b14e838c
--- /dev/null
+++ b/api/proto/teleport/devicetrust/v1/tpm.proto
@@ -0,0 +1,59 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.devicetrust.v1;
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
+
+// Encapsulates the value of a PCR at a point at time.
+// See https://pkg.go.dev/github.com/google/go-attestation/attest#PCR
+message TPMPCR {
+  // the PCR index in the PCR bank
+  int32 index = 1;
+  // the digest currently held in the PCR
+  bytes digest = 2;
+  // the hash algorithm used to produce the digest in this PCR bank. This value
+  // is the underlying value of the Go crypto.Hash type.
+  uint64 digest_alg = 3;
+}
+
+// Encapsulates the result of a quote operation against the TPM over a PCR
+// using an attestation key.
+// See https://pkg.go.dev/github.com/google/go-attestation/attest#Quote
+message TPMQuote {
+  bytes quote = 1;
+  bytes signature = 2;
+}
+
+// The quotes, PCRs and event log from a TPM that attest to the booted state
+// of the machine.
+// See https://pkg.go.dev/github.com/google/go-attestation/attest#PlatformParameters
+// Excludes TPMVersion and Public since these are already known values.
+message TPMPlatformParameters {
+  repeated TPMQuote quotes = 1;
+  repeated TPMPCR pcrs = 2;
+  bytes event_log = 3;
+}
+
+// Holds the record of a TPM platform attestation, including the platform
+// parameters sent by the device and the nonce the server generated. This allows
+// a historical platform attestation to be revalidated and allows us to compare
+// the incoming state of a device (e.g during authentication) against the
+// historical state in order to detect potentially malicious actions.
+message TPMPlatformAttestation {
+  bytes nonce = 1;
+  TPMPlatformParameters platform_parameters = 2;
+}
diff --git a/api/proto/teleport/embedding/v1/embedding.proto b/api/proto/teleport/embedding/v1/embedding.proto
new file mode 100644
index 0000000000000..cef7732aab551
--- /dev/null
+++ b/api/proto/teleport/embedding/v1/embedding.proto
@@ -0,0 +1,38 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.embedding.v1;
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/embedding/v1;embeddingv1";
+
+// Embedding contains a Teleport resource embedding. Embeddings are small semantic
+// representations of larger and more complex data. Embeddings can be compared,
+// the smaller the distance between two vectors, the closer the concepts are.
+// Teleport Assist embeds resources to perform semantic search.
+message Embedding {
+  // EmbeddedKind is the kind of the embedded resource.
+  string embedded_kind = 1;
+
+  // EmbeddedId is the ID of the embedded resource.
+  string embedded_id = 2;
+
+  // EmbeddedHash is the hash of the embedded resource after serialization.
+  // This helps checking if the resource has changed and needs a new embedding.
+  bytes embedded_hash = 3;
+
+  // Vector is the embedding itself, as provided by the model.
+  repeated double vector = 4;
+}
diff --git a/api/proto/teleport/header/v1/metadata.proto b/api/proto/teleport/header/v1/metadata.proto
new file mode 100644
index 0000000000000..f430c942401f2
--- /dev/null
+++ b/api/proto/teleport/header/v1/metadata.proto
@@ -0,0 +1,39 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.header.v1;
+
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/header/v1;header";
+
+// Metadata is resource metadata.
+message Metadata {
+  // name is an object name.
+  string name = 1;
+  // namespace is object namespace. The field should be called "namespace"
+  // when it returns in Teleport 2.4.
+  string namespace = 2;
+  // description is object description.
+  string description = 3;
+  // labels is a set of labels.
+  map<string, string> labels = 5;
+  // expires is a global expiry time header can be set on any resource in the
+  // system.
+  google.protobuf.Timestamp expires = 6;
+  // ID is a record ID
+  int64 id = 7;
+}
diff --git a/api/proto/teleport/header/v1/resourceheader.proto b/api/proto/teleport/header/v1/resourceheader.proto
new file mode 100644
index 0000000000000..7c2de3551cc8c
--- /dev/null
+++ b/api/proto/teleport/header/v1/resourceheader.proto
@@ -0,0 +1,33 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.header.v1;
+
+import "teleport/header/v1/metadata.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/header/v1;header";
+
+// ResourceHeader is a shared resource header.
+message ResourceHeader {
+  // kind is a resource kind.
+  string kind = 1;
+  // sub_kind is an optional resource sub kind, used in some resources.
+  string sub_kind = 2;
+  // version is version.
+  string version = 3;
+  // metadata is resource metadata.
+  Metadata metadata = 4;
+}
diff --git a/api/proto/teleport/legacy/client/proto/authservice.proto b/api/proto/teleport/legacy/client/proto/authservice.proto
index d77f235c85d46..21be60ef47bc0 100644
--- a/api/proto/teleport/legacy/client/proto/authservice.proto
+++ b/api/proto/teleport/legacy/client/proto/authservice.proto
@@ -135,6 +135,8 @@ message Event {
     types.IntegrationV1 Integration = 42 [(gogoproto.jsontag) = "integration,omitempty"];
     // WatchStatus is an WatchStatus resource.
     types.WatchStatusV1 WatchStatus = 43 [(gogoproto.jsontag) = "watch_status,omitempty"];
+    // HeadlessAuthentication is a HeadlessAuthentication resource.
+    types.HeadlessAuthentication HeadlessAuthentication = 44 [(gogoproto.jsontag) = "headless_authentication,omitempty"];
   }
 }
 
@@ -3001,6 +3003,9 @@ service AuthService {
   // GetHeadlessAuthentication is a request to retrieve a headless authentication from the backend.
   rpc GetHeadlessAuthentication(GetHeadlessAuthenticationRequest) returns (types.HeadlessAuthentication);
 
+  // WatchPendingHeadlessAuthentications watches the backend for pending headless authentication requests for the user.
+  rpc WatchPendingHeadlessAuthentications(google.protobuf.Empty) returns (stream Event);
+
   // UpdateHeadlessAuthenticationState is a request to update a headless authentication's state.
   rpc UpdateHeadlessAuthenticationState(UpdateHeadlessAuthenticationStateRequest) returns (google.protobuf.Empty);
 
diff --git a/api/proto/teleport/legacy/types/device.proto b/api/proto/teleport/legacy/types/device.proto
index 4da16d6f7659e..7f863c4af9bda 100644
--- a/api/proto/teleport/legacy/types/device.proto
+++ b/api/proto/teleport/legacy/types/device.proto
@@ -67,10 +67,10 @@ message DeviceSpec {
 // teleport.devicetrust.v1.DeviceCredential.
 message DeviceCredential {
   string id = 1 [(gogoproto.jsontag) = "id"];
-  bytes public_key_der = 2 [(gogoproto.jsontag) = "public_key_der"];
-  string device_attestation_type = 3 [(gogoproto.jsontag) = "device_attestation_type"];
-  string tpm_ekcert_serial = 4 [(gogoproto.jsontag) = "tpm_ekcert_serial"];
-  bytes tpm_ak_public = 5 [(gogoproto.jsontag) = "tpm_ak_public"];
+  bytes public_key_der = 2 [(gogoproto.jsontag) = "public_key_der,omitempty"];
+  string device_attestation_type = 3 [(gogoproto.jsontag) = "device_attestation_type,omitempty"];
+  string tpm_ekcert_serial = 4 [(gogoproto.jsontag) = "tpm_ekcert_serial,omitempty"];
+  bytes tpm_ak_public = 5 [(gogoproto.jsontag) = "tpm_ak_public,omitempty"];
 }
 
 // DeviceCollectedData is the resource representation of
@@ -95,10 +95,39 @@ message DeviceCollectedData {
   string reported_asset_tag = 11 [(gogoproto.jsontag) = "reported_asset_tag,omitempty"];
   string system_serial_number = 12 [(gogoproto.jsontag) = "system_serial_number,omitempty"];
   string base_board_serial_number = 13 [(gogoproto.jsontag) = "base_board_serial_number,omitempty"];
+  TPMPlatformAttestation tpm_platform_attestation = 14 [(gogoproto.jsontag) = "tpm_platform_attestation,omitempty"];
+}
+
+// TPMPCR is the resource representation of teleport.devicetrust.v1.TPMPCR.
+message TPMPCR {
+  int32 index = 1 [(gogoproto.jsontag) = "index"];
+  bytes digest = 2 [(gogoproto.jsontag) = "digest"];
+  uint64 digest_alg = 3 [(gogoproto.jsontag) = "digest_alg"];
+}
+
+// TPMQuote is the resource representation of teleport.devicetrust.v1.TPMQuote.
+message TPMQuote {
+  bytes quote = 1 [(gogoproto.jsontag) = "quote"];
+  bytes signature = 2 [(gogoproto.jsontag) = "signature"];
+}
+
+// TPMPlatformParameters is the resource representation of
+// teleport.devicetrust.v1.TPMPlatformParameters.
+message TPMPlatformParameters {
+  repeated TPMQuote quotes = 1 [(gogoproto.jsontag) = "quotes"];
+  repeated TPMPCR pcrs = 2 [(gogoproto.jsontag) = "pcrs"];
+  bytes event_log = 3 [(gogoproto.jsontag) = "event_log"];
+}
+
+// TPMPlatformAttestation is the resource representation of
+// teleport.devicetrust.v1.TPMPlatformAttestation.
+message TPMPlatformAttestation {
+  bytes nonce = 1 [(gogoproto.jsontag) = "nonce,omitempty"];
+  TPMPlatformParameters platform_parameters = 2 [(gogoproto.jsontag) = "platform_parameters,omitempty"];
 }
 
 // DeviceSource is the resource representation of
-// teleport.devicetrust.v1.DeviceSource.
+// teleport.devicetrust.v1.DeviceSource..
 message DeviceSource {
   string name = 1 [(gogoproto.jsontag) = "name"];
   string origin = 2 [(gogoproto.jsontag) = "origin"];
@@ -116,4 +145,5 @@ message DeviceProfile {
   string os_build = 4 [(gogoproto.jsontag) = "os_build,omitempty"];
   repeated string os_usernames = 5 [(gogoproto.jsontag) = "os_usernames,omitempty"];
   string jamf_binary_version = 6 [(gogoproto.jsontag) = "jamf_binary_version,omitempty"];
+  string external_id = 7 [(gogoproto.jsontag) = "external_id,omitempty"];
 }
diff --git a/api/proto/teleport/legacy/types/types.proto b/api/proto/teleport/legacy/types/types.proto
index 4fc1ea60f98fc..5c3b5ad3beb90 100644
--- a/api/proto/teleport/legacy/types/types.proto
+++ b/api/proto/teleport/legacy/types/types.proto
@@ -348,6 +348,11 @@ message DatabaseSpecV3 {
   ];
   // AdminUser is the database admin user for automatic user provisioning.
   DatabaseAdminUser AdminUser = 11 [(gogoproto.jsontag) = "admin_user,omitempty"];
+  // MongoAtlas contains Atlas metadata about the database.
+  MongoAtlas MongoAtlas = 12 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "mongo_atlas,omitempty"
+  ];
 }
 
 // DatabaseAdminUser contains information about privileged database user used
@@ -426,6 +431,11 @@ message AWS {
   // AssumeRoleARN is an optional AWS role ARN to assume when accessing a database.
   // Set this field and ExternalID to enable access across AWS accounts.
   string AssumeRoleARN = 11 [(gogoproto.jsontag) = "assume_role_arn,omitempty"];
+  // OpenSearch contains AWS OpenSearch specific metadata.
+  OpenSearch OpenSearch = 12 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "opensearch,omitempty"
+  ];
 }
 
 // SecretStore contains secret store configurations.
@@ -500,6 +510,16 @@ message RedshiftServerless {
   string WorkgroupID = 3 [(gogoproto.jsontag) = "workgroup_id,omitempty"];
 }
 
+// OpenSearch contains AWS OpenSearch specific metadata.
+message OpenSearch {
+  // DomainName is the name of the domain.
+  string DomainName = 1 [(gogoproto.jsontag) = "domain_name,omitempty"];
+  // DomainID is the ID of the domain.
+  string DomainID = 2 [(gogoproto.jsontag) = "domain_id,omitempty"];
+  // EndpointType is the type of the endpoint.
+  string EndpointType = 3 [(gogoproto.jsontag) = "endpoint_type,omitempty"];
+}
+
 // GCPCloudSQL contains parameters specific to GCP Cloud SQL databases.
 message GCPCloudSQL {
   // ProjectID is the GCP project ID the Cloud SQL instance resides in.
@@ -575,6 +595,12 @@ message MySQLOptions {
   string ServerVersion = 1 [(gogoproto.jsontag) = "server_version,omitempty"];
 }
 
+// MongoAtlas contains Atlas metadata about the database.
+message MongoAtlas {
+  // Name is the Atlas database instance name.
+  string Name = 1 [(gogoproto.jsontag) = "name,omitempty"];
+}
+
 // InstanceV1 represents the state of a running teleport instance independent
 // of the specific services that instance exposes.
 message InstanceV1 {
@@ -843,6 +869,8 @@ message AppSpecV3 {
   AppAWS AWS = 6 [(gogoproto.jsontag) = "aws,omitempty"];
   // Cloud identifies the cloud instance the app represents.
   string Cloud = 7 [(gogoproto.jsontag) = "cloud,omitempty"];
+  // UserGroups are a list of user group IDs that this app is associated with.
+  repeated string UserGroups = 8;
 }
 
 // App is a specific application that a server proxies.
@@ -1709,6 +1737,13 @@ message AuthPreferenceSpecV2 {
     (gogoproto.jsontag) = "allow_headless,omitempty",
     (gogoproto.customtype) = "BoolOption"
   ];
+
+  // DefaultSessionTTL is the TTL to use for user certs when
+  // an explicit TTL is not requested.
+  int64 DefaultSessionTTL = 16 [
+    (gogoproto.jsontag) = "default_session_ttl,omitempty",
+    (gogoproto.casttype) = "Duration"
+  ];
 }
 
 // U2F defines settings for U2F device.
@@ -2290,6 +2325,19 @@ message RoleSpecV6 {
   ];
 }
 
+// CreateHostUserMode determines whether host user creation should be
+// disabled or if host users should be cleaned up or kept after
+// sessions end.
+enum CreateHostUserMode {
+  HOST_USER_MODE_UNSPECIFIED = 0;
+  // HOST_USER_MODE_OFF disables host user creation.
+  HOST_USER_MODE_OFF = 1;
+  // HOST_USER_MODE_DROP enables host user creation and deletes users at session end.
+  HOST_USER_MODE_DROP = 2;
+  // HOST_USER_MODE_KEEP enables host user creation and leaves users behind at session end.
+  HOST_USER_MODE_KEEP = 3;
+}
+
 // RoleOptions is a set of role options
 message RoleOptions {
   // ForwardAgent is SSH agent forwarding.
@@ -2403,7 +2451,7 @@ message RoleOptions {
   // CreateHostUser allows users to be automatically created on a host
   BoolValue CreateHostUser = 20 [
     (gogoproto.nullable) = true,
-    (gogoproto.jsontag) = "create_host_user",
+    (gogoproto.jsontag) = "create_host_user,omitempty",
     (gogoproto.customtype) = "BoolOption"
   ];
 
@@ -2447,6 +2495,10 @@ message RoleOptions {
     (gogoproto.jsontag) = "create_db_user",
     (gogoproto.customtype) = "BoolOption"
   ];
+
+  // CreateHostUserMode allows users to be automatically created on a
+  // host when not set to off
+  CreateHostUserMode CreateHostUserMode = 28 [(gogoproto.jsontag) = "create_host_user_mode,omitempty"];
 }
 
 message RecordSession {
@@ -4976,6 +5028,18 @@ message DatabaseResourceMatcher {
     (gogoproto.jsontag) = "labels",
     (gogoproto.customtype) = "Labels"
   ];
+  ResourceMatcherAWS AWS = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "aws"
+  ];
+}
+
+// ResourceMatcherAWS contains AWS specific settings for resource matcher.
+message ResourceMatcherAWS {
+  // AssumeRoleARN is an optional AWS role ARN to assume when accessing a database.
+  string AssumeRoleARN = 1 [(gogoproto.jsontag) = "assume_role_arn,omitempty"];
+  // ExternalID is an optional AWS external ID used to enable assuming an AWS role across accounts.
+  string ExternalID = 2 [(gogoproto.jsontag) = "external_id,omitempty"];
 }
 
 // AlertSeverity represents how problematic/urgent an alert is, and is used to assist
@@ -5144,6 +5208,8 @@ message PluginSpecV1 {
     PluginOktaSettings okta = 4;
     // Settings for device trust jamf plugin
     PluginJamfSettings jamf = 5;
+    // Settings for the PagerDuty plugin
+    PluginPagerDutySettings pager_duty = 6;
   }
 }
 
@@ -5169,6 +5235,19 @@ message PluginOpsgenieAccessSettings {
   string api_endpoint = 5;
 }
 
+message PluginPagerDutySettings {
+  option (gogoproto.equal) = true;
+
+  // UserEmail is the email address of the PagerDuty user that will be
+  // listed as the reporter source of incidents, comments, etc
+  // within PagerDuty. Should usually be the same user the API key
+  // represents.
+  string user_email = 1;
+
+  // APIEndpoint is the address of PagerDuty API.
+  string api_endpoint = 2;
+}
+
 // Defines settings for the OpenAI plugin. Currently there are no settings.
 message PluginOpenAISettings {
   option (gogoproto.equal) = true;
@@ -5454,6 +5533,18 @@ message UserGroupV1 {
     (gogoproto.jsontag) = "",
     (gogoproto.embed) = true
   ];
+
+  // Spec is the user group resource spec.
+  UserGroupSpecV1 Spec = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "spec"
+  ];
+}
+
+// UserGroupSpecV1 is the specification of a user group.
+message UserGroupSpecV1 {
+  // Applications are a list of application IDs belonging to this user group.
+  repeated string Applications = 1;
 }
 
 // OktaImportRuleSpecV1 is a Okta import rule specification.
@@ -5755,8 +5846,8 @@ message JamfSpecV1 {
     (gogoproto.jsontag) = "sync_delay,omitempty",
     (gogoproto.casttype) = "Duration"
   ];
-  // Jamf API endpoint.
-  // Example: "https://yourtenant.jamfcloud.com".
+  // Jamf Pro API endpoint.
+  // Example: "https://yourtenant.jamfcloud.com/api".
   // Required.
   string api_endpoint = 4 [(gogoproto.jsontag) = "api_endpoint,omitempty"];
   // Jamf API username.
@@ -5785,8 +5876,7 @@ message JamfInventoryEntry {
   // PARTIAL syncs are scheduled in the time window between FULL syncs, so
   // sync_period_partial must always be smaller than sync_period_full, otherwise
   // it would never trigger.
-  // Set to negative to disable PARTIAL syncs.
-  // Defaults to 6h.
+  // Set to zero or negative to disable PARTIAL syncs.
   int64 sync_period_partial = 2 [
     (gogoproto.jsontag) = "sync_period_partial,omitempty",
     (gogoproto.casttype) = "Duration"
@@ -5794,8 +5884,7 @@ message JamfInventoryEntry {
   // Sync period for FULL syncs.
   // Ideally sync_period_full is a multiple of sync_period_partial, so schedules
   // line up perfectly.
-  // Set to negative to disable FULL syncs.
-  // Defaults to 24h.
+  // Set to zero or negative to disable FULL syncs.
   int64 sync_period_full = 3 [
     (gogoproto.jsontag) = "sync_period_full,omitempty",
     (gogoproto.casttype) = "Duration"
@@ -5837,3 +5926,100 @@ message MessageWithHeader {
     (gogoproto.embed) = true
   ];
 }
+
+// AWSMatcher matches AWS EC2 instances and AWS Databases
+message AWSMatcher {
+  // Types are AWS database types to match, "ec2", "rds", "redshift", "elasticache",
+  // or "memorydb".
+  repeated string Types = 1 [(gogoproto.jsontag) = "types,omitempty"];
+  // Regions are AWS regions to query for databases.
+  repeated string Regions = 2 [(gogoproto.jsontag) = "regions,omitempty"];
+  // AssumeRoleARN is the AWS role to assume for database discovery.
+  AssumeRole AssumeRole = 3 [(gogoproto.jsontag) = "assume_role,omitempty"];
+  // Tags are AWS resource Tags to match.
+  wrappers.LabelValues Tags = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "tags,omitempty",
+    (gogoproto.customtype) = "Labels"
+  ];
+  // Params sets the join method when installing on discovered EC2 nodes
+  InstallerParams Params = 5 [(gogoproto.jsontag) = "install,omitempty"];
+  // SSM provides options to use when sending a document command to
+  // an EC2 node
+  AWSSSM SSM = 6 [(gogoproto.jsontag) = "ssm,omitempty"];
+}
+
+// AssumeRole provides a role ARN and ExternalID to assume an AWS role
+// when interacting with AWS resources.
+message AssumeRole {
+  // RoleARN is the fully specified AWS IAM role ARN.
+  string RoleARN = 1 [(gogoproto.jsontag) = "role_arn"];
+  // ExternalID is the external ID used to assume a role in another account.
+  string ExternalID = 2 [(gogoproto.jsontag) = "external_id"];
+}
+
+// InstallParams sets join method to use on discovered nodes
+message InstallerParams {
+  // JoinMethod is the method to use when joining the cluster
+  string JoinMethod = 1 [
+    (gogoproto.jsontag) = "join_method",
+    (gogoproto.casttype) = "JoinMethod"
+  ];
+  // JoinToken is the token to use when joining the cluster
+  string JoinToken = 2 [(gogoproto.jsontag) = "join_token"];
+  // ScriptName is the name of the teleport installer script
+  // resource for the cloud instance to execute
+  string ScriptName = 3 [(gogoproto.jsontag) = "script_name,omitempty"];
+  // InstallTeleport disables agentless discovery
+  bool InstallTeleport = 4 [(gogoproto.jsontag) = "install_teleport,omitempty"];
+  // SSHDConfig provides the path to write sshd configuration changes
+  string SSHDConfig = 5 [(gogoproto.jsontag) = "sshd_config,omitempty"];
+  // PublicProxyAddr is the address of the proxy the discovered node should use
+  // to connect to the cluster. Used only in Azure.
+  string PublicProxyAddr = 6 [(gogoproto.jsontag) = "proxy_addr,omitempty"];
+}
+
+// AWSSSM provides options to use when executing SSM documents
+message AWSSSM {
+  // DocumentName is the name of the document to use when executing an
+  // SSM command
+  string DocumentName = 1 [(gogoproto.jsontag) = "document_name,omitempty"];
+}
+
+// AzureMatcher matches Azure resources.
+// It defines which resource types, filters and some configuration params.
+message AzureMatcher {
+  // Subscriptions are Azure subscriptions to query for resources.
+  repeated string Subscriptions = 1 [(gogoproto.jsontag) = "subscriptions,omitempty"];
+  // ResourceGroups are Azure resource groups to query for resources.
+  repeated string ResourceGroups = 2 [(gogoproto.jsontag) = "resource_groups,omitempty"];
+  // Types are Azure types to match: "mysql", "postgres", "aks", "vm"
+  repeated string Types = 3 [(gogoproto.jsontag) = "types,omitempty"];
+  // Regions are Azure locations to match for databases.
+  repeated string Regions = 4 [(gogoproto.jsontag) = "regions,omitempty"];
+  // ResourceTags are Azure tags on resources to match.
+  wrappers.LabelValues ResourceTags = 5 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "tags,omitempty",
+    (gogoproto.customtype) = "Labels"
+  ];
+  // Params sets the join method when installing on
+  // discovered Azure nodes.
+  InstallerParams Params = 6 [(gogoproto.jsontag) = "install_params,omitempty"];
+}
+
+// GCPMatcher matches GCP resources.
+message GCPMatcher {
+  // Types are GKE resource types to match: "gke".
+  repeated string Types = 1 [(gogoproto.jsontag) = "types,omitempty"];
+  // Locations are GKE locations to search resources for.
+  repeated string Locations = 2 [(gogoproto.jsontag) = "locations,omitempty"];
+  // Tags are GCP labels to match.
+  wrappers.LabelValues Tags = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "tags,omitempty",
+    (gogoproto.customtype) = "Labels"
+  ];
+  // ProjectIDs are the GCP project ID where the resources are deployed.
+  repeated string ProjectIDs = 4 [(gogoproto.jsontag) = "project_ids,omitempty"];
+}
diff --git a/api/proto/teleport/trait/v1/trait.proto b/api/proto/teleport/trait/v1/trait.proto
new file mode 100644
index 0000000000000..0d6889d698b34
--- /dev/null
+++ b/api/proto/teleport/trait/v1/trait.proto
@@ -0,0 +1,27 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.trait.v1;
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/trait/v1;trait";
+
+// Trait is a trait that can be use in various resources.
+message Trait {
+  // key is the name of the trait.
+  string key = 1;
+  // values is the list of trait values.
+  repeated string values = 2;
+}
diff --git a/api/proto/teleport/usageevents/v1/usageevents.proto b/api/proto/teleport/usageevents/v1/usageevents.proto
index b31542a4f7bf7..48a4d9bb86ccc 100644
--- a/api/proto/teleport/usageevents/v1/usageevents.proto
+++ b/api/proto/teleport/usageevents/v1/usageevents.proto
@@ -47,6 +47,13 @@ message UIOnboardSetCredentialSubmitEvent {
   string username = 1;
 }
 
+// UIOnboardQuestionnaireSubmitEvent is a UI event sent during registration when
+// the user submits their onboarding questionnaire.
+message UIOnboardQuestionnaireSubmitEvent {
+  // The event username. Not extracted from identity as this is pre-registration.
+  string username = 1;
+}
+
 // UIOnboardRegisterChallengeSubmitEvent is a UI event sent during registration
 // when the MFA challenge is completed.
 message UIOnboardRegisterChallengeSubmitEvent {
@@ -128,6 +135,8 @@ enum DiscoverResource {
   DISCOVER_RESOURCE_DOC_DATABASE_RDS_PROXY = 34;
   DISCOVER_RESOURCE_DOC_DATABASE_HIGH_AVAILABILITY = 35;
   DISCOVER_RESOURCE_DOC_DATABASE_DYNAMIC_REGISTRATION = 36;
+
+  DISCOVER_RESOURCE_SAML_APPLICATION = 37;
 }
 
 // DiscoverResourceMetadata contains common metadata identifying resource type being added.
@@ -211,6 +220,7 @@ enum CTA {
   CTA_PREMIUM_SUPPORT = 4;
   CTA_TRUSTED_DEVICES = 5;
   CTA_UPGRADE_BANNER = 6;
+  CTA_BILLING_SUMMARY = 7;
 }
 
 // UIDiscoverDeployServiceEvent is emitted after the user installs a Teleport Agent.
@@ -224,6 +234,34 @@ message UIDiscoverDeployServiceEvent {
   DiscoverMetadata metadata = 1;
   DiscoverResourceMetadata resource = 2;
   DiscoverStepStatus status = 3;
+
+  // DeployMethod describes the method used to deploy a service.
+  enum DeployMethod {
+    // DEPLOY_METHOD_UNSPECIFIED means there was an existing service
+    // so deploying step got skipped.
+    DEPLOY_METHOD_UNSPECIFIED = 0;
+    // DEPLOY_METHOD_AUTO means Teleport deployed a service for the user.
+    DEPLOY_METHOD_AUTO = 1;
+    // DEPLOY_METHOD_MANUAL means a user deployed a service by themselves.
+    DEPLOY_METHOD_MANUAL = 2;
+  }
+
+  DeployMethod deploy_method = 4;
+
+  // DeployType describes the type of deployment.
+  enum DeployType {
+    // DEPLOY_METHOD_UNSPECIFIED means there was an existing service
+    // so deploying step got skipped.
+    DEPLOY_TYPE_UNSPECIFIED = 0;
+    // DEPLOY_TYPE_INSTALL_SCRIPT means service was deployed using an
+    // install script.
+    DEPLOY_TYPE_INSTALL_SCRIPT = 1;
+    // DEPLOY_TYPE_AMAZON_ECS means service was deployed using amazon's
+    // elastic container service.
+    DEPLOY_TYPE_AMAZON_ECS = 2;
+  }
+
+  DeployType deploy_type = 5;
 }
 
 // UIDiscoverDatabaseRegisterEvent is emitted when a user is finished with the step that registers a database resource.
@@ -392,6 +430,7 @@ message UsageEventOneOf {
     AssistCompletionEvent assist_completion = 30;
     UIIntegrationEnrollStartEvent ui_integration_enroll_start_event = 31;
     UIIntegrationEnrollCompleteEvent ui_integration_enroll_complete_event = 32;
+    UIOnboardQuestionnaireSubmitEvent ui_onboard_questionnaire_submit = 33;
   }
   reserved 2; //UIOnboardGetStartedClickEvent
   reserved "ui_onboard_get_started_click";
diff --git a/api/proto/teleport/userpreferences/v1/assist.proto b/api/proto/teleport/userpreferences/v1/assist.proto
new file mode 100644
index 0000000000000..2897dfad5ad96
--- /dev/null
+++ b/api/proto/teleport/userpreferences/v1/assist.proto
@@ -0,0 +1,40 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.userpreferences.v1;
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1;userpreferencesv1";
+
+// AssistViewMode is the way the assistant is displayed.
+enum AssistViewMode {
+  ASSIST_VIEW_MODE_UNSPECIFIED = 0;
+  // DOCKED is the assistant is docked to the right hand side of the screen.
+  ASSIST_VIEW_MODE_DOCKED = 1;
+  // POPUP is the assistant is displayed as a popup.
+  ASSIST_VIEW_MODE_POPUP = 2;
+  // POPUP_EXPANDED is the assistant is displayed as a popup and expanded.
+  ASSIST_VIEW_MODE_POPUP_EXPANDED = 3;
+  // POPUP_EXPANDED_SIDEBAR_VISIBLE is the assistant is displayed as a popup and expanded with the sidebar visible.
+  ASSIST_VIEW_MODE_POPUP_EXPANDED_SIDEBAR_VISIBLE = 4;
+}
+
+// AssistUserPreferences is the user preferences for Assist.
+message AssistUserPreferences {
+  // preferredLogins is an array of the logins a user would prefer to use when running a command, ordered by preference.
+  repeated string preferred_logins = 1;
+  // viewMode is the way the assistant is displayed.
+  AssistViewMode view_mode = 2;
+}
diff --git a/api/proto/teleport/userpreferences/v1/onboard.proto b/api/proto/teleport/userpreferences/v1/onboard.proto
new file mode 100644
index 0000000000000..9df0ec0d04780
--- /dev/null
+++ b/api/proto/teleport/userpreferences/v1/onboard.proto
@@ -0,0 +1,35 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.userpreferences.v1;
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1;userpreferencesv1";
+
+// Resources are the Resource options in the onboarding questionnaire
+enum Resource {
+  RESOURCE_UNSPECIFIED = 0;
+  RESOURCE_WINDOWS_DESKTOPS = 1;
+  RESOURCE_SERVER_SSH = 2;
+  RESOURCE_DATABASES = 3;
+  RESOURCE_KUBERNETES = 4;
+  RESOURCE_WEB_APPLICATIONS = 5;
+}
+
+// OnboardUserPreferences is the user preferences selected during onboarding.
+message OnboardUserPreferences {
+  // preferredResources is an array of the resources a user selected during their onboarding questionnaire.
+  repeated Resource preferred_resources = 1;
+}
diff --git a/api/proto/teleport/userpreferences/v1/theme.proto b/api/proto/teleport/userpreferences/v1/theme.proto
new file mode 100644
index 0000000000000..236c71a54b7a4
--- /dev/null
+++ b/api/proto/teleport/userpreferences/v1/theme.proto
@@ -0,0 +1,28 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.userpreferences.v1;
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1;userpreferencesv1";
+
+// Theme is a frontend theme.
+enum Theme {
+  THEME_UNSPECIFIED = 0;
+  // THEME_LIGHT is the light theme.
+  THEME_LIGHT = 1;
+  // THEME_DARK is the dark theme.
+  THEME_DARK = 2;
+}
diff --git a/api/proto/teleport/userpreferences/v1/userpreferences.proto b/api/proto/teleport/userpreferences/v1/userpreferences.proto
new file mode 100644
index 0000000000000..1d142c9632ee1
--- /dev/null
+++ b/api/proto/teleport/userpreferences/v1/userpreferences.proto
@@ -0,0 +1,62 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.userpreferences.v1;
+
+import "google/protobuf/empty.proto";
+import "teleport/userpreferences/v1/assist.proto";
+import "teleport/userpreferences/v1/onboard.proto";
+import "teleport/userpreferences/v1/theme.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1;userpreferencesv1";
+
+// UserPreferences is a collection of different user changeable preferences for the frontend.
+message UserPreferences {
+  // assist is the preferences for the Teleport Assist.
+  v1.AssistUserPreferences assist = 1;
+  // theme is the theme of the frontend.
+  Theme theme = 2;
+  // onboard is the preferences from the onboarding questionnaire.
+  v1.OnboardUserPreferences onboard = 3;
+}
+
+// GetUserPreferencesRequest is a request to get the user preferences.
+message GetUserPreferencesRequest {
+  // username is the username of the owner of the user preferences to get.
+  string username = 1;
+}
+
+// GetUserPreferencesResponse is a response to get the user preferences.
+message GetUserPreferencesResponse {
+  // preferences is the user preferences.
+  UserPreferences preferences = 1;
+}
+
+// UpsertUserPreferencesRequest is a request to create or update the user preferences.
+message UpsertUserPreferencesRequest {
+  // preferences is the new user preferences to set.
+  UserPreferences preferences = 1;
+  // username is the username of the owner of the user preferences to update.
+  string username = 2;
+}
+
+// UserPreferencesService is a service that stores user settings.
+service UserPreferencesService {
+  // GetUserPreferences returns the user preferences for a given user.
+  rpc GetUserPreferences(GetUserPreferencesRequest) returns (GetUserPreferencesResponse);
+  // UpsertUserPreferences creates or updates user preferences for a given username.
+  rpc UpsertUserPreferences(UpsertUserPreferencesRequest) returns (google.protobuf.Empty);
+}
diff --git a/api/testhelpers/proxy.go b/api/testhelpers/proxy.go
new file mode 100644
index 0000000000000..4c85a10daf718
--- /dev/null
+++ b/api/testhelpers/proxy.go
@@ -0,0 +1,100 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package testhelpers
+
+import (
+	"io"
+	"net"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gravitational/trace"
+)
+
+// ProxyHandler is a http.Handler that implements a simple HTTP proxy server.
+type ProxyHandler struct {
+	sync.Mutex
+	count int
+}
+
+// ServeHTTP only accepts the CONNECT verb and will tunnel your connection to
+// the specified host. Also tracks the number of connections that it proxies for
+// debugging purposes.
+func (p *ProxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Validate http connect parameters.
+	if r.Method != http.MethodConnect {
+		trace.WriteError(w, trace.BadParameter("%v not supported", r.Method))
+		return
+	}
+	if r.Host == "" {
+		trace.WriteError(w, trace.BadParameter("host not set"))
+		return
+	}
+
+	// Dial to the target host, this is done before hijacking the connection to
+	// ensure the target host is accessible.
+	dialer := net.Dialer{}
+	dconn, err := dialer.DialContext(r.Context(), "tcp", r.Host)
+	if err != nil {
+		trace.WriteError(w, err)
+		return
+	}
+	defer dconn.Close()
+
+	// Once the client receives 200 OK, the rest of the data will no longer be
+	// http, but whatever protocol is being tunneled.
+	w.WriteHeader(http.StatusOK)
+
+	// Hijack request so we can get underlying connection.
+	hj, ok := w.(http.Hijacker)
+	if !ok {
+		trace.WriteError(w, trace.AccessDenied("unable to hijack connection"))
+		return
+	}
+	sconn, _, err := hj.Hijack()
+	if err != nil {
+		trace.WriteError(w, err)
+		return
+	}
+	defer sconn.Close()
+
+	// Success, we're proxying data now.
+	p.Lock()
+	p.count++
+	p.Unlock()
+
+	// Copy from src to dst and dst to src.
+	errc := make(chan error, 2)
+	replicate := func(dst io.Writer, src io.Reader) {
+		_, err := io.Copy(dst, src)
+		errc <- err
+	}
+	go replicate(sconn, dconn)
+	go replicate(dconn, sconn)
+
+	// Wait until done, error, or 10 second.
+	select {
+	case <-time.After(10 * time.Second):
+	case <-errc:
+	}
+}
+
+// Count returns the number of requests that have been proxied.
+func (p *ProxyHandler) Count() int {
+	p.Lock()
+	defer p.Unlock()
+	return p.count
+}
diff --git a/api/types/app.go b/api/types/app.go
index ad4f663c9b097..e2b7c4d77b882 100644
--- a/api/types/app.go
+++ b/api/types/app.go
@@ -72,6 +72,10 @@ type Application interface {
 	GetAWSAccountID() string
 	// GetAWSExternalID returns the AWS External ID configured for this app.
 	GetAWSExternalID() string
+	// GetUserGroups will get the list of user group IDs associated with the application.
+	GetUserGroups() []string
+	// SetUserGroups will set the list of user group IDs associated with the application.
+	SetUserGroups([]string)
 	// Copy returns a copy of this app resource.
 	Copy() *AppV3
 }
@@ -289,6 +293,16 @@ func (a *AppV3) GetAWSExternalID() string {
 	return a.Spec.AWS.ExternalID
 }
 
+// GetUserGroups will get the list of user group IDss associated with the application.
+func (a *AppV3) GetUserGroups() []string {
+	return a.Spec.UserGroups
+}
+
+// SetUserGroups will set the list of user group IDs associated with the application.
+func (a *AppV3) SetUserGroups(userGroups []string) {
+	a.Spec.UserGroups = userGroups
+}
+
 // String returns the app string representation.
 func (a *AppV3) String() string {
 	return fmt.Sprintf("App(Name=%v, PublicAddr=%v, Labels=%v)",
diff --git a/api/types/authentication.go b/api/types/authentication.go
index 5d1ac8e6188d2..ce89028832b73 100644
--- a/api/types/authentication.go
+++ b/api/types/authentication.go
@@ -29,6 +29,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/tlsutils"
 )
@@ -127,6 +128,11 @@ type AuthPreference interface {
 	// SetSAMLIdPEnabled sets the SAML IdP to enabled.
 	SetSAMLIdPEnabled(bool)
 
+	// GetDefaultSessionTTL retrieves the max session ttl
+	GetDefaultSessionTTL() Duration
+	// SetDefaultSessionTTL sets the max session ttl
+	SetDefaultSessionTTL(Duration)
+
 	// String represents a human readable version of authentication settings.
 	String() string
 }
@@ -435,6 +441,16 @@ func (c *AuthPreferenceV2) SetSAMLIdPEnabled(enabled bool) {
 	c.Spec.IDP.SAML.Enabled = NewBoolOption(enabled)
 }
 
+// SetDefaultSessionTTL sets the default session ttl
+func (c *AuthPreferenceV2) SetDefaultSessionTTL(sessionTTL Duration) {
+	c.Spec.DefaultSessionTTL = sessionTTL
+}
+
+// GetDefaultSessionTTL retrieves the default session ttl
+func (c *AuthPreferenceV2) GetDefaultSessionTTL() Duration {
+	return c.Spec.DefaultSessionTTL
+}
+
 // setStaticFields sets static resource header and metadata fields.
 func (c *AuthPreferenceV2) setStaticFields() {
 	c.Kind = KindClusterAuthPreference
@@ -468,6 +484,10 @@ func (c *AuthPreferenceV2) CheckAndSetDefaults() error {
 		c.SetOrigin(OriginDynamic)
 	}
 
+	if c.Spec.DefaultSessionTTL == 0 {
+		c.Spec.DefaultSessionTTL = Duration(defaults.CertDuration)
+	}
+
 	switch c.Spec.Type {
 	case constants.Local, constants.OIDC, constants.SAML, constants.Github:
 		// Note that "type:local" and "local_auth:false" is considered a valid
diff --git a/api/types/constants.go b/api/types/constants.go
index 66ffca553ed3f..eb6a0429478bf 100644
--- a/api/types/constants.go
+++ b/api/types/constants.go
@@ -155,9 +155,69 @@ const (
 	// KindKubernetesCluster is a Kubernetes cluster.
 	KindKubernetesCluster = "kube_cluster"
 
-	// KindKubePod is an Kubernetes Pod resource type.
+	// KindKubePod is a Kubernetes Pod resource type.
 	KindKubePod = "pod"
 
+	// KindKubeSecret is a Kubernetes Secret resource type.
+	KindKubeSecret = "secret"
+
+	// KindKubeConfigMap is a Kubernetes Configmap resource type.
+	KindKubeConfigmap = "configmap"
+
+	// KindKubeNamespace is a Kubernetes namespace resource type.
+	KindKubeNamespace = "namespace"
+
+	// KindKubeService is a Kubernetes Service resource type.
+	KindKubeService = "service"
+
+	// KindKubeServiceAccount is an Kubernetes Service Account resource type.
+	KindKubeServiceAccount = "serviceaccount"
+
+	// KindKubeNode is a Kubernetes Node resource type.
+	KindKubeNode = "kube_node"
+
+	// KindKubePersistentVolume is a Kubernetes Persistent Volume resource type.
+	KindKubePersistentVolume = "persistentvolume"
+
+	// KindKubePersistentVolumeClaim is a Kubernetes Persistent Volume Claim resource type.
+	KindKubePersistentVolumeClaim = "persistentvolumeclaim"
+
+	// KindKubeDeployment is a Kubernetes Deployment resource type.
+	KindKubeDeployment = "deployment"
+
+	// KindKubeReplicaSet is a Kubernetes Replicaset resource type.
+	KindKubeReplicaSet = "replicaset"
+
+	// KindKubeStatefulset is a Kubernetes Statefulset resource type.
+	KindKubeStatefulset = "statefulset"
+
+	// KindKubeDaemonSet is a Kubernetes Daemonset resource type.
+	KindKubeDaemonSet = "daemonset"
+
+	// KindKubeClusterRole is a Kubernetes ClusterRole resource type.
+	KindKubeClusterRole = "clusterrole"
+
+	// KindKubeRole is a Kubernetes Role resource type.
+	KindKubeRole = "role"
+
+	// KindKubeClusterRoleBinding is a Kubernetes Cluster Role Binding resource type.
+	KindKubeClusterRoleBinding = "clusterrolebinding"
+
+	// KindKubeRoleBinding is a Kubernetes Role Binding resource type.
+	KindKubeRoleBinding = "rolebinding"
+
+	// KindKubeCronjob is a Kubernetes Cronjob resource type.
+	KindKubeCronjob = "cronjob"
+
+	// KindKubeJob is a Kubernetes job resource type.
+	KindKubeJob = "job"
+
+	// KindKubeCertificateSigningRequest is a Certificate Signing Request resource type.
+	KindKubeCertificateSigningRequest = "certificatesigningrequest"
+
+	// KindKubeIngress is a Kubernetes Ingress resource type.
+	KindKubeIngress = "ingress"
+
 	// KindToken is a provisioning token resource
 	KindToken = "token"
 
@@ -364,6 +424,9 @@ const (
 	// KindWatchStatus is a kind for WatchStatus resource which contains information about a successful Watch request.
 	KindWatchStatus = "watch_status"
 
+	// V7 is the seventh version of resources.
+	V7 = "v7"
+
 	// V6 is the sixth version of resources.
 	V6 = "v6"
 
@@ -437,6 +500,10 @@ const (
 	// that the resource originates from.
 	OriginLabel = TeleportNamespace + "/origin"
 
+	// ClusterLabel is a label that identifies the current cluster when creating resources on another systems.
+	// Eg, when creating a resource in AWS, this label must be set as a Tag in the resource.
+	ClusterLabel = TeleportNamespace + "/cluster"
+
 	// ADLabel is a resource metadata label name used to identify if resource is part of Active Directory
 	ADLabel = TeleportNamespace + "/ad"
 
@@ -464,6 +531,13 @@ const (
 	// created from the Okta service.
 	OriginOkta = "okta"
 
+	// OriginIntegrationAWSOIDC is an origin value indicating that the resource was
+	// created from the AWS OIDC Integration.
+	OriginIntegrationAWSOIDC = "integration_awsoidc"
+
+	// IntegrationLabel is a resource metadata label name used to identify the integration name that created the resource.
+	IntegrationLabel = TeleportNamespace + "/integration"
+
 	// AWSAccountIDLabel is used to identify nodes by AWS account ID
 	// found via automatic discovery, to avoid re-running installation
 	// commands on the node.
@@ -562,6 +636,31 @@ const (
 	// that the discovered resource is owned by. It is used to differentiate resources
 	// that belong to different discovery services that operate on different sets of resources.
 	TeleportInternalDiscoveryGroupName = TeleportInternalLabelPrefix + "discovery-group-name"
+
+	// TeleportDowngradedLabel identifies resources that have been automatically
+	// downgraded before being returned to clients on older versions that do not
+	// support one or more features enabled in that resource.
+	TeleportDowngradedLabel = TeleportInternalLabelPrefix + "downgraded"
+
+	// TeleportInternalResourceType indicates the type of internal Teleport resource a resource is.
+	// Valid values are:
+	// - system: These resources will be automatically created and overwritten on startup. Users should
+	//           not change these resources.
+	// - preset: These resources will be created if they don't exist. Updates may be applied to them,
+	//           but user changes to these resources will be preserved.
+	TeleportInternalResourceType = TeleportInternalLabelPrefix + "resource-type"
+
+	// TeleportResourceRevision marks a teleport-managed resource with a reversion
+	// number to aid future migrations. Label value is expected to be a number.
+	TeleportResourceRevision = TeleportInternalLabelPrefix + "revision"
+
+	// SystemResource are resources that will be automatically created and overwritten on startup. Users
+	// should not change these resources.
+	SystemResource = "system"
+
+	// PresetResource are resources resources will be created if they don't exist. Updates may be applied
+	// to them, but user changes to these resources will be preserved.
+	PresetResource = "preset"
 )
 
 // CloudHostnameTag is the name of the tag in a cloud instance used to override a node's hostname.
@@ -673,13 +772,64 @@ var RequestableResourceKinds = []string{
 	KindDatabase,
 	KindApp,
 	KindWindowsDesktop,
-	KindKubePod,
 	KindUserGroup,
+	KindKubePod,
+	KindKubeSecret,
+	KindKubeConfigmap,
+	KindKubeNamespace,
+	KindKubeService,
+	KindKubeServiceAccount,
+	KindKubeNode,
+	KindKubePersistentVolume,
+	KindKubePersistentVolumeClaim,
+	KindKubeDeployment,
+	KindKubeReplicaSet,
+	KindKubeStatefulset,
+	KindKubeDaemonSet,
+	KindKubeClusterRole,
+	KindKubeRole,
+	KindKubeClusterRoleBinding,
+	KindKubeRoleBinding,
+	KindKubeCronjob,
+	KindKubeJob,
+	KindKubeCertificateSigningRequest,
+	KindKubeIngress,
 }
 
 // KubernetesResourcesKinds lists the supported Kubernetes resource kinds.
 var KubernetesResourcesKinds = []string{
 	KindKubePod,
+	KindKubeSecret,
+	KindKubeConfigmap,
+	KindKubeNamespace,
+	KindKubeService,
+	KindKubeServiceAccount,
+	KindKubeNode,
+	KindKubePersistentVolume,
+	KindKubePersistentVolumeClaim,
+	KindKubeDeployment,
+	KindKubeReplicaSet,
+	KindKubeStatefulset,
+	KindKubeDaemonSet,
+	KindKubeClusterRole,
+	KindKubeRole,
+	KindKubeClusterRoleBinding,
+	KindKubeRoleBinding,
+	KindKubeCronjob,
+	KindKubeJob,
+	KindKubeCertificateSigningRequest,
+	KindKubeIngress,
+}
+
+// KubernetesClusterWideResourceKinds is the list of supported Kubernetes cluster resource kinds
+// that are not namespaced.
+var KubernetesClusterWideResourceKinds = []string{
+	KindKubeNamespace,
+	KindKubeNode,
+	KindKubePersistentVolume,
+	KindKubeClusterRole,
+	KindKubeClusterRoleBinding,
+	KindKubeCertificateSigningRequest,
 }
 
 const (
diff --git a/api/types/database.go b/api/types/database.go
index a882b7d97519f..d86c0e4a12c78 100644
--- a/api/types/database.go
+++ b/api/types/database.go
@@ -26,6 +26,7 @@ import (
 	"github.com/sirupsen/logrus"
 
 	"github.com/gravitational/teleport/api/utils"
+	atlasutils "github.com/gravitational/teleport/api/utils/atlas"
 	awsutils "github.com/gravitational/teleport/api/utils/aws"
 	azureutils "github.com/gravitational/teleport/api/utils/azure"
 )
@@ -97,6 +98,8 @@ type Database interface {
 	GetManagedUsers() []string
 	// SetManagedUsers sets a list of database users that are managed by Teleport.
 	SetManagedUsers(users []string)
+	// GetMongoAtlas returns Mongo Atlas database metadata.
+	GetMongoAtlas() MongoAtlas
 	// IsRDS returns true if this is an RDS/Aurora database.
 	IsRDS() bool
 	// IsRDSProxy returns true if this is an RDS Proxy database.
@@ -118,6 +121,9 @@ type Database interface {
 	// RequireAWSIAMRolesAsUsers returns true for database types that require
 	// AWS IAM roles as database users.
 	RequireAWSIAMRolesAsUsers() bool
+	// SupportAWSIAMRoleARNAsUsers returns true for database types that support
+	// AWS IAM roles as database users.
+	SupportAWSIAMRoleARNAsUsers() bool
 	// Copy returns a copy of this database resource.
 	Copy() *DatabaseV3
 	// GetAdminUser returns database privileged user information.
@@ -508,6 +514,10 @@ func (d *DatabaseV3) getAWSType() (string, bool) {
 
 // GetType returns the database type.
 func (d *DatabaseV3) GetType() string {
+	if d.GetMongoAtlas().Name != "" {
+		return DatabaseTypeMongoAtlas
+	}
+
 	if awsType, ok := d.getAWSType(); ok {
 		return awsType
 	}
@@ -518,6 +528,7 @@ func (d *DatabaseV3) GetType() string {
 	if d.GetAzure().Name != "" {
 		return DatabaseTypeAzure
 	}
+
 	return DatabaseTypeSelfHosted
 }
 
@@ -740,6 +751,12 @@ func (d *DatabaseV3) CheckAndSetDefaults() error {
 			}
 			d.Spec.Azure.Name = name
 		}
+	case atlasutils.IsAtlasEndpoint(d.Spec.URI):
+		name, err := atlasutils.ParseAtlasEndpoint(d.Spec.URI)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		d.Spec.MongoAtlas.Name = name
 	}
 
 	// Validate AWS Specific configuration
@@ -863,6 +880,11 @@ func (d *DatabaseV3) SetManagedUsers(users []string) {
 	d.Status.ManagedUsers = users
 }
 
+// GetMongoAtlas returns Mongo Atlas database metadata.
+func (d *DatabaseV3) GetMongoAtlas() MongoAtlas {
+	return d.Spec.MongoAtlas
+}
+
 // RequireAWSIAMRolesAsUsers returns true for database types that require AWS
 // IAM roles as database users.
 // IMPORTANT: if you add a database that requires AWS IAM Roles as users,
@@ -885,6 +907,12 @@ func (d *DatabaseV3) RequireAWSIAMRolesAsUsers() bool {
 	}
 }
 
+// SupportAWSIAMRoleARNAsUsers returns true for database types that support AWS
+// IAM roles as database users.
+func (d *DatabaseV3) SupportAWSIAMRoleARNAsUsers() bool {
+	return d.GetType() == DatabaseTypeMongoAtlas
+}
+
 const (
 	// DatabaseProtocolPostgreSQL is the PostgreSQL database protocol.
 	DatabaseProtocolPostgreSQL = "postgres"
@@ -915,6 +943,8 @@ const (
 	DatabaseTypeDynamoDB = "dynamodb"
 	// DatabaseTypeOpenSearch is AWS-hosted OpenSearch instance.
 	DatabaseTypeOpenSearch = "opensearch"
+	// DatabaseTypeMongoAtlas
+	DatabaseTypeMongoAtlas = "mongo-atlas"
 )
 
 // GetServerName returns the GCP database project and instance as "<project-id>:<instance-id>".
diff --git a/api/types/database_test.go b/api/types/database_test.go
index 7e8b9aa0b837c..769fd05bc9607 100644
--- a/api/types/database_test.go
+++ b/api/types/database_test.go
@@ -28,7 +28,7 @@ import (
 // TestDatabaseRDSEndpoint verifies AWS info is correctly populated
 // based on the RDS endpoint.
 func TestDatabaseRDSEndpoint(t *testing.T) {
-	isBadParamErrFn := func(tt require.TestingT, err error, i ...interface{}) {
+	isBadParamErrFn := func(tt require.TestingT, err error, i ...any) {
 		require.True(tt, trace.IsBadParameter(err), "expected bad parameter, got %v", err)
 	}
 
diff --git a/api/types/device.go b/api/types/device.go
index e75e139326e62..96d6377a252d3 100644
--- a/api/types/device.go
+++ b/api/types/device.go
@@ -15,7 +15,6 @@
 package types
 
 import (
-	"encoding/json"
 	"time"
 
 	"github.com/google/uuid"
@@ -86,15 +85,6 @@ func (d *DeviceV1) CheckAndSetDefaults() error {
 	return nil
 }
 
-// UnmarshalDevice unmarshals a DeviceV1 resource and runs CheckAndSetDefaults.
-func UnmarshalDevice(raw []byte) (*DeviceV1, error) {
-	dev := &DeviceV1{}
-	if err := json.Unmarshal(raw, dev); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return dev, trace.Wrap(dev.CheckAndSetDefaults())
-}
-
 // DeviceFromResource converts a resource DeviceV1 to an API devicepb.Device.
 func DeviceFromResource(res *DeviceV1) (*devicepb.Device, error) {
 	if res == nil {
@@ -156,6 +146,9 @@ func DeviceFromResource(res *DeviceV1) (*devicepb.Device, error) {
 			ReportedAssetTag:        d.ReportedAssetTag,
 			SystemSerialNumber:      d.SystemSerialNumber,
 			BaseBoardSerialNumber:   d.BaseBoardSerialNumber,
+			TpmPlatformAttestation: tpmPlatformAttestationFromResource(
+				d.TpmPlatformAttestation,
+			),
 		}
 	}
 
@@ -180,6 +173,7 @@ func DeviceFromResource(res *DeviceV1) (*devicepb.Device, error) {
 			OsBuild:           p.OsBuild,
 			OsUsernames:       p.OsUsernames,
 			JamfBinaryVersion: p.JamfBinaryVersion,
+			ExternalId:        p.ExternalId,
 		}
 	}
 
@@ -242,6 +236,9 @@ func DeviceToResource(dev *devicepb.Device) *DeviceV1 {
 			ReportedAssetTag:        d.ReportedAssetTag,
 			SystemSerialNumber:      d.SystemSerialNumber,
 			BaseBoardSerialNumber:   d.BaseBoardSerialNumber,
+			TpmPlatformAttestation: tpmPlatformAttestationToResource(
+				d.TpmPlatformAttestation,
+			),
 		}
 	}
 
@@ -262,6 +259,7 @@ func DeviceToResource(dev *devicepb.Device) *DeviceV1 {
 			OsBuild:           p.OsBuild,
 			OsUsernames:       p.OsUsernames,
 			JamfBinaryVersion: p.JamfBinaryVersion,
+			ExternalId:        p.ExternalId,
 		}
 	}
 
@@ -289,6 +287,80 @@ func DeviceToResource(dev *devicepb.Device) *DeviceV1 {
 	return res
 }
 
+func tpmPlatformAttestationToResource(pa *devicepb.TPMPlatformAttestation) *TPMPlatformAttestation {
+	if pa == nil {
+		return nil
+	}
+
+	var outPlatParams *TPMPlatformParameters
+	if pa.PlatformParameters != nil {
+		var quotes []*TPMQuote
+		for _, q := range pa.PlatformParameters.Quotes {
+			quotes = append(quotes, &TPMQuote{
+				Quote:     q.Quote,
+				Signature: q.Signature,
+			})
+		}
+
+		var pcrs []*TPMPCR
+		for _, pcr := range pa.PlatformParameters.Pcrs {
+			pcrs = append(pcrs, &TPMPCR{
+				Index:     pcr.Index,
+				Digest:    pcr.Digest,
+				DigestAlg: pcr.DigestAlg,
+			})
+		}
+
+		outPlatParams = &TPMPlatformParameters{
+			Quotes:   quotes,
+			Pcrs:     pcrs,
+			EventLog: pa.PlatformParameters.EventLog,
+		}
+	}
+
+	return &TPMPlatformAttestation{
+		Nonce:              pa.Nonce,
+		PlatformParameters: outPlatParams,
+	}
+}
+
+func tpmPlatformAttestationFromResource(pa *TPMPlatformAttestation) *devicepb.TPMPlatformAttestation {
+	if pa == nil {
+		return nil
+	}
+
+	var outPlatParams *devicepb.TPMPlatformParameters
+	if pa.PlatformParameters != nil {
+		var quotes []*devicepb.TPMQuote
+		for _, q := range pa.PlatformParameters.Quotes {
+			quotes = append(quotes, &devicepb.TPMQuote{
+				Quote:     q.Quote,
+				Signature: q.Signature,
+			})
+		}
+
+		var pcrs []*devicepb.TPMPCR
+		for _, pcr := range pa.PlatformParameters.Pcrs {
+			pcrs = append(pcrs, &devicepb.TPMPCR{
+				Index:     pcr.Index,
+				Digest:    pcr.Digest,
+				DigestAlg: pcr.DigestAlg,
+			})
+		}
+
+		outPlatParams = &devicepb.TPMPlatformParameters{
+			Quotes:   quotes,
+			EventLog: pa.PlatformParameters.EventLog,
+			Pcrs:     pcrs,
+		}
+	}
+
+	return &devicepb.TPMPlatformAttestation{
+		Nonce:              pa.Nonce,
+		PlatformParameters: outPlatParams,
+	}
+}
+
 // ResourceOSTypeToString converts OSType to a string representation suitable
 // for use in resource fields.
 func ResourceOSTypeToString(osType devicepb.OSType) string {
@@ -361,7 +433,8 @@ func ResourceDeviceAttestationTypeToString(
 ) string {
 	switch attestationType {
 	case devicepb.DeviceAttestationType_DEVICE_ATTESTATION_TYPE_UNSPECIFIED:
-		return "unspecified"
+		// Default to empty, so it doesn't show in non-TPM devices.
+		return ""
 	case devicepb.DeviceAttestationType_DEVICE_ATTESTATION_TYPE_TPM_EKPUB:
 		return "tpm_ekpub"
 	case devicepb.DeviceAttestationType_DEVICE_ATTESTATION_TYPE_TPM_EKCERT:
diff --git a/api/types/device.pb.go b/api/types/device.pb.go
index 0ef8e9b47935e..57d68d722b622 100644
--- a/api/types/device.pb.go
+++ b/api/types/device.pb.go
@@ -131,10 +131,10 @@ var xxx_messageInfo_DeviceSpec proto.InternalMessageInfo
 // teleport.devicetrust.v1.DeviceCredential.
 type DeviceCredential struct {
 	Id                    string   `protobuf:"bytes,1,opt,name=id,proto3" json:"id"`
-	PublicKeyDer          []byte   `protobuf:"bytes,2,opt,name=public_key_der,json=publicKeyDer,proto3" json:"public_key_der"`
-	DeviceAttestationType string   `protobuf:"bytes,3,opt,name=device_attestation_type,json=deviceAttestationType,proto3" json:"device_attestation_type"`
-	TpmEkcertSerial       string   `protobuf:"bytes,4,opt,name=tpm_ekcert_serial,json=tpmEkcertSerial,proto3" json:"tpm_ekcert_serial"`
-	TpmAkPublic           []byte   `protobuf:"bytes,5,opt,name=tpm_ak_public,json=tpmAkPublic,proto3" json:"tpm_ak_public"`
+	PublicKeyDer          []byte   `protobuf:"bytes,2,opt,name=public_key_der,json=publicKeyDer,proto3" json:"public_key_der,omitempty"`
+	DeviceAttestationType string   `protobuf:"bytes,3,opt,name=device_attestation_type,json=deviceAttestationType,proto3" json:"device_attestation_type,omitempty"`
+	TpmEkcertSerial       string   `protobuf:"bytes,4,opt,name=tpm_ekcert_serial,json=tpmEkcertSerial,proto3" json:"tpm_ekcert_serial,omitempty"`
+	TpmAkPublic           []byte   `protobuf:"bytes,5,opt,name=tpm_ak_public,json=tpmAkPublic,proto3" json:"tpm_ak_public,omitempty"`
 	XXX_NoUnkeyedLiteral  struct{} `json:"-"`
 	XXX_unrecognized      []byte   `json:"-"`
 	XXX_sizecache         int32    `json:"-"`
@@ -176,22 +176,23 @@ var xxx_messageInfo_DeviceCredential proto.InternalMessageInfo
 // DeviceCollectedData is the resource representation of
 // teleport.devicetrust.v1.DeviceCollectedData.
 type DeviceCollectedData struct {
-	CollectTime             *time.Time `protobuf:"bytes,1,opt,name=collect_time,json=collectTime,proto3,stdtime" json:"collect_time"`
-	RecordTime              *time.Time `protobuf:"bytes,2,opt,name=record_time,json=recordTime,proto3,stdtime" json:"record_time"`
-	OsType                  string     `protobuf:"bytes,3,opt,name=os_type,json=osType,proto3" json:"os_type"`
-	SerialNumber            string     `protobuf:"bytes,4,opt,name=serial_number,json=serialNumber,proto3" json:"serial_number,omitempty"`
-	ModelIdentifier         string     `protobuf:"bytes,5,opt,name=model_identifier,json=modelIdentifier,proto3" json:"model_identifier,omitempty"`
-	OsVersion               string     `protobuf:"bytes,6,opt,name=os_version,json=osVersion,proto3" json:"os_version,omitempty"`
-	OsBuild                 string     `protobuf:"bytes,7,opt,name=os_build,json=osBuild,proto3" json:"os_build,omitempty"`
-	OsUsername              string     `protobuf:"bytes,8,opt,name=os_username,json=osUsername,proto3" json:"os_username,omitempty"`
-	JamfBinaryVersion       string     `protobuf:"bytes,9,opt,name=jamf_binary_version,json=jamfBinaryVersion,proto3" json:"jamf_binary_version,omitempty"`
-	MacosEnrollmentProfiles string     `protobuf:"bytes,10,opt,name=macos_enrollment_profiles,json=macosEnrollmentProfiles,proto3" json:"macos_enrollment_profiles,omitempty"`
-	ReportedAssetTag        string     `protobuf:"bytes,11,opt,name=reported_asset_tag,json=reportedAssetTag,proto3" json:"reported_asset_tag,omitempty"`
-	SystemSerialNumber      string     `protobuf:"bytes,12,opt,name=system_serial_number,json=systemSerialNumber,proto3" json:"system_serial_number,omitempty"`
-	BaseBoardSerialNumber   string     `protobuf:"bytes,13,opt,name=base_board_serial_number,json=baseBoardSerialNumber,proto3" json:"base_board_serial_number,omitempty"`
-	XXX_NoUnkeyedLiteral    struct{}   `json:"-"`
-	XXX_unrecognized        []byte     `json:"-"`
-	XXX_sizecache           int32      `json:"-"`
+	CollectTime             *time.Time              `protobuf:"bytes,1,opt,name=collect_time,json=collectTime,proto3,stdtime" json:"collect_time"`
+	RecordTime              *time.Time              `protobuf:"bytes,2,opt,name=record_time,json=recordTime,proto3,stdtime" json:"record_time"`
+	OsType                  string                  `protobuf:"bytes,3,opt,name=os_type,json=osType,proto3" json:"os_type"`
+	SerialNumber            string                  `protobuf:"bytes,4,opt,name=serial_number,json=serialNumber,proto3" json:"serial_number,omitempty"`
+	ModelIdentifier         string                  `protobuf:"bytes,5,opt,name=model_identifier,json=modelIdentifier,proto3" json:"model_identifier,omitempty"`
+	OsVersion               string                  `protobuf:"bytes,6,opt,name=os_version,json=osVersion,proto3" json:"os_version,omitempty"`
+	OsBuild                 string                  `protobuf:"bytes,7,opt,name=os_build,json=osBuild,proto3" json:"os_build,omitempty"`
+	OsUsername              string                  `protobuf:"bytes,8,opt,name=os_username,json=osUsername,proto3" json:"os_username,omitempty"`
+	JamfBinaryVersion       string                  `protobuf:"bytes,9,opt,name=jamf_binary_version,json=jamfBinaryVersion,proto3" json:"jamf_binary_version,omitempty"`
+	MacosEnrollmentProfiles string                  `protobuf:"bytes,10,opt,name=macos_enrollment_profiles,json=macosEnrollmentProfiles,proto3" json:"macos_enrollment_profiles,omitempty"`
+	ReportedAssetTag        string                  `protobuf:"bytes,11,opt,name=reported_asset_tag,json=reportedAssetTag,proto3" json:"reported_asset_tag,omitempty"`
+	SystemSerialNumber      string                  `protobuf:"bytes,12,opt,name=system_serial_number,json=systemSerialNumber,proto3" json:"system_serial_number,omitempty"`
+	BaseBoardSerialNumber   string                  `protobuf:"bytes,13,opt,name=base_board_serial_number,json=baseBoardSerialNumber,proto3" json:"base_board_serial_number,omitempty"`
+	TpmPlatformAttestation  *TPMPlatformAttestation `protobuf:"bytes,14,opt,name=tpm_platform_attestation,json=tpmPlatformAttestation,proto3" json:"tpm_platform_attestation,omitempty"`
+	XXX_NoUnkeyedLiteral    struct{}                `json:"-"`
+	XXX_unrecognized        []byte                  `json:"-"`
+	XXX_sizecache           int32                   `json:"-"`
 }
 
 func (m *DeviceCollectedData) Reset()         { *m = DeviceCollectedData{} }
@@ -227,8 +228,180 @@ func (m *DeviceCollectedData) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_DeviceCollectedData proto.InternalMessageInfo
 
+// TPMPCR is the resource representation of teleport.devicetrust.v1.TPMPCR.
+type TPMPCR struct {
+	Index                int32    `protobuf:"varint,1,opt,name=index,proto3" json:"index"`
+	Digest               []byte   `protobuf:"bytes,2,opt,name=digest,proto3" json:"digest"`
+	DigestAlg            uint64   `protobuf:"varint,3,opt,name=digest_alg,json=digestAlg,proto3" json:"digest_alg"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *TPMPCR) Reset()         { *m = TPMPCR{} }
+func (m *TPMPCR) String() string { return proto.CompactTextString(m) }
+func (*TPMPCR) ProtoMessage()    {}
+func (*TPMPCR) Descriptor() ([]byte, []int) {
+	return fileDescriptor_aceaef1b58496e7d, []int{4}
+}
+func (m *TPMPCR) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *TPMPCR) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_TPMPCR.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *TPMPCR) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_TPMPCR.Merge(m, src)
+}
+func (m *TPMPCR) XXX_Size() int {
+	return m.Size()
+}
+func (m *TPMPCR) XXX_DiscardUnknown() {
+	xxx_messageInfo_TPMPCR.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_TPMPCR proto.InternalMessageInfo
+
+// TPMQuote is the resource representation of teleport.devicetrust.v1.TPMQuote.
+type TPMQuote struct {
+	Quote                []byte   `protobuf:"bytes,1,opt,name=quote,proto3" json:"quote"`
+	Signature            []byte   `protobuf:"bytes,2,opt,name=signature,proto3" json:"signature"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *TPMQuote) Reset()         { *m = TPMQuote{} }
+func (m *TPMQuote) String() string { return proto.CompactTextString(m) }
+func (*TPMQuote) ProtoMessage()    {}
+func (*TPMQuote) Descriptor() ([]byte, []int) {
+	return fileDescriptor_aceaef1b58496e7d, []int{5}
+}
+func (m *TPMQuote) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *TPMQuote) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_TPMQuote.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *TPMQuote) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_TPMQuote.Merge(m, src)
+}
+func (m *TPMQuote) XXX_Size() int {
+	return m.Size()
+}
+func (m *TPMQuote) XXX_DiscardUnknown() {
+	xxx_messageInfo_TPMQuote.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_TPMQuote proto.InternalMessageInfo
+
+// TPMPlatformParameters is the resource representation of
+// teleport.devicetrust.v1.TPMPlatformParameters.
+type TPMPlatformParameters struct {
+	Quotes               []*TPMQuote `protobuf:"bytes,1,rep,name=quotes,proto3" json:"quotes"`
+	Pcrs                 []*TPMPCR   `protobuf:"bytes,2,rep,name=pcrs,proto3" json:"pcrs"`
+	EventLog             []byte      `protobuf:"bytes,3,opt,name=event_log,json=eventLog,proto3" json:"event_log"`
+	XXX_NoUnkeyedLiteral struct{}    `json:"-"`
+	XXX_unrecognized     []byte      `json:"-"`
+	XXX_sizecache        int32       `json:"-"`
+}
+
+func (m *TPMPlatformParameters) Reset()         { *m = TPMPlatformParameters{} }
+func (m *TPMPlatformParameters) String() string { return proto.CompactTextString(m) }
+func (*TPMPlatformParameters) ProtoMessage()    {}
+func (*TPMPlatformParameters) Descriptor() ([]byte, []int) {
+	return fileDescriptor_aceaef1b58496e7d, []int{6}
+}
+func (m *TPMPlatformParameters) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *TPMPlatformParameters) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_TPMPlatformParameters.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *TPMPlatformParameters) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_TPMPlatformParameters.Merge(m, src)
+}
+func (m *TPMPlatformParameters) XXX_Size() int {
+	return m.Size()
+}
+func (m *TPMPlatformParameters) XXX_DiscardUnknown() {
+	xxx_messageInfo_TPMPlatformParameters.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_TPMPlatformParameters proto.InternalMessageInfo
+
+// TPMPlatformAttestation is the resource representation of
+// teleport.devicetrust.v1.TPMPlatformAttestation.
+type TPMPlatformAttestation struct {
+	Nonce                []byte                 `protobuf:"bytes,1,opt,name=nonce,proto3" json:"nonce,omitempty"`
+	PlatformParameters   *TPMPlatformParameters `protobuf:"bytes,2,opt,name=platform_parameters,json=platformParameters,proto3" json:"platform_parameters,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}               `json:"-"`
+	XXX_unrecognized     []byte                 `json:"-"`
+	XXX_sizecache        int32                  `json:"-"`
+}
+
+func (m *TPMPlatformAttestation) Reset()         { *m = TPMPlatformAttestation{} }
+func (m *TPMPlatformAttestation) String() string { return proto.CompactTextString(m) }
+func (*TPMPlatformAttestation) ProtoMessage()    {}
+func (*TPMPlatformAttestation) Descriptor() ([]byte, []int) {
+	return fileDescriptor_aceaef1b58496e7d, []int{7}
+}
+func (m *TPMPlatformAttestation) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *TPMPlatformAttestation) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_TPMPlatformAttestation.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *TPMPlatformAttestation) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_TPMPlatformAttestation.Merge(m, src)
+}
+func (m *TPMPlatformAttestation) XXX_Size() int {
+	return m.Size()
+}
+func (m *TPMPlatformAttestation) XXX_DiscardUnknown() {
+	xxx_messageInfo_TPMPlatformAttestation.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_TPMPlatformAttestation proto.InternalMessageInfo
+
 // DeviceSource is the resource representation of
-// teleport.devicetrust.v1.DeviceSource.
+// teleport.devicetrust.v1.DeviceSource..
 type DeviceSource struct {
 	Name                 string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name"`
 	Origin               string   `protobuf:"bytes,2,opt,name=origin,proto3" json:"origin"`
@@ -241,7 +414,7 @@ func (m *DeviceSource) Reset()         { *m = DeviceSource{} }
 func (m *DeviceSource) String() string { return proto.CompactTextString(m) }
 func (*DeviceSource) ProtoMessage()    {}
 func (*DeviceSource) Descriptor() ([]byte, []int) {
-	return fileDescriptor_aceaef1b58496e7d, []int{4}
+	return fileDescriptor_aceaef1b58496e7d, []int{8}
 }
 func (m *DeviceSource) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -279,6 +452,7 @@ type DeviceProfile struct {
 	OsBuild              string     `protobuf:"bytes,4,opt,name=os_build,json=osBuild,proto3" json:"os_build,omitempty"`
 	OsUsernames          []string   `protobuf:"bytes,5,rep,name=os_usernames,json=osUsernames,proto3" json:"os_usernames,omitempty"`
 	JamfBinaryVersion    string     `protobuf:"bytes,6,opt,name=jamf_binary_version,json=jamfBinaryVersion,proto3" json:"jamf_binary_version,omitempty"`
+	ExternalId           string     `protobuf:"bytes,7,opt,name=external_id,json=externalId,proto3" json:"external_id,omitempty"`
 	XXX_NoUnkeyedLiteral struct{}   `json:"-"`
 	XXX_unrecognized     []byte     `json:"-"`
 	XXX_sizecache        int32      `json:"-"`
@@ -288,7 +462,7 @@ func (m *DeviceProfile) Reset()         { *m = DeviceProfile{} }
 func (m *DeviceProfile) String() string { return proto.CompactTextString(m) }
 func (*DeviceProfile) ProtoMessage()    {}
 func (*DeviceProfile) Descriptor() ([]byte, []int) {
-	return fileDescriptor_aceaef1b58496e7d, []int{5}
+	return fileDescriptor_aceaef1b58496e7d, []int{9}
 }
 func (m *DeviceProfile) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -322,6 +496,10 @@ func init() {
 	proto.RegisterType((*DeviceSpec)(nil), "types.DeviceSpec")
 	proto.RegisterType((*DeviceCredential)(nil), "types.DeviceCredential")
 	proto.RegisterType((*DeviceCollectedData)(nil), "types.DeviceCollectedData")
+	proto.RegisterType((*TPMPCR)(nil), "types.TPMPCR")
+	proto.RegisterType((*TPMQuote)(nil), "types.TPMQuote")
+	proto.RegisterType((*TPMPlatformParameters)(nil), "types.TPMPlatformParameters")
+	proto.RegisterType((*TPMPlatformAttestation)(nil), "types.TPMPlatformAttestation")
 	proto.RegisterType((*DeviceSource)(nil), "types.DeviceSource")
 	proto.RegisterType((*DeviceProfile)(nil), "types.DeviceProfile")
 }
@@ -331,77 +509,96 @@ func init() {
 }
 
 var fileDescriptor_aceaef1b58496e7d = []byte{
-	// 1113 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x56, 0xdd, 0x6e, 0xdb, 0x36,
-	0x18, 0xad, 0x7f, 0xea, 0xc4, 0xb4, 0xdd, 0x26, 0x4c, 0xd2, 0xa8, 0x59, 0x6a, 0xa6, 0xde, 0xb0,
-	0x15, 0xdb, 0x60, 0xa3, 0x1b, 0xf6, 0x83, 0x0d, 0x05, 0x16, 0x2d, 0x01, 0x56, 0x0c, 0x28, 0x52,
-	0x39, 0xeb, 0x45, 0x6f, 0x08, 0x5a, 0x62, 0x3c, 0x2d, 0x92, 0x29, 0x88, 0x74, 0x30, 0xbf, 0xc5,
-	0xde, 0x65, 0x7b, 0x88, 0x5c, 0xf6, 0x6a, 0x97, 0xdc, 0x96, 0x4b, 0x3d, 0xc1, 0x2e, 0x07, 0x7d,
-	0x94, 0x6d, 0x2a, 0x3f, 0x68, 0x50, 0xec, 0x46, 0x09, 0xcf, 0x39, 0xdf, 0x21, 0x45, 0x7d, 0x87,
-	0x34, 0xea, 0x29, 0x1e, 0xf1, 0x44, 0xa4, 0x6a, 0x10, 0xf1, 0x31, 0xf3, 0x67, 0x03, 0x35, 0x4b,
-	0xb8, 0x1c, 0x04, 0xfc, 0x2c, 0xf4, 0x79, 0x3f, 0x49, 0x85, 0x12, 0xf8, 0x2e, 0x60, 0x3b, 0x9b,
-	0x63, 0x31, 0x16, 0x80, 0x0c, 0xf2, 0xff, 0x0c, 0xb9, 0x43, 0xc6, 0x42, 0x8c, 0x23, 0x3e, 0x80,
-	0xd1, 0x68, 0x7a, 0x32, 0x50, 0x61, 0xcc, 0xa5, 0x62, 0x71, 0x52, 0x08, 0x1e, 0x5f, 0x3f, 0x03,
-	0x3c, 0x8d, 0xa4, 0xf7, 0x2b, 0x5a, 0x3d, 0x80, 0x09, 0x5f, 0x3d, 0xc5, 0xdf, 0xa2, 0xc6, 0x0f,
-	0x9c, 0x05, 0x3c, 0x75, 0x2a, 0x7b, 0x95, 0x27, 0xad, 0xcf, 0xb6, 0xfa, 0x46, 0xe9, 0x71, 0x29,
-	0xa6, 0xa9, 0xcf, 0x0d, 0xe9, 0xb6, 0xcf, 0x35, 0xb9, 0xf3, 0x46, 0x93, 0x4a, 0xa6, 0xc9, 0x1d,
-	0xaf, 0x28, 0xc1, 0x03, 0x54, 0x97, 0x09, 0xf7, 0x9d, 0xbb, 0x50, 0xba, 0x5e, 0x94, 0x1a, 0xef,
-	0x61, 0xc2, 0x7d, 0x77, 0x35, 0xd3, 0x04, 0x24, 0x1e, 0x3c, 0x7b, 0xff, 0xd6, 0x11, 0x5a, 0xd2,
-	0xf8, 0x03, 0xb4, 0x22, 0x24, 0xcd, 0xab, 0x60, 0xf6, 0xa6, 0xdb, 0xca, 0x34, 0x99, 0x43, 0x5e,
-	0x43, 0xc8, 0xe3, 0x59, 0xc2, 0xf1, 0xc7, 0xa8, 0xc9, 0xa4, 0xe4, 0x8a, 0x2a, 0x36, 0x76, 0xaa,
-	0xa0, 0xeb, 0x64, 0x9a, 0x2c, 0x41, 0x6f, 0x15, 0xfe, 0x3d, 0x66, 0x63, 0x7c, 0x84, 0x5a, 0x7e,
-	0xca, 0x99, 0xe2, 0x34, 0xdf, 0x17, 0xa7, 0x06, 0x0b, 0xdb, 0xe9, 0x9b, 0x4d, 0xeb, 0xcf, 0x37,
-	0xad, 0x7f, 0x3c, 0xdf, 0x34, 0x77, 0x23, 0xd3, 0xc4, 0x2e, 0xf9, 0xed, 0x2f, 0x52, 0xf1, 0x90,
-	0x01, 0x72, 0x55, 0xee, 0x38, 0x4d, 0x82, 0x85, 0x63, 0xfd, 0x76, 0x8e, 0x56, 0x89, 0x71, 0x34,
-	0x00, 0x38, 0x7e, 0x89, 0x3a, 0x7c, 0x92, 0x8a, 0x28, 0xa2, 0x52, 0x31, 0x35, 0x95, 0xb0, 0x7d,
-	0x4d, 0x77, 0x3d, 0xd3, 0xa4, 0x4c, 0x78, 0x6d, 0x33, 0x1c, 0xc2, 0x08, 0xbf, 0x44, 0xf9, 0xba,
-	0x02, 0x3e, 0x51, 0x21, 0x8b, 0x9c, 0x06, 0x2c, 0x64, 0xbb, 0xb4, 0xe7, 0xdf, 0x2f, 0x68, 0xd7,
-	0xc9, 0x34, 0xd9, 0x5c, 0xca, 0x3f, 0x15, 0x71, 0xa8, 0x78, 0x9c, 0xa8, 0x99, 0x67, 0x99, 0x60,
-	0x8a, 0xee, 0xf9, 0x22, 0x8a, 0xb8, 0xaf, 0x78, 0x40, 0x03, 0xa6, 0x98, 0xb3, 0xb2, 0x57, 0x83,
-	0xf7, 0x2b, 0xd9, 0xce, 0x25, 0x07, 0x4c, 0x31, 0x77, 0x37, 0xd3, 0xc4, 0x29, 0x57, 0x59, 0xee,
-	0x1d, 0xdf, 0x16, 0xe3, 0x7d, 0xd4, 0x30, 0x7d, 0xe4, 0xac, 0xc2, 0x7a, 0x37, 0xca, 0x3d, 0x02,
-	0x94, 0xbb, 0x99, 0x69, 0xb2, 0x66, 0x64, 0x96, 0x53, 0x51, 0x88, 0x0f, 0xd1, 0x4a, 0x92, 0x8a,
-	0x93, 0x30, 0xe2, 0x4e, 0x13, 0x3c, 0x36, 0x4b, 0x1e, 0x47, 0x86, 0x73, 0xb7, 0x32, 0x4d, 0xd6,
-	0x0b, 0xa1, 0xe5, 0x32, 0xaf, 0xed, 0xfd, 0x5e, 0x45, 0x6b, 0x97, 0x77, 0x09, 0x3f, 0x40, 0xd5,
-	0x30, 0x28, 0x7a, 0xaf, 0x91, 0x69, 0x52, 0x0d, 0x03, 0xaf, 0x1a, 0x06, 0xf8, 0x6b, 0x74, 0x2f,
-	0x99, 0x8e, 0xa2, 0xd0, 0xa7, 0xa7, 0x7c, 0x46, 0xf3, 0x74, 0xe4, 0x7d, 0xd7, 0x76, 0x71, 0xa6,
-	0xc9, 0x25, 0xc6, 0x6b, 0x9b, 0xf1, 0x8f, 0x7c, 0x76, 0xc0, 0x53, 0x3c, 0x44, 0xdb, 0x26, 0xcc,
-	0x94, 0x29, 0x95, 0x77, 0x84, 0x0a, 0xc5, 0xc4, 0xb4, 0x78, 0x0d, 0xa6, 0x79, 0x2f, 0xd3, 0xe4,
-	0x26, 0x89, 0xb7, 0x65, 0x88, 0xfd, 0x25, 0x0e, 0x09, 0xd8, 0x47, 0xeb, 0x2a, 0x89, 0x29, 0x3f,
-	0xf5, 0x79, 0xaa, 0xa8, 0xe4, 0x69, 0xde, 0x00, 0x75, 0xb0, 0x83, 0xd7, 0xbe, 0x42, 0x7a, 0xf7,
-	0x55, 0x12, 0x1f, 0x02, 0x32, 0x04, 0x00, 0x7f, 0x81, 0x3a, 0xb9, 0x8a, 0x9d, 0x52, 0xb3, 0x5c,
-	0x68, 0xba, 0xb6, 0x69, 0xba, 0x12, 0xe1, 0xb5, 0x54, 0x12, 0xef, 0x9f, 0x1e, 0xc1, 0xa0, 0xf7,
-	0xe7, 0x0a, 0xda, 0xb8, 0xa6, 0x09, 0xf0, 0x10, 0xb5, 0x8b, 0x0f, 0x6d, 0x62, 0x51, 0x79, 0x6b,
-	0x2c, 0xf2, 0x8f, 0x5c, 0xaa, 0x81, 0x5c, 0xb4, 0x0a, 0x64, 0x1e, 0xb5, 0x94, 0xfb, 0x22, 0x0d,
-	0x8c, 0x67, 0xf5, 0x76, 0x51, 0xb3, 0x4a, 0x4c, 0xd4, 0x0c, 0x00, 0x8e, 0xd6, 0x01, 0x53, 0xbb,
-	0xf9, 0x80, 0xf9, 0x0e, 0x75, 0xcc, 0xb6, 0xd1, 0xc9, 0x34, 0x1e, 0xf1, 0xb4, 0xd8, 0x5a, 0xf8,
-	0x52, 0x25, 0xc2, 0xea, 0xab, 0xb6, 0x21, 0x5e, 0x00, 0x8e, 0x9f, 0xa3, 0xb5, 0x58, 0x04, 0x3c,
-	0xa2, 0x21, 0x74, 0xd6, 0x49, 0xc8, 0xd3, 0x22, 0xd5, 0xdd, 0x4c, 0x93, 0x9d, 0xcb, 0x9c, 0xe5,
-	0x73, 0x1f, 0xb8, 0xe7, 0x0b, 0x0a, 0x7f, 0x85, 0x90, 0x90, 0xf4, 0x8c, 0xa7, 0x32, 0x14, 0x13,
-	0x48, 0x79, 0xd3, 0x84, 0x79, 0x89, 0x5a, 0xe5, 0x4d, 0x21, 0x5f, 0x19, 0x10, 0x3f, 0x45, 0xab,
-	0x42, 0xd2, 0xd1, 0x34, 0x8c, 0x02, 0x67, 0x05, 0xca, 0x1e, 0x64, 0x9a, 0xe0, 0x39, 0x66, 0x67,
-	0x42, 0x48, 0x37, 0x87, 0xf0, 0x37, 0xa8, 0x25, 0x24, 0x9d, 0x4a, 0x9e, 0x4e, 0x58, 0x6c, 0x22,
-	0xda, 0x74, 0x1f, 0x66, 0x9a, 0x6c, 0x59, 0xb0, 0x7d, 0x74, 0x08, 0xf9, 0x53, 0x81, 0xe2, 0x97,
-	0x68, 0xe3, 0x17, 0x16, 0x9f, 0xd0, 0x51, 0x38, 0x61, 0xe9, 0x6c, 0xb1, 0xe0, 0x26, 0x78, 0x3c,
-	0xce, 0x34, 0x79, 0x74, 0x0d, 0x6d, 0x79, 0xad, 0xe7, 0xb4, 0x0b, 0xec, 0xfc, 0x0d, 0x7c, 0xf4,
-	0x30, 0x66, 0xbe, 0x90, 0xd4, 0x1c, 0x7b, 0x31, 0x9f, 0x28, 0x5a, 0xc4, 0x57, 0x3a, 0x08, 0x8c,
-	0x3f, 0xca, 0x34, 0x79, 0xff, 0x46, 0x91, 0x65, 0xbf, 0x0d, 0xa2, 0xc3, 0x85, 0xa6, 0x38, 0x26,
-	0x24, 0x7e, 0x81, 0x70, 0x0a, 0xf7, 0x23, 0x0f, 0xe8, 0xf2, 0x5a, 0x69, 0x81, 0xfb, 0x5e, 0xa6,
-	0xc9, 0xee, 0x55, 0xd6, 0xb2, 0x5d, 0x9b, 0xb3, 0xfb, 0xf3, 0x1b, 0xe7, 0x18, 0x6d, 0xca, 0x99,
-	0x54, 0x3c, 0xa6, 0xe5, 0x1e, 0x6a, 0x83, 0x63, 0x2f, 0xd3, 0xa4, 0x7b, 0x1d, 0x6f, 0x79, 0x62,
-	0xc3, 0x0f, 0xed, 0x86, 0xa2, 0xc8, 0x19, 0x31, 0xc9, 0xe9, 0x48, 0xb0, 0x34, 0xb8, 0xe4, 0xdc,
-	0x01, 0xe7, 0x0f, 0x33, 0x4d, 0x7a, 0x37, 0x69, 0x2c, 0xf7, 0xad, 0x5c, 0xe3, 0xe6, 0x12, 0x7b,
-	0x82, 0xde, 0x11, 0x6a, 0xdb, 0x67, 0x30, 0xde, 0x45, 0x75, 0xe8, 0x01, 0x73, 0x16, 0xc2, 0xbd,
-	0x9d, 0x8f, 0x3d, 0x78, 0xe2, 0x1e, 0x6a, 0x88, 0x34, 0x1c, 0x87, 0x93, 0xe2, 0xfe, 0x45, 0x99,
-	0x26, 0x05, 0xe2, 0x15, 0x7f, 0x7b, 0x7f, 0xd4, 0x50, 0xa7, 0x74, 0x24, 0xe3, 0xd7, 0xe5, 0xab,
-	0xf3, 0xed, 0x67, 0xc4, 0xa3, 0xbc, 0xf5, 0xac, 0x92, 0xe5, 0x6b, 0x5c, 0xb9, 0x44, 0xaf, 0x4b,
-	0x5c, 0xf5, 0xff, 0x48, 0x5c, 0xed, 0xdd, 0x12, 0x57, 0xbf, 0x5d, 0xe2, 0x9e, 0xa1, 0xb6, 0x15,
-	0xad, 0xfc, 0xea, 0xaf, 0x3d, 0x69, 0xba, 0x3b, 0x99, 0x26, 0x0f, 0x6c, 0xdc, 0x2a, 0x6d, 0x2d,
-	0x33, 0x27, 0x6f, 0x0a, 0x5d, 0xe3, 0xdd, 0x43, 0xe7, 0x3e, 0x3b, 0xff, 0xa7, 0x7b, 0xe7, 0xfc,
-	0xa2, 0x5b, 0x79, 0x73, 0xd1, 0xad, 0xfc, 0x7d, 0xd1, 0xad, 0xbc, 0xfe, 0x64, 0x1c, 0xaa, 0x9f,
-	0xa7, 0xa3, 0xbe, 0x2f, 0xe2, 0xc1, 0x38, 0x65, 0x67, 0xa1, 0xb9, 0x89, 0x58, 0x34, 0x58, 0xfc,
-	0xb4, 0x64, 0x49, 0x68, 0x7e, 0x51, 0x8e, 0x1a, 0xf0, 0x19, 0x3f, 0xff, 0x2f, 0x00, 0x00, 0xff,
-	0xff, 0xa1, 0x9e, 0x8d, 0x5b, 0xd9, 0x0a, 0x00, 0x00,
+	// 1424 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x57, 0xcb, 0x6e, 0xdb, 0x46,
+	0x17, 0x8e, 0x2e, 0x96, 0xa5, 0x91, 0xe4, 0xd8, 0xe3, 0x1b, 0xe3, 0x38, 0x9e, 0x44, 0xff, 0x2d,
+	0x7f, 0xd3, 0x5a, 0x48, 0x03, 0xb4, 0x40, 0x8a, 0xa0, 0x35, 0x93, 0x00, 0x0d, 0xd2, 0x04, 0x0a,
+	0xed, 0x06, 0x45, 0x80, 0x82, 0x18, 0x91, 0x63, 0x96, 0x35, 0xa9, 0x61, 0x39, 0x23, 0x23, 0x02,
+	0x0a, 0xf4, 0x15, 0xfa, 0x12, 0x7d, 0x84, 0xbe, 0x43, 0x96, 0xd9, 0x75, 0x51, 0x80, 0x6d, 0xb3,
+	0xe4, 0xaa, 0xcb, 0x2e, 0x8b, 0x39, 0x43, 0x49, 0xc3, 0x58, 0x46, 0x82, 0xb6, 0x1b, 0x91, 0xfc,
+	0xbe, 0x73, 0xbe, 0x19, 0x1e, 0x9e, 0xcb, 0x08, 0xf5, 0x24, 0x8b, 0x58, 0xc2, 0x53, 0xd9, 0x8f,
+	0x58, 0x40, 0xbd, 0x49, 0x5f, 0x4e, 0x12, 0x26, 0xfa, 0x3e, 0x3b, 0x0d, 0x3d, 0xb6, 0x9f, 0xa4,
+	0x5c, 0x72, 0xbc, 0x04, 0xd8, 0xce, 0x46, 0xc0, 0x03, 0x0e, 0x48, 0x5f, 0xdd, 0x69, 0x72, 0x87,
+	0x04, 0x9c, 0x07, 0x11, 0xeb, 0xc3, 0xd3, 0x70, 0x7c, 0xdc, 0x97, 0x61, 0xcc, 0x84, 0xa4, 0x71,
+	0x52, 0x18, 0x5c, 0x5b, 0xbc, 0x02, 0xfc, 0x6a, 0x93, 0xde, 0x73, 0xd4, 0xbc, 0x07, 0x0b, 0x3e,
+	0xbd, 0x89, 0x3f, 0x42, 0x8d, 0x4f, 0x19, 0xf5, 0x59, 0x6a, 0x55, 0xae, 0x56, 0xae, 0xb7, 0xdf,
+	0xdf, 0xdc, 0xd7, 0x96, 0x0e, 0x13, 0x7c, 0x9c, 0x7a, 0x4c, 0x93, 0x76, 0xe7, 0x45, 0x46, 0x2e,
+	0xbc, 0xcc, 0x48, 0x25, 0xcf, 0xc8, 0x05, 0xa7, 0x70, 0xc1, 0x7d, 0x54, 0x17, 0x09, 0xf3, 0xac,
+	0x25, 0x70, 0x5d, 0x2b, 0x5c, 0xb5, 0xf6, 0x61, 0xc2, 0x3c, 0xbb, 0x99, 0x67, 0x04, 0x4c, 0x1c,
+	0xf8, 0xed, 0xfd, 0x51, 0x47, 0x68, 0x4e, 0xe3, 0x7f, 0xa3, 0x65, 0x2e, 0x5c, 0xe5, 0x05, 0xab,
+	0xb7, 0xec, 0x76, 0x9e, 0x91, 0x29, 0xe4, 0x34, 0xb8, 0x38, 0x9a, 0x24, 0x0c, 0xbf, 0x83, 0x5a,
+	0x54, 0x08, 0x26, 0x5d, 0x49, 0x03, 0xab, 0x0a, 0x76, 0xdd, 0x3c, 0x23, 0x73, 0xd0, 0x69, 0xc2,
+	0xed, 0x11, 0x0d, 0xf0, 0x00, 0xb5, 0xbd, 0x94, 0x51, 0xc9, 0x5c, 0x15, 0x17, 0xab, 0x06, 0x1b,
+	0xdb, 0xd9, 0xd7, 0x41, 0xdb, 0x9f, 0x06, 0x6d, 0xff, 0x68, 0x1a, 0x34, 0x7b, 0x3d, 0xcf, 0x88,
+	0xe9, 0xf2, 0xfd, 0x2f, 0xa4, 0xe2, 0x20, 0x0d, 0x28, 0x2b, 0xa5, 0x38, 0x4e, 0xfc, 0x99, 0x62,
+	0xfd, 0xed, 0x14, 0x0d, 0x17, 0xad, 0xa8, 0x01, 0x50, 0xfc, 0x00, 0x75, 0xd9, 0x28, 0xe5, 0x51,
+	0xe4, 0x0a, 0x49, 0xe5, 0x58, 0x40, 0xf8, 0x5a, 0xf6, 0x5a, 0x9e, 0x91, 0x32, 0xe1, 0x74, 0xf4,
+	0xe3, 0x21, 0x3c, 0xe1, 0x27, 0x48, 0xed, 0xcb, 0x67, 0x23, 0x19, 0xd2, 0xc8, 0x6a, 0xc0, 0x46,
+	0xb6, 0x4b, 0x31, 0xbf, 0x3b, 0xa3, 0x6d, 0x2b, 0xcf, 0xc8, 0xc6, 0xdc, 0xfc, 0x5d, 0x1e, 0x87,
+	0x92, 0xc5, 0x89, 0x9c, 0x38, 0x86, 0x08, 0x76, 0xd1, 0x8a, 0xc7, 0xa3, 0x88, 0x79, 0x92, 0xf9,
+	0xae, 0x4f, 0x25, 0xb5, 0x96, 0xaf, 0xd6, 0xe0, 0xfd, 0x4a, 0xb2, 0x53, 0x93, 0x7b, 0x54, 0x52,
+	0x7b, 0x37, 0xcf, 0x88, 0x55, 0xf6, 0x32, 0xd4, 0xbb, 0x9e, 0x69, 0x8c, 0x0f, 0x50, 0x43, 0xe7,
+	0x91, 0xd5, 0x84, 0xfd, 0xae, 0x97, 0x73, 0x04, 0x28, 0x7b, 0x23, 0xcf, 0xc8, 0xaa, 0x36, 0x33,
+	0x94, 0x0a, 0x47, 0x7c, 0x1f, 0x2d, 0x27, 0x29, 0x3f, 0x0e, 0x23, 0x66, 0xb5, 0x40, 0x63, 0xa3,
+	0xa4, 0x31, 0xd0, 0x9c, 0xbd, 0x99, 0x67, 0x64, 0xad, 0x30, 0x34, 0x54, 0xa6, 0xbe, 0xbd, 0x9f,
+	0xab, 0x68, 0xf5, 0xf5, 0x28, 0xe1, 0x2d, 0x54, 0x0d, 0xfd, 0x22, 0xf7, 0x1a, 0x79, 0x46, 0xaa,
+	0xa1, 0xef, 0x54, 0x43, 0x1f, 0xdb, 0x68, 0x25, 0x19, 0x0f, 0xa3, 0xd0, 0x73, 0x4f, 0xd8, 0xc4,
+	0x55, 0xd5, 0xa1, 0xf2, 0xae, 0xa3, 0xdf, 0xbd, 0xcc, 0x18, 0x6b, 0x75, 0x34, 0xf3, 0x90, 0x4d,
+	0xee, 0xb1, 0x14, 0x7f, 0x89, 0xb6, 0x75, 0x59, 0xbb, 0x54, 0x4a, 0x95, 0x1b, 0x32, 0xe4, 0x23,
+	0x9d, 0xec, 0x35, 0x58, 0xf0, 0x3f, 0x79, 0x46, 0xae, 0x9d, 0x63, 0x62, 0xa8, 0x6e, 0x6a, 0x93,
+	0x83, 0xb9, 0x05, 0x54, 0xc5, 0x43, 0xb4, 0x26, 0x93, 0xd8, 0x65, 0x27, 0x1e, 0x4b, 0xa5, 0x2b,
+	0x58, 0xaa, 0x92, 0xa2, 0x0e, 0xc2, 0x24, 0xcf, 0xc8, 0xe5, 0x33, 0xa4, 0x21, 0x79, 0x51, 0x26,
+	0xf1, 0x7d, 0xe0, 0x0e, 0x81, 0xc2, 0x1f, 0xa3, 0xae, 0xb2, 0xa7, 0x27, 0xae, 0x7e, 0x05, 0x48,
+	0xc9, 0x8e, 0x7d, 0x39, 0xcf, 0xc8, 0x76, 0x89, 0x30, 0x44, 0xda, 0x32, 0x89, 0x0f, 0x4e, 0x06,
+	0x00, 0xf7, 0x7e, 0x6a, 0xa2, 0xf5, 0x05, 0xc9, 0x82, 0x0f, 0x51, 0xa7, 0x48, 0x08, 0x5d, 0x3e,
+	0x95, 0x37, 0x96, 0x8f, 0x4a, 0x86, 0x92, 0x0f, 0xd4, 0x4f, 0xbb, 0x40, 0xa6, 0x25, 0x99, 0x32,
+	0x8f, 0xa7, 0xbe, 0xd6, 0xac, 0xbe, 0x5d, 0x49, 0x1a, 0x2e, 0xba, 0x24, 0x35, 0x00, 0x8a, 0x46,
+	0x23, 0xaa, 0x9d, 0xdf, 0x88, 0x3e, 0x41, 0x5d, 0x1d, 0x4a, 0x77, 0x34, 0x8e, 0x87, 0x2c, 0x2d,
+	0xc2, 0x0d, 0x51, 0x2a, 0x11, 0x66, 0x4e, 0x68, 0xe2, 0x31, 0xe0, 0xf8, 0x01, 0x5a, 0x8d, 0xb9,
+	0xcf, 0x22, 0x37, 0x84, 0x0c, 0x3c, 0x0e, 0x59, 0x5a, 0x54, 0xff, 0x5e, 0x9e, 0x91, 0x9d, 0xd7,
+	0x39, 0xf3, 0x93, 0x01, 0xf7, 0x60, 0x46, 0xe1, 0x0f, 0x11, 0xe2, 0xc2, 0x3d, 0x65, 0xa9, 0x08,
+	0xf9, 0x08, 0xba, 0x41, 0x4b, 0x17, 0xfd, 0x1c, 0x35, 0xdc, 0x5b, 0x5c, 0x3c, 0xd5, 0x20, 0xbe,
+	0x89, 0x9a, 0x5c, 0xb8, 0xc3, 0x71, 0x18, 0xf9, 0xd6, 0x32, 0xb8, 0x6d, 0xe5, 0x19, 0xc1, 0x53,
+	0xcc, 0xac, 0x1d, 0x2e, 0x6c, 0x05, 0xe1, 0xdb, 0xa8, 0xcd, 0x85, 0x3b, 0x16, 0x2c, 0x1d, 0xd1,
+	0x58, 0x97, 0x72, 0xcb, 0xbe, 0x94, 0x67, 0x64, 0xd3, 0x80, 0xcd, 0x16, 0xc3, 0xc5, 0xe7, 0x05,
+	0x8a, 0x9f, 0xa0, 0xf5, 0xaf, 0x69, 0x7c, 0xec, 0x0e, 0xc3, 0x11, 0x4d, 0x27, 0xb3, 0x0d, 0xb7,
+	0x40, 0xe3, 0x5a, 0x9e, 0x91, 0x2b, 0x0b, 0x68, 0x43, 0x6b, 0x4d, 0xd1, 0x36, 0xb0, 0xd3, 0x37,
+	0xf0, 0xd0, 0xa5, 0x98, 0x7a, 0x5c, 0xb8, 0xba, 0x3d, 0xc6, 0x6c, 0x24, 0xdd, 0xa2, 0xcc, 0x85,
+	0x85, 0x40, 0xf8, 0x7f, 0x79, 0x46, 0xfe, 0x75, 0xae, 0x91, 0x21, 0xbf, 0x0d, 0x46, 0xf7, 0x67,
+	0x36, 0x45, 0x3b, 0x11, 0xf8, 0x31, 0xc2, 0x29, 0xcc, 0x51, 0xe6, 0xbb, 0xf3, 0xf1, 0xd3, 0x06,
+	0xf5, 0xab, 0x79, 0x46, 0x76, 0xcf, 0xb2, 0x86, 0xec, 0xea, 0x94, 0x3d, 0x98, 0x4e, 0xa6, 0x23,
+	0xb4, 0x21, 0x26, 0x42, 0xb2, 0xd8, 0x2d, 0xe7, 0x50, 0x07, 0x14, 0x7b, 0x79, 0x46, 0xf6, 0x16,
+	0xf1, 0x86, 0x26, 0xd6, 0xfc, 0xa1, 0x99, 0x50, 0x2e, 0xb2, 0x86, 0x54, 0x30, 0x77, 0xc8, 0x69,
+	0xea, 0xbf, 0xa6, 0xdc, 0x05, 0xe5, 0xff, 0xe6, 0x19, 0xe9, 0x9d, 0x67, 0x63, 0xb6, 0x19, 0x65,
+	0x63, 0x2b, 0x93, 0xd2, 0x02, 0xdf, 0x21, 0x4b, 0x35, 0x80, 0x24, 0xa2, 0xf2, 0x98, 0xa7, 0xb1,
+	0xd9, 0xa8, 0xac, 0x15, 0x28, 0xbc, 0x2b, 0x45, 0x3b, 0x3e, 0x1a, 0x3c, 0x1a, 0x14, 0x56, 0x46,
+	0xaf, 0xd2, 0xeb, 0x9f, 0x27, 0x61, 0xac, 0xbf, 0x25, 0x93, 0x78, 0x81, 0x7f, 0xef, 0x5b, 0xd4,
+	0x50, 0xca, 0x77, 0x1d, 0x4c, 0xd0, 0x52, 0x38, 0xf2, 0xd9, 0x73, 0x68, 0x22, 0x4b, 0x76, 0x2b,
+	0xcf, 0x88, 0x06, 0x1c, 0x7d, 0xc1, 0x3d, 0xd4, 0xf0, 0xc3, 0x80, 0x09, 0x59, 0x74, 0x6b, 0x94,
+	0x67, 0xa4, 0x40, 0x9c, 0xe2, 0x8a, 0xdf, 0x43, 0x48, 0xdf, 0xb9, 0x34, 0x0a, 0xa0, 0xd8, 0xeb,
+	0xf6, 0x4a, 0x9e, 0x11, 0x03, 0x75, 0x5a, 0xfa, 0xfe, 0x20, 0x0a, 0x7a, 0x5f, 0xa0, 0xe6, 0xd1,
+	0xe0, 0xd1, 0x93, 0x31, 0x97, 0x4c, 0xad, 0xff, 0x8d, 0xba, 0x81, 0xf5, 0x3b, 0x7a, 0x7d, 0x00,
+	0x1c, 0x7d, 0xc1, 0x37, 0x50, 0x4b, 0x84, 0xc1, 0x88, 0xca, 0x71, 0xca, 0x8a, 0x2d, 0xc0, 0x41,
+	0x65, 0x06, 0x3a, 0xf3, 0xdb, 0xde, 0x0f, 0x15, 0xb4, 0x69, 0x84, 0x6c, 0x40, 0x53, 0x1a, 0x33,
+	0xc9, 0x52, 0x81, 0x6f, 0xa1, 0x06, 0xe8, 0x09, 0xab, 0x02, 0xc3, 0xf8, 0xe2, 0x3c, 0xc0, 0xb0,
+	0x11, 0xfd, 0x5e, 0xda, 0xc4, 0x29, 0xae, 0xf8, 0x06, 0xaa, 0x27, 0x5e, 0x2a, 0xac, 0x2a, 0xb8,
+	0x74, 0x8d, 0x6f, 0x72, 0xd7, 0xd1, 0xc7, 0x30, 0x45, 0x3b, 0xf0, 0xab, 0x4e, 0x54, 0xec, 0x54,
+	0x15, 0x44, 0xc4, 0x75, 0x0c, 0x8a, 0x8d, 0xce, 0x40, 0xa7, 0x09, 0xb7, 0x9f, 0xf1, 0xa0, 0xf7,
+	0x63, 0x05, 0x6d, 0x2d, 0xfe, 0xb4, 0xf8, 0xff, 0x68, 0x69, 0xc4, 0x47, 0xde, 0x34, 0x20, 0xaa,
+	0xcb, 0x5e, 0x04, 0xc0, 0xf8, 0xac, 0xda, 0x02, 0x27, 0x68, 0x7d, 0xf6, 0xfd, 0x93, 0xd9, 0xab,
+	0x16, 0xad, 0x7b, 0xf7, 0x6c, 0x06, 0xcd, 0xc3, 0xa1, 0x7b, 0xc4, 0x02, 0x67, 0xb3, 0x32, 0x92,
+	0x33, 0x6e, 0xbd, 0x01, 0xea, 0x98, 0x87, 0x0c, 0xbc, 0x8b, 0xea, 0xd0, 0xbc, 0xf4, 0xb0, 0x87,
+	0x88, 0xa8, 0x67, 0x07, 0x7e, 0x55, 0xea, 0xf0, 0x34, 0x0c, 0xc2, 0x51, 0x71, 0xc0, 0x84, 0x10,
+	0x6b, 0xc4, 0x29, 0xae, 0xbd, 0xdf, 0x6b, 0xa8, 0x5b, 0x3a, 0x73, 0xe0, 0x67, 0xe5, 0xb3, 0xe1,
+	0x9b, 0x87, 0xdb, 0x15, 0xd5, 0x33, 0x0d, 0x97, 0xf9, 0x3b, 0x9c, 0x39, 0x25, 0x2e, 0x1a, 0x15,
+	0xd5, 0x7f, 0x62, 0x54, 0xd4, 0xfe, 0xda, 0xa8, 0xa8, 0xbf, 0xdd, 0xa8, 0xb8, 0x83, 0x3a, 0xc6,
+	0x4c, 0x50, 0x67, 0xdb, 0xda, 0xf5, 0x96, 0xbd, 0x93, 0x67, 0x64, 0xcb, 0xc4, 0xcd, 0x73, 0xc4,
+	0x7c, 0x58, 0x88, 0xf3, 0xa6, 0x45, 0xe3, 0x6f, 0x4c, 0x8b, 0xdb, 0xa8, 0xcd, 0x9e, 0x4b, 0xb5,
+	0x80, 0x8a, 0x57, 0x31, 0xf2, 0x60, 0x78, 0x19, 0xb0, 0x39, 0xbc, 0xa6, 0xf0, 0x03, 0xdf, 0xbe,
+	0xf3, 0xe2, 0xb7, 0xbd, 0x0b, 0x2f, 0x5e, 0xed, 0x55, 0x5e, 0xbe, 0xda, 0xab, 0xfc, 0xfa, 0x6a,
+	0xaf, 0xf2, 0xec, 0x46, 0x10, 0xca, 0xaf, 0xc6, 0xc3, 0x7d, 0x8f, 0xc7, 0xfd, 0x20, 0xa5, 0xa7,
+	0xa1, 0xae, 0x05, 0x1a, 0xf5, 0x67, 0xff, 0xbb, 0x68, 0x12, 0xea, 0xbf, 0x5b, 0xc3, 0x06, 0xa4,
+	0xc0, 0xad, 0x3f, 0x03, 0x00, 0x00, 0xff, 0xff, 0x00, 0xc1, 0xeb, 0xe3, 0xf6, 0x0d, 0x00, 0x00,
 }
 
 func (m *DeviceV1) Marshal() (dAtA []byte, err error) {
@@ -657,6 +854,18 @@ func (m *DeviceCollectedData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.TpmPlatformAttestation != nil {
+		{
+			size, err := m.TpmPlatformAttestation.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintDevice(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x72
+	}
 	if len(m.BaseBoardSerialNumber) > 0 {
 		i -= len(m.BaseBoardSerialNumber)
 		copy(dAtA[i:], m.BaseBoardSerialNumber)
@@ -735,29 +944,29 @@ func (m *DeviceCollectedData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		dAtA[i] = 0x1a
 	}
 	if m.RecordTime != nil {
-		n8, err8 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.RecordTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.RecordTime):])
-		if err8 != nil {
-			return 0, err8
+		n9, err9 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.RecordTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.RecordTime):])
+		if err9 != nil {
+			return 0, err9
 		}
-		i -= n8
-		i = encodeVarintDevice(dAtA, i, uint64(n8))
+		i -= n9
+		i = encodeVarintDevice(dAtA, i, uint64(n9))
 		i--
 		dAtA[i] = 0x12
 	}
 	if m.CollectTime != nil {
-		n9, err9 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.CollectTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.CollectTime):])
-		if err9 != nil {
-			return 0, err9
+		n10, err10 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.CollectTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.CollectTime):])
+		if err10 != nil {
+			return 0, err10
 		}
-		i -= n9
-		i = encodeVarintDevice(dAtA, i, uint64(n9))
+		i -= n10
+		i = encodeVarintDevice(dAtA, i, uint64(n10))
 		i--
 		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *DeviceSource) Marshal() (dAtA []byte, err error) {
+func (m *TPMPCR) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -767,12 +976,12 @@ func (m *DeviceSource) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DeviceSource) MarshalTo(dAtA []byte) (int, error) {
+func (m *TPMPCR) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DeviceSource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *TPMPCR) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -781,24 +990,27 @@ func (m *DeviceSource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Origin) > 0 {
-		i -= len(m.Origin)
-		copy(dAtA[i:], m.Origin)
-		i = encodeVarintDevice(dAtA, i, uint64(len(m.Origin)))
+	if m.DigestAlg != 0 {
+		i = encodeVarintDevice(dAtA, i, uint64(m.DigestAlg))
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.Digest) > 0 {
+		i -= len(m.Digest)
+		copy(dAtA[i:], m.Digest)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.Digest)))
 		i--
 		dAtA[i] = 0x12
 	}
-	if len(m.Name) > 0 {
-		i -= len(m.Name)
-		copy(dAtA[i:], m.Name)
-		i = encodeVarintDevice(dAtA, i, uint64(len(m.Name)))
+	if m.Index != 0 {
+		i = encodeVarintDevice(dAtA, i, uint64(m.Index))
 		i--
-		dAtA[i] = 0xa
+		dAtA[i] = 0x8
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *DeviceProfile) Marshal() (dAtA []byte, err error) {
+func (m *TPMQuote) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -808,12 +1020,12 @@ func (m *DeviceProfile) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DeviceProfile) MarshalTo(dAtA []byte) (int, error) {
+func (m *TPMQuote) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DeviceProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *TPMQuote) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -822,92 +1034,289 @@ func (m *DeviceProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.JamfBinaryVersion) > 0 {
-		i -= len(m.JamfBinaryVersion)
-		copy(dAtA[i:], m.JamfBinaryVersion)
-		i = encodeVarintDevice(dAtA, i, uint64(len(m.JamfBinaryVersion)))
-		i--
-		dAtA[i] = 0x32
-	}
-	if len(m.OsUsernames) > 0 {
-		for iNdEx := len(m.OsUsernames) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.OsUsernames[iNdEx])
-			copy(dAtA[i:], m.OsUsernames[iNdEx])
-			i = encodeVarintDevice(dAtA, i, uint64(len(m.OsUsernames[iNdEx])))
-			i--
-			dAtA[i] = 0x2a
-		}
-	}
-	if len(m.OsBuild) > 0 {
-		i -= len(m.OsBuild)
-		copy(dAtA[i:], m.OsBuild)
-		i = encodeVarintDevice(dAtA, i, uint64(len(m.OsBuild)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.OsVersion) > 0 {
-		i -= len(m.OsVersion)
-		copy(dAtA[i:], m.OsVersion)
-		i = encodeVarintDevice(dAtA, i, uint64(len(m.OsVersion)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.ModelIdentifier) > 0 {
-		i -= len(m.ModelIdentifier)
-		copy(dAtA[i:], m.ModelIdentifier)
-		i = encodeVarintDevice(dAtA, i, uint64(len(m.ModelIdentifier)))
+	if len(m.Signature) > 0 {
+		i -= len(m.Signature)
+		copy(dAtA[i:], m.Signature)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.Signature)))
 		i--
 		dAtA[i] = 0x12
 	}
-	if m.UpdateTime != nil {
-		n10, err10 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.UpdateTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.UpdateTime):])
-		if err10 != nil {
-			return 0, err10
-		}
-		i -= n10
-		i = encodeVarintDevice(dAtA, i, uint64(n10))
+	if len(m.Quote) > 0 {
+		i -= len(m.Quote)
+		copy(dAtA[i:], m.Quote)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.Quote)))
 		i--
 		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func encodeVarintDevice(dAtA []byte, offset int, v uint64) int {
-	offset -= sovDevice(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
+func (m *TPMPlatformParameters) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	dAtA[offset] = uint8(v)
-	return base
+	return dAtA[:n], nil
 }
-func (m *DeviceV1) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+
+func (m *TPMPlatformParameters) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TPMPlatformParameters) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.ResourceHeader.Size()
-	n += 1 + l + sovDevice(uint64(l))
-	if m.Spec != nil {
-		l = m.Spec.Size()
-		n += 1 + l + sovDevice(uint64(l))
-	}
 	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	return n
+	if len(m.EventLog) > 0 {
+		i -= len(m.EventLog)
+		copy(dAtA[i:], m.EventLog)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.EventLog)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Pcrs) > 0 {
+		for iNdEx := len(m.Pcrs) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Pcrs[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintDevice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Quotes) > 0 {
+		for iNdEx := len(m.Quotes) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Quotes[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintDevice(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
 }
 
-func (m *DeviceSpec) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *TPMPlatformAttestation) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *TPMPlatformAttestation) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TPMPlatformAttestation) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.OsType)
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.PlatformParameters != nil {
+		{
+			size, err := m.PlatformParameters.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintDevice(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Nonce) > 0 {
+		i -= len(m.Nonce)
+		copy(dAtA[i:], m.Nonce)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.Nonce)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *DeviceSource) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DeviceSource) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DeviceSource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Origin) > 0 {
+		i -= len(m.Origin)
+		copy(dAtA[i:], m.Origin)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.Origin)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *DeviceProfile) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DeviceProfile) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DeviceProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.ExternalId) > 0 {
+		i -= len(m.ExternalId)
+		copy(dAtA[i:], m.ExternalId)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.ExternalId)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.JamfBinaryVersion) > 0 {
+		i -= len(m.JamfBinaryVersion)
+		copy(dAtA[i:], m.JamfBinaryVersion)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.JamfBinaryVersion)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.OsUsernames) > 0 {
+		for iNdEx := len(m.OsUsernames) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.OsUsernames[iNdEx])
+			copy(dAtA[i:], m.OsUsernames[iNdEx])
+			i = encodeVarintDevice(dAtA, i, uint64(len(m.OsUsernames[iNdEx])))
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
+	if len(m.OsBuild) > 0 {
+		i -= len(m.OsBuild)
+		copy(dAtA[i:], m.OsBuild)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.OsBuild)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.OsVersion) > 0 {
+		i -= len(m.OsVersion)
+		copy(dAtA[i:], m.OsVersion)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.OsVersion)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.ModelIdentifier) > 0 {
+		i -= len(m.ModelIdentifier)
+		copy(dAtA[i:], m.ModelIdentifier)
+		i = encodeVarintDevice(dAtA, i, uint64(len(m.ModelIdentifier)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.UpdateTime != nil {
+		n12, err12 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.UpdateTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.UpdateTime):])
+		if err12 != nil {
+			return 0, err12
+		}
+		i -= n12
+		i = encodeVarintDevice(dAtA, i, uint64(n12))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintDevice(dAtA []byte, offset int, v uint64) int {
+	offset -= sovDevice(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *DeviceV1) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ResourceHeader.Size()
+	n += 1 + l + sovDevice(uint64(l))
+	if m.Spec != nil {
+		l = m.Spec.Size()
+		n += 1 + l + sovDevice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *DeviceSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.OsType)
 	if l > 0 {
 		n += 1 + l + sovDevice(uint64(l))
 	}
@@ -1041,6 +1450,100 @@ func (m *DeviceCollectedData) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovDevice(uint64(l))
 	}
+	if m.TpmPlatformAttestation != nil {
+		l = m.TpmPlatformAttestation.Size()
+		n += 1 + l + sovDevice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *TPMPCR) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Index != 0 {
+		n += 1 + sovDevice(uint64(m.Index))
+	}
+	l = len(m.Digest)
+	if l > 0 {
+		n += 1 + l + sovDevice(uint64(l))
+	}
+	if m.DigestAlg != 0 {
+		n += 1 + sovDevice(uint64(m.DigestAlg))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *TPMQuote) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Quote)
+	if l > 0 {
+		n += 1 + l + sovDevice(uint64(l))
+	}
+	l = len(m.Signature)
+	if l > 0 {
+		n += 1 + l + sovDevice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *TPMPlatformParameters) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Quotes) > 0 {
+		for _, e := range m.Quotes {
+			l = e.Size()
+			n += 1 + l + sovDevice(uint64(l))
+		}
+	}
+	if len(m.Pcrs) > 0 {
+		for _, e := range m.Pcrs {
+			l = e.Size()
+			n += 1 + l + sovDevice(uint64(l))
+		}
+	}
+	l = len(m.EventLog)
+	if l > 0 {
+		n += 1 + l + sovDevice(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *TPMPlatformAttestation) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Nonce)
+	if l > 0 {
+		n += 1 + l + sovDevice(uint64(l))
+	}
+	if m.PlatformParameters != nil {
+		l = m.PlatformParameters.Size()
+		n += 1 + l + sovDevice(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -1099,6 +1602,10 @@ func (m *DeviceProfile) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovDevice(uint64(l))
 	}
+	l = len(m.ExternalId)
+	if l > 0 {
+		n += 1 + l + sovDevice(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -2006,9 +2513,475 @@ func (m *DeviceCollectedData) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OsVersion", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field OsVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthDevice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.OsVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OsBuild", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthDevice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.OsBuild = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OsUsername", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthDevice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.OsUsername = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field JamfBinaryVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthDevice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.JamfBinaryVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MacosEnrollmentProfiles", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthDevice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.MacosEnrollmentProfiles = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReportedAssetTag", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthDevice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ReportedAssetTag = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SystemSerialNumber", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthDevice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SystemSerialNumber = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BaseBoardSerialNumber", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthDevice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.BaseBoardSerialNumber = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 14:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TpmPlatformAttestation", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthDevice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.TpmPlatformAttestation == nil {
+				m.TpmPlatformAttestation = &TPMPlatformAttestation{}
+			}
+			if err := m.TpmPlatformAttestation.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipDevice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TPMPCR) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowDevice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TPMPCR: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TPMPCR: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Index", wireType)
+			}
+			m.Index = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Index |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Digest", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthDevice
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Digest = append(m.Digest[:0], dAtA[iNdEx:postIndex]...)
+			if m.Digest == nil {
+				m.Digest = []byte{}
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DigestAlg", wireType)
+			}
+			m.DigestAlg = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DigestAlg |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipDevice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TPMQuote) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowDevice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TPMQuote: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TPMQuote: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Quote", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowDevice
@@ -2018,29 +2991,31 @@ func (m *DeviceCollectedData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthDevice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthDevice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.OsVersion = string(dAtA[iNdEx:postIndex])
+			m.Quote = append(m.Quote[:0], dAtA[iNdEx:postIndex]...)
+			if m.Quote == nil {
+				m.Quote = []byte{}
+			}
 			iNdEx = postIndex
-		case 7:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OsBuild", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Signature", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowDevice
@@ -2050,61 +3025,82 @@ func (m *DeviceCollectedData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthDevice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthDevice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.OsBuild = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 8:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OsUsername", wireType)
+			m.Signature = append(m.Signature[:0], dAtA[iNdEx:postIndex]...)
+			if m.Signature == nil {
+				m.Signature = []byte{}
 			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowDevice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipDevice(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthDevice
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthDevice
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TPMPlatformParameters) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowDevice
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.OsUsername = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 9:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TPMPlatformParameters: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TPMPlatformParameters: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field JamfBinaryVersion", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Quotes", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowDevice
@@ -2114,29 +3110,31 @@ func (m *DeviceCollectedData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthDevice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthDevice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.JamfBinaryVersion = string(dAtA[iNdEx:postIndex])
+			m.Quotes = append(m.Quotes, &TPMQuote{})
+			if err := m.Quotes[len(m.Quotes)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 10:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MacosEnrollmentProfiles", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Pcrs", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowDevice
@@ -2146,29 +3144,31 @@ func (m *DeviceCollectedData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthDevice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthDevice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.MacosEnrollmentProfiles = string(dAtA[iNdEx:postIndex])
+			m.Pcrs = append(m.Pcrs, &TPMPCR{})
+			if err := m.Pcrs[len(m.Pcrs)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 11:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ReportedAssetTag", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field EventLog", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowDevice
@@ -2178,29 +3178,82 @@ func (m *DeviceCollectedData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthDevice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthDevice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ReportedAssetTag = string(dAtA[iNdEx:postIndex])
+			m.EventLog = append(m.EventLog[:0], dAtA[iNdEx:postIndex]...)
+			if m.EventLog == nil {
+				m.EventLog = []byte{}
+			}
 			iNdEx = postIndex
-		case 12:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipDevice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TPMPlatformAttestation) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowDevice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TPMPlatformAttestation: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TPMPlatformAttestation: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SystemSerialNumber", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Nonce", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowDevice
@@ -2210,29 +3263,31 @@ func (m *DeviceCollectedData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthDevice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthDevice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SystemSerialNumber = string(dAtA[iNdEx:postIndex])
+			m.Nonce = append(m.Nonce[:0], dAtA[iNdEx:postIndex]...)
+			if m.Nonce == nil {
+				m.Nonce = []byte{}
+			}
 			iNdEx = postIndex
-		case 13:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BaseBoardSerialNumber", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PlatformParameters", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowDevice
@@ -2242,23 +3297,27 @@ func (m *DeviceCollectedData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthDevice
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthDevice
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.BaseBoardSerialNumber = string(dAtA[iNdEx:postIndex])
+			if m.PlatformParameters == nil {
+				m.PlatformParameters = &TPMPlatformParameters{}
+			}
+			if err := m.PlatformParameters.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -2622,6 +3681,38 @@ func (m *DeviceProfile) Unmarshal(dAtA []byte) error {
 			}
 			m.JamfBinaryVersion = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExternalId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDevice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthDevice
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthDevice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExternalId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipDevice(dAtA[iNdEx:])
diff --git a/api/types/device_test.go b/api/types/device_test.go
index 1eba2fa46536e..48479664fd1d0 100644
--- a/api/types/device_test.go
+++ b/api/types/device_test.go
@@ -15,6 +15,7 @@
 package types
 
 import (
+	"crypto"
 	"testing"
 	"time"
 
@@ -24,80 +25,9 @@ import (
 	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
-	"github.com/gravitational/teleport/api/defaults"
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
 )
 
-// TestUnmarshalDevice tests that devices can be successfully
-// unmarshalled from YAML and JSON.
-func TestUnmarshalDevice(t *testing.T) {
-	for _, tc := range []struct {
-		desc          string
-		input         string
-		errorContains string
-		expected      *DeviceV1
-	}{
-		{
-			desc: "success",
-			input: `
-{
-  "kind": "device",
-	"version": "v1",
-	"metadata": {
-		"name": "xaa"
-	},
-	"spec": {
-		"asset_tag": "mymachine",
-		"os_type": "macos",
-		"enroll_status": "enrolled"
-	}
-}`,
-			expected: &DeviceV1{
-				ResourceHeader: ResourceHeader{
-					Kind:    KindDevice,
-					Version: "v1",
-					Metadata: Metadata{
-						Namespace: defaults.Namespace,
-						Name:      "xaa",
-					},
-				},
-				Spec: &DeviceSpec{
-					OsType:       "macos",
-					AssetTag:     "mymachine",
-					EnrollStatus: "enrolled",
-				},
-			},
-		},
-		{
-			desc:          "fail string as num",
-			errorContains: `cannot unmarshal number`,
-			input: `
-{
-  "kind": "device",
-	"version": "v1",
-	"metadata": {
-		"name": "secretid"
-	},
-	"spec": {
-		"asset_tag": 4,
-		"os_type": "macos",
-		"enroll_status": "enrolled"
-	}
-}`,
-		},
-	} {
-		t.Run(tc.desc, func(t *testing.T) {
-			out, err := UnmarshalDevice([]byte(tc.input))
-			if tc.errorContains != "" {
-				require.ErrorContains(t, err, tc.errorContains, "error from UnmarshalDevice does not contain the expected string")
-				return
-			}
-			require.NoError(t, err, "UnmarshalDevice returned unexpected error")
-			require.Equal(t, tc.expected, out, "unmarshalled device  does not match what was expected")
-		})
-	}
-}
-
 func TestDeviceConversions_toAndFrom(t *testing.T) {
 	t1 := time.UnixMilli(1680276526972000) // Fri Mar 31 2023 15:28:46 UTC
 	t11 := t1.Add(100 * time.Millisecond)
@@ -142,6 +72,34 @@ func TestDeviceConversions_toAndFrom(t *testing.T) {
 				ReportedAssetTag:        assetTag + "-reported",
 				SystemSerialNumber:      assetTag + "-system",
 				BaseBoardSerialNumber:   assetTag + "-board",
+				TpmPlatformAttestation: &devicepb.TPMPlatformAttestation{
+					Nonce: []byte("foo-bar-bizz"),
+					PlatformParameters: &devicepb.TPMPlatformParameters{
+						EventLog: []byte("dummy-event-log"),
+						Quotes: []*devicepb.TPMQuote{
+							{
+								Quote:     []byte("fake-quote-1"),
+								Signature: []byte("fake-signature-1"),
+							},
+							{
+								Quote:     []byte("fake-quote-2"),
+								Signature: []byte("fake-signature-2"),
+							},
+						},
+						Pcrs: []*devicepb.TPMPCR{
+							{
+								Index:     0,
+								Digest:    []byte("fake-sha1-digest"),
+								DigestAlg: uint64(crypto.SHA1),
+							},
+							{
+								Index:     1,
+								Digest:    []byte("fake-sha256-digest"),
+								DigestAlg: uint64(crypto.SHA256),
+							},
+						},
+					},
+				},
 			},
 		},
 		Source: &devicepb.DeviceSource{
@@ -155,6 +113,7 @@ func TestDeviceConversions_toAndFrom(t *testing.T) {
 			OsBuild:           "22D68",
 			OsUsernames:       []string{"admin", "llama"},
 			JamfBinaryVersion: "9.27",
+			ExternalId:        "99",
 		},
 	}
 
@@ -177,10 +136,12 @@ func TestResourceAttestationType_toAndFrom(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		attestationType string
-		errorContains   string
+		wantEmpty       bool
+		wantErr         string
 	}{
 		{
 			attestationType: "unspecified",
+			wantEmpty:       true,
 		},
 		{
 			attestationType: "tpm_ekpub",
@@ -193,18 +154,23 @@ func TestResourceAttestationType_toAndFrom(t *testing.T) {
 		},
 		{
 			attestationType: "quantum_entanglement",
-			errorContains:   "unknown attestation type",
+			wantErr:         "unknown attestation type",
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.attestationType, func(t *testing.T) {
 			asEnum, err := ResourceDeviceAttestationTypeFromString(tt.attestationType)
-			if tt.errorContains != "" {
-				require.ErrorContains(t, err, tt.errorContains)
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr, "ResourceDeviceAttestationTypeFromString error mismatch")
 				return
 			}
+
 			got := ResourceDeviceAttestationTypeToString(asEnum)
-			require.Equal(t, tt.attestationType, got)
+			want := tt.attestationType
+			if tt.wantEmpty {
+				want = ""
+			}
+			require.Equal(t, want, got, "ResourceDeviceAttestationTypeToString mismatch")
 		})
 	}
 }
diff --git a/api/types/fuzz_test.go b/api/types/fuzz_test.go
index 2747376bf45cb..c6a81b668cc54 100644
--- a/api/types/fuzz_test.go
+++ b/api/types/fuzz_test.go
@@ -23,6 +23,11 @@ import (
 )
 
 func FuzzParseDuration(f *testing.F) {
+	f.Add("")
+	f.Add("300ms")
+	f.Add("-1.5h")
+	f.Add("2h45m")
+
 	f.Fuzz(func(t *testing.T, s string) {
 		require.NotPanics(t, func() {
 			parseDuration(s)
diff --git a/api/types/headlessauthn.go b/api/types/headlessauthn.go
index c37a8cd50d28c..c710c4ebfc849 100644
--- a/api/types/headlessauthn.go
+++ b/api/types/headlessauthn.go
@@ -22,9 +22,8 @@ import (
 	"github.com/gravitational/trace"
 )
 
-// NewHeadlessAuthenticationStub creates a new a headless authentication resource with limited data.
-// The stub is used to initiate headless login.
-func NewHeadlessAuthenticationStub(name string, expires time.Time) (*HeadlessAuthentication, error) {
+// NewHeadlessAuthentication creates a new a headless authentication resource.
+func NewHeadlessAuthentication(username, name string, expires time.Time) (*HeadlessAuthentication, error) {
 	ha := &HeadlessAuthentication{
 		ResourceHeader: ResourceHeader{
 			Metadata: Metadata{
@@ -32,6 +31,7 @@ func NewHeadlessAuthenticationStub(name string, expires time.Time) (*HeadlessAut
 				Expires: &expires,
 			},
 		},
+		User: username,
 	}
 	return ha, ha.CheckAndSetDefaults()
 }
@@ -47,12 +47,13 @@ func (h *HeadlessAuthentication) CheckAndSetDefaults() error {
 		return trace.BadParameter("headless authentication resource must have non-zero header.metadata.expires")
 	}
 
+	if h.User == "" {
+		return trace.BadParameter("headless authentication resource must have non-empty user")
+	}
+
 	if h.Version == "" {
 		h.Version = V1
 	}
-	if h.State == HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_UNSPECIFIED {
-		h.State = HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING
-	}
 
 	return nil
 }
@@ -75,3 +76,97 @@ func (h HeadlessAuthenticationState) Stringify() string {
 		return "unknown"
 	}
 }
+
+// IsUnspecified headless authentication state. This usually means the headless
+// authentication resource is a headless authentication stub, with limited data.
+func (s HeadlessAuthenticationState) IsUnspecified() bool {
+	return s == HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_UNSPECIFIED
+}
+
+// IsPending headless authentication state.
+func (s HeadlessAuthenticationState) IsPending() bool {
+	return s == HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING
+}
+
+// headlessStateVariants allows iteration of the expected variants
+// of HeadlessAuthenticationState.
+var headlessStateVariants = [4]HeadlessAuthenticationState{
+	HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_UNSPECIFIED,
+	HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING,
+	HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_DENIED,
+	HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED,
+}
+
+// Parse attempts to interpret a value as a string representation
+// of a HeadlessAuthenticationState.
+func (s *HeadlessAuthenticationState) Parse(val string) error {
+	for _, state := range headlessStateVariants {
+		if state.String() == val {
+			*s = state
+			return nil
+		}
+	}
+	return trace.BadParameter("unknown request state: %q", val)
+}
+
+// HeadlessAuthenticationFilter encodes filter params for headless authentications.
+type HeadlessAuthenticationFilter struct {
+	Name     string
+	Username string
+	State    HeadlessAuthenticationState
+}
+
+// key values for map encoding of headless authn filter.
+const (
+	headlessFilterKeyName     = "name"
+	headlessFilterKeyUsername = "username"
+	headlessFilterKeyState    = "state"
+)
+
+// IntoMap copies HeadlessAuthenticationFilter values into a map.
+func (f *HeadlessAuthenticationFilter) IntoMap() map[string]string {
+	m := make(map[string]string)
+	if f.Name != "" {
+		m[headlessFilterKeyName] = f.Name
+	}
+	if f.Username != "" {
+		m[headlessFilterKeyUsername] = f.Username
+	}
+	if !f.State.IsUnspecified() {
+		m[headlessFilterKeyState] = f.State.String()
+	}
+	return m
+}
+
+// FromMap copies values from a map into this HeadlessAuthenticationFilter value.
+func (f *HeadlessAuthenticationFilter) FromMap(m map[string]string) error {
+	for key, val := range m {
+		switch key {
+		case headlessFilterKeyName:
+			f.Name = val
+		case headlessFilterKeyUsername:
+			f.Username = val
+		case headlessFilterKeyState:
+			if err := f.State.Parse(val); err != nil {
+				return trace.Wrap(err)
+			}
+		default:
+			return trace.BadParameter("unknown filter key %s", key)
+		}
+	}
+	return nil
+}
+
+// Match checks if a given headless authentication matches this filter.
+func (f *HeadlessAuthenticationFilter) Match(req HeadlessAuthentication) bool {
+	if f.Name != "" && req.GetName() != f.Name {
+		return false
+	}
+	if f.Username != "" && req.User != f.Username {
+		return false
+	}
+	if !f.State.IsUnspecified() && req.State != f.State {
+		return false
+	}
+	return true
+}
diff --git a/api/types/installers/installer.sh.tmpl b/api/types/installers/installer.sh.tmpl
index d44a53d81767f..dc75bc407b325 100644
--- a/api/types/installers/installer.sh.tmpl
+++ b/api/types/installers/installer.sh.tmpl
@@ -28,15 +28,10 @@ on_azure() {
     PACKAGE_LIST="${PACKAGE_LIST} {{ .TeleportPackage }}-updater"
   fi
 
-  # old versions of ubuntu require that keys get added by `apt-key add`, without
-  # adding the key apt shows a key signing error when installing teleport.
-  LEGACY_UBUNTU=false
-  if [ "$VERSION_CODENAME" = "xenial" ] || [ "$VERSION_CODENAME" = "trusty" ]; then
-    LEGACY_UBUNTU=true
-  fi
-
   if [ "$ID" = "debian" ] || [ "$ID" = "ubuntu" ]; then
-    if [ "$LEGACY_UBUNTU" = true ]; then
+    # old versions of ubuntu require that keys get added by `apt-key add`, without
+    # adding the key apt shows a key signing error when installing teleport.
+    if [ "$VERSION_CODENAME" = "xenial" ] || [ "$VERSION_CODENAME" = "trusty" ]; then
       curl -o /tmp/teleport-pubkey.asc https://apt.releases.teleport.dev/gpg
       sudo apt-key add /tmp/teleport-pubkey.asc
       echo "deb https://apt.releases.teleport.dev/ubuntu ${VERSION_CODENAME?} {{ .RepoChannel }}" | sudo tee /etc/apt/sources.list.d/teleport.list
diff --git a/api/types/jamf.go b/api/types/jamf.go
index e731d29ea7991..fb3214dfae324 100644
--- a/api/types/jamf.go
+++ b/api/types/jamf.go
@@ -17,7 +17,6 @@ package types
 import (
 	"net/url"
 	"strings"
-	"time"
 
 	"github.com/gravitational/trace"
 	"golang.org/x/exp/slices"
@@ -39,15 +38,6 @@ var JamfOnMissingActions = []string{
 	JamfOnMissingDelete,
 }
 
-const (
-	// JamfSyncPeriodPartialDefault is the default value for sync_period_partial
-	// in inventory entries.
-	JamfSyncPeriodPartialDefault = 6 * time.Hour
-	// JamfSyncPeriodFullDefault is the default value for sync_period_full in
-	// inventory entries.
-	JamfSyncPeriodFullDefault = 24 * time.Hour
-)
-
 // ValidateJamfSpecV1 validates a [JamfSpecV1] instance.
 func ValidateJamfSpecV1(s *JamfSpecV1) error {
 	switch {
@@ -77,15 +67,9 @@ func ValidateJamfSpecV1(s *JamfSpecV1) error {
 		}
 
 		syncPartial := e.SyncPeriodPartial
-		if syncPartial == 0 {
-			syncPartial = Duration(JamfSyncPeriodPartialDefault)
-		}
 		syncFull := e.SyncPeriodFull
-		if syncFull == 0 {
-			syncFull = Duration(JamfSyncPeriodFullDefault)
-		}
-		if syncPartial > syncFull {
-			return trace.BadParameter("inventory[%v]: sync_period_partial is greater than sync_period_full, partial syncs will never happen", i)
+		if syncFull > 0 && syncPartial >= syncFull {
+			return trace.BadParameter("inventory[%v]: sync_period_partial is greater or equal to sync_period_full, partial syncs will never happen", i)
 		}
 	}
 
diff --git a/api/types/jamf_test.go b/api/types/jamf_test.go
index 017a9899a14ff..962f2c06cb693 100644
--- a/api/types/jamf_test.go
+++ b/api/types/jamf_test.go
@@ -148,7 +148,7 @@ func TestValidateJamfSpecV1(t *testing.T) {
 					},
 				}
 			}),
-			wantErr: "greater than sync_period_full",
+			wantErr: "greater or equal to sync_period_full",
 		},
 		{
 			name: "inventory on_missing invalid",
@@ -162,6 +162,42 @@ func TestValidateJamfSpecV1(t *testing.T) {
 			}),
 			wantErr: "on_missing",
 		},
+		{
+			name: "inventory sync_partial disabled",
+			spec: modify(func(spec *types.JamfSpecV1) {
+				spec.Inventory = []*types.JamfInventoryEntry{
+					validEntry,
+					{
+						SyncPeriodPartial: -1,
+						SyncPeriodFull:    types.Duration(8 * time.Hour),
+					},
+				}
+			}),
+		},
+		{
+			name: "inventory sync_full disabled",
+			spec: modify(func(spec *types.JamfSpecV1) {
+				spec.Inventory = []*types.JamfInventoryEntry{
+					validEntry,
+					{
+						SyncPeriodPartial: types.Duration(12 * time.Hour),
+						SyncPeriodFull:    -1,
+					},
+				}
+			}),
+		},
+		{
+			name: "inventory all syncs disabled",
+			spec: modify(func(spec *types.JamfSpecV1) {
+				spec.Inventory = []*types.JamfInventoryEntry{
+					validEntry,
+					{
+						SyncPeriodPartial: 0,
+						SyncPeriodFull:    0,
+					},
+				}
+			}),
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
diff --git a/api/types/plugin.go b/api/types/plugin.go
index 8756699f3fb1b..223d6778e6939 100644
--- a/api/types/plugin.go
+++ b/api/types/plugin.go
@@ -40,6 +40,8 @@ const (
 	PluginTypeJamf = "jamf"
 	// PluginTypeOpsgenie is the Opsgenie access request plugin
 	PluginTypeOpsgenie = "opsgenie"
+	// PluginTypePagerDuty is the PagerDuty access plugin
+	PluginTypePagerDuty = "pagerduty"
 )
 
 // PluginSubkind represents the type of the plugin, e.g., access request, MDM etc.
@@ -133,28 +135,36 @@ func (p *PluginV1) CheckAndSetDefaults() error {
 		}
 	case *PluginSpecV1_Opsgenie:
 		if settings.Opsgenie == nil {
-			return trace.BadParameter("settings must be set")
+			return trace.BadParameter("missing opsgenie settings")
 		}
 		if err := settings.Opsgenie.CheckAndSetDefaults(); err != nil {
 			return trace.Wrap(err)
 		}
 
-		bearer := p.Credentials.GetBearerToken()
-		if bearer == nil {
-			return trace.BadParameter("opsgenie plugin must be used with the bearer token credential type")
+		staticCreds := p.Credentials.GetStaticCredentialsRef()
+		if staticCreds == nil {
+			return trace.BadParameter("opsgenie plugin must be used with the static credentials ref type")
 		}
-		if bearer.Token == "" {
-			return trace.BadParameter("Token must be specified")
+		if len(staticCreds.Labels) == 0 {
+			return trace.BadParameter("labels must be specified")
 		}
 	case *PluginSpecV1_Jamf:
-		if settings.Jamf.JamfSpec.ApiEndpoint == "" {
-			return trace.BadParameter("api endpoint must be set")
+		// Check Jamf settings.
+		if settings.Jamf == nil {
+			return trace.BadParameter("missing Jamf settings")
+		}
+		if err := settings.Jamf.CheckAndSetDefaults(); err != nil {
+			return trace.Wrap(err)
 		}
 		if p.Credentials == nil {
 			return trace.BadParameter("credentials must be set")
 		}
-		if p.Credentials.GetIdSecret().Id == "" || p.Credentials.GetIdSecret().Secret == "" {
-			return trace.BadParameter("Jamf plugin requires Jamf account username and password")
+		staticCreds := p.Credentials.GetStaticCredentialsRef()
+		if staticCreds == nil {
+			return trace.BadParameter("jamf plugin must be used with the static credentials ref type")
+		}
+		if len(staticCreds.Labels) == 0 {
+			return trace.BadParameter("labels must be specified")
 		}
 	case *PluginSpecV1_Okta:
 		// Check settings.
@@ -175,6 +185,13 @@ func (p *PluginV1) CheckAndSetDefaults() error {
 		if len(staticCreds.Labels) == 0 {
 			return trace.BadParameter("labels must be specified")
 		}
+	case *PluginSpecV1_PagerDuty:
+		if settings.PagerDuty == nil {
+			return trace.BadParameter("missing PagerDuty settings")
+		}
+		if err := settings.PagerDuty.CheckAndSetDefaults(); err != nil {
+			return trace.Wrap(err)
+		}
 	default:
 		return trace.BadParameter("settings are not set or have an unknown type")
 	}
@@ -311,6 +328,10 @@ func (p *PluginV1) GetType() PluginType {
 		return PluginTypeOkta
 	case *PluginSpecV1_Jamf:
 		return PluginTypeJamf
+	case *PluginSpecV1_Opsgenie:
+		return PluginTypeOpsgenie
+	case *PluginSpecV1_PagerDuty:
+		return PluginTypePagerDuty
 	default:
 		return PluginTypeUnknown
 	}
@@ -342,6 +363,15 @@ func (s *PluginOpsgenieAccessSettings) CheckAndSetDefaults() error {
 	return nil
 }
 
+// CheckAndSetDefaults validates and set the default values.
+func (s *PluginJamfSettings) CheckAndSetDefaults() error {
+	if s.JamfSpec.ApiEndpoint == "" {
+		return trace.BadParameter("api endpoint must be set")
+	}
+
+	return nil
+}
+
 // CheckAndSetDefaults validates and set the default values
 func (c *PluginOAuth2AuthorizationCodeCredentials) CheckAndSetDefaults() error {
 	if c.AuthorizationCode == "" {
@@ -354,6 +384,18 @@ func (c *PluginOAuth2AuthorizationCodeCredentials) CheckAndSetDefaults() error {
 	return nil
 }
 
+// CheckAndSetDefaults validates and set the default PagerDuty values
+func (c *PluginPagerDutySettings) CheckAndSetDefaults() error {
+	if c.ApiEndpoint == "" {
+		return trace.BadParameter("api_endpoint must be set")
+	}
+
+	if c.UserEmail == "" {
+		return trace.BadParameter("user_email must be set")
+	}
+	return nil
+}
+
 // CheckAndSetDefaults validates and set the default values
 func (c *PluginOAuth2AccessTokenCredentials) CheckAndSetDefaults() error {
 	if c.AccessToken == "" {
diff --git a/api/types/plugin_test.go b/api/types/plugin_test.go
index 5c6cd80f90182..d46f755bc32f6 100644
--- a/api/types/plugin_test.go
+++ b/api/types/plugin_test.go
@@ -109,6 +109,98 @@ func TestPluginOpenAIValidation(t *testing.T) {
 	}
 }
 
+func TestPluginOpsgenieValidation(t *testing.T) {
+	testCases := []struct {
+		name      string
+		settings  *PluginSpecV1_Opsgenie
+		creds     *PluginCredentialsV1
+		assertErr require.ErrorAssertionFunc
+	}{
+		{
+			name: "no settings",
+			settings: &PluginSpecV1_Opsgenie{
+				Opsgenie: nil,
+			},
+			creds: nil,
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "missing opsgenie settings")
+			},
+		},
+		{
+			name: "no api endpint",
+			settings: &PluginSpecV1_Opsgenie{
+				Opsgenie: &PluginOpsgenieAccessSettings{},
+			},
+			creds: nil,
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "api endpoint url must be set")
+			},
+		},
+		{
+			name: "no static credentials",
+			settings: &PluginSpecV1_Opsgenie{
+				Opsgenie: &PluginOpsgenieAccessSettings{
+					ApiEndpoint: "https://test.opsgenie.com",
+				},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "must be used with the static credentials ref type")
+			},
+		},
+		{
+			name: "static credentials labels not defined",
+			settings: &PluginSpecV1_Opsgenie{
+				Opsgenie: &PluginOpsgenieAccessSettings{
+					ApiEndpoint: "https://test.opsgenie.com",
+				},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_StaticCredentialsRef{
+					&PluginStaticCredentialsRef{
+						Labels: map[string]string{},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "labels must be specified")
+			},
+		},
+		{
+			name: "valid credentials (static credentials)",
+			settings: &PluginSpecV1_Opsgenie{
+				Opsgenie: &PluginOpsgenieAccessSettings{
+					ApiEndpoint: "https://test.opsgenie.com",
+				},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_StaticCredentialsRef{
+					&PluginStaticCredentialsRef{
+						Labels: map[string]string{
+							"label1": "value1",
+						},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.NoError(t, err)
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			plugin := NewPluginV1(Metadata{Name: "foobar"}, PluginSpecV1{
+				Settings: tc.settings,
+			}, tc.creds)
+			tc.assertErr(t, plugin.CheckAndSetDefaults())
+		})
+	}
+}
+
 func TestPluginOktaValidation(t *testing.T) {
 	testCases := []struct {
 		name      string
@@ -216,3 +308,121 @@ func TestPluginOktaValidation(t *testing.T) {
 		})
 	}
 }
+
+func TestPluginJamfValidation(t *testing.T) {
+	testCases := []struct {
+		name      string
+		settings  *PluginSpecV1_Jamf
+		creds     *PluginCredentialsV1
+		assertErr require.ErrorAssertionFunc
+	}{
+		{
+			name: "no settings",
+			settings: &PluginSpecV1_Jamf{
+				Jamf: nil,
+			},
+			creds: nil,
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "missing Jamf settings")
+			},
+		},
+		{
+			name: "no api Endpoint",
+			settings: &PluginSpecV1_Jamf{
+				Jamf: &PluginJamfSettings{
+					JamfSpec: &JamfSpecV1{},
+				},
+			},
+			creds: nil,
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "api endpoint must be set")
+			},
+		},
+		{
+			name: "no credentials inner",
+			settings: &PluginSpecV1_Jamf{
+				Jamf: &PluginJamfSettings{
+					JamfSpec: &JamfSpecV1{
+						ApiEndpoint: "https://api.testjamfserver.com",
+					},
+				},
+			},
+			creds: &PluginCredentialsV1{},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "must be used with the static credentials ref type")
+			},
+		},
+		{
+			name: "invalid credential type (oauth2)",
+			settings: &PluginSpecV1_Jamf{
+				Jamf: &PluginJamfSettings{
+					JamfSpec: &JamfSpecV1{
+						ApiEndpoint: "https://api.testjamfserver.com",
+					},
+				},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_Oauth2AccessToken{},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "must be used with the static credentials ref type")
+			},
+		},
+		{
+			name: "invalid credentials (static credentials)",
+			settings: &PluginSpecV1_Jamf{
+				Jamf: &PluginJamfSettings{
+					JamfSpec: &JamfSpecV1{
+						ApiEndpoint: "https://api.testjamfserver.com",
+					},
+				},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_StaticCredentialsRef{
+					&PluginStaticCredentialsRef{
+						Labels: map[string]string{},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.True(t, trace.IsBadParameter(err))
+				require.Contains(t, err.Error(), "labels must be specified")
+			},
+		},
+		{
+			name: "valid credentials (static credentials)",
+			settings: &PluginSpecV1_Jamf{
+				Jamf: &PluginJamfSettings{
+					JamfSpec: &JamfSpecV1{
+						ApiEndpoint: "https://api.testjamfserver.com",
+					},
+				},
+			},
+			creds: &PluginCredentialsV1{
+				Credentials: &PluginCredentialsV1_StaticCredentialsRef{
+					&PluginStaticCredentialsRef{
+						Labels: map[string]string{
+							"label1": "value1",
+						},
+					},
+				},
+			},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.NoError(t, err)
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			plugin := NewPluginV1(Metadata{Name: "foobar"}, PluginSpecV1{
+				Settings: tc.settings,
+			}, tc.creds)
+			tc.assertErr(t, plugin.CheckAndSetDefaults())
+		})
+	}
+}
diff --git a/api/types/remotecluster.go b/api/types/remotecluster.go
index 8e3647c53db48..d96834441e107 100644
--- a/api/types/remotecluster.go
+++ b/api/types/remotecluster.go
@@ -45,6 +45,13 @@ type RemoteCluster interface {
 
 	// Clone performs a deep copy.
 	Clone() RemoteCluster
+
+	// GetLabel retrieves the label with the provided key. If not found value
+	// will be empty and ok will be false.
+	GetLabel(key string) (value string, ok bool)
+
+	// GetAllLabels returns all labels for the remote cluster
+	GetAllLabels() map[string]string
 }
 
 // NewRemoteCluster is a convenience way to create a RemoteCluster resource.
@@ -164,3 +171,16 @@ func (c *RemoteClusterV3) SetName(e string) {
 func (c *RemoteClusterV3) String() string {
 	return fmt.Sprintf("RemoteCluster(%v, %v)", c.Metadata.Name, c.Status.Connection)
 }
+
+// GetLabel retrieves the label with the provided key. If not found value
+// will be empty and ok will be false.
+func (c *RemoteClusterV3) GetLabel(key string) (value string, ok bool) {
+	value, ok = c.Metadata.Labels[key]
+	return value, ok
+}
+
+// GetAllLabels returns all labels for the remote cluster. Remote clusters only
+// have static labels.
+func (c *RemoteClusterV3) GetAllLabels() map[string]string {
+	return c.Metadata.Labels
+}
diff --git a/api/types/resource.go b/api/types/resource.go
index 34bf5d2e422f8..c2eb51e0622b7 100644
--- a/api/types/resource.go
+++ b/api/types/resource.go
@@ -57,9 +57,21 @@ type Resource interface {
 	CheckAndSetDefaults() error
 }
 
+// IsSystemResource checks to see if the given resource is considered
+// part of the teleport system, as opposed to some user created resource
+// or preset.
+func IsSystemResource(r Resource) bool {
+	metadata := r.GetMetadata()
+	if t, ok := metadata.Labels[TeleportInternalResourceType]; ok {
+		return t == SystemResource
+	}
+	return false
+}
+
 // ResourceDetails includes details about the resource
 type ResourceDetails struct {
-	Hostname string
+	Hostname     string
+	FriendlyName string
 }
 
 // ResourceWithSecrets includes additional properties which must
diff --git a/api/types/resource_ids.go b/api/types/resource_ids.go
index 3f10b99647699..1a2df74b6a931 100644
--- a/api/types/resource_ids.go
+++ b/api/types/resource_ids.go
@@ -52,13 +52,17 @@ func (id *ResourceID) validateK8sSubResource() error {
 	if id.SubResourceName == "" {
 		return trace.BadParameter("resource of kind %q must include a subresource name", id.Kind)
 	}
-
+	isResourceNamespaceScoped := slices.Contains(KubernetesClusterWideResourceKinds, id.Kind)
 	switch split := strings.Split(id.SubResourceName, "/"); {
-	case len(split) != 2:
+	case isResourceNamespaceScoped && len(split) != 1:
+		return trace.BadParameter("subresource %q must follow the following format: <name>", id.SubResourceName)
+	case isResourceNamespaceScoped && split[0] == "":
+		return trace.BadParameter("subresource %q must include a non-empty name: <name>", id.SubResourceName)
+	case !isResourceNamespaceScoped && len(split) != 2:
 		return trace.BadParameter("subresource %q must follow the following format: <namespace>/<name>", id.SubResourceName)
-	case split[0] == "":
+	case !isResourceNamespaceScoped && split[0] == "":
 		return trace.BadParameter("subresource %q must include a non-empty namespace: <namespace>/<name>", id.SubResourceName)
-	case split[1] == "":
+	case !isResourceNamespaceScoped && split[1] == "":
 		return trace.BadParameter("subresource %q must include a non-empty name: <namespace>/<name>", id.SubResourceName)
 	}
 
@@ -93,6 +97,7 @@ func ResourceIDFromString(raw string) (ResourceID, error) {
 	}
 	switch {
 	case slices.Contains(KubernetesResourcesKinds, resourceID.Kind):
+		isResourceNamespaceScoped := slices.Contains(KubernetesClusterWideResourceKinds, resourceID.Kind)
 		// Kubernetes forbids slashes "/" in Namespaces and Pod names, so it's safe to
 		// explode the resourceID.Name and extract the last two entries as namespace
 		// and name.
@@ -102,9 +107,12 @@ func ResourceIDFromString(raw string) (ResourceID, error) {
 		// will fail because, for kind=pod, it's mandatory to present a non-empty
 		// namespace and name.
 		splits := strings.Split(resourceID.Name, "/")
-		if len(splits) >= 3 {
+		if !isResourceNamespaceScoped && len(splits) >= 3 {
 			resourceID.Name = strings.Join(splits[:len(splits)-2], "/")
 			resourceID.SubResourceName = strings.Join(splits[len(splits)-2:], "/")
+		} else if isResourceNamespaceScoped && len(splits) >= 2 {
+			resourceID.Name = strings.Join(splits[:len(splits)-1], "/")
+			resourceID.SubResourceName = strings.Join(splits[len(splits)-1:], "/")
 		}
 	}
 
diff --git a/api/types/resource_ids_test.go b/api/types/resource_ids_test.go
index f8d5d0ac3447b..07400e35846ad 100644
--- a/api/types/resource_ids_test.go
+++ b/api/types/resource_ids_test.go
@@ -144,6 +144,281 @@ func TestResourceIDs(t *testing.T) {
 			expected:         `["/one/pod/cluster"]`,
 			expectParseError: true,
 		},
+		{
+			desc: "pod resource name in cluster with slash",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubePod,
+				Name:            "cluster",
+				SubResourceName: "namespace/pod*",
+			}},
+			expected: `["/one/pod/cluster/namespace/pod*"]`,
+		},
+		{
+			desc: "secret resource name with missing namespace",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeSecret,
+				Name:            "cluster",
+				SubResourceName: "/secret*",
+			}},
+			expected:         `["/one/secret/cluster//secret*"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "secret resource name with missing namespace and pod name",
+			in: []ResourceID{{
+				ClusterName: "one",
+				Kind:        KindKubeSecret,
+				Name:        "cluster",
+			}},
+			expected:         `["/one/secret/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "secret resource name in cluster with slash",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeSecret,
+				Name:            "cluster",
+				SubResourceName: "namespace/secret*",
+			}},
+			expected: `["/one/secret/cluster/namespace/secret*"]`,
+		},
+		{
+			desc: "configmap resource name with missing namespace",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeConfigmap,
+				Name:            "cluster",
+				SubResourceName: "/configmap*",
+			}},
+			expected:         `["/one/configmap/cluster//configmap*"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "configmap resource name with missing namespace and pod name",
+			in: []ResourceID{{
+				ClusterName: "one",
+				Kind:        KindKubeConfigmap,
+				Name:        "cluster",
+			}},
+			expected:         `["/one/configmap/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "configmap resource name in cluster with slash",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeConfigmap,
+				Name:            "cluster",
+				SubResourceName: "namespace/configmap*",
+			}},
+			expected: `["/one/configmap/cluster/namespace/configmap*"]`,
+		},
+		{
+			desc: "service resource name with missing namespace",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeService,
+				Name:            "cluster",
+				SubResourceName: "/service*",
+			}},
+			expected:         `["/one/service/cluster//service*"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "service resource name with missing namespace and pod name",
+			in: []ResourceID{{
+				ClusterName: "one",
+				Kind:        KindKubeService,
+				Name:        "cluster",
+			}},
+			expected:         `["/one/service/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "service resource name in cluster with slash",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeService,
+				Name:            "cluster",
+				SubResourceName: "namespace/service*",
+			}},
+			expected: `["/one/service/cluster/namespace/service*"]`,
+		},
+		{
+			desc: "service_account resource name with missing namespace",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeServiceAccount,
+				Name:            "cluster",
+				SubResourceName: "/service_account*",
+			}},
+			expected:         `["/one/serviceaccount/cluster//service_account*"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "service_account resource name with missing namespace and pod name",
+			in: []ResourceID{{
+				ClusterName: "one",
+				Kind:        KindKubeServiceAccount,
+				Name:        "cluster",
+			}},
+			expected:         `["/one/serviceaccount/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "service_account resource name in cluster with slash",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeServiceAccount,
+				Name:            "cluster",
+				SubResourceName: "namespace/service_account*",
+			}},
+			expected: `["/one/serviceaccount/cluster/namespace/service_account*"]`,
+		},
+		{
+			desc: "persistent_volume_claim resource name with missing namespace",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubePersistentVolumeClaim,
+				Name:            "cluster",
+				SubResourceName: "/persistent_volume_claim*",
+			}},
+			expected:         `["/one/persistentvolumeclaim/cluster//persistent_volume_claim*"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "persistent_volume_claim resource name with missing namespace and pod name",
+			in: []ResourceID{{
+				ClusterName: "one",
+				Kind:        KindKubePersistentVolumeClaim,
+				Name:        "cluster",
+			}},
+			expected:         `["/one/persistentvolumeclaim/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "namespace resource name with missing namespace and pod name",
+			in: []ResourceID{{
+				ClusterName: "one",
+				Kind:        KindKubeNamespace,
+				Name:        "cluster",
+			}},
+			expected:         `["/one/namespace/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "namespace resource name in cluster with slash",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeNamespace,
+				Name:            "cluster",
+				SubResourceName: "namespace*",
+			}},
+			expected: `["/one/namespace/cluster/namespace*"]`,
+		},
+		{
+			desc: "kube_node resource name with missing namespace and pod name",
+			in: []ResourceID{{
+				ClusterName: "one",
+				Kind:        KindKubeNode,
+				Name:        "cluster",
+			}},
+			expected:         `["/one/kube_node/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "kube_node resource name in cluster with slash",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeNode,
+				Name:            "cluster",
+				SubResourceName: "kube_node*",
+			}},
+			expected: `["/one/kube_node/cluster/kube_node*"]`,
+		},
+		{
+			desc: "persistent_volume resource name with missing namespace and pod name",
+			in: []ResourceID{{
+				ClusterName: "one",
+				Kind:        KindKubePersistentVolume,
+				Name:        "cluster",
+			}},
+			expected:         `["/one/persistentvolume/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "persistent_volume resource name in cluster with slash",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubePersistentVolume,
+				Name:            "cluster",
+				SubResourceName: "persistent_volume*",
+			}},
+			expected: `["/one/persistentvolume/cluster/persistent_volume*"]`,
+		},
+		{
+			desc: "cluster_role resource name with missing namespace and pod name",
+			in: []ResourceID{{
+				ClusterName: "one",
+				Kind:        KindKubeClusterRole,
+				Name:        "cluster",
+			}},
+			expected:         `["/one/clusterrole/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "cluster_role resource name in cluster with slash",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeClusterRole,
+				Name:            "cluster",
+				SubResourceName: "cluster_role*",
+			}},
+			expected: `["/one/clusterrole/cluster/cluster_role*"]`,
+		},
+		{
+			desc: "cluster_role_binding resource name with missing namespace and pod name",
+			in: []ResourceID{{
+				ClusterName: "one",
+				Kind:        KindKubeClusterRoleBinding,
+				Name:        "cluster",
+			}},
+			expected:         `["/one/clusterrolebinding/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "cluster_role_binding resource name in cluster with slash",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeClusterRoleBinding,
+				Name:            "cluster",
+				SubResourceName: "cluster_role_binding*",
+			}},
+			expected: `["/one/clusterrolebinding/cluster/cluster_role_binding*"]`,
+		},
+		{
+			desc: "certificate_signing_request resource name with missing namespace and pod name",
+			in: []ResourceID{{
+				ClusterName: "one",
+				Kind:        KindKubeCertificateSigningRequest,
+				Name:        "cluster",
+			}},
+			expected:         `["/one/certificatesigningrequest/cluster"]`,
+			expectParseError: true,
+		},
+		{
+			desc: "certificate_signing_request resource name in cluster with slash",
+			in: []ResourceID{{
+				ClusterName:     "one",
+				Kind:            KindKubeCertificateSigningRequest,
+				Name:            "cluster",
+				SubResourceName: "certificate_signing_request*",
+			}},
+			expected: `["/one/certificatesigningrequest/cluster/certificate_signing_request*"]`,
+		},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.desc, func(t *testing.T) {
diff --git a/api/types/role.go b/api/types/role.go
index 0ed850262709f..c44846abc7ec5 100644
--- a/api/types/role.go
+++ b/api/types/role.go
@@ -71,6 +71,13 @@ type Role interface {
 	// SetNamespaces sets a list of namespaces this role is allowed or denied access to.
 	SetNamespaces(RoleConditionType, []string)
 
+	// GetLabelMatchers gets the LabelMatchers that match labels of resources of
+	// type [kind] this role is allowed or denied access to.
+	GetLabelMatchers(rct RoleConditionType, kind string) (LabelMatchers, error)
+	// SetLabelMatchers sets the LabelMatchers that match labels of resources of
+	// type [kind] this role is allowed or denied access to.
+	SetLabelMatchers(rct RoleConditionType, kind string, labelMatchers LabelMatchers) error
+
 	// GetNodeLabels gets the map of node labels this role is allowed or denied access to.
 	GetNodeLabels(RoleConditionType) Labels
 	// SetNodeLabels sets the map of node labels this role is allowed or denied access to.
@@ -237,11 +244,17 @@ type Role interface {
 	SetGroupLabels(RoleConditionType, Labels)
 }
 
-// NewRole constructs new standard V6 role.
-// This creates a V6 role with V4+ RBAC semantics.
+// NewRole constructs new standard V7 role.
+// This creates a V7 role with V4+ RBAC semantics.
 func NewRole(name string, spec RoleSpecV6) (Role, error) {
+	role, err := NewRoleWithVersion(name, V7, spec)
+	return role, trace.Wrap(err)
+}
+
+// NewRoleWithVersion constructs new standard role with the version specified.
+func NewRoleWithVersion(name string, version string, spec RoleSpecV6) (Role, error) {
 	role := RoleV6{
-		Version: V6,
+		Version: version,
 		Metadata: Metadata{
 			Name: name,
 		},
@@ -383,11 +396,53 @@ func (r *RoleV6) SetKubeGroups(rct RoleConditionType, groups []string) {
 // access to.
 func (r *RoleV6) GetKubeResources(rct RoleConditionType) []KubernetesResource {
 	if rct == Allow {
-		return r.Spec.Allow.KubernetesResources
+		return r.convertKubernetesResourcesBetweenRoleVersions(r.Spec.Allow.KubernetesResources)
 	}
 	return r.Spec.Deny.KubernetesResources
 }
 
+// convertKubeResourcesBetweenRoleVersions converts Kubernetes resources between role versions.
+// This is required to keep compatibility between role versions to avoid breaking changes
+// when upgrading Teleport.
+// For roles v7, it returns the list as it is.
+// For older roles <v7, if the kind is pod and name and namespace are wildcards,
+// then return a wildcard resource since RoleV6 and below do not restrict access
+// to other resources. This is a simple optimization to reduce the number of resources.
+// Finally, if the older role version is not a wildcard, then it returns the pod resources as is
+// and append the other supported resources - KubernetesResourcesKinds - for Role v7.
+func (r *RoleV6) convertKubernetesResourcesBetweenRoleVersions(resources []KubernetesResource) []KubernetesResource {
+	switch r.Version {
+	case V7:
+		return resources
+	// Teleport does not support role versions < v3.
+	case V6, V5, V4, V3:
+		switch {
+		// If role does not have kube labels, return empty list since it won't match
+		// any kubernetes cluster.
+		case !r.HasLabelMatchers(Allow, KindKubernetesCluster):
+			return nil
+			// If role is not V7 and resources is wildcard, return wildcard for kind as well.
+			// This is an optimization to avoid appending multiple resources.
+			// This check ignores the Kind field because `validateKubeResources` ensures
+			// that for older roles, the Kind field can only be pod.
+		case len(resources) == 1 && resources[0].Name == Wildcard && resources[0].Namespace == Wildcard:
+			return []KubernetesResource{{Kind: Wildcard, Name: Wildcard, Namespace: Wildcard}}
+		default:
+			for _, resource := range KubernetesResourcesKinds {
+				// Ignore Pod resources for older roles because Pods were already supported
+				// so we don't need to keep backwards compatibility for them.
+				if resource == KindKubePod {
+					continue
+				}
+				resources = append(resources, KubernetesResource{Kind: resource, Name: Wildcard, Namespace: Wildcard})
+			}
+			return resources
+		}
+	default:
+		return nil
+	}
+}
+
 // SetKubeResources configures the Kubernetes Resources for the RoleConditionType.
 func (r *RoleV6) SetKubeResources(rct RoleConditionType, pods []KubernetesResource) {
 	if rct == Allow {
@@ -826,8 +881,8 @@ func (r *RoleV6) GetPrivateKeyPolicy() keys.PrivateKeyPolicy {
 // setStaticFields sets static resource header and metadata fields.
 func (r *RoleV6) setStaticFields() {
 	r.Kind = KindRole
-	if r.Version != V3 && r.Version != V4 && r.Version != V5 {
-		r.Version = V6
+	if r.Version != V3 && r.Version != V4 && r.Version != V5 && r.Version != V6 {
+		r.Version = V7
 	}
 }
 
@@ -883,9 +938,6 @@ func (r *RoleV6) CheckAndSetDefaults() error {
 	if r.Spec.Options.DesktopDirectorySharing == nil {
 		r.Spec.Options.DesktopDirectorySharing = NewBoolOption(true)
 	}
-	if r.Spec.Options.CreateHostUser == nil {
-		r.Spec.Options.CreateHostUser = NewBoolOption(false)
-	}
 	if r.Spec.Options.CreateDesktopUser == nil {
 		r.Spec.Options.CreateDesktopUser = NewBoolOption(false)
 	}
@@ -904,6 +956,10 @@ func (r *RoleV6) CheckAndSetDefaults() error {
 		}
 	}
 
+	if _, ok := CreateHostUserMode_name[int32(r.Spec.Options.CreateHostUserMode)]; !ok {
+		return trace.BadParameter("invalid host user mode %q, expected one of off, drop or keep", r.Spec.Options.CreateHostUserMode)
+	}
+
 	switch r.Version {
 	case V3:
 		if r.Spec.Allow.NodeLabels == nil {
@@ -931,7 +987,7 @@ func (r *RoleV6) CheckAndSetDefaults() error {
 	case V4, V5:
 		// Labels default to nil/empty for v4+ roles
 		// Allow unrestricted access to all pods.
-		if len(r.Spec.Allow.KubernetesResources) == 0 && len(r.Spec.Allow.KubernetesLabels) > 0 {
+		if len(r.Spec.Allow.KubernetesResources) == 0 && r.HasLabelMatchers(Allow, KindKubernetesCluster) {
 			r.Spec.Allow.KubernetesResources = []KubernetesResource{
 				{
 					Kind:      KindKubePod,
@@ -941,12 +997,27 @@ func (r *RoleV6) CheckAndSetDefaults() error {
 			}
 		}
 
-		if err := validateRoleSpecKubeResources(r.Spec); err != nil {
+		if err := validateRoleSpecKubeResources(r.Version, r.Spec); err != nil {
 			return trace.Wrap(err)
 		}
 
 	case V6:
-		if err := validateRoleSpecKubeResources(r.Spec); err != nil {
+		if err := validateRoleSpecKubeResources(r.Version, r.Spec); err != nil {
+			return trace.Wrap(err)
+		}
+	case V7:
+		// Kubernetes resources default to {kind:*, name:*, namespace:*} for v7 roles.
+		if len(r.Spec.Allow.KubernetesResources) == 0 && r.HasLabelMatchers(Allow, KindKubernetesCluster) {
+			r.Spec.Allow.KubernetesResources = []KubernetesResource{
+				{
+					Kind:      Wildcard,
+					Namespace: Wildcard,
+					Name:      Wildcard,
+				},
+			}
+		}
+
+		if err := validateRoleSpecKubeResources(r.Version, r.Spec); err != nil {
 			return trace.Wrap(err)
 		}
 	default:
@@ -1505,11 +1576,11 @@ func (r *RoleV6) SetPreviewAsRoles(rct RoleConditionType, roles []string) {
 
 // validateRoleSpecKubeResources validates the Allow/Deny Kubernetes Resources
 // entries.
-func validateRoleSpecKubeResources(spec RoleSpecV6) error {
-	if err := validateKubeResources(spec.Allow.KubernetesResources); err != nil {
+func validateRoleSpecKubeResources(version string, spec RoleSpecV6) error {
+	if err := validateKubeResources(version, spec.Allow.KubernetesResources); err != nil {
 		return trace.Wrap(err)
 	}
-	if err := validateKubeResources(spec.Deny.KubernetesResources); err != nil {
+	if err := validateKubeResources(version, spec.Deny.KubernetesResources); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
@@ -1519,12 +1590,23 @@ func validateRoleSpecKubeResources(spec RoleSpecV6) error {
 // - Kind belongs to KubernetesResourcesKinds
 // - Name is not empty
 // - Namespace is not empty
-func validateKubeResources(kubeResources []KubernetesResource) error {
+func validateKubeResources(roleVersion string, kubeResources []KubernetesResource) error {
 	for _, kubeResource := range kubeResources {
-		if !slices.Contains(KubernetesResourcesKinds, kubeResource.Kind) {
-			return trace.BadParameter("KubernetesResource kind %q is invalid or unsupported; Supported: %v", kubeResource.Kind, KubernetesResourcesKinds)
+		if !slices.Contains(KubernetesResourcesKinds, kubeResource.Kind) && kubeResource.Kind != Wildcard {
+			return trace.BadParameter("KubernetesResource kind %q is invalid or unsupported; Supported: %v", kubeResource.Kind, append([]string{Wildcard}, KubernetesResourcesKinds...))
+		}
+		// Only Pod resources are supported in role version <=V6.
+		// This is mandatory because we must append the other resources to the
+		// kubernetes resources.
+		switch roleVersion {
+		// Teleport does not support role versions < v3.
+		case V6, V5, V4, V3:
+			if kubeResource.Kind != KindKubePod {
+				return trace.BadParameter("KubernetesResource %q is not supported in role version %q. Upgrade the role version to %q", kubeResource.Kind, roleVersion, V7)
+			}
 		}
-		if len(kubeResource.Namespace) == 0 {
+
+		if len(kubeResource.Namespace) == 0 && !slices.Contains(KubernetesClusterWideResourceKinds, kubeResource.Kind) {
 			return trace.BadParameter("KubernetesResource must include Namespace")
 		}
 		if len(kubeResource.Name) == 0 {
@@ -1557,3 +1639,212 @@ func (a AccessReviewConditions) IsEmpty() bool {
 		len(a.Roles) == 0 &&
 		len(a.Where) == 0
 }
+
+// LabelMatchers holds the role label matchers and label expression that are
+// used to match resource labels of a specific resource kind and condition
+// (allow/deny).
+type LabelMatchers struct {
+	Labels     Labels
+	Expression string
+}
+
+// Empty returns true if all elements of the LabelMatchers are empty/unset.
+func (l LabelMatchers) Empty() bool {
+	return len(l.Labels) == 0 && len(l.Expression) == 0
+}
+
+// GetLabelMatchers gets the LabelMatchers that match labels of resources of
+// type [kind] this role is allowed or denied access to.
+func (r *RoleV6) GetLabelMatchers(rct RoleConditionType, kind string) (LabelMatchers, error) {
+	var cond *RoleConditions
+	if rct == Allow {
+		cond = &r.Spec.Allow
+	} else {
+		cond = &r.Spec.Deny
+	}
+	switch kind {
+	case KindRemoteCluster:
+		return LabelMatchers{cond.ClusterLabels, cond.ClusterLabelsExpression}, nil
+	case KindNode:
+		return LabelMatchers{cond.NodeLabels, cond.NodeLabelsExpression}, nil
+	case KindKubernetesCluster:
+		return LabelMatchers{cond.KubernetesLabels, cond.KubernetesLabelsExpression}, nil
+	case KindApp:
+		return LabelMatchers{cond.AppLabels, cond.AppLabelsExpression}, nil
+	case KindDatabase:
+		return LabelMatchers{cond.DatabaseLabels, cond.DatabaseLabelsExpression}, nil
+	case KindDatabaseService:
+		return LabelMatchers{cond.DatabaseServiceLabels, cond.DatabaseServiceLabelsExpression}, nil
+	case KindWindowsDesktop:
+		return LabelMatchers{cond.WindowsDesktopLabels, cond.WindowsDesktopLabelsExpression}, nil
+	case KindWindowsDesktopService:
+		return LabelMatchers{cond.WindowsDesktopLabels, cond.WindowsDesktopLabelsExpression}, nil
+	case KindUserGroup:
+		return LabelMatchers{cond.GroupLabels, cond.GroupLabelsExpression}, nil
+	}
+	return LabelMatchers{}, trace.BadParameter("can't get label matchers for resource kind %q", kind)
+}
+
+// SetLabelMatchers sets the LabelMatchers that match labels of resources of
+// type [kind] this role is allowed or denied access to.
+func (r *RoleV6) SetLabelMatchers(rct RoleConditionType, kind string, labelMatchers LabelMatchers) error {
+	var cond *RoleConditions
+	if rct == Allow {
+		cond = &r.Spec.Allow
+	} else {
+		cond = &r.Spec.Deny
+	}
+	switch kind {
+	case KindRemoteCluster:
+		cond.ClusterLabels = labelMatchers.Labels
+		cond.ClusterLabelsExpression = labelMatchers.Expression
+		return nil
+	case KindNode:
+		cond.NodeLabels = labelMatchers.Labels
+		cond.NodeLabelsExpression = labelMatchers.Expression
+		return nil
+	case KindKubernetesCluster:
+		cond.KubernetesLabels = labelMatchers.Labels
+		cond.KubernetesLabelsExpression = labelMatchers.Expression
+		return nil
+	case KindApp:
+		cond.AppLabels = labelMatchers.Labels
+		cond.AppLabelsExpression = labelMatchers.Expression
+		return nil
+	case KindDatabase:
+		cond.DatabaseLabels = labelMatchers.Labels
+		cond.DatabaseLabelsExpression = labelMatchers.Expression
+		return nil
+	case KindDatabaseService:
+		cond.DatabaseServiceLabels = labelMatchers.Labels
+		cond.DatabaseServiceLabelsExpression = labelMatchers.Expression
+		return nil
+	case KindWindowsDesktop:
+		cond.WindowsDesktopLabels = labelMatchers.Labels
+		cond.WindowsDesktopLabelsExpression = labelMatchers.Expression
+		return nil
+	case KindWindowsDesktopService:
+		cond.WindowsDesktopLabels = labelMatchers.Labels
+		cond.WindowsDesktopLabelsExpression = labelMatchers.Expression
+		return nil
+	case KindUserGroup:
+		cond.GroupLabels = labelMatchers.Labels
+		cond.GroupLabelsExpression = labelMatchers.Expression
+		return nil
+	}
+	return trace.BadParameter("can't set label matchers for resource kind %q", kind)
+}
+
+// HasLabelMatchers returns true if the role has label matchers for the
+// specified resource kind and condition (allow/deny).
+// If the kind is not supported, false is returned.
+func (r *RoleV6) HasLabelMatchers(rct RoleConditionType, kind string) bool {
+	lm, err := r.GetLabelMatchers(rct, kind)
+	return err == nil && !lm.Empty()
+}
+
+// LabelMatcherKinds is the complete list of resource kinds that support label
+// matchers.
+var LabelMatcherKinds = []string{
+	KindRemoteCluster,
+	KindNode,
+	KindKubernetesCluster,
+	KindApp,
+	KindDatabase,
+	KindDatabaseService,
+	KindWindowsDesktop,
+	KindWindowsDesktopService,
+	KindUserGroup,
+}
+
+const (
+	createHostUserModeOffString  = "off"
+	createHostUserModeDropString = "drop"
+	createHostUserModeKeepString = "keep"
+)
+
+func (h CreateHostUserMode) encode() (string, error) {
+	switch h {
+	case CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED:
+		return "", nil
+	case CreateHostUserMode_HOST_USER_MODE_OFF:
+		return createHostUserModeOffString, nil
+	case CreateHostUserMode_HOST_USER_MODE_DROP:
+		return createHostUserModeDropString, nil
+	case CreateHostUserMode_HOST_USER_MODE_KEEP:
+		return createHostUserModeKeepString, nil
+	}
+	return "", trace.BadParameter("invalid host user mode %v", h)
+}
+
+func (h *CreateHostUserMode) decode(val any) error {
+	var valS string
+	switch val := val.(type) {
+	case string:
+		valS = val
+	case bool:
+		if val {
+			return trace.BadParameter("create_host_user_mode cannot be true, got %v", val)
+		}
+		valS = createHostUserModeOffString
+	default:
+		return trace.BadParameter("bad value type %T, expected string", val)
+	}
+
+	switch valS {
+	case "":
+		*h = CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED
+	case createHostUserModeOffString:
+		*h = CreateHostUserMode_HOST_USER_MODE_OFF
+	case createHostUserModeDropString:
+		*h = CreateHostUserMode_HOST_USER_MODE_DROP
+	case createHostUserModeKeepString:
+		*h = CreateHostUserMode_HOST_USER_MODE_KEEP
+	default:
+		return trace.BadParameter("invalid host user mode %v", val)
+	}
+	return nil
+}
+
+// UnmarshalYAML supports parsing CreateHostUserMode from string.
+func (h *CreateHostUserMode) UnmarshalYAML(unmarshal func(interface{}) error) error {
+	var val interface{}
+	err := unmarshal(&val)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	err = h.decode(val)
+	return trace.Wrap(err)
+}
+
+// MarshalYAML marshals CreateHostUserMode to yaml.
+func (h *CreateHostUserMode) MarshalYAML() (interface{}, error) {
+	val, err := h.encode()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return val, nil
+}
+
+// MarshalJSON marshals CreateHostUserMode to json bytes.
+func (h *CreateHostUserMode) MarshalJSON() ([]byte, error) {
+	val, err := h.encode()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	out, err := json.Marshal(val)
+	return out, trace.Wrap(err)
+}
+
+// UnmarshalJSON supports parsing CreateHostUserMode from string.
+func (h *CreateHostUserMode) UnmarshalJSON(data []byte) error {
+	var val interface{}
+	err := json.Unmarshal(data, &val)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	err = h.decode(val)
+	return trace.Wrap(err)
+}
diff --git a/api/types/role_test.go b/api/types/role_test.go
index 5441edfccc9fe..073caafbfda68 100644
--- a/api/types/role_test.go
+++ b/api/types/role_test.go
@@ -17,9 +17,12 @@ limitations under the License.
 package types
 
 import (
+	"encoding/json"
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v2"
 
 	"github.com/gravitational/teleport/api/types/wrappers"
 )
@@ -143,3 +146,283 @@ func TestAccessReviewConditionsIsEmpty(t *testing.T) {
 		})
 	}
 }
+
+func TestRole_GetKubeResources(t *testing.T) {
+	kubeLabels := Labels{
+		Wildcard: {Wildcard},
+	}
+	labelsExpression := "contains(user.spec.traits[\"groups\"], \"prod\")"
+	type args struct {
+		version          string
+		labels           Labels
+		labelsExpression string
+		resources        []KubernetesResource
+	}
+	tests := []struct {
+		name                string
+		args                args
+		want                []KubernetesResource
+		assertErrorCreation require.ErrorAssertionFunc
+	}{
+		{
+			name: "v7 with error",
+			args: args{
+				version: V7,
+				labels:  kubeLabels,
+				resources: []KubernetesResource{
+					{
+						Kind:      "invalid resource",
+						Namespace: "test",
+						Name:      "test",
+					},
+				},
+			},
+			assertErrorCreation: require.Error,
+		},
+		{
+			name: "v7",
+			args: args{
+				version: V7,
+				labels:  kubeLabels,
+				resources: []KubernetesResource{
+					{
+						Kind:      KindKubePod,
+						Namespace: "test",
+						Name:      "test",
+					},
+				},
+			},
+			assertErrorCreation: require.NoError,
+			want: []KubernetesResource{
+				{
+					Kind:      KindKubePod,
+					Namespace: "test",
+					Name:      "test",
+				},
+			},
+		},
+		{
+			name: "v7 with labels expression",
+			args: args{
+				version:          V7,
+				labelsExpression: labelsExpression,
+				resources: []KubernetesResource{
+					{
+						Kind:      KindKubePod,
+						Namespace: "test",
+						Name:      "test",
+					},
+				},
+			},
+			assertErrorCreation: require.NoError,
+			want: []KubernetesResource{
+				{
+					Kind:      KindKubePod,
+					Namespace: "test",
+					Name:      "test",
+				},
+			},
+		},
+		{
+			name: "v6 to v7 without wildcard; labels expression",
+			args: args{
+				version:          V6,
+				labelsExpression: labelsExpression,
+				resources: []KubernetesResource{
+					{
+						Kind:      KindKubePod,
+						Namespace: "test",
+						Name:      "test",
+					},
+				},
+			},
+			assertErrorCreation: require.NoError,
+			want: append([]KubernetesResource{
+				{
+					Kind:      KindKubePod,
+					Namespace: "test",
+					Name:      "test",
+				},
+			},
+				appendV7KubeResources()...),
+		},
+		{
+			name: "v6 to v7 with wildcard",
+			args: args{
+				version: V6,
+				labels:  kubeLabels,
+				resources: []KubernetesResource{
+					{
+						Kind:      KindKubePod,
+						Namespace: Wildcard,
+						Name:      Wildcard,
+					},
+				},
+			},
+			assertErrorCreation: require.NoError,
+			want: []KubernetesResource{
+				{
+					Kind:      Wildcard,
+					Namespace: Wildcard,
+					Name:      Wildcard,
+				},
+			},
+		},
+		{
+			name: "v6 to v7 without wildcard",
+			args: args{
+				version: V6,
+				labels:  kubeLabels,
+				resources: []KubernetesResource{
+					{
+						Kind:      KindKubePod,
+						Namespace: "test",
+						Name:      "test",
+					},
+				},
+			},
+			assertErrorCreation: require.NoError,
+			want: append([]KubernetesResource{
+				{
+					Kind:      KindKubePod,
+					Namespace: "test",
+					Name:      "test",
+				},
+			},
+				appendV7KubeResources()...),
+		},
+		{
+			name: "v5 to v7: populate with defaults.",
+			args: args{
+				version:   V5,
+				labels:    kubeLabels,
+				resources: nil,
+			},
+			assertErrorCreation: require.NoError,
+			want: []KubernetesResource{
+				{
+					Kind:      Wildcard,
+					Namespace: Wildcard,
+					Name:      Wildcard,
+				},
+			},
+		},
+		{
+			name: "v5 to v7 without kube labels",
+			args: args{
+				version:   V5,
+				resources: nil,
+			},
+			assertErrorCreation: require.NoError,
+			want:                nil,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r, err := NewRoleWithVersion(
+				"test",
+				tt.args.version,
+				RoleSpecV6{
+					Allow: RoleConditions{
+						Namespaces:                 []string{"default"},
+						KubernetesLabels:           tt.args.labels,
+						KubernetesResources:        tt.args.resources,
+						KubernetesLabelsExpression: tt.args.labelsExpression,
+					},
+				},
+			)
+			tt.assertErrorCreation(t, err)
+			if err != nil {
+				return
+			}
+			got := r.GetKubeResources(Allow)
+			require.Equal(t, tt.want, got)
+			got = r.GetKubeResources(Deny)
+			require.Empty(t, got)
+		})
+	}
+}
+
+func appendV7KubeResources() []KubernetesResource {
+	resources := []KubernetesResource{}
+	// append other kubernetes resources
+	for _, resource := range KubernetesResourcesKinds {
+		if resource == KindKubePod {
+			continue
+		}
+		resources = append(resources, KubernetesResource{
+			Kind:      resource,
+			Namespace: Wildcard,
+			Name:      Wildcard,
+		},
+		)
+	}
+	return resources
+}
+
+func TestMarshallCreateHostUserModeJSON(t *testing.T) {
+	for _, tc := range []struct {
+		input    CreateHostUserMode
+		expected string
+	}{
+		{input: CreateHostUserMode_HOST_USER_MODE_OFF, expected: "off"},
+		{input: CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED, expected: ""},
+		{input: CreateHostUserMode_HOST_USER_MODE_DROP, expected: "drop"},
+		{input: CreateHostUserMode_HOST_USER_MODE_KEEP, expected: "keep"},
+	} {
+		got, err := json.Marshal(&tc.input)
+		require.NoError(t, err)
+		require.Equal(t, fmt.Sprintf("%q", tc.expected), string(got))
+	}
+}
+
+func TestMarshallCreateHostUserModeYAML(t *testing.T) {
+	for _, tc := range []struct {
+		input    CreateHostUserMode
+		expected string
+	}{
+		{input: CreateHostUserMode_HOST_USER_MODE_OFF, expected: "\"off\""},
+		{input: CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED, expected: "\"\""},
+		{input: CreateHostUserMode_HOST_USER_MODE_DROP, expected: "drop"},
+		{input: CreateHostUserMode_HOST_USER_MODE_KEEP, expected: "keep"},
+	} {
+		got, err := yaml.Marshal(&tc.input)
+		require.NoError(t, err)
+		require.Equal(t, fmt.Sprintf("%s\n", tc.expected), string(got))
+	}
+}
+
+func TestUnmarshallCreateHostUserModeJSON(t *testing.T) {
+	for _, tc := range []struct {
+		expected CreateHostUserMode
+		input    string
+	}{
+		{expected: CreateHostUserMode_HOST_USER_MODE_OFF, input: "off"},
+		{expected: CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED, input: ""},
+		{expected: CreateHostUserMode_HOST_USER_MODE_DROP, input: "drop"},
+		{expected: CreateHostUserMode_HOST_USER_MODE_KEEP, input: "keep"},
+	} {
+		var got CreateHostUserMode
+		err := json.Unmarshal([]byte(fmt.Sprintf("%q", tc.input)), &got)
+		require.NoError(t, err)
+		require.Equal(t, tc.expected, got)
+	}
+}
+
+func TestUnmarshallCreateHostUserModeYAML(t *testing.T) {
+	for _, tc := range []struct {
+		expected CreateHostUserMode
+		input    string
+	}{
+		{expected: CreateHostUserMode_HOST_USER_MODE_OFF, input: "\"off\""},
+		{expected: CreateHostUserMode_HOST_USER_MODE_OFF, input: "off"},
+		{expected: CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED, input: "\"\""},
+		{expected: CreateHostUserMode_HOST_USER_MODE_DROP, input: "drop"},
+		{expected: CreateHostUserMode_HOST_USER_MODE_KEEP, input: "keep"},
+	} {
+		var got CreateHostUserMode
+		err := yaml.Unmarshal([]byte(tc.input), &got)
+		require.NoError(t, err)
+		require.Equal(t, tc.expected, got)
+	}
+}
diff --git a/api/types/session_tracker.go b/api/types/session_tracker.go
index 8c2866c178258..b96428a601c67 100644
--- a/api/types/session_tracker.go
+++ b/api/types/session_tracker.go
@@ -20,6 +20,7 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"golang.org/x/exp/slices"
 
 	"github.com/gravitational/teleport/api/defaults"
 )
@@ -94,7 +95,7 @@ type SessionTracker interface {
 	RemoveParticipant(string) error
 
 	// UpdatePresence updates presence timestamp of a participant.
-	UpdatePresence(string) error
+	UpdatePresence(string, time.Time) error
 
 	// GetKubeCluster returns the name of the kubernetes cluster the session is running in.
 	GetKubeCluster() string
@@ -302,15 +303,17 @@ func (s *SessionTrackerV1) GetHostUser() string {
 }
 
 // UpdatePresence updates presence timestamp of a participant.
-func (s *SessionTrackerV1) UpdatePresence(user string) error {
-	for _, participant := range s.Spec.Participants {
-		if participant.User == user {
-			participant.LastActive = time.Now().UTC()
-			return nil
-		}
+func (s *SessionTrackerV1) UpdatePresence(user string, t time.Time) error {
+	idx := slices.IndexFunc(s.Spec.Participants, func(participant Participant) bool {
+		return participant.User == user
+	})
+
+	if idx < 0 {
+		return trace.NotFound("participant %v not found", user)
 	}
 
-	return trace.NotFound("participant %v not found", user)
+	s.Spec.Participants[idx].LastActive = t
+	return nil
 }
 
 // GetHostPolicySets returns a list of policy sets held by the host user at the time of session creation.
diff --git a/api/types/session_tracker_test.go b/api/types/session_tracker_test.go
new file mode 100644
index 0000000000000..59cbb7fbd84fa
--- /dev/null
+++ b/api/types/session_tracker_test.go
@@ -0,0 +1,66 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package types
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSessionTrackerV1_UpdatePresence(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	now := clock.Now().UTC()
+
+	s, err := NewSessionTracker(SessionTrackerSpecV1{
+		SessionID: "123",
+		Participants: []Participant{
+			{
+				ID:         "1",
+				User:       "llama",
+				Mode:       string(SessionPeerMode),
+				LastActive: now,
+			},
+			{
+				ID:         "2",
+				User:       "fish",
+				Mode:       string(SessionModeratorMode),
+				LastActive: now,
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	// Presence cannot be updated for a non-existent user
+	err = s.UpdatePresence("alpaca", now.Add(time.Hour))
+	require.ErrorIs(t, err, trace.NotFound("participant alpaca not found"))
+
+	// Update presence for just the user fish
+	require.NoError(t, s.UpdatePresence("fish", now.Add(time.Hour)))
+
+	// Verify that llama has not been active but that fish was
+	for _, participant := range s.GetParticipants() {
+		lastActive := now
+		if participant.User == "fish" {
+			lastActive = lastActive.Add(time.Hour)
+		}
+
+		assert.Equal(t, lastActive, participant.LastActive)
+	}
+}
diff --git a/api/types/types.pb.go b/api/types/types.pb.go
index 80aad7b76aa23..40b0595d85eba 100644
--- a/api/types/types.pb.go
+++ b/api/types/types.pb.go
@@ -232,6 +232,43 @@ func (RequestState) EnumDescriptor() ([]byte, []int) {
 	return fileDescriptor_9198ee693835762e, []int{5}
 }
 
+// CreateHostUserMode determines whether host user creation should be
+// disabled or if host users should be cleaned up or kept after
+// sessions end.
+type CreateHostUserMode int32
+
+const (
+	CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED CreateHostUserMode = 0
+	// HOST_USER_MODE_OFF disables host user creation.
+	CreateHostUserMode_HOST_USER_MODE_OFF CreateHostUserMode = 1
+	// HOST_USER_MODE_DROP enables host user creation and deletes users at session end.
+	CreateHostUserMode_HOST_USER_MODE_DROP CreateHostUserMode = 2
+	// HOST_USER_MODE_KEEP enables host user creation and leaves users behind at session end.
+	CreateHostUserMode_HOST_USER_MODE_KEEP CreateHostUserMode = 3
+)
+
+var CreateHostUserMode_name = map[int32]string{
+	0: "HOST_USER_MODE_UNSPECIFIED",
+	1: "HOST_USER_MODE_OFF",
+	2: "HOST_USER_MODE_DROP",
+	3: "HOST_USER_MODE_KEEP",
+}
+
+var CreateHostUserMode_value = map[string]int32{
+	"HOST_USER_MODE_UNSPECIFIED": 0,
+	"HOST_USER_MODE_OFF":         1,
+	"HOST_USER_MODE_DROP":        2,
+	"HOST_USER_MODE_KEEP":        3,
+}
+
+func (x CreateHostUserMode) String() string {
+	return proto.EnumName(CreateHostUserMode_name, int32(x))
+}
+
+func (CreateHostUserMode) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{6}
+}
+
 // CertExtensionMode specifies the type of extension to use in the cert.
 type CertExtensionMode int32
 
@@ -254,7 +291,7 @@ func (x CertExtensionMode) String() string {
 }
 
 func (CertExtensionMode) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{6}
+	return fileDescriptor_9198ee693835762e, []int{7}
 }
 
 // CertExtensionType represents the certificate type the extension is for.
@@ -279,7 +316,7 @@ func (x CertExtensionType) String() string {
 }
 
 func (CertExtensionType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{7}
+	return fileDescriptor_9198ee693835762e, []int{8}
 }
 
 // SessionState represents the state of a session.
@@ -313,7 +350,7 @@ func (x SessionState) String() string {
 }
 
 func (SessionState) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{8}
+	return fileDescriptor_9198ee693835762e, []int{9}
 }
 
 // AlertSeverity represents how problematic/urgent an alert is, and is used to assist
@@ -343,7 +380,7 @@ func (x AlertSeverity) String() string {
 }
 
 func (AlertSeverity) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{9}
+	return fileDescriptor_9198ee693835762e, []int{10}
 }
 
 // RequireMFAType is a type of MFA requirement enforced outside of login,
@@ -384,7 +421,7 @@ func (x RequireMFAType) String() string {
 }
 
 func (RequireMFAType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{10}
+	return fileDescriptor_9198ee693835762e, []int{11}
 }
 
 type PluginStatusCode int32
@@ -425,7 +462,7 @@ func (x PluginStatusCode) String() string {
 }
 
 func (PluginStatusCode) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{11}
+	return fileDescriptor_9198ee693835762e, []int{12}
 }
 
 // HeadlessAuthenticationState is a headless authentication state.
@@ -460,7 +497,7 @@ func (x HeadlessAuthenticationState) String() string {
 }
 
 func (HeadlessAuthenticationState) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{12}
+	return fileDescriptor_9198ee693835762e, []int{13}
 }
 
 // The type of a KeepAlive. When adding a new type, please double-check
@@ -543,7 +580,7 @@ func (x CertAuthoritySpecV2_SigningAlgType) String() string {
 }
 
 func (CertAuthoritySpecV2_SigningAlgType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{47, 0}
+	return fileDescriptor_9198ee693835762e, []int{49, 0}
 }
 
 // FIPSEndpointState represents an AWS FIPS endpoint state.
@@ -576,7 +613,7 @@ func (x ClusterAuditConfigSpecV2_FIPSEndpointState) String() string {
 }
 
 func (ClusterAuditConfigSpecV2_FIPSEndpointState) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{66, 0}
+	return fileDescriptor_9198ee693835762e, []int{68, 0}
 }
 
 // TraceType is an identification of the checkpoint.
@@ -646,7 +683,7 @@ func (x ConnectionDiagnosticTrace_TraceType) String() string {
 }
 
 func (ConnectionDiagnosticTrace_TraceType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{222, 0}
+	return fileDescriptor_9198ee693835762e, []int{224, 0}
 }
 
 // StatusType describes whether this was a success or a failure.
@@ -675,7 +712,7 @@ func (x ConnectionDiagnosticTrace_StatusType) String() string {
 }
 
 func (ConnectionDiagnosticTrace_StatusType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{222, 1}
+	return fileDescriptor_9198ee693835762e, []int{224, 1}
 }
 
 // OktaAssignmentStatus represents the status of an Okta assignment.
@@ -715,7 +752,7 @@ func (x OktaAssignmentSpecV1_OktaAssignmentStatus) String() string {
 }
 
 func (OktaAssignmentSpecV1_OktaAssignmentStatus) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{269, 0}
+	return fileDescriptor_9198ee693835762e, []int{274, 0}
 }
 
 // OktaAssignmentTargetType is the type of Okta object that an assignment is targeting.
@@ -747,7 +784,7 @@ func (x OktaAssignmentTargetV1_OktaAssignmentTargetType) String() string {
 }
 
 func (OktaAssignmentTargetV1_OktaAssignmentTargetType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{270, 0}
+	return fileDescriptor_9198ee693835762e, []int{275, 0}
 }
 
 type KeepAlive struct {
@@ -1258,10 +1295,12 @@ type DatabaseSpecV3 struct {
 	// MySQL is an additional section with MySQL database options.
 	MySQL MySQLOptions `protobuf:"bytes,10,opt,name=MySQL,proto3" json:"mysql,omitempty"`
 	// AdminUser is the database admin user for automatic user provisioning.
-	AdminUser            *DatabaseAdminUser `protobuf:"bytes,11,opt,name=AdminUser,proto3" json:"admin_user,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}           `json:"-"`
-	XXX_unrecognized     []byte             `json:"-"`
-	XXX_sizecache        int32              `json:"-"`
+	AdminUser *DatabaseAdminUser `protobuf:"bytes,11,opt,name=AdminUser,proto3" json:"admin_user,omitempty"`
+	// MongoAtlas contains Atlas metadata about the database.
+	MongoAtlas           MongoAtlas `protobuf:"bytes,12,opt,name=MongoAtlas,proto3" json:"mongo_atlas,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}   `json:"-"`
+	XXX_unrecognized     []byte     `json:"-"`
+	XXX_sizecache        int32      `json:"-"`
 }
 
 func (m *DatabaseSpecV3) Reset()         { *m = DatabaseSpecV3{} }
@@ -1414,10 +1453,12 @@ type AWS struct {
 	ExternalID string `protobuf:"bytes,10,opt,name=ExternalID,proto3" json:"external_id,omitempty"`
 	// AssumeRoleARN is an optional AWS role ARN to assume when accessing a database.
 	// Set this field and ExternalID to enable access across AWS accounts.
-	AssumeRoleARN        string   `protobuf:"bytes,11,opt,name=AssumeRoleARN,proto3" json:"assume_role_arn,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	AssumeRoleARN string `protobuf:"bytes,11,opt,name=AssumeRoleARN,proto3" json:"assume_role_arn,omitempty"`
+	// OpenSearch contains AWS OpenSearch specific metadata.
+	OpenSearch           OpenSearch `protobuf:"bytes,12,opt,name=OpenSearch,proto3" json:"opensearch,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}   `json:"-"`
+	XXX_unrecognized     []byte     `json:"-"`
+	XXX_sizecache        int32      `json:"-"`
 }
 
 func (m *AWS) Reset()         { *m = AWS{} }
@@ -1777,6 +1818,52 @@ func (m *RedshiftServerless) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_RedshiftServerless proto.InternalMessageInfo
 
+// OpenSearch contains AWS OpenSearch specific metadata.
+type OpenSearch struct {
+	// DomainName is the name of the domain.
+	DomainName string `protobuf:"bytes,1,opt,name=DomainName,proto3" json:"domain_name,omitempty"`
+	// DomainID is the ID of the domain.
+	DomainID string `protobuf:"bytes,2,opt,name=DomainID,proto3" json:"domain_id,omitempty"`
+	// EndpointType is the type of the endpoint.
+	EndpointType         string   `protobuf:"bytes,3,opt,name=EndpointType,proto3" json:"endpoint_type,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *OpenSearch) Reset()         { *m = OpenSearch{} }
+func (m *OpenSearch) String() string { return proto.CompactTextString(m) }
+func (*OpenSearch) ProtoMessage()    {}
+func (*OpenSearch) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{20}
+}
+func (m *OpenSearch) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *OpenSearch) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_OpenSearch.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *OpenSearch) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_OpenSearch.Merge(m, src)
+}
+func (m *OpenSearch) XXX_Size() int {
+	return m.Size()
+}
+func (m *OpenSearch) XXX_DiscardUnknown() {
+	xxx_messageInfo_OpenSearch.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_OpenSearch proto.InternalMessageInfo
+
 // GCPCloudSQL contains parameters specific to GCP Cloud SQL databases.
 type GCPCloudSQL struct {
 	// ProjectID is the GCP project ID the Cloud SQL instance resides in.
@@ -1792,7 +1879,7 @@ func (m *GCPCloudSQL) Reset()         { *m = GCPCloudSQL{} }
 func (m *GCPCloudSQL) String() string { return proto.CompactTextString(m) }
 func (*GCPCloudSQL) ProtoMessage()    {}
 func (*GCPCloudSQL) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{20}
+	return fileDescriptor_9198ee693835762e, []int{21}
 }
 func (m *GCPCloudSQL) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1840,7 +1927,7 @@ func (m *Azure) Reset()         { *m = Azure{} }
 func (m *Azure) String() string { return proto.CompactTextString(m) }
 func (*Azure) ProtoMessage()    {}
 func (*Azure) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{21}
+	return fileDescriptor_9198ee693835762e, []int{22}
 }
 func (m *Azure) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1882,7 +1969,7 @@ func (m *AzureRedis) Reset()         { *m = AzureRedis{} }
 func (m *AzureRedis) String() string { return proto.CompactTextString(m) }
 func (*AzureRedis) ProtoMessage()    {}
 func (*AzureRedis) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{22}
+	return fileDescriptor_9198ee693835762e, []int{23}
 }
 func (m *AzureRedis) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1934,7 +2021,7 @@ func (m *AD) Reset()         { *m = AD{} }
 func (m *AD) String() string { return proto.CompactTextString(m) }
 func (*AD) ProtoMessage()    {}
 func (*AD) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{23}
+	return fileDescriptor_9198ee693835762e, []int{24}
 }
 func (m *AD) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1982,7 +2069,7 @@ func (m *DatabaseTLS) Reset()         { *m = DatabaseTLS{} }
 func (m *DatabaseTLS) String() string { return proto.CompactTextString(m) }
 func (*DatabaseTLS) ProtoMessage()    {}
 func (*DatabaseTLS) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{24}
+	return fileDescriptor_9198ee693835762e, []int{25}
 }
 func (m *DatabaseTLS) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2025,7 +2112,7 @@ func (m *MySQLOptions) Reset()         { *m = MySQLOptions{} }
 func (m *MySQLOptions) String() string { return proto.CompactTextString(m) }
 func (*MySQLOptions) ProtoMessage()    {}
 func (*MySQLOptions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{25}
+	return fileDescriptor_9198ee693835762e, []int{26}
 }
 func (m *MySQLOptions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2054,6 +2141,48 @@ func (m *MySQLOptions) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_MySQLOptions proto.InternalMessageInfo
 
+// MongoAtlas contains Atlas metadata about the database.
+type MongoAtlas struct {
+	// Name is the Atlas database instance name.
+	Name                 string   `protobuf:"bytes,1,opt,name=Name,proto3" json:"name,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *MongoAtlas) Reset()         { *m = MongoAtlas{} }
+func (m *MongoAtlas) String() string { return proto.CompactTextString(m) }
+func (*MongoAtlas) ProtoMessage()    {}
+func (*MongoAtlas) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{27}
+}
+func (m *MongoAtlas) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *MongoAtlas) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_MongoAtlas.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *MongoAtlas) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MongoAtlas.Merge(m, src)
+}
+func (m *MongoAtlas) XXX_Size() int {
+	return m.Size()
+}
+func (m *MongoAtlas) XXX_DiscardUnknown() {
+	xxx_messageInfo_MongoAtlas.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_MongoAtlas proto.InternalMessageInfo
+
 // InstanceV1 represents the state of a running teleport instance independent
 // of the specific services that instance exposes.
 type InstanceV1 struct {
@@ -2068,7 +2197,7 @@ func (m *InstanceV1) Reset()         { *m = InstanceV1{} }
 func (m *InstanceV1) String() string { return proto.CompactTextString(m) }
 func (*InstanceV1) ProtoMessage()    {}
 func (*InstanceV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{26}
+	return fileDescriptor_9198ee693835762e, []int{28}
 }
 func (m *InstanceV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2120,7 +2249,7 @@ func (m *InstanceSpecV1) Reset()         { *m = InstanceSpecV1{} }
 func (m *InstanceSpecV1) String() string { return proto.CompactTextString(m) }
 func (*InstanceSpecV1) ProtoMessage()    {}
 func (*InstanceSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{27}
+	return fileDescriptor_9198ee693835762e, []int{29}
 }
 func (m *InstanceSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2190,7 +2319,7 @@ func (m *InstanceControlLogEntry) Reset()         { *m = InstanceControlLogEntry
 func (m *InstanceControlLogEntry) String() string { return proto.CompactTextString(m) }
 func (*InstanceControlLogEntry) ProtoMessage()    {}
 func (*InstanceControlLogEntry) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{28}
+	return fileDescriptor_9198ee693835762e, []int{30}
 }
 func (m *InstanceControlLogEntry) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2238,7 +2367,7 @@ func (m *InstanceFilter) Reset()         { *m = InstanceFilter{} }
 func (m *InstanceFilter) String() string { return proto.CompactTextString(m) }
 func (*InstanceFilter) ProtoMessage()    {}
 func (*InstanceFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{29}
+	return fileDescriptor_9198ee693835762e, []int{31}
 }
 func (m *InstanceFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2287,7 +2416,7 @@ type ServerV2 struct {
 func (m *ServerV2) Reset()      { *m = ServerV2{} }
 func (*ServerV2) ProtoMessage() {}
 func (*ServerV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{30}
+	return fileDescriptor_9198ee693835762e, []int{32}
 }
 func (m *ServerV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2330,7 +2459,7 @@ func (m *ServerV2List) Reset()         { *m = ServerV2List{} }
 func (m *ServerV2List) String() string { return proto.CompactTextString(m) }
 func (*ServerV2List) ProtoMessage()    {}
 func (*ServerV2List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{31}
+	return fileDescriptor_9198ee693835762e, []int{33}
 }
 func (m *ServerV2List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2396,7 +2525,7 @@ func (m *ServerSpecV2) Reset()         { *m = ServerSpecV2{} }
 func (m *ServerSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ServerSpecV2) ProtoMessage()    {}
 func (*ServerSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{32}
+	return fileDescriptor_9198ee693835762e, []int{34}
 }
 func (m *ServerSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2445,7 +2574,7 @@ type AppServerV3 struct {
 func (m *AppServerV3) Reset()      { *m = AppServerV3{} }
 func (*AppServerV3) ProtoMessage() {}
 func (*AppServerV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{33}
+	return fileDescriptor_9198ee693835762e, []int{35}
 }
 func (m *AppServerV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2497,7 +2626,7 @@ func (m *AppServerSpecV3) Reset()         { *m = AppServerSpecV3{} }
 func (m *AppServerSpecV3) String() string { return proto.CompactTextString(m) }
 func (*AppServerSpecV3) ProtoMessage()    {}
 func (*AppServerSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{34}
+	return fileDescriptor_9198ee693835762e, []int{36}
 }
 func (m *AppServerSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2539,7 +2668,7 @@ func (m *AppV3List) Reset()         { *m = AppV3List{} }
 func (m *AppV3List) String() string { return proto.CompactTextString(m) }
 func (*AppV3List) ProtoMessage()    {}
 func (*AppV3List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{35}
+	return fileDescriptor_9198ee693835762e, []int{37}
 }
 func (m *AppV3List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2588,7 +2717,7 @@ type AppV3 struct {
 func (m *AppV3) Reset()      { *m = AppV3{} }
 func (*AppV3) ProtoMessage() {}
 func (*AppV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{36}
+	return fileDescriptor_9198ee693835762e, []int{38}
 }
 func (m *AppV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2632,7 +2761,9 @@ type AppSpecV3 struct {
 	// AWS contains additional options for AWS applications.
 	AWS *AppAWS `protobuf:"bytes,6,opt,name=AWS,proto3" json:"aws,omitempty"`
 	// Cloud identifies the cloud instance the app represents.
-	Cloud                string   `protobuf:"bytes,7,opt,name=Cloud,proto3" json:"cloud,omitempty"`
+	Cloud string `protobuf:"bytes,7,opt,name=Cloud,proto3" json:"cloud,omitempty"`
+	// UserGroups are a list of user group IDs that this app is associated with.
+	UserGroups           []string `protobuf:"bytes,8,rep,name=UserGroups,proto3" json:"UserGroups,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -2642,7 +2773,7 @@ func (m *AppSpecV3) Reset()         { *m = AppSpecV3{} }
 func (m *AppSpecV3) String() string { return proto.CompactTextString(m) }
 func (*AppSpecV3) ProtoMessage()    {}
 func (*AppSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{37}
+	return fileDescriptor_9198ee693835762e, []int{39}
 }
 func (m *AppSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2702,7 +2833,7 @@ func (m *App) Reset()         { *m = App{} }
 func (m *App) String() string { return proto.CompactTextString(m) }
 func (*App) ProtoMessage()    {}
 func (*App) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{38}
+	return fileDescriptor_9198ee693835762e, []int{40}
 }
 func (m *App) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2748,7 +2879,7 @@ func (m *Rewrite) Reset()         { *m = Rewrite{} }
 func (m *Rewrite) String() string { return proto.CompactTextString(m) }
 func (*Rewrite) ProtoMessage()    {}
 func (*Rewrite) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{39}
+	return fileDescriptor_9198ee693835762e, []int{41}
 }
 func (m *Rewrite) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2792,7 +2923,7 @@ func (m *Header) Reset()         { *m = Header{} }
 func (m *Header) String() string { return proto.CompactTextString(m) }
 func (*Header) ProtoMessage()    {}
 func (*Header) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{40}
+	return fileDescriptor_9198ee693835762e, []int{42}
 }
 func (m *Header) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2839,7 +2970,7 @@ func (m *CommandLabelV2) Reset()         { *m = CommandLabelV2{} }
 func (m *CommandLabelV2) String() string { return proto.CompactTextString(m) }
 func (*CommandLabelV2) ProtoMessage()    {}
 func (*CommandLabelV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{41}
+	return fileDescriptor_9198ee693835762e, []int{43}
 }
 func (m *CommandLabelV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2881,7 +3012,7 @@ func (m *AppAWS) Reset()         { *m = AppAWS{} }
 func (m *AppAWS) String() string { return proto.CompactTextString(m) }
 func (*AppAWS) ProtoMessage()    {}
 func (*AppAWS) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{42}
+	return fileDescriptor_9198ee693835762e, []int{44}
 }
 func (m *AppAWS) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2927,7 +3058,7 @@ func (m *SSHKeyPair) Reset()         { *m = SSHKeyPair{} }
 func (m *SSHKeyPair) String() string { return proto.CompactTextString(m) }
 func (*SSHKeyPair) ProtoMessage()    {}
 func (*SSHKeyPair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{43}
+	return fileDescriptor_9198ee693835762e, []int{45}
 }
 func (m *SSHKeyPair) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -2973,7 +3104,7 @@ func (m *TLSKeyPair) Reset()         { *m = TLSKeyPair{} }
 func (m *TLSKeyPair) String() string { return proto.CompactTextString(m) }
 func (*TLSKeyPair) ProtoMessage()    {}
 func (*TLSKeyPair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{44}
+	return fileDescriptor_9198ee693835762e, []int{46}
 }
 func (m *TLSKeyPair) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3019,7 +3150,7 @@ func (m *JWTKeyPair) Reset()         { *m = JWTKeyPair{} }
 func (m *JWTKeyPair) String() string { return proto.CompactTextString(m) }
 func (*JWTKeyPair) ProtoMessage()    {}
 func (*JWTKeyPair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{45}
+	return fileDescriptor_9198ee693835762e, []int{47}
 }
 func (m *JWTKeyPair) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3068,7 +3199,7 @@ type CertAuthorityV2 struct {
 func (m *CertAuthorityV2) Reset()      { *m = CertAuthorityV2{} }
 func (*CertAuthorityV2) ProtoMessage() {}
 func (*CertAuthorityV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{46}
+	return fileDescriptor_9198ee693835762e, []int{48}
 }
 func (m *CertAuthorityV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3131,7 +3262,7 @@ func (m *CertAuthoritySpecV2) Reset()         { *m = CertAuthoritySpecV2{} }
 func (m *CertAuthoritySpecV2) String() string { return proto.CompactTextString(m) }
 func (*CertAuthoritySpecV2) ProtoMessage()    {}
 func (*CertAuthoritySpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{47}
+	return fileDescriptor_9198ee693835762e, []int{49}
 }
 func (m *CertAuthoritySpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3177,7 +3308,7 @@ func (m *CAKeySet) Reset()         { *m = CAKeySet{} }
 func (m *CAKeySet) String() string { return proto.CompactTextString(m) }
 func (*CAKeySet) ProtoMessage()    {}
 func (*CAKeySet) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{48}
+	return fileDescriptor_9198ee693835762e, []int{50}
 }
 func (m *CAKeySet) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3222,7 +3353,7 @@ func (m *RoleMapping) Reset()         { *m = RoleMapping{} }
 func (m *RoleMapping) String() string { return proto.CompactTextString(m) }
 func (*RoleMapping) ProtoMessage()    {}
 func (*RoleMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{49}
+	return fileDescriptor_9198ee693835762e, []int{51}
 }
 func (m *RoleMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3270,7 +3401,7 @@ type ProvisionTokenV1 struct {
 func (m *ProvisionTokenV1) Reset()      { *m = ProvisionTokenV1{} }
 func (*ProvisionTokenV1) ProtoMessage() {}
 func (*ProvisionTokenV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{50}
+	return fileDescriptor_9198ee693835762e, []int{52}
 }
 func (m *ProvisionTokenV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3319,7 +3450,7 @@ type ProvisionTokenV2 struct {
 func (m *ProvisionTokenV2) Reset()      { *m = ProvisionTokenV2{} }
 func (*ProvisionTokenV2) ProtoMessage() {}
 func (*ProvisionTokenV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{51}
+	return fileDescriptor_9198ee693835762e, []int{53}
 }
 func (m *ProvisionTokenV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3361,7 +3492,7 @@ func (m *ProvisionTokenV2List) Reset()         { *m = ProvisionTokenV2List{} }
 func (m *ProvisionTokenV2List) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenV2List) ProtoMessage()    {}
 func (*ProvisionTokenV2List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{52}
+	return fileDescriptor_9198ee693835762e, []int{54}
 }
 func (m *ProvisionTokenV2List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3413,7 +3544,7 @@ func (m *TokenRule) Reset()         { *m = TokenRule{} }
 func (m *TokenRule) String() string { return proto.CompactTextString(m) }
 func (*TokenRule) ProtoMessage()    {}
 func (*TokenRule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{53}
+	return fileDescriptor_9198ee693835762e, []int{55}
 }
 func (m *TokenRule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3489,7 +3620,7 @@ func (m *ProvisionTokenSpecV2) Reset()         { *m = ProvisionTokenSpecV2{} }
 func (m *ProvisionTokenSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{54}
+	return fileDescriptor_9198ee693835762e, []int{56}
 }
 func (m *ProvisionTokenSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3542,7 +3673,7 @@ func (m *ProvisionTokenSpecV2GitHub) Reset()         { *m = ProvisionTokenSpecV2
 func (m *ProvisionTokenSpecV2GitHub) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GitHub) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GitHub) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{55}
+	return fileDescriptor_9198ee693835762e, []int{57}
 }
 func (m *ProvisionTokenSpecV2GitHub) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3604,7 +3735,7 @@ func (m *ProvisionTokenSpecV2GitHub_Rule) Reset()         { *m = ProvisionTokenS
 func (m *ProvisionTokenSpecV2GitHub_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GitHub_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GitHub_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{55, 0}
+	return fileDescriptor_9198ee693835762e, []int{57, 0}
 }
 func (m *ProvisionTokenSpecV2GitHub_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3652,7 +3783,7 @@ func (m *ProvisionTokenSpecV2GitLab) Reset()         { *m = ProvisionTokenSpecV2
 func (m *ProvisionTokenSpecV2GitLab) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GitLab) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GitLab) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{56}
+	return fileDescriptor_9198ee693835762e, []int{58}
 }
 func (m *ProvisionTokenSpecV2GitLab) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3718,7 +3849,7 @@ func (m *ProvisionTokenSpecV2GitLab_Rule) Reset()         { *m = ProvisionTokenS
 func (m *ProvisionTokenSpecV2GitLab_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GitLab_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GitLab_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{56, 0}
+	return fileDescriptor_9198ee693835762e, []int{58, 0}
 }
 func (m *ProvisionTokenSpecV2GitLab_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3763,7 +3894,7 @@ func (m *ProvisionTokenSpecV2CircleCI) Reset()         { *m = ProvisionTokenSpec
 func (m *ProvisionTokenSpecV2CircleCI) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2CircleCI) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2CircleCI) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{57}
+	return fileDescriptor_9198ee693835762e, []int{59}
 }
 func (m *ProvisionTokenSpecV2CircleCI) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3804,7 +3935,7 @@ func (m *ProvisionTokenSpecV2CircleCI_Rule) Reset()         { *m = ProvisionToke
 func (m *ProvisionTokenSpecV2CircleCI_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2CircleCI_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2CircleCI_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{57, 0}
+	return fileDescriptor_9198ee693835762e, []int{59, 0}
 }
 func (m *ProvisionTokenSpecV2CircleCI_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3848,7 +3979,7 @@ func (m *ProvisionTokenSpecV2Kubernetes) Reset()         { *m = ProvisionTokenSp
 func (m *ProvisionTokenSpecV2Kubernetes) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Kubernetes) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Kubernetes) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{58}
+	return fileDescriptor_9198ee693835762e, []int{60}
 }
 func (m *ProvisionTokenSpecV2Kubernetes) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3892,7 +4023,7 @@ func (m *ProvisionTokenSpecV2Kubernetes_Rule) Reset()         { *m = ProvisionTo
 func (m *ProvisionTokenSpecV2Kubernetes_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Kubernetes_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Kubernetes_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{58, 0}
+	return fileDescriptor_9198ee693835762e, []int{60, 0}
 }
 func (m *ProvisionTokenSpecV2Kubernetes_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3936,7 +4067,7 @@ func (m *ProvisionTokenSpecV2Azure) Reset()         { *m = ProvisionTokenSpecV2A
 func (m *ProvisionTokenSpecV2Azure) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Azure) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Azure) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{59}
+	return fileDescriptor_9198ee693835762e, []int{61}
 }
 func (m *ProvisionTokenSpecV2Azure) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -3982,7 +4113,7 @@ func (m *ProvisionTokenSpecV2Azure_Rule) Reset()         { *m = ProvisionTokenSp
 func (m *ProvisionTokenSpecV2Azure_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2Azure_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2Azure_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{59, 0}
+	return fileDescriptor_9198ee693835762e, []int{61, 0}
 }
 func (m *ProvisionTokenSpecV2Azure_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4026,7 +4157,7 @@ func (m *ProvisionTokenSpecV2GCP) Reset()         { *m = ProvisionTokenSpecV2GCP
 func (m *ProvisionTokenSpecV2GCP) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GCP) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GCP) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{60}
+	return fileDescriptor_9198ee693835762e, []int{62}
 }
 func (m *ProvisionTokenSpecV2GCP) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4075,7 +4206,7 @@ func (m *ProvisionTokenSpecV2GCP_Rule) Reset()         { *m = ProvisionTokenSpec
 func (m *ProvisionTokenSpecV2GCP_Rule) String() string { return proto.CompactTextString(m) }
 func (*ProvisionTokenSpecV2GCP_Rule) ProtoMessage()    {}
 func (*ProvisionTokenSpecV2GCP_Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{60, 0}
+	return fileDescriptor_9198ee693835762e, []int{62, 0}
 }
 func (m *ProvisionTokenSpecV2GCP_Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4124,7 +4255,7 @@ type StaticTokensV2 struct {
 func (m *StaticTokensV2) Reset()      { *m = StaticTokensV2{} }
 func (*StaticTokensV2) ProtoMessage() {}
 func (*StaticTokensV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{61}
+	return fileDescriptor_9198ee693835762e, []int{63}
 }
 func (m *StaticTokensV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4167,7 +4298,7 @@ func (m *StaticTokensSpecV2) Reset()         { *m = StaticTokensSpecV2{} }
 func (m *StaticTokensSpecV2) String() string { return proto.CompactTextString(m) }
 func (*StaticTokensSpecV2) ProtoMessage()    {}
 func (*StaticTokensSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{62}
+	return fileDescriptor_9198ee693835762e, []int{64}
 }
 func (m *StaticTokensSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4216,7 +4347,7 @@ type ClusterNameV2 struct {
 func (m *ClusterNameV2) Reset()      { *m = ClusterNameV2{} }
 func (*ClusterNameV2) ProtoMessage() {}
 func (*ClusterNameV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{63}
+	return fileDescriptor_9198ee693835762e, []int{65}
 }
 func (m *ClusterNameV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4262,7 +4393,7 @@ func (m *ClusterNameSpecV2) Reset()         { *m = ClusterNameSpecV2{} }
 func (m *ClusterNameSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ClusterNameSpecV2) ProtoMessage()    {}
 func (*ClusterNameSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{64}
+	return fileDescriptor_9198ee693835762e, []int{66}
 }
 func (m *ClusterNameSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4312,7 +4443,7 @@ func (m *ClusterAuditConfigV2) Reset()         { *m = ClusterAuditConfigV2{} }
 func (m *ClusterAuditConfigV2) String() string { return proto.CompactTextString(m) }
 func (*ClusterAuditConfigV2) ProtoMessage()    {}
 func (*ClusterAuditConfigV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{65}
+	return fileDescriptor_9198ee693835762e, []int{67}
 }
 func (m *ClusterAuditConfigV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4382,7 +4513,7 @@ func (m *ClusterAuditConfigSpecV2) Reset()         { *m = ClusterAuditConfigSpec
 func (m *ClusterAuditConfigSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ClusterAuditConfigSpecV2) ProtoMessage()    {}
 func (*ClusterAuditConfigSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{66}
+	return fileDescriptor_9198ee693835762e, []int{68}
 }
 func (m *ClusterAuditConfigSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4432,7 +4563,7 @@ func (m *ClusterNetworkingConfigV2) Reset()         { *m = ClusterNetworkingConf
 func (m *ClusterNetworkingConfigV2) String() string { return proto.CompactTextString(m) }
 func (*ClusterNetworkingConfigV2) ProtoMessage()    {}
 func (*ClusterNetworkingConfigV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{67}
+	return fileDescriptor_9198ee693835762e, []int{69}
 }
 func (m *ClusterNetworkingConfigV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4501,7 +4632,7 @@ func (m *ClusterNetworkingConfigSpecV2) Reset()         { *m = ClusterNetworking
 func (m *ClusterNetworkingConfigSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ClusterNetworkingConfigSpecV2) ProtoMessage()    {}
 func (*ClusterNetworkingConfigSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{68}
+	return fileDescriptor_9198ee693835762e, []int{70}
 }
 func (m *ClusterNetworkingConfigSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4545,7 +4676,7 @@ func (m *TunnelStrategyV1) Reset()         { *m = TunnelStrategyV1{} }
 func (m *TunnelStrategyV1) String() string { return proto.CompactTextString(m) }
 func (*TunnelStrategyV1) ProtoMessage()    {}
 func (*TunnelStrategyV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{69}
+	return fileDescriptor_9198ee693835762e, []int{71}
 }
 func (m *TunnelStrategyV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4630,7 +4761,7 @@ func (m *AgentMeshTunnelStrategy) Reset()         { *m = AgentMeshTunnelStrategy
 func (m *AgentMeshTunnelStrategy) String() string { return proto.CompactTextString(m) }
 func (*AgentMeshTunnelStrategy) ProtoMessage()    {}
 func (*AgentMeshTunnelStrategy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{70}
+	return fileDescriptor_9198ee693835762e, []int{72}
 }
 func (m *AgentMeshTunnelStrategy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4671,7 +4802,7 @@ func (m *ProxyPeeringTunnelStrategy) Reset()         { *m = ProxyPeeringTunnelSt
 func (m *ProxyPeeringTunnelStrategy) String() string { return proto.CompactTextString(m) }
 func (*ProxyPeeringTunnelStrategy) ProtoMessage()    {}
 func (*ProxyPeeringTunnelStrategy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{71}
+	return fileDescriptor_9198ee693835762e, []int{73}
 }
 func (m *ProxyPeeringTunnelStrategy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4721,7 +4852,7 @@ func (m *SessionRecordingConfigV2) Reset()         { *m = SessionRecordingConfig
 func (m *SessionRecordingConfigV2) String() string { return proto.CompactTextString(m) }
 func (*SessionRecordingConfigV2) ProtoMessage()    {}
 func (*SessionRecordingConfigV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{72}
+	return fileDescriptor_9198ee693835762e, []int{74}
 }
 func (m *SessionRecordingConfigV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4767,7 +4898,7 @@ func (m *SessionRecordingConfigSpecV2) Reset()         { *m = SessionRecordingCo
 func (m *SessionRecordingConfigSpecV2) String() string { return proto.CompactTextString(m) }
 func (*SessionRecordingConfigSpecV2) ProtoMessage()    {}
 func (*SessionRecordingConfigSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{73}
+	return fileDescriptor_9198ee693835762e, []int{75}
 }
 func (m *SessionRecordingConfigSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4816,7 +4947,7 @@ type AuthPreferenceV2 struct {
 func (m *AuthPreferenceV2) Reset()      { *m = AuthPreferenceV2{} }
 func (*AuthPreferenceV2) ProtoMessage() {}
 func (*AuthPreferenceV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{74}
+	return fileDescriptor_9198ee693835762e, []int{76}
 }
 func (m *AuthPreferenceV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4883,17 +5014,20 @@ type AuthPreferenceSpecV2 struct {
 	// Headless authentication requires Webauthn to work.
 	// Defaults to true if the Webauthn is configured, defaults to false
 	// otherwise.
-	AllowHeadless        *BoolOption `protobuf:"bytes,15,opt,name=AllowHeadless,proto3,customtype=BoolOption" json:"allow_headless,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}    `json:"-"`
-	XXX_unrecognized     []byte      `json:"-"`
-	XXX_sizecache        int32       `json:"-"`
+	AllowHeadless *BoolOption `protobuf:"bytes,15,opt,name=AllowHeadless,proto3,customtype=BoolOption" json:"allow_headless,omitempty"`
+	// DefaultSessionTTL is the TTL to use for user certs when
+	// an explicit TTL is not requested.
+	DefaultSessionTTL    Duration `protobuf:"varint,16,opt,name=DefaultSessionTTL,proto3,casttype=Duration" json:"default_session_ttl,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *AuthPreferenceSpecV2) Reset()         { *m = AuthPreferenceSpecV2{} }
 func (m *AuthPreferenceSpecV2) String() string { return proto.CompactTextString(m) }
 func (*AuthPreferenceSpecV2) ProtoMessage()    {}
 func (*AuthPreferenceSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{75}
+	return fileDescriptor_9198ee693835762e, []int{77}
 }
 func (m *AuthPreferenceSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4944,7 +5078,7 @@ func (m *U2F) Reset()         { *m = U2F{} }
 func (m *U2F) String() string { return proto.CompactTextString(m) }
 func (*U2F) ProtoMessage()    {}
 func (*U2F) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{76}
+	return fileDescriptor_9198ee693835762e, []int{78}
 }
 func (m *U2F) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5012,7 +5146,7 @@ func (m *Webauthn) Reset()         { *m = Webauthn{} }
 func (m *Webauthn) String() string { return proto.CompactTextString(m) }
 func (*Webauthn) ProtoMessage()    {}
 func (*Webauthn) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{77}
+	return fileDescriptor_9198ee693835762e, []int{79}
 }
 func (m *Webauthn) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5083,7 +5217,7 @@ func (m *DeviceTrust) Reset()         { *m = DeviceTrust{} }
 func (m *DeviceTrust) String() string { return proto.CompactTextString(m) }
 func (*DeviceTrust) ProtoMessage()    {}
 func (*DeviceTrust) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{78}
+	return fileDescriptor_9198ee693835762e, []int{80}
 }
 func (m *DeviceTrust) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5133,7 +5267,7 @@ func (m *Namespace) Reset()         { *m = Namespace{} }
 func (m *Namespace) String() string { return proto.CompactTextString(m) }
 func (*Namespace) ProtoMessage()    {}
 func (*Namespace) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{79}
+	return fileDescriptor_9198ee693835762e, []int{81}
 }
 func (m *Namespace) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5173,7 +5307,7 @@ func (m *NamespaceSpec) Reset()         { *m = NamespaceSpec{} }
 func (m *NamespaceSpec) String() string { return proto.CompactTextString(m) }
 func (*NamespaceSpec) ProtoMessage()    {}
 func (*NamespaceSpec) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{80}
+	return fileDescriptor_9198ee693835762e, []int{82}
 }
 func (m *NamespaceSpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5221,7 +5355,7 @@ type UserTokenV3 struct {
 func (m *UserTokenV3) Reset()      { *m = UserTokenV3{} }
 func (*UserTokenV3) ProtoMessage() {}
 func (*UserTokenV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{81}
+	return fileDescriptor_9198ee693835762e, []int{83}
 }
 func (m *UserTokenV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5268,7 +5402,7 @@ func (m *UserTokenSpecV3) Reset()         { *m = UserTokenSpecV3{} }
 func (m *UserTokenSpecV3) String() string { return proto.CompactTextString(m) }
 func (*UserTokenSpecV3) ProtoMessage()    {}
 func (*UserTokenSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{82}
+	return fileDescriptor_9198ee693835762e, []int{84}
 }
 func (m *UserTokenSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5316,7 +5450,7 @@ type UserTokenSecretsV3 struct {
 func (m *UserTokenSecretsV3) Reset()      { *m = UserTokenSecretsV3{} }
 func (*UserTokenSecretsV3) ProtoMessage() {}
 func (*UserTokenSecretsV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{83}
+	return fileDescriptor_9198ee693835762e, []int{85}
 }
 func (m *UserTokenSecretsV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5361,7 +5495,7 @@ func (m *UserTokenSecretsSpecV3) Reset()         { *m = UserTokenSecretsSpecV3{}
 func (m *UserTokenSecretsSpecV3) String() string { return proto.CompactTextString(m) }
 func (*UserTokenSecretsSpecV3) ProtoMessage()    {}
 func (*UserTokenSecretsSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{84}
+	return fileDescriptor_9198ee693835762e, []int{86}
 }
 func (m *UserTokenSecretsSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5410,7 +5544,7 @@ type AccessRequestV3 struct {
 func (m *AccessRequestV3) Reset()      { *m = AccessRequestV3{} }
 func (*AccessRequestV3) ProtoMessage() {}
 func (*AccessRequestV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{85}
+	return fileDescriptor_9198ee693835762e, []int{87}
 }
 func (m *AccessRequestV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5462,7 +5596,7 @@ func (m *AccessReviewThreshold) Reset()         { *m = AccessReviewThreshold{} }
 func (m *AccessReviewThreshold) String() string { return proto.CompactTextString(m) }
 func (*AccessReviewThreshold) ProtoMessage()    {}
 func (*AccessReviewThreshold) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{86}
+	return fileDescriptor_9198ee693835762e, []int{88}
 }
 func (m *AccessReviewThreshold) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5518,7 +5652,7 @@ func (m *AccessReview) Reset()         { *m = AccessReview{} }
 func (m *AccessReview) String() string { return proto.CompactTextString(m) }
 func (*AccessReview) ProtoMessage()    {}
 func (*AccessReview) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{87}
+	return fileDescriptor_9198ee693835762e, []int{89}
 }
 func (m *AccessReview) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5563,7 +5697,7 @@ func (m *AccessReviewSubmission) Reset()         { *m = AccessReviewSubmission{}
 func (m *AccessReviewSubmission) String() string { return proto.CompactTextString(m) }
 func (*AccessReviewSubmission) ProtoMessage()    {}
 func (*AccessReviewSubmission) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{88}
+	return fileDescriptor_9198ee693835762e, []int{90}
 }
 func (m *AccessReviewSubmission) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5606,7 +5740,7 @@ func (m *ThresholdIndexSet) Reset()         { *m = ThresholdIndexSet{} }
 func (m *ThresholdIndexSet) String() string { return proto.CompactTextString(m) }
 func (*ThresholdIndexSet) ProtoMessage()    {}
 func (*ThresholdIndexSet) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{89}
+	return fileDescriptor_9198ee693835762e, []int{91}
 }
 func (m *ThresholdIndexSet) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5649,7 +5783,7 @@ func (m *ThresholdIndexSets) Reset()         { *m = ThresholdIndexSets{} }
 func (m *ThresholdIndexSets) String() string { return proto.CompactTextString(m) }
 func (*ThresholdIndexSets) ProtoMessage()    {}
 func (*ThresholdIndexSets) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{90}
+	return fileDescriptor_9198ee693835762e, []int{92}
 }
 func (m *ThresholdIndexSets) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5742,7 +5876,7 @@ func (m *AccessRequestSpecV3) Reset()         { *m = AccessRequestSpecV3{} }
 func (m *AccessRequestSpecV3) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestSpecV3) ProtoMessage()    {}
 func (*AccessRequestSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{91}
+	return fileDescriptor_9198ee693835762e, []int{93}
 }
 func (m *AccessRequestSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5788,7 +5922,7 @@ func (m *AccessRequestFilter) Reset()         { *m = AccessRequestFilter{} }
 func (m *AccessRequestFilter) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestFilter) ProtoMessage()    {}
 func (*AccessRequestFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{92}
+	return fileDescriptor_9198ee693835762e, []int{94}
 }
 func (m *AccessRequestFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5844,7 +5978,7 @@ func (m *AccessCapabilities) Reset()         { *m = AccessCapabilities{} }
 func (m *AccessCapabilities) String() string { return proto.CompactTextString(m) }
 func (*AccessCapabilities) ProtoMessage()    {}
 func (*AccessCapabilities) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{93}
+	return fileDescriptor_9198ee693835762e, []int{95}
 }
 func (m *AccessCapabilities) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5896,7 +6030,7 @@ func (m *AccessCapabilitiesRequest) Reset()         { *m = AccessCapabilitiesReq
 func (m *AccessCapabilitiesRequest) String() string { return proto.CompactTextString(m) }
 func (*AccessCapabilitiesRequest) ProtoMessage()    {}
 func (*AccessCapabilitiesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{94}
+	return fileDescriptor_9198ee693835762e, []int{96}
 }
 func (m *AccessCapabilitiesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5948,7 +6082,7 @@ func (m *ResourceID) Reset()         { *m = ResourceID{} }
 func (m *ResourceID) String() string { return proto.CompactTextString(m) }
 func (*ResourceID) ProtoMessage()    {}
 func (*ResourceID) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{95}
+	return fileDescriptor_9198ee693835762e, []int{97}
 }
 func (m *ResourceID) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5997,7 +6131,7 @@ type PluginDataV3 struct {
 func (m *PluginDataV3) Reset()      { *m = PluginDataV3{} }
 func (*PluginDataV3) ProtoMessage() {}
 func (*PluginDataV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{96}
+	return fileDescriptor_9198ee693835762e, []int{98}
 }
 func (m *PluginDataV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6040,7 +6174,7 @@ func (m *PluginDataEntry) Reset()         { *m = PluginDataEntry{} }
 func (m *PluginDataEntry) String() string { return proto.CompactTextString(m) }
 func (*PluginDataEntry) ProtoMessage()    {}
 func (*PluginDataEntry) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{97}
+	return fileDescriptor_9198ee693835762e, []int{99}
 }
 func (m *PluginDataEntry) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6082,7 +6216,7 @@ func (m *PluginDataSpecV3) Reset()         { *m = PluginDataSpecV3{} }
 func (m *PluginDataSpecV3) String() string { return proto.CompactTextString(m) }
 func (*PluginDataSpecV3) ProtoMessage()    {}
 func (*PluginDataSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{98}
+	return fileDescriptor_9198ee693835762e, []int{100}
 }
 func (m *PluginDataSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6129,7 +6263,7 @@ func (m *PluginDataFilter) Reset()         { *m = PluginDataFilter{} }
 func (m *PluginDataFilter) String() string { return proto.CompactTextString(m) }
 func (*PluginDataFilter) ProtoMessage()    {}
 func (*PluginDataFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{99}
+	return fileDescriptor_9198ee693835762e, []int{101}
 }
 func (m *PluginDataFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6180,7 +6314,7 @@ func (m *PluginDataUpdateParams) Reset()         { *m = PluginDataUpdateParams{}
 func (m *PluginDataUpdateParams) String() string { return proto.CompactTextString(m) }
 func (*PluginDataUpdateParams) ProtoMessage()    {}
 func (*PluginDataUpdateParams) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{100}
+	return fileDescriptor_9198ee693835762e, []int{102}
 }
 func (m *PluginDataUpdateParams) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6229,7 +6363,7 @@ type RoleV6 struct {
 func (m *RoleV6) Reset()      { *m = RoleV6{} }
 func (*RoleV6) ProtoMessage() {}
 func (*RoleV6) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{101}
+	return fileDescriptor_9198ee693835762e, []int{103}
 }
 func (m *RoleV6) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6276,7 +6410,7 @@ func (m *RoleSpecV6) Reset()         { *m = RoleSpecV6{} }
 func (m *RoleSpecV6) String() string { return proto.CompactTextString(m) }
 func (*RoleSpecV6) ProtoMessage()    {}
 func (*RoleSpecV6) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{102}
+	return fileDescriptor_9198ee693835762e, []int{104}
 }
 func (m *RoleSpecV6) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6360,7 +6494,7 @@ type RoleOptions struct {
 	// true.
 	DesktopDirectorySharing *BoolOption `protobuf:"bytes,19,opt,name=DesktopDirectorySharing,proto3,customtype=BoolOption" json:"desktop_directory_sharing"`
 	// CreateHostUser allows users to be automatically created on a host
-	CreateHostUser *BoolOption `protobuf:"bytes,20,opt,name=CreateHostUser,proto3,customtype=BoolOption" json:"create_host_user"`
+	CreateHostUser *BoolOption `protobuf:"bytes,20,opt,name=CreateHostUser,proto3,customtype=BoolOption" json:"create_host_user,omitempty"`
 	// PinSourceIP forces the same client IP for certificate generation and usage
 	PinSourceIP Bool `protobuf:"varint,21,opt,name=PinSourceIP,proto3,casttype=Bool" json:"pin_source_ip"`
 	// SSHFileCopy indicates whether remote file operations via SCP or SFTP are allowed
@@ -6379,17 +6513,20 @@ type RoleOptions struct {
 	// CreateDesktopUser allows users to be automatically created on a Windows desktop
 	CreateDesktopUser *BoolOption `protobuf:"bytes,26,opt,name=CreateDesktopUser,proto3,customtype=BoolOption" json:"create_desktop_user"`
 	// CreateDatabaseUser enabled automatic database user creation.
-	CreateDatabaseUser   *BoolOption `protobuf:"bytes,27,opt,name=CreateDatabaseUser,proto3,customtype=BoolOption" json:"create_db_user"`
-	XXX_NoUnkeyedLiteral struct{}    `json:"-"`
-	XXX_unrecognized     []byte      `json:"-"`
-	XXX_sizecache        int32       `json:"-"`
+	CreateDatabaseUser *BoolOption `protobuf:"bytes,27,opt,name=CreateDatabaseUser,proto3,customtype=BoolOption" json:"create_db_user"`
+	// CreateHostUserMode allows users to be automatically created on a
+	// host when not set to off
+	CreateHostUserMode   CreateHostUserMode `protobuf:"varint,28,opt,name=CreateHostUserMode,proto3,enum=types.CreateHostUserMode" json:"create_host_user_mode,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}           `json:"-"`
+	XXX_unrecognized     []byte             `json:"-"`
+	XXX_sizecache        int32              `json:"-"`
 }
 
 func (m *RoleOptions) Reset()         { *m = RoleOptions{} }
 func (m *RoleOptions) String() string { return proto.CompactTextString(m) }
 func (*RoleOptions) ProtoMessage()    {}
 func (*RoleOptions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{103}
+	return fileDescriptor_9198ee693835762e, []int{105}
 }
 func (m *RoleOptions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6435,7 +6572,7 @@ func (m *RecordSession) Reset()         { *m = RecordSession{} }
 func (m *RecordSession) String() string { return proto.CompactTextString(m) }
 func (*RecordSession) ProtoMessage()    {}
 func (*RecordSession) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{104}
+	return fileDescriptor_9198ee693835762e, []int{106}
 }
 func (m *RecordSession) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6485,7 +6622,7 @@ func (m *CertExtension) Reset()         { *m = CertExtension{} }
 func (m *CertExtension) String() string { return proto.CompactTextString(m) }
 func (*CertExtension) ProtoMessage()    {}
 func (*CertExtension) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{105}
+	return fileDescriptor_9198ee693835762e, []int{107}
 }
 func (m *CertExtension) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6612,7 +6749,7 @@ func (m *RoleConditions) Reset()         { *m = RoleConditions{} }
 func (m *RoleConditions) String() string { return proto.CompactTextString(m) }
 func (*RoleConditions) ProtoMessage()    {}
 func (*RoleConditions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{106}
+	return fileDescriptor_9198ee693835762e, []int{108}
 }
 func (m *RoleConditions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6661,7 +6798,7 @@ func (m *KubernetesResource) Reset()         { *m = KubernetesResource{} }
 func (m *KubernetesResource) String() string { return proto.CompactTextString(m) }
 func (*KubernetesResource) ProtoMessage()    {}
 func (*KubernetesResource) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{107}
+	return fileDescriptor_9198ee693835762e, []int{109}
 }
 func (m *KubernetesResource) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6714,7 +6851,7 @@ func (m *SessionRequirePolicy) Reset()         { *m = SessionRequirePolicy{} }
 func (m *SessionRequirePolicy) String() string { return proto.CompactTextString(m) }
 func (*SessionRequirePolicy) ProtoMessage()    {}
 func (*SessionRequirePolicy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{108}
+	return fileDescriptor_9198ee693835762e, []int{110}
 }
 func (m *SessionRequirePolicy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6762,7 +6899,7 @@ func (m *SessionJoinPolicy) Reset()         { *m = SessionJoinPolicy{} }
 func (m *SessionJoinPolicy) String() string { return proto.CompactTextString(m) }
 func (*SessionJoinPolicy) ProtoMessage()    {}
 func (*SessionJoinPolicy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{109}
+	return fileDescriptor_9198ee693835762e, []int{111}
 }
 func (m *SessionJoinPolicy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6828,7 +6965,7 @@ func (m *AccessRequestConditions) Reset()         { *m = AccessRequestConditions
 func (m *AccessRequestConditions) String() string { return proto.CompactTextString(m) }
 func (*AccessRequestConditions) ProtoMessage()    {}
 func (*AccessRequestConditions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{110}
+	return fileDescriptor_9198ee693835762e, []int{112}
 }
 func (m *AccessRequestConditions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6881,7 +7018,7 @@ func (m *AccessReviewConditions) Reset()         { *m = AccessReviewConditions{}
 func (m *AccessReviewConditions) String() string { return proto.CompactTextString(m) }
 func (*AccessReviewConditions) ProtoMessage()    {}
 func (*AccessReviewConditions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{111}
+	return fileDescriptor_9198ee693835762e, []int{113}
 }
 func (m *AccessReviewConditions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6927,7 +7064,7 @@ func (m *ClaimMapping) Reset()         { *m = ClaimMapping{} }
 func (m *ClaimMapping) String() string { return proto.CompactTextString(m) }
 func (*ClaimMapping) ProtoMessage()    {}
 func (*ClaimMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{112}
+	return fileDescriptor_9198ee693835762e, []int{114}
 }
 func (m *ClaimMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6973,7 +7110,7 @@ func (m *TraitMapping) Reset()         { *m = TraitMapping{} }
 func (m *TraitMapping) String() string { return proto.CompactTextString(m) }
 func (*TraitMapping) ProtoMessage()    {}
 func (*TraitMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{113}
+	return fileDescriptor_9198ee693835762e, []int{115}
 }
 func (m *TraitMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7022,7 +7159,7 @@ func (m *Rule) Reset()         { *m = Rule{} }
 func (m *Rule) String() string { return proto.CompactTextString(m) }
 func (*Rule) ProtoMessage()    {}
 func (*Rule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{114}
+	return fileDescriptor_9198ee693835762e, []int{116}
 }
 func (m *Rule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7070,7 +7207,7 @@ func (m *ImpersonateConditions) Reset()         { *m = ImpersonateConditions{} }
 func (m *ImpersonateConditions) String() string { return proto.CompactTextString(m) }
 func (*ImpersonateConditions) ProtoMessage()    {}
 func (*ImpersonateConditions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{115}
+	return fileDescriptor_9198ee693835762e, []int{117}
 }
 func (m *ImpersonateConditions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7112,7 +7249,7 @@ func (m *BoolValue) Reset()         { *m = BoolValue{} }
 func (m *BoolValue) String() string { return proto.CompactTextString(m) }
 func (*BoolValue) ProtoMessage()    {}
 func (*BoolValue) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{116}
+	return fileDescriptor_9198ee693835762e, []int{118}
 }
 func (m *BoolValue) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7161,7 +7298,7 @@ type UserV2 struct {
 func (m *UserV2) Reset()      { *m = UserV2{} }
 func (*UserV2) ProtoMessage() {}
 func (*UserV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{117}
+	return fileDescriptor_9198ee693835762e, []int{119}
 }
 func (m *UserV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7225,7 +7362,7 @@ func (m *UserSpecV2) Reset()         { *m = UserSpecV2{} }
 func (m *UserSpecV2) String() string { return proto.CompactTextString(m) }
 func (*UserSpecV2) ProtoMessage()    {}
 func (*UserSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{118}
+	return fileDescriptor_9198ee693835762e, []int{120}
 }
 func (m *UserSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7270,7 +7407,7 @@ type ExternalIdentity struct {
 func (m *ExternalIdentity) Reset()      { *m = ExternalIdentity{} }
 func (*ExternalIdentity) ProtoMessage() {}
 func (*ExternalIdentity) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{119}
+	return fileDescriptor_9198ee693835762e, []int{121}
 }
 func (m *ExternalIdentity) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7322,7 +7459,7 @@ func (m *LoginStatus) Reset()         { *m = LoginStatus{} }
 func (m *LoginStatus) String() string { return proto.CompactTextString(m) }
 func (*LoginStatus) ProtoMessage()    {}
 func (*LoginStatus) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{120}
+	return fileDescriptor_9198ee693835762e, []int{122}
 }
 func (m *LoginStatus) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7367,7 +7504,7 @@ type CreatedBy struct {
 func (m *CreatedBy) Reset()      { *m = CreatedBy{} }
 func (*CreatedBy) ProtoMessage() {}
 func (*CreatedBy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{121}
+	return fileDescriptor_9198ee693835762e, []int{123}
 }
 func (m *CreatedBy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7416,7 +7553,7 @@ func (m *LocalAuthSecrets) Reset()         { *m = LocalAuthSecrets{} }
 func (m *LocalAuthSecrets) String() string { return proto.CompactTextString(m) }
 func (*LocalAuthSecrets) ProtoMessage()    {}
 func (*LocalAuthSecrets) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{122}
+	return fileDescriptor_9198ee693835762e, []int{124}
 }
 func (m *LocalAuthSecrets) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7472,7 +7609,7 @@ func (m *MFADevice) Reset()         { *m = MFADevice{} }
 func (m *MFADevice) String() string { return proto.CompactTextString(m) }
 func (*MFADevice) ProtoMessage()    {}
 func (*MFADevice) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{123}
+	return fileDescriptor_9198ee693835762e, []int{125}
 }
 func (m *MFADevice) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7570,7 +7707,7 @@ func (m *TOTPDevice) Reset()         { *m = TOTPDevice{} }
 func (m *TOTPDevice) String() string { return proto.CompactTextString(m) }
 func (*TOTPDevice) ProtoMessage()    {}
 func (*TOTPDevice) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{124}
+	return fileDescriptor_9198ee693835762e, []int{126}
 }
 func (m *TOTPDevice) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7616,7 +7753,7 @@ func (m *U2FDevice) Reset()         { *m = U2FDevice{} }
 func (m *U2FDevice) String() string { return proto.CompactTextString(m) }
 func (*U2FDevice) ProtoMessage()    {}
 func (*U2FDevice) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{125}
+	return fileDescriptor_9198ee693835762e, []int{127}
 }
 func (m *U2FDevice) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7690,7 +7827,7 @@ func (m *WebauthnDevice) Reset()         { *m = WebauthnDevice{} }
 func (m *WebauthnDevice) String() string { return proto.CompactTextString(m) }
 func (*WebauthnDevice) ProtoMessage()    {}
 func (*WebauthnDevice) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{126}
+	return fileDescriptor_9198ee693835762e, []int{128}
 }
 func (m *WebauthnDevice) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7733,7 +7870,7 @@ func (m *WebauthnLocalAuth) Reset()         { *m = WebauthnLocalAuth{} }
 func (m *WebauthnLocalAuth) String() string { return proto.CompactTextString(m) }
 func (*WebauthnLocalAuth) ProtoMessage()    {}
 func (*WebauthnLocalAuth) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{127}
+	return fileDescriptor_9198ee693835762e, []int{129}
 }
 func (m *WebauthnLocalAuth) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7779,7 +7916,7 @@ func (m *ConnectorRef) Reset()         { *m = ConnectorRef{} }
 func (m *ConnectorRef) String() string { return proto.CompactTextString(m) }
 func (*ConnectorRef) ProtoMessage()    {}
 func (*ConnectorRef) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{128}
+	return fileDescriptor_9198ee693835762e, []int{130}
 }
 func (m *ConnectorRef) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7821,7 +7958,7 @@ func (m *UserRef) Reset()         { *m = UserRef{} }
 func (m *UserRef) String() string { return proto.CompactTextString(m) }
 func (*UserRef) ProtoMessage()    {}
 func (*UserRef) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{129}
+	return fileDescriptor_9198ee693835762e, []int{131}
 }
 func (m *UserRef) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7871,7 +8008,7 @@ func (m *ReverseTunnelV2) Reset()         { *m = ReverseTunnelV2{} }
 func (m *ReverseTunnelV2) String() string { return proto.CompactTextString(m) }
 func (*ReverseTunnelV2) ProtoMessage()    {}
 func (*ReverseTunnelV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{130}
+	return fileDescriptor_9198ee693835762e, []int{132}
 }
 func (m *ReverseTunnelV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7918,7 +8055,7 @@ func (m *ReverseTunnelSpecV2) Reset()         { *m = ReverseTunnelSpecV2{} }
 func (m *ReverseTunnelSpecV2) String() string { return proto.CompactTextString(m) }
 func (*ReverseTunnelSpecV2) ProtoMessage()    {}
 func (*ReverseTunnelSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{131}
+	return fileDescriptor_9198ee693835762e, []int{133}
 }
 func (m *ReverseTunnelSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -7967,7 +8104,7 @@ type TunnelConnectionV2 struct {
 func (m *TunnelConnectionV2) Reset()      { *m = TunnelConnectionV2{} }
 func (*TunnelConnectionV2) ProtoMessage() {}
 func (*TunnelConnectionV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{132}
+	return fileDescriptor_9198ee693835762e, []int{134}
 }
 func (m *TunnelConnectionV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8015,7 +8152,7 @@ func (m *TunnelConnectionSpecV2) Reset()         { *m = TunnelConnectionSpecV2{}
 func (m *TunnelConnectionSpecV2) String() string { return proto.CompactTextString(m) }
 func (*TunnelConnectionSpecV2) ProtoMessage()    {}
 func (*TunnelConnectionSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{133}
+	return fileDescriptor_9198ee693835762e, []int{135}
 }
 func (m *TunnelConnectionSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8063,7 +8200,7 @@ func (m *SemaphoreFilter) Reset()         { *m = SemaphoreFilter{} }
 func (m *SemaphoreFilter) String() string { return proto.CompactTextString(m) }
 func (*SemaphoreFilter) ProtoMessage()    {}
 func (*SemaphoreFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{134}
+	return fileDescriptor_9198ee693835762e, []int{136}
 }
 func (m *SemaphoreFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8114,7 +8251,7 @@ func (m *AcquireSemaphoreRequest) Reset()         { *m = AcquireSemaphoreRequest
 func (m *AcquireSemaphoreRequest) String() string { return proto.CompactTextString(m) }
 func (*AcquireSemaphoreRequest) ProtoMessage()    {}
 func (*AcquireSemaphoreRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{135}
+	return fileDescriptor_9198ee693835762e, []int{137}
 }
 func (m *AcquireSemaphoreRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8162,7 +8299,7 @@ func (m *SemaphoreLease) Reset()         { *m = SemaphoreLease{} }
 func (m *SemaphoreLease) String() string { return proto.CompactTextString(m) }
 func (*SemaphoreLease) ProtoMessage()    {}
 func (*SemaphoreLease) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{136}
+	return fileDescriptor_9198ee693835762e, []int{138}
 }
 func (m *SemaphoreLease) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8208,7 +8345,7 @@ func (m *SemaphoreLeaseRef) Reset()         { *m = SemaphoreLeaseRef{} }
 func (m *SemaphoreLeaseRef) String() string { return proto.CompactTextString(m) }
 func (*SemaphoreLeaseRef) ProtoMessage()    {}
 func (*SemaphoreLeaseRef) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{137}
+	return fileDescriptor_9198ee693835762e, []int{139}
 }
 func (m *SemaphoreLeaseRef) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8257,7 +8394,7 @@ type SemaphoreV3 struct {
 func (m *SemaphoreV3) Reset()      { *m = SemaphoreV3{} }
 func (*SemaphoreV3) ProtoMessage() {}
 func (*SemaphoreV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{138}
+	return fileDescriptor_9198ee693835762e, []int{140}
 }
 func (m *SemaphoreV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8299,7 +8436,7 @@ func (m *SemaphoreSpecV3) Reset()         { *m = SemaphoreSpecV3{} }
 func (m *SemaphoreSpecV3) String() string { return proto.CompactTextString(m) }
 func (*SemaphoreSpecV3) ProtoMessage()    {}
 func (*SemaphoreSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{139}
+	return fileDescriptor_9198ee693835762e, []int{141}
 }
 func (m *SemaphoreSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8348,7 +8485,7 @@ type WebSessionV2 struct {
 func (m *WebSessionV2) Reset()      { *m = WebSessionV2{} }
 func (*WebSessionV2) ProtoMessage() {}
 func (*WebSessionV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{140}
+	return fileDescriptor_9198ee693835762e, []int{142}
 }
 func (m *WebSessionV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8414,7 +8551,7 @@ func (m *WebSessionSpecV2) Reset()         { *m = WebSessionSpecV2{} }
 func (m *WebSessionSpecV2) String() string { return proto.CompactTextString(m) }
 func (*WebSessionSpecV2) ProtoMessage()    {}
 func (*WebSessionSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{141}
+	return fileDescriptor_9198ee693835762e, []int{143}
 }
 func (m *WebSessionSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8456,7 +8593,7 @@ func (m *WebSessionFilter) Reset()         { *m = WebSessionFilter{} }
 func (m *WebSessionFilter) String() string { return proto.CompactTextString(m) }
 func (*WebSessionFilter) ProtoMessage()    {}
 func (*WebSessionFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{142}
+	return fileDescriptor_9198ee693835762e, []int{144}
 }
 func (m *WebSessionFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8527,7 +8664,7 @@ func (m *SAMLSessionData) Reset()         { *m = SAMLSessionData{} }
 func (m *SAMLSessionData) String() string { return proto.CompactTextString(m) }
 func (*SAMLSessionData) ProtoMessage()    {}
 func (*SAMLSessionData) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{143}
+	return fileDescriptor_9198ee693835762e, []int{145}
 }
 func (m *SAMLSessionData) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8576,7 +8713,7 @@ func (m *SAMLAttribute) Reset()         { *m = SAMLAttribute{} }
 func (m *SAMLAttribute) String() string { return proto.CompactTextString(m) }
 func (*SAMLAttribute) ProtoMessage()    {}
 func (*SAMLAttribute) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{144}
+	return fileDescriptor_9198ee693835762e, []int{146}
 }
 func (m *SAMLAttribute) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8623,7 +8760,7 @@ func (m *SAMLAttributeValue) Reset()         { *m = SAMLAttributeValue{} }
 func (m *SAMLAttributeValue) String() string { return proto.CompactTextString(m) }
 func (*SAMLAttributeValue) ProtoMessage()    {}
 func (*SAMLAttributeValue) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{145}
+	return fileDescriptor_9198ee693835762e, []int{147}
 }
 func (m *SAMLAttributeValue) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8674,7 +8811,7 @@ func (m *SAMLNameID) Reset()         { *m = SAMLNameID{} }
 func (m *SAMLNameID) String() string { return proto.CompactTextString(m) }
 func (*SAMLNameID) ProtoMessage()    {}
 func (*SAMLNameID) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{146}
+	return fileDescriptor_9198ee693835762e, []int{148}
 }
 func (m *SAMLNameID) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8723,7 +8860,7 @@ type RemoteClusterV3 struct {
 func (m *RemoteClusterV3) Reset()      { *m = RemoteClusterV3{} }
 func (*RemoteClusterV3) ProtoMessage() {}
 func (*RemoteClusterV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{147}
+	return fileDescriptor_9198ee693835762e, []int{149}
 }
 func (m *RemoteClusterV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8767,7 +8904,7 @@ func (m *RemoteClusterStatusV3) Reset()         { *m = RemoteClusterStatusV3{} }
 func (m *RemoteClusterStatusV3) String() string { return proto.CompactTextString(m) }
 func (*RemoteClusterStatusV3) ProtoMessage()    {}
 func (*RemoteClusterStatusV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{148}
+	return fileDescriptor_9198ee693835762e, []int{150}
 }
 func (m *RemoteClusterStatusV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8817,7 +8954,7 @@ func (m *KubernetesCluster) Reset()         { *m = KubernetesCluster{} }
 func (m *KubernetesCluster) String() string { return proto.CompactTextString(m) }
 func (*KubernetesCluster) ProtoMessage()    {}
 func (*KubernetesCluster) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{149}
+	return fileDescriptor_9198ee693835762e, []int{151}
 }
 func (m *KubernetesCluster) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8866,7 +9003,7 @@ type KubernetesClusterV3 struct {
 func (m *KubernetesClusterV3) Reset()      { *m = KubernetesClusterV3{} }
 func (*KubernetesClusterV3) ProtoMessage() {}
 func (*KubernetesClusterV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{150}
+	return fileDescriptor_9198ee693835762e, []int{152}
 }
 func (m *KubernetesClusterV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8917,7 +9054,7 @@ func (m *KubernetesClusterSpecV3) Reset()         { *m = KubernetesClusterSpecV3
 func (m *KubernetesClusterSpecV3) String() string { return proto.CompactTextString(m) }
 func (*KubernetesClusterSpecV3) ProtoMessage()    {}
 func (*KubernetesClusterSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{151}
+	return fileDescriptor_9198ee693835762e, []int{153}
 }
 func (m *KubernetesClusterSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8965,7 +9102,7 @@ func (m *KubeAzure) Reset()         { *m = KubeAzure{} }
 func (m *KubeAzure) String() string { return proto.CompactTextString(m) }
 func (*KubeAzure) ProtoMessage()    {}
 func (*KubeAzure) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{152}
+	return fileDescriptor_9198ee693835762e, []int{154}
 }
 func (m *KubeAzure) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9011,7 +9148,7 @@ func (m *KubeAWS) Reset()         { *m = KubeAWS{} }
 func (m *KubeAWS) String() string { return proto.CompactTextString(m) }
 func (*KubeAWS) ProtoMessage()    {}
 func (*KubeAWS) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{153}
+	return fileDescriptor_9198ee693835762e, []int{155}
 }
 func (m *KubeAWS) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9057,7 +9194,7 @@ func (m *KubeGCP) Reset()         { *m = KubeGCP{} }
 func (m *KubeGCP) String() string { return proto.CompactTextString(m) }
 func (*KubeGCP) ProtoMessage()    {}
 func (*KubeGCP) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{154}
+	return fileDescriptor_9198ee693835762e, []int{156}
 }
 func (m *KubeGCP) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9099,7 +9236,7 @@ func (m *KubernetesClusterV3List) Reset()         { *m = KubernetesClusterV3List
 func (m *KubernetesClusterV3List) String() string { return proto.CompactTextString(m) }
 func (*KubernetesClusterV3List) ProtoMessage()    {}
 func (*KubernetesClusterV3List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{155}
+	return fileDescriptor_9198ee693835762e, []int{157}
 }
 func (m *KubernetesClusterV3List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9148,7 +9285,7 @@ type KubernetesServerV3 struct {
 func (m *KubernetesServerV3) Reset()      { *m = KubernetesServerV3{} }
 func (*KubernetesServerV3) ProtoMessage() {}
 func (*KubernetesServerV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{156}
+	return fileDescriptor_9198ee693835762e, []int{158}
 }
 func (m *KubernetesServerV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9200,7 +9337,7 @@ func (m *KubernetesServerSpecV3) Reset()         { *m = KubernetesServerSpecV3{}
 func (m *KubernetesServerSpecV3) String() string { return proto.CompactTextString(m) }
 func (*KubernetesServerSpecV3) ProtoMessage()    {}
 func (*KubernetesServerSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{157}
+	return fileDescriptor_9198ee693835762e, []int{159}
 }
 func (m *KubernetesServerSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9252,7 +9389,7 @@ type WebTokenV3 struct {
 func (m *WebTokenV3) Reset()      { *m = WebTokenV3{} }
 func (*WebTokenV3) ProtoMessage() {}
 func (*WebTokenV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{158}
+	return fileDescriptor_9198ee693835762e, []int{160}
 }
 func (m *WebTokenV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9296,7 +9433,7 @@ func (m *WebTokenSpecV3) Reset()         { *m = WebTokenSpecV3{} }
 func (m *WebTokenSpecV3) String() string { return proto.CompactTextString(m) }
 func (*WebTokenSpecV3) ProtoMessage()    {}
 func (*WebTokenSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{159}
+	return fileDescriptor_9198ee693835762e, []int{161}
 }
 func (m *WebTokenSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9340,7 +9477,7 @@ func (m *GetWebSessionRequest) Reset()         { *m = GetWebSessionRequest{} }
 func (m *GetWebSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*GetWebSessionRequest) ProtoMessage()    {}
 func (*GetWebSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{160}
+	return fileDescriptor_9198ee693835762e, []int{162}
 }
 func (m *GetWebSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9384,7 +9521,7 @@ func (m *DeleteWebSessionRequest) Reset()         { *m = DeleteWebSessionRequest
 func (m *DeleteWebSessionRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteWebSessionRequest) ProtoMessage()    {}
 func (*DeleteWebSessionRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{161}
+	return fileDescriptor_9198ee693835762e, []int{163}
 }
 func (m *DeleteWebSessionRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9428,7 +9565,7 @@ func (m *GetWebTokenRequest) Reset()         { *m = GetWebTokenRequest{} }
 func (m *GetWebTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*GetWebTokenRequest) ProtoMessage()    {}
 func (*GetWebTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{162}
+	return fileDescriptor_9198ee693835762e, []int{164}
 }
 func (m *GetWebTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9472,7 +9609,7 @@ func (m *DeleteWebTokenRequest) Reset()         { *m = DeleteWebTokenRequest{} }
 func (m *DeleteWebTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*DeleteWebTokenRequest) ProtoMessage()    {}
 func (*DeleteWebTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{163}
+	return fileDescriptor_9198ee693835762e, []int{165}
 }
 func (m *DeleteWebTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9514,7 +9651,7 @@ func (m *ResourceRequest) Reset()         { *m = ResourceRequest{} }
 func (m *ResourceRequest) String() string { return proto.CompactTextString(m) }
 func (*ResourceRequest) ProtoMessage()    {}
 func (*ResourceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{164}
+	return fileDescriptor_9198ee693835762e, []int{166}
 }
 func (m *ResourceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9558,7 +9695,7 @@ func (m *ResourceWithSecretsRequest) Reset()         { *m = ResourceWithSecretsR
 func (m *ResourceWithSecretsRequest) String() string { return proto.CompactTextString(m) }
 func (*ResourceWithSecretsRequest) ProtoMessage()    {}
 func (*ResourceWithSecretsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{165}
+	return fileDescriptor_9198ee693835762e, []int{167}
 }
 func (m *ResourceWithSecretsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9600,7 +9737,7 @@ func (m *ResourcesWithSecretsRequest) Reset()         { *m = ResourcesWithSecret
 func (m *ResourcesWithSecretsRequest) String() string { return proto.CompactTextString(m) }
 func (*ResourcesWithSecretsRequest) ProtoMessage()    {}
 func (*ResourcesWithSecretsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{166}
+	return fileDescriptor_9198ee693835762e, []int{168}
 }
 func (m *ResourcesWithSecretsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9644,7 +9781,7 @@ func (m *ResourceInNamespaceRequest) Reset()         { *m = ResourceInNamespaceR
 func (m *ResourceInNamespaceRequest) String() string { return proto.CompactTextString(m) }
 func (*ResourceInNamespaceRequest) ProtoMessage()    {}
 func (*ResourceInNamespaceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{167}
+	return fileDescriptor_9198ee693835762e, []int{169}
 }
 func (m *ResourceInNamespaceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9686,7 +9823,7 @@ func (m *ResourcesInNamespaceRequest) Reset()         { *m = ResourcesInNamespac
 func (m *ResourcesInNamespaceRequest) String() string { return proto.CompactTextString(m) }
 func (*ResourcesInNamespaceRequest) ProtoMessage()    {}
 func (*ResourcesInNamespaceRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{168}
+	return fileDescriptor_9198ee693835762e, []int{170}
 }
 func (m *ResourcesInNamespaceRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9736,7 +9873,7 @@ func (m *OIDCConnectorV3) Reset()         { *m = OIDCConnectorV3{} }
 func (m *OIDCConnectorV3) String() string { return proto.CompactTextString(m) }
 func (*OIDCConnectorV3) ProtoMessage()    {}
 func (*OIDCConnectorV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{169}
+	return fileDescriptor_9198ee693835762e, []int{171}
 }
 func (m *OIDCConnectorV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9778,7 +9915,7 @@ func (m *OIDCConnectorV3List) Reset()         { *m = OIDCConnectorV3List{} }
 func (m *OIDCConnectorV3List) String() string { return proto.CompactTextString(m) }
 func (*OIDCConnectorV3List) ProtoMessage()    {}
 func (*OIDCConnectorV3List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{170}
+	return fileDescriptor_9198ee693835762e, []int{172}
 }
 func (m *OIDCConnectorV3List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9857,7 +9994,7 @@ func (m *OIDCConnectorSpecV3) Reset()         { *m = OIDCConnectorSpecV3{} }
 func (m *OIDCConnectorSpecV3) String() string { return proto.CompactTextString(m) }
 func (*OIDCConnectorSpecV3) ProtoMessage()    {}
 func (*OIDCConnectorSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{171}
+	return fileDescriptor_9198ee693835762e, []int{173}
 }
 func (m *OIDCConnectorSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9943,7 +10080,7 @@ func (m *OIDCAuthRequest) Reset()         { *m = OIDCAuthRequest{} }
 func (m *OIDCAuthRequest) String() string { return proto.CompactTextString(m) }
 func (*OIDCAuthRequest) ProtoMessage()    {}
 func (*OIDCAuthRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{172}
+	return fileDescriptor_9198ee693835762e, []int{174}
 }
 func (m *OIDCAuthRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9993,7 +10130,7 @@ func (m *SAMLConnectorV2) Reset()         { *m = SAMLConnectorV2{} }
 func (m *SAMLConnectorV2) String() string { return proto.CompactTextString(m) }
 func (*SAMLConnectorV2) ProtoMessage()    {}
 func (*SAMLConnectorV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{173}
+	return fileDescriptor_9198ee693835762e, []int{175}
 }
 func (m *SAMLConnectorV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10035,7 +10172,7 @@ func (m *SAMLConnectorV2List) Reset()         { *m = SAMLConnectorV2List{} }
 func (m *SAMLConnectorV2List) String() string { return proto.CompactTextString(m) }
 func (*SAMLConnectorV2List) ProtoMessage()    {}
 func (*SAMLConnectorV2List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{174}
+	return fileDescriptor_9198ee693835762e, []int{176}
 }
 func (m *SAMLConnectorV2List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10107,7 +10244,7 @@ func (m *SAMLConnectorSpecV2) Reset()         { *m = SAMLConnectorSpecV2{} }
 func (m *SAMLConnectorSpecV2) String() string { return proto.CompactTextString(m) }
 func (*SAMLConnectorSpecV2) ProtoMessage()    {}
 func (*SAMLConnectorSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{175}
+	return fileDescriptor_9198ee693835762e, []int{177}
 }
 func (m *SAMLConnectorSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10186,7 +10323,7 @@ func (m *SAMLAuthRequest) Reset()         { *m = SAMLAuthRequest{} }
 func (m *SAMLAuthRequest) String() string { return proto.CompactTextString(m) }
 func (*SAMLAuthRequest) ProtoMessage()    {}
 func (*SAMLAuthRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{176}
+	return fileDescriptor_9198ee693835762e, []int{178}
 }
 func (m *SAMLAuthRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10232,7 +10369,7 @@ func (m *AttributeMapping) Reset()         { *m = AttributeMapping{} }
 func (m *AttributeMapping) String() string { return proto.CompactTextString(m) }
 func (*AttributeMapping) ProtoMessage()    {}
 func (*AttributeMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{177}
+	return fileDescriptor_9198ee693835762e, []int{179}
 }
 func (m *AttributeMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10277,7 +10414,7 @@ func (m *AsymmetricKeyPair) Reset()         { *m = AsymmetricKeyPair{} }
 func (m *AsymmetricKeyPair) String() string { return proto.CompactTextString(m) }
 func (*AsymmetricKeyPair) ProtoMessage()    {}
 func (*AsymmetricKeyPair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{178}
+	return fileDescriptor_9198ee693835762e, []int{180}
 }
 func (m *AsymmetricKeyPair) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10327,7 +10464,7 @@ func (m *GithubConnectorV3) Reset()         { *m = GithubConnectorV3{} }
 func (m *GithubConnectorV3) String() string { return proto.CompactTextString(m) }
 func (*GithubConnectorV3) ProtoMessage()    {}
 func (*GithubConnectorV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{179}
+	return fileDescriptor_9198ee693835762e, []int{181}
 }
 func (m *GithubConnectorV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10369,7 +10506,7 @@ func (m *GithubConnectorV3List) Reset()         { *m = GithubConnectorV3List{} }
 func (m *GithubConnectorV3List) String() string { return proto.CompactTextString(m) }
 func (*GithubConnectorV3List) ProtoMessage()    {}
 func (*GithubConnectorV3List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{180}
+	return fileDescriptor_9198ee693835762e, []int{182}
 }
 func (m *GithubConnectorV3List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10429,7 +10566,7 @@ func (m *GithubConnectorSpecV3) Reset()         { *m = GithubConnectorSpecV3{} }
 func (m *GithubConnectorSpecV3) String() string { return proto.CompactTextString(m) }
 func (*GithubConnectorSpecV3) ProtoMessage()    {}
 func (*GithubConnectorSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{181}
+	return fileDescriptor_9198ee693835762e, []int{183}
 }
 func (m *GithubConnectorSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10505,7 +10642,7 @@ func (m *GithubAuthRequest) Reset()         { *m = GithubAuthRequest{} }
 func (m *GithubAuthRequest) String() string { return proto.CompactTextString(m) }
 func (*GithubAuthRequest) ProtoMessage()    {}
 func (*GithubAuthRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{182}
+	return fileDescriptor_9198ee693835762e, []int{184}
 }
 func (m *GithubAuthRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10549,7 +10686,7 @@ func (m *SSOWarnings) Reset()         { *m = SSOWarnings{} }
 func (m *SSOWarnings) String() string { return proto.CompactTextString(m) }
 func (*SSOWarnings) ProtoMessage()    {}
 func (*SSOWarnings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{183}
+	return fileDescriptor_9198ee693835762e, []int{185}
 }
 func (m *SSOWarnings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10605,7 +10742,7 @@ func (m *CreateUserParams) Reset()         { *m = CreateUserParams{} }
 func (m *CreateUserParams) String() string { return proto.CompactTextString(m) }
 func (*CreateUserParams) ProtoMessage()    {}
 func (*CreateUserParams) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{184}
+	return fileDescriptor_9198ee693835762e, []int{186}
 }
 func (m *CreateUserParams) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10690,7 +10827,7 @@ func (m *SSODiagnosticInfo) Reset()         { *m = SSODiagnosticInfo{} }
 func (m *SSODiagnosticInfo) String() string { return proto.CompactTextString(m) }
 func (*SSODiagnosticInfo) ProtoMessage()    {}
 func (*SSODiagnosticInfo) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{185}
+	return fileDescriptor_9198ee693835762e, []int{187}
 }
 func (m *SSODiagnosticInfo) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10734,7 +10871,7 @@ func (m *GithubTokenInfo) Reset()         { *m = GithubTokenInfo{} }
 func (m *GithubTokenInfo) String() string { return proto.CompactTextString(m) }
 func (*GithubTokenInfo) ProtoMessage()    {}
 func (*GithubTokenInfo) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{186}
+	return fileDescriptor_9198ee693835762e, []int{188}
 }
 func (m *GithubTokenInfo) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10780,7 +10917,7 @@ func (m *GithubClaims) Reset()         { *m = GithubClaims{} }
 func (m *GithubClaims) String() string { return proto.CompactTextString(m) }
 func (*GithubClaims) ProtoMessage()    {}
 func (*GithubClaims) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{187}
+	return fileDescriptor_9198ee693835762e, []int{189}
 }
 func (m *GithubClaims) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10832,7 +10969,7 @@ func (m *TeamMapping) Reset()         { *m = TeamMapping{} }
 func (m *TeamMapping) String() string { return proto.CompactTextString(m) }
 func (*TeamMapping) ProtoMessage()    {}
 func (*TeamMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{188}
+	return fileDescriptor_9198ee693835762e, []int{190}
 }
 func (m *TeamMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10878,7 +11015,7 @@ func (m *TeamRolesMapping) Reset()         { *m = TeamRolesMapping{} }
 func (m *TeamRolesMapping) String() string { return proto.CompactTextString(m) }
 func (*TeamRolesMapping) ProtoMessage()    {}
 func (*TeamRolesMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{189}
+	return fileDescriptor_9198ee693835762e, []int{191}
 }
 func (m *TeamRolesMapping) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10927,7 +11064,7 @@ type TrustedClusterV2 struct {
 func (m *TrustedClusterV2) Reset()      { *m = TrustedClusterV2{} }
 func (*TrustedClusterV2) ProtoMessage() {}
 func (*TrustedClusterV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{190}
+	return fileDescriptor_9198ee693835762e, []int{192}
 }
 func (m *TrustedClusterV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10969,7 +11106,7 @@ func (m *TrustedClusterV2List) Reset()         { *m = TrustedClusterV2List{} }
 func (m *TrustedClusterV2List) String() string { return proto.CompactTextString(m) }
 func (*TrustedClusterV2List) ProtoMessage()    {}
 func (*TrustedClusterV2List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{191}
+	return fileDescriptor_9198ee693835762e, []int{193}
 }
 func (m *TrustedClusterV2List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11025,7 +11162,7 @@ func (m *TrustedClusterSpecV2) Reset()         { *m = TrustedClusterSpecV2{} }
 func (m *TrustedClusterSpecV2) String() string { return proto.CompactTextString(m) }
 func (*TrustedClusterSpecV2) ProtoMessage()    {}
 func (*TrustedClusterSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{192}
+	return fileDescriptor_9198ee693835762e, []int{194}
 }
 func (m *TrustedClusterSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11078,7 +11215,7 @@ func (m *LockV2) Reset()         { *m = LockV2{} }
 func (m *LockV2) String() string { return proto.CompactTextString(m) }
 func (*LockV2) ProtoMessage()    {}
 func (*LockV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{193}
+	return fileDescriptor_9198ee693835762e, []int{195}
 }
 func (m *LockV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11128,7 +11265,7 @@ func (m *LockSpecV2) Reset()         { *m = LockSpecV2{} }
 func (m *LockSpecV2) String() string { return proto.CompactTextString(m) }
 func (*LockSpecV2) ProtoMessage()    {}
 func (*LockSpecV2) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{194}
+	return fileDescriptor_9198ee693835762e, []int{196}
 }
 func (m *LockSpecV2) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11189,7 +11326,7 @@ type LockTarget struct {
 func (m *LockTarget) Reset()      { *m = LockTarget{} }
 func (*LockTarget) ProtoMessage() {}
 func (*LockTarget) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{195}
+	return fileDescriptor_9198ee693835762e, []int{197}
 }
 func (m *LockTarget) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11233,7 +11370,7 @@ func (m *AddressCondition) Reset()         { *m = AddressCondition{} }
 func (m *AddressCondition) String() string { return proto.CompactTextString(m) }
 func (*AddressCondition) ProtoMessage()    {}
 func (*AddressCondition) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{196}
+	return fileDescriptor_9198ee693835762e, []int{198}
 }
 func (m *AddressCondition) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11276,7 +11413,7 @@ func (m *NetworkRestrictionsSpecV4) Reset()         { *m = NetworkRestrictionsSp
 func (m *NetworkRestrictionsSpecV4) String() string { return proto.CompactTextString(m) }
 func (*NetworkRestrictionsSpecV4) ProtoMessage()    {}
 func (*NetworkRestrictionsSpecV4) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{197}
+	return fileDescriptor_9198ee693835762e, []int{199}
 }
 func (m *NetworkRestrictionsSpecV4) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11329,7 +11466,7 @@ func (m *NetworkRestrictionsV4) Reset()         { *m = NetworkRestrictionsV4{} }
 func (m *NetworkRestrictionsV4) String() string { return proto.CompactTextString(m) }
 func (*NetworkRestrictionsV4) ProtoMessage()    {}
 func (*NetworkRestrictionsV4) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{198}
+	return fileDescriptor_9198ee693835762e, []int{200}
 }
 func (m *NetworkRestrictionsV4) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11373,7 +11510,7 @@ func (m *WindowsDesktopServiceV3) Reset()         { *m = WindowsDesktopServiceV3
 func (m *WindowsDesktopServiceV3) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopServiceV3) ProtoMessage()    {}
 func (*WindowsDesktopServiceV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{199}
+	return fileDescriptor_9198ee693835762e, []int{201}
 }
 func (m *WindowsDesktopServiceV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11421,7 +11558,7 @@ func (m *WindowsDesktopServiceSpecV3) Reset()         { *m = WindowsDesktopServi
 func (m *WindowsDesktopServiceSpecV3) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopServiceSpecV3) ProtoMessage()    {}
 func (*WindowsDesktopServiceSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{200}
+	return fileDescriptor_9198ee693835762e, []int{202}
 }
 func (m *WindowsDesktopServiceSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11465,7 +11602,7 @@ func (m *WindowsDesktopFilter) Reset()         { *m = WindowsDesktopFilter{} }
 func (m *WindowsDesktopFilter) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopFilter) ProtoMessage()    {}
 func (*WindowsDesktopFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{201}
+	return fileDescriptor_9198ee693835762e, []int{203}
 }
 func (m *WindowsDesktopFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11509,7 +11646,7 @@ func (m *WindowsDesktopV3) Reset()         { *m = WindowsDesktopV3{} }
 func (m *WindowsDesktopV3) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopV3) ProtoMessage()    {}
 func (*WindowsDesktopV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{202}
+	return fileDescriptor_9198ee693835762e, []int{204}
 }
 func (m *WindowsDesktopV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11558,7 +11695,7 @@ func (m *WindowsDesktopSpecV3) Reset()         { *m = WindowsDesktopSpecV3{} }
 func (m *WindowsDesktopSpecV3) String() string { return proto.CompactTextString(m) }
 func (*WindowsDesktopSpecV3) ProtoMessage()    {}
 func (*WindowsDesktopSpecV3) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{203}
+	return fileDescriptor_9198ee693835762e, []int{205}
 }
 func (m *WindowsDesktopSpecV3) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11631,7 +11768,7 @@ func (m *RegisterUsingTokenRequest) Reset()         { *m = RegisterUsingTokenReq
 func (m *RegisterUsingTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*RegisterUsingTokenRequest) ProtoMessage()    {}
 func (*RegisterUsingTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{204}
+	return fileDescriptor_9198ee693835762e, []int{206}
 }
 func (m *RegisterUsingTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11685,7 +11822,7 @@ func (m *RecoveryCodesV1) Reset()         { *m = RecoveryCodesV1{} }
 func (m *RecoveryCodesV1) String() string { return proto.CompactTextString(m) }
 func (*RecoveryCodesV1) ProtoMessage()    {}
 func (*RecoveryCodesV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{205}
+	return fileDescriptor_9198ee693835762e, []int{207}
 }
 func (m *RecoveryCodesV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11730,7 +11867,7 @@ func (m *RecoveryCodesSpecV1) Reset()         { *m = RecoveryCodesSpecV1{} }
 func (m *RecoveryCodesSpecV1) String() string { return proto.CompactTextString(m) }
 func (*RecoveryCodesSpecV1) ProtoMessage()    {}
 func (*RecoveryCodesSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{206}
+	return fileDescriptor_9198ee693835762e, []int{208}
 }
 func (m *RecoveryCodesSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11774,7 +11911,7 @@ func (m *RecoveryCode) Reset()         { *m = RecoveryCode{} }
 func (m *RecoveryCode) String() string { return proto.CompactTextString(m) }
 func (*RecoveryCode) ProtoMessage()    {}
 func (*RecoveryCode) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{207}
+	return fileDescriptor_9198ee693835762e, []int{209}
 }
 func (m *RecoveryCode) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11814,7 +11951,7 @@ func (m *NullableSessionState) Reset()         { *m = NullableSessionState{} }
 func (m *NullableSessionState) String() string { return proto.CompactTextString(m) }
 func (*NullableSessionState) ProtoMessage()    {}
 func (*NullableSessionState) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{208}
+	return fileDescriptor_9198ee693835762e, []int{210}
 }
 func (m *NullableSessionState) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11860,7 +11997,7 @@ func (m *SessionTrackerFilter) Reset()         { *m = SessionTrackerFilter{} }
 func (m *SessionTrackerFilter) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerFilter) ProtoMessage()    {}
 func (*SessionTrackerFilter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{209}
+	return fileDescriptor_9198ee693835762e, []int{211}
 }
 func (m *SessionTrackerFilter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11904,7 +12041,7 @@ func (m *SessionTrackerV1) Reset()         { *m = SessionTrackerV1{} }
 func (m *SessionTrackerV1) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerV1) ProtoMessage()    {}
 func (*SessionTrackerV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{210}
+	return fileDescriptor_9198ee693835762e, []int{212}
 }
 func (m *SessionTrackerV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -11998,7 +12135,7 @@ func (m *SessionTrackerSpecV1) Reset()         { *m = SessionTrackerSpecV1{} }
 func (m *SessionTrackerSpecV1) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerSpecV1) ProtoMessage()    {}
 func (*SessionTrackerSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{211}
+	return fileDescriptor_9198ee693835762e, []int{213}
 }
 func (m *SessionTrackerSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12045,7 +12182,7 @@ func (m *SessionTrackerPolicySet) Reset()         { *m = SessionTrackerPolicySet
 func (m *SessionTrackerPolicySet) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerPolicySet) ProtoMessage()    {}
 func (*SessionTrackerPolicySet) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{212}
+	return fileDescriptor_9198ee693835762e, []int{214}
 }
 func (m *SessionTrackerPolicySet) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12093,7 +12230,7 @@ func (m *Participant) Reset()         { *m = Participant{} }
 func (m *Participant) String() string { return proto.CompactTextString(m) }
 func (*Participant) ProtoMessage()    {}
 func (*Participant) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{213}
+	return fileDescriptor_9198ee693835762e, []int{215}
 }
 func (m *Participant) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12137,7 +12274,7 @@ func (m *UIConfigV1) Reset()         { *m = UIConfigV1{} }
 func (m *UIConfigV1) String() string { return proto.CompactTextString(m) }
 func (*UIConfigV1) ProtoMessage()    {}
 func (*UIConfigV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{214}
+	return fileDescriptor_9198ee693835762e, []int{216}
 }
 func (m *UIConfigV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12178,7 +12315,7 @@ func (m *UIConfigSpecV1) Reset()         { *m = UIConfigSpecV1{} }
 func (m *UIConfigSpecV1) String() string { return proto.CompactTextString(m) }
 func (*UIConfigSpecV1) ProtoMessage()    {}
 func (*UIConfigSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{215}
+	return fileDescriptor_9198ee693835762e, []int{217}
 }
 func (m *UIConfigSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12229,7 +12366,7 @@ func (m *InstallerV1) Reset()         { *m = InstallerV1{} }
 func (m *InstallerV1) String() string { return proto.CompactTextString(m) }
 func (*InstallerV1) ProtoMessage()    {}
 func (*InstallerV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{216}
+	return fileDescriptor_9198ee693835762e, []int{218}
 }
 func (m *InstallerV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12271,7 +12408,7 @@ func (m *InstallerSpecV1) Reset()         { *m = InstallerSpecV1{} }
 func (m *InstallerSpecV1) String() string { return proto.CompactTextString(m) }
 func (*InstallerSpecV1) ProtoMessage()    {}
 func (*InstallerSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{217}
+	return fileDescriptor_9198ee693835762e, []int{219}
 }
 func (m *InstallerSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12313,7 +12450,7 @@ func (m *InstallerV1List) Reset()         { *m = InstallerV1List{} }
 func (m *InstallerV1List) String() string { return proto.CompactTextString(m) }
 func (*InstallerV1List) ProtoMessage()    {}
 func (*InstallerV1List) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{218}
+	return fileDescriptor_9198ee693835762e, []int{220}
 }
 func (m *InstallerV1List) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12357,7 +12494,7 @@ func (m *SortBy) Reset()         { *m = SortBy{} }
 func (m *SortBy) String() string { return proto.CompactTextString(m) }
 func (*SortBy) ProtoMessage()    {}
 func (*SortBy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{219}
+	return fileDescriptor_9198ee693835762e, []int{221}
 }
 func (m *SortBy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12403,7 +12540,7 @@ func (m *ConnectionDiagnosticV1) Reset()         { *m = ConnectionDiagnosticV1{}
 func (m *ConnectionDiagnosticV1) String() string { return proto.CompactTextString(m) }
 func (*ConnectionDiagnosticV1) ProtoMessage()    {}
 func (*ConnectionDiagnosticV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{220}
+	return fileDescriptor_9198ee693835762e, []int{222}
 }
 func (m *ConnectionDiagnosticV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12453,7 +12590,7 @@ func (m *ConnectionDiagnosticSpecV1) Reset()         { *m = ConnectionDiagnostic
 func (m *ConnectionDiagnosticSpecV1) String() string { return proto.CompactTextString(m) }
 func (*ConnectionDiagnosticSpecV1) ProtoMessage()    {}
 func (*ConnectionDiagnosticSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{221}
+	return fileDescriptor_9198ee693835762e, []int{223}
 }
 func (m *ConnectionDiagnosticSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12499,7 +12636,7 @@ func (m *ConnectionDiagnosticTrace) Reset()         { *m = ConnectionDiagnosticT
 func (m *ConnectionDiagnosticTrace) String() string { return proto.CompactTextString(m) }
 func (*ConnectionDiagnosticTrace) ProtoMessage()    {}
 func (*ConnectionDiagnosticTrace) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{222}
+	return fileDescriptor_9198ee693835762e, []int{224}
 }
 func (m *ConnectionDiagnosticTrace) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12542,7 +12679,7 @@ func (m *DatabaseServiceV1) Reset()         { *m = DatabaseServiceV1{} }
 func (m *DatabaseServiceV1) String() string { return proto.CompactTextString(m) }
 func (*DatabaseServiceV1) ProtoMessage()    {}
 func (*DatabaseServiceV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{223}
+	return fileDescriptor_9198ee693835762e, []int{225}
 }
 func (m *DatabaseServiceV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12584,7 +12721,7 @@ func (m *DatabaseServiceSpecV1) Reset()         { *m = DatabaseServiceSpecV1{} }
 func (m *DatabaseServiceSpecV1) String() string { return proto.CompactTextString(m) }
 func (*DatabaseServiceSpecV1) ProtoMessage()    {}
 func (*DatabaseServiceSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{224}
+	return fileDescriptor_9198ee693835762e, []int{226}
 }
 func (m *DatabaseServiceSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12615,17 +12752,18 @@ var xxx_messageInfo_DatabaseServiceSpecV1 proto.InternalMessageInfo
 
 // DatabaseResourceMatcher is a set of properties that is used to match on resources.
 type DatabaseResourceMatcher struct {
-	Labels               *Labels  `protobuf:"bytes,1,opt,name=Labels,proto3,customtype=Labels" json:"labels"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	Labels               *Labels            `protobuf:"bytes,1,opt,name=Labels,proto3,customtype=Labels" json:"labels"`
+	AWS                  ResourceMatcherAWS `protobuf:"bytes,2,opt,name=AWS,proto3" json:"aws"`
+	XXX_NoUnkeyedLiteral struct{}           `json:"-"`
+	XXX_unrecognized     []byte             `json:"-"`
+	XXX_sizecache        int32              `json:"-"`
 }
 
 func (m *DatabaseResourceMatcher) Reset()         { *m = DatabaseResourceMatcher{} }
 func (m *DatabaseResourceMatcher) String() string { return proto.CompactTextString(m) }
 func (*DatabaseResourceMatcher) ProtoMessage()    {}
 func (*DatabaseResourceMatcher) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{225}
+	return fileDescriptor_9198ee693835762e, []int{227}
 }
 func (m *DatabaseResourceMatcher) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12654,6 +12792,50 @@ func (m *DatabaseResourceMatcher) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_DatabaseResourceMatcher proto.InternalMessageInfo
 
+// ResourceMatcherAWS contains AWS specific settings for resource matcher.
+type ResourceMatcherAWS struct {
+	// AssumeRoleARN is an optional AWS role ARN to assume when accessing a database.
+	AssumeRoleARN string `protobuf:"bytes,1,opt,name=AssumeRoleARN,proto3" json:"assume_role_arn,omitempty"`
+	// ExternalID is an optional AWS external ID used to enable assuming an AWS role across accounts.
+	ExternalID           string   `protobuf:"bytes,2,opt,name=ExternalID,proto3" json:"external_id,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ResourceMatcherAWS) Reset()         { *m = ResourceMatcherAWS{} }
+func (m *ResourceMatcherAWS) String() string { return proto.CompactTextString(m) }
+func (*ResourceMatcherAWS) ProtoMessage()    {}
+func (*ResourceMatcherAWS) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{228}
+}
+func (m *ResourceMatcherAWS) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ResourceMatcherAWS) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ResourceMatcherAWS.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ResourceMatcherAWS) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ResourceMatcherAWS.Merge(m, src)
+}
+func (m *ResourceMatcherAWS) XXX_Size() int {
+	return m.Size()
+}
+func (m *ResourceMatcherAWS) XXX_DiscardUnknown() {
+	xxx_messageInfo_ResourceMatcherAWS.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ResourceMatcherAWS proto.InternalMessageInfo
+
 // ClusterAlert is a cluster-level alert message.
 type ClusterAlert struct {
 	ResourceHeader       `protobuf:"bytes,1,opt,name=Header,proto3,embedded=Header" json:""`
@@ -12667,7 +12849,7 @@ func (m *ClusterAlert) Reset()         { *m = ClusterAlert{} }
 func (m *ClusterAlert) String() string { return proto.CompactTextString(m) }
 func (*ClusterAlert) ProtoMessage()    {}
 func (*ClusterAlert) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{226}
+	return fileDescriptor_9198ee693835762e, []int{229}
 }
 func (m *ClusterAlert) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12713,7 +12895,7 @@ func (m *ClusterAlertSpec) Reset()         { *m = ClusterAlertSpec{} }
 func (m *ClusterAlertSpec) String() string { return proto.CompactTextString(m) }
 func (*ClusterAlertSpec) ProtoMessage()    {}
 func (*ClusterAlertSpec) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{227}
+	return fileDescriptor_9198ee693835762e, []int{230}
 }
 func (m *ClusterAlertSpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12766,7 +12948,7 @@ func (m *GetClusterAlertsRequest) Reset()         { *m = GetClusterAlertsRequest
 func (m *GetClusterAlertsRequest) String() string { return proto.CompactTextString(m) }
 func (*GetClusterAlertsRequest) ProtoMessage()    {}
 func (*GetClusterAlertsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{228}
+	return fileDescriptor_9198ee693835762e, []int{231}
 }
 func (m *GetClusterAlertsRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12816,7 +12998,7 @@ func (m *AlertAcknowledgement) Reset()         { *m = AlertAcknowledgement{} }
 func (m *AlertAcknowledgement) String() string { return proto.CompactTextString(m) }
 func (*AlertAcknowledgement) ProtoMessage()    {}
 func (*AlertAcknowledgement) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{229}
+	return fileDescriptor_9198ee693835762e, []int{232}
 }
 func (m *AlertAcknowledgement) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12868,7 +13050,7 @@ func (m *Release) Reset()         { *m = Release{} }
 func (m *Release) String() string { return proto.CompactTextString(m) }
 func (*Release) ProtoMessage()    {}
 func (*Release) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{230}
+	return fileDescriptor_9198ee693835762e, []int{233}
 }
 func (m *Release) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12926,7 +13108,7 @@ func (m *Asset) Reset()         { *m = Asset{} }
 func (m *Asset) String() string { return proto.CompactTextString(m) }
 func (*Asset) ProtoMessage()    {}
 func (*Asset) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{231}
+	return fileDescriptor_9198ee693835762e, []int{234}
 }
 func (m *Asset) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -12979,7 +13161,7 @@ func (m *PluginV1) Reset()         { *m = PluginV1{} }
 func (m *PluginV1) String() string { return proto.CompactTextString(m) }
 func (*PluginV1) ProtoMessage()    {}
 func (*PluginV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{232}
+	return fileDescriptor_9198ee693835762e, []int{235}
 }
 func (m *PluginV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13018,6 +13200,7 @@ type PluginSpecV1 struct {
 	//	*PluginSpecV1_Openai
 	//	*PluginSpecV1_Okta
 	//	*PluginSpecV1_Jamf
+	//	*PluginSpecV1_PagerDuty
 	Settings             isPluginSpecV1_Settings `protobuf_oneof:"settings"`
 	XXX_NoUnkeyedLiteral struct{}                `json:"-"`
 	XXX_unrecognized     []byte                  `json:"-"`
@@ -13028,7 +13211,7 @@ func (m *PluginSpecV1) Reset()         { *m = PluginSpecV1{} }
 func (m *PluginSpecV1) String() string { return proto.CompactTextString(m) }
 func (*PluginSpecV1) ProtoMessage()    {}
 func (*PluginSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{233}
+	return fileDescriptor_9198ee693835762e, []int{236}
 }
 func (m *PluginSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13079,12 +13262,16 @@ type PluginSpecV1_Okta struct {
 type PluginSpecV1_Jamf struct {
 	Jamf *PluginJamfSettings `protobuf:"bytes,5,opt,name=jamf,proto3,oneof" json:"jamf,omitempty"`
 }
+type PluginSpecV1_PagerDuty struct {
+	PagerDuty *PluginPagerDutySettings `protobuf:"bytes,6,opt,name=pager_duty,json=pagerDuty,proto3,oneof" json:"pager_duty,omitempty"`
+}
 
 func (*PluginSpecV1_SlackAccessPlugin) isPluginSpecV1_Settings() {}
 func (*PluginSpecV1_Opsgenie) isPluginSpecV1_Settings()          {}
 func (*PluginSpecV1_Openai) isPluginSpecV1_Settings()            {}
 func (*PluginSpecV1_Okta) isPluginSpecV1_Settings()              {}
 func (*PluginSpecV1_Jamf) isPluginSpecV1_Settings()              {}
+func (*PluginSpecV1_PagerDuty) isPluginSpecV1_Settings()         {}
 
 func (m *PluginSpecV1) GetSettings() isPluginSpecV1_Settings {
 	if m != nil {
@@ -13128,6 +13315,13 @@ func (m *PluginSpecV1) GetJamf() *PluginJamfSettings {
 	return nil
 }
 
+func (m *PluginSpecV1) GetPagerDuty() *PluginPagerDutySettings {
+	if x, ok := m.GetSettings().(*PluginSpecV1_PagerDuty); ok {
+		return x.PagerDuty
+	}
+	return nil
+}
+
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*PluginSpecV1) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -13136,6 +13330,7 @@ func (*PluginSpecV1) XXX_OneofWrappers() []interface{} {
 		(*PluginSpecV1_Openai)(nil),
 		(*PluginSpecV1_Okta)(nil),
 		(*PluginSpecV1_Jamf)(nil),
+		(*PluginSpecV1_PagerDuty)(nil),
 	}
 }
 
@@ -13150,7 +13345,7 @@ func (m *PluginSlackAccessSettings) Reset()         { *m = PluginSlackAccessSett
 func (m *PluginSlackAccessSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginSlackAccessSettings) ProtoMessage()    {}
 func (*PluginSlackAccessSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{234}
+	return fileDescriptor_9198ee693835762e, []int{237}
 }
 func (m *PluginSlackAccessSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13197,7 +13392,7 @@ func (m *PluginOpsgenieAccessSettings) Reset()         { *m = PluginOpsgenieAcce
 func (m *PluginOpsgenieAccessSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginOpsgenieAccessSettings) ProtoMessage()    {}
 func (*PluginOpsgenieAccessSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{235}
+	return fileDescriptor_9198ee693835762e, []int{238}
 }
 func (m *PluginOpsgenieAccessSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13226,6 +13421,52 @@ func (m *PluginOpsgenieAccessSettings) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_PluginOpsgenieAccessSettings proto.InternalMessageInfo
 
+type PluginPagerDutySettings struct {
+	// UserEmail is the email address of the PagerDuty user that will be
+	// listed as the reporter source of incidents, comments, etc
+	// within PagerDuty. Should usually be the same user the API key
+	// represents.
+	UserEmail string `protobuf:"bytes,1,opt,name=user_email,json=userEmail,proto3" json:"user_email,omitempty"`
+	// APIEndpoint is the address of PagerDuty API.
+	ApiEndpoint          string   `protobuf:"bytes,2,opt,name=api_endpoint,json=apiEndpoint,proto3" json:"api_endpoint,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PluginPagerDutySettings) Reset()         { *m = PluginPagerDutySettings{} }
+func (m *PluginPagerDutySettings) String() string { return proto.CompactTextString(m) }
+func (*PluginPagerDutySettings) ProtoMessage()    {}
+func (*PluginPagerDutySettings) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{239}
+}
+func (m *PluginPagerDutySettings) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *PluginPagerDutySettings) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_PluginPagerDutySettings.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *PluginPagerDutySettings) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_PluginPagerDutySettings.Merge(m, src)
+}
+func (m *PluginPagerDutySettings) XXX_Size() int {
+	return m.Size()
+}
+func (m *PluginPagerDutySettings) XXX_DiscardUnknown() {
+	xxx_messageInfo_PluginPagerDutySettings.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PluginPagerDutySettings proto.InternalMessageInfo
+
 // Defines settings for the OpenAI plugin. Currently there are no settings.
 type PluginOpenAISettings struct {
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
@@ -13237,7 +13478,7 @@ func (m *PluginOpenAISettings) Reset()         { *m = PluginOpenAISettings{} }
 func (m *PluginOpenAISettings) String() string { return proto.CompactTextString(m) }
 func (*PluginOpenAISettings) ProtoMessage()    {}
 func (*PluginOpenAISettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{236}
+	return fileDescriptor_9198ee693835762e, []int{240}
 }
 func (m *PluginOpenAISettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13279,7 +13520,7 @@ func (m *PluginJamfSettings) Reset()         { *m = PluginJamfSettings{} }
 func (m *PluginJamfSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginJamfSettings) ProtoMessage()    {}
 func (*PluginJamfSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{237}
+	return fileDescriptor_9198ee693835762e, []int{241}
 }
 func (m *PluginJamfSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13321,7 +13562,7 @@ func (m *PluginOktaSettings) Reset()         { *m = PluginOktaSettings{} }
 func (m *PluginOktaSettings) String() string { return proto.CompactTextString(m) }
 func (*PluginOktaSettings) ProtoMessage()    {}
 func (*PluginOktaSettings) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{238}
+	return fileDescriptor_9198ee693835762e, []int{242}
 }
 func (m *PluginOktaSettings) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13366,7 +13607,7 @@ func (m *PluginBootstrapCredentialsV1) Reset()         { *m = PluginBootstrapCre
 func (m *PluginBootstrapCredentialsV1) String() string { return proto.CompactTextString(m) }
 func (*PluginBootstrapCredentialsV1) ProtoMessage()    {}
 func (*PluginBootstrapCredentialsV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{239}
+	return fileDescriptor_9198ee693835762e, []int{243}
 }
 func (m *PluginBootstrapCredentialsV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13466,7 +13707,7 @@ func (m *PluginIdSecretCredential) Reset()         { *m = PluginIdSecretCredenti
 func (m *PluginIdSecretCredential) String() string { return proto.CompactTextString(m) }
 func (*PluginIdSecretCredential) ProtoMessage()    {}
 func (*PluginIdSecretCredential) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{240}
+	return fileDescriptor_9198ee693835762e, []int{244}
 }
 func (m *PluginIdSecretCredential) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13509,7 +13750,7 @@ func (m *PluginOAuth2AuthorizationCodeCredentials) Reset() {
 func (m *PluginOAuth2AuthorizationCodeCredentials) String() string { return proto.CompactTextString(m) }
 func (*PluginOAuth2AuthorizationCodeCredentials) ProtoMessage()    {}
 func (*PluginOAuth2AuthorizationCodeCredentials) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{241}
+	return fileDescriptor_9198ee693835762e, []int{245}
 }
 func (m *PluginOAuth2AuthorizationCodeCredentials) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13550,7 +13791,7 @@ func (m *PluginStatusV1) Reset()         { *m = PluginStatusV1{} }
 func (m *PluginStatusV1) String() string { return proto.CompactTextString(m) }
 func (*PluginStatusV1) ProtoMessage()    {}
 func (*PluginStatusV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{242}
+	return fileDescriptor_9198ee693835762e, []int{246}
 }
 func (m *PluginStatusV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13598,7 +13839,7 @@ func (m *PluginCredentialsV1) Reset()         { *m = PluginCredentialsV1{} }
 func (m *PluginCredentialsV1) String() string { return proto.CompactTextString(m) }
 func (*PluginCredentialsV1) ProtoMessage()    {}
 func (*PluginCredentialsV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{243}
+	return fileDescriptor_9198ee693835762e, []int{247}
 }
 func (m *PluginCredentialsV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13709,7 +13950,7 @@ func (m *PluginOAuth2AccessTokenCredentials) Reset()         { *m = PluginOAuth2
 func (m *PluginOAuth2AccessTokenCredentials) String() string { return proto.CompactTextString(m) }
 func (*PluginOAuth2AccessTokenCredentials) ProtoMessage()    {}
 func (*PluginOAuth2AccessTokenCredentials) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{244}
+	return fileDescriptor_9198ee693835762e, []int{248}
 }
 func (m *PluginOAuth2AccessTokenCredentials) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13750,7 +13991,7 @@ func (m *PluginBearerTokenCredentials) Reset()         { *m = PluginBearerTokenC
 func (m *PluginBearerTokenCredentials) String() string { return proto.CompactTextString(m) }
 func (*PluginBearerTokenCredentials) ProtoMessage()    {}
 func (*PluginBearerTokenCredentials) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{245}
+	return fileDescriptor_9198ee693835762e, []int{249}
 }
 func (m *PluginBearerTokenCredentials) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13792,7 +14033,7 @@ func (m *PluginStaticCredentialsRef) Reset()         { *m = PluginStaticCredenti
 func (m *PluginStaticCredentialsRef) String() string { return proto.CompactTextString(m) }
 func (*PluginStaticCredentialsRef) ProtoMessage()    {}
 func (*PluginStaticCredentialsRef) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{246}
+	return fileDescriptor_9198ee693835762e, []int{250}
 }
 func (m *PluginStaticCredentialsRef) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13834,7 +14075,7 @@ func (m *PluginListV1) Reset()         { *m = PluginListV1{} }
 func (m *PluginListV1) String() string { return proto.CompactTextString(m) }
 func (*PluginListV1) ProtoMessage()    {}
 func (*PluginListV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{247}
+	return fileDescriptor_9198ee693835762e, []int{251}
 }
 func (m *PluginListV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13877,7 +14118,7 @@ type PluginStaticCredentialsV1 struct {
 func (m *PluginStaticCredentialsV1) Reset()      { *m = PluginStaticCredentialsV1{} }
 func (*PluginStaticCredentialsV1) ProtoMessage() {}
 func (*PluginStaticCredentialsV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{248}
+	return fileDescriptor_9198ee693835762e, []int{252}
 }
 func (m *PluginStaticCredentialsV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -13923,7 +14164,7 @@ func (m *PluginStaticCredentialsSpecV1) Reset()         { *m = PluginStaticCrede
 func (m *PluginStaticCredentialsSpecV1) String() string { return proto.CompactTextString(m) }
 func (*PluginStaticCredentialsSpecV1) ProtoMessage()    {}
 func (*PluginStaticCredentialsSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{249}
+	return fileDescriptor_9198ee693835762e, []int{253}
 }
 func (m *PluginStaticCredentialsSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14025,7 +14266,7 @@ func (m *PluginStaticCredentialsBasicAuth) Reset()         { *m = PluginStaticCr
 func (m *PluginStaticCredentialsBasicAuth) String() string { return proto.CompactTextString(m) }
 func (*PluginStaticCredentialsBasicAuth) ProtoMessage()    {}
 func (*PluginStaticCredentialsBasicAuth) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{250}
+	return fileDescriptor_9198ee693835762e, []int{254}
 }
 func (m *PluginStaticCredentialsBasicAuth) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14071,7 +14312,7 @@ func (m *PluginStaticCredentialsOAuthClientSecret) Reset() {
 func (m *PluginStaticCredentialsOAuthClientSecret) String() string { return proto.CompactTextString(m) }
 func (*PluginStaticCredentialsOAuthClientSecret) ProtoMessage()    {}
 func (*PluginStaticCredentialsOAuthClientSecret) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{251}
+	return fileDescriptor_9198ee693835762e, []int{255}
 }
 func (m *PluginStaticCredentialsOAuthClientSecret) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14114,7 +14355,7 @@ type SAMLIdPServiceProviderV1 struct {
 func (m *SAMLIdPServiceProviderV1) Reset()      { *m = SAMLIdPServiceProviderV1{} }
 func (*SAMLIdPServiceProviderV1) ProtoMessage() {}
 func (*SAMLIdPServiceProviderV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{252}
+	return fileDescriptor_9198ee693835762e, []int{256}
 }
 func (m *SAMLIdPServiceProviderV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14160,7 +14401,7 @@ func (m *SAMLIdPServiceProviderSpecV1) Reset()         { *m = SAMLIdPServiceProv
 func (m *SAMLIdPServiceProviderSpecV1) String() string { return proto.CompactTextString(m) }
 func (*SAMLIdPServiceProviderSpecV1) ProtoMessage()    {}
 func (*SAMLIdPServiceProviderSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{253}
+	return fileDescriptor_9198ee693835762e, []int{257}
 }
 func (m *SAMLIdPServiceProviderSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14202,7 +14443,7 @@ func (m *IdPOptions) Reset()         { *m = IdPOptions{} }
 func (m *IdPOptions) String() string { return proto.CompactTextString(m) }
 func (*IdPOptions) ProtoMessage()    {}
 func (*IdPOptions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{254}
+	return fileDescriptor_9198ee693835762e, []int{258}
 }
 func (m *IdPOptions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14244,7 +14485,7 @@ func (m *IdPSAMLOptions) Reset()         { *m = IdPSAMLOptions{} }
 func (m *IdPSAMLOptions) String() string { return proto.CompactTextString(m) }
 func (*IdPSAMLOptions) ProtoMessage()    {}
 func (*IdPSAMLOptions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{255}
+	return fileDescriptor_9198ee693835762e, []int{259}
 }
 func (m *IdPSAMLOptions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14294,7 +14535,7 @@ func (m *KubernetesResourceV1) Reset()         { *m = KubernetesResourceV1{} }
 func (m *KubernetesResourceV1) String() string { return proto.CompactTextString(m) }
 func (*KubernetesResourceV1) ProtoMessage()    {}
 func (*KubernetesResourceV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{256}
+	return fileDescriptor_9198ee693835762e, []int{260}
 }
 func (m *KubernetesResourceV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14336,7 +14577,7 @@ func (m *KubernetesResourceSpecV1) Reset()         { *m = KubernetesResourceSpec
 func (m *KubernetesResourceSpecV1) String() string { return proto.CompactTextString(m) }
 func (*KubernetesResourceSpecV1) ProtoMessage()    {}
 func (*KubernetesResourceSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{257}
+	return fileDescriptor_9198ee693835762e, []int{261}
 }
 func (m *KubernetesResourceSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14382,7 +14623,7 @@ func (m *ClusterMaintenanceConfigV1) Reset()         { *m = ClusterMaintenanceCo
 func (m *ClusterMaintenanceConfigV1) String() string { return proto.CompactTextString(m) }
 func (*ClusterMaintenanceConfigV1) ProtoMessage()    {}
 func (*ClusterMaintenanceConfigV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{258}
+	return fileDescriptor_9198ee693835762e, []int{262}
 }
 func (m *ClusterMaintenanceConfigV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14424,7 +14665,7 @@ func (m *ClusterMaintenanceConfigSpecV1) Reset()         { *m = ClusterMaintenan
 func (m *ClusterMaintenanceConfigSpecV1) String() string { return proto.CompactTextString(m) }
 func (*ClusterMaintenanceConfigSpecV1) ProtoMessage()    {}
 func (*ClusterMaintenanceConfigSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{259}
+	return fileDescriptor_9198ee693835762e, []int{263}
 }
 func (m *ClusterMaintenanceConfigSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14470,7 +14711,7 @@ func (m *AgentUpgradeWindow) Reset()         { *m = AgentUpgradeWindow{} }
 func (m *AgentUpgradeWindow) String() string { return proto.CompactTextString(m) }
 func (*AgentUpgradeWindow) ProtoMessage()    {}
 func (*AgentUpgradeWindow) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{260}
+	return fileDescriptor_9198ee693835762e, []int{264}
 }
 func (m *AgentUpgradeWindow) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14517,7 +14758,7 @@ func (m *ScheduledAgentUpgradeWindow) Reset()         { *m = ScheduledAgentUpgra
 func (m *ScheduledAgentUpgradeWindow) String() string { return proto.CompactTextString(m) }
 func (*ScheduledAgentUpgradeWindow) ProtoMessage()    {}
 func (*ScheduledAgentUpgradeWindow) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{261}
+	return fileDescriptor_9198ee693835762e, []int{265}
 }
 func (m *ScheduledAgentUpgradeWindow) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14560,7 +14801,7 @@ func (m *AgentUpgradeSchedule) Reset()         { *m = AgentUpgradeSchedule{} }
 func (m *AgentUpgradeSchedule) String() string { return proto.CompactTextString(m) }
 func (*AgentUpgradeSchedule) ProtoMessage()    {}
 func (*AgentUpgradeSchedule) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{262}
+	return fileDescriptor_9198ee693835762e, []int{266}
 }
 func (m *AgentUpgradeSchedule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14592,16 +14833,18 @@ var xxx_messageInfo_AgentUpgradeSchedule proto.InternalMessageInfo
 // UserGroupV1 is a representation of an externally sourced user group.
 type UserGroupV1 struct {
 	// Header is the resource header for the user group.
-	ResourceHeader       `protobuf:"bytes,1,opt,name=Header,proto3,embedded=Header" json:""`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	ResourceHeader `protobuf:"bytes,1,opt,name=Header,proto3,embedded=Header" json:""`
+	// Spec is the user group resource spec.
+	Spec                 UserGroupSpecV1 `protobuf:"bytes,2,opt,name=Spec,proto3" json:"spec"`
+	XXX_NoUnkeyedLiteral struct{}        `json:"-"`
+	XXX_unrecognized     []byte          `json:"-"`
+	XXX_sizecache        int32           `json:"-"`
 }
 
 func (m *UserGroupV1) Reset()      { *m = UserGroupV1{} }
 func (*UserGroupV1) ProtoMessage() {}
 func (*UserGroupV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{263}
+	return fileDescriptor_9198ee693835762e, []int{267}
 }
 func (m *UserGroupV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14630,6 +14873,48 @@ func (m *UserGroupV1) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_UserGroupV1 proto.InternalMessageInfo
 
+// UserGroupSpecV1 is the specification of a user group.
+type UserGroupSpecV1 struct {
+	// Applications are a list of application IDs belonging to this user group.
+	Applications         []string `protobuf:"bytes,1,rep,name=Applications,proto3" json:"Applications,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *UserGroupSpecV1) Reset()         { *m = UserGroupSpecV1{} }
+func (m *UserGroupSpecV1) String() string { return proto.CompactTextString(m) }
+func (*UserGroupSpecV1) ProtoMessage()    {}
+func (*UserGroupSpecV1) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{268}
+}
+func (m *UserGroupSpecV1) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *UserGroupSpecV1) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_UserGroupSpecV1.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *UserGroupSpecV1) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_UserGroupSpecV1.Merge(m, src)
+}
+func (m *UserGroupSpecV1) XXX_Size() int {
+	return m.Size()
+}
+func (m *UserGroupSpecV1) XXX_DiscardUnknown() {
+	xxx_messageInfo_UserGroupSpecV1.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UserGroupSpecV1 proto.InternalMessageInfo
+
 // OktaImportRuleSpecV1 is a Okta import rule specification.
 type OktaImportRuleSpecV1 struct {
 	// Priority represents the priority of the rule application. Lower numbered rules will be applied first.
@@ -14645,7 +14930,7 @@ func (m *OktaImportRuleSpecV1) Reset()         { *m = OktaImportRuleSpecV1{} }
 func (m *OktaImportRuleSpecV1) String() string { return proto.CompactTextString(m) }
 func (*OktaImportRuleSpecV1) ProtoMessage()    {}
 func (*OktaImportRuleSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{264}
+	return fileDescriptor_9198ee693835762e, []int{269}
 }
 func (m *OktaImportRuleSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14689,7 +14974,7 @@ func (m *OktaImportRuleMappingV1) Reset()         { *m = OktaImportRuleMappingV1
 func (m *OktaImportRuleMappingV1) String() string { return proto.CompactTextString(m) }
 func (*OktaImportRuleMappingV1) ProtoMessage()    {}
 func (*OktaImportRuleMappingV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{265}
+	return fileDescriptor_9198ee693835762e, []int{270}
 }
 func (m *OktaImportRuleMappingV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14732,7 +15017,7 @@ type OktaImportRuleV1 struct {
 func (m *OktaImportRuleV1) Reset()      { *m = OktaImportRuleV1{} }
 func (*OktaImportRuleV1) ProtoMessage() {}
 func (*OktaImportRuleV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{266}
+	return fileDescriptor_9198ee693835762e, []int{271}
 }
 func (m *OktaImportRuleV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14780,7 +15065,7 @@ func (m *OktaImportRuleMatchV1) Reset()         { *m = OktaImportRuleMatchV1{} }
 func (m *OktaImportRuleMatchV1) String() string { return proto.CompactTextString(m) }
 func (*OktaImportRuleMatchV1) ProtoMessage()    {}
 func (*OktaImportRuleMatchV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{267}
+	return fileDescriptor_9198ee693835762e, []int{272}
 }
 func (m *OktaImportRuleMatchV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14823,7 +15108,7 @@ type OktaAssignmentV1 struct {
 func (m *OktaAssignmentV1) Reset()      { *m = OktaAssignmentV1{} }
 func (*OktaAssignmentV1) ProtoMessage() {}
 func (*OktaAssignmentV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{268}
+	return fileDescriptor_9198ee693835762e, []int{273}
 }
 func (m *OktaAssignmentV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14877,7 +15162,7 @@ func (m *OktaAssignmentSpecV1) Reset()         { *m = OktaAssignmentSpecV1{} }
 func (m *OktaAssignmentSpecV1) String() string { return proto.CompactTextString(m) }
 func (*OktaAssignmentSpecV1) ProtoMessage()    {}
 func (*OktaAssignmentSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{269}
+	return fileDescriptor_9198ee693835762e, []int{274}
 }
 func (m *OktaAssignmentSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14921,7 +15206,7 @@ func (m *OktaAssignmentTargetV1) Reset()         { *m = OktaAssignmentTargetV1{}
 func (m *OktaAssignmentTargetV1) String() string { return proto.CompactTextString(m) }
 func (*OktaAssignmentTargetV1) ProtoMessage()    {}
 func (*OktaAssignmentTargetV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{270}
+	return fileDescriptor_9198ee693835762e, []int{275}
 }
 func (m *OktaAssignmentTargetV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -14966,7 +15251,7 @@ type IntegrationV1 struct {
 func (m *IntegrationV1) Reset()      { *m = IntegrationV1{} }
 func (*IntegrationV1) ProtoMessage() {}
 func (*IntegrationV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{271}
+	return fileDescriptor_9198ee693835762e, []int{276}
 }
 func (m *IntegrationV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15010,7 +15295,7 @@ func (m *IntegrationSpecV1) Reset()         { *m = IntegrationSpecV1{} }
 func (m *IntegrationSpecV1) String() string { return proto.CompactTextString(m) }
 func (*IntegrationSpecV1) ProtoMessage()    {}
 func (*IntegrationSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{272}
+	return fileDescriptor_9198ee693835762e, []int{277}
 }
 func (m *IntegrationSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15086,7 +15371,7 @@ func (m *AWSOIDCIntegrationSpecV1) Reset()         { *m = AWSOIDCIntegrationSpec
 func (m *AWSOIDCIntegrationSpecV1) String() string { return proto.CompactTextString(m) }
 func (*AWSOIDCIntegrationSpecV1) ProtoMessage()    {}
 func (*AWSOIDCIntegrationSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{273}
+	return fileDescriptor_9198ee693835762e, []int{278}
 }
 func (m *AWSOIDCIntegrationSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15138,7 +15423,7 @@ func (m *HeadlessAuthentication) Reset()         { *m = HeadlessAuthentication{}
 func (m *HeadlessAuthentication) String() string { return proto.CompactTextString(m) }
 func (*HeadlessAuthentication) ProtoMessage()    {}
 func (*HeadlessAuthentication) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{274}
+	return fileDescriptor_9198ee693835762e, []int{279}
 }
 func (m *HeadlessAuthentication) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15195,7 +15480,7 @@ func (m *WatchKind) Reset()         { *m = WatchKind{} }
 func (m *WatchKind) String() string { return proto.CompactTextString(m) }
 func (*WatchKind) ProtoMessage()    {}
 func (*WatchKind) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{275}
+	return fileDescriptor_9198ee693835762e, []int{280}
 }
 func (m *WatchKind) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15245,7 +15530,7 @@ func (m *WatchStatusV1) Reset()         { *m = WatchStatusV1{} }
 func (m *WatchStatusV1) String() string { return proto.CompactTextString(m) }
 func (*WatchStatusV1) ProtoMessage()    {}
 func (*WatchStatusV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{276}
+	return fileDescriptor_9198ee693835762e, []int{281}
 }
 func (m *WatchStatusV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15286,7 +15571,7 @@ func (m *WatchStatusSpecV1) Reset()         { *m = WatchStatusSpecV1{} }
 func (m *WatchStatusSpecV1) String() string { return proto.CompactTextString(m) }
 func (*WatchStatusSpecV1) ProtoMessage()    {}
 func (*WatchStatusSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{277}
+	return fileDescriptor_9198ee693835762e, []int{282}
 }
 func (m *WatchStatusSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15336,7 +15621,7 @@ func (m *ServerInfoV1) Reset()         { *m = ServerInfoV1{} }
 func (m *ServerInfoV1) String() string { return proto.CompactTextString(m) }
 func (*ServerInfoV1) ProtoMessage()    {}
 func (*ServerInfoV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{278}
+	return fileDescriptor_9198ee693835762e, []int{283}
 }
 func (m *ServerInfoV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15378,7 +15663,7 @@ func (m *ServerInfoSpecV1) Reset()         { *m = ServerInfoSpecV1{} }
 func (m *ServerInfoSpecV1) String() string { return proto.CompactTextString(m) }
 func (*ServerInfoSpecV1) ProtoMessage()    {}
 func (*ServerInfoSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{279}
+	return fileDescriptor_9198ee693835762e, []int{284}
 }
 func (m *ServerInfoSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15422,7 +15707,7 @@ func (m *ServerInfoSpecV1_AWSInfo) Reset()         { *m = ServerInfoSpecV1_AWSIn
 func (m *ServerInfoSpecV1_AWSInfo) String() string { return proto.CompactTextString(m) }
 func (*ServerInfoSpecV1_AWSInfo) ProtoMessage()    {}
 func (*ServerInfoSpecV1_AWSInfo) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{279, 0}
+	return fileDescriptor_9198ee693835762e, []int{284, 0}
 }
 func (m *ServerInfoSpecV1_AWSInfo) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15463,8 +15748,8 @@ type JamfSpecV1 struct {
 	// Set to negative to perform syncs immediately on startup.
 	// Defaults to a random delay (a few minutes max).
 	SyncDelay Duration `protobuf:"varint,3,opt,name=sync_delay,json=syncDelay,proto3,casttype=Duration" json:"sync_delay,omitempty"`
-	// Jamf API endpoint.
-	// Example: "https://yourtenant.jamfcloud.com".
+	// Jamf Pro API endpoint.
+	// Example: "https://yourtenant.jamfcloud.com/api".
 	// Required.
 	ApiEndpoint string `protobuf:"bytes,4,opt,name=api_endpoint,json=apiEndpoint,proto3" json:"api_endpoint,omitempty"`
 	// Jamf API username.
@@ -15489,7 +15774,7 @@ func (m *JamfSpecV1) Reset()         { *m = JamfSpecV1{} }
 func (m *JamfSpecV1) String() string { return proto.CompactTextString(m) }
 func (*JamfSpecV1) ProtoMessage()    {}
 func (*JamfSpecV1) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{280}
+	return fileDescriptor_9198ee693835762e, []int{285}
 }
 func (m *JamfSpecV1) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15528,14 +15813,12 @@ type JamfInventoryEntry struct {
 	// PARTIAL syncs are scheduled in the time window between FULL syncs, so
 	// sync_period_partial must always be smaller than sync_period_full, otherwise
 	// it would never trigger.
-	// Set to negative to disable PARTIAL syncs.
-	// Defaults to 6h.
+	// Set to zero or negative to disable PARTIAL syncs.
 	SyncPeriodPartial Duration `protobuf:"varint,2,opt,name=sync_period_partial,json=syncPeriodPartial,proto3,casttype=Duration" json:"sync_period_partial,omitempty"`
 	// Sync period for FULL syncs.
 	// Ideally sync_period_full is a multiple of sync_period_partial, so schedules
 	// line up perfectly.
-	// Set to negative to disable FULL syncs.
-	// Defaults to 24h.
+	// Set to zero or negative to disable FULL syncs.
 	SyncPeriodFull Duration `protobuf:"varint,3,opt,name=sync_period_full,json=syncPeriodFull,proto3,casttype=Duration" json:"sync_period_full,omitempty"`
 	// on_missing is the trigger used on devices missing from the MDM view in a
 	// FULL sync.
@@ -15553,7 +15836,7 @@ func (m *JamfInventoryEntry) Reset()         { *m = JamfInventoryEntry{} }
 func (m *JamfInventoryEntry) String() string { return proto.CompactTextString(m) }
 func (*JamfInventoryEntry) ProtoMessage()    {}
 func (*JamfInventoryEntry) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{281}
+	return fileDescriptor_9198ee693835762e, []int{286}
 }
 func (m *JamfInventoryEntry) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15610,7 +15893,7 @@ type MessageWithHeader struct {
 func (m *MessageWithHeader) Reset()      { *m = MessageWithHeader{} }
 func (*MessageWithHeader) ProtoMessage() {}
 func (*MessageWithHeader) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9198ee693835762e, []int{282}
+	return fileDescriptor_9198ee693835762e, []int{287}
 }
 func (m *MessageWithHeader) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -15639,6 +15922,304 @@ func (m *MessageWithHeader) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_MessageWithHeader proto.InternalMessageInfo
 
+// AWSMatcher matches AWS EC2 instances and AWS Databases
+type AWSMatcher struct {
+	// Types are AWS database types to match, "ec2", "rds", "redshift", "elasticache",
+	// or "memorydb".
+	Types []string `protobuf:"bytes,1,rep,name=Types,proto3" json:"types,omitempty"`
+	// Regions are AWS regions to query for databases.
+	Regions []string `protobuf:"bytes,2,rep,name=Regions,proto3" json:"regions,omitempty"`
+	// AssumeRoleARN is the AWS role to assume for database discovery.
+	AssumeRole *AssumeRole `protobuf:"bytes,3,opt,name=AssumeRole,proto3" json:"assume_role,omitempty"`
+	// Tags are AWS resource Tags to match.
+	Tags Labels `protobuf:"bytes,4,opt,name=Tags,proto3,customtype=Labels" json:"tags,omitempty"`
+	// Params sets the join method when installing on discovered EC2 nodes
+	Params *InstallerParams `protobuf:"bytes,5,opt,name=Params,proto3" json:"install,omitempty"`
+	// SSM provides options to use when sending a document command to
+	// an EC2 node
+	SSM                  *AWSSSM  `protobuf:"bytes,6,opt,name=SSM,proto3" json:"ssm,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *AWSMatcher) Reset()         { *m = AWSMatcher{} }
+func (m *AWSMatcher) String() string { return proto.CompactTextString(m) }
+func (*AWSMatcher) ProtoMessage()    {}
+func (*AWSMatcher) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{288}
+}
+func (m *AWSMatcher) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *AWSMatcher) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_AWSMatcher.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *AWSMatcher) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_AWSMatcher.Merge(m, src)
+}
+func (m *AWSMatcher) XXX_Size() int {
+	return m.Size()
+}
+func (m *AWSMatcher) XXX_DiscardUnknown() {
+	xxx_messageInfo_AWSMatcher.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AWSMatcher proto.InternalMessageInfo
+
+// AssumeRole provides a role ARN and ExternalID to assume an AWS role
+// when interacting with AWS resources.
+type AssumeRole struct {
+	// RoleARN is the fully specified AWS IAM role ARN.
+	RoleARN string `protobuf:"bytes,1,opt,name=RoleARN,proto3" json:"role_arn"`
+	// ExternalID is the external ID used to assume a role in another account.
+	ExternalID           string   `protobuf:"bytes,2,opt,name=ExternalID,proto3" json:"external_id"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *AssumeRole) Reset()         { *m = AssumeRole{} }
+func (m *AssumeRole) String() string { return proto.CompactTextString(m) }
+func (*AssumeRole) ProtoMessage()    {}
+func (*AssumeRole) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{289}
+}
+func (m *AssumeRole) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *AssumeRole) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_AssumeRole.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *AssumeRole) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_AssumeRole.Merge(m, src)
+}
+func (m *AssumeRole) XXX_Size() int {
+	return m.Size()
+}
+func (m *AssumeRole) XXX_DiscardUnknown() {
+	xxx_messageInfo_AssumeRole.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AssumeRole proto.InternalMessageInfo
+
+// InstallParams sets join method to use on discovered nodes
+type InstallerParams struct {
+	// JoinMethod is the method to use when joining the cluster
+	JoinMethod JoinMethod `protobuf:"bytes,1,opt,name=JoinMethod,proto3,casttype=JoinMethod" json:"join_method"`
+	// JoinToken is the token to use when joining the cluster
+	JoinToken string `protobuf:"bytes,2,opt,name=JoinToken,proto3" json:"join_token"`
+	// ScriptName is the name of the teleport installer script
+	// resource for the cloud instance to execute
+	ScriptName string `protobuf:"bytes,3,opt,name=ScriptName,proto3" json:"script_name,omitempty"`
+	// InstallTeleport disables agentless discovery
+	InstallTeleport bool `protobuf:"varint,4,opt,name=InstallTeleport,proto3" json:"install_teleport,omitempty"`
+	// SSHDConfig provides the path to write sshd configuration changes
+	SSHDConfig string `protobuf:"bytes,5,opt,name=SSHDConfig,proto3" json:"sshd_config,omitempty"`
+	// PublicProxyAddr is the address of the proxy the discovered node should use
+	// to connect to the cluster. Used only in Azure.
+	PublicProxyAddr      string   `protobuf:"bytes,6,opt,name=PublicProxyAddr,proto3" json:"proxy_addr,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *InstallerParams) Reset()         { *m = InstallerParams{} }
+func (m *InstallerParams) String() string { return proto.CompactTextString(m) }
+func (*InstallerParams) ProtoMessage()    {}
+func (*InstallerParams) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{290}
+}
+func (m *InstallerParams) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *InstallerParams) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_InstallerParams.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *InstallerParams) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_InstallerParams.Merge(m, src)
+}
+func (m *InstallerParams) XXX_Size() int {
+	return m.Size()
+}
+func (m *InstallerParams) XXX_DiscardUnknown() {
+	xxx_messageInfo_InstallerParams.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_InstallerParams proto.InternalMessageInfo
+
+// AWSSSM provides options to use when executing SSM documents
+type AWSSSM struct {
+	// DocumentName is the name of the document to use when executing an
+	// SSM command
+	DocumentName         string   `protobuf:"bytes,1,opt,name=DocumentName,proto3" json:"document_name,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *AWSSSM) Reset()         { *m = AWSSSM{} }
+func (m *AWSSSM) String() string { return proto.CompactTextString(m) }
+func (*AWSSSM) ProtoMessage()    {}
+func (*AWSSSM) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{291}
+}
+func (m *AWSSSM) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *AWSSSM) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_AWSSSM.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *AWSSSM) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_AWSSSM.Merge(m, src)
+}
+func (m *AWSSSM) XXX_Size() int {
+	return m.Size()
+}
+func (m *AWSSSM) XXX_DiscardUnknown() {
+	xxx_messageInfo_AWSSSM.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AWSSSM proto.InternalMessageInfo
+
+// AzureMatcher matches Azure resources.
+// It defines which resource types, filters and some configuration params.
+type AzureMatcher struct {
+	// Subscriptions are Azure subscriptions to query for resources.
+	Subscriptions []string `protobuf:"bytes,1,rep,name=Subscriptions,proto3" json:"subscriptions,omitempty"`
+	// ResourceGroups are Azure resource groups to query for resources.
+	ResourceGroups []string `protobuf:"bytes,2,rep,name=ResourceGroups,proto3" json:"resource_groups,omitempty"`
+	// Types are Azure types to match: "mysql", "postgres", "aks", "vm"
+	Types []string `protobuf:"bytes,3,rep,name=Types,proto3" json:"types,omitempty"`
+	// Regions are Azure locations to match for databases.
+	Regions []string `protobuf:"bytes,4,rep,name=Regions,proto3" json:"regions,omitempty"`
+	// ResourceTags are Azure tags on resources to match.
+	ResourceTags Labels `protobuf:"bytes,5,opt,name=ResourceTags,proto3,customtype=Labels" json:"tags,omitempty"`
+	// Params sets the join method when installing on
+	// discovered Azure nodes.
+	Params               *InstallerParams `protobuf:"bytes,6,opt,name=Params,proto3" json:"install_params,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}         `json:"-"`
+	XXX_unrecognized     []byte           `json:"-"`
+	XXX_sizecache        int32            `json:"-"`
+}
+
+func (m *AzureMatcher) Reset()         { *m = AzureMatcher{} }
+func (m *AzureMatcher) String() string { return proto.CompactTextString(m) }
+func (*AzureMatcher) ProtoMessage()    {}
+func (*AzureMatcher) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{292}
+}
+func (m *AzureMatcher) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *AzureMatcher) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_AzureMatcher.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *AzureMatcher) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_AzureMatcher.Merge(m, src)
+}
+func (m *AzureMatcher) XXX_Size() int {
+	return m.Size()
+}
+func (m *AzureMatcher) XXX_DiscardUnknown() {
+	xxx_messageInfo_AzureMatcher.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AzureMatcher proto.InternalMessageInfo
+
+// GCPMatcher matches GCP resources.
+type GCPMatcher struct {
+	// Types are GKE resource types to match: "gke".
+	Types []string `protobuf:"bytes,1,rep,name=Types,proto3" json:"types,omitempty"`
+	// Locations are GKE locations to search resources for.
+	Locations []string `protobuf:"bytes,2,rep,name=Locations,proto3" json:"locations,omitempty"`
+	// Tags are GCP labels to match.
+	Tags Labels `protobuf:"bytes,3,opt,name=Tags,proto3,customtype=Labels" json:"tags,omitempty"`
+	// ProjectIDs are the GCP project ID where the resources are deployed.
+	ProjectIDs           []string `protobuf:"bytes,4,rep,name=ProjectIDs,proto3" json:"project_ids,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GCPMatcher) Reset()         { *m = GCPMatcher{} }
+func (m *GCPMatcher) String() string { return proto.CompactTextString(m) }
+func (*GCPMatcher) ProtoMessage()    {}
+func (*GCPMatcher) Descriptor() ([]byte, []int) {
+	return fileDescriptor_9198ee693835762e, []int{293}
+}
+func (m *GCPMatcher) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *GCPMatcher) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_GCPMatcher.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *GCPMatcher) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_GCPMatcher.Merge(m, src)
+}
+func (m *GCPMatcher) XXX_Size() int {
+	return m.Size()
+}
+func (m *GCPMatcher) XXX_DiscardUnknown() {
+	xxx_messageInfo_GCPMatcher.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GCPMatcher proto.InternalMessageInfo
+
 func init() {
 	proto.RegisterEnum("types.DatabaseTLSMode", DatabaseTLSMode_name, DatabaseTLSMode_value)
 	proto.RegisterEnum("types.PrivateKeyType", PrivateKeyType_name, PrivateKeyType_value)
@@ -15646,6 +16227,7 @@ func init() {
 	proto.RegisterEnum("types.RoutingStrategy", RoutingStrategy_name, RoutingStrategy_value)
 	proto.RegisterEnum("types.UserTokenUsage", UserTokenUsage_name, UserTokenUsage_value)
 	proto.RegisterEnum("types.RequestState", RequestState_name, RequestState_value)
+	proto.RegisterEnum("types.CreateHostUserMode", CreateHostUserMode_name, CreateHostUserMode_value)
 	proto.RegisterEnum("types.CertExtensionMode", CertExtensionMode_name, CertExtensionMode_value)
 	proto.RegisterEnum("types.CertExtensionType", CertExtensionType_name, CertExtensionType_value)
 	proto.RegisterEnum("types.SessionState", SessionState_name, SessionState_value)
@@ -15683,12 +16265,14 @@ func init() {
 	proto.RegisterType((*ElastiCache)(nil), "types.ElastiCache")
 	proto.RegisterType((*MemoryDB)(nil), "types.MemoryDB")
 	proto.RegisterType((*RedshiftServerless)(nil), "types.RedshiftServerless")
+	proto.RegisterType((*OpenSearch)(nil), "types.OpenSearch")
 	proto.RegisterType((*GCPCloudSQL)(nil), "types.GCPCloudSQL")
 	proto.RegisterType((*Azure)(nil), "types.Azure")
 	proto.RegisterType((*AzureRedis)(nil), "types.AzureRedis")
 	proto.RegisterType((*AD)(nil), "types.AD")
 	proto.RegisterType((*DatabaseTLS)(nil), "types.DatabaseTLS")
 	proto.RegisterType((*MySQLOptions)(nil), "types.MySQLOptions")
+	proto.RegisterType((*MongoAtlas)(nil), "types.MongoAtlas")
 	proto.RegisterType((*InstanceV1)(nil), "types.InstanceV1")
 	proto.RegisterType((*InstanceSpecV1)(nil), "types.InstanceSpecV1")
 	proto.RegisterType((*InstanceControlLogEntry)(nil), "types.InstanceControlLogEntry")
@@ -15908,6 +16492,7 @@ func init() {
 	proto.RegisterType((*DatabaseServiceV1)(nil), "types.DatabaseServiceV1")
 	proto.RegisterType((*DatabaseServiceSpecV1)(nil), "types.DatabaseServiceSpecV1")
 	proto.RegisterType((*DatabaseResourceMatcher)(nil), "types.DatabaseResourceMatcher")
+	proto.RegisterType((*ResourceMatcherAWS)(nil), "types.ResourceMatcherAWS")
 	proto.RegisterType((*ClusterAlert)(nil), "types.ClusterAlert")
 	proto.RegisterType((*ClusterAlertSpec)(nil), "types.ClusterAlertSpec")
 	proto.RegisterType((*GetClusterAlertsRequest)(nil), "types.GetClusterAlertsRequest")
@@ -15919,6 +16504,7 @@ func init() {
 	proto.RegisterType((*PluginSpecV1)(nil), "types.PluginSpecV1")
 	proto.RegisterType((*PluginSlackAccessSettings)(nil), "types.PluginSlackAccessSettings")
 	proto.RegisterType((*PluginOpsgenieAccessSettings)(nil), "types.PluginOpsgenieAccessSettings")
+	proto.RegisterType((*PluginPagerDutySettings)(nil), "types.PluginPagerDutySettings")
 	proto.RegisterType((*PluginOpenAISettings)(nil), "types.PluginOpenAISettings")
 	proto.RegisterType((*PluginJamfSettings)(nil), "types.PluginJamfSettings")
 	proto.RegisterType((*PluginOktaSettings)(nil), "types.PluginOktaSettings")
@@ -15948,6 +16534,7 @@ func init() {
 	proto.RegisterType((*ScheduledAgentUpgradeWindow)(nil), "types.ScheduledAgentUpgradeWindow")
 	proto.RegisterType((*AgentUpgradeSchedule)(nil), "types.AgentUpgradeSchedule")
 	proto.RegisterType((*UserGroupV1)(nil), "types.UserGroupV1")
+	proto.RegisterType((*UserGroupSpecV1)(nil), "types.UserGroupSpecV1")
 	proto.RegisterType((*OktaImportRuleSpecV1)(nil), "types.OktaImportRuleSpecV1")
 	proto.RegisterType((*OktaImportRuleMappingV1)(nil), "types.OktaImportRuleMappingV1")
 	proto.RegisterMapType((map[string]string)(nil), "types.OktaImportRuleMappingV1.AddLabelsEntry")
@@ -15970,1348 +16557,1405 @@ func init() {
 	proto.RegisterType((*JamfSpecV1)(nil), "types.JamfSpecV1")
 	proto.RegisterType((*JamfInventoryEntry)(nil), "types.JamfInventoryEntry")
 	proto.RegisterType((*MessageWithHeader)(nil), "types.MessageWithHeader")
+	proto.RegisterType((*AWSMatcher)(nil), "types.AWSMatcher")
+	proto.RegisterType((*AssumeRole)(nil), "types.AssumeRole")
+	proto.RegisterType((*InstallerParams)(nil), "types.InstallerParams")
+	proto.RegisterType((*AWSSSM)(nil), "types.AWSSSM")
+	proto.RegisterType((*AzureMatcher)(nil), "types.AzureMatcher")
+	proto.RegisterType((*GCPMatcher)(nil), "types.GCPMatcher")
 }
 
 func init() { proto.RegisterFile("teleport/legacy/types/types.proto", fileDescriptor_9198ee693835762e) }
 
 var fileDescriptor_9198ee693835762e = []byte{
-	// 21367 bytes of a gzipped FileDescriptorProto
+	// 22190 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0xfd, 0x7d, 0x90, 0x1c, 0x49,
-	0x76, 0x18, 0x86, 0xa3, 0xba, 0xe7, 0xa3, 0xe7, 0xcd, 0x57, 0x4f, 0x62, 0x00, 0x0c, 0xb0, 0x1f,
-	0x83, 0x2d, 0xec, 0x62, 0x01, 0xec, 0x2e, 0x70, 0x18, 0xdc, 0xe2, 0x6e, 0x6f, 0xbf, 0xae, 0xa7,
-	0xbb, 0x81, 0xe9, 0xc5, 0x7c, 0xf4, 0x55, 0xcf, 0xc7, 0xed, 0x7d, 0xd5, 0xd5, 0x74, 0xe7, 0xcc,
-	0xd4, 0xa2, 0xbb, 0xab, 0xaf, 0xaa, 0x1a, 0xc0, 0x1c, 0xc9, 0x20, 0x29, 0x91, 0xba, 0x1f, 0x7f,
-	0xfc, 0x38, 0x52, 0x3e, 0x92, 0x27, 0x4b, 0xb2, 0x18, 0x0c, 0x49, 0x26, 0x2d, 0x91, 0xa1, 0x90,
-	0x14, 0x21, 0x3b, 0x64, 0xd3, 0xa6, 0x42, 0xc1, 0xa0, 0xa4, 0x90, 0x45, 0x47, 0xd8, 0xe1, 0xf0,
-	0x59, 0x31, 0x16, 0x49, 0xdb, 0xe1, 0x80, 0x23, 0x14, 0x76, 0x30, 0x42, 0x11, 0x3e, 0x07, 0x6d,
-	0x47, 0xbe, 0xcc, 0xac, 0xca, 0xac, 0xae, 0xee, 0xe9, 0x59, 0x60, 0x83, 0xc4, 0xda, 0xff, 0x00,
-	0xd3, 0x2f, 0xdf, 0x7b, 0x99, 0x95, 0xf9, 0x32, 0xf3, 0xe5, 0xcb, 0xf7, 0x5e, 0xc2, 0x4b, 0x21,
-	0x6d, 0xd2, 0x8e, 0xe7, 0x87, 0x37, 0x9a, 0x74, 0xdf, 0xa9, 0x1f, 0xde, 0x08, 0x0f, 0x3b, 0x34,
-	0xe0, 0xff, 0x5e, 0xef, 0xf8, 0x5e, 0xe8, 0x91, 0x51, 0xfc, 0x71, 0x61, 0x7e, 0xdf, 0xdb, 0xf7,
-	0x10, 0x72, 0x83, 0xfd, 0xc5, 0x0b, 0x2f, 0x2c, 0xee, 0x7b, 0xde, 0x7e, 0x93, 0xde, 0xc0, 0x5f,
-	0xbb, 0xdd, 0xbd, 0x1b, 0xa1, 0xdb, 0xa2, 0x41, 0xe8, 0xb4, 0x3a, 0x02, 0xe1, 0x6a, 0x54, 0x81,
-	0x13, 0x86, 0xac, 0x24, 0x74, 0xbd, 0xf6, 0x8d, 0x07, 0x37, 0xd5, 0x9f, 0x02, 0xf5, 0x8d, 0xf4,
-	0xb6, 0x3c, 0xf4, 0x9d, 0x4e, 0x87, 0xfa, 0xf1, 0x1f, 0x1c, 0xdd, 0xfc, 0x47, 0x59, 0x98, 0xb8,
-	0x47, 0x69, 0xa7, 0xd0, 0x74, 0x1f, 0x50, 0x72, 0x09, 0x46, 0xd6, 0x9d, 0x16, 0x5d, 0x30, 0x2e,
-	0x1a, 0x57, 0x26, 0x96, 0x67, 0x1f, 0x1f, 0x2d, 0x4e, 0x06, 0xd4, 0x7f, 0x40, 0x7d, 0xbb, 0xed,
-	0xb4, 0xa8, 0x85, 0x85, 0xe4, 0x35, 0x98, 0x60, 0xff, 0x07, 0x1d, 0xa7, 0x4e, 0x17, 0x32, 0x88,
-	0x39, 0xfd, 0xf8, 0x68, 0x71, 0xa2, 0x2d, 0x81, 0x56, 0x5c, 0x4e, 0x2e, 0xc3, 0xf8, 0x2a, 0x75,
-	0x02, 0x5a, 0x29, 0x2d, 0x64, 0x2f, 0x1a, 0x57, 0xb2, 0xcb, 0x53, 0x8f, 0x8f, 0x16, 0x73, 0x4d,
-	0x06, 0xb2, 0xdd, 0x86, 0x25, 0x0b, 0x49, 0x05, 0xc6, 0xcb, 0x8f, 0x3a, 0xae, 0x4f, 0x83, 0x85,
-	0x91, 0x8b, 0xc6, 0x95, 0xc9, 0xa5, 0x0b, 0xd7, 0x79, 0xa7, 0x5c, 0x97, 0x9d, 0x72, 0x7d, 0x53,
-	0x76, 0xca, 0xf2, 0xe9, 0xdf, 0x3f, 0x5a, 0x3c, 0xf5, 0xf8, 0x68, 0x71, 0x9c, 0x72, 0x92, 0x5f,
-	0xfc, 0x1f, 0x16, 0x0d, 0x4b, 0xd2, 0x93, 0x77, 0x60, 0x64, 0xf3, 0xb0, 0x43, 0x17, 0x26, 0x2e,
-	0x1a, 0x57, 0x66, 0x96, 0x5e, 0xbc, 0xce, 0x87, 0x21, 0xfa, 0xc8, 0xf8, 0x2f, 0x86, 0xb5, 0x9c,
-	0x7b, 0x7c, 0xb4, 0x38, 0xc2, 0x50, 0x2c, 0xa4, 0x22, 0x6f, 0xc0, 0xd8, 0x8a, 0x17, 0x84, 0x95,
-	0xd2, 0x02, 0xe0, 0xa7, 0x9d, 0x79, 0x7c, 0xb4, 0x38, 0x77, 0xe0, 0x05, 0xa1, 0xed, 0x36, 0x5e,
-	0xf7, 0x5a, 0x6e, 0x48, 0x5b, 0x9d, 0xf0, 0xd0, 0x12, 0x48, 0xe6, 0x23, 0x98, 0xd6, 0xf8, 0x91,
-	0x49, 0x18, 0xdf, 0x5a, 0xbf, 0xb7, 0xbe, 0xb1, 0xb3, 0x9e, 0x3f, 0x45, 0x72, 0x30, 0xb2, 0xbe,
-	0x51, 0x2a, 0xe7, 0x0d, 0x32, 0x0e, 0xd9, 0x42, 0xb5, 0x9a, 0xcf, 0x90, 0x29, 0xc8, 0x95, 0x0a,
-	0x9b, 0x85, 0xe5, 0x42, 0xad, 0x9c, 0xcf, 0x92, 0xd3, 0x30, 0xbb, 0x53, 0x59, 0x2f, 0x6d, 0xec,
-	0xd4, 0xec, 0x52, 0xb9, 0x76, 0x6f, 0x73, 0xa3, 0x9a, 0x1f, 0x21, 0x33, 0x00, 0xf7, 0xb6, 0x96,
-	0xcb, 0xd6, 0x7a, 0x79, 0xb3, 0x5c, 0xcb, 0x8f, 0x92, 0x79, 0xc8, 0x4b, 0x12, 0xbb, 0x56, 0xb6,
-	0xb6, 0x2b, 0xc5, 0x72, 0x7e, 0xcc, 0xfc, 0x4e, 0x16, 0x72, 0x6b, 0x34, 0x74, 0x1a, 0x4e, 0xe8,
-	0x90, 0xe7, 0xb5, 0x81, 0xc3, 0x6f, 0x52, 0x46, 0xec, 0x52, 0xef, 0x88, 0x8d, 0x3e, 0x3e, 0x5a,
-	0x34, 0xde, 0x50, 0x47, 0xea, 0x6d, 0x98, 0x2c, 0xd1, 0xa0, 0xee, 0xbb, 0x1d, 0x26, 0x4d, 0x38,
-	0x5a, 0x13, 0xcb, 0xe7, 0x1f, 0x1f, 0x2d, 0x9e, 0x69, 0xc4, 0x60, 0xa5, 0x07, 0x54, 0x6c, 0x52,
-	0x81, 0xb1, 0x55, 0x67, 0x97, 0x36, 0x83, 0x85, 0xd1, 0x8b, 0xd9, 0x2b, 0x93, 0x4b, 0xcf, 0x89,
-	0x5e, 0x97, 0x0d, 0xbc, 0xce, 0x4b, 0xcb, 0xed, 0xd0, 0x3f, 0x5c, 0x9e, 0x7f, 0x7c, 0xb4, 0x98,
-	0x6f, 0x22, 0x40, 0xed, 0x51, 0x8e, 0x42, 0x6a, 0xb1, 0x24, 0x8c, 0x1d, 0x2b, 0x09, 0x2f, 0xfc,
-	0xfe, 0xd1, 0xa2, 0xc1, 0x46, 0x48, 0x48, 0x42, 0xcc, 0x4f, 0x97, 0x89, 0x8b, 0x90, 0xa9, 0x94,
-	0x16, 0xc6, 0x51, 0x02, 0xf3, 0x8f, 0x8f, 0x16, 0xa7, 0xb4, 0xc1, 0xcc, 0x54, 0x4a, 0x17, 0xde,
-	0x82, 0x49, 0xa5, 0x8d, 0x24, 0x0f, 0xd9, 0xfb, 0xf4, 0x90, 0xf7, 0xa7, 0xc5, 0xfe, 0x24, 0xf3,
-	0x30, 0xfa, 0xc0, 0x69, 0x76, 0x45, 0x07, 0x5a, 0xfc, 0xc7, 0x17, 0x32, 0x9f, 0x37, 0xcc, 0xbf,
-	0x3c, 0x02, 0x39, 0xcb, 0xe3, 0xb3, 0x90, 0x5c, 0x85, 0xd1, 0x5a, 0xe8, 0x84, 0x72, 0x28, 0x4e,
-	0x3f, 0x3e, 0x5a, 0x9c, 0x65, 0x33, 0x94, 0x2a, 0xf5, 0x71, 0x0c, 0x86, 0x5a, 0x3d, 0x70, 0x02,
-	0x39, 0x24, 0x88, 0xda, 0x61, 0x00, 0x15, 0x15, 0x31, 0xc8, 0x65, 0x18, 0x59, 0xf3, 0x1a, 0x54,
-	0x8c, 0x0a, 0x79, 0x7c, 0xb4, 0x38, 0xd3, 0xf2, 0x1a, 0x2a, 0x22, 0x96, 0x93, 0xd7, 0x61, 0xa2,
-	0xd8, 0xf5, 0x7d, 0xda, 0x66, 0x02, 0x3c, 0x82, 0xc8, 0x33, 0x8f, 0x8f, 0x16, 0xa1, 0xce, 0x81,
-	0x6c, 0xca, 0xc5, 0x08, 0xac, 0xab, 0x6b, 0xa1, 0xe3, 0x87, 0xb4, 0xb1, 0x30, 0x3a, 0x54, 0x57,
-	0xb3, 0x49, 0x37, 0x17, 0x70, 0x92, 0x64, 0x57, 0x0b, 0x4e, 0x64, 0x05, 0x26, 0xef, 0xfa, 0x4e,
-	0x9d, 0x56, 0xa9, 0xef, 0x7a, 0x0d, 0x1c, 0xc3, 0xec, 0xf2, 0xe5, 0xc7, 0x47, 0x8b, 0x67, 0xf7,
-	0x19, 0xd8, 0xee, 0x20, 0x3c, 0xa6, 0xfe, 0xe1, 0xd1, 0x62, 0xae, 0xd4, 0xf5, 0xb1, 0xf7, 0x2c,
-	0x95, 0x94, 0x7c, 0x93, 0x0d, 0x49, 0x10, 0x62, 0xd7, 0xd2, 0x06, 0x8e, 0xde, 0xe0, 0x26, 0x9a,
-	0xa2, 0x89, 0x67, 0x9b, 0x4e, 0x10, 0xda, 0x3e, 0xa7, 0x4b, 0xb4, 0x53, 0x65, 0x49, 0x36, 0x20,
-	0x57, 0xab, 0x1f, 0xd0, 0x46, 0xb7, 0x49, 0x17, 0x72, 0xc8, 0xfe, 0x9c, 0x10, 0x5c, 0x39, 0x9e,
-	0xb2, 0x78, 0xf9, 0x82, 0xe0, 0x4d, 0x02, 0x01, 0x51, 0xfa, 0x3e, 0x62, 0xf2, 0x85, 0xdc, 0xf7,
-	0x7f, 0x6d, 0xf1, 0xd4, 0x4f, 0xfc, 0xeb, 0x8b, 0xa7, 0xcc, 0x7f, 0x94, 0x81, 0x7c, 0x92, 0x09,
-	0xd9, 0x83, 0xe9, 0xad, 0x4e, 0xc3, 0x09, 0x69, 0xb1, 0xe9, 0xd2, 0x76, 0x18, 0xa0, 0x90, 0x0c,
-	0xfe, 0xa6, 0x97, 0x45, 0xbd, 0x0b, 0x5d, 0x24, 0xb4, 0xeb, 0x9c, 0x32, 0xf1, 0x55, 0x3a, 0xdb,
-	0xb8, 0x9e, 0x1a, 0xae, 0xde, 0x01, 0x4a, 0xd8, 0xc9, 0xea, 0xe1, 0xeb, 0x7e, 0x9f, 0x7a, 0x04,
-	0x5b, 0x21, 0x40, 0xed, 0xc6, 0xee, 0x21, 0x4a, 0xe6, 0xf0, 0x02, 0xc4, 0x48, 0x52, 0x04, 0x88,
-	0x81, 0xcd, 0xff, 0xd1, 0x80, 0x19, 0x8b, 0x06, 0x5e, 0xd7, 0xaf, 0xd3, 0x15, 0xea, 0x34, 0xa8,
-	0xcf, 0xc4, 0xff, 0x9e, 0xdb, 0x6e, 0x88, 0x39, 0x85, 0xe2, 0x7f, 0xdf, 0x6d, 0xab, 0x53, 0x18,
-	0xcb, 0xc9, 0x67, 0x60, 0xbc, 0xd6, 0xdd, 0x45, 0x54, 0x3e, 0xa7, 0xce, 0xe2, 0x88, 0x75, 0x77,
-	0xed, 0x04, 0xba, 0x44, 0x23, 0x37, 0x60, 0x7c, 0x9b, 0xfa, 0x41, 0xbc, 0xe2, 0xe1, 0x7a, 0xff,
-	0x80, 0x83, 0x54, 0x02, 0x81, 0x45, 0xee, 0xc6, 0xab, 0xae, 0xd8, 0xa9, 0x66, 0x13, 0x6b, 0x5d,
-	0x2c, 0x2a, 0x2d, 0x01, 0x51, 0x45, 0x45, 0x62, 0x99, 0xbf, 0x94, 0x81, 0x7c, 0xc9, 0x09, 0x9d,
-	0x5d, 0x27, 0x10, 0xfd, 0xb9, 0x7d, 0x8b, 0xad, 0xe3, 0xca, 0x87, 0xe2, 0x3a, 0xce, 0x5a, 0xfe,
-	0xb1, 0x3f, 0xef, 0x95, 0xe4, 0xe7, 0x4d, 0xb2, 0x6d, 0x53, 0x7c, 0x5e, 0xfc, 0x51, 0xef, 0x1e,
-	0xff, 0x51, 0x79, 0xf1, 0x51, 0x39, 0xf9, 0x51, 0xf1, 0xa7, 0x90, 0x77, 0x61, 0xa4, 0xd6, 0xa1,
-	0x75, 0xb1, 0x88, 0xc8, 0xb5, 0x5f, 0xff, 0x38, 0x86, 0xb0, 0x7d, 0x6b, 0x79, 0x4a, 0xb0, 0x19,
-	0x09, 0x3a, 0xb4, 0x6e, 0x21, 0x99, 0x32, 0x69, 0xfe, 0xd9, 0x18, 0xcc, 0xa7, 0x91, 0x91, 0x77,
-	0xf5, 0xcd, 0x89, 0x77, 0xcf, 0x73, 0x7d, 0x37, 0xa7, 0x05, 0x43, 0xdf, 0x9e, 0xae, 0x41, 0xae,
-	0xca, 0x04, 0xb2, 0xee, 0x35, 0x45, 0xcf, 0xb1, 0x55, 0x31, 0xd7, 0x91, 0x30, 0xc3, 0x8a, 0xca,
-	0xc9, 0x73, 0x90, 0xdd, 0xb2, 0x2a, 0xa2, 0xbb, 0x26, 0x1e, 0x1f, 0x2d, 0x66, 0xbb, 0xbe, 0xbb,
-	0x60, 0x58, 0x0c, 0x4a, 0x6e, 0xc0, 0x58, 0xb1, 0x50, 0xa4, 0x7e, 0x88, 0xdd, 0x34, 0xb5, 0x7c,
-	0x8e, 0x49, 0x4b, 0xdd, 0xb1, 0xeb, 0xd4, 0x0f, 0xb5, 0xea, 0x05, 0x1a, 0x79, 0x0d, 0xb2, 0x85,
-	0x9d, 0x9a, 0xe8, 0x19, 0x10, 0x3d, 0x53, 0xd8, 0xa9, 0x2d, 0x4f, 0x8b, 0x8e, 0xc8, 0x3a, 0x0f,
-	0x03, 0xc6, 0xbd, 0xb0, 0x53, 0x53, 0x47, 0x6b, 0x6c, 0xc0, 0x68, 0x5d, 0x81, 0x1c, 0xd3, 0x3e,
-	0xd8, 0x06, 0x8f, 0x8b, 0xe2, 0x04, 0x57, 0xaa, 0x0e, 0x04, 0xcc, 0x8a, 0x4a, 0xc9, 0xa5, 0x48,
-	0x99, 0xc9, 0xc5, 0xfc, 0x84, 0x32, 0x23, 0x55, 0x18, 0xf2, 0x08, 0xa6, 0x4b, 0x87, 0x6d, 0xa7,
-	0xe5, 0xd6, 0xc5, 0x16, 0x3e, 0x81, 0x5b, 0xf8, 0xf5, 0x01, 0xc3, 0x78, 0x5d, 0x23, 0xe0, 0xbb,
-	0xba, 0x5c, 0x7c, 0x17, 0x1a, 0xbc, 0xcc, 0x4e, 0xee, 0xf0, 0x0b, 0x86, 0xa5, 0x57, 0xc4, 0xe6,
-	0x92, 0x5c, 0x22, 0x51, 0xdb, 0x8a, 0xc5, 0x4e, 0x82, 0xe3, 0xb9, 0xe4, 0x0b, 0x88, 0x3a, 0x97,
-	0xa2, 0x4d, 0xf7, 0x5d, 0xc8, 0xde, 0x2d, 0x56, 0x17, 0x26, 0x91, 0x07, 0x11, 0x3c, 0xee, 0x16,
-	0xab, 0xc5, 0xa6, 0xd7, 0x6d, 0xd4, 0xbe, 0xb4, 0xba, 0x7c, 0x4e, 0xb0, 0x99, 0xde, 0xaf, 0x77,
-	0xb4, 0x16, 0x31, 0x3a, 0x52, 0x86, 0x9c, 0xfc, 0xca, 0x85, 0x29, 0xe4, 0x31, 0x97, 0xf8, 0xf8,
-	0xed, 0x5b, 0x7c, 0xae, 0x35, 0xc4, 0x6f, 0xb5, 0x15, 0x12, 0x87, 0xdc, 0x42, 0x29, 0x7b, 0x74,
-	0x58, 0x29, 0x05, 0x0b, 0xd3, 0x17, 0xb3, 0x57, 0x26, 0x50, 0x3c, 0x4e, 0x77, 0x18, 0xcc, 0x76,
-	0x1b, 0xaa, 0xb2, 0x13, 0x21, 0x5e, 0xd8, 0x01, 0xd2, 0xdb, 0x99, 0x29, 0xea, 0xc7, 0x6b, 0xaa,
-	0xfa, 0x31, 0xb9, 0x74, 0x46, 0x34, 0xb0, 0xe8, 0xb5, 0x5a, 0x4e, 0xbb, 0x81, 0xb4, 0xdb, 0x4b,
-	0xaa, 0x56, 0x52, 0x80, 0x99, 0xb8, 0xf5, 0xab, 0x6e, 0x10, 0x92, 0x1b, 0x30, 0x21, 0x21, 0x6c,
-	0xe7, 0xc9, 0xa6, 0x7e, 0xa7, 0x15, 0xe3, 0x98, 0xbf, 0x97, 0x01, 0x88, 0x4b, 0x9e, 0xd1, 0xc5,
-	0xe9, 0x73, 0xda, 0xe2, 0x74, 0x26, 0x29, 0xd5, 0x7d, 0x97, 0x25, 0xf2, 0x3e, 0x8c, 0x31, 0x3d,
-	0xad, 0x2b, 0xf5, 0xd0, 0x73, 0x49, 0x52, 0x2c, 0xdc, 0xbe, 0xb5, 0x3c, 0x23, 0x88, 0xc7, 0x02,
-	0x84, 0x58, 0x82, 0x4c, 0x59, 0xd7, 0x7e, 0x6a, 0x2c, 0x1e, 0x0c, 0xb1, 0xa2, 0x5d, 0x51, 0x96,
-	0x24, 0x23, 0x9e, 0xc4, 0x72, 0x49, 0x52, 0x16, 0xa4, 0xf3, 0x7c, 0x41, 0xe2, 0x9d, 0x3a, 0x2e,
-	0x16, 0xa4, 0xe4, 0x72, 0xc4, 0x3b, 0xf0, 0xd8, 0xe5, 0xa8, 0x93, 0x9c, 0xeb, 0x23, 0x28, 0x06,
-	0x57, 0x52, 0x7b, 0x25, 0x6d, 0x96, 0x5f, 0x3c, 0x6e, 0x96, 0x27, 0xe7, 0xf8, 0xad, 0x7e, 0x0b,
-	0xe0, 0x19, 0x39, 0x25, 0x9d, 0x87, 0x2a, 0x39, 0x2e, 0x84, 0x6f, 0xf3, 0xf9, 0x3c, 0xd6, 0x77,
-	0x3e, 0x9f, 0x49, 0x9d, 0xcf, 0x7c, 0x36, 0xbf, 0x0d, 0xa3, 0x85, 0x6f, 0x77, 0x7d, 0x2a, 0x14,
-	0xc6, 0x29, 0x59, 0x27, 0x83, 0x45, 0x0b, 0xc1, 0xac, 0xc3, 0x7e, 0xaa, 0x8a, 0x36, 0x96, 0xb3,
-	0x9a, 0x37, 0x57, 0x6b, 0x42, 0x19, 0x24, 0x89, 0x6e, 0xd9, 0x5c, 0x55, 0x9a, 0x1d, 0x6a, 0x5f,
-	0xcd, 0xa8, 0xc8, 0x0d, 0xc8, 0x14, 0x4a, 0x78, 0xee, 0x9c, 0x5c, 0x9a, 0x90, 0xd5, 0x96, 0x96,
-	0xe7, 0x05, 0xc9, 0x94, 0xa3, 0x1d, 0x3a, 0x0a, 0x25, 0xb2, 0x0c, 0xa3, 0x6b, 0x87, 0xb5, 0x2f,
-	0xad, 0x8a, 0xd5, 0xef, 0xb4, 0x94, 0x6b, 0x06, 0xdb, 0xc0, 0xad, 0x2b, 0x88, 0x5b, 0xdc, 0x3a,
-	0x0c, 0xbe, 0xd5, 0x54, 0x5b, 0x8c, 0x68, 0xa4, 0x0a, 0x13, 0x85, 0x46, 0xcb, 0x6d, 0x6f, 0x05,
-	0xd4, 0x17, 0x2b, 0xe0, 0x42, 0xa2, 0xdd, 0x51, 0xf9, 0xf2, 0xc2, 0xe3, 0xa3, 0xc5, 0x79, 0x87,
-	0xfd, 0xb4, 0xbb, 0x01, 0xf5, 0x15, 0x6e, 0x31, 0x93, 0x4f, 0x6e, 0x49, 0xba, 0x09, 0x73, 0x3d,
-	0x4d, 0x1a, 0x7c, 0x74, 0x35, 0xff, 0xa6, 0xaa, 0x25, 0x89, 0x09, 0xc7, 0xce, 0xe8, 0x42, 0xec,
-	0x8d, 0x58, 0x67, 0xeb, 0x11, 0xfb, 0x48, 0xe8, 0xaf, 0x72, 0x11, 0xcc, 0xf4, 0x88, 0xe0, 0xa4,
-	0xb2, 0x07, 0x73, 0xc1, 0x8b, 0x06, 0x24, 0xfb, 0xf1, 0x07, 0xe4, 0x7d, 0x98, 0x5a, 0x73, 0xda,
-	0xce, 0x3e, 0x6d, 0xb0, 0xef, 0xe3, 0x53, 0x8c, 0x2b, 0x2b, 0xe7, 0x5a, 0x1c, 0x8e, 0x7d, 0xaf,
-	0x4a, 0x8f, 0x46, 0x40, 0x6e, 0x4a, 0x01, 0x1e, 0x4d, 0x11, 0x60, 0xa9, 0x37, 0x8c, 0xa2, 0x00,
-	0x0b, 0xb1, 0x35, 0xbf, 0x3f, 0x86, 0xdf, 0x48, 0x5e, 0x87, 0x31, 0x8b, 0xee, 0xc7, 0x2a, 0x12,
-	0x1e, 0xb5, 0x7d, 0x84, 0xa8, 0x1d, 0xc3, 0x71, 0x70, 0xff, 0xa5, 0x8d, 0xe0, 0xc0, 0xdd, 0x0b,
-	0x45, 0xef, 0x44, 0xfb, 0xaf, 0x00, 0x2b, 0xfb, 0xaf, 0x80, 0x68, 0xfb, 0xaf, 0x80, 0xb1, 0x49,
-	0x6e, 0x95, 0x6a, 0xa2, 0xd3, 0x64, 0x0f, 0x5b, 0x25, 0x65, 0xb6, 0xf8, 0xda, 0xf6, 0xc7, 0xb0,
-	0xc9, 0x6d, 0x98, 0x28, 0xd4, 0xeb, 0x5e, 0x57, 0x39, 0xab, 0x72, 0xf1, 0xe4, 0x40, 0xdd, 0xde,
-	0x12, 0xa3, 0x92, 0x1a, 0x4c, 0x96, 0xd9, 0x01, 0xcf, 0x2d, 0x3a, 0xf5, 0x03, 0xd9, 0x49, 0x72,
-	0xaa, 0x2a, 0x25, 0xd1, 0x81, 0xe3, 0x0c, 0x45, 0x60, 0x9d, 0x01, 0x55, 0x03, 0x86, 0x82, 0x4b,
-	0x36, 0x61, 0xb2, 0x46, 0xeb, 0x3e, 0x0d, 0x6b, 0xa1, 0xe7, 0xd3, 0xc4, 0xca, 0xa3, 0x94, 0x2c,
-	0xbf, 0x28, 0xcf, 0x98, 0x01, 0x02, 0xed, 0x80, 0x41, 0x55, 0xae, 0x0a, 0x32, 0x3f, 0x2c, 0xb4,
-	0x3c, 0xff, 0xb0, 0xb4, 0x2c, 0x56, 0xa3, 0x78, 0xeb, 0xe2, 0x60, 0xf5, 0xb0, 0xc0, 0x20, 0x8d,
-	0x5d, 0xfd, 0xb0, 0xc0, 0xb1, 0x70, 0xa4, 0x4a, 0x35, 0x54, 0x1a, 0xc4, 0xda, 0x34, 0x1b, 0xf7,
-	0x32, 0x82, 0x95, 0x91, 0x6a, 0x04, 0xa8, 0x72, 0x68, 0x23, 0x25, 0xb0, 0x48, 0x07, 0x88, 0x1c,
-	0x35, 0xae, 0xd0, 0x35, 0x69, 0x10, 0x88, 0x25, 0xeb, 0x7c, 0x62, 0xf0, 0x63, 0x84, 0xe5, 0x57,
-	0x04, 0xf3, 0x17, 0xa4, 0x18, 0x88, 0xf3, 0x21, 0x2b, 0x54, 0xea, 0x49, 0xe1, 0x4d, 0xde, 0x02,
-	0x28, 0x3f, 0x0a, 0xa9, 0xdf, 0x76, 0x9a, 0x91, 0x51, 0x0d, 0xcd, 0x4a, 0x54, 0x40, 0xf5, 0x81,
-	0x56, 0x90, 0x49, 0x11, 0xa6, 0x0b, 0x41, 0xd0, 0x6d, 0x51, 0xcb, 0x6b, 0xd2, 0x82, 0xb5, 0x8e,
-	0xcb, 0xdb, 0xc4, 0xf2, 0x0b, 0x8f, 0x8f, 0x16, 0xcf, 0x3b, 0x58, 0x60, 0xfb, 0x5e, 0x93, 0xda,
-	0x8e, 0xaf, 0x4a, 0xb7, 0x4e, 0x63, 0xfe, 0x88, 0x36, 0xb2, 0x4c, 0xea, 0xee, 0xd1, 0xc3, 0xaa,
-	0x4f, 0xf7, 0xdc, 0x47, 0x62, 0x92, 0xa0, 0xd4, 0xdd, 0xa7, 0x87, 0x76, 0x07, 0xa1, 0xaa, 0xd4,
-	0x45, 0xa8, 0xe4, 0xb3, 0x90, 0xbb, 0xb7, 0x56, 0xbb, 0x47, 0x0f, 0x2b, 0x25, 0xb1, 0x15, 0x73,
-	0xb2, 0x56, 0x60, 0x33, 0x52, 0xed, 0x1b, 0x22, 0x4c, 0x73, 0x39, 0x9e, 0x61, 0xac, 0xe6, 0x62,
-	0xb3, 0x1b, 0x84, 0xd4, 0xaf, 0x94, 0xd4, 0x9a, 0xeb, 0x1c, 0x98, 0x90, 0xf7, 0x08, 0xd5, 0xfc,
-	0xb9, 0x0c, 0xce, 0x2e, 0xd6, 0x91, 0x95, 0x36, 0x3b, 0x3b, 0xd7, 0x69, 0xc4, 0x00, 0x3b, 0xd2,
-	0x15, 0xd0, 0x44, 0x47, 0xc6, 0xc8, 0x7a, 0xd5, 0x99, 0xa1, 0xab, 0x66, 0x55, 0xca, 0x93, 0xb8,
-	0x30, 0xe0, 0x8a, 0x2a, 0x7d, 0x01, 0x4d, 0x54, 0x19, 0x23, 0x93, 0xcb, 0x30, 0x5e, 0x29, 0xac,
-	0x15, 0xba, 0xe1, 0x01, 0xce, 0xed, 0x1c, 0x57, 0x6f, 0x5c, 0xa7, 0x65, 0x3b, 0xdd, 0xf0, 0xc0,
-	0x92, 0x85, 0xec, 0x00, 0x5e, 0xeb, 0xee, 0xb6, 0x69, 0xc8, 0x4d, 0x87, 0x62, 0x31, 0x0f, 0x38,
-	0x28, 0xa1, 0x35, 0x32, 0x90, 0xf9, 0xbb, 0x46, 0x3c, 0x17, 0xc8, 0x65, 0x6d, 0xf3, 0x40, 0xc3,
-	0x00, 0xdb, 0x3c, 0x54, 0xc3, 0x00, 0x5a, 0x40, 0x2d, 0x20, 0xc5, 0x6e, 0x10, 0x7a, 0xad, 0x72,
-	0xbb, 0xd1, 0xf1, 0xdc, 0x76, 0x88, 0x54, 0xbc, 0x27, 0xcc, 0xc7, 0x47, 0x8b, 0x2f, 0xd6, 0xb1,
-	0xd4, 0xa6, 0xa2, 0xd8, 0x4e, 0x70, 0x49, 0xa1, 0x7e, 0x82, 0xce, 0x31, 0xff, 0x79, 0x46, 0x5b,
-	0xc3, 0x58, 0xf3, 0x2c, 0xda, 0x69, 0xba, 0x75, 0x3c, 0xce, 0xdc, 0xf5, 0xbd, 0x6e, 0x27, 0x1a,
-	0x62, 0x6c, 0x9e, 0x1f, 0x97, 0xda, 0xfb, 0xac, 0x58, 0xe7, 0x9d, 0x42, 0x4d, 0xbe, 0x08, 0x53,
-	0x6c, 0x3b, 0x11, 0x3f, 0x83, 0x85, 0x0c, 0xf6, 0xee, 0xf3, 0x68, 0xe2, 0x09, 0xa8, 0x1f, 0xb1,
-	0xd1, 0xf6, 0x21, 0x95, 0x82, 0x34, 0x60, 0x61, 0xd3, 0x77, 0xda, 0x81, 0x1b, 0x96, 0xdb, 0x75,
-	0xff, 0x10, 0xb7, 0xbf, 0x72, 0xdb, 0xd9, 0x6d, 0xd2, 0x06, 0x7e, 0x6e, 0x6e, 0xf9, 0xca, 0xe3,
-	0xa3, 0xc5, 0x97, 0x43, 0x8e, 0x63, 0xd3, 0x08, 0xc9, 0xa6, 0x1c, 0x4b, 0xe1, 0xdc, 0x97, 0x13,
-	0xdb, 0x2e, 0x65, 0xb7, 0xa2, 0xd9, 0x7e, 0x24, 0x3a, 0xdb, 0x9f, 0x8b, 0x46, 0x83, 0xad, 0x4b,
-	0x6a, 0x33, 0x55, 0x02, 0xf3, 0xdf, 0x19, 0xf1, 0x2a, 0x4b, 0xde, 0x81, 0x49, 0x21, 0xbe, 0x8a,
-	0x5c, 0x5c, 0x60, 0xeb, 0xb5, 0x94, 0xf5, 0xc4, 0xc8, 0xaa, 0xe8, 0xec, 0x0c, 0x53, 0x28, 0xae,
-	0x2a, 0xb2, 0x81, 0x67, 0x18, 0xa7, 0xde, 0x4c, 0x52, 0x49, 0x34, 0x26, 0x04, 0x9b, 0xab, 0x35,
-	0xbd, 0x57, 0x50, 0x08, 0xc2, 0x66, 0x90, 0xd2, 0x0d, 0x0a, 0xf2, 0x93, 0x7f, 0xf8, 0x7f, 0x6b,
-	0xa4, 0x2d, 0xe6, 0x64, 0x19, 0xa6, 0x77, 0x3c, 0xff, 0x3e, 0x8e, 0xaf, 0xd2, 0x09, 0x38, 0xf2,
-	0x0f, 0x65, 0x41, 0xf2, 0x83, 0x74, 0x12, 0xb5, 0x6d, 0x4a, 0x6f, 0xe8, 0x6d, 0x4b, 0x70, 0xd0,
-	0x08, 0xd8, 0x38, 0x44, 0x1c, 0xa3, 0xd9, 0x81, 0xe3, 0x10, 0x37, 0x41, 0x13, 0x61, 0x15, 0xdd,
-	0xfc, 0x09, 0x03, 0x26, 0x15, 0x75, 0x9f, 0xad, 0x5f, 0x55, 0xdf, 0xfb, 0x88, 0xd6, 0x43, 0x7d,
-	0xe9, 0xec, 0x70, 0x60, 0x62, 0xfd, 0x8a, 0x50, 0x13, 0x4b, 0x66, 0xe6, 0x04, 0x4b, 0xa6, 0xf9,
-	0xbf, 0x1b, 0x42, 0x0b, 0x1b, 0x7a, 0x8d, 0xd1, 0xd7, 0x83, 0xcc, 0x49, 0x16, 0xcb, 0x2f, 0xc2,
-	0xa8, 0x45, 0x1b, 0x6e, 0x20, 0x34, 0xa8, 0x39, 0x55, 0xe3, 0xc3, 0x82, 0x58, 0xe9, 0xf4, 0xd9,
-	0x4f, 0x55, 0xe9, 0xc4, 0x72, 0xb6, 0x55, 0x56, 0x82, 0x3b, 0x4d, 0xfa, 0xc8, 0xe5, 0x92, 0x20,
-	0x16, 0x5d, 0xdc, 0x2a, 0xdd, 0xc0, 0xde, 0x63, 0x25, 0x62, 0xcf, 0x56, 0x47, 0x5d, 0xa3, 0x31,
-	0x3f, 0x04, 0x88, 0xab, 0x24, 0xf7, 0x20, 0x2f, 0xe6, 0x86, 0xdb, 0xde, 0xaf, 0x7a, 0x4d, 0xb7,
-	0x2e, 0xb4, 0xff, 0xe5, 0xc5, 0xc7, 0x47, 0x8b, 0xcf, 0xd5, 0xa3, 0x32, 0xbb, 0x83, 0x85, 0x0a,
-	0xdf, 0x1e, 0x42, 0xf3, 0x3f, 0xcc, 0xb0, 0xb3, 0x11, 0xeb, 0xa3, 0x7b, 0xf4, 0x30, 0x74, 0x76,
-	0xef, 0xb8, 0x4d, 0xaa, 0xee, 0x61, 0xf7, 0x11, 0x6a, 0xef, 0xb9, 0x9a, 0x61, 0x5d, 0x41, 0x26,
-	0xb7, 0x20, 0x77, 0xcf, 0xdf, 0x7d, 0x13, 0x09, 0x33, 0xd1, 0x69, 0xf7, 0xf4, 0x7d, 0x7f, 0xf7,
-	0xcd, 0x24, 0x59, 0x84, 0x48, 0x4c, 0x18, 0x2b, 0x79, 0x2d, 0xc7, 0x95, 0x16, 0x06, 0x60, 0xc7,
-	0xf4, 0x06, 0x42, 0x2c, 0x51, 0xc2, 0xce, 0xd7, 0xb5, 0xea, 0xba, 0x98, 0x7e, 0x78, 0xbe, 0x0e,
-	0x3a, 0x6d, 0x8b, 0xc1, 0x58, 0x9d, 0xab, 0xa5, 0x42, 0x15, 0x8f, 0x1a, 0xa3, 0x71, 0x9d, 0xcd,
-	0x86, 0xd3, 0x49, 0x1e, 0x36, 0x22, 0x44, 0xf2, 0x2e, 0x4c, 0xde, 0x2b, 0x15, 0x57, 0xbc, 0x80,
-	0x4f, 0x9d, 0xb1, 0x78, 0xea, 0xdc, 0x6f, 0xd4, 0x6d, 0xb4, 0xbe, 0x25, 0xd7, 0x20, 0x05, 0xdf,
-	0xfc, 0x2d, 0x03, 0x26, 0x95, 0x03, 0x27, 0xf9, 0xac, 0xb8, 0xfa, 0x31, 0xf0, 0x3a, 0xf3, 0x6c,
-	0xef, 0x91, 0x94, 0x95, 0xf2, 0x73, 0x53, 0xcb, 0x6b, 0x50, 0x71, 0x11, 0x14, 0x1f, 0x91, 0x32,
-	0xc3, 0x1c, 0x91, 0xde, 0x02, 0xe0, 0x32, 0x80, 0x4d, 0x56, 0xf6, 0x32, 0xe5, 0xfa, 0x57, 0x1d,
-	0x97, 0x18, 0xd9, 0xb4, 0x60, 0x4a, 0x3d, 0x1e, 0xb1, 0xe5, 0x47, 0x98, 0xb3, 0x85, 0x6d, 0x47,
-	0x59, 0x7e, 0x04, 0xb7, 0x5e, 0xf3, 0xba, 0x4e, 0x62, 0xfe, 0x05, 0x23, 0x9e, 0xb8, 0xdb, 0x37,
-	0xc9, 0xdb, 0x30, 0xc6, 0x2f, 0x02, 0xc4, 0x7d, 0xc9, 0x99, 0x48, 0x51, 0x55, 0x6f, 0x09, 0xb8,
-	0x11, 0xe7, 0x0f, 0xf8, 0x85, 0xe0, 0x29, 0x4b, 0x90, 0x44, 0xf6, 0x1f, 0xfd, 0x90, 0x2a, 0xb9,
-	0xa3, 0xa5, 0xe3, 0x66, 0x9a, 0xfd, 0xc7, 0xfc, 0x0f, 0xb2, 0x30, 0xa3, 0xa3, 0xa9, 0xb7, 0x05,
-	0xc6, 0x50, 0xb7, 0x05, 0x5f, 0x84, 0x1c, 0xfb, 0x32, 0xb7, 0x4e, 0xe5, 0x06, 0xfc, 0x32, 0x5a,
-	0xc5, 0x04, 0x4c, 0xbb, 0x05, 0x83, 0xda, 0x61, 0x10, 0xd2, 0x16, 0xd3, 0x5b, 0xad, 0x88, 0x8a,
-	0x2c, 0x29, 0xc6, 0xde, 0x6c, 0xbc, 0x27, 0x49, 0x63, 0xaf, 0x2a, 0x81, 0x91, 0xd9, 0xf7, 0x0d,
-	0x18, 0x63, 0xba, 0x55, 0x74, 0xac, 0xc2, 0x56, 0x32, 0xb5, 0x2b, 0x71, 0x87, 0xcd, 0x91, 0xc8,
-	0x0e, 0xe4, 0x56, 0x9d, 0x20, 0xac, 0x51, 0xda, 0x1e, 0xe2, 0x1e, 0x70, 0x51, 0x74, 0xd5, 0x69,
-	0xbc, 0x64, 0x0b, 0x28, 0x6d, 0x27, 0x2e, 0x72, 0x22, 0x66, 0xe4, 0xeb, 0x00, 0x45, 0xaf, 0x1d,
-	0xfa, 0x5e, 0x73, 0xd5, 0xdb, 0x5f, 0x18, 0x43, 0x53, 0xd3, 0x8b, 0x89, 0x01, 0x88, 0x11, 0xb8,
-	0x81, 0x29, 0x3a, 0xb4, 0xd5, 0x79, 0x81, 0xdd, 0xf4, 0xf6, 0x55, 0xc9, 0x8b, 0xf1, 0xcd, 0x1f,
-	0x66, 0xe0, 0x5c, 0x1f, 0x36, 0x6c, 0xd1, 0xc6, 0x4d, 0x55, 0x59, 0xb4, 0x13, 0x7b, 0x29, 0xbf,
-	0xee, 0xe7, 0x17, 0xc3, 0x4c, 0x36, 0x46, 0xd2, 0x2f, 0x86, 0xc9, 0x07, 0x30, 0xc2, 0x3e, 0x7e,
-	0x88, 0x0b, 0x2e, 0x79, 0x02, 0x9b, 0x09, 0x5d, 0x75, 0x60, 0xb0, 0x53, 0x90, 0x07, 0xf9, 0x2c,
-	0x64, 0x37, 0x37, 0x57, 0x71, 0x54, 0xb2, 0xa8, 0xd8, 0x4d, 0x87, 0x61, 0x53, 0x13, 0x82, 0x69,
-	0x46, 0x7b, 0x3d, 0xba, 0x0f, 0x65, 0xe8, 0xe4, 0xcb, 0x89, 0xcb, 0xf5, 0x6b, 0x83, 0xbb, 0x70,
-	0xf8, 0xbb, 0xf6, 0x27, 0xb9, 0xf4, 0xf6, 0xe3, 0xc9, 0x71, 0xc7, 0x6d, 0x86, 0xd4, 0x27, 0x17,
-	0xb8, 0xac, 0xc7, 0xc7, 0x1b, 0x2b, 0xfa, 0x4d, 0x16, 0xe2, 0x89, 0xc3, 0x39, 0x45, 0x33, 0xe4,
-	0x9a, 0x32, 0x43, 0xb2, 0x38, 0x43, 0x66, 0xfa, 0xcd, 0x05, 0xf3, 0x27, 0x33, 0xb2, 0x8a, 0xed,
-	0xa5, 0x67, 0xd4, 0x1a, 0xfd, 0xa6, 0x66, 0x8d, 0x3e, 0x1d, 0x19, 0x18, 0xa2, 0xbb, 0x95, 0xa5,
-	0x63, 0xae, 0xc8, 0xde, 0x82, 0x29, 0xd9, 0x05, 0x68, 0xd4, 0xbf, 0x0a, 0xe3, 0xf2, 0x92, 0x97,
-	0x9b, 0xf4, 0x67, 0x35, 0x9e, 0xdb, 0x4b, 0x96, 0x2c, 0x37, 0xff, 0xab, 0x51, 0x49, 0xcb, 0x6b,
-	0x62, 0x5d, 0x58, 0x68, 0x34, 0x7c, 0xb5, 0x0b, 0x9d, 0x46, 0xc3, 0xb7, 0x10, 0xca, 0xf6, 0x84,
-	0x6a, 0x77, 0xb7, 0xe9, 0xd6, 0x11, 0x47, 0xd1, 0x67, 0x3a, 0x08, 0xb5, 0x19, 0xaa, 0x3a, 0x33,
-	0x63, 0x64, 0xed, 0x86, 0x2a, 0x3b, 0xf0, 0x86, 0xea, 0x1b, 0x30, 0x51, 0x6c, 0x35, 0x34, 0x63,
-	0xb4, 0x99, 0xd2, 0x29, 0xd7, 0x23, 0x24, 0x2e, 0xd6, 0xcf, 0x8b, 0x3e, 0x9a, 0xaf, 0xb7, 0x1a,
-	0xbd, 0x26, 0xe8, 0x98, 0xa5, 0x76, 0xc5, 0x34, 0xfa, 0x24, 0x57, 0x4c, 0xb7, 0x61, 0x62, 0x2b,
-	0xa0, 0x9b, 0xdd, 0x76, 0x9b, 0x36, 0x71, 0x4f, 0xcf, 0x71, 0x15, 0xb4, 0x1b, 0x50, 0x3b, 0x44,
-	0xa8, 0xda, 0x80, 0x08, 0x55, 0x15, 0xab, 0xf1, 0x01, 0x62, 0xf5, 0x59, 0x18, 0x29, 0x74, 0x3a,
-	0xf2, 0xee, 0x2d, 0x32, 0x52, 0x76, 0x3a, 0x38, 0x83, 0x67, 0x9c, 0x4e, 0x47, 0xbf, 0x49, 0x43,
-	0x6c, 0xbc, 0x71, 0xa2, 0xd4, 0xc7, 0x01, 0x9a, 0x8c, 0xf5, 0x93, 0x0e, 0xa5, 0x7e, 0x72, 0x78,
-	0x22, 0x44, 0xed, 0x9a, 0x6a, 0x6a, 0xc8, 0x6b, 0x2a, 0xf2, 0x12, 0x4c, 0x29, 0xc3, 0x2e, 0xee,
-	0xb7, 0xac, 0xc9, 0x4e, 0x34, 0xe6, 0xc1, 0x85, 0x1a, 0xcc, 0xe8, 0xa3, 0xf4, 0x14, 0x4c, 0xc6,
-	0x1f, 0x8c, 0xe4, 0x72, 0xf9, 0x89, 0x0f, 0x46, 0x72, 0x90, 0x9f, 0xb4, 0xc8, 0xbd, 0xee, 0x2e,
-	0xf5, 0xdb, 0x34, 0xa4, 0x81, 0xd0, 0x2f, 0x03, 0xf3, 0x3b, 0x19, 0x98, 0x2c, 0x74, 0x3a, 0xcf,
-	0xf8, 0x05, 0xfa, 0xe7, 0xb5, 0x55, 0xe1, 0x6c, 0x3c, 0xfa, 0x27, 0xb8, 0x3b, 0xff, 0xed, 0x0c,
-	0xcc, 0x26, 0x28, 0xd4, 0xd6, 0x1b, 0x43, 0x5e, 0x28, 0x67, 0x86, 0xbc, 0x50, 0xce, 0xf6, 0xbf,
-	0x50, 0x56, 0xe7, 0xdc, 0xc8, 0x93, 0xcc, 0xb9, 0x57, 0x21, 0x5b, 0xe8, 0x74, 0x92, 0x66, 0xf0,
-	0x4e, 0x67, 0xfb, 0x16, 0xd7, 0xd3, 0x9d, 0x4e, 0xc7, 0x62, 0x18, 0x9a, 0x48, 0x8f, 0x0d, 0x29,
-	0xd2, 0xe6, 0x1b, 0x30, 0x81, 0xbc, 0x70, 0x19, 0xbd, 0x28, 0xe6, 0x1f, 0x5f, 0x43, 0xb5, 0xba,
-	0xf8, 0x5c, 0x33, 0xff, 0x4f, 0x76, 0x20, 0x64, 0xbf, 0x9f, 0x51, 0x19, 0x5b, 0xd2, 0x64, 0x2c,
-	0xaf, 0xc8, 0xd8, 0x30, 0xd2, 0xf5, 0x4b, 0x23, 0xd8, 0x5b, 0x42, 0xae, 0xc4, 0x95, 0xa4, 0x91,
-	0x72, 0x25, 0xf9, 0x04, 0xbb, 0xc6, 0xfd, 0xe4, 0xe5, 0x64, 0x16, 0x07, 0xe3, 0x52, 0xb2, 0xa9,
-	0x4f, 0xe5, 0x5e, 0x72, 0x05, 0x48, 0xa5, 0x1d, 0xd0, 0x7a, 0xd7, 0xa7, 0xb5, 0xfb, 0x6e, 0x67,
-	0x9b, 0xfa, 0xee, 0xde, 0xa1, 0x38, 0x35, 0xe3, 0xc2, 0xee, 0x8a, 0x52, 0x3b, 0xb8, 0xef, 0x76,
-	0xd8, 0x91, 0xc5, 0xdd, 0x3b, 0xb4, 0x52, 0x68, 0xc8, 0xfb, 0x30, 0x6e, 0xd1, 0x87, 0xbe, 0x1b,
-	0xca, 0xbb, 0x88, 0x99, 0xe8, 0x78, 0x82, 0x50, 0xae, 0x7e, 0xfb, 0xfc, 0x87, 0x3a, 0xfe, 0xa2,
-	0x9c, 0x2c, 0xf1, 0xfb, 0x29, 0x7e, 0xe7, 0x30, 0x1d, 0x7f, 0x6d, 0x61, 0xa7, 0xb6, 0x3c, 0xd7,
-	0xe7, 0x86, 0xf4, 0x2a, 0x8c, 0xa2, 0x75, 0x44, 0x6c, 0x2a, 0xe8, 0x3b, 0x58, 0x67, 0x00, 0xd5,
-	0x34, 0x80, 0x18, 0x9f, 0xdc, 0x75, 0xde, 0xf7, 0x46, 0x71, 0x7e, 0x1e, 0xe3, 0x7c, 0x3a, 0xe0,
-	0xfa, 0x5a, 0x97, 0x95, 0xec, 0x49, 0x64, 0x65, 0x1b, 0xa6, 0x6a, 0x6c, 0x95, 0xd0, 0xef, 0xb1,
-	0x9f, 0x8f, 0x3b, 0xef, 0xba, 0x5a, 0x3c, 0x48, 0x17, 0xd6, 0xf8, 0x10, 0x3b, 0x29, 0x83, 0x5c,
-	0xe5, 0x7e, 0x41, 0x61, 0x9c, 0x22, 0x7d, 0xd1, 0x72, 0x56, 0xe7, 0x9d, 0x75, 0x62, 0xb9, 0x1b,
-	0x7b, 0x32, 0xb9, 0x1b, 0xff, 0x58, 0x72, 0x97, 0xf0, 0xf8, 0xcd, 0x9d, 0xc4, 0xe3, 0xf7, 0xc2,
-	0xfb, 0x30, 0xd7, 0xd3, 0xc3, 0x27, 0x39, 0x40, 0x7c, 0x72, 0x62, 0xf9, 0x63, 0xa0, 0xcc, 0xac,
-	0x9c, 0x45, 0x1b, 0xae, 0x4f, 0xeb, 0x21, 0xae, 0xec, 0x62, 0x31, 0xf6, 0x05, 0x2c, 0x71, 0x97,
-	0x89, 0x30, 0xf2, 0x1e, 0x8c, 0x73, 0xcb, 0x01, 0x3f, 0xb1, 0xc7, 0x33, 0x52, 0x58, 0x19, 0xb8,
-	0x43, 0x38, 0xc7, 0x50, 0x7b, 0x55, 0x10, 0x99, 0x77, 0xa5, 0xb1, 0xe2, 0x98, 0x79, 0xb1, 0x08,
-	0xa3, 0xdb, 0x71, 0xcf, 0xa0, 0xa7, 0x19, 0xff, 0x08, 0x8b, 0xc3, 0xcd, 0x9f, 0x35, 0x60, 0x46,
-	0xff, 0x4a, 0x72, 0x1d, 0xc6, 0x84, 0x5b, 0xad, 0x81, 0x47, 0x48, 0xf6, 0x35, 0x63, 0xdc, 0xa1,
-	0x56, 0x73, 0xa3, 0x15, 0x58, 0x6c, 0x67, 0x11, 0x1c, 0x84, 0xf5, 0x01, 0x77, 0x16, 0x21, 0xa4,
-	0x96, 0x2c, 0x23, 0x26, 0x8c, 0x59, 0x34, 0xe8, 0x36, 0x43, 0xd5, 0x4a, 0xe6, 0x23, 0xc4, 0x12,
-	0x25, 0x66, 0x11, 0xc6, 0xf8, 0x92, 0x94, 0xb8, 0xd0, 0x33, 0x4e, 0x70, 0xa1, 0x67, 0x1e, 0x19,
-	0x00, 0xb5, 0xda, 0xca, 0x3d, 0x7a, 0x58, 0x75, 0x5c, 0x1f, 0xcd, 0xba, 0x38, 0xa5, 0xef, 0x89,
-	0x21, 0x9f, 0x12, 0x66, 0x5d, 0x3e, 0xfd, 0xef, 0xd3, 0x43, 0xcd, 0xac, 0x2b, 0x51, 0x71, 0xdd,
-	0xf0, 0xdd, 0x07, 0x4e, 0x48, 0x19, 0x61, 0x06, 0x09, 0xf9, 0xba, 0xc1, 0xa1, 0x09, 0x4a, 0x05,
-	0x99, 0x7c, 0x1d, 0x66, 0xe2, 0x5f, 0x68, 0x21, 0xc8, 0xa2, 0x5d, 0x4d, 0x8a, 0x95, 0x5e, 0xb8,
-	0xfc, 0xe2, 0xe3, 0xa3, 0xc5, 0x0b, 0x0a, 0xd7, 0xa4, 0x41, 0x3e, 0xc1, 0xcc, 0xfc, 0x75, 0x03,
-	0xef, 0x03, 0xe4, 0x07, 0x5e, 0x86, 0x91, 0xc8, 0x4d, 0x61, 0x8a, 0x5b, 0x21, 0x12, 0x06, 0x38,
-	0x2c, 0x27, 0x97, 0x20, 0x1b, 0x7f, 0x09, 0x2e, 0xf9, 0xfa, 0x17, 0xb0, 0x52, 0x72, 0x17, 0xc6,
-	0x87, 0x6a, 0x33, 0x8a, 0x78, 0x4a, 0x5b, 0x25, 0x35, 0x8e, 0xc2, 0x07, 0x3b, 0x9b, 0x9f, 0xde,
-	0x51, 0xf8, 0x6e, 0x06, 0x66, 0x59, 0xbf, 0x16, 0xba, 0xe1, 0x81, 0xe7, 0xbb, 0xe1, 0xe1, 0x33,
-	0x6b, 0x2e, 0x78, 0x47, 0x53, 0xda, 0x2e, 0xc8, 0xb5, 0x4f, 0xfd, 0xb6, 0xa1, 0xac, 0x06, 0xbf,
-	0x37, 0x0a, 0xa7, 0x53, 0xa8, 0xc8, 0xeb, 0x9a, 0x99, 0x6c, 0x41, 0xc6, 0xc2, 0xfc, 0xf0, 0x68,
-	0x71, 0x4a, 0xa2, 0x6f, 0xc6, 0xb1, 0x31, 0x4b, 0xfa, 0xe5, 0x1a, 0xef, 0x29, 0xb4, 0x9a, 0xa9,
-	0x97, 0x6b, 0xfa, 0x95, 0xda, 0x55, 0x18, 0xb5, 0xbc, 0x26, 0x95, 0xb7, 0xbb, 0xa8, 0xa8, 0xf8,
-	0x0c, 0xa0, 0xdd, 0x61, 0x30, 0x00, 0x59, 0x81, 0x71, 0xf6, 0xc7, 0x9a, 0xd3, 0x11, 0xb6, 0x42,
-	0x12, 0x1d, 0x1b, 0x10, 0xda, 0x71, 0xdb, 0xfb, 0xea, 0xc9, 0xa1, 0x49, 0xed, 0x96, 0xd3, 0xd1,
-	0x76, 0x36, 0x8e, 0xa8, 0x9d, 0x40, 0x72, 0xfd, 0x4f, 0x20, 0xc6, 0xb1, 0x27, 0x90, 0x06, 0x40,
-	0xcd, 0xdd, 0x6f, 0xbb, 0xed, 0xfd, 0x42, 0x73, 0x5f, 0x44, 0x14, 0x5d, 0xed, 0x3f, 0x0a, 0xd7,
-	0x63, 0x64, 0x14, 0x5c, 0x6e, 0x42, 0xe7, 0x30, 0xdb, 0x69, 0x6a, 0x86, 0xcc, 0x18, 0x95, 0xac,
-	0x03, 0x14, 0xea, 0xa1, 0xfb, 0x80, 0x09, 0x70, 0x20, 0x7c, 0xb8, 0x64, 0x83, 0x8b, 0x85, 0x7b,
-	0xf4, 0xb0, 0x46, 0xc3, 0xd8, 0x30, 0xea, 0x20, 0x2a, 0x9b, 0x07, 0x6a, 0x1f, 0x2a, 0x1c, 0x48,
-	0x07, 0xce, 0x14, 0x1a, 0x0d, 0x97, 0x7d, 0x81, 0xd3, 0xdc, 0xf4, 0xd9, 0x60, 0x34, 0x90, 0xf5,
-	0x54, 0x3a, 0xeb, 0xab, 0x82, 0xf5, 0x4b, 0x4e, 0x44, 0x65, 0x87, 0x9c, 0x2c, 0x59, 0x4d, 0x3a,
-	0x63, 0x73, 0x03, 0x66, 0xf4, 0x4f, 0xd7, 0xe3, 0xa0, 0xa6, 0x20, 0x67, 0xd5, 0x0a, 0x76, 0x6d,
-	0xa5, 0x70, 0x33, 0x6f, 0x90, 0x3c, 0x4c, 0x89, 0x5f, 0x4b, 0xf6, 0xd2, 0x9b, 0xb7, 0xf3, 0x19,
-	0x0d, 0xf2, 0xe6, 0xcd, 0xa5, 0x7c, 0xf6, 0x83, 0x91, 0x5c, 0x36, 0x3f, 0xf2, 0xc1, 0x48, 0x6e,
-	0x24, 0x3f, 0xfa, 0xc1, 0x48, 0x6e, 0x3c, 0x9f, 0xe3, 0x36, 0x00, 0xf3, 0xef, 0x1b, 0x90, 0x93,
-	0xed, 0x26, 0xb7, 0x21, 0x5b, 0xab, 0xad, 0x24, 0x5c, 0x59, 0xe3, 0xfd, 0x85, 0xaf, 0xa4, 0x41,
-	0x70, 0xa0, 0xae, 0xa4, 0xb5, 0xda, 0x0a, 0xa3, 0xdb, 0x5c, 0xad, 0x89, 0xed, 0x5d, 0xd2, 0xc5,
-	0xcb, 0x36, 0xa7, 0x4b, 0xf1, 0xef, 0xbb, 0x0d, 0xd9, 0x0f, 0x76, 0x36, 0xc5, 0xb1, 0x44, 0xd2,
-	0xc5, 0x2b, 0x29, 0xa7, 0xfb, 0xe8, 0xa1, 0xba, 0xbe, 0x33, 0x02, 0xd3, 0x82, 0x49, 0x45, 0x84,
-	0xf9, 0x76, 0xdb, 0xf2, 0xa2, 0x18, 0x21, 0xb1, 0xdd, 0x32, 0x88, 0x25, 0x4a, 0x98, 0x76, 0xb0,
-	0xea, 0xd5, 0x9d, 0xa6, 0xd8, 0xb7, 0x51, 0x3b, 0x68, 0x32, 0x80, 0xc5, 0xe1, 0xe6, 0xef, 0x1a,
-	0x90, 0xaf, 0xfa, 0xde, 0x03, 0x97, 0x2d, 0x33, 0x9b, 0xde, 0x7d, 0xda, 0xde, 0xbe, 0x49, 0xde,
-	0x90, 0x93, 0xcd, 0x88, 0x0e, 0xc1, 0xa3, 0x38, 0xd9, 0x12, 0x26, 0x55, 0x31, 0xe1, 0x94, 0x50,
-	0xab, 0xcc, 0xf0, 0xe1, 0x1b, 0xc7, 0x84, 0x5a, 0x2d, 0xc2, 0x28, 0x36, 0x47, 0xf1, 0xa0, 0x1f,
-	0x0d, 0x19, 0xc0, 0xe2, 0x70, 0xf5, 0x50, 0x99, 0xe9, 0xf9, 0x86, 0xa5, 0x4f, 0x55, 0x08, 0x84,
-	0xfe, 0x71, 0x43, 0xad, 0xd4, 0x1f, 0xc2, 0x7c, 0xb2, 0x4b, 0xd0, 0x40, 0x51, 0x80, 0x59, 0x1d,
-	0x2e, 0x6d, 0x15, 0xe7, 0x52, 0xeb, 0xda, 0x5e, 0xb2, 0x92, 0xf8, 0xe6, 0x1f, 0x19, 0x30, 0x81,
-	0x7f, 0x5a, 0xdd, 0x26, 0x5e, 0x57, 0x17, 0x76, 0x6a, 0xc2, 0xad, 0x4e, 0x55, 0xe3, 0x9c, 0x87,
-	0x81, 0x2d, 0x7c, 0xf0, 0xb4, 0xf5, 0x25, 0x42, 0x16, 0xa4, 0xdc, 0x89, 0x50, 0xde, 0x6b, 0x45,
-	0xa4, 0xdc, 0xdb, 0x30, 0x48, 0x90, 0x0a, 0x64, 0xf4, 0xb0, 0xd8, 0xa9, 0x31, 0xf1, 0x53, 0x6f,
-	0xb3, 0x90, 0xce, 0x6b, 0xea, 0x1e, 0x16, 0x1c, 0x0d, 0x2f, 0xb3, 0x76, 0x6a, 0x05, 0x6b, 0x5d,
-	0xbb, 0xcc, 0x62, 0x6d, 0xd4, 0xbc, 0xbe, 0x04, 0x92, 0xf9, 0x77, 0x72, 0xc9, 0x0e, 0x14, 0x5b,
-	0xdd, 0x09, 0xe7, 0xc6, 0xdb, 0x30, 0x5a, 0x68, 0x36, 0xbd, 0x87, 0x62, 0x95, 0x90, 0xf6, 0x92,
-	0xa8, 0xff, 0xf8, 0x4e, 0xe6, 0x30, 0x14, 0xcd, 0x8b, 0x98, 0x01, 0x48, 0x11, 0x26, 0x0a, 0x3b,
-	0xb5, 0x4a, 0xa5, 0xb4, 0xb9, 0xb9, 0x2a, 0xe2, 0x5e, 0x5f, 0x91, 0xfd, 0xe3, 0xba, 0x0d, 0x3b,
-	0x79, 0xeb, 0x13, 0x6b, 0xee, 0x31, 0x1d, 0x79, 0x17, 0xe0, 0x03, 0xcf, 0x6d, 0xaf, 0xd1, 0xf0,
-	0xc0, 0x6b, 0x88, 0x8f, 0x7f, 0xe1, 0xf1, 0xd1, 0xe2, 0xe4, 0x47, 0x9e, 0xdb, 0xb6, 0x5b, 0x08,
-	0x66, 0x6d, 0x8f, 0x91, 0x2c, 0xe5, 0x6f, 0xd6, 0xd3, 0xcb, 0x1e, 0xbf, 0x82, 0x1e, 0x8d, 0x7b,
-	0x7a, 0xd7, 0xeb, 0xb9, 0x7d, 0x96, 0x68, 0xa4, 0x05, 0xb3, 0xb5, 0xee, 0xfe, 0x3e, 0x65, 0xab,
-	0xba, 0x38, 0xfd, 0x8e, 0x89, 0x33, 0x57, 0x14, 0x35, 0xcc, 0x4f, 0x22, 0xec, 0x7c, 0x12, 0x2c,
-	0xbf, 0xce, 0x04, 0xf9, 0x07, 0x47, 0x8b, 0xe2, 0x36, 0x89, 0x29, 0x69, 0x81, 0xa4, 0xef, 0xb5,
-	0xbf, 0x24, 0x79, 0x93, 0x0d, 0x18, 0xbb, 0xeb, 0x86, 0x2b, 0xdd, 0x5d, 0x71, 0x7c, 0x7d, 0x69,
-	0xc0, 0xa4, 0xe1, 0x88, 0xfc, 0x04, 0xbf, 0xef, 0x86, 0x07, 0x5d, 0xd5, 0x4d, 0x52, 0xb0, 0x21,
-	0x3b, 0x90, 0x2b, 0xba, 0x7e, 0xbd, 0x49, 0x8b, 0x15, 0xb1, 0xeb, 0x5f, 0x1a, 0xc0, 0x52, 0xa2,
-	0xf2, 0x7e, 0xa9, 0xe3, 0xaf, 0xba, 0xab, 0x6a, 0x01, 0x12, 0x83, 0xfc, 0x7b, 0x06, 0x3c, 0x17,
-	0xb5, 0xbe, 0xb0, 0x4f, 0xdb, 0xe1, 0x9a, 0x13, 0xd6, 0x0f, 0xa8, 0x1f, 0x05, 0xcc, 0x0c, 0xe8,
-	0xa5, 0x2f, 0xf4, 0xf4, 0xd2, 0x95, 0xb8, 0x97, 0x1c, 0xc6, 0xcc, 0x6e, 0x71, 0x6e, 0xbd, 0x7d,
-	0x36, 0xa8, 0x56, 0x62, 0x03, 0xc4, 0x06, 0x71, 0xe1, 0x41, 0xfe, 0xca, 0x80, 0x0f, 0x8e, 0x91,
-	0x85, 0xeb, 0x62, 0xf4, 0x5b, 0xf3, 0xb8, 0x88, 0xa0, 0xe4, 0x9e, 0xf4, 0x43, 0xe6, 0x1a, 0xc9,
-	0xc5, 0x01, 0xbc, 0xb9, 0x6f, 0xf2, 0xe9, 0x01, 0x8e, 0xf5, 0x7c, 0xb4, 0x57, 0x9d, 0x5d, 0xa1,
-	0x84, 0x1c, 0x33, 0xda, 0xab, 0x4e, 0x3c, 0xda, 0x4d, 0x27, 0x39, 0xda, 0xab, 0xce, 0x2e, 0x29,
-	0xf2, 0x18, 0x81, 0x69, 0xe4, 0xf6, 0xe2, 0x20, 0x6e, 0xc5, 0x2a, 0xdf, 0x99, 0x7b, 0x63, 0x05,
-	0xcc, 0x7f, 0x3b, 0x02, 0x17, 0xfa, 0xcb, 0x1b, 0xf9, 0x92, 0x5c, 0x04, 0xf8, 0x52, 0x7b, 0xf9,
-	0x58, 0x09, 0xbd, 0x7e, 0xec, 0xd2, 0xf0, 0x65, 0x98, 0x2f, 0xb7, 0x43, 0xea, 0x77, 0x7c, 0x57,
-	0xc6, 0x54, 0xad, 0x78, 0x81, 0x74, 0xd3, 0x78, 0xf9, 0xf1, 0xd1, 0xe2, 0x45, 0x1a, 0x95, 0x0b,
-	0x8f, 0x1d, 0x74, 0x1a, 0x51, 0x58, 0xa5, 0x72, 0xb8, 0xf0, 0xeb, 0x59, 0x18, 0xc1, 0x95, 0xfd,
-	0x12, 0x64, 0x6b, 0xdd, 0x5d, 0xb1, 0xa4, 0x73, 0x1d, 0x48, 0x9b, 0x2f, 0xac, 0x94, 0x7c, 0x1e,
-	0xc0, 0xa2, 0x1d, 0x2f, 0x70, 0x43, 0xcf, 0x3f, 0x54, 0x7d, 0x42, 0xfd, 0x08, 0xaa, 0x3b, 0x2b,
-	0x49, 0x28, 0x59, 0x81, 0xd9, 0xf8, 0xd7, 0xc6, 0xc3, 0x36, 0x95, 0xa6, 0x3b, 0x3c, 0xa6, 0xc5,
-	0xe4, 0xb6, 0xc7, 0xca, 0xd4, 0x15, 0x20, 0x41, 0x46, 0x96, 0x20, 0xb7, 0xe3, 0xf9, 0xf7, 0xf7,
-	0x58, 0x0f, 0x8f, 0xc4, 0x6b, 0xd4, 0x43, 0x01, 0x53, 0xe7, 0xa2, 0xc4, 0x23, 0x6f, 0xc3, 0x64,
-	0xb9, 0xfd, 0xc0, 0xf5, 0xbd, 0x76, 0x8b, 0xb6, 0xa5, 0x57, 0x0e, 0x37, 0x3f, 0xc4, 0x60, 0xcd,
-	0xcb, 0x3b, 0x06, 0xb3, 0xc3, 0x48, 0xa1, 0x1e, 0x7a, 0xbe, 0x70, 0xca, 0xe1, 0xe3, 0xc4, 0x00,
-	0xda, 0x38, 0x31, 0x00, 0xeb, 0x44, 0x8b, 0xee, 0x09, 0xf3, 0x2a, 0x76, 0xa2, 0x4f, 0xf7, 0x34,
-	0x17, 0x76, 0xba, 0xc7, 0xd6, 0x58, 0x8b, 0xee, 0xe1, 0x09, 0x2a, 0x17, 0xb7, 0xdf, 0xa7, 0x7b,
-	0x3d, 0x67, 0x6f, 0x81, 0x66, 0xfe, 0x46, 0x7f, 0x81, 0x63, 0x42, 0x7d, 0x32, 0x81, 0x5b, 0x75,
-	0x86, 0x10, 0xb8, 0xd7, 0x23, 0x17, 0xa8, 0x4c, 0x1c, 0x12, 0xc0, 0x5d, 0xa0, 0xd4, 0x59, 0xc5,
-	0x71, 0x2e, 0xfc, 0xff, 0x4e, 0x24, 0x44, 0xa2, 0x93, 0x32, 0xc3, 0x76, 0x52, 0x76, 0xa8, 0x4e,
-	0x22, 0xcb, 0x30, 0x1d, 0xe5, 0x25, 0xa8, 0x3a, 0xc2, 0x83, 0x58, 0xb8, 0x10, 0x45, 0x59, 0x26,
-	0xec, 0x8e, 0x13, 0xaa, 0x9a, 0xbd, 0x4e, 0x42, 0xde, 0x81, 0x49, 0xe1, 0x07, 0x88, 0x1c, 0x46,
-	0x63, 0x07, 0x44, 0xe9, 0x34, 0x98, 0xa0, 0x57, 0xd1, 0x49, 0x19, 0x66, 0xaa, 0x6e, 0x87, 0x36,
-	0xdd, 0x36, 0xad, 0xa1, 0x8b, 0x91, 0x90, 0x18, 0xf4, 0xa7, 0xeb, 0x88, 0x12, 0x9b, 0x7b, 0x1f,
-	0x69, 0x86, 0x08, 0x8d, 0x28, 0x29, 0xac, 0xe3, 0x27, 0x11, 0x56, 0xf3, 0xef, 0x67, 0xe0, 0xf9,
-	0x41, 0x1b, 0x17, 0xa9, 0xe9, 0xc2, 0x72, 0x65, 0x88, 0xcd, 0xee, 0x78, 0x71, 0x29, 0xc3, 0xcc,
-	0x86, 0xbf, 0xef, 0xb4, 0xdd, 0x6f, 0xa3, 0x42, 0x12, 0x79, 0x32, 0xe2, 0x97, 0x7b, 0x4a, 0x89,
-	0x6e, 0xe5, 0x4b, 0x10, 0x5d, 0x78, 0x20, 0xc4, 0xe8, 0xe3, 0x7a, 0x6e, 0xde, 0x86, 0x89, 0xa2,
-	0xd7, 0x0e, 0xe9, 0xa3, 0x30, 0xe1, 0xb1, 0xce, 0x81, 0x49, 0x8f, 0x75, 0x89, 0x6a, 0xfe, 0x9e,
-	0x01, 0x2f, 0x0e, 0xde, 0xfc, 0xc8, 0x96, 0xde, 0x6d, 0xd7, 0x86, 0xda, 0x32, 0x8f, 0xed, 0xb8,
-	0x0b, 0x6b, 0xe2, 0x8b, 0xcb, 0x30, 0x23, 0x1c, 0x56, 0x74, 0xdd, 0x1a, 0x3b, 0x50, 0x38, 0x7e,
-	0xa5, 0xe8, 0xd7, 0x09, 0x22, 0xf3, 0x4f, 0x0d, 0x38, 0xdf, 0x77, 0xa7, 0x25, 0x55, 0xfd, 0x1b,
-	0x5e, 0x39, 0x6e, 0x6b, 0x3e, 0xbe, 0xf9, 0x3f, 0x6f, 0x88, 0xf6, 0xbf, 0x07, 0x53, 0xb5, 0xee,
-	0x6e, 0x32, 0xd6, 0x1a, 0x67, 0x4e, 0xa0, 0xc0, 0xb5, 0x1b, 0x14, 0x05, 0xce, 0xbe, 0x5f, 0xfa,
-	0xe5, 0xa1, 0x27, 0xb9, 0x3c, 0x20, 0xe0, 0xf7, 0x47, 0xae, 0xb0, 0xe8, 0xe9, 0xab, 0x2a, 0x1e,
-	0x09, 0x22, 0xf3, 0xb7, 0x33, 0x70, 0xae, 0xcf, 0x6e, 0x4e, 0xd6, 0xf5, 0xaf, 0xbf, 0x34, 0x78,
-	0xf3, 0x3f, 0xfe, 0xdb, 0xff, 0x89, 0xfc, 0x76, 0x34, 0x69, 0x0a, 0x11, 0x94, 0x07, 0x05, 0x61,
-	0xd2, 0x94, 0xe2, 0x1a, 0xe8, 0x26, 0x4d, 0x89, 0x4c, 0xde, 0x84, 0x09, 0x76, 0x30, 0x0f, 0x95,
-	0x23, 0x11, 0xf7, 0x15, 0x95, 0x40, 0x55, 0x5e, 0x23, 0x4c, 0xb6, 0x99, 0xea, 0x03, 0x2f, 0xbd,
-	0xa0, 0x70, 0x33, 0x4d, 0x88, 0x8b, 0xae, 0x4e, 0xeb, 0x64, 0xe6, 0xcf, 0x67, 0x60, 0x86, 0xdf,
-	0xc8, 0xf0, 0xe3, 0xde, 0x33, 0x7b, 0x94, 0x7e, 0x5b, 0x3b, 0x4a, 0xcb, 0xa0, 0x24, 0xf5, 0xd3,
-	0x86, 0x3a, 0x48, 0x1f, 0x00, 0xe9, 0xa5, 0x21, 0x96, 0xbc, 0x37, 0x1c, 0xe6, 0x0c, 0x7d, 0x33,
-	0x8e, 0x5f, 0xc3, 0x24, 0x4b, 0x75, 0x1b, 0x0d, 0x19, 0x81, 0xa5, 0xf1, 0x30, 0x7f, 0x36, 0x03,
-	0xd3, 0x8a, 0xc9, 0xf3, 0x99, 0xed, 0xf8, 0x2f, 0x68, 0x1d, 0x2f, 0x83, 0x48, 0x95, 0x2f, 0x1b,
-	0xaa, 0xdf, 0xbb, 0x30, 0xd7, 0x43, 0x92, 0xb4, 0x1c, 0x1b, 0xc3, 0x58, 0x8e, 0x5f, 0xef, 0x0d,
-	0x5a, 0xe2, 0xb9, 0x6c, 0xa2, 0xa0, 0x25, 0x35, 0x4a, 0xea, 0xbb, 0x19, 0x98, 0x17, 0xbf, 0x0a,
-	0xdd, 0x86, 0x1b, 0x16, 0xbd, 0xf6, 0x9e, 0xbb, 0xff, 0xcc, 0x8e, 0x45, 0x41, 0x1b, 0x8b, 0x45,
-	0x7d, 0x2c, 0x94, 0x0f, 0xec, 0x3f, 0x24, 0xe6, 0x4f, 0x01, 0x2c, 0xf4, 0x23, 0x18, 0xda, 0x3f,
-	0x36, 0x0e, 0x28, 0xcd, 0x0c, 0x11, 0x50, 0xba, 0x0a, 0x79, 0xac, 0xaa, 0x46, 0x03, 0xd6, 0x09,
-	0x41, 0x9c, 0x48, 0xe3, 0xe2, 0xe3, 0xa3, 0xc5, 0xe7, 0x1d, 0x56, 0x66, 0x07, 0xa2, 0xd0, 0xee,
-	0xfa, 0xea, 0x71, 0xbb, 0x87, 0x92, 0xfc, 0xba, 0x01, 0x33, 0x08, 0x2c, 0x3f, 0xa0, 0xed, 0x10,
-	0x99, 0x8d, 0x08, 0x07, 0xa9, 0xe8, 0xa4, 0x5d, 0x0b, 0x7d, 0xb7, 0xbd, 0x2f, 0x8e, 0xda, 0xbb,
-	0xe2, 0xa8, 0xfd, 0x0e, 0x37, 0x11, 0x5c, 0xaf, 0x7b, 0xad, 0x1b, 0xfb, 0xbe, 0xf3, 0xc0, 0xe5,
-	0xd6, 0x7c, 0xa7, 0x79, 0x23, 0xce, 0xa3, 0xd6, 0x71, 0x13, 0x99, 0xd1, 0x04, 0x2b, 0x34, 0x63,
-	0xf0, 0x86, 0x52, 0xac, 0x36, 0xd1, 0xcc, 0x44, 0x8b, 0xc8, 0x57, 0xe0, 0x1c, 0x0f, 0xe8, 0x61,
-	0x3a, 0x88, 0xdb, 0xee, 0x7a, 0xdd, 0x60, 0xd9, 0xa9, 0xdf, 0x67, 0xfb, 0x1e, 0xbf, 0xd4, 0xc7,
-	0x2f, 0xaf, 0x47, 0x85, 0xf6, 0x2e, 0x2f, 0x55, 0x58, 0xf6, 0x63, 0x40, 0x56, 0x60, 0x8e, 0x17,
-	0x15, 0xba, 0xa1, 0x57, 0xab, 0x3b, 0x4d, 0xb7, 0xbd, 0x8f, 0x4a, 0x64, 0x8e, 0xef, 0xc7, 0x4e,
-	0x37, 0xf4, 0xec, 0x80, 0xc3, 0x15, 0x7e, 0xbd, 0x44, 0xa4, 0xc2, 0xce, 0x6c, 0x4e, 0x63, 0xcd,
-	0x79, 0x54, 0x74, 0x3a, 0x4e, 0xdd, 0x0d, 0x79, 0x18, 0x69, 0x96, 0x87, 0x72, 0xf8, 0xd4, 0x69,
-	0xd8, 0x2d, 0xe7, 0x91, 0x5d, 0x17, 0x85, 0xfa, 0xa1, 0x4d, 0xa3, 0x8b, 0x58, 0xb9, 0xed, 0x88,
-	0xd5, 0x44, 0x92, 0x95, 0xdb, 0xee, 0xcf, 0x2a, 0xa6, 0x93, 0xac, 0x36, 0x1d, 0x7f, 0x9f, 0x86,
-	0xfc, 0x32, 0x1c, 0x2e, 0x1a, 0x57, 0x0c, 0x85, 0x55, 0x88, 0x65, 0x36, 0x5e, 0x8c, 0x27, 0x59,
-	0x29, 0x74, 0x4c, 0xf2, 0x76, 0x7c, 0x37, 0xa4, 0xea, 0x17, 0x4e, 0x62, 0xb3, 0xb0, 0xff, 0xd1,
-	0x1d, 0xa0, 0xdf, 0x27, 0xf6, 0x50, 0xc6, 0xdc, 0x94, 0x8f, 0x9c, 0xea, 0xe1, 0x96, 0xfe, 0x95,
-	0x3d, 0x94, 0x11, 0x37, 0xf5, 0x3b, 0xa7, 0xf1, 0x3b, 0x15, 0x6e, 0x7d, 0x3e, 0xb4, 0x87, 0x92,
-	0xac, 0xb3, 0x4e, 0x0b, 0x69, 0x9b, 0x49, 0xb4, 0x70, 0x06, 0x98, 0xc1, 0xa6, 0xbd, 0x2c, 0x6e,
-	0xb4, 0xf2, 0xbe, 0x2c, 0xb6, 0x53, 0x5c, 0x03, 0x92, 0xc4, 0xe4, 0x47, 0x61, 0x76, 0x2b, 0xa0,
-	0x77, 0x2a, 0xd5, 0x9a, 0x0c, 0xe0, 0x5a, 0x98, 0xc5, 0x7b, 0xae, 0x9b, 0xc7, 0x2c, 0x3a, 0xd7,
-	0x55, 0x1a, 0xcc, 0x68, 0xc6, 0xc7, 0xad, 0x1b, 0x50, 0x7b, 0xcf, 0xed, 0x04, 0x51, 0x30, 0xa5,
-	0x3a, 0x6e, 0x89, 0xaa, 0xcc, 0x15, 0x98, 0xeb, 0x61, 0x43, 0x66, 0x00, 0x18, 0xd0, 0xde, 0x5a,
-	0xaf, 0x95, 0x37, 0xf3, 0xa7, 0x48, 0x1e, 0xa6, 0xf0, 0x77, 0x79, 0xbd, 0xb0, 0xbc, 0x5a, 0x2e,
-	0xe5, 0x0d, 0x32, 0x07, 0xd3, 0x08, 0x29, 0x55, 0x6a, 0x1c, 0x94, 0xf9, 0x60, 0x24, 0x37, 0x9a,
-	0x1f, 0xb3, 0xf2, 0x7c, 0xea, 0x86, 0x6c, 0x02, 0xe0, 0x9e, 0x62, 0xfe, 0x95, 0x0c, 0x9c, 0x97,
-	0xdb, 0x0a, 0x0d, 0x1f, 0x7a, 0xfe, 0x7d, 0xb7, 0xbd, 0xff, 0x8c, 0xef, 0x0e, 0x77, 0xb4, 0xdd,
-	0xe1, 0xe5, 0xc4, 0x4e, 0x9d, 0xf8, 0xca, 0x01, 0x5b, 0xc4, 0xaf, 0x8c, 0xc3, 0x0b, 0x03, 0xa9,
-	0xc8, 0x97, 0xd8, 0x6e, 0xee, 0xd2, 0x76, 0x58, 0x69, 0x34, 0xe9, 0xa6, 0xdb, 0xa2, 0x5e, 0x37,
-	0x14, 0xce, 0x27, 0x97, 0x98, 0x7a, 0xcb, 0xd3, 0x91, 0xd9, 0x6e, 0xa3, 0x49, 0xed, 0x90, 0x17,
-	0x6b, 0xe2, 0xd6, 0x4b, 0xcd, 0x58, 0x46, 0x29, 0x13, 0x2b, 0xed, 0x90, 0xfa, 0x0f, 0x1c, 0x9e,
-	0x95, 0x49, 0xb0, 0xbc, 0x4f, 0x69, 0xc7, 0x76, 0x58, 0xa9, 0xed, 0x8a, 0x62, 0x9d, 0x65, 0x0f,
-	0x35, 0xb9, 0xa3, 0xb0, 0x2c, 0x32, 0x75, 0x78, 0xcd, 0x79, 0x24, 0xec, 0xee, 0x22, 0xb8, 0x3b,
-	0x62, 0xc9, 0x73, 0x0b, 0xb4, 0x9c, 0x47, 0x56, 0x2f, 0x09, 0xf9, 0x3a, 0x9c, 0x11, 0x1b, 0x90,
-	0x88, 0xa9, 0x90, 0x5f, 0xcc, 0x23, 0x36, 0x5e, 0x7d, 0x7c, 0xb4, 0x78, 0x4e, 0x6c, 0x5f, 0xb6,
-	0x8c, 0x4f, 0x49, 0xfb, 0xea, 0x74, 0x2e, 0x64, 0x93, 0x6d, 0xc8, 0x89, 0xee, 0x58, 0xa3, 0x41,
-	0xe0, 0xec, 0x4b, 0x1b, 0x3d, 0xf7, 0x00, 0x53, 0x3a, 0xd3, 0x6e, 0xf1, 0x72, 0xab, 0x2f, 0x25,
-	0x59, 0x81, 0x99, 0x1d, 0xba, 0xab, 0x8e, 0xcf, 0x58, 0xb4, 0x54, 0xe5, 0x1f, 0xd2, 0xdd, 0xfe,
-	0x83, 0x93, 0xa0, 0x23, 0x2e, 0xcc, 0xa1, 0x77, 0xec, 0xaa, 0x1b, 0x84, 0xb4, 0x4d, 0x7d, 0x8c,
-	0x3b, 0x1b, 0xc7, 0xc5, 0x60, 0x21, 0xd6, 0x90, 0xf5, 0xf2, 0xe5, 0x97, 0x1e, 0x1f, 0x2d, 0xbe,
-	0xc0, 0x3d, 0x6d, 0x9b, 0x02, 0x6e, 0x27, 0x72, 0x13, 0xf6, 0x72, 0x25, 0xdf, 0x84, 0x59, 0xcb,
-	0xeb, 0x86, 0x6e, 0x7b, 0xbf, 0x16, 0xfa, 0x4e, 0x48, 0xf7, 0xf9, 0x86, 0x14, 0x07, 0xb8, 0x25,
-	0x4a, 0x85, 0x71, 0x91, 0x03, 0xed, 0x40, 0x40, 0xb5, 0x1d, 0x41, 0x27, 0x20, 0xdf, 0x80, 0x19,
-	0xee, 0x82, 0x1f, 0x55, 0x30, 0xa1, 0xa5, 0xf1, 0xd1, 0x0b, 0xb7, 0x6f, 0xf2, 0x03, 0x2a, 0x77,
-	0xe5, 0x4f, 0xab, 0x20, 0xc1, 0x8d, 0x7c, 0x55, 0x74, 0x56, 0xd5, 0x6d, 0xef, 0x47, 0x62, 0x0c,
-	0xd8, 0xf3, 0x6f, 0xc4, 0x5d, 0xd2, 0x61, 0xcd, 0x95, 0x62, 0xdc, 0xe7, 0xce, 0xa7, 0x97, 0x8f,
-	0x79, 0x64, 0x40, 0x3e, 0xd9, 0x40, 0xf2, 0x65, 0x98, 0xe0, 0xd7, 0x00, 0x34, 0x38, 0x10, 0x91,
-	0x70, 0xd2, 0xee, 0x1d, 0xc1, 0x75, 0x22, 0x91, 0x50, 0x83, 0x5f, 0x32, 0x50, 0xf5, 0x22, 0x7c,
-	0xe5, 0x94, 0x15, 0x33, 0x23, 0x0d, 0x98, 0xe2, 0x6d, 0xa0, 0x18, 0xb3, 0x29, 0x6e, 0x83, 0x5f,
-	0x52, 0xc7, 0x5c, 0x14, 0x25, 0xf8, 0x63, 0x58, 0xa3, 0xf8, 0x52, 0x8e, 0xa0, 0x55, 0xa1, 0x71,
-	0x5d, 0x06, 0xc8, 0x49, 0x42, 0xf3, 0x3c, 0x9c, 0xeb, 0xd3, 0x66, 0xf3, 0x01, 0x5a, 0x48, 0xfb,
-	0xd4, 0x48, 0xbe, 0x0c, 0xf3, 0x48, 0x58, 0xf4, 0xda, 0x6d, 0x5a, 0x0f, 0x71, 0x92, 0x49, 0x23,
-	0x4b, 0x96, 0xdb, 0xcf, 0xf9, 0xf7, 0xd6, 0x23, 0x04, 0x3b, 0x69, 0x6b, 0x49, 0xe5, 0x60, 0xfe,
-	0x6a, 0x06, 0x16, 0xc4, 0xbc, 0xb5, 0x68, 0xdd, 0xf3, 0x1b, 0xcf, 0xfe, 0x3e, 0x51, 0xd6, 0xf6,
-	0x89, 0x4b, 0x51, 0x60, 0x4d, 0xda, 0x47, 0x0e, 0xd8, 0x26, 0x7e, 0xdb, 0x80, 0xe7, 0x07, 0x11,
-	0xb1, 0xde, 0x89, 0x62, 0x54, 0x27, 0x7a, 0x62, 0x51, 0x3b, 0x70, 0x1a, 0x07, 0xb4, 0x78, 0x40,
-	0xeb, 0xf7, 0x83, 0x15, 0x2f, 0x08, 0xd1, 0x19, 0x25, 0xa3, 0x39, 0xa2, 0x2f, 0x7b, 0x1e, 0xbf,
-	0x31, 0xc3, 0x6b, 0x45, 0xe3, 0x07, 0x47, 0x8b, 0xc0, 0x40, 0x3c, 0xaa, 0x54, 0x98, 0x6d, 0x1f,
-	0x1d, 0xda, 0x75, 0xe4, 0xc1, 0xa3, 0x68, 0xef, 0xd3, 0xc3, 0xc0, 0x4a, 0x63, 0x8d, 0x8e, 0x05,
-	0x85, 0x6e, 0x78, 0x50, 0xf5, 0xe9, 0x1e, 0xf5, 0x69, 0xbb, 0x4e, 0x3f, 0x65, 0x8e, 0x05, 0xfa,
-	0xc7, 0x0d, 0x75, 0x2e, 0xff, 0x2e, 0xc0, 0x7c, 0x1a, 0x19, 0xeb, 0x17, 0xe5, 0x28, 0x98, 0xcc,
-	0x87, 0xfc, 0x17, 0x0d, 0x98, 0xaa, 0xd1, 0xba, 0xd7, 0x6e, 0xdc, 0xc1, 0x9b, 0x12, 0xd1, 0x3b,
-	0x36, 0xdf, 0x0a, 0x19, 0xdc, 0xde, 0x4b, 0x5c, 0xa1, 0xfc, 0xf0, 0x68, 0xf1, 0x8b, 0xc3, 0x9d,
-	0xc0, 0xea, 0x1e, 0x86, 0x10, 0x86, 0x98, 0x62, 0x27, 0xaa, 0x02, 0x3d, 0xce, 0xb4, 0x4a, 0xc9,
-	0x32, 0x4c, 0x8b, 0xe9, 0xea, 0xa9, 0x21, 0xca, 0x78, 0x23, 0x50, 0x97, 0x05, 0x3d, 0x39, 0x0d,
-	0x34, 0x12, 0x72, 0x0b, 0xb2, 0x5b, 0x4b, 0x77, 0xc4, 0x18, 0xc8, 0x08, 0xab, 0xad, 0xa5, 0x3b,
-	0x68, 0xe4, 0x61, 0x8a, 0xf3, 0x74, 0x77, 0x49, 0xbb, 0xbc, 0xd8, 0x5a, 0xba, 0x43, 0x7e, 0x1c,
-	0xce, 0x94, 0xdc, 0x40, 0x54, 0xc1, 0x5d, 0x5c, 0x1a, 0xe8, 0xd2, 0x39, 0xd6, 0x47, 0x7a, 0x3f,
-	0x97, 0x2a, 0xbd, 0x2f, 0x35, 0x22, 0x26, 0x36, 0xf7, 0x9f, 0x69, 0x24, 0x43, 0xb1, 0xd3, 0xeb,
-	0x21, 0x1f, 0xc1, 0x0c, 0x1a, 0x29, 0xd1, 0xeb, 0x07, 0xd3, 0xa9, 0x8c, 0xf7, 0xa9, 0xf9, 0x33,
-	0xa9, 0x35, 0x5f, 0x40, 0x9b, 0xa7, 0x8d, 0xbe, 0x43, 0x98, 0x7a, 0x45, 0x3b, 0xcb, 0x6a, 0x9c,
-	0xc9, 0x07, 0x30, 0x2b, 0x94, 0x8a, 0x8d, 0xbd, 0xcd, 0x03, 0x5a, 0x72, 0x0e, 0xc5, 0xb5, 0x16,
-	0x9e, 0x53, 0x84, 0x26, 0x62, 0x7b, 0x7b, 0x76, 0x78, 0x40, 0xed, 0x86, 0xa3, 0x6d, 0xbf, 0x09,
-	0x42, 0xf2, 0x23, 0x30, 0xb9, 0xea, 0xd5, 0x99, 0x3e, 0x89, 0x2b, 0xc3, 0x04, 0xf2, 0xf9, 0x10,
-	0x93, 0xf3, 0x72, 0x70, 0x42, 0x49, 0xf8, 0xe1, 0xd1, 0xe2, 0xdb, 0x27, 0x15, 0x1a, 0xa5, 0x02,
-	0x4b, 0xad, 0x8d, 0x14, 0x21, 0xb7, 0x43, 0x77, 0xd9, 0xd7, 0x26, 0x13, 0x4b, 0x4a, 0xb0, 0xb8,
-	0x69, 0x14, 0xbf, 0xb4, 0x9b, 0x46, 0x01, 0x23, 0x3e, 0xcc, 0x61, 0xff, 0x54, 0x9d, 0x20, 0x78,
-	0xe8, 0xf9, 0x0d, 0xcc, 0x94, 0x34, 0xd9, 0xa7, 0xf3, 0x97, 0x52, 0x3b, 0xff, 0x79, 0xde, 0xf9,
-	0x1d, 0x85, 0x83, 0xaa, 0x16, 0xf5, 0xb0, 0x27, 0xdf, 0x84, 0x19, 0x8b, 0x7e, 0xab, 0xeb, 0xfa,
-	0x74, 0xed, 0x4e, 0x01, 0x67, 0xe5, 0x94, 0xe6, 0x18, 0xab, 0x17, 0x72, 0xdd, 0xcb, 0xe7, 0x30,
-	0x69, 0x57, 0xb1, 0x5b, 0x7b, 0x8e, 0x6e, 0x57, 0x57, 0x49, 0x48, 0x15, 0x26, 0x4b, 0xf4, 0x81,
-	0x5b, 0xa7, 0xe8, 0xbe, 0x27, 0xae, 0xcf, 0xa3, 0x44, 0x77, 0x71, 0x09, 0xb7, 0x30, 0x34, 0x10,
-	0xc0, 0x9d, 0x01, 0xf5, 0x48, 0x80, 0x08, 0x91, 0xdc, 0x86, 0x6c, 0xa5, 0x54, 0xc5, 0x43, 0x68,
-	0xec, 0x15, 0x57, 0x69, 0x54, 0x65, 0xbe, 0x34, 0xbc, 0x17, 0x74, 0x1b, 0xda, 0xdd, 0x7b, 0xa5,
-	0x54, 0x25, 0x7b, 0x30, 0x8d, 0x1d, 0xb0, 0x42, 0x1d, 0xde, 0xb7, 0xb3, 0x7d, 0xfa, 0xf6, 0x7a,
-	0x6a, 0xdf, 0x2e, 0xf0, 0xbe, 0x3d, 0x10, 0xd4, 0x5a, 0x02, 0x28, 0x95, 0xad, 0x38, 0x18, 0xce,
-	0x89, 0x7e, 0x10, 0xfb, 0xd8, 0xda, 0x9d, 0x82, 0xf9, 0x9f, 0x18, 0xb8, 0x22, 0x90, 0x6b, 0x18,
-	0xd8, 0x15, 0xdd, 0x4f, 0xa1, 0x89, 0xcb, 0xe9, 0x24, 0xf2, 0x93, 0x70, 0x14, 0xf2, 0x3a, 0x8c,
-	0xdd, 0x71, 0xea, 0x34, 0x94, 0x36, 0x7e, 0x44, 0xde, 0x43, 0x88, 0x6a, 0x0f, 0xe3, 0x38, 0x4c,
-	0x59, 0xe1, 0x3d, 0x55, 0x88, 0xf3, 0xf4, 0x17, 0x0b, 0xd2, 0xc4, 0x8f, 0xca, 0x8a, 0xe8, 0x61,
-	0x25, 0x91, 0xbf, 0x5d, 0x77, 0x54, 0x5e, 0xa9, 0x1c, 0xcc, 0xff, 0xcd, 0x88, 0x45, 0x9c, 0xbc,
-	0x0a, 0x23, 0x56, 0x35, 0x6a, 0x3f, 0x77, 0xb1, 0x4d, 0x34, 0x1f, 0x11, 0xc8, 0x57, 0xe1, 0x8c,
-	0xc2, 0x07, 0xbb, 0x89, 0x36, 0x58, 0x83, 0xf8, 0xc7, 0xbc, 0x82, 0x3e, 0xa0, 0x4a, 0x4b, 0x1c,
-	0x8e, 0x91, 0x68, 0x51, 0x3a, 0x0f, 0xd4, 0xcc, 0xe2, 0x82, 0x12, 0x6d, 0xbb, 0x9c, 0xb7, 0xf2,
-	0xb1, 0x2a, 0xef, 0x06, 0x22, 0x24, 0x3f, 0x36, 0x8d, 0x03, 0x77, 0x03, 0x35, 0x7f, 0xc7, 0xd0,
-	0x44, 0x37, 0xca, 0x89, 0x6e, 0x1c, 0x93, 0x13, 0xfd, 0x2d, 0x80, 0x42, 0x37, 0xf4, 0xca, 0x6d,
-	0xdf, 0x6b, 0xf2, 0x83, 0xa6, 0x48, 0xd1, 0x83, 0xe6, 0x33, 0x8a, 0x60, 0xcd, 0x5b, 0x2d, 0x42,
-	0x26, 0xab, 0x90, 0x2f, 0xdf, 0x43, 0x3f, 0xdf, 0xb8, 0xab, 0xf8, 0xe7, 0xe0, 0x8a, 0x48, 0xef,
-	0xb3, 0x35, 0xbc, 0x4f, 0x2f, 0xf5, 0x50, 0x9a, 0xff, 0x87, 0xa1, 0xe4, 0xe1, 0x7f, 0x46, 0xd5,
-	0x91, 0xdb, 0x9a, 0x3a, 0x32, 0x2f, 0x48, 0xa3, 0xaf, 0x62, 0x65, 0xa9, 0x2a, 0xe4, 0xac, 0x72,
-	0xa5, 0x8f, 0x80, 0xef, 0x64, 0x60, 0x72, 0x2b, 0xa0, 0x3e, 0xbf, 0x69, 0xf9, 0x74, 0x05, 0xee,
-	0x46, 0xdf, 0x35, 0x54, 0x68, 0xe5, 0x1f, 0x1a, 0x68, 0x81, 0x53, 0x29, 0x58, 0x6f, 0x60, 0x3e,
-	0x4f, 0xa5, 0x37, 0xba, 0x01, 0xf5, 0x2d, 0x84, 0xf2, 0x90, 0xba, 0x55, 0x3d, 0xa4, 0xae, 0x69,
-	0x31, 0x18, 0xf9, 0x22, 0x8c, 0x6e, 0xa1, 0x3d, 0x41, 0x0f, 0xa8, 0x88, 0xf8, 0x63, 0x21, 0x5f,
-	0x22, 0xba, 0xec, 0x4f, 0x75, 0x85, 0xc3, 0x32, 0x52, 0x83, 0xf1, 0xa2, 0x4f, 0x31, 0xe3, 0xfe,
-	0xc8, 0xf0, 0x4e, 0xc1, 0x75, 0x4e, 0x92, 0x74, 0x0a, 0x16, 0x9c, 0xcc, 0x5f, 0xce, 0x00, 0x89,
-	0xbf, 0x11, 0xd3, 0xf1, 0x05, 0xcf, 0xec, 0xa0, 0xbf, 0xaf, 0x0d, 0xfa, 0x0b, 0x3d, 0x83, 0xce,
-	0x3f, 0x6f, 0xa8, 0xb1, 0xff, 0x5d, 0x03, 0xce, 0xa6, 0x13, 0x92, 0x4b, 0x30, 0xb6, 0xb1, 0x59,
-	0x95, 0x31, 0x39, 0xe2, 0x53, 0xbc, 0x0e, 0x1e, 0x7b, 0x2c, 0x51, 0x44, 0xde, 0x80, 0xb1, 0x2f,
-	0x59, 0x45, 0xb6, 0x0a, 0x2a, 0x69, 0x7e, 0xbe, 0xe5, 0xdb, 0x75, 0x7d, 0x21, 0x14, 0x48, 0xea,
-	0xd8, 0x66, 0x9f, 0xda, 0xd8, 0x7e, 0x37, 0x03, 0xb3, 0x85, 0x7a, 0x9d, 0x06, 0x01, 0xdb, 0x62,
-	0x69, 0x10, 0x3e, 0xb3, 0x03, 0x9b, 0x1e, 0x6d, 0xa3, 0x7d, 0xdb, 0x50, 0xa3, 0xfa, 0x7b, 0x06,
-	0x9c, 0x91, 0x54, 0x0f, 0x5c, 0xfa, 0x70, 0xf3, 0xc0, 0xa7, 0xc1, 0x81, 0xd7, 0x6c, 0x0c, 0x9d,
-	0x4b, 0x8c, 0xa9, 0x19, 0x98, 0x55, 0x45, 0xbd, 0x76, 0xdb, 0x43, 0x88, 0xa6, 0x66, 0xf0, 0xcc,
-	0x2b, 0x37, 0x60, 0xbc, 0xd0, 0xe9, 0xf8, 0xde, 0x03, 0x3e, 0xed, 0xa7, 0x85, 0x8f, 0x34, 0x07,
-	0x69, 0x3e, 0xd5, 0x1c, 0xc4, 0x9a, 0x51, 0xa2, 0x6d, 0x1e, 0xee, 0x3c, 0xcd, 0x9b, 0xd1, 0xa0,
-	0x6d, 0x55, 0x9f, 0xc7, 0x72, 0xf3, 0x17, 0x46, 0x60, 0x4a, 0xfd, 0x10, 0x62, 0xf2, 0xcc, 0x42,
-	0x9e, 0xaf, 0x86, 0x2e, 0x38, 0x08, 0xb1, 0x44, 0x49, 0x1c, 0xf1, 0x93, 0x39, 0x36, 0xe2, 0x67,
-	0x07, 0xa6, 0xab, 0xbe, 0xd7, 0xf1, 0x02, 0xda, 0xe0, 0x8f, 0xa6, 0xf0, 0x55, 0xeb, 0xb4, 0xa2,
-	0xed, 0xb2, 0x3e, 0xc7, 0xbb, 0x05, 0x3c, 0xeb, 0x75, 0x04, 0xb6, 0x9d, 0x7c, 0x52, 0x45, 0xe7,
-	0xc3, 0xaf, 0x2d, 0x9d, 0x40, 0x24, 0x20, 0x88, 0xae, 0x2d, 0x19, 0x44, 0xbf, 0xb6, 0x64, 0x10,
-	0x75, 0x5a, 0x8c, 0x3e, 0xad, 0x69, 0x41, 0x7e, 0xd9, 0x80, 0xc9, 0x42, 0xbb, 0x2d, 0x22, 0x89,
-	0x8e, 0x71, 0xa5, 0xfe, 0x9a, 0xb8, 0xb9, 0x7c, 0xfb, 0x63, 0xdd, 0x5c, 0x6e, 0xfa, 0x8e, 0x1b,
-	0x06, 0xa8, 0xd2, 0xc4, 0x15, 0xaa, 0xea, 0xba, 0xd2, 0x0e, 0xf2, 0x36, 0xe4, 0x23, 0x79, 0xac,
-	0xb4, 0x1b, 0xf4, 0x11, 0x0d, 0x16, 0xc6, 0x2f, 0x66, 0xaf, 0x4c, 0xf3, 0xf7, 0x9e, 0xb4, 0x2b,
-	0xd9, 0x24, 0xa2, 0xf9, 0x5d, 0x03, 0xce, 0xaa, 0x02, 0x51, 0xeb, 0xee, 0xb6, 0x5c, 0x54, 0xa8,
-	0xc9, 0x75, 0x98, 0x10, 0xe3, 0x15, 0x69, 0xa2, 0xbd, 0x09, 0x95, 0x62, 0x14, 0x52, 0x66, 0x43,
-	0xc4, 0x78, 0x08, 0x43, 0xd0, 0xe9, 0xc4, 0x74, 0x63, 0x45, 0xcb, 0x0b, 0xa2, 0xb3, 0xf3, 0x3e,
-	0xfe, 0xd6, 0xc7, 0x8e, 0x41, 0xcc, 0xf7, 0x60, 0x4e, 0x6f, 0x65, 0x8d, 0x62, 0x52, 0x1c, 0xf9,
-	0x69, 0x46, 0xfa, 0xa7, 0xc9, 0x72, 0x73, 0x07, 0x48, 0x0f, 0x7d, 0x80, 0xd7, 0xef, 0x34, 0x94,
-	0xee, 0x21, 0xd2, 0xf8, 0xdd, 0x83, 0x18, 0xbd, 0x44, 0x35, 0xa9, 0x76, 0x37, 0x92, 0x9a, 0xff,
-	0x62, 0x12, 0x4e, 0xa7, 0x2c, 0x1d, 0xc7, 0x6c, 0xed, 0x8b, 0xfa, 0xe4, 0x99, 0x88, 0xa2, 0x14,
-	0xe4, 0x94, 0x79, 0x4f, 0xbe, 0x2f, 0x34, 0x60, 0xaa, 0x0c, 0x7a, 0x74, 0xe8, 0x93, 0xd8, 0xde,
-	0xd5, 0x40, 0xa2, 0xd1, 0xa7, 0x16, 0x48, 0xb4, 0x0c, 0xd3, 0xe2, 0xab, 0xc4, 0x54, 0x1e, 0x8b,
-	0x6d, 0x3e, 0x3e, 0x2f, 0xb0, 0x7b, 0xa6, 0xb4, 0x4e, 0xc2, 0x79, 0x04, 0x5e, 0xf3, 0x01, 0x15,
-	0x3c, 0xc6, 0x55, 0x1e, 0x58, 0x90, 0xca, 0x43, 0x21, 0x21, 0x7f, 0x07, 0xd3, 0x6c, 0x22, 0x44,
-	0x9d, 0xcf, 0xb9, 0x41, 0xf3, 0xb9, 0xf1, 0x74, 0xe6, 0xf3, 0x0b, 0xb2, 0x8d, 0xe9, 0xf3, 0x3a,
-	0xa5, 0x59, 0xe4, 0x37, 0x0c, 0x98, 0xe3, 0xd1, 0x2c, 0x6a, 0x63, 0x07, 0x46, 0x28, 0xd4, 0x9f,
-	0x4e, 0x63, 0x9f, 0x0f, 0xb0, 0xda, 0x3e, 0x6d, 0xed, 0x6d, 0x14, 0xf9, 0x0a, 0x40, 0x34, 0xa3,
-	0x82, 0x05, 0xd0, 0x33, 0x38, 0xa4, 0x6d, 0x9f, 0x71, 0xda, 0xa7, 0x30, 0xa2, 0xd3, 0x92, 0xab,
-	0x46, 0x50, 0xf2, 0xe3, 0x30, 0xcf, 0xe6, 0x4b, 0x04, 0x11, 0xb1, 0x77, 0x0b, 0x93, 0x58, 0xcb,
-	0x67, 0xfb, 0x6f, 0xed, 0xd7, 0xd3, 0xc8, 0x78, 0x96, 0x87, 0x38, 0x99, 0x79, 0xd8, 0x52, 0xcf,
-	0xac, 0x69, 0x14, 0x18, 0xcc, 0x8a, 0xad, 0xe7, 0x49, 0x96, 0xfa, 0xac, 0x6f, 0xe7, 0xe5, 0x5c,
-	0xe0, 0xeb, 0x5b, 0xa0, 0x7b, 0x43, 0x23, 0x88, 0x7c, 0x09, 0x48, 0x14, 0x06, 0xc2, 0x61, 0x54,
-	0x26, 0x60, 0xe2, 0x06, 0xa0, 0x38, 0x9c, 0xc4, 0x97, 0xc5, 0xaa, 0x90, 0xf4, 0x12, 0x13, 0x0a,
-	0xf3, 0xe2, 0xa3, 0x19, 0x54, 0xa6, 0x21, 0x0d, 0x16, 0x66, 0xb4, 0xc8, 0xc6, 0xb8, 0x24, 0xce,
-	0x7a, 0xae, 0xe4, 0x32, 0xd5, 0xce, 0xed, 0x69, 0xec, 0xc8, 0x6d, 0x98, 0x58, 0xf5, 0xf6, 0xdd,
-	0xf6, 0x8a, 0x74, 0x2a, 0x10, 0x17, 0x9c, 0x4d, 0x06, 0xb4, 0x0f, 0x74, 0xd7, 0x80, 0x18, 0x95,
-	0x69, 0xb5, 0x25, 0xff, 0xd0, 0xea, 0xb6, 0x17, 0xf2, 0x78, 0x5a, 0x47, 0x75, 0xa6, 0xe1, 0x1f,
-	0xda, 0x7e, 0x57, 0xf7, 0x59, 0x47, 0xa4, 0x0b, 0xbb, 0x70, 0xbe, 0xef, 0xa0, 0xa5, 0x24, 0x94,
-	0xb8, 0xa1, 0x27, 0x94, 0x38, 0xdf, 0x6f, 0x71, 0x0f, 0xd4, 0xa4, 0x12, 0x7f, 0xc3, 0x48, 0xac,
-	0xe6, 0x42, 0xf5, 0xe2, 0xf9, 0x03, 0xfb, 0x6d, 0x77, 0x19, 0x4c, 0x84, 0xcd, 0xd7, 0xfb, 0x4c,
-	0xac, 0xf2, 0x25, 0x9e, 0x5e, 0xe0, 0x2b, 0xff, 0x13, 0x2e, 0xec, 0xe6, 0xbf, 0xce, 0x02, 0xe1,
-	0x2d, 0x2c, 0x3a, 0x1d, 0x67, 0xd7, 0x6d, 0xba, 0xa1, 0x8b, 0x41, 0x3c, 0x79, 0xc1, 0xc2, 0xd9,
-	0x6d, 0x52, 0x35, 0x02, 0x4e, 0x38, 0xd9, 0x44, 0x65, 0x76, 0x52, 0x49, 0xeb, 0x21, 0xec, 0x23,
-	0x8a, 0x99, 0x27, 0x11, 0xc5, 0x6f, 0xc2, 0x73, 0x85, 0x0e, 0x26, 0xaf, 0x96, 0xb5, 0xdc, 0xf1,
-	0x7c, 0x29, 0x44, 0x9a, 0x33, 0xac, 0x13, 0xa1, 0xf5, 0xb4, 0x74, 0x10, 0x0b, 0x65, 0x1f, 0xa9,
-	0xfa, 0x5e, 0xab, 0x13, 0xaa, 0xd1, 0x04, 0x72, 0x1f, 0xe9, 0x60, 0x49, 0xca, 0x3e, 0xc2, 0x49,
-	0x24, 0x0f, 0xd7, 0x97, 0xfb, 0xc8, 0x28, 0x0a, 0x66, 0xc4, 0xc3, 0xf5, 0x69, 0x9f, 0xbd, 0x28,
-	0x22, 0x21, 0xef, 0xc0, 0x64, 0xa1, 0x1b, 0x7a, 0x82, 0xb1, 0xf0, 0x0e, 0x8b, 0xfd, 0xb8, 0x44,
-	0x53, 0x34, 0xb5, 0x2d, 0x46, 0x37, 0xff, 0xe3, 0x0c, 0x9c, 0xef, 0x1d, 0x5e, 0x51, 0x1a, 0x09,
-	0x99, 0x71, 0x8c, 0x90, 0xa5, 0x49, 0x03, 0xb7, 0x88, 0x3d, 0x35, 0x69, 0xe0, 0x39, 0xb0, 0x3f,
-	0xa6, 0x34, 0xd4, 0x60, 0x52, 0x5d, 0x8f, 0x46, 0x3e, 0xee, 0x7a, 0xa4, 0x72, 0x31, 0xff, 0x33,
-	0x43, 0xcd, 0xcc, 0x4c, 0xde, 0x48, 0xf3, 0x45, 0xe5, 0x89, 0x51, 0x38, 0x58, 0x77, 0x43, 0x95,
-	0x47, 0xd9, 0x4c, 0xea, 0x51, 0x56, 0xe6, 0x78, 0xc9, 0xa6, 0xe6, 0x78, 0x29, 0xc1, 0x6c, 0xad,
-	0xbb, 0x2b, 0xeb, 0x46, 0xc4, 0x11, 0xcd, 0x9d, 0xde, 0x96, 0xed, 0xd7, 0x03, 0x25, 0x35, 0x12,
-	0xf3, 0x67, 0x32, 0x30, 0x55, 0x6d, 0x76, 0xf7, 0xdd, 0x76, 0xc9, 0x09, 0x9d, 0x67, 0xf6, 0x74,
-	0xfd, 0x96, 0x76, 0xba, 0x8e, 0x5c, 0xae, 0xa3, 0x0f, 0x1b, 0xea, 0x68, 0xfd, 0x3d, 0x03, 0x66,
-	0x63, 0x12, 0xbe, 0xc4, 0xaf, 0xc0, 0x08, 0xfb, 0x21, 0x94, 0xf5, 0x8b, 0x3d, 0x8c, 0x79, 0x56,
-	0xd4, 0xe8, 0x2f, 0x71, 0xde, 0xd5, 0xdf, 0xe5, 0x43, 0x0e, 0x17, 0x3e, 0xc7, 0x5f, 0xc8, 0x3a,
-	0x79, 0x36, 0xd4, 0x7f, 0x60, 0x40, 0x3e, 0xf9, 0x25, 0xe4, 0x1e, 0x8c, 0x33, 0x4e, 0x6e, 0xf4,
-	0xda, 0xd6, 0xcb, 0x7d, 0xbe, 0xf9, 0xba, 0x40, 0xe3, 0xcd, 0xc3, 0xce, 0xa7, 0x1c, 0x62, 0x49,
-	0x0e, 0x17, 0x2c, 0x98, 0x52, 0xb1, 0x52, 0x5a, 0xf7, 0xba, 0xbe, 0xaf, 0x9d, 0x4d, 0xef, 0x07,
-	0xb5, 0xd5, 0x7f, 0x4d, 0x6b, 0xb5, 0xd8, 0xd1, 0x86, 0x7d, 0x6b, 0x11, 0x73, 0x2b, 0x71, 0x29,
-	0x55, 0xe5, 0x2c, 0x45, 0xa0, 0x23, 0x3c, 0x76, 0x2c, 0xe7, 0xf5, 0x09, 0x39, 0xc3, 0x63, 0x79,
-	0x07, 0x21, 0xea, 0xbe, 0xce, 0x71, 0xcc, 0xbf, 0x9e, 0x85, 0xb3, 0x71, 0xf3, 0xf8, 0xcb, 0x93,
-	0x55, 0xc7, 0x77, 0x5a, 0xc1, 0x31, 0x33, 0xe0, 0x4a, 0x4f, 0xd3, 0x30, 0x9f, 0xa1, 0x6c, 0x9a,
-	0xd2, 0x20, 0x33, 0xd1, 0x20, 0xb4, 0x67, 0xf0, 0x06, 0xc9, 0x66, 0x90, 0x7b, 0x90, 0xad, 0xd1,
-	0x50, 0xac, 0x45, 0x97, 0x7b, 0x7a, 0x55, 0x6d, 0xd7, 0xf5, 0x1a, 0x0d, 0xf9, 0x20, 0xf2, 0x88,
-	0x39, 0xaa, 0xa5, 0x82, 0x60, 0x27, 0xd3, 0x1d, 0x18, 0x2b, 0x3f, 0xea, 0xd0, 0x7a, 0x28, 0x12,
-	0x8b, 0x5d, 0x1d, 0xcc, 0x8f, 0xe3, 0x2a, 0xe9, 0xcb, 0x28, 0x02, 0xd4, 0xce, 0xe2, 0x28, 0x17,
-	0x6e, 0x43, 0x4e, 0x56, 0x7e, 0xa2, 0x34, 0x5c, 0x6f, 0xc1, 0xa4, 0x52, 0xc9, 0x89, 0x84, 0xfe,
-	0x4f, 0x0d, 0x18, 0x63, 0x3b, 0xc1, 0xf6, 0xed, 0x67, 0x74, 0x45, 0xba, 0xa5, 0xad, 0x48, 0x73,
-	0x4a, 0xb6, 0x19, 0x9c, 0x97, 0xb7, 0x8f, 0x59, 0x8b, 0x8e, 0xd8, 0xbe, 0x12, 0x21, 0x93, 0xbb,
-	0x30, 0x2e, 0xae, 0x3c, 0x85, 0x73, 0x96, 0x9a, 0xbe, 0x46, 0x5e, 0x86, 0x46, 0x0a, 0xbf, 0xd7,
-	0x49, 0x9e, 0x90, 0x24, 0x35, 0x29, 0xc5, 0xa9, 0x07, 0xb4, 0x6c, 0xe7, 0x1e, 0xfa, 0x88, 0xf3,
-	0xf4, 0x2b, 0xca, 0x8b, 0x00, 0x7d, 0x02, 0xf9, 0x0a, 0xc2, 0xc6, 0x97, 0x1d, 0xc4, 0xe4, 0xac,
-	0x4c, 0x59, 0x9d, 0x6a, 0xfe, 0xfb, 0x5f, 0xe7, 0x78, 0xe2, 0x12, 0xd9, 0xb0, 0x77, 0x61, 0xea,
-	0x8e, 0xe7, 0x3f, 0x74, 0x7c, 0x1e, 0x8e, 0x8e, 0x9f, 0xc9, 0xef, 0xd2, 0xa6, 0xf7, 0x38, 0x9c,
-	0x07, 0xb4, 0xff, 0xf0, 0x68, 0x71, 0x64, 0xd9, 0xf3, 0x9a, 0x96, 0x86, 0x4e, 0x36, 0x60, 0x7a,
-	0xcd, 0x79, 0x24, 0x2e, 0x60, 0x37, 0x37, 0x57, 0x85, 0xd3, 0xe7, 0xd5, 0xc7, 0x47, 0x8b, 0xe7,
-	0x5b, 0xce, 0xa3, 0xe8, 0x02, 0xbb, 0x7f, 0x76, 0x04, 0x9d, 0x9e, 0xb8, 0x30, 0x53, 0xf5, 0xfc,
-	0x50, 0x54, 0xc2, 0x8e, 0x77, 0xd9, 0x3e, 0x57, 0xc8, 0x37, 0x52, 0xaf, 0x90, 0xcf, 0xb3, 0x33,
-	0xad, 0xbd, 0x17, 0x91, 0x6b, 0x91, 0x9c, 0x1a, 0x63, 0xf2, 0x2e, 0xcc, 0x15, 0xa9, 0x1f, 0xba,
-	0x7b, 0x6e, 0xdd, 0x09, 0xe9, 0x1d, 0xcf, 0x6f, 0x39, 0x52, 0x91, 0x44, 0xdb, 0x12, 0x5e, 0x04,
-	0xee, 0x21, 0xd8, 0xea, 0xc5, 0x24, 0x5f, 0x4d, 0x73, 0xa3, 0x1d, 0x8d, 0x9d, 0x05, 0x53, 0xdc,
-	0x68, 0xfb, 0x39, 0x0b, 0xf6, 0x3a, 0xd4, 0xee, 0x0f, 0xf2, 0x51, 0xc9, 0x2d, 0xdf, 0x14, 0xee,
-	0x2d, 0xc7, 0xfb, 0xa0, 0x44, 0xe3, 0xd6, 0xc7, 0x17, 0x65, 0x09, 0xb2, 0xcb, 0xd5, 0x3b, 0x68,
-	0x2d, 0x94, 0x37, 0xa0, 0xed, 0x03, 0xa7, 0x5d, 0x47, 0x05, 0x4f, 0xf8, 0x85, 0xa9, 0x0b, 0xde,
-	0x72, 0xf5, 0x0e, 0x71, 0xe0, 0x74, 0x95, 0xfa, 0x2d, 0x37, 0xfc, 0xf2, 0xcd, 0x9b, 0xca, 0x40,
-	0xe5, 0xb0, 0x69, 0x37, 0x44, 0xd3, 0x16, 0x3b, 0x88, 0x62, 0x3f, 0xba, 0x79, 0x33, 0x75, 0x38,
-	0xa2, 0x86, 0xa5, 0xf1, 0x22, 0x65, 0x98, 0x59, 0x73, 0x1e, 0xc5, 0xee, 0x7c, 0x81, 0x08, 0x48,
-	0x78, 0x41, 0x0a, 0x56, 0xec, 0x0a, 0xa8, 0x45, 0x1c, 0xea, 0x44, 0x4c, 0x3f, 0x8f, 0xc5, 0x2b,
-	0x10, 0xae, 0x9c, 0xa8, 0xa8, 0x29, 0xc2, 0xa9, 0x29, 0x99, 0x0a, 0x3a, 0xd9, 0x8a, 0x4e, 0x19,
-	0x5c, 0x4b, 0x17, 0xf9, 0x98, 0x6f, 0xa8, 0xa7, 0x0c, 0x07, 0x4b, 0xb4, 0xcf, 0x9a, 0x8d, 0xce,
-	0x77, 0xdc, 0xbf, 0xd1, 0xd2, 0xb9, 0xf4, 0x1e, 0x5e, 0xa6, 0x4e, 0x7e, 0x78, 0xa1, 0x30, 0xb2,
-	0xea, 0xd5, 0xef, 0xa3, 0x87, 0xc6, 0xc4, 0xf2, 0x97, 0xd8, 0x74, 0x6f, 0x7a, 0xf5, 0xfb, 0x4f,
-	0xcf, 0xf7, 0x06, 0xd9, 0x93, 0x75, 0xd6, 0x54, 0x26, 0x05, 0xa2, 0x4f, 0x84, 0x3f, 0xc7, 0x7c,
-	0xa4, 0xbd, 0x2b, 0x65, 0x5c, 0xaf, 0xe0, 0x42, 0x23, 0xbb, 0xd6, 0xd2, 0xc9, 0x09, 0x85, 0x7c,
-	0x89, 0x06, 0xf7, 0x43, 0xaf, 0x53, 0x6c, 0xba, 0x9d, 0x5d, 0xcf, 0xf1, 0x1b, 0x68, 0x0f, 0x48,
-	0x9b, 0xdf, 0xaf, 0xa6, 0xce, 0xef, 0xb9, 0x06, 0xa7, 0xb7, 0xeb, 0x92, 0x81, 0xd5, 0xc3, 0x92,
-	0x7c, 0x15, 0x66, 0x98, 0x70, 0x97, 0x1f, 0x85, 0xb4, 0xcd, 0x47, 0x7e, 0x0e, 0x77, 0xe6, 0x79,
-	0x25, 0xcd, 0x57, 0x54, 0xc8, 0x65, 0x0a, 0x27, 0x3b, 0x8d, 0x08, 0x54, 0x99, 0xd2, 0x59, 0x91,
-	0x06, 0x2c, 0xac, 0x39, 0x8f, 0x94, 0xbc, 0xd5, 0x8a, 0x90, 0x12, 0x14, 0x30, 0x7c, 0x42, 0x89,
-	0x09, 0x58, 0x9c, 0x8e, 0xa3, 0x8f, 0xbc, 0xf6, 0xe5, 0x44, 0x7e, 0x04, 0xce, 0x89, 0xcf, 0x2a,
-	0x61, 0x0e, 0x4b, 0xcf, 0x3f, 0xac, 0x1d, 0x38, 0xe8, 0xc9, 0x7b, 0xfa, 0x64, 0x0b, 0xa2, 0xec,
-	0xb0, 0x86, 0xe4, 0x63, 0x07, 0x9c, 0x91, 0xd5, 0xaf, 0x06, 0xf2, 0x4d, 0x98, 0xe1, 0x66, 0xe0,
-	0x15, 0x2f, 0x08, 0xf1, 0x10, 0x3a, 0xdf, 0xa7, 0xce, 0xcb, 0xa9, 0x75, 0xe6, 0xb9, 0x6d, 0x99,
-	0xbb, 0x74, 0xa2, 0x25, 0x3c, 0xc1, 0x8f, 0xbc, 0x0d, 0x93, 0x55, 0xb7, 0xcd, 0x43, 0xea, 0x2b,
-	0xd5, 0x85, 0x33, 0xf1, 0xae, 0xd3, 0x71, 0xdb, 0xb6, 0x3c, 0xff, 0x75, 0xa2, 0x45, 0x42, 0xc5,
-	0x26, 0x3b, 0x30, 0x59, 0xab, 0xad, 0xdc, 0x71, 0xd9, 0xb6, 0xd7, 0x39, 0x5c, 0x38, 0xdb, 0xa7,
-	0x6d, 0x97, 0x52, 0xdb, 0x36, 0x1d, 0x04, 0x07, 0xf8, 0xb8, 0x8c, 0x5d, 0xf7, 0x3a, 0x87, 0x96,
-	0xca, 0x29, 0xc5, 0x55, 0xeb, 0xdc, 0x53, 0x76, 0xd5, 0xaa, 0xc0, 0xac, 0xe2, 0xef, 0x82, 0xbe,
-	0x2e, 0x0b, 0xf1, 0xfb, 0x3b, 0xaa, 0x6b, 0x56, 0xd2, 0xe1, 0x3e, 0x49, 0x27, 0x7d, 0xb4, 0xce,
-	0x9f, 0xd4, 0x47, 0xcb, 0x85, 0x39, 0x3e, 0x18, 0x62, 0xf4, 0x71, 0x7c, 0x2f, 0xf4, 0xe9, 0xc3,
-	0xab, 0xa9, 0x7d, 0x78, 0x5a, 0x8c, 0xaf, 0x14, 0x2d, 0x1c, 0xe2, 0x5e, 0xae, 0x64, 0x0f, 0x88,
-	0x00, 0x8a, 0xa7, 0x6d, 0xb0, 0xae, 0xe7, 0xfa, 0xd4, 0xf5, 0x72, 0x6a, 0x5d, 0x33, 0xb2, 0xae,
-	0x5d, 0x5e, 0x4d, 0x0a, 0xc7, 0x0f, 0x46, 0x72, 0xd3, 0xf9, 0x99, 0x34, 0x77, 0xb0, 0xff, 0x22,
-	0x93, 0x58, 0xc0, 0x48, 0x05, 0xc6, 0x45, 0x0b, 0x85, 0x46, 0xd7, 0xdb, 0x8e, 0x17, 0x52, 0xdb,
-	0x31, 0x2e, 0x3e, 0xd6, 0x92, 0xf4, 0xe4, 0x21, 0x63, 0xb5, 0xe7, 0x74, 0x9b, 0x32, 0xd3, 0xcb,
-	0xd7, 0xf9, 0xfa, 0x84, 0x20, 0x6d, 0x25, 0x2e, 0x9d, 0xdc, 0x75, 0x56, 0xf7, 0xcc, 0xc6, 0x25,
-	0x59, 0xd6, 0x46, 0xee, 0xf3, 0x1c, 0x79, 0xd9, 0xc8, 0xff, 0x52, 0x4f, 0x88, 0xf7, 0xd4, 0x2a,
-	0x64, 0xb5, 0x98, 0xbf, 0x63, 0xc0, 0xb4, 0xb6, 0x02, 0x92, 0xdb, 0x8a, 0x73, 0x71, 0x1c, 0x45,
-	0xa2, 0xe1, 0xe0, 0xf4, 0x48, 0xba, 0x1d, 0xdf, 0x16, 0xce, 0x5d, 0x99, 0xfe, 0x74, 0xa9, 0xef,
-	0x1e, 0x0d, 0xb6, 0xc7, 0x44, 0x39, 0x77, 0x47, 0xfa, 0xe4, 0xdc, 0xfd, 0xcd, 0xf3, 0x30, 0xa3,
-	0xab, 0xc8, 0xec, 0xcc, 0x8a, 0x96, 0x69, 0x69, 0x36, 0xe5, 0x59, 0xa4, 0x11, 0xa2, 0xbd, 0xa8,
-	0x82, 0x10, 0xf2, 0x0a, 0x40, 0xe4, 0xe7, 0x24, 0x2d, 0xa3, 0xa3, 0x8f, 0x8f, 0x16, 0x8d, 0x37,
-	0x2c, 0xa5, 0x80, 0x7c, 0x03, 0x60, 0xdd, 0x6b, 0xd0, 0x28, 0xcf, 0xf9, 0x80, 0xdb, 0x99, 0x57,
-	0x7b, 0xf2, 0x47, 0x9d, 0x69, 0x7b, 0x0d, 0xda, 0x9b, 0x2c, 0x4a, 0xe1, 0x48, 0xbe, 0x00, 0xa3,
-	0x56, 0xb7, 0x49, 0xa5, 0x05, 0x6d, 0x52, 0xae, 0x49, 0xdd, 0xa6, 0xf2, 0x04, 0xb2, 0xdf, 0x4d,
-	0x5e, 0xca, 0x33, 0x00, 0x79, 0x9f, 0xe7, 0x95, 0x12, 0xc9, 0x1b, 0x46, 0x63, 0x5b, 0xb1, 0xb2,
-	0x43, 0xf5, 0xa4, 0x6f, 0x50, 0x48, 0xc8, 0x06, 0x8c, 0xab, 0x46, 0x4e, 0x25, 0x4a, 0x45, 0x35,
-	0xa0, 0x2b, 0xa7, 0x10, 0x91, 0xa8, 0x3a, 0x69, 0xff, 0x94, 0x5c, 0xc8, 0x3b, 0x30, 0xc1, 0xd8,
-	0xf3, 0xe7, 0x74, 0xc7, 0x63, 0x8b, 0xb0, 0xd2, 0xa0, 0xe4, 0x8b, 0xba, 0x31, 0x01, 0xf9, 0x2a,
-	0x66, 0xae, 0x17, 0x5d, 0x3d, 0xf0, 0xd6, 0xee, 0x72, 0x4f, 0x57, 0xcf, 0x3b, 0x9d, 0x4e, 0xca,
-	0xfb, 0x22, 0x11, 0x3f, 0xb2, 0x1f, 0x85, 0xfe, 0x0f, 0x93, 0x0b, 0xec, 0x5a, 0x4f, 0x05, 0x0b,
-	0x32, 0x9a, 0xbd, 0x37, 0x5f, 0xbd, 0xc6, 0x97, 0x74, 0x20, 0x1f, 0x6f, 0xfe, 0xa2, 0x2e, 0x18,
-	0x54, 0xd7, 0x1b, 0x3d, 0x75, 0xa9, 0x03, 0xd8, 0x53, 0x5d, 0x0f, 0x77, 0xd2, 0x88, 0xdf, 0x2c,
-	0x17, 0xf5, 0x4d, 0x0e, 0xaa, 0xef, 0x95, 0x9e, 0xfa, 0x4e, 0x37, 0x76, 0x7b, 0xeb, 0x49, 0xf0,
-	0x24, 0xef, 0xc0, 0xb4, 0x84, 0xe0, 0xfc, 0x10, 0x4f, 0x92, 0xf0, 0xd7, 0xf6, 0x77, 0xd1, 0xa5,
-	0x5f, 0xcf, 0xa6, 0xae, 0x22, 0xab, 0xd4, 0x5c, 0x3a, 0xa6, 0x35, 0xea, 0xa4, 0x54, 0xe8, 0xc8,
-	0xe4, 0x43, 0x98, 0xac, 0xb4, 0xd8, 0x87, 0x78, 0x6d, 0x27, 0xa4, 0xc2, 0x83, 0x59, 0xde, 0x40,
-	0x2a, 0x25, 0x8a, 0xa8, 0xf2, 0xd7, 0x03, 0xe3, 0x22, 0xf5, 0x38, 0xa0, 0x50, 0xb0, 0xce, 0xe3,
-	0x56, 0x6d, 0x21, 0xc3, 0xd2, 0xbb, 0xf9, 0x85, 0x94, 0x5b, 0x40, 0x85, 0xbd, 0x48, 0x92, 0xc2,
-	0xa0, 0xf2, 0x42, 0x20, 0x91, 0x24, 0x45, 0xe5, 0x49, 0xde, 0x85, 0x49, 0x91, 0x26, 0xb1, 0x60,
-	0xad, 0x07, 0x0b, 0xf9, 0xf8, 0xa5, 0x69, 0x99, 0x51, 0xd1, 0x76, 0xfc, 0x84, 0x2b, 0x48, 0x8c,
-	0x4f, 0xbe, 0x0c, 0xf3, 0x3b, 0x6e, 0xbb, 0xe1, 0x3d, 0x0c, 0xc4, 0x36, 0x25, 0x16, 0xba, 0xb9,
-	0xd8, 0x63, 0xf7, 0x21, 0x2f, 0x8f, 0x76, 0xef, 0x9e, 0x85, 0x2f, 0x95, 0x03, 0xf9, 0xb1, 0x1e,
-	0xce, 0x5c, 0x82, 0xc8, 0x20, 0x09, 0x5a, 0xea, 0x91, 0xa0, 0xde, 0xea, 0x93, 0xe2, 0x94, 0x5a,
-	0x0d, 0xf1, 0x80, 0xe8, 0xfb, 0xfb, 0x07, 0x9e, 0xdb, 0x5e, 0x38, 0x8d, 0x6b, 0xe1, 0x73, 0xc9,
-	0x28, 0x28, 0xc4, 0xe3, 0xcf, 0x14, 0xca, 0xc7, 0x56, 0x75, 0x2d, 0xed, 0x23, 0x4f, 0x33, 0x4f,
-	0xa6, 0xb0, 0x26, 0x1f, 0xc2, 0x14, 0xfb, 0x3f, 0x3a, 0x3c, 0xce, 0x6b, 0x7e, 0x23, 0x0a, 0xa6,
-	0xa8, 0x07, 0xc7, 0x08, 0xf3, 0x38, 0xa6, 0x9c, 0x2b, 0x35, 0x56, 0xe4, 0x2d, 0x00, 0xa6, 0x09,
-	0x8b, 0xe5, 0xf8, 0x4c, 0x9c, 0x93, 0x06, 0x15, 0xe6, 0xde, 0x85, 0x38, 0x46, 0x66, 0x27, 0x5a,
-	0xf6, 0xab, 0xd6, 0x6d, 0x78, 0x6c, 0x6e, 0x9c, 0x45, 0x5a, 0x3c, 0xd1, 0x22, 0x6d, 0xc0, 0xe1,
-	0xaa, 0x74, 0x28, 0xe8, 0x64, 0x05, 0x66, 0x31, 0x77, 0x50, 0xa5, 0x41, 0xdb, 0x21, 0xde, 0x36,
-	0x2d, 0x9c, 0x53, 0x6e, 0xe3, 0x58, 0x91, 0xed, 0x46, 0x65, 0xaa, 0xf6, 0x99, 0x20, 0x23, 0x01,
-	0x9c, 0x8e, 0x57, 0x97, 0xf8, 0x6e, 0x6f, 0x01, 0x3b, 0x49, 0xde, 0xbf, 0xf6, 0x62, 0xf0, 0xf5,
-	0x98, 0x8d, 0x88, 0xb2, 0x70, 0x49, 0x23, 0xae, 0x5a, 0x61, 0x1a, 0x77, 0x62, 0x01, 0xb9, 0x5b,
-	0xac, 0x26, 0x93, 0xeb, 0x9c, 0xc7, 0x2f, 0xc0, 0x61, 0xde, 0xaf, 0x77, 0xec, 0x01, 0x09, 0x76,
-	0x52, 0xa8, 0xc9, 0xb7, 0xe1, 0x4c, 0xf4, 0x18, 0x3d, 0x2f, 0x12, 0x72, 0x7d, 0xe1, 0x84, 0x2b,
-	0x71, 0x63, 0x37, 0xaa, 0xba, 0x47, 0xa4, 0xd3, 0xab, 0x20, 0x0e, 0x4c, 0xe2, 0xb0, 0x8a, 0x1a,
-	0x9f, 0x1b, 0x54, 0xe3, 0x95, 0x9e, 0x1a, 0xcf, 0xf2, 0x27, 0x57, 0x7b, 0x2a, 0x53, 0x79, 0x92,
-	0x65, 0x98, 0x16, 0xf3, 0x48, 0x48, 0xdb, 0xf3, 0xf1, 0x9b, 0xc1, 0x72, 0x06, 0xf6, 0x08, 0x9c,
-	0x4e, 0xa2, 0xae, 0xc8, 0xfc, 0x7a, 0xf1, 0x05, 0x6d, 0x45, 0x4e, 0xde, 0x2a, 0xea, 0xc8, 0x6c,
-	0x45, 0x8a, 0xb5, 0x98, 0xf2, 0xa3, 0x8e, 0x2f, 0x4c, 0x09, 0x2f, 0xc6, 0xd9, 0x11, 0x15, 0xe5,
-	0xc7, 0xa6, 0x11, 0x86, 0xba, 0x24, 0xa4, 0x71, 0x20, 0x5b, 0x70, 0x3a, 0xda, 0xb5, 0x15, 0xc6,
-	0x8b, 0xc8, 0xf8, 0xd2, 0xe3, 0xa3, 0xc5, 0xc5, 0x78, 0xab, 0x4f, 0xe7, 0x9b, 0x46, 0x4f, 0x1c,
-	0x38, 0xa7, 0xed, 0xd3, 0x0a, 0xeb, 0x8b, 0xc8, 0xfa, 0xd5, 0xc7, 0x47, 0x8b, 0x97, 0xf4, 0x4d,
-	0x3e, 0x9d, 0x7d, 0x3f, 0x3e, 0xe4, 0x23, 0xb8, 0x90, 0xdc, 0x9b, 0x95, 0x5a, 0x5e, 0xc2, 0x5a,
-	0xae, 0x3d, 0x3e, 0x5a, 0xbc, 0xdc, 0xb3, 0xbd, 0xa7, 0x57, 0x34, 0x80, 0x1b, 0xf9, 0x06, 0x2c,
-	0xe8, 0xfb, 0xb3, 0x52, 0x93, 0x19, 0x3f, 0x47, 0x1d, 0x6d, 0xec, 0xe9, 0x35, 0xf4, 0xe5, 0x41,
-	0x42, 0x58, 0x4c, 0x95, 0x6e, 0xa5, 0x9a, 0x4b, 0xf1, 0x07, 0xf5, 0xcc, 0x92, 0xf4, 0xea, 0x8e,
-	0x63, 0x49, 0x1e, 0xc2, 0x8b, 0x69, 0xdb, 0x84, 0x52, 0xe9, 0xcb, 0x91, 0xb1, 0xee, 0xb5, 0xf4,
-	0x2d, 0x27, 0xbd, 0xe6, 0x63, 0xd8, 0x92, 0xaf, 0xc2, 0x19, 0x65, 0x7e, 0x29, 0xf5, 0xbd, 0x82,
-	0xf5, 0x61, 0xbc, 0x8d, 0x3a, 0x31, 0xd3, 0x6b, 0x49, 0xe7, 0x61, 0xfe, 0x55, 0x03, 0x48, 0xef,
-	0xc2, 0x37, 0xf4, 0xfd, 0xdd, 0x9b, 0x4a, 0x30, 0x8a, 0xfa, 0xa0, 0x6e, 0x94, 0x60, 0x51, 0x55,
-	0x78, 0xe3, 0xb0, 0x95, 0xcb, 0xda, 0x01, 0xab, 0xaf, 0x07, 0xb3, 0xf9, 0xc7, 0x06, 0xcc, 0xa7,
-	0x6d, 0xb1, 0xc7, 0xbc, 0x8a, 0x62, 0x26, 0x1c, 0x9f, 0xf1, 0x42, 0x8e, 0x3b, 0x3e, 0x47, 0xee,
-	0xce, 0x8b, 0x30, 0xca, 0xbe, 0x40, 0x3a, 0x87, 0xe0, 0x29, 0x8e, 0x7d, 0x62, 0x60, 0x71, 0x38,
-	0x43, 0xe0, 0x41, 0xe1, 0xec, 0x98, 0x37, 0xca, 0x11, 0x70, 0x05, 0xb7, 0x38, 0x9c, 0x21, 0xb0,
-	0xd3, 0xa2, 0x3c, 0xdd, 0x20, 0x02, 0x3b, 0x44, 0x06, 0x16, 0x87, 0x93, 0xcb, 0x30, 0xbe, 0xd1,
-	0x5e, 0xa5, 0xce, 0x03, 0x99, 0xf8, 0x11, 0x2f, 0x10, 0xbd, 0xb6, 0xdd, 0x64, 0x30, 0x4b, 0x16,
-	0x9a, 0xdf, 0x33, 0x60, 0xae, 0x67, 0x77, 0x3f, 0xfe, 0xe1, 0x97, 0xc1, 0x2e, 0x9e, 0xc3, 0x7c,
-	0x1f, 0x6f, 0xfe, 0x48, 0x7a, 0xf3, 0xcd, 0xdf, 0x1e, 0x81, 0x73, 0x7d, 0x0e, 0x5b, 0xb1, 0x7b,
-	0xb6, 0x71, 0xac, 0x7b, 0xf6, 0xd7, 0xd8, 0xe1, 0xc6, 0x71, 0x5b, 0xc1, 0xa6, 0x17, 0xb7, 0x38,
-	0xf6, 0x64, 0xc3, 0x32, 0xf9, 0x2e, 0xc3, 0x4b, 0x62, 0xaf, 0x3e, 0x5f, 0x47, 0x0a, 0x3b, 0xf4,
-	0x7a, 0xd7, 0x7a, 0x8d, 0x59, 0x8f, 0x83, 0x74, 0xf6, 0xcf, 0x89, 0x83, 0xb4, 0xee, 0x96, 0x38,
-	0xf2, 0x54, 0xdd, 0x12, 0xd3, 0x5d, 0x66, 0x46, 0x9f, 0xc4, 0x81, 0xaa, 0x08, 0xd3, 0x35, 0xea,
-	0xf8, 0xf5, 0x83, 0x42, 0xc0, 0x07, 0x69, 0x2c, 0x4e, 0xb7, 0x18, 0x60, 0x81, 0xed, 0x04, 0xbd,
-	0x63, 0xa1, 0xd1, 0x98, 0xdf, 0xcb, 0xe8, 0x7e, 0xdd, 0x7f, 0x1e, 0xe5, 0xe5, 0x2a, 0x8c, 0xee,
-	0x1c, 0x50, 0x5f, 0x2e, 0x3d, 0xd8, 0x90, 0x87, 0x0c, 0xa0, 0x36, 0x04, 0x31, 0xc8, 0x1d, 0x98,
-	0xa9, 0xf2, 0xfe, 0x93, 0x9d, 0x32, 0x12, 0x6b, 0xae, 0x1d, 0x71, 0xbe, 0x4a, 0xe9, 0x95, 0x04,
-	0x95, 0xf9, 0x23, 0x30, 0xa5, 0x36, 0x1a, 0x17, 0x16, 0xf6, 0x5b, 0xcc, 0x6c, 0xbe, 0xb0, 0x30,
-	0x80, 0xc5, 0xe1, 0xc7, 0x3e, 0xea, 0x14, 0xf7, 0x66, 0xf6, 0xb8, 0xde, 0x64, 0x95, 0xa3, 0xdc,
-	0x2a, 0x95, 0xe3, 0x6f, 0xb5, 0xf2, 0x90, 0x01, 0x2c, 0x0e, 0x7f, 0xaa, 0x95, 0xff, 0x53, 0x99,
-	0x12, 0xf3, 0x4d, 0x98, 0x88, 0x35, 0xf6, 0x38, 0x75, 0xfe, 0xe9, 0x34, 0x3d, 0x3c, 0xc6, 0x64,
-	0x55, 0x6d, 0x53, 0x7f, 0x57, 0x0b, 0x02, 0x79, 0xc0, 0x00, 0x6a, 0x55, 0x88, 0x71, 0x92, 0x71,
-	0xbd, 0x01, 0xe3, 0x05, 0x71, 0x7b, 0xc2, 0x07, 0x94, 0x07, 0xba, 0xf4, 0x5c, 0x95, 0x48, 0x2c,
-	0xf3, 0xfb, 0x06, 0x9c, 0x49, 0x3d, 0xc8, 0xb3, 0x5a, 0xb9, 0xc5, 0x40, 0x11, 0xeb, 0xa4, 0xb9,
-	0x80, 0x63, 0x9c, 0x24, 0xa0, 0x65, 0xf8, 0x6f, 0x31, 0x5f, 0x82, 0x89, 0xc8, 0x8c, 0x4c, 0xe6,
-	0xe5, 0xd0, 0xe1, 0x95, 0xba, 0xb4, 0x46, 0xfe, 0xa9, 0x01, 0x63, 0xac, 0x09, 0xcf, 0x6c, 0xf2,
-	0x8a, 0x74, 0x07, 0x0b, 0xf6, 0x49, 0x43, 0xa5, 0xac, 0xf8, 0xf5, 0x31, 0x80, 0x18, 0x99, 0xec,
-	0xc2, 0xcc, 0x46, 0xa5, 0x54, 0x54, 0xce, 0xa3, 0x7a, 0xf6, 0xce, 0xe8, 0xa1, 0x31, 0x8e, 0x70,
-	0x18, 0xaf, 0x31, 0x9e, 0xdb, 0xa8, 0xa7, 0x9f, 0x55, 0x13, 0x1c, 0x59, 0x1d, 0xb5, 0xc2, 0xda,
-	0xaa, 0x52, 0x47, 0x66, 0xc8, 0x3a, 0x02, 0xa7, 0xd5, 0xec, 0x53, 0x87, 0xce, 0x91, 0x1c, 0x40,
-	0xfe, 0x2e, 0xee, 0x62, 0x4a, 0x2d, 0xd9, 0xc1, 0xb5, 0x5c, 0x12, 0xb5, 0x3c, 0xc7, 0xb7, 0xbf,
-	0xf4, 0x7a, 0x7a, 0xb8, 0xc6, 0x92, 0x3b, 0x72, 0xac, 0xe4, 0xfe, 0x25, 0x03, 0xc6, 0xf8, 0x36,
-	0x29, 0x46, 0xab, 0xcf, 0x46, 0xbc, 0xf3, 0x74, 0x36, 0xe2, 0x3c, 0xae, 0x5c, 0x9a, 0x05, 0x9d,
-	0x97, 0x91, 0x12, 0x8c, 0xd5, 0x42, 0x27, 0xec, 0xca, 0x88, 0x29, 0xe9, 0x45, 0x83, 0x96, 0x25,
-	0x5e, 0x12, 0x87, 0x05, 0x05, 0xf8, 0x5b, 0xe5, 0xc2, 0x31, 0x48, 0x25, 0x8e, 0x48, 0x19, 0x3f,
-	0x36, 0x22, 0x45, 0x46, 0xf1, 0x8c, 0x8b, 0x88, 0x14, 0x3d, 0x0e, 0x65, 0x15, 0x26, 0x44, 0x9c,
-	0xcb, 0xf2, 0xa1, 0xb0, 0x1f, 0xcb, 0x7b, 0xa0, 0x08, 0xae, 0x3c, 0x48, 0xcd, 0x41, 0xf6, 0xae,
-	0xf6, 0x6a, 0x5a, 0x84, 0x48, 0x36, 0x78, 0x9e, 0x60, 0x9e, 0xca, 0x43, 0xcf, 0x48, 0x15, 0xc1,
-	0x45, 0x20, 0xa8, 0x74, 0x96, 0x4f, 0xc9, 0xdc, 0x11, 0xf3, 0x30, 0x7f, 0xc1, 0x80, 0x7c, 0x52,
-	0x5e, 0xc8, 0x3b, 0x30, 0x19, 0x25, 0x3f, 0x89, 0xfc, 0xd3, 0xd1, 0xf2, 0x13, 0x67, 0x4b, 0xd1,
-	0x3c, 0xd5, 0x55, 0x74, 0xb2, 0x04, 0x39, 0x36, 0xed, 0x94, 0xf7, 0x80, 0x71, 0x3d, 0xe9, 0x0a,
-	0x98, 0xea, 0xda, 0x27, 0xf1, 0x94, 0x59, 0xfb, 0xaf, 0xb2, 0x30, 0xa9, 0x0c, 0x16, 0xb9, 0x0a,
-	0xb9, 0x4a, 0xb0, 0xea, 0xd5, 0xef, 0xd3, 0x86, 0xf0, 0x18, 0x9a, 0x7e, 0x7c, 0xb4, 0x38, 0xe1,
-	0x06, 0x76, 0x13, 0x81, 0x56, 0x54, 0x4c, 0x96, 0x61, 0x9a, 0xff, 0x25, 0xb3, 0xa2, 0x65, 0x62,
-	0x6f, 0x07, 0x8e, 0x2c, 0xf3, 0xa1, 0xa9, 0x6a, 0x82, 0x46, 0x42, 0xbe, 0x0e, 0xc0, 0x01, 0x43,
-	0xbe, 0xda, 0x2f, 0x27, 0xf0, 0x19, 0x51, 0x41, 0xca, 0xe3, 0xfd, 0x0a, 0x43, 0xf2, 0x4d, 0x9e,
-	0xd7, 0x44, 0x0a, 0xd7, 0xf1, 0x31, 0x54, 0xa6, 0x74, 0x55, 0x66, 0xfc, 0xed, 0xf4, 0x98, 0x27,
-	0x95, 0x25, 0xf9, 0xae, 0x01, 0x17, 0x2c, 0x5a, 0xf7, 0x1e, 0x50, 0xff, 0xb0, 0x10, 0x22, 0x96,
-	0x5a, 0xe3, 0xf1, 0x01, 0x56, 0xb7, 0x44, 0x8d, 0xaf, 0xfa, 0x82, 0x0b, 0x66, 0x97, 0x68, 0x75,
-	0x42, 0x7b, 0x40, 0x13, 0x06, 0x54, 0x69, 0xfe, 0x77, 0x86, 0x32, 0x05, 0xc8, 0x3a, 0xa6, 0x66,
-	0xe7, 0xc2, 0x22, 0xee, 0x45, 0x23, 0x0d, 0x4f, 0xc2, 0x2d, 0xba, 0xb7, 0xfc, 0x9c, 0x70, 0xee,
-	0x39, 0x1d, 0x89, 0x5c, 0x22, 0x65, 0x3b, 0x07, 0x92, 0x2f, 0xc2, 0x08, 0x0e, 0xd5, 0xf1, 0x4f,
-	0x50, 0xc9, 0xad, 0x66, 0x84, 0x8d, 0x11, 0xb6, 0x1a, 0x29, 0xc9, 0x67, 0x84, 0xf7, 0x7b, 0x56,
-	0x7b, 0x06, 0x95, 0x81, 0x58, 0x3b, 0xa2, 0x3d, 0x26, 0x0e, 0xb3, 0x53, 0xa4, 0xf5, 0x57, 0x32,
-	0x90, 0x4f, 0x4e, 0x3c, 0xf2, 0x3e, 0x4c, 0xc9, 0xb4, 0x2c, 0x2b, 0x8e, 0x48, 0xb6, 0x36, 0x25,
-	0x92, 0x9d, 0x09, 0xb8, 0x7d, 0xe0, 0x68, 0x0f, 0x8b, 0x69, 0x04, 0x6c, 0x43, 0xde, 0x14, 0xd1,
-	0xdb, 0xca, 0x04, 0x0a, 0xbd, 0xb0, 0x93, 0x78, 0x15, 0x51, 0xa2, 0x91, 0x37, 0x21, 0xbb, 0x76,
-	0xa7, 0x20, 0xbc, 0x42, 0xe5, 0xfa, 0xb2, 0x76, 0xa7, 0xc0, 0x6f, 0xf2, 0xf9, 0x05, 0xbd, 0xee,
-	0x2e, 0xc0, 0xf0, 0xc9, 0xaa, 0x92, 0xe9, 0x66, 0x4c, 0xcb, 0xdb, 0x2c, 0xc1, 0xd1, 0xc7, 0x1d,
-	0x9f, 0xf2, 0x46, 0x7d, 0x75, 0xcd, 0xfc, 0xcd, 0x2c, 0x4c, 0x44, 0xf5, 0x13, 0x02, 0xa8, 0x6f,
-	0x08, 0xc7, 0x50, 0xfc, 0x9b, 0x9c, 0x87, 0x9c, 0x54, 0x31, 0x84, 0x73, 0xe8, 0x78, 0x20, 0xd4,
-	0x8b, 0x05, 0x90, 0xba, 0x04, 0x57, 0x2f, 0x2c, 0xf9, 0x93, 0xdc, 0x84, 0x48, 0x51, 0xe8, 0xa7,
-	0x51, 0x8c, 0xb0, 0x01, 0xb3, 0x22, 0x34, 0x32, 0x03, 0x19, 0x97, 0x47, 0xe6, 0x4e, 0x58, 0x19,
-	0xb7, 0x41, 0xde, 0x87, 0x9c, 0xd3, 0x68, 0xd0, 0x86, 0xed, 0xc8, 0x0b, 0xc6, 0x41, 0x42, 0x93,
-	0x63, 0xdc, 0xf8, 0x8a, 0x8e, 0x54, 0x85, 0x90, 0x14, 0x60, 0xa2, 0xe9, 0x70, 0x6f, 0x93, 0xc6,
-	0x10, 0xdb, 0x43, 0xcc, 0x21, 0xc7, 0xc8, 0xb6, 0x02, 0xda, 0x20, 0xaf, 0xc2, 0x08, 0x1b, 0x4d,
-	0xb1, 0x1f, 0x44, 0x6f, 0xc8, 0x6d, 0x6c, 0x56, 0x79, 0x87, 0xad, 0x9c, 0xb2, 0x10, 0x81, 0xbc,
-	0x0c, 0xd9, 0xee, 0xd2, 0x9e, 0x58, 0xe9, 0xf3, 0x71, 0xd6, 0xa9, 0x08, 0x8d, 0x15, 0x93, 0x5b,
-	0x90, 0x7b, 0xa8, 0x27, 0x2c, 0x3a, 0x93, 0x18, 0xc6, 0x08, 0x3f, 0x42, 0x5c, 0xce, 0xc1, 0x18,
-	0x77, 0x02, 0x31, 0x5f, 0x04, 0x88, 0xab, 0xee, 0xf5, 0xe1, 0x35, 0xbf, 0x0e, 0x13, 0x51, 0x95,
-	0xe4, 0x05, 0x80, 0xfb, 0xf4, 0xd0, 0x3e, 0x70, 0xda, 0x8d, 0x26, 0x57, 0x38, 0xa7, 0xac, 0x89,
-	0xfb, 0xf4, 0x70, 0x05, 0x01, 0xe4, 0x1c, 0x8c, 0x77, 0xd8, 0xa8, 0xca, 0x37, 0x3d, 0xad, 0xb1,
-	0x4e, 0x77, 0x97, 0x49, 0xe8, 0x02, 0x8c, 0xa3, 0x11, 0x45, 0x4c, 0xb4, 0x69, 0x4b, 0xfe, 0x34,
-	0xff, 0x59, 0x06, 0x53, 0x50, 0x2a, 0xed, 0x24, 0x97, 0x60, 0xba, 0xee, 0x53, 0xdc, 0x8e, 0xf0,
-	0x41, 0x58, 0x51, 0xcf, 0x54, 0x0c, 0xac, 0x34, 0xc8, 0x65, 0x98, 0x8d, 0x1f, 0x19, 0xb5, 0xeb,
-	0xbb, 0x22, 0xbb, 0xd8, 0x94, 0x35, 0xdd, 0x91, 0xaf, 0x8c, 0x16, 0x77, 0x31, 0xa2, 0x3c, 0xaf,
-	0x66, 0x8e, 0x09, 0xa3, 0xa7, 0x44, 0xac, 0x59, 0x05, 0x8e, 0x7e, 0x03, 0x67, 0x61, 0xcc, 0x71,
-	0xf6, 0xbb, 0x2e, 0x8f, 0x6e, 0x9d, 0xb2, 0xc4, 0x2f, 0xf2, 0x1a, 0xcc, 0x05, 0xee, 0x7e, 0xdb,
-	0x09, 0xbb, 0xbe, 0xc8, 0x01, 0x4a, 0x7d, 0x14, 0xa9, 0x69, 0x2b, 0x1f, 0x15, 0x14, 0x39, 0x9c,
-	0xbc, 0x01, 0x44, 0xad, 0xcf, 0xdb, 0xfd, 0x88, 0xd6, 0xb9, 0xa8, 0x4d, 0x59, 0x73, 0x4a, 0xc9,
-	0x06, 0x16, 0x90, 0x97, 0x60, 0xca, 0xa7, 0x01, 0xaa, 0x64, 0xd8, 0x6d, 0x98, 0xa1, 0xd9, 0x9a,
-	0x94, 0x30, 0xd6, 0x77, 0x57, 0x20, 0xaf, 0x74, 0x07, 0x26, 0xe7, 0xe1, 0xa9, 0xb5, 0xac, 0x99,
-	0x18, 0x6e, 0x75, 0x2a, 0x0d, 0x73, 0x19, 0xe6, 0x7a, 0x66, 0x2e, 0x79, 0x83, 0x9f, 0x03, 0xc4,
-	0x4e, 0x3e, 0xc5, 0x8f, 0x3d, 0x6c, 0x39, 0xd3, 0x37, 0x71, 0x81, 0x64, 0xb6, 0x61, 0x4a, 0x5d,
-	0x89, 0x8f, 0xc9, 0xf0, 0x76, 0x16, 0x43, 0xd8, 0xf8, 0x32, 0x35, 0xf6, 0xf8, 0x68, 0x31, 0xe3,
-	0x36, 0x30, 0x70, 0xed, 0x0a, 0xe4, 0xa4, 0x3e, 0x21, 0xce, 0x08, 0x68, 0x04, 0x13, 0xaa, 0xe7,
-	0xa1, 0x15, 0x95, 0x9a, 0xaf, 0xc2, 0xb8, 0x58, 0x6c, 0x07, 0x9b, 0xbe, 0xcc, 0x9f, 0xce, 0xc0,
-	0xac, 0x45, 0xd9, 0x52, 0x40, 0x79, 0x5a, 0xc7, 0x4f, 0xd9, 0xc3, 0xac, 0xda, 0xb7, 0x0d, 0x48,
-	0xa8, 0xf8, 0x5b, 0x06, 0x9c, 0x4e, 0xc1, 0xfd, 0x58, 0x69, 0xf2, 0x6f, 0xc3, 0x44, 0xc9, 0x75,
-	0x9a, 0x85, 0x46, 0x23, 0x0a, 0xc5, 0x43, 0xbd, 0xb1, 0xc1, 0x24, 0xcd, 0x61, 0x50, 0x75, 0xdb,
-	0x8d, 0x50, 0xc9, 0x35, 0x21, 0x14, 0xf1, 0x9b, 0x3c, 0xf2, 0xe9, 0x57, 0xe0, 0x6d, 0x8a, 0x1f,
-	0x7e, 0xc5, 0xf4, 0x2d, 0x1c, 0x18, 0xbb, 0x1d, 0x3e, 0xb3, 0x43, 0x97, 0x9e, 0xbe, 0x25, 0xf9,
-	0x79, 0x43, 0x1d, 0x50, 0x7f, 0x21, 0x03, 0x67, 0xd3, 0x09, 0x3f, 0xee, 0x8b, 0x07, 0x98, 0xcd,
-	0x52, 0x79, 0x5d, 0x17, 0x5f, 0x3c, 0xe0, 0xa9, 0x2f, 0x11, 0x3f, 0x46, 0x20, 0x7b, 0x30, 0xbd,
-	0xea, 0x04, 0xe1, 0x0a, 0x75, 0xfc, 0x70, 0x97, 0x3a, 0xe1, 0x10, 0xba, 0xee, 0xcb, 0xe2, 0x6b,
-	0x16, 0x70, 0xfb, 0x3b, 0x90, 0x94, 0x09, 0x55, 0x50, 0x67, 0x1b, 0x09, 0xca, 0xc8, 0x10, 0x82,
-	0xf2, 0x2d, 0x98, 0xad, 0xd1, 0x96, 0xd3, 0x39, 0xf0, 0x7c, 0x2a, 0xac, 0xf5, 0xd7, 0x61, 0x3a,
-	0x02, 0xa5, 0x4a, 0x8b, 0x5e, 0xac, 0xe1, 0x2b, 0x1d, 0x11, 0x2f, 0x25, 0x7a, 0xb1, 0xf9, 0x57,
-	0x32, 0x70, 0xae, 0x50, 0x17, 0x37, 0xf2, 0xa2, 0x40, 0x3a, 0x0e, 0x7d, 0xc2, 0x75, 0x93, 0x1b,
-	0x30, 0xb1, 0xe6, 0x3c, 0x5a, 0xa5, 0x4e, 0x40, 0x03, 0x91, 0x6f, 0x9a, 0x2b, 0x6a, 0xce, 0xa3,
-	0xf8, 0xa2, 0xda, 0x8a, 0x71, 0xd4, 0x63, 0xe9, 0xc8, 0x13, 0x1e, 0x4b, 0x4d, 0x18, 0x5b, 0xf1,
-	0x9a, 0x0d, 0xb1, 0x8d, 0x89, 0x9b, 0x92, 0x03, 0x84, 0x58, 0xa2, 0xc4, 0xfc, 0x63, 0x03, 0x66,
-	0xa2, 0x16, 0x63, 0x13, 0x3e, 0xf1, 0x2e, 0xb9, 0x0c, 0xe3, 0x58, 0x51, 0xa5, 0xa4, 0x6e, 0x1a,
-	0x4d, 0x06, 0xb2, 0xdd, 0x86, 0x25, 0x0b, 0xd5, 0x9e, 0x18, 0x7d, 0xb2, 0x9e, 0x30, 0xff, 0x23,
-	0xbc, 0x84, 0x51, 0xbf, 0x92, 0xed, 0x44, 0x4a, 0x43, 0x8c, 0x21, 0x1b, 0x92, 0x79, 0x6a, 0x43,
-	0x92, 0xed, 0x3b, 0x24, 0xdf, 0xc9, 0xc0, 0x64, 0xd4, 0xd8, 0x4f, 0x59, 0xde, 0xb3, 0xe8, 0xbb,
-	0x86, 0x0a, 0xe5, 0xac, 0x29, 0x6b, 0x85, 0x88, 0x98, 0xfc, 0x22, 0x8c, 0x89, 0xc9, 0x64, 0x24,
-	0x1c, 0x68, 0x12, 0xa3, 0xbb, 0x3c, 0x23, 0x58, 0x8f, 0xe1, 0x80, 0x06, 0x96, 0xa0, 0xc3, 0x58,
-	0xd9, 0x1d, 0xba, 0x2b, 0xee, 0xe4, 0x9e, 0xd9, 0x3d, 0x2a, 0x3d, 0x56, 0x36, 0xfe, 0xb0, 0xa1,
-	0x76, 0xa7, 0xa3, 0x51, 0xc8, 0x27, 0x49, 0x8e, 0xcf, 0x2c, 0x57, 0xed, 0xee, 0x8a, 0xc7, 0xfc,
-	0x31, 0xb3, 0x5c, 0xa7, 0xbb, 0x6b, 0x31, 0x18, 0xb9, 0x0c, 0x23, 0x55, 0xdf, 0x7d, 0x80, 0x5f,
-	0x3d, 0xc5, 0x2f, 0x7e, 0x3b, 0xbe, 0xfb, 0x40, 0xbd, 0xf8, 0x65, 0xe5, 0x78, 0xf4, 0x5d, 0xad,
-	0x61, 0xfc, 0x11, 0xaa, 0xe0, 0xe2, 0xe8, 0xdb, 0x0c, 0x92, 0x09, 0x6f, 0x25, 0x1a, 0xdb, 0x2a,
-	0x97, 0xa9, 0xe3, 0x8b, 0x2c, 0x68, 0x62, 0x39, 0xc3, 0xad, 0x72, 0x17, 0xc1, 0xfc, 0xd5, 0x25,
-	0x4b, 0x45, 0x22, 0x4d, 0x20, 0xca, 0x4f, 0x39, 0x81, 0x8f, 0x3f, 0x0d, 0x5e, 0x94, 0x76, 0x3a,
-	0x95, 0xb5, 0xad, 0xce, 0xe6, 0x14, 0xbe, 0x4f, 0xd3, 0x9a, 0x58, 0x15, 0x39, 0x31, 0xd0, 0xe4,
-	0x91, 0x3b, 0x96, 0x99, 0x0c, 0xd0, 0x03, 0x9e, 0x33, 0x23, 0x32, 0x7c, 0xc4, 0x4c, 0xc8, 0x7b,
-	0x30, 0xa9, 0x46, 0x95, 0xf1, 0xd8, 0xa7, 0xe7, 0x79, 0x2e, 0x8a, 0x3e, 0x89, 0xff, 0x55, 0x02,
-	0xb2, 0x0b, 0xe7, 0x8a, 0x5e, 0x3b, 0xe8, 0xb6, 0x68, 0x43, 0xbb, 0x33, 0xae, 0x94, 0xf0, 0x28,
-	0x3a, 0xc1, 0x43, 0x54, 0xea, 0x02, 0x45, 0x04, 0x31, 0x49, 0xef, 0x44, 0xfd, 0x00, 0xd2, 0x8f,
-	0x11, 0xd9, 0x84, 0xc9, 0x5a, 0x61, 0x6d, 0x55, 0x46, 0x06, 0x4d, 0xea, 0xcb, 0x46, 0x5c, 0x52,
-	0x62, 0x13, 0x83, 0x07, 0xc7, 0x3b, 0xad, 0xa6, 0x74, 0x8e, 0x53, 0xed, 0x94, 0x0a, 0xb2, 0xf9,
-	0x19, 0x55, 0xbe, 0x85, 0xba, 0x31, 0x50, 0xbe, 0xcd, 0xff, 0x66, 0x0c, 0x66, 0x13, 0xd5, 0x89,
-	0xf3, 0x8f, 0xd1, 0x73, 0xfe, 0xa9, 0x01, 0x70, 0xa3, 0xd7, 0x90, 0xd6, 0x29, 0xe9, 0x57, 0x3d,
-	0x29, 0x82, 0x10, 0xa2, 0xb1, 0x52, 0xd8, 0x30, 0xa6, 0x5c, 0x12, 0x86, 0xb4, 0x4e, 0x46, 0x4c,
-	0xb9, 0x30, 0x29, 0x4c, 0x63, 0x36, 0x64, 0x11, 0x46, 0x31, 0x69, 0x89, 0xea, 0xd6, 0xee, 0x32,
-	0x80, 0xc5, 0xe1, 0xe4, 0x12, 0x8c, 0xb1, 0xcd, 0xb9, 0x52, 0x12, 0x93, 0x0b, 0xd7, 0x2c, 0xb6,
-	0x7b, 0xb3, 0x9d, 0x50, 0x14, 0x91, 0xdb, 0x30, 0xc5, 0xff, 0x12, 0xd1, 0x8d, 0x63, 0xba, 0x87,
-	0x87, 0xed, 0x36, 0x64, 0x80, 0xa3, 0x86, 0xc7, 0xb4, 0xd6, 0x5a, 0x77, 0x57, 0x3c, 0xf1, 0x38,
-	0x1e, 0x6b, 0xad, 0x01, 0x07, 0xe2, 0x3b, 0x5d, 0x11, 0x02, 0xdb, 0x23, 0x85, 0x73, 0x59, 0x0e,
-	0xcf, 0x2a, 0xb8, 0x47, 0x72, 0xa7, 0x32, 0x4b, 0x94, 0x90, 0xab, 0xdc, 0xfe, 0x8c, 0xea, 0x06,
-	0x4f, 0x1c, 0x8d, 0x16, 0x63, 0x3c, 0xf0, 0xa2, 0xce, 0x11, 0x15, 0xb3, 0xca, 0xd9, 0xdf, 0xe5,
-	0x96, 0xe3, 0x36, 0x85, 0xb8, 0x62, 0xe5, 0x88, 0x4b, 0x19, 0xd4, 0x8a, 0x11, 0xc8, 0x3b, 0x30,
-	0xc3, 0x7e, 0x14, 0xbd, 0x56, 0xcb, 0x6b, 0x23, 0xfb, 0xc9, 0x38, 0x0e, 0x1d, 0x49, 0xea, 0x58,
-	0xc4, 0x6b, 0x49, 0xe0, 0xb2, 0x75, 0x0a, 0x6f, 0xa3, 0xba, 0xdc, 0x32, 0x3e, 0x15, 0xaf, 0x53,
-	0x48, 0x1a, 0x70, 0xb8, 0xa5, 0x22, 0x91, 0xb7, 0x60, 0x9a, 0xfd, 0xbc, 0xeb, 0x3e, 0xa0, 0xbc,
-	0xc2, 0xe9, 0xf8, 0x62, 0x10, 0xa9, 0xf6, 0x59, 0x09, 0xaf, 0x4f, 0xc7, 0x24, 0x5f, 0x82, 0x33,
-	0xc8, 0xa9, 0xee, 0x75, 0x68, 0xa3, 0xb0, 0xb7, 0xe7, 0x36, 0x5d, 0x9c, 0xbd, 0x22, 0x8e, 0x0f,
-	0xad, 0x91, 0xbc, 0x62, 0xc4, 0xb0, 0x9d, 0x18, 0xc5, 0x4a, 0xa7, 0x24, 0x3b, 0x90, 0x2f, 0x76,
-	0x83, 0xd0, 0x6b, 0x15, 0xc2, 0xd0, 0x77, 0x77, 0xbb, 0x21, 0x0d, 0x16, 0x66, 0xb5, 0x68, 0x37,
-	0x36, 0x39, 0xa2, 0x42, 0x6e, 0x67, 0xa8, 0x23, 0x85, 0xed, 0x44, 0x24, 0x56, 0x0f, 0x13, 0xf3,
-	0xbf, 0x36, 0x60, 0x5a, 0x23, 0x25, 0x6f, 0xc2, 0xd4, 0x1d, 0xdf, 0xa5, 0xed, 0x46, 0xf3, 0x50,
-	0x39, 0x00, 0xa1, 0x76, 0xbc, 0x27, 0xe0, 0xfc, 0xab, 0x35, 0xb4, 0xc8, 0x7e, 0x90, 0x49, 0x75,
-	0x9d, 0xb9, 0xc1, 0xa3, 0x2b, 0x84, 0x80, 0x66, 0xe3, 0xf0, 0x5b, 0x14, 0x50, 0x21, 0x9d, 0x0a,
-	0x0a, 0x79, 0x17, 0xc6, 0xf8, 0xbd, 0x95, 0xf0, 0xe3, 0x38, 0x9f, 0xf6, 0x99, 0x3c, 0x92, 0x07,
-	0x05, 0x11, 0xaf, 0xcb, 0x03, 0x4b, 0x10, 0x99, 0xbf, 0x6c, 0x00, 0xe9, 0x45, 0x3d, 0xc6, 0x9e,
-	0x72, 0xec, 0x35, 0xfc, 0x17, 0xa3, 0xd9, 0x98, 0xd5, 0xac, 0x87, 0xac, 0x26, 0x5e, 0xc0, 0x3b,
-	0x5e, 0xcc, 0x3a, 0xd5, 0xc0, 0xc3, 0x8b, 0xcd, 0x9f, 0xca, 0x00, 0xc4, 0xd8, 0xe4, 0xf3, 0x3c,
-	0xb9, 0xee, 0x97, 0xba, 0x4e, 0xd3, 0xdd, 0x73, 0xf5, 0x34, 0x30, 0xc8, 0xe4, 0x5b, 0xb2, 0xc4,
-	0xd2, 0x11, 0xc9, 0xfb, 0x30, 0x5b, 0xab, 0xea, 0xb4, 0x4a, 0x22, 0xd1, 0xa0, 0x63, 0x27, 0xc8,
-	0x93, 0xd8, 0xe8, 0xaf, 0xa5, 0x8e, 0x06, 0xf7, 0xd7, 0xe2, 0x03, 0x21, 0x4a, 0xd8, 0xc2, 0x52,
-	0xab, 0xe2, 0xd3, 0x8a, 0x0d, 0xda, 0xa8, 0x94, 0xc4, 0x2a, 0x85, 0xad, 0x0b, 0x3a, 0x76, 0x87,
-	0x17, 0xe0, 0x7b, 0x7e, 0x1a, 0x5e, 0xdc, 0x91, 0xa3, 0x7d, 0xa2, 0x75, 0x7e, 0x15, 0xcd, 0x49,
-	0x2d, 0x2f, 0xa4, 0xe2, 0x14, 0xfd, 0xcc, 0xea, 0xd3, 0xf1, 0xa5, 0xe7, 0xa8, 0x16, 0x84, 0xa0,
-	0x7d, 0x1d, 0xc7, 0xd8, 0xbe, 0x15, 0x2b, 0xbf, 0xfc, 0xfa, 0x53, 0x5e, 0x7a, 0x2a, 0xaa, 0xdf,
-	0xdf, 0x32, 0xe0, 0x4c, 0x2a, 0x2d, 0xb9, 0x0e, 0x10, 0xdb, 0x2a, 0x44, 0x2f, 0xf1, 0x67, 0x15,
-	0x23, 0xa8, 0xa5, 0x60, 0x90, 0xaf, 0x25, 0xad, 0x0c, 0xc7, 0x6f, 0x84, 0x17, 0x64, 0x52, 0x01,
-	0xdd, 0xca, 0x90, 0x62, 0x5b, 0x30, 0x7f, 0x2b, 0x0b, 0x73, 0x4a, 0x4c, 0x2b, 0x6f, 0xeb, 0x31,
-	0xfe, 0x73, 0xf7, 0xe5, 0x13, 0x9e, 0xc2, 0x13, 0x3a, 0xa3, 0x3d, 0xe3, 0xdb, 0xc3, 0xed, 0xba,
-	0x8a, 0xcc, 0x33, 0x69, 0xe0, 0xd2, 0x29, 0x5e, 0xf4, 0xec, 0xf1, 0x88, 0xd6, 0x98, 0x93, 0x00,
-	0xa6, 0x4b, 0x87, 0x6d, 0xa7, 0x15, 0xd5, 0xc6, 0x2f, 0xea, 0x5f, 0xeb, 0x5b, 0x9b, 0x86, 0xcd,
-	0xab, 0x93, 0x3a, 0xe7, 0x42, 0x83, 0x97, 0xa5, 0xc4, 0xfa, 0x68, 0x54, 0x17, 0xde, 0x87, 0xb9,
-	0x9e, 0x46, 0x9f, 0x28, 0xa9, 0xc7, 0x0e, 0x90, 0xde, 0x76, 0xa4, 0x70, 0x78, 0x4d, 0x4f, 0x19,
-	0x73, 0x26, 0xba, 0xc6, 0x6b, 0xb5, 0x9c, 0x76, 0x83, 0x5f, 0xfb, 0x2f, 0xa9, 0x29, 0x3f, 0x7e,
-	0x35, 0xa3, 0xba, 0xf2, 0x3f, 0xeb, 0xb3, 0xee, 0x8b, 0xda, 0x29, 0xeb, 0xc5, 0x7e, 0x63, 0x3a,
-	0xd4, 0x69, 0xf6, 0x07, 0x59, 0x38, 0xd7, 0x87, 0x92, 0x1c, 0x26, 0x85, 0x88, 0x9f, 0x6e, 0x6f,
-	0x0e, 0xae, 0xf0, 0x69, 0x88, 0x12, 0xf9, 0x3c, 0x0f, 0xe6, 0xab, 0xe3, 0x6b, 0x3d, 0xe2, 0x5c,
-	0xc7, 0x9f, 0x44, 0x8b, 0xa0, 0xc9, 0x28, 0x3e, 0x0e, 0x25, 0xef, 0xc3, 0x28, 0xc6, 0x71, 0x24,
-	0x72, 0x6a, 0x30, 0x0c, 0x84, 0x2b, 0x09, 0x48, 0xd8, 0x4f, 0x2d, 0x01, 0x09, 0xbe, 0x51, 0xfd,
-	0x39, 0xc8, 0x16, 0x76, 0x6a, 0x62, 0x5c, 0x66, 0x54, 0xf2, 0x9d, 0x5a, 0x9c, 0x4b, 0xd1, 0xd1,
-	0x92, 0x1e, 0x32, 0x0a, 0x46, 0x78, 0xb7, 0x58, 0x15, 0xa3, 0xa2, 0x12, 0xde, 0x2d, 0x56, 0x63,
-	0xc2, 0xfd, 0xba, 0x16, 0xad, 0x7c, 0xb7, 0x58, 0xfd, 0xe4, 0xc4, 0xfe, 0xe7, 0x32, 0x3c, 0x02,
-	0x91, 0x7f, 0xd8, 0xfb, 0x30, 0xa5, 0xa5, 0xf4, 0x32, 0x62, 0x7d, 0x2c, 0x4a, 0x47, 0x96, 0xf0,
-	0x93, 0xd0, 0x08, 0x64, 0x56, 0xd2, 0xe8, 0xb5, 0x6b, 0xd5, 0xcd, 0x41, 0x7f, 0x21, 0x3b, 0x99,
-	0x95, 0x34, 0x22, 0x21, 0xb7, 0x20, 0xb7, 0x49, 0xdb, 0x4e, 0x3b, 0x8c, 0x0c, 0x6d, 0xe8, 0x96,
-	0x17, 0x22, 0x4c, 0xd7, 0x1a, 0x22, 0x44, 0x7c, 0x9b, 0x5c, 0x79, 0xab, 0x3b, 0xda, 0x8b, 0xb9,
-	0xb3, 0xa8, 0x52, 0x92, 0x78, 0xdc, 0x5d, 0x27, 0x32, 0x7f, 0xd5, 0x80, 0x71, 0x31, 0x90, 0xca,
-	0x03, 0xb1, 0xc6, 0x10, 0x0f, 0xc4, 0xde, 0x86, 0x09, 0x11, 0x4c, 0xa3, 0x3f, 0xeb, 0x2e, 0xe2,
-	0x6f, 0x12, 0xcf, 0xba, 0x47, 0xa8, 0x43, 0x7b, 0x9d, 0xff, 0x75, 0xd1, 0xb2, 0xbb, 0xc5, 0x2a,
-	0x59, 0x82, 0x9c, 0x7c, 0x67, 0x5b, 0xb4, 0x0d, 0x97, 0x1d, 0xf9, 0x20, 0xb7, 0xda, 0x41, 0x12,
-	0x4f, 0x7f, 0xae, 0x3e, 0x33, 0xfc, 0x73, 0xf5, 0xc3, 0xb6, 0x8f, 0xa6, 0x2c, 0x12, 0xdb, 0xb7,
-	0x56, 0xdd, 0x20, 0x24, 0x1f, 0xa8, 0xde, 0xfc, 0xa2, 0x48, 0xae, 0x14, 0x17, 0xfa, 0xad, 0x14,
-	0xdb, 0xb7, 0xac, 0x14, 0x2a, 0xbc, 0xaf, 0x89, 0xc1, 0x35, 0xea, 0x3f, 0x78, 0x86, 0x57, 0xe9,
-	0xf4, 0xfb, 0x9a, 0xe4, 0xe7, 0x0d, 0xb5, 0x48, 0xff, 0xab, 0x0c, 0x9c, 0x4d, 0x27, 0x54, 0xbf,
-	0xc5, 0x18, 0xf0, 0x2d, 0x57, 0x20, 0xb7, 0xe2, 0x05, 0xa1, 0xe2, 0x1a, 0x85, 0x66, 0xe5, 0x03,
-	0x01, 0xb3, 0xa2, 0x52, 0x76, 0xe6, 0x66, 0x7f, 0x47, 0xd3, 0x13, 0xf9, 0x61, 0xdc, 0x1d, 0x3b,
-	0x73, 0xf3, 0x22, 0x72, 0x17, 0x72, 0x96, 0x70, 0x3c, 0x4f, 0x74, 0x8d, 0x04, 0x47, 0xda, 0x14,
-	0xf1, 0x05, 0x44, 0xcb, 0xac, 0x26, 0x60, 0xa4, 0x00, 0xe3, 0x62, 0xf4, 0x13, 0x57, 0x92, 0x29,
-	0x22, 0xa3, 0x27, 0x3b, 0x94, 0x74, 0x6c, 0x45, 0xc1, 0xcb, 0xa5, 0x4a, 0x49, 0xfa, 0x90, 0xe3,
-	0x8a, 0xc2, 0x2f, 0x9f, 0xf4, 0xf4, 0x8a, 0x11, 0xa2, 0xf9, 0xd3, 0x19, 0x80, 0x1d, 0xba, 0xfb,
-	0x6c, 0xbf, 0xe2, 0xf1, 0x39, 0x4d, 0xc2, 0x14, 0xcf, 0x8b, 0xe1, 0x1f, 0xf1, 0xd8, 0x40, 0x0f,
-	0x88, 0xe1, 0x9f, 0xf0, 0x58, 0x84, 0x51, 0x6e, 0xed, 0x54, 0x0e, 0x89, 0xdc, 0xcc, 0xc9, 0xe1,
-	0xe6, 0x2e, 0xcc, 0xdf, 0xa5, 0x61, 0x6c, 0xde, 0x92, 0x57, 0x5a, 0x83, 0xd9, 0xbe, 0x0e, 0x13,
-	0x02, 0x5f, 0x7f, 0x33, 0x5d, 0x86, 0xb2, 0xa2, 0x2d, 0x46, 0x22, 0xb0, 0xd5, 0xa8, 0x44, 0x9b,
-	0x34, 0xa4, 0x9f, 0x6c, 0x35, 0x35, 0x20, 0xfc, 0x53, 0xf0, 0xcb, 0x86, 0xab, 0xe1, 0xd8, 0xfe,
-	0xd9, 0x86, 0x33, 0x51, 0xdb, 0x9f, 0x26, 0xdf, 0x1b, 0xec, 0x48, 0x29, 0xf2, 0x04, 0xc6, 0x1c,
-	0x07, 0xf8, 0x34, 0x3c, 0x82, 0x0b, 0x92, 0x60, 0xc7, 0x8d, 0x5c, 0xc8, 0x86, 0xa2, 0x25, 0xef,
-	0xc0, 0xa4, 0x42, 0x23, 0x32, 0xb1, 0xa2, 0xf9, 0xf3, 0xa1, 0x1b, 0x1e, 0xd8, 0x01, 0x87, 0xab,
-	0xe6, 0x4f, 0x05, 0xdd, 0xfc, 0x2a, 0x3c, 0x17, 0x39, 0xdc, 0xa7, 0x54, 0x9d, 0x60, 0x6e, 0x9c,
-	0x8c, 0xf9, 0x7a, 0xfc, 0x59, 0x95, 0x76, 0x14, 0xfe, 0x25, 0x79, 0x13, 0xf5, 0xb3, 0xc4, 0xc7,
-	0x3c, 0xdf, 0x13, 0x50, 0xa6, 0xc4, 0x8d, 0x99, 0x6f, 0x2b, 0x8d, 0x4d, 0x61, 0xa8, 0x11, 0x1b,
-	0x49, 0xe2, 0x9f, 0xce, 0xc0, 0xec, 0x46, 0xa5, 0x54, 0x8c, 0xbc, 0x5a, 0x3e, 0x65, 0x4f, 0x8c,
-	0x68, 0xdf, 0xd6, 0x7f, 0xbd, 0x31, 0xb7, 0xe0, 0x74, 0xa2, 0x1b, 0x50, 0x75, 0x78, 0x8f, 0x3b,
-	0xc6, 0x47, 0x60, 0xa9, 0x36, 0x9c, 0x4d, 0x63, 0xbf, 0x7d, 0xcb, 0x4a, 0x60, 0x9b, 0x7f, 0x2f,
-	0x97, 0xe0, 0x2b, 0x96, 0xb0, 0xd7, 0x61, 0xa2, 0x12, 0x04, 0x5d, 0xea, 0x6f, 0x59, 0xab, 0xaa,
-	0xa9, 0xc0, 0x45, 0xa0, 0xdd, 0xf5, 0x9b, 0x56, 0x8c, 0x40, 0xae, 0x42, 0x4e, 0xe4, 0xa6, 0x93,
-	0x6b, 0x02, 0x5a, 0x6d, 0xa3, 0xd4, 0x76, 0x56, 0x54, 0x4c, 0xde, 0x84, 0x29, 0xfe, 0x37, 0x97,
-	0x36, 0xd1, 0xe1, 0x68, 0x1c, 0x14, 0xe8, 0x5c, 0x3a, 0x2d, 0x0d, 0x8d, 0x5c, 0x83, 0x6c, 0xa1,
-	0x68, 0xa9, 0x4f, 0x25, 0x3b, 0x75, 0x9f, 0x3f, 0x99, 0xae, 0x1f, 0x22, 0x8a, 0x16, 0xd3, 0xfe,
-	0x84, 0x29, 0xc9, 0x17, 0x96, 0x6c, 0x94, 0x00, 0x69, 0x6d, 0x4a, 0x6c, 0x66, 0x08, 0x23, 0x37,
-	0x60, 0xbc, 0xe4, 0x06, 0x9d, 0xa6, 0x73, 0x28, 0xec, 0xd8, 0x3c, 0xf1, 0x38, 0x07, 0xa9, 0x32,
-	0x23, 0xb0, 0xc8, 0x55, 0x18, 0x45, 0x23, 0xab, 0xb0, 0x65, 0xf3, 0xf4, 0xdc, 0x0c, 0xa0, 0xa5,
-	0xe7, 0x66, 0x00, 0x4c, 0x7d, 0xca, 0x33, 0xb8, 0x4d, 0x28, 0xa9, 0x4f, 0x93, 0x99, 0xdb, 0x04,
-	0x4e, 0x6f, 0x24, 0x15, 0x3c, 0xcd, 0x48, 0xaa, 0x5d, 0x38, 0x77, 0x17, 0xad, 0x37, 0x7a, 0x7c,
-	0xfb, 0x96, 0x55, 0x11, 0xf6, 0x70, 0xbc, 0xf1, 0xe1, 0x06, 0x9e, 0x64, 0x88, 0xbc, 0xdd, 0xf5,
-	0xd5, 0x77, 0x34, 0xfa, 0x31, 0x22, 0x5f, 0x86, 0xf9, 0xb4, 0x22, 0x61, 0x35, 0xc7, 0x48, 0xee,
-	0xf4, 0x0a, 0xd4, 0x48, 0xee, 0x34, 0x0e, 0x64, 0x15, 0xf2, 0x1c, 0x5e, 0x68, 0xb4, 0xdc, 0x36,
-	0xb7, 0xfc, 0x4f, 0xc7, 0xcf, 0x54, 0x0a, 0xae, 0x0e, 0x2b, 0xe4, 0x37, 0x00, 0x5a, 0x88, 0x44,
-	0x82, 0x92, 0xfc, 0xa2, 0xc1, 0x4e, 0x73, 0x3c, 0xdf, 0xd9, 0x96, 0xb5, 0x1a, 0x88, 0x2c, 0x20,
-	0x67, 0xe3, 0xe8, 0x87, 0x5a, 0xe8, 0xbb, 0xed, 0x7d, 0x11, 0xfe, 0xb0, 0x29, 0xc2, 0x1f, 0xde,
-	0xf9, 0x58, 0xe1, 0x0f, 0x9c, 0x55, 0xf0, 0xf8, 0x68, 0x71, 0xca, 0x17, 0x75, 0xe2, 0x2c, 0xd2,
-	0x5a, 0x80, 0x0f, 0xe9, 0x35, 0x9b, 0xde, 0xc3, 0xad, 0xf6, 0x03, 0xea, 0xbb, 0x7b, 0x2e, 0x6d,
-	0xf0, 0x8f, 0x9c, 0xc5, 0x15, 0x9c, 0x3f, 0xa4, 0x87, 0x6f, 0x1f, 0x76, 0x23, 0x84, 0x9e, 0x0f,
-	0x4d, 0xe5, 0xc0, 0x0e, 0x9e, 0xd2, 0x61, 0x9f, 0xc7, 0xb1, 0xe5, 0xe3, 0x83, 0xa7, 0xf4, 0xee,
-	0xb7, 0x51, 0x8c, 0x54, 0xe1, 0xd1, 0x48, 0x84, 0x77, 0xf0, 0xaf, 0x4c, 0xf0, 0x15, 0xb9, 0xd0,
-	0x0d, 0x0f, 0xe4, 0x1a, 0xbe, 0x94, 0x16, 0x74, 0xc0, 0x5d, 0x9e, 0x94, 0xa0, 0x03, 0x3d, 0xd4,
-	0x40, 0x9a, 0xd2, 0x33, 0xa9, 0xa6, 0xf4, 0xd7, 0x61, 0x02, 0x5f, 0xf6, 0x8d, 0xbc, 0xbb, 0x73,
-	0xc2, 0x56, 0xc9, 0x80, 0x3c, 0xc5, 0x57, 0x8c, 0x40, 0x6e, 0x00, 0x60, 0x2a, 0x7c, 0xbe, 0xc1,
-	0x2b, 0xc9, 0x39, 0x31, 0x63, 0xbe, 0xb8, 0x45, 0x56, 0x50, 0x90, 0x7d, 0xcd, 0xba, 0xa3, 0x5e,
-	0x3b, 0x73, 0xf6, 0x81, 0xbf, 0x27, 0xd0, 0x63, 0x04, 0xf6, 0x79, 0xca, 0x30, 0x89, 0x45, 0x25,
-	0xdf, 0x33, 0x96, 0x2a, 0x12, 0x7a, 0x74, 0x49, 0x57, 0x56, 0x5c, 0x53, 0xa6, 0x84, 0x47, 0x57,
-	0xe4, 0xf6, 0x6a, 0xc5, 0x08, 0xe4, 0x73, 0x30, 0x5e, 0xa4, 0x7e, 0xb8, 0xb9, 0xb9, 0x8a, 0x37,
-	0xc3, 0x3c, 0x83, 0x65, 0x0e, 0xb3, 0x0d, 0x86, 0x61, 0xf3, 0x87, 0x47, 0x8b, 0xd3, 0xa1, 0xdb,
-	0xa2, 0xd7, 0xa3, 0x6b, 0x5c, 0x89, 0x4d, 0x96, 0x21, 0xcf, 0xef, 0x18, 0x63, 0x45, 0x0e, 0x97,
-	0x99, 0x1c, 0x5f, 0xf4, 0xc4, 0x85, 0xe4, 0x43, 0xba, 0x1b, 0xe5, 0x5a, 0xec, 0xc1, 0x27, 0x65,
-	0x99, 0xa2, 0x54, 0xfd, 0x48, 0x88, 0x2d, 0x0b, 0x62, 0x61, 0xd6, 0xbe, 0xb5, 0x97, 0x82, 0x14,
-	0x60, 0xba, 0xe8, 0xb5, 0x3a, 0x4e, 0xe8, 0x62, 0x8e, 0xfa, 0x43, 0xb1, 0xa2, 0xa0, 0x75, 0xa4,
-	0xae, 0x16, 0xe8, 0x0f, 0xf5, 0x2a, 0x05, 0xe4, 0x0e, 0xcc, 0x58, 0x5e, 0x97, 0x0d, 0x92, 0x3c,
-	0xd2, 0xf0, 0x45, 0x23, 0x7a, 0x02, 0x9e, 0x8d, 0xa5, 0x2d, 0xce, 0x2f, 0x5a, 0x76, 0x1c, 0x8d,
-	0x8a, 0xac, 0xa7, 0xd8, 0x96, 0xd5, 0x95, 0x42, 0xcd, 0xb8, 0xd8, 0xc3, 0x2c, 0xc5, 0x2c, 0x7d,
-	0x0b, 0x26, 0x6b, 0xb5, 0x8d, 0x4d, 0x1a, 0x84, 0x77, 0x9a, 0xde, 0x43, 0x5c, 0x28, 0x72, 0x22,
-	0xd1, 0x73, 0xe0, 0xd9, 0x21, 0x0d, 0x42, 0x7b, 0xaf, 0xe9, 0x3d, 0xb4, 0x54, 0x2c, 0xf2, 0x0d,
-	0xe5, 0xe5, 0x62, 0xdc, 0xf9, 0x67, 0x8f, 0xdd, 0xf9, 0x13, 0xaf, 0x1a, 0xb3, 0xfd, 0x3f, 0xf5,
-	0x55, 0x63, 0x86, 0x8e, 0xa1, 0x0a, 0xec, 0x30, 0x56, 0x68, 0x34, 0x7c, 0x1a, 0x04, 0x62, 0x46,
-	0x2b, 0xef, 0xb2, 0x3b, 0xbc, 0x40, 0x0b, 0x55, 0x50, 0x08, 0xc8, 0x77, 0x0c, 0x38, 0xa3, 0x7a,
-	0x3b, 0xe3, 0x64, 0x69, 0xd1, 0x76, 0xb8, 0x30, 0x87, 0x2d, 0x7d, 0xe3, 0xba, 0x5c, 0xd1, 0xae,
-	0x2b, 0x68, 0xd7, 0x1f, 0xdc, 0xbc, 0xae, 0xbc, 0xd5, 0x59, 0x93, 0x44, 0x22, 0x95, 0x46, 0x1a,
-	0x3f, 0x75, 0x75, 0x72, 0x52, 0x48, 0x49, 0x91, 0x6d, 0x7a, 0x4c, 0x9e, 0xd0, 0xb7, 0xa1, 0x52,
-	0xc5, 0x6c, 0x41, 0xc2, 0x38, 0x25, 0xa4, 0x8f, 0x7b, 0x41, 0xb8, 0x1d, 0x7d, 0x6f, 0x53, 0x68,
-	0x50, 0x55, 0xac, 0x15, 0xd6, 0x56, 0x63, 0x7d, 0xe7, 0xd3, 0xe5, 0x62, 0xac, 0x7d, 0xdb, 0x00,
-	0x17, 0xe3, 0x2d, 0x38, 0x9d, 0xe8, 0x06, 0xa9, 0x2a, 0x6a, 0xe0, 0xa4, 0xaa, 0x98, 0xa0, 0xb1,
-	0x12, 0xd8, 0xe6, 0xdf, 0x1d, 0x4f, 0xf0, 0x15, 0x6e, 0x45, 0x26, 0x8c, 0x71, 0x4d, 0x50, 0x7d,
-	0x18, 0x8e, 0xeb, 0x89, 0x96, 0x28, 0x21, 0xe7, 0x21, 0x5b, 0xab, 0x6d, 0xa8, 0xcf, 0x56, 0x06,
-	0x81, 0x67, 0x31, 0x18, 0x1b, 0x21, 0xf4, 0x18, 0x52, 0xd2, 0xf6, 0xb1, 0x65, 0xcf, 0x42, 0x28,
-	0xeb, 0x6f, 0xa9, 0x97, 0x8d, 0xc4, 0xfd, 0x2d, 0xf4, 0xb2, 0x58, 0x1b, 0x2b, 0xc2, 0x42, 0x21,
-	0x08, 0xa8, 0xcf, 0x9f, 0xf4, 0x47, 0x47, 0x14, 0x5f, 0xe8, 0x0e, 0x62, 0x75, 0xc7, 0x4a, 0x9d,
-	0x7a, 0x60, 0xf5, 0x45, 0x24, 0x57, 0x20, 0x57, 0xe8, 0x36, 0x5c, 0xda, 0xae, 0x6b, 0xa9, 0x1f,
-	0x1c, 0x01, 0xb3, 0xa2, 0x52, 0xf2, 0x25, 0x38, 0x23, 0x88, 0xa4, 0x02, 0x29, 0x7a, 0x60, 0x3c,
-	0x9e, 0x82, 0x52, 0xb7, 0x89, 0x2f, 0x39, 0x79, 0x97, 0xa4, 0x53, 0x92, 0x02, 0xe4, 0xcb, 0xe8,
-	0x52, 0x5f, 0xa2, 0xdc, 0xde, 0xea, 0xf9, 0xe2, 0x05, 0x6e, 0xd4, 0x44, 0xb9, 0xbb, 0xbd, 0xdd,
-	0x88, 0x0a, 0xad, 0x1e, 0x74, 0x72, 0x0f, 0x4e, 0x27, 0x61, 0x6c, 0x21, 0xe7, 0x4a, 0x27, 0xe6,
-	0x8d, 0xea, 0xe1, 0x82, 0x4b, 0x79, 0x1a, 0x15, 0xd9, 0x85, 0xb9, 0xf8, 0x92, 0x5f, 0x57, 0x45,
-	0xa5, 0x4f, 0x5a, 0x54, 0x2e, 0xd5, 0xd1, 0xe7, 0x84, 0x30, 0x9e, 0x8e, 0x1d, 0x06, 0x22, 0x95,
-	0xd4, 0xea, 0x65, 0x47, 0x1a, 0x30, 0x53, 0x73, 0xf7, 0xdb, 0x6e, 0x7b, 0xff, 0x1e, 0x3d, 0xac,
-	0x3a, 0xae, 0x2f, 0xbc, 0x83, 0xa4, 0xef, 0x5f, 0x21, 0x38, 0x6c, 0xb5, 0x68, 0xe8, 0xe3, 0x16,
-	0xc9, 0xca, 0x31, 0xa2, 0xce, 0x60, 0x7b, 0x41, 0xc0, 0xe9, 0x30, 0x7a, 0xa4, 0xe3, 0xb8, 0xda,
-	0x5e, 0xa0, 0xf3, 0xd4, 0x8e, 0x03, 0x53, 0x43, 0x1e, 0x07, 0x9a, 0x30, 0x57, 0x6e, 0xd7, 0xfd,
-	0x43, 0x34, 0x7b, 0xcb, 0xc6, 0x4d, 0x1f, 0xd3, 0xb8, 0x97, 0x45, 0xe3, 0x9e, 0x77, 0xa4, 0x84,
-	0xa5, 0x35, 0xaf, 0x97, 0x31, 0xa9, 0x89, 0xe7, 0xc6, 0x2b, 0xa5, 0x6a, 0xa5, 0xed, 0x86, 0x2e,
-	0x3e, 0xd1, 0xc6, 0xf7, 0x98, 0x57, 0x04, 0xcf, 0x17, 0xb8, 0xda, 0xe7, 0x36, 0x3a, 0xb6, 0x2b,
-	0x51, 0x7a, 0xde, 0x13, 0x57, 0xe9, 0xcd, 0xff, 0x34, 0xc7, 0x57, 0x43, 0x55, 0x4d, 0xeb, 0xe7,
-	0xef, 0x94, 0x50, 0xdf, 0x32, 0x27, 0x51, 0xdf, 0xb2, 0xc7, 0xab, 0x6f, 0x23, 0xc7, 0xa9, 0x6f,
-	0x09, 0xfd, 0x6a, 0xf4, 0xc4, 0xfa, 0xd5, 0xd8, 0x09, 0xf4, 0xab, 0xf1, 0x13, 0xe9, 0x57, 0x9a,
-	0xa2, 0x98, 0x3b, 0x4e, 0x51, 0xfc, 0xff, 0xb4, 0xb1, 0x67, 0x55, 0x1b, 0x4b, 0xdb, 0x5c, 0x4f,
-	0xa4, 0x8d, 0xf5, 0x57, 0xa6, 0xf2, 0x7f, 0xd6, 0xca, 0xd4, 0xdc, 0xc7, 0x50, 0xa6, 0x7e, 0x14,
-	0xf2, 0xc9, 0xf5, 0xfd, 0xf8, 0xe4, 0x46, 0x4f, 0x2d, 0x07, 0x09, 0xdb, 0x7d, 0x92, 0xeb, 0x2b,
-	0x3b, 0xe4, 0x55, 0x7d, 0xf7, 0x81, 0x13, 0xd2, 0xf8, 0x69, 0x64, 0x3c, 0xe4, 0x75, 0x38, 0x14,
-	0xe7, 0xbc, 0x82, 0x12, 0xa9, 0x16, 0x99, 0x34, 0xd5, 0xc2, 0xfc, 0x99, 0x0c, 0xcc, 0xf1, 0xb4,
-	0x09, 0xcf, 0xbe, 0x6d, 0xf1, 0x3d, 0x4d, 0x61, 0x94, 0x2e, 0x44, 0x89, 0xaf, 0x1b, 0x60, 0x5d,
-	0xfc, 0x3a, 0x9c, 0xe9, 0xe9, 0x0a, 0x54, 0x1a, 0x4b, 0x32, 0x61, 0x45, 0x8f, 0xda, 0xb8, 0x90,
-	0x5e, 0xc9, 0xf6, 0x2d, 0xab, 0x87, 0xc2, 0xfc, 0xb7, 0xd9, 0x1e, 0xfe, 0xc2, 0xce, 0xa8, 0x5a,
-	0x0e, 0x8d, 0x93, 0x59, 0x0e, 0x33, 0xc3, 0x59, 0x0e, 0x13, 0x7b, 0x4b, 0x76, 0x98, 0xbd, 0xe5,
-	0x4b, 0x30, 0xbd, 0x49, 0x9d, 0x56, 0xb0, 0xe9, 0x89, 0xb4, 0xa8, 0xdc, 0x85, 0x50, 0xe6, 0xa3,
-	0x60, 0x65, 0x52, 0xe7, 0x89, 0x5c, 0x21, 0x42, 0x46, 0xc0, 0xd6, 0x43, 0x9e, 0x27, 0xd5, 0xd2,
-	0x39, 0xa8, 0x8a, 0xec, 0xe8, 0x00, 0x45, 0xb6, 0x06, 0x53, 0x82, 0x2e, 0xce, 0xe8, 0x14, 0x6b,
-	0x5c, 0xac, 0x08, 0xe1, 0xb2, 0xf6, 0xe8, 0x11, 0x97, 0xa8, 0x76, 0xae, 0x6c, 0x69, 0x4c, 0x58,
-	0x17, 0x94, 0xdb, 0x8d, 0x8e, 0xe7, 0xb6, 0xb1, 0x0b, 0xc6, 0xe3, 0x2e, 0xa0, 0x02, 0xcc, 0xbb,
-	0x40, 0x41, 0x22, 0xef, 0xc0, 0x4c, 0xa1, 0x5a, 0x51, 0xc9, 0x72, 0xb1, 0xf1, 0xd2, 0xe9, 0xb8,
-	0xb6, 0x46, 0x9a, 0xc0, 0x35, 0x7f, 0x62, 0x42, 0xce, 0xad, 0x4f, 0xd6, 0x4a, 0xa4, 0xdb, 0x7d,
-	0xb2, 0x27, 0xb4, 0xfb, 0x8c, 0x1c, 0xb7, 0x9d, 0x6b, 0x3a, 0xc6, 0xe8, 0x09, 0x74, 0x8c, 0xb1,
-	0x27, 0xb6, 0xe1, 0x8c, 0x9f, 0x50, 0x6b, 0x48, 0x88, 0x79, 0x6e, 0x18, 0x31, 0x4f, 0xd5, 0x34,
-	0x26, 0x9e, 0x5c, 0xd3, 0x80, 0x13, 0x6b, 0x1a, 0xca, 0x2b, 0xc2, 0x93, 0x43, 0xbd, 0x22, 0x6c,
-	0x0c, 0xf1, 0x8a, 0xf0, 0xa7, 0x4a, 0x7d, 0xf9, 0x66, 0xba, 0xfa, 0x32, 0x78, 0xa9, 0xff, 0x7f,
-	0xb3, 0x02, 0xe3, 0x63, 0x2f, 0xef, 0x38, 0x3e, 0x3b, 0x0b, 0x06, 0xe4, 0x06, 0x8c, 0xcb, 0xcc,
-	0x32, 0x46, 0x7c, 0xac, 0xee, 0x4d, 0x29, 0x23, 0xb1, 0xd8, 0xb1, 0x51, 0x12, 0x8b, 0xd8, 0x6a,
-	0x9e, 0x44, 0x43, 0xc0, 0xb4, 0x24, 0x1a, 0x02, 0x66, 0xfe, 0xed, 0x11, 0x39, 0x93, 0xd9, 0xb1,
-	0x46, 0x3c, 0x58, 0xb7, 0xac, 0x8c, 0x9c, 0xa2, 0x3e, 0x25, 0xc6, 0x26, 0xe1, 0x33, 0xa4, 0x93,
-	0x7c, 0x9c, 0xb4, 0x3c, 0xca, 0xeb, 0x05, 0xd9, 0x21, 0x5e, 0x2f, 0x78, 0x4b, 0x4b, 0xfd, 0x3f,
-	0x12, 0xe7, 0x9a, 0x66, 0xd2, 0x3d, 0x38, 0xe9, 0xff, 0x6d, 0x35, 0x47, 0xff, 0x68, 0x1c, 0x86,
-	0x8e, 0x94, 0x03, 0xb2, 0xf3, 0x47, 0xfa, 0xe0, 0xd8, 0x49, 0x52, 0x54, 0x8d, 0xff, 0x99, 0xa6,
-	0xa8, 0x2a, 0x03, 0x28, 0xaf, 0x98, 0x71, 0x53, 0xfd, 0x2b, 0xac, 0x9b, 0x8e, 0x7f, 0xc1, 0x4c,
-	0x21, 0x34, 0xff, 0x39, 0x81, 0xb9, 0x5a, 0x6d, 0xa3, 0xe4, 0x3a, 0xfb, 0x6d, 0x2f, 0x08, 0xdd,
-	0x7a, 0xa5, 0xbd, 0xe7, 0x31, 0x65, 0x28, 0x5a, 0x15, 0x94, 0x74, 0x49, 0xf1, 0x8a, 0x10, 0x15,
-	0x33, 0x65, 0xbb, 0xec, 0xfb, 0x9e, 0xaf, 0x2a, 0xdb, 0x94, 0x01, 0x2c, 0x0e, 0x67, 0xfa, 0x46,
-	0xad, 0xcb, 0x9f, 0xa3, 0xe2, 0xb7, 0x27, 0xa8, 0x6f, 0x04, 0x1c, 0x64, 0xc9, 0x32, 0x42, 0x7b,
-	0x05, 0x56, 0xe8, 0x9f, 0xe7, 0xb4, 0x44, 0x57, 0x71, 0x31, 0x5f, 0xf3, 0xc4, 0x9e, 0x84, 0x41,
-	0x28, 0x1d, 0x84, 0xab, 0x57, 0x6d, 0x3d, 0x73, 0xe0, 0x10, 0xce, 0x68, 0xc1, 0x14, 0xc3, 0x5a,
-	0x94, 0xae, 0x09, 0xfd, 0xc6, 0xc4, 0x98, 0xb0, 0x14, 0xb3, 0x92, 0x9a, 0x2b, 0x37, 0xb5, 0x06,
-	0xf2, 0x33, 0x06, 0xbc, 0x90, 0x5a, 0x12, 0xcd, 0xee, 0x49, 0x2d, 0xd9, 0x98, 0xb2, 0x68, 0xf0,
-	0xac, 0xc0, 0xfd, 0xaa, 0xb6, 0x53, 0x96, 0x82, 0xc1, 0x35, 0x91, 0x7f, 0x6c, 0xc0, 0x39, 0x0d,
-	0x23, 0x5a, 0xf3, 0x02, 0xdc, 0x9b, 0xfa, 0xca, 0xf5, 0x47, 0x4f, 0x47, 0xae, 0x2f, 0xe9, 0xdf,
-	0x12, 0x2f, 0xc9, 0xea, 0x37, 0xf4, 0x6b, 0x21, 0x79, 0x00, 0x73, 0x58, 0x24, 0xad, 0x5b, 0x4c,
-	0x66, 0x85, 0x51, 0x6c, 0x3e, 0x6e, 0x36, 0x0f, 0x10, 0xc2, 0x97, 0x5d, 0x96, 0x7e, 0x70, 0xb4,
-	0x38, 0xad, 0xa1, 0x63, 0x9e, 0x53, 0x6c, 0x43, 0x64, 0x22, 0x73, 0xdb, 0x7b, 0x9e, 0xf6, 0x58,
-	0x7c, 0xb2, 0x0a, 0xf2, 0x9f, 0x1b, 0xb0, 0xc0, 0xa0, 0xfc, 0x33, 0xee, 0xf8, 0x5e, 0x2b, 0x2a,
-	0x97, 0x77, 0xb6, 0x7d, 0xba, 0xad, 0xf9, 0x74, 0xba, 0xed, 0x15, 0x6c, 0x32, 0x5f, 0x13, 0xec,
-	0x3d, 0xdf, 0x6b, 0xc5, 0xcd, 0xd7, 0x5e, 0xe9, 0xea, 0xd7, 0x48, 0xf2, 0x93, 0x06, 0x9c, 0xd7,
-	0x0c, 0x0c, 0x6a, 0x76, 0x4f, 0x11, 0x86, 0x25, 0x2f, 0xf8, 0xd5, 0xa2, 0xe5, 0xeb, 0x42, 0xfe,
-	0x2f, 0x63, 0x0b, 0xe2, 0xdd, 0x02, 0xdb, 0x62, 0xb7, 0x38, 0x96, 0xd2, 0x84, 0xfe, 0xb5, 0x10,
-	0x17, 0xe6, 0xf0, 0xc6, 0x49, 0xf3, 0x2d, 0x98, 0xef, 0xef, 0x5b, 0x10, 0x65, 0xe0, 0xc7, 0x0c,
-	0x8a, 0xfd, 0x1d, 0x0c, 0x7a, 0xb9, 0x92, 0x1f, 0x83, 0xf3, 0x3d, 0xc0, 0x68, 0xb6, 0x9d, 0xe9,
-	0x3b, 0xdb, 0x5e, 0x7b, 0x7c, 0xb4, 0xf8, 0x6a, 0x5a, 0x6d, 0x69, 0x33, 0xad, 0x7f, 0x0d, 0xc4,
-	0x01, 0x88, 0x0b, 0xc5, 0xb3, 0x5f, 0xe9, 0x02, 0xfa, 0x9a, 0x90, 0x0f, 0x05, 0x9f, 0xad, 0xe5,
-	0x4a, 0x1b, 0xd4, 0x2d, 0x2f, 0x46, 0x22, 0x14, 0xa6, 0x94, 0xec, 0x91, 0x87, 0xf8, 0xfe, 0x57,
-	0xdf, 0x4a, 0x7e, 0x70, 0xb4, 0xa8, 0x61, 0x33, 0xbd, 0x58, 0x4d, 0x4b, 0xa9, 0xea, 0xc5, 0x1a,
-	0x22, 0xf9, 0x07, 0x06, 0xcc, 0x33, 0x40, 0x2c, 0x54, 0xe2, 0xa3, 0x16, 0x06, 0x49, 0xfd, 0xc1,
-	0xd3, 0x91, 0xfa, 0x97, 0xb0, 0x8d, 0xaa, 0xd4, 0xf7, 0x74, 0x49, 0x6a, 0xe3, 0x50, 0xda, 0xb5,
-	0xcb, 0x4d, 0x4d, 0xda, 0xcf, 0x0f, 0x21, 0xed, 0x7c, 0x00, 0x8e, 0x97, 0xf6, 0xbe, 0xb5, 0x90,
-	0x4d, 0x98, 0x12, 0x2a, 0x31, 0xef, 0xb0, 0x17, 0xb5, 0x64, 0x75, 0x6a, 0x11, 0x3f, 0xa7, 0x88,
-	0xe4, 0x9a, 0x3d, 0x5f, 0xa8, 0x71, 0x21, 0x6d, 0x38, 0xcd, 0x7f, 0xeb, 0xd6, 0x81, 0xc5, 0xbe,
-	0xd6, 0x81, 0x2b, 0xe2, 0x8b, 0x2e, 0x0a, 0xfe, 0x09, 0x23, 0x81, 0xfa, 0xc4, 0x40, 0x0a, 0x63,
-	0xd2, 0x01, 0xa2, 0x81, 0xf9, 0xa4, 0xbd, 0x38, 0xd8, 0x26, 0xf0, 0xaa, 0xa8, 0x73, 0x31, 0x59,
-	0x67, 0x72, 0xe6, 0xa6, 0xf0, 0x26, 0x0e, 0xcc, 0x0a, 0x28, 0x3b, 0x00, 0xe3, 0x0a, 0xff, 0x92,
-	0x16, 0xb1, 0x9d, 0x28, 0xe5, 0xcf, 0x43, 0xc9, 0x9a, 0x30, 0xa2, 0x3e, 0xb1, 0xa0, 0x27, 0xf9,
-	0x91, 0x0d, 0x98, 0xc3, 0x37, 0xfb, 0x69, 0x03, 0xbf, 0x92, 0x3f, 0x56, 0x65, 0xc6, 0x79, 0xb0,
-	0x1d, 0x5e, 0x28, 0x54, 0xfc, 0xe4, 0x4b, 0x55, 0xbd, 0xb4, 0xe6, 0x77, 0x8c, 0x9e, 0x46, 0xb3,
-	0x93, 0x3b, 0xfe, 0x50, 0x82, 0x35, 0xf1, 0xe4, 0xce, 0x9b, 0x88, 0x16, 0x84, 0x18, 0x81, 0x29,
-	0x4b, 0x6a, 0x22, 0x90, 0xac, 0x78, 0x88, 0x9b, 0x83, 0xe2, 0x03, 0xe5, 0xa2, 0xf4, 0xf9, 0xca,
-	0xc6, 0x4a, 0x17, 0xfa, 0x7c, 0x09, 0x4f, 0x2f, 0xf3, 0x27, 0x33, 0xba, 0xd8, 0x91, 0x2b, 0x8a,
-	0xde, 0xae, 0xa4, 0x22, 0x91, 0x7a, 0xbb, 0xa2, 0xad, 0xff, 0x2d, 0x03, 0x4e, 0x6f, 0xf8, 0xfb,
-	0x4e, 0xdb, 0xfd, 0x36, 0x4f, 0x69, 0xe6, 0xe1, 0xb8, 0x44, 0x71, 0x2a, 0x9f, 0x68, 0x6a, 0x74,
-	0x4f, 0xa9, 0x98, 0x49, 0x0a, 0x8a, 0x8c, 0x95, 0xd6, 0x1e, 0xf4, 0xa2, 0xc5, 0x86, 0x29, 0x19,
-	0xea, 0x39, 0x3a, 0x87, 0x9b, 0xbf, 0x90, 0x81, 0x49, 0x65, 0x0a, 0x90, 0xcf, 0xc2, 0x94, 0xca,
-	0x47, 0xb5, 0xfa, 0xa8, 0xd5, 0x5a, 0x1a, 0x16, 0x9a, 0x7d, 0xa8, 0xd3, 0xd2, 0xcc, 0x3e, 0x4c,
-	0xd0, 0x11, 0x7a, 0xc2, 0xa3, 0xcd, 0xfb, 0x29, 0x47, 0x9b, 0x13, 0xbd, 0x6a, 0xf6, 0x4e, 0xef,
-	0x01, 0x67, 0xf8, 0x47, 0xc8, 0xcc, 0x5f, 0x32, 0x20, 0x9f, 0x9c, 0xa4, 0x9f, 0x48, 0xaf, 0x9c,
-	0xc0, 0xbe, 0xfe, 0xf3, 0x19, 0xc8, 0xe3, 0x13, 0x91, 0xb4, 0x21, 0x63, 0x03, 0x9e, 0x55, 0x5f,
-	0x89, 0x77, 0x35, 0xd3, 0xf7, 0x73, 0xd1, 0xbe, 0xa2, 0x7e, 0xdc, 0x80, 0x9c, 0x29, 0x23, 0xdf,
-	0xff, 0xb5, 0xc5, 0x53, 0xe6, 0x87, 0x30, 0x9f, 0xec, 0x0e, 0x34, 0x7f, 0x17, 0x60, 0x56, 0x87,
-	0x27, 0x13, 0x4f, 0x27, 0xa9, 0xac, 0x24, 0xbe, 0xf9, 0x07, 0x99, 0x24, 0x6f, 0xe1, 0x37, 0xc1,
-	0x16, 0x9d, 0xb6, 0xb3, 0xdb, 0x8c, 0x72, 0xe3, 0x8a, 0xd7, 0xff, 0x11, 0x64, 0xc9, 0xb2, 0x93,
-	0xa4, 0x20, 0x8f, 0x3c, 0xdc, 0xb3, 0xe9, 0x1e, 0xee, 0xe4, 0x76, 0xc2, 0x63, 0x48, 0x09, 0xc7,
-	0x7e, 0x48, 0x77, 0xed, 0xd8, 0x6b, 0x28, 0xe1, 0x28, 0x54, 0x84, 0x79, 0x2d, 0x67, 0x9d, 0xa4,
-	0x1f, 0x8d, 0x0d, 0xae, 0x21, 0x16, 0x70, 0xe2, 0x54, 0x64, 0xb2, 0x02, 0xe3, 0xac, 0x99, 0x6b,
-	0x4e, 0x47, 0x58, 0xb5, 0xd5, 0x47, 0xd2, 0xe5, 0xe6, 0xa5, 0x84, 0xbc, 0x34, 0x29, 0xdb, 0xf2,
-	0xb5, 0x47, 0x01, 0x39, 0xa2, 0xf9, 0x27, 0x06, 0x9b, 0xff, 0xf5, 0xfb, 0x9f, 0xb2, 0xe4, 0xe8,
-	0xec, 0x93, 0x06, 0xb8, 0xf5, 0xfc, 0x61, 0x86, 0xa7, 0x37, 0x16, 0xe2, 0xf3, 0x16, 0x8c, 0x6d,
-	0x3a, 0xfe, 0x3e, 0x0d, 0x45, 0x22, 0x5e, 0x95, 0x0b, 0x2f, 0x88, 0x83, 0xc5, 0x43, 0xfc, 0x6d,
-	0x09, 0x02, 0xd5, 0x16, 0x96, 0x19, 0xca, 0x16, 0xa6, 0x98, 0x67, 0xb3, 0x4f, 0xcd, 0x3c, 0xfb,
-	0x95, 0x28, 0xb3, 0x70, 0x21, 0x1c, 0x22, 0x25, 0xda, 0xc5, 0x64, 0x9a, 0xed, 0x9e, 0xe4, 0x75,
-	0x31, 0x3b, 0x72, 0x5b, 0x4d, 0xdc, 0xad, 0x38, 0x8d, 0x1f, 0x93, 0xa2, 0xdb, 0xfc, 0xc3, 0x2c,
-	0xef, 0x63, 0xd1, 0x51, 0x97, 0xb5, 0x80, 0x12, 0x9c, 0x27, 0x6c, 0xa1, 0x57, 0x63, 0xfb, 0xd0,
-	0x7f, 0xe1, 0x32, 0x8c, 0x30, 0xd9, 0x14, 0xbd, 0xc9, 0x1f, 0xb8, 0xf6, 0x9a, 0x5a, 0x0c, 0x20,
-	0x2b, 0x67, 0x73, 0x19, 0xf7, 0x24, 0xf5, 0x8d, 0x00, 0xdc, 0xb6, 0xd4, 0xb9, 0x8c, 0x18, 0xe4,
-	0x0a, 0x8c, 0xac, 0x7b, 0x0d, 0x99, 0x7a, 0x6f, 0x1e, 0xc3, 0x0a, 0xb5, 0x97, 0x7e, 0x17, 0x0c,
-	0x0b, 0x31, 0xd8, 0xb7, 0x46, 0xc9, 0x7a, 0xd5, 0x6f, 0x6d, 0xed, 0x39, 0x36, 0x4f, 0x12, 0xab,
-	0x7e, 0x6b, 0x9c, 0xd7, 0xb7, 0x0c, 0x33, 0xfa, 0x1b, 0x46, 0xc2, 0xe9, 0x09, 0xcd, 0xac, 0x89,
-	0xa7, 0x90, 0x54, 0xeb, 0xb8, 0x4e, 0x44, 0x96, 0x61, 0x5a, 0x4b, 0xf9, 0x23, 0xae, 0x97, 0xd0,
-	0xbc, 0xa9, 0x27, 0x0c, 0x52, 0xcd, 0x9b, 0x1a, 0x09, 0xdb, 0xcf, 0x45, 0xfb, 0x95, 0x4b, 0xa6,
-	0x9e, 0xb6, 0x0b, 0x1c, 0x72, 0x0b, 0x72, 0x3c, 0x7e, 0xaf, 0x52, 0x52, 0x6f, 0x2b, 0x02, 0x84,
-	0x25, 0xe2, 0x5f, 0x25, 0xa2, 0x12, 0xaf, 0xf5, 0x19, 0xc8, 0x8b, 0x25, 0x29, 0x7a, 0x13, 0x02,
-	0x6f, 0x8a, 0x2b, 0x25, 0x4b, 0x5d, 0x46, 0xea, 0x6e, 0xc3, 0xb7, 0x10, 0x6a, 0x7e, 0xcf, 0x80,
-	0xf3, 0xeb, 0x34, 0x7c, 0xe8, 0xf9, 0xf7, 0x2d, 0x1a, 0x84, 0xbe, 0xcb, 0x9f, 0x98, 0xc0, 0x89,
-	0xf8, 0x59, 0xf2, 0x0e, 0x8c, 0xa2, 0xf7, 0x4d, 0x62, 0x67, 0x48, 0xd6, 0xb1, 0x3c, 0x2d, 0x04,
-	0x78, 0x14, 0x5d, 0x79, 0x2c, 0x4e, 0x44, 0xde, 0x82, 0x91, 0x12, 0x6d, 0x1f, 0x26, 0xde, 0x1a,
-	0xe8, 0x21, 0x8e, 0x16, 0x84, 0x06, 0x6d, 0x1f, 0x5a, 0x48, 0x62, 0xfe, 0x52, 0x06, 0xce, 0xa4,
-	0x34, 0x6b, 0xfb, 0xb3, 0xcf, 0xe8, 0xaa, 0xb8, 0xac, 0xad, 0x8a, 0x17, 0x05, 0x69, 0xdf, 0x8e,
-	0x4f, 0x5d, 0x24, 0xff, 0x9a, 0x01, 0xe7, 0x74, 0x01, 0x15, 0xee, 0x76, 0xdb, 0xb7, 0xc8, 0xdb,
-	0x30, 0xb6, 0x42, 0x9d, 0x06, 0x95, 0xa9, 0xcb, 0xe3, 0xe7, 0xba, 0x79, 0x70, 0x12, 0x2f, 0xe4,
-	0x6c, 0xff, 0x80, 0xaf, 0x61, 0xa7, 0x2c, 0x41, 0x42, 0x4a, 0xa2, 0x71, 0x5c, 0x1f, 0x37, 0x65,
-	0xa0, 0x60, 0x5a, 0x55, 0x03, 0xee, 0xd9, 0x7f, 0x60, 0xc0, 0x73, 0x03, 0x68, 0xd8, 0xc0, 0xb1,
-	0xa1, 0x57, 0x07, 0x0e, 0x77, 0x54, 0x84, 0x92, 0xf7, 0x60, 0x76, 0x53, 0xe8, 0xf3, 0x72, 0x38,
-	0x32, 0xf1, 0x7c, 0x91, 0xaa, 0xbe, 0x2d, 0xc7, 0x25, 0x89, 0xac, 0x45, 0xb0, 0x66, 0x07, 0x46,
-	0xb0, 0xaa, 0x01, 0xa1, 0x23, 0xc3, 0x06, 0x84, 0x7e, 0x98, 0x7c, 0xf9, 0x53, 0xe4, 0xe5, 0x8a,
-	0xc3, 0x61, 0x8d, 0xfe, 0xe1, 0xb0, 0x03, 0xb3, 0xff, 0xe0, 0x4b, 0x07, 0x3a, 0xef, 0x27, 0x1d,
-	0xcf, 0x77, 0xb5, 0xf1, 0x7c, 0x2e, 0x7d, 0x3c, 0xfb, 0x0f, 0xe4, 0xdf, 0x30, 0x92, 0x1f, 0x3b,
-	0xd4, 0x08, 0x9a, 0x30, 0x56, 0xf2, 0x5a, 0x8e, 0xdb, 0x56, 0xdf, 0x38, 0x6b, 0x20, 0xc4, 0x12,
-	0x25, 0xc3, 0x45, 0x0f, 0x5f, 0x84, 0xd1, 0x75, 0xaf, 0x5d, 0x28, 0x09, 0xdf, 0x3a, 0xe4, 0xd3,
-	0xf6, 0xda, 0xb6, 0xd3, 0xb0, 0x78, 0x81, 0xf9, 0x33, 0xa3, 0x70, 0xde, 0xa2, 0xfb, 0x2e, 0xd3,
-	0x38, 0xb7, 0x02, 0xb7, 0xbd, 0xaf, 0x85, 0x4a, 0x9a, 0x89, 0x31, 0x11, 0xf9, 0x2a, 0x19, 0x24,
-	0xaa, 0xe3, 0x2a, 0xe4, 0xd8, 0x06, 0xa3, 0x0c, 0x0b, 0x5e, 0x47, 0xe0, 0x2b, 0x8c, 0x5c, 0x5e,
-	0x64, 0x31, 0xb9, 0x26, 0x36, 0x40, 0x25, 0xa3, 0x30, 0xdb, 0x00, 0x7f, 0x78, 0xb4, 0x08, 0xb5,
-	0xc3, 0x20, 0xa4, 0x78, 0xf8, 0x11, 0x9b, 0x60, 0xa4, 0xa5, 0x8e, 0xf4, 0xd1, 0x52, 0xd7, 0x60,
-	0xbe, 0xd0, 0xe0, 0xeb, 0x9e, 0xd3, 0xac, 0xfa, 0x6e, 0xbb, 0xee, 0x76, 0x9c, 0xa6, 0x3c, 0x79,
-	0xe1, 0xa5, 0x94, 0x13, 0x95, 0xdb, 0x9d, 0x08, 0xc1, 0x4a, 0x25, 0x63, 0x9f, 0x51, 0x5a, 0xaf,
-	0xf1, 0x17, 0x86, 0xf9, 0x4d, 0x13, 0x7e, 0x46, 0xa3, 0x1d, 0xf0, 0x27, 0x86, 0xad, 0xa8, 0x18,
-	0xf5, 0x63, 0xbc, 0xce, 0xdf, 0x5c, 0xad, 0xc5, 0x61, 0x1b, 0x3c, 0xe1, 0x21, 0xbf, 0xf2, 0x0f,
-	0x9b, 0x01, 0x5e, 0xfb, 0x6b, 0x78, 0x31, 0x5d, 0xad, 0xb6, 0xc2, 0xe8, 0x72, 0x3d, 0x74, 0x41,
-	0x70, 0xa0, 0xd2, 0x71, 0x3c, 0x72, 0x03, 0x80, 0xa7, 0xea, 0x41, 0x91, 0x99, 0x88, 0xb5, 0x69,
-	0x1f, 0xa1, 0x5c, 0x9b, 0x56, 0x50, 0xc8, 0x3b, 0x70, 0xba, 0x5c, 0x5c, 0x92, 0xf6, 0xc1, 0x92,
-	0x57, 0xef, 0xe2, 0x05, 0x2d, 0x60, 0x7d, 0x38, 0x86, 0xb4, 0xbe, 0xc4, 0xe4, 0x24, 0x0d, 0x8d,
-	0x5c, 0x86, 0xf1, 0x4a, 0x89, 0xf7, 0xfd, 0xa4, 0x9a, 0xd5, 0x5b, 0x38, 0x3e, 0xc8, 0x42, 0xb2,
-	0x11, 0xab, 0x7b, 0x53, 0xc7, 0xea, 0x65, 0xe7, 0x8f, 0x57, 0xf5, 0x44, 0xf2, 0x6f, 0xfe, 0xc8,
-	0x44, 0xd1, 0x6b, 0xd0, 0x60, 0xfb, 0xe6, 0xa7, 0x2c, 0xf9, 0xb7, 0xf2, 0x6d, 0xb8, 0x10, 0xdc,
-	0x4c, 0x5d, 0x35, 0xfe, 0x7d, 0x4c, 0xfe, 0xdd, 0x83, 0x4b, 0x3e, 0x0f, 0xa3, 0xf8, 0x53, 0xa8,
-	0x10, 0xa7, 0x53, 0xd8, 0xc6, 0xea, 0x43, 0x9d, 0x3f, 0xf7, 0x87, 0x04, 0xa4, 0x02, 0xe3, 0x42,
-	0x7b, 0x3d, 0x49, 0x0a, 0x5b, 0xa1, 0x06, 0xf3, 0x41, 0x12, 0xf4, 0x66, 0x03, 0xa6, 0xd4, 0x0a,
-	0x99, 0x70, 0xae, 0x38, 0xc1, 0x01, 0x6d, 0xb0, 0x5f, 0x22, 0xfb, 0x3c, 0x0a, 0xe7, 0x01, 0x42,
-	0x6d, 0xd6, 0x0e, 0x4b, 0x41, 0x61, 0x0b, 0x57, 0x25, 0xd8, 0x0a, 0x44, 0x53, 0xc4, 0x79, 0xd6,
-	0x45, 0xdb, 0x48, 0xc3, 0x12, 0x45, 0xe6, 0x57, 0x60, 0x7e, 0xbd, 0xdb, 0x6c, 0xb2, 0xb3, 0xad,
-	0xcc, 0x4e, 0x1a, 0x3a, 0x21, 0x25, 0xcb, 0x30, 0x8a, 0x7f, 0x60, 0x45, 0x33, 0x51, 0x17, 0xa8,
-	0x38, 0xe8, 0x6b, 0x65, 0x60, 0xa0, 0x65, 0xa8, 0xbf, 0xbf, 0xcd, 0x49, 0xcd, 0xdf, 0x8f, 0x1f,
-	0x9e, 0xdc, 0xf4, 0x9d, 0xfa, 0x7d, 0xea, 0x8b, 0x1d, 0x68, 0xd8, 0x87, 0x31, 0x3f, 0x90, 0x8d,
-	0xd0, 0x77, 0x85, 0xb4, 0x06, 0x1f, 0xd7, 0x18, 0xf2, 0x0e, 0x4c, 0x8a, 0x9d, 0x41, 0x49, 0x0f,
-	0x82, 0x31, 0xd8, 0xf2, 0x79, 0xd1, 0xc4, 0xcd, 0xbd, 0x8a, 0x8e, 0x1b, 0x9e, 0xfe, 0x29, 0xdb,
-	0x37, 0x3f, 0x89, 0x0d, 0x4f, 0xaf, 0x63, 0x80, 0xe8, 0xfe, 0x43, 0x48, 0xf6, 0xad, 0x90, 0xdd,
-	0xdb, 0x6a, 0x42, 0x00, 0x23, 0x3e, 0x7e, 0xc4, 0x09, 0x01, 0xd4, 0xe3, 0x47, 0x84, 0x1a, 0x8d,
-	0x49, 0xe6, 0x98, 0x31, 0x79, 0x4f, 0x8e, 0x49, 0xb6, 0xbf, 0x60, 0x9c, 0x1e, 0x30, 0x0e, 0xb5,
-	0x78, 0x86, 0x8c, 0x0c, 0x75, 0x76, 0x3d, 0x85, 0x99, 0x0f, 0x39, 0x49, 0x72, 0x41, 0x13, 0x9c,
-	0xd4, 0x03, 0xf1, 0xe8, 0xf0, 0x4c, 0x8f, 0x39, 0x10, 0x7f, 0x01, 0xa6, 0x0a, 0x61, 0xe8, 0xd4,
-	0x0f, 0x68, 0xa3, 0xc4, 0x96, 0x27, 0x25, 0x76, 0xd9, 0x11, 0x70, 0xf5, 0x66, 0x42, 0xc5, 0xe5,
-	0xb9, 0x78, 0x9c, 0x40, 0x38, 0x8e, 0x45, 0xb9, 0x78, 0x18, 0x44, 0xcf, 0xc5, 0xc3, 0x20, 0xe4,
-	0x06, 0x8c, 0x57, 0xda, 0x0f, 0x5c, 0xd6, 0x27, 0xb9, 0xf8, 0x31, 0x3d, 0x97, 0x83, 0xd4, 0xc5,
-	0x55, 0x60, 0x91, 0xb7, 0x14, 0xcd, 0x71, 0x22, 0x3e, 0x25, 0x72, 0xbb, 0x82, 0x2d, 0x15, 0x48,
-	0x55, 0x2b, 0x8c, 0x54, 0xc9, 0xdb, 0x30, 0x2e, 0xcd, 0x45, 0x10, 0x9f, 0x0c, 0x05, 0x65, 0x6f,
-	0x84, 0x9a, 0x44, 0xc6, 0x77, 0xac, 0x94, 0x2c, 0xfa, 0x93, 0xca, 0x3b, 0x56, 0x4a, 0x16, 0x7d,
-	0xed, 0x1d, 0x2b, 0x25, 0x9f, 0x7e, 0x74, 0xd2, 0x9e, 0x3a, 0xf6, 0xa4, 0xbd, 0x0d, 0x53, 0x55,
-	0xc7, 0x0f, 0x5d, 0xa6, 0x2e, 0xb4, 0xc3, 0x60, 0x61, 0x5a, 0x33, 0x4e, 0x29, 0x45, 0xcb, 0x2f,
-	0xca, 0xf7, 0x9c, 0x3a, 0x0a, 0xbe, 0xfe, 0x10, 0x50, 0x0c, 0x4f, 0x77, 0x1b, 0x9b, 0x79, 0x12,
-	0xb7, 0x31, 0xec, 0x54, 0x34, 0x48, 0xcc, 0xc6, 0xc7, 0x5e, 0xd4, 0x0c, 0x13, 0x56, 0x89, 0x08,
-	0x91, 0x7c, 0x0d, 0xa6, 0xd8, 0xdf, 0xf8, 0x3a, 0xad, 0x4b, 0x83, 0x85, 0x3c, 0x7e, 0xdc, 0x8b,
-	0xa9, 0xb3, 0x9f, 0x3f, 0x61, 0x5b, 0xa3, 0x21, 0x9f, 0xc0, 0xc8, 0x38, 0x69, 0x69, 0xd4, 0xb8,
-	0x91, 0xf7, 0x61, 0x4a, 0x3e, 0xc0, 0x8c, 0x83, 0x34, 0x17, 0x3b, 0xfe, 0x35, 0x04, 0xbc, 0x27,
-	0x1d, 0x96, 0x4a, 0xc0, 0xb6, 0xf9, 0x42, 0x87, 0x2f, 0x90, 0x44, 0x91, 0xf6, 0x4e, 0xcf, 0xe2,
-	0x28, 0xd1, 0xc8, 0x17, 0x61, 0xaa, 0xd0, 0xe9, 0xc4, 0x2b, 0xce, 0x69, 0xc5, 0xda, 0xd0, 0xe9,
-	0xd8, 0xa9, 0xab, 0x8e, 0x46, 0x91, 0x5c, 0x98, 0xe7, 0x4f, 0xb4, 0x30, 0x93, 0x37, 0x22, 0xc5,
-	0xf9, 0x4c, 0x6c, 0x3a, 0x13, 0xda, 0xb9, 0x3a, 0xd3, 0x38, 0x92, 0xf9, 0xc7, 0x06, 0x9c, 0xeb,
-	0xd3, 0xcb, 0x51, 0xe6, 0x28, 0x63, 0x70, 0xe6, 0x28, 0x36, 0x5b, 0xf5, 0xe3, 0x1e, 0xd6, 0x29,
-	0x34, 0x1b, 0xb5, 0x8f, 0xa4, 0x8e, 0xe3, 0x01, 0x11, 0x0f, 0x2f, 0x2b, 0x0f, 0x14, 0x8b, 0xf4,
-	0x85, 0x89, 0x85, 0x5f, 0x7b, 0xa0, 0x99, 0xbf, 0xf0, 0xed, 0x73, 0x50, 0xd4, 0x95, 0x1f, 0x79,
-	0xda, 0xac, 0x49, 0x61, 0x6d, 0x1e, 0x19, 0x30, 0xa9, 0xc8, 0x3e, 0xb9, 0xa8, 0xc4, 0x19, 0xe5,
-	0x79, 0x3a, 0x6a, 0x85, 0x43, 0x86, 0xaf, 0xfe, 0x28, 0xc8, 0x99, 0xe3, 0x2d, 0x6b, 0x6b, 0x4c,
-	0xfd, 0x50, 0xb2, 0x6b, 0xb5, 0x34, 0x33, 0x98, 0x85, 0xe5, 0xf8, 0xf4, 0x9b, 0x13, 0x84, 0x85,
-	0x7a, 0xe8, 0x3e, 0xa0, 0x43, 0x2c, 0xf4, 0xf1, 0xd3, 0x6f, 0x4e, 0x10, 0xda, 0x0e, 0x92, 0xf5,
-	0x3c, 0xfd, 0x16, 0x31, 0x34, 0xff, 0x82, 0x01, 0xb0, 0x55, 0x29, 0x62, 0x7a, 0xbc, 0x27, 0xdd,
-	0x88, 0xd3, 0x53, 0x0e, 0x49, 0xee, 0x03, 0xb6, 0xe0, 0x2a, 0xcc, 0xe8, 0x58, 0xe4, 0x3d, 0x98,
-	0xad, 0xd5, 0x7d, 0xaf, 0xd9, 0xdc, 0x75, 0xea, 0xf7, 0x57, 0xdd, 0x36, 0xe5, 0xb9, 0x5e, 0x46,
-	0xf9, 0xf2, 0x1f, 0x44, 0x45, 0x76, 0x93, 0x95, 0x59, 0x49, 0x64, 0xf3, 0x4f, 0x0d, 0x98, 0xac,
-	0xb4, 0x83, 0xd0, 0x69, 0x36, 0x51, 0xc1, 0xf8, 0x34, 0xbd, 0x48, 0x10, 0x7d, 0xd7, 0x80, 0x1e,
-	0x7d, 0x13, 0x66, 0x13, 0x68, 0xec, 0x60, 0x5c, 0xc3, 0x30, 0x48, 0xf5, 0x60, 0xcc, 0x03, 0x23,
-	0x2d, 0x51, 0x62, 0x96, 0x15, 0xb2, 0xed, 0x9b, 0x78, 0x51, 0xb4, 0x04, 0xe0, 0x4a, 0x90, 0x54,
-	0xe3, 0x49, 0xb2, 0x25, 0xdb, 0x37, 0x2d, 0x05, 0xcb, 0x5c, 0x87, 0xb1, 0x9a, 0xe7, 0x87, 0xcb,
-	0x87, 0x5c, 0x73, 0x2e, 0xd1, 0xa0, 0xae, 0xde, 0x04, 0xb9, 0x68, 0x7d, 0xad, 0x5b, 0xa2, 0x88,
-	0x9d, 0x9b, 0xef, 0xb8, 0xb4, 0xd9, 0x50, 0x5d, 0xfe, 0xf6, 0x18, 0xc0, 0xe2, 0x70, 0x76, 0xba,
-	0x38, 0x1b, 0xa7, 0x6f, 0x8d, 0x7d, 0x0b, 0x9f, 0x54, 0x60, 0x8b, 0x5a, 0xff, 0xbe, 0xa4, 0x3f,
-	0xf8, 0xa7, 0xd5, 0x34, 0xa0, 0xab, 0xff, 0x9e, 0x01, 0x17, 0xfa, 0x93, 0xa8, 0xee, 0x8a, 0xc6,
-	0x00, 0x77, 0xc5, 0x57, 0x92, 0x37, 0x17, 0x88, 0x26, 0x6e, 0x2e, 0xe2, 0xfb, 0x8a, 0x12, 0x7a,
-	0x8b, 0xd6, 0xa3, 0xc7, 0x55, 0x2f, 0x0e, 0x68, 0x33, 0x22, 0xf2, 0x61, 0x0e, 0x91, 0xc6, 0x12,
-	0xb4, 0xe6, 0xef, 0x8c, 0xc0, 0xf9, 0xbe, 0x14, 0x64, 0x45, 0xc9, 0x04, 0x3d, 0x13, 0xe5, 0xa0,
-	0xed, 0x8b, 0x7f, 0x1d, 0xff, 0x45, 0x87, 0xa0, 0x64, 0x10, 0xc3, 0x46, 0x94, 0x01, 0x38, 0x83,
-	0xbc, 0x5e, 0x3b, 0x96, 0x17, 0x47, 0x47, 0x66, 0xd0, 0x9b, 0x0c, 0x18, 0x63, 0x4d, 0x68, 0xe8,
-	0xb8, 0xcd, 0x40, 0x9d, 0x76, 0x0d, 0x0e, 0xb2, 0x64, 0x59, 0xec, 0x43, 0x3a, 0x92, 0xee, 0x43,
-	0x6a, 0xfe, 0x5f, 0x06, 0x4c, 0x44, 0xcd, 0x26, 0x17, 0xe0, 0xec, 0xa6, 0x55, 0x28, 0x96, 0xed,
-	0xcd, 0x0f, 0xab, 0x65, 0x7b, 0x6b, 0xbd, 0x56, 0x2d, 0x17, 0x2b, 0x77, 0x2a, 0xe5, 0x52, 0xfe,
-	0x14, 0x99, 0x83, 0xe9, 0xad, 0xf5, 0x7b, 0xeb, 0x1b, 0x3b, 0xeb, 0x76, 0xd9, 0xb2, 0x36, 0xac,
-	0xbc, 0x41, 0xa6, 0x61, 0xc2, 0x5a, 0x2e, 0x14, 0xed, 0xf5, 0x8d, 0x52, 0x39, 0x9f, 0x21, 0x79,
-	0x98, 0x2a, 0x6e, 0xac, 0xaf, 0x97, 0x8b, 0x9b, 0x95, 0xed, 0xca, 0xe6, 0x87, 0xf9, 0x2c, 0x21,
-	0x30, 0x83, 0x08, 0x55, 0xab, 0xb2, 0x5e, 0xac, 0x54, 0x0b, 0xab, 0xf9, 0x11, 0x06, 0x63, 0xf8,
-	0x0a, 0x6c, 0x34, 0x62, 0x74, 0x6f, 0x6b, 0xb9, 0x9c, 0x1f, 0x63, 0x28, 0xec, 0x2f, 0x05, 0x65,
-	0x9c, 0x55, 0x8f, 0x28, 0xa5, 0xc2, 0x66, 0x61, 0xb9, 0x50, 0x2b, 0xe7, 0x73, 0xe4, 0x1c, 0x9c,
-	0xd6, 0x40, 0xf6, 0xea, 0xc6, 0xdd, 0xca, 0x7a, 0x7e, 0x82, 0xcc, 0x43, 0x3e, 0x82, 0x95, 0x96,
-	0xed, 0xad, 0x5a, 0xd9, 0xca, 0x43, 0x12, 0xba, 0x5e, 0x58, 0x2b, 0xe7, 0x27, 0xcd, 0x77, 0x79,
-	0x78, 0x09, 0xef, 0x6a, 0x72, 0x16, 0x48, 0x6d, 0xb3, 0xb0, 0xb9, 0x55, 0x4b, 0x7c, 0xfc, 0x24,
-	0x8c, 0xd7, 0xb6, 0x8a, 0xc5, 0x72, 0xad, 0x96, 0x37, 0x08, 0xc0, 0xd8, 0x9d, 0x42, 0x65, 0xb5,
-	0x5c, 0xca, 0x67, 0xcc, 0x5f, 0x34, 0x60, 0x4e, 0xaa, 0x3b, 0xd2, 0x0c, 0xfd, 0x84, 0x73, 0xf1,
-	0x3d, 0xed, 0x14, 0x27, 0xbd, 0xff, 0x13, 0x95, 0x0c, 0x98, 0x86, 0x3e, 0x9c, 0x49, 0x45, 0x26,
-	0x1f, 0x42, 0x5e, 0x36, 0x60, 0xcd, 0x09, 0xeb, 0x07, 0xf1, 0x32, 0xf6, 0x62, 0xa2, 0x92, 0x04,
-	0x1a, 0xb7, 0xa6, 0xc5, 0x4f, 0x1e, 0xf5, 0xb0, 0x31, 0xbf, 0x01, 0xe7, 0xfa, 0xd0, 0x92, 0x22,
-	0x8c, 0x45, 0x79, 0x71, 0x07, 0xf8, 0xb9, 0xcc, 0xff, 0xe0, 0x68, 0x51, 0x20, 0xe2, 0xc3, 0x2f,
-	0xf8, 0x97, 0x25, 0x20, 0xe6, 0x5f, 0x32, 0x60, 0x4a, 0x28, 0xc9, 0x85, 0x26, 0xf5, 0xc3, 0x27,
-	0xeb, 0xe1, 0xb7, 0xb4, 0x1e, 0x8e, 0xbc, 0xa0, 0x15, 0xfe, 0xac, 0x38, 0xb5, 0x73, 0xff, 0x4b,
-	0x03, 0xf2, 0x49, 0x44, 0xf2, 0x1e, 0xe4, 0x6a, 0xf4, 0x01, 0xf5, 0xdd, 0xf0, 0x50, 0xac, 0x15,
-	0x32, 0xe1, 0x3e, 0xc7, 0x11, 0x65, 0xdc, 0x16, 0x17, 0x88, 0x5f, 0x56, 0x44, 0x33, 0xec, 0x92,
-	0xa7, 0x1c, 0x73, 0xb3, 0x4f, 0xeb, 0x98, 0x6b, 0xfe, 0x9b, 0x0c, 0x9c, 0xbb, 0x4b, 0x43, 0xf5,
-	0x9b, 0xa2, 0x3b, 0xbb, 0xcf, 0x0c, 0xf7, 0x5d, 0xca, 0x97, 0x2c, 0xc0, 0x38, 0x16, 0xc9, 0x08,
-	0x73, 0x4b, 0xfe, 0x24, 0xcb, 0x91, 0x18, 0x64, 0xb5, 0x8c, 0xde, 0x7d, 0xea, 0xbe, 0xae, 0xe4,
-	0xf8, 0x95, 0x52, 0x40, 0x2e, 0xc3, 0x0c, 0x26, 0xb1, 0xeb, 0x32, 0xe9, 0xa1, 0x0d, 0x71, 0xdc,
-	0xcf, 0x59, 0x09, 0x28, 0xb9, 0x06, 0x79, 0x06, 0x29, 0xd4, 0xef, 0xb7, 0xbd, 0x87, 0x4d, 0xda,
-	0xd8, 0xa7, 0xfc, 0x81, 0xd1, 0x9c, 0xd5, 0x03, 0x97, 0x3c, 0xb7, 0xda, 0xfc, 0xb8, 0x4a, 0x1b,
-	0x78, 0x26, 0x17, 0x3c, 0x63, 0xe8, 0x85, 0xb7, 0x60, 0xf2, 0x63, 0xe6, 0xeb, 0x36, 0xff, 0x7b,
-	0x03, 0xe6, 0xf1, 0xe3, 0x94, 0x8a, 0xd1, 0x58, 0xfb, 0x99, 0xb8, 0xb7, 0x94, 0x14, 0xb6, 0x0e,
-	0x03, 0xe9, 0x47, 0x8d, 0xa8, 0x17, 0x63, 0x1b, 0x40, 0x66, 0x08, 0x1b, 0x40, 0xed, 0x24, 0xef,
-	0x91, 0x0d, 0x69, 0xc2, 0xe0, 0xaf, 0xc8, 0xc6, 0x43, 0x6e, 0xfe, 0xc5, 0x0c, 0x8c, 0x5b, 0x14,
-	0x1f, 0x6a, 0x22, 0x97, 0x61, 0x7c, 0xdd, 0x0b, 0x69, 0xb0, 0xa6, 0xbd, 0xca, 0xd5, 0x66, 0x20,
-	0xbb, 0xd5, 0xb0, 0x64, 0x21, 0x13, 0xf8, 0xaa, 0xef, 0x35, 0xba, 0xf5, 0x50, 0x15, 0xf8, 0x0e,
-	0x07, 0x59, 0xb2, 0x8c, 0xbc, 0x0e, 0x13, 0x82, 0x73, 0x74, 0x53, 0x82, 0x1e, 0x7e, 0x3e, 0x8d,
-	0x1e, 0xfa, 0x8a, 0x11, 0x50, 0xad, 0xe3, 0x7b, 0xec, 0x88, 0xa2, 0xd6, 0xf5, 0x6c, 0x9b, 0x52,
-	0x5b, 0x1d, 0x1d, 0xa0, 0xad, 0x7e, 0x06, 0xc6, 0x0a, 0x41, 0x40, 0x43, 0x19, 0x9c, 0x39, 0x15,
-	0x25, 0x84, 0x08, 0x68, 0xc8, 0x19, 0x3b, 0x58, 0x6e, 0x09, 0x3c, 0xf3, 0x4f, 0x32, 0x30, 0x8a,
-	0x7f, 0xe2, 0xed, 0x90, 0x5f, 0x3f, 0xd0, 0x6e, 0x87, 0xfc, 0xfa, 0x81, 0x85, 0x50, 0x72, 0x13,
-	0x4f, 0xa6, 0x32, 0xdb, 0xb2, 0xf8, 0x7a, 0x34, 0xb9, 0x36, 0x62, 0xb0, 0xa5, 0xe2, 0x44, 0xd7,
-	0x66, 0xd9, 0xd4, 0x90, 0xec, 0xb3, 0x90, 0xd9, 0xa8, 0x89, 0x2f, 0xc6, 0x7c, 0x0f, 0x5e, 0x60,
-	0x65, 0x36, 0x6a, 0xd8, 0x1b, 0x2b, 0x85, 0xa5, 0x37, 0x6f, 0xab, 0x0f, 0xc8, 0x05, 0x07, 0xce,
-	0xd2, 0x9b, 0xb7, 0x2d, 0x51, 0xc2, 0xfa, 0x17, 0xdb, 0x5c, 0x73, 0xbf, 0x4d, 0x45, 0x3c, 0x23,
-	0xf6, 0x2f, 0x7e, 0x9b, 0x1d, 0xb8, 0xdf, 0xa6, 0x56, 0x8c, 0x40, 0x96, 0x60, 0x52, 0x84, 0xb0,
-	0x22, 0xbe, 0x12, 0x62, 0x2a, 0x42, 0x5c, 0x39, 0x85, 0x8a, 0xc4, 0x6f, 0x3f, 0xc4, 0x00, 0xc9,
-	0x37, 0x61, 0xc4, 0xed, 0x87, 0x1c, 0xc2, 0xc0, 0x52, 0x50, 0xe2, 0x70, 0xcc, 0x38, 0x4e, 0x51,
-	0x0d, 0xc7, 0xc4, 0xa4, 0x84, 0x11, 0x82, 0xf9, 0x1b, 0x19, 0xc8, 0x55, 0x9b, 0xdd, 0x7d, 0xb7,
-	0xbd, 0x7d, 0xf3, 0xcf, 0xf4, 0x11, 0xe3, 0x37, 0x00, 0x37, 0x09, 0xa1, 0x3f, 0x4b, 0x03, 0x26,
-	0x6f, 0x9a, 0xd8, 0xaa, 0x39, 0x09, 0xa2, 0x91, 0x5b, 0x20, 0x04, 0x53, 0xbc, 0x69, 0x75, 0x46,
-	0x27, 0xe0, 0xaf, 0x39, 0x48, 0x12, 0x81, 0x4a, 0xde, 0x81, 0xc9, 0xf8, 0x35, 0xd9, 0xf8, 0xa9,
-	0x2a, 0x95, 0xb2, 0x18, 0x97, 0x6f, 0xdf, 0xb4, 0x54, 0x74, 0xf3, 0x0f, 0x32, 0x30, 0xa5, 0xb6,
-	0x87, 0x58, 0x70, 0x3a, 0x68, 0xb2, 0x83, 0xa3, 0xf0, 0xe0, 0xe8, 0x60, 0xa1, 0xd8, 0x4e, 0x2f,
-	0xea, 0x0d, 0x62, 0x78, 0xdc, 0x9d, 0xa3, 0x46, 0xc3, 0xd0, 0x6d, 0xef, 0x07, 0x2b, 0xa7, 0xac,
-	0xb9, 0x20, 0x06, 0x73, 0x3c, 0x52, 0x80, 0x9c, 0xd7, 0x09, 0xf6, 0x69, 0xdb, 0x95, 0xf6, 0xf5,
-	0x4b, 0x1a, 0xa3, 0x0d, 0x51, 0xd8, 0xc3, 0x2b, 0x22, 0x23, 0x6f, 0xc2, 0x98, 0xd7, 0xa1, 0x6d,
-	0xc7, 0x15, 0x7b, 0xdc, 0x73, 0x09, 0x06, 0xb4, 0x5d, 0xa8, 0x28, 0x84, 0x02, 0x99, 0xdc, 0x80,
-	0x11, 0xef, 0x7e, 0x34, 0x5e, 0xe7, 0x75, 0xa2, 0xfb, 0xa1, 0xa3, 0x90, 0x20, 0x22, 0x23, 0xf8,
-	0xc8, 0x69, 0xed, 0x89, 0x11, 0xd3, 0x09, 0x3e, 0x70, 0x5a, 0x7b, 0x2a, 0x01, 0x43, 0xfc, 0xc2,
-	0xc8, 0xff, 0xf2, 0x6b, 0x8b, 0xc6, 0x32, 0x40, 0x2e, 0x10, 0x25, 0xe6, 0x2a, 0x9c, 0xef, 0xdb,
-	0x3f, 0xe4, 0x2a, 0xe4, 0xf7, 0x1c, 0x71, 0x34, 0xaf, 0x1f, 0x38, 0xed, 0x36, 0x6d, 0x0a, 0xc9,
-	0x9c, 0x95, 0xf0, 0x22, 0x07, 0x73, 0xce, 0xe6, 0x3f, 0x36, 0xe0, 0xf9, 0x41, 0xbd, 0x44, 0x2e,
-	0x40, 0xae, 0xe3, 0xbb, 0x1e, 0xee, 0xc6, 0x5c, 0x96, 0xa3, 0xdf, 0xe4, 0x05, 0x00, 0xbe, 0x6d,
-	0x84, 0xce, 0xbe, 0x70, 0x0e, 0xb5, 0x26, 0x10, 0xb2, 0xe9, 0xec, 0x07, 0xe4, 0x35, 0x98, 0x6b,
-	0xd0, 0x3d, 0xa7, 0xdb, 0x0c, 0xed, 0xa0, 0x7e, 0x40, 0x1b, 0xe8, 0x8f, 0x8d, 0x97, 0xfe, 0x56,
-	0x5e, 0x14, 0xd4, 0x24, 0x9c, 0xbc, 0x04, 0x53, 0x6a, 0xf0, 0xb7, 0x78, 0x9a, 0x7b, 0xd2, 0xe9,
-	0xb8, 0x32, 0xfc, 0x9b, 0xb7, 0xf8, 0x83, 0x91, 0x9c, 0x91, 0xcf, 0x58, 0x78, 0xf7, 0x6d, 0x3e,
-	0x0f, 0xf3, 0x69, 0x23, 0x24, 0xbe, 0xed, 0x03, 0x20, 0xbd, 0x3d, 0x4b, 0xae, 0xc3, 0x04, 0xeb,
-	0x59, 0x8c, 0x59, 0x4d, 0x78, 0xb8, 0x21, 0x1e, 0xca, 0xa9, 0x95, 0xfb, 0x48, 0xfc, 0x2d, 0x78,
-	0xdd, 0x92, 0xbc, 0xd4, 0x61, 0x25, 0xe7, 0x60, 0xdc, 0xf3, 0xf7, 0xd9, 0xfa, 0x20, 0x7a, 0x79,
-	0xcc, 0xf3, 0xf7, 0xb7, 0x7c, 0xd9, 0xb9, 0x7f, 0x3b, 0x23, 0x3b, 0x77, 0xd9, 0xf3, 0xc2, 0x20,
-	0xf4, 0x9d, 0x8e, 0x36, 0x57, 0x48, 0x0b, 0xce, 0x7b, 0x4e, 0x37, 0x3c, 0x58, 0xb2, 0xd9, 0xbf,
-	0x9e, 0x2f, 0x3d, 0xa5, 0xeb, 0xf2, 0x62, 0x6c, 0x72, 0xe9, 0x86, 0x2e, 0x54, 0x05, 0x86, 0x5d,
-	0x50, 0x91, 0x8b, 0x5e, 0x83, 0x2a, 0x5c, 0x57, 0x4e, 0x59, 0xe7, 0x38, 0xcf, 0x1e, 0x2c, 0xb2,
-	0x02, 0xda, 0xeb, 0x77, 0xa9, 0x93, 0x45, 0x79, 0xa9, 0x4e, 0xe7, 0x3a, 0xb9, 0xab, 0x3c, 0x95,
-	0xf7, 0x1e, 0x4c, 0xb8, 0x0d, 0x91, 0x16, 0x41, 0x4c, 0x99, 0x45, 0x8d, 0x4d, 0xa5, 0xc1, 0xb3,
-	0x24, 0xc4, 0x3c, 0xd8, 0x7c, 0x73, 0x05, 0x74, 0x79, 0x5a, 0x5b, 0x55, 0xcc, 0x65, 0x58, 0xe8,
-	0x47, 0x26, 0x5e, 0x6a, 0x37, 0xa2, 0x97, 0xda, 0xcf, 0xc2, 0x58, 0xa0, 0xe4, 0x69, 0xb0, 0xc4,
-	0x2f, 0xf3, 0x47, 0xe1, 0xca, 0xb0, 0x7d, 0x84, 0x8f, 0x71, 0xa7, 0x77, 0xf8, 0x84, 0x35, 0xe7,
-	0xf4, 0xf4, 0x1b, 0x3e, 0xc6, 0x1d, 0x85, 0xaa, 0xbb, 0xa2, 0xe2, 0x49, 0x09, 0xdb, 0xf2, 0x5d,
-	0xf3, 0x5d, 0x98, 0xd1, 0x97, 0x51, 0xf2, 0x1a, 0x8c, 0x44, 0x5c, 0x67, 0x22, 0x75, 0x5f, 0x45,
-	0x62, 0xbc, 0x2d, 0x44, 0x32, 0xff, 0xe7, 0x0c, 0x9c, 0x4e, 0x59, 0x4c, 0xc9, 0x57, 0xe1, 0xb4,
-	0x14, 0x10, 0xbe, 0x5e, 0xf2, 0x81, 0xe3, 0xa2, 0x71, 0x35, 0x4d, 0x34, 0x10, 0x2d, 0x65, 0xf8,
-	0xe6, 0x84, 0x50, 0xc4, 0xe5, 0x7f, 0x7e, 0xc4, 0x81, 0x7c, 0x08, 0x67, 0xc5, 0xd3, 0x39, 0x8a,
-	0x54, 0xd8, 0x3e, 0xdd, 0x13, 0x2b, 0xeb, 0x4b, 0x3d, 0xbd, 0xe7, 0xd6, 0x95, 0xe6, 0x58, 0x74,
-	0x6f, 0xe5, 0x94, 0x35, 0x1f, 0xa4, 0xc0, 0x93, 0x92, 0xf6, 0x77, 0x0d, 0x30, 0x8f, 0xef, 0x2f,
-	0x5c, 0x8d, 0x92, 0x1d, 0xce, 0x56, 0x23, 0xa5, 0xf7, 0x2e, 0xc1, 0xb4, 0x4f, 0xf7, 0x7c, 0x1a,
-	0x1c, 0x28, 0xdd, 0x37, 0x61, 0x4d, 0x09, 0xa0, 0xec, 0x18, 0x19, 0xec, 0x31, 0xc4, 0xe1, 0x29,
-	0xc7, 0x36, 0x5e, 0xae, 0xf6, 0x0a, 0x22, 0xf3, 0x4e, 0xb4, 0x80, 0xa4, 0x8e, 0x03, 0x53, 0xff,
-	0xd5, 0x06, 0xf2, 0x1f, 0x1f, 0x8c, 0xe4, 0x32, 0xf9, 0xac, 0x25, 0x42, 0x52, 0xf6, 0xdc, 0x26,
-	0x35, 0xff, 0xa1, 0x01, 0x17, 0xfa, 0x77, 0x1e, 0xf9, 0xaa, 0x72, 0x5a, 0xce, 0xf2, 0x88, 0xfc,
-	0x63, 0xfa, 0x5b, 0x3d, 0x29, 0x89, 0x28, 0x89, 0xe4, 0xab, 0x31, 0x82, 0xe5, 0x93, 0x9c, 0x61,
-	0xde, 0x92, 0xda, 0xc3, 0xaa, 0x1b, 0x84, 0xdb, 0x37, 0xc9, 0x55, 0x18, 0xe7, 0x0a, 0x83, 0x6c,
-	0xe8, 0xac, 0xd6, 0xd0, 0xed, 0x9b, 0x96, 0x2c, 0x37, 0xbf, 0x6f, 0x44, 0xfb, 0x64, 0xb2, 0xf9,
-	0xdb, 0x37, 0xc9, 0xe7, 0x86, 0x3b, 0xc8, 0xe7, 0xe4, 0x41, 0x3e, 0x3a, 0xc4, 0x7f, 0x5e, 0x3b,
-	0xc4, 0xbf, 0x3c, 0xb8, 0x9f, 0xc4, 0x5e, 0x92, 0xcc, 0xeb, 0xff, 0xef, 0x0c, 0x78, 0x61, 0x20,
-	0x05, 0x79, 0x1e, 0x72, 0x85, 0x6a, 0x65, 0x33, 0x1e, 0x59, 0x36, 0x5b, 0x24, 0x84, 0xdc, 0x85,
-	0x89, 0x65, 0x27, 0x70, 0xeb, 0x4c, 0x80, 0x45, 0x43, 0x5e, 0x1d, 0xdc, 0x90, 0x08, 0x7d, 0xe5,
-	0x94, 0x15, 0xd3, 0x12, 0x1b, 0xe6, 0x70, 0x16, 0xf4, 0xe4, 0xcd, 0x4e, 0x6e, 0x3b, 0x3d, 0x0c,
-	0x7b, 0xc8, 0xd8, 0x0a, 0xd3, 0x03, 0x4c, 0x4e, 0xbe, 0x07, 0x70, 0xf1, 0xb8, 0x06, 0x9e, 0x20,
-	0xb0, 0xe9, 0x0a, 0xe4, 0xaa, 0x4e, 0x10, 0x3c, 0xf4, 0xfc, 0x86, 0xfa, 0x6c, 0x46, 0x47, 0xc0,
-	0xac, 0xa8, 0xd4, 0xfc, 0x39, 0x43, 0xee, 0x0d, 0xc7, 0x7f, 0x88, 0x92, 0x38, 0xa8, 0x31, 0x38,
-	0x71, 0x50, 0xe3, 0x63, 0x26, 0x0e, 0x32, 0x7f, 0x43, 0x84, 0x1d, 0x57, 0x1a, 0xd5, 0x44, 0xca,
-	0xc6, 0x27, 0x35, 0xe2, 0x95, 0x35, 0xe9, 0xbc, 0xa4, 0x64, 0x20, 0xeb, 0xad, 0xab, 0xbf, 0x2d,
-	0x4f, 0x11, 0xd5, 0x9f, 0x33, 0xe0, 0xf9, 0x41, 0xe4, 0xa9, 0xd9, 0x25, 0x8d, 0x93, 0x65, 0x97,
-	0xbc, 0x0a, 0x39, 0x0e, 0xd3, 0x73, 0xbc, 0x0b, 0x52, 0xd6, 0xe1, 0xb2, 0xd8, 0x2c, 0x00, 0x54,
-	0x1a, 0xd5, 0x8d, 0x0e, 0x0f, 0x7e, 0xbe, 0x05, 0x23, 0xac, 0x6d, 0x89, 0x8e, 0x62, 0x4d, 0x2d,
-	0xac, 0xad, 0x0a, 0x24, 0x7e, 0x72, 0x0d, 0x9c, 0x56, 0xd3, 0x42, 0x64, 0x73, 0x07, 0x66, 0x74,
-	0x0c, 0x52, 0xd6, 0xc3, 0x65, 0xe2, 0x67, 0xa9, 0x96, 0x3d, 0x8f, 0xdb, 0x09, 0x97, 0xcf, 0xff,
-	0xe0, 0x68, 0x11, 0xd8, 0x4f, 0x4e, 0x93, 0x16, 0x4e, 0x63, 0x7e, 0x37, 0x03, 0xf3, 0xf1, 0xdd,
-	0xba, 0x1c, 0xae, 0x67, 0xf6, 0xee, 0xab, 0xa0, 0xdd, 0xcd, 0x2c, 0xf6, 0xbc, 0xfc, 0x22, 0x3f,
-	0x70, 0x80, 0x49, 0xf8, 0x2e, 0x2c, 0xf4, 0xc3, 0x27, 0xaf, 0xf5, 0xbc, 0xcd, 0x20, 0x7c, 0x40,
-	0xa3, 0x47, 0x1c, 0x94, 0xa7, 0x1a, 0xfe, 0xa5, 0x01, 0x17, 0x84, 0xb9, 0x6e, 0xcd, 0x71, 0xdb,
-	0xf8, 0x1e, 0x55, 0x9d, 0x3e, 0x9d, 0x4b, 0xd3, 0xbb, 0xda, 0x94, 0x79, 0x45, 0xb7, 0xca, 0xf6,
-	0xd4, 0xd6, 0xff, 0x6b, 0xc9, 0x55, 0x74, 0x9c, 0xad, 0x73, 0x8b, 0xc9, 0x08, 0x77, 0x0c, 0x69,
-	0x33, 0x80, 0xea, 0x18, 0x82, 0x18, 0xe6, 0x8f, 0xc3, 0x8b, 0x83, 0x2b, 0x20, 0x5f, 0x87, 0xe9,
-	0xc2, 0x3e, 0x6d, 0x87, 0x5b, 0x9d, 0x7d, 0xdf, 0x69, 0x50, 0x69, 0xc5, 0x96, 0x07, 0x46, 0xb5,
-	0x8c, 0x3b, 0x0b, 0x0b, 0x47, 0x05, 0x06, 0xb7, 0xbb, 0x82, 0x48, 0x0b, 0x8b, 0x50, 0xb9, 0x99,
-	0x3f, 0x61, 0x00, 0xe9, 0xe5, 0x41, 0x6e, 0xc3, 0xd4, 0xd6, 0x66, 0xb1, 0x16, 0x3a, 0x7e, 0xb8,
-	0xe2, 0x75, 0x79, 0x77, 0x4e, 0x8b, 0x3b, 0xf4, 0xb0, 0x6e, 0x07, 0xac, 0xc0, 0x3e, 0xf0, 0xba,
-	0xbe, 0xa5, 0xe1, 0x61, 0x46, 0x1b, 0x4a, 0xef, 0x37, 0x9c, 0x43, 0x3d, 0xa3, 0x8d, 0x80, 0x69,
-	0x19, 0x6d, 0x04, 0xcc, 0xfc, 0x9b, 0x06, 0x3c, 0x27, 0x4f, 0x7f, 0x8d, 0x94, 0xb6, 0x14, 0xd1,
-	0x3b, 0xcb, 0x97, 0x41, 0x48, 0x83, 0xf4, 0xa6, 0x39, 0xe9, 0xc0, 0x88, 0x0d, 0x44, 0x05, 0x8a,
-	0xd3, 0xe2, 0x63, 0x7c, 0xa1, 0xd7, 0x19, 0xc2, 0x83, 0x31, 0x1f, 0x8d, 0x68, 0xe8, 0x75, 0x90,
-	0x05, 0x52, 0x9a, 0x14, 0xe6, 0xd5, 0xc6, 0xc9, 0x16, 0x93, 0x35, 0x18, 0x17, 0x5e, 0xda, 0x42,
-	0x13, 0x91, 0x8e, 0xfb, 0x03, 0xbe, 0x69, 0x79, 0x56, 0xba, 0x49, 0x8a, 0x20, 0x18, 0x4b, 0xf2,
-	0x30, 0x37, 0xf9, 0x33, 0xc0, 0x18, 0x16, 0xfa, 0x84, 0x12, 0xad, 0xac, 0xde, 0xff, 0x7f, 0x03,
-	0xe6, 0xd9, 0x79, 0xb5, 0xd2, 0xea, 0x78, 0x7e, 0x68, 0x75, 0x9b, 0x72, 0xf6, 0xb1, 0xad, 0x53,
-	0x1e, 0xea, 0xf9, 0xbd, 0x3e, 0xdf, 0x3a, 0x05, 0xcc, 0x8a, 0x4a, 0xc9, 0x0a, 0xe4, 0x44, 0x04,
-	0x9d, 0x7c, 0x14, 0x53, 0xde, 0xda, 0xe8, 0x8c, 0x05, 0x12, 0x9b, 0x1b, 0xb8, 0xa0, 0x08, 0x1a,
-	0x2b, 0xa2, 0x36, 0xff, 0xc4, 0x80, 0x73, 0x7d, 0x68, 0xc8, 0xbb, 0x30, 0x8a, 0x17, 0x37, 0xa2,
-	0x2f, 0x9f, 0xef, 0x53, 0x45, 0x58, 0x3f, 0xd8, 0xbe, 0xc9, 0xaf, 0x13, 0x5b, 0xec, 0x87, 0xc5,
-	0xa9, 0xc8, 0x57, 0x61, 0xa2, 0xd0, 0x68, 0x68, 0x4f, 0x77, 0xbe, 0x31, 0xb8, 0x95, 0xd7, 0x23,
-	0x7c, 0xae, 0xc1, 0x72, 0x03, 0x64, 0xa3, 0x21, 0xde, 0x3e, 0xb4, 0x62, 0x7e, 0x17, 0xde, 0x81,
-	0x19, 0x1d, 0xf9, 0x44, 0x1a, 0xec, 0xf7, 0x0d, 0xc8, 0xeb, 0x6d, 0xf8, 0x64, 0xdc, 0x2d, 0xd3,
-	0x86, 0xf9, 0x98, 0xbd, 0xfd, 0x97, 0x32, 0x70, 0x26, 0xb5, 0x87, 0xc9, 0x1b, 0x30, 0x56, 0xe8,
-	0x74, 0x2a, 0x25, 0x2e, 0xdb, 0x62, 0x2b, 0x77, 0x3a, 0x9d, 0x44, 0x80, 0x86, 0x40, 0x22, 0xb7,
-	0x20, 0x87, 0x82, 0xcb, 0x08, 0x32, 0x71, 0x4c, 0x07, 0x46, 0x3e, 0x27, 0x63, 0x3a, 0x24, 0x22,
-	0xb9, 0x03, 0x33, 0xc2, 0xf3, 0xca, 0xa2, 0xfb, 0xf4, 0x51, 0x14, 0x5c, 0x8c, 0xf1, 0xcf, 0xd2,
-	0x4f, 0xcb, 0xf6, 0x79, 0x99, 0x1a, 0x25, 0xa6, 0x53, 0xe1, 0xcb, 0x1d, 0x8c, 0xa7, 0xca, 0x89,
-	0x07, 0x96, 0xf0, 0x97, 0x3b, 0xb0, 0x11, 0x7d, 0x78, 0xf5, 0x50, 0x46, 0xc3, 0x55, 0x08, 0x02,
-	0x77, 0xbf, 0xdd, 0xa2, 0xed, 0xf0, 0x93, 0x1b, 0xae, 0xb8, 0x8e, 0xa1, 0x86, 0xeb, 0x7b, 0x23,
-	0x7c, 0x32, 0x27, 0xc9, 0x8e, 0x79, 0x9c, 0xaa, 0x04, 0xe3, 0x3c, 0xe6, 0x50, 0xce, 0x8c, 0x17,
-	0x52, 0x9b, 0xc0, 0x71, 0xb6, 0x6f, 0x72, 0x65, 0x82, 0xdf, 0x3f, 0x05, 0x96, 0x24, 0x25, 0xdb,
-	0x30, 0x59, 0x6c, 0x52, 0xa7, 0xdd, 0xed, 0x0c, 0xf9, 0xc6, 0xfc, 0x82, 0xf8, 0x96, 0xa9, 0x3a,
-	0x27, 0x8b, 0x1f, 0x99, 0x57, 0x19, 0x91, 0xcd, 0xc8, 0x24, 0x3d, 0x82, 0x66, 0x92, 0xcf, 0x0c,
-	0xe8, 0x9f, 0x24, 0x10, 0xe9, 0xf4, 0xfb, 0x16, 0x61, 0xb3, 0xb6, 0x61, 0x66, 0xd5, 0x09, 0xc2,
-	0x4d, 0xdf, 0x69, 0x07, 0x18, 0xb6, 0x31, 0x84, 0x2f, 0xad, 0x4c, 0x31, 0x3e, 0x8b, 0x7e, 0x5b,
-	0x61, 0x44, 0x8a, 0x6d, 0x4e, 0xb0, 0x63, 0xda, 0xcb, 0x1d, 0xb7, 0xed, 0x34, 0xdd, 0x6f, 0xcb,
-	0x9b, 0x3b, 0xae, 0xbd, 0xec, 0x49, 0xa0, 0x15, 0x97, 0x9b, 0x5f, 0xeb, 0x19, 0x37, 0xde, 0xca,
-	0x49, 0x18, 0x17, 0xae, 0x0d, 0xfc, 0xaa, 0xbf, 0x5a, 0x5e, 0x2f, 0x55, 0xd6, 0xef, 0xe6, 0x0d,
-	0x32, 0x03, 0x50, 0xb5, 0x36, 0x8a, 0xe5, 0x5a, 0x8d, 0xfd, 0xce, 0xb0, 0xdf, 0xc2, 0x0f, 0xe0,
-	0xce, 0xd6, 0x6a, 0x3e, 0xab, 0xb8, 0x02, 0x8c, 0x98, 0xff, 0xc2, 0x80, 0xb3, 0xe9, 0x43, 0x49,
-	0x36, 0x01, 0x9d, 0x41, 0x84, 0x05, 0xea, 0xf6, 0xc0, 0x71, 0x4f, 0x05, 0x27, 0x9d, 0x4a, 0x42,
-	0xee, 0xac, 0x90, 0x71, 0xa5, 0xae, 0x1a, 0xa5, 0xfa, 0x76, 0x1b, 0x66, 0x11, 0x16, 0xfa, 0xf1,
-	0xd0, 0x3f, 0x75, 0x16, 0x26, 0x0b, 0xd5, 0xea, 0x6a, 0xa5, 0x58, 0xd8, 0xac, 0x6c, 0xac, 0xe7,
-	0x0d, 0x32, 0x01, 0xa3, 0x77, 0xad, 0x8d, 0xad, 0x6a, 0x3e, 0x63, 0xfe, 0x65, 0x03, 0xa6, 0x2b,
-	0xed, 0x90, 0xee, 0xf3, 0xd4, 0x66, 0x4f, 0x3a, 0xf9, 0xbe, 0xa0, 0x4d, 0xbe, 0x85, 0xc8, 0x6d,
-	0x2a, 0xaa, 0x60, 0xa8, 0x99, 0xf7, 0x10, 0xe6, 0x7a, 0x48, 0x48, 0x0d, 0xc6, 0x0b, 0x3b, 0xb5,
-	0x8d, 0x4a, 0xa9, 0x28, 0x1a, 0x26, 0x55, 0x64, 0x01, 0xed, 0xad, 0x84, 0x5f, 0xb3, 0x3e, 0x0c,
-	0x6c, 0xcf, 0x6d, 0x28, 0xd9, 0x12, 0x57, 0x4e, 0x59, 0x92, 0x13, 0x3b, 0x2f, 0x0b, 0x2d, 0x1f,
-	0x15, 0xe8, 0x55, 0x58, 0xe8, 0xc7, 0x8d, 0x9d, 0x1b, 0x2c, 0xaf, 0x49, 0x0b, 0xd6, 0xba, 0x7a,
-	0x8b, 0x8b, 0xc1, 0xed, 0x8e, 0xdf, 0x4e, 0x06, 0xb7, 0x17, 0xac, 0x75, 0xf3, 0xaf, 0x66, 0xe0,
-	0x2c, 0xeb, 0x97, 0x26, 0x0d, 0x02, 0x76, 0xea, 0x65, 0x07, 0x2c, 0xf1, 0x44, 0xe9, 0xe7, 0x60,
-	0xec, 0xe0, 0x64, 0xe6, 0x10, 0x8e, 0x4e, 0x08, 0xe0, 0x5a, 0x23, 0xf6, 0x3d, 0xfc, 0x9b, 0xbc,
-	0x00, 0x4a, 0x1a, 0x53, 0x5c, 0x2a, 0xa6, 0xac, 0x89, 0x4e, 0x94, 0xcc, 0xf4, 0xf3, 0x30, 0x8a,
-	0x0e, 0xf5, 0x62, 0xc6, 0x4b, 0xbd, 0x29, 0xbd, 0x65, 0xe8, 0x69, 0x6f, 0x71, 0x02, 0x72, 0x03,
-	0x20, 0x0e, 0x3d, 0x16, 0x53, 0x5a, 0x9e, 0xd5, 0xa2, 0xe8, 0x63, 0x6b, 0xa2, 0xb5, 0xe7, 0x88,
-	0x78, 0xde, 0x6b, 0x30, 0x27, 0x8f, 0xed, 0x1d, 0xe9, 0x11, 0xce, 0x9d, 0xdf, 0xad, 0x59, 0x5e,
-	0x50, 0xe9, 0x08, 0xaf, 0x70, 0xf3, 0x7f, 0xca, 0xc0, 0xc4, 0x0e, 0xdb, 0xff, 0xf0, 0x8c, 0x35,
-	0xf8, 0xcc, 0xb6, 0x04, 0x93, 0xab, 0x9e, 0xd3, 0xd0, 0x9f, 0xd8, 0xc3, 0x3b, 0xc9, 0xa6, 0xe7,
-	0x48, 0x3b, 0x68, 0x60, 0xa9, 0x48, 0xc7, 0xdc, 0xa7, 0x7e, 0x00, 0x63, 0x3c, 0xa2, 0x44, 0x24,
-	0x04, 0x96, 0x1a, 0x50, 0xd4, 0xa2, 0xeb, 0xbc, 0x58, 0xb1, 0xb7, 0xed, 0x21, 0x40, 0xdd, 0x8e,
-	0x45, 0x4c, 0x8a, 0x72, 0xa2, 0x1c, 0x1d, 0xee, 0x44, 0xa9, 0xf8, 0x01, 0x8f, 0x0d, 0xe3, 0x07,
-	0x7c, 0xe1, 0x2d, 0x98, 0x54, 0xda, 0x73, 0x22, 0x85, 0xe8, 0x27, 0x33, 0x30, 0x8d, 0x5f, 0x15,
-	0x19, 0xca, 0x9f, 0xcd, 0xf3, 0xf1, 0x17, 0xb4, 0xf3, 0xf1, 0x82, 0x3a, 0x5e, 0xfc, 0xcb, 0x06,
-	0x1c, 0x8c, 0x3f, 0x80, 0xb9, 0x1e, 0x44, 0xf2, 0x26, 0x8c, 0xb2, 0xe6, 0xcb, 0xf3, 0x44, 0x3e,
-	0x29, 0x01, 0x71, 0x9c, 0x16, 0xfb, 0xf0, 0xc0, 0xe2, 0xd8, 0xe6, 0xff, 0x6d, 0xc0, 0x94, 0x88,
-	0x45, 0x6f, 0xef, 0x79, 0xcf, 0x6c, 0x77, 0xbe, 0xa5, 0x75, 0xe7, 0xb9, 0xc8, 0x97, 0x5c, 0x7e,
-	0xd8, 0x80, 0xde, 0xfc, 0x27, 0x18, 0xd1, 0xa4, 0x23, 0x92, 0x12, 0x7f, 0x28, 0x5c, 0x5f, 0x9a,
-	0x93, 0x58, 0x6c, 0xad, 0xc6, 0x5c, 0x53, 0x73, 0xe9, 0xaf, 0x86, 0x5f, 0x38, 0xc0, 0x45, 0x5e,
-	0xe6, 0x7d, 0x8a, 0x5f, 0x99, 0x56, 0xf2, 0x3e, 0xc5, 0xaf, 0x4c, 0xab, 0x6f, 0x4b, 0xdf, 0x00,
-	0x40, 0xe7, 0xdc, 0x76, 0x9d, 0x46, 0x56, 0x2d, 0xf4, 0x40, 0x70, 0x05, 0x94, 0xe1, 0x2b, 0x28,
-	0xe6, 0x6f, 0x66, 0x01, 0xe2, 0xeb, 0x47, 0x36, 0x23, 0xa9, 0x96, 0xc2, 0x45, 0x58, 0xd3, 0x10,
-	0xa4, 0x8e, 0x92, 0x00, 0x91, 0xcb, 0x30, 0xa2, 0xe4, 0x70, 0x4d, 0x75, 0xf9, 0x47, 0xa3, 0x69,
-	0x11, 0x20, 0x38, 0x6c, 0xd7, 0xed, 0x06, 0x6d, 0x3a, 0x7c, 0x71, 0xce, 0xe2, 0xeb, 0x6f, 0xf3,
-	0x31, 0xb4, 0x4f, 0x96, 0xd1, 0x09, 0x86, 0x51, 0x62, 0x08, 0xe4, 0xdd, 0xc4, 0x5d, 0xed, 0x48,
-	0x1c, 0xe9, 0xa0, 0xc2, 0xd5, 0x48, 0x07, 0xe5, 0x1e, 0x97, 0x2c, 0x41, 0x64, 0xce, 0x55, 0x57,
-	0xa8, 0xb4, 0x9c, 0xb3, 0x12, 0xc6, 0x68, 0xa4, 0x61, 0x57, 0x7b, 0x7a, 0x51, 0xc0, 0x54, 0x1a,
-	0x09, 0x23, 0x55, 0x98, 0x70, 0xdb, 0x0f, 0x68, 0x3b, 0xf4, 0xfc, 0xc3, 0x85, 0x71, 0x9c, 0x55,
-	0xe7, 0x95, 0x9b, 0xde, 0x8a, 0x2c, 0xe3, 0x8b, 0x2a, 0x9e, 0x59, 0x22, 0x7c, 0x35, 0xb4, 0x2c,
-	0x02, 0x8a, 0x6b, 0xdd, 0x7f, 0x9a, 0x01, 0xd2, 0xcb, 0x80, 0x7c, 0x01, 0x26, 0xf9, 0x9a, 0x6c,
-	0xfb, 0xc1, 0xb7, 0xc4, 0x85, 0x30, 0x0f, 0x2a, 0x56, 0xc0, 0x6a, 0x22, 0x28, 0x0e, 0xb6, 0x82,
-	0x6f, 0x35, 0xc9, 0xd7, 0xe1, 0x34, 0x0e, 0x40, 0x87, 0xfa, 0xae, 0xd7, 0xb0, 0x31, 0x0c, 0xc8,
-	0x69, 0x8a, 0x9c, 0x61, 0x6f, 0x60, 0x72, 0xcb, 0xde, 0xe2, 0x3e, 0x03, 0x35, 0xc7, 0x50, 0xab,
-	0x88, 0x59, 0xe5, 0x88, 0x64, 0x13, 0xf2, 0x2a, 0xfd, 0x5e, 0xb7, 0xd9, 0x14, 0x63, 0x7f, 0x0d,
-	0xdf, 0xbc, 0x49, 0x94, 0xf5, 0x61, 0x3c, 0x13, 0x33, 0xbe, 0xd3, 0x6d, 0x36, 0xc9, 0xe7, 0x00,
-	0xbc, 0xb6, 0xdd, 0x72, 0x83, 0xc0, 0x6d, 0xef, 0x0b, 0x21, 0xc0, 0x00, 0x9f, 0x18, 0xaa, 0x76,
-	0xa3, 0xd7, 0x5e, 0xe3, 0x40, 0xd1, 0x8d, 0x5f, 0x81, 0x39, 0xe1, 0x63, 0xb8, 0xe3, 0x86, 0x07,
-	0x42, 0x63, 0x7b, 0x3a, 0x96, 0x8f, 0x6b, 0xef, 0xc3, 0xac, 0xf4, 0x0c, 0xdd, 0x5c, 0xad, 0x61,
-	0x20, 0xc7, 0x2c, 0x4c, 0x6e, 0x97, 0xad, 0xca, 0x9d, 0x0f, 0xed, 0x3b, 0x5b, 0xab, 0xab, 0xf9,
-	0x53, 0x64, 0x1a, 0x26, 0x04, 0xa0, 0x58, 0xc8, 0x1b, 0x64, 0x0a, 0x72, 0x95, 0xf5, 0x5a, 0xb9,
-	0xb8, 0x65, 0x95, 0xf3, 0x99, 0x6b, 0x4b, 0x30, 0x13, 0xbf, 0xf7, 0x80, 0x3a, 0xec, 0x38, 0x64,
-	0xad, 0xc2, 0x4e, 0xfe, 0x14, 0xd3, 0xbe, 0xab, 0xf7, 0x8a, 0xb5, 0x9b, 0x37, 0xf3, 0x06, 0x53,
-	0x6c, 0xef, 0x16, 0xab, 0xf6, 0xbd, 0xb5, 0x5a, 0x3e, 0x73, 0xed, 0x33, 0x30, 0x87, 0x29, 0x0b,
-	0x56, 0xdd, 0x20, 0xa4, 0x6d, 0xea, 0x63, 0xb5, 0x53, 0x90, 0xab, 0xd1, 0x8e, 0xe3, 0x3b, 0x21,
-	0xe5, 0x75, 0xae, 0x75, 0x9b, 0xa1, 0xdb, 0x69, 0xd2, 0x47, 0x79, 0xe3, 0xda, 0x5b, 0x30, 0x6b,
-	0x79, 0xdd, 0xd0, 0x6d, 0xef, 0xd7, 0x42, 0x86, 0xb1, 0x7f, 0x48, 0xce, 0xc0, 0xdc, 0xd6, 0x7a,
-	0x61, 0x6d, 0xb9, 0x72, 0x77, 0x6b, 0x63, 0xab, 0x66, 0xaf, 0x15, 0x36, 0x8b, 0x2b, 0x5c, 0x69,
-	0x5e, 0xdb, 0xa8, 0x6d, 0xda, 0x56, 0xb9, 0x58, 0x5e, 0xdf, 0xcc, 0x1b, 0xd7, 0x7e, 0xd6, 0x80,
-	0x19, 0x76, 0xc0, 0xc3, 0x2b, 0xa1, 0x2d, 0xf4, 0xd4, 0xbc, 0x08, 0xcf, 0x6f, 0xd5, 0xca, 0x96,
-	0xbd, 0xb9, 0x71, 0xaf, 0xbc, 0x6e, 0x6f, 0xd5, 0x0a, 0x77, 0x93, 0xde, 0xd4, 0x8b, 0xf0, 0x9c,
-	0x82, 0x61, 0x95, 0x8b, 0x1b, 0xdb, 0x65, 0xcb, 0xae, 0x16, 0x6a, 0xb5, 0x9d, 0x0d, 0xab, 0x94,
-	0x37, 0xc8, 0x05, 0x38, 0x9b, 0x82, 0xb0, 0x76, 0xa7, 0x90, 0xcf, 0xf4, 0x94, 0xad, 0x97, 0x77,
-	0x0a, 0xab, 0xf6, 0xf2, 0xc6, 0x66, 0x3e, 0x7b, 0xed, 0x7d, 0x98, 0x12, 0x2e, 0x94, 0x3c, 0x36,
-	0x32, 0x07, 0x23, 0xeb, 0x1b, 0xeb, 0xe5, 0xe4, 0xc1, 0x66, 0x0a, 0x72, 0x85, 0x6a, 0xd5, 0xda,
-	0xd8, 0x2e, 0x97, 0xf2, 0x19, 0xd6, 0x91, 0xa5, 0xf2, 0x3a, 0x6b, 0x59, 0xf6, 0x9a, 0x09, 0x73,
-	0x45, 0xea, 0x87, 0xe5, 0x47, 0x21, 0x6d, 0xb3, 0xfd, 0x04, 0xfb, 0x6e, 0x1a, 0x26, 0xca, 0x5f,
-	0xde, 0x2c, 0xaf, 0xd7, 0xd8, 0x39, 0xe1, 0xd4, 0xb5, 0xe7, 0x13, 0x38, 0x72, 0x58, 0x6a, 0xb5,
-	0x95, 0xfc, 0xa9, 0x6b, 0x5f, 0x63, 0xfb, 0xa0, 0x12, 0xf7, 0x7b, 0x0e, 0x4e, 0xab, 0xbf, 0xab,
-	0xb4, 0xdd, 0x70, 0xdb, 0xfb, 0xf9, 0x53, 0xc9, 0x02, 0xab, 0xdb, 0x6e, 0xb3, 0x02, 0xfc, 0x78,
-	0xb5, 0x60, 0x93, 0xfa, 0x2d, 0xb7, 0xed, 0x84, 0xb4, 0x91, 0xcf, 0x5c, 0xbb, 0x0e, 0xd3, 0x9a,
-	0xf7, 0x29, 0xab, 0x77, 0x75, 0x43, 0x88, 0xc3, 0x5a, 0xb9, 0x54, 0xd9, 0x5a, 0xcb, 0x8f, 0xb2,
-	0xcf, 0x5e, 0xa9, 0xdc, 0x5d, 0xc9, 0xc3, 0xb5, 0xaf, 0xc1, 0x8c, 0x08, 0x67, 0x5a, 0xbb, 0x53,
-	0x90, 0x0d, 0xdd, 0xb8, 0x73, 0x47, 0x78, 0x75, 0xb3, 0xa3, 0x1d, 0x9e, 0x7d, 0x9e, 0x87, 0x05,
-	0xf1, 0xc3, 0x2e, 0xac, 0x97, 0xec, 0x95, 0x82, 0x55, 0xda, 0x29, 0x58, 0x65, 0xfb, 0x5e, 0xf9,
-	0xc3, 0x7c, 0x86, 0x9c, 0x05, 0xa2, 0x42, 0xec, 0xcd, 0x8d, 0xad, 0xe2, 0x4a, 0x3e, 0x7b, 0xcd,
-	0x85, 0x7c, 0xd2, 0x91, 0xa0, 0xe7, 0x38, 0x69, 0x6d, 0xad, 0xaf, 0xf3, 0x5e, 0x9f, 0x85, 0xc9,
-	0x8d, 0xcd, 0x95, 0xb2, 0x25, 0x3c, 0xe8, 0xd1, 0x65, 0x7e, 0x6b, 0xbd, 0xb0, 0xb5, 0xb9, 0xb2,
-	0x61, 0x55, 0xbe, 0xc2, 0xba, 0x9f, 0x2c, 0xc0, 0x7c, 0x6d, 0xb5, 0x50, 0xbc, 0x67, 0xaf, 0x6f,
-	0x6c, 0xda, 0x95, 0x75, 0xbb, 0xb8, 0x52, 0x58, 0x5f, 0x2f, 0xaf, 0xe6, 0xe1, 0xda, 0xbf, 0x34,
-	0xe0, 0xb9, 0x01, 0xba, 0x39, 0x79, 0x03, 0xae, 0xae, 0x94, 0x0b, 0xa5, 0xd5, 0x72, 0xad, 0x66,
-	0x33, 0x96, 0xe5, 0xf5, 0x4d, 0x71, 0xb2, 0xb3, 0x6b, 0x9b, 0x85, 0xcd, 0xa4, 0x04, 0x5e, 0x85,
-	0x57, 0x06, 0xa3, 0xc7, 0xc2, 0x72, 0x05, 0x5e, 0x1e, 0x8c, 0x2a, 0x84, 0x27, 0x43, 0xae, 0xc1,
-	0xe5, 0xc1, 0x98, 0x91, 0xd0, 0x65, 0x97, 0xdf, 0xfd, 0xfd, 0x3f, 0x7c, 0xf1, 0xd4, 0xef, 0xff,
-	0xd1, 0x8b, 0xc6, 0x1f, 0xfc, 0xd1, 0x8b, 0xc6, 0xbf, 0xf9, 0xa3, 0x17, 0x8d, 0xaf, 0xbc, 0x76,
-	0x82, 0x1c, 0x87, 0xbb, 0x63, 0x68, 0x3a, 0xb8, 0xf5, 0xff, 0x04, 0x00, 0x00, 0xff, 0xff, 0x6a,
-	0x55, 0x0b, 0x55, 0x9f, 0x45, 0x01, 0x00,
+	0x76, 0x18, 0x86, 0xa3, 0xba, 0xe7, 0xa3, 0xe7, 0xcd, 0x57, 0x4f, 0x62, 0x00, 0x0c, 0xb0, 0x58,
+	0x0c, 0xb6, 0x76, 0x17, 0x0b, 0x60, 0x77, 0x81, 0xc3, 0xe0, 0x16, 0x77, 0xb8, 0xfd, 0xba, 0x9e,
+	0xee, 0x01, 0xa6, 0x81, 0xf9, 0xe8, 0xab, 0x9e, 0x8f, 0xdb, 0xdb, 0x3b, 0xd6, 0xd5, 0x74, 0xe7,
+	0xcc, 0xd4, 0xa2, 0xbb, 0xab, 0xaf, 0xaa, 0x1a, 0xc0, 0x1c, 0xc5, 0x1f, 0x3f, 0x24, 0xea, 0x7e,
+	0x34, 0x3f, 0x8e, 0x27, 0x1f, 0xc9, 0x93, 0x25, 0x99, 0x0c, 0x86, 0x24, 0x93, 0x96, 0xc8, 0x90,
+	0x25, 0x45, 0xc8, 0x0e, 0xd9, 0xb4, 0xa9, 0x50, 0x30, 0x28, 0x29, 0x64, 0xd1, 0x11, 0xfe, 0x08,
+	0x9f, 0x15, 0x63, 0x91, 0xb4, 0x1c, 0x36, 0xc2, 0xa1, 0xb0, 0x83, 0x11, 0x8c, 0xf0, 0x39, 0x28,
+	0x3b, 0xf2, 0x65, 0x66, 0x55, 0x66, 0x75, 0x75, 0x4f, 0xcf, 0x02, 0x1b, 0x24, 0xd6, 0xfe, 0x07,
+	0x98, 0x7e, 0xf9, 0xde, 0xcb, 0xac, 0xcc, 0x97, 0x99, 0x2f, 0x5f, 0xbe, 0xf7, 0x12, 0x5e, 0x0a,
+	0x69, 0x83, 0xb6, 0x3d, 0x3f, 0xbc, 0xde, 0xa0, 0x7b, 0x4e, 0xed, 0xe0, 0x7a, 0x78, 0xd0, 0xa6,
+	0x01, 0xff, 0xf7, 0x5a, 0xdb, 0xf7, 0x42, 0x8f, 0x0c, 0xe3, 0x8f, 0x73, 0xb3, 0x7b, 0xde, 0x9e,
+	0x87, 0x90, 0xeb, 0xec, 0x2f, 0x5e, 0x78, 0x6e, 0x7e, 0xcf, 0xf3, 0xf6, 0x1a, 0xf4, 0x3a, 0xfe,
+	0xda, 0xe9, 0xec, 0x5e, 0x0f, 0xdd, 0x26, 0x0d, 0x42, 0xa7, 0xd9, 0x16, 0x08, 0x57, 0xa2, 0x0a,
+	0x9c, 0x30, 0x64, 0x25, 0xa1, 0xeb, 0xb5, 0xae, 0x3f, 0xbc, 0xa1, 0xfe, 0x14, 0xa8, 0x6f, 0xa6,
+	0xb7, 0xe5, 0x91, 0xef, 0xb4, 0xdb, 0xd4, 0x8f, 0xff, 0xe0, 0xe8, 0xe6, 0x3f, 0xc8, 0xc2, 0xd8,
+	0x7d, 0x4a, 0xdb, 0x85, 0x86, 0xfb, 0x90, 0x92, 0x97, 0x61, 0x68, 0xcd, 0x69, 0xd2, 0x39, 0xe3,
+	0xa2, 0x71, 0x79, 0x6c, 0x71, 0xfa, 0xc9, 0xe1, 0xfc, 0x78, 0x40, 0xfd, 0x87, 0xd4, 0xb7, 0x5b,
+	0x4e, 0x93, 0x5a, 0x58, 0x48, 0x5e, 0x87, 0x31, 0xf6, 0x7f, 0xd0, 0x76, 0x6a, 0x74, 0x2e, 0x83,
+	0x98, 0x93, 0x4f, 0x0e, 0xe7, 0xc7, 0x5a, 0x12, 0x68, 0xc5, 0xe5, 0xe4, 0x12, 0x8c, 0xae, 0x50,
+	0x27, 0xa0, 0xe5, 0xd2, 0x5c, 0xf6, 0xa2, 0x71, 0x39, 0xbb, 0x38, 0xf1, 0xe4, 0x70, 0x3e, 0xd7,
+	0x60, 0x20, 0xdb, 0xad, 0x5b, 0xb2, 0x90, 0x94, 0x61, 0x74, 0xe9, 0x71, 0xdb, 0xf5, 0x69, 0x30,
+	0x37, 0x74, 0xd1, 0xb8, 0x3c, 0xbe, 0x70, 0xee, 0x1a, 0xef, 0x94, 0x6b, 0xb2, 0x53, 0xae, 0x6d,
+	0xc8, 0x4e, 0x59, 0x3c, 0xf9, 0xbb, 0x87, 0xf3, 0x27, 0x9e, 0x1c, 0xce, 0x8f, 0x52, 0x4e, 0xf2,
+	0xf3, 0xff, 0xe3, 0xbc, 0x61, 0x49, 0x7a, 0xf2, 0x0e, 0x0c, 0x6d, 0x1c, 0xb4, 0xe9, 0xdc, 0xd8,
+	0x45, 0xe3, 0xf2, 0xd4, 0xc2, 0x85, 0x6b, 0x7c, 0x18, 0xa2, 0x8f, 0x8c, 0xff, 0x62, 0x58, 0x8b,
+	0xb9, 0x27, 0x87, 0xf3, 0x43, 0x0c, 0xc5, 0x42, 0x2a, 0xf2, 0x26, 0x8c, 0x2c, 0x7b, 0x41, 0x58,
+	0x2e, 0xcd, 0x01, 0x7e, 0xda, 0xa9, 0x27, 0x87, 0xf3, 0x33, 0xfb, 0x5e, 0x10, 0xda, 0x6e, 0xfd,
+	0x0d, 0xaf, 0xe9, 0x86, 0xb4, 0xd9, 0x0e, 0x0f, 0x2c, 0x81, 0x64, 0x3e, 0x86, 0x49, 0x8d, 0x1f,
+	0x19, 0x87, 0xd1, 0xcd, 0xb5, 0xfb, 0x6b, 0xeb, 0xdb, 0x6b, 0xf9, 0x13, 0x24, 0x07, 0x43, 0x6b,
+	0xeb, 0xa5, 0xa5, 0xbc, 0x41, 0x46, 0x21, 0x5b, 0xa8, 0x54, 0xf2, 0x19, 0x32, 0x01, 0xb9, 0x52,
+	0x61, 0xa3, 0xb0, 0x58, 0xa8, 0x2e, 0xe5, 0xb3, 0xe4, 0x24, 0x4c, 0x6f, 0x97, 0xd7, 0x4a, 0xeb,
+	0xdb, 0x55, 0xbb, 0xb4, 0x54, 0xbd, 0xbf, 0xb1, 0x5e, 0xc9, 0x0f, 0x91, 0x29, 0x80, 0xfb, 0x9b,
+	0x8b, 0x4b, 0xd6, 0xda, 0xd2, 0xc6, 0x52, 0x35, 0x3f, 0x4c, 0x66, 0x21, 0x2f, 0x49, 0xec, 0xea,
+	0x92, 0xb5, 0x55, 0x2e, 0x2e, 0xe5, 0x47, 0xcc, 0x6f, 0x65, 0x21, 0xb7, 0x4a, 0x43, 0xa7, 0xee,
+	0x84, 0x0e, 0x39, 0xaf, 0x0d, 0x1c, 0x7e, 0x93, 0x32, 0x62, 0x2f, 0x77, 0x8f, 0xd8, 0xf0, 0x93,
+	0xc3, 0x79, 0xe3, 0x4d, 0x75, 0xa4, 0xde, 0x86, 0xf1, 0x12, 0x0d, 0x6a, 0xbe, 0xdb, 0x66, 0xd2,
+	0x84, 0xa3, 0x35, 0xb6, 0x78, 0xf6, 0xc9, 0xe1, 0xfc, 0xa9, 0x7a, 0x0c, 0x56, 0x7a, 0x40, 0xc5,
+	0x26, 0x65, 0x18, 0x59, 0x71, 0x76, 0x68, 0x23, 0x98, 0x1b, 0xbe, 0x98, 0xbd, 0x3c, 0xbe, 0xf0,
+	0x82, 0xe8, 0x75, 0xd9, 0xc0, 0x6b, 0xbc, 0x74, 0xa9, 0x15, 0xfa, 0x07, 0x8b, 0xb3, 0x4f, 0x0e,
+	0xe7, 0xf3, 0x0d, 0x04, 0xa8, 0x3d, 0xca, 0x51, 0x48, 0x35, 0x96, 0x84, 0x91, 0x23, 0x25, 0xe1,
+	0xc5, 0xdf, 0x3d, 0x9c, 0x37, 0xd8, 0x08, 0x09, 0x49, 0x88, 0xf9, 0xe9, 0x32, 0x71, 0x11, 0x32,
+	0xe5, 0xd2, 0xdc, 0x28, 0x4a, 0x60, 0xfe, 0xc9, 0xe1, 0xfc, 0x84, 0x36, 0x98, 0x99, 0x72, 0xe9,
+	0xdc, 0x6d, 0x18, 0x57, 0xda, 0x48, 0xf2, 0x90, 0x7d, 0x40, 0x0f, 0x78, 0x7f, 0x5a, 0xec, 0x4f,
+	0x32, 0x0b, 0xc3, 0x0f, 0x9d, 0x46, 0x47, 0x74, 0xa0, 0xc5, 0x7f, 0x7c, 0x21, 0xf3, 0x79, 0xc3,
+	0xfc, 0x4b, 0x43, 0x90, 0xb3, 0x3c, 0x3e, 0x0b, 0xc9, 0x15, 0x18, 0xae, 0x86, 0x4e, 0x28, 0x87,
+	0xe2, 0xe4, 0x93, 0xc3, 0xf9, 0x69, 0x36, 0x43, 0xa9, 0x52, 0x1f, 0xc7, 0x60, 0xa8, 0x95, 0x7d,
+	0x27, 0x90, 0x43, 0x82, 0xa8, 0x6d, 0x06, 0x50, 0x51, 0x11, 0x83, 0x5c, 0x82, 0xa1, 0x55, 0xaf,
+	0x4e, 0xc5, 0xa8, 0x90, 0x27, 0x87, 0xf3, 0x53, 0x4d, 0xaf, 0xae, 0x22, 0x62, 0x39, 0x79, 0x03,
+	0xc6, 0x8a, 0x1d, 0xdf, 0xa7, 0x2d, 0x26, 0xc0, 0x43, 0x88, 0x3c, 0xf5, 0xe4, 0x70, 0x1e, 0x6a,
+	0x1c, 0xc8, 0xa6, 0x5c, 0x8c, 0xc0, 0xba, 0xba, 0x1a, 0x3a, 0x7e, 0x48, 0xeb, 0x73, 0xc3, 0x03,
+	0x75, 0x35, 0x9b, 0x74, 0x33, 0x01, 0x27, 0x49, 0x76, 0xb5, 0xe0, 0x44, 0x96, 0x61, 0xfc, 0xae,
+	0xef, 0xd4, 0x68, 0x85, 0xfa, 0xae, 0x57, 0xc7, 0x31, 0xcc, 0x2e, 0x5e, 0x7a, 0x72, 0x38, 0x7f,
+	0x7a, 0x8f, 0x81, 0xed, 0x36, 0xc2, 0x63, 0xea, 0x1f, 0x1c, 0xce, 0xe7, 0x4a, 0x1d, 0x1f, 0x7b,
+	0xcf, 0x52, 0x49, 0xc9, 0xd7, 0xd9, 0x90, 0x04, 0x21, 0x76, 0x2d, 0xad, 0xe3, 0xe8, 0xf5, 0x6f,
+	0xa2, 0x29, 0x9a, 0x78, 0xba, 0xe1, 0x04, 0xa1, 0xed, 0x73, 0xba, 0x44, 0x3b, 0x55, 0x96, 0x64,
+	0x1d, 0x72, 0xd5, 0xda, 0x3e, 0xad, 0x77, 0x1a, 0x74, 0x2e, 0x87, 0xec, 0xcf, 0x08, 0xc1, 0x95,
+	0xe3, 0x29, 0x8b, 0x17, 0xcf, 0x09, 0xde, 0x24, 0x10, 0x10, 0xa5, 0xef, 0x23, 0x26, 0x5f, 0xc8,
+	0x7d, 0xef, 0x57, 0xe6, 0x4f, 0xfc, 0xd8, 0xbf, 0xbc, 0x78, 0xc2, 0xfc, 0x07, 0x19, 0xc8, 0x27,
+	0x99, 0x90, 0x5d, 0x98, 0xdc, 0x6c, 0xd7, 0x9d, 0x90, 0x16, 0x1b, 0x2e, 0x6d, 0x85, 0x01, 0x0a,
+	0x49, 0xff, 0x6f, 0x7a, 0x45, 0xd4, 0x3b, 0xd7, 0x41, 0x42, 0xbb, 0xc6, 0x29, 0x13, 0x5f, 0xa5,
+	0xb3, 0x8d, 0xeb, 0xa9, 0xe2, 0xea, 0x1d, 0xa0, 0x84, 0x1d, 0xaf, 0x1e, 0xbe, 0xee, 0xf7, 0xa8,
+	0x47, 0xb0, 0x15, 0x02, 0xd4, 0xaa, 0xef, 0x1c, 0xa0, 0x64, 0x0e, 0x2e, 0x40, 0x8c, 0x24, 0x45,
+	0x80, 0x18, 0xd8, 0xfc, 0x9f, 0x0c, 0x98, 0xb2, 0x68, 0xe0, 0x75, 0xfc, 0x1a, 0x5d, 0xa6, 0x4e,
+	0x9d, 0xfa, 0x4c, 0xfc, 0xef, 0xbb, 0xad, 0xba, 0x98, 0x53, 0x28, 0xfe, 0x0f, 0xdc, 0x96, 0x3a,
+	0x85, 0xb1, 0x9c, 0x7c, 0x06, 0x46, 0xab, 0x9d, 0x1d, 0x44, 0xe5, 0x73, 0xea, 0x34, 0x8e, 0x58,
+	0x67, 0xc7, 0x4e, 0xa0, 0x4b, 0x34, 0x72, 0x1d, 0x46, 0xb7, 0xa8, 0x1f, 0xc4, 0x2b, 0x1e, 0xae,
+	0xf7, 0x0f, 0x39, 0x48, 0x25, 0x10, 0x58, 0xe4, 0x6e, 0xbc, 0xea, 0x8a, 0x9d, 0x6a, 0x3a, 0xb1,
+	0xd6, 0xc5, 0xa2, 0xd2, 0x14, 0x10, 0x55, 0x54, 0x24, 0x96, 0xf9, 0x9d, 0x0c, 0xe4, 0x4b, 0x4e,
+	0xe8, 0xec, 0x38, 0x81, 0xe8, 0xcf, 0xad, 0x9b, 0x6c, 0x1d, 0x57, 0x3e, 0x14, 0xd7, 0x71, 0xd6,
+	0xf2, 0x8f, 0xfd, 0x79, 0xaf, 0x26, 0x3f, 0x6f, 0x9c, 0x6d, 0x9b, 0xe2, 0xf3, 0xe2, 0x8f, 0x7a,
+	0xf7, 0xe8, 0x8f, 0xca, 0x8b, 0x8f, 0xca, 0xc9, 0x8f, 0x8a, 0x3f, 0x85, 0xbc, 0x0b, 0x43, 0xd5,
+	0x36, 0xad, 0x89, 0x45, 0x44, 0xae, 0xfd, 0xfa, 0xc7, 0x31, 0x84, 0xad, 0x9b, 0x8b, 0x13, 0x82,
+	0xcd, 0x50, 0xd0, 0xa6, 0x35, 0x0b, 0xc9, 0x94, 0x49, 0xf3, 0x4f, 0x46, 0x60, 0x36, 0x8d, 0x8c,
+	0xbc, 0xab, 0x6f, 0x4e, 0xbc, 0x7b, 0x5e, 0xe8, 0xb9, 0x39, 0xcd, 0x19, 0xfa, 0xf6, 0x74, 0x15,
+	0x72, 0x15, 0x26, 0x90, 0x35, 0xaf, 0x21, 0x7a, 0x8e, 0xad, 0x8a, 0xb9, 0xb6, 0x84, 0x19, 0x56,
+	0x54, 0x4e, 0x5e, 0x80, 0xec, 0xa6, 0x55, 0x16, 0xdd, 0x35, 0xf6, 0xe4, 0x70, 0x3e, 0xdb, 0xf1,
+	0xdd, 0x39, 0xc3, 0x62, 0x50, 0x72, 0x1d, 0x46, 0x8a, 0x85, 0x22, 0xf5, 0x43, 0xec, 0xa6, 0x89,
+	0xc5, 0x33, 0x4c, 0x5a, 0x6a, 0x8e, 0x5d, 0xa3, 0x7e, 0xa8, 0x55, 0x2f, 0xd0, 0xc8, 0xeb, 0x90,
+	0x2d, 0x6c, 0x57, 0x45, 0xcf, 0x80, 0xe8, 0x99, 0xc2, 0x76, 0x75, 0x71, 0x52, 0x74, 0x44, 0xd6,
+	0x79, 0x14, 0x30, 0xee, 0x85, 0xed, 0xaa, 0x3a, 0x5a, 0x23, 0x7d, 0x46, 0xeb, 0x32, 0xe4, 0x98,
+	0xf6, 0xc1, 0x36, 0x78, 0x5c, 0x14, 0xc7, 0xb8, 0x52, 0xb5, 0x2f, 0x60, 0x56, 0x54, 0x4a, 0x5e,
+	0x8e, 0x94, 0x99, 0x5c, 0xcc, 0x4f, 0x28, 0x33, 0x52, 0x85, 0x21, 0x8f, 0x61, 0xb2, 0x74, 0xd0,
+	0x72, 0x9a, 0x6e, 0x4d, 0x6c, 0xe1, 0x63, 0xb8, 0x85, 0x5f, 0xeb, 0x33, 0x8c, 0xd7, 0x34, 0x02,
+	0xbe, 0xab, 0xcb, 0xc5, 0x77, 0xae, 0xce, 0xcb, 0xec, 0xe4, 0x0e, 0x3f, 0x67, 0x58, 0x7a, 0x45,
+	0x6c, 0x2e, 0xc9, 0x25, 0x12, 0xb5, 0xad, 0x58, 0xec, 0x24, 0x38, 0x9e, 0x4b, 0xbe, 0x80, 0xa8,
+	0x73, 0x29, 0xda, 0x74, 0xdf, 0x85, 0xec, 0xdd, 0x62, 0x65, 0x6e, 0x1c, 0x79, 0x10, 0xc1, 0xe3,
+	0x6e, 0xb1, 0x52, 0x6c, 0x78, 0x9d, 0x7a, 0xf5, 0x4b, 0x2b, 0x8b, 0x67, 0x04, 0x9b, 0xc9, 0xbd,
+	0x5a, 0x5b, 0x6b, 0x11, 0xa3, 0x23, 0x4b, 0x90, 0x93, 0x5f, 0x39, 0x37, 0x81, 0x3c, 0x66, 0x12,
+	0x1f, 0xbf, 0x75, 0x93, 0xcf, 0xb5, 0xba, 0xf8, 0xad, 0xb6, 0x42, 0xe2, 0x90, 0x9b, 0x28, 0x65,
+	0x8f, 0x0f, 0xca, 0xa5, 0x60, 0x6e, 0xf2, 0x62, 0xf6, 0xf2, 0x18, 0x8a, 0xc7, 0xc9, 0x36, 0x83,
+	0xd9, 0x6e, 0x5d, 0x55, 0x76, 0x22, 0xc4, 0x73, 0xdb, 0x40, 0xba, 0x3b, 0x33, 0x45, 0xfd, 0x78,
+	0x5d, 0x55, 0x3f, 0xc6, 0x17, 0x4e, 0x89, 0x06, 0x16, 0xbd, 0x66, 0xd3, 0x69, 0xd5, 0x91, 0x76,
+	0x6b, 0x41, 0xd5, 0x4a, 0x0a, 0x30, 0x15, 0xb7, 0x7e, 0xc5, 0x0d, 0x42, 0x72, 0x1d, 0xc6, 0x24,
+	0x84, 0xed, 0x3c, 0xd9, 0xd4, 0xef, 0xb4, 0x62, 0x1c, 0xf3, 0x77, 0x32, 0x00, 0x71, 0xc9, 0x73,
+	0xba, 0x38, 0x7d, 0x4e, 0x5b, 0x9c, 0x4e, 0x25, 0xa5, 0xba, 0xe7, 0xb2, 0x44, 0xde, 0x87, 0x11,
+	0xa6, 0xa7, 0x75, 0xa4, 0x1e, 0x7a, 0x26, 0x49, 0x8a, 0x85, 0x5b, 0x37, 0x17, 0xa7, 0x04, 0xf1,
+	0x48, 0x80, 0x10, 0x4b, 0x90, 0x29, 0xeb, 0xda, 0x7f, 0x3b, 0x12, 0x0f, 0x86, 0x58, 0xd1, 0x2e,
+	0x2b, 0x4b, 0x92, 0x11, 0x4f, 0x62, 0xb9, 0x24, 0x29, 0x0b, 0xd2, 0x59, 0xbe, 0x20, 0xf1, 0x4e,
+	0x1d, 0x15, 0x0b, 0x52, 0x72, 0x39, 0xe2, 0x1d, 0x78, 0xe4, 0x72, 0xd4, 0x4e, 0xce, 0xf5, 0x21,
+	0x14, 0x83, 0xcb, 0xa9, 0xbd, 0x92, 0x36, 0xcb, 0x2f, 0x1e, 0x35, 0xcb, 0x93, 0x73, 0xfc, 0x66,
+	0xaf, 0x05, 0xf0, 0x94, 0x9c, 0x92, 0xce, 0x23, 0x95, 0x1c, 0x17, 0xc2, 0xb7, 0xf9, 0x7c, 0x1e,
+	0xe9, 0x39, 0x9f, 0x4f, 0xa5, 0xce, 0x67, 0x3e, 0x9b, 0xdf, 0x86, 0xe1, 0xc2, 0x37, 0x3b, 0x3e,
+	0x15, 0x0a, 0xe3, 0x84, 0xac, 0x93, 0xc1, 0xa2, 0x85, 0x60, 0xda, 0x61, 0x3f, 0x55, 0x45, 0x1b,
+	0xcb, 0x59, 0xcd, 0x1b, 0x2b, 0x55, 0xa1, 0x0c, 0x92, 0x44, 0xb7, 0x6c, 0xac, 0x28, 0xcd, 0x0e,
+	0xb5, 0xaf, 0x66, 0x54, 0xe4, 0x3a, 0x64, 0x0a, 0x25, 0x3c, 0x77, 0x8e, 0x2f, 0x8c, 0xc9, 0x6a,
+	0x4b, 0x8b, 0xb3, 0x82, 0x64, 0xc2, 0xd1, 0x0e, 0x1d, 0x85, 0x12, 0x59, 0x84, 0xe1, 0xd5, 0x83,
+	0xea, 0x97, 0x56, 0xc4, 0xea, 0x77, 0x52, 0xca, 0x35, 0x83, 0xad, 0xe3, 0xd6, 0x15, 0xc4, 0x2d,
+	0x6e, 0x1e, 0x04, 0xdf, 0x68, 0xa8, 0x2d, 0x46, 0x34, 0x52, 0x81, 0xb1, 0x42, 0xbd, 0xe9, 0xb6,
+	0x36, 0x03, 0xea, 0x8b, 0x15, 0x70, 0x2e, 0xd1, 0xee, 0xa8, 0x7c, 0x71, 0xee, 0xc9, 0xe1, 0xfc,
+	0xac, 0xc3, 0x7e, 0xda, 0x9d, 0x80, 0xfa, 0x0a, 0xb7, 0x98, 0x09, 0xa9, 0x00, 0xac, 0x7a, 0xad,
+	0x3d, 0xaf, 0x10, 0x36, 0x9c, 0x20, 0xb1, 0x20, 0xc6, 0x05, 0x91, 0x3e, 0x77, 0xaa, 0xc9, 0x60,
+	0xb6, 0xc3, 0x80, 0x0a, 0x43, 0x85, 0xc7, 0x27, 0xb7, 0xc8, 0xdd, 0x80, 0x99, 0xae, 0x8f, 0xec,
+	0x7f, 0x18, 0x36, 0xff, 0xba, 0xaa, 0x77, 0x89, 0x29, 0xcc, 0x4e, 0xfd, 0x62, 0x22, 0x19, 0xb1,
+	0x16, 0xd8, 0x35, 0x91, 0xa2, 0x69, 0x74, 0x85, 0x0b, 0x75, 0xa6, 0x4b, 0xa8, 0xc7, 0x95, 0x5d,
+	0x9d, 0x8b, 0x72, 0x34, 0xc4, 0xd9, 0x8f, 0x3f, 0xc4, 0xef, 0xc3, 0xc4, 0xaa, 0xd3, 0x72, 0xf6,
+	0x68, 0x9d, 0x7d, 0x1f, 0x9f, 0xb4, 0x5c, 0xfd, 0x39, 0xd3, 0xe4, 0x70, 0x1c, 0x4d, 0xb5, 0xf7,
+	0x35, 0x02, 0x72, 0x43, 0x4e, 0x89, 0xe1, 0x94, 0x29, 0x21, 0x35, 0x91, 0x61, 0x9c, 0x12, 0x62,
+	0x22, 0x98, 0xff, 0xeb, 0x08, 0x7e, 0x23, 0x79, 0x03, 0x46, 0x2c, 0xba, 0x17, 0x2b, 0x5d, 0x78,
+	0x78, 0xf7, 0x11, 0xa2, 0x76, 0x0c, 0xc7, 0xc1, 0x1d, 0x9d, 0xd6, 0x83, 0x7d, 0x77, 0x37, 0x14,
+	0xbd, 0x13, 0xed, 0xe8, 0x02, 0xac, 0xec, 0xe8, 0x02, 0xa2, 0xed, 0xe8, 0x02, 0xc6, 0x96, 0x0d,
+	0xab, 0x54, 0x15, 0x9d, 0x26, 0x7b, 0xd8, 0x2a, 0x29, 0xf3, 0xcf, 0xd7, 0x36, 0x54, 0x86, 0x4d,
+	0x6e, 0xc1, 0x58, 0xa1, 0x56, 0xf3, 0x3a, 0xca, 0xe9, 0x97, 0x0b, 0x3c, 0x07, 0xea, 0x16, 0x9c,
+	0x18, 0x95, 0x54, 0x61, 0x7c, 0x89, 0x1d, 0x19, 0xdd, 0xa2, 0x53, 0xdb, 0x97, 0x9d, 0x24, 0x27,
+	0xbf, 0x52, 0x12, 0x8b, 0x3c, 0x45, 0x60, 0x8d, 0x01, 0x55, 0x93, 0x88, 0x82, 0x4b, 0x36, 0x60,
+	0xbc, 0x4a, 0x6b, 0x3e, 0x0d, 0xab, 0xa1, 0xe7, 0xd3, 0xc4, 0x5a, 0xa6, 0x94, 0x2c, 0x5e, 0x90,
+	0xa7, 0xd6, 0x00, 0x81, 0x76, 0xc0, 0xa0, 0x2a, 0x57, 0x05, 0x99, 0x1f, 0x3f, 0x9a, 0x9e, 0x7f,
+	0x50, 0x5a, 0x14, 0xeb, 0x5b, 0xbc, 0x19, 0x72, 0xb0, 0x7a, 0xfc, 0x60, 0x90, 0xfa, 0x8e, 0x7e,
+	0xfc, 0xe0, 0x58, 0x38, 0x52, 0xa5, 0x2a, 0xaa, 0x21, 0x62, 0xb5, 0x9b, 0x8e, 0x7b, 0x19, 0xc1,
+	0xca, 0x48, 0xd5, 0x03, 0x54, 0x62, 0xb4, 0x91, 0x12, 0x58, 0xa4, 0x0d, 0x44, 0x8e, 0x1a, 0x57,
+	0x11, 0x1b, 0x34, 0x08, 0xc4, 0x22, 0x78, 0x36, 0x31, 0xf8, 0x31, 0xc2, 0xe2, 0xab, 0x82, 0xf9,
+	0x8b, 0x52, 0x0c, 0xc4, 0x89, 0x93, 0x15, 0x2a, 0xf5, 0xa4, 0xf0, 0x26, 0xb7, 0x01, 0x96, 0x1e,
+	0x87, 0xd4, 0x6f, 0x39, 0x8d, 0xc8, 0x4c, 0x87, 0x86, 0x2a, 0x2a, 0xa0, 0xfa, 0x40, 0x2b, 0xc8,
+	0xa4, 0x08, 0x93, 0x85, 0x20, 0xe8, 0x34, 0xa9, 0xe5, 0x35, 0x68, 0xc1, 0x5a, 0xc3, 0x05, 0x73,
+	0x6c, 0xf1, 0xc5, 0x27, 0x87, 0xf3, 0x67, 0x1d, 0x2c, 0xb0, 0x7d, 0xaf, 0x41, 0x6d, 0xc7, 0x57,
+	0xa5, 0x5b, 0xa7, 0x21, 0xeb, 0x00, 0xeb, 0x6d, 0xda, 0xaa, 0x52, 0xc7, 0xaf, 0xed, 0x27, 0xd6,
+	0xc7, 0xb8, 0x60, 0xf1, 0xbc, 0xf8, 0xc2, 0x59, 0xaf, 0x4d, 0x5b, 0x01, 0xc2, 0xd4, 0x56, 0xc5,
+	0x98, 0xe6, 0x0f, 0x6b, 0xa2, 0xc2, 0xc4, 0xf8, 0x3e, 0x3d, 0xa8, 0xf8, 0x74, 0xd7, 0x7d, 0x2c,
+	0x66, 0x1d, 0x8a, 0xf1, 0x03, 0x7a, 0x60, 0xb7, 0x11, 0xaa, 0x8a, 0x71, 0x84, 0x4a, 0x3e, 0x0b,
+	0xb9, 0xfb, 0xab, 0xd5, 0xfb, 0xf4, 0xa0, 0x5c, 0x12, 0xda, 0x02, 0x27, 0x6b, 0x06, 0x36, 0x23,
+	0xd5, 0x3a, 0x25, 0xc2, 0x34, 0x17, 0xe3, 0x29, 0xcb, 0x6a, 0x2e, 0x36, 0x3a, 0x41, 0x48, 0xfd,
+	0x72, 0x49, 0xad, 0xb9, 0xc6, 0x81, 0x89, 0x09, 0x14, 0xa1, 0x9a, 0x3f, 0x93, 0xc1, 0xe9, 0xca,
+	0x46, 0xa6, 0xdc, 0x62, 0xc7, 0xfb, 0x1a, 0x8d, 0x18, 0xe0, 0xc8, 0xb8, 0x02, 0x9a, 0x18, 0x99,
+	0x18, 0x59, 0xaf, 0x3a, 0x33, 0x70, 0xd5, 0xac, 0x4a, 0x69, 0x2c, 0x10, 0x36, 0x66, 0x51, 0xa5,
+	0x2f, 0xa0, 0x89, 0x2a, 0x63, 0x64, 0x72, 0x09, 0x46, 0xcb, 0x85, 0xd5, 0x42, 0x27, 0xdc, 0xc7,
+	0xc5, 0x22, 0xc7, 0x35, 0x30, 0xd7, 0x69, 0xda, 0x4e, 0x27, 0xdc, 0xb7, 0x64, 0x21, 0xb9, 0x8e,
+	0x9a, 0x6d, 0x8b, 0x86, 0xdc, 0xba, 0x29, 0x76, 0x87, 0x80, 0x83, 0x12, 0x8a, 0x2d, 0x03, 0x99,
+	0xbf, 0x6d, 0xc4, 0x93, 0x8b, 0x5c, 0xd2, 0x76, 0x23, 0xb4, 0x5d, 0xb0, 0xdd, 0x48, 0xb5, 0x5d,
+	0xa0, 0x91, 0xd6, 0x02, 0x52, 0xec, 0x04, 0xa1, 0xd7, 0x5c, 0x6a, 0xd5, 0xdb, 0x9e, 0xdb, 0x0a,
+	0x91, 0x8a, 0xf7, 0x84, 0xf9, 0xe4, 0x70, 0xfe, 0x42, 0x0d, 0x4b, 0x6d, 0x2a, 0x8a, 0xed, 0x04,
+	0x97, 0x14, 0xea, 0xa7, 0xe8, 0x1c, 0xf3, 0x9f, 0x66, 0xb4, 0x45, 0x91, 0x35, 0xcf, 0xa2, 0xed,
+	0x86, 0x5b, 0xc3, 0x13, 0xd7, 0x5d, 0xdf, 0xeb, 0xb4, 0xa3, 0x21, 0xc6, 0xe6, 0xf9, 0x71, 0xa9,
+	0xbd, 0xc7, 0x8a, 0x75, 0xde, 0x29, 0xd4, 0xe4, 0x8b, 0x30, 0xc1, 0xf6, 0x27, 0xf1, 0x33, 0x98,
+	0xcb, 0x60, 0xef, 0x9e, 0x47, 0x2b, 0x54, 0x40, 0xfd, 0x88, 0x8d, 0xb6, 0xb1, 0xa9, 0x14, 0xa4,
+	0x0e, 0x73, 0x1b, 0xbe, 0xd3, 0x0a, 0xdc, 0x70, 0xa9, 0x55, 0xf3, 0x0f, 0x70, 0x3f, 0x5d, 0x6a,
+	0x39, 0x3b, 0x0d, 0x5a, 0xc7, 0xcf, 0xcd, 0x2d, 0x5e, 0x7e, 0x72, 0x38, 0xff, 0x4a, 0xc8, 0x71,
+	0x6c, 0x1a, 0x21, 0xd9, 0x94, 0x63, 0x29, 0x9c, 0x7b, 0x72, 0x62, 0xfb, 0xaf, 0xec, 0x56, 0xbc,
+	0x59, 0x18, 0x8a, 0xcc, 0x0f, 0x67, 0xa2, 0xd1, 0x60, 0xd3, 0x5f, 0x6d, 0xa6, 0x4a, 0x60, 0xfe,
+	0xb1, 0x11, 0x2f, 0xdb, 0xe4, 0x1d, 0x18, 0x17, 0xe2, 0xab, 0xc8, 0xc5, 0x39, 0xb6, 0x01, 0x48,
+	0x59, 0x4f, 0x8c, 0xac, 0x8a, 0xce, 0x8e, 0x59, 0x85, 0xe2, 0x8a, 0x22, 0x1b, 0x78, 0xcc, 0x72,
+	0x6a, 0x8d, 0x24, 0x95, 0x44, 0x63, 0x42, 0xb0, 0xb1, 0x52, 0xd5, 0x7b, 0x05, 0x85, 0x20, 0x6c,
+	0x04, 0x29, 0xdd, 0xa0, 0x20, 0x3f, 0xfd, 0x87, 0xff, 0x77, 0x46, 0xda, 0xee, 0x40, 0x16, 0x61,
+	0x72, 0xdb, 0xf3, 0x1f, 0xe0, 0xf8, 0x2a, 0x9d, 0x80, 0x23, 0xff, 0x48, 0x16, 0x24, 0x3f, 0x48,
+	0x27, 0x51, 0xdb, 0xa6, 0xf4, 0x86, 0xde, 0xb6, 0x04, 0x07, 0x8d, 0x80, 0x8d, 0x43, 0xc4, 0x31,
+	0x9a, 0x1d, 0x38, 0x0e, 0x71, 0x13, 0x34, 0x11, 0x56, 0xd1, 0xcd, 0xff, 0xcc, 0x50, 0x77, 0x01,
+	0xd6, 0xc9, 0x25, 0xaf, 0xe9, 0xb8, 0x2d, 0xe5, 0x73, 0xf8, 0xe5, 0x09, 0x42, 0x93, 0x2d, 0x51,
+	0x90, 0xc9, 0x4d, 0xc8, 0xf1, 0x5f, 0xd1, 0xc2, 0x87, 0x66, 0x03, 0x41, 0xa8, 0xaf, 0xda, 0x12,
+	0xb1, 0x6b, 0x64, 0xb2, 0xc7, 0x1d, 0x99, 0x1f, 0x33, 0x60, 0x5c, 0x39, 0x51, 0xb1, 0xf5, 0xb7,
+	0xe2, 0x7b, 0x1f, 0xd1, 0x5a, 0xa8, 0x2f, 0xfd, 0x6d, 0x0e, 0x4c, 0xac, 0xbf, 0x11, 0x6a, 0x62,
+	0xc9, 0xcf, 0x1c, 0x63, 0xc9, 0x37, 0xff, 0x0f, 0x43, 0xa8, 0xa5, 0x03, 0xaf, 0x91, 0xfa, 0x7a,
+	0x96, 0x39, 0xce, 0x62, 0xff, 0x45, 0x18, 0xb6, 0x68, 0xdd, 0x0d, 0x84, 0x4a, 0x39, 0xa3, 0xaa,
+	0xc0, 0x58, 0x10, 0x6b, 0xe1, 0x3e, 0xfb, 0xa9, 0x6a, 0xe1, 0x58, 0xce, 0x74, 0x87, 0x72, 0x70,
+	0xa7, 0x41, 0x1f, 0xbb, 0x5c, 0x92, 0xc5, 0xa6, 0x81, 0xba, 0x83, 0x1b, 0xd8, 0xbb, 0xac, 0x44,
+	0x28, 0x31, 0xaa, 0xd4, 0x6a, 0x34, 0xe6, 0x07, 0x00, 0x71, 0x95, 0xe4, 0x3e, 0xe4, 0xc5, 0xdc,
+	0x76, 0x5b, 0x7b, 0x15, 0xaf, 0xe1, 0xd6, 0xc4, 0x71, 0x68, 0x71, 0xfe, 0xc9, 0xe1, 0xfc, 0x0b,
+	0xb5, 0xa8, 0xcc, 0x6e, 0x63, 0xa1, 0xc2, 0xb7, 0x8b, 0xd0, 0xfc, 0x0f, 0x32, 0xec, 0xf8, 0xc9,
+	0xfa, 0xe8, 0x3e, 0x3d, 0x08, 0x9d, 0x9d, 0x3b, 0x6e, 0x43, 0x93, 0xc4, 0x07, 0x08, 0xb5, 0x77,
+	0x5d, 0xed, 0xee, 0x42, 0x41, 0x66, 0x92, 0x78, 0xdf, 0xdf, 0x79, 0x0b, 0x09, 0x15, 0x49, 0x7c,
+	0xe0, 0xef, 0xbc, 0x95, 0x24, 0x8b, 0x10, 0x89, 0x09, 0x23, 0x5c, 0x2a, 0x85, 0x0c, 0xc2, 0x93,
+	0xc3, 0xf9, 0x11, 0x2e, 0xbc, 0x96, 0x28, 0x21, 0x67, 0x21, 0x5b, 0xad, 0xac, 0x89, 0xe5, 0x03,
+	0x4d, 0x18, 0x41, 0xbb, 0x65, 0x31, 0x18, 0xab, 0x73, 0xa5, 0x54, 0xa8, 0xe0, 0xd9, 0x6b, 0x38,
+	0xae, 0xb3, 0x51, 0x77, 0xda, 0xc9, 0xd3, 0x57, 0x84, 0x48, 0xde, 0x85, 0xf1, 0xfb, 0xa5, 0xe2,
+	0xb2, 0x17, 0xf0, 0xa9, 0x3f, 0x12, 0x0b, 0xff, 0x83, 0x7a, 0xcd, 0x46, 0x03, 0x67, 0x72, 0x0d,
+	0x55, 0xf0, 0xcd, 0xdf, 0x30, 0x60, 0x5c, 0x39, 0xd3, 0x93, 0xcf, 0x8a, 0xdb, 0x35, 0x03, 0x6f,
+	0x8c, 0x4f, 0x77, 0x9f, 0xfa, 0x59, 0x29, 0x3f, 0x48, 0x36, 0xbd, 0x3a, 0x15, 0x77, 0x6d, 0xf1,
+	0x99, 0x31, 0x33, 0xc8, 0x99, 0xf1, 0x36, 0x00, 0x97, 0x01, 0x6c, 0xb2, 0xb2, 0x17, 0x2b, 0x37,
+	0xec, 0xea, 0xb8, 0xc4, 0xc8, 0xa6, 0x05, 0x13, 0xea, 0x79, 0x91, 0x2d, 0x9f, 0xe2, 0xc6, 0x40,
+	0x98, 0xcf, 0x94, 0xe5, 0x53, 0x70, 0xeb, 0xbe, 0xc1, 0xd0, 0x49, 0xcc, 0xcf, 0xaa, 0x87, 0xfc,
+	0x41, 0x27, 0xa0, 0xf9, 0x13, 0x46, 0x3c, 0xdd, 0xb7, 0x6e, 0x90, 0xb7, 0x61, 0x84, 0xdf, 0xd0,
+	0x88, 0x8b, 0xac, 0x53, 0x91, 0xbe, 0xaf, 0x5e, 0xdf, 0x70, 0xeb, 0xda, 0xef, 0xf1, 0x9b, 0xda,
+	0x13, 0x96, 0x20, 0x89, 0x0c, 0x73, 0xfa, 0x59, 0x5f, 0x72, 0x47, 0x13, 0xd4, 0x8d, 0x34, 0xc3,
+	0x9c, 0xf9, 0xef, 0x67, 0x61, 0x4a, 0x47, 0x53, 0xaf, 0x71, 0x8c, 0x81, 0xae, 0x71, 0xbe, 0x08,
+	0x39, 0xd6, 0x1f, 0x6e, 0x8d, 0x4a, 0xb5, 0xe3, 0x15, 0x34, 0x57, 0x0a, 0x98, 0x76, 0x3d, 0x09,
+	0xd5, 0x83, 0x20, 0xa4, 0x4d, 0xa6, 0xfe, 0x5b, 0x11, 0x15, 0x59, 0x50, 0xac, 0xf0, 0xd9, 0x78,
+	0x27, 0x96, 0x56, 0x78, 0x55, 0x6e, 0x23, 0x7b, 0xfc, 0x9b, 0x30, 0xc2, 0x34, 0xca, 0xe8, 0x74,
+	0x8a, 0xad, 0x64, 0xca, 0x66, 0xc2, 0xb9, 0x80, 0x23, 0x91, 0x6d, 0xc8, 0xad, 0x38, 0x41, 0x58,
+	0xa5, 0xb4, 0x35, 0xc0, 0x05, 0xed, 0xbc, 0xe8, 0xaa, 0x93, 0x78, 0xfb, 0x19, 0x50, 0xda, 0x4a,
+	0xdc, 0xb0, 0x45, 0xcc, 0xc8, 0xd7, 0x00, 0x8a, 0x5e, 0x2b, 0xf4, 0xbd, 0xc6, 0x8a, 0xb7, 0x37,
+	0x37, 0x82, 0x36, 0xc0, 0x0b, 0x89, 0x01, 0x88, 0x11, 0xb8, 0xe5, 0x2f, 0x3a, 0xfb, 0xd6, 0x78,
+	0x81, 0xdd, 0xf0, 0xf6, 0x54, 0x79, 0x8d, 0xf1, 0xcd, 0x1f, 0x64, 0xe0, 0x4c, 0x0f, 0x36, 0x4c,
+	0xd2, 0x70, 0xc3, 0x52, 0x24, 0x2d, 0xb1, 0x4f, 0x71, 0x3f, 0x0c, 0x7e, 0x63, 0xcf, 0x64, 0x63,
+	0x28, 0xfd, 0xc6, 0x9e, 0xdc, 0x83, 0x21, 0xf6, 0xf1, 0x03, 0xdc, 0x3c, 0xca, 0x83, 0xec, 0x54,
+	0xe8, 0xaa, 0x03, 0x83, 0x9d, 0x82, 0x3c, 0xc8, 0x67, 0x21, 0xbb, 0xb1, 0xb1, 0x82, 0xa3, 0x92,
+	0x45, 0x75, 0x76, 0x32, 0x0c, 0x1b, 0x9a, 0x10, 0x4c, 0x32, 0xda, 0x6b, 0xd1, 0x45, 0x35, 0x43,
+	0x27, 0x5f, 0x4e, 0x78, 0x3d, 0x5c, 0xed, 0xdf, 0x85, 0x83, 0x3b, 0x41, 0x3c, 0x8d, 0x37, 0x82,
+	0x1f, 0x4f, 0x8e, 0x3b, 0x6e, 0x23, 0xa4, 0x3e, 0x39, 0xc7, 0x65, 0x3d, 0x3e, 0xd4, 0x59, 0xd1,
+	0x6f, 0x32, 0x17, 0x4f, 0x1c, 0xce, 0x29, 0x9a, 0x21, 0x57, 0x95, 0x19, 0x92, 0xc5, 0x19, 0x32,
+	0xd5, 0x6b, 0x2e, 0x98, 0x3f, 0x9e, 0x91, 0x55, 0x6c, 0x2d, 0x3c, 0xa7, 0xd7, 0x04, 0x6f, 0x69,
+	0xd7, 0x04, 0x27, 0x23, 0x3b, 0x4d, 0x74, 0xe9, 0xb5, 0x70, 0xc4, 0xdd, 0xe5, 0x6d, 0x98, 0x90,
+	0x5d, 0x80, 0xb7, 0x2d, 0x57, 0x60, 0x54, 0xde, 0xbe, 0xf3, 0xbb, 0x96, 0x69, 0x8d, 0xe7, 0xd6,
+	0x82, 0x25, 0xcb, 0xcd, 0xff, 0x6a, 0x58, 0xd2, 0xf2, 0x9a, 0x58, 0x17, 0x16, 0xea, 0x75, 0x5f,
+	0xed, 0x42, 0xa7, 0x5e, 0xf7, 0x2d, 0x84, 0xb2, 0x9d, 0xa4, 0xd2, 0xd9, 0x69, 0xb8, 0x35, 0xc4,
+	0x51, 0xb4, 0xa0, 0x36, 0x42, 0x6d, 0x86, 0xaa, 0xce, 0xcc, 0x18, 0x59, 0xbb, 0x3a, 0xcc, 0xf6,
+	0xbd, 0x3a, 0xfc, 0x21, 0x18, 0x2b, 0x36, 0xeb, 0xda, 0x2d, 0x81, 0x99, 0xd2, 0x29, 0xd7, 0x22,
+	0x24, 0x2e, 0xd6, 0x91, 0xd1, 0xa3, 0xd6, 0xac, 0x77, 0xdf, 0x0d, 0xc4, 0x2c, 0xb5, 0xbb, 0xbf,
+	0xe1, 0xa7, 0xb9, 0xfb, 0xbb, 0x05, 0x63, 0x9b, 0x01, 0xdd, 0xe8, 0xb4, 0x5a, 0xb4, 0x81, 0x9a,
+	0x40, 0x8e, 0x2b, 0xae, 0x9d, 0x80, 0xda, 0x21, 0x42, 0xd5, 0x06, 0x44, 0xa8, 0xaa, 0x58, 0x8d,
+	0xf6, 0x11, 0xab, 0xcf, 0xc2, 0x50, 0xa1, 0xdd, 0x96, 0x97, 0xa2, 0x91, 0xad, 0xb7, 0xdd, 0xc6,
+	0x19, 0x3c, 0xe5, 0xb4, 0xdb, 0xfa, 0x15, 0x27, 0x62, 0xe3, 0x55, 0x20, 0xa5, 0x3e, 0x0e, 0xd0,
+	0x78, 0xac, 0xd5, 0xb4, 0x29, 0xf5, 0x93, 0xc3, 0x13, 0x21, 0x6a, 0xf7, 0x87, 0x13, 0x03, 0xde,
+	0x1f, 0x92, 0x97, 0x60, 0x42, 0x19, 0x76, 0x71, 0xf1, 0x68, 0x8d, 0xb7, 0xa3, 0x31, 0x0f, 0xce,
+	0x55, 0x61, 0x4a, 0x1f, 0xa5, 0x67, 0x60, 0x79, 0xbf, 0x37, 0x94, 0xcb, 0xe5, 0xc7, 0xee, 0x0d,
+	0xe5, 0x20, 0x3f, 0x6e, 0x91, 0xfb, 0x9d, 0x1d, 0xea, 0xb7, 0x68, 0x48, 0x03, 0xa1, 0x95, 0x06,
+	0xe6, 0xb7, 0x32, 0x30, 0x5e, 0x68, 0xb7, 0x9f, 0x73, 0xcf, 0x86, 0xcf, 0x6b, 0xab, 0xc2, 0xe9,
+	0x78, 0xf4, 0x8f, 0xe1, 0xd4, 0xf0, 0x9b, 0x19, 0x98, 0x4e, 0x50, 0xa8, 0xad, 0x37, 0x06, 0xbc,
+	0xe9, 0xcf, 0x0c, 0x78, 0xd3, 0x9f, 0xed, 0x7d, 0xd3, 0xaf, 0xce, 0xb9, 0xa1, 0xa7, 0x99, 0x73,
+	0xaf, 0x41, 0xb6, 0xd0, 0x6e, 0x27, 0x6f, 0x13, 0xda, 0xed, 0xad, 0x9b, 0x5c, 0xbb, 0x77, 0xda,
+	0x6d, 0x8b, 0x61, 0x68, 0x22, 0x3d, 0x32, 0xa0, 0x48, 0x9b, 0x6f, 0xc2, 0x18, 0xf2, 0xc2, 0x65,
+	0xf4, 0xa2, 0x98, 0x7f, 0x7c, 0x0d, 0xd5, 0xea, 0xe2, 0x73, 0xcd, 0xfc, 0xbf, 0xd8, 0x31, 0x92,
+	0xfd, 0x7e, 0x4e, 0x65, 0x6c, 0x41, 0x93, 0xb1, 0xbc, 0x22, 0x63, 0x83, 0x48, 0xd7, 0x7f, 0x34,
+	0x84, 0xbd, 0x25, 0xe4, 0x4a, 0xdc, 0x15, 0x1b, 0x29, 0x77, 0xc5, 0x4f, 0xb1, 0x6b, 0x3c, 0x48,
+	0xde, 0x1a, 0x67, 0x71, 0x30, 0x5e, 0x4e, 0x36, 0xf5, 0x99, 0x5c, 0x18, 0x2f, 0x03, 0x29, 0xb7,
+	0x02, 0x5a, 0xeb, 0xf8, 0xb4, 0xfa, 0xc0, 0x6d, 0x6f, 0x51, 0xdf, 0xdd, 0x3d, 0x10, 0x67, 0x6d,
+	0x5c, 0xd8, 0x5d, 0x51, 0x6a, 0x07, 0x0f, 0xdc, 0x36, 0x3b, 0xe8, 0xb8, 0xbb, 0x07, 0x56, 0x0a,
+	0x0d, 0x79, 0x1f, 0x46, 0x2d, 0xfa, 0xc8, 0x77, 0x43, 0x79, 0xa5, 0x33, 0x15, 0x1d, 0x4f, 0x10,
+	0xca, 0xd5, 0x6f, 0x9f, 0xff, 0x50, 0xc7, 0x5f, 0x94, 0x93, 0x05, 0x7e, 0xcd, 0xc7, 0xaf, 0x6e,
+	0x26, 0xe3, 0xaf, 0x2d, 0x6c, 0x57, 0x17, 0x67, 0x7a, 0x5c, 0x5d, 0x5f, 0x81, 0x61, 0xb4, 0xa9,
+	0x88, 0x4d, 0x05, 0x9d, 0x3a, 0x6b, 0x0c, 0xa0, 0x1a, 0x14, 0x10, 0x83, 0x5c, 0x00, 0x88, 0x8c,
+	0x99, 0xc1, 0x5c, 0x0e, 0x17, 0x6e, 0x05, 0xf2, 0xc9, 0xdd, 0x9a, 0x7e, 0x77, 0x18, 0xe7, 0xef,
+	0x11, 0x5e, 0xc3, 0x7d, 0xfc, 0x0e, 0x74, 0x59, 0xca, 0x1e, 0x47, 0x96, 0xb6, 0x60, 0xa2, 0xca,
+	0x56, 0x11, 0xdd, 0x01, 0xe1, 0x7c, 0xdc, 0xb9, 0xd7, 0xd4, 0xe2, 0x7e, 0xba, 0xb2, 0xc6, 0x87,
+	0xd8, 0x49, 0x19, 0xe5, 0x2a, 0xf9, 0x8b, 0x0a, 0xe3, 0x14, 0xe9, 0x8c, 0x96, 0xbb, 0x1a, 0xef,
+	0xac, 0x63, 0xcb, 0xe5, 0xc8, 0xd3, 0xc9, 0xe5, 0xe8, 0xc7, 0x92, 0xcb, 0x84, 0xab, 0x76, 0xee,
+	0x38, 0xae, 0xda, 0xe7, 0xde, 0x87, 0x99, 0xae, 0x1e, 0x3e, 0xce, 0x01, 0xe3, 0x93, 0x13, 0xcb,
+	0x1f, 0x01, 0x65, 0xe6, 0xe5, 0x2c, 0x5a, 0x77, 0x7d, 0x5a, 0x0b, 0x71, 0xe5, 0x17, 0x8b, 0xb5,
+	0x2f, 0x60, 0x89, 0x2b, 0x63, 0x84, 0x91, 0xf7, 0x60, 0x94, 0x5b, 0x16, 0xf8, 0x89, 0x3e, 0x9e,
+	0xb1, 0xc2, 0x0a, 0xc1, 0x3d, 0xf9, 0x39, 0x86, 0xda, 0xab, 0x82, 0xc8, 0xbc, 0x2b, 0x8d, 0x19,
+	0x47, 0xcc, 0x8b, 0x79, 0x18, 0xde, 0x8a, 0x7b, 0x06, 0x5d, 0x04, 0xf9, 0x47, 0x58, 0x1c, 0x6e,
+	0xfe, 0xb4, 0x01, 0x53, 0xfa, 0x57, 0x92, 0x6b, 0x30, 0x22, 0xfc, 0xa1, 0x0d, 0x3c, 0x62, 0xb2,
+	0xaf, 0x19, 0xe1, 0x9e, 0xd0, 0x9a, 0xff, 0xb3, 0xc0, 0x62, 0x3b, 0x8f, 0xe0, 0x20, 0xac, 0x13,
+	0xb8, 0xf3, 0x08, 0x21, 0xb5, 0x64, 0x19, 0x31, 0x61, 0xc4, 0xa2, 0x41, 0xa7, 0x11, 0xaa, 0xb6,
+	0x37, 0x1f, 0x21, 0x96, 0x28, 0x31, 0x8b, 0x30, 0xc2, 0x97, 0xac, 0xc4, 0xbd, 0xa9, 0x71, 0x8c,
+	0x7b, 0x53, 0xf3, 0xd0, 0x00, 0xa8, 0x56, 0x97, 0xef, 0xd3, 0x83, 0x8a, 0xe3, 0xfa, 0x68, 0x2c,
+	0xc6, 0x29, 0x7d, 0x5f, 0x0c, 0xf9, 0x84, 0x30, 0x16, 0xf3, 0xe9, 0xff, 0x80, 0x1e, 0x68, 0xc6,
+	0x62, 0x89, 0x8a, 0xeb, 0x86, 0xef, 0x3e, 0x74, 0x42, 0xca, 0x08, 0x33, 0x48, 0xc8, 0xd7, 0x0d,
+	0x0e, 0x4d, 0x50, 0x2a, 0xc8, 0xe4, 0x6b, 0x30, 0x15, 0xff, 0x8a, 0x4c, 0xde, 0x53, 0x91, 0x58,
+	0xe9, 0x85, 0x8b, 0x17, 0x9e, 0x1c, 0xce, 0x9f, 0x53, 0xb8, 0x26, 0x8d, 0xe1, 0x09, 0x66, 0xe6,
+	0xaf, 0x1a, 0x78, 0x4b, 0x22, 0x3f, 0xf0, 0x12, 0x0c, 0x45, 0xde, 0x20, 0x13, 0xdc, 0x4a, 0x91,
+	0x30, 0xeb, 0x61, 0x39, 0x79, 0x19, 0xb2, 0xf1, 0x97, 0xe0, 0x96, 0xa0, 0x7f, 0x01, 0x2b, 0x25,
+	0x77, 0x61, 0x74, 0xa0, 0x36, 0xa3, 0x88, 0xa7, 0xb4, 0x55, 0x52, 0xe3, 0x28, 0xdc, 0xdb, 0xde,
+	0xf8, 0xf4, 0x8e, 0xc2, 0xb7, 0x33, 0x30, 0xcd, 0xfa, 0xb5, 0xd0, 0x09, 0xf7, 0x3d, 0xdf, 0x0d,
+	0x0f, 0x9e, 0x5b, 0x73, 0xc2, 0x3b, 0x9a, 0x52, 0x77, 0x4e, 0xae, 0x7d, 0xea, 0xb7, 0x0d, 0x64,
+	0x55, 0xf8, 0x9d, 0x61, 0x38, 0x99, 0x42, 0x45, 0xde, 0xd0, 0xcc, 0x68, 0x73, 0x32, 0x88, 0xe9,
+	0x07, 0x87, 0xf3, 0x13, 0x12, 0x7d, 0x23, 0x0e, 0x6a, 0x5a, 0xd0, 0xaf, 0x1c, 0x79, 0x4f, 0xa1,
+	0x55, 0x4d, 0xbd, 0x72, 0xd4, 0x2f, 0x1a, 0xaf, 0xc0, 0xb0, 0xe5, 0x35, 0xa8, 0xbc, 0xf3, 0x46,
+	0x45, 0xc6, 0x67, 0x00, 0xed, 0x66, 0x84, 0x01, 0xc8, 0x32, 0x8c, 0xb2, 0x3f, 0x56, 0x9d, 0xb6,
+	0xb0, 0x25, 0x92, 0xe8, 0x58, 0x81, 0xd0, 0xb6, 0xdb, 0xda, 0x53, 0x4f, 0x16, 0x0d, 0x6a, 0x37,
+	0x9d, 0xb6, 0xb6, 0xb3, 0x71, 0x44, 0xed, 0x84, 0x92, 0xeb, 0x7d, 0x42, 0x31, 0x8e, 0x3c, 0xa1,
+	0xd4, 0x01, 0xaa, 0xee, 0x5e, 0xcb, 0x6d, 0xed, 0x15, 0x1a, 0x7b, 0x22, 0x14, 0xec, 0x4a, 0xef,
+	0x51, 0xb8, 0x16, 0x23, 0xa3, 0xe0, 0x72, 0xc3, 0x3c, 0x87, 0xd9, 0x4e, 0x43, 0x33, 0x74, 0xc6,
+	0xa8, 0x64, 0x0d, 0xa0, 0x50, 0x0b, 0xdd, 0x87, 0x4c, 0x80, 0x03, 0xe1, 0x7c, 0x27, 0x1b, 0x5c,
+	0x2c, 0xdc, 0xa7, 0x07, 0x55, 0x1a, 0xc6, 0x86, 0x53, 0x07, 0x51, 0xd9, 0x3c, 0xd0, 0xfc, 0xe4,
+	0x62, 0x0e, 0xa4, 0x0d, 0xa7, 0x0a, 0xf5, 0xba, 0xcb, 0xbe, 0xc0, 0x69, 0x6c, 0xf8, 0x6c, 0x30,
+	0xea, 0xc8, 0x7a, 0x22, 0x9d, 0xf5, 0x15, 0xc1, 0xfa, 0x25, 0x27, 0xa2, 0xb2, 0x43, 0x4e, 0x96,
+	0xac, 0x26, 0x9d, 0xb1, 0xb9, 0x0e, 0x53, 0xfa, 0xa7, 0xeb, 0x01, 0x6c, 0x13, 0x90, 0xb3, 0xaa,
+	0x05, 0xbb, 0xba, 0x5c, 0xb8, 0x91, 0x37, 0x48, 0x1e, 0x26, 0xc4, 0xaf, 0x05, 0x7b, 0xe1, 0xad,
+	0x5b, 0xf9, 0x8c, 0x06, 0x79, 0xeb, 0xc6, 0x42, 0x3e, 0x7b, 0x6f, 0x28, 0x97, 0xcd, 0x0f, 0xdd,
+	0x1b, 0xca, 0x0d, 0xe5, 0x87, 0xef, 0x0d, 0xe5, 0x46, 0xf3, 0x39, 0x6e, 0x23, 0x30, 0xff, 0xae,
+	0x01, 0x39, 0xd9, 0x6e, 0x72, 0x0b, 0xb2, 0xd5, 0xea, 0x72, 0xc2, 0x07, 0x39, 0xde, 0x5f, 0xf8,
+	0x4a, 0x1a, 0x04, 0xaa, 0xbf, 0x0c, 0x23, 0x60, 0x74, 0x1b, 0x2b, 0x55, 0xb1, 0xbd, 0x4b, 0xba,
+	0x78, 0xd9, 0xe6, 0x74, 0x29, 0x8e, 0x99, 0xb7, 0x20, 0x7b, 0x6f, 0x7b, 0x43, 0x1c, 0x5b, 0x24,
+	0x5d, 0xbc, 0x92, 0x72, 0xba, 0x8f, 0x1e, 0xa9, 0xeb, 0x3b, 0x23, 0x30, 0x2d, 0x18, 0x57, 0x44,
+	0x98, 0x6f, 0xb7, 0x4d, 0x2f, 0x0a, 0xee, 0x12, 0xdb, 0x2d, 0x83, 0x58, 0xa2, 0x84, 0x69, 0x07,
+	0x2b, 0x5e, 0xcd, 0x69, 0x88, 0x7d, 0x1b, 0xb5, 0x83, 0x06, 0x03, 0x58, 0x1c, 0x6e, 0xfe, 0xb6,
+	0x01, 0xf9, 0x8a, 0xef, 0x3d, 0x74, 0xd9, 0x32, 0xb3, 0xe1, 0x3d, 0xa0, 0xad, 0xad, 0x1b, 0xe4,
+	0x4d, 0x39, 0xd9, 0x8c, 0xe8, 0x90, 0x3c, 0x8c, 0x93, 0x2d, 0x61, 0x72, 0x15, 0x13, 0x4e, 0x89,
+	0x91, 0xcb, 0x0c, 0x1e, 0x77, 0x73, 0x44, 0x8c, 0xdc, 0x3c, 0x0c, 0x63, 0x73, 0x94, 0xd0, 0x87,
+	0xe1, 0x90, 0x01, 0x2c, 0x0e, 0x57, 0x56, 0xa5, 0xef, 0x64, 0xba, 0xbe, 0x61, 0xe1, 0x53, 0x15,
+	0xbb, 0xa2, 0x7f, 0xdc, 0x40, 0x2b, 0xf5, 0x07, 0x30, 0x9b, 0xec, 0x12, 0x34, 0x60, 0x14, 0x60,
+	0x5a, 0x87, 0x4b, 0x5b, 0xc6, 0x99, 0xd4, 0xba, 0xb6, 0x16, 0xac, 0x24, 0xbe, 0xf9, 0x07, 0x06,
+	0x8c, 0xe1, 0x9f, 0x56, 0xa7, 0x81, 0x97, 0xe0, 0x85, 0xed, 0xaa, 0xf0, 0x5e, 0x54, 0xd5, 0x38,
+	0xe7, 0x51, 0x60, 0x0b, 0x57, 0x47, 0x6d, 0x7d, 0x89, 0x90, 0x05, 0x29, 0xf7, 0xd5, 0x94, 0xf7,
+	0x5e, 0x11, 0x29, 0x77, 0xea, 0x0c, 0x12, 0xa4, 0x02, 0x19, 0xfd, 0x4e, 0xb6, 0xab, 0x4c, 0xfc,
+	0xd4, 0xdb, 0x2e, 0xa4, 0xf3, 0x1a, 0xba, 0xdf, 0x09, 0x47, 0xc3, 0xcb, 0xae, 0xed, 0x6a, 0xc1,
+	0x5a, 0xd3, 0x2e, 0xbb, 0x58, 0x1b, 0x35, 0xe7, 0x3a, 0x81, 0x64, 0xfe, 0xad, 0x5c, 0xb2, 0x03,
+	0xc5, 0x56, 0x77, 0xcc, 0xb9, 0xf1, 0x36, 0x0c, 0x17, 0x1a, 0x0d, 0xef, 0x91, 0x58, 0x25, 0xa4,
+	0x3d, 0x25, 0xea, 0x3f, 0xbe, 0x93, 0x39, 0x0c, 0x45, 0x73, 0xff, 0x66, 0x00, 0x52, 0x84, 0xb1,
+	0xc2, 0x76, 0xb5, 0x5c, 0x2e, 0x6d, 0x6c, 0xac, 0x88, 0x80, 0xe5, 0x57, 0x65, 0xff, 0xb8, 0x6e,
+	0xdd, 0x4e, 0xde, 0x0a, 0xc5, 0x9a, 0x7b, 0x4c, 0x47, 0xde, 0x05, 0xb8, 0xe7, 0xb9, 0xad, 0x55,
+	0x1a, 0xee, 0x7b, 0x75, 0xf1, 0xf1, 0x2f, 0x3e, 0x39, 0x9c, 0x1f, 0xff, 0xc8, 0x73, 0x5b, 0x76,
+	0x13, 0xc1, 0xac, 0xed, 0x31, 0x92, 0xa5, 0xfc, 0xcd, 0x7a, 0x7a, 0xd1, 0xe3, 0x17, 0xdb, 0xc3,
+	0x71, 0x4f, 0xef, 0x78, 0x5d, 0x77, 0xda, 0x12, 0x8d, 0x34, 0x61, 0xba, 0xda, 0xd9, 0xdb, 0xa3,
+	0x6c, 0x55, 0x17, 0xa7, 0xdf, 0x11, 0x71, 0xe6, 0x8a, 0xc2, 0xbd, 0xf9, 0x49, 0x84, 0x9d, 0x4f,
+	0x82, 0xc5, 0x37, 0x98, 0x20, 0x7f, 0xff, 0x70, 0x5e, 0xdc, 0x36, 0x31, 0x25, 0x2d, 0x90, 0xf4,
+	0xdd, 0xf6, 0x99, 0x24, 0x6f, 0xb2, 0x0e, 0x23, 0x77, 0xdd, 0x70, 0xb9, 0xb3, 0x23, 0x8e, 0xaf,
+	0x2f, 0xf5, 0x99, 0x34, 0x1c, 0x91, 0x9f, 0xe0, 0xf7, 0xdc, 0x70, 0xbf, 0xa3, 0x7a, 0xa3, 0x0a,
+	0x36, 0x64, 0x1b, 0x72, 0x45, 0xd7, 0xaf, 0x35, 0x68, 0xb1, 0x2c, 0x76, 0xfd, 0x97, 0xfb, 0xb0,
+	0x94, 0xa8, 0xbc, 0x5f, 0x6a, 0xf8, 0xab, 0xe6, 0xaa, 0x5a, 0x80, 0xc4, 0x20, 0xff, 0xae, 0x01,
+	0x2f, 0x44, 0xad, 0x2f, 0xec, 0xd1, 0x56, 0xb8, 0xea, 0x84, 0xb5, 0x7d, 0xea, 0x47, 0x91, 0x4e,
+	0x7d, 0x7a, 0xe9, 0x0b, 0x5d, 0xbd, 0x74, 0x39, 0xee, 0x25, 0x87, 0x31, 0xb3, 0x9b, 0x9c, 0x5b,
+	0x77, 0x9f, 0xf5, 0xab, 0x95, 0xd8, 0x00, 0xb1, 0xc1, 0x5c, 0xb8, 0xfe, 0xbf, 0xda, 0xe7, 0x83,
+	0x63, 0x64, 0xe1, 0xd0, 0x19, 0xfd, 0xd6, 0xfc, 0x38, 0x22, 0x28, 0xb9, 0x2f, 0xdd, 0xbd, 0xb9,
+	0x46, 0x72, 0xb1, 0x0f, 0x6f, 0xee, 0x02, 0x7e, 0xb2, 0x4f, 0x44, 0x04, 0x1f, 0xed, 0x15, 0x67,
+	0x47, 0x28, 0x21, 0x47, 0x8c, 0xf6, 0x8a, 0x13, 0x8f, 0x76, 0xc3, 0x49, 0x8e, 0xf6, 0x8a, 0xb3,
+	0x43, 0x8a, 0x3c, 0xb8, 0x63, 0x12, 0xb9, 0x5d, 0xe8, 0xc7, 0xad, 0x58, 0xe1, 0x3b, 0x73, 0x77,
+	0x90, 0x87, 0xf9, 0x6f, 0x86, 0xe0, 0x5c, 0x6f, 0x79, 0x23, 0x5f, 0x92, 0x8b, 0x00, 0x5f, 0x6a,
+	0x2f, 0x1d, 0x29, 0xa1, 0xd7, 0x8e, 0x5c, 0x1a, 0xbe, 0x0c, 0xb3, 0x4b, 0xad, 0x90, 0xfa, 0x6d,
+	0xdf, 0x95, 0xc1, 0x70, 0xcb, 0x5e, 0x20, 0x9d, 0x3f, 0x5e, 0x79, 0x72, 0x38, 0x7f, 0x91, 0x46,
+	0xe5, 0xc2, 0x0f, 0x08, 0x5d, 0x51, 0x14, 0x56, 0xa9, 0x1c, 0xce, 0xfd, 0x6a, 0x16, 0x86, 0x70,
+	0x65, 0x7f, 0x19, 0xb2, 0xd5, 0xce, 0x8e, 0x58, 0xd2, 0xb9, 0x0e, 0xa4, 0xcd, 0x17, 0x56, 0x4a,
+	0x3e, 0x0f, 0x60, 0xd1, 0xb6, 0x17, 0xb8, 0xa1, 0xe7, 0x1f, 0xa8, 0x9e, 0xb2, 0x7e, 0x04, 0xd5,
+	0x5d, 0xa0, 0x24, 0x94, 0x2c, 0xc3, 0x74, 0xfc, 0x6b, 0xfd, 0x51, 0x8b, 0x4a, 0xd3, 0x1d, 0x1e,
+	0xd3, 0x62, 0x72, 0xdb, 0x63, 0x65, 0xea, 0x0a, 0x90, 0x20, 0x23, 0x0b, 0x90, 0xdb, 0xf6, 0xfc,
+	0x07, 0xbb, 0xac, 0x87, 0x87, 0xe2, 0x35, 0xea, 0x91, 0x80, 0xa9, 0x73, 0x51, 0xe2, 0x91, 0xb7,
+	0x61, 0x7c, 0xa9, 0xf5, 0xd0, 0xf5, 0xbd, 0x56, 0x93, 0xb6, 0xa4, 0xaf, 0x0f, 0x37, 0x3f, 0xc4,
+	0x60, 0xcd, 0x99, 0x3e, 0x06, 0xb3, 0xc3, 0x48, 0xa1, 0x16, 0x7a, 0xbe, 0x70, 0xf5, 0xe1, 0xe3,
+	0xc4, 0x00, 0xda, 0x38, 0x31, 0x00, 0xeb, 0x44, 0x8b, 0xee, 0x0a, 0xf3, 0x2b, 0x76, 0xa2, 0x4f,
+	0x77, 0xb5, 0x48, 0x01, 0xba, 0xcb, 0xd6, 0x58, 0x8b, 0xee, 0xe2, 0x09, 0x2a, 0x17, 0xb7, 0xdf,
+	0xa7, 0xbb, 0x5d, 0x67, 0x6f, 0x81, 0x66, 0xfe, 0x5a, 0x6f, 0x81, 0x63, 0x42, 0x7d, 0x3c, 0x81,
+	0x5b, 0x71, 0x06, 0x10, 0xb8, 0x37, 0x22, 0xc7, 0xaa, 0x4c, 0x1c, 0x79, 0xc1, 0x1d, 0xab, 0xd4,
+	0x59, 0xc5, 0x71, 0xce, 0xfd, 0xff, 0x8f, 0x25, 0x44, 0xa2, 0x93, 0x32, 0x83, 0x76, 0x52, 0x76,
+	0xa0, 0x4e, 0x22, 0x8b, 0x30, 0x19, 0x25, 0x94, 0xa8, 0x38, 0xc2, 0xaf, 0x5a, 0x38, 0x26, 0x45,
+	0xe9, 0x41, 0xec, 0xb6, 0x13, 0xaa, 0x9a, 0xbd, 0x4e, 0x42, 0xde, 0x81, 0x71, 0xe1, 0x5d, 0x88,
+	0x1c, 0x86, 0x63, 0xb7, 0x4c, 0xe9, 0x8a, 0x98, 0xa0, 0x57, 0xd1, 0xc9, 0x12, 0x4c, 0x55, 0xdc,
+	0x36, 0x6d, 0xb8, 0x2d, 0x5a, 0x45, 0x17, 0x24, 0x21, 0x31, 0xe8, 0xa5, 0xd7, 0x16, 0x25, 0x36,
+	0xf7, 0x4e, 0xd2, 0x0c, 0x11, 0x1a, 0x51, 0x52, 0x58, 0x47, 0x8f, 0x23, 0xac, 0xe6, 0xdf, 0xcd,
+	0xc0, 0xf9, 0x7e, 0x1b, 0x17, 0xa9, 0xea, 0xc2, 0x72, 0x79, 0x80, 0xcd, 0xee, 0x68, 0x71, 0x59,
+	0x82, 0xa9, 0x75, 0x7f, 0xcf, 0x69, 0xb9, 0xdf, 0x44, 0x85, 0x24, 0xf2, 0x8f, 0xc4, 0x2f, 0xf7,
+	0x94, 0x12, 0xdd, 0xca, 0x97, 0x20, 0x3a, 0xf7, 0x50, 0x88, 0xd1, 0xc7, 0xf5, 0x07, 0xbd, 0x05,
+	0x63, 0x45, 0xaf, 0x15, 0xd2, 0xc7, 0x61, 0xc2, 0x8f, 0x9f, 0x03, 0x93, 0x7e, 0xfc, 0x12, 0xd5,
+	0xfc, 0x1d, 0x03, 0x2e, 0xf4, 0xdf, 0xfc, 0xc8, 0xa6, 0xde, 0x6d, 0x57, 0x07, 0xda, 0x32, 0x8f,
+	0xec, 0xb8, 0x73, 0xab, 0xe2, 0x8b, 0x97, 0x60, 0x4a, 0x38, 0xb4, 0xe8, 0xba, 0x35, 0x76, 0xa0,
+	0x70, 0x0c, 0x4b, 0xd1, 0xaf, 0x13, 0x44, 0xe6, 0x9f, 0x18, 0x70, 0xb6, 0xe7, 0x4e, 0x4b, 0x2a,
+	0xfa, 0x37, 0xbc, 0x7a, 0xd4, 0xd6, 0x7c, 0x74, 0xf3, 0x7f, 0xd6, 0x10, 0xed, 0x7f, 0x0f, 0x26,
+	0xaa, 0x9d, 0x9d, 0x64, 0x90, 0x3c, 0xce, 0x9c, 0x40, 0x81, 0x6b, 0x37, 0x28, 0x0a, 0x9c, 0x7d,
+	0xbf, 0xf4, 0xdb, 0x13, 0x57, 0x52, 0xfc, 0x80, 0x80, 0xdf, 0x1f, 0x39, 0xd8, 0xa2, 0xff, 0xb3,
+	0xaa, 0x78, 0x24, 0x88, 0xcc, 0xdf, 0xcc, 0xc0, 0x99, 0x1e, 0xbb, 0x39, 0x59, 0xd3, 0xbf, 0xfe,
+	0xe5, 0xfe, 0x9b, 0xff, 0xd1, 0xdf, 0xfe, 0x8f, 0xe4, 0xb7, 0xa3, 0x49, 0x53, 0x88, 0xa0, 0x3c,
+	0x28, 0x08, 0x93, 0xa6, 0x14, 0xd7, 0x40, 0x37, 0x69, 0x4a, 0x64, 0xf2, 0x16, 0x8c, 0xb1, 0x83,
+	0x79, 0xa8, 0x1c, 0x89, 0xb8, 0x07, 0xaa, 0x04, 0xaa, 0xf2, 0x1a, 0x61, 0xb2, 0xcd, 0x54, 0x1f,
+	0x78, 0xe9, 0x25, 0x85, 0x9b, 0x69, 0x42, 0x5c, 0x74, 0x75, 0x5a, 0x27, 0x33, 0x7f, 0x36, 0x03,
+	0x53, 0xfc, 0x46, 0x86, 0x1f, 0xf7, 0x9e, 0xdb, 0xa3, 0xf4, 0xdb, 0xda, 0x51, 0x5a, 0xc6, 0x7e,
+	0xa9, 0x9f, 0x36, 0xd0, 0x41, 0x7a, 0x1f, 0x48, 0x37, 0x0d, 0xb1, 0xe4, 0xbd, 0xe1, 0x20, 0x67,
+	0xe8, 0x1b, 0x71, 0x98, 0x20, 0x66, 0xc7, 0xaa, 0xd9, 0x68, 0xc8, 0x08, 0x2c, 0x8d, 0x87, 0xf9,
+	0xd3, 0x19, 0x98, 0x54, 0x4c, 0x9e, 0xcf, 0x6d, 0xc7, 0x7f, 0x41, 0xeb, 0x78, 0x19, 0xfd, 0xab,
+	0x7c, 0xd9, 0x40, 0xfd, 0xde, 0x81, 0x99, 0x2e, 0x92, 0xa4, 0xe5, 0xd8, 0x18, 0xc4, 0x72, 0xfc,
+	0x46, 0x77, 0x28, 0x17, 0x4f, 0x42, 0x14, 0x85, 0x72, 0xa9, 0xb1, 0x63, 0xdf, 0xce, 0xc0, 0xac,
+	0xf8, 0x55, 0xe8, 0xd4, 0xdd, 0xb0, 0xe8, 0xb5, 0x76, 0xdd, 0xbd, 0xe7, 0x76, 0x2c, 0x0a, 0xda,
+	0x58, 0xcc, 0xeb, 0x63, 0xa1, 0x7c, 0x60, 0xef, 0x21, 0x31, 0xff, 0x02, 0xc0, 0x5c, 0x2f, 0x82,
+	0x81, 0xfd, 0x67, 0xe3, 0xb8, 0xdd, 0xcc, 0x00, 0x71, 0xbb, 0x2b, 0x90, 0xc7, 0xaa, 0xaa, 0x34,
+	0x60, 0x9d, 0x10, 0xc4, 0x19, 0x50, 0x2e, 0x3e, 0x39, 0x9c, 0x3f, 0xef, 0xb0, 0x32, 0x3b, 0x10,
+	0x85, 0x76, 0xc7, 0x57, 0x8f, 0xdb, 0x5d, 0x94, 0xe4, 0x57, 0x0d, 0x98, 0x42, 0xe0, 0xd2, 0x43,
+	0xda, 0x0a, 0x91, 0xd9, 0x90, 0x70, 0xa0, 0x8a, 0x4e, 0xda, 0xd5, 0xd0, 0x77, 0x5b, 0x7b, 0xe2,
+	0xa8, 0xbd, 0x23, 0x8e, 0xda, 0xef, 0x70, 0x13, 0xc1, 0xb5, 0x9a, 0xd7, 0xbc, 0xbe, 0xe7, 0x3b,
+	0x0f, 0x5d, 0x6e, 0xcd, 0x77, 0x1a, 0xd7, 0xe3, 0x04, 0x78, 0x6d, 0x37, 0x91, 0xd2, 0x4e, 0xb0,
+	0x42, 0x33, 0x06, 0x6f, 0x28, 0xc5, 0x6a, 0x13, 0xcd, 0x4c, 0xb4, 0x88, 0x7c, 0x05, 0xce, 0xf0,
+	0x30, 0x27, 0xa6, 0x83, 0xb8, 0xad, 0x8e, 0xd7, 0x09, 0x16, 0x9d, 0xda, 0x03, 0xb6, 0xef, 0xf1,
+	0x4b, 0x7d, 0xfc, 0xf2, 0x5a, 0x54, 0x68, 0xef, 0xf0, 0x52, 0x85, 0x65, 0x2f, 0x06, 0x64, 0x19,
+	0x66, 0x78, 0x51, 0xa1, 0x13, 0x7a, 0xd5, 0x9a, 0xd3, 0x70, 0x5b, 0x7b, 0xa8, 0x44, 0xe6, 0xf8,
+	0x7e, 0xec, 0x74, 0x42, 0xcf, 0x0e, 0x38, 0x5c, 0xe1, 0xd7, 0x4d, 0x44, 0xca, 0xec, 0xcc, 0xe6,
+	0xd4, 0x57, 0x9d, 0xc7, 0x45, 0xa7, 0xed, 0xd4, 0xdc, 0x90, 0x47, 0xeb, 0x66, 0x79, 0x80, 0x88,
+	0x4f, 0x9d, 0xba, 0xdd, 0x74, 0x1e, 0xdb, 0x35, 0x51, 0xa8, 0x1f, 0xda, 0x34, 0xba, 0x88, 0x95,
+	0xdb, 0x8a, 0x58, 0x8d, 0x25, 0x59, 0xb9, 0xad, 0xde, 0xac, 0x62, 0x3a, 0xc9, 0x6a, 0xc3, 0xf1,
+	0xf7, 0x68, 0xc8, 0x2f, 0xc3, 0xe1, 0xa2, 0x71, 0xd9, 0x50, 0x58, 0x85, 0x58, 0x66, 0xe3, 0xc5,
+	0x78, 0x92, 0x95, 0x42, 0xc7, 0x24, 0x6f, 0xdb, 0x77, 0x43, 0xaa, 0x7e, 0xe1, 0x38, 0x36, 0x0b,
+	0xfb, 0x1f, 0xdd, 0x01, 0x7a, 0x7d, 0x62, 0x17, 0x65, 0xcc, 0x4d, 0xf9, 0xc8, 0x89, 0x2e, 0x6e,
+	0xe9, 0x5f, 0xd9, 0x45, 0x19, 0x71, 0x53, 0xbf, 0x73, 0x12, 0xbf, 0x53, 0xe1, 0xd6, 0xe3, 0x43,
+	0xbb, 0x28, 0xc9, 0x1a, 0xeb, 0xb4, 0x90, 0xb6, 0x98, 0x44, 0x0b, 0x67, 0x80, 0x29, 0x6c, 0xda,
+	0x2b, 0xe2, 0x46, 0x2b, 0xef, 0xcb, 0x62, 0x3b, 0xc5, 0x35, 0x20, 0x49, 0x4c, 0xfe, 0x1c, 0x4c,
+	0x6f, 0x06, 0xf4, 0x4e, 0xb9, 0x52, 0x95, 0x81, 0x5d, 0x73, 0xd3, 0x78, 0xcf, 0x75, 0xe3, 0x88,
+	0x45, 0xe7, 0x9a, 0x4a, 0x83, 0xa9, 0xe8, 0xf8, 0xb8, 0x75, 0x02, 0x6a, 0xef, 0xba, 0xed, 0x20,
+	0x0a, 0x31, 0x55, 0xc7, 0x2d, 0x51, 0x95, 0xb9, 0x0c, 0x33, 0x5d, 0x6c, 0xc8, 0x14, 0x00, 0x03,
+	0xda, 0x9b, 0x6b, 0xd5, 0xa5, 0x8d, 0xfc, 0x09, 0x92, 0x87, 0x09, 0xfc, 0xbd, 0xb4, 0x56, 0x58,
+	0x5c, 0x59, 0x2a, 0xe5, 0x0d, 0x32, 0x03, 0x93, 0x08, 0x29, 0x95, 0xab, 0x1c, 0x94, 0xb9, 0x37,
+	0x94, 0x1b, 0xce, 0x8f, 0x58, 0x79, 0x3e, 0x75, 0x43, 0x36, 0x01, 0x70, 0x4f, 0x31, 0xff, 0x72,
+	0x06, 0xce, 0xca, 0x6d, 0x85, 0x86, 0x8f, 0x3c, 0xff, 0x81, 0xdb, 0xda, 0x7b, 0xce, 0x77, 0x87,
+	0x3b, 0xda, 0xee, 0xf0, 0x4a, 0x62, 0xa7, 0x4e, 0x7c, 0x65, 0x9f, 0x2d, 0xe2, 0x17, 0x47, 0xe1,
+	0xc5, 0xbe, 0x54, 0xe4, 0x4b, 0x6c, 0x37, 0x77, 0x69, 0x2b, 0x2c, 0xd7, 0x1b, 0x74, 0xc3, 0x6d,
+	0x52, 0xaf, 0x13, 0x0a, 0xe7, 0x93, 0x97, 0x99, 0x7a, 0xcb, 0xf3, 0xc8, 0xd9, 0x6e, 0xbd, 0x41,
+	0xed, 0x90, 0x17, 0x6b, 0xe2, 0xd6, 0x4d, 0xcd, 0x58, 0x46, 0xb9, 0x2e, 0xcb, 0xad, 0x90, 0xfa,
+	0x0f, 0x1d, 0x9e, 0x4e, 0x4b, 0xb0, 0x7c, 0x40, 0x69, 0xdb, 0x76, 0x58, 0xa9, 0xed, 0x8a, 0x62,
+	0x9d, 0x65, 0x17, 0x35, 0xb9, 0xa3, 0xb0, 0x2c, 0x32, 0x75, 0x78, 0xd5, 0x79, 0x2c, 0xec, 0xee,
+	0x22, 0xe4, 0x3d, 0x62, 0xc9, 0x53, 0x38, 0x34, 0x9d, 0xc7, 0x56, 0x37, 0x09, 0xf9, 0x1a, 0x9c,
+	0x12, 0x1b, 0x90, 0x88, 0xb9, 0x90, 0x5f, 0xcc, 0x23, 0x3a, 0x5e, 0x7b, 0x72, 0x38, 0x7f, 0x46,
+	0x6c, 0x5f, 0xb6, 0x8c, 0x5f, 0x49, 0xfb, 0xea, 0x74, 0x2e, 0x64, 0x83, 0x6d, 0xc8, 0x89, 0xee,
+	0x58, 0xa5, 0x41, 0xe0, 0xec, 0x49, 0x1b, 0x3d, 0xf7, 0x00, 0x53, 0x3a, 0xd3, 0x6e, 0xf2, 0x72,
+	0xab, 0x27, 0x25, 0x59, 0x86, 0xa9, 0x6d, 0xba, 0xa3, 0x8e, 0xcf, 0x48, 0xb4, 0x54, 0xe5, 0x1f,
+	0xd1, 0x9d, 0xde, 0x83, 0x93, 0xa0, 0x23, 0x2e, 0xcc, 0xa0, 0xf7, 0xec, 0x8a, 0x1b, 0x84, 0xb4,
+	0x45, 0x7d, 0x8c, 0x66, 0x1b, 0xc5, 0xc5, 0x60, 0x2e, 0xd6, 0x90, 0xf5, 0xf2, 0xc5, 0x97, 0x9e,
+	0x1c, 0xce, 0xbf, 0xc8, 0x3d, 0x71, 0x1b, 0x02, 0x6e, 0x27, 0x92, 0x4a, 0x76, 0x73, 0x25, 0x5f,
+	0x87, 0x69, 0xcb, 0xeb, 0x84, 0x6e, 0x6b, 0xaf, 0x1a, 0xfa, 0x4e, 0x48, 0xf7, 0xf8, 0x86, 0x14,
+	0x87, 0xcd, 0x25, 0x4a, 0x85, 0x71, 0x91, 0x03, 0xed, 0x40, 0x40, 0xb5, 0x1d, 0x41, 0x27, 0x20,
+	0x3f, 0x04, 0x53, 0xdc, 0x45, 0x3f, 0xaa, 0x60, 0x4c, 0xcb, 0xbf, 0xa4, 0x17, 0x6e, 0xdd, 0xe0,
+	0x07, 0x54, 0xee, 0xea, 0x9f, 0x56, 0x41, 0x82, 0x1b, 0xf9, 0x50, 0x74, 0x56, 0xc5, 0x6d, 0xed,
+	0x45, 0x62, 0x0c, 0xd8, 0xf3, 0x6f, 0xc6, 0x5d, 0xd2, 0x66, 0xcd, 0x95, 0x62, 0xdc, 0xe3, 0xce,
+	0xa7, 0x9b, 0x8f, 0x79, 0x68, 0x40, 0x3e, 0xd9, 0x40, 0xf2, 0x65, 0x18, 0xe3, 0xd7, 0x00, 0x34,
+	0xd8, 0x17, 0x91, 0x72, 0xd2, 0xee, 0x1d, 0xc1, 0x75, 0x22, 0x91, 0xb7, 0x84, 0x5f, 0x32, 0x50,
+	0xf5, 0x22, 0x7c, 0xf9, 0x84, 0x15, 0x33, 0x23, 0x75, 0x98, 0xe0, 0x6d, 0xa0, 0x18, 0x09, 0x2a,
+	0x6e, 0x83, 0x5f, 0x52, 0xc7, 0x5c, 0x14, 0x25, 0xf8, 0x63, 0xb0, 0xa4, 0xf8, 0x52, 0x8e, 0xa0,
+	0x55, 0xa1, 0x71, 0x5d, 0x04, 0xc8, 0x49, 0x42, 0xf3, 0x2c, 0x9c, 0xe9, 0xd1, 0x66, 0xf3, 0x21,
+	0x5a, 0x48, 0x7b, 0xd4, 0x48, 0xbe, 0x0c, 0xb3, 0x48, 0x58, 0xf4, 0x5a, 0x2d, 0x5a, 0x0b, 0x71,
+	0x92, 0x49, 0x23, 0x4b, 0x96, 0xdb, 0xcf, 0xf9, 0xf7, 0xd6, 0x22, 0x04, 0x3b, 0x69, 0x6b, 0x49,
+	0xe5, 0x60, 0xfe, 0x52, 0x06, 0xe6, 0xc4, 0xbc, 0xb5, 0x68, 0xcd, 0xf3, 0xeb, 0xcf, 0xff, 0x3e,
+	0xb1, 0xa4, 0xed, 0x13, 0x2f, 0x47, 0x81, 0x37, 0x69, 0x1f, 0xd9, 0x67, 0x9b, 0xf8, 0x4d, 0x03,
+	0xce, 0xf7, 0x23, 0x62, 0xbd, 0x13, 0x45, 0xbe, 0x8e, 0x75, 0x45, 0xb8, 0xb6, 0xe1, 0x24, 0x0e,
+	0x68, 0x71, 0x9f, 0xd6, 0x1e, 0x04, 0xcb, 0x5e, 0x10, 0xa2, 0x33, 0x4a, 0x46, 0x73, 0x54, 0x5f,
+	0xf4, 0x3c, 0x7e, 0x63, 0x86, 0xd7, 0x8a, 0xc6, 0xf7, 0x0f, 0xe7, 0x81, 0x81, 0x78, 0xac, 0xaa,
+	0x30, 0xdb, 0x3e, 0x3e, 0xb0, 0x6b, 0xc8, 0x83, 0xc7, 0xe6, 0x3e, 0xa0, 0x07, 0x81, 0x95, 0xc6,
+	0x1a, 0x1d, 0x0b, 0x0a, 0x9d, 0x70, 0xbf, 0xe2, 0xd3, 0x5d, 0xea, 0xd3, 0x56, 0x8d, 0x7e, 0xca,
+	0x1c, 0x0b, 0xf4, 0x8f, 0x1b, 0xe8, 0x5c, 0xfe, 0xbf, 0x01, 0xcc, 0xa6, 0x91, 0xb1, 0x7e, 0x51,
+	0x8e, 0x82, 0xc9, 0x44, 0xd6, 0x7f, 0xde, 0x80, 0x89, 0x2a, 0xad, 0x79, 0xad, 0xfa, 0x1d, 0xbc,
+	0x29, 0x11, 0xbd, 0x63, 0xf3, 0xad, 0x90, 0xc1, 0xed, 0xdd, 0xc4, 0x15, 0xca, 0x0f, 0x0e, 0xe7,
+	0xbf, 0x38, 0xd8, 0x09, 0xac, 0xe6, 0x61, 0x88, 0x61, 0x88, 0x99, 0x8c, 0xa2, 0x2a, 0xd0, 0xe3,
+	0x4c, 0xab, 0x94, 0x2c, 0xc2, 0xa4, 0x98, 0xae, 0x9e, 0x1a, 0xf8, 0x8c, 0x37, 0x02, 0x35, 0x59,
+	0xd0, 0x95, 0xe9, 0x41, 0x23, 0x21, 0x37, 0x21, 0xbb, 0xb9, 0x70, 0x47, 0x8c, 0x81, 0x8c, 0xc0,
+	0xda, 0x5c, 0xb8, 0x83, 0x46, 0x1e, 0xa6, 0x38, 0x4f, 0x76, 0x16, 0xb4, 0xcb, 0x8b, 0xcd, 0x85,
+	0x3b, 0xe4, 0x47, 0xe1, 0x54, 0xc9, 0x0d, 0x44, 0x15, 0xdc, 0xc5, 0xa5, 0x8e, 0x2e, 0x9d, 0x23,
+	0x3d, 0xa4, 0xf7, 0x73, 0xa9, 0xd2, 0xfb, 0x52, 0x3d, 0x62, 0x62, 0x73, 0xff, 0x99, 0x7a, 0x32,
+	0xc0, 0x3b, 0xbd, 0x1e, 0xf2, 0x11, 0x4c, 0xa1, 0x91, 0x12, 0xbd, 0x7e, 0x30, 0xc9, 0xcc, 0x68,
+	0x8f, 0x9a, 0x3f, 0x93, 0x5a, 0xf3, 0x39, 0xb4, 0x79, 0xda, 0xe8, 0x3b, 0x84, 0x09, 0x69, 0xb4,
+	0xb3, 0xac, 0xc6, 0x99, 0xdc, 0x83, 0x69, 0xa1, 0x54, 0xac, 0xef, 0x6e, 0xec, 0xd3, 0x92, 0x73,
+	0x20, 0xae, 0xb5, 0xf0, 0x9c, 0x22, 0x34, 0x11, 0xdb, 0xdb, 0xb5, 0xc3, 0x7d, 0x6a, 0xd7, 0x1d,
+	0x6d, 0xfb, 0x4d, 0x10, 0x92, 0x1f, 0x86, 0xf1, 0x15, 0xaf, 0xc6, 0xf4, 0x49, 0x5c, 0x19, 0xc6,
+	0x90, 0xcf, 0x07, 0x98, 0x55, 0x99, 0x83, 0x13, 0x4a, 0xc2, 0x0f, 0x0e, 0xe7, 0xdf, 0x3e, 0xae,
+	0xd0, 0x28, 0x15, 0x58, 0x6a, 0x6d, 0xa4, 0x08, 0xb9, 0x6d, 0xba, 0xc3, 0xbe, 0x36, 0x99, 0x11,
+	0x54, 0x82, 0xc5, 0x4d, 0xa3, 0xf8, 0xa5, 0xdd, 0x34, 0x0a, 0x18, 0xf1, 0x61, 0x06, 0xfb, 0xa7,
+	0xe2, 0x04, 0xc1, 0x23, 0xcf, 0xaf, 0x63, 0x42, 0xaa, 0xf1, 0x1e, 0x9d, 0xbf, 0x90, 0xda, 0xf9,
+	0xe7, 0x79, 0xe7, 0xb7, 0x15, 0x0e, 0xaa, 0x5a, 0xd4, 0xc5, 0x9e, 0x7c, 0x1d, 0xa6, 0x2c, 0xfa,
+	0x8d, 0x8e, 0xeb, 0xd3, 0xd5, 0x3b, 0x05, 0x9c, 0x95, 0x13, 0x9a, 0x63, 0xac, 0x5e, 0xc8, 0x75,
+	0x2f, 0x9f, 0xc3, 0xa4, 0x5d, 0xc5, 0x6e, 0xee, 0x3a, 0xba, 0x5d, 0x5d, 0x25, 0x21, 0x15, 0x18,
+	0x2f, 0xd1, 0x87, 0x6e, 0x8d, 0xa2, 0xfb, 0x9e, 0xb8, 0x3e, 0x8f, 0x32, 0x14, 0xc6, 0x25, 0xdc,
+	0xc2, 0x50, 0x47, 0x00, 0x77, 0x06, 0xd4, 0x23, 0x01, 0x22, 0x44, 0x72, 0x0b, 0xb2, 0xe5, 0x52,
+	0x05, 0x0f, 0xa1, 0xb1, 0x57, 0x5c, 0xb9, 0x5e, 0x91, 0x69, 0xe9, 0xf0, 0x5e, 0xd0, 0xad, 0x6b,
+	0x77, 0xef, 0xe5, 0x52, 0x85, 0xec, 0xc2, 0x24, 0x76, 0xc0, 0x32, 0x75, 0x78, 0xdf, 0x4e, 0xf7,
+	0xe8, 0xdb, 0x6b, 0xa9, 0x7d, 0x3b, 0xc7, 0xfb, 0x76, 0x5f, 0x50, 0x6b, 0x79, 0xb6, 0x54, 0xb6,
+	0x4c, 0x51, 0x2b, 0xd1, 0x5d, 0xa7, 0xd3, 0x90, 0xc6, 0xa5, 0x8d, 0x8d, 0x95, 0xb9, 0x7c, 0xac,
+	0xa8, 0xd5, 0x79, 0x61, 0xd4, 0x7f, 0xbd, 0x9d, 0x73, 0xba, 0xf9, 0x88, 0x53, 0xe7, 0x8c, 0xe8,
+	0x64, 0x51, 0xb0, 0x7a, 0xa7, 0x60, 0xfe, 0x27, 0x06, 0x2e, 0x37, 0xe4, 0x2a, 0x46, 0x95, 0x45,
+	0x97, 0x5f, 0x68, 0x3f, 0x73, 0xda, 0x89, 0x94, 0x30, 0x1c, 0x85, 0xbc, 0x01, 0x23, 0x77, 0x9c,
+	0x1a, 0x0d, 0xe5, 0x05, 0x02, 0x22, 0xef, 0x22, 0x44, 0x35, 0xb6, 0x71, 0x1c, 0xa6, 0x09, 0xf1,
+	0x61, 0x28, 0xc4, 0xaf, 0x37, 0x14, 0x0b, 0xf2, 0xfe, 0x00, 0x35, 0x21, 0x31, 0x7c, 0xca, 0xf3,
+	0x0e, 0x76, 0x4d, 0xcb, 0xae, 0x98, 0xca, 0xc1, 0xfc, 0xdf, 0x8d, 0x78, 0xfe, 0x90, 0xd7, 0x60,
+	0xc8, 0xaa, 0x44, 0xed, 0xe7, 0xfe, 0xbb, 0x89, 0xe6, 0x23, 0x02, 0xf9, 0x10, 0x4e, 0x29, 0x7c,
+	0x70, 0x0c, 0x68, 0x9d, 0x35, 0x88, 0x7f, 0xcc, 0xab, 0xe8, 0x60, 0xaa, 0xb4, 0xc4, 0xe1, 0x18,
+	0x89, 0x16, 0xa5, 0xf3, 0x40, 0xb5, 0x2f, 0x2e, 0x28, 0xd1, 0x96, 0xcb, 0x79, 0x2b, 0x1f, 0xab,
+	0xf2, 0xae, 0x23, 0x42, 0xf2, 0x63, 0xd3, 0x38, 0x70, 0x1f, 0x53, 0xf3, 0xb7, 0x0c, 0x6d, 0x5e,
+	0x44, 0x99, 0xf2, 0x8d, 0x23, 0x32, 0xe5, 0xdf, 0x06, 0x28, 0x74, 0x42, 0x6f, 0xa9, 0xe5, 0x7b,
+	0x0d, 0x7e, 0x8a, 0x15, 0x59, 0x91, 0xd0, 0x36, 0x47, 0x11, 0xac, 0xb9, 0xc2, 0x45, 0xc8, 0x64,
+	0x05, 0xf2, 0x4b, 0xf7, 0xd1, 0x89, 0x38, 0xee, 0x2a, 0xfe, 0x39, 0xb8, 0xdc, 0xd2, 0x07, 0x6c,
+	0x83, 0xe8, 0xd1, 0x4b, 0x5d, 0x94, 0xe6, 0xff, 0x69, 0x28, 0xaf, 0x33, 0x3c, 0xa7, 0xba, 0xce,
+	0x2d, 0x4d, 0xd7, 0x99, 0x15, 0xa4, 0xd1, 0x57, 0xb1, 0xb2, 0x54, 0xfd, 0x74, 0x5a, 0xf1, 0x17,
+	0x40, 0xc0, 0xb7, 0x32, 0x30, 0xbe, 0x19, 0x50, 0x9f, 0x5f, 0xe3, 0x7c, 0xba, 0xa2, 0x86, 0xa3,
+	0xef, 0x1a, 0x28, 0xae, 0xf3, 0xf7, 0x0d, 0x34, 0xef, 0xa9, 0x14, 0xac, 0x37, 0x30, 0xcb, 0xab,
+	0xd2, 0x1b, 0x9d, 0x80, 0xfa, 0x16, 0x42, 0x79, 0xbc, 0xde, 0x8a, 0x1e, 0xaf, 0xd7, 0xb0, 0x18,
+	0x8c, 0x7c, 0x11, 0x86, 0x37, 0xd1, 0x58, 0xa1, 0x47, 0x6b, 0x44, 0xfc, 0xb1, 0x90, 0x2f, 0x11,
+	0x1d, 0xf6, 0xa7, 0xba, 0xc2, 0x61, 0x19, 0xa9, 0xc2, 0x68, 0xd1, 0xa7, 0xf8, 0x0e, 0xc3, 0xd0,
+	0xe0, 0x1e, 0xc7, 0x35, 0x4e, 0x92, 0xf4, 0x38, 0x16, 0x9c, 0xcc, 0x5f, 0xc8, 0x00, 0x89, 0xbf,
+	0x11, 0x33, 0x20, 0x06, 0xcf, 0xed, 0xa0, 0xbf, 0xaf, 0x0d, 0xfa, 0x8b, 0x5d, 0x83, 0xce, 0x3f,
+	0x6f, 0xa0, 0xb1, 0xff, 0x6d, 0x03, 0x4e, 0xa7, 0x13, 0x92, 0x97, 0x61, 0x64, 0x7d, 0xa3, 0x22,
+	0x03, 0x7e, 0xc4, 0xa7, 0x78, 0x6d, 0x3c, 0x53, 0x59, 0xa2, 0x88, 0xbc, 0x09, 0x23, 0x5f, 0xb2,
+	0x8a, 0x6c, 0x15, 0x54, 0x32, 0x13, 0x7d, 0xc3, 0xb7, 0x6b, 0xfa, 0x42, 0x28, 0x90, 0xd4, 0xb1,
+	0xcd, 0x3e, 0xb3, 0xb1, 0xfd, 0x76, 0x06, 0xa6, 0x0b, 0xb5, 0x1a, 0x0d, 0x02, 0xb6, 0xc5, 0xd2,
+	0x20, 0x7c, 0x6e, 0x07, 0x36, 0x3d, 0x94, 0x47, 0xfb, 0xb6, 0x81, 0x46, 0xf5, 0x77, 0x0c, 0x38,
+	0x25, 0xa9, 0x1e, 0xba, 0xf4, 0xd1, 0xc6, 0xbe, 0x4f, 0x83, 0x7d, 0xaf, 0x51, 0x1f, 0x38, 0xfd,
+	0x19, 0x53, 0x33, 0x30, 0xa5, 0x8b, 0x7a, 0xa7, 0xb7, 0x8b, 0x10, 0x4d, 0xcd, 0xe0, 0x69, 0x5f,
+	0xae, 0xc3, 0x68, 0xa1, 0xdd, 0xf6, 0xbd, 0x87, 0x7c, 0xda, 0x4f, 0x0a, 0x07, 0x6c, 0x0e, 0xd2,
+	0x1c, 0xb6, 0x39, 0x88, 0x35, 0xa3, 0x44, 0x5b, 0x3c, 0xd6, 0x7a, 0x92, 0x37, 0xa3, 0x4e, 0x5b,
+	0xea, 0x61, 0x01, 0xcb, 0xcd, 0x9f, 0x1b, 0x82, 0x09, 0xf5, 0x43, 0x88, 0xc9, 0xd3, 0x1a, 0x79,
+	0xbe, 0x1a, 0x17, 0xe1, 0x20, 0xc4, 0x12, 0x25, 0x71, 0x38, 0x51, 0xe6, 0xc8, 0x70, 0xa2, 0x6d,
+	0x98, 0xac, 0xf8, 0x5e, 0xdb, 0x0b, 0x68, 0x9d, 0x3f, 0xa5, 0xc3, 0x57, 0xad, 0x93, 0x8a, 0x2a,
+	0xcd, 0xfa, 0x1c, 0x2f, 0x2e, 0xf0, 0x20, 0xd9, 0x16, 0xd8, 0x76, 0xf2, 0xa1, 0x1d, 0x9d, 0x0f,
+	0xbf, 0x13, 0x75, 0x02, 0x91, 0xfd, 0x20, 0xba, 0x13, 0x65, 0x10, 0xfd, 0x4e, 0x94, 0x41, 0xd4,
+	0x69, 0x31, 0xfc, 0xac, 0xa6, 0x05, 0xf9, 0x05, 0x03, 0xc6, 0x0b, 0xad, 0x96, 0x08, 0x53, 0x3a,
+	0xc2, 0x4f, 0xfb, 0xab, 0xe2, 0x5a, 0xf4, 0xed, 0x8f, 0x75, 0x2d, 0xba, 0xe1, 0x3b, 0x6e, 0x18,
+	0xa0, 0x4a, 0x13, 0x57, 0xa8, 0x9e, 0x05, 0x94, 0x76, 0x90, 0xb7, 0x21, 0x1f, 0xc9, 0x63, 0xb9,
+	0x55, 0xa7, 0x8f, 0x69, 0x30, 0x37, 0x7a, 0x31, 0x7b, 0x79, 0x92, 0xbf, 0x02, 0xa6, 0xdd, 0xf7,
+	0x26, 0x11, 0xcd, 0x6f, 0x1b, 0x70, 0x5a, 0x15, 0x88, 0x6a, 0x67, 0xa7, 0xe9, 0xa2, 0x42, 0x4d,
+	0xae, 0xc1, 0x98, 0x18, 0xaf, 0x48, 0x13, 0xed, 0xce, 0xe6, 0x14, 0xa3, 0x90, 0x25, 0x36, 0x44,
+	0x8c, 0x87, 0xb0, 0x32, 0x9d, 0x4c, 0x4c, 0x37, 0x56, 0xb4, 0x38, 0x27, 0x3a, 0x3b, 0xef, 0xe3,
+	0x6f, 0x7d, 0xec, 0x18, 0xc4, 0x7c, 0x0f, 0x66, 0xf4, 0x56, 0x56, 0x29, 0x66, 0xe4, 0x91, 0x9f,
+	0x66, 0xa4, 0x7f, 0x9a, 0x2c, 0x37, 0xb7, 0x81, 0x74, 0xd1, 0x07, 0x78, 0xb7, 0x4f, 0x43, 0xe9,
+	0x7b, 0x22, 0x2d, 0xeb, 0x5d, 0x88, 0xd1, 0xfb, 0x64, 0xe3, 0x6a, 0x77, 0x23, 0xa9, 0xf9, 0xcf,
+	0xc6, 0xe1, 0x64, 0xca, 0xd2, 0x71, 0xc4, 0xd6, 0x3e, 0xaf, 0x4f, 0x9e, 0xb1, 0x28, 0x04, 0x42,
+	0x4e, 0x99, 0xf7, 0xe4, 0xab, 0x53, 0x7d, 0xa6, 0x4a, 0xbf, 0xa7, 0xa8, 0x3e, 0x89, 0xed, 0x5d,
+	0x8d, 0x52, 0x1a, 0x7e, 0x66, 0x51, 0x4a, 0x8b, 0x30, 0x29, 0xbe, 0x4a, 0x4c, 0xe5, 0x91, 0xd8,
+	0xa0, 0xe4, 0xf3, 0x02, 0xbb, 0x6b, 0x4a, 0xeb, 0x24, 0x9c, 0x47, 0xe0, 0x35, 0x1e, 0x52, 0xc1,
+	0x63, 0x54, 0xe5, 0x81, 0x05, 0xa9, 0x3c, 0x14, 0x12, 0xf2, 0xb7, 0x30, 0xb3, 0x29, 0x42, 0xd4,
+	0xf9, 0x9c, 0xeb, 0x37, 0x9f, 0xeb, 0xcf, 0x66, 0x3e, 0xbf, 0x28, 0xdb, 0x98, 0x3e, 0xaf, 0x53,
+	0x9a, 0x45, 0x7e, 0xcd, 0x80, 0x19, 0x1e, 0x2a, 0xa3, 0x36, 0xb6, 0x6f, 0xf8, 0x43, 0xed, 0xd9,
+	0x34, 0xf6, 0x7c, 0x80, 0xd5, 0xf6, 0x68, 0x6b, 0x77, 0xa3, 0xc8, 0x57, 0x00, 0xa2, 0x19, 0x15,
+	0xcc, 0x81, 0x9e, 0x1e, 0x22, 0x6d, 0xfb, 0x8c, 0x73, 0x4e, 0x85, 0x11, 0x9d, 0x96, 0xcf, 0x36,
+	0x82, 0x92, 0x1f, 0x85, 0x59, 0x36, 0x5f, 0x22, 0x88, 0x08, 0xec, 0x9b, 0x1b, 0xc7, 0x5a, 0x3e,
+	0xdb, 0x7b, 0x6b, 0xbf, 0x96, 0x46, 0xc6, 0x53, 0x48, 0xc4, 0x09, 0xe9, 0xc3, 0xa6, 0x7a, 0x66,
+	0x4d, 0xa3, 0xc0, 0x48, 0x59, 0x6c, 0x3d, 0xcf, 0xf0, 0xd4, 0x63, 0x7d, 0x3b, 0x2b, 0xe7, 0x02,
+	0x5f, 0xdf, 0x02, 0xdd, 0xd5, 0x1a, 0x41, 0xe4, 0x4b, 0x40, 0xa2, 0x18, 0x13, 0x0e, 0xa3, 0x32,
+	0xfb, 0x13, 0xb7, 0x2e, 0xc5, 0xb1, 0x2a, 0xbe, 0x2c, 0x56, 0x85, 0xa4, 0x9b, 0x98, 0x50, 0x98,
+	0x15, 0x1f, 0xcd, 0xa0, 0x32, 0x73, 0x6a, 0x30, 0x37, 0xa5, 0x85, 0x4d, 0xc6, 0x25, 0x71, 0xe6,
+	0x7a, 0x25, 0xfd, 0xaa, 0x76, 0x6e, 0x4f, 0x63, 0x47, 0x6e, 0xc1, 0xd8, 0x8a, 0xb7, 0xe7, 0xb6,
+	0x96, 0xa5, 0xc7, 0x82, 0xb8, 0x3d, 0x6d, 0x30, 0xa0, 0xbd, 0xaf, 0xfb, 0x1d, 0xc4, 0xa8, 0x4c,
+	0xab, 0x2d, 0xf9, 0x07, 0x56, 0xa7, 0x85, 0x36, 0xa0, 0x1c, 0x57, 0x67, 0xea, 0xfe, 0x81, 0xed,
+	0x77, 0x74, 0x87, 0x78, 0x44, 0x3a, 0xb7, 0x03, 0x67, 0x7b, 0x0e, 0x5a, 0x4a, 0xb6, 0x8a, 0xeb,
+	0x7a, 0xb6, 0x8a, 0xb3, 0xbd, 0x16, 0xf7, 0x40, 0xcd, 0x58, 0xf1, 0xcb, 0x46, 0x62, 0x35, 0x17,
+	0xaa, 0x17, 0x4f, 0x5e, 0xd8, 0x6b, 0xbb, 0xcb, 0x60, 0xee, 0x71, 0xbe, 0xde, 0x67, 0x62, 0x95,
+	0x2f, 0xf1, 0x20, 0x07, 0x5f, 0xf9, 0x9f, 0x72, 0x61, 0x37, 0xff, 0x65, 0x16, 0x08, 0x6f, 0x61,
+	0xd1, 0x69, 0x3b, 0x3b, 0x6e, 0xc3, 0x0d, 0x5d, 0x8c, 0x10, 0xca, 0x0b, 0x16, 0xce, 0x4e, 0x83,
+	0xaa, 0xe1, 0x75, 0xc2, 0x83, 0x27, 0x2a, 0xb3, 0x93, 0x4a, 0x5a, 0x17, 0x61, 0x0f, 0x51, 0xcc,
+	0x3c, 0x8d, 0x28, 0x7e, 0x1d, 0x5e, 0x28, 0xb4, 0x31, 0x5f, 0xb8, 0xac, 0xe5, 0x8e, 0xe7, 0x4b,
+	0x21, 0xd2, 0x3c, 0x6d, 0x9d, 0x08, 0xad, 0xab, 0xa5, 0xfd, 0x58, 0x28, 0xfb, 0x48, 0xc5, 0xf7,
+	0x9a, 0xed, 0x50, 0x0d, 0x55, 0x90, 0xfb, 0x48, 0x1b, 0x4b, 0x52, 0xf6, 0x11, 0x4e, 0x22, 0x79,
+	0xb8, 0xbe, 0xdc, 0x47, 0x86, 0x51, 0x30, 0x23, 0x1e, 0xae, 0x4f, 0x7b, 0xec, 0x45, 0x11, 0x09,
+	0x79, 0x07, 0xc6, 0x0b, 0x9d, 0xd0, 0x13, 0x8c, 0x85, 0xeb, 0x59, 0xec, 0x24, 0x26, 0x9a, 0xa2,
+	0xa9, 0x6d, 0x31, 0xba, 0xf9, 0x1f, 0x67, 0xe0, 0x6c, 0xf7, 0xf0, 0x8a, 0xd2, 0x48, 0xc8, 0x8c,
+	0x23, 0x84, 0x2c, 0x4d, 0x1a, 0xb8, 0x45, 0xec, 0x99, 0x49, 0x03, 0x4f, 0x3b, 0xfe, 0x31, 0xa5,
+	0xa1, 0x0a, 0xe3, 0xea, 0x7a, 0x34, 0xf4, 0x71, 0xd7, 0x23, 0x95, 0x0b, 0x26, 0xf0, 0x56, 0xf2,
+	0x43, 0xbf, 0x99, 0xe6, 0xe8, 0xca, 0xb3, 0xae, 0x70, 0xb0, 0xee, 0xe3, 0x2a, 0x8f, 0xb2, 0x99,
+	0xd4, 0xa3, 0xac, 0x4c, 0x20, 0x93, 0x4d, 0x4d, 0x20, 0x53, 0x82, 0xe9, 0x6a, 0x67, 0x47, 0xd6,
+	0x8d, 0x88, 0x43, 0x9a, 0xaf, 0xbe, 0x2d, 0xdb, 0xaf, 0x47, 0x61, 0x6a, 0x24, 0xe6, 0x4f, 0x65,
+	0x60, 0xa2, 0xd2, 0xe8, 0xec, 0xb9, 0xad, 0x92, 0x13, 0x3a, 0xcf, 0xed, 0xe9, 0xfa, 0xb6, 0x76,
+	0xba, 0x8e, 0xfc, 0xb9, 0xa3, 0x0f, 0x1b, 0xe8, 0x68, 0xfd, 0x5d, 0x03, 0xa6, 0x63, 0x12, 0xbe,
+	0xc4, 0x2f, 0xc3, 0x10, 0xfb, 0x21, 0x94, 0xf5, 0x8b, 0x5d, 0x8c, 0x79, 0x4a, 0xd6, 0xe8, 0x2f,
+	0x71, 0xde, 0xd5, 0x5f, 0x6b, 0x44, 0x0e, 0xe7, 0x3e, 0xc7, 0xdf, 0x4d, 0x3b, 0x7e, 0x2a, 0xd6,
+	0xbf, 0x67, 0x40, 0x3e, 0xf9, 0x25, 0xe4, 0x3e, 0x8c, 0x32, 0x4e, 0x6e, 0xf4, 0x06, 0xdb, 0x2b,
+	0x3d, 0xbe, 0xf9, 0x9a, 0x40, 0xe3, 0xcd, 0xc3, 0xce, 0xa7, 0x1c, 0x62, 0x49, 0x0e, 0xe7, 0x2c,
+	0x98, 0x50, 0xb1, 0x52, 0x5a, 0xf7, 0x86, 0xbe, 0xaf, 0x9d, 0x4e, 0xef, 0x07, 0xb5, 0xd5, 0x7f,
+	0x55, 0x6b, 0xb5, 0xd8, 0xd1, 0x06, 0x7d, 0x81, 0x13, 0x13, 0x37, 0x71, 0x29, 0x55, 0xe5, 0x2c,
+	0x45, 0xa0, 0x23, 0x3c, 0x76, 0x2c, 0xe7, 0xf5, 0x09, 0x39, 0xc3, 0x63, 0x79, 0x1b, 0x21, 0xea,
+	0xbe, 0xce, 0x71, 0xcc, 0xbf, 0x96, 0x85, 0xd3, 0x71, 0xf3, 0xf8, 0x7b, 0xa4, 0x15, 0xc7, 0x77,
+	0x9a, 0xc1, 0x11, 0x33, 0xe0, 0x72, 0x57, 0xd3, 0x30, 0x99, 0xa2, 0x6c, 0x9a, 0xd2, 0x20, 0x33,
+	0xd1, 0x20, 0xb4, 0x67, 0xf0, 0x06, 0xc9, 0x66, 0x90, 0xfb, 0x90, 0xad, 0xd2, 0x50, 0xac, 0x45,
+	0x97, 0xba, 0x7a, 0x55, 0x6d, 0xd7, 0xb5, 0x2a, 0x0d, 0xf9, 0x20, 0xf2, 0x70, 0x3c, 0xaa, 0xe5,
+	0x99, 0x60, 0x27, 0xd3, 0x6d, 0x18, 0x59, 0x7a, 0xdc, 0xa6, 0xb5, 0x50, 0x64, 0x2d, 0xbb, 0xd2,
+	0x9f, 0x1f, 0xc7, 0x55, 0x72, 0xa3, 0x51, 0x04, 0xa8, 0x9d, 0xc5, 0x51, 0xce, 0xdd, 0x82, 0x9c,
+	0xac, 0xfc, 0x58, 0x39, 0xbe, 0x6e, 0xc3, 0xb8, 0x52, 0xc9, 0xb1, 0x84, 0xfe, 0x4f, 0x0c, 0x18,
+	0x61, 0x3b, 0xc1, 0xd6, 0xad, 0xe7, 0x74, 0x45, 0xba, 0xa9, 0xad, 0x48, 0x33, 0x4a, 0x2a, 0x1b,
+	0x9c, 0x97, 0xb7, 0x8e, 0x58, 0x8b, 0x0e, 0xd9, 0xbe, 0x12, 0x21, 0x93, 0xbb, 0x30, 0x2a, 0xee,
+	0x53, 0x85, 0xe7, 0x97, 0x9a, 0x1b, 0x47, 0xde, 0xb4, 0x46, 0x0a, 0xbf, 0xd7, 0x4e, 0x9e, 0x90,
+	0x24, 0x35, 0x29, 0xc5, 0x79, 0x0d, 0xb4, 0x54, 0xeb, 0x1e, 0x3a, 0xa0, 0xf3, 0xdc, 0x2e, 0xca,
+	0x23, 0x06, 0x3d, 0xa2, 0x04, 0x0b, 0xc2, 0xc6, 0x97, 0xed, 0xc7, 0xe4, 0xb4, 0xcc, 0x97, 0x9d,
+	0x6a, 0xfe, 0xfb, 0xd7, 0x84, 0x67, 0x45, 0x91, 0x0d, 0x7b, 0x17, 0x26, 0xee, 0x78, 0xfe, 0x23,
+	0xc7, 0xe7, 0xb1, 0xee, 0xf8, 0x99, 0xfc, 0x2e, 0x6d, 0x72, 0x97, 0xc3, 0x79, 0xb4, 0xfc, 0x0f,
+	0x0e, 0xe7, 0x87, 0x16, 0x3d, 0xaf, 0x61, 0x69, 0xe8, 0x64, 0x1d, 0x26, 0x57, 0x9d, 0xc7, 0xca,
+	0x0d, 0x2f, 0xf7, 0x28, 0xbd, 0xf2, 0xe4, 0x70, 0xfe, 0x6c, 0xd3, 0x79, 0x3c, 0xc0, 0xed, 0xae,
+	0x4e, 0x4f, 0x5c, 0x98, 0xaa, 0x78, 0x7e, 0x28, 0x2a, 0x61, 0xc7, 0xbb, 0x6c, 0x8f, 0xfb, 0xe9,
+	0xeb, 0xa9, 0xf7, 0xd3, 0x67, 0xd9, 0x99, 0xd6, 0xde, 0x8d, 0xc8, 0xb5, 0x30, 0x51, 0x8d, 0x31,
+	0x79, 0x17, 0x66, 0x8a, 0xd4, 0x0f, 0xdd, 0x5d, 0xb7, 0xe6, 0x84, 0xf4, 0x8e, 0xe7, 0x37, 0x1d,
+	0xa9, 0x48, 0xa2, 0x6d, 0x09, 0x2f, 0x02, 0x77, 0x11, 0x6c, 0x75, 0x63, 0x92, 0x0f, 0xd3, 0x7c,
+	0x74, 0x87, 0xe3, 0x0b, 0xee, 0x14, 0x1f, 0xdd, 0x5e, 0x17, 0xdc, 0xdd, 0xde, 0xba, 0x7b, 0xfd,
+	0x1c, 0x60, 0x72, 0x8b, 0x37, 0x84, 0xef, 0xcc, 0xd1, 0x0e, 0x2e, 0xd1, 0xb8, 0xf5, 0x70, 0x74,
+	0x59, 0x80, 0xec, 0x62, 0xe5, 0x0e, 0x5a, 0x0b, 0xe5, 0x0d, 0x68, 0x6b, 0xdf, 0x69, 0xd5, 0x50,
+	0xc1, 0x13, 0x4e, 0x67, 0xea, 0x82, 0xb7, 0x58, 0xb9, 0x43, 0x1c, 0x38, 0x59, 0xa1, 0x7e, 0xd3,
+	0x0d, 0xbf, 0x7c, 0xe3, 0x86, 0x32, 0x50, 0x39, 0x6c, 0xda, 0x75, 0xd1, 0xb4, 0xf9, 0x36, 0xa2,
+	0xd8, 0x8f, 0x6f, 0xdc, 0x48, 0x1d, 0x8e, 0xa8, 0x61, 0x69, 0xbc, 0xc8, 0x12, 0x4c, 0xad, 0x3a,
+	0x8f, 0x63, 0x5f, 0xc1, 0x40, 0x44, 0x3b, 0xbc, 0x28, 0x05, 0x2b, 0xf6, 0x33, 0xd4, 0xc2, 0x19,
+	0x75, 0x22, 0xa6, 0x9f, 0xc7, 0xe2, 0x15, 0x08, 0x3f, 0x51, 0x54, 0xd4, 0x14, 0xe1, 0xd4, 0x94,
+	0x4c, 0x05, 0x9d, 0x6c, 0x46, 0xa7, 0x0c, 0xae, 0xa5, 0x8b, 0x64, 0xd0, 0xd7, 0xd5, 0x53, 0x86,
+	0x83, 0x25, 0xda, 0x67, 0x4d, 0x47, 0xe7, 0x3b, 0xee, 0x3c, 0x69, 0xe9, 0x5c, 0xba, 0x0f, 0x2f,
+	0x13, 0xc7, 0x3f, 0xbc, 0x50, 0x18, 0x5a, 0xf1, 0x6a, 0x0f, 0xd0, 0xfd, 0x63, 0x6c, 0xf1, 0x4b,
+	0x6c, 0xba, 0x37, 0xbc, 0xda, 0x83, 0x67, 0xe7, 0xd8, 0x83, 0xec, 0xc9, 0x1a, 0x6b, 0x2a, 0x93,
+	0x02, 0xd1, 0x27, 0xc2, 0x59, 0x64, 0x36, 0xd2, 0xde, 0x95, 0x32, 0xae, 0x57, 0x70, 0xa1, 0x91,
+	0x5d, 0x6b, 0xe9, 0xe4, 0x84, 0x42, 0xbe, 0x44, 0x83, 0x07, 0xa1, 0xd7, 0x2e, 0x36, 0xdc, 0xf6,
+	0x8e, 0xe7, 0xf8, 0x75, 0xb4, 0x07, 0xa4, 0xcd, 0xef, 0xd7, 0x52, 0xe7, 0xf7, 0x4c, 0x9d, 0xd3,
+	0xdb, 0x35, 0xc9, 0xc0, 0xea, 0x62, 0x49, 0x3e, 0x84, 0x29, 0x26, 0xdc, 0x4b, 0x8f, 0x43, 0xda,
+	0xe2, 0x23, 0x3f, 0x83, 0x3b, 0xf3, 0xac, 0x92, 0x43, 0x2c, 0x2a, 0xe4, 0x32, 0x85, 0x93, 0x9d,
+	0x46, 0x04, 0xaa, 0x4c, 0xe9, 0xac, 0x48, 0x1d, 0xe6, 0x56, 0x9d, 0xc7, 0x4a, 0xd2, 0x6c, 0x45,
+	0x48, 0x09, 0x0a, 0x18, 0xbe, 0x5a, 0xc5, 0x04, 0x2c, 0xce, 0xf5, 0xd1, 0x43, 0x5e, 0x7b, 0x72,
+	0x22, 0x3f, 0x0c, 0x67, 0xc4, 0x67, 0x95, 0x30, 0x41, 0xa6, 0xe7, 0x1f, 0x54, 0xf7, 0x1d, 0x74,
+	0x13, 0x3e, 0x79, 0xbc, 0x05, 0x51, 0x76, 0x58, 0x5d, 0xf2, 0xb1, 0x03, 0xce, 0xc8, 0xea, 0x55,
+	0x03, 0xf9, 0x08, 0xa6, 0xb8, 0x19, 0x78, 0xd9, 0x0b, 0x42, 0x3c, 0x84, 0xce, 0x1e, 0xcf, 0xfb,
+	0x8d, 0xdb, 0x96, 0xb9, 0xbf, 0x68, 0xe2, 0xd0, 0x9a, 0xe0, 0x4c, 0xde, 0x86, 0xf1, 0x8a, 0xdb,
+	0xe2, 0x91, 0xfb, 0xe5, 0xca, 0xdc, 0xa9, 0x78, 0xff, 0x69, 0xbb, 0x2d, 0x5b, 0x9e, 0x04, 0xdb,
+	0xd1, 0x72, 0xa1, 0x62, 0x93, 0x6d, 0x18, 0xaf, 0x56, 0x97, 0xef, 0xb8, 0x6c, 0x03, 0x6c, 0x1f,
+	0xcc, 0x9d, 0xee, 0xd1, 0xca, 0x97, 0x53, 0x5b, 0x39, 0x19, 0x04, 0xfb, 0xf8, 0x32, 0x8e, 0x5d,
+	0xf3, 0xda, 0x07, 0x96, 0xca, 0x29, 0xc5, 0x23, 0xec, 0xcc, 0x33, 0xf6, 0x08, 0x2b, 0xc3, 0xb4,
+	0xe2, 0xf9, 0x82, 0x5e, 0x2f, 0x73, 0xf1, 0xe3, 0x41, 0xaa, 0x07, 0x58, 0xd2, 0xaf, 0x3f, 0x49,
+	0x27, 0x5d, 0xc1, 0xce, 0x1e, 0xd7, 0x15, 0xcc, 0x85, 0x19, 0x3e, 0x18, 0x42, 0x0e, 0x70, 0xa4,
+	0xcf, 0xf5, 0xe8, 0xc3, 0x2b, 0xa9, 0x7d, 0x78, 0x52, 0x8c, 0xb4, 0x14, 0x32, 0xbc, 0xf6, 0xe8,
+	0xe6, 0x4a, 0x76, 0x81, 0x08, 0xa0, 0x78, 0x97, 0x07, 0xeb, 0x7a, 0xa1, 0x47, 0x5d, 0xaf, 0xa4,
+	0xd6, 0x35, 0x25, 0xeb, 0xda, 0xe1, 0xd5, 0xa4, 0x70, 0x24, 0x2d, 0x59, 0x8f, 0x94, 0x2f, 0xec,
+	0xd8, 0xf3, 0x38, 0x76, 0xd2, 0x2a, 0xd8, 0x8d, 0x80, 0x11, 0x30, 0xf3, 0x49, 0xa1, 0x4d, 0xf6,
+	0x7b, 0x0a, 0xe7, 0x7b, 0x43, 0xb9, 0xc9, 0xfc, 0x54, 0x9a, 0x23, 0xda, 0x7f, 0x91, 0x49, 0x2c,
+	0x9d, 0xa4, 0x0c, 0xa3, 0xa2, 0x47, 0x84, 0x2e, 0xd9, 0xfd, 0xdd, 0x2f, 0xa6, 0x7e, 0xf7, 0xa8,
+	0xe8, 0x5c, 0x4b, 0xd2, 0x93, 0x47, 0x8c, 0x15, 0xfa, 0xc4, 0x09, 0xe5, 0xfb, 0x6b, 0x7c, 0x65,
+	0x44, 0x90, 0xb6, 0x07, 0x94, 0x8e, 0xef, 0x11, 0xac, 0x3b, 0x9c, 0xe3, 0x66, 0x20, 0x6b, 0x23,
+	0x0f, 0x78, 0xea, 0xbf, 0x6c, 0xe4, 0x56, 0xaa, 0xe7, 0xf9, 0x7b, 0x66, 0x15, 0xb2, 0x5a, 0xcc,
+	0xdf, 0x32, 0x60, 0x52, 0x5b, 0x7b, 0xc9, 0x2d, 0xc5, 0x67, 0x3a, 0x0e, 0x8e, 0xd1, 0x70, 0x70,
+	0x3a, 0x26, 0xbd, 0xa9, 0x6f, 0x09, 0xb7, 0xb2, 0x4c, 0x6f, 0xba, 0xd4, 0x47, 0xa2, 0xfa, 0x5b,
+	0x82, 0xa2, 0x54, 0xc2, 0x43, 0x3d, 0x52, 0x09, 0xff, 0xfa, 0x59, 0x98, 0xd2, 0x95, 0x73, 0x76,
+	0x5a, 0x46, 0x9b, 0xb8, 0x34, 0xd8, 0xf2, 0xe4, 0xd8, 0x08, 0xd1, 0x1e, 0x92, 0x41, 0x08, 0x79,
+	0x15, 0x20, 0xf2, 0xb0, 0x92, 0x36, 0xd9, 0xe1, 0x27, 0x87, 0xf3, 0xc6, 0x9b, 0x96, 0x52, 0x40,
+	0x7e, 0x08, 0x60, 0xcd, 0xab, 0xd3, 0x28, 0xbd, 0x7b, 0x9f, 0x7b, 0xa1, 0xd7, 0xba, 0xd2, 0x62,
+	0x9d, 0x6a, 0x79, 0x75, 0xda, 0x9d, 0x03, 0x4b, 0xe1, 0x48, 0xbe, 0x00, 0xc3, 0x56, 0xa7, 0x41,
+	0xa5, 0xed, 0x6e, 0x5c, 0xae, 0x81, 0x9d, 0x86, 0xf2, 0x24, 0xb7, 0xdf, 0x49, 0xba, 0x03, 0x30,
+	0x00, 0x79, 0x9f, 0xa7, 0xcb, 0x12, 0x39, 0x29, 0x86, 0x63, 0x2b, 0xb5, 0xb2, 0x37, 0x76, 0x65,
+	0xa5, 0x50, 0x48, 0xc8, 0x3a, 0x8c, 0xaa, 0xe6, 0x55, 0x25, 0xf8, 0x46, 0x35, 0xdd, 0x2b, 0xe7,
+	0x1f, 0x91, 0x7f, 0x3b, 0x69, 0x79, 0x95, 0x5c, 0xc8, 0x3b, 0x30, 0xc6, 0xd8, 0xf3, 0xc7, 0x98,
+	0x47, 0x63, 0x5b, 0xb4, 0xd2, 0xa0, 0xe4, 0x7b, 0xcc, 0x31, 0x01, 0xf9, 0x10, 0x13, 0xf6, 0x8b,
+	0xae, 0xee, 0x7b, 0x5f, 0x78, 0xa9, 0xab, 0xab, 0x67, 0x9d, 0x76, 0x3b, 0xe5, 0x59, 0x95, 0x88,
+	0x1f, 0xd9, 0x8b, 0x32, 0x1a, 0x0c, 0x92, 0xe2, 0xec, 0x6a, 0x57, 0x05, 0x73, 0x32, 0x48, 0xbf,
+	0x3b, 0x4d, 0xbf, 0xc6, 0x97, 0xb4, 0x21, 0x1f, 0xab, 0x1d, 0xa2, 0x2e, 0xe8, 0x57, 0xd7, 0x9b,
+	0x5d, 0x75, 0xa9, 0x03, 0xd8, 0x55, 0x5d, 0x17, 0x77, 0x52, 0x8f, 0xdf, 0xd0, 0x17, 0xf5, 0x8d,
+	0xf7, 0xab, 0xef, 0xd5, 0xae, 0xfa, 0x4e, 0xd6, 0x77, 0xba, 0xeb, 0x49, 0xf0, 0x24, 0xef, 0xc0,
+	0xa4, 0x84, 0xe0, 0xfc, 0x10, 0x2f, 0xb1, 0xa0, 0x6d, 0xa2, 0xbe, 0x83, 0x91, 0x0a, 0x7a, 0x92,
+	0x78, 0x15, 0x59, 0xa5, 0xe6, 0xd2, 0x31, 0xa9, 0x51, 0x27, 0xa5, 0x42, 0x47, 0x26, 0x1f, 0xc0,
+	0x78, 0xb9, 0xc9, 0x3e, 0xc4, 0x6b, 0x39, 0x21, 0x15, 0x8e, 0xd9, 0xf2, 0xee, 0x53, 0x29, 0x51,
+	0x44, 0x95, 0x3f, 0xb5, 0x18, 0x17, 0xa9, 0x07, 0x11, 0x85, 0x82, 0x75, 0x1e, 0xb7, 0xa7, 0x0b,
+	0x19, 0x96, 0x4e, 0xdb, 0x2f, 0xa6, 0xdc, 0x3f, 0x2a, 0xec, 0x45, 0xee, 0x17, 0x06, 0x95, 0x57,
+	0x11, 0x89, 0xdc, 0x2f, 0x2a, 0x4f, 0xf2, 0x2e, 0x8c, 0x8b, 0xec, 0x8f, 0x05, 0x6b, 0x2d, 0x98,
+	0xcb, 0xc7, 0xef, 0x94, 0xcb, 0x44, 0x91, 0xb6, 0xe3, 0x27, 0x9c, 0x50, 0x62, 0x7c, 0xf2, 0x65,
+	0x98, 0xdd, 0x76, 0x5b, 0x75, 0xef, 0x51, 0x20, 0xb6, 0x29, 0xb1, 0xd0, 0xcd, 0xc4, 0xbe, 0xc2,
+	0x8f, 0x78, 0x79, 0xa4, 0x2d, 0x74, 0x2d, 0x7c, 0xa9, 0x1c, 0xc8, 0x8f, 0x74, 0x71, 0xe6, 0x12,
+	0x44, 0xfa, 0x49, 0xd0, 0x42, 0x97, 0x04, 0x75, 0x57, 0x9f, 0x14, 0xa7, 0xd4, 0x6a, 0x88, 0x07,
+	0x44, 0xdf, 0xdf, 0xef, 0x79, 0x6e, 0x6b, 0xee, 0x24, 0xae, 0x85, 0x2f, 0x24, 0x83, 0xbb, 0x10,
+	0x8f, 0xbf, 0xe9, 0x28, 0x5f, 0xd6, 0xd5, 0xb5, 0xc2, 0x8f, 0x3c, 0xcd, 0x30, 0x9a, 0xc2, 0x9a,
+	0x7c, 0x00, 0x13, 0xec, 0xff, 0xe8, 0xd8, 0x3a, 0xab, 0x79, 0xac, 0x28, 0x98, 0xa2, 0x1e, 0x1c,
+	0x23, 0x4c, 0x4f, 0x99, 0x72, 0xa2, 0xd5, 0x58, 0x91, 0xdb, 0x00, 0x4c, 0x7f, 0x11, 0xcb, 0xf1,
+	0xa9, 0x38, 0xd5, 0x0e, 0x6a, 0x3d, 0xdd, 0x0b, 0x71, 0x8c, 0xcc, 0xce, 0xd2, 0xec, 0x57, 0xb5,
+	0x53, 0xf7, 0xd8, 0xdc, 0x38, 0x8d, 0xb4, 0x78, 0x96, 0x46, 0xda, 0x80, 0xc3, 0x55, 0xe9, 0x50,
+	0xd0, 0xc9, 0x32, 0x4c, 0x63, 0x4a, 0xa4, 0x72, 0x9d, 0xb6, 0x42, 0xbc, 0xe7, 0x9a, 0x3b, 0xa3,
+	0xdc, 0x03, 0xb2, 0x22, 0xdb, 0x8d, 0xca, 0x54, 0x6d, 0x37, 0x41, 0x46, 0x02, 0x38, 0x19, 0xaf,
+	0x2e, 0xf1, 0xad, 0xe2, 0x1c, 0x76, 0x92, 0xd4, 0xf1, 0xba, 0x31, 0xf8, 0x7a, 0xcc, 0x46, 0x44,
+	0x59, 0xb8, 0xa4, 0xf9, 0x58, 0xad, 0x30, 0x8d, 0x3b, 0xb1, 0x80, 0xdc, 0x2d, 0x56, 0x92, 0x39,
+	0x83, 0xce, 0xe2, 0x17, 0xe0, 0x30, 0xef, 0xd5, 0xda, 0x76, 0x9f, 0xbc, 0x41, 0x29, 0xd4, 0xe4,
+	0x9b, 0x70, 0x4a, 0xae, 0x20, 0xa2, 0x48, 0xc8, 0xf5, 0xb9, 0x63, 0xae, 0xc4, 0xf5, 0x9d, 0xa8,
+	0xea, 0x2e, 0x91, 0x4e, 0xaf, 0x82, 0x38, 0x30, 0x8e, 0xc3, 0x2a, 0x6a, 0x7c, 0xa1, 0x5f, 0x8d,
+	0x97, 0xbb, 0x6a, 0x3c, 0xcd, 0xdf, 0xd7, 0xed, 0xaa, 0x4c, 0xe5, 0x49, 0x16, 0x61, 0x52, 0xcc,
+	0x23, 0x21, 0x6d, 0xe7, 0xe3, 0x07, 0xa2, 0xe5, 0x0c, 0xec, 0x12, 0x38, 0x9d, 0x44, 0x5d, 0x91,
+	0xf9, 0xc5, 0xe6, 0x8b, 0xda, 0x8a, 0x9c, 0xbc, 0xcf, 0xd4, 0x91, 0xd9, 0x8a, 0x14, 0x6b, 0x31,
+	0x4b, 0x8f, 0xdb, 0xbe, 0x30, 0x62, 0x5c, 0x88, 0x93, 0x3e, 0x2a, 0xca, 0x8f, 0x4d, 0x23, 0x0c,
+	0x75, 0x49, 0x48, 0xe3, 0x40, 0x36, 0xe1, 0x64, 0xb4, 0x6b, 0x2b, 0x8c, 0xe7, 0x91, 0x31, 0x1e,
+	0x26, 0xe2, 0xad, 0x3e, 0x9d, 0x6f, 0x1a, 0x3d, 0x71, 0xe0, 0x8c, 0xb6, 0x4f, 0x2b, 0xac, 0x2f,
+	0x22, 0xeb, 0xd7, 0x9e, 0x1c, 0xce, 0xbf, 0xac, 0x6f, 0xf2, 0xe9, 0xec, 0x7b, 0xf1, 0x21, 0x1f,
+	0xc1, 0xb9, 0xe4, 0xde, 0xac, 0xd4, 0xf2, 0x12, 0xd6, 0x72, 0xf5, 0xc9, 0xe1, 0xfc, 0xa5, 0xae,
+	0xed, 0x3d, 0xbd, 0xa2, 0x3e, 0xdc, 0xc8, 0x0f, 0xc1, 0x9c, 0xbe, 0x3f, 0x2b, 0x35, 0x99, 0xf1,
+	0xdb, 0xe3, 0xd1, 0xc6, 0x9e, 0x5e, 0x43, 0x4f, 0x1e, 0x24, 0x84, 0xf9, 0x54, 0xe9, 0x56, 0xaa,
+	0x79, 0x39, 0xfe, 0xa0, 0xae, 0x59, 0x92, 0x5e, 0xdd, 0x51, 0x2c, 0xc9, 0x23, 0xb8, 0x90, 0xb6,
+	0x4d, 0x28, 0x95, 0xbe, 0x12, 0x99, 0x09, 0x5f, 0x4f, 0xdf, 0x72, 0xd2, 0x6b, 0x3e, 0x82, 0x2d,
+	0xf9, 0x10, 0x4e, 0x29, 0xf3, 0x4b, 0xa9, 0xef, 0x55, 0xac, 0x0f, 0x23, 0x7d, 0xd4, 0x89, 0x99,
+	0x5e, 0x4b, 0x3a, 0x0f, 0xf3, 0xaf, 0x18, 0x40, 0xba, 0x17, 0xbe, 0x81, 0x6f, 0x0e, 0xdf, 0x52,
+	0xc2, 0x60, 0xd4, 0xd7, 0x87, 0xa3, 0xbc, 0x91, 0xaa, 0xc2, 0x1b, 0x07, 0xcc, 0x5c, 0xd2, 0x0e,
+	0x58, 0xbd, 0x5f, 0xae, 0xfd, 0x43, 0x03, 0x66, 0xd3, 0xb6, 0xd8, 0x23, 0x1e, 0x7b, 0x31, 0x13,
+	0x2e, 0xd7, 0x78, 0x15, 0xc8, 0x5d, 0xae, 0x23, 0x47, 0xeb, 0x79, 0x18, 0x66, 0x5f, 0x20, 0xdd,
+	0x52, 0xf0, 0x14, 0xc7, 0x3e, 0x31, 0xb0, 0x38, 0x9c, 0x21, 0xf0, 0x58, 0x77, 0x76, 0xcc, 0x1b,
+	0xe6, 0x08, 0xb8, 0x82, 0x5b, 0x1c, 0xce, 0x10, 0xd8, 0x69, 0x51, 0x9e, 0x6e, 0x10, 0x81, 0x1d,
+	0x22, 0x03, 0x8b, 0xc3, 0xc9, 0x25, 0x18, 0x5d, 0x6f, 0xad, 0x50, 0xe7, 0xa1, 0xcc, 0x67, 0x89,
+	0x57, 0x97, 0x5e, 0xcb, 0x6e, 0x30, 0x98, 0x25, 0x0b, 0xcd, 0xef, 0x1a, 0x30, 0xd3, 0xb5, 0xbb,
+	0x1f, 0xfd, 0x9e, 0x4d, 0x7f, 0xe7, 0xd2, 0x41, 0xbe, 0x8f, 0x37, 0x7f, 0x28, 0xbd, 0xf9, 0xe6,
+	0x6f, 0x0e, 0xc1, 0x99, 0x1e, 0x87, 0xad, 0xd8, 0x31, 0xdc, 0x38, 0xd2, 0x31, 0xfc, 0xab, 0xec,
+	0x70, 0xe3, 0xb8, 0xcd, 0x60, 0xc3, 0x8b, 0x5b, 0x1c, 0xfb, 0xd0, 0x61, 0x99, 0x7c, 0x6e, 0xe2,
+	0x25, 0xb1, 0x57, 0x9f, 0xad, 0x21, 0x85, 0x1d, 0x7a, 0xdd, 0x6b, 0xbd, 0xc6, 0xac, 0xcb, 0x35,
+	0x3b, 0xfb, 0x67, 0xc4, 0x35, 0x5b, 0x77, 0x88, 0x1c, 0x7a, 0xa6, 0x0e, 0x91, 0xe9, 0xce, 0x3a,
+	0xc3, 0x4f, 0xe3, 0xba, 0x55, 0x84, 0x49, 0xfe, 0x26, 0x7e, 0x21, 0xe0, 0x83, 0x34, 0x12, 0x67,
+	0x91, 0x0c, 0xb0, 0xc0, 0x76, 0x82, 0xee, 0xb1, 0xd0, 0x68, 0xcc, 0xef, 0x66, 0x74, 0x8f, 0xf2,
+	0x3f, 0x8b, 0xf2, 0x72, 0x05, 0x86, 0xb7, 0xf7, 0xa9, 0x2f, 0x97, 0x1e, 0x6c, 0xc8, 0x23, 0x06,
+	0x50, 0x1b, 0x82, 0x18, 0xe4, 0x0e, 0x4c, 0x55, 0x78, 0xff, 0xc9, 0x4e, 0x19, 0x8a, 0x35, 0xd7,
+	0xb6, 0x38, 0x5f, 0xa5, 0xf4, 0x4a, 0x82, 0xca, 0xfc, 0x61, 0x98, 0x50, 0x1b, 0x8d, 0x0b, 0x0b,
+	0xfb, 0x2d, 0x66, 0x36, 0x5f, 0x58, 0x18, 0xc0, 0xe2, 0xf0, 0x23, 0xdf, 0xaa, 0x8a, 0x7b, 0x33,
+	0x7b, 0x54, 0x6f, 0xb2, 0xca, 0x51, 0x6e, 0x95, 0xca, 0xf1, 0xb7, 0x5a, 0x79, 0xc8, 0x00, 0x16,
+	0x87, 0x3f, 0xd3, 0xca, 0xff, 0xb1, 0xcc, 0xf4, 0xf9, 0x16, 0x8c, 0xc5, 0x1a, 0x7b, 0xfc, 0x22,
+	0xc0, 0xc9, 0x34, 0x3d, 0x3c, 0xc6, 0x64, 0x55, 0x6d, 0x51, 0x7f, 0x47, 0x0b, 0x3f, 0x79, 0xc8,
+	0x00, 0x6a, 0x55, 0x88, 0x71, 0x9c, 0x71, 0xbd, 0x0e, 0xa3, 0x05, 0x71, 0x6f, 0xc3, 0x07, 0x94,
+	0x87, 0xd8, 0x74, 0x5d, 0xd2, 0x48, 0x2c, 0xf3, 0x7b, 0x06, 0x9c, 0x4a, 0x3d, 0xc8, 0xb3, 0x5a,
+	0xb9, 0xc5, 0x40, 0x11, 0xeb, 0xa4, 0xb9, 0x80, 0x63, 0x1c, 0x27, 0x94, 0x66, 0xf0, 0x6f, 0x31,
+	0x5f, 0x82, 0xb1, 0xc8, 0x8c, 0x4c, 0x66, 0xe5, 0xd0, 0xe1, 0x65, 0xbe, 0xb4, 0x46, 0xfe, 0x89,
+	0x01, 0x23, 0xac, 0x09, 0xcf, 0x6d, 0x4e, 0x8e, 0x74, 0xd7, 0x0e, 0xf6, 0x49, 0x03, 0x65, 0xe2,
+	0xf8, 0xd5, 0x11, 0xfe, 0x62, 0xa3, 0xc8, 0xbf, 0xb1, 0x03, 0x53, 0xeb, 0xe5, 0x52, 0x51, 0x39,
+	0x8f, 0xea, 0x49, 0x49, 0xa3, 0xf7, 0xd3, 0x38, 0xc2, 0x41, 0xbc, 0xc6, 0x78, 0x6e, 0xbd, 0x96,
+	0x7e, 0x56, 0x4d, 0x70, 0x64, 0x75, 0x54, 0x0b, 0xab, 0x2b, 0x4a, 0x1d, 0x99, 0x01, 0xeb, 0x08,
+	0x9c, 0x66, 0xa3, 0x47, 0x1d, 0x3a, 0x47, 0xb2, 0x0f, 0xf9, 0xbb, 0xb8, 0x8b, 0x29, 0xb5, 0x64,
+	0xfb, 0xd7, 0xf2, 0xb2, 0xa8, 0xe5, 0x05, 0xbe, 0xfd, 0xa5, 0xd7, 0xd3, 0xc5, 0x35, 0x96, 0xdc,
+	0xa1, 0x23, 0x25, 0xf7, 0x2f, 0x1a, 0x30, 0xc2, 0xb7, 0x49, 0x31, 0x5a, 0x3d, 0x36, 0xe2, 0xed,
+	0x67, 0xb3, 0x11, 0xe7, 0x71, 0xe5, 0xd2, 0x2c, 0xe8, 0xbc, 0x8c, 0x94, 0x60, 0xa4, 0x1a, 0x3a,
+	0x61, 0x47, 0xc6, 0x6a, 0x49, 0xff, 0x1d, 0xb4, 0x2c, 0xf1, 0x92, 0x38, 0x20, 0x29, 0xc0, 0xdf,
+	0x2a, 0x17, 0x8e, 0x41, 0xca, 0x71, 0x2c, 0xcc, 0xe8, 0x91, 0xb1, 0x30, 0x32, 0x7e, 0x68, 0x54,
+	0xc4, 0xc2, 0xe8, 0x11, 0x30, 0x2b, 0x30, 0x26, 0x22, 0x6c, 0x16, 0x0f, 0x84, 0xfd, 0x38, 0xaf,
+	0xdd, 0x4b, 0xd5, 0x17, 0xd5, 0x77, 0xb8, 0x39, 0xc8, 0xde, 0xd1, 0x1e, 0x83, 0x8b, 0x10, 0xc9,
+	0x3a, 0x4f, 0x7f, 0xcc, 0x33, 0x94, 0xe8, 0x89, 0xb6, 0x22, 0xb8, 0x08, 0x41, 0x95, 0x6e, 0xfa,
+	0x29, 0x09, 0x49, 0x62, 0x1e, 0xe6, 0xcf, 0x19, 0x90, 0x4f, 0xca, 0x0b, 0x79, 0x07, 0xc6, 0xa3,
+	0x9c, 0x2e, 0x91, 0x67, 0x3c, 0x5a, 0x7e, 0xe2, 0x24, 0x30, 0x9a, 0x8f, 0xbc, 0x8a, 0x4e, 0x16,
+	0x20, 0xc7, 0xa6, 0x9d, 0xf2, 0x0c, 0x32, 0xae, 0x27, 0x1d, 0x01, 0x53, 0x9d, 0x0a, 0x25, 0x9e,
+	0x32, 0x6b, 0xff, 0x45, 0x16, 0xc6, 0x95, 0xc1, 0x22, 0x57, 0x20, 0x57, 0x0e, 0x56, 0xbc, 0xda,
+	0x03, 0x5a, 0x17, 0xbe, 0x4a, 0x93, 0x4f, 0x0e, 0xe7, 0xc7, 0xdc, 0xc0, 0x6e, 0x20, 0xd0, 0x8a,
+	0x8a, 0xc9, 0x22, 0x4c, 0xf2, 0xbf, 0x64, 0xb2, 0xb7, 0x4c, 0xec, 0x67, 0xc1, 0x91, 0x65, 0x9a,
+	0x37, 0x55, 0x4d, 0xd0, 0x48, 0xc8, 0xd7, 0x00, 0x38, 0x80, 0x8d, 0xef, 0x00, 0x01, 0xb6, 0x72,
+	0x02, 0x9f, 0x12, 0x15, 0x84, 0xae, 0xfa, 0x85, 0x28, 0x0a, 0x0a, 0x43, 0xf2, 0x75, 0x9e, 0xae,
+	0x45, 0x0a, 0xd7, 0xd1, 0xd1, 0x5b, 0xa6, 0x74, 0x92, 0x66, 0xfc, 0xed, 0xf4, 0x68, 0x2b, 0x95,
+	0x25, 0xf9, 0xb6, 0x01, 0xe7, 0x2c, 0x5a, 0xf3, 0x1e, 0x52, 0xff, 0xa0, 0x10, 0x22, 0x96, 0x5a,
+	0xe3, 0xd1, 0xa1, 0x5d, 0x37, 0x45, 0x8d, 0xaf, 0xf9, 0x82, 0x0b, 0xe6, 0xb5, 0x68, 0xb6, 0x43,
+	0xbb, 0x4f, 0x13, 0xfa, 0x54, 0x69, 0xfe, 0xf7, 0x86, 0x32, 0x05, 0xc8, 0x1a, 0x66, 0x9c, 0xe7,
+	0xc2, 0x22, 0xee, 0x45, 0x23, 0x0d, 0x4f, 0xc2, 0x2d, 0xba, 0xbb, 0xf8, 0x82, 0x70, 0x2b, 0x3a,
+	0x19, 0x89, 0x5c, 0x22, 0x13, 0x3d, 0x07, 0x92, 0x2f, 0xc2, 0x10, 0x0e, 0xd5, 0xd1, 0x2f, 0x6b,
+	0xc9, 0xad, 0x66, 0x88, 0x8d, 0x11, 0xb6, 0x1a, 0x29, 0xc9, 0x67, 0x84, 0xdf, 0x7d, 0x56, 0x7b,
+	0xdd, 0x95, 0x81, 0x58, 0x3b, 0xa2, 0x3d, 0x26, 0x0e, 0xf0, 0x53, 0xa4, 0xf5, 0x17, 0x33, 0x90,
+	0x4f, 0x4e, 0x3c, 0xf2, 0x3e, 0x4c, 0xc8, 0x6c, 0x33, 0xcb, 0x8e, 0xc8, 0x21, 0x37, 0x21, 0x72,
+	0xb8, 0x09, 0xb8, 0xbd, 0xef, 0x68, 0xef, 0xa5, 0x69, 0x04, 0x6c, 0x43, 0xde, 0x10, 0x71, 0xe3,
+	0xca, 0x04, 0x0a, 0xbd, 0xb0, 0x9d, 0x78, 0xec, 0x51, 0xa2, 0x91, 0xb7, 0x20, 0xbb, 0x7a, 0xa7,
+	0x20, 0xfc, 0x51, 0xe5, 0xfa, 0xb2, 0x7a, 0xa7, 0xc0, 0x3d, 0x07, 0xb8, 0x43, 0x80, 0xee, 0x9e,
+	0xc0, 0xf0, 0xc9, 0x8a, 0x92, 0xc0, 0x67, 0x44, 0x4b, 0x47, 0x2d, 0xc1, 0xd1, 0xc7, 0x1d, 0x9d,
+	0xc9, 0x47, 0x7d, 0x4c, 0xce, 0xfc, 0xf5, 0x2c, 0x8c, 0x45, 0xf5, 0x13, 0x02, 0xa8, 0x6f, 0x08,
+	0x97, 0x54, 0xfc, 0x9b, 0x9c, 0x85, 0x9c, 0x54, 0x31, 0x84, 0x5b, 0xea, 0x68, 0x20, 0xd4, 0x8b,
+	0x39, 0x90, 0xba, 0x04, 0x57, 0x2f, 0x2c, 0xf9, 0x93, 0xdc, 0x80, 0x48, 0x51, 0xe8, 0xa5, 0x51,
+	0x0c, 0xb1, 0x01, 0xb3, 0x22, 0x34, 0x32, 0x05, 0x19, 0x97, 0xc7, 0x04, 0x8f, 0x59, 0x19, 0xb7,
+	0x4e, 0xde, 0x87, 0x9c, 0x53, 0xaf, 0xd3, 0xba, 0xed, 0xc8, 0x0b, 0xc6, 0x7e, 0x42, 0x93, 0x63,
+	0xdc, 0xf8, 0x8a, 0x8e, 0x54, 0x85, 0x90, 0x14, 0x60, 0xac, 0xe1, 0x70, 0x97, 0x81, 0xfa, 0x00,
+	0xdb, 0x43, 0xcc, 0x21, 0xc7, 0xc8, 0x36, 0x03, 0x5a, 0x27, 0xaf, 0xc1, 0x10, 0x1b, 0x4d, 0xb1,
+	0x1f, 0x44, 0x4f, 0xe3, 0xad, 0x6f, 0x54, 0x78, 0x87, 0x2d, 0x9f, 0xb0, 0x10, 0x81, 0xbc, 0x02,
+	0xd9, 0xce, 0xc2, 0xae, 0x58, 0xe9, 0xf3, 0x71, 0x32, 0xad, 0x08, 0x8d, 0x15, 0x93, 0x9b, 0x90,
+	0x7b, 0xa4, 0xe7, 0x61, 0x3a, 0x95, 0x18, 0xc6, 0x08, 0x3f, 0x42, 0x5c, 0xcc, 0xc1, 0x08, 0x77,
+	0x3a, 0x31, 0x2f, 0x00, 0xc4, 0x55, 0x77, 0x7b, 0x0f, 0x9b, 0x5f, 0x83, 0xb1, 0xa8, 0x4a, 0xf2,
+	0x22, 0xc0, 0x03, 0x7a, 0x60, 0xef, 0x3b, 0xad, 0x7a, 0x83, 0x2b, 0x9c, 0x13, 0xd6, 0xd8, 0x03,
+	0x7a, 0xb0, 0x8c, 0x00, 0x72, 0x06, 0x46, 0xdb, 0x6c, 0x54, 0xe5, 0x53, 0xa5, 0xd6, 0x48, 0xbb,
+	0xb3, 0xc3, 0x24, 0x74, 0x0e, 0x46, 0xd1, 0x88, 0x22, 0x26, 0xda, 0xa4, 0x25, 0x7f, 0x9a, 0xff,
+	0x24, 0x83, 0x99, 0x35, 0x95, 0x76, 0x92, 0x97, 0x61, 0xb2, 0xe6, 0x53, 0xdc, 0x8e, 0xf0, 0x9d,
+	0x5b, 0x51, 0xcf, 0x44, 0x0c, 0x2c, 0xd7, 0xc9, 0x25, 0x98, 0x8e, 0xdf, 0x4e, 0xb5, 0x6b, 0x3b,
+	0x22, 0x69, 0xda, 0x84, 0x35, 0xd9, 0x96, 0x8f, 0xa7, 0x16, 0x77, 0x30, 0x96, 0x3d, 0xaf, 0xe6,
+	0xac, 0x09, 0xa3, 0x17, 0x52, 0xac, 0x69, 0x05, 0x8e, 0x7e, 0x03, 0xa7, 0x61, 0xc4, 0x71, 0xf6,
+	0x3a, 0x2e, 0x8f, 0xab, 0x9d, 0xb0, 0xc4, 0x2f, 0xf2, 0x3a, 0xcc, 0x04, 0xee, 0x5e, 0xcb, 0x09,
+	0x3b, 0xbe, 0x48, 0x6d, 0x4a, 0x7d, 0x14, 0xa9, 0x49, 0x2b, 0x1f, 0x15, 0x14, 0x39, 0x9c, 0xbc,
+	0x09, 0x44, 0xad, 0xcf, 0xdb, 0xf9, 0x88, 0xd6, 0xb8, 0xa8, 0x4d, 0x58, 0x33, 0x4a, 0xc9, 0x3a,
+	0x16, 0x90, 0x97, 0x60, 0xc2, 0xa7, 0x01, 0xaa, 0x64, 0xd8, 0x6d, 0x98, 0x78, 0xda, 0x1a, 0x97,
+	0x30, 0xd6, 0x77, 0x97, 0x21, 0xaf, 0x74, 0x07, 0xa6, 0x05, 0xe2, 0x19, 0xc3, 0xac, 0xa9, 0x18,
+	0x6e, 0xb5, 0xcb, 0x75, 0x73, 0x11, 0x66, 0xba, 0x66, 0x2e, 0x79, 0x93, 0x9f, 0x03, 0xc4, 0x4e,
+	0x3e, 0xc1, 0x8f, 0x3d, 0xe8, 0xf0, 0xa2, 0x6d, 0xe2, 0x02, 0xc9, 0x6c, 0xc1, 0x84, 0xba, 0x12,
+	0x1f, 0x91, 0xb8, 0xee, 0x34, 0x06, 0xcf, 0xf1, 0x65, 0x6a, 0xe4, 0xc9, 0xe1, 0x7c, 0xc6, 0xad,
+	0x63, 0xc8, 0xdc, 0x65, 0xc8, 0x49, 0x7d, 0x42, 0x9c, 0x11, 0xd0, 0x08, 0x26, 0x54, 0xcf, 0x03,
+	0x2b, 0x2a, 0x35, 0x5f, 0x83, 0x51, 0xb1, 0xd8, 0xf6, 0x37, 0x7d, 0x99, 0x3f, 0x99, 0x81, 0x69,
+	0x8b, 0xb2, 0xa5, 0x80, 0xf2, 0x6c, 0x95, 0x9f, 0xb2, 0xf7, 0x66, 0xb5, 0x6f, 0xeb, 0x93, 0x27,
+	0xf2, 0x37, 0x0c, 0x38, 0x99, 0x82, 0xfb, 0xb1, 0xb2, 0xff, 0xdf, 0x82, 0xb1, 0x92, 0xeb, 0x34,
+	0x0a, 0xf5, 0x7a, 0x14, 0x04, 0x88, 0x7a, 0x63, 0x9d, 0x49, 0x9a, 0xc3, 0xa0, 0xea, 0xb6, 0x1b,
+	0xa1, 0x92, 0xab, 0x42, 0x28, 0xe2, 0xa7, 0x86, 0xe4, 0x8b, 0xb6, 0xc0, 0xdb, 0x14, 0xbf, 0x67,
+	0x8b, 0x89, 0x63, 0x38, 0x30, 0x76, 0x78, 0x7c, 0x6e, 0x87, 0x2e, 0x3d, 0x71, 0x4c, 0xf2, 0xf3,
+	0x06, 0x3a, 0xa0, 0xfe, 0x5c, 0x06, 0x4e, 0xa7, 0x13, 0x7e, 0xdc, 0x87, 0x1c, 0x30, 0x49, 0xa7,
+	0xf2, 0x68, 0x30, 0x3e, 0xe4, 0xc0, 0x33, 0x7a, 0x22, 0x7e, 0x8c, 0x40, 0x76, 0x61, 0x72, 0xc5,
+	0x09, 0xc2, 0x65, 0xea, 0xf8, 0xe1, 0x0e, 0x75, 0xc2, 0x01, 0x74, 0xdd, 0x57, 0xc4, 0xd7, 0xcc,
+	0xe1, 0xf6, 0xb7, 0x2f, 0x29, 0x13, 0xaa, 0xa0, 0xce, 0x36, 0x12, 0x94, 0xa1, 0x01, 0x04, 0xe5,
+	0x1b, 0x30, 0x5d, 0xa5, 0x4d, 0xa7, 0xbd, 0xef, 0xf9, 0x54, 0x58, 0xeb, 0xaf, 0xc1, 0x64, 0x04,
+	0x4a, 0x95, 0x16, 0xbd, 0x58, 0xc3, 0x57, 0x3a, 0x22, 0x5e, 0x4a, 0xf4, 0x62, 0xf3, 0x2f, 0x67,
+	0xe0, 0x4c, 0xa1, 0x26, 0x6e, 0xe4, 0x45, 0x81, 0x74, 0x1c, 0xfa, 0x84, 0xeb, 0x26, 0xd7, 0x61,
+	0x6c, 0xd5, 0x79, 0xbc, 0x42, 0x9d, 0x80, 0x06, 0x22, 0x8d, 0x36, 0x57, 0xd4, 0x9c, 0xc7, 0xf1,
+	0x45, 0xb5, 0x15, 0xe3, 0xa8, 0xc7, 0xd2, 0xa1, 0xa7, 0x3c, 0x96, 0x9a, 0x30, 0xb2, 0xec, 0x35,
+	0xea, 0x62, 0x1b, 0x13, 0x37, 0x25, 0xfb, 0x08, 0xb1, 0x44, 0x89, 0xf9, 0x87, 0x06, 0x4c, 0x45,
+	0x2d, 0xc6, 0x26, 0x7c, 0xe2, 0x5d, 0x72, 0x09, 0x46, 0xb1, 0xa2, 0x72, 0x49, 0xdd, 0x34, 0x1a,
+	0x0c, 0x64, 0xbb, 0x75, 0x4b, 0x16, 0xaa, 0x3d, 0x31, 0xfc, 0x74, 0x3d, 0x61, 0xfe, 0x87, 0x78,
+	0x09, 0xa3, 0x7e, 0x25, 0xdb, 0x89, 0x94, 0x86, 0x18, 0x03, 0x36, 0x24, 0xf3, 0xcc, 0x86, 0x24,
+	0xdb, 0x73, 0x48, 0xbe, 0x95, 0x81, 0xf1, 0xa8, 0xb1, 0x9f, 0xb2, 0x8c, 0x6b, 0xd1, 0x77, 0x0d,
+	0x14, 0x44, 0x5a, 0x55, 0xd6, 0x0a, 0x11, 0xab, 0xf9, 0x45, 0x18, 0x11, 0x93, 0xc9, 0x48, 0x38,
+	0xd0, 0x24, 0x46, 0x77, 0x71, 0x4a, 0xb0, 0x1e, 0xc1, 0x01, 0x0d, 0x2c, 0x41, 0x87, 0x51, 0xba,
+	0xdb, 0x74, 0x47, 0xdc, 0xc9, 0x3d, 0xb7, 0x7b, 0x54, 0x7a, 0x94, 0x6e, 0xfc, 0x61, 0x03, 0xed,
+	0x4e, 0x87, 0xc3, 0x90, 0x4f, 0x92, 0x1c, 0x9d, 0xd3, 0xae, 0xd2, 0xd9, 0xe1, 0x5a, 0x38, 0xcf,
+	0x69, 0xd7, 0xee, 0xec, 0x58, 0x0c, 0x46, 0x2e, 0xc1, 0x50, 0xc5, 0x77, 0x1f, 0xe2, 0x57, 0x4f,
+	0xf0, 0x8b, 0xdf, 0xb6, 0xef, 0x3e, 0x54, 0x2f, 0x7e, 0x59, 0x39, 0x1e, 0x7d, 0x57, 0xaa, 0x18,
+	0xf9, 0x84, 0x2a, 0xb8, 0x38, 0xfa, 0x36, 0x82, 0x64, 0x1e, 0x5f, 0x89, 0xc6, 0xb6, 0xca, 0x45,
+	0xea, 0xf8, 0x22, 0xff, 0x9a, 0x58, 0xce, 0x70, 0xab, 0xdc, 0x41, 0x30, 0x7f, 0x4c, 0xca, 0x52,
+	0x91, 0x48, 0x03, 0x88, 0xf2, 0x53, 0x4e, 0xe0, 0xa3, 0x4f, 0x83, 0x17, 0xa5, 0x9d, 0x4e, 0x65,
+	0x6d, 0xab, 0xb3, 0x39, 0x85, 0xef, 0xb3, 0xb4, 0x26, 0x56, 0x44, 0x36, 0x0e, 0x34, 0x79, 0xe4,
+	0x8e, 0x64, 0x26, 0x43, 0x03, 0x81, 0x67, 0xeb, 0x88, 0x0c, 0x1f, 0x31, 0x13, 0xf2, 0x1e, 0x8c,
+	0xab, 0xf1, 0x6c, 0x3c, 0xea, 0xea, 0x3c, 0xcf, 0x82, 0xd1, 0xe3, 0x3d, 0x03, 0x95, 0x80, 0xec,
+	0xc0, 0x99, 0xa2, 0xd7, 0x0a, 0x3a, 0x4d, 0x5a, 0xd7, 0xee, 0x8c, 0xcb, 0x25, 0x3c, 0x8a, 0x8e,
+	0xf1, 0xe0, 0x98, 0x9a, 0x40, 0x11, 0xe1, 0x53, 0xd2, 0x3b, 0x51, 0x3f, 0x80, 0xf4, 0x62, 0x44,
+	0x36, 0x60, 0xbc, 0x5a, 0x58, 0x5d, 0x91, 0x31, 0x49, 0xe3, 0xfa, 0xb2, 0x11, 0x97, 0x94, 0xd8,
+	0xc4, 0xe0, 0x61, 0xf9, 0x4e, 0xb3, 0x21, 0x9d, 0xe3, 0x54, 0x3b, 0xa5, 0x82, 0x6c, 0x7e, 0x46,
+	0x95, 0x6f, 0xa1, 0x6e, 0xf4, 0x95, 0x6f, 0xf3, 0xbf, 0x19, 0x81, 0xe9, 0x44, 0x75, 0xe2, 0xfc,
+	0x63, 0x74, 0x9d, 0x7f, 0xaa, 0x00, 0xdc, 0xe8, 0x35, 0xa0, 0x75, 0x4a, 0xfa, 0x55, 0x8f, 0x8b,
+	0xa8, 0x84, 0x68, 0xac, 0x14, 0x36, 0x8c, 0x29, 0x97, 0x84, 0x01, 0xad, 0x93, 0x11, 0x53, 0x2e,
+	0x4c, 0x0a, 0xd3, 0x98, 0x0d, 0x99, 0x87, 0x61, 0x4c, 0x97, 0xa2, 0xba, 0xb5, 0xbb, 0x0c, 0x60,
+	0x71, 0x38, 0x79, 0x19, 0x46, 0xd8, 0xe6, 0x5c, 0x2e, 0x89, 0xc9, 0x85, 0x6b, 0x16, 0xdb, 0xbd,
+	0xd9, 0x4e, 0x28, 0x8a, 0xc8, 0x2d, 0x98, 0xe0, 0x7f, 0x89, 0xb8, 0xca, 0x11, 0xdd, 0xc3, 0xc3,
+	0x76, 0xeb, 0x32, 0xb4, 0x52, 0xc3, 0x63, 0x5a, 0x6b, 0xb5, 0xb3, 0x23, 0x5e, 0xae, 0x1c, 0x8d,
+	0xb5, 0xd6, 0x80, 0x03, 0xf1, 0xf9, 0xb1, 0x08, 0x81, 0xed, 0x91, 0xc2, 0xb9, 0x2c, 0x87, 0x67,
+	0x15, 0xdc, 0x23, 0xb9, 0x53, 0x99, 0x25, 0x4a, 0xc8, 0x15, 0x6e, 0x7f, 0x46, 0x75, 0x83, 0xe7,
+	0xc3, 0x46, 0x8b, 0x31, 0x1e, 0x78, 0x51, 0xe7, 0x88, 0x8a, 0x59, 0xe5, 0xec, 0xef, 0xa5, 0xa6,
+	0xe3, 0x36, 0x84, 0xb8, 0x62, 0xe5, 0x88, 0x4b, 0x19, 0xd4, 0x8a, 0x11, 0xc8, 0x3b, 0x30, 0xc5,
+	0x7e, 0x14, 0xbd, 0x66, 0xd3, 0x6b, 0x21, 0xfb, 0xf1, 0x38, 0x02, 0x1e, 0x49, 0x6a, 0x58, 0xc4,
+	0x6b, 0x49, 0xe0, 0xb2, 0x75, 0x0a, 0x6f, 0xa3, 0x3a, 0xdc, 0x32, 0x3e, 0x11, 0xaf, 0x53, 0x48,
+	0x1a, 0x70, 0xb8, 0xa5, 0x22, 0x91, 0xdb, 0x30, 0xc9, 0x7e, 0xde, 0x75, 0x1f, 0x52, 0x5e, 0xe1,
+	0x64, 0x7c, 0x31, 0x88, 0x54, 0x7b, 0xac, 0x84, 0xd7, 0xa7, 0x63, 0x92, 0x2f, 0xc1, 0x29, 0xe4,
+	0x54, 0xf3, 0xda, 0xb4, 0x5e, 0xd8, 0xdd, 0x75, 0x1b, 0x2e, 0xce, 0x5e, 0x11, 0x41, 0x88, 0xd6,
+	0x48, 0x5e, 0x31, 0x62, 0xd8, 0x4e, 0x8c, 0x62, 0xa5, 0x53, 0x92, 0x6d, 0xc8, 0x17, 0x3b, 0x41,
+	0xe8, 0x35, 0x0b, 0x61, 0xe8, 0xbb, 0x3b, 0x9d, 0x90, 0x06, 0x73, 0xd3, 0x5a, 0x9c, 0x1d, 0x9b,
+	0x1c, 0x51, 0x21, 0xb7, 0x33, 0xd4, 0x90, 0xc2, 0x76, 0x22, 0x12, 0xab, 0x8b, 0x89, 0xf9, 0x5f,
+	0x1b, 0x30, 0xa9, 0x91, 0x92, 0xb7, 0x60, 0xe2, 0x8e, 0xef, 0xd2, 0x56, 0xbd, 0x71, 0xa0, 0x1c,
+	0x80, 0x50, 0x3b, 0xde, 0x15, 0x70, 0xfe, 0xd5, 0x1a, 0x5a, 0x64, 0x3f, 0xc8, 0xa4, 0xba, 0xce,
+	0x5c, 0xe7, 0xd1, 0x15, 0x42, 0x40, 0xb3, 0x71, 0xe0, 0x2f, 0x0a, 0xa8, 0x90, 0x4e, 0x05, 0x85,
+	0xbc, 0x0b, 0x23, 0xfc, 0xde, 0x4a, 0xf8, 0x71, 0x9c, 0x4d, 0xfb, 0x4c, 0x1e, 0xc9, 0x83, 0x82,
+	0x88, 0xd7, 0xe5, 0x81, 0x25, 0x88, 0xcc, 0x5f, 0x30, 0x80, 0x74, 0xa3, 0x1e, 0x61, 0x4f, 0x39,
+	0xf2, 0x1a, 0xfe, 0x8b, 0xd1, 0x6c, 0xcc, 0x6a, 0xd6, 0x43, 0x56, 0x13, 0x2f, 0xe0, 0x1d, 0x2f,
+	0x66, 0x9d, 0x6a, 0xe0, 0xe1, 0xc5, 0xe6, 0x5f, 0xc8, 0x00, 0xc4, 0xd8, 0xe4, 0xf3, 0x3c, 0xad,
+	0xef, 0x97, 0x3a, 0x4e, 0xc3, 0xdd, 0x75, 0xf5, 0x04, 0x34, 0xc8, 0xe4, 0x1b, 0xb2, 0xc4, 0xd2,
+	0x11, 0xc9, 0xfb, 0x30, 0x5d, 0xad, 0xe8, 0xb4, 0x4a, 0x0a, 0xd3, 0xa0, 0x6d, 0x27, 0xc8, 0x93,
+	0xd8, 0xe8, 0xaf, 0xa5, 0x8e, 0x06, 0xf7, 0xd7, 0xe2, 0x03, 0x21, 0x4a, 0xd8, 0xc2, 0x52, 0xad,
+	0xe0, 0x8b, 0x91, 0x75, 0x5a, 0x2f, 0x97, 0xc4, 0x2a, 0x85, 0xad, 0x0b, 0xda, 0x76, 0x9b, 0x17,
+	0xe0, 0x33, 0x85, 0x1a, 0x5e, 0xdc, 0x91, 0xc3, 0x3d, 0xa2, 0x75, 0x7e, 0x09, 0xcd, 0x49, 0x4d,
+	0x2f, 0xa4, 0xe2, 0x14, 0xfd, 0xdc, 0xea, 0xd3, 0xf1, 0xa5, 0xe7, 0xb0, 0x16, 0x84, 0xa0, 0x7d,
+	0x1d, 0xc7, 0xd8, 0xba, 0x19, 0x2b, 0xbf, 0xfc, 0xfa, 0x53, 0x5e, 0x7a, 0x2a, 0xaa, 0xdf, 0xdf,
+	0x30, 0xe0, 0x54, 0x2a, 0x2d, 0xb9, 0x06, 0x10, 0xdb, 0x2a, 0x44, 0x2f, 0xf1, 0xd7, 0x22, 0x23,
+	0xa8, 0xa5, 0x60, 0x90, 0xaf, 0x26, 0xad, 0x0c, 0x47, 0x6f, 0x84, 0xe7, 0x64, 0x3a, 0x03, 0xdd,
+	0xca, 0x90, 0x62, 0x5b, 0x30, 0x7f, 0x23, 0x0b, 0x33, 0x4a, 0x34, 0x2d, 0x6f, 0xeb, 0x11, 0xfe,
+	0x73, 0x0f, 0xe4, 0xcb, 0xa4, 0xc2, 0x13, 0x3a, 0xa3, 0xbd, 0x4e, 0xdc, 0xc5, 0xed, 0x9a, 0x8a,
+	0xcc, 0x73, 0x78, 0xe0, 0xd2, 0x29, 0x1e, 0x2a, 0xed, 0xf2, 0x88, 0xd6, 0x98, 0x93, 0x00, 0x26,
+	0x4b, 0x07, 0x2d, 0xa7, 0x19, 0xd5, 0xc6, 0x2f, 0xea, 0x5f, 0xef, 0x59, 0x9b, 0x86, 0xcd, 0xab,
+	0x93, 0x3a, 0xe7, 0x5c, 0x9d, 0x97, 0xa5, 0xc4, 0xfa, 0x68, 0x54, 0xe7, 0xde, 0x87, 0x99, 0xae,
+	0x46, 0x1f, 0x2b, 0x9d, 0xc8, 0x36, 0x90, 0xee, 0x76, 0xa4, 0x70, 0x78, 0x5d, 0x4f, 0x56, 0x73,
+	0x2a, 0xba, 0xc6, 0x6b, 0x36, 0x9d, 0x56, 0x9d, 0x5f, 0xfb, 0x2f, 0xa8, 0xc9, 0x46, 0x7e, 0x29,
+	0xa3, 0xba, 0xf2, 0x3f, 0xef, 0xb3, 0xee, 0x8b, 0xda, 0x29, 0xeb, 0x42, 0xaf, 0x31, 0x1d, 0xe8,
+	0x34, 0xfb, 0xfd, 0x2c, 0x9c, 0xe9, 0x41, 0x49, 0x0e, 0x92, 0x42, 0xc4, 0x4f, 0xb7, 0x37, 0xfa,
+	0x57, 0xf8, 0x2c, 0x44, 0x89, 0x7c, 0x9e, 0x07, 0xf3, 0xd5, 0xf0, 0x11, 0x22, 0x71, 0xae, 0xe3,
+	0x2f, 0xbd, 0x45, 0xd0, 0x64, 0x14, 0x1f, 0x87, 0x92, 0xf7, 0x61, 0x18, 0xe3, 0x38, 0x12, 0xd9,
+	0x3c, 0x18, 0x06, 0xc2, 0x95, 0xd4, 0x27, 0xec, 0xa7, 0x96, 0xfa, 0x04, 0x9f, 0xde, 0xfe, 0x1c,
+	0x64, 0x0b, 0xdb, 0x55, 0x31, 0x2e, 0x53, 0x2a, 0xf9, 0x76, 0x35, 0xce, 0xe2, 0xe8, 0x68, 0xe9,
+	0x16, 0x19, 0x05, 0x23, 0xbc, 0x5b, 0xac, 0x88, 0x51, 0x51, 0x09, 0xef, 0x16, 0x2b, 0x31, 0xe1,
+	0x5e, 0x4d, 0x8b, 0x8e, 0xbe, 0x5b, 0xac, 0x7c, 0x72, 0x62, 0xff, 0x33, 0x19, 0x1e, 0x81, 0xc8,
+	0x3f, 0xec, 0x7d, 0x98, 0xd0, 0x92, 0x89, 0x19, 0xb1, 0x3e, 0x16, 0x25, 0x42, 0x4b, 0xf8, 0x49,
+	0x68, 0x04, 0x32, 0x1f, 0x6a, 0xf4, 0x88, 0xb7, 0xea, 0xe6, 0xa0, 0x3f, 0xfc, 0x9d, 0xcc, 0x87,
+	0x1a, 0x91, 0x90, 0x9b, 0x90, 0xdb, 0xa0, 0x2d, 0xa7, 0x15, 0x46, 0x86, 0x36, 0x74, 0xcb, 0x0b,
+	0x11, 0xa6, 0x6b, 0x0d, 0x11, 0x22, 0x3e, 0xb9, 0xae, 0x3c, 0x41, 0x1e, 0xed, 0xc5, 0xdc, 0x59,
+	0x54, 0x29, 0x49, 0xbc, 0x59, 0xaf, 0x13, 0x99, 0xbf, 0x64, 0xc0, 0xa8, 0x18, 0x48, 0xe5, 0xdd,
+	0x5b, 0x63, 0x80, 0x77, 0x6f, 0x6f, 0xc1, 0x98, 0x08, 0xa6, 0xd1, 0x5f, 0xab, 0x17, 0xf1, 0x37,
+	0x89, 0xd7, 0xea, 0x23, 0xd4, 0x81, 0xbd, 0xce, 0xff, 0x9a, 0x68, 0xd9, 0xdd, 0x62, 0x85, 0x2c,
+	0x40, 0x4e, 0x3e, 0x1f, 0x2e, 0xda, 0x86, 0xcb, 0x8e, 0x7c, 0x67, 0x5c, 0xed, 0x20, 0x89, 0xa7,
+	0xbf, 0xc2, 0x9f, 0x19, 0xfc, 0x15, 0xfe, 0x41, 0xdb, 0x47, 0x53, 0x16, 0x89, 0xad, 0x9b, 0x2b,
+	0x6e, 0x10, 0x92, 0x7b, 0xaa, 0x37, 0xbf, 0x28, 0x92, 0x2b, 0xc5, 0xb9, 0x5e, 0x2b, 0xc5, 0xd6,
+	0x4d, 0x2b, 0x85, 0x0a, 0xef, 0x6b, 0x62, 0x70, 0x95, 0xfa, 0x0f, 0x9f, 0xe3, 0x55, 0x3a, 0xfd,
+	0xbe, 0x26, 0xf9, 0x79, 0x03, 0x2d, 0xd2, 0xff, 0x22, 0x03, 0xa7, 0xd3, 0x09, 0xd5, 0x6f, 0x31,
+	0xfa, 0x7c, 0xcb, 0x65, 0xc8, 0x2d, 0x7b, 0x41, 0xa8, 0xb8, 0x46, 0xa1, 0x59, 0x79, 0x5f, 0xc0,
+	0xac, 0xa8, 0x94, 0x9d, 0xb9, 0xd9, 0xdf, 0xd1, 0xf4, 0x44, 0x7e, 0x18, 0x77, 0xc7, 0xce, 0xdc,
+	0xbc, 0x88, 0xdc, 0x85, 0x9c, 0x25, 0x1c, 0xcf, 0x13, 0x5d, 0x23, 0xc1, 0x91, 0x36, 0x45, 0x7c,
+	0x01, 0xd1, 0x72, 0xba, 0x09, 0x18, 0x29, 0xc0, 0xa8, 0x18, 0xfd, 0xc4, 0x95, 0x64, 0x8a, 0xc8,
+	0xe8, 0x69, 0x16, 0x25, 0x1d, 0x5b, 0x51, 0xf0, 0x72, 0xa9, 0x5c, 0x92, 0x3e, 0xe4, 0xb8, 0xa2,
+	0xf0, 0xcb, 0x27, 0x3d, 0xb1, 0x63, 0x84, 0x68, 0xfe, 0x64, 0x06, 0x60, 0x9b, 0xee, 0x3c, 0xdf,
+	0xef, 0x87, 0x7c, 0x4e, 0x93, 0x30, 0xc5, 0xf3, 0x62, 0xf0, 0xe7, 0x43, 0xd6, 0xd1, 0x03, 0x62,
+	0xf0, 0xc7, 0x43, 0xe6, 0x61, 0x98, 0x5b, 0x3b, 0x95, 0x43, 0x22, 0x37, 0x73, 0x72, 0xb8, 0xb9,
+	0x03, 0xb3, 0x77, 0x69, 0x18, 0x9b, 0xb7, 0xe4, 0x95, 0x56, 0x7f, 0xb6, 0x6f, 0xc0, 0x98, 0xc0,
+	0xd7, 0x9f, 0x82, 0x97, 0xa1, 0xac, 0x68, 0x8b, 0x91, 0x08, 0x6c, 0x35, 0x2a, 0xd1, 0x06, 0x0d,
+	0xe9, 0x27, 0x5b, 0x4d, 0x15, 0x08, 0xff, 0x14, 0xfc, 0xb2, 0xc1, 0x6a, 0x38, 0xb2, 0x7f, 0xb6,
+	0xe0, 0x54, 0xd4, 0xf6, 0x67, 0xc9, 0xf7, 0x3a, 0x3b, 0x52, 0x8a, 0x0c, 0x85, 0x31, 0xc7, 0x3e,
+	0x3e, 0x0d, 0x8f, 0xe1, 0x9c, 0x24, 0xd8, 0x76, 0x23, 0x17, 0xb2, 0x81, 0x68, 0xc9, 0x3b, 0x30,
+	0xae, 0xd0, 0x88, 0x1c, 0xb0, 0x68, 0xfe, 0x7c, 0xe4, 0x86, 0xfb, 0x76, 0xc0, 0xe1, 0xaa, 0xf9,
+	0x53, 0x41, 0x37, 0x3f, 0x84, 0x17, 0x22, 0x87, 0xfb, 0x94, 0xaa, 0x13, 0xcc, 0x8d, 0xe3, 0x31,
+	0x5f, 0x8b, 0x3f, 0xab, 0xdc, 0x8a, 0xc2, 0xbf, 0x24, 0x6f, 0xa2, 0x7e, 0x96, 0xf8, 0x98, 0xf3,
+	0x5d, 0x01, 0x65, 0x4a, 0xdc, 0x98, 0xf9, 0xb6, 0xd2, 0xd8, 0x14, 0x86, 0x1a, 0xb1, 0x91, 0x24,
+	0xfe, 0xc9, 0x0c, 0x4c, 0xaf, 0x97, 0x4b, 0xc5, 0xc8, 0xab, 0xe5, 0x53, 0xf6, 0xb8, 0x89, 0xf6,
+	0x6d, 0xbd, 0xd7, 0x1b, 0x73, 0x13, 0x4e, 0x26, 0xba, 0x01, 0x55, 0x87, 0xf7, 0xb8, 0x63, 0x7c,
+	0x04, 0x96, 0x6a, 0xc3, 0xe9, 0x34, 0xf6, 0x5b, 0x37, 0xad, 0x04, 0xb6, 0xf9, 0x77, 0x72, 0x09,
+	0xbe, 0x62, 0x09, 0x7b, 0x03, 0xc6, 0xca, 0x41, 0xd0, 0xa1, 0xfe, 0xa6, 0xb5, 0xa2, 0x9a, 0x0a,
+	0x5c, 0x04, 0xda, 0x1d, 0xbf, 0x61, 0xc5, 0x08, 0xe4, 0x0a, 0xe4, 0x44, 0x56, 0x3c, 0xb9, 0x26,
+	0xa0, 0xd5, 0x36, 0x4a, 0xaa, 0x67, 0x45, 0xc5, 0xe4, 0x2d, 0x98, 0xe0, 0x7f, 0x73, 0x69, 0x13,
+	0x1d, 0x8e, 0xc6, 0x41, 0x81, 0xce, 0xa5, 0xd3, 0xd2, 0xd0, 0xc8, 0x55, 0xc8, 0x16, 0x8a, 0x96,
+	0xfa, 0x02, 0xb4, 0x53, 0xf3, 0xf9, 0x4b, 0xf0, 0xfa, 0x21, 0xa2, 0x68, 0x31, 0xed, 0x4f, 0x98,
+	0x92, 0x7c, 0x61, 0xc9, 0x46, 0x09, 0x90, 0xd6, 0xa6, 0xc4, 0x66, 0x86, 0x30, 0x72, 0x1d, 0x46,
+	0x4b, 0x6e, 0xd0, 0x6e, 0x38, 0x07, 0xc2, 0x8e, 0xcd, 0x53, 0x9e, 0x73, 0x90, 0x2a, 0x33, 0x02,
+	0x8b, 0x5c, 0x81, 0x61, 0x34, 0xb2, 0x0a, 0x5b, 0x36, 0x4f, 0x0c, 0xce, 0x00, 0x5a, 0x62, 0x70,
+	0x06, 0xc0, 0xa4, 0xab, 0x3c, 0x77, 0xdc, 0x98, 0x92, 0x74, 0x35, 0x99, 0x33, 0x4e, 0xe0, 0x74,
+	0x47, 0x52, 0xc1, 0xb3, 0x8c, 0xa4, 0xda, 0x81, 0x33, 0x77, 0xd1, 0x7a, 0xa3, 0xc7, 0xb7, 0x6f,
+	0x5a, 0x65, 0x61, 0x0f, 0xc7, 0x1b, 0x1f, 0x6e, 0xe0, 0x49, 0x86, 0xc8, 0xdb, 0x1d, 0x5f, 0x7d,
+	0xc1, 0xa3, 0x17, 0x23, 0xf2, 0x65, 0x98, 0x4d, 0x2b, 0x12, 0x56, 0x73, 0x8c, 0xe4, 0x4e, 0xaf,
+	0x40, 0x8d, 0xe4, 0x4e, 0xe3, 0x40, 0x56, 0x20, 0xcf, 0xe1, 0x85, 0x7a, 0xd3, 0x6d, 0x71, 0xcb,
+	0xff, 0x64, 0xfc, 0xfa, 0xa6, 0xe0, 0xea, 0xb0, 0x42, 0x7e, 0x03, 0xa0, 0x85, 0x48, 0x24, 0x28,
+	0xc9, 0xcf, 0x1b, 0xec, 0x34, 0xc7, 0x33, 0xad, 0x6d, 0x5a, 0x2b, 0x81, 0xc8, 0x02, 0x72, 0x3a,
+	0x8e, 0x7e, 0xa8, 0x86, 0xbe, 0xdb, 0xda, 0x13, 0xe1, 0x0f, 0x1b, 0x22, 0xfc, 0xe1, 0x9d, 0x8f,
+	0x15, 0xfe, 0xc0, 0x59, 0x05, 0x4f, 0x0e, 0xe7, 0x27, 0x7c, 0x51, 0x27, 0xce, 0x22, 0xad, 0x05,
+	0xf8, 0x84, 0x5f, 0xa3, 0xe1, 0x3d, 0xda, 0x6c, 0x3d, 0xa4, 0xbe, 0xbb, 0xeb, 0xd2, 0x3a, 0xff,
+	0xc8, 0x69, 0x5c, 0xc1, 0xf9, 0x13, 0x7e, 0xf8, 0xa4, 0x63, 0x27, 0x42, 0xe8, 0xfa, 0xd0, 0x54,
+	0x0e, 0xec, 0xe0, 0x29, 0x1d, 0xf6, 0x79, 0x1c, 0x5b, 0x3e, 0x3e, 0x78, 0x4a, 0xef, 0x7e, 0x1b,
+	0xc5, 0x48, 0x15, 0x1e, 0x8d, 0x44, 0x78, 0x07, 0xff, 0xe2, 0x18, 0x5f, 0x91, 0x0b, 0x9d, 0x70,
+	0x5f, 0xae, 0xe1, 0x0b, 0x69, 0x41, 0x07, 0xdc, 0xe5, 0x49, 0x09, 0x3a, 0xd0, 0x43, 0x0d, 0xa4,
+	0x29, 0x3d, 0x93, 0x6a, 0x4a, 0x7f, 0x03, 0xc6, 0xf0, 0xc1, 0xe2, 0xc8, 0xbb, 0x3b, 0x27, 0x6c,
+	0x95, 0x0c, 0xc8, 0x53, 0x8a, 0xc5, 0x08, 0xe4, 0x3a, 0x00, 0x26, 0xe1, 0xe7, 0x1b, 0xbc, 0x92,
+	0x16, 0x14, 0x73, 0xf5, 0x8b, 0x5b, 0x64, 0x05, 0x05, 0xd9, 0x57, 0xad, 0x3b, 0xea, 0xb5, 0x33,
+	0x67, 0x1f, 0xf8, 0xbb, 0x02, 0x3d, 0x46, 0x60, 0x9f, 0xa7, 0x0c, 0x93, 0x58, 0x54, 0xf2, 0x5d,
+	0x63, 0xa9, 0x22, 0xa1, 0x47, 0x97, 0x74, 0x65, 0xc5, 0x35, 0x65, 0x42, 0x78, 0x74, 0x45, 0x6e,
+	0xaf, 0x56, 0x8c, 0x40, 0x3e, 0x07, 0xa3, 0x45, 0xea, 0x87, 0x1b, 0x1b, 0x2b, 0x78, 0x33, 0xcc,
+	0x73, 0x67, 0xe6, 0x30, 0xcf, 0x61, 0x18, 0x36, 0x7e, 0x70, 0x38, 0x3f, 0x19, 0xba, 0x4d, 0x7a,
+	0x2d, 0xba, 0xc6, 0x95, 0xd8, 0x64, 0x11, 0xf2, 0xfc, 0x8e, 0x31, 0x56, 0xe4, 0x70, 0x99, 0xc9,
+	0xf1, 0x45, 0x4f, 0x5c, 0x48, 0x3e, 0xa2, 0x3b, 0x51, 0x96, 0xc7, 0x2e, 0x7c, 0xb2, 0x24, 0x93,
+	0xa3, 0xaa, 0x1f, 0x09, 0xb1, 0x65, 0x41, 0x2c, 0xcc, 0xda, 0xb7, 0x76, 0x53, 0x90, 0x02, 0x4c,
+	0x16, 0xbd, 0x66, 0xdb, 0x09, 0x5d, 0xcc, 0x8e, 0x7f, 0x20, 0x56, 0x14, 0xb4, 0x8e, 0xd4, 0xd4,
+	0x02, 0xfd, 0xfd, 0x61, 0xa5, 0x80, 0xdc, 0x81, 0x29, 0xcb, 0xeb, 0xb0, 0x41, 0x92, 0x47, 0x1a,
+	0xbe, 0x68, 0x44, 0x2f, 0xdb, 0xb3, 0xb1, 0xb4, 0xc5, 0xf9, 0x45, 0xcb, 0x8e, 0xa3, 0x51, 0x91,
+	0xb5, 0x14, 0xdb, 0xb2, 0xba, 0x52, 0xa8, 0xb9, 0x1e, 0xbb, 0x98, 0xa5, 0x98, 0xa5, 0x6f, 0xc2,
+	0x78, 0xb5, 0xba, 0xbe, 0x41, 0x83, 0xf0, 0x4e, 0xc3, 0x7b, 0x84, 0x0b, 0x45, 0x4e, 0xa4, 0x98,
+	0x0e, 0x3c, 0x3b, 0xa4, 0x41, 0x68, 0xef, 0x36, 0xbc, 0x47, 0x96, 0x8a, 0x45, 0x7e, 0x48, 0x79,
+	0x90, 0x19, 0x77, 0xfe, 0xe9, 0x23, 0x77, 0xfe, 0xc4, 0x63, 0xcd, 0x6c, 0xff, 0x4f, 0x7d, 0xac,
+	0x99, 0xa1, 0x63, 0xa8, 0x02, 0x3b, 0x8c, 0x15, 0xea, 0x75, 0x9f, 0x06, 0x81, 0x98, 0xd1, 0xca,
+	0x73, 0xf3, 0x0e, 0x2f, 0xd0, 0x42, 0x15, 0x14, 0x02, 0xf2, 0x2d, 0x03, 0x4e, 0xa9, 0xde, 0xce,
+	0x38, 0x59, 0x9a, 0xb4, 0x15, 0xce, 0xcd, 0x60, 0x4b, 0xdf, 0xbc, 0x26, 0x57, 0xb4, 0x6b, 0x0a,
+	0xda, 0xb5, 0x87, 0x37, 0xae, 0x29, 0xaf, 0x84, 0x56, 0x25, 0x91, 0x48, 0xa5, 0x91, 0xc6, 0x4f,
+	0x5d, 0x9d, 0x9c, 0x14, 0x52, 0x52, 0x64, 0x9b, 0x1e, 0x93, 0x27, 0xf4, 0x6d, 0x28, 0x57, 0x30,
+	0x5b, 0x90, 0x30, 0x4e, 0x09, 0xe9, 0xe3, 0x5e, 0x10, 0x6e, 0x5b, 0xdf, 0xdb, 0x14, 0x1a, 0x54,
+	0x15, 0xab, 0x85, 0xd5, 0x95, 0x58, 0xdf, 0xf9, 0x74, 0xb9, 0x18, 0x6b, 0xdf, 0xd6, 0xc7, 0xc5,
+	0x78, 0x13, 0x4e, 0x26, 0xba, 0x41, 0xaa, 0x8a, 0x1a, 0x38, 0xa9, 0x2a, 0x26, 0x68, 0xac, 0x04,
+	0xb6, 0xf9, 0xb7, 0x47, 0x13, 0x7c, 0x85, 0x5b, 0x91, 0x09, 0x23, 0x5c, 0x13, 0x54, 0x9f, 0xa4,
+	0xe3, 0x7a, 0xa2, 0x25, 0x4a, 0xc8, 0x59, 0xc8, 0x56, 0xab, 0xeb, 0xea, 0x83, 0x99, 0x41, 0xe0,
+	0x59, 0x0c, 0xc6, 0x46, 0x08, 0x3d, 0x86, 0x94, 0xb4, 0x7d, 0x6c, 0xd9, 0xb3, 0x10, 0xca, 0xfa,
+	0x5b, 0xea, 0x65, 0x43, 0x71, 0x7f, 0x0b, 0xbd, 0x2c, 0xd6, 0xc6, 0x8a, 0x30, 0x57, 0x08, 0x02,
+	0xea, 0xe3, 0xeb, 0xbc, 0xdc, 0x11, 0xc5, 0x17, 0xba, 0x83, 0x58, 0xdd, 0xb1, 0x52, 0xa7, 0x16,
+	0x58, 0x3d, 0x11, 0xc9, 0x65, 0xc8, 0x15, 0x3a, 0x75, 0x97, 0xb6, 0x6a, 0x5a, 0xea, 0x07, 0x47,
+	0xc0, 0xac, 0xa8, 0x94, 0x7c, 0x09, 0x4e, 0x09, 0x22, 0xa9, 0x40, 0x8a, 0x1e, 0x18, 0x8d, 0xa7,
+	0xa0, 0xd4, 0x6d, 0xe2, 0x4b, 0x4e, 0xde, 0x25, 0xe9, 0x94, 0xa4, 0x00, 0xf9, 0x25, 0x74, 0xa9,
+	0x2f, 0x51, 0x6e, 0x6f, 0xf5, 0x7c, 0xf1, 0xb0, 0x38, 0x6a, 0xa2, 0xdc, 0xdd, 0xde, 0xae, 0x47,
+	0x85, 0x56, 0x17, 0x3a, 0xb9, 0x0f, 0x27, 0x93, 0x30, 0xb6, 0x90, 0x73, 0xa5, 0x13, 0xf3, 0x46,
+	0x75, 0x71, 0xc1, 0xa5, 0x3c, 0x8d, 0x8a, 0xec, 0xc0, 0x4c, 0x7c, 0xc9, 0xaf, 0xab, 0xa2, 0xd2,
+	0x27, 0x2d, 0x2a, 0x97, 0xea, 0xe8, 0x0b, 0x42, 0x18, 0x4f, 0xc6, 0x0e, 0x03, 0x91, 0x4a, 0x6a,
+	0x75, 0xb3, 0x23, 0x75, 0x98, 0xaa, 0xba, 0x7b, 0x2d, 0xb7, 0xb5, 0x77, 0x9f, 0x1e, 0x54, 0x1c,
+	0xd7, 0x17, 0xde, 0x41, 0xd2, 0xf7, 0xaf, 0x10, 0x1c, 0x34, 0x9b, 0x34, 0xf4, 0x71, 0x8b, 0x64,
+	0xe5, 0x18, 0x51, 0x67, 0xb0, 0xbd, 0x20, 0xe0, 0x74, 0x18, 0x3d, 0xd2, 0x76, 0x5c, 0x6d, 0x2f,
+	0xd0, 0x79, 0x6a, 0xc7, 0x81, 0x89, 0x01, 0x8f, 0x03, 0x0d, 0x98, 0x59, 0x6a, 0xd5, 0xfc, 0x03,
+	0x34, 0x7b, 0xcb, 0xc6, 0x4d, 0x1e, 0xd1, 0xb8, 0x57, 0x44, 0xe3, 0xce, 0x3b, 0x52, 0xc2, 0xd2,
+	0x9a, 0xd7, 0xcd, 0x98, 0x54, 0xc5, 0x2b, 0xea, 0xe5, 0x52, 0xa5, 0xdc, 0x72, 0x43, 0x17, 0x1f,
+	0x87, 0xe3, 0x7b, 0xcc, 0xab, 0x82, 0xe7, 0x8b, 0x5c, 0xed, 0x73, 0xeb, 0x6d, 0xdb, 0x95, 0x28,
+	0x5d, 0xcf, 0xa4, 0xab, 0xf4, 0xe6, 0x7f, 0x9a, 0xe3, 0xab, 0xa1, 0xaa, 0xa6, 0xf5, 0xf2, 0x77,
+	0x4a, 0xa8, 0x6f, 0x99, 0xe3, 0xa8, 0x6f, 0xd9, 0xa3, 0xd5, 0xb7, 0xa1, 0xa3, 0xd4, 0xb7, 0x84,
+	0x7e, 0x35, 0x7c, 0x6c, 0xfd, 0x6a, 0xe4, 0x18, 0xfa, 0xd5, 0xe8, 0xb1, 0xf4, 0x2b, 0x4d, 0x51,
+	0xcc, 0x1d, 0xa5, 0x28, 0xfe, 0x7f, 0xda, 0xd8, 0xf3, 0xaa, 0x8d, 0xa5, 0x6d, 0xae, 0xc7, 0xd2,
+	0xc6, 0x7a, 0x2b, 0x53, 0xf9, 0x3f, 0x6d, 0x65, 0x6a, 0xe6, 0x63, 0x28, 0x53, 0x7f, 0x0e, 0xf2,
+	0xc9, 0xf5, 0xfd, 0xe8, 0xe4, 0x46, 0xcf, 0x2c, 0x07, 0x09, 0xdb, 0x7d, 0x92, 0xeb, 0x2b, 0x3b,
+	0xe4, 0x55, 0x7c, 0xf7, 0xa1, 0x13, 0xd2, 0xf8, 0x51, 0x66, 0x3c, 0xe4, 0xb5, 0x39, 0x14, 0xe7,
+	0xbc, 0x82, 0x12, 0xa9, 0x16, 0x99, 0x34, 0xd5, 0xc2, 0xfc, 0xa9, 0x0c, 0xcc, 0xf0, 0xb4, 0x09,
+	0xcf, 0xbf, 0x6d, 0xf1, 0x3d, 0x4d, 0x61, 0x94, 0x2e, 0x44, 0x89, 0xaf, 0xeb, 0x63, 0x5d, 0xfc,
+	0x1a, 0x9c, 0xea, 0xea, 0x0a, 0x54, 0x1a, 0x4b, 0x32, 0x61, 0x45, 0x97, 0xda, 0x38, 0x97, 0x5e,
+	0xc9, 0xd6, 0x4d, 0xab, 0x8b, 0xc2, 0xfc, 0x37, 0xd9, 0x2e, 0xfe, 0xc2, 0xce, 0xa8, 0x5a, 0x0e,
+	0x8d, 0xe3, 0x59, 0x0e, 0x33, 0x83, 0x59, 0x0e, 0x13, 0x7b, 0x4b, 0x76, 0x90, 0xbd, 0xe5, 0x4b,
+	0x30, 0xb9, 0x41, 0x9d, 0x66, 0xb0, 0xe1, 0x89, 0xb4, 0xa8, 0xdc, 0x85, 0x50, 0xe6, 0xa3, 0x60,
+	0x65, 0x52, 0xe7, 0x89, 0x5c, 0x21, 0x42, 0x46, 0xc0, 0xd6, 0x43, 0x9e, 0x27, 0xd5, 0xd2, 0x39,
+	0xa8, 0x8a, 0xec, 0x70, 0x1f, 0x45, 0xb6, 0x0a, 0x13, 0x82, 0x2e, 0xce, 0xe8, 0x14, 0x6b, 0x5c,
+	0xac, 0x08, 0xe1, 0xb2, 0xf6, 0xe8, 0xf9, 0x98, 0xa8, 0x76, 0xae, 0x6c, 0x69, 0x4c, 0x58, 0x17,
+	0x2c, 0xb5, 0xea, 0x6d, 0xcf, 0x6d, 0x61, 0x17, 0x8c, 0xc6, 0x5d, 0x40, 0x05, 0x98, 0x77, 0x81,
+	0x82, 0x44, 0xde, 0x81, 0xa9, 0x42, 0xa5, 0xac, 0x92, 0xe5, 0x62, 0xe3, 0xa5, 0xd3, 0x76, 0x6d,
+	0x8d, 0x34, 0x81, 0x6b, 0xfe, 0xd8, 0x98, 0x9c, 0x5b, 0x9f, 0xac, 0x95, 0x48, 0xb7, 0xfb, 0x64,
+	0x8f, 0x69, 0xf7, 0x19, 0x3a, 0x6a, 0x3b, 0xd7, 0x74, 0x8c, 0xe1, 0x63, 0xe8, 0x18, 0x23, 0x4f,
+	0x6d, 0xc3, 0x19, 0x3d, 0xa6, 0xd6, 0x90, 0x10, 0xf3, 0xdc, 0x20, 0x62, 0x9e, 0xaa, 0x69, 0x8c,
+	0x3d, 0xbd, 0xa6, 0x01, 0xc7, 0xd6, 0x34, 0x94, 0xf7, 0x8b, 0xc7, 0x07, 0x7a, 0xbf, 0xd8, 0x18,
+	0xe0, 0xfd, 0xe2, 0x4f, 0x95, 0xfa, 0xf2, 0xf5, 0x74, 0xf5, 0xa5, 0xff, 0x52, 0xff, 0xff, 0x66,
+	0x05, 0xc6, 0xc7, 0x5e, 0xde, 0x76, 0x7c, 0x76, 0x16, 0x0c, 0xc8, 0x75, 0x18, 0x95, 0x99, 0x65,
+	0x8c, 0xf8, 0x58, 0xdd, 0x9d, 0x52, 0x46, 0x62, 0xb1, 0x63, 0xa3, 0x24, 0x16, 0xb1, 0xd5, 0x3c,
+	0x89, 0x86, 0x80, 0x69, 0x49, 0x34, 0x04, 0xcc, 0xfc, 0x9b, 0x43, 0x72, 0x26, 0xb3, 0x63, 0x8d,
+	0x78, 0x2a, 0x6f, 0x51, 0x19, 0x39, 0x45, 0x7d, 0x4a, 0x8c, 0x4d, 0xc2, 0x67, 0x48, 0x27, 0xf9,
+	0x38, 0x69, 0x79, 0x94, 0xd7, 0x0b, 0xb2, 0x03, 0xbc, 0x5e, 0x70, 0x5b, 0x4b, 0xfd, 0x3f, 0x14,
+	0xe7, 0x9a, 0x66, 0xd2, 0xdd, 0x3f, 0xe9, 0xff, 0x2d, 0x35, 0x47, 0xff, 0x70, 0x1c, 0x86, 0x8e,
+	0x94, 0x7d, 0xb2, 0xf3, 0x47, 0xfa, 0xe0, 0xc8, 0x71, 0x52, 0x54, 0x8d, 0xfe, 0xa9, 0xa6, 0xa8,
+	0x5a, 0x02, 0x50, 0xde, 0x4f, 0xe3, 0xa6, 0xfa, 0x57, 0x59, 0x37, 0x1d, 0xfd, 0x76, 0x9a, 0x42,
+	0x68, 0xfe, 0x53, 0x02, 0x33, 0xd5, 0xea, 0x7a, 0xc9, 0x75, 0xf6, 0x5a, 0x5e, 0x10, 0xba, 0xb5,
+	0x72, 0x6b, 0xd7, 0x63, 0xca, 0x50, 0xb4, 0x2a, 0x28, 0xe9, 0x92, 0xe2, 0x15, 0x21, 0x2a, 0x66,
+	0xca, 0xf6, 0x92, 0xef, 0x7b, 0xbe, 0xaa, 0x6c, 0x53, 0x06, 0xb0, 0x38, 0x9c, 0xe9, 0x1b, 0xd5,
+	0x0e, 0x7f, 0x08, 0x8b, 0xdf, 0x9e, 0xa0, 0xbe, 0x11, 0x70, 0x90, 0x25, 0xcb, 0x08, 0xed, 0x16,
+	0x58, 0xa1, 0x7f, 0x9e, 0xd1, 0x12, 0x5d, 0xc5, 0xc5, 0x7c, 0xcd, 0x13, 0x7b, 0x12, 0x06, 0xa1,
+	0xb4, 0x11, 0xae, 0x5e, 0xb5, 0x75, 0xcd, 0x81, 0x03, 0x38, 0xa5, 0x05, 0x53, 0x0c, 0x6a, 0x51,
+	0xba, 0x2a, 0xf4, 0x1b, 0x13, 0x63, 0xc2, 0x52, 0xcc, 0x4a, 0x6a, 0xae, 0xdc, 0xd4, 0x1a, 0xc8,
+	0x4f, 0x19, 0xf0, 0x62, 0x6a, 0x49, 0x34, 0xbb, 0xc7, 0xb5, 0x64, 0x63, 0xca, 0xa2, 0xc1, 0xb3,
+	0x02, 0xf7, 0xaa, 0xda, 0x4e, 0x59, 0x0a, 0xfa, 0xd7, 0x44, 0xfe, 0xa1, 0x01, 0x67, 0x34, 0x8c,
+	0x68, 0xcd, 0x0b, 0x70, 0x6f, 0xea, 0x29, 0xd7, 0x1f, 0x3d, 0x1b, 0xb9, 0x7e, 0x59, 0xff, 0x96,
+	0x78, 0x49, 0x56, 0xbf, 0xa1, 0x57, 0x0b, 0xc9, 0x43, 0x98, 0xc1, 0x22, 0x69, 0xdd, 0x62, 0x32,
+	0x2b, 0x8c, 0x62, 0xb3, 0x71, 0xb3, 0x79, 0x80, 0x10, 0xbe, 0xec, 0xb2, 0xf0, 0xfd, 0xc3, 0xf9,
+	0x49, 0x0d, 0x1d, 0xf3, 0x9c, 0x62, 0x1b, 0x22, 0x13, 0x99, 0xdb, 0xda, 0xf5, 0xb4, 0x67, 0xea,
+	0x93, 0x55, 0x90, 0xff, 0xdc, 0x80, 0x39, 0x06, 0xe5, 0x9f, 0x71, 0xc7, 0xf7, 0x9a, 0x51, 0xb9,
+	0xbc, 0xb3, 0xed, 0xd1, 0x6d, 0x8d, 0x67, 0xd3, 0x6d, 0xaf, 0x62, 0x93, 0xf9, 0x9a, 0x60, 0xef,
+	0xfa, 0x5e, 0x33, 0x6e, 0xbe, 0xf6, 0x3e, 0x58, 0xaf, 0x46, 0x92, 0x1f, 0x37, 0xe0, 0xac, 0x66,
+	0x60, 0x50, 0xb3, 0x7b, 0x8a, 0x30, 0x2c, 0x79, 0xc1, 0xaf, 0x16, 0x2d, 0x5e, 0x13, 0xf2, 0x7f,
+	0x09, 0x5b, 0x10, 0xef, 0x16, 0xd8, 0x16, 0xbb, 0xc9, 0xb1, 0x94, 0x26, 0xf4, 0xae, 0x85, 0xb8,
+	0x30, 0x83, 0x37, 0x4e, 0x9a, 0x6f, 0xc1, 0x6c, 0x6f, 0xdf, 0x82, 0x28, 0x03, 0x3f, 0x66, 0x50,
+	0xec, 0xed, 0x60, 0xd0, 0xcd, 0x95, 0xfc, 0x08, 0x9c, 0xed, 0x02, 0x46, 0xb3, 0xed, 0x54, 0xcf,
+	0xd9, 0xf6, 0xfa, 0x93, 0xc3, 0xf9, 0xd7, 0xd2, 0x6a, 0x4b, 0x9b, 0x69, 0xbd, 0x6b, 0x20, 0x0e,
+	0x40, 0x5c, 0x28, 0x9e, 0x19, 0x4b, 0x17, 0xd0, 0xd7, 0x85, 0x7c, 0x28, 0xf8, 0x6c, 0x2d, 0x57,
+	0xda, 0xa0, 0x6e, 0x79, 0x31, 0x12, 0xa1, 0x30, 0xa1, 0x64, 0x8f, 0x3c, 0xc0, 0xf7, 0xc6, 0x7a,
+	0x56, 0xf2, 0xfd, 0xc3, 0x79, 0x0d, 0x9b, 0xe9, 0xc5, 0x6a, 0x5a, 0x4a, 0x55, 0x2f, 0xd6, 0x10,
+	0xc9, 0xdf, 0x33, 0x60, 0x96, 0x01, 0x62, 0xa1, 0x12, 0x1f, 0x35, 0xd7, 0x4f, 0xea, 0xf7, 0x9f,
+	0x8d, 0xd4, 0xbf, 0x84, 0x6d, 0x54, 0xa5, 0xbe, 0xab, 0x4b, 0x52, 0x1b, 0x87, 0xd2, 0xae, 0x5d,
+	0x6e, 0x6a, 0xd2, 0x7e, 0x76, 0x00, 0x69, 0xe7, 0x03, 0x70, 0xb4, 0xb4, 0xf7, 0xac, 0x85, 0x6c,
+	0xc0, 0x84, 0x50, 0x89, 0x79, 0x87, 0x5d, 0xd0, 0x92, 0xd5, 0xa9, 0x45, 0xfc, 0x9c, 0x22, 0x92,
+	0x6b, 0x76, 0x7d, 0xa1, 0xc6, 0x85, 0xb4, 0xe0, 0x24, 0xff, 0xad, 0x5b, 0x07, 0xe6, 0x7b, 0x5a,
+	0x07, 0x2e, 0x8b, 0x2f, 0xba, 0x28, 0xf8, 0x27, 0x8c, 0x04, 0xea, 0x13, 0x03, 0x29, 0x8c, 0x49,
+	0x1b, 0x88, 0x06, 0xe6, 0x93, 0xf6, 0x62, 0x7f, 0x9b, 0xc0, 0x6b, 0xa2, 0xce, 0xf9, 0x64, 0x9d,
+	0xc9, 0x99, 0x9b, 0xc2, 0x9b, 0x38, 0x30, 0x2d, 0xa0, 0xec, 0x00, 0x8c, 0x2b, 0xfc, 0x4b, 0x5a,
+	0xc4, 0x76, 0xa2, 0x94, 0x3f, 0x0f, 0x25, 0x6b, 0xc2, 0x88, 0xfa, 0xc4, 0x82, 0x9e, 0xe4, 0x47,
+	0xd6, 0x61, 0xa6, 0xd0, 0x6e, 0x37, 0x5c, 0x5a, 0xc7, 0xaf, 0xe4, 0x8f, 0x55, 0x99, 0x71, 0x1e,
+	0x6c, 0x87, 0x17, 0x0a, 0x15, 0x3f, 0xf9, 0x52, 0x55, 0x37, 0xad, 0xf9, 0x2d, 0xa3, 0xab, 0xd1,
+	0xec, 0xe4, 0x8e, 0x3f, 0x94, 0x60, 0x4d, 0x3c, 0xb9, 0xf3, 0x26, 0xa2, 0x05, 0x21, 0x46, 0x60,
+	0xca, 0x92, 0x9a, 0x08, 0x24, 0x2b, 0x9e, 0x00, 0xe7, 0xa0, 0xf8, 0x40, 0x39, 0x2f, 0x7d, 0xbe,
+	0xb2, 0xb1, 0xd2, 0x85, 0x3e, 0x5f, 0xc2, 0xd3, 0xcb, 0xfc, 0xf1, 0x8c, 0x2e, 0x76, 0xe4, 0xb2,
+	0xa2, 0xb7, 0x2b, 0xa9, 0x48, 0xa4, 0xde, 0xae, 0x68, 0xeb, 0x7f, 0xc3, 0x80, 0x93, 0xeb, 0xfe,
+	0x9e, 0xd3, 0x72, 0xbf, 0xc9, 0x53, 0x9a, 0x79, 0x38, 0x2e, 0x51, 0x9c, 0xca, 0x27, 0x9a, 0x1a,
+	0xdd, 0x53, 0x2a, 0x66, 0x92, 0x82, 0x22, 0x63, 0xa5, 0xb5, 0x07, 0xbd, 0x68, 0xb1, 0x61, 0x4a,
+	0x86, 0x7a, 0x8e, 0xce, 0xe1, 0xe6, 0xcf, 0x65, 0x60, 0x5c, 0x99, 0x02, 0xe4, 0xb3, 0x30, 0xa1,
+	0xf2, 0x51, 0xad, 0x3e, 0x6a, 0xb5, 0x96, 0x86, 0x85, 0x66, 0x1f, 0xea, 0x34, 0x35, 0xb3, 0x0f,
+	0x13, 0x74, 0x84, 0x1e, 0xf3, 0x68, 0xf3, 0x7e, 0xca, 0xd1, 0xe6, 0x58, 0xaf, 0x9a, 0xbd, 0xd3,
+	0x7d, 0xc0, 0x19, 0xfc, 0x11, 0x32, 0xf3, 0x3b, 0x06, 0xe4, 0x93, 0x93, 0xf4, 0x13, 0xe9, 0x95,
+	0x63, 0xd8, 0xd7, 0x7f, 0x36, 0x03, 0x79, 0x7c, 0x92, 0x92, 0xd6, 0x65, 0x6c, 0xc0, 0xf3, 0xea,
+	0x2b, 0xf1, 0xae, 0x66, 0xfa, 0x7e, 0x21, 0xda, 0x57, 0xd4, 0x8f, 0xeb, 0x93, 0x33, 0x65, 0xe8,
+	0x7b, 0xbf, 0x32, 0x7f, 0xc2, 0xfc, 0x00, 0x66, 0x93, 0xdd, 0x81, 0xe6, 0xef, 0x02, 0x4c, 0xeb,
+	0xf0, 0x64, 0xe2, 0xe9, 0x24, 0x95, 0x95, 0xc4, 0x37, 0x7f, 0x2f, 0x93, 0xe4, 0x2d, 0xfc, 0x26,
+	0xd8, 0xa2, 0xd3, 0x72, 0x76, 0x1a, 0x51, 0x6e, 0x5c, 0xbe, 0xe8, 0x70, 0x90, 0x25, 0xcb, 0x8e,
+	0x93, 0x82, 0x3c, 0xf2, 0x70, 0xcf, 0xa6, 0x7b, 0xb8, 0x93, 0x5b, 0x09, 0x8f, 0x21, 0x25, 0x1c,
+	0xfb, 0x11, 0xdd, 0xb1, 0x63, 0xaf, 0xa1, 0x84, 0xa3, 0x50, 0x11, 0x66, 0xb5, 0x9c, 0x75, 0x92,
+	0x7e, 0x38, 0x36, 0xb8, 0x86, 0x58, 0xc0, 0x89, 0x53, 0x91, 0xc9, 0x32, 0x8c, 0xb2, 0x66, 0xae,
+	0x3a, 0x6d, 0x61, 0xd5, 0x56, 0x9f, 0x67, 0x97, 0x9b, 0x97, 0x12, 0xf2, 0xd2, 0xa0, 0x6c, 0xcb,
+	0xd7, 0x1e, 0x05, 0xe4, 0x88, 0xe6, 0x1f, 0x19, 0x6c, 0xfe, 0xd7, 0x1e, 0x7c, 0xca, 0x92, 0xa3,
+	0xb3, 0x4f, 0xea, 0xe3, 0xd6, 0xf3, 0xfb, 0x19, 0x9e, 0xde, 0x58, 0x88, 0xcf, 0x6d, 0x18, 0xd9,
+	0x70, 0xfc, 0x3d, 0x1a, 0x8a, 0x44, 0xbc, 0x2a, 0x17, 0x5e, 0x10, 0x07, 0x8b, 0x87, 0xf8, 0xdb,
+	0x12, 0x04, 0xaa, 0x2d, 0x2c, 0x33, 0x90, 0x2d, 0x4c, 0x31, 0xcf, 0x66, 0x9f, 0x99, 0x79, 0xf6,
+	0x2b, 0x51, 0x66, 0xe1, 0x42, 0x38, 0x40, 0x4a, 0xb4, 0x8b, 0xc9, 0x34, 0xdb, 0x5d, 0xc9, 0xeb,
+	0x62, 0x76, 0xe4, 0x96, 0x9a, 0xb8, 0x5b, 0x71, 0x1a, 0x3f, 0x22, 0x45, 0xb7, 0xf9, 0xfb, 0x59,
+	0xde, 0xc7, 0xa2, 0xa3, 0x2e, 0x69, 0x01, 0x25, 0x38, 0x4f, 0x12, 0x0f, 0x24, 0xf3, 0xd0, 0x92,
+	0x4b, 0x30, 0xc4, 0x64, 0x53, 0xf4, 0x26, 0x7f, 0x5a, 0xdb, 0x6b, 0x68, 0x31, 0x80, 0xac, 0x9c,
+	0xcd, 0x65, 0xdc, 0x93, 0xd4, 0x37, 0x02, 0x70, 0xdb, 0x52, 0xe7, 0x32, 0x62, 0x90, 0xcb, 0x30,
+	0xb4, 0xe6, 0xd5, 0x65, 0xea, 0xbd, 0x59, 0x0c, 0x2b, 0xd4, 0x5e, 0xb8, 0x9d, 0x33, 0x2c, 0xc4,
+	0x60, 0xdf, 0x1a, 0x25, 0xeb, 0x55, 0xbf, 0xb5, 0xb9, 0xeb, 0xd8, 0x3c, 0x49, 0xac, 0xfa, 0xad,
+	0x71, 0x5e, 0xdf, 0x25, 0x98, 0xd2, 0xdf, 0x30, 0x12, 0x4e, 0x4f, 0x68, 0x66, 0x4d, 0x3c, 0x85,
+	0xa4, 0x5a, 0xc7, 0x75, 0x22, 0xb2, 0x08, 0x93, 0x5a, 0xca, 0x1f, 0x71, 0xbd, 0x84, 0xe6, 0x4d,
+	0x3d, 0x61, 0x90, 0x6a, 0xde, 0xd4, 0x48, 0xd8, 0x7e, 0x2e, 0xda, 0xaf, 0x5c, 0x32, 0x75, 0xb5,
+	0x5d, 0xe0, 0x90, 0x9b, 0x90, 0xe3, 0xf1, 0x7b, 0xe5, 0x92, 0x7a, 0x5b, 0x11, 0x20, 0x2c, 0x11,
+	0xff, 0x2a, 0x11, 0x95, 0x78, 0xad, 0xcf, 0x40, 0x5e, 0x2c, 0x49, 0xd1, 0x9b, 0x10, 0x78, 0x53,
+	0x5c, 0x2e, 0x59, 0xea, 0x32, 0x52, 0x73, 0xeb, 0xbe, 0x85, 0x50, 0xf3, 0xbb, 0x06, 0x9c, 0x5d,
+	0xa3, 0xe1, 0x23, 0xcf, 0x7f, 0x60, 0xd1, 0x20, 0xf4, 0x5d, 0xfe, 0xc4, 0x04, 0x4e, 0xc4, 0xcf,
+	0x92, 0x77, 0x60, 0x18, 0xbd, 0x6f, 0x12, 0x3b, 0x43, 0xb2, 0x8e, 0xc5, 0x49, 0x21, 0xc0, 0xc3,
+	0xe8, 0xca, 0x63, 0x71, 0x22, 0x72, 0x1b, 0x86, 0x4a, 0xb4, 0x75, 0x90, 0x78, 0x6b, 0xa0, 0x8b,
+	0x38, 0x5a, 0x10, 0xea, 0xb4, 0x75, 0x60, 0x21, 0x89, 0xf9, 0x9d, 0x0c, 0x9c, 0x4a, 0x69, 0xd6,
+	0xd6, 0x67, 0x9f, 0xd3, 0x55, 0x71, 0x51, 0x5b, 0x15, 0x2f, 0x0a, 0xd2, 0x9e, 0x1d, 0x9f, 0xba,
+	0x48, 0xfe, 0x55, 0x03, 0xce, 0xe8, 0x02, 0x2a, 0xdc, 0xed, 0xb6, 0x6e, 0x92, 0xb7, 0x61, 0x64,
+	0x99, 0x3a, 0x75, 0x2a, 0x53, 0x97, 0xc7, 0xcf, 0x83, 0xf3, 0xe0, 0x24, 0x5e, 0xc8, 0xd9, 0xfe,
+	0x1e, 0x5f, 0xc3, 0x4e, 0x58, 0x82, 0x84, 0x94, 0x44, 0xe3, 0xb8, 0x3e, 0x6e, 0xca, 0x40, 0xc1,
+	0xb4, 0xaa, 0xfa, 0xdc, 0xb3, 0x7f, 0xdf, 0x80, 0x17, 0xfa, 0xd0, 0xb0, 0x81, 0x63, 0x43, 0xaf,
+	0x0e, 0x1c, 0xee, 0xa8, 0x08, 0x25, 0xef, 0xc1, 0xf4, 0x86, 0xd0, 0xe7, 0xe5, 0x70, 0x64, 0xe2,
+	0xf9, 0x22, 0x55, 0x7d, 0x5b, 0x8e, 0x4b, 0x12, 0x59, 0x8b, 0x60, 0xcd, 0xf6, 0x8d, 0x60, 0x55,
+	0x03, 0x42, 0x87, 0x06, 0x0d, 0x08, 0xfd, 0x20, 0xf9, 0xf2, 0xa7, 0xc8, 0xcb, 0x15, 0x87, 0xc3,
+	0x1a, 0xbd, 0xc3, 0x61, 0xfb, 0x66, 0xff, 0xc1, 0x97, 0x0e, 0x74, 0xde, 0x4f, 0x3b, 0x9e, 0xef,
+	0x6a, 0xe3, 0xf9, 0x42, 0xfa, 0x78, 0xf6, 0x1e, 0xc8, 0x5f, 0x36, 0x92, 0x1f, 0x3b, 0xd0, 0x08,
+	0x9a, 0x30, 0x52, 0xf2, 0x9a, 0x8e, 0xdb, 0x52, 0xdf, 0x38, 0xab, 0x23, 0xc4, 0x12, 0x25, 0x83,
+	0x45, 0x0f, 0x5f, 0x84, 0xe1, 0x35, 0xaf, 0x55, 0x28, 0x09, 0xdf, 0x3a, 0xe4, 0xd3, 0xf2, 0x5a,
+	0xb6, 0x53, 0xb7, 0x78, 0x81, 0xf9, 0x53, 0xc3, 0x70, 0xd6, 0xa2, 0x7b, 0x2e, 0xd3, 0x38, 0x37,
+	0x03, 0xb7, 0xb5, 0xa7, 0x85, 0x4a, 0x9a, 0x89, 0x31, 0x11, 0xf9, 0x2a, 0x19, 0x24, 0xaa, 0xe3,
+	0x0a, 0xe4, 0xd8, 0x06, 0xa3, 0x0c, 0x0b, 0x5e, 0x47, 0xe0, 0x2b, 0x8c, 0x5c, 0x5e, 0x64, 0x31,
+	0xb9, 0x2a, 0x36, 0x40, 0x25, 0xa3, 0x30, 0xdb, 0x00, 0x7f, 0x70, 0x38, 0x0f, 0xd5, 0x83, 0x20,
+	0xa4, 0x78, 0xf8, 0x11, 0x9b, 0x60, 0xa4, 0xa5, 0x0e, 0xf5, 0xd0, 0x52, 0x57, 0x61, 0xb6, 0x50,
+	0xe7, 0xeb, 0x9e, 0xd3, 0xa8, 0xf8, 0x6e, 0xab, 0xe6, 0xb6, 0x9d, 0x86, 0x3c, 0x79, 0xe1, 0xa5,
+	0x94, 0x13, 0x95, 0xdb, 0xed, 0x08, 0xc1, 0x4a, 0x25, 0x63, 0x9f, 0x51, 0x5a, 0xab, 0xf2, 0x17,
+	0x86, 0xf9, 0x4d, 0x13, 0x7e, 0x46, 0xbd, 0x15, 0xf0, 0x27, 0x86, 0xad, 0xa8, 0x18, 0xf5, 0x63,
+	0xbc, 0xce, 0xdf, 0x58, 0xa9, 0xc6, 0x61, 0x1b, 0x3c, 0xe1, 0x21, 0xbf, 0xf2, 0x0f, 0x1b, 0x01,
+	0x5e, 0xfb, 0x6b, 0x78, 0x31, 0x5d, 0xb5, 0xba, 0xcc, 0xe8, 0x72, 0x5d, 0x74, 0x41, 0xb0, 0xaf,
+	0xd2, 0x71, 0x3c, 0x72, 0x1d, 0x80, 0xa7, 0xea, 0x41, 0x91, 0x19, 0x8b, 0xb5, 0x69, 0x1f, 0xa1,
+	0x5c, 0x9b, 0x56, 0x50, 0xc8, 0x3b, 0x70, 0x72, 0xa9, 0xb8, 0x20, 0xed, 0x83, 0x25, 0xaf, 0xd6,
+	0xc1, 0x0b, 0x5a, 0xc0, 0xfa, 0x70, 0x0c, 0x69, 0x6d, 0x81, 0xc9, 0x49, 0x1a, 0x1a, 0xb9, 0x04,
+	0xa3, 0xe5, 0x12, 0xef, 0xfb, 0x71, 0x35, 0xab, 0xb7, 0x70, 0x7c, 0x90, 0x85, 0x64, 0x3d, 0x56,
+	0xf7, 0x26, 0x8e, 0xd4, 0xcb, 0xce, 0x1e, 0xad, 0xea, 0x89, 0xe4, 0xdf, 0xfc, 0x91, 0x89, 0xa2,
+	0x57, 0xa7, 0xc1, 0xd6, 0x8d, 0x4f, 0x59, 0xf2, 0x6f, 0xe5, 0xdb, 0x70, 0x21, 0xb8, 0x91, 0xba,
+	0x6a, 0xfc, 0x7b, 0x98, 0xfc, 0xbb, 0x0b, 0x97, 0x7c, 0x1e, 0x86, 0xf1, 0xa7, 0x50, 0x21, 0x4e,
+	0xa6, 0xb0, 0x8d, 0xd5, 0x87, 0x1a, 0x7f, 0xee, 0x0f, 0x09, 0x48, 0x19, 0x46, 0x85, 0xf6, 0x7a,
+	0x9c, 0x14, 0xb6, 0x42, 0x0d, 0xe6, 0x83, 0x24, 0xe8, 0xcd, 0x3a, 0x4c, 0xa8, 0x15, 0x32, 0xe1,
+	0x5c, 0x76, 0x82, 0x7d, 0x5a, 0x67, 0xbf, 0x44, 0xf6, 0x79, 0x14, 0xce, 0x7d, 0x84, 0xda, 0xac,
+	0x1d, 0x96, 0x82, 0xc2, 0x16, 0xae, 0x72, 0xb0, 0x19, 0x88, 0xa6, 0x88, 0xf3, 0xac, 0x8b, 0xb6,
+	0x91, 0xba, 0x25, 0x8a, 0xcc, 0xaf, 0xc0, 0xec, 0x5a, 0xa7, 0xd1, 0x60, 0x67, 0x5b, 0x99, 0x9d,
+	0x34, 0x74, 0x42, 0x4a, 0x16, 0x61, 0x18, 0xff, 0xc0, 0x8a, 0xa6, 0xa2, 0x2e, 0x50, 0x71, 0xd0,
+	0xd7, 0xca, 0xc0, 0x40, 0xcb, 0x50, 0x7f, 0x7f, 0x9b, 0x93, 0x9a, 0xbf, 0x1b, 0x3f, 0x3c, 0xb9,
+	0xe1, 0x3b, 0xb5, 0x07, 0xd4, 0x17, 0x3b, 0xd0, 0xa0, 0x0f, 0x63, 0xde, 0x93, 0x8d, 0xd0, 0x77,
+	0x85, 0xb4, 0x06, 0x1f, 0xd5, 0x18, 0xf2, 0x0e, 0x8c, 0x8b, 0x9d, 0x41, 0x49, 0x0f, 0x82, 0x31,
+	0xd8, 0xf2, 0x79, 0xd1, 0xc4, 0xcd, 0xbd, 0x8a, 0x8e, 0x1b, 0x9e, 0xfe, 0x29, 0x5b, 0x37, 0x3e,
+	0x89, 0x0d, 0x4f, 0xaf, 0xa3, 0x8f, 0xe8, 0xfe, 0x7d, 0x48, 0xf6, 0xad, 0x90, 0xdd, 0x5b, 0x6a,
+	0x42, 0x00, 0x23, 0x3e, 0x7e, 0xc4, 0x09, 0x01, 0xd4, 0xe3, 0x47, 0x84, 0x1a, 0x8d, 0x49, 0xe6,
+	0x88, 0x31, 0x79, 0x4f, 0x8e, 0x49, 0xb6, 0xb7, 0x60, 0x9c, 0xec, 0x33, 0x0e, 0xd5, 0x78, 0x86,
+	0x0c, 0x0d, 0x74, 0x76, 0x3d, 0x81, 0x99, 0x0f, 0x39, 0x49, 0x72, 0x41, 0x13, 0x9c, 0xd4, 0x03,
+	0xf1, 0xf0, 0xe0, 0x4c, 0x8f, 0x38, 0x10, 0x7f, 0x01, 0x26, 0x0a, 0x61, 0xe8, 0xd4, 0xf6, 0x69,
+	0xbd, 0xc4, 0x96, 0x27, 0x25, 0x76, 0xd9, 0x11, 0x70, 0xf5, 0x66, 0x42, 0xc5, 0xe5, 0xb9, 0x78,
+	0x9c, 0x40, 0x38, 0x8e, 0x45, 0xb9, 0x78, 0x18, 0x44, 0xcf, 0xc5, 0xc3, 0x20, 0xe4, 0x3a, 0x8c,
+	0x96, 0x5b, 0x0f, 0x5d, 0xd6, 0x27, 0xb9, 0xf8, 0x31, 0x3d, 0x97, 0x83, 0xd4, 0xc5, 0x55, 0x60,
+	0x91, 0xdb, 0x8a, 0xe6, 0x38, 0x16, 0x9f, 0x12, 0xb9, 0x5d, 0xc1, 0x96, 0x0a, 0xa4, 0xaa, 0x15,
+	0x46, 0xaa, 0xe4, 0x2d, 0x18, 0x95, 0xe6, 0x22, 0x88, 0x4f, 0x86, 0x82, 0xb2, 0x3b, 0x42, 0x4d,
+	0x22, 0xe3, 0x3b, 0x56, 0x4a, 0x16, 0xfd, 0x71, 0xe5, 0x1d, 0x2b, 0x25, 0x8b, 0xbe, 0xf6, 0x8e,
+	0x95, 0x92, 0x4f, 0x3f, 0x3a, 0x69, 0x4f, 0x1c, 0x79, 0xd2, 0xde, 0x82, 0x89, 0x8a, 0xe3, 0x87,
+	0x2e, 0x53, 0x17, 0x5a, 0x61, 0x30, 0x37, 0xa9, 0x19, 0xa7, 0x94, 0xa2, 0xc5, 0x0b, 0xf2, 0x3d,
+	0xa7, 0xb6, 0x82, 0xaf, 0x3f, 0x04, 0x14, 0xc3, 0xd3, 0xdd, 0xc6, 0xa6, 0x9e, 0xc6, 0x6d, 0x0c,
+	0x3b, 0x15, 0x0d, 0x12, 0xd3, 0xf1, 0xb1, 0x17, 0x35, 0xc3, 0x84, 0x55, 0x22, 0x42, 0x24, 0x5f,
+	0x85, 0x09, 0xf6, 0x37, 0xbe, 0x4e, 0xeb, 0xd2, 0x60, 0x2e, 0x8f, 0x1f, 0x77, 0x21, 0x75, 0xf6,
+	0xf3, 0x27, 0x6c, 0xab, 0x34, 0xe4, 0x13, 0x18, 0x19, 0x27, 0x2d, 0x8d, 0x1a, 0x37, 0xf2, 0x3e,
+	0x4c, 0xc8, 0x07, 0x98, 0x71, 0x90, 0x66, 0x62, 0xc7, 0xbf, 0xba, 0x80, 0x77, 0xa5, 0xc3, 0x52,
+	0x09, 0xd8, 0x36, 0x5f, 0x68, 0xf3, 0x05, 0x92, 0x28, 0xd2, 0xde, 0xee, 0x5a, 0x1c, 0x25, 0x1a,
+	0xf9, 0x22, 0x4c, 0x14, 0xda, 0xed, 0x78, 0xc5, 0x39, 0xa9, 0x58, 0x1b, 0xda, 0x6d, 0x3b, 0x75,
+	0xd5, 0xd1, 0x28, 0x92, 0x0b, 0xf3, 0xec, 0xb1, 0x16, 0x66, 0xf2, 0x66, 0xa4, 0x38, 0x9f, 0x8a,
+	0x4d, 0x67, 0x42, 0x3b, 0x57, 0x67, 0x1a, 0x47, 0x32, 0xff, 0xd0, 0x80, 0x33, 0x3d, 0x7a, 0x39,
+	0xca, 0x1c, 0x65, 0xf4, 0xcf, 0x1c, 0xc5, 0x66, 0xab, 0x7e, 0xdc, 0xc3, 0x3a, 0x85, 0x66, 0xa3,
+	0xf6, 0x91, 0xd4, 0x71, 0x3c, 0x20, 0xe2, 0xe1, 0x65, 0xe5, 0x81, 0x62, 0x91, 0xbe, 0x30, 0xb1,
+	0xf0, 0x6b, 0x0f, 0x34, 0xf3, 0x17, 0xbe, 0x7d, 0x0e, 0x8a, 0xba, 0xf2, 0x23, 0x4f, 0x9b, 0x35,
+	0x29, 0xac, 0xcd, 0x43, 0x03, 0xc6, 0x15, 0xd9, 0x27, 0x17, 0x95, 0x38, 0xa3, 0x3c, 0x4f, 0x47,
+	0xad, 0x70, 0xc8, 0xf0, 0xd5, 0x1f, 0x05, 0x39, 0x73, 0xb4, 0x65, 0x6d, 0x95, 0xa9, 0x1f, 0x4a,
+	0x76, 0xad, 0xa6, 0x66, 0x06, 0xb3, 0xb0, 0x1c, 0x9f, 0x7e, 0x73, 0x82, 0xb0, 0x50, 0x0b, 0xdd,
+	0x87, 0x74, 0x80, 0x85, 0x3e, 0x7e, 0xfa, 0xcd, 0x09, 0x42, 0xdb, 0x41, 0xb2, 0xae, 0xa7, 0xdf,
+	0x22, 0x86, 0xe6, 0x4f, 0x18, 0x00, 0x9b, 0xe5, 0x22, 0xa6, 0xc7, 0x7b, 0xda, 0x8d, 0x38, 0x3d,
+	0xe5, 0x90, 0xe4, 0xde, 0x67, 0x0b, 0xae, 0xc0, 0x94, 0x8e, 0x45, 0xde, 0x83, 0xe9, 0x6a, 0xcd,
+	0xf7, 0x1a, 0x8d, 0x1d, 0xa7, 0xf6, 0x60, 0xc5, 0x6d, 0x51, 0x9e, 0xeb, 0x65, 0x98, 0x2f, 0xff,
+	0x41, 0x54, 0x64, 0x37, 0x58, 0x99, 0x95, 0x44, 0x36, 0xff, 0xc4, 0x80, 0xf1, 0x72, 0x2b, 0x08,
+	0x9d, 0x46, 0x03, 0x15, 0x8c, 0x4f, 0xd3, 0x8b, 0x04, 0xd1, 0x77, 0xf5, 0xe9, 0xd1, 0xb7, 0x60,
+	0x3a, 0x81, 0xc6, 0x0e, 0xc6, 0x55, 0x0c, 0x83, 0x54, 0x0f, 0xc6, 0x3c, 0x30, 0xd2, 0x12, 0x25,
+	0xe6, 0x92, 0x42, 0xb6, 0x75, 0x03, 0x2f, 0x8a, 0x16, 0x00, 0x5c, 0x09, 0x92, 0x6a, 0x3c, 0x49,
+	0xb6, 0x64, 0xeb, 0x86, 0xa5, 0x60, 0x99, 0x6b, 0x30, 0x52, 0xf5, 0xfc, 0x70, 0xf1, 0x80, 0x6b,
+	0xce, 0x25, 0x1a, 0xd4, 0xd4, 0x9b, 0x20, 0x17, 0xad, 0xaf, 0x35, 0x4b, 0x14, 0xb1, 0x73, 0xf3,
+	0x1d, 0x97, 0x36, 0xea, 0xaa, 0xcb, 0xdf, 0x2e, 0x03, 0x58, 0x1c, 0xce, 0x4e, 0x17, 0xa7, 0xe3,
+	0xf4, 0xad, 0xb1, 0x6f, 0xe1, 0xd3, 0x0a, 0x6c, 0x51, 0xeb, 0xdf, 0x97, 0xf4, 0x07, 0xff, 0xb4,
+	0x9a, 0xfa, 0x74, 0xf5, 0xdf, 0x31, 0xe0, 0x5c, 0x6f, 0x12, 0xd5, 0x5d, 0xd1, 0xe8, 0xe3, 0xae,
+	0xf8, 0x6a, 0xf2, 0xe6, 0x02, 0xd1, 0xc4, 0xcd, 0x45, 0x7c, 0x5f, 0x51, 0x42, 0x6f, 0xd1, 0x5a,
+	0xf4, 0xb8, 0xea, 0xc5, 0x3e, 0x6d, 0x46, 0x44, 0x3e, 0xcc, 0x21, 0xd2, 0x58, 0x82, 0xd6, 0xfc,
+	0xad, 0x21, 0x38, 0xdb, 0x93, 0x82, 0x2c, 0x2b, 0x99, 0xa0, 0xa7, 0xa2, 0x1c, 0xb4, 0x3d, 0xf1,
+	0xaf, 0xe1, 0xbf, 0xe8, 0x10, 0x94, 0x0c, 0x62, 0x58, 0x8f, 0x32, 0x00, 0x67, 0x90, 0xd7, 0xeb,
+	0x47, 0xf2, 0xe2, 0xe8, 0xc8, 0x0c, 0xba, 0x93, 0x01, 0x63, 0xac, 0x09, 0x0d, 0x1d, 0xb7, 0x11,
+	0xa8, 0xd3, 0xae, 0xce, 0x41, 0x96, 0x2c, 0x8b, 0x7d, 0x48, 0x87, 0xd2, 0x7d, 0x48, 0xcd, 0x7f,
+	0x6b, 0xc0, 0x58, 0xd4, 0x6c, 0x72, 0x0e, 0x4e, 0x6f, 0x58, 0x85, 0xe2, 0x92, 0xbd, 0xf1, 0x41,
+	0x65, 0xc9, 0xde, 0x5c, 0xab, 0x56, 0x96, 0x8a, 0xe5, 0x3b, 0xe5, 0xa5, 0x52, 0xfe, 0x04, 0x99,
+	0x81, 0xc9, 0xcd, 0xb5, 0xfb, 0x6b, 0xeb, 0xdb, 0x6b, 0xf6, 0x92, 0x65, 0xad, 0x5b, 0x79, 0x83,
+	0x4c, 0xc2, 0x98, 0xb5, 0x58, 0x28, 0xda, 0x6b, 0xeb, 0xa5, 0xa5, 0x7c, 0x86, 0xe4, 0x61, 0xa2,
+	0xb8, 0xbe, 0xb6, 0xb6, 0x54, 0xdc, 0x28, 0x6f, 0x95, 0x37, 0x3e, 0xc8, 0x67, 0x09, 0x81, 0x29,
+	0x44, 0xa8, 0x58, 0xe5, 0xb5, 0x62, 0xb9, 0x52, 0x58, 0xc9, 0x0f, 0x31, 0x18, 0xc3, 0x57, 0x60,
+	0xc3, 0x11, 0xa3, 0xfb, 0x9b, 0x8b, 0x4b, 0xf9, 0x11, 0x86, 0xc2, 0xfe, 0x52, 0x50, 0x46, 0x59,
+	0xf5, 0x88, 0x52, 0x2a, 0x6c, 0x14, 0x16, 0x0b, 0xd5, 0xa5, 0x7c, 0x8e, 0x9c, 0x81, 0x93, 0x1a,
+	0xc8, 0x5e, 0x59, 0xbf, 0x5b, 0x5e, 0xcb, 0x8f, 0x91, 0x59, 0xc8, 0x47, 0xb0, 0xd2, 0xa2, 0xbd,
+	0x59, 0x5d, 0xb2, 0xf2, 0x90, 0x84, 0xae, 0x15, 0x56, 0x97, 0xf2, 0xe3, 0xe6, 0xbb, 0x3c, 0xbc,
+	0x84, 0x77, 0x35, 0x39, 0x0d, 0xa4, 0xba, 0x51, 0xd8, 0xd8, 0xac, 0x26, 0x3e, 0x7e, 0x1c, 0x46,
+	0xab, 0x9b, 0xc5, 0xe2, 0x52, 0xb5, 0x9a, 0x37, 0x08, 0xc0, 0xc8, 0x9d, 0x42, 0x79, 0x65, 0xa9,
+	0x94, 0xcf, 0x98, 0x3f, 0x6f, 0xc0, 0x8c, 0x54, 0x77, 0xa4, 0x19, 0xfa, 0x29, 0xe7, 0xe2, 0x7b,
+	0xda, 0x29, 0x4e, 0x7a, 0xff, 0x27, 0x2a, 0xe9, 0x33, 0x0d, 0x7d, 0x38, 0x95, 0x8a, 0x4c, 0x3e,
+	0x80, 0xbc, 0x6c, 0xc0, 0xaa, 0x13, 0xd6, 0xf6, 0xe3, 0x65, 0xec, 0x42, 0xa2, 0x92, 0x04, 0x1a,
+	0xb7, 0xa6, 0xc5, 0x4f, 0x1e, 0x75, 0xb1, 0x31, 0xbf, 0x67, 0xc0, 0x99, 0x1e, 0xc4, 0xa4, 0x08,
+	0x23, 0x51, 0x62, 0xdc, 0x3e, 0x8e, 0x2e, 0xb3, 0xdf, 0x3f, 0x9c, 0x17, 0x88, 0xf8, 0xf2, 0x0b,
+	0xfe, 0x65, 0x8d, 0x44, 0x99, 0x6e, 0x31, 0xdd, 0x2c, 0xef, 0x93, 0xb3, 0x89, 0xee, 0x14, 0x35,
+	0x15, 0xb6, 0xab, 0x8b, 0xe3, 0xa2, 0x43, 0xb2, 0xce, 0xa3, 0x00, 0xf3, 0xcd, 0x9a, 0xdf, 0x35,
+	0x98, 0xaa, 0x94, 0x44, 0x24, 0x45, 0x98, 0x2c, 0x04, 0x41, 0xa7, 0x49, 0x2d, 0xaf, 0x41, 0x0b,
+	0xd6, 0x9a, 0xd8, 0x0b, 0xf0, 0xcc, 0xe3, 0x60, 0x01, 0x2a, 0xc6, 0xb6, 0xe3, 0xb7, 0xb4, 0x4b,
+	0x2d, 0x95, 0x86, 0xdc, 0x06, 0x88, 0x1e, 0xe7, 0x95, 0x31, 0xd5, 0x3c, 0x0a, 0x5f, 0x40, 0x75,
+	0x8d, 0x51, 0x41, 0x36, 0xff, 0xa2, 0x01, 0x13, 0x42, 0xed, 0x2f, 0x34, 0xa8, 0x1f, 0x3e, 0x9d,
+	0xcc, 0xdc, 0xd6, 0x64, 0x26, 0xf2, 0xeb, 0x56, 0xf8, 0xb3, 0xe2, 0x54, 0x71, 0xf9, 0x2f, 0x0d,
+	0xc8, 0x27, 0x11, 0xc9, 0x7b, 0x90, 0xab, 0xd2, 0x87, 0xd4, 0x77, 0xc3, 0x03, 0xb1, 0xfa, 0xc9,
+	0x27, 0x04, 0x38, 0x8e, 0x28, 0xe3, 0xd6, 0xc5, 0x40, 0xfc, 0xb2, 0x22, 0x9a, 0x41, 0x17, 0x71,
+	0xe5, 0xe0, 0x9e, 0x7d, 0x56, 0x07, 0x77, 0xf3, 0x5f, 0x65, 0xe0, 0xcc, 0x5d, 0x1a, 0xaa, 0xdf,
+	0x14, 0xdd, 0x42, 0x7e, 0x66, 0xb0, 0xef, 0x52, 0xbe, 0x64, 0x0e, 0x46, 0xb1, 0x48, 0x8e, 0xaf,
+	0x25, 0x7f, 0x92, 0xc5, 0x48, 0xae, 0xb3, 0x5a, 0x8e, 0xf2, 0x1e, 0x75, 0x5f, 0x53, 0xb2, 0x16,
+	0x47, 0x62, 0x7d, 0x09, 0xa6, 0x30, 0x2d, 0x5f, 0x87, 0x4d, 0x07, 0x5a, 0x17, 0x06, 0x8c, 0x9c,
+	0x95, 0x80, 0x92, 0xab, 0x90, 0x67, 0x90, 0x42, 0xed, 0x41, 0xcb, 0x7b, 0xd4, 0xa0, 0xf5, 0x3d,
+	0xca, 0x9f, 0x4c, 0xcd, 0x59, 0x5d, 0x70, 0xc9, 0x73, 0xb3, 0xc5, 0x0f, 0xe0, 0xb4, 0x8e, 0x56,
+	0x06, 0xc1, 0x33, 0x86, 0x9e, 0xbb, 0x0d, 0xe3, 0x1f, 0x33, 0x03, 0xb9, 0xf9, 0x3f, 0x18, 0x30,
+	0x8b, 0x1f, 0xa7, 0x54, 0x8c, 0xe6, 0xe7, 0xcf, 0xc4, 0xbd, 0xa5, 0x24, 0xe5, 0x75, 0x18, 0x48,
+	0x9f, 0x0a, 0x51, 0x2f, 0xc6, 0x56, 0x8d, 0xcc, 0x00, 0x56, 0x8d, 0xea, 0x71, 0x5e, 0x58, 0x1b,
+	0xd0, 0x28, 0xc3, 0xdf, 0xc5, 0x8d, 0x87, 0xdc, 0xfc, 0xf3, 0x19, 0x18, 0xb5, 0x28, 0x3e, 0x3d,
+	0x45, 0x2e, 0xc1, 0xe8, 0x9a, 0x17, 0xd2, 0x60, 0x55, 0x7b, 0x67, 0xac, 0xc5, 0x40, 0x76, 0xb3,
+	0x6e, 0xc9, 0x42, 0x26, 0xf0, 0x15, 0xdf, 0xab, 0x77, 0x6a, 0xa1, 0x2a, 0xf0, 0x6d, 0x0e, 0xb2,
+	0x64, 0x19, 0x79, 0x03, 0xc6, 0x04, 0xe7, 0xe8, 0xee, 0x07, 0x7d, 0x16, 0x7d, 0x1a, 0x3d, 0x5d,
+	0x16, 0x23, 0xa0, 0xa2, 0xca, 0xb5, 0x86, 0x21, 0x45, 0x51, 0xed, 0x52, 0x04, 0xa4, 0xfe, 0x3d,
+	0xdc, 0x47, 0xff, 0xfe, 0x0c, 0x8c, 0x14, 0x82, 0x80, 0x86, 0x32, 0xdc, 0x74, 0x22, 0x4a, 0x71,
+	0x11, 0xd0, 0x90, 0x33, 0x76, 0xb0, 0xdc, 0x12, 0x78, 0xe6, 0x1f, 0x65, 0x60, 0x18, 0xff, 0xc4,
+	0xfb, 0x2e, 0xbf, 0xb6, 0xaf, 0xdd, 0x77, 0xf9, 0xb5, 0x7d, 0x0b, 0xa1, 0xe4, 0x06, 0x9e, 0xb5,
+	0x65, 0xfe, 0x68, 0xf1, 0xf5, 0x68, 0x44, 0xae, 0xc7, 0x60, 0x4b, 0xc5, 0x89, 0x2e, 0x02, 0xb3,
+	0xa9, 0x41, 0xe6, 0xa7, 0x21, 0xb3, 0x5e, 0x15, 0x5f, 0x8c, 0x19, 0x2c, 0xbc, 0xc0, 0xca, 0xac,
+	0x57, 0xb1, 0x37, 0x96, 0x0b, 0x0b, 0x6f, 0xdd, 0x52, 0x9f, 0xc4, 0x0b, 0xf6, 0x9d, 0x85, 0xb7,
+	0x6e, 0x59, 0xa2, 0x84, 0xf5, 0x2f, 0xb6, 0xb9, 0xea, 0x7e, 0x93, 0x8a, 0x08, 0x4d, 0xec, 0x5f,
+	0xfc, 0x36, 0x3b, 0x70, 0xbf, 0x49, 0xad, 0x18, 0x81, 0x2c, 0xc0, 0xb8, 0x08, 0xca, 0x45, 0x7c,
+	0x25, 0x68, 0x56, 0x04, 0xed, 0x72, 0x0a, 0x15, 0x89, 0xdf, 0xe7, 0x88, 0x01, 0x92, 0xaf, 0xdc,
+	0x88, 0xfb, 0x1c, 0x39, 0x84, 0x81, 0xa5, 0xa0, 0xc4, 0x01, 0xa6, 0x71, 0xe4, 0xa5, 0x1a, 0x60,
+	0x8a, 0x69, 0x16, 0x23, 0x04, 0xf3, 0xd7, 0x32, 0x90, 0xab, 0x34, 0x3a, 0x7b, 0x6e, 0x6b, 0xeb,
+	0xc6, 0x9f, 0xea, 0xb3, 0xcc, 0x6f, 0x02, 0x6e, 0x12, 0xe2, 0x44, 0x20, 0x4d, 0xb2, 0xbc, 0x69,
+	0x42, 0xf9, 0xe0, 0x24, 0x88, 0x46, 0x6e, 0x82, 0x10, 0x4c, 0xf1, 0x4a, 0xd7, 0x29, 0x9d, 0x80,
+	0xbf, 0x4f, 0x21, 0x49, 0x04, 0x2a, 0x79, 0x07, 0xc6, 0xe3, 0xf7, 0x71, 0xe3, 0xc7, 0xb7, 0x54,
+	0xca, 0x62, 0x5c, 0xbe, 0x75, 0xc3, 0x52, 0xd1, 0xcd, 0xef, 0x64, 0x61, 0x42, 0x6d, 0x0f, 0xb1,
+	0xe0, 0x64, 0xd0, 0x60, 0x47, 0x61, 0xe1, 0x93, 0xd2, 0xc6, 0x42, 0xb1, 0x9d, 0x5e, 0xd4, 0x1b,
+	0xc4, 0xf0, 0xb8, 0x83, 0x4a, 0x95, 0x86, 0xa1, 0xdb, 0xda, 0x0b, 0x96, 0x4f, 0x58, 0x33, 0x41,
+	0x0c, 0xe6, 0x78, 0xa4, 0x00, 0x39, 0xaf, 0x1d, 0xec, 0xd1, 0x96, 0x2b, 0x6f, 0x0c, 0x5e, 0xd6,
+	0x18, 0xad, 0x8b, 0xc2, 0x2e, 0x5e, 0x11, 0x19, 0x79, 0x0b, 0x46, 0xbc, 0x36, 0x6d, 0x39, 0xae,
+	0xd8, 0xe3, 0x5e, 0x48, 0x30, 0xa0, 0xad, 0x42, 0x59, 0x21, 0x14, 0xc8, 0xe4, 0x3a, 0x0c, 0x79,
+	0x0f, 0xa2, 0xf1, 0x3a, 0xab, 0x13, 0x3d, 0x08, 0x1d, 0x85, 0x04, 0x11, 0x19, 0xc1, 0x47, 0x4e,
+	0x73, 0x57, 0x8c, 0x98, 0x4e, 0x70, 0xcf, 0x69, 0xee, 0xaa, 0x04, 0x0c, 0x91, 0xbc, 0x0f, 0xd0,
+	0x76, 0xf6, 0xa8, 0x6f, 0xd7, 0x3b, 0xe1, 0x81, 0x18, 0xb7, 0x0b, 0x1a, 0x59, 0x85, 0x15, 0x97,
+	0x3a, 0xe1, 0x81, 0x42, 0x3b, 0xd6, 0x96, 0xc0, 0x2f, 0x0c, 0xfd, 0x2f, 0xbf, 0x32, 0x6f, 0x2c,
+	0x02, 0xe4, 0x02, 0x51, 0x6c, 0xae, 0xc0, 0xd9, 0x9e, 0x1d, 0x4c, 0xae, 0x40, 0x7e, 0xd7, 0x11,
+	0xd6, 0x8a, 0xda, 0xbe, 0xd3, 0x6a, 0xd1, 0x86, 0x10, 0xed, 0x69, 0x09, 0x2f, 0x72, 0x30, 0xe7,
+	0x6c, 0xfe, 0x43, 0x03, 0xce, 0xf7, 0xeb, 0x66, 0x72, 0x0e, 0x72, 0x6d, 0xdf, 0xf5, 0x70, 0x3b,
+	0xe7, 0x93, 0x21, 0xfa, 0x4d, 0x5e, 0x04, 0xe0, 0xfb, 0x4e, 0xe8, 0xec, 0x09, 0x7f, 0x59, 0x6b,
+	0x0c, 0x21, 0x1b, 0xce, 0x5e, 0x40, 0x5e, 0x87, 0x99, 0x3a, 0xdd, 0x75, 0x3a, 0x8d, 0xd0, 0x0e,
+	0x6a, 0xfb, 0xb4, 0x8e, 0x2e, 0xea, 0xe8, 0x07, 0x61, 0xe5, 0x45, 0x41, 0x55, 0xc2, 0xc9, 0x4b,
+	0x30, 0xa1, 0xc6, 0xc3, 0x8b, 0xd7, 0xca, 0xc7, 0x9d, 0xb6, 0x2b, 0x23, 0xe2, 0x79, 0x8b, 0xef,
+	0x0d, 0xe5, 0x8c, 0x7c, 0xc6, 0x42, 0x77, 0x00, 0xd3, 0x81, 0x33, 0x3d, 0x7a, 0x91, 0xb5, 0x2d,
+	0x7e, 0xc2, 0x4a, 0x26, 0xc4, 0xed, 0x44, 0x0f, 0x59, 0x25, 0xab, 0xcb, 0xf4, 0xa8, 0xce, 0x3c,
+	0x0f, 0xb3, 0x69, 0x52, 0x24, 0x4a, 0xef, 0x01, 0xe9, 0x1e, 0x7d, 0x72, 0x0d, 0xc6, 0xd8, 0xe8,
+	0x63, 0xa4, 0x70, 0xc2, 0xaf, 0x10, 0xf1, 0x70, 0x2e, 0x59, 0xb9, 0x8f, 0xc4, 0xdf, 0x82, 0xd7,
+	0x4d, 0xc9, 0x4b, 0x15, 0x3d, 0x72, 0x06, 0x46, 0x3d, 0x7f, 0x8f, 0xad, 0x61, 0xe2, 0x23, 0x46,
+	0x3c, 0x7f, 0x6f, 0xd3, 0x97, 0xe3, 0xf7, 0x37, 0x33, 0x72, 0xfc, 0x16, 0x3d, 0x2f, 0x0c, 0x42,
+	0xdf, 0x69, 0x6b, 0xf3, 0x99, 0x34, 0xe1, 0xac, 0xe7, 0x74, 0xc2, 0xfd, 0x05, 0x9b, 0xfd, 0xeb,
+	0xf9, 0xd2, 0x3f, 0xbd, 0x26, 0xaf, 0x23, 0xc7, 0x17, 0xae, 0xeb, 0x82, 0x5f, 0x60, 0xd8, 0x05,
+	0x15, 0xb9, 0xe8, 0xd5, 0xa9, 0xc2, 0x75, 0xf9, 0x84, 0x75, 0x86, 0xf3, 0xec, 0xc2, 0x22, 0xcb,
+	0xa0, 0xbd, 0x39, 0x98, 0x3a, 0xa1, 0x95, 0xf7, 0x01, 0x75, 0xae, 0xe3, 0x3b, 0xca, 0x03, 0x85,
+	0xef, 0xc1, 0x98, 0x5b, 0x17, 0xc9, 0x28, 0xc4, 0xb4, 0x9e, 0xd7, 0xd8, 0x94, 0xeb, 0x3c, 0x37,
+	0x45, 0xcc, 0x83, 0xad, 0x09, 0xae, 0x80, 0x2e, 0x4e, 0x6a, 0x2b, 0x9f, 0xb9, 0x08, 0x73, 0xbd,
+	0xc8, 0xc4, 0xfb, 0xf8, 0x46, 0xf4, 0x3e, 0xfe, 0x69, 0x18, 0x09, 0x94, 0xec, 0x18, 0x96, 0xf8,
+	0x65, 0xfe, 0x39, 0xb8, 0x3c, 0x68, 0x1f, 0xe1, 0x13, 0xe8, 0xe9, 0x1d, 0x3e, 0x66, 0xcd, 0x38,
+	0x5d, 0xfd, 0x86, 0x4f, 0xa0, 0x47, 0x09, 0x02, 0x5c, 0x29, 0x8f, 0x12, 0xb6, 0xe9, 0xbb, 0xe6,
+	0xbb, 0x30, 0xa5, 0x2f, 0xf5, 0xe4, 0x75, 0x18, 0x8a, 0xb8, 0x4e, 0x45, 0x47, 0x12, 0x15, 0x89,
+	0xf1, 0xb6, 0x10, 0xc9, 0xfc, 0x9f, 0x33, 0x70, 0x32, 0x65, 0xc1, 0x27, 0x1f, 0xc2, 0x49, 0x29,
+	0x20, 0x7c, 0x4d, 0xe7, 0x03, 0xc7, 0x45, 0xe3, 0x4a, 0x9a, 0x68, 0x20, 0x5a, 0xca, 0xf0, 0xcd,
+	0x08, 0xa1, 0x88, 0xcb, 0xff, 0xec, 0x88, 0x03, 0xf9, 0x00, 0x4e, 0x8b, 0x07, 0x8b, 0x14, 0xa9,
+	0xb0, 0x7d, 0xba, 0x2b, 0x56, 0xff, 0x97, 0xba, 0x7a, 0xcf, 0xad, 0x29, 0xcd, 0xb1, 0xe8, 0xee,
+	0xf2, 0x09, 0x6b, 0x36, 0x48, 0x81, 0x27, 0x25, 0xed, 0x6f, 0x1b, 0x60, 0x1e, 0xdd, 0x5f, 0xb8,
+	0x02, 0x25, 0x3b, 0x9c, 0xad, 0x40, 0x4a, 0xef, 0xbd, 0x0c, 0x93, 0x3e, 0xdd, 0xf5, 0x69, 0xb0,
+	0xaf, 0x74, 0xdf, 0x98, 0x35, 0x21, 0x80, 0xb2, 0x63, 0x64, 0x88, 0xcd, 0x00, 0x07, 0xbc, 0x1c,
+	0x53, 0x0e, 0xb8, 0x6a, 0x2e, 0x88, 0xcc, 0x3b, 0xd1, 0x02, 0x92, 0x3a, 0x0e, 0xec, 0x88, 0xa2,
+	0x36, 0x90, 0xff, 0xb8, 0x37, 0x94, 0xcb, 0xe4, 0xb3, 0x96, 0x08, 0x04, 0xda, 0x75, 0x1b, 0xd4,
+	0xfc, 0xfb, 0x06, 0x9c, 0xeb, 0xdd, 0x79, 0xe4, 0x43, 0xc5, 0x44, 0x91, 0xe5, 0x79, 0x10, 0x8e,
+	0xe8, 0x6f, 0xf5, 0x34, 0x27, 0x62, 0x53, 0x92, 0x6f, 0xf5, 0x08, 0x96, 0x4f, 0x73, 0xce, 0xba,
+	0x2d, 0x35, 0x9c, 0x15, 0x37, 0x08, 0xb7, 0x6e, 0x90, 0x2b, 0x30, 0xca, 0x95, 0x1a, 0xd9, 0xd0,
+	0x69, 0xad, 0xa1, 0x5b, 0x37, 0x2c, 0x59, 0x6e, 0x7e, 0xcf, 0x88, 0xb6, 0xe2, 0x64, 0xf3, 0xb7,
+	0x6e, 0x90, 0xcf, 0x0d, 0x66, 0x6c, 0xc8, 0x49, 0x63, 0x43, 0x64, 0x68, 0xf8, 0xbc, 0x66, 0x68,
+	0x78, 0xa5, 0x7f, 0x3f, 0x89, 0xbd, 0x24, 0xf9, 0x9a, 0xc2, 0x1f, 0x1b, 0xf0, 0x62, 0x5f, 0x0a,
+	0x72, 0x1e, 0x72, 0x85, 0x4a, 0x79, 0x23, 0x1e, 0x59, 0x36, 0x5b, 0x24, 0x84, 0xdc, 0x85, 0xb1,
+	0x45, 0x27, 0x70, 0x6b, 0x4c, 0x80, 0x45, 0x43, 0x5e, 0xeb, 0xdf, 0x90, 0x08, 0x9d, 0xe9, 0x2f,
+	0xd1, 0x0f, 0x62, 0xc3, 0x0c, 0xce, 0x82, 0xae, 0x6c, 0xe5, 0xc9, 0x6d, 0xa7, 0x8b, 0x61, 0x17,
+	0x19, 0x5b, 0x61, 0xba, 0x80, 0xc9, 0xc9, 0xf7, 0x10, 0x2e, 0x1e, 0xd5, 0xc0, 0x63, 0x84, 0x93,
+	0x5d, 0x86, 0x5c, 0xc5, 0x09, 0x82, 0x47, 0x9e, 0x5f, 0x57, 0x1f, 0x2b, 0x69, 0x0b, 0x98, 0x15,
+	0x95, 0x9a, 0x3f, 0x63, 0xc8, 0xbd, 0xe1, 0xe8, 0x0f, 0x51, 0xd2, 0x35, 0xd5, 0xfb, 0xa7, 0x6b,
+	0xaa, 0x7f, 0xcc, 0x74, 0x4d, 0xe6, 0xaf, 0x89, 0x60, 0xef, 0x72, 0xbd, 0x92, 0x48, 0x94, 0xf9,
+	0xb4, 0xa6, 0xd3, 0x25, 0x4d, 0x3a, 0x5f, 0x56, 0xf2, 0xbe, 0x75, 0xd7, 0xd5, 0xdb, 0x82, 0xaa,
+	0x88, 0xea, 0xcf, 0x18, 0x70, 0xbe, 0x1f, 0x79, 0x6a, 0x4e, 0x4f, 0xe3, 0x78, 0x39, 0x3d, 0xaf,
+	0x40, 0x8e, 0xc3, 0xf4, 0xcc, 0xfa, 0x82, 0x94, 0x75, 0xb8, 0x2c, 0x36, 0x0b, 0x00, 0xe5, 0x7a,
+	0x65, 0xbd, 0xcd, 0x43, 0xce, 0x6f, 0xc2, 0x10, 0x6b, 0x5b, 0xa2, 0xa3, 0x58, 0x53, 0x0b, 0xab,
+	0x2b, 0x02, 0x89, 0x9f, 0xae, 0x03, 0xa7, 0xd9, 0xb0, 0x10, 0xd9, 0xdc, 0x86, 0x29, 0x1d, 0x83,
+	0x2c, 0xe9, 0x41, 0x4a, 0xf1, 0x63, 0x60, 0x8b, 0x9e, 0xc7, 0x8d, 0xb3, 0x8b, 0x67, 0xbf, 0x7f,
+	0x38, 0x0f, 0xec, 0x27, 0xa7, 0x49, 0x0b, 0x62, 0x32, 0xbf, 0x9d, 0x81, 0xd9, 0xd8, 0xa3, 0x41,
+	0x0e, 0xd7, 0x73, 0x7b, 0xe3, 0x58, 0xd0, 0x6e, 0xc4, 0xe6, 0xbb, 0xde, 0xdb, 0x91, 0x1f, 0xd8,
+	0xc7, 0x10, 0x7f, 0x17, 0xe6, 0x7a, 0xe1, 0x93, 0xd7, 0xbb, 0x5e, 0xc4, 0x10, 0x9e, 0xb7, 0xd1,
+	0xd3, 0x19, 0xca, 0x03, 0x19, 0xff, 0xdc, 0x80, 0x73, 0xc2, 0xa4, 0xb8, 0xea, 0xb8, 0x2d, 0x7c,
+	0x05, 0xac, 0x46, 0x9f, 0xcd, 0x55, 0xf5, 0x5d, 0x6d, 0xca, 0xbc, 0xaa, 0x5b, 0x8e, 0xbb, 0x6a,
+	0xeb, 0xfd, 0xb5, 0xe4, 0x0a, 0xba, 0x2b, 0xd7, 0xb8, 0x55, 0x67, 0x88, 0xbb, 0xe3, 0xb4, 0x18,
+	0x40, 0x75, 0xc7, 0x41, 0x0c, 0xf3, 0x47, 0xe1, 0x42, 0xff, 0x0a, 0xc8, 0xd7, 0x60, 0xb2, 0xb0,
+	0x47, 0x5b, 0xe1, 0x66, 0x7b, 0xcf, 0x77, 0xea, 0x54, 0x5e, 0x1d, 0xc8, 0x43, 0xad, 0x5a, 0xc6,
+	0x5d, 0xb4, 0x85, 0x7b, 0x08, 0x83, 0xdb, 0x1d, 0x41, 0xa4, 0xd9, 0xed, 0x55, 0x6e, 0xe6, 0x8f,
+	0x19, 0x40, 0xba, 0x79, 0x90, 0x5b, 0x30, 0xb1, 0xb9, 0x51, 0xac, 0x86, 0x8e, 0x1f, 0x2e, 0x7b,
+	0x1d, 0xde, 0x9d, 0x93, 0xc2, 0x73, 0x21, 0xac, 0xd9, 0x01, 0x2b, 0xb0, 0xf7, 0xbd, 0x8e, 0x6f,
+	0x69, 0x78, 0x98, 0x47, 0x88, 0xd2, 0x07, 0x75, 0xe7, 0x40, 0xcf, 0x23, 0x24, 0x60, 0x5a, 0x1e,
+	0x21, 0x01, 0x33, 0xff, 0xba, 0x01, 0x2f, 0xc8, 0x03, 0x66, 0x3d, 0xa5, 0x2d, 0x45, 0xf4, 0x89,
+	0xf3, 0x65, 0xe8, 0x57, 0x3f, 0xbd, 0x69, 0x46, 0xba, 0x8d, 0x62, 0x03, 0x51, 0x81, 0xe2, 0xb4,
+	0xf8, 0x04, 0x62, 0xe8, 0xb5, 0x07, 0xf0, 0x1b, 0xcd, 0x47, 0x23, 0x1a, 0x7a, 0x6d, 0x64, 0x81,
+	0x94, 0x26, 0x85, 0x59, 0xb5, 0x71, 0xb2, 0xc5, 0x64, 0x15, 0x46, 0x85, 0x6f, 0xbc, 0xd0, 0x44,
+	0x64, 0xb8, 0x44, 0x9f, 0x6f, 0x5a, 0x9c, 0x96, 0xce, 0xa9, 0x22, 0xf4, 0xc8, 0x92, 0x3c, 0xcc,
+	0x9f, 0x33, 0xf8, 0xeb, 0xcb, 0x18, 0x8d, 0xfb, 0xb4, 0x22, 0xad, 0xeb, 0x28, 0xd2, 0x59, 0x20,
+	0x62, 0x3f, 0xd0, 0xc2, 0xff, 0x16, 0x4c, 0x27, 0x08, 0x88, 0x89, 0x6e, 0x49, 0x0d, 0x97, 0x3f,
+	0x26, 0xc7, 0xbf, 0x7b, 0xcc, 0xd2, 0x60, 0xe6, 0xbf, 0x63, 0xc0, 0x2c, 0x3b, 0x21, 0x97, 0x9b,
+	0x6d, 0xcf, 0x0f, 0xad, 0x4e, 0x43, 0xce, 0x77, 0xb6, 0x59, 0x4b, 0x4b, 0x05, 0xf7, 0xdf, 0xe0,
+	0x9b, 0xb5, 0x80, 0x59, 0x51, 0x29, 0x59, 0x86, 0x9c, 0x88, 0x94, 0x94, 0x8f, 0x9f, 0x4a, 0x9b,
+	0x8c, 0xce, 0x58, 0x20, 0xb1, 0x2f, 0xc1, 0x25, 0x4c, 0xd0, 0x58, 0x11, 0xb5, 0xf9, 0x47, 0x06,
+	0x9c, 0xe9, 0x41, 0x43, 0xde, 0x85, 0x61, 0xbc, 0x0c, 0x13, 0xa3, 0x77, 0xbe, 0x47, 0x15, 0x61,
+	0x6d, 0x7f, 0xeb, 0x06, 0xbf, 0x36, 0x6e, 0xb2, 0x1f, 0x16, 0xa7, 0x22, 0x1f, 0xc2, 0x58, 0xa1,
+	0x5e, 0xd7, 0x9e, 0x68, 0x7d, 0xb3, 0x7f, 0x2b, 0xaf, 0x45, 0xf8, 0x5c, 0x67, 0xe6, 0x66, 0xd9,
+	0x7a, 0x5d, 0xbc, 0x71, 0x69, 0xc5, 0xfc, 0xce, 0xbd, 0x03, 0x53, 0x3a, 0xf2, 0xb1, 0x74, 0xe6,
+	0xef, 0x19, 0x90, 0xd7, 0xdb, 0xf0, 0xc9, 0xb8, 0xd5, 0xa6, 0x0d, 0xf3, 0x11, 0x42, 0xf5, 0x9d,
+	0x0c, 0x9c, 0x4a, 0xed, 0x61, 0xf2, 0x26, 0x8c, 0x14, 0xda, 0xed, 0x72, 0x49, 0x48, 0x15, 0x57,
+	0x1e, 0x9c, 0x76, 0x3b, 0x11, 0x88, 0x23, 0x90, 0xc8, 0x4d, 0xc8, 0xa1, 0x64, 0x32, 0x82, 0x4c,
+	0x1c, 0xbb, 0x83, 0x11, 0xee, 0xc9, 0xd8, 0x1d, 0x89, 0x48, 0xee, 0xc0, 0x94, 0xf0, 0xb0, 0xb3,
+	0xe8, 0x1e, 0x7d, 0x1c, 0x05, 0x91, 0x63, 0x9c, 0xbb, 0xf4, 0xc7, 0xb3, 0x7d, 0x5e, 0xa6, 0x46,
+	0x03, 0xea, 0x54, 0xf8, 0x42, 0x0b, 0xe3, 0xa9, 0x72, 0xe2, 0x01, 0x44, 0xfc, 0x85, 0x16, 0x6c,
+	0x44, 0x0f, 0x5e, 0x5d, 0x94, 0xd1, 0x70, 0x15, 0x82, 0xc0, 0xdd, 0x6b, 0x35, 0x69, 0x2b, 0xfc,
+	0xe4, 0x86, 0x2b, 0xae, 0x63, 0xa0, 0xe1, 0xfa, 0xee, 0x10, 0x9f, 0xcc, 0x49, 0xb2, 0x23, 0x1e,
+	0x21, 0x2b, 0xc1, 0x28, 0x8f, 0x2d, 0x95, 0x33, 0xe3, 0xc5, 0xd4, 0x26, 0x70, 0x9c, 0xad, 0x1b,
+	0x5c, 0x7d, 0xe1, 0xb7, 0x72, 0x81, 0x25, 0x49, 0xc9, 0x16, 0x8c, 0x17, 0x1b, 0xd4, 0x69, 0x75,
+	0xda, 0x6c, 0x91, 0x1e, 0xe0, 0xf4, 0x3c, 0x27, 0xbe, 0x65, 0xa2, 0xc6, 0xc9, 0xec, 0xd0, 0x6d,
+	0x52, 0x5c, 0xc9, 0x55, 0x46, 0x64, 0x23, 0x32, 0xd4, 0x0f, 0xa1, 0x61, 0xe6, 0x33, 0x7d, 0xfa,
+	0x27, 0x09, 0x44, 0x3a, 0xfd, 0x16, 0x4a, 0x58, 0xf2, 0x6d, 0x98, 0x5a, 0x71, 0x82, 0x70, 0xc3,
+	0x77, 0x5a, 0x01, 0x86, 0xe7, 0x0c, 0xe0, 0x33, 0x2d, 0x53, 0xc9, 0x4f, 0xa3, 0x7f, 0x5e, 0x18,
+	0x91, 0x62, 0x9b, 0x13, 0xec, 0x98, 0xbe, 0x74, 0xc7, 0x6d, 0x39, 0x0d, 0xf7, 0x9b, 0xf2, 0x3e,
+	0x93, 0xeb, 0x4b, 0xbb, 0x12, 0x68, 0xc5, 0xe5, 0xe6, 0x57, 0xbb, 0xc6, 0x8d, 0xb7, 0x72, 0x1c,
+	0x46, 0x85, 0x0b, 0x0b, 0x77, 0xe9, 0xa8, 0x2c, 0xad, 0x95, 0xca, 0x6b, 0x77, 0xf3, 0x06, 0x99,
+	0x02, 0xa8, 0x58, 0xeb, 0xc5, 0xa5, 0x6a, 0x95, 0xfd, 0xce, 0xb0, 0xdf, 0xc2, 0xdf, 0xe3, 0xce,
+	0xe6, 0x4a, 0x3e, 0xab, 0xb8, 0x7c, 0x0c, 0x99, 0xff, 0xcc, 0x80, 0xd3, 0xe9, 0x43, 0x49, 0x36,
+	0x00, 0x9d, 0x7e, 0x84, 0xcd, 0xeb, 0x56, 0xdf, 0x71, 0x4f, 0x05, 0x27, 0x9d, 0x87, 0x42, 0xee,
+	0x94, 0x92, 0x71, 0xa5, 0x76, 0x1c, 0xa5, 0x74, 0x77, 0xeb, 0x66, 0x11, 0xe6, 0x7a, 0xf1, 0xd0,
+	0x3f, 0x75, 0x1a, 0xc6, 0x0b, 0x95, 0xca, 0x4a, 0xb9, 0x58, 0xd8, 0x28, 0xaf, 0xaf, 0xe5, 0x0d,
+	0x32, 0x06, 0xc3, 0x77, 0xad, 0xf5, 0xcd, 0x4a, 0x3e, 0x63, 0xfe, 0x25, 0x03, 0x26, 0xcb, 0xad,
+	0x90, 0xee, 0xf1, 0x14, 0x76, 0x4f, 0x3b, 0xf9, 0xbe, 0xa0, 0x4d, 0xbe, 0xb9, 0xc8, 0x3d, 0x2e,
+	0xaa, 0x60, 0xa0, 0x99, 0xf7, 0x08, 0x66, 0xba, 0x48, 0x48, 0x15, 0x46, 0x0b, 0xdb, 0xd5, 0xf5,
+	0x72, 0xa9, 0x28, 0x1a, 0x26, 0x95, 0x72, 0x01, 0xed, 0xae, 0x84, 0x5f, 0x3e, 0x3f, 0x0a, 0x6c,
+	0xcf, 0xad, 0x2b, 0x59, 0x31, 0x97, 0x4f, 0x58, 0x92, 0x13, 0x3b, 0xa1, 0x8b, 0x73, 0x05, 0xaa,
+	0xec, 0x2b, 0x30, 0xd7, 0x8b, 0x1b, 0x3b, 0xa9, 0xe8, 0xbe, 0x22, 0xa7, 0xa3, 0x24, 0x06, 0xba,
+	0x93, 0x88, 0x44, 0x33, 0xff, 0x4a, 0x06, 0x4e, 0xb3, 0x7e, 0x69, 0xd0, 0x20, 0x60, 0xe7, 0x6c,
+	0x76, 0xa4, 0x13, 0x4f, 0xd1, 0x7e, 0x0e, 0x46, 0xf6, 0x8f, 0x67, 0x80, 0xe1, 0xe8, 0x84, 0x00,
+	0xae, 0x35, 0x62, 0xdf, 0xc3, 0xbf, 0xc9, 0x8b, 0xa0, 0xa4, 0xab, 0xc5, 0xa5, 0x62, 0xc2, 0x1a,
+	0x6b, 0x47, 0x49, 0x6b, 0x3f, 0x0f, 0xc3, 0x18, 0x38, 0x21, 0x66, 0xbc, 0xd4, 0xd4, 0xd2, 0x5b,
+	0x86, 0x11, 0x15, 0x16, 0x27, 0x20, 0xd7, 0x01, 0xe2, 0x10, 0x73, 0x31, 0xa5, 0xe5, 0xe9, 0x30,
+	0x8a, 0x32, 0xb7, 0xc6, 0x9a, 0xbb, 0x8e, 0x88, 0xdb, 0xbe, 0x0a, 0x33, 0xd2, 0x50, 0xd0, 0x96,
+	0x9e, 0xff, 0x3c, 0xc8, 0xc1, 0x9a, 0xe6, 0x05, 0xe5, 0xb6, 0xf0, 0xfe, 0x37, 0xff, 0x75, 0x06,
+	0xc6, 0xb6, 0xd9, 0xfe, 0x87, 0xa7, 0xba, 0xfe, 0xa7, 0xc4, 0x05, 0x18, 0x5f, 0xf1, 0x9c, 0xba,
+	0xfe, 0x94, 0x22, 0xde, 0xd4, 0x36, 0x3c, 0x47, 0x5a, 0x5e, 0x03, 0x4b, 0x45, 0x3a, 0xe2, 0x96,
+	0xf9, 0x1e, 0x8c, 0xf0, 0xc8, 0x21, 0x91, 0xf8, 0x59, 0x6a, 0x40, 0x51, 0x8b, 0xae, 0xf1, 0x62,
+	0xc5, 0xc2, 0xb7, 0x8b, 0x00, 0x75, 0x3b, 0x16, 0xb1, 0x47, 0xca, 0x19, 0x76, 0x78, 0xb0, 0x33,
+	0xac, 0xe2, 0xef, 0x3d, 0x32, 0x88, 0xbf, 0xf7, 0xb9, 0xdb, 0x30, 0xae, 0xb4, 0xe7, 0x58, 0x0a,
+	0xd1, 0x8f, 0x67, 0x60, 0x12, 0xbf, 0x2a, 0x32, 0xcd, 0x3f, 0x9f, 0x27, 0xf2, 0x2f, 0x68, 0x27,
+	0xf2, 0x39, 0x75, 0xbc, 0xf8, 0x97, 0xf5, 0x39, 0x8a, 0xdf, 0x83, 0x99, 0x2e, 0x44, 0xf2, 0x16,
+	0x0c, 0xb3, 0xe6, 0xcb, 0x13, 0x4c, 0x3e, 0x29, 0x01, 0x71, 0x3c, 0x1e, 0xfb, 0xf0, 0xc0, 0xe2,
+	0xd8, 0xe6, 0xff, 0x6d, 0xc0, 0x84, 0xc8, 0x39, 0xd0, 0xda, 0xf5, 0x9e, 0xdb, 0xee, 0xbc, 0xad,
+	0x75, 0xe7, 0x99, 0x28, 0x66, 0x40, 0x7e, 0x58, 0x9f, 0xde, 0xfc, 0x47, 0x18, 0xb9, 0xa6, 0x23,
+	0x92, 0x12, 0xf7, 0xd0, 0xd3, 0x97, 0xe6, 0x24, 0x16, 0x5b, 0xab, 0x31, 0xa7, 0xd8, 0x4c, 0xfa,
+	0xeb, 0xf0, 0xe7, 0xf6, 0x71, 0x91, 0x97, 0xf9, 0xbd, 0xe2, 0xd7, 0xc4, 0x95, 0xfc, 0x5e, 0xf1,
+	0x6b, 0xe2, 0xea, 0x1b, 0xe2, 0xd7, 0x01, 0xd0, 0x09, 0xbb, 0x55, 0xa3, 0x91, 0x1d, 0x0d, 0xfd,
+	0x32, 0x5c, 0x01, 0x65, 0xf8, 0x0a, 0x8a, 0xf9, 0xeb, 0x59, 0x80, 0xf8, 0xc2, 0x93, 0xcd, 0x48,
+	0xaa, 0xa5, 0xea, 0x11, 0xf6, 0x3b, 0x04, 0xa9, 0xa3, 0x24, 0x40, 0xe4, 0x12, 0x0c, 0x29, 0xb9,
+	0x7a, 0x53, 0x43, 0x3b, 0xd0, 0x4c, 0x5b, 0x04, 0x08, 0x0e, 0x5a, 0x35, 0xbb, 0x4e, 0x1b, 0x0e,
+	0x5f, 0x9c, 0xb3, 0xf8, 0xca, 0xdf, 0x6c, 0x0c, 0xed, 0x91, 0x4d, 0x76, 0x8c, 0x61, 0x94, 0x18,
+	0x02, 0x79, 0x37, 0x71, 0x23, 0x3c, 0x14, 0x47, 0xb4, 0xa8, 0x70, 0x35, 0xa2, 0x45, 0xb9, 0x2d,
+	0x26, 0x0b, 0x10, 0x19, 0x90, 0xd5, 0x15, 0x2a, 0x2d, 0xb7, 0xb0, 0x84, 0x31, 0x1a, 0x69, 0x4a,
+	0xd6, 0x9e, 0xd8, 0x14, 0x30, 0x95, 0x46, 0xc2, 0x48, 0x05, 0xc6, 0xdc, 0xd6, 0x43, 0xda, 0x0a,
+	0x3d, 0xff, 0x60, 0x6e, 0x14, 0x67, 0xd5, 0x59, 0xe5, 0x6e, 0xb9, 0x2c, 0xcb, 0xf8, 0xa2, 0x8a,
+	0x67, 0x96, 0x08, 0x5f, 0x0d, 0x21, 0x8c, 0x80, 0xe2, 0x22, 0xf9, 0x1f, 0x67, 0x80, 0x74, 0x33,
+	0x20, 0x5f, 0x80, 0x71, 0xbe, 0x26, 0xdb, 0x7e, 0xf0, 0x0d, 0x71, 0x05, 0xcd, 0xfd, 0x2f, 0x15,
+	0xb0, 0xea, 0x7f, 0xc9, 0xc1, 0x56, 0xf0, 0x8d, 0x06, 0xf9, 0x1a, 0x9c, 0xc4, 0x01, 0x68, 0x53,
+	0xdf, 0xf5, 0xea, 0x36, 0x86, 0x7b, 0x39, 0x0d, 0x91, 0x1b, 0xee, 0x4d, 0x4c, 0x62, 0xda, 0x5d,
+	0xdc, 0x63, 0xa0, 0x66, 0x18, 0x6a, 0x05, 0x31, 0x2b, 0x1c, 0x91, 0x6c, 0x40, 0x5e, 0xa5, 0xdf,
+	0xed, 0x34, 0x1a, 0x62, 0xec, 0xaf, 0xe2, 0xdb, 0x46, 0x89, 0xb2, 0x1e, 0x8c, 0xa7, 0x62, 0xc6,
+	0x77, 0x3a, 0x8d, 0x06, 0xf9, 0x1c, 0x80, 0xd7, 0xb2, 0x9b, 0x6e, 0x10, 0xb8, 0xad, 0x3d, 0x21,
+	0x04, 0x18, 0xc8, 0x15, 0x43, 0xd5, 0x6e, 0xf4, 0x5a, 0xab, 0x1c, 0x28, 0xba, 0xf1, 0x2b, 0x30,
+	0x23, 0x3c, 0x2f, 0xb7, 0xdd, 0x70, 0x5f, 0x68, 0x6c, 0x4f, 0xa3, 0xee, 0x29, 0x2a, 0xdb, 0xbf,
+	0xcd, 0x00, 0x14, 0xb6, 0xab, 0xd2, 0xe9, 0xf7, 0x0a, 0x0c, 0x33, 0x3d, 0x54, 0x9e, 0x67, 0xd1,
+	0x1a, 0x88, 0x7c, 0x55, 0x6b, 0x20, 0x62, 0xb0, 0x99, 0x67, 0xd1, 0x3d, 0x34, 0xa9, 0x64, 0xe2,
+	0xc3, 0xaf, 0xcf, 0x41, 0x9a, 0x5a, 0xc5, 0x41, 0x64, 0x05, 0x20, 0x76, 0xc3, 0x15, 0x27, 0xa3,
+	0x99, 0xd8, 0x9f, 0x4d, 0x14, 0x88, 0x2c, 0x02, 0xb1, 0x2b, 0xaf, 0x2a, 0x08, 0x31, 0x1a, 0xb9,
+	0x0f, 0x43, 0x1b, 0xce, 0x9e, 0xf4, 0x27, 0xec, 0xe1, 0x9c, 0x7c, 0x51, 0x64, 0xe1, 0x8b, 0x1d,
+	0x94, 0xa7, 0x42, 0x47, 0x4b, 0x56, 0x8a, 0x4c, 0xc8, 0x12, 0x8c, 0x88, 0x0c, 0xcb, 0x3d, 0x22,
+	0x55, 0x44, 0x82, 0x65, 0x11, 0x8c, 0x89, 0x40, 0xed, 0x81, 0x58, 0x9e, 0x4b, 0x79, 0x01, 0xb2,
+	0xd5, 0xea, 0xaa, 0x70, 0xc9, 0x99, 0x8c, 0xd5, 0xdc, 0x6a, 0x75, 0x55, 0x66, 0x91, 0x57, 0xdf,
+	0xf0, 0x64, 0xc8, 0x26, 0x55, 0x7b, 0x85, 0x5c, 0x4a, 0x2a, 0xab, 0x68, 0x24, 0x92, 0xca, 0x6a,
+	0xa4, 0xa2, 0xb2, 0x65, 0xb3, 0xcb, 0x83, 0x19, 0x97, 0x4d, 0xc5, 0x83, 0x59, 0xf3, 0x5b, 0xfe,
+	0x89, 0xac, 0x12, 0x19, 0x23, 0x9a, 0xfb, 0x2e, 0xc0, 0x3d, 0xcf, 0x6d, 0xad, 0xd2, 0x70, 0xdf,
+	0xab, 0x2b, 0x8e, 0xd4, 0xe3, 0x1f, 0x79, 0x6e, 0xcb, 0x6e, 0x22, 0xf8, 0x07, 0x87, 0xf3, 0x0a,
+	0x92, 0xa5, 0xfc, 0xcd, 0x16, 0x7a, 0xf6, 0x4b, 0x7d, 0xb9, 0x1b, 0x17, 0x7a, 0xa4, 0x16, 0x0f,
+	0x36, 0x44, 0x08, 0xe4, 0x36, 0x00, 0x8f, 0xd1, 0x51, 0x94, 0x3b, 0x1c, 0x6a, 0x7e, 0xa1, 0x92,
+	0x8c, 0xec, 0x53, 0x90, 0xc9, 0x72, 0xd4, 0x74, 0x99, 0x36, 0x45, 0xe4, 0xd6, 0x40, 0x13, 0x88,
+	0x18, 0x0e, 0x5b, 0x26, 0x59, 0x51, 0x13, 0x5c, 0x26, 0xc8, 0xb0, 0x11, 0xd5, 0xe5, 0x12, 0xb7,
+	0x59, 0x8b, 0x25, 0x95, 0x37, 0x22, 0xd8, 0xaf, 0xdb, 0x35, 0x04, 0x6b, 0x8d, 0x88, 0x90, 0xc9,
+	0x22, 0x4c, 0x73, 0x77, 0xbf, 0x28, 0xfd, 0x9a, 0x58, 0x5e, 0x71, 0x22, 0xc7, 0xf9, 0xd9, 0xd4,
+	0xea, 0x13, 0x04, 0x66, 0x19, 0x46, 0xb8, 0x34, 0x60, 0x78, 0xa6, 0xc8, 0xfd, 0xa0, 0x04, 0x1a,
+	0xf2, 0xf0, 0x4c, 0x01, 0xef, 0x0e, 0xcf, 0x54, 0x08, 0xcc, 0x5f, 0xce, 0xc2, 0x44, 0xe1, 0x9b,
+	0x1d, 0x3f, 0x72, 0xd7, 0x2f, 0xc0, 0x64, 0xb5, 0xb3, 0x13, 0x39, 0x6b, 0xca, 0x19, 0xcc, 0x1f,
+	0xbc, 0x53, 0x0b, 0x54, 0xf3, 0xba, 0x46, 0x41, 0x96, 0x60, 0x4a, 0xae, 0x1e, 0x22, 0x23, 0x23,
+	0x9f, 0xd8, 0xe8, 0x5c, 0x2f, 0xc3, 0x08, 0xba, 0xf3, 0x31, 0x26, 0x88, 0xe2, 0x35, 0x24, 0x7b,
+	0x9c, 0x35, 0x64, 0x68, 0xa0, 0x35, 0xe4, 0x43, 0x98, 0x90, 0xb5, 0xe1, 0xec, 0x1f, 0x7e, 0xba,
+	0xd9, 0xaf, 0x31, 0x23, 0x2b, 0xd1, 0x2a, 0x30, 0xd2, 0x77, 0x15, 0xc0, 0x3b, 0x0b, 0x29, 0x76,
+	0x5d, 0x29, 0xd6, 0x05, 0x0f, 0xf3, 0x8f, 0x0d, 0x80, 0xbb, 0xc5, 0xca, 0xc7, 0x58, 0x59, 0xdf,
+	0x82, 0xb1, 0x15, 0x4f, 0x9a, 0xab, 0x15, 0x3b, 0x61, 0x43, 0x02, 0xd5, 0xcd, 0x22, 0xc2, 0x8c,
+	0x56, 0xc4, 0xec, 0xb3, 0x58, 0x11, 0x6f, 0x03, 0x54, 0x7c, 0xef, 0x23, 0x5a, 0x0b, 0xe3, 0x44,
+	0x43, 0x38, 0x53, 0xda, 0x1c, 0x9a, 0x30, 0x57, 0x2a, 0xc8, 0x57, 0xdf, 0x87, 0x69, 0x19, 0x53,
+	0xb2, 0xb1, 0x52, 0xc5, 0x18, 0xd0, 0x69, 0x18, 0xdf, 0x5a, 0xb2, 0xca, 0x77, 0x3e, 0xb0, 0xef,
+	0x6c, 0xae, 0xac, 0xe4, 0x4f, 0x90, 0x49, 0x18, 0x13, 0x80, 0x62, 0x21, 0x6f, 0x90, 0x09, 0xc8,
+	0x95, 0xd7, 0xaa, 0x4b, 0xc5, 0x4d, 0x6b, 0x29, 0x9f, 0xb9, 0xba, 0x00, 0x53, 0xf1, 0x53, 0x51,
+	0x68, 0x16, 0x19, 0x85, 0xac, 0x55, 0xd8, 0xce, 0x9f, 0x20, 0x00, 0x23, 0x95, 0xfb, 0xc5, 0xea,
+	0x8d, 0x1b, 0x79, 0x83, 0x8c, 0xc3, 0xe8, 0xdd, 0x62, 0xc5, 0xbe, 0xbf, 0x5a, 0xcd, 0x67, 0xae,
+	0x7e, 0x06, 0x66, 0x70, 0x9e, 0xad, 0xb8, 0x41, 0x48, 0x5b, 0xd4, 0xc7, 0x6a, 0x27, 0x20, 0x57,
+	0xa5, 0x6c, 0x80, 0x42, 0xca, 0xeb, 0x5c, 0xed, 0x34, 0x42, 0xb7, 0xdd, 0xa0, 0x8f, 0xf3, 0xc6,
+	0xd5, 0xdb, 0x30, 0x6d, 0x79, 0x9d, 0xd0, 0x6d, 0xed, 0x55, 0x43, 0x86, 0xb1, 0x77, 0x40, 0x4e,
+	0xc1, 0xcc, 0xe6, 0x5a, 0x61, 0x75, 0xb1, 0x7c, 0x77, 0x73, 0x7d, 0xb3, 0x6a, 0xaf, 0x16, 0x36,
+	0x8a, 0xcb, 0xdc, 0x0e, 0xb3, 0xba, 0x5e, 0xdd, 0xb0, 0xad, 0xa5, 0xe2, 0xd2, 0xda, 0x46, 0xde,
+	0xb8, 0xfa, 0xd3, 0x06, 0x4c, 0x6d, 0x06, 0xc2, 0xaf, 0x65, 0x13, 0x43, 0x22, 0x2e, 0xc2, 0xf9,
+	0xcd, 0xea, 0x92, 0x65, 0x6f, 0xac, 0xdf, 0x5f, 0x5a, 0xb3, 0x37, 0xab, 0x85, 0xbb, 0xc9, 0x40,
+	0xac, 0x79, 0x78, 0x41, 0xc1, 0xb0, 0x96, 0x8a, 0xeb, 0x5b, 0x4b, 0x96, 0x5d, 0x29, 0x54, 0xab,
+	0xdb, 0xeb, 0x56, 0x29, 0x6f, 0x90, 0x73, 0x70, 0x3a, 0x05, 0x61, 0xf5, 0x4e, 0x21, 0x9f, 0xe9,
+	0x2a, 0x5b, 0x5b, 0xda, 0x2e, 0xac, 0xd8, 0x8b, 0xeb, 0x1b, 0xf9, 0xec, 0xd5, 0xf7, 0xd9, 0x9c,
+	0xc0, 0x58, 0x05, 0x9e, 0x56, 0x21, 0x07, 0x43, 0x6b, 0xeb, 0x6b, 0x4b, 0x49, 0x5b, 0xd9, 0x04,
+	0xe4, 0x0a, 0x95, 0x8a, 0xb5, 0xbe, 0xb5, 0x54, 0xca, 0x67, 0x58, 0x47, 0x96, 0x96, 0xd6, 0x58,
+	0xcb, 0xb2, 0x57, 0xff, 0x7f, 0x40, 0x78, 0x10, 0x86, 0x8c, 0x4d, 0xc7, 0xce, 0xbb, 0x00, 0xe7,
+	0x96, 0xd9, 0x57, 0x63, 0xbd, 0xab, 0xeb, 0xa5, 0xe4, 0xf7, 0x9c, 0x06, 0x92, 0x28, 0x5f, 0xbf,
+	0x73, 0x27, 0x6f, 0x90, 0x33, 0x70, 0x32, 0x01, 0x2f, 0x59, 0xeb, 0x95, 0x7c, 0x26, 0xa5, 0xe0,
+	0xfe, 0xd2, 0x52, 0x25, 0x9f, 0xbd, 0x6a, 0xc2, 0x4c, 0x91, 0xfa, 0x21, 0xdb, 0xad, 0x5a, 0xec,
+	0x88, 0x84, 0xd5, 0x4f, 0xc2, 0xd8, 0xd2, 0x97, 0x37, 0x96, 0xd6, 0xaa, 0xe5, 0xf5, 0xb5, 0xfc,
+	0x89, 0xab, 0xe7, 0x13, 0x38, 0x52, 0x2c, 0xaa, 0xd5, 0xe5, 0xfc, 0x89, 0xab, 0x5f, 0x65, 0x47,
+	0x3b, 0x25, 0x65, 0xc9, 0x19, 0x38, 0xa9, 0xfe, 0xae, 0xd0, 0x56, 0xdd, 0x6d, 0xed, 0xe5, 0x4f,
+	0x24, 0x0b, 0xac, 0x4e, 0xab, 0xc5, 0x0a, 0xb0, 0xf3, 0xd5, 0x82, 0x0d, 0xea, 0x37, 0xdd, 0x96,
+	0x13, 0xd2, 0x7a, 0x3e, 0x73, 0xf5, 0x1a, 0x4c, 0x6a, 0x61, 0x26, 0xac, 0xde, 0x95, 0x75, 0x21,
+	0x8e, 0xab, 0x4b, 0xa5, 0xf2, 0xe6, 0x6a, 0x7e, 0x98, 0x75, 0xfb, 0x72, 0xf9, 0xee, 0x72, 0x1e,
+	0xae, 0x7e, 0x95, 0xad, 0xa3, 0x18, 0x89, 0xbd, 0x7a, 0xa7, 0x20, 0x1b, 0xca, 0x3a, 0x87, 0x07,
+	0xa4, 0x2d, 0x55, 0xab, 0xdc, 0x9c, 0x77, 0x1e, 0xe6, 0xc4, 0x0f, 0xbb, 0xb0, 0x56, 0xb2, 0x97,
+	0x0b, 0x56, 0x69, 0xbb, 0x60, 0xb1, 0x6e, 0xf9, 0x20, 0x9f, 0xc1, 0xfe, 0x55, 0x20, 0xf6, 0xc6,
+	0xfa, 0x66, 0x71, 0x39, 0x9f, 0xbd, 0xea, 0x42, 0x3e, 0xe9, 0x8d, 0xd7, 0x65, 0x21, 0xb5, 0x36,
+	0xd7, 0xd6, 0xf8, 0xa8, 0x4f, 0xc3, 0xf8, 0xfa, 0xc6, 0xf2, 0x92, 0x25, 0x82, 0xff, 0x30, 0xda,
+	0x6f, 0x73, 0xad, 0xb0, 0xb9, 0xb1, 0xbc, 0x6e, 0x95, 0xbf, 0xc2, 0x86, 0x9f, 0xcc, 0xc1, 0x6c,
+	0x75, 0xa5, 0x50, 0xbc, 0x6f, 0xaf, 0xad, 0x6f, 0xd8, 0xe5, 0x35, 0xbb, 0xb8, 0x5c, 0x58, 0x5b,
+	0x5b, 0x5a, 0xc9, 0xc3, 0xd5, 0x7f, 0x6e, 0xc0, 0x0b, 0x7d, 0xcc, 0x4d, 0xe4, 0x4d, 0xb8, 0xb2,
+	0xbc, 0x54, 0x28, 0xad, 0x2c, 0x55, 0xab, 0x36, 0x63, 0xb9, 0xb4, 0xb6, 0x21, 0x8c, 0x95, 0x76,
+	0x75, 0xa3, 0xb0, 0x91, 0x94, 0x98, 0x2b, 0xf0, 0x6a, 0x7f, 0xf4, 0x58, 0x58, 0x2f, 0xc3, 0x2b,
+	0xfd, 0x51, 0x85, 0xf0, 0x66, 0xc8, 0x55, 0xb8, 0xd4, 0x1f, 0x33, 0x12, 0xfa, 0xec, 0xe2, 0xbb,
+	0xbf, 0xfb, 0xfb, 0x17, 0x4e, 0xfc, 0xee, 0x1f, 0x5c, 0x30, 0x7e, 0xef, 0x0f, 0x2e, 0x18, 0xff,
+	0xea, 0x0f, 0x2e, 0x18, 0x5f, 0x79, 0xfd, 0x18, 0xe9, 0x99, 0x77, 0x46, 0xd0, 0x1a, 0x7e, 0xf3,
+	0xff, 0x09, 0x00, 0x00, 0xff, 0xff, 0x3f, 0xee, 0x69, 0x2c, 0xea, 0x50, 0x01, 0x00,
 }
 
 func (this *PluginSpecV1) Equal(that interface{}) bool {
@@ -17467,6 +18111,30 @@ func (this *PluginSpecV1_Jamf) Equal(that interface{}) bool {
 	}
 	return true
 }
+func (this *PluginSpecV1_PagerDuty) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginSpecV1_PagerDuty)
+	if !ok {
+		that2, ok := that.(PluginSpecV1_PagerDuty)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !this.PagerDuty.Equal(that1.PagerDuty) {
+		return false
+	}
+	return true
+}
 func (this *PluginSlackAccessSettings) Equal(that interface{}) bool {
 	if that == nil {
 		return this == nil
@@ -17540,6 +18208,36 @@ func (this *PluginOpsgenieAccessSettings) Equal(that interface{}) bool {
 	}
 	return true
 }
+func (this *PluginPagerDutySettings) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*PluginPagerDutySettings)
+	if !ok {
+		that2, ok := that.(PluginPagerDutySettings)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.UserEmail != that1.UserEmail {
+		return false
+	}
+	if this.ApiEndpoint != that1.ApiEndpoint {
+		return false
+	}
+	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
+		return false
+	}
+	return true
+}
 func (this *PluginOpenAISettings) Equal(that interface{}) bool {
 	if that == nil {
 		return this == nil
@@ -18409,6 +19107,16 @@ func (m *DatabaseSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	{
+		size, err := m.MongoAtlas.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x62
 	if m.AdminUser != nil {
 		{
 			size, err := m.AdminUser.MarshalToSizedBuffer(dAtA[:i])
@@ -18660,6 +19368,16 @@ func (m *AWS) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	{
+		size, err := m.OpenSearch.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x62
 	if len(m.AssumeRoleARN) > 0 {
 		i -= len(m.AssumeRoleARN)
 		copy(dAtA[i:], m.AssumeRoleARN)
@@ -19117,6 +19835,54 @@ func (m *RedshiftServerless) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *OpenSearch) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *OpenSearch) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OpenSearch) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.EndpointType) > 0 {
+		i -= len(m.EndpointType)
+		copy(dAtA[i:], m.EndpointType)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.EndpointType)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.DomainID) > 0 {
+		i -= len(m.DomainID)
+		copy(dAtA[i:], m.DomainID)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.DomainID)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.DomainName) > 0 {
+		i -= len(m.DomainName)
+		copy(dAtA[i:], m.DomainName)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.DomainName)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *GCPCloudSQL) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -19402,6 +20168,40 @@ func (m *MySQLOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *MongoAtlas) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MongoAtlas) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MongoAtlas) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *InstanceV1) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -19487,12 +20287,12 @@ func (m *InstanceSpecV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0x32
 		}
 	}
-	n41, err41 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastSeen, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastSeen):])
-	if err41 != nil {
-		return 0, err41
+	n43, err43 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastSeen, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastSeen):])
+	if err43 != nil {
+		return 0, err43
 	}
-	i -= n41
-	i = encodeVarintTypes(dAtA, i, uint64(n41))
+	i -= n43
+	i = encodeVarintTypes(dAtA, i, uint64(n43))
 	i--
 	dAtA[i] = 0x2a
 	if len(m.AuthID) > 0 {
@@ -19576,12 +20376,12 @@ func (m *InstanceControlLogEntry) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i--
 		dAtA[i] = 0x20
 	}
-	n42, err42 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Time, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Time):])
-	if err42 != nil {
-		return 0, err42
+	n44, err44 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Time, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Time):])
+	if err44 != nil {
+		return 0, err44
 	}
-	i -= n42
-	i = encodeVarintTypes(dAtA, i, uint64(n42))
+	i -= n44
+	i = encodeVarintTypes(dAtA, i, uint64(n44))
 	i--
 	dAtA[i] = 0x1a
 	if m.ID != 0 {
@@ -20176,6 +20976,15 @@ func (m *AppSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.UserGroups) > 0 {
+		for iNdEx := len(m.UserGroups) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.UserGroups[iNdEx])
+			copy(dAtA[i:], m.UserGroups[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.UserGroups[iNdEx])))
+			i--
+			dAtA[i] = 0x42
+		}
+	}
 	if len(m.Cloud) > 0 {
 		i -= len(m.Cloud)
 		copy(dAtA[i:], m.Cloud)
@@ -21001,12 +21810,12 @@ func (m *ProvisionTokenV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x1a
 	}
-	n63, err63 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err63 != nil {
-		return 0, err63
+	n65, err65 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err65 != nil {
+		return 0, err65
 	}
-	i -= n63
-	i = encodeVarintTypes(dAtA, i, uint64(n63))
+	i -= n65
+	i = encodeVarintTypes(dAtA, i, uint64(n65))
 	i--
 	dAtA[i] = 0x12
 	if len(m.Roles) > 0 {
@@ -22849,6 +23658,13 @@ func (m *AuthPreferenceSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.DefaultSessionTTL != 0 {
+		i = encodeVarintTypes(dAtA, i, uint64(m.DefaultSessionTTL))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x80
+	}
 	if m.AllowHeadless != nil {
 		{
 			size := m.AllowHeadless.Size()
@@ -23332,12 +24148,12 @@ func (m *UserTokenSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n103, err103 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err103 != nil {
-		return 0, err103
+	n105, err105 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err105 != nil {
+		return 0, err105
 	}
-	i -= n103
-	i = encodeVarintTypes(dAtA, i, uint64(n103))
+	i -= n105
+	i = encodeVarintTypes(dAtA, i, uint64(n105))
 	i--
 	dAtA[i] = 0x22
 	if m.Usage != 0 {
@@ -23454,12 +24270,12 @@ func (m *UserTokenSecretsSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n106, err106 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err106 != nil {
-		return 0, err106
+	n108, err108 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err108 != nil {
+		return 0, err108
 	}
-	i -= n106
-	i = encodeVarintTypes(dAtA, i, uint64(n106))
+	i -= n108
+	i = encodeVarintTypes(dAtA, i, uint64(n108))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.QRCode) > 0 {
@@ -23623,20 +24439,20 @@ func (m *AccessReview) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if len(m.ThresholdIndexes) > 0 {
-		dAtA110 := make([]byte, len(m.ThresholdIndexes)*10)
-		var j109 int
+		dAtA112 := make([]byte, len(m.ThresholdIndexes)*10)
+		var j111 int
 		for _, num := range m.ThresholdIndexes {
 			for num >= 1<<7 {
-				dAtA110[j109] = uint8(uint64(num)&0x7f | 0x80)
+				dAtA112[j111] = uint8(uint64(num)&0x7f | 0x80)
 				num >>= 7
-				j109++
+				j111++
 			}
-			dAtA110[j109] = uint8(num)
-			j109++
+			dAtA112[j111] = uint8(num)
+			j111++
 		}
-		i -= j109
-		copy(dAtA[i:], dAtA110[:j109])
-		i = encodeVarintTypes(dAtA, i, uint64(j109))
+		i -= j111
+		copy(dAtA[i:], dAtA112[:j111])
+		i = encodeVarintTypes(dAtA, i, uint64(j111))
 		i--
 		dAtA[i] = 0x3a
 	}
@@ -23650,12 +24466,12 @@ func (m *AccessReview) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	i--
 	dAtA[i] = 0x32
-	n112, err112 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err112 != nil {
-		return 0, err112
+	n114, err114 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err114 != nil {
+		return 0, err114
 	}
-	i -= n112
-	i = encodeVarintTypes(dAtA, i, uint64(n112))
+	i -= n114
+	i = encodeVarintTypes(dAtA, i, uint64(n114))
 	i--
 	dAtA[i] = 0x2a
 	if len(m.Reason) > 0 {
@@ -23758,20 +24574,20 @@ func (m *ThresholdIndexSet) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if len(m.Indexes) > 0 {
-		dAtA115 := make([]byte, len(m.Indexes)*10)
-		var j114 int
+		dAtA117 := make([]byte, len(m.Indexes)*10)
+		var j116 int
 		for _, num := range m.Indexes {
 			for num >= 1<<7 {
-				dAtA115[j114] = uint8(uint64(num)&0x7f | 0x80)
+				dAtA117[j116] = uint8(uint64(num)&0x7f | 0x80)
 				num >>= 7
-				j114++
+				j116++
 			}
-			dAtA115[j114] = uint8(num)
-			j114++
+			dAtA117[j116] = uint8(num)
+			j116++
 		}
-		i -= j114
-		copy(dAtA[i:], dAtA115[:j114])
-		i = encodeVarintTypes(dAtA, i, uint64(j114))
+		i -= j116
+		copy(dAtA[i:], dAtA117[:j116])
+		i = encodeVarintTypes(dAtA, i, uint64(j116))
 		i--
 		dAtA[i] = 0xa
 	}
@@ -23971,20 +24787,20 @@ func (m *AccessRequestSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x32
 	}
-	n119, err119 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err119 != nil {
-		return 0, err119
+	n121, err121 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err121 != nil {
+		return 0, err121
 	}
-	i -= n119
-	i = encodeVarintTypes(dAtA, i, uint64(n119))
+	i -= n121
+	i = encodeVarintTypes(dAtA, i, uint64(n121))
 	i--
 	dAtA[i] = 0x2a
-	n120, err120 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err120 != nil {
-		return 0, err120
+	n122, err122 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err122 != nil {
+		return 0, err122
 	}
-	i -= n120
-	i = encodeVarintTypes(dAtA, i, uint64(n120))
+	i -= n122
+	i = encodeVarintTypes(dAtA, i, uint64(n122))
 	i--
 	dAtA[i] = 0x22
 	if m.State != 0 {
@@ -24711,6 +25527,13 @@ func (m *RoleOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.CreateHostUserMode != 0 {
+		i = encodeVarintTypes(dAtA, i, uint64(m.CreateHostUserMode))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xe0
+	}
 	if m.CreateDatabaseUser != nil {
 		{
 			size := m.CreateDatabaseUser.Size()
@@ -26205,12 +27028,12 @@ func (m *UserSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	i--
 	dAtA[i] = 0x42
-	n155, err155 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err155 != nil {
-		return 0, err155
+	n157, err157 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err157 != nil {
+		return 0, err157
 	}
-	i -= n155
-	i = encodeVarintTypes(dAtA, i, uint64(n155))
+	i -= n157
+	i = encodeVarintTypes(dAtA, i, uint64(n157))
 	i--
 	dAtA[i] = 0x3a
 	{
@@ -26352,28 +27175,28 @@ func (m *LoginStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n158, err158 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.RecoveryAttemptLockExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.RecoveryAttemptLockExpires):])
-	if err158 != nil {
-		return 0, err158
+	n160, err160 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.RecoveryAttemptLockExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.RecoveryAttemptLockExpires):])
+	if err160 != nil {
+		return 0, err160
 	}
-	i -= n158
-	i = encodeVarintTypes(dAtA, i, uint64(n158))
+	i -= n160
+	i = encodeVarintTypes(dAtA, i, uint64(n160))
 	i--
 	dAtA[i] = 0x2a
-	n159, err159 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LockExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LockExpires):])
-	if err159 != nil {
-		return 0, err159
+	n161, err161 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LockExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LockExpires):])
+	if err161 != nil {
+		return 0, err161
 	}
-	i -= n159
-	i = encodeVarintTypes(dAtA, i, uint64(n159))
+	i -= n161
+	i = encodeVarintTypes(dAtA, i, uint64(n161))
 	i--
 	dAtA[i] = 0x22
-	n160, err160 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LockedTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LockedTime):])
-	if err160 != nil {
-		return 0, err160
+	n162, err162 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LockedTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LockedTime):])
+	if err162 != nil {
+		return 0, err162
 	}
-	i -= n160
-	i = encodeVarintTypes(dAtA, i, uint64(n160))
+	i -= n162
+	i = encodeVarintTypes(dAtA, i, uint64(n162))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.LockedMessage) > 0 {
@@ -26430,12 +27253,12 @@ func (m *CreatedBy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	i--
 	dAtA[i] = 0x1a
-	n162, err162 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Time, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Time):])
-	if err162 != nil {
-		return 0, err162
+	n164, err164 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Time, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Time):])
+	if err164 != nil {
+		return 0, err164
 	}
-	i -= n162
-	i = encodeVarintTypes(dAtA, i, uint64(n162))
+	i -= n164
+	i = encodeVarintTypes(dAtA, i, uint64(n164))
 	i--
 	dAtA[i] = 0x12
 	if m.Connector != nil {
@@ -26553,20 +27376,20 @@ func (m *MFADevice) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			}
 		}
 	}
-	n165, err165 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastUsed, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUsed):])
-	if err165 != nil {
-		return 0, err165
+	n167, err167 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastUsed, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUsed):])
+	if err167 != nil {
+		return 0, err167
 	}
-	i -= n165
-	i = encodeVarintTypes(dAtA, i, uint64(n165))
+	i -= n167
+	i = encodeVarintTypes(dAtA, i, uint64(n167))
 	i--
 	dAtA[i] = 0x3a
-	n166, err166 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.AddedAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.AddedAt):])
-	if err166 != nil {
-		return 0, err166
+	n168, err168 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.AddedAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.AddedAt):])
+	if err168 != nil {
+		return 0, err168
 	}
-	i -= n166
-	i = encodeVarintTypes(dAtA, i, uint64(n166))
+	i -= n168
+	i = encodeVarintTypes(dAtA, i, uint64(n168))
 	i--
 	dAtA[i] = 0x32
 	if len(m.Id) > 0 {
@@ -27170,12 +27993,12 @@ func (m *TunnelConnectionSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i--
 		dAtA[i] = 0x22
 	}
-	n175, err175 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastHeartbeat, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastHeartbeat):])
-	if err175 != nil {
-		return 0, err175
+	n177, err177 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastHeartbeat, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastHeartbeat):])
+	if err177 != nil {
+		return 0, err177
 	}
-	i -= n175
-	i = encodeVarintTypes(dAtA, i, uint64(n175))
+	i -= n177
+	i = encodeVarintTypes(dAtA, i, uint64(n177))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.ProxyName) > 0 {
@@ -27267,12 +28090,12 @@ func (m *AcquireSemaphoreRequest) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i--
 		dAtA[i] = 0x2a
 	}
-	n176, err176 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err176 != nil {
-		return 0, err176
+	n178, err178 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err178 != nil {
+		return 0, err178
 	}
-	i -= n176
-	i = encodeVarintTypes(dAtA, i, uint64(n176))
+	i -= n178
+	i = encodeVarintTypes(dAtA, i, uint64(n178))
 	i--
 	dAtA[i] = 0x22
 	if m.MaxLeases != 0 {
@@ -27321,12 +28144,12 @@ func (m *SemaphoreLease) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n177, err177 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err177 != nil {
-		return 0, err177
+	n179, err179 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err179 != nil {
+		return 0, err179
 	}
-	i -= n177
-	i = encodeVarintTypes(dAtA, i, uint64(n177))
+	i -= n179
+	i = encodeVarintTypes(dAtA, i, uint64(n179))
 	i--
 	dAtA[i] = 0x2a
 	if len(m.LeaseID) > 0 {
@@ -27384,12 +28207,12 @@ func (m *SemaphoreLeaseRef) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x1a
 	}
-	n178, err178 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err178 != nil {
-		return 0, err178
+	n180, err180 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err180 != nil {
+		return 0, err180
 	}
-	i -= n178
-	i = encodeVarintTypes(dAtA, i, uint64(n178))
+	i -= n180
+	i = encodeVarintTypes(dAtA, i, uint64(n180))
 	i--
 	dAtA[i] = 0x12
 	if len(m.LeaseID) > 0 {
@@ -27627,28 +28450,28 @@ func (m *WebSessionSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x48
 	}
-	n184, err184 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LoginTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LoginTime):])
-	if err184 != nil {
-		return 0, err184
+	n186, err186 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LoginTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LoginTime):])
+	if err186 != nil {
+		return 0, err186
 	}
-	i -= n184
-	i = encodeVarintTypes(dAtA, i, uint64(n184))
+	i -= n186
+	i = encodeVarintTypes(dAtA, i, uint64(n186))
 	i--
 	dAtA[i] = 0x42
-	n185, err185 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err185 != nil {
-		return 0, err185
+	n187, err187 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err187 != nil {
+		return 0, err187
 	}
-	i -= n185
-	i = encodeVarintTypes(dAtA, i, uint64(n185))
+	i -= n187
+	i = encodeVarintTypes(dAtA, i, uint64(n187))
 	i--
 	dAtA[i] = 0x3a
-	n186, err186 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.BearerTokenExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.BearerTokenExpires):])
-	if err186 != nil {
-		return 0, err186
+	n188, err188 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.BearerTokenExpires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.BearerTokenExpires):])
+	if err188 != nil {
+		return 0, err188
 	}
-	i -= n186
-	i = encodeVarintTypes(dAtA, i, uint64(n186))
+	i -= n188
+	i = encodeVarintTypes(dAtA, i, uint64(n188))
 	i--
 	dAtA[i] = 0x32
 	if len(m.BearerToken) > 0 {
@@ -27840,20 +28663,20 @@ func (m *SAMLSessionData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x22
 	}
-	n187, err187 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.ExpireTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.ExpireTime):])
-	if err187 != nil {
-		return 0, err187
+	n189, err189 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.ExpireTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.ExpireTime):])
+	if err189 != nil {
+		return 0, err189
 	}
-	i -= n187
-	i = encodeVarintTypes(dAtA, i, uint64(n187))
+	i -= n189
+	i = encodeVarintTypes(dAtA, i, uint64(n189))
 	i--
 	dAtA[i] = 0x1a
-	n188, err188 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CreateTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CreateTime):])
-	if err188 != nil {
-		return 0, err188
+	n190, err190 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CreateTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CreateTime):])
+	if err190 != nil {
+		return 0, err190
 	}
-	i -= n188
-	i = encodeVarintTypes(dAtA, i, uint64(n188))
+	i -= n190
+	i = encodeVarintTypes(dAtA, i, uint64(n190))
 	i--
 	dAtA[i] = 0x12
 	if len(m.ID) > 0 {
@@ -28135,12 +28958,12 @@ func (m *RemoteClusterStatusV3) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n192, err192 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastHeartbeat, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastHeartbeat):])
-	if err192 != nil {
-		return 0, err192
+	n194, err194 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastHeartbeat, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastHeartbeat):])
+	if err194 != nil {
+		return 0, err194
 	}
-	i -= n192
-	i = encodeVarintTypes(dAtA, i, uint64(n192))
+	i -= n194
+	i = encodeVarintTypes(dAtA, i, uint64(n194))
 	i--
 	dAtA[i] = 0x12
 	if len(m.Connection) > 0 {
@@ -30424,12 +31247,12 @@ func (m *GithubAuthRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		dAtA[i] = 0x62
 	}
 	if m.Expires != nil {
-		n221, err221 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
-		if err221 != nil {
-			return 0, err221
+		n223, err223 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
+		if err223 != nil {
+			return 0, err223
 		}
-		i -= n221
-		i = encodeVarintTypes(dAtA, i, uint64(n221))
+		i -= n223
+		i = encodeVarintTypes(dAtA, i, uint64(n223))
 		i--
 		dAtA[i] = 0x5a
 	}
@@ -31441,21 +32264,21 @@ func (m *LockSpecV2) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x2a
 	}
-	n239, err239 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CreatedAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CreatedAt):])
-	if err239 != nil {
-		return 0, err239
+	n241, err241 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CreatedAt, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CreatedAt):])
+	if err241 != nil {
+		return 0, err241
 	}
-	i -= n239
-	i = encodeVarintTypes(dAtA, i, uint64(n239))
+	i -= n241
+	i = encodeVarintTypes(dAtA, i, uint64(n241))
 	i--
 	dAtA[i] = 0x22
 	if m.Expires != nil {
-		n240, err240 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
-		if err240 != nil {
-			return 0, err240
+		n242, err242 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
+		if err242 != nil {
+			return 0, err242
 		}
-		i -= n240
-		i = encodeVarintTypes(dAtA, i, uint64(n240))
+		i -= n242
+		i = encodeVarintTypes(dAtA, i, uint64(n242))
 		i--
 		dAtA[i] = 0x1a
 	}
@@ -32001,12 +32824,12 @@ func (m *RegisterUsingTokenRequest) MarshalToSizedBuffer(dAtA []byte) (int, erro
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if m.Expires != nil {
-		n248, err248 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
-		if err248 != nil {
-			return 0, err248
+		n250, err250 := github_com_gogo_protobuf_types.StdTimeMarshalTo(*m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(*m.Expires):])
+		if err250 != nil {
+			return 0, err250
 		}
-		i -= n248
-		i = encodeVarintTypes(dAtA, i, uint64(n248))
+		i -= n250
+		i = encodeVarintTypes(dAtA, i, uint64(n250))
 		i--
 		dAtA[i] = 0x62
 	}
@@ -32186,12 +33009,12 @@ func (m *RecoveryCodesSpecV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n251, err251 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err251 != nil {
-		return 0, err251
+	n253, err253 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err253 != nil {
+		return 0, err253
 	}
-	i -= n251
-	i = encodeVarintTypes(dAtA, i, uint64(n251))
+	i -= n253
+	i = encodeVarintTypes(dAtA, i, uint64(n253))
 	i--
 	dAtA[i] = 0x12
 	if len(m.Codes) > 0 {
@@ -32551,20 +33374,20 @@ func (m *SessionTrackerSpecV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x32
 	}
-	n255, err255 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err255 != nil {
-		return 0, err255
+	n257, err257 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err257 != nil {
+		return 0, err257
 	}
-	i -= n255
-	i = encodeVarintTypes(dAtA, i, uint64(n255))
+	i -= n257
+	i = encodeVarintTypes(dAtA, i, uint64(n257))
 	i--
 	dAtA[i] = 0x2a
-	n256, err256 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err256 != nil {
-		return 0, err256
+	n258, err258 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err258 != nil {
+		return 0, err258
 	}
-	i -= n256
-	i = encodeVarintTypes(dAtA, i, uint64(n256))
+	i -= n258
+	i = encodeVarintTypes(dAtA, i, uint64(n258))
 	i--
 	dAtA[i] = 0x22
 	if m.State != 0 {
@@ -32668,12 +33491,12 @@ func (m *Participant) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n257, err257 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastActive, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastActive):])
-	if err257 != nil {
-		return 0, err257
+	n259, err259 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastActive, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastActive):])
+	if err259 != nil {
+		return 0, err259
 	}
-	i -= n257
-	i = encodeVarintTypes(dAtA, i, uint64(n257))
+	i -= n259
+	i = encodeVarintTypes(dAtA, i, uint64(n259))
 	i--
 	dAtA[i] = 0x22
 	if len(m.Mode) > 0 {
@@ -33234,6 +34057,16 @@ func (m *DatabaseResourceMatcher) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	{
+		size, err := m.AWS.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
 	if m.Labels != nil {
 		{
 			size := m.Labels.Size()
@@ -33249,6 +34082,47 @@ func (m *DatabaseResourceMatcher) MarshalToSizedBuffer(dAtA []byte) (int, error)
 	return len(dAtA) - i, nil
 }
 
+func (m *ResourceMatcherAWS) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ResourceMatcherAWS) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ResourceMatcherAWS) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.ExternalID) > 0 {
+		i -= len(m.ExternalID)
+		copy(dAtA[i:], m.ExternalID)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.ExternalID)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.AssumeRoleARN) > 0 {
+		i -= len(m.AssumeRoleARN)
+		copy(dAtA[i:], m.AssumeRoleARN)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.AssumeRoleARN)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *ClusterAlert) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -33320,12 +34194,12 @@ func (m *ClusterAlertSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n269, err269 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
-	if err269 != nil {
-		return 0, err269
+	n272, err272 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Created, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Created):])
+	if err272 != nil {
+		return 0, err272
 	}
-	i -= n269
-	i = encodeVarintTypes(dAtA, i, uint64(n269))
+	i -= n272
+	i = encodeVarintTypes(dAtA, i, uint64(n272))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.Message) > 0 {
@@ -33455,12 +34329,12 @@ func (m *AlertAcknowledgement) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n270, err270 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err270 != nil {
-		return 0, err270
+	n273, err273 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err273 != nil {
+		return 0, err273
 	}
-	i -= n270
-	i = encodeVarintTypes(dAtA, i, uint64(n270))
+	i -= n273
+	i = encodeVarintTypes(dAtA, i, uint64(n273))
 	i--
 	dAtA[i] = 0x22
 	if len(m.Reason) > 0 {
@@ -33877,6 +34751,27 @@ func (m *PluginSpecV1_Jamf) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	return len(dAtA) - i, nil
 }
+func (m *PluginSpecV1_PagerDuty) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PluginSpecV1_PagerDuty) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.PagerDuty != nil {
+		{
+			size, err := m.PagerDuty.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
+	}
+	return len(dAtA) - i, nil
+}
 func (m *PluginSlackAccessSettings) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -33970,6 +34865,47 @@ func (m *PluginOpsgenieAccessSettings) MarshalToSizedBuffer(dAtA []byte) (int, e
 	return len(dAtA) - i, nil
 }
 
+func (m *PluginPagerDutySettings) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PluginPagerDutySettings) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PluginPagerDutySettings) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.ApiEndpoint) > 0 {
+		i -= len(m.ApiEndpoint)
+		copy(dAtA[i:], m.ApiEndpoint)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.ApiEndpoint)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.UserEmail) > 0 {
+		i -= len(m.UserEmail)
+		copy(dAtA[i:], m.UserEmail)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.UserEmail)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *PluginOpenAISettings) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -34427,12 +35363,12 @@ func (m *PluginOAuth2AccessTokenCredentials) MarshalToSizedBuffer(dAtA []byte) (
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n288, err288 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err288 != nil {
-		return 0, err288
+	n292, err292 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err292 != nil {
+		return 0, err292
 	}
-	i -= n288
-	i = encodeVarintTypes(dAtA, i, uint64(n288))
+	i -= n292
+	i = encodeVarintTypes(dAtA, i, uint64(n292))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.RefreshToken) > 0 {
@@ -35220,20 +36156,20 @@ func (m *ScheduledAgentUpgradeWindow) MarshalToSizedBuffer(dAtA []byte) (int, er
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n302, err302 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Stop, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Stop):])
-	if err302 != nil {
-		return 0, err302
+	n306, err306 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Stop, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Stop):])
+	if err306 != nil {
+		return 0, err306
 	}
-	i -= n302
-	i = encodeVarintTypes(dAtA, i, uint64(n302))
+	i -= n306
+	i = encodeVarintTypes(dAtA, i, uint64(n306))
 	i--
 	dAtA[i] = 0x12
-	n303, err303 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Start, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Start):])
-	if err303 != nil {
-		return 0, err303
+	n307, err307 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Start, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Start):])
+	if err307 != nil {
+		return 0, err307
 	}
-	i -= n303
-	i = encodeVarintTypes(dAtA, i, uint64(n303))
+	i -= n307
+	i = encodeVarintTypes(dAtA, i, uint64(n307))
 	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
@@ -35304,6 +36240,16 @@ func (m *UserGroupV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
 	{
 		size, err := m.ResourceHeader.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -35317,6 +36263,42 @@ func (m *UserGroupV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *UserGroupSpecV1) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UserGroupSpecV1) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UserGroupSpecV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Applications) > 0 {
+		for iNdEx := len(m.Applications) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Applications[iNdEx])
+			copy(dAtA[i:], m.Applications[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Applications[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *OktaImportRuleSpecV1) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -35614,12 +36596,12 @@ func (m *OktaAssignmentSpecV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x30
 	}
-	n309, err309 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastTransition, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastTransition):])
-	if err309 != nil {
-		return 0, err309
+	n314, err314 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastTransition, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastTransition):])
+	if err314 != nil {
+		return 0, err314
 	}
-	i -= n309
-	i = encodeVarintTypes(dAtA, i, uint64(n309))
+	i -= n314
+	i = encodeVarintTypes(dAtA, i, uint64(n314))
 	i--
 	dAtA[i] = 0x2a
 	if m.Status != 0 {
@@ -35627,12 +36609,12 @@ func (m *OktaAssignmentSpecV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x20
 	}
-	n310, err310 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CleanupTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CleanupTime):])
-	if err310 != nil {
-		return 0, err310
+	n315, err315 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.CleanupTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.CleanupTime):])
+	if err315 != nil {
+		return 0, err315
 	}
-	i -= n310
-	i = encodeVarintTypes(dAtA, i, uint64(n310))
+	i -= n315
+	i = encodeVarintTypes(dAtA, i, uint64(n315))
 	i--
 	dAtA[i] = 0x1a
 	if len(m.Targets) > 0 {
@@ -36424,6 +37406,393 @@ func (m *MessageWithHeader) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *AWSMatcher) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AWSMatcher) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AWSMatcher) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.SSM != nil {
+		{
+			size, err := m.SSM.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
+	}
+	if m.Params != nil {
+		{
+			size, err := m.Params.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
+	}
+	{
+		size := m.Tags.Size()
+		i -= size
+		if _, err := m.Tags.MarshalTo(dAtA[i:]); err != nil {
+			return 0, err
+		}
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	if m.AssumeRole != nil {
+		{
+			size, err := m.AssumeRole.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Regions) > 0 {
+		for iNdEx := len(m.Regions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Regions[iNdEx])
+			copy(dAtA[i:], m.Regions[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Regions[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Types) > 0 {
+		for iNdEx := len(m.Types) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Types[iNdEx])
+			copy(dAtA[i:], m.Types[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Types[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AssumeRole) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AssumeRole) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AssumeRole) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.ExternalID) > 0 {
+		i -= len(m.ExternalID)
+		copy(dAtA[i:], m.ExternalID)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.ExternalID)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.RoleARN) > 0 {
+		i -= len(m.RoleARN)
+		copy(dAtA[i:], m.RoleARN)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.RoleARN)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *InstallerParams) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *InstallerParams) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *InstallerParams) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.PublicProxyAddr) > 0 {
+		i -= len(m.PublicProxyAddr)
+		copy(dAtA[i:], m.PublicProxyAddr)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.PublicProxyAddr)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.SSHDConfig) > 0 {
+		i -= len(m.SSHDConfig)
+		copy(dAtA[i:], m.SSHDConfig)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.SSHDConfig)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.InstallTeleport {
+		i--
+		if m.InstallTeleport {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if len(m.ScriptName) > 0 {
+		i -= len(m.ScriptName)
+		copy(dAtA[i:], m.ScriptName)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.ScriptName)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.JoinToken) > 0 {
+		i -= len(m.JoinToken)
+		copy(dAtA[i:], m.JoinToken)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.JoinToken)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.JoinMethod) > 0 {
+		i -= len(m.JoinMethod)
+		copy(dAtA[i:], m.JoinMethod)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.JoinMethod)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AWSSSM) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AWSSSM) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AWSSSM) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.DocumentName) > 0 {
+		i -= len(m.DocumentName)
+		copy(dAtA[i:], m.DocumentName)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.DocumentName)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AzureMatcher) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AzureMatcher) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AzureMatcher) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Params != nil {
+		{
+			size, err := m.Params.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintTypes(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
+	}
+	{
+		size := m.ResourceTags.Size()
+		i -= size
+		if _, err := m.ResourceTags.MarshalTo(dAtA[i:]); err != nil {
+			return 0, err
+		}
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x2a
+	if len(m.Regions) > 0 {
+		for iNdEx := len(m.Regions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Regions[iNdEx])
+			copy(dAtA[i:], m.Regions[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Regions[iNdEx])))
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	if len(m.Types) > 0 {
+		for iNdEx := len(m.Types) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Types[iNdEx])
+			copy(dAtA[i:], m.Types[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Types[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.ResourceGroups) > 0 {
+		for iNdEx := len(m.ResourceGroups) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ResourceGroups[iNdEx])
+			copy(dAtA[i:], m.ResourceGroups[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.ResourceGroups[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Subscriptions) > 0 {
+		for iNdEx := len(m.Subscriptions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Subscriptions[iNdEx])
+			copy(dAtA[i:], m.Subscriptions[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Subscriptions[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *GCPMatcher) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GCPMatcher) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GCPMatcher) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.ProjectIDs) > 0 {
+		for iNdEx := len(m.ProjectIDs) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ProjectIDs[iNdEx])
+			copy(dAtA[i:], m.ProjectIDs[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.ProjectIDs[iNdEx])))
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	{
+		size := m.Tags.Size()
+		i -= size
+		if _, err := m.Tags.MarshalTo(dAtA[i:]); err != nil {
+			return 0, err
+		}
+		i = encodeVarintTypes(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	if len(m.Locations) > 0 {
+		for iNdEx := len(m.Locations) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Locations[iNdEx])
+			copy(dAtA[i:], m.Locations[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Locations[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Types) > 0 {
+		for iNdEx := len(m.Types) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Types[iNdEx])
+			copy(dAtA[i:], m.Types[iNdEx])
+			i = encodeVarintTypes(dAtA, i, uint64(len(m.Types[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func encodeVarintTypes(dAtA []byte, offset int, v uint64) int {
 	offset -= sovTypes(v)
 	base := offset
@@ -36771,6 +38140,8 @@ func (m *DatabaseSpecV3) Size() (n int) {
 		l = m.AdminUser.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	l = m.MongoAtlas.Size()
+	n += 1 + l + sovTypes(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -36857,6 +38228,8 @@ func (m *AWS) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	l = m.OpenSearch.Size()
+	n += 1 + l + sovTypes(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -37036,6 +38409,30 @@ func (m *RedshiftServerless) Size() (n int) {
 	return n
 }
 
+func (m *OpenSearch) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.DomainName)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.DomainID)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.EndpointType)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *GCPCloudSQL) Size() (n int) {
 	if m == nil {
 		return 0
@@ -37172,6 +38569,22 @@ func (m *MySQLOptions) Size() (n int) {
 	return n
 }
 
+func (m *MongoAtlas) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *InstanceV1) Size() (n int) {
 	if m == nil {
 		return 0
@@ -37542,6 +38955,12 @@ func (m *AppSpecV3) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if len(m.UserGroups) > 0 {
+		for _, s := range m.UserGroups {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -38785,6 +40204,9 @@ func (m *AuthPreferenceSpecV2) Size() (n int) {
 		l = m.AllowHeadless.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if m.DefaultSessionTTL != 0 {
+		n += 2 + sovTypes(uint64(m.DefaultSessionTTL))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -39651,6 +41073,9 @@ func (m *RoleOptions) Size() (n int) {
 		l = m.CreateDatabaseUser.Size()
 		n += 2 + l + sovTypes(uint64(l))
 	}
+	if m.CreateHostUserMode != 0 {
+		n += 2 + sovTypes(uint64(m.CreateHostUserMode))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -43397,6 +44822,28 @@ func (m *DatabaseResourceMatcher) Size() (n int) {
 		l = m.Labels.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	l = m.AWS.Size()
+	n += 1 + l + sovTypes(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ResourceMatcherAWS) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.AssumeRoleARN)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.ExternalID)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -43694,6 +45141,18 @@ func (m *PluginSpecV1_Jamf) Size() (n int) {
 	}
 	return n
 }
+func (m *PluginSpecV1_PagerDuty) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PagerDuty != nil {
+		l = m.PagerDuty.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	return n
+}
 func (m *PluginSlackAccessSettings) Size() (n int) {
 	if m == nil {
 		return 0
@@ -43742,6 +45201,26 @@ func (m *PluginOpsgenieAccessSettings) Size() (n int) {
 	return n
 }
 
+func (m *PluginPagerDutySettings) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.UserEmail)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.ApiEndpoint)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *PluginOpenAISettings) Size() (n int) {
 	if m == nil {
 		return 0
@@ -44348,6 +45827,26 @@ func (m *UserGroupV1) Size() (n int) {
 	_ = l
 	l = m.ResourceHeader.Size()
 	n += 1 + l + sovTypes(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovTypes(uint64(l))
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *UserGroupSpecV1) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Applications) > 0 {
+		for _, s := range m.Applications {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -44841,6 +46340,189 @@ func (m *MessageWithHeader) Size() (n int) {
 	return n
 }
 
+func (m *AWSMatcher) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Types) > 0 {
+		for _, s := range m.Types {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if len(m.Regions) > 0 {
+		for _, s := range m.Regions {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.AssumeRole != nil {
+		l = m.AssumeRole.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = m.Tags.Size()
+	n += 1 + l + sovTypes(uint64(l))
+	if m.Params != nil {
+		l = m.Params.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.SSM != nil {
+		l = m.SSM.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AssumeRole) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.RoleARN)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.ExternalID)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *InstallerParams) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.JoinMethod)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.JoinToken)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.ScriptName)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.InstallTeleport {
+		n += 2
+	}
+	l = len(m.SSHDConfig)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.PublicProxyAddr)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AWSSSM) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.DocumentName)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *AzureMatcher) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Subscriptions) > 0 {
+		for _, s := range m.Subscriptions {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if len(m.ResourceGroups) > 0 {
+		for _, s := range m.ResourceGroups {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if len(m.Types) > 0 {
+		for _, s := range m.Types {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if len(m.Regions) > 0 {
+		for _, s := range m.Regions {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	l = m.ResourceTags.Size()
+	n += 1 + l + sovTypes(uint64(l))
+	if m.Params != nil {
+		l = m.Params.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *GCPMatcher) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Types) > 0 {
+		for _, s := range m.Types {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if len(m.Locations) > 0 {
+		for _, s := range m.Locations {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	l = m.Tags.Size()
+	n += 1 + l + sovTypes(uint64(l))
+	if len(m.ProjectIDs) > 0 {
+		for _, s := range m.ProjectIDs {
+			l = len(s)
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func sovTypes(x uint64) (n int) {
 	return (math_bits.Len64(x|1) + 6) / 7
 }
@@ -47626,6 +49308,39 @@ func (m *DatabaseSpecV3) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MongoAtlas", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.MongoAtlas.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -48333,6 +50048,39 @@ func (m *AWS) Unmarshal(dAtA []byte) error {
 			}
 			m.AssumeRoleARN = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OpenSearch", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.OpenSearch.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -49380,7 +51128,7 @@ func (m *RedshiftServerless) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *GCPCloudSQL) Unmarshal(dAtA []byte) error {
+func (m *OpenSearch) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49403,15 +51151,15 @@ func (m *GCPCloudSQL) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: GCPCloudSQL: wiretype end group for non-group")
+			return fmt.Errorf("proto: OpenSearch: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GCPCloudSQL: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: OpenSearch: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ProjectID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DomainName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49439,11 +51187,11 @@ func (m *GCPCloudSQL) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ProjectID = string(dAtA[iNdEx:postIndex])
+			m.DomainName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field InstanceID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DomainID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49471,7 +51219,39 @@ func (m *GCPCloudSQL) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.InstanceID = string(dAtA[iNdEx:postIndex])
+			m.DomainID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EndpointType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EndpointType = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -49495,7 +51275,7 @@ func (m *GCPCloudSQL) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Azure) Unmarshal(dAtA []byte) error {
+func (m *GCPCloudSQL) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49518,15 +51298,15 @@ func (m *Azure) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Azure: wiretype end group for non-group")
+			return fmt.Errorf("proto: GCPCloudSQL: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Azure: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GCPCloudSQL: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ProjectID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49554,147 +51334,11 @@ func (m *Azure) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.ProjectID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.ResourceID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Redis", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Redis.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IsFlexiServer", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.IsFlexiServer = bool(v != 0)
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTypes(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *AzureRedis) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTypes
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: AzureRedis: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AzureRedis: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ClusteringPolicy", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field InstanceID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49722,7 +51366,7 @@ func (m *AzureRedis) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ClusteringPolicy = string(dAtA[iNdEx:postIndex])
+			m.InstanceID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -49746,7 +51390,7 @@ func (m *AzureRedis) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AD) Unmarshal(dAtA []byte) error {
+func (m *Azure) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -49769,15 +51413,15 @@ func (m *AD) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AD: wiretype end group for non-group")
+			return fmt.Errorf("proto: Azure: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AD: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Azure: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KeytabFile", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -49805,11 +51449,262 @@ func (m *AD) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.KeytabFile = string(dAtA[iNdEx:postIndex])
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Krb5File", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Redis", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Redis.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IsFlexiServer", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.IsFlexiServer = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AzureRedis) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AzureRedis: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AzureRedis: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusteringPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClusteringPolicy = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AD) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AD: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AD: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KeytabFile", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KeytabFile = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Krb5File", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -50206,6 +52101,89 @@ func (m *MySQLOptions) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *MongoAtlas) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MongoAtlas: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MongoAtlas: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *InstanceV1) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -52891,6 +54869,38 @@ func (m *AppSpecV3) Unmarshal(dAtA []byte) error {
 			}
 			m.Cloud = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserGroups", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UserGroups = append(m.UserGroups, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -60767,6 +62777,25 @@ func (m *AuthPreferenceSpecV2) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 16:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultSessionTTL", wireType)
+			}
+			m.DefaultSessionTTL = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DefaultSessionTTL |= Duration(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -66814,6 +68843,25 @@ func (m *RoleOptions) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 28:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CreateHostUserMode", wireType)
+			}
+			m.CreateHostUserMode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.CreateHostUserMode |= CreateHostUserMode(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -91451,6 +93499,154 @@ func (m *DatabaseResourceMatcher) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AWS", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.AWS.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ResourceMatcherAWS) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ResourceMatcherAWS: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ResourceMatcherAWS: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AssumeRoleARN", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AssumeRoleARN = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExternalID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExternalID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -93219,62 +95415,11 @@ func (m *PluginSpecV1) Unmarshal(dAtA []byte) error {
 			}
 			m.Settings = &PluginSpecV1_Jamf{v}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTypes(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *PluginSlackAccessSettings) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTypes
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: PluginSlackAccessSettings: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PluginSlackAccessSettings: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field FallbackChannel", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PagerDuty", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -93284,23 +95429,109 @@ func (m *PluginSlackAccessSettings) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.FallbackChannel = string(dAtA[iNdEx:postIndex])
+			v := &PluginPagerDutySettings{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Settings = &PluginSpecV1_PagerDuty{v}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PluginSlackAccessSettings) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PluginSlackAccessSettings: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PluginSlackAccessSettings: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FallbackChannel", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FallbackChannel = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -93503,6 +95734,121 @@ func (m *PluginOpsgenieAccessSettings) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *PluginPagerDutySettings) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PluginPagerDutySettings: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PluginPagerDutySettings: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserEmail", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UserEmail = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ApiEndpoint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ApiEndpoint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *PluginOpenAISettings) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -96659,6 +99005,39 @@ func (m *UserGroupV1) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -96681,7 +99060,7 @@ func (m *UserGroupV1) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *OktaImportRuleSpecV1) Unmarshal(dAtA []byte) error {
+func (m *UserGroupSpecV1) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -96704,36 +99083,17 @@ func (m *OktaImportRuleSpecV1) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: OktaImportRuleSpecV1: wiretype end group for non-group")
+			return fmt.Errorf("proto: UserGroupSpecV1: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: OktaImportRuleSpecV1: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: UserGroupSpecV1: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
-			}
-			m.Priority = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Priority |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Mappings", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Applications", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -96743,25 +99103,127 @@ func (m *OktaImportRuleSpecV1) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Mappings = append(m.Mappings, &OktaImportRuleMappingV1{})
-			if err := m.Mappings[len(m.Mappings)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Applications = append(m.Applications, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OktaImportRuleSpecV1) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OktaImportRuleSpecV1: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OktaImportRuleSpecV1: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
+			}
+			m.Priority = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Priority |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Mappings", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Mappings = append(m.Mappings, &OktaImportRuleMappingV1{})
+			if err := m.Mappings[len(m.Mappings)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -98881,7 +101343,1282 @@ func (m *WatchStatusSpecV1) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ServerInfoV1) Unmarshal(dAtA []byte) error {
+func (m *ServerInfoV1) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ServerInfoV1: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ServerInfoV1: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SubKind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SubKind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ServerInfoSpecV1) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ServerInfoSpecV1: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ServerInfoSpecV1: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AWS", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.AWS == nil {
+				m.AWS = &ServerInfoSpecV1_AWSInfo{}
+			}
+			if err := m.AWS.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ServerInfoSpecV1_AWSInfo) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AWSInfo: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AWSInfo: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccountID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AccountID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InstanceID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InstanceID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *JamfSpecV1) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: JamfSpecV1: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: JamfSpecV1: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Enabled = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SyncDelay", wireType)
+			}
+			m.SyncDelay = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.SyncDelay |= Duration(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ApiEndpoint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ApiEndpoint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Username = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Password", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Password = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Inventory", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Inventory = append(m.Inventory, &JamfInventoryEntry{})
+			if err := m.Inventory[len(m.Inventory)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *JamfInventoryEntry) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: JamfInventoryEntry: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: JamfInventoryEntry: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FilterRsql", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FilterRsql = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SyncPeriodPartial", wireType)
+			}
+			m.SyncPeriodPartial = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.SyncPeriodPartial |= Duration(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SyncPeriodFull", wireType)
+			}
+			m.SyncPeriodFull = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.SyncPeriodFull |= Duration(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OnMissing", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.OnMissing = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MessageWithHeader) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MessageWithHeader: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MessageWithHeader: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceHeader", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ResourceHeader.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AWSMatcher) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AWSMatcher: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AWSMatcher: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Types", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Types = append(m.Types, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Regions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Regions = append(m.Regions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AssumeRole", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.AssumeRole == nil {
+				m.AssumeRole = &AssumeRole{}
+			}
+			if err := m.AssumeRole.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Tags", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Tags.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Params", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Params == nil {
+				m.Params = &InstallerParams{}
+			}
+			if err := m.Params.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SSM", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SSM == nil {
+				m.SSM = &AWSSSM{}
+			}
+			if err := m.SSM.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AssumeRole) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AssumeRole: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AssumeRole: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RoleARN", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RoleARN = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExternalID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExternalID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *InstallerParams) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -98904,15 +102641,15 @@ func (m *ServerInfoV1) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ServerInfoV1: wiretype end group for non-group")
+			return fmt.Errorf("proto: InstallerParams: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ServerInfoV1: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: InstallerParams: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field JoinMethod", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -98940,11 +102677,11 @@ func (m *ServerInfoV1) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Kind = string(dAtA[iNdEx:postIndex])
+			m.JoinMethod = JoinMethod(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SubKind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field JoinToken", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -98972,11 +102709,11 @@ func (m *ServerInfoV1) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SubKind = string(dAtA[iNdEx:postIndex])
+			m.JoinToken = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ScriptName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -99004,13 +102741,13 @@ func (m *ServerInfoV1) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Version = string(dAtA[iNdEx:postIndex])
+			m.ScriptName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InstallTeleport", wireType)
 			}
-			var msglen int
+			var v int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -99020,30 +102757,17 @@ func (m *ServerInfoV1) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				v |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
+			m.InstallTeleport = bool(v != 0)
 		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SSHDConfig", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -99053,81 +102777,29 @@ func (m *ServerInfoV1) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.SSHDConfig = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTypes(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *ServerInfoSpecV1) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTypes
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: ServerInfoSpecV1: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ServerInfoSpecV1: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AWS", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicProxyAddr", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -99137,27 +102809,23 @@ func (m *ServerInfoSpecV1) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AWS == nil {
-				m.AWS = &ServerInfoSpecV1_AWSInfo{}
-			}
-			if err := m.AWS.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.PublicProxyAddr = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -99181,7 +102849,7 @@ func (m *ServerInfoSpecV1) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ServerInfoSpecV1_AWSInfo) Unmarshal(dAtA []byte) error {
+func (m *AWSSSM) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -99204,47 +102872,15 @@ func (m *ServerInfoSpecV1_AWSInfo) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AWSInfo: wiretype end group for non-group")
+			return fmt.Errorf("proto: AWSSSM: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AWSInfo: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AWSSSM: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AccountID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.AccountID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field InstanceID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DocumentName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -99272,7 +102908,7 @@ func (m *ServerInfoSpecV1_AWSInfo) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.InstanceID = string(dAtA[iNdEx:postIndex])
+			m.DocumentName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -99296,7 +102932,7 @@ func (m *ServerInfoSpecV1_AWSInfo) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *JamfSpecV1) Unmarshal(dAtA []byte) error {
+func (m *AzureMatcher) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -99319,17 +102955,17 @@ func (m *JamfSpecV1) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: JamfSpecV1: wiretype end group for non-group")
+			return fmt.Errorf("proto: AzureMatcher: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: JamfSpecV1: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: AzureMatcher: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Subscriptions", wireType)
 			}
-			var v int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -99339,15 +102975,27 @@ func (m *JamfSpecV1) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.Enabled = bool(v != 0)
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Subscriptions = append(m.Subscriptions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceGroups", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -99375,30 +103023,11 @@ func (m *JamfSpecV1) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.ResourceGroups = append(m.ResourceGroups, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SyncDelay", wireType)
-			}
-			m.SyncDelay = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.SyncDelay |= Duration(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ApiEndpoint", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Types", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -99426,11 +103055,11 @@ func (m *JamfSpecV1) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ApiEndpoint = string(dAtA[iNdEx:postIndex])
+			m.Types = append(m.Types, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 5:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Regions", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -99458,13 +103087,13 @@ func (m *JamfSpecV1) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Username = string(dAtA[iNdEx:postIndex])
+			m.Regions = append(m.Regions, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 6:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Password", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceTags", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -99474,27 +103103,28 @@ func (m *JamfSpecV1) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Password = string(dAtA[iNdEx:postIndex])
+			if err := m.ResourceTags.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 7:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Inventory", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Params", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -99521,8 +103151,10 @@ func (m *JamfSpecV1) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Inventory = append(m.Inventory, &JamfInventoryEntry{})
-			if err := m.Inventory[len(m.Inventory)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Params == nil {
+				m.Params = &InstallerParams{}
+			}
+			if err := m.Params.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -99548,7 +103180,7 @@ func (m *JamfSpecV1) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *JamfInventoryEntry) Unmarshal(dAtA []byte) error {
+func (m *GCPMatcher) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -99571,15 +103203,15 @@ func (m *JamfInventoryEntry) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: JamfInventoryEntry: wiretype end group for non-group")
+			return fmt.Errorf("proto: GCPMatcher: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: JamfInventoryEntry: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: GCPMatcher: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field FilterRsql", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Types", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -99607,13 +103239,13 @@ func (m *JamfInventoryEntry) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.FilterRsql = string(dAtA[iNdEx:postIndex])
+			m.Types = append(m.Types, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SyncPeriodPartial", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Locations", wireType)
 			}
-			m.SyncPeriodPartial = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -99623,35 +103255,29 @@ func (m *JamfInventoryEntry) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.SyncPeriodPartial |= Duration(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SyncPeriodFull", wireType)
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
 			}
-			m.SyncPeriodFull = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.SyncPeriodFull |= Duration(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
 			}
-		case 4:
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Locations = append(m.Locations, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OnMissing", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Tags", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -99661,80 +103287,30 @@ func (m *JamfInventoryEntry) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.OnMissing = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTypes(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.Tags.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *MessageWithHeader) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTypes
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: MessageWithHeader: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MessageWithHeader: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceHeader", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ProjectIDs", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTypes
@@ -99744,24 +103320,23 @@ func (m *MessageWithHeader) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthTypes
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthTypes
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ResourceHeader.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.ProjectIDs = append(m.ProjectIDs, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
diff --git a/api/types/usergroup.go b/api/types/usergroup.go
index d1ca3421d3d18..afaa415361823 100644
--- a/api/types/usergroup.go
+++ b/api/types/usergroup.go
@@ -28,16 +28,22 @@ import (
 // UserGroup specifies an externally sourced group.
 type UserGroup interface {
 	ResourceWithLabels
+
+	// GetApplications will return a list of application IDs associated with the user group.
+	GetApplications() []string
+	// SetApplications will set the list of application IDs associated with the user group.
+	SetApplications([]string)
 }
 
 var _ ResourceWithLabels = (*UserGroupV1)(nil)
 
 // NewUserGroup returns a new UserGroup.
-func NewUserGroup(metadata Metadata) (UserGroup, error) {
+func NewUserGroup(metadata Metadata, spec UserGroupSpecV1) (UserGroup, error) {
 	g := &UserGroupV1{
 		ResourceHeader: ResourceHeader{
 			Metadata: metadata,
 		},
+		Spec: spec,
 	}
 	if err := g.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
@@ -45,6 +51,16 @@ func NewUserGroup(metadata Metadata) (UserGroup, error) {
 	return g, nil
 }
 
+// GetApplications will return a list of application IDs associated with the user group.
+func (g *UserGroupV1) GetApplications() []string {
+	return g.Spec.Applications
+}
+
+// SetApplications will set the list of application IDs associated with the user group.
+func (g *UserGroupV1) SetApplications(applications []string) {
+	g.Spec.Applications = applications
+}
+
 // String returns the user group string representation.
 func (g *UserGroupV1) String() string {
 	return fmt.Sprintf("UserGroupV1(Name=%v, Labels=%v)",
diff --git a/api/types/usergroup_test.go b/api/types/usergroup_test.go
index 6ae61f2334717..69f95636bf48d 100644
--- a/api/types/usergroup_test.go
+++ b/api/types/usergroup_test.go
@@ -26,7 +26,7 @@ func TestUserGroupMatchSearch(t *testing.T) {
 	ug, err := NewUserGroup(Metadata{
 		Name:        "test",
 		Description: "description",
-	})
+	}, UserGroupSpecV1{})
 	require.NoError(t, err)
 
 	// Match against the name
diff --git a/api/utils/atlas/endpoints.go b/api/utils/atlas/endpoints.go
new file mode 100644
index 0000000000000..1a3484ce401a1
--- /dev/null
+++ b/api/utils/atlas/endpoints.go
@@ -0,0 +1,53 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package atlas
+
+import (
+	"net/url"
+	"strings"
+
+	"github.com/gravitational/trace"
+)
+
+// IsAtlasEndpoint returns true if the input URI is an MongoDB Atlas endpoint.
+func IsAtlasEndpoint(endpoint string) bool {
+	return strings.Contains(endpoint, EndpointSuffix)
+}
+
+// ParseAtlasEndpoint extracts the database name from the Atlas endpoint.
+func ParseAtlasEndpoint(endpoint string) (string, error) {
+	// Add a temporary schema to make a valid URL for url.Parse if schema is
+	// not found.
+	if !strings.Contains(endpoint, "://") {
+		endpoint = "schema://" + endpoint
+	}
+
+	parsed, err := url.Parse(endpoint)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	parts := strings.Split(parsed.Hostname(), ".")
+	if !IsAtlasEndpoint(endpoint) || len(parts) < 3 {
+		return "", trace.BadParameter("failed to parse %q as Mongo Atlas endpoint", endpoint)
+	}
+
+	return parts[0], nil
+}
+
+const (
+	// EndpointSuffix is the databases endpoint suffix.
+	EndpointSuffix = ".mongodb.net"
+)
diff --git a/api/utils/atlas/endpoints_test.go b/api/utils/atlas/endpoints_test.go
new file mode 100644
index 0000000000000..76e07ca99ac91
--- /dev/null
+++ b/api/utils/atlas/endpoints_test.go
@@ -0,0 +1,82 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package atlas
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsAtlasEndpoint(t *testing.T) {
+	for _, tc := range []struct {
+		desc     string
+		endpoint string
+		result   bool
+	}{
+		// Valid
+		{"public endpoint host only", "test.xxxxxxx.mongodb.net", true},
+		{"public endpoint", "mongodb://test.xxxxxxx.mongodb.net", true},
+		{"public endpoint with srv", "mongodb+srv://test.xxxxxxx.mongodb.net", true},
+		{"private link", "mongodb://pl-0-us-east-1-xxxxx.mongodb.net:1024,pl-0-us-east-1-xxxxx.mongodb.net:1025,pl-0-us-east-1-xxxxx.mongodb.net:1026/?ssl=true&authSource=admin&replicaSet=Cluster0-shard-0-shard-0", true},
+		{"private link with srv", "mongodb+srv://cluster0-pl-0-xxxxx.mongodb.net", true},
+		{"azure private link", "mongodb://cluster0-pl-0.xxxxx.azure.mongodb.net", true},
+		{"azure private link with srv", "mongodb://pl-0-eastus2.xxxxx.azure.mongodb.net:1024,pl-0-eastus2.xxxxx.azure.mongodb.net:1025,pl-0-eastus2.xxxxx.azure.mongodb.net:1026/?ssl=truereplicaSet=atlas-xxxxxx-shard-0 ", true},
+		// Invalid
+		{"internal name", "mongodb://mongodb", false},
+		{"domain name with mongodb", "mongodb://mongodb.company.com", false},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			require.Equal(t, tc.result, IsAtlasEndpoint(tc.endpoint))
+		})
+	}
+}
+
+func TestParseAtlasEndpoint(t *testing.T) {
+	for _, tc := range []struct {
+		desc      string
+		endpoint  string
+		result    string
+		errAssert require.ErrorAssertionFunc
+	}{
+		// Valid
+		{"public endpoint host only", "test.xxxxxxx.mongodb.net", "test", require.NoError},
+		{"public endpoint", "mongodb://test.xxxxxxx.mongodb.net", "test", require.NoError},
+		{"public endpoint with srv", "mongodb+srv://test.xxxxxxx.mongodb.net", "test", require.NoError},
+		{
+			"private link",
+			"mongodb://pl-0-us-east-1-xxxxx.mongodb.net:1024,pl-0-us-east-1-xxxxx.mongodb.net:1025,pl-0-us-east-1-xxxxx.mongodb.net:1026/?ssl=true&authSource=admin&replicaSet=Cluster0-shard-0-shard-0",
+			"pl-0-us-east-1-xxxxx",
+			require.NoError,
+		},
+		{"private link with srv", "mongodb+srv://cluster0-pl-0-xxxxx.mongodb.net", "cluster0-pl-0-xxxxx", require.NoError},
+		{"azure private link", "mongodb://cluster0-pl-0.xxxxx.azure.mongodb.net", "cluster0-pl-0", require.NoError},
+		{
+			"azure private link with srv",
+			"mongodb://pl-0-eastus2.xxxxx.azure.mongodb.net:1024,pl-0-eastus2.xxxxx.azure.mongodb.net:1025,pl-0-eastus2.xxxxx.azure.mongodb.net:1026/?ssl=truereplicaSet=atlas-xxxxxx-shard-0 ",
+			"pl-0-eastus2",
+			require.NoError,
+		},
+		// Invalid
+		{"internal name", "mongodb://mongodb", "", require.Error},
+		{"domain name with mongodb", "mongodb://mongodb.company.com", "", require.Error},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			res, err := ParseAtlasEndpoint(tc.endpoint)
+			tc.errAssert(t, err)
+			require.Equal(t, tc.result, res)
+		})
+	}
+}
diff --git a/api/utils/aws/endpoint.go b/api/utils/aws/endpoint.go
index 2b7814da04059..7fef2c2dffa56 100644
--- a/api/utils/aws/endpoint.go
+++ b/api/utils/aws/endpoint.go
@@ -352,6 +352,13 @@ const (
 	MemoryDBClusterEndpoint = "cluster"
 	// MemoryDBNodeEndpoint is the endpoint of an individual MemoryDB node.
 	MemoryDBNodeEndpoint = "node"
+
+	// OpenSearchDefaultEndpoint is the default endpoint for domain.
+	OpenSearchDefaultEndpoint = "default"
+	// OpenSearchCustomEndpoint is the custom endpoint configured for domain.
+	OpenSearchCustomEndpoint = "custom"
+	// OpenSearchVPCEndpoint is the VPC endpoint for domain.
+	OpenSearchVPCEndpoint = "vpc"
 )
 
 // ParseElastiCacheEndpoint extracts the details from the provided
diff --git a/api/utils/aws/fuzz_test.go b/api/utils/aws/fuzz_test.go
index 2623d4d7cadb9..c65d018119ec3 100644
--- a/api/utils/aws/fuzz_test.go
+++ b/api/utils/aws/fuzz_test.go
@@ -23,6 +23,21 @@ import (
 )
 
 func FuzzParseRDSEndpoint(f *testing.F) {
+	f.Add("")
+	f.Add(":123")
+	f.Add("foo:123")
+	f.Add("foo" + AWSCNEndpointSuffix)
+	f.Add("a.cluster-custom-b.c." + RDSServiceName + AWSEndpointSuffix)
+	f.Add("a.cluster-b.c." + RDSServiceName + AWSEndpointSuffix)
+	f.Add("a.proxy-b.c." + RDSServiceName + AWSEndpointSuffix)
+	f.Add("a.b.c." + RDSServiceName + AWSEndpointSuffix)
+	f.Add("a.endpoint.proxy-c.d." + RDSServiceName + AWSEndpointSuffix)
+	f.Add("a.cluster-custom-b." + RDSServiceName + ".c" + AWSCNEndpointSuffix)
+	f.Add("a.cluster-b." + RDSServiceName + ".c" + AWSCNEndpointSuffix)
+	f.Add("a.proxy-b." + RDSServiceName + ".c" + AWSCNEndpointSuffix)
+	f.Add("a.b." + RDSServiceName + ".c" + AWSCNEndpointSuffix)
+	f.Add("a.endpoint.proxy-c." + RDSServiceName + ".d" + AWSCNEndpointSuffix)
+
 	f.Fuzz(func(t *testing.T, endpoint string) {
 		require.NotPanics(t, func() {
 			_, _ = ParseRDSEndpoint(endpoint)
@@ -31,6 +46,13 @@ func FuzzParseRDSEndpoint(f *testing.F) {
 }
 
 func FuzzParseRedshiftEndpoint(f *testing.F) {
+	f.Add("")
+	f.Add(":123")
+	f.Add("foo:123")
+	f.Add("foo" + AWSCNEndpointSuffix)
+	f.Add("redshift-cluster-1.abcdefghijklmnop.us-east-1.redshift.amazonaws.com")
+	f.Add("redshift-cluster-2.abcdefghijklmnop.redshift.cn-north-1.amazonaws.com.cn")
+
 	f.Fuzz(func(t *testing.T, endpoint string) {
 		require.NotPanics(t, func() {
 			_, _, _ = ParseRedshiftEndpoint(endpoint)
@@ -39,6 +61,29 @@ func FuzzParseRedshiftEndpoint(f *testing.F) {
 }
 
 func FuzzParseElastiCacheEndpoint(f *testing.F) {
+	f.Add("")
+	f.Add(":123")
+	f.Add("foo:123")
+	f.Add("foo" + AWSEndpointSuffix)
+	f.Add("foo" + AWSCNEndpointSuffix)
+	f.Add("clustercfg.b.c.usnw1." + ElastiCacheServiceName + AWSEndpointSuffix)
+	f.Add("clustercfg.my-redis-shards.xxxxxx.use1.cache.foo:6379")
+	f.Add("a.b.clustercfg.usnw1." + ElastiCacheServiceName + AWSEndpointSuffix)
+	f.Add("my-redis-shards.xxxxxx.clustercfg.use1.cache.foo:6379")
+	f.Add("a.b.0001.usnw1." + ElastiCacheServiceName + AWSEndpointSuffix)
+	f.Add("my-redis-cluster-001.xxxxxx.0001.use0.cache.foo:6379")
+	f.Add("my-redis-shards-0001-001.xxxxxx.0001.use0.cache.foo:6379")
+	f.Add("master.b.c.usnw1." + ElastiCacheServiceName + AWSEndpointSuffix)
+	f.Add("master.my-redis-cluster.xxxxxx.use1.cache.foo:6379")
+	f.Add("replica.b.c.usnw1." + ElastiCacheServiceName + AWSEndpointSuffix)
+	f.Add("replica.my-redis-cluster.xxxxxx.use1.cache.foo:6379")
+	f.Add("a.b.c.usnw1." + ElastiCacheServiceName + AWSEndpointSuffix)
+	f.Add("a.b.c.usne1." + ElastiCacheServiceName + AWSEndpointSuffix)
+	f.Add("a.b.c.usse1." + ElastiCacheServiceName + AWSEndpointSuffix)
+	f.Add("a.b.c.ussw1." + ElastiCacheServiceName + AWSEndpointSuffix)
+	f.Add("my-redis-cluster.xxxxxx.ng.0001.use1.cache.foo:6379")
+	f.Add("my-redis-cluster-ro.xxxxxx.ng.0001.use1.cache.foo:6379")
+
 	f.Fuzz(func(t *testing.T, endpoint string) {
 		require.NotPanics(t, func() {
 			_, _ = ParseElastiCacheEndpoint(endpoint)
@@ -47,6 +92,13 @@ func FuzzParseElastiCacheEndpoint(f *testing.F) {
 }
 
 func FuzzParseDynamoDBEndpoint(f *testing.F) {
+	f.Add("")
+	f.Add(":123")
+	f.Add("foo:123")
+	f.Add(DynamoDBServiceName + ".foo" + AWSEndpointSuffix)
+	f.Add(DynamoDBServiceName + ".foo" + AWSEndpointSuffix + ":1234")
+	f.Add(DynamoDBFipsServiceName + ".foo" + AWSCNEndpointSuffix)
+
 	f.Fuzz(func(t *testing.T, endpoint string) {
 		require.NotPanics(t, func() {
 			_, _ = ParseDynamoDBEndpoint(endpoint)
@@ -55,6 +107,13 @@ func FuzzParseDynamoDBEndpoint(f *testing.F) {
 }
 
 func FuzzParseOpensearchEndpoint(f *testing.F) {
+	f.Add("")
+	f.Add(":123")
+	f.Add("foo:123")
+	f.Add("a.b." + OpenSearchServiceName + AWSEndpointSuffix)
+	f.Add("a.b." + OpenSearchServiceName + AWSEndpointSuffix + ":1234")
+	f.Add("a.b." + OpenSearchServiceName + AWSCNEndpointSuffix)
+
 	f.Fuzz(func(t *testing.T, endpoint string) {
 		require.NotPanics(t, func() {
 			_, _ = ParseOpensearchEndpoint(endpoint)
diff --git a/api/utils/aws/identifiers.go b/api/utils/aws/identifiers.go
index 2094b6e65e032..330fb8319478f 100644
--- a/api/utils/aws/identifiers.go
+++ b/api/utils/aws/identifiers.go
@@ -17,6 +17,10 @@ limitations under the License.
 package aws
 
 import (
+	"regexp"
+	"strings"
+	"unicode"
+
 	"github.com/gravitational/trace"
 )
 
@@ -35,3 +39,38 @@ func IsValidAccountID(accountID string) error {
 
 	return nil
 }
+
+// matchRoleName is a regex that matches against AWS IAM Role Names.
+var matchRoleName = regexp.MustCompile(`^[\w+=,.@-]+$`).MatchString
+
+// IsValidIAMRoleName checks whether the role name is a valid AWS IAM Role identifier.
+//
+// > Length Constraints: Minimum length of 1. Maximum length of 64.
+// > Pattern: [\w+=,.@-]+
+// https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html
+func IsValidIAMRoleName(roleName string) error {
+	if len(roleName) == 0 || len(roleName) > 64 || !matchRoleName(roleName) {
+		return trace.BadParameter("role is invalid")
+	}
+
+	return nil
+}
+
+// IsValidRegion ensures the region looks to be valid.
+// It does not do a full validation, because AWS doesn't provide documentation for that.
+// However, they usually only have the following chars: [a-z0-9\-]
+func IsValidRegion(region string) error {
+	indexNotFound := -1
+
+	if len(region) == 0 {
+		return trace.BadParameter("region is invalid")
+	}
+
+	if strings.IndexFunc(region, func(r rune) bool {
+		return !(unicode.IsDigit(r) || unicode.IsLetter(r) || r == '-')
+	}) == indexNotFound {
+		return nil
+	}
+
+	return trace.BadParameter("region is invalid")
+}
diff --git a/api/utils/aws/identifiers_test.go b/api/utils/aws/identifiers_test.go
index 8d33fa9b9eae3..f5718beef88bd 100644
--- a/api/utils/aws/identifiers_test.go
+++ b/api/utils/aws/identifiers_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package aws
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/gravitational/trace"
@@ -24,7 +25,7 @@ import (
 )
 
 func TestIsValidAccountID(t *testing.T) {
-	isBadParamErrFn := func(tt require.TestingT, err error, i ...interface{}) {
+	isBadParamErrFn := func(tt require.TestingT, err error, i ...any) {
 		require.True(tt, trace.IsBadParameter(err), "expected bad parameter, got %v", err)
 	}
 
@@ -74,3 +75,97 @@ func TestIsValidAccountID(t *testing.T) {
 		})
 	}
 }
+
+func TestIsValidIAMRoleName(t *testing.T) {
+	isBadParamErrFn := func(tt require.TestingT, err error, i ...any) {
+		require.True(tt, trace.IsBadParameter(err), "expected bad parameter, got %v", err)
+	}
+
+	for _, tt := range []struct {
+		name     string
+		role     string
+		errCheck require.ErrorAssertionFunc
+	}{
+		{
+			name:     "valid",
+			role:     "valid",
+			errCheck: require.NoError,
+		},
+		{
+			name:     "valid with numbers",
+			role:     "00VALID11",
+			errCheck: require.NoError,
+		},
+		{
+			name:     "only one symbol",
+			role:     "_",
+			errCheck: require.NoError,
+		},
+		{
+			name:     "all symbols",
+			role:     "Test+1=2,3.4@5-6_7",
+			errCheck: require.NoError,
+		},
+		{
+			name:     "empty",
+			role:     "",
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name:     "too large",
+			role:     strings.Repeat("r", 65),
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name:     "invalid symbols",
+			role:     "role/admin",
+			errCheck: isBadParamErrFn,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.errCheck(t, IsValidIAMRoleName(tt.role))
+		})
+	}
+}
+
+func TestIsValidRegion(t *testing.T) {
+	isBadParamErrFn := func(tt require.TestingT, err error, i ...any) {
+		require.True(tt, trace.IsBadParameter(err), "expected bad parameter, got %v", err)
+	}
+
+	for _, tt := range []struct {
+		name     string
+		region   string
+		errCheck require.ErrorAssertionFunc
+	}{
+		{
+			name:     "us region",
+			region:   "us-east-1",
+			errCheck: require.NoError,
+		},
+		{
+			name:     "eu region",
+			region:   "eu-west-1",
+			errCheck: require.NoError,
+		},
+		{
+			name:     "us gov",
+			region:   "us-gov-east-1",
+			errCheck: require.NoError,
+		},
+		{
+			name:     "empty",
+			region:   "",
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name:     "symbols",
+			region:   "us@east-1",
+			errCheck: isBadParamErrFn,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.errCheck(t, IsValidRegion(tt.region))
+		})
+	}
+}
diff --git a/api/utils/azure/fuzz_test.go b/api/utils/azure/fuzz_test.go
index fa31656acac10..5b2780164aa6b 100644
--- a/api/utils/azure/fuzz_test.go
+++ b/api/utils/azure/fuzz_test.go
@@ -23,6 +23,12 @@ import (
 )
 
 func FuzzParseDatabaseEndpoint(f *testing.F) {
+	f.Add("")
+	f.Add("foo")
+	f.Add(":1234")
+	f.Add("foo:1234")
+	f.Add("name.mysql.database.azure.com:1234")
+
 	f.Fuzz(func(t *testing.T, endpoint string) {
 		require.NotPanics(t, func() {
 			ParseDatabaseEndpoint(endpoint)
@@ -31,6 +37,12 @@ func FuzzParseDatabaseEndpoint(f *testing.F) {
 }
 
 func FuzzParseCacheForRedisEndpoint(f *testing.F) {
+	f.Add("")
+	f.Add("foo")
+	f.Add("name.redis.cache.windows.net")
+	f.Add("name.redis.cache.windows.net:1234")
+	f.Add("name.region.redisenterprise.cache.azure.net")
+
 	f.Fuzz(func(t *testing.T, endpoint string) {
 		require.NotPanics(t, func() {
 			ParseCacheForRedisEndpoint(endpoint)
@@ -39,6 +51,12 @@ func FuzzParseCacheForRedisEndpoint(f *testing.F) {
 }
 
 func FuzzNormalizeLocation(f *testing.F) {
+	f.Add("")
+	f.Add("foo")
+	f.Add("northcentralusstage")
+	f.Add("North Central US (Stage)")
+	f.Add("(US) North Central US (Stage)")
+
 	f.Fuzz(func(t *testing.T, location string) {
 		require.NotPanics(t, func() {
 			NormalizeLocation(location)
@@ -47,6 +65,13 @@ func FuzzNormalizeLocation(f *testing.F) {
 }
 
 func FuzzParseMSSQLEndpoint(f *testing.F) {
+	f.Add("")
+	f.Add("foo")
+	f.Add(":1234")
+	f.Add("foo:1234")
+	f.Add("name.database.windows.net:1234")
+	f.Add(".database.windows.net:1234")
+
 	f.Fuzz(func(t *testing.T, endpoint string) {
 		require.NotPanics(t, func() {
 			ParseMSSQLEndpoint(endpoint)
diff --git a/api/utils/sshutils/callback.go b/api/utils/sshutils/callback.go
index f010324e5ba98..e10a38d6e5eca 100644
--- a/api/utils/sshutils/callback.go
+++ b/api/utils/sshutils/callback.go
@@ -35,7 +35,7 @@ type HostKeyCallbackConfig struct {
 	// FIPS allows to set FIPS mode which will validate algorithms.
 	FIPS bool
 	// OnCheckCert is called on SSH certificate validation.
-	OnCheckCert func(*ssh.Certificate)
+	OnCheckCert func(*ssh.Certificate) error
 	// Clock is used to set the Checker Time
 	Clock clockwork.Clock
 }
diff --git a/api/utils/sshutils/checker.go b/api/utils/sshutils/checker.go
index 50bb38baf6b1d..68543405523c3 100644
--- a/api/utils/sshutils/checker.go
+++ b/api/utils/sshutils/checker.go
@@ -36,7 +36,7 @@ type CertChecker struct {
 	FIPS bool
 
 	// OnCheckCert is called when validating host certificate.
-	OnCheckCert func(*ssh.Certificate)
+	OnCheckCert func(*ssh.Certificate) error
 }
 
 // Authenticate checks the validity of a user certificate.
@@ -67,7 +67,9 @@ func (c *CertChecker) CheckCert(principal string, cert *ssh.Certificate) error {
 	}
 
 	if c.OnCheckCert != nil {
-		c.OnCheckCert(cert)
+		if err := c.OnCheckCert(cert); err != nil {
+			return trace.Wrap(err)
+		}
 	}
 
 	return nil
@@ -86,7 +88,9 @@ func (c *CertChecker) CheckHostKey(addr string, remote net.Addr, key ssh.PublicK
 	}
 
 	if cert, ok := key.(*ssh.Certificate); ok && c.OnCheckCert != nil {
-		c.OnCheckCert(cert)
+		if err := c.OnCheckCert(cert); err != nil {
+			return trace.Wrap(err)
+		}
 	}
 
 	return nil
diff --git a/assets/aws/Makefile b/assets/aws/Makefile
index 4f4b6101393cf..945ae8444ecc1 100644
--- a/assets/aws/Makefile
+++ b/assets/aws/Makefile
@@ -14,7 +14,7 @@ AWS_REGION ?= us-west-2
 # This must be a _released_ version of Teleport, i.e. one which has binaries
 # available for download on https://gravitational.com/teleport/download
 # Unreleased versions will fail to build.
-TELEPORT_VERSION ?= 13.0.4
+TELEPORT_VERSION ?= 13.1.5
 
 # Teleport UID is the UID of a non-privileged 'teleport' user
 TELEPORT_UID ?= 1007
diff --git a/assets/aws/files/install-hardened.sh b/assets/aws/files/install-hardened.sh
index 65c948cb67172..519147dafda4a 100644
--- a/assets/aws/files/install-hardened.sh
+++ b/assets/aws/files/install-hardened.sh
@@ -1,9 +1,5 @@
 #!/bin/bash
 
-# Set some curl options so that temporary failures get retried
-# More info: https://ec.haxx.se/usingcurl-timeouts.html
-CURL_OPTS=(-L --retry 100 --retry-delay 0 --connect-timeout 10 --max-time 300)
-
 # Update packages
 dnf -y update
 
@@ -28,32 +24,6 @@ usermod -a -G adm teleport
 install -d -m 0700 -o teleport -g adm /var/lib/teleport
 install -d -m 0755 -o teleport -g adm /run/teleport /etc/teleport.d
 
-
-# Pick the teleport tarball filename matching the requested teleport
-# edition.
-case "${TELEPORT_TYPE}-${TELEPORT_FIPS}" in
-    oss-0) TARBALL="teleport-v${TELEPORT_VERSION}-linux-amd64-bin.tar.gz" ;;
-    ent-0) TARBALL="teleport-ent-v${TELEPORT_VERSION}-linux-amd64-bin.tar.gz" ;;
-    ent-1) TARBALL="teleport-ent-v${TELEPORT_VERSION}-linux-amd64-fips-bin.tar.gz" ;;
-    oss-1)
-        echo "OSS FIPS not supported" >&2
-        exit 1
-        ;;
-    *)
-        echo "Invalid environment" >&2
-        exit 1
-        ;;
-esac
-TARBALL_FILENAME="/tmp/files/${TARBALL}"
-
-if [[ -f "${TARBALL_FILENAME}" ]]; then    
-    echo "Found locally uploaded tarball: ${TARBALL_FILENAME}, moving to /tmp/teleport.tar.gz"
-    mv "${TARBALL_FILENAME}" /tmp/teleport.tar.gz
-else
-    echo "Downloading teleport tarball ${TARBALL}"
-    curl "${CURL_OPTS[@]}" -o /tmp/teleport.tar.gz "https://get.gravitational.com/teleport/${TELEPORT_VERSION}/${TARBALL}"
-fi
-
 # Extract tarball to /tmp/teleport to get the binaries out
 mkdir /tmp/teleport
 tar -C /tmp/teleport -x -z -f /tmp/teleport.tar.gz --strip-components=1
diff --git a/assets/aws/go.mod b/assets/aws/go.mod
index d61802ed1dcc5..fe30d07cd6dcc 100644
--- a/assets/aws/go.mod
+++ b/assets/aws/go.mod
@@ -4,22 +4,22 @@ go 1.19
 
 require (
 	github.com/alecthomas/kingpin/v2 v2.3.2 // replaced
-	github.com/aws/aws-sdk-go-v2 v1.18.0
-	github.com/aws/aws-sdk-go-v2/config v1.18.25
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.98.0
+	github.com/aws/aws-sdk-go-v2 v1.18.1
+	github.com/aws/aws-sdk-go-v2/config v1.18.27
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.102.0
 )
 
 require (
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.24 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.12.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.19.0 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.26 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.35 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.12.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.19.2 // indirect
 	github.com/aws/smithy-go v1.13.5 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
diff --git a/assets/aws/go.sum b/assets/aws/go.sum
index 412e2811709b2..e3291d7f8f535 100644
--- a/assets/aws/go.sum
+++ b/assets/aws/go.sum
@@ -1,29 +1,29 @@
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
-github.com/aws/aws-sdk-go-v2 v1.18.0 h1:882kkTpSFhdgYRKVZ/VCgf7sd0ru57p2JCxz4/oN5RY=
-github.com/aws/aws-sdk-go-v2 v1.18.0/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
-github.com/aws/aws-sdk-go-v2/config v1.18.25 h1:JuYyZcnMPBiFqn87L2cRppo+rNwgah6YwD3VuyvaW6Q=
-github.com/aws/aws-sdk-go-v2/config v1.18.25/go.mod h1:dZnYpD5wTW/dQF0rRNLVypB396zWCcPiBIvdvSWHEg4=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.24 h1:PjiYyls3QdCrzqUN35jMWtUK1vqVZ+zLfdOa/UPFDp0=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.24/go.mod h1:jYPYi99wUOPIFi0rhiOvXeSEReVOzBqFNOX5bXYoG2o=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3 h1:jJPgroehGvjrde3XufFIJUZVK5A2L9a3KwSFgKy9n8w=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3/go.mod h1:4Q0UFP0YJf0NrsEuEYHpM9fTSEVnD16Z3uyEF7J9JGM=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33 h1:kG5eQilShqmJbv11XL1VpyDbaEJzWxd4zRiCG30GSn4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33/go.mod h1:7i0PF1ME/2eUPFcjkVIwq+DOygHEoK92t5cDqNgYbIw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27 h1:vFQlirhuM8lLlpI7imKOMsjdQLuN9CPi+k44F/OFVsk=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27/go.mod h1:UrHnn3QV/d0pBZ6QBAEQcqFLf8FAzLmoUfPVIueOvoM=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 h1:gGLG7yKaXG02/jBlg210R7VgQIotiQntNhsCFejawx8=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34/go.mod h1:Etz2dj6UHYuw+Xw830KfzCfWGMzqvUTCjUj5b76GVDc=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.98.0 h1:WblDV33AG9dhv0zFEPEmGtD5UECSNpKMxtdENULfR8M=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.98.0/go.mod h1:L3ZT0N/vBsw77mOAawXmRnREpEjcHd2v5Hzf7AkIH8M=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27 h1:0iKliEXAcCa2qVtRs7Ot5hItA2MsufrphbRFlz1Owxo=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27/go.mod h1:EOwBD4J4S5qYszS5/3DpkejfuK+Z5/1uzICfPaZLtqw=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.10 h1:UBQjaMTCKwyUYwiVnUt6toEJwGXsLBI6al083tpjJzY=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.10/go.mod h1:ouy2P4z6sJN70fR3ka3wD3Ro3KezSxU6eKGQI2+2fjI=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10 h1:PkHIIJs8qvq0e5QybnZoG1K/9QTrLr9OsqCIo59jOBA=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10/go.mod h1:AFvkxc8xfBe8XA+5St5XIHHrQQtkxqrRincx4hmMHOk=
-github.com/aws/aws-sdk-go-v2/service/sts v1.19.0 h1:2DQLAKDteoEDI8zpCzqBMaZlJuoE9iTYD0gFmXVax9E=
-github.com/aws/aws-sdk-go-v2/service/sts v1.19.0/go.mod h1:BgQOMsg8av8jset59jelyPW7NoZcZXLVpDsXunGDrk8=
+github.com/aws/aws-sdk-go-v2 v1.18.1 h1:+tefE750oAb7ZQGzla6bLkOwfcQCEtC5y2RqoqCeqKo=
+github.com/aws/aws-sdk-go-v2 v1.18.1/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
+github.com/aws/aws-sdk-go-v2/config v1.18.27 h1:Az9uLwmssTE6OGTpsFqOnaGpLnKDqNYOJzWuC6UAYzA=
+github.com/aws/aws-sdk-go-v2/config v1.18.27/go.mod h1:0My+YgmkGxeqjXZb5BYme5pc4drjTnM+x1GJ3zv42Nw=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.26 h1:qmU+yhKmOCyujmuPY7tf5MxR/RKyZrOPO3V4DobiTUk=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.26/go.mod h1:GoXt2YC8jHUBbA4jr+W3JiemnIbkXOfxSXcisUsZ3os=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4 h1:LxK/bitrAr4lnh9LnIS6i7zWbCOdMsfzKFBI6LUCS0I=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4/go.mod h1:E1hLXN/BL2e6YizK1zFlYd8vsfi2GTjbjBazinMmeaM=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34 h1:A5UqQEmPaCFpedKouS4v+dHCTUo2sKqhoKO9U5kxyWo=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34/go.mod h1:wZpTEecJe0Btj3IYnDx/VlUzor9wm3fJHyvLpQF0VwY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28 h1:srIVS45eQuewqz6fKKu6ZGXaq6FuFg5NzgQBAM6g8Y4=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28/go.mod h1:7VRpKQQedkfIEXb4k52I7swUnZP0wohVajJMRn3vsUw=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.35 h1:LWA+3kDM8ly001vJ1X1waCuLJdtTl48gwkPKWy9sosI=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.35/go.mod h1:0Eg1YjxE0Bhn56lx+SHJwCzhW+2JGtizsrx+lCqrfm0=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.102.0 h1:P4dyjm49F2kKws0FpouBC6fjVImACXKt752+CWa01lM=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.102.0/go.mod h1:tIctCeX9IbzsUTKHt53SVEcgyfxV2ElxJeEB+QUbc4M=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28 h1:bkRyG4a929RCnpVSTvLM2j/T4ls015ZhhYApbmYs15s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28/go.mod h1:jj7znCIg05jXlaGBlFMGP8+7UN3VtCkRBG2spnmRQkU=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.12 h1:nneMBM2p79PGWBQovYO/6Xnc2ryRMw3InnDJq1FHkSY=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.12/go.mod h1:HuCOxYsF21eKrerARYO6HapNeh9GBNq7fius2AcwodY=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.12 h1:2qTR7IFk7/0IN/adSFhYu9Xthr0zVFTgBrmPldILn80=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.12/go.mod h1:E4VrHCPzmVB/KFXtqBGKb3c8zpbNBgKe3fisDNLAW5w=
+github.com/aws/aws-sdk-go-v2/service/sts v1.19.2 h1:XFJ2Z6sNUUcAz9poj+245DMkrHE4h2j5I9/xD50RHfE=
+github.com/aws/aws-sdk-go-v2/service/sts v1.19.2/go.mod h1:dp0yLPsLBOi++WTxzCjA/oZqi6NPIhoR+uF7GeMU9eg=
 github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
 github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
diff --git a/assets/aws/single-ami.pkr.hcl b/assets/aws/single-ami.pkr.hcl
index ccb67ce093d5a..3272aca091cf3 100644
--- a/assets/aws/single-ami.pkr.hcl
+++ b/assets/aws/single-ami.pkr.hcl
@@ -67,6 +67,11 @@ variable "teleport_fips" {
   default = false
 }
 
+variable "teleport_tarball" {
+  description = "Path to teleport tarball"
+  type = string  
+}
+
 variable "teleport_uid" {
   type    = string
   default = "1007"
@@ -175,21 +180,16 @@ build {
     destination = "/tmp/files"
   }
 
-  provisioner "shell" {
-    remote_folder = local.remote_folder
-    inline = [
-      "sudo cp /tmp/files/system/* /etc/systemd/system/",
-      "sudo cp /tmp/files/bin/* /usr/local/bin/"
-    ]
+  provisioner "file" {
+    source = var.teleport_tarball
+    destination = "/tmp/teleport.tar.gz"
   }
 
   provisioner "shell" {
     remote_folder = local.remote_folder
-    environment_vars = [
-      "FIPS=${var.teleport_fips ? 1 : 0}"
-    ]
     inline = [
-      "if [ \"$FIPS\" -eq 1 ]; then touch /tmp/teleport-fips; fi"
+      "sudo cp /tmp/files/system/* /etc/systemd/system/",
+      "sudo cp /tmp/files/bin/* /usr/local/bin/"
     ]
   }
 
diff --git a/assets/backport/go.mod b/assets/backport/go.mod
index 403e983b3a195..20bfa0d141fcf 100644
--- a/assets/backport/go.mod
+++ b/assets/backport/go.mod
@@ -5,23 +5,23 @@ go 1.18
 require (
 	github.com/google/go-github/v41 v41.0.0
 	github.com/gravitational/trace v1.2.1
-	github.com/stretchr/testify v1.8.3
-	golang.org/x/oauth2 v0.8.0
+	github.com/stretchr/testify v1.8.4
+	golang.org/x/oauth2 v0.9.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/jonboulle/clockwork v0.2.2 // indirect
+	github.com/jonboulle/clockwork v0.4.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/sirupsen/logrus v1.8.1 // indirect
-	golang.org/x/crypto v0.1.0 // indirect
-	golang.org/x/net v0.10.0 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/term v0.8.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	golang.org/x/crypto v0.10.0 // indirect
+	golang.org/x/net v0.11.0 // indirect
+	golang.org/x/sys v0.9.0 // indirect
+	golang.org/x/term v0.9.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/assets/backport/go.sum b/assets/backport/go.sum
index 6fe2118da3d86..884add34bac16 100644
--- a/assets/backport/go.sum
+++ b/assets/backport/go.sum
@@ -36,8 +36,8 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -55,27 +55,29 @@ github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/gravitational/trace v1.2.1 h1:Iaf43aqbKV5H8bdiRs1qByjEHgAfADJ0lt0JwRyu+q8=
 github.com/gravitational/trace v1.2.1/go.mod h1:n0ijrq6psJY0sOI/NzLp+xdd8xl79jjwzVOFHDY6+kQ=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ=
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
+github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=
+github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
-github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU=
-golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
+golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
+golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
@@ -91,12 +93,12 @@ golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81R
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU=
+golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
-golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
+golang.org/x/oauth2 v0.9.0 h1:BPpt2kU7oMRq3kCHAA1tbSEshXRw1LpG2ztgDwrzuAs=
+golang.org/x/oauth2 v0.9.0/go.mod h1:qYgFZaFiu6Wg24azG8bdV52QJXJGbZzIIsRCdVKzbLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -111,12 +113,13 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
+golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28=
+golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -155,8 +158,8 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
diff --git a/assets/loadtest/.gitignore b/assets/loadtest/.gitignore
index 7bf02cfaf4c25..7291a8fc7a146 100644
--- a/assets/loadtest/.gitignore
+++ b/assets/loadtest/.gitignore
@@ -15,4 +15,6 @@ k8s/secrets/**
 **/terraform.tfstate*
 **/terraform.tfvars
 
-.secrets
\ No newline at end of file
+.secrets
+
+control-plane/vars.env
\ No newline at end of file
diff --git a/assets/loadtest/Makefile b/assets/loadtest/Makefile
index 0cba13de646fb..2d1329630c1a4 100644
--- a/assets/loadtest/Makefile
+++ b/assets/loadtest/Makefile
@@ -1,75 +1,78 @@
-SOAK_TEST_DURATION ?= 30m
-USE_CERT_MANAGER ?= yes
-TELEPORT_IMAGE ?= public.ecr.aws/gravitational/teleport-ent:12.0.0
-NAMESPACE ?= loadtest
-
-.PHONY: reserve-ips
-reserve-ips:
-	@make -C network apply
-
-# create gke cluster 
-.PHONY: create-cluster
-create-cluster:
-	@make -C ./cluster apply
-	@make -C ./cluster get-creds
-
-# delete gke cluster
-.PHONY: delete-cluster
-delete-cluster:
-	@make -C cluster destroy USE_CERT_MANAGER=$(USE_CERT_MANAGER)
-
-# deploy teleport with etcd backend to loadtest namespace
-.PHONY: deploy-etcd-cluster
-deploy-etcd-cluster:
-	@make -C k8s apply BACKEND=etcd USE_CERT_MANAGER=$(USE_CERT_MANAGER) TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-
-# deploy teleport with firestore backend to loadtest namespace
-.PHONY: deploy-firestore-cluster
-deploy-firestore-cluster:
-	@make -C k8s apply BACKEND=firestore USE_CERT_MANAGER=$(USE_CERT_MANAGER) TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-
-# deploy teleport with dynamo backend to loadtest namespace
-.PHONY: deploy-dynamo-cluster
-deploy-dynamo-cluster:
-	@make -C k8s apply BACKEND=dynamo USE_CERT_MANAGER=$(USE_CERT_MANAGER) TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-
-# delete the loadtest namespace
-.PHONY: delete-deploy
-delete-deploy:
-	@make -C k8s clean USE_CERT_MANAGER=$(USE_CERT_MANAGER)
-
-# run soak tests
-.PHONY: run-soak-tests
-run-soak-tests:
-	@make -C k8s run-soak-tests SOAK_TEST_DURATION=$(SOAK_TEST_DURATION) TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-
-# run 500 node trusted cluster scaling test
-# This installs 500 trusted clusters, waits for a period of time and then
-# deletes all 500. When they are all removed from auth the process is repeated once more.
-# The test helps identify any potential memory leaks caused by remote clusters
-.PHONY: run-tc-scaling-test
-run-tc-scaling-test:
-	@make -C k8s run-tc-scaling-test TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-
-# run the 10k scaling test
-# This tests installs 10,000 IoT nodes and then removes all 10,000 nodes after a fixed period of time.
-# The process repeats once more and then the same is done for non-IoT nodes. The test helps identify any
-# potential memory leaks caused by large clusters for both non-IoT and IoT nodes.
-.PHONY: run-scaling-test
-run-scaling-test:
-	@make -C k8s run-scaling-test TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-
-# list pods in loadtest namespace
-.PHONY: pods
-pods:
-	@make -C k8s pods NAMESPACE=$(NAMESPACE)
-
-# get cluster credentials
-.PHONY: get-creds
-get-creds:
-	@make -C cluster get-creds
-
-# collect heap and goroutine profiles
-.PHONY: collect-profiles
-collect-profiles:
-	@make -C k8s collect-profiles PROFILE_LOCATION=$(shell pwd) NAMESPACE=$(NAMESPACE)
\ No newline at end of file
+# creates an eks cluster
+.PHONY: create-aws-cluster
+create-aws-cluster:
+	$(MAKE) -C cluster/aws create-cluster
+
+# creates an gks cluster
+.PHONY: create-gcp-cluster
+create-gcp-cluster:
+	$(MAKE) -C cluster/gcp create-cluster
+
+# deletes an eks cluster
+.PHONY: delete-aws-cluster
+delete-aws-cluster:
+	$(MAKE) -C cluster/aws destroy
+
+# deletes a gks cluster
+.PHONY: delete-gcp-cluster
+delete-gcp-cluster:
+	$(MAKE) -C cluster/gcp destroy
+
+# cleans up all deployed resources in the cluster and
+# any resources created in the cloud provider
+.PHONY: destroy-deploy
+destroy-deploy:
+	$(MAKE) -C control-plane destroy
+
+# deploys teleport auth and proxy
+.PHONY: deploy-control-plane
+deploy-control-plane:
+	$(MAKE) -C control-plane deploy
+
+# deletes the teleport auth and proxy deployments
+.PHONY: delete-teleport
+delete-teleport:
+	$(MAKE) -C control-plane delete-teleport
+
+# deploys teleport auth and proxy to the cluster
+.PHONY: deploy-teleport
+deploy-teleport:
+	$(MAKE) -C control-plane deploy-teleport
+
+NODE_REPLICAS ?= 1000
+PROXY_SERVER ?=
+NODE_TOKEN ?=
+
+# deploys nodes and adds them to the teleport cluster
+.PHONY: deploy-nodes
+deploy-nodes:
+	helm upgrade --install node-agents -n agents --create-namespace ./helm/node-agent/ --values ./helm/values/node-agents.yaml --set replicaCount=${NODE_REPLICAS} --set agentsPerPod=10 --set proxyServer=${PROXY_SERVER} --set joinParams.token_name=${NODE_TOKEN}
+
+# deletes all nodes
+.PHONY: delete-nodes
+delete-nodes:
+	helm delete -n agents node-agents
+
+TELEPORT_USER ?= test
+
+# creates a local teleport user
+.PHONY: create-user
+create-user:
+	kubectl --namespace teleport exec deploy/teleport-auth -- tctl users add ${TELEPORT_USER} --roles=access,editor,auditor
+
+# creates a token that can be used by nodes to join the
+# teleport cluster
+.PHONY: create-token
+create-token:
+	kubectl --namespace teleport exec deploy/teleport-auth -- tctl tokens add --type=node --ttl=8h
+
+# forwards the grafana web app to localhost:6060
+.PHONY: forward-grafana
+forward-grafana:
+	$(MAKE) -C control-plane forward-monitor
+
+# scales teleport auth pods up/down
+.PHONY: scale-auth
+scale-auth:
+	kubectl scale deployment/teleport-auth --replicas=$(REPLICAS) -n teleport
+
diff --git a/assets/loadtest/README.md b/assets/loadtest/README.md
deleted file mode 100644
index b1fecb348a558..0000000000000
--- a/assets/loadtest/README.md
+++ /dev/null
@@ -1,119 +0,0 @@
-# loadtest
-
-Automation for the `loadtest` kuberentes cluster and performing Teleport load tests.
-
-## About
-
-This automation sets up a kubernetes cluster named `loadtest` in the configured GCP project.  
-This cluster is used for, among other things, the `1k`/`10k` scaling tests that are performed as part of
-Teleports manual release test plan.
-
-## Setup
-
-### Prerequisites
-- Make sure you have the following tools installed:
-    - `terraform`
-    - `gcloud`
-    - `kubectl`
-- Make sure that you have a GCP service account key with `Compute Admin`, `Compute Network Admin`,
-      `Kubernetes Engine Admin`, `Kubernetes Engine Cluster Admin`, and `Service Account User`
-  - To authenticate as the service account follow these [instructions](https://cloud.google.com/docs/authentication/production)
-- Make sure you have reserved static ip addresses for the proxy
-  - This only needs to be done once per GCP project, see the [network docs](./network/README.md) for details
-
-### Creating the Cluster
-
-First create a cluster, if you are running this automation for the first time, you may be asked to run
-`terraform init` from the cluster directory before continuing. To resize the cluster, edit [`terraform.tfvars`](cluster/terraform.tfvars) as needed.
-
-```bash
-$ make create-cluster
-```
-
-### DNS Entries
-Before deploying anything to the cluster you first need to set `PROXY_HOST`. These variables should
-be the DNS names to be used for the [`proxy`](./k8s/proxy.yaml). When everything is successfully deployed you should be able
-to navigate to `https://PROXY_HOST:3080` in your browser.
-
-```bash
-$ export PROXY_HOST=proxy.loadtest.com 
-```
-
-### TLS Certificates
-
-Certificates can be provisioned automatically via [cert-manager](https://cert-manager.io/) or by hand.
-
-#### cert-manager
-If you would like to use cert-manager to automatically retrieve TLS certificates for you, create 
-[`cetificate.yaml`](./k8s/certificate.yaml) with your `cert-manager.io/v1/ClusterIssuer`, `cert-manager.io/v1/Certificate` and any
-secrets required for your solver.
-
-#### Kubernetes secret
-
-To manual supply TLS certificates create a tls secret, run the following:
-
-```bash
-$ kubectl create secret tls teleport-tls -n loadtest \
-    --cert=path/to/cert/file \
-    --key=path/to/key/file
-```
-
-You **must** also provide `USE_CERT_MANAGER=no` to all make commands below.
-
-### Teleport Configuration
-You must supply an [OIDC Connector](https://goteleport.com/docs/enterprise/sso/oidc/) that will be used for authentication. Create [`oidc.yaml`](./teleport/oidc.yaml)
-before attempting to deploy Teleport to the cluster.
-
-
-## Deploy Teleport
-
-### etcd Backend
-
-```bash
-$ make deploy-etcd-cluster
-```
-
-### Firestore Backend
-
-To use the firestore backend you must have a GCP service account key with `Cloud Datastore User`, `Cloud Datastore Index Admin`
-`Storage Object Admin` permissions. Set `GCP_CREDS_LOCATION` to the location that you saved the service account key.
-
-```bash
-$ export GCP_CREDS_LOCATION=/path/to/service/account/key
-$ make deploy-firestore-cluster
-```
-
-## Running Tests
-
-To run soak tests:
-
-```bash
-$ make run-soak-tests
-```
-
-
-**Note:** You must have enough nodes in the cluster to run the following tests. Ensure your `node_count` in [`terraform.tfvars`](cluster/terraform.tfvars) is correctly set.
-
-To run the 10k node scaling tests:
-
-```bash
-$ make run-scaling-test
-```
-
-To run the trusted cluster scaling test:
-```bash
-$ make run-tc-scaling-test
-```
-
-## Cleanup
-
-To delete the loadtest deployment:
-```bash
-$ make delete-deploy
-```
-
-
-To delete the entire cluster:
-```bash
-$ make delete-cluster
-```
\ No newline at end of file
diff --git a/assets/loadtest/cluster/aws/Makefile b/assets/loadtest/cluster/aws/Makefile
new file mode 100644
index 0000000000000..46d1b826e11b5
--- /dev/null
+++ b/assets/loadtest/cluster/aws/Makefile
@@ -0,0 +1,14 @@
+# creates an eks cluster
+.PHONY: create-cluster
+create-cluster:
+	eksctl create cluster -f cluster.yaml
+
+# gets kubernetes credentials
+.PHONY: get-creds
+get-creds:
+	eksctl utils write-kubeconfig
+
+# deletes the eks cluster
+.PHONY: destroy
+destroy:
+	eksctl delete cluster -f cluster.yaml --wait --disable-nodegroup-eviction
diff --git a/assets/loadtest/cluster/aws/cluster.yaml b/assets/loadtest/cluster/aws/cluster.yaml
new file mode 100644
index 0000000000000..9b8d32a9f6eda
--- /dev/null
+++ b/assets/loadtest/cluster/aws/cluster.yaml
@@ -0,0 +1,21 @@
+apiVersion: eksctl.io/v1alpha5
+kind: ClusterConfig
+metadata:
+  name:
+  region:
+  version: "1.23"
+
+iam:
+  withOIDC: true
+
+addons:
+  - name: aws-ebs-csi-driver
+    version: v1.11.4-eksbuild.1
+    attachPolicyARNs:
+      - arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy
+
+managedNodeGroups:
+  - name:
+    instanceType: m5.4xlarge
+    minSize: 2
+    maxSize: 10
\ No newline at end of file
diff --git a/assets/loadtest/cluster/Makefile b/assets/loadtest/cluster/gcp/Makefile
similarity index 93%
rename from assets/loadtest/cluster/Makefile
rename to assets/loadtest/cluster/gcp/Makefile
index 6c97c3501f80b..e914b70fceebb 100644
--- a/assets/loadtest/cluster/Makefile
+++ b/assets/loadtest/cluster/gcp/Makefile
@@ -4,8 +4,8 @@ plan:
 	terraform plan
 
 # apply cluster configuration
-.PHONY: apply
-apply:
+.PHONY: create-cluster
+create-cluster:
 	terraform apply
 
 # authorize kubectl to manage the cluster
diff --git a/assets/loadtest/cluster/README.md b/assets/loadtest/cluster/gcp/README.md
similarity index 100%
rename from assets/loadtest/cluster/README.md
rename to assets/loadtest/cluster/gcp/README.md
diff --git a/assets/loadtest/cluster/main.tf b/assets/loadtest/cluster/gcp/main.tf
similarity index 100%
rename from assets/loadtest/cluster/main.tf
rename to assets/loadtest/cluster/gcp/main.tf
diff --git a/assets/loadtest/cluster/outputs.tf b/assets/loadtest/cluster/gcp/outputs.tf
similarity index 100%
rename from assets/loadtest/cluster/outputs.tf
rename to assets/loadtest/cluster/gcp/outputs.tf
diff --git a/assets/loadtest/cluster/variables.tf b/assets/loadtest/cluster/gcp/variables.tf
similarity index 100%
rename from assets/loadtest/cluster/variables.tf
rename to assets/loadtest/cluster/gcp/variables.tf
diff --git a/assets/loadtest/control-plane/.gitignore b/assets/loadtest/control-plane/.gitignore
new file mode 100644
index 0000000000000..8c22876fb3c99
--- /dev/null
+++ b/assets/loadtest/control-plane/.gitignore
@@ -0,0 +1,2 @@
+vars.env
+state
diff --git a/assets/loadtest/control-plane/Makefile b/assets/loadtest/control-plane/Makefile
new file mode 100644
index 0000000000000..377b0b373f727
--- /dev/null
+++ b/assets/loadtest/control-plane/Makefile
@@ -0,0 +1,26 @@
+# initializes helm repos and install teleport
+.PHONY: deploy
+deploy:
+	./init.sh
+	./apply.sh
+
+# initializes helm repos and install teleport
+.PHONY: destroy
+destroy:
+	./clean-non-kube.sh
+
+.PHONY: delete-teleport
+delete-teleport:
+	./teleport/uninstall-teleport.sh
+
+.PHONY: deploy-teleport
+deploy-teleport:
+	./teleport/install-teleport.sh
+	./teleport/wait.sh auth
+	./dns/update-record.sh UPSERT
+	./teleport/wait.sh proxy
+
+# forwards the in cluster grafana to localhost:6060
+.PHONY: forward-monitor
+forward-monitor:
+	./monitoring/port-forward.sh
\ No newline at end of file
diff --git a/assets/loadtest/control-plane/README.md b/assets/loadtest/control-plane/README.md
new file mode 100644
index 0000000000000..5a92bca9c1d94
--- /dev/null
+++ b/assets/loadtest/control-plane/README.md
@@ -0,0 +1,24 @@
+# control-plane
+
+A collection of scripts used to automate the process of setting up a teleport control plane using the
+`teleport-cluster` helm chart in `aws`.
+
+*note:* This is an experimental tool used for internal testing and may be buggy/brittle.
+
+## Quickstart
+
+- Ensure aws cli is authenticated.
+
+- Set up eks cluster and load credentials into kubectl.
+
+- Create a `vars.env` in this directory (see `example-vars.env` for required contents and explanation).
+Note that the name of the eks cluster must match the `CLUSTER_NAME` variable.
+
+- If needed, run `init.sh` to add/update all necessary helm repos.
+
+- Invoke `./apply.sh` to spin up the teleport control plane and monitoring stack.
+
+- Use `./monitoring/port-forward.sh` to forward the grafana ui.
+
+- When finished, first invoke `./clean-non-kube.sh`, then destroy the eks cluster (this ordering
+is important, as some of the resources created by these scripts interfere with eks cluster teardown).
diff --git a/assets/loadtest/control-plane/apply.sh b/assets/loadtest/control-plane/apply.sh
new file mode 100755
index 0000000000000..aee99c9d73c23
--- /dev/null
+++ b/assets/loadtest/control-plane/apply.sh
@@ -0,0 +1,89 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# set up cluster resources (kube cluster must exist, aws and kubectl must be authenticated,
+# and helm repos must be up to date).
+
+source vars.env
+
+log_info() {
+    echo "[i] $* [ $(caller | awk '{print $1}') ]" >&2
+}
+
+
+case "$TELEPORT_BACKEND" in
+    dynamo)
+        ;;
+    etcd)
+        ;;
+    *)
+        echo "invalid teleport backend '$TELEPORT_BACKEND', expected one of 'dynamo' or 'etcd'" >&2
+        exit 1
+        ;;
+esac
+
+log_info "generating iam policies..."
+
+./policies/gen-policies.sh
+
+log_info "creating iam policies..."
+
+./policies/create-policies.sh
+
+log_info "attaching iam policies..."
+
+./policies/attach-policies.sh attach
+
+log_info "installing monitoring stack..."
+
+./monitoring/install-monitoring.sh
+
+log_info "setting up cert-manager..."
+
+./dns/init-cert-manager.sh
+
+case "$TELEPORT_BACKEND" in
+    dynamo)
+        log_info "generating helm values for dynamo-backed control plane..."
+        ./teleport/gen-dynamo-teleport.sh
+        ;;
+    etcd)
+        log_info "installing etcd..."
+        make -C ../etcd deploy
+
+        log_info "generating helm values for etcd-backed control plane..."
+        ./teleport/gen-etcd-teleport.sh
+        ;;
+    *)
+        echo "invalid teleport backend '$TELEPORT_BACKEND', expected one of 'dynamo' or 'etcd'" >&2
+        exit 1
+        ;;
+esac
+
+log_info "installing control plane chart..."
+
+./teleport/install-teleport.sh
+
+log_info "waiting for auths to report ready..."
+
+./teleport/wait.sh auth
+
+log_info "setting up dns record..."
+
+./dns/update-record.sh UPSERT # CREATE|UPSERT|DELETE
+
+log_info "waiting for proxies to report ready..."
+
+./teleport/wait.sh proxy
+
+
+if [[ "$TELEPORT_BACKEND" == "dynamo" ]]; then
+    log_info "switching dynamo to on-demand mode..."
+
+    ./storage/set-on-demand.sh
+fi
+
+log_info "setting grafana admin password..."
+
+./monitoring/set-password.sh
diff --git a/assets/loadtest/control-plane/clean-non-kube.sh b/assets/loadtest/control-plane/clean-non-kube.sh
new file mode 100755
index 0000000000000..6a754373ed9dc
--- /dev/null
+++ b/assets/loadtest/control-plane/clean-non-kube.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# clean up the resources not automatically destroyed by bringing down the kube cluster.
+
+log_info() {
+    echo "[i] $* [ $(caller | awk '{print $1}') ]" >&2
+}
+
+log_info "detaching iam policies..."
+
+./policies/attach-policies.sh detach
+
+log_info "deleting iam policies..."
+
+./policies/delete-policies.sh
+
+log_info "destroying cluster storage..."
+
+./storage/delete-storage.sh
+
+log_info "deleting dns records..."
+
+./dns/update-record.sh DELETE
diff --git a/assets/loadtest/control-plane/dns/init-cert-manager.sh b/assets/loadtest/control-plane/dns/init-cert-manager.sh
new file mode 100755
index 0000000000000..ebf053bde8d2e
--- /dev/null
+++ b/assets/loadtest/control-plane/dns/init-cert-manager.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+issuer_yaml="$STATE_DIR/aws-issuer.yaml"
+
+mkdir -p "$STATE_DIR"
+
+cat > "$issuer_yaml" <<EOF
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: letsencrypt-production
+  namespace: teleport
+spec:
+  acme:
+    email: ${EMAIL}
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-production
+    solvers:
+    - selector:
+        dnsZones:
+          - ${ROUTE53_ZONE}
+      dns01:
+        route53:
+          region: ${AWS_REGION}
+          hostedZoneID: ${ROUTE53_ZONE_ID}
+EOF
+
+# install cert-manager in the kube cluster
+helm install cert-manager jetstack/cert-manager \
+    --create-namespace \
+    --namespace cert-manager \
+    --set installCRDs=true \
+    --set extraArgs="{--issuer-ambient-credentials}" # required to automount ambient AWS credentials when using an Issuer
+
+
+# set up namespace
+kubectl create namespace teleport
+kubectl label namespace teleport 'pod-security.kubernetes.io/enforce=baseline'
+
+# configure cert manager
+kubectl --namespace teleport create -f "$issuer_yaml"
+
diff --git a/assets/loadtest/control-plane/dns/update-record.sh b/assets/loadtest/control-plane/dns/update-record.sh
new file mode 100755
index 0000000000000..4171def53b46f
--- /dev/null
+++ b/assets/loadtest/control-plane/dns/update-record.sh
@@ -0,0 +1,64 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+action="${1}"
+
+case "$action" in
+    CREATE)
+        ;;
+    UPSERT)
+        ;;
+    DELETE)
+        ;;
+    *)
+        echo "invalid dns record update action '${action}', expected CREATE|UPSERT|DELETE" >&2
+        exit 1
+esac
+
+records_json="$STATE_DIR/records.json"
+
+NAMESPACE='teleport'
+RELEASE_NAME='teleport'
+MYZONE_DNS="${ROUTE53_ZONE}"
+MYDNS="${CLUSTER_NAME}.${ROUTE53_ZONE}"
+MY_CLUSTER_REGION="${AWS_REGION}"
+MYZONE="$(aws route53 list-hosted-zones-by-name --dns-name="${MYZONE_DNS?}" | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)"
+MYELB="$(kubectl --namespace "${NAMESPACE?}" get "service/${RELEASE_NAME?}" -o jsonpath='{.status.loadBalancer.ingress[*].hostname}')"
+MYELB_NAME="${MYELB%%-*}"
+MYELB_ZONE="$(aws elbv2 describe-load-balancers --region "${MY_CLUSTER_REGION?}" --names "${MYELB_NAME?}" | jq -r '.LoadBalancers[0].CanonicalHostedZoneId')"
+jq -n --arg dns "${MYDNS?}" --arg elb "${MYELB?}" --arg elbz "${MYELB_ZONE?}" --arg act "$action" \
+    '{
+        "Comment": "Change records",
+        "Changes": [
+          {
+            "Action": $act,
+            "ResourceRecordSet": {
+              "Name": $dns,
+              "Type": "A",
+              "AliasTarget": {
+                "HostedZoneId": $elbz,
+                "DNSName": ("dualstack." + $elb),
+                "EvaluateTargetHealth": false
+              }
+            }
+          },
+          {
+            "Action": $act,
+            "ResourceRecordSet": {
+              "Name": ("*." + $dns),
+              "Type": "A",
+              "AliasTarget": {
+                "HostedZoneId": $elbz,
+                "DNSName": ("dualstack." + $elb),
+                "EvaluateTargetHealth": false
+              }
+            }
+          }
+      ]
+    }' > "$records_json"
+jq < "$records_json"
+CHANGEID="$(aws route53 change-resource-record-sets --hosted-zone-id "${MYZONE?}" --change-batch "file://${records_json}" | jq -r '.ChangeInfo.Id')"
+aws route53 get-change --id "${CHANGEID?}" | jq '.ChangeInfo.Status'
diff --git a/assets/loadtest/control-plane/example-vars.env b/assets/loadtest/control-plane/example-vars.env
new file mode 100644
index 0000000000000..9ba0a511f2e63
--- /dev/null
+++ b/assets/loadtest/control-plane/example-vars.env
@@ -0,0 +1,32 @@
+# generated file output directory (relative)
+STATE_DIR="state"
+
+# backend variant to use (must be one of "dynamo" or "etcd")
+TELEPORT_BACKEND="dynamo"
+
+# the short name of the teleport cluster (full name will end up being <cluster-name>.<route53-zone>).
+CLUSTER_NAME="my-cluster"
+
+# session recording bucket name
+SESSION_BUCKET="${CLUSTER_NAME}-sess-deadbeefdeadbeef"
+
+# route53 zone name
+ROUTE53_ZONE="my-route53.zone"
+
+# route53 zone id
+ROUTE53_ZONE_ID="0123456789"
+
+# email for use with letsencrypt
+EMAIL="alice@example.com"
+
+# aws account id
+ACCOUNT_ID="0123456789"
+
+# grafana password
+GRAFANA_PASS="insecure"
+
+# sets the version of teleport to install
+TELEPORT_VERSION="13.0.0-alpha.2"
+
+# aws region to use for resources
+AWS_REGION="$(aws configure get region)"
diff --git a/assets/loadtest/control-plane/init.sh b/assets/loadtest/control-plane/init.sh
new file mode 100755
index 0000000000000..b129d96963973
--- /dev/null
+++ b/assets/loadtest/control-plane/init.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# initialize dependencies
+
+helm repo add teleport https://charts.releases.teleport.dev
+helm repo add jetstack https://charts.jetstack.io
+helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+helm repo update
diff --git a/assets/loadtest/control-plane/monitoring/install-monitoring.sh b/assets/loadtest/control-plane/monitoring/install-monitoring.sh
new file mode 100755
index 0000000000000..7fce64fa6a7dc
--- /dev/null
+++ b/assets/loadtest/control-plane/monitoring/install-monitoring.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+monitor_yaml="$STATE_DIR/monitoring.yaml"
+
+# source: examples/load-tests/values/kube-prometheus-stack.yaml
+cat > "$monitor_yaml" <<EOF
+prometheus:
+  prometheusSpec:
+    scrapeInterval: 15s
+    retention: 30d
+    resources:
+      requests:
+        memory: 16Gi
+        cpu: "4"
+      limits:
+        memory: 16Gi
+        # cpu: 4
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: 50Gi
+    podMonitorSelectorNilUsesHelmValues: false
+    serviceMonitorSelectorNilUsesHelmValues: false
+EOF
+
+helm install monitoring \
+    -n monitoring \
+    --create-namespace prometheus-community/kube-prometheus-stack \
+    -f "$monitor_yaml"
diff --git a/assets/loadtest/control-plane/monitoring/port-forward.sh b/assets/loadtest/control-plane/monitoring/port-forward.sh
new file mode 100755
index 0000000000000..4eddca01a235b
--- /dev/null
+++ b/assets/loadtest/control-plane/monitoring/port-forward.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -euo pipefail
+
+localport="6060"
+
+echo "port forwarding grafana on $localport..."
+
+kubectl --namespace monitoring port-forward svc/monitoring-grafana "${localport}:80"
diff --git a/assets/loadtest/control-plane/monitoring/set-password.sh b/assets/loadtest/control-plane/monitoring/set-password.sh
new file mode 100644
index 0000000000000..532300ab92ce3
--- /dev/null
+++ b/assets/loadtest/control-plane/monitoring/set-password.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+GRAFANA_POD=$(kubectl get pods --selector=app.kubernetes.io/name=grafana -n monitoring | tail -n 1 | awk '{print $1}')
+
+if test -z "$GRAFANA_POD"; then
+    echo "failed to discover grafana pod" >&2
+    exit 1
+fi
+
+kubectl exec --stdin --namespace="monitoring" --tty --container grafana $GRAFANA_POD -- grafana-cli admin reset-admin-password $GRAFANA_PASS
diff --git a/assets/loadtest/control-plane/policies/attach-policies.sh b/assets/loadtest/control-plane/policies/attach-policies.sh
new file mode 100755
index 0000000000000..f11d2a0f56efb
--- /dev/null
+++ b/assets/loadtest/control-plane/policies/attach-policies.sh
@@ -0,0 +1,72 @@
+#!/bin/bash
+
+set -euo pipefail
+
+mode="${1:?'mode (one of attach or detach)'}"
+
+case "$mode" in
+    attach)
+        ;;
+    detach)
+        ;;
+    *)
+        echo "ERROR: unknown mode $mode, expected one of 'attach' or 'detach'."
+        ;;
+esac
+
+source vars.env
+
+dynamo_policy_arn="arn:aws:iam::${ACCOUNT_ID}:policy/${CLUSTER_NAME}-dynamo"
+
+s3_policy_arn="arn:aws:iam::${ACCOUNT_ID}:policy/${CLUSTER_NAME}-s3"
+
+route53_policy_arn="arn:aws:iam::${ACCOUNT_ID}:policy/${CLUSTER_NAME}-route53"
+
+
+# used for stripping out node role name
+role_arn_prefix="arn:aws:iam::${ACCOUNT_ID}:role/"
+
+
+log_info() {
+    echo "[i] $* [ $(caller | awk '{print $1}') ]" >&2
+}
+
+# discover the node groups associated with our eks cluster
+nodegroups="$(aws eks list-nodegroups --cluster-name="$CLUSTER_NAME" | jq -r .nodegroups[])"
+
+
+if test -z "$nodegroups"; then
+    log_info "failed to discover node group!"
+    exit 1
+fi
+
+while read -r ngroup; do
+    noderole_arn="$(aws eks describe-nodegroup \
+        --cluster-name="$CLUSTER_NAME" \
+        --nodegroup-name="$ngroup" \
+        | jq -r .nodegroup.nodeRole)"
+
+    if test -z "$noderole_arn"; then
+        log_info "failed to discover node role for group '$ngroup'!"
+        exit 1
+    fi
+
+    noderole_name="${noderole_arn#"$role_arn_prefix"}"
+
+    log_info "${mode}ing policies to discovered node role '$noderole_name'..."
+
+    if [[ "$TELEPORT_BACKEND" == "dynamo" ]]; then
+        aws iam "$mode-role-policy" \
+            --policy-arn="$dynamo_policy_arn" \
+            --role-name="$noderole_name"
+    fi
+
+    aws iam "$mode-role-policy" \
+        --policy-arn="$s3_policy_arn" \
+        --role-name="$noderole_name"
+
+    aws iam "$mode-role-policy" \
+        --policy-arn="$route53_policy_arn" \
+        --role-name="$noderole_name"
+
+done <<< "$nodegroups"
diff --git a/assets/loadtest/control-plane/policies/create-policies.sh b/assets/loadtest/control-plane/policies/create-policies.sh
new file mode 100755
index 0000000000000..dd71e923dd662
--- /dev/null
+++ b/assets/loadtest/control-plane/policies/create-policies.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+dynamo_policy="$STATE_DIR/dynamo-iam-policy"
+
+s3_policy="$STATE_DIR/s3-iam-policy"
+
+route53_policy="$STATE_DIR/route53-policy"
+
+if [[ "$TELEPORT_BACKEND" == "dynamo" ]]; then
+  aws iam create-policy \
+      --policy-name "${CLUSTER_NAME}-dynamo" \
+      --policy-document "$(cat "$dynamo_policy")"
+fi
+
+aws iam create-policy \
+    --policy-name "${CLUSTER_NAME}-s3" \
+    --policy-document "$(cat "$s3_policy")"
+
+aws iam create-policy \
+    --policy-name "${CLUSTER_NAME}-route53" \
+    --policy-document "$(cat "$route53_policy")"
+
diff --git a/assets/loadtest/control-plane/policies/delete-policies.sh b/assets/loadtest/control-plane/policies/delete-policies.sh
new file mode 100755
index 0000000000000..0389d3af6b7d7
--- /dev/null
+++ b/assets/loadtest/control-plane/policies/delete-policies.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+dynamo_policy_arn="arn:aws:iam::${ACCOUNT_ID}:policy/${CLUSTER_NAME}-dynamo"
+
+s3_policy_arn="arn:aws:iam::${ACCOUNT_ID}:policy/${CLUSTER_NAME}-s3"
+
+route53_policy_arn="arn:aws:iam::${ACCOUNT_ID}:policy/${CLUSTER_NAME}-route53"
+
+if [[ "$TELEPORT_BACKEND" == "dynamo" ]]; then
+    aws iam delete-policy \
+        --policy-arn "$dynamo_policy_arn"
+fi
+
+aws iam delete-policy \
+    --policy-arn "$s3_policy_arn"
+
+aws iam delete-policy \
+    --policy-arn "$route53_policy_arn"
diff --git a/assets/loadtest/control-plane/policies/gen-policies.sh b/assets/loadtest/control-plane/policies/gen-policies.sh
new file mode 100755
index 0000000000000..8fa0a717cbdf0
--- /dev/null
+++ b/assets/loadtest/control-plane/policies/gen-policies.sh
@@ -0,0 +1,128 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+dynamo_policy="$STATE_DIR/dynamo-iam-policy"
+
+s3_policy="$STATE_DIR/s3-iam-policy"
+
+route53_policy="$STATE_DIR/route53-policy"
+
+mkdir -p "$STATE_DIR"
+
+cat > "$dynamo_policy" <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "ClusterStateStorage",
+            "Effect": "Allow",
+            "Action": [
+                "dynamodb:BatchWriteItem",
+                "dynamodb:UpdateTimeToLive",
+                "dynamodb:PutItem",
+                "dynamodb:DeleteItem",
+                "dynamodb:Scan",
+                "dynamodb:Query",
+                "dynamodb:DescribeStream",
+                "dynamodb:UpdateItem",
+                "dynamodb:DescribeTimeToLive",
+                "dynamodb:CreateTable",
+                "dynamodb:DescribeTable",
+                "dynamodb:GetShardIterator",
+                "dynamodb:GetItem",
+                "dynamodb:UpdateTable",
+                "dynamodb:GetRecords",
+                "dynamodb:UpdateContinuousBackups"
+            ],
+            "Resource": [
+                "arn:aws:dynamodb:${AWS_REGION}:${ACCOUNT_ID}:table/${CLUSTER_NAME}-backend",
+                "arn:aws:dynamodb:${AWS_REGION}:${ACCOUNT_ID}:table/${CLUSTER_NAME}-backend/stream/*"
+            ]
+        },
+        {
+            "Sid": "ClusterEventsStorage",
+            "Effect": "Allow",
+            "Action": [
+                "dynamodb:CreateTable",
+                "dynamodb:BatchWriteItem",
+                "dynamodb:UpdateTimeToLive",
+                "dynamodb:PutItem",
+                "dynamodb:DescribeTable",
+                "dynamodb:DeleteItem",
+                "dynamodb:GetItem",
+                "dynamodb:Scan",
+
+                "dynamodb:Query",
+                "dynamodb:UpdateItem",
+                "dynamodb:DescribeTimeToLive",
+                "dynamodb:UpdateTable",
+                "dynamodb:UpdateContinuousBackups"
+            ],
+            "Resource": [
+                "arn:aws:dynamodb:${AWS_REGION}:${ACCOUNT_ID}:table/${CLUSTER_NAME}-events",
+                "arn:aws:dynamodb:${AWS_REGION}:${ACCOUNT_ID}:table/${CLUSTER_NAME}-events/index/*"
+            ]
+        }
+    ]
+}
+EOF
+
+cat > "$s3_policy" <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "BucketActions",
+            "Effect": "Allow",
+            "Action": [
+                "s3:PutEncryptionConfiguration",
+                "s3:PutBucketVersioning",
+                "s3:ListBucketVersions",
+                "s3:ListBucketMultipartUploads",
+                "s3:ListBucket",
+                "s3:GetEncryptionConfiguration",
+                "s3:GetBucketVersioning",
+                "s3:CreateBucket"
+            ],
+            "Resource": "arn:aws:s3:::${SESSION_BUCKET}"
+        },
+        {
+            "Sid": "ObjectActions",
+            "Effect": "Allow",
+            "Action": [
+                "s3:GetObjectVersion",
+                "s3:GetObjectRetention",
+                "s3:*Object",
+                "s3:ListMultipartUploadParts",
+                "s3:AbortMultipartUpload"
+            ],
+            "Resource": "arn:aws:s3:::${SESSION_BUCKET}/*"
+        }
+    ]
+}
+EOF
+
+
+cat > "$route53_policy" <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": "route53:GetChange",
+            "Resource": "arn:aws:route53:::change/*"
+        },
+        {
+            "Effect": "Allow",
+            "Action": [
+                "route53:ChangeResourceRecordSets",
+                "route53:ListResourceRecordSets"
+            ],
+            "Resource": "arn:aws:route53:::hostedzone/${ROUTE53_ZONE_ID}"
+        }
+    ]
+}
+EOF
diff --git a/assets/loadtest/control-plane/storage/delete-storage.sh b/assets/loadtest/control-plane/storage/delete-storage.sh
new file mode 100755
index 0000000000000..70f4f26f4fa0b
--- /dev/null
+++ b/assets/loadtest/control-plane/storage/delete-storage.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+# delete dynamo tables
+
+if [[ "$TELEPORT_BACKEND" == "dynamo" ]]; then
+    aws dynamodb delete-table \
+        --table-name "${CLUSTER_NAME}-backend"
+
+    aws dynamodb delete-table \
+        --table-name "${CLUSTER_NAME}-events"
+fi
+
+# empty the session bucket
+
+contents="$(aws s3 ls "$SESSION_BUCKET")"
+
+if ! test -z "$contents"; then
+    aws s3api delete-objects \
+      --bucket "$SESSION_BUCKET" \
+      --delete "$( \
+        aws s3api list-object-versions \
+        --bucket "$SESSION_BUCKET" \
+        --output=json \
+        --query='{Objects: Versions[].{Key:Key,VersionId:VersionId}}' \
+        )"
+fi
+
+# delete the session bucket
+
+aws s3api delete-bucket \
+    --bucket "$SESSION_BUCKET"
diff --git a/assets/loadtest/control-plane/storage/set-on-demand.sh b/assets/loadtest/control-plane/storage/set-on-demand.sh
new file mode 100755
index 0000000000000..9a8cb00d6a76d
--- /dev/null
+++ b/assets/loadtest/control-plane/storage/set-on-demand.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+# update billing mode of tables
+
+aws dynamodb update-table \
+    --table-name "${CLUSTER_NAME}-backend" \
+    --billing-mode "PAY_PER_REQUEST" \
+    > /dev/null
+
+aws dynamodb update-table \
+    --table-name "${CLUSTER_NAME}-events" \
+    --billing-mode "PAY_PER_REQUEST" \
+    > /dev/null
diff --git a/assets/loadtest/control-plane/teleport/gen-dynamo-teleport.sh b/assets/loadtest/control-plane/teleport/gen-dynamo-teleport.sh
new file mode 100755
index 0000000000000..081825f3acff3
--- /dev/null
+++ b/assets/loadtest/control-plane/teleport/gen-dynamo-teleport.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+values_yaml="$STATE_DIR/teleport-values.yaml"
+
+mkdir -p "$STATE_DIR"
+
+cat > "$values_yaml" <<EOF
+chartMode: aws
+clusterName: ${CLUSTER_NAME}.${ROUTE53_ZONE}      # Name of your cluster. Use the FQDN you intend to configure in DNS below.
+teleportVersionOverride: ${TELEPORT_VERSION}
+proxyListenerMode: "multiplex"
+aws:
+  region: ${AWS_REGION}                           # AWS region
+  backendTable: ${CLUSTER_NAME}-backend           # DynamoDB table to use for the Teleport backend
+  auditLogTable: ${CLUSTER_NAME}-events           # DynamoDB table to use for the Teleport audit log (must be different to the backend table)
+  auditLogMirrorOnStdout: false                   # Whether to mirror audit log entries to stdout in JSON format (useful for external log collectors)
+  sessionRecordingBucket: ${SESSION_BUCKET}       # S3 bucket to use for Teleport session recordings
+  backups: true                                   # Whether or not to turn on DynamoDB backups
+  dynamoAutoScaling: false                        # Whether Teleport should configure DynamoDB's autoscaling.
+highAvailability:
+  replicaCount: 2                                 # Number of replicas to configure
+  certManager:
+    enabled: true                                 # Enable cert-manager support to get TLS certificates
+    issuerName: letsencrypt-production            # Name of the cert-manager Issuer to use (as configured above)
+# If you are running Kubernetes 1.23 or above, disable PodSecurityPolicies
+podSecurityPolicy:
+  enabled: false
+podMonitor:
+  enabled: true
+auth:
+  teleportConfig:
+    kubernetes_service:
+      enabled: false
+EOF
diff --git a/assets/loadtest/control-plane/teleport/gen-etcd-teleport.sh b/assets/loadtest/control-plane/teleport/gen-etcd-teleport.sh
new file mode 100755
index 0000000000000..0227ce1c8c182
--- /dev/null
+++ b/assets/loadtest/control-plane/teleport/gen-etcd-teleport.sh
@@ -0,0 +1,84 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+values_yaml="$STATE_DIR/teleport-values.yaml"
+
+mkdir -p "$STATE_DIR"
+
+cat > "$values_yaml" <<EOF
+chartMode: standalone
+clusterName: ${CLUSTER_NAME}.${ROUTE53_ZONE}      # Name of your cluster. Use the FQDN you intend to configure in DNS below.
+teleportVersionOverride: ${TELEPORT_VERSION}
+
+extraArgs: ['--debug']
+
+persistence:
+    enabled: false
+
+highAvailability:
+  replicaCount: 2
+  certManager:
+    enabled: true
+    issuerName: letsencrypt-production
+
+authentication:
+  type: local
+  secondFactor: "optional"
+  webauthn:
+    rp_id: ${CLUSTER_NAME}.${ROUTE53_ZONE}
+  connector_name: passwordless
+  device_trust:
+    mode: "off"
+proxyListenerMode: separate
+auth:
+  teleportConfig:
+    version: v3
+    teleport:
+      log:
+        severity: DEBUG
+        format:
+          output: json
+      storage:
+        type: etcd
+        peers: [https://etcd.etcd.svc.cluster.local:2379]
+        insecure: true
+        prefix: teleport
+      connection_limits:
+        max_connections: 65000
+        max_users: 10000
+      advertise_ip: teleport-auth
+    auth_service:
+      enabled: true
+      cluster_name: ${CLUSTER_NAME}.${ROUTE53_ZONE}
+      listen_addr: 0.0.0.0:3025
+      routing_strategy: most_recent
+
+proxy:
+  annotations:
+    service:
+      service.beta.kubernetes.io/aws-load-balancer-type: nlb
+      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
+      service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
+  teleportConfig:
+    version: v3
+    teleport:
+      auth_server: "teleport-auth.teleport.svc.cluster.local:3025"
+      log:
+        severity: DEBUG
+        format:
+          output: json
+      connection_limits:
+        max_connections: 65000
+        max_users: 1000
+    proxy_service:
+      enabled: true
+      web_listen_addr: 0.0.0.0:3080
+      public_addr: ${CLUSTER_NAME}.${ROUTE53_ZONE}:443
+podSecurityPolicy:
+  enabled: false
+podMonitor:
+  enabled: true
+EOF
\ No newline at end of file
diff --git a/assets/loadtest/control-plane/teleport/install-teleport.sh b/assets/loadtest/control-plane/teleport/install-teleport.sh
new file mode 100755
index 0000000000000..53db262686da7
--- /dev/null
+++ b/assets/loadtest/control-plane/teleport/install-teleport.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+values_yaml="$STATE_DIR/teleport-values.yaml"
+
+helm upgrade --install teleport teleport/teleport-cluster \
+  --create-namespace \
+  --namespace teleport \
+  -f "$values_yaml"
diff --git a/assets/loadtest/control-plane/teleport/uninstall-teleport.sh b/assets/loadtest/control-plane/teleport/uninstall-teleport.sh
new file mode 100755
index 0000000000000..40f5aa0aba31c
--- /dev/null
+++ b/assets/loadtest/control-plane/teleport/uninstall-teleport.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+set -euo pipefail
+
+helm --namespace teleport uninstall teleport
diff --git a/assets/loadtest/control-plane/teleport/wait.sh b/assets/loadtest/control-plane/teleport/wait.sh
new file mode 100755
index 0000000000000..13950dbe4e338
--- /dev/null
+++ b/assets/loadtest/control-plane/teleport/wait.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source vars.env
+
+component="${1}"
+
+case "$component" in
+    auth)
+        ;;
+    proxy)
+        ;;
+    *)
+        echo "unknown component '$component'" >&2
+        exit 1
+        ;;
+esac
+
+kubectl wait pods \
+    --namespace teleport \
+    --timeout 10m \
+    --selector "app.kubernetes.io/component=${component}" \
+    --for "condition=Ready"
diff --git a/assets/loadtest/etcd/Makefile b/assets/loadtest/etcd/Makefile
index 58a53112a0ac7..9c788015ce42a 100644
--- a/assets/loadtest/etcd/Makefile
+++ b/assets/loadtest/etcd/Makefile
@@ -1,9 +1,33 @@
-# generates certificates
-.PHONY: all
-all:
-	make -C certs all
-
-# deletes generated certificates
-.PHONY: destroy
-destroy:
-	make -C certs clean
+# deploys etcd into the cluster
+.PHONY: deploy
+deploy:
+	kubectl create namespace etcd --dry-run=client -o yaml | kubectl apply -f -
+	kubectl create secret tls client-certs -n etcd \
+	  --cert=./certs/client-cert.pem \
+	  --key=./certs/client-key.pem
+
+	kubectl create secret tls server-certs -n etcd \
+  	  --cert=./certs/server-cert.pem \
+  	  --key=./certs/server-key.pem
+
+	kubectl create secret tls client-certs -n etcd \
+		  --cert=./certs/client-cert.pem \
+		  --key=./certs/client-key.pem
+
+	helm repo add bitnami https://charts.bitnami.com/bitnami
+	helm install etcd -n etcd --create-namespace bitnami/etcd \
+		--set replicaCount=3 \
+		--set metrics.enabled=true \
+		--set metrics.podMonitor.enabled=true \
+		--set auth.peer.secureTransport=true \
+		--set auth.peer.useAutoTLS=true \
+		--set auth.client.secureTransport=true \
+		--set auth.client.existingSecret=client-certs \
+		--set auth.client.enableAuthentication=true
+
+
+# deletes etcd from the cluster
+.PHONY: delete
+delete:
+	helm delete -n etcd etcd
+	kubectl delete ns etcd
\ No newline at end of file
diff --git a/assets/loadtest/etcd/README.md b/assets/loadtest/etcd/README.md
deleted file mode 100644
index dc127a63afb2e..0000000000000
--- a/assets/loadtest/etcd/README.md
+++ /dev/null
@@ -1,14 +0,0 @@
-# etcd
-
-To generate self-signed certificates for secure connectivity to etcd run:
-
-```bash
-$ make
-```
-
-
-To delete the generated certificates run:
-
-```bash
-$ make clean
-```
\ No newline at end of file
diff --git a/assets/loadtest/etcd/certs/Makefile b/assets/loadtest/etcd/certs/Makefile
old mode 100755
new mode 100644
diff --git a/examples/load-tests/.gitignore b/assets/loadtest/helm/.gitignore
similarity index 100%
rename from examples/load-tests/.gitignore
rename to assets/loadtest/helm/.gitignore
diff --git a/examples/load-tests/README.md b/assets/loadtest/helm/README.md
similarity index 100%
rename from examples/load-tests/README.md
rename to assets/loadtest/helm/README.md
diff --git a/examples/load-tests/fixtures/user.yaml b/assets/loadtest/helm/fixtures/user.yaml
similarity index 100%
rename from examples/load-tests/fixtures/user.yaml
rename to assets/loadtest/helm/fixtures/user.yaml
diff --git a/examples/load-tests/node-agent/.helmignore b/assets/loadtest/helm/node-agent/.helmignore
similarity index 100%
rename from examples/load-tests/node-agent/.helmignore
rename to assets/loadtest/helm/node-agent/.helmignore
diff --git a/examples/load-tests/node-agent/Chart.yaml b/assets/loadtest/helm/node-agent/Chart.yaml
similarity index 83%
rename from examples/load-tests/node-agent/Chart.yaml
rename to assets/loadtest/helm/node-agent/Chart.yaml
index 345de8f837521..768446bb74150 100644
--- a/examples/load-tests/node-agent/Chart.yaml
+++ b/assets/loadtest/helm/node-agent/Chart.yaml
@@ -6,4 +6,4 @@ type: application
 
 version: 0.1.0
 
-appVersion: "12.0.0-dev"
+appVersion: "13.0.0-alpha.1"
diff --git a/examples/load-tests/node-agent/templates/config.yaml b/assets/loadtest/helm/node-agent/templates/config.yaml
similarity index 90%
rename from examples/load-tests/node-agent/templates/config.yaml
rename to assets/loadtest/helm/node-agent/templates/config.yaml
index 07958a06d654c..3d6b5e4457239 100644
--- a/examples/load-tests/node-agent/templates/config.yaml
+++ b/assets/loadtest/helm/node-agent/templates/config.yaml
@@ -24,6 +24,9 @@ data:
       enabled: false
     ssh_service:
       enabled: true
+      commands:
+        - name: fullname
+          command: ['bash', '-c', 'echo "$HOSTNAME-$REPLICA"']
       # listen_addr set at runtime to avoid conflicts in the same pod
       # listen_addr: 0.0.0.0:3022
   entrypoint.sh: |2
diff --git a/examples/load-tests/node-agent/templates/deployment.yaml b/assets/loadtest/helm/node-agent/templates/deployment.yaml
similarity index 97%
rename from examples/load-tests/node-agent/templates/deployment.yaml
rename to assets/loadtest/helm/node-agent/templates/deployment.yaml
index 8a8da4b2a8652..8e9b22e905e9e 100644
--- a/examples/load-tests/node-agent/templates/deployment.yaml
+++ b/assets/loadtest/helm/node-agent/templates/deployment.yaml
@@ -1,7 +1,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  namespace: agents
+  namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}
 spec:
   replicas: {{ .Values.replicaCount }}
diff --git a/examples/load-tests/node-agent/templates/serviceaccount.yaml b/assets/loadtest/helm/node-agent/templates/serviceaccount.yaml
similarity index 100%
rename from examples/load-tests/node-agent/templates/serviceaccount.yaml
rename to assets/loadtest/helm/node-agent/templates/serviceaccount.yaml
diff --git a/examples/load-tests/node-agent/values.yaml b/assets/loadtest/helm/node-agent/values.yaml
similarity index 78%
rename from examples/load-tests/node-agent/values.yaml
rename to assets/loadtest/helm/node-agent/values.yaml
index fd5820fc73589..a3b32c6cd2ce4 100644
--- a/examples/load-tests/node-agent/values.yaml
+++ b/assets/loadtest/helm/node-agent/values.yaml
@@ -19,14 +19,6 @@ joinParams:
   # DO NOT USE THIS IN PRODUCTION
   token_name: qwertyuiop
 
-# Applied par agent (not per-pod)
-resources:
-  limits:
-    memory: 150Mi
-  requests:
-    cpu: 20m
-    memory: 150Mi
-
 tolerations: []
 
 affinity: {}
diff --git a/examples/load-tests/podmonitor.yaml b/assets/loadtest/helm/podmonitor.yaml
similarity index 100%
rename from examples/load-tests/podmonitor.yaml
rename to assets/loadtest/helm/podmonitor.yaml
diff --git a/examples/load-tests/tsh-bench-agent/.helmignore b/assets/loadtest/helm/tsh-bench-agent/.helmignore
similarity index 100%
rename from examples/load-tests/tsh-bench-agent/.helmignore
rename to assets/loadtest/helm/tsh-bench-agent/.helmignore
diff --git a/examples/load-tests/tsh-bench-agent/Chart.yaml b/assets/loadtest/helm/tsh-bench-agent/Chart.yaml
similarity index 83%
rename from examples/load-tests/tsh-bench-agent/Chart.yaml
rename to assets/loadtest/helm/tsh-bench-agent/Chart.yaml
index 69115468689d6..c3a0405f0c3ad 100644
--- a/examples/load-tests/tsh-bench-agent/Chart.yaml
+++ b/assets/loadtest/helm/tsh-bench-agent/Chart.yaml
@@ -6,4 +6,4 @@ type: application
 
 version: 0.1.0
 
-appVersion: "12.0.0-dev"
+appVersion: "13.0.0-alpha.1"
diff --git a/examples/load-tests/tsh-bench-agent/templates/deployment.yaml b/assets/loadtest/helm/tsh-bench-agent/templates/deployment.yaml
similarity index 100%
rename from examples/load-tests/tsh-bench-agent/templates/deployment.yaml
rename to assets/loadtest/helm/tsh-bench-agent/templates/deployment.yaml
diff --git a/examples/load-tests/tsh-bench-agent/values.yaml b/assets/loadtest/helm/tsh-bench-agent/values.yaml
similarity index 100%
rename from examples/load-tests/tsh-bench-agent/values.yaml
rename to assets/loadtest/helm/tsh-bench-agent/values.yaml
diff --git a/examples/load-tests/values/kube-prometheus-stack.yaml b/assets/loadtest/helm/values/kube-prometheus-stack.yaml
similarity index 100%
rename from examples/load-tests/values/kube-prometheus-stack.yaml
rename to assets/loadtest/helm/values/kube-prometheus-stack.yaml
diff --git a/assets/loadtest/helm/values/node-agents.yaml b/assets/loadtest/helm/values/node-agents.yaml
new file mode 100644
index 0000000000000..c5ebd5e3d1e68
--- /dev/null
+++ b/assets/loadtest/helm/values/node-agents.yaml
@@ -0,0 +1,11 @@
+replicaCount: 30
+agentsPerPod: 15
+
+minReadySeconds: 30
+
+image:
+  tag: 13.0.0-alpha.2
+
+joinParams:
+  method: token
+  token_name: "qwertyuiop"
diff --git a/examples/load-tests/values/teleport.yaml b/assets/loadtest/helm/values/teleport.yaml
similarity index 88%
rename from examples/load-tests/values/teleport.yaml
rename to assets/loadtest/helm/values/teleport.yaml
index 67ed4b2982062..6ef242cc6e884 100644
--- a/examples/load-tests/values/teleport.yaml
+++ b/assets/loadtest/helm/values/teleport.yaml
@@ -26,8 +26,7 @@ podMonitor:
   enabled: true
   interval: ""
 
-# TODO: change after v12 is released
-teleportVersionOverride: 12.0.0-hugochartsplit.2
+teleportVersionOverride: 13.0.0-alpha.1
 
 auth:
   teleportConfig:
diff --git a/examples/load-tests/values/tsh-bench-agents.yaml b/assets/loadtest/helm/values/tsh-bench-agents.yaml
similarity index 100%
rename from examples/load-tests/values/tsh-bench-agents.yaml
rename to assets/loadtest/helm/values/tsh-bench-agents.yaml
diff --git a/assets/loadtest/k8s/Makefile b/assets/loadtest/k8s/Makefile
deleted file mode 100644
index d63d8eff21984..0000000000000
--- a/assets/loadtest/k8s/Makefile
+++ /dev/null
@@ -1,499 +0,0 @@
-LICENSE_PATH ?= /var/lib/teleport/license.pem
-CERT_MANAGER_VERSION ?= v1.7.1
-SOAK_TEST_DURATION ?= 30m
-BACKEND ?= etcd
-USE_CERT_MANAGER ?= yes
-TELEPORT_IMAGE ?= public.ecr.aws/gravitational/teleport-ent:12.0.0
-NAMESPACE ?= loadtest
-NODE ?=
-
-# performs initialization needed for cluster
-# 1) generates etcd certs
-# 2) creates namespace
-# 3) installs cert-manager
-# 4) creates and applies secrets
-.PHONY: setup
-setup:
-	@if [ -z ${TELEPORT_IMAGE} ]; then \
-		echo "TELEPORT_IMAGE is not set, cannot apply cluster."; \
-		exit 1; \
-	fi
-
-
-	@echo "applying image: ${TELEPORT_IMAGE}"
-ifeq ($(BACKEND), etcd)
-	$(MAKE) -C ../etcd/certs all
-endif
-	kubectl create namespace $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f -
-	$(MAKE) -C ./secrets all
-ifeq ($(USE_CERT_MANAGER), yes)
-	kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/$(CERT_MANAGER_VERSION)/cert-manager.yaml
-endif
-	$(MAKE) generate-secrets
-
-# create kubernetes secrets
-.PHONY: generate-secrets
-generate-secrets:
-ifeq ($(BACKEND), etcd)
-	kubectl create secret generic etcd-client-certs -n $(NAMESPACE) \
-		--from-file=client-cert.pem=../etcd/certs/client-cert.pem \
-		--from-file=client-key.pem=../etcd/certs/client-key.pem \
-		--from-file=ca-cert.pem=../etcd/certs/ca-cert.pem \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-	kubectl create secret generic etcd-server-certs -n $(NAMESPACE) \
-		--from-file=server-cert.pem=../etcd/certs/server-cert.pem \
-		--from-file=server-key.pem=../etcd/certs/server-key.pem \
-		--from-file=ca-cert.pem=../etcd/certs/ca-cert.pem \
-		--dry-run=client -o yaml | kubectl apply -f -
-endif
-
-ifeq ($(BACKEND), firestore)
-	kubectl create secret generic gcp-creds -n $(NAMESPACE) \
-		--from-file=gcp_creds.json=${GCP_CREDS_LOCATION} \
-		--dry-run=client -o yaml | kubectl apply -f -
-endif
-
-	kubectl create secret generic license -n $(NAMESPACE) \
-		--from-file=license.pem=$(LICENSE_PATH) \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-# deletes the loadtest and cert-manager namespaces
-.PHONY: clean
-clean:
-	$(MAKE) -C secrets clean
-	$(MAKE) -C ../etcd/certs clean
-	kubectl delete namespace $(NAMESPACE) --ignore-not-found
-	kubectl delete -f https://github.com/jetstack/cert-manager/releases/download/$(CERT_MANAGER_VERSION)/cert-manager.yaml --ignore-not-found
-
-
-ifeq ($(BACKEND), etcd)
-# deploys etcd and teleport to the loadtest namespace
-.PHONY: apply
-apply: setup install-etcd generate-certificates install-monitor install-teleport
-else
-# deploys and teleport to the loadtest namespace
-.PHONY: apply
-apply: setup generate-certificates install-monitor install-teleport
-endif
-
-ifeq ($(USE_CERT_MANAGER), yes)
-# generate-certificates applies a cert-manager.io/v1/ClusterIssuer and a cert-manager.io/v1/Certificate
-# that will automatically fetch tls certificates
-.PHONY: generate-certificates
-generate-certificates:
-	kubectl wait --for=condition=available --timeout=600s deploy cert-manager -n cert-manager
-	kubectl wait --for=condition=available --timeout=600s deploy cert-manager-webhook -n cert-manager
-	kubectl wait --for=condition=available --timeout=600s deploy cert-manager-cainjector -n cert-manager
-# we have to sleep here to due to issues with certmanager
-# Error from server (InternalError): error when creating "certificate.yaml": Internal error occurred: failed calling webhook "webhook.cert-manager.io": Post "https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s": x509: certificate signed by unknown authority
-# Error from server (InternalError): error when creating "certificate.yaml": Internal error occurred: failed calling webhook "webhook.cert-manager.io": Post "https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s": x509: certificate signed by unknown authority
-# See https://github.com/jetstack/cert-manager/issues/2602 and https://github.com/jetstack/cert-manager/issues/2752
-	@echo "waiting for cert-manager to be ready..."
-	@sleep 90
-	kubectl apply -f certificate.yaml
-else
-.PHONY: generate-certificates
-generate-certificates:
-	kubectl apply -f tls.yaml
-endif
-
-# installs teleport auth, proxy, one IoT node and one non-IoT node
-.PHONY: install-teleport
-install-teleport: install-auth install-proxy install-node install-iot-node
-
-# deletes teleport deployments, services, and configmaps
-.PHONY: delete-teleport
-delete-teleport: delete-tc delete-nodes delete-proxy delete-auth
-
-# installs prometheus exporter
-.PHONY: install-monitor
-install-monitor:
-	$(MAKE) -s expand-yaml FILENAME=prometheus NAMESPACE=$(NAMESPACE)
-	kubectl apply -f prometheus-gen.yaml
-
-# deletes prometheus exporter
-.PHONY: delete-monitor
-delete-monitor:
-	kubectl delete -f prometheus-gen.yaml --ignore-not-found
-
-# installs an etcd cluster
-.PHONY: install-etcd
-install-etcd:
-	kubectl create configmap etcd-config -n $(NAMESPACE) \
-		--from-file=etcd.sh=./etcd.sh \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-
-	$(MAKE) -s expand-yaml FILENAME=etcd NAMESPACE=$(NAMESPACE)
-	kubectl apply -f etcd-gen.yaml
-
-# deletes etcd deployment, services, and configmaps
-.PHONY: delete-etcd
-delete-etcd:
-	kubectl delete -f etcd-gen.yaml --ignore-not-found
-	kubectl delete configmap etcd-config -n $(NAMESPACE) --ignore-not-found
-
-
-# install auth and applies required teleport resources for loadtests
-.PHONY: install-auth
-install-auth: setup-auth
-	kubectl wait --for=condition=ready pod -l teleport-role=auth -n $(NAMESPACE) --timeout=120s
-
-	kubectl -n $(NAMESPACE) exec deploy/auth -c teleport -it \
-		-- tctl --config /etc/teleport/teleport.yaml create -f /etc/teleport/admin.yaml
-	kubectl -n $(NAMESPACE) exec deploy/auth -c teleport -it \
-		-- tctl --config /etc/teleport/teleport.yaml create -f /etc/teleport/oidc.yaml
-	kubectl -n $(NAMESPACE) exec deploy/auth -c teleport -it \
-		-- tctl --config /etc/teleport/teleport.yaml create -f /etc/teleport/user.yaml
-
-
-ifeq ($(BACKEND), etcd)
-.PHONY: setup-auth
-setup-auth:
-	$(MAKE) -s expand-yaml FILENAME=../teleport/teleport-auth-etcd
-
-	kubectl create configmap auth-config -n $(NAMESPACE) \
-		--from-file=teleport.yaml=../teleport/teleport-auth-etcd-gen.yaml \
-		--from-file=oidc.yaml=../teleport/oidc.yaml \
-		--from-file=admin.yaml=../teleport/admin.yaml \
-		--from-file=user.yaml=../teleport/soaktest-user.yaml \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-	$(MAKE) -s expand-yaml FILENAME=auth-etcd TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-	kubectl apply -f auth-etcd-gen.yaml
-else ifeq ($(BACKEND), firestore)
-.PHONY: setup-auth
-setup-auth:
-	$(MAKE) -s expand-yaml FILENAME=../teleport/teleport-auth-firestore
-
-	kubectl create configmap auth-config -n $(NAMESPACE) \
-		--from-file=teleport.yaml=../teleport/teleport-auth-firestore-gen.yaml \
-		--from-file=oidc.yaml=../teleport/oidc.yaml \
-		--from-file=admin.yaml=../teleport/admin.yaml \
-		--from-file=user.yaml=../teleport/soaktest-user.yaml \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-	$(MAKE) -s expand-yaml FILENAME=auth-firestore TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-	kubectl apply -f auth-firestore-gen.yaml
-else ifeq ($(BACKEND), dynamo)
-.PHONY: setup-auth
-setup-auth:
-	$(MAKE) -s expand-yaml DYNAMO_TABLE=${DYNAMO_TABLE} DYNAMO_REGION=${DYNAMO_REGION} FILENAME=../teleport/teleport-auth-dynamo
-
-	kubectl create configmap auth-config -n $(NAMESPACE) \
-		--from-file=teleport.yaml=../teleport/teleport-auth-dynamo-gen.yaml \
-		--from-file=oidc.yaml=../teleport/oidc.yaml \
-		--from-file=admin.yaml=../teleport/admin.yaml \
-		--from-file=user.yaml=../teleport/soaktest-user.yaml \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-	$(MAKE) -s expand-yaml FILENAME=auth-dynamo TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-	kubectl apply -f auth-dynamo-gen.yaml
-else
-.PHONY: setup-auth
-setup-auth:
-	@echo "unknown backend $(BACKEND)"
-	exit 1
-endif
-
-# deletes auth deployment, services and configmaps
-.PHONY: delete-auth
-delete-auth:
-	kubectl delete -f auth-etcd-gen.yaml --ignore-not-found
-	kubectl delete -f auth-dynamo-gen.yaml --ignore-not-found
-	kubectl delete -f auth-firestore-gen.yaml --ignore-not-found
-	kubectl delete configmap auth-config -n $(NAMESPACE) --ignore-not-found
-
-# install proxy
-.PHONY: install-proxy
-install-proxy:
-	$(MAKE) -s expand-yaml FILENAME=../teleport/teleport-proxy
-	kubectl create configmap proxy-config -n $(NAMESPACE) \
-		--from-file=teleport.yaml=../teleport/teleport-proxy-gen.yaml \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-
-	$(MAKE) -s expand-yaml FILENAME=proxy TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-	kubectl apply -f proxy-gen.yaml
-
-# deletes proxy deployment, services and configmaps
-.PHONY: delete-proxy
-delete-proxy:
-	kubectl delete -f proxy-gen.yaml --ignore-not-found
-	kubectl delete configmap proxy-config -n $(NAMESPACE) --ignore-not-found
-
-# deletes all node deployment and configmaps
-.PHONY: delete-nodes
-delete-nodes: delete-node delete-iot-node
-
-# deletes all non-IoT nodes
-.PHONY: delete-node
-delete-node:
-	kubectl delete -f node-gen.yaml --ignore-not-found
-	kubectl delete configmap node-config -n $(NAMESPACE) --ignore-not-found
-
-# deletes all IoT nodes
-.PHONY: delete-iot-node
-delete-iot-node:
-	kubectl delete -f iot-node-gen.yaml --ignore-not-found
-	kubectl delete configmap iot-node-config -n $(NAMESPACE) --ignore-not-found
-
-# install one IoT node and one non-IoT node
-.PHONY: install-nodes
-install-nodes: install-iot-node install-node
-
-# install an IoT mode node
-.PHONY: install-iot-node
-install-iot-node:
-	$(MAKE) -s expand-yaml FILENAME=../teleport/teleport-iot-node
-	kubectl create configmap iot-node-config -n $(NAMESPACE) \
-		--from-file=teleport.yaml=../teleport/teleport-iot-node-gen.yaml \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-	$(MAKE) -s expand-yaml FILENAME=iot-node TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-	kubectl apply -f iot-node-gen.yaml
-
-# install a non-IoT mode node
-.PHONY: install-node
-install-node:
-	$(MAKE) -s expand-yaml FILENAME=../teleport/teleport-node
-	kubectl create configmap node-config -n $(NAMESPACE) \
-		--from-file=teleport.yaml=../teleport/teleport-node-gen.yaml \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-	$(MAKE) -s expand-yaml FILENAME=node TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-	kubectl apply -f node-gen.yaml
-
-# installs a trusted cluster
-.PHONY: install-tc
-install-tc:
-	$(MAKE) -s expand-yaml FILENAME=../teleport/tc
-	kubectl create configmap tc-config -n $(NAMESPACE) \
-		--from-file=teleport.yaml=../teleport/teleport-tc.yaml \
-		--from-file=cluster.yaml=../teleport/tc-gen.yaml \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-	$(MAKE) -s expand-yaml FILENAME=tc TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE) NAMESPACE=$(NAMESPACE)
-	kubectl apply -f tc-gen.yaml
-
-# deletes all rc resources from teleport and deletes trusted cluster deployments and configmaps
-.PHONY: delete-tc
-delete-tc:
-	kubectl delete -f tc-gen.yaml --ignore-not-found
-	kubectl delete configmap tc-config -n $(NAMESPACE) --ignore-not-found
-
-	kubectl -n $(NAMESPACE) exec deploy/auth -c teleport -it \
-		-- /bin/bash -c "tctl --config /etc/teleport/teleport.yaml get rc | grep ' name:' | cut -d ':' -f2- | xargs -P 20 -n 1 -I {} tctl --config /etc/teleport/teleport.yaml rm rc/{}"
-
-# joins all trusted clusters to root cluster
-.PHONY: setup-tc
-setup-tc:
-	kubectl get pod -n $(NAMESPACE) -l app="tc" -o custom-columns=name:metadata.name --no-headers \
-	| xargs -P 20 -n 1 -I {} kubectl -n $(NAMESPACE) exec {} -- tctl --config /etc/teleport/teleport.yaml create -f /etc/teleport/cluster.yaml
-
-# scales trusted clusters to 500
-.PHONY: scale-tc-500
-scale-tc-500:
-	kubectl scale --replicas=500 deploy tc -n $(NAMESPACE)
-
-# scales trusted clusters to 1
-.PHONY: scale-tc-1
-scale-tc-1:
-	kubectl scale --replicas=1 deploy tc -n $(NAMESPACE)
-
-# scales nodes to 1
-.PHONY: scale-1-non-iot
-scale-1-non-iot:
-	kubectl scale --replicas=1 deploy node -n $(NAMESPACE)
-
-# scales nodes to 1000
-.PHONY: scale-1k-non-iot
-scale-1k-non-iot:
-	kubectl scale --replicas=1000 deploy node -n $(NAMESPACE)
-
-# scales nodes to 10000
-.PHONY: scale-10k-non-iot
-scale-10k-non-iot:
-	kubectl scale --replicas=10000 deploy node -n $(NAMESPACE)
-
-# scales nodes to 1
-.PHONY: scale-1-iot
-scale-1-iot:
-	kubectl scale --replicas=1 deploy iot-node -n $(NAMESPACE)
-
-# scales nodes to 1000
-.PHONY: scale-1k-iot
-scale-1k-iot:
-	kubectl scale --replicas=1000 deploy iot-node -n $(NAMESPACE)
-
-# scales nodes to 10000
-.PHONY: scale-10k-iot
-scale-10k-iot:
-	kubectl scale --replicas=10000 deploy iot-node -n $(NAMESPACE)
-
-# gets pods in loadtest namespace
-.PHONY: pods
-pods:
-	kubectl get pods -n $(NAMESPACE)
-
-# removes all soak test jobs and configmaps
-.PHONY: delete-soaktest
-.PHONY: delete-soaktest
-delete-soaktest:
-	kubectl delete job -l app=soaktest -n $(NAMESPACE) --ignore-not-found
-
-	kubectl delete configmap soaktest-config -n $(NAMESPACE) --ignore-not-found
-
-# creates the soak test job
-.PHONY: install-soaktest
-install-soaktest:
-	kubectl create configmap soaktest-config -n $(NAMESPACE) \
-		--from-file=soaktest.sh=../teleport/soaktest.sh \
-		--from-literal=DURATION=$(SOAK_TEST_DURATION) \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-	kubectl create secret generic soaktest -n $(NAMESPACE) \
-		--from-file=auth=./secrets/soaktest-auth \
-		--from-literal=PROXY_HOST=$$(cat ./secrets/secrets.env | grep PROXY_HOST | cut -d '=' -f2- ) \
-		--dry-run=client -o yaml | kubectl apply -f -
-
-	$(MAKE) -s expand-yaml FILENAME=soaktest TELEPORT_IMAGE=$(TELEPORT_IMAGE) NAMESPACE=$(NAMESPACE)
-	kubectl create -f soaktest-gen.yaml
-
-# deploys a job to run the soak tests
-.PHONY: run-soak-tests
-run-soak-tests:
-	kubectl -n $(NAMESPACE) exec $$(kubectl get pod -n $(NAMESPACE) -l teleport-role="auth" -o jsonpath="{.items[0].metadata.name}") -it \
-		-- tctl auth sign --overwrite --user=soaktest-runner --out=/data/soaktest-auth --ttl=8760h --config /etc/teleport/teleport.yaml
-
-	kubectl cp $(NAMESPACE)/$$(kubectl get pod -n $(NAMESPACE) -l teleport-role="auth" -o jsonpath="{.items[0].metadata.name}"):/data/soaktest-auth ./secrets/soaktest-auth
-
-	kubectl wait --for=condition=available --timeout=600s deploy/node -n $(NAMESPACE)
-	kubectl wait --for=condition=available --timeout=600s deploy/iot-node -n $(NAMESPACE)
-
-	$(MAKE) -s install-soaktest
-
-	@sleep 1
-
-	kubectl wait --for=condition=ready pod $$(kubectl get pods --sort-by=.metadata.creationTimestamp -o jsonpath="{.items[-1:].metadata.name}" -l app=soaktest -n $(NAMESPACE)) -n $(NAMESPACE) --timeout=120s
-	kubectl logs $$(kubectl get pods --sort-by=.metadata.creationTimestamp -o jsonpath="{.items[-1:].metadata.name}" -l app=soaktest -n $(NAMESPACE)) -n $(NAMESPACE) --tail -1 -f
-
-# runs the node scaling tests
-.PHONY: run-scaling-test
-run-scaling-test:
-	$(MAKE) -s delete-nodes
-	$(MAKE) -s install-node
-	$(MAKE) -s scale-10k-non-iot
-	@kubectl wait --for=condition=available deploy/node -n $(NAMESPACE) --timeout=60m
-	@sleep 30
-	$(MAKE) -s scale-1-non-iot
-	@sleep 15
-	$(MAKE) -s scale-10k-non-iot
-	@kubectl wait --for=condition=available deploy/node -n $(NAMESPACE) --timeout=60m
-	@sleep 15
-	$(MAKE) -s scale-1-non-iot
-
-	@sleep 15
-
-	$(MAKE) -s delete-nodes
-	$(MAKE) -s install-iot-node
-	$(MAKE) -s scale-10k-iot
-	@kubectl wait --for=condition=available deploy/iot-node -n $(NAMESPACE) --timeout=60m
-	@sleep 30
-	$(MAKE) -s scale-1-iot
-	@sleep 15
-	$(MAKE) -s scale-10k-iot
-	@kubectl wait --for=condition=available  deploy/iot-node -n $(NAMESPACE) --timeout=60m
-	@sleep 15
-	$(MAKE) -s scale-1
-
-	$(MAKE) -s delete-nodes
-	$(MAKE) -s install-nodes
-
-# runs the trusted-cluster scaling tests
-.PHONY: run-tc-scaling-test
-run-tc-scaling-test:
-	$(MAKE) -s install-tc
-	$(MAKE) -s scale-tc-500
-	kubectl wait --for=condition=available deploy/tc -n $(NAMESPACE) --timeout=60m
-	@sleep 120
-	$(MAKE) -s setup-tc
-
-	@sleep 300
-
-	$(MAKE) -s delete-tc
-
-	@sleep 180
-
-	$(MAKE) -s install-tc
-	$(MAKE) -s scale-tc-500
-	kubectl wait --for=condition=available deploy/tc -n $(NAMESPACE) --timeout=60m
-	@sleep 120
-	$(MAKE) -s setup-tc
-
-	@sleep 300
-
-	$(MAKE) -s delete-tc
-
-# collect goroutine and heap go profiles from the auth deployment
-.PHONY: collect-profiles
-collect-profiles: collect-auth collect-proxy collect-node
-
-# forwards the pods diagnostics address
-.PHONY: forward-pod-diagnostics
-forward-pod-diagnostics:
-	kubectl port-forward $(POD) 3434:3434 -n $(NAMESPACE) > /dev/null 2>&1 &
-
-# retrieves profiles from all pods matching the selector
-.PHONY: collect-pods
-collect-pods:
-	@for POD in $$(kubectl get pod -n $(NAMESPACE) -l $(SELECTOR) -o custom-columns=name:metadata.name --no-headers) ; do \
-$(MAKE) collect-pod POD=$$POD ; \
-    done
-
-# retrieves profiles from all proxy pods
-.PHONY: collect-proxy
-collect-proxy:
-	$(MAKE) -s collect-pods SELECTOR=teleport-role="proxy"
-
-# retrieves profiles from all auth pods
-.PHONY: collect-auth
-collect-auth:
-	$(MAKE) -s collect-pods SELECTOR=teleport-role="auth"
-
-# retrieves profiles from a node
-.PHONY: collect-node
-collect-node:
-	$(MAKE) -s collect-pod POD=$(NODE)
-
-# retrieves profiles from a particular pod
-ifeq ($(POD),)
-.PHONY: collect-pod
-collect-pod:
-	@echo "No pod provided; $(MAKE) collect-pod POD=<pod-name>"
-	exit 1
-else
-.PHONY: collect-pod
-collect-pod:
-	$(MAKE) -s forward-pod-diagnostics POD=$(POD)
-	@echo "waiting for $(POD) to be available..."
-	@timeout 30 sh -c 'until nc -z localhost 3434; do sleep 0.5; done'
-	@if [ $$? -ne 0 ]; then echo "unable to reach $$POD"; exit 1; fi
-	$(MAKE) -s fetch-profiles LOCATION=$(POD)-$(shell date +%s)
-	kill -s kill $$(pgrep -f 3434:3434)
-endif
-
-# downloads the remote profiles
-.PHONY: fetch-profiles
-fetch-profiles:
-	mkdir -p $(PWD)/profiles/$(LOCATION)/
-	curl -o $(PWD)/profiles/$(LOCATION)/goroutine.profile http://127.0.0.1:3434/debug/pprof/goroutine
-	curl -o $(PWD)/profiles/$(LOCATION)/heap.profile http://127.0.0.1:3434/debug/pprof/heap
-	curl -o $(PWD)/profiles/$(LOCATION)/trace.profile http://127.0.0.1:3434/debug/pprof/trace?seconds=10
-
-# expands any placeholders in the provided yaml file with the value in the matching environment variable. the
-# output file will be named the same with a -gen suffix, i.e input = test then output will be test-gen.yaml
-.PHONY: expand-yaml
-expand-yaml:
-	@bash -c "set -a && source ./secrets/secrets.env && set +a && envsubst < $(FILENAME).yaml > $(FILENAME)-gen.yaml"
diff --git a/assets/loadtest/k8s/auth-dynamo.yaml b/assets/loadtest/k8s/auth-dynamo.yaml
deleted file mode 100644
index 1d4fa0a54216f..0000000000000
--- a/assets/loadtest/k8s/auth-dynamo.yaml
+++ /dev/null
@@ -1,83 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: auth
-  namespace: ${NAMESPACE}
-  labels:
-    teleport-role: auth
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      teleport-role: auth
-  template:
-    metadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "3434"
-      labels:
-        backend: dynamo
-        teleport-role: auth
-    spec:
-      volumes:
-        - name: config
-          configMap:
-            name: auth-config
-        - name: license
-          secret:
-            secretName: license
-        - name: storage
-          emptyDir: {}
-      containers:
-        - name: teleport
-          image: ${TELEPORT_IMAGE}
-          args: ["-d", "--insecure", "--diag-addr=0.0.0.0:3434"]
-          ports:
-            - name: diag
-              containerPort: 3434
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /healthz
-              port: 3434
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 2
-          livenessProbe:
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            successThreshold: 1
-            tcpSocket:
-              port: 3434
-            timeoutSeconds: 1
-          volumeMounts:
-            - name: config
-              mountPath: /etc/teleport/
-              readOnly: true
-            - name: license
-              mountPath: /var/lib/teleport/license.pem
-              subPath: license.pem
-              readOnly: true
-            - mountPath: /data
-              name: storage
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: auth
-  namespace: ${NAMESPACE}
-spec:
-  ports:
-    - name: auth
-      port: 3025
-      targetPort: 3025
-    - name: diag
-      port: 3434
-      targetPort: 3434
-  selector:
-    teleport-role: auth
-  type: ClusterIP
diff --git a/assets/loadtest/k8s/auth-etcd.yaml b/assets/loadtest/k8s/auth-etcd.yaml
deleted file mode 100644
index 33cb2887ac64e..0000000000000
--- a/assets/loadtest/k8s/auth-etcd.yaml
+++ /dev/null
@@ -1,91 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: auth
-  namespace: ${NAMESPACE}
-  labels:
-    teleport-role: auth
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      teleport-role: auth
-  template:
-    metadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "3434"
-      labels:
-        teleport-role: auth
-        backend: etcd
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "3434"
-    spec:
-      volumes:
-        - name: config
-          configMap:
-            name: auth-config
-        - name: certs
-          secret:
-            secretName: etcd-client-certs
-        - name: license
-          secret:
-            secretName: license
-        - name: storage
-          emptyDir: {}
-      containers:
-        - name: teleport
-          image: ${TELEPORT_IMAGE}
-          args: ["-d", "--insecure", "--diag-addr=0.0.0.0:3434"]
-          ports:
-            - name: diag
-              containerPort: 3434
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /healthz
-              port: 3434
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 2
-          livenessProbe:
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            successThreshold: 1
-            tcpSocket:
-              port: 3434
-            timeoutSeconds: 1
-          volumeMounts:
-            - name: config
-              mountPath: /etc/teleport/
-              readOnly: true
-            - name: license
-              mountPath: /var/lib/teleport/license.pem
-              subPath: license.pem
-              readOnly: true
-            - name: certs
-              mountPath: /etc/etcd/certs/
-              readOnly: true
-            - mountPath: /data
-              name: storage
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: auth
-  namespace: ${NAMESPACE}
-spec:
-  ports:
-    - name: auth
-      port: 3025
-      targetPort: 3025
-    - name: diag
-      port: 3434
-      targetPort: 3434
-  selector:
-    teleport-role: auth
-  type: ClusterIP
diff --git a/assets/loadtest/k8s/auth-firestore.yaml b/assets/loadtest/k8s/auth-firestore.yaml
deleted file mode 100644
index e0a8afc7b8678..0000000000000
--- a/assets/loadtest/k8s/auth-firestore.yaml
+++ /dev/null
@@ -1,92 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: auth
-  namespace: ${NAMESPACE}
-  labels:
-    teleport-role: auth
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      teleport-role: auth
-  template:
-  metadata:
-    annotations:
-      prometheus.io/scrape: "true"
-      prometheus.io/port: "3434"
-    labels:
-      teleport-role: auth
-      backend: firestore
-      prometheus.io/scrape: "true"
-      prometheus.io/port: "3434"
-    spec:
-      volumes:
-        - name: config
-          configMap:
-            name: auth-config
-        - name: creds
-          secret:
-            secretName: gcp-creds
-        - name: license
-          secret:
-            secretName: license
-        - name: storage
-          emptyDir: {}
-      containers:
-        - name: teleport
-          image: ${TELEPORT_IMAGE}
-          args: ["-d", "--insecure", "--diag-addr=0.0.0.0:3434"]
-          ports:
-            - name: diag
-              containerPort: 3434
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /healthz
-              port: 3434
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 2
-          livenessProbe:
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            successThreshold: 1
-            tcpSocket:
-              port: 3434
-            timeoutSeconds: 1
-          volumeMounts:
-            - name: config
-              mountPath: /etc/teleport/
-              readOnly: true
-            - name: license
-              mountPath: /var/lib/teleport/license.pem
-              subPath: license.pem
-              readOnly: true
-            - name: creds
-              mountPath: /var/lib/teleport/gcp_creds.json
-              subPath: gcp_creds.json
-              readOnly: true
-            - mountPath: /data
-              name: storage
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: auth
-  namespace: ${NAMESPACE}
-spec:
-  ports:
-    - name: auth
-      port: 3025
-      targetPort: 3025
-    - name: diag
-      port: 3434
-      targetPort: 3434
-  selector:
-    teleport-role: auth
-  type: ClusterIP
diff --git a/assets/loadtest/k8s/etcd.sh b/assets/loadtest/k8s/etcd.sh
deleted file mode 100644
index 9e7b9446f7667..0000000000000
--- a/assets/loadtest/k8s/etcd.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/bin/sh
-# This script runs etcd.
-set -e
-set -x
-
-PEERS="etcd-0=https://etcd-0.etcd:2380,etcd-1=https://etcd-1.etcd:2380,etcd-2=https://etcd-2.etcd:2380"
-exec etcd \
-  --name ${POD_NAME} \
-  --advertise-client-urls https://${POD_NAME}.etcd:2379 \
-  --listen-client-urls https://0.0.0.0:2379 \
-  --initial-advertise-peer-urls https://${POD_NAME}.etcd:2380 \
-  --listen-peer-urls https://0.0.0.0:2380 \
-  --initial-cluster ${PEERS} \
-  --trusted-ca-file=/etc/etcd/certs/ca-cert.pem \
-  --cert-file=/etc/etcd/certs/server-cert.pem \
-  --key-file=/etc/etcd/certs/server-key.pem \
-  --peer-cert-file=/etc/etcd/certs/server-cert.pem \
-  --peer-key-file=/etc/etcd/certs/server-key.pem \
-  --peer-trusted-ca-file=/etc/etcd/certs/ca-cert.pem \
-  --client-cert-auth \
-  --peer-client-cert-auth \
-  --auto-compaction-retention=1
\ No newline at end of file
diff --git a/assets/loadtest/k8s/etcd.yaml b/assets/loadtest/k8s/etcd.yaml
deleted file mode 100644
index 83c936bec4e7f..0000000000000
--- a/assets/loadtest/k8s/etcd.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: etcd
-  namespace: ${NAMESPACE}
-  labels:
-    app: etcd
-spec:
-  serviceName: etcd
-  replicas: 3
-  selector:
-    matchLabels:
-      app: etcd
-  template:
-    metadata:
-      name: etcd
-      labels:
-        app: etcd
-    spec:
-      volumes:
-        - name: config
-          configMap:
-            name: etcd-config
-            defaultMode: 0777
-        - name: server-certs
-          secret:
-            secretName: etcd-server-certs
-        - name: client-certs
-          secret:
-            secretName: etcd-client-certs
-      containers:
-        - name: etcd
-          image: quay.io/coreos/etcd:v3.3.25
-          ports:
-            - containerPort: 2379
-              name: client
-            - containerPort: 2380
-              name: peer
-          volumeMounts:
-            - mountPath: /scripts
-              name: config
-              readOnly: true
-            - name: server-certs
-              mountPath: /etc/etcd/certs/
-              readOnly: true
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-          command:
-            - /bin/sh
-            - -c
-            - |
-              cp /scripts/etcd.sh /tmp
-              chmod +x /tmp/etcd.sh
-              /tmp/etcd.sh
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: etcd
-  namespace: ${NAMESPACE}
-  labels:
-    app: etcd
-spec:
-  clusterIP: None
-  ports:
-    - port: 2379
-      name: client
-    - port: 2380
-      name: peer
-  selector:
-    app: etcd
\ No newline at end of file
diff --git a/assets/loadtest/k8s/iot-node.yaml b/assets/loadtest/k8s/iot-node.yaml
deleted file mode 100644
index 0a65a092f8d2d..0000000000000
--- a/assets/loadtest/k8s/iot-node.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    teleport-role: node
-  name: iot-node
-  namespace: ${NAMESPACE}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      teleport-role: node
-      node: iot
-  template:
-    metadata:
-      labels:
-        teleport-role: node
-        node: iot
-    spec:
-      containers:
-        - image: ${TELEPORT_IMAGE}
-          name: teleport
-          args: ["-d", "--insecure", "--diag-addr=0.0.0.0:3434"]
-          ports:
-            - name: nodessh
-              containerPort: 3022
-              protocol: TCP
-            - name: diag
-              containerPort: 3434
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /healthz
-              port: 3434
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 2
-          livenessProbe:
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            successThreshold: 1
-            tcpSocket:
-              port: 3434
-            timeoutSeconds: 1
-          volumeMounts:
-            - mountPath: /etc/teleport
-              name: config
-              readOnly: true
-      volumes:
-        - configMap:
-            name: iot-node-config
-          name: config
diff --git a/assets/loadtest/k8s/node.yaml b/assets/loadtest/k8s/node.yaml
deleted file mode 100644
index b1ecc77234d50..0000000000000
--- a/assets/loadtest/k8s/node.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    teleport-role: node
-  name: node
-  namespace: ${NAMESPACE}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      teleport-role: node
-      node: regular
-  template:
-    metadata:
-      labels:
-        teleport-role: node
-        node: regular
-    spec:
-      containers:
-        - image: ${TELEPORT_IMAGE}
-          name: teleport
-          args: ["-d", "--insecure", "--diag-addr=0.0.0.0:3434"]
-          ports:
-            - name: nodessh
-              containerPort: 3022
-              protocol: TCP
-            - name: diag
-              containerPort: 3434
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /healthz
-              port: 3434
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 2
-          livenessProbe:
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            successThreshold: 1
-            tcpSocket:
-              port: 3434
-            timeoutSeconds: 1
-          volumeMounts:
-            - mountPath: /etc/teleport
-              name: config
-              readOnly: true
-      volumes:
-        - configMap:
-            name: node-config
-          name: config
diff --git a/assets/loadtest/k8s/prometheus.yaml b/assets/loadtest/k8s/prometheus.yaml
deleted file mode 100644
index 3649f3f7f92d0..0000000000000
--- a/assets/loadtest/k8s/prometheus.yaml
+++ /dev/null
@@ -1,291 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: prometheus-loadtest
----
-# Source: prometheus/templates/server/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-  namespace: prometheus-loadtest
-  annotations:
-    {}
----
-# Source: prometheus/templates/server/cm.yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-  namespace: prometheus-loadtest
-data:
-  alerting_rules.yml: |
-    {}
-  alerts: |
-    {}
-  prometheus.yml: |
-    global:
-      evaluation_interval: 1m
-      scrape_interval: 1m
-      scrape_timeout: 10s
-    remote_write:
-    - url: ${PROM_REMOTE_URL}
-      basic_auth:
-        username: ${PROM_USER}
-        password: ${PROM_PASSWORD}
-    rule_files:
-    - /etc/config/recording_rules.yml
-    - /etc/config/alerting_rules.yml
-    - /etc/config/rules
-    - /etc/config/alerts
-    scrape_configs:
-    - job_name: kubernetes-pods
-      kubernetes_sd_configs:
-      - role: pod
-      relabel_configs:
-      - action: keep
-        regex: true
-        source_labels:
-        - __meta_kubernetes_pod_annotation_prometheus_io_scrape
-      - action: drop
-        regex: true
-        source_labels:
-        - __meta_kubernetes_pod_annotation_prometheus_io_scrape_slow
-      - action: replace
-        regex: (https?)
-        source_labels:
-        - __meta_kubernetes_pod_annotation_prometheus_io_scheme
-        target_label: __scheme__
-      - action: replace
-        regex: (.+)
-        source_labels:
-        - __meta_kubernetes_pod_annotation_prometheus_io_path
-        target_label: __metrics_path__
-      - action: replace
-        regex: ([^:]+)(?::\d+)?;(\d+)
-        replacement: $1:$2
-        source_labels:
-        - __address__
-        - __meta_kubernetes_pod_annotation_prometheus_io_port
-        target_label: __address__
-      - action: labelmap
-        regex: __meta_kubernetes_pod_annotation_prometheus_io_param_(.+)
-        replacement: __param_$1
-      - action: labelmap
-        regex: __meta_kubernetes_pod_label_(.+)
-      - action: replace
-        source_labels:
-        - __meta_kubernetes_namespace
-        target_label: namespace
-      - action: replace
-        source_labels:
-        - __meta_kubernetes_pod_name
-        target_label: pod
-      - action: drop
-        regex: Pending|Succeeded|Failed|Completed
-        source_labels:
-        - __meta_kubernetes_pod_phase
-  recording_rules.yml: |
-    {}
-  rules: |
-    {}
----
-# Source: prometheus/templates/server/clusterrole.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-      - nodes/proxy
-      - nodes/metrics
-      - services
-      - endpoints
-      - pods
-      - ingresses
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - "extensions"
-      - "networking.k8s.io"
-    resources:
-      - ingresses/status
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - nonResourceURLs:
-      - "/metrics"
-    verbs:
-      - get
----
-# Source: prometheus/templates/server/clusterrolebinding.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-subjects:
-  - kind: ServiceAccount
-    name: prometheus-server
-    namespace: prometheus-loadtest
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: prometheus-server
----
-# Source: prometheus/templates/server/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-  namespace: prometheus-loadtest
-spec:
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: 9090
-  selector:
-    component: "server"
-    app: prometheus
-    release: prometheus
-  sessionAffinity: None
-  type: "ClusterIP"
----
-# Source: prometheus/templates/server/deploy.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-  namespace: prometheus-loadtest
-spec:
-  selector:
-    matchLabels:
-      component: "server"
-      app: prometheus
-      release: prometheus
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        component: "server"
-        app: prometheus
-        release: prometheus
-        chart: prometheus-15.4.0
-        heritage: Helm
-    spec:
-      enableServiceLinks: true
-      serviceAccountName: prometheus-server
-      containers:
-        - name: prometheus-server-configmap-reload
-          image: "jimmidyson/configmap-reload:v0.5.0"
-          imagePullPolicy: "IfNotPresent"
-          args:
-            - --volume-dir=/etc/config
-            - --webhook-url=http://127.0.0.1:9090/-/reload
-          resources:
-            {}
-          volumeMounts:
-            - name: config-volume
-              mountPath: /etc/config
-              readOnly: true
-
-        - name: prometheus-server
-          image: "quay.io/prometheus/prometheus:v2.31.1"
-          imagePullPolicy: "IfNotPresent"
-          args:
-            - --storage.tsdb.retention.time=15d
-            - --config.file=/etc/config/prometheus.yml
-            - --storage.tsdb.path=/data
-            - --web.console.libraries=/etc/prometheus/console_libraries
-            - --web.console.templates=/etc/prometheus/consoles
-            - --web.enable-lifecycle
-          ports:
-            - containerPort: 9090
-          readinessProbe:
-            httpGet:
-              path: /-/ready
-              port: 9090
-              scheme: HTTP
-            initialDelaySeconds: 30
-            periodSeconds: 5
-            timeoutSeconds: 4
-            failureThreshold: 3
-            successThreshold: 1
-          livenessProbe:
-            httpGet:
-              path: /-/healthy
-              port: 9090
-              scheme: HTTP
-            initialDelaySeconds: 30
-            periodSeconds: 15
-            timeoutSeconds: 10
-            failureThreshold: 3
-            successThreshold: 1
-          resources:
-            {}
-          volumeMounts:
-            - name: config-volume
-              mountPath: /etc/config
-            - name: storage-volume
-              mountPath: /data
-              subPath: ""
-      hostNetwork: false
-      dnsPolicy: ClusterFirst
-      securityContext:
-        fsGroup: 65534
-        runAsGroup: 65534
-        runAsNonRoot: true
-        runAsUser: 65534
-      terminationGracePeriodSeconds: 300
-      volumes:
-        - name: config-volume
-          configMap:
-            name: prometheus-server
-        - name: storage-volume
-          emptyDir:
-            {}
diff --git a/assets/loadtest/k8s/proxy.yaml b/assets/loadtest/k8s/proxy.yaml
deleted file mode 100644
index c377949554d48..0000000000000
--- a/assets/loadtest/k8s/proxy.yaml
+++ /dev/null
@@ -1,102 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: proxy
-  namespace: ${NAMESPACE}
-  labels:
-    teleport-role: proxy
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      teleport-role: proxy
-  template:
-    metadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "3434"
-      labels:
-        teleport-role: proxy
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "3434"
-    spec:
-      volumes:
-        - name: config
-          configMap:
-            name: proxy-config
-        - name: teleport-tls
-          secret:
-            secretName: teleport-tls
-      containers:
-        - name: teleport
-          image: ${TELEPORT_IMAGE}
-          args: ["-d", "--insecure", "--diag-addr=0.0.0.0:3434"]
-          ports:
-            - name: diag
-              containerPort: 3434
-              protocol: TCP
-            - name: web
-              containerPort: 3080
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /healthz
-              port: 3434
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 2
-          livenessProbe:
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            successThreshold: 1
-            tcpSocket:
-              port: 3434
-            timeoutSeconds: 1
-          volumeMounts:
-            - name: config
-              mountPath: /etc/teleport/
-              readOnly: true
-            - name: teleport-tls
-              mountPath: /etc/teleport-tls/
-              readOnly: true
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: proxy
-  namespace: ${NAMESPACE}
-  labels:
-    teleport-role: proxy
-spec:
-  type: LoadBalancer
-  loadBalancerIP: ${PROXY_IP}
-  ports:
-  - name: https
-    port: 3080
-    targetPort: 3080
-    protocol: TCP
-  - name: sshproxy
-    port: 3023
-    targetPort: 3023
-    protocol: TCP
-  - name: k8s
-    port: 3026
-    targetPort: 3026
-    protocol: TCP
-  - name: sshtun
-    port: 3024
-    targetPort: 3024
-    protocol: TCP
-  - name: mysql
-    port: 3036
-    targetPort: 3036
-    protocol: TCP
-  - name: diag
-    port: 3434
-    targetPort: 3434
-  selector:
-    teleport-role: proxy
diff --git a/assets/loadtest/k8s/secrets/Makefile b/assets/loadtest/k8s/secrets/Makefile
deleted file mode 100644
index 9e3ad14ff265d..0000000000000
--- a/assets/loadtest/k8s/secrets/Makefile
+++ /dev/null
@@ -1,58 +0,0 @@
-
-# output:
-#   node-token      : static join token for teleport nodes
-#   proxy-token     : static join token for teleport proxies
-#   tc-token        : static join token for teleport trusted clusters
-#   secrets.env     : env file to be used to replace placeholder values in yaml files
-.PHONY:all
-all: join-tokens env
-	@rm -rf *csr
-
-.PHONY: env
-env:
-	@if [ -z ${PROXY_HOST} ]; then \
-		echo "PROXY_HOST is not set, cannot apply cluster."; \
-		exit 1; \
-	fi
-
-	@if [ -z ${PROM_REMOTE_URL} ]; then \
-		echo "PROM_REMOTE_URL is not set, cannot apply cluster."; \
-		exit 1; \
-	fi
-
-	@if [ -z ${PROM_USER} ]; then \
-		echo "PROM_USER is not set, cannot apply cluster."; \
-		exit 1; \
-	fi
-
-	@if [ -z ${PROM_PASSWORD} ]; then \
-		echo "PROM_PASSWORD is not set, cannot apply cluster."; \
-		exit 1; \
-	fi
-
-	@echo PROXY_IP=$(shell make -C ../../network get-proxy-ip) > secrets.env
-	@echo PROXY_HOST=${PROXY_HOST} >> secrets.env
-	@echo NODE_TOKEN=$(shell cat node-token) >> secrets.env
-	@echo PROXY_TOKEN=$(shell cat proxy-token) >> secrets.env
-	@echo TC_TOKEN=$(shell cat tc-token) >> secrets.env
-	@echo GCP_PROJECT=$(shell make -C ../../cluster get-project) >> secrets.env
-	@echo PROM_REMOTE_URL=${PROM_REMOTE_URL} >> secrets.env
-	@echo PROM_USER=${PROM_USER} >> secrets.env
-	@echo PROM_PASSWORD=${PROM_PASSWORD} >> secrets.env
-
-node-token:
-	openssl rand -base64 32 | tr -d '\n' > node-token
-
-proxy-token:
-	openssl rand -base64 32 | tr -d '\n' > proxy-token
-
-tc-token:
-	openssl rand -base64 32 | tr -d '\n' > tc-token
-
-.PHONY: join-tokens
-join-tokens: node-token proxy-token tc-token
-
-# removes everything
-.PHONY:clean
-clean:
-	rm -rf *-pass *-token *-auth *.env
\ No newline at end of file
diff --git a/assets/loadtest/k8s/soaktest.yaml b/assets/loadtest/k8s/soaktest.yaml
deleted file mode 100644
index 98cc56f6f8cff..0000000000000
--- a/assets/loadtest/k8s/soaktest.yaml
+++ /dev/null
@@ -1,47 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  generateName: soaktest-
-  namespace: ${NAMESPACE}
-  labels:
-    app: soaktest
-spec:      
-  completions: 1
-  parallelism: 1
-  backoffLimit: 2
-  template:
-    metadata:
-      labels:
-        app: soaktest
-    spec:
-      restartPolicy: Never
-      volumes:
-        - name: config
-          configMap:
-            name: soaktest-config
-            defaultMode: 0777
-        - name: soaktest-auth
-          secret:
-            secretName: soaktest
-      containers:
-        - image: ${TELEPORT_IMAGE}
-          name: teleport
-          envFrom:
-          - configMapRef:
-              name: soaktest-config
-          - secretRef:
-              name: soaktest
-          command:
-            - /bin/sh
-            - -c
-            - |
-              cp /scripts/soaktest.sh /tmp
-              chmod +x /tmp/soaktest.sh
-              /tmp/soaktest.sh
-          volumeMounts:
-            - mountPath: /scripts
-              name: config
-              readOnly: true
-            - mountPath: /etc/teleport
-              name: soaktest-auth
-              readOnly: true
diff --git a/assets/loadtest/k8s/tc.yaml b/assets/loadtest/k8s/tc.yaml
deleted file mode 100644
index 606ae8663146a..0000000000000
--- a/assets/loadtest/k8s/tc.yaml
+++ /dev/null
@@ -1,61 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: tc
-  name: tc
-  namespace: ${NAMESPACE}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tc
-  template:
-    metadata:
-      labels:
-        app: tc
-    spec:
-      volumes:
-        - name: config
-          configMap:
-            name: tc-config
-        - name: license
-          secret:
-            secretName: license
-      containers:
-        - image: ${TELEPORT_IMAGE}
-          args: ["-d", "--insecure", "--diag-addr=0.0.0.0:3434"]
-          name: tc
-          ports:
-            - containerPort: 3022
-              name: nodessh
-              protocol: TCP
-            - name: diag
-              containerPort: 3434
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /healthz
-              port: 3434
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 2
-          livenessProbe:
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            successThreshold: 1
-            tcpSocket:
-              port: 3434
-            timeoutSeconds: 1
-          volumeMounts:
-            - name: config
-              mountPath: /etc/teleport/
-              readOnly: true
-            - name: license
-              mountPath: /var/lib/teleport/license.pem
-              subPath: license.pem
-              readOnly: true
diff --git a/assets/loadtest/network/Makefile b/assets/loadtest/network/Makefile
deleted file mode 100644
index aeaa90e8303e4..0000000000000
--- a/assets/loadtest/network/Makefile
+++ /dev/null
@@ -1,29 +0,0 @@
-# preview address configuration
-.PHONY: plan
-plan:
-	terraform plan
-
-# reserve static ips
-.PHONY: apply
-apply:
-	terraform apply
-
-# release static ips
-.PHONY: destroy
-destroy:
-	terraform destroy
-
-# print static ips
-.PHONY: get-ips
-get-ips:
-	@terraform output
-
-# print proxy static ip
-.PHONY: get-proxy-ip
-get-proxy-ip:
-	@terraform output -raw proxy_ip
-
-# print grafana static ip
-.PHONY: get-grafana-ip
-get-grafana-ip:
-	@terraform output -raw grafana_ip
\ No newline at end of file
diff --git a/assets/loadtest/network/README.md b/assets/loadtest/network/README.md
deleted file mode 100644
index cdb525db6b0fc..0000000000000
--- a/assets/loadtest/network/README.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# Network
-
-This reserves external static ip addresses to be used
-for the [`k8s/proxy`](../k8s/proxy.yaml) and [`k8s/grafana`](../k8s/grafana.yaml) services.
-Once you have the ips you **must** setup the DNS records accordingly.
-
-**NOTE**: This only needs to be run once for a GCP project.
-
-## Usage
-
-Confirm that everything is working correctly:
-
-```bash
-$ make plan
-```
-
-If you are running this automation for the first time, you may be asked to run
-`terraform init` before continuing.
-
-```bash
-$ make apply
-```
-
----
-
-To release the static ip addresses run:
-
-```bash
-$ make destroy
-```
\ No newline at end of file
diff --git a/assets/loadtest/network/main.tf b/assets/loadtest/network/main.tf
deleted file mode 100644
index c12391b297034..0000000000000
--- a/assets/loadtest/network/main.tf
+++ /dev/null
@@ -1,19 +0,0 @@
-provider "google" {
-  project = var.project
-  region  = var.region
-  zone    = var.zone
-}
-
-terraform {
-  required_version = ">= 0.12"
-  backend "gcs" {
-    bucket = "loadtest-tf-state"
-    prefix = "terraform/state"
-  }
-}
-
-resource "google_compute_address" "proxy_ip" {
-  name         = "proxy-ip"
-  address_type = "EXTERNAL"
-  network_tier = "PREMIUM"
-}
\ No newline at end of file
diff --git a/assets/loadtest/network/outputs.tf b/assets/loadtest/network/outputs.tf
deleted file mode 100644
index 1b4b436a62242..0000000000000
--- a/assets/loadtest/network/outputs.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-output "proxy_ip" {
-  description = "The static proxy ip address"
-  value       = google_compute_address.proxy_ip.address
-}
\ No newline at end of file
diff --git a/assets/loadtest/network/variables.tf b/assets/loadtest/network/variables.tf
deleted file mode 100644
index bf736c4aa81ed..0000000000000
--- a/assets/loadtest/network/variables.tf
+++ /dev/null
@@ -1,16 +0,0 @@
-variable "project" {
-  type        = string
-  description = "The project to manage resources in."
-}
-
-variable "region" {
-  type        = string
-  description = "The region to manage resources in."
-  default     = "us-central1"
-}
-
-variable "zone" {
-  type        = string
-  description = "The zone to manage resources in."
-  default     = "us-central1-a"
-}
diff --git a/assets/loadtest/teleport/admin.yaml b/assets/loadtest/teleport/admin.yaml
deleted file mode 100644
index efc5a507908c4..0000000000000
--- a/assets/loadtest/teleport/admin.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-kind: role
-version: v3
-metadata:
-  name: clusteradmin
-spec:
-  # SSH options used for user sessions 
-  options:
-    # max_session_ttl defines the TTL (time to live) of SSH certificates 
-    # issued to the users with this role.
-    max_session_ttl: 8h
-
-    # forward_agent controls either users are allowed to use SSH agent forwarding
-    forward_agent: true
-
-  # allow section declares a list of resource/verb combinations that are
-  # allowed for the users of this role. by default nothing is allowed.
-  allow:
-    # logins array defines the OS logins a user is allowed to use.
-    # A few special variables are supported here (see below)
-    logins: [root, ubuntu]
-
-    # node labels that a user can connect to. The wildcard ('*') means "any node"
-    node_labels:
-      '*': '*'
-
-    # see below.
-    rules:
-    - resources: ['*']
-      verbs: ['*']
-
-  # the deny section uses the identical format as the 'allow' section.
-  # the deny rules always override allow rules.
-  deny: {}
diff --git a/assets/loadtest/teleport/soaktest-user.yaml b/assets/loadtest/teleport/soaktest-user.yaml
deleted file mode 100644
index 1c117f34426e2..0000000000000
--- a/assets/loadtest/teleport/soaktest-user.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-kind: user
-metadata:
-  name: soaktest-runner
-spec:
-  roles: ['clusteradmin']
-version: v2
\ No newline at end of file
diff --git a/assets/loadtest/teleport/soaktest.sh b/assets/loadtest/teleport/soaktest.sh
deleted file mode 100755
index cb28bf6e7f614..0000000000000
--- a/assets/loadtest/teleport/soaktest.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/bash
-# This script runs the teleport load test soak tests.
-set -e
-set -x
-
-direct_node=$(tsh --insecure --proxy="${PROXY_HOST}":3080 -i /etc/teleport/auth -l root ls -f names | grep -v iot)
-tunnel_node=$(tsh --insecure --proxy="${PROXY_HOST}":3080 -i /etc/teleport/auth -l root ls -f names | grep iot)
-
-echo "${direct_node}"
-echo "${tunnel_node}"
-
-if [ -z "${direct_node}" ]; then
-		echo "no direct dial nodes found to run soak test on.";
-		exit 1;
-fi
-
-if [ -z "${tunnel_node}" ]; then
-		echo "no reverse tunnel nodes found to run soak test on.";
-		exit 1;
-fi
-
-echo "----Direct Dial Node Test----"
-tsh --insecure --proxy="${PROXY_HOST}":3080 -i /etc/teleport/auth bench --duration="${DURATION}" root@"${direct_node}" ls
-
-tsh --insecure --proxy="${PROXY_HOST}":3080 -i /etc/teleport/auth bench --duration="${DURATION}" --interactive root@"${direct_node}" ps aux
-
-echo "----Reverse Tunnel Node Test----"
-tsh --insecure --proxy="${PROXY_HOST}":3080 -i /etc/teleport/auth bench --duration="${DURATION}" root@"${tunnel_node}" ls
-
-tsh --insecure --proxy="${PROXY_HOST}":3080 -i /etc/teleport/auth bench --duration="${DURATION}" --interactive root@"${tunnel_node}" ps aux
\ No newline at end of file
diff --git a/assets/loadtest/teleport/tc.yaml b/assets/loadtest/teleport/tc.yaml
deleted file mode 100644
index 12e23cd2b52aa..0000000000000
--- a/assets/loadtest/teleport/tc.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-kind: trusted_cluster
-version: v2
-metadata:
-  name: one
-spec:
-  enabled: true
-  token: cluster-${TC_TOKEN}
-  tunnel_addr: "${PROXY_HOST}:3024"
-  web_proxy_addr: "${PROXY_HOST}:3080"
-  role_map:
-    - remote: '*'
-      local: ['access']
\ No newline at end of file
diff --git a/assets/loadtest/teleport/teleport-auth-dynamo.yaml b/assets/loadtest/teleport/teleport-auth-dynamo.yaml
deleted file mode 100644
index 3094c70a0bfee..0000000000000
--- a/assets/loadtest/teleport/teleport-auth-dynamo.yaml
+++ /dev/null
@@ -1,36 +0,0 @@
-teleport:
-  log:
-    severity: DEBUG
-
-  data_dir: /var/lib/teleport
-
-  advertise_ip: auth
-
-  storage:
-    type: dynamodb
-    table_name: ${DYNAMO_TABLE}
-    region: ${DYNAMO_REGION}
-
-  connection_limits:
-    max_connections: 65000
-    max_users: 10000
-
-auth_service:
-  enabled: yes
-
-  listen_addr: 0.0.0.0:3025
-
-  authentication:
-    type: oidc
-
-  cluster_name: one
-  tokens:
-    - "node:node-${NODE_TOKEN}"
-    - "proxy:proxy-${PROXY_TOKEN}"
-    - "trusted_cluster:cluster-${TC_TOKEN}"
-
-ssh_service:
-  enabled: no
-
-proxy_service:
-  enabled: no
\ No newline at end of file
diff --git a/assets/loadtest/teleport/teleport-auth-etcd.yaml b/assets/loadtest/teleport/teleport-auth-etcd.yaml
deleted file mode 100644
index 4ddc5db51ea07..0000000000000
--- a/assets/loadtest/teleport/teleport-auth-etcd.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-teleport:
-  log:
-    severity: DEBUG
-    format:
-      output: json
-
-  data_dir: /var/lib/teleport
-
-  advertise_ip: auth
-
-  storage:
-    type: etcd
-    peers: [https://etcd-0.etcd:2379, https://etcd-1.etcd:2379, https://etcd-2.etcd:2379]
-    tls_cert_file: /etc/etcd/certs/client-cert.pem
-    tls_key_file: /etc/etcd/certs/client-key.pem
-    tls_ca_file: /etc/etcd/certs/ca-cert.pem
-    prefix: teleport
-  connection_limits:
-    max_connections: 65000
-    max_users: 10000
-
-auth_service:
-  enabled: yes
-
-  listen_addr: 0.0.0.0:3025
-
-  authentication:
-    type: oidc
-
-  cluster_name: one
-  tokens: 
-      - "node:node-${NODE_TOKEN}"
-      - "proxy:proxy-${PROXY_TOKEN}"
-      - "trusted_cluster:cluster-${TC_TOKEN}"
-
-ssh_service:
-  enabled: no
-
-proxy_service:
-  enabled: no
\ No newline at end of file
diff --git a/assets/loadtest/teleport/teleport-auth-firestore.yaml b/assets/loadtest/teleport/teleport-auth-firestore.yaml
deleted file mode 100644
index da9265d9a1ee3..0000000000000
--- a/assets/loadtest/teleport/teleport-auth-firestore.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-teleport:
-  log:
-    severity: DEBUG
-
-  data_dir: /var/lib/teleport
-
-  advertise_ip: auth
-
-  storage:
-    type: firestore
-    collection_name: cluster-data
-    credentials_path: /var/lib/teleport/gcp_creds.json
-    project_id: "${GCP_PROJECT}"
-    audit_events_uri: "firestore://events?projectID=${GCP_PROJECT}&credentialsPath=/var/lib/teleport/gcp_creds.json"
-    audit_sessions_uri: "gs://teleport-session-storage-2?projectID=${GCP_PROJECT}&credentialsPath=/var/lib/teleport/gcp_creds.json"
-  connection_limits:
-    max_connections: 65000
-    max_users: 10000
-
-auth_service:
-  enabled: yes
-
-  listen_addr: 0.0.0.0:3025
-
-  authentication:
-    type: oidc
-
-  cluster_name: one
-  tokens: 
-      - "node:node-${NODE_TOKEN}"
-      - "proxy:proxy-${PROXY_TOKEN}"
-      - "trusted_cluster:cluster-${TC_TOKEN}"
-
-ssh_service:
-  enabled: no
-
-proxy_service:
-  enabled: no
\ No newline at end of file
diff --git a/assets/loadtest/teleport/teleport-iot-node.yaml b/assets/loadtest/teleport/teleport-iot-node.yaml
deleted file mode 100644
index cbc1a01e3dda0..0000000000000
--- a/assets/loadtest/teleport/teleport-iot-node.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-version: v3
-teleport:
-  data_dir: /var/lib/teleport
-  log:
-    severity: DEBUG
-    format:
-      output: json
-  storage:
-    type: dir
-  auth_token: "node-${NODE_TOKEN}"
-  proxy_server: ${PROXY_HOST}:3080
-auth_service:
-  enabled: false
-proxy_service:
-  enabled: false
-ssh_service:
-  enabled: true
diff --git a/assets/loadtest/teleport/teleport-node.yaml b/assets/loadtest/teleport/teleport-node.yaml
deleted file mode 100644
index 0c09953a35601..0000000000000
--- a/assets/loadtest/teleport/teleport-node.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-version: v3
-teleport:
-  data_dir: /var/lib/teleport
-  log:
-    severity: DEBUG
-    format:
-      output: json
-  storage:
-    type: dir
-  auth_token: "node-${NODE_TOKEN}"
-  auth_server: auth:3025
-auth_service:
-  enabled: false
-proxy_service:
-  enabled: false
-ssh_service:
-  enabled: true
diff --git a/assets/loadtest/teleport/teleport-proxy.yaml b/assets/loadtest/teleport/teleport-proxy.yaml
deleted file mode 100644
index 88bc708c98c30..0000000000000
--- a/assets/loadtest/teleport/teleport-proxy.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-version: v3
-teleport:
-  log:
-    severity: DEBUG
-    format:
-      output: json
-
-  data_dir: /var/lib/teleport
-  auth_server: auth:3025
-  auth_token: "proxy-${PROXY_TOKEN}"
-  cache:
-    type: in-memory
-  connection_limits:
-    max_connections: 65000
-    max_users: 10000
-
-auth_service:
-  enabled: no
-
-ssh_service:
-  enabled: no
-
-proxy_service:
-  enabled: yes
-  https_cert_file: /etc/teleport-tls/tls.crt
-  https_key_file: /etc/teleport-tls/tls.key
-  public_addr: "${PROXY_HOST}:3080"
-  tunnel_public_addr: "${PROXY_HOST}:3024"
-  tunnel_listen_addr: 0.0.0.0:3024
-  listen_addr: 0.0.0.0:3023
diff --git a/assets/loadtest/teleport/teleport-tc.yaml b/assets/loadtest/teleport/teleport-tc.yaml
deleted file mode 100644
index 7bb83bf6906c4..0000000000000
--- a/assets/loadtest/teleport/teleport-tc.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-auth_service:
-  enabled: true
-proxy_service:
-  enabled: true
-ssh_service:
-  enabled: true
-teleport:
-  data_dir: /var/lib/teleport
-  log:
-    output: stderr
-    severity: DEBUG
-  storage:
-    type: dir
\ No newline at end of file
diff --git a/build.assets/Dockerfile b/build.assets/Dockerfile
index 44c23d07e37ca..aa4f1aaf78a83 100644
--- a/build.assets/Dockerfile
+++ b/build.assets/Dockerfile
@@ -1,20 +1,16 @@
 # This Dockerfile makes the "build box" the container used to:
-# * build Teleport Connect
 # * run test and linters in CI
 # * building other Docker images
 #
 # For Teleport releases we're using CentOS 7 box to keep the binaries compatible
 # with older Linux distributions (glibc 2.17+).
 #
-# This image uses Ubuntu 20.04 as a base as Connect links against glibc and
-# we want to keep the required version as low as possible.
-#
 # Check the README to learn how to safely introduce changes to Dockerfiles.
 
 ## LIBFIDO2 ###################################################################
 
 # Build libfido2 separately for isolation, speed and flexibility.
-FROM buildpack-deps:20.04 AS libfido2
+FROM buildpack-deps:22.04 AS libfido2
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends cmake && \
@@ -29,6 +25,7 @@ RUN git clone --depth=1 https://github.com/illiliti/libudev-zero.git -b 1.0.2 &&
     make clean
 
 # Install libcbor.
+# Keep the version below synced with devbox.json
 RUN git clone --depth=1 https://github.com/PJK/libcbor.git -b v0.10.2 && \
     cd libcbor && \
     [ "$(git rev-parse HEAD)" = 'efa6c0886bae46bdaef9b679f61f4b9d8bc296ae' ] && \
@@ -42,6 +39,7 @@ RUN git clone --depth=1 https://github.com/PJK/libcbor.git -b v0.10.2 && \
 
 # Install openssl.
 # install_sw install only binaries, skips docs.
+# Keep the version below synced with devbox.json
 RUN git clone --depth=1 https://github.com/openssl/openssl.git -b openssl-3.0.9 && \
     cd openssl && \
     [ "$(git rev-parse HEAD)" = 'de90e54bbe82e5be4fb9608b6f5c308bb837d355' ] && \
@@ -51,6 +49,7 @@ RUN git clone --depth=1 https://github.com/openssl/openssl.git -b openssl-3.0.9
 
 # Install libfido2.
 # Depends on libcbor, libcrypto (OpenSSL 3.x), libudev and zlib1g-dev.
+# Keep the version below synced with devbox.json
 RUN git clone --depth=1 https://github.com/Yubico/libfido2.git -b 1.13.0 && \
     cd libfido2 && \
     [ "$(git rev-parse HEAD)" = '486a8f8667e42f55cee2bba301b41433cacec830' ] && \
@@ -66,7 +65,7 @@ RUN git clone --depth=1 https://github.com/Yubico/libfido2.git -b 1.13.0 && \
 
 ## LIBBPF #####################################################################
 
-FROM buildpack-deps:20.04 AS libbpf
+FROM buildpack-deps:22.04 AS libbpf
 
 # Install required dependencies
 RUN apt-get update -y --fix-missing && \
@@ -98,7 +97,7 @@ RUN mkdir -p /opt && cd /opt &&  \
 # 4. Fast, language-dependent dependencies
 # 5. Multi-stage layer copies
 
-FROM ubuntu:20.04 AS buildbox
+FROM ubuntu:22.04 AS buildbox
 
 COPY locale.gen /etc/locale.gen
 COPY profile /etc/profile
@@ -115,7 +114,7 @@ ARG BUILDARCH
 
 # Install packages.
 # Java JRE is required by gcloud firestore emulator.
-# Latest git 2.18+ is required for GitHub actions
+# Latest git 2.18+ is required for GitHub actions.
 # NOTE: gcc-multilib is not available on ARM, so ony amd64 version includes it.
 RUN apt-get -y update && \
     apt-get -y install software-properties-common && \
@@ -150,8 +149,8 @@ RUN apt-get -y update && \
         python3-setuptools \
         python3-wheel \
         pkg-config \
-        # Used during tag builds to build the RPM package of Connect.
-        rpm \
+        # rsync is required for some integration tests
+        rsync \
         softhsm2 \
         sudo \
         tree \
@@ -170,6 +169,7 @@ RUN apt-get -y update && \
     tee /etc/apt/sources.list.d/docker.list > /dev/null && \
     apt-get update && \
     apt-get install -y docker-ce-cli && \
+    if [ "$BUILDARCH" = "arm64" ]; then apt-get install -y binaryen; fi && \
     pip3 --no-cache-dir install yamllint && \
     dpkg-reconfigure locales && \
     apt-get -y clean && \
@@ -212,6 +212,8 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustc --version && \
     rustup component add rustfmt clippy && \
     if [ "$BUILDARCH" = "amd64" ]; then rustup target add aarch64-unknown-linux-gnu; fi
+# Install wasm-pack for targeting WebAssembly from Rust.
+RUN cargo install wasm-pack
 # Switch back to root for the remaining instructions and keep it as the default
 # user.
 USER root
@@ -244,11 +246,13 @@ RUN make -C /opt/pam_teleport install
 ENV SOFTHSM2_PATH "/usr/lib/softhsm/libsofthsm2.so"
 
 # Install bats.
+# Keep the version below synced with devbox.json
 RUN curl -fsSL https://github.com/bats-core/bats-core/archive/v1.2.1.tar.gz | tar -xz && \
     cd bats-core-1.2.1 && ./install.sh /usr/local && cd .. && \
     rm -r bats-core-1.2.1
 
 # Install shellcheck.
+# Keep the version below synced with devbox.json
 RUN scversion='v0.9.0' && \
     curl -fsSL "https://github.com/koalaman/shellcheck/releases/download/$scversion/shellcheck-$scversion.linux.$(if [ "$BUILDARCH" = "amd64" ]; then echo "x86_64"; else echo "aarch64"; fi).tar.xz" | \
         tar -xJv && \
@@ -256,6 +260,7 @@ RUN scversion='v0.9.0' && \
     shellcheck --version
 
 # Install helm.
+# Keep the version below synced with devbox.json
 RUN mkdir -p helm-tarball && \
     curl -fsSL https://get.helm.sh/helm-v3.5.2-$(go env GOOS)-$(go env GOARCH).tar.gz | tar -C helm-tarball -xz && \
     cp helm-tarball/$(go env GOOS)-$(go env GOARCH)/helm /bin/ && \
@@ -292,13 +297,16 @@ ARG GOGO_PROTO_TAG # eg, "v1.3.2"
 RUN go install "github.com/gogo/protobuf/protoc-gen-gogofast@$GOGO_PROTO_TAG"
 
 # Install addlicense.
+# Keep the version below synced with devbox.json
 RUN go install github.com/google/addlicense@v1.0.0
 
 # Install GCI.
+# Keep the version below synced with devbox.json
 RUN go install github.com/daixiang0/gci@v0.9.1
 
 # Install golangci-lint.
-RUN TAG='v1.53.1' && \
+# Keep the version below synced with devbox.json
+RUN TAG='v1.53.3' && \
     curl -fsSL "https://raw.githubusercontent.com/golangci/golangci-lint/$TAG/install.sh" | \
     sh -s -- -b "$(go env GOPATH)/bin" "$TAG"
 
diff --git a/build.assets/Dockerfile-arm-fips b/build.assets/Dockerfile-arm-fips
deleted file mode 100644
index 3096fc5bf0634..0000000000000
--- a/build.assets/Dockerfile-arm-fips
+++ /dev/null
@@ -1,6 +0,0 @@
-ARG BUILDBOX_VERSION
-FROM public.ecr.aws/gravitational/teleport-buildbox-fips:$BUILDBOX_VERSION
-
-RUN apt-get -y update && \
-    apt-get -y install gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu && \
-    apt-get -y autoclean && apt-get -y clean
diff --git a/build.assets/Dockerfile-centos7 b/build.assets/Dockerfile-centos7
index 975ddc835f92b..536402c847d6d 100644
--- a/build.assets/Dockerfile-centos7
+++ b/build.assets/Dockerfile-centos7
@@ -253,6 +253,8 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustup --version && \
     cargo --version && \
     rustc --version
+# Install wasm-pack for targeting WebAssembly from Rust.
+RUN cargo install wasm-pack
 
 # Do a quick switch back to root and copy/setup libfido2 and libpcsclite binaries.
 # Do this last to take better advantage of the multi-stage build.
diff --git a/build.assets/Dockerfile-centos7-fips b/build.assets/Dockerfile-centos7-fips
index 733e3150bb6e0..50e9d27c86484 100644
--- a/build.assets/Dockerfile-centos7-fips
+++ b/build.assets/Dockerfile-centos7-fips
@@ -166,6 +166,8 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustc --version && \
     rustup component add rustfmt clippy && \
     rustup target add aarch64-unknown-linux-gnu
+# Install wasm-pack for targeting WebAssembly from Rust.
+RUN cargo install wasm-pack
 
 
 # Copy BoringSSL into the final image
diff --git a/build.assets/Dockerfile-connect b/build.assets/Dockerfile-connect
new file mode 100644
index 0000000000000..a6235025814f7
--- /dev/null
+++ b/build.assets/Dockerfile-connect
@@ -0,0 +1,46 @@
+# This Dockerfile makes the "build box connect" the container used
+# to build the Teleport Connect.
+#
+# This image is base on the node image, which is based on Debian Buster.
+# Using it as a image allows us to link agains the same version of
+# glibc as Node.js.
+#
+# Check the README to learn how to safely introduce changes to Dockerfiles.
+
+## BUILDBOX-CONNECT ###################################################################
+
+# Pin the tag to Debian Buster to make sure the Glibc compatibility.
+ARG NODE_VERSION
+FROM node:${NODE_VERSION}-buster AS buildbox
+
+COPY locale.gen /etc/locale.gen
+COPY profile /etc/profile
+ENV LANGUAGE="en_US.UTF-8" \
+    LANG="en_US.UTF-8" \
+    LC_ALL="en_US.UTF-8" \
+    LC_CTYPE="en_US.UTF-8" \
+    DEBIAN_FRONTEND="noninteractive"
+
+# Install packages.
+RUN apt-get -y update && \
+    apt-get install -q -y --no-install-recommends \
+        build-essential \
+        ca-certificates \
+        git \
+        libc6-dev \
+        libssl-dev \
+        locales \
+        openssh-client \
+        pkg-config \
+        python3-pip \
+        python3-setuptools \
+        python3-wheel \
+        # Used during tag builds to build the RPM package of Connect.
+        rpm \
+        && \
+    dpkg-reconfigure locales && \
+    apt-get -y clean && \
+    rm -rf /var/lib/apt/lists/*
+
+# Do not create the ci user as we do on other images, as node image
+# already has node user with UID:GID 1000:1000 user.
diff --git a/build.assets/Dockerfile-fips b/build.assets/Dockerfile-fips
deleted file mode 100644
index 181ec49d7e139..0000000000000
--- a/build.assets/Dockerfile-fips
+++ /dev/null
@@ -1,187 +0,0 @@
-# This Dockerfile makes the FIPS "build box": the container used to build official
-# FIPS releases of Teleport and its documentation.
-
-
-FROM ubuntu:18.04 as boringssl
-# The below tools are required in order to build and compile the module:
-# Clang compiler version 7.0.1
-# Go programming language version 1.12.7
-# Ninja build system version 1.9.0
-#
-# We also need the FIPS 140-2 validated release of BoringSSL: ae223d6138807a13006342edfeef32e813246b39
-# For more information please refer to the section 12. Guidance and Secure Operation of:
-# https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3678.pdf
-
-RUN apt-get update -y --fix-missing && \
-    apt-get -q -y upgrade && \
-    apt-get install -y --no-install-recommends apt-utils ca-certificates curl && \
-    apt-get install -q -y --no-install-recommends \
-        build-essential \
-        cmake \
-        git \
-        tar \
-        xz-utils \
-        unzip \
-        zip \
-        && \
-    apt-get -y clean && \
-    rm -rf /var/lib/apt/lists/*
-
-
-RUN mkdir -p /opt && cd /opt && \
-    curl -sLO https://releases.llvm.org/7.0.1/clang+llvm-7.0.1-x86_64-linux-gnu-ubuntu-18.04.tar.xz && \
-    echo "e74ce06d99ed9ce42898e22d2a966f71ae785bdf4edbded93e628d696858921a" "clang+llvm-7.0.1-x86_64-linux-gnu-ubuntu-18.04.tar.xz" | sha256sum --check && \
-    tar xJf clang+llvm-7.0.1-x86_64-linux-gnu-ubuntu-18.04.tar.xz && \
-    rm -f clang+llvm-7.0.1-x86_64-linux-gnu-ubuntu-18.04.tar.xz
-ENV PATH="/opt/clang+llvm-7.0.1-x86_64-linux-gnu-ubuntu-18.04/bin:$PATH"
-
-
-RUN mkdir -p /opt && cd /opt && \
-    curl -sLO https://go.dev/dl/go1.12.7.linux-amd64.tar.gz && \
-    echo "66d83bfb5a9ede000e33c6579a91a29e6b101829ad41fffb5c5bb6c900e109d9" "go1.12.7.linux-amd64.tar.gz" | sha256sum --check && \
-    tar xf go1.12.7.linux-amd64.tar.gz && \
-    rm -f go1.12.7.linux-amd64.tar.gz && \
-    chmod a+w /opt/go && \
-    chmod a+w /var/lib && \
-    chmod a-w /
-ENV GOPATH="/go" \
-    GOROOT="/opt/go" \
-    PATH="$PATH:/opt/go/bin:/go/bin"
-
-RUN mkdir -p /opt && cd /opt && \
-    curl -sLO https://github.com/ninja-build/ninja/releases/download/v1.9.0/ninja-linux.zip && \
-    echo "1b1235f2b0b4df55ac6d80bbe681ea3639c9d2c505c7ff2159a3daf63d196305" "ninja-linux.zip" | sha256sum --check && \
-    unzip ninja-linux.zip && \
-    rm -f ninja-linux.zip && \
-    mv /opt/ninja /usr/bin
-
-RUN mkdir -p /opt && cd /opt && \
-    git clone https://github.com/google/boringssl.git && \
-    cd boringssl && \
-    git checkout ae223d6138807a13006342edfeef32e813246b39 && \
-    mkdir build && \
-    cd build && \
-    cmake -DFIPS=1 -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_BUILD_TYPE=Release -GNinja .. && \
-    ninja
-
-
-# Use Ubuntu 18.04 as base to get an older glibc version.
-# Using a newer base image will build against a newer glibc, which creates a
-# runtime requirement for the host to have newer glibc too. For example,
-# teleport built on any newer Ubuntu version will not run on Centos 7 because
-# of this.
-FROM ubuntu:18.04
-
-COPY locale.gen /etc/locale.gen
-COPY profile /etc/profile
-
-ENV LANGUAGE="en_US.UTF-8" \
-    LANG="en_US.UTF-8" \
-    LC_ALL="en_US.UTF-8" \
-    LC_CTYPE="en_US.UTF-8" \
-    DEBIAN_FRONTEND="noninteractive"
-
-RUN apt-get update -y --fix-missing && \
-    apt-get -q -y upgrade && \
-    apt-get install -y --no-install-recommends apt-utils ca-certificates curl && \
-    apt-get install -q -y --no-install-recommends \
-        clang-10 \
-        clang-format-10 \
-        gcc \
-        git \
-        gzip \
-        libc6-dev \
-        libelf-dev \
-        libpam-dev \
-        libsqlite3-0 \
-        llvm-10 \
-        locales \
-        make \
-        net-tools \
-        openssh-client \
-        pkg-config \
-        tar \
-        tree \
-        unzip \
-        zip \
-        zlib1g-dev \
-        && \
-    dpkg-reconfigure locales && \
-    apt-get -y clean && \
-    rm -rf /var/lib/apt/lists/*
-
-ARG UID
-ARG GID
-RUN (groupadd ci --gid=$GID -o && useradd ci --uid=$UID --gid=$GID --create-home --shell=/bin/sh && \
-     mkdir -p -m0700 /var/lib/teleport && chown -R ci /var/lib/teleport)
-
-# Install etcd.
-RUN (curl -L https://github.com/coreos/etcd/releases/download/v3.3.9/etcd-v3.3.9-linux-amd64.tar.gz | tar -xz && \
-     cp etcd-v3.3.9-linux-amd64/etcd* /bin/)
-
-# Install Go.
-ARG GOLANG_VERSION
-RUN mkdir -p /opt && cd /opt && curl https://storage.googleapis.com/golang/$GOLANG_VERSION.linux-amd64.tar.gz | tar xz && \
-    mkdir -p /go/src/github.com/gravitational/teleport && \
-    chmod a+w /go && \
-    chmod a+w /var/lib && \
-    chmod a-w /
-ENV GOEXPERIMENT=boringcrypto \
-    GOPATH="/go" \
-    GOROOT="/opt/go" \
-    PATH="$PATH:/opt/go/bin:/go/bin:/go/src/github.com/gravitational/teleport/build"
-
-ARG BUILDARCH
-
-# Install Nodejs
-ARG NODE_VERSION
-ENV NODE_PATH="/usr/local/lib/nodejs-linux"
-ENV PATH="$PATH:${NODE_PATH}/bin"
-RUN export NODE_ARCH=$(if [ "$BUILDARCH" = "amd64" ]; then echo "x64"; else echo "arm64"; fi) && \
-    export NODE_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" && \
-    mkdir -p ${NODE_PATH} && \
-    curl -o /tmp/nodejs.tar.xz -L ${NODE_URL} && \
-    tar -xJf /tmp/nodejs.tar.xz -C /usr/local/lib/nodejs-linux --strip-components=1
-RUN corepack enable yarn
-
-# Install libbpf
-ARG LIBBPF_VERSION
-RUN mkdir -p /opt && cd /opt && \
-    curl -fsSL https://github.com/libbpf/libbpf/archive/refs/tags/v${LIBBPF_VERSION}.tar.gz | tar xz && \
-    cd /opt/libbpf-${LIBBPF_VERSION}/src && \
-    make && \
-    make install
-
-# Install PAM module and policies for testing.
-COPY pam/ /opt/pam_teleport/
-RUN make -C /opt/pam_teleport install
-
-ARG RUST_VERSION
-ENV RUSTUP_HOME=/usr/local/rustup \
-     CARGO_HOME=/usr/local/cargo \
-     PATH=/usr/local/cargo/bin:$PATH \
-     RUST_VERSION=$RUST_VERSION
-
-RUN mkdir -p $RUSTUP_HOME && chmod a+w $RUSTUP_HOME && \
-    mkdir -p $CARGO_HOME/registry && chmod -R a+w $CARGO_HOME
-
-# Install Rust using the ci user, as that is the user that
-# will run builds using the Rust toolchains we install here.
-USER ci
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain $RUST_VERSION && \
-    rustup --version && \
-    cargo --version && \
-    rustc --version && \
-    rustup component add rustfmt clippy && \
-    rustup target add aarch64-unknown-linux-gnu
-
-# Copy BoringSSL into the final image
-COPY --from=boringssl /opt/boringssl /opt/boringssl
-
-# set boring-rs crate env variables to point to pre-built binaries
-# https://github.com/cloudflare/boring#support-for-pre-built-binaries
-ENV BORING_BSSL_PATH=/opt/boringssl
-ENV BORING_BSSL_INCLUDE_PATH=/opt/boringssl/include
-
-VOLUME ["/go/src/github.com/gravitational/teleport"]
-EXPOSE 6600 2379 2380
diff --git a/build.assets/Dockerfile-multiarch b/build.assets/Dockerfile-multiarch
index 8909273c97fd5..bebd0309ed2d6 100644
--- a/build.assets/Dockerfile-multiarch
+++ b/build.assets/Dockerfile-multiarch
@@ -130,6 +130,8 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --pr
     cargo --version && \
     rustc --version && \
     rustup target add ${RUST_ARCH}
+# Install wasm-pack for targeting WebAssembly from Rust.
+RUN cargo install wasm-pack
 
 USER root
 
diff --git a/build.assets/Makefile b/build.assets/Makefile
index 968d9e6f35b72..40ae773c1dca9 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -19,17 +19,21 @@ TEST_KUBE ?=
 OS ?= linux
 ARCH ?= amd64
 
-GOLANG_VERSION ?= go1.20.4
+# Sync with devbox.json.
+GOLANG_VERSION ?= go1.20.5
 
+# Sync with devbox.json.
 NODE_VERSION ?= 16.18.1
 
+# Sync any version changes below with devbox.json.
 # run lint-rust check locally before merging code after you bump this
 RUST_VERSION ?= 1.68.0
 LIBBPF_VERSION ?= 1.0.1
 LIBPCSCLITE_VERSION ?= 1.9.9-teleport
 
+# Sync any version changes below with devbox.json.
 # Protogen related versions.
-BUF_VERSION ?= 1.20.0
+BUF_VERSION ?= 1.22.0
 # Keep in sync with api/proto/buf.yaml (and buf.lock)
 GOGO_PROTO_TAG ?= v1.3.2
 NODE_GRPC_TOOLS_VERSION ?= 1.12.4
@@ -54,7 +58,6 @@ include grpcbox.mk
 # target. The other solution was to remove the 'buildbox' dependency from the 'release' target, but this would
 # make it harder to run `make -C build.assets release` locally as the buildbox would not automatically be built.
 BUILDBOX_NAME=$(BUILDBOX)
-BUILDBOX_FIPS_NAME=$(BUILDBOX_FIPS)
 
 DOCSBOX=ghcr.io/gravitational/docs
 
@@ -67,9 +70,17 @@ ifeq ("$(DRONE)","true")
 CI := true
 endif
 ifeq ("$(CI)","true")
+# The UID/GID of the runner user on ARC runners is 1001, not 1000
+# This var is currently only set for ARC runners via https://github.com/gravitational/cloud-terraform/pull/2473
+ifeq ("$(CI_SYSTEM)","ARC")
+UID := 1001
+GID := 1001
+NOROOT := -u 1001:1001
+else
 UID := 1000
 GID := 1000
 NOROOT := -u 1000:1000
+endif
 # if running in CI and the GOCACHE environment variable is not set, set it to a sensible default
 ifeq ("$(GOCACHE)",)
 GOCACHE := /go/cache
@@ -149,20 +160,7 @@ buildbox:
 # Builds a Docker buildbox for FIPS
 #
 .PHONY:buildbox-fips
-buildbox-fips:
-	if [[ "$(BUILDBOX_FIPS_NAME)" == "$(BUILDBOX_FIPS)" ]]; then \
-		if [[ $${DRONE} == "true" ]] && ! docker inspect --type=image $(BUILDBOX_FIPS) 2>&1 >/dev/null; then docker pull $(BUILDBOX_FIPS) || true; fi; \
-		docker build \
-			--build-arg UID=$(UID) \
-			--build-arg GID=$(GID) \
-			--build-arg BUILDARCH=$(RUNTIME_ARCH) \
-			--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
-			--build-arg NODE_VERSION=$(NODE_VERSION) \
-			--build-arg RUST_VERSION=$(RUST_VERSION) \
-			--build-arg LIBBPF_VERSION=$(LIBBPF_VERSION) \
-			--cache-from $(BUILDBOX_FIPS) \
-			--tag $(BUILDBOX_FIPS) -f Dockerfile-fips . ; \
-	fi
+buildbox-fips: buildbox-centos7-fips
 
 #
 # Builds a Docker buildbox for CentOS 7 builds
@@ -214,31 +212,29 @@ buildbox-arm: buildbox
 		--cache-from $(BUILDBOX_ARM) \
 		--tag $(BUILDBOX_ARM) -f Dockerfile-arm .
 
-#
-# Builds a Docker buildbox for ARMv7/ARM64 FIPS builds
-# ARM buildboxes use a regular Teleport buildbox as a base which already has a user
-# with the correct UID and GID created, so those arguments are not needed here.
-#
-.PHONY:buildbox-arm-fips
-buildbox-arm-fips: buildbox-fips
-	@if [[ $${DRONE} == "true" ]] && ! docker inspect --type=image $(BUILDBOX_ARM_FIPS) 2>&1 >/dev/null; then docker pull $(BUILDBOX_ARM_FIPS) || true; fi;
-	docker build \
-		--build-arg BUILDBOX_VERSION=$(BUILDBOX_VERSION) \
-		--cache-from $(BUILDBOX_FIPS) \
-		--cache-from $(BUILDBOX_ARM_FIPS) \
-		--tag $(BUILDBOX_ARM_FIPS) -f Dockerfile-arm-fips .
-
 CONNECT_VERSION ?= $(VERSION)
 ifeq ($(CONNECT_VERSION),)
 CONNECT_VERSION := $(BUILDBOX_VERSION)-dev
 endif
 
+#
+# Builds a Docker buildbox for Linux Connect builds
+#
+.PHONY:buildbox-connect
+buildbox-connect:
+	if [[ $${DRONE} == "true" ]] && ! docker inspect --type=image $(BUILDBOX_CONNECT) 2>&1 >/dev/null; then docker pull $(BUILDBOX_CONNECT) || true; fi; \
+	DOCKER_BUILDKIT=1 docker build \
+		--build-arg NODE_VERSION=$(NODE_VERSION) \
+		--cache-from $(BUILDBOX_CONNECT) \
+		--tag $(BUILDBOX_CONNECT) -f Dockerfile-connect . ;
+
 #
 # Builds Teleport Connect inside the buildbox container.
 #
 .PHONY:teleterm
-teleterm: buildbox
-	docker run $(DOCKERFLAGS) $(NOROOT) $(BUILDBOX) \
+teleterm: buildbox-connect
+	# Always run this image as user 1000, as the Node base image assumes that.
+	docker run $(DOCKERFLAGS) -u 1000:1000 $(BUILDBOX_CONNECT) \
 		bash -c "cd $(SRCDIR) && export CONNECT_TSH_BIN_PATH=\$$PWD/../teleport/build/tsh && yarn install --frozen-lockfile && yarn build-term && yarn package-term -c.extraMetadata.version=$(CONNECT_VERSION)"
 
 # Builds webassets inside Docker.
@@ -404,8 +400,7 @@ release-amd64:
 	$(MAKE) release ARCH=amd64 FIDO2=yes
 
 .PHONY: release-amd64-fips
-release-amd64-fips:
-	$(MAKE) release-fips ARCH=amd64 FIPS=yes BUILDBOX_FIPS_NAME=$(BUILDBOX_FIPS)
+release-amd64-fips: release-amd64-centos7-fips
 
 .PHONY: release-386
 release-386:
@@ -439,9 +434,9 @@ release-arm64: buildbox-arm
 # CI should not use this target, it should use named Makefile targets like release-amd64-fips.
 #
 .PHONY:release-fips
-release-fips: buildbox-fips
+release-fips: buildbox-centos7-fips
 	@if [ -z ${VERSION} ]; then echo "VERSION is not set"; exit 1; fi
-	docker run $(DOCKERFLAGS) -i $(NOROOT) $(BUILDBOX_FIPS_NAME) \
+	docker run $(DOCKERFLAGS) -i $(NOROOT) $(BUILDBOX_CENTOS7_FIPS) \
 		/usr/bin/make -C e release -e ADDFLAGS="$(ADDFLAGS)" OS=$(OS) ARCH=$(ARCH) RUNTIME=$(GOLANG_VERSION) FIPS=yes VERSION=$(VERSION) GITTAG=v$(VERSION) REPRODUCIBLE=yes
 
 #
diff --git a/build.assets/README.md b/build.assets/README.md
index 73977bb579ecb..67f3ed0935a46 100644
--- a/build.assets/README.md
+++ b/build.assets/README.md
@@ -20,20 +20,23 @@ should be split into two stages:
    ECR.
 3. Then you can open another PR which starts using the new build box image.
 
-# DynamoDB static binary docker build 
+# DynamoDB static binary docker build
 
 The static binary will be built along with all nodejs assets inside the container.
 From the root directory of the source checkout run:
+
 ```
 docker build -f build.assets/Dockerfile.dynamodb -t teleportbuilder .
 ```
 
 Then you can upload the result to an S3 bucket for release.
+
 ```
 docker run -it -e AWS_ACL=public-read -e S3_BUCKET=my-teleport-releases -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY teleportbuilder
 ```
 
-Or simply copy the binary out of the image using a volume (it will be copied to current directory/build/teleport.
+Or simply copy the binary out of the image using a volume (it will be copied to current directory/build/teleport).
+
 ```
 docker run -v $(pwd)/build:/builds -it teleportbuilder cp /gopath/src/github.com/gravitational/teleport/teleport.tgz /builds
 ```
@@ -41,11 +44,13 @@ docker run -v $(pwd)/build:/builds -it teleportbuilder cp /gopath/src/github.com
 # OS package repo migrations
 
 An OS package repo migration is semi-manually publishing specific releases to the new APT and YUM repos. This is required in several situations:
-* A customer requests that we add an older version to the repos
-* We add another OS package repo (for example APK)
-* A OS package promotion fails (for example https://drone.platform.teleport.sh/gravitational/teleport/14666/1/3), requires a PR to fix, and we don't want to cut another minor version
+
+- A customer requests that we add an older version to the repos
+- We add another OS package repo (for example APK)
+- A OS package promotion fails (for example https://drone.platform.teleport.sh/gravitational/teleport/14666/1/3), requires a PR to fix, and we don't want to cut another minor version
 
 Multiple migrations can be performed at once. To run a migration do the following:
+
 1. Clone https://github.com/gravitational/teleport.git.
 2. Change to the directory the repo was cloned to.
 3. Create a new branch from master.
diff --git a/build.assets/flake/flake.lock b/build.assets/flake/flake.lock
new file mode 100644
index 0000000000000..bf85aebea267d
--- /dev/null
+++ b/build.assets/flake/flake.lock
@@ -0,0 +1,181 @@
+{
+  "nodes": {
+    "batsPkgs": {
+      "locked": {
+        "lastModified": 1614022514,
+        "narHash": "sha256-htMUqRk3r5s3kuixCgojWZX9nwM++xeFfeZU+3xQLCA=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "5c1ffb7a9fc96f2d64ed3523c2bdd379bdb7b471",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "5c1ffb7a9fc96f2d64ed3523c2bdd379bdb7b471",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1681202837,
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1681202837,
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "helmPkgs": {
+      "locked": {
+        "lastModified": 1678571061,
+        "narHash": "sha256-0gI2FHID8XYD3504kLFRLH3C2GmMCzVMC50APV/kZp8=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "8ad5e8132c5dcf977e308e7bf5517cc6cc0bf7d8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "8ad5e8132c5dcf977e308e7bf5517cc6cc0bf7d8",
+        "type": "github"
+      }
+    },
+    "libbpfPkgs": {
+      "locked": {
+        "lastModified": 1671056470,
+        "narHash": "sha256-rrcDHjRX9R8qXvkcGvKunsw3mf7zyPJzx1y8TPqjWdM=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "79b3d4bcae8c7007c9fd51c279a8a67acfa73a2a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "79b3d4bcae8c7007c9fd51c279a8a67acfa73a2a",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1678571061,
+        "narHash": "sha256-0gI2FHID8XYD3504kLFRLH3C2GmMCzVMC50APV/kZp8=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "8ad5e8132c5dcf977e308e7bf5517cc6cc0bf7d8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "8ad5e8132c5dcf977e308e7bf5517cc6cc0bf7d8",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1681358109,
+        "narHash": "sha256-eKyxW4OohHQx9Urxi7TQlFBTDWII+F+x2hklDOQPB50=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "96ba1c52e54e74c3197f4d43026b3f3d92e83ff9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "batsPkgs": "batsPkgs",
+        "flake-utils": "flake-utils",
+        "helmPkgs": "helmPkgs",
+        "libbpfPkgs": "libbpfPkgs",
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1686537156,
+        "narHash": "sha256-mJD80brS6h6P4jzwdKID0S9RvfyiruxgJbXvPPIDqF0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "e75da5cfc7da874401decaa88f4ccb3b4d64d20d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/build.assets/flake/flake.nix b/build.assets/flake/flake.nix
new file mode 100644
index 0000000000000..574c796039acf
--- /dev/null
+++ b/build.assets/flake/flake.nix
@@ -0,0 +1,239 @@
+# Copyright 2023 Gravitational, Inc.
+# 
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+# 
+#     http://www.apache.org/licenses/LICENSE-2.0
+# 
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# This file contains the dependencies for the Teleport nix shell, which contains
+# all of the utilities for building and linting Teleport.
+#
+
+{
+  description = "Teleport shell dependencies";
+
+  inputs = {
+    flake-utils.url = "github:numtide/flake-utils";
+    nixpkgs.url = "github:nixos/nixpkgs/8ad5e8132c5dcf977e308e7bf5517cc6cc0bf7d8"; # general packages
+    rust-overlay.url = "github:oxalica/rust-overlay";
+
+
+    # Linting dependencies
+    helmPkgs.url = "github:nixos/nixpkgs/8ad5e8132c5dcf977e308e7bf5517cc6cc0bf7d8"; # helm 3.11.1
+
+    # libbpf dependencies.
+    libbpfPkgs.url = "github:nixos/nixpkgs/79b3d4bcae8c7007c9fd51c279a8a67acfa73a2a"; # libbpf 1.0.1
+
+    # bats dependencies.
+    batsPkgs.url = "github:nixos/nixpkgs/5c1ffb7a9fc96f2d64ed3523c2bdd379bdb7b471"; # bats 1.2.1
+  };
+
+  outputs = { self,
+              flake-utils,
+              nixpkgs,
+              rust-overlay,
+
+              helmPkgs,
+              libbpfPkgs,
+              batsPkgs,
+     }:
+    flake-utils.lib.eachDefaultSystem
+      (system:
+        let
+          # These versions are not available from nixpkgs
+          gogoVersion = "v1.3.2";
+          helmUnittestVersion = "v1.0.16";
+          nodeProtocTsVersion = "v5.0.1";
+          grpcToolsVersion = "1.12.4";
+          libpcscliteVersion = "1.9.9-teleport";
+          rustVersion = "1.68.0";
+          yarnVersion = "1.22.19";
+
+          overlays = [ (import rust-overlay) ];
+
+          # Package aliases to make reusing these packages easier.
+          # The individual package names here have been determined by using
+          # https://lazamar.co.uk/nix-versions/
+          libbpf = libbpfPkgs.legacyPackages.${system}.libbpf;
+          bats = batsPkgs.legacyPackages.${system}.bats;
+
+          # pkgs is an alias for the nixpkgs at the system level. This will be used
+          # for general utilities.
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+
+          # The helm unittest plugin.
+          helm-unittest = pkgs.buildGoModule rec {
+            name = "helm-unittest";
+          
+            src = pkgs.fetchFromGitHub {
+              owner = "vbehar";
+              repo = "helm3-unittest";
+              rev = helmUnittestVersion;
+              sha256 = "sha256-2UfQimIlA+hb1CpQrWfMh5iBEvgdnrkCGYaTJC3Bzpo=";
+            };
+
+            vendorSha256 = null;
+          
+            postInstall = ''
+              install -Dm644 plugin.yaml $out/helm-unittest/plugin.yaml
+              mkdir "$out/helm-unittest/bin"
+              mv $out/bin/helm3-unittest $out/helm-unittest/bin/unittest
+            '';
+          
+            doCheck = false;
+          };
+
+          # Wrap helm with the unittest plugin.
+          helm = (pkgs.wrapHelm helmPkgs.legacyPackages.${system}.kubernetes-helm {plugins = [helm-unittest];});
+
+          libpcscliteAdditionalNativeBuildInputs = if pkgs.stdenv.isDarwin then
+            [pkgs.darwin.IOKit] else [];
+          libpcscliteAdditionalBuildInputs = if pkgs.stdenv.isLinux then
+            [pkgs.libusb1] else [];
+
+          # Compile libpcsclite.
+          libpcsclite = pkgs.stdenv.mkDerivation {
+            name = "libpcsclite";
+            src = pkgs.fetchFromGitHub {
+              owner = "gravitational";
+              repo = "PCSC";
+              rev = libpcscliteVersion;
+              sha256 = "sha256-Eig30fj7YlDHe6A/ceJ+KLhzT/ctxb9d4nFnsxk+WsA=";
+            };
+            nativeBuildInputs = [
+              pkgs.autoreconfHook
+            ] ++ libpcscliteAdditionalNativeBuildInputs;
+            buildInputs = [
+              pkgs.autoconf-archive
+              pkgs.flex
+              pkgs.gcc
+              pkgs.pkg-config
+            ] ++ libpcscliteAdditionalBuildInputs;
+            configurePhase = ''
+              ./bootstrap
+              ./configure --enable-static --with-pic --disable-libsystemd --with-systemdsystemunitdir=$out --exec-prefix=$out --prefix=$out
+            '';
+            makeFlags = [
+              "CFLAGS=\"-std=gnu99\""
+            ];
+          };
+
+          # Compile protoc-gen-gogo for golang protobuf compilation.
+          protoc-gen-gogo = pkgs.buildGoModule {
+            name = "protoc-gen-gogo";
+            version = gogoVersion;
+
+            src = pkgs.fetchFromGitHub {
+              owner = "gogo";
+              repo = "protobuf";
+              rev = gogoVersion;
+              sha256 = "sha256-CoUqgLFnLNCS9OxKFS7XwjE17SlH6iL1Kgv+0uEK2zU=";
+            };
+
+            vendorSha256 = "sha256-nOL2Ulo9VlOHAqJgZuHl7fGjz/WFAaWPdemplbQWcak=";
+
+            buildPhase = ''
+              export GOBIN="$out/bin"
+              export GOCACHE="$(mktemp -d)"
+              make install
+              cp -R protobuf "$out/protobuf"
+            '';
+          };
+
+          node-protoc-ts = pkgs.buildNpmPackage {
+            name = "grpc_tools_node_protoc_ts";
+            version = nodeProtocTsVersion;
+
+            src = pkgs.fetchFromGitHub {
+              owner = "agreatfool";
+              repo = "grpc_tools_node_protoc_ts";
+              rev = nodeProtocTsVersion;
+              sha256 = "sha256-kDrflQVENjOY7ei3+D3Znx4eUDPoja8UGG2Phv1eptA=";
+            };
+
+            npmDepsHash = "sha256-fxOyItDkkv5OAmtScD9ykq26Meh6qyZSDmWegeh+GRY=";
+          };
+
+          grpc-tools = pkgs.stdenv.mkDerivation rec {
+            pname = "grpc-tools";
+            version = grpcToolsVersion;
+          
+            src = pkgs.fetchFromGitHub {
+              owner = "grpc";
+              repo = "grpc-node";
+              rev = "grpc-tools@${grpcToolsVersion}";
+              fetchSubmodules = true;
+              sha256 = "sha256-708lBIGW5+vvSTrZHl/kc+ck7JKNXElrghIGDrMSyx8=";
+            };
+          
+            sourceRoot = "source/packages/grpc-tools";
+          
+            nativeBuildInputs = [ pkgs.cmake ];
+          
+            installPhase = ''
+              install -Dm755 -t $out/bin grpc_node_plugin
+
+              cp grpc_node_plugin grpc_tools_node_protoc_plugin
+              install -Dm755 -t $out/bin grpc_tools_node_protoc_plugin
+              
+              install -Dm755 -t $out/bin deps/protobuf/protoc
+            '';
+          };
+
+          rust = pkgs.rust-bin.stable.${rustVersion}.default;
+
+          # Yarn binary.
+          yarn = pkgs.stdenv.mkDerivation {
+            name = "yarn";
+            src = fetchTarball {
+              url = "https://yarnpkg.com/downloads/${yarnVersion}/yarn-v${yarnVersion}.tar.gz";
+              sha256 = "sha256:0jl77rl2sidsj3ym637w7g35wnv190l96n050aqlm4pyc6wi8v6p";
+            };
+            buildInputs = [
+              pkgs.nodejs-16_x
+            ];
+            buildPhase = ''
+              mkdir "$out"
+              cp -R * "$out"
+            '';
+          };
+
+          conditionalBuildInputs = if pkgs.stdenv.isLinux then [
+            bats
+            libbpf
+          ] else if pkgs.stdenv.isDarwin then [
+            pkgs.darwin.IOKit
+          ] else [
+            pkgs.hello # The derivation below will not work with an empty array, so this is a dummy package to fill it in.
+          ];
+
+          conditional = pkgs.stdenv.mkDerivation {
+            name = "conditional";
+            dontUnpack = true;
+            dontBuild = true;
+            propagatedBuildInputs = conditionalBuildInputs;
+          };
+        in
+        {
+          packages = {
+            conditional = conditional;
+            node-protoc-ts = node-protoc-ts;
+            grpc-tools = grpc-tools;
+            helm = helm;
+            libpcsclite = libpcsclite;
+            protoc-gen-gogo = protoc-gen-gogo;
+            rust = rust;
+            yarn = yarn;
+          };
+      });
+}
diff --git a/build.assets/images.mk b/build.assets/images.mk
index 6f165efde6440..5eb8a3b2aa9b9 100644
--- a/build.assets/images.mk
+++ b/build.assets/images.mk
@@ -6,12 +6,11 @@ BUILDBOX_VERSION ?= teleport14
 BUILDBOX_BASE_NAME ?= public.ecr.aws/gravitational/teleport-buildbox
 
 BUILDBOX=$(BUILDBOX_BASE_NAME):$(BUILDBOX_VERSION)
-BUILDBOX_FIPS=$(BUILDBOX_BASE_NAME)-fips:$(BUILDBOX_VERSION)
 BUILDBOX_CENTOS7=$(BUILDBOX_BASE_NAME)-centos7:$(BUILDBOX_VERSION)
 BUILDBOX_CENTOS7_FIPS=$(BUILDBOX_BASE_NAME)-centos7-fips:$(BUILDBOX_VERSION)
 BUILDBOX_ARM=$(BUILDBOX_BASE_NAME)-arm:$(BUILDBOX_VERSION)
-BUILDBOX_ARM_FIPS=$(BUILDBOX_BASE_NAME)-arm-fips:$(BUILDBOX_VERSION)
 BUILDBOX_UI=$(BUILDBOX_BASE_NAME)-ui:$(BUILDBOX_VERSION)
+BUILDBOX_CONNECT=$(BUILDBOX_BASE_NAME)-connect:$(BUILDBOX_VERSION)
 BUILDBOX_CENTOS7_ASSETS=$(BUILDBOX_BASE_NAME)-centos7-assets:$(BUILDBOX_VERSION)
 
 .PHONY:show-buildbox-base-image
diff --git a/build.assets/tooling/cmd/difftest/main.go b/build.assets/tooling/cmd/difftest/main.go
index 8183e29d64bd1..b343df0abd74a 100644
--- a/build.assets/tooling/cmd/difftest/main.go
+++ b/build.assets/tooling/cmd/difftest/main.go
@@ -60,6 +60,14 @@ var (
 		// TestProxySSH and TestList takes around 10-15s to run, largely due to the 7-10 seconds it takes to create a
 		// tsh test suite. This prevents it from ever completing the 100 runs successfully.
 		"TestProxySSH", "TestList", "TestForwardingTraces", "TestExportingTraces",
+
+		// TestDiagnoseSSHConnection takes around 15s to run.
+		// When running 100x it exceeds the 600s defined to run the tests.
+		"TestDiagnoseSSHConnection",
+
+		// TestServer_Authenticate_headless takes about 4-5 seconds to run, so if other tests are changed
+		// in the same PR that take >1 second total, it may cause the flaky test detector to time out.
+		"TestServer_Authenticate_headless",
 	}
 )
 
@@ -169,7 +177,7 @@ func test(repoPath string, ref string, changedFiles []string) {
 		}
 
 		for _, n := range r.New {
-			if slices.Contains(testsToSkip, n.RefName) {
+			if slices.Contains(testsToSkip, n.RefName) || slices.Contains(testsToSkip, "*") {
 				log.Printf("-skipping %q (%s)\n", n.RefName, dir)
 				continue
 			}
@@ -182,7 +190,7 @@ func test(repoPath string, ref string, changedFiles []string) {
 		}
 
 		for _, n := range r.Changed {
-			if slices.Contains(testsToSkip, n.RefName) {
+			if slices.Contains(testsToSkip, n.RefName) || slices.Contains(testsToSkip, "*") {
 				log.Printf("-skipping %q (%s)\n", n.RefName, dir)
 				continue
 			}
diff --git a/build.assets/tooling/cmd/render-tests/_sample/README.md b/build.assets/tooling/cmd/render-tests/_sample/README.md
new file mode 100644
index 0000000000000..566f256084672
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/_sample/README.md
@@ -0,0 +1,8 @@
+This is a dummy Go module for the purposes of generating test data for
+render-test. Run:
+
+    go test -cover -json ./...
+
+Modify some of the test files to make them fail or to skip tests to
+vary the data. The output is stored in files in the `../testdata/`
+directory.
diff --git a/build.assets/tooling/cmd/render-tests/_sample/go.mod b/build.assets/tooling/cmd/render-tests/_sample/go.mod
new file mode 100644
index 0000000000000..1dbc6becd677f
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/_sample/go.mod
@@ -0,0 +1,3 @@
+module example.com
+
+go 1.20
diff --git a/web/packages/teleport/src/Assist/Chat/index.ts b/build.assets/tooling/cmd/render-tests/_sample/package1/foo.go
similarity index 79%
rename from web/packages/teleport/src/Assist/Chat/index.ts
rename to build.assets/tooling/cmd/render-tests/_sample/package1/foo.go
index c1c6b784089a7..5d8639df6613a 100644
--- a/web/packages/teleport/src/Assist/Chat/index.ts
+++ b/build.assets/tooling/cmd/render-tests/_sample/package1/foo.go
@@ -14,4 +14,18 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-export { Chat } from './Chat';
+package package1
+
+import "fmt"
+
+func foo() {
+	fmt.Println("hello world: foo")
+}
+
+func foo2() {
+	x := 1
+	if x > 2 {
+		x++
+	}
+	fmt.Println("x = ", x)
+}
diff --git a/build.assets/tooling/cmd/render-tests/_sample/package1/foo_test.go b/build.assets/tooling/cmd/render-tests/_sample/package1/foo_test.go
new file mode 100644
index 0000000000000..9d946ad6ab107
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/_sample/package1/foo_test.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package package1
+
+import "testing"
+
+func Test1(t *testing.T) {
+	t.Log("doing stuff")
+	foo2()
+	// t.Fatal("fail") // uncomment for flaky result
+}
+
+func Test2(t *testing.T) {
+	t.Log("stuff doing")
+}
diff --git a/web/packages/teleport/src/Assist/Sidebar/index.ts b/build.assets/tooling/cmd/render-tests/_sample/package2/bar.go
similarity index 89%
rename from web/packages/teleport/src/Assist/Sidebar/index.ts
rename to build.assets/tooling/cmd/render-tests/_sample/package2/bar.go
index 813fb0ef8bc9e..14db46ba46c4c 100644
--- a/web/packages/teleport/src/Assist/Sidebar/index.ts
+++ b/build.assets/tooling/cmd/render-tests/_sample/package2/bar.go
@@ -14,4 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-export { Sidebar } from './Sidebar';
+package package2
+
+import "fmt"
+
+func bar() {
+	fmt.Println("bar")
+}
diff --git a/web/packages/teleport/src/services/ping/types.ts b/build.assets/tooling/cmd/render-tests/_sample/package2/bar_test.go
similarity index 85%
rename from web/packages/teleport/src/services/ping/types.ts
rename to build.assets/tooling/cmd/render-tests/_sample/package2/bar_test.go
index 480f59a6989ea..11714c70ed15a 100644
--- a/web/packages/teleport/src/services/ping/types.ts
+++ b/build.assets/tooling/cmd/render-tests/_sample/package2/bar_test.go
@@ -14,7 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-export interface PingResponse {
-  automaticUpgrades: boolean;
-  assistEnabled: boolean;
+package package2
+
+import "testing"
+
+func Test3(t *testing.T) {
+	// t.Fatal("not implemented")
 }
diff --git a/build.assets/tooling/cmd/render-tests/_sample/package3/baz_test.go b/build.assets/tooling/cmd/render-tests/_sample/package3/baz_test.go
new file mode 100644
index 0000000000000..3f42b3e11f57c
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/_sample/package3/baz_test.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package package3
+
+import "testing"
+
+func Test4(t *testing.T) {
+	// t.Fatal("sometimes I flake") // uncomment for flaky results
+}
+
+func Test5(t *testing.T) {
+	// t.Fatal("nevermind") // uncomment for flaky result
+}
diff --git a/build.assets/tooling/cmd/render-tests/args.go b/build.assets/tooling/cmd/render-tests/args.go
index 4debec4909e72..855eb7e6ca18c 100644
--- a/build.assets/tooling/cmd/render-tests/args.go
+++ b/build.assets/tooling/cmd/render-tests/args.go
@@ -27,13 +27,15 @@ import (
 type reportMode int
 
 const (
-	byPackage reportMode = 0
-	byTest    reportMode = iota
+	byPackage reportMode = iota
+	byTest
+	byFlakiness
 )
 
 const (
-	byPackageName = "package"
-	byTestName    = "test"
+	byPackageName   = "package"
+	byTestName      = "test"
+	byFlakinessName = "flakiness"
 )
 
 func (m *reportMode) String() string {
@@ -44,6 +46,9 @@ func (m *reportMode) String() string {
 	case byTest:
 		return byTestName
 
+	case byFlakiness:
+		return byFlakinessName
+
 	default:
 		return fmt.Sprintf("Unknown filter mode %d", *m)
 	}
@@ -57,6 +62,9 @@ func (m *reportMode) Set(text string) error {
 	case byTestName:
 		(*m) = byTest
 
+	case byFlakinessName:
+		(*m) = byFlakiness
+
 	default:
 		return trace.Errorf("Invalid report mode %q", text)
 	}
@@ -65,14 +73,22 @@ func (m *reportMode) Set(text string) error {
 }
 
 type args struct {
-	report reportMode
+	report      reportMode
+	top         int
+	summaryFile string
 }
 
-func parseCommandLine() args {
-	reportMode := byPackage
-	flag.Var(&reportMode, "report-by",
-		fmt.Sprintf("test reporting mode [%s, %s]", byPackageName, byTestName))
+func parseCommandLine() (args, error) {
+	var a args
+	flag.Var(&a.report, "report-by",
+		fmt.Sprintf("test reporting mode [%s, %s, %s]", byPackageName, byTestName, byFlakinessName))
+	flag.IntVar(&a.top, "top", 0, "top number of flaky tests to report [default 0 - all]")
+	flag.StringVar(&a.summaryFile, "summary-file", "", "file to write summary to")
 	flag.Parse()
 
-	return args{report: reportMode}
+	if a.top != 0 && a.report != byFlakiness {
+		return args{}, trace.Errorf("-top <n> can only be used with -report-by flakiness")
+	}
+
+	return a, nil
 }
diff --git a/build.assets/tooling/cmd/render-tests/main.go b/build.assets/tooling/cmd/render-tests/main.go
index 8f637c9e06264..6388786928395 100644
--- a/build.assets/tooling/cmd/render-tests/main.go
+++ b/build.assets/tooling/cmd/render-tests/main.go
@@ -27,16 +27,11 @@ import (
 	"io"
 	"os"
 	"os/signal"
-	"regexp"
-	"sort"
-	"strconv"
 	"time"
 
 	"github.com/gravitational/trace"
 )
 
-var covPattern = regexp.MustCompile(`^coverage: (\d+\.\d+)\% of statements`)
-
 // matches `event` in src/cmd/internal/test2json/test2json.go
 type TestEvent struct {
 	Time           time.Time // encodes as an RFC3339-format string
@@ -47,62 +42,37 @@ type TestEvent struct {
 	Output         string
 }
 
-func (e *TestEvent) FullName() string {
-	if e.Test == "" {
-		return e.Package
-	}
-	return e.Package + "." + e.Test
-}
-
-// action names used by the go test runner in its JSON output
-const (
-	actionPass   = "pass"
-	actionFail   = "fail"
-	actionSkip   = "skip"
-	actionOutput = "output"
-)
-
-// separator for console output
-const separator = "==================================================="
-
 func readInput(input io.Reader, ch chan<- TestEvent, errCh chan<- error) {
 	defer close(ch)
 	decoder := json.NewDecoder(input)
-	for {
+	var err error
+	for err == nil {
 		event := TestEvent{}
-
-		err := decoder.Decode(&event)
-		if errors.Is(err, io.EOF) {
-			return
+		if err = decoder.Decode(&event); err == nil {
+			ch <- event
 		}
+	}
 
-		if err != nil {
-			fmt.Printf("Error parsing JSON test record: %v\n", err)
-
-			scanner := bufio.NewScanner(decoder.Buffered())
-			for scanner.Scan() {
-				line := scanner.Text()
-				if line != "" {
-					err = trace.Errorf(line)
-					break
-				}
+	if !errors.Is(err, io.EOF) {
+		fmt.Printf("Error parsing JSON test record: %v\n", err)
+		scanner := bufio.NewScanner(decoder.Buffered())
+		for scanner.Scan() {
+			line := scanner.Text()
+			if line != "" {
+				err = trace.Errorf(line)
+				break
 			}
-
-			errCh <- err
-
-			return
 		}
-
-		ch <- event
+		errCh <- err
 	}
 }
 
 func main() {
-	args := parseCommandLine()
-
-	testOutput := newOutputMap()
-	failedPackages := make(map[string]*packageOutput)
-	coverage := make(map[string]float64)
+	args, err := parseCommandLine()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
 
 	events := make(chan TestEvent)
 	errors := make(chan error)
@@ -111,124 +81,49 @@ func main() {
 	signals := make(chan os.Signal, 1)
 	signal.Notify(signals, os.Interrupt)
 
-readloop:
-	for {
+	var summaryOut io.Writer = os.Stdout
+	if args.summaryFile != "" {
+		f, err := os.Create(args.summaryFile)
+		if err != nil {
+			// Don't fatally exit, because we should still summarize the
+			// results to stdout
+			fmt.Fprintf(os.Stderr, "Could not create summary file: %v\n", err)
+		} else {
+			summaryOut = io.MultiWriter(os.Stdout, f)
+			defer f.Close()
+		}
+	}
+
+	rr := newRunResult(args.report, args.top)
+	ok := true
+	for ok {
+		var event TestEvent
 		select {
 		case <-signals:
-			break readloop
+			ok = false
 
 		case err := <-errors:
 			fmt.Printf("FATAL error: %q\n", err)
+			ok = false
 
-		case event, keepGoing := <-events:
-			if !keepGoing {
-				break readloop
-			}
-
-			testName := event.FullName()
-
-			testOutput.record(event)
-
-			if args.report == byTest {
-				switch event.Action {
-				case actionPass, actionFail, actionSkip:
-					fmt.Printf("%s (in %6.2fs): %s\n", event.Action, event.ElapsedSeconds, event.FullName())
-				}
-			}
-
-			// if this is whole-package summary result
-			if event.Test == "" {
-				switch event.Action {
-				case actionOutput:
-					if matches := covPattern.FindStringSubmatch(event.Output); len(matches) != 0 {
-						value, err := strconv.ParseFloat(matches[1], 64)
-						if err != nil {
-							panic("Malformed coverage value: " + err.Error())
-						}
-						coverage[testName] = value
-					}
-
-				case actionFail:
-					// cache the failed test output
-					failedPackages[event.Package] = testOutput.getPkg(event.Package)
-					fallthrough
-
-				case actionPass, actionSkip:
-					if args.report == byPackage {
-						// extract and format coverage value
-						covText := "------"
-						if covValue, ok := coverage[testName]; ok {
-							covText = fmt.Sprintf("%5.1f%%", covValue)
-						}
-
-						// only display package results as progress messages
-						fmt.Printf("%s %s (in %6.2fs): %s\n", covText, event.Action, event.ElapsedSeconds, event.Package)
-					}
-
-					// Don't need this no more
-					testOutput.deletePkg(event.Package)
-				}
+		case event, ok = <-events:
+			if ok {
+				rr.processTestEvent(event)
+				rr.printTestResult(os.Stdout, event)
 			}
 		}
 	}
 
-	fmt.Println(separator)
-
-	fmt.Printf("%d tests passed. %d failed, %d skipped\n",
-		testOutput.actionCounts[actionPass], testOutput.actionCounts[actionFail], testOutput.actionCounts[actionSkip])
-
-	fmt.Println(separator)
-
-	if len(failedPackages) == 0 {
-		fmt.Println("All tests pass. Yay!")
-		os.Exit(0)
-	}
-
-	// Generate a sorted list of package names, so that we present the
-	// packages that fail in a repeatable order.
-	names := make([]string, 0, len(failedPackages))
-	for k := range failedPackages {
-		names = append(names, k)
-	}
-	sort.Strings(names)
-
-	// Print a summary list of the failed tests and packages.
-	for _, pkgName := range names {
-		pkg := failedPackages[pkgName]
-
-		fmt.Printf("FAIL: %s\n", pkgName)
-
-		for testName := range pkg.failedSubtests {
-			fmt.Printf("FAIL: %s.%s\n", pkgName, testName)
-		}
+	if args.report == byFlakiness {
+		rr.printFlakinessSummary(summaryOut)
+	} else {
+		rr.printSummary(summaryOut)
 	}
+	fmt.Fprintln(os.Stdout, separator)
+	rr.printFailedTestOutput(os.Stdout)
 
-	fmt.Println(separator)
-
-	// Print the output of each failed package or test. Note that we only print
-	// the package output if there is no identifiable test that caused the
-	// failure, as it will probably swamp the individual test output.
-	for _, pkgName := range names {
-		pkg := failedPackages[pkgName]
-
-		if len(pkg.failedSubtests) == 0 {
-			fmt.Printf("OUTPUT %s\n", pkgName)
-			fmt.Println(separator)
-			for _, l := range pkg.output {
-				fmt.Print(l)
-			}
-			fmt.Println(separator)
-		} else {
-			for _, testName := range pkg.FailedTests() {
-				fmt.Printf("OUTPUT %s.%s\n", pkgName, testName)
-				fmt.Println(separator)
-				for _, l := range pkg.failedSubtests[testName] {
-					fmt.Print(l)
-				}
-				fmt.Println(separator)
-			}
-		}
+	if rr.testCount.fail == 0 {
+		os.Exit(0)
 	}
-
 	os.Exit(1)
 }
diff --git a/build.assets/tooling/cmd/render-tests/main_test.go b/build.assets/tooling/cmd/render-tests/main_test.go
new file mode 100644
index 0000000000000..c2f8117f1d35c
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/main_test.go
@@ -0,0 +1,66 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestReadInput(t *testing.T) {
+	// var passFailPass and func strToEvents in result_test.go
+	expected := strToEvents(t, passFailPass)
+	eventChan := make(chan TestEvent)
+	errChan := make(chan error)
+
+	actual := []TestEvent{}
+	go readInput(strings.NewReader(passFailPass), eventChan, errChan)
+	ok := true
+	for ok {
+		var event TestEvent
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		case event, ok = <-eventChan:
+			if ok {
+				actual = append(actual, event)
+			}
+		}
+	}
+
+	require.Equal(t, expected, actual)
+}
+
+func TestReadInputFail(t *testing.T) {
+	// var passFailPass and func strToEvents in result_test.go
+	eventChan := make(chan TestEvent)
+	errChan := make(chan error)
+
+	go readInput(strings.NewReader(passFailPass+"bad json data\noh no\n"), eventChan, errChan)
+	ok := true
+	var err error
+	for ok {
+		select {
+		case err = <-errChan:
+		case _, ok = <-eventChan:
+		}
+	}
+
+	require.Error(t, err)
+}
diff --git a/build.assets/tooling/cmd/render-tests/outputMap.go b/build.assets/tooling/cmd/render-tests/outputMap.go
deleted file mode 100644
index 48d51d680a747..0000000000000
--- a/build.assets/tooling/cmd/render-tests/outputMap.go
+++ /dev/null
@@ -1,90 +0,0 @@
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package main
-
-import "sort"
-
-type packageOutput struct {
-	output         []string
-	subtestOutput  map[string][]string
-	failedSubtests map[string][]string
-}
-
-func (pkg *packageOutput) FailedTests() []string {
-	result := []string{}
-	for testName := range pkg.failedSubtests {
-		result = append(result, testName)
-	}
-	sort.Strings(result)
-	return result
-}
-
-type outputMap struct {
-	packages     map[string]*packageOutput
-	actionCounts map[string]int
-}
-
-func newOutputMap() *outputMap {
-	return &outputMap{
-		packages:     make(map[string]*packageOutput),
-		actionCounts: make(map[string]int),
-	}
-}
-
-func (m *outputMap) record(event TestEvent) {
-	m.actionCounts[event.Action]++
-
-	var pkgOutput *packageOutput
-	var exists bool
-	if pkgOutput, exists = m.packages[event.Package]; !exists {
-		pkgOutput = &packageOutput{
-			subtestOutput:  make(map[string][]string),
-			failedSubtests: make(map[string][]string),
-		}
-		m.packages[event.Package] = pkgOutput
-	}
-
-	switch event.Action {
-	case actionOutput:
-		pkgOutput.output = append(pkgOutput.output, event.Output)
-		if event.Test != "" {
-			pkgOutput.subtestOutput[event.Test] = append(pkgOutput.subtestOutput[event.Test], event.Output)
-		}
-
-	case actionFail:
-		// If this is a single test result
-		if event.Test != "" {
-			pkgOutput.failedSubtests[event.Test] = pkgOutput.subtestOutput[event.Test]
-		} else {
-			// If this is a package result, we only want to preserve the package output if
-			// there are no failed subtests
-			if len(pkgOutput.failedSubtests) > 0 {
-				pkgOutput.output = nil
-			}
-		}
-		fallthrough
-
-	case actionPass, actionSkip:
-		delete(pkgOutput.subtestOutput, event.Test)
-	}
-}
-
-func (m *outputMap) getPkg(pkgName string) *packageOutput {
-	return m.packages[pkgName]
-}
-
-func (m *outputMap) deletePkg(pkgName string) {
-	delete(m.packages, pkgName)
-}
diff --git a/build.assets/tooling/cmd/render-tests/result.go b/build.assets/tooling/cmd/render-tests/result.go
new file mode 100644
index 0000000000000..4f9b91c8ebcfe
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/result.go
@@ -0,0 +1,330 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"io"
+	"regexp"
+	"sort"
+	"strconv"
+
+	"golang.org/x/exp/maps"
+)
+
+// separator for console output
+const separator = "==================================================="
+
+// action names used by the go test runner in its JSON output
+const (
+	actionPass   = "pass"
+	actionFail   = "fail"
+	actionSkip   = "skip"
+	actionOutput = "output"
+)
+
+// covPattern matches output that contains package coverage values
+var covPattern = regexp.MustCompile("\t" + `coverage: (\d+\.\d+)\% of statements`)
+
+type counts struct {
+	total int
+	pass  int
+	fail  int
+	skip  int
+}
+
+func (c *counts) record(action string) {
+	c.total++
+	switch action {
+	case actionPass:
+		c.pass++
+	case actionFail:
+		c.fail++
+	case actionSkip:
+		c.skip++
+	}
+}
+
+func (c counts) String() string {
+	return fmt.Sprintf("%d passed, %d failed, %d skipped", c.pass, c.fail, c.skip)
+}
+
+func (c counts) failureRate() float64 {
+	return float64(c.fail) / float64(c.total)
+}
+
+// runResult records the results of an entire test run piped into render-tests.
+type runResult struct {
+	pkgCount  counts
+	testCount counts
+	packages  map[string]*packageResult
+	reportBy  reportMode
+	top       int
+}
+
+// packageResult records the test results of a single Go package including the
+// individual tests within that package.
+type packageResult struct {
+	name     string
+	count    counts
+	coverage *float64
+	output   []string
+	tests    map[string]*testResult
+}
+
+// testResult records the results of a single test.
+type testResult struct {
+	name   string
+	count  counts
+	output []string
+}
+
+func newRunResult(reportBy reportMode, top int) *runResult {
+	return &runResult{
+		packages: map[string]*packageResult{},
+		reportBy: reportBy,
+		top:      top,
+	}
+}
+
+func newPackageResult(name string) *packageResult {
+	return &packageResult{
+		name:  name,
+		tests: map[string]*testResult{},
+	}
+}
+
+func newTestResult(name string) *testResult {
+	return &testResult{
+		name: name,
+	}
+}
+
+func (rr *runResult) getPackage(name string) *packageResult {
+	if pkg, ok := rr.packages[name]; ok {
+		return pkg
+	}
+	pkg := newPackageResult(name)
+	rr.packages[name] = pkg
+	return pkg
+}
+
+func (rr *runResult) processTestEvent(te TestEvent) {
+	pkg := rr.getPackage(te.Package)
+	pkg.processTestEvent(te)
+
+	if te.Test == "" {
+		rr.pkgCount.record(te.Action)
+	} else {
+		rr.testCount.record(te.Action)
+	}
+}
+
+func (rr *runResult) printTestResult(out io.Writer, te TestEvent) {
+	if !isTestResult(te.Action) {
+		return
+	}
+
+	// Report each completion of packages and tests when reporting by test
+	if rr.reportBy == byTest {
+		testname := te.Package
+		if te.Test != "" {
+			testname += "." + te.Test
+		}
+		fmt.Fprintf(out, "%s (in %6.2fs): %s\n", te.Action, te.ElapsedSeconds, testname)
+	} else if rr.reportBy == byPackage && te.Test == "" {
+		pkg := rr.getPackage(te.Package)
+		covText := "------"
+		if pkg.coverage != nil {
+			covText = fmt.Sprintf("%5.1f%%", *pkg.coverage)
+		}
+		fmt.Fprintf(out, "%s %s (in %6.2fs): %s\n", te.Action, covText, te.ElapsedSeconds, pkg.name)
+	}
+}
+
+func (rr *runResult) printSummary(out io.Writer) {
+	fmt.Fprintln(out, separator)
+	fmt.Fprintln(out, "Tests:", rr.testCount)
+	fmt.Fprintln(out, "Packages:", rr.pkgCount)
+	fmt.Fprintln(out, separator)
+
+	if rr.testCount.fail == 0 {
+		fmt.Fprintln(out, "All tests pass. Yay!")
+		return
+	}
+	rr.printFailedTests(out)
+}
+
+func (rr *runResult) printFlakinessSummary(out io.Writer) {
+	if rr.testCount.fail == 0 {
+		fmt.Fprintln(out, "No flaky tests!")
+		return
+	}
+
+	// get all failed tests so we can get the top N flaky failures
+	var alltests []*testResult
+	for _, pkg := range rr.packages {
+		if pkg.count.fail == 0 {
+			continue
+		}
+		for _, test := range pkg.tests {
+			if test.count.fail > 0 {
+				alltests = append(alltests, test)
+			}
+		}
+		// Create a pseudo-test result for the package level output
+		// as it can contain relevant output not included in individual
+		// tests such as crash or data race output.
+		tr := &testResult{
+			name:   pkg.name,
+			count:  pkg.count,
+			output: pkg.output,
+		}
+		alltests = append(alltests, tr)
+	}
+	// reverse sort by failure rate
+	sort.Slice(alltests, func(i, j int) bool {
+		return alltests[i].count.failureRate() > alltests[j].count.failureRate()
+	})
+	for i, test := range alltests {
+		if rr.top != 0 && i >= rr.top {
+			break
+		}
+		fmt.Fprintf(out, "FAIL(%d/%d): %s\n", test.count.fail, test.count.total, test.name)
+	}
+}
+
+// printFailedTests prints a summary list of the failed tests and packages in
+// the given packages.
+func (rr *runResult) printFailedTests(out io.Writer) {
+	// Order the packages by name for consistent output ordering.
+	pkgs := maps.Values(rr.packages)
+	sort.Slice(pkgs, func(i, j int) bool { return pkgs[i].name < pkgs[j].name })
+
+	for _, pkg := range pkgs {
+		if pkg.count.fail == 0 {
+			continue
+		}
+		fmt.Fprintf(out, "FAIL: %s\n", pkg.name)
+		for _, test := range pkg.tests {
+			if test.count.fail == 0 {
+				continue
+			}
+			fmt.Fprintf(out, "FAIL: %s\n", test.name)
+		}
+	}
+}
+
+// printFailedTestOutput prints the output of each failed package or test. Only
+// print the package output if there is no test that failed (how can this
+// happen?) so as to not swamp individual test output.
+func (rr *runResult) printFailedTestOutput(out io.Writer) {
+	// Order the packages by name for consistent output ordering.
+	pkgs := maps.Values(rr.packages)
+	sort.Slice(pkgs, func(i, j int) bool { return pkgs[i].name < pkgs[j].name })
+
+	for _, pkg := range pkgs {
+		if pkg.count.fail == 0 {
+			continue
+		}
+		printOutput(out, pkg.name, pkg.output)
+		for _, test := range pkg.tests {
+			if test.count.fail == 0 {
+				continue
+			}
+			printOutput(out, test.name, test.output)
+		}
+	}
+}
+
+func printOutput(out io.Writer, test string, output []string) {
+	fmt.Fprintf(out, "OUTPUT %s\n", test)
+	fmt.Fprintln(out, separator)
+	for _, line := range output {
+		fmt.Fprint(out, line)
+	}
+	fmt.Fprintln(out, separator)
+}
+
+func (pr *packageResult) processTestEvent(te TestEvent) {
+	if te.Test != "" {
+		tst := pr.getTest(pr.name + "." + te.Test)
+		tst.processTestEvent(te)
+		return
+	}
+
+	if te.Action == actionOutput {
+		// Only append output if no failures. We only record the output
+		// of the first failure so we don't store too much redundant output.
+		if pr.count.fail == 0 {
+			pr.output = append(pr.output, te.Output)
+		}
+		if matches := covPattern.FindStringSubmatch(te.Output); len(matches) > 0 {
+			value, err := strconv.ParseFloat(matches[1], 64)
+			if err != nil {
+				panic("Malformed coverage value: " + err.Error())
+			}
+			pr.coverage = &value
+		}
+	}
+
+	if !isTestResult(te.Action) {
+		return
+	}
+
+	pr.count.record(te.Action)
+
+	// Delete test output of passed / skipped packages. Only save output of failures.
+	if pr.count.fail == 0 && (te.Action == actionPass || te.Action == actionSkip) {
+		pr.output = nil
+	}
+}
+
+func (pr *packageResult) getTest(name string) *testResult {
+	if tst, ok := pr.tests[name]; ok {
+		return tst
+	}
+	tst := newTestResult(name)
+	pr.tests[name] = tst
+	return tst
+
+}
+
+func (tr *testResult) processTestEvent(te TestEvent) {
+	if te.Action == actionOutput {
+		// Only append output if no failures. We only record the output
+		// of the first failure so we don't store too much redundant output.
+		if tr.count.fail == 0 {
+			tr.output = append(tr.output, te.Output)
+		}
+	}
+
+	if !isTestResult(te.Action) {
+		return
+	}
+
+	tr.count.record(te.Action)
+
+	// Delete test output of passed / skipped tests. Only save output of failures.
+	if tr.count.fail == 0 && (te.Action == actionPass || te.Action == actionSkip) {
+		tr.output = nil
+	}
+}
+
+func isTestResult(action string) bool {
+	return action == actionPass || action == actionFail || action == actionSkip
+}
diff --git a/build.assets/tooling/cmd/render-tests/result_test.go b/build.assets/tooling/cmd/render-tests/result_test.go
new file mode 100644
index 0000000000000..a3c643c6813a5
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/result_test.go
@@ -0,0 +1,267 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"bytes"
+	_ "embed"
+	"encoding/json"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	//go:embed testdata/pass-pass-pass.in
+	passPassPass string
+
+	//go:embed testdata/pass-fail-pass.in
+	passFailPass string
+
+	//go:embed testdata/pass-fail-skip.in
+	passFailSkip string
+
+	//go:embed testdata/flaky-pass.in
+	flakyPass string
+	//go:embed testdata/flaky-fail-1.in
+	flakyFail1 string
+	//go:embed testdata/flaky-fail-4.in
+	flakyFail4 string
+	//go:embed testdata/flaky-fail-5.in
+	flakyFail5 string
+)
+
+func TestHierarchy(t *testing.T) {
+	rr := newRunResult(byPackage, 0)
+	feedEvents(t, rr, passFailSkip)
+
+	pkgname := "example.com/package"
+	require.Contains(t, rr.packages, pkgname)
+	pkg := rr.packages[pkgname]
+	require.Contains(t, pkg.tests, pkgname+".TestParse")
+	require.Contains(t, pkg.tests, pkgname+".TestEmpty")
+	require.Contains(t, pkg.tests, pkgname+".TestParseHostPort")
+}
+
+func TestStatus(t *testing.T) {
+	rr := newRunResult(byPackage, 0)
+	feedEvents(t, rr, passFailSkip)
+
+	require.Equal(t, 1, rr.testCount.pass)
+	require.Equal(t, 1, rr.testCount.fail)
+	require.Equal(t, 1, rr.testCount.skip)
+	require.Equal(t, 1, rr.pkgCount.fail)
+	pkgname := "example.com/package"
+	pkg := rr.packages[pkgname]
+	require.Equal(t, 1, pkg.count.fail)
+	require.Equal(t, 1, pkg.tests[pkgname+".TestEmpty"].count.pass)
+	require.Equal(t, 1, pkg.tests[pkgname+".TestParse"].count.fail)
+	require.Equal(t, 1, pkg.tests[pkgname+".TestParseHostPort"].count.skip)
+}
+
+func TestSuccessOutput(t *testing.T) {
+	rr := newRunResult(byPackage, 0)
+	feedEvents(t, rr, passPassPass)
+
+	pkgname := "example.com/package"
+	pkg := rr.packages[pkgname]
+	require.Empty(t, pkg.output)
+	require.Empty(t, pkg.tests[pkgname+".TestEmpty"].output)
+	require.Empty(t, pkg.tests[pkgname+".TestParseHostPort"].output)
+	require.Empty(t, pkg.tests[pkgname+".TestParse"].output)
+}
+
+func TestFailureOutput(t *testing.T) {
+	rr := newRunResult(byPackage, 0)
+	feedEvents(t, rr, passFailSkip)
+
+	pkgname := "example.com/package"
+	pkg := rr.packages[pkgname]
+	require.Empty(t, pkg.tests[pkgname+".TestEmpty"].output)
+	require.Empty(t, pkg.tests[pkgname+".TestParseHostPort"].output)
+	expectedTestOutput := []string{
+		"=== RUN   TestParse\n",
+		"=== PAUSE TestParse\n",
+		"=== CONT  TestParse\n",
+		"    addr_test.go:71: failed\n",
+		"--- FAIL: TestParse (0.00s)\n",
+	}
+	expectedPkgOutput := []string{
+		"FAIL\n",
+		"\texample.com/package\tcoverage: 2.4% of statements\n",
+		"FAIL\texample.com/package\t0.007s\n",
+	}
+	require.Equal(t, expectedTestOutput, pkg.tests[pkgname+".TestParse"].output)
+	require.Equal(t, expectedPkgOutput, pkg.output)
+}
+
+func TestPrintTestResultByPackage(t *testing.T) {
+	output := &bytes.Buffer{}
+	events := strToEvents(t, passFailSkip)
+	rr := newRunResult(byPackage, 0)
+	for _, event := range events {
+		rr.processTestEvent(event)
+		rr.printTestResult(output, event)
+	}
+
+	expected := "fail   2.4% (in   0.01s): example.com/package\n"
+	require.Equal(t, expected, output.String())
+}
+
+func TestPrintTestResultByTest(t *testing.T) {
+	output := &bytes.Buffer{}
+	events := strToEvents(t, passFailSkip)
+	rr := newRunResult(byTest, 0)
+	for _, event := range events {
+		rr.processTestEvent(event)
+		rr.printTestResult(output, event)
+	}
+
+	expected := `
+skip (in   0.00s): example.com/package.TestParseHostPort
+pass (in   0.00s): example.com/package.TestEmpty
+fail (in   0.00s): example.com/package.TestParse
+fail (in   0.01s): example.com/package
+`[1:]
+	require.Equal(t, expected, output.String())
+}
+
+func TestPrintSummaryNoFail(t *testing.T) {
+	rr := newRunResult(byTest, 0)
+	feedEvents(t, rr, passPassPass)
+
+	output := &bytes.Buffer{}
+	rr.printSummary(output)
+
+	expected := `
+===================================================
+Tests: 3 passed, 0 failed, 0 skipped
+Packages: 1 passed, 0 failed, 0 skipped
+===================================================
+All tests pass. Yay!
+`[1:]
+	require.Equal(t, expected, output.String())
+}
+
+func TestPrintSummaryFail(t *testing.T) {
+	rr := newRunResult(byPackage, 0)
+	feedEvents(t, rr, passFailPass)
+
+	output := &bytes.Buffer{}
+	rr.printSummary(output)
+
+	expected := `
+===================================================
+Tests: 1 passed, 1 failed, 1 skipped
+Packages: 1 passed, 1 failed, 0 skipped
+===================================================
+FAIL: example.com/package
+FAIL: example.com/package.TestParse
+`[1:]
+	require.Equal(t, expected, output.String())
+}
+
+func TestPrintFailedTestOutput(t *testing.T) {
+	rr := newRunResult(byPackage, 0)
+	feedEvents(t, rr, passFailPass)
+
+	output := &bytes.Buffer{}
+	rr.printFailedTestOutput(output)
+
+	expected := `
+OUTPUT example.com/package
+===================================================
+FAIL
+	example.com/package	coverage: 2.4% of statements
+FAIL	example.com/package	0.007s
+===================================================
+OUTPUT example.com/package.TestParse
+===================================================
+=== RUN   TestParse
+=== PAUSE TestParse
+=== CONT  TestParse
+    addr_test.go:71: failed
+--- FAIL: TestParse (0.00s)
+===================================================
+`[1:]
+	require.Equal(t, expected, output.String())
+}
+
+func TestPrintFlakinessSummaryNoFail(t *testing.T) {
+	rr := newRunResult(byFlakiness, 2) // top 2 failures only
+	feedEvents(t, rr, flakyPass)
+	feedEvents(t, rr, flakyPass)
+	feedEvents(t, rr, flakyPass)
+	feedEvents(t, rr, flakyPass)
+
+	output := &bytes.Buffer{}
+	rr.printFlakinessSummary(output)
+
+	expected := "No flaky tests!\n"
+	require.Equal(t, expected, output.String())
+}
+
+func TestPrintFlakinessSummaryFail(t *testing.T) {
+	rr := newRunResult(byFlakiness, 3) // top 3 failures only (including packages)
+	feedEvents(t, rr, flakyPass)
+	feedEvents(t, rr, flakyFail1)
+	feedEvents(t, rr, flakyPass)
+	feedEvents(t, rr, flakyFail4)
+	feedEvents(t, rr, flakyFail5)
+	feedEvents(t, rr, flakyFail5)
+	feedEvents(t, rr, flakyFail5)
+	feedEvents(t, rr, flakyPass)
+	feedEvents(t, rr, flakyFail1)
+	feedEvents(t, rr, flakyPass)
+
+	output := &bytes.Buffer{}
+	rr.printFlakinessSummary(output)
+
+	expected := `
+FAIL(4/10): example.com/package3
+FAIL(3/10): example.com/package3.Test5
+FAIL(2/10): example.com/package1.Test1
+`[1:]
+	require.Equal(t, expected, output.String())
+}
+
+func strToEvents(t *testing.T, s string) []TestEvent {
+	t.Helper()
+	result := []TestEvent{}
+	decoder := json.NewDecoder(strings.NewReader(s))
+	for {
+		event := TestEvent{}
+		err := decoder.Decode(&event)
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		require.NoError(t, err)
+		result = append(result, event)
+	}
+	return result
+}
+
+func feedEvents(t *testing.T, rr *runResult, s string) {
+	t.Helper()
+	events := strToEvents(t, s)
+	for _, event := range events {
+		rr.processTestEvent(event)
+	}
+}
diff --git a/build.assets/tooling/cmd/render-tests/testdata/flaky-fail-1.in b/build.assets/tooling/cmd/render-tests/testdata/flaky-fail-1.in
new file mode 100644
index 0000000000000..0d777c5380466
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/testdata/flaky-fail-1.in
@@ -0,0 +1,39 @@
+{"Time":"2023-05-30T15:37:05.506456445+10:00","Action":"start","Package":"example.com/package1"}
+{"Time":"2023-05-30T15:37:05.506570915+10:00","Action":"start","Package":"example.com/package2"}
+{"Time":"2023-05-30T15:37:05.506620642+10:00","Action":"run","Package":"example.com/package2","Test":"Test3"}
+{"Time":"2023-05-30T15:37:05.50663482+10:00","Action":"output","Package":"example.com/package2","Test":"Test3","Output":"=== RUN   Test3\n"}
+{"Time":"2023-05-30T15:37:05.506647252+10:00","Action":"output","Package":"example.com/package2","Test":"Test3","Output":"--- PASS: Test3 (0.00s)\n"}
+{"Time":"2023-05-30T15:37:05.506654935+10:00","Action":"pass","Package":"example.com/package2","Test":"Test3","Elapsed":0}
+{"Time":"2023-05-30T15:37:05.506661569+10:00","Action":"output","Package":"example.com/package2","Output":"PASS\n"}
+{"Time":"2023-05-30T15:37:05.506668204+10:00","Action":"output","Package":"example.com/package2","Output":"\texample.com/package2\tcoverage: 0.0% of statements\n"}
+{"Time":"2023-05-30T15:37:05.506673862+10:00","Action":"output","Package":"example.com/package2","Output":"ok  \texample.com/package2\t(cached)\tcoverage: 0.0% of statements\n"}
+{"Time":"2023-05-30T15:37:05.506681125+10:00","Action":"pass","Package":"example.com/package2","Elapsed":0}
+{"Time":"2023-05-30T15:37:05.506722611+10:00","Action":"start","Package":"example.com/package3"}
+{"Time":"2023-05-30T15:37:05.506746497+10:00","Action":"run","Package":"example.com/package3","Test":"Test4"}
+{"Time":"2023-05-30T15:37:05.506754598+10:00","Action":"output","Package":"example.com/package3","Test":"Test4","Output":"=== RUN   Test4\n"}
+{"Time":"2023-05-30T15:37:05.506769265+10:00","Action":"output","Package":"example.com/package3","Test":"Test4","Output":"--- PASS: Test4 (0.00s)\n"}
+{"Time":"2023-05-30T15:37:05.506779462+10:00","Action":"pass","Package":"example.com/package3","Test":"Test4","Elapsed":0}
+{"Time":"2023-05-30T15:37:05.506785119+10:00","Action":"run","Package":"example.com/package3","Test":"Test5"}
+{"Time":"2023-05-30T15:37:05.506790287+10:00","Action":"output","Package":"example.com/package3","Test":"Test5","Output":"=== RUN   Test5\n"}
+{"Time":"2023-05-30T15:37:05.506795874+10:00","Action":"output","Package":"example.com/package3","Test":"Test5","Output":"--- PASS: Test5 (0.00s)\n"}
+{"Time":"2023-05-30T15:37:05.506801113+10:00","Action":"pass","Package":"example.com/package3","Test":"Test5","Elapsed":0}
+{"Time":"2023-05-30T15:37:05.506805862+10:00","Action":"output","Package":"example.com/package3","Output":"PASS\n"}
+{"Time":"2023-05-30T15:37:05.506810681+10:00","Action":"output","Package":"example.com/package3","Output":"coverage: [no statements]\n"}
+{"Time":"2023-05-30T15:37:05.50681543+10:00","Action":"output","Package":"example.com/package3","Output":"ok  \texample.com/package3\t(cached)\tcoverage: [no statements]\n"}
+{"Time":"2023-05-30T15:37:05.506822903+10:00","Action":"pass","Package":"example.com/package3","Elapsed":0}
+{"Time":"2023-05-30T15:37:05.507702765+10:00","Action":"run","Package":"example.com/package1","Test":"Test1"}
+{"Time":"2023-05-30T15:37:05.507715685+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"=== RUN   Test1\n"}
+{"Time":"2023-05-30T15:37:05.507723717+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"    foo_test.go:6: doing stuff\n"}
+{"Time":"2023-05-30T15:37:05.507729374+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"x =  1\n"}
+{"Time":"2023-05-30T15:37:05.507734193+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"    foo_test.go:8: fail\n"}
+{"Time":"2023-05-30T15:37:05.507743831+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"--- FAIL: Test1 (0.00s)\n"}
+{"Time":"2023-05-30T15:37:05.507750885+10:00","Action":"fail","Package":"example.com/package1","Test":"Test1","Elapsed":0}
+{"Time":"2023-05-30T15:37:05.507758498+10:00","Action":"run","Package":"example.com/package1","Test":"Test2"}
+{"Time":"2023-05-30T15:37:05.507763806+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"=== RUN   Test2\n"}
+{"Time":"2023-05-30T15:37:05.507777216+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"    foo_test.go:12: stuff doing\n"}
+{"Time":"2023-05-30T15:37:05.507782873+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"--- PASS: Test2 (0.00s)\n"}
+{"Time":"2023-05-30T15:37:05.5077886+10:00","Action":"pass","Package":"example.com/package1","Test":"Test2","Elapsed":0}
+{"Time":"2023-05-30T15:37:05.507793838+10:00","Action":"output","Package":"example.com/package1","Output":"FAIL\n"}
+{"Time":"2023-05-30T15:37:05.508093038+10:00","Action":"output","Package":"example.com/package1","Output":"\texample.com/package1\tcoverage: 60.0% of statements\n"}
+{"Time":"2023-05-30T15:37:05.508278118+10:00","Action":"output","Package":"example.com/package1","Output":"FAIL\texample.com/package1\t0.002s\n"}
+{"Time":"2023-05-30T15:37:05.50829474+10:00","Action":"fail","Package":"example.com/package1","Elapsed":0.002}
diff --git a/build.assets/tooling/cmd/render-tests/testdata/flaky-fail-4.in b/build.assets/tooling/cmd/render-tests/testdata/flaky-fail-4.in
new file mode 100644
index 0000000000000..4c7100a2dd2d5
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/testdata/flaky-fail-4.in
@@ -0,0 +1,39 @@
+{"Time":"2023-05-30T15:38:53.265810939+10:00","Action":"start","Package":"example.com/package1"}
+{"Time":"2023-05-30T15:38:53.265919752+10:00","Action":"run","Package":"example.com/package1","Test":"Test1"}
+{"Time":"2023-05-30T15:38:53.265931136+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"=== RUN   Test1\n"}
+{"Time":"2023-05-30T15:38:53.265940146+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"    foo_test.go:6: doing stuff\n"}
+{"Time":"2023-05-30T15:38:53.265949295+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"x =  1\n"}
+{"Time":"2023-05-30T15:38:53.265961238+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"--- PASS: Test1 (0.00s)\n"}
+{"Time":"2023-05-30T15:38:53.265966825+10:00","Action":"pass","Package":"example.com/package1","Test":"Test1","Elapsed":0}
+{"Time":"2023-05-30T15:38:53.265974368+10:00","Action":"run","Package":"example.com/package1","Test":"Test2"}
+{"Time":"2023-05-30T15:38:53.265980095+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"=== RUN   Test2\n"}
+{"Time":"2023-05-30T15:38:53.265986311+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"    foo_test.go:12: stuff doing\n"}
+{"Time":"2023-05-30T15:38:53.265970596+10:00","Action":"start","Package":"example.com/package2"}
+{"Time":"2023-05-30T15:38:53.265993085+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"--- PASS: Test2 (0.00s)\n"}
+{"Time":"2023-05-30T15:38:53.266004469+10:00","Action":"pass","Package":"example.com/package1","Test":"Test2","Elapsed":0}
+{"Time":"2023-05-30T15:38:53.266004469+10:00","Action":"run","Package":"example.com/package2","Test":"Test3"}
+{"Time":"2023-05-30T15:38:53.266010616+10:00","Action":"output","Package":"example.com/package1","Output":"PASS\n"}
+{"Time":"2023-05-30T15:38:53.26601299+10:00","Action":"output","Package":"example.com/package2","Test":"Test3","Output":"=== RUN   Test3\n"}
+{"Time":"2023-05-30T15:38:53.266016831+10:00","Action":"output","Package":"example.com/package1","Output":"\texample.com/package1\tcoverage: 60.0% of statements\n"}
+{"Time":"2023-05-30T15:38:53.26602165+10:00","Action":"output","Package":"example.com/package2","Test":"Test3","Output":"--- PASS: Test3 (0.00s)\n"}
+{"Time":"2023-05-30T15:38:53.266023117+10:00","Action":"output","Package":"example.com/package1","Output":"ok  \texample.com/package1\t(cached)\tcoverage: 60.0% of statements\n"}
+{"Time":"2023-05-30T15:38:53.266028285+10:00","Action":"pass","Package":"example.com/package2","Test":"Test3","Elapsed":0}
+{"Time":"2023-05-30T15:38:53.26603499+10:00","Action":"output","Package":"example.com/package2","Output":"PASS\n"}
+{"Time":"2023-05-30T15:38:53.26603499+10:00","Action":"pass","Package":"example.com/package1","Elapsed":0}
+{"Time":"2023-05-30T15:38:53.266041555+10:00","Action":"output","Package":"example.com/package2","Output":"\texample.com/package2\tcoverage: 0.0% of statements\n"}
+{"Time":"2023-05-30T15:38:53.26604833+10:00","Action":"output","Package":"example.com/package2","Output":"ok  \texample.com/package2\t(cached)\tcoverage: 0.0% of statements\n"}
+{"Time":"2023-05-30T15:38:53.266056012+10:00","Action":"pass","Package":"example.com/package2","Elapsed":0}
+{"Time":"2023-05-30T15:38:53.332950364+10:00","Action":"start","Package":"example.com/package3"}
+{"Time":"2023-05-30T15:38:53.334705198+10:00","Action":"run","Package":"example.com/package3","Test":"Test4"}
+{"Time":"2023-05-30T15:38:53.33485871+10:00","Action":"output","Package":"example.com/package3","Test":"Test4","Output":"=== RUN   Test4\n"}
+{"Time":"2023-05-30T15:38:53.334871421+10:00","Action":"output","Package":"example.com/package3","Test":"Test4","Output":"    baz_test.go:6: sometimes I flake\n"}
+{"Time":"2023-05-30T15:38:53.334885738+10:00","Action":"output","Package":"example.com/package3","Test":"Test4","Output":"--- FAIL: Test4 (0.00s)\n"}
+{"Time":"2023-05-30T15:38:53.334894189+10:00","Action":"fail","Package":"example.com/package3","Test":"Test4","Elapsed":0}
+{"Time":"2023-05-30T15:38:53.334915561+10:00","Action":"run","Package":"example.com/package3","Test":"Test5"}
+{"Time":"2023-05-30T15:38:53.334923243+10:00","Action":"output","Package":"example.com/package3","Test":"Test5","Output":"=== RUN   Test5\n"}
+{"Time":"2023-05-30T15:38:53.334931764+10:00","Action":"output","Package":"example.com/package3","Test":"Test5","Output":"--- PASS: Test5 (0.00s)\n"}
+{"Time":"2023-05-30T15:38:53.334939307+10:00","Action":"pass","Package":"example.com/package3","Test":"Test5","Elapsed":0}
+{"Time":"2023-05-30T15:38:53.334947059+10:00","Action":"output","Package":"example.com/package3","Output":"FAIL\n"}
+{"Time":"2023-05-30T15:38:53.334956069+10:00","Action":"output","Package":"example.com/package3","Output":"coverage: [no statements]\n"}
+{"Time":"2023-05-30T15:38:53.335260368+10:00","Action":"output","Package":"example.com/package3","Output":"FAIL\texample.com/package3\t0.002s\n"}
+{"Time":"2023-05-30T15:38:53.335292355+10:00","Action":"fail","Package":"example.com/package3","Elapsed":0.002}
diff --git a/build.assets/tooling/cmd/render-tests/testdata/flaky-fail-5.in b/build.assets/tooling/cmd/render-tests/testdata/flaky-fail-5.in
new file mode 100644
index 0000000000000..c05655412afa7
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/testdata/flaky-fail-5.in
@@ -0,0 +1,39 @@
+{"Time":"2023-05-30T15:39:01.411862493+10:00","Action":"start","Package":"example.com/package1"}
+{"Time":"2023-05-30T15:39:01.411959782+10:00","Action":"run","Package":"example.com/package1","Test":"Test1"}
+{"Time":"2023-05-30T15:39:01.411966767+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"=== RUN   Test1\n"}
+{"Time":"2023-05-30T15:39:01.411974798+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"    foo_test.go:6: doing stuff\n"}
+{"Time":"2023-05-30T15:39:01.411981573+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"x =  1\n"}
+{"Time":"2023-05-30T15:39:01.411989256+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"--- PASS: Test1 (0.00s)\n"}
+{"Time":"2023-05-30T15:39:01.411994075+10:00","Action":"pass","Package":"example.com/package1","Test":"Test1","Elapsed":0}
+{"Time":"2023-05-30T15:39:01.412001129+10:00","Action":"run","Package":"example.com/package1","Test":"Test2"}
+{"Time":"2023-05-30T15:39:01.412006786+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"=== RUN   Test2\n"}
+{"Time":"2023-05-30T15:39:01.412014468+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"    foo_test.go:12: stuff doing\n"}
+{"Time":"2023-05-30T15:39:01.412023548+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"--- PASS: Test2 (0.00s)\n"}
+{"Time":"2023-05-30T15:39:01.412028856+10:00","Action":"pass","Package":"example.com/package1","Test":"Test2","Elapsed":0}
+{"Time":"2023-05-30T15:39:01.412033046+10:00","Action":"output","Package":"example.com/package1","Output":"PASS\n"}
+{"Time":"2023-05-30T15:39:01.412038214+10:00","Action":"output","Package":"example.com/package1","Output":"\texample.com/package1\tcoverage: 60.0% of statements\n"}
+{"Time":"2023-05-30T15:39:01.412043522+10:00","Action":"output","Package":"example.com/package1","Output":"ok  \texample.com/package1\t(cached)\tcoverage: 60.0% of statements\n"}
+{"Time":"2023-05-30T15:39:01.412032068+10:00","Action":"start","Package":"example.com/package2"}
+{"Time":"2023-05-30T15:39:01.412051275+10:00","Action":"pass","Package":"example.com/package1","Elapsed":0}
+{"Time":"2023-05-30T15:39:01.412060284+10:00","Action":"run","Package":"example.com/package2","Test":"Test3"}
+{"Time":"2023-05-30T15:39:01.41206636+10:00","Action":"output","Package":"example.com/package2","Test":"Test3","Output":"=== RUN   Test3\n"}
+{"Time":"2023-05-30T15:39:01.412074532+10:00","Action":"output","Package":"example.com/package2","Test":"Test3","Output":"--- PASS: Test3 (0.00s)\n"}
+{"Time":"2023-05-30T15:39:01.412080818+10:00","Action":"pass","Package":"example.com/package2","Test":"Test3","Elapsed":0}
+{"Time":"2023-05-30T15:39:01.41208836+10:00","Action":"output","Package":"example.com/package2","Output":"PASS\n"}
+{"Time":"2023-05-30T15:39:01.412092621+10:00","Action":"output","Package":"example.com/package2","Output":"\texample.com/package2\tcoverage: 0.0% of statements\n"}
+{"Time":"2023-05-30T15:39:01.412098837+10:00","Action":"output","Package":"example.com/package2","Output":"ok  \texample.com/package2\t(cached)\tcoverage: 0.0% of statements\n"}
+{"Time":"2023-05-30T15:39:01.412106449+10:00","Action":"pass","Package":"example.com/package2","Elapsed":0}
+{"Time":"2023-05-30T15:39:01.480442467+10:00","Action":"start","Package":"example.com/package3"}
+{"Time":"2023-05-30T15:39:01.481862621+10:00","Action":"run","Package":"example.com/package3","Test":"Test4"}
+{"Time":"2023-05-30T15:39:01.481938399+10:00","Action":"output","Package":"example.com/package3","Test":"Test4","Output":"=== RUN   Test4\n"}
+{"Time":"2023-05-30T15:39:01.481953904+10:00","Action":"output","Package":"example.com/package3","Test":"Test4","Output":"--- PASS: Test4 (0.00s)\n"}
+{"Time":"2023-05-30T15:39:01.48196005+10:00","Action":"pass","Package":"example.com/package3","Test":"Test4","Elapsed":0}
+{"Time":"2023-05-30T15:39:01.481966266+10:00","Action":"run","Package":"example.com/package3","Test":"Test5"}
+{"Time":"2023-05-30T15:39:01.481970596+10:00","Action":"output","Package":"example.com/package3","Test":"Test5","Output":"=== RUN   Test5\n"}
+{"Time":"2023-05-30T15:39:01.481979187+10:00","Action":"output","Package":"example.com/package3","Test":"Test5","Output":"    baz_test.go:10: nevermind\n"}
+{"Time":"2023-05-30T15:39:01.481984425+10:00","Action":"output","Package":"example.com/package3","Test":"Test5","Output":"--- FAIL: Test5 (0.00s)\n"}
+{"Time":"2023-05-30T15:39:01.481989104+10:00","Action":"fail","Package":"example.com/package3","Test":"Test5","Elapsed":0}
+{"Time":"2023-05-30T15:39:01.482003561+10:00","Action":"output","Package":"example.com/package3","Output":"FAIL\n"}
+{"Time":"2023-05-30T15:39:01.482009218+10:00","Action":"output","Package":"example.com/package3","Output":"coverage: [no statements]\n"}
+{"Time":"2023-05-30T15:39:01.482341663+10:00","Action":"output","Package":"example.com/package3","Output":"FAIL\texample.com/package3\t0.001s\n"}
+{"Time":"2023-05-30T15:39:01.48242233+10:00","Action":"fail","Package":"example.com/package3","Elapsed":0.002}
diff --git a/build.assets/tooling/cmd/render-tests/testdata/flaky-pass.in b/build.assets/tooling/cmd/render-tests/testdata/flaky-pass.in
new file mode 100644
index 0000000000000..9b5347e4da9dc
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/testdata/flaky-pass.in
@@ -0,0 +1,38 @@
+{"Time":"2023-05-30T15:35:36.877912355+10:00","Action":"start","Package":"example.com/package1"}
+{"Time":"2023-05-30T15:35:36.877982756+10:00","Action":"run","Package":"example.com/package1","Test":"Test1"}
+{"Time":"2023-05-30T15:35:36.877987994+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"=== RUN   Test1\n"}
+{"Time":"2023-05-30T15:35:36.877994279+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"    foo_test.go:6: doing stuff\n"}
+{"Time":"2023-05-30T15:35:36.877999587+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"x =  1\n"}
+{"Time":"2023-05-30T15:35:36.878006711+10:00","Action":"output","Package":"example.com/package1","Test":"Test1","Output":"--- PASS: Test1 (0.00s)\n"}
+{"Time":"2023-05-30T15:35:36.878011879+10:00","Action":"pass","Package":"example.com/package1","Test":"Test1","Elapsed":0}
+{"Time":"2023-05-30T15:35:36.878017606+10:00","Action":"run","Package":"example.com/package1","Test":"Test2"}
+{"Time":"2023-05-30T15:35:36.878021867+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"=== RUN   Test2\n"}
+{"Time":"2023-05-30T15:35:36.878026756+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"    foo_test.go:12: stuff doing\n"}
+{"Time":"2023-05-30T15:35:36.878031505+10:00","Action":"output","Package":"example.com/package1","Test":"Test2","Output":"--- PASS: Test2 (0.00s)\n"}
+{"Time":"2023-05-30T15:35:36.878036254+10:00","Action":"pass","Package":"example.com/package1","Test":"Test2","Elapsed":0}
+{"Time":"2023-05-30T15:35:36.878041003+10:00","Action":"output","Package":"example.com/package1","Output":"PASS\n"}
+{"Time":"2023-05-30T15:35:36.878045264+10:00","Action":"output","Package":"example.com/package1","Output":"\texample.com/package1\tcoverage: 60.0% of statements\n"}
+{"Time":"2023-05-30T15:35:36.878050013+10:00","Action":"output","Package":"example.com/package1","Output":"ok  \texample.com/package1\t(cached)\tcoverage: 60.0% of statements\n"}
+{"Time":"2023-05-30T15:35:36.87806014+10:00","Action":"pass","Package":"example.com/package1","Elapsed":0}
+{"Time":"2023-05-30T15:35:36.878058673+10:00","Action":"start","Package":"example.com/package2"}
+{"Time":"2023-05-30T15:35:36.878085772+10:00","Action":"run","Package":"example.com/package2","Test":"Test3"}
+{"Time":"2023-05-30T15:35:36.878091149+10:00","Action":"output","Package":"example.com/package2","Test":"Test3","Output":"=== RUN   Test3\n"}
+{"Time":"2023-05-30T15:35:36.878097854+10:00","Action":"output","Package":"example.com/package2","Test":"Test3","Output":"--- PASS: Test3 (0.00s)\n"}
+{"Time":"2023-05-30T15:35:36.878103441+10:00","Action":"pass","Package":"example.com/package2","Test":"Test3","Elapsed":0}
+{"Time":"2023-05-30T15:35:36.87810868+10:00","Action":"output","Package":"example.com/package2","Output":"PASS\n"}
+{"Time":"2023-05-30T15:35:36.878113918+10:00","Action":"output","Package":"example.com/package2","Output":"\texample.com/package2\tcoverage: 0.0% of statements\n"}
+{"Time":"2023-05-30T15:35:36.878118737+10:00","Action":"output","Package":"example.com/package2","Output":"ok  \texample.com/package2\t(cached)\tcoverage: 0.0% of statements\n"}
+{"Time":"2023-05-30T15:35:36.878125022+10:00","Action":"pass","Package":"example.com/package2","Elapsed":0}
+{"Time":"2023-05-30T15:35:36.878156521+10:00","Action":"start","Package":"example.com/package3"}
+{"Time":"2023-05-30T15:35:36.878174889+10:00","Action":"run","Package":"example.com/package3","Test":"Test4"}
+{"Time":"2023-05-30T15:35:36.878180057+10:00","Action":"output","Package":"example.com/package3","Test":"Test4","Output":"=== RUN   Test4\n"}
+{"Time":"2023-05-30T15:35:36.878185854+10:00","Action":"output","Package":"example.com/package3","Test":"Test4","Output":"--- PASS: Test4 (0.00s)\n"}
+{"Time":"2023-05-30T15:35:36.878191092+10:00","Action":"pass","Package":"example.com/package3","Test":"Test4","Elapsed":0}
+{"Time":"2023-05-30T15:35:36.878195004+10:00","Action":"run","Package":"example.com/package3","Test":"Test5"}
+{"Time":"2023-05-30T15:35:36.878199753+10:00","Action":"output","Package":"example.com/package3","Test":"Test5","Output":"=== RUN   Test5\n"}
+{"Time":"2023-05-30T15:35:36.878212953+10:00","Action":"output","Package":"example.com/package3","Test":"Test5","Output":"--- PASS: Test5 (0.00s)\n"}
+{"Time":"2023-05-30T15:35:36.87821875+10:00","Action":"pass","Package":"example.com/package3","Test":"Test5","Elapsed":0}
+{"Time":"2023-05-30T15:35:36.87822308+10:00","Action":"output","Package":"example.com/package3","Output":"PASS\n"}
+{"Time":"2023-05-30T15:35:36.878227899+10:00","Action":"output","Package":"example.com/package3","Output":"coverage: [no statements]\n"}
+{"Time":"2023-05-30T15:35:36.878232159+10:00","Action":"output","Package":"example.com/package3","Output":"ok  \texample.com/package3\t(cached)\tcoverage: [no statements]\n"}
+{"Time":"2023-05-30T15:35:36.878239213+10:00","Action":"pass","Package":"example.com/package3","Elapsed":0}
diff --git a/build.assets/tooling/cmd/render-tests/testdata/pass-fail-pass.in b/build.assets/tooling/cmd/render-tests/testdata/pass-fail-pass.in
new file mode 100644
index 0000000000000..853df905233b9
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/testdata/pass-fail-pass.in
@@ -0,0 +1,37 @@
+{"Time":"2023-05-24T17:29:16.929248048+10:00","Action":"start","Package":"example.com/package"}
+{"Time":"2023-05-24T17:29:16.929248048+10:00","Action":"start","Package":"example.com/package2"}
+{"Time":"2023-05-24T17:29:16.934340321+10:00","Action":"run","Package":"example.com/package","Test":"TestParseHostPort"}
+{"Time":"2023-05-24T17:29:16.934457584+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"=== RUN   TestParseHostPort\n"}
+{"Time":"2023-05-24T17:29:16.934493832+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"=== PAUSE TestParseHostPort\n"}
+{"Time":"2023-05-24T17:29:16.934500118+10:00","Action":"pause","Package":"example.com/package","Test":"TestParseHostPort"}
+{"Time":"2023-05-24T17:29:16.934502037+10:00","Action":"start","Package":"example.com/package2"}
+{"Time":"2023-05-24T17:29:16.934506823+10:00","Action":"run","Package":"example.com/package2","Test":"TestEmpty"}
+{"Time":"2023-05-24T17:29:16.934511572+10:00","Action":"output","Package":"example.com/package2","Test":"TestEmpty","Output":"=== RUN   TestEmpty\n"}
+{"Time":"2023-05-24T17:29:16.934518556+10:00","Action":"output","Package":"example.com/package2","Test":"TestEmpty","Output":"=== PAUSE TestEmpty\n"}
+{"Time":"2023-05-24T17:29:16.934523794+10:00","Action":"pause","Package":"example.com/package","Test":"TestEmpty"}
+{"Time":"2023-05-24T17:29:16.934528962+10:00","Action":"run","Package":"example.com/package","Test":"TestParse"}
+{"Time":"2023-05-24T17:29:16.934533781+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"=== RUN   TestParse\n"}
+{"Time":"2023-05-24T17:29:16.934539508+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"=== PAUSE TestParse\n"}
+{"Time":"2023-05-24T17:29:16.934544188+10:00","Action":"pause","Package":"example.com/package","Test":"TestParse"}
+{"Time":"2023-05-24T17:29:16.934549286+10:00","Action":"cont","Package":"example.com/package","Test":"TestParseHostPort"}
+{"Time":"2023-05-24T17:29:16.934555921+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"=== CONT  TestParseHostPort\n"}
+{"Time":"2023-05-24T17:29:16.93456067+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"    addr_test.go:32: \n"}
+{"Time":"2023-05-24T17:29:16.934565978+10:00","Action":"cont","Package":"example.com/package","Test":"TestParse"}
+{"Time":"2023-05-24T17:29:16.934570797+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"=== CONT  TestParse\n"}
+{"Time":"2023-05-24T17:29:16.934579877+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"--- PASS: TestParseHostPort (0.00s)\n"}
+{"Time":"2023-05-24T17:29:16.934586442+10:00","Action":"skip","Package":"example.com/package","Test":"TestParseHostPort","Elapsed":0}
+{"Time":"2023-05-24T17:29:16.934592169+10:00","Action":"cont","Package":"example.com/package2","Test":"TestEmpty"}
+{"Time":"2023-05-24T17:29:16.934596988+10:00","Action":"output","Package":"example.com/package2","Test":"TestEmpty","Output":"=== CONT  TestEmpty\n"}
+{"Time":"2023-05-24T17:29:16.934602785+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"    addr_test.go:71: failed\n"}
+{"Time":"2023-05-24T17:29:16.934608442+10:00","Action":"output","Package":"example.com/package2","Test":"TestEmpty","Output":"--- PASS: TestEmpty (0.00s)\n"}
+{"Time":"2023-05-24T17:29:16.93461368+10:00","Action":"pass","Package":"example.com/package2","Test":"TestEmpty","Elapsed":0}
+{"Time":"2023-05-24T17:29:16.934618429+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"--- FAIL: TestParse (0.00s)\n"}
+{"Time":"2023-05-24T17:29:16.934629464+10:00","Action":"fail","Package":"example.com/package","Test":"TestParse","Elapsed":0}
+{"Time":"2023-05-24T17:29:16.934634283+10:00","Action":"output","Package":"example.com/package","Output":"FAIL\n"}
+{"Time":"2023-05-24T17:29:16.935972653+10:00","Action":"output","Package":"example.com/package","Output":"\texample.com/package\tcoverage: 2.4% of statements\n"}
+{"Time":"2023-05-24T17:29:16.936504774+10:00","Action":"output","Package":"example.com/package","Output":"FAIL\texample.com/package\t0.007s\n"}
+{"Time":"2023-05-24T17:29:16.936553034+10:00","Action":"fail","Package":"example.com/package","Elapsed":0.007}
+{"Time":"2023-05-24T17:58:42.948894851+10:00","Action":"output","Package":"example.com/package2","Output":"PASS\n"}
+{"Time":"2023-05-24T17:58:42.948904+10:00","Action":"output","Package":"example.com/package2","Output":"\texample.com/package\tcoverage: 3.3% of statements\n"}
+{"Time":"2023-05-24T17:58:42.948909797+10:00","Action":"output","Package":"example.com/package2","Output":"ok  \texample.com/package\t\tcoverage: 3.3% of statements\n"}
+{"Time":"2023-05-24T17:29:16.936583274+10:00","Action":"pass","Package":"example.com/package2","Elapsed":0.007}
diff --git a/build.assets/tooling/cmd/render-tests/testdata/pass-fail-skip.in b/build.assets/tooling/cmd/render-tests/testdata/pass-fail-skip.in
new file mode 100644
index 0000000000000..72f9b0b25c7ab
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/testdata/pass-fail-skip.in
@@ -0,0 +1,31 @@
+{"Time":"2023-05-24T17:29:16.929248048+10:00","Action":"start","Package":"example.com/package"}
+{"Time":"2023-05-24T17:29:16.934340321+10:00","Action":"run","Package":"example.com/package","Test":"TestParseHostPort"}
+{"Time":"2023-05-24T17:29:16.934457584+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"=== RUN   TestParseHostPort\n"}
+{"Time":"2023-05-24T17:29:16.934493832+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"=== PAUSE TestParseHostPort\n"}
+{"Time":"2023-05-24T17:29:16.934500118+10:00","Action":"pause","Package":"example.com/package","Test":"TestParseHostPort"}
+{"Time":"2023-05-24T17:29:16.934506823+10:00","Action":"run","Package":"example.com/package","Test":"TestEmpty"}
+{"Time":"2023-05-24T17:29:16.934511572+10:00","Action":"output","Package":"example.com/package","Test":"TestEmpty","Output":"=== RUN   TestEmpty\n"}
+{"Time":"2023-05-24T17:29:16.934518556+10:00","Action":"output","Package":"example.com/package","Test":"TestEmpty","Output":"=== PAUSE TestEmpty\n"}
+{"Time":"2023-05-24T17:29:16.934523794+10:00","Action":"pause","Package":"example.com/package","Test":"TestEmpty"}
+{"Time":"2023-05-24T17:29:16.934528962+10:00","Action":"run","Package":"example.com/package","Test":"TestParse"}
+{"Time":"2023-05-24T17:29:16.934533781+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"=== RUN   TestParse\n"}
+{"Time":"2023-05-24T17:29:16.934539508+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"=== PAUSE TestParse\n"}
+{"Time":"2023-05-24T17:29:16.934544188+10:00","Action":"pause","Package":"example.com/package","Test":"TestParse"}
+{"Time":"2023-05-24T17:29:16.934549286+10:00","Action":"cont","Package":"example.com/package","Test":"TestParseHostPort"}
+{"Time":"2023-05-24T17:29:16.934555921+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"=== CONT  TestParseHostPort\n"}
+{"Time":"2023-05-24T17:29:16.93456067+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"    addr_test.go:32: \n"}
+{"Time":"2023-05-24T17:29:16.934565978+10:00","Action":"cont","Package":"example.com/package","Test":"TestParse"}
+{"Time":"2023-05-24T17:29:16.934570797+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"=== CONT  TestParse\n"}
+{"Time":"2023-05-24T17:29:16.934579877+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"--- SKIP: TestParseHostPort (0.00s)\n"}
+{"Time":"2023-05-24T17:29:16.934586442+10:00","Action":"skip","Package":"example.com/package","Test":"TestParseHostPort","Elapsed":0}
+{"Time":"2023-05-24T17:29:16.934592169+10:00","Action":"cont","Package":"example.com/package","Test":"TestEmpty"}
+{"Time":"2023-05-24T17:29:16.934596988+10:00","Action":"output","Package":"example.com/package","Test":"TestEmpty","Output":"=== CONT  TestEmpty\n"}
+{"Time":"2023-05-24T17:29:16.934602785+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"    addr_test.go:71: failed\n"}
+{"Time":"2023-05-24T17:29:16.934608442+10:00","Action":"output","Package":"example.com/package","Test":"TestEmpty","Output":"--- PASS: TestEmpty (0.00s)\n"}
+{"Time":"2023-05-24T17:29:16.93461368+10:00","Action":"pass","Package":"example.com/package","Test":"TestEmpty","Elapsed":0}
+{"Time":"2023-05-24T17:29:16.934618429+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"--- FAIL: TestParse (0.00s)\n"}
+{"Time":"2023-05-24T17:29:16.934629464+10:00","Action":"fail","Package":"example.com/package","Test":"TestParse","Elapsed":0}
+{"Time":"2023-05-24T17:29:16.934634283+10:00","Action":"output","Package":"example.com/package","Output":"FAIL\n"}
+{"Time":"2023-05-24T17:29:16.935972653+10:00","Action":"output","Package":"example.com/package","Output":"\texample.com/package\tcoverage: 2.4% of statements\n"}
+{"Time":"2023-05-24T17:29:16.936504774+10:00","Action":"output","Package":"example.com/package","Output":"FAIL\texample.com/package\t0.007s\n"}
+{"Time":"2023-05-24T17:29:16.936553034+10:00","Action":"fail","Package":"example.com/package","Elapsed":0.007}
diff --git a/build.assets/tooling/cmd/render-tests/testdata/pass-pass-pass.in b/build.assets/tooling/cmd/render-tests/testdata/pass-pass-pass.in
new file mode 100644
index 0000000000000..48fe32cdd8e16
--- /dev/null
+++ b/build.assets/tooling/cmd/render-tests/testdata/pass-pass-pass.in
@@ -0,0 +1,29 @@
+{"Time":"2023-05-24T17:58:42.948659276+10:00","Action":"start","Package":"example.com/package"}
+{"Time":"2023-05-24T17:58:42.948757054+10:00","Action":"run","Package":"example.com/package","Test":"TestParseHostPort"}
+{"Time":"2023-05-24T17:58:42.948764178+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"=== RUN   TestParseHostPort\n"}
+{"Time":"2023-05-24T17:58:42.948771791+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"=== PAUSE TestParseHostPort\n"}
+{"Time":"2023-05-24T17:58:42.948778565+10:00","Action":"pause","Package":"example.com/package","Test":"TestParseHostPort"}
+{"Time":"2023-05-24T17:58:42.9487852+10:00","Action":"run","Package":"example.com/package","Test":"TestEmpty"}
+{"Time":"2023-05-24T17:58:42.948791416+10:00","Action":"output","Package":"example.com/package","Test":"TestEmpty","Output":"=== RUN   TestEmpty\n"}
+{"Time":"2023-05-24T17:58:42.948796654+10:00","Action":"output","Package":"example.com/package","Test":"TestEmpty","Output":"=== PAUSE TestEmpty\n"}
+{"Time":"2023-05-24T17:58:42.948801334+10:00","Action":"pause","Package":"example.com/package","Test":"TestEmpty"}
+{"Time":"2023-05-24T17:58:42.948806641+10:00","Action":"run","Package":"example.com/package","Test":"TestParse"}
+{"Time":"2023-05-24T17:58:42.94881153+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"=== RUN   TestParse\n"}
+{"Time":"2023-05-24T17:58:42.948816699+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"=== PAUSE TestParse\n"}
+{"Time":"2023-05-24T17:58:42.948821448+10:00","Action":"pause","Package":"example.com/package","Test":"TestParse"}
+{"Time":"2023-05-24T17:58:42.948826197+10:00","Action":"cont","Package":"example.com/package","Test":"TestParseHostPort"}
+{"Time":"2023-05-24T17:58:42.948831365+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"=== CONT  TestParseHostPort\n"}
+{"Time":"2023-05-24T17:58:42.948836184+10:00","Action":"cont","Package":"example.com/package","Test":"TestParse"}
+{"Time":"2023-05-24T17:58:42.948841003+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"=== CONT  TestParse\n"}
+{"Time":"2023-05-24T17:58:42.948845822+10:00","Action":"cont","Package":"example.com/package","Test":"TestEmpty"}
+{"Time":"2023-05-24T17:58:42.948850083+10:00","Action":"output","Package":"example.com/package","Test":"TestEmpty","Output":"=== CONT  TestEmpty\n"}
+{"Time":"2023-05-24T17:58:42.948857695+10:00","Action":"output","Package":"example.com/package","Test":"TestParseHostPort","Output":"--- PASS: TestParseHostPort (0.00s)\n"}
+{"Time":"2023-05-24T17:58:42.948866705+10:00","Action":"pass","Package":"example.com/package","Test":"TestParseHostPort","Elapsed":0}
+{"Time":"2023-05-24T17:58:42.948874457+10:00","Action":"output","Package":"example.com/package","Test":"TestParse","Output":"--- PASS: TestParse (0.00s)\n"}
+{"Time":"2023-05-24T17:58:42.948880184+10:00","Action":"pass","Package":"example.com/package","Test":"TestParse","Elapsed":0}
+{"Time":"2023-05-24T17:58:42.948885283+10:00","Action":"output","Package":"example.com/package","Test":"TestEmpty","Output":"--- PASS: TestEmpty (0.00s)\n"}
+{"Time":"2023-05-24T17:58:42.948890032+10:00","Action":"pass","Package":"example.com/package","Test":"TestEmpty","Elapsed":0}
+{"Time":"2023-05-24T17:58:42.948894851+10:00","Action":"output","Package":"example.com/package","Output":"PASS\n"}
+{"Time":"2023-05-24T17:58:42.948904+10:00","Action":"output","Package":"example.com/package","Output":"\texample.com/package\tcoverage: 3.3% of statements\n"}
+{"Time":"2023-05-24T17:58:42.948909797+10:00","Action":"output","Package":"example.com/package","Output":"ok  \texample.com/package\t\tcoverage: 3.3% of statements\n"}
+{"Time":"2023-05-24T17:58:42.948917759+10:00","Action":"pass","Package":"example.com/package","Elapsed":0}
diff --git a/build.assets/tooling/cmd/rerun/main.go b/build.assets/tooling/cmd/rerun/main.go
new file mode 100644
index 0000000000000..a1f5960b5bd00
--- /dev/null
+++ b/build.assets/tooling/cmd/rerun/main.go
@@ -0,0 +1,159 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Command rerun runs a command repeatedly until a timeout or number of runs completes.
+//
+//	Usage: rerun [-t timeout] [-n count] <command> [args...]
+//
+// Rerun runs <command> with [args...] <n> number of times or until <timeout>
+// elapses since starting, whichever comes first. The command will be allowed
+// to complete if <timeout> elapses, after which no more runs will be made.
+//
+// The exit code of command is the <command>'s exit code from the last run.
+// If the <command> could not be run, then the exit code will be 1 and no
+// more runs will be made.
+//
+// <timeout> is parsed as a [time.Duration string].
+//
+// If <count> is 0 (the default), then only the <timeout> will apply.
+// If <timeout> is 0 (the default), then only the <count> will apply.
+// If neither <count> or <timeout>, then the <command> will not be run.
+//
+// <command> is executed directly with [args...] as provided. If <command>
+// does not contain any path separators, the search path is used to locate
+// it. No shell is used to run <command>.
+//
+// [time.Duration string]: https://golang.org/pkg/time/#ParseDuration
+package main
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/signal"
+	"sync"
+	"syscall"
+	"time"
+)
+
+var (
+	count   = flag.Int("n", 0, "Maximum number of runs")
+	timeout = flag.Duration("t", 0, "Rerun until timeout passes")
+)
+
+func usage() {
+	fmt.Fprintln(flag.CommandLine.Output(), "usage: rerun [-t timeout] [-n count] <command> [args...]")
+	flag.PrintDefaults()
+}
+
+type UsageError string
+
+func (u UsageError) Error() string {
+	return string(u)
+}
+
+func main() {
+	flag.Usage = usage
+	flag.Parse()
+	code, err := rerun(flag.Args())
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		var uerr UsageError
+		if errors.As(err, &uerr) {
+			usage()
+		}
+	}
+	os.Exit(code)
+}
+
+func rerun(args []string) (int, error) {
+	if len(args) < 1 {
+		return 1, UsageError("no command supplied")
+	}
+	if *count < 0 {
+		return 1, UsageError("run count must be a non-negative number")
+	}
+	if *timeout < 0 {
+		return 1, UsageError("timeout must be a non-negative duration")
+	}
+	if *count == 0 && *timeout == 0 {
+		return 0, nil
+	}
+
+	var (
+		cmd      *exec.Cmd
+		proc     *os.Process
+		procLock sync.Mutex
+		err      error
+		done     = make(chan struct{})
+		signals  = make(chan os.Signal, 1)
+		now      = time.Now()
+		endTime  = now.Add(*timeout)
+	)
+	signal.Notify(signals, os.Interrupt, syscall.SIGTERM)
+	go func() {
+		defer close(done)
+		sig := <-signals
+		procLock.Lock()
+		defer procLock.Unlock()
+		if proc != nil {
+			proc.Signal(sig)
+		}
+	}()
+	for i := 0; !isDone(i, now, endTime, done); i++ {
+		cmd = exec.Command(args[0], args[1:]...)
+		cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
+
+		// Immediately terminate if we cannot start the process. No point
+		// re-running a command that cannot run.
+		if err = cmd.Start(); err != nil {
+			break
+		}
+		procLock.Lock()
+		proc = cmd.Process
+		procLock.Unlock()
+
+		// Record the error for the case this is the last run. We return
+		// that error.
+		err = cmd.Wait()
+
+		now = time.Now()
+	}
+
+	// We terminated due to some error trying to run the command. Return
+	// with that error.
+	var exitErr *exec.ExitError
+	if err != nil && !errors.As(err, &exitErr) {
+		return 1, err
+	}
+
+	// Otherwise, just return the last exit code
+	return cmd.ProcessState.ExitCode(), nil
+}
+
+// isDone returns true if we are done re-running the command; either we have
+// reached the required number of runs, have reached the timeout, or the
+// done channel is closed (via a signal).
+func isDone(n int, now, endTime time.Time, ch <-chan struct{}) bool {
+	select {
+	case <-ch:
+		return true
+	default:
+		return (*count > 0 && n > *count) || (*timeout > 0 && !now.Before(endTime))
+	}
+}
diff --git a/build.assets/tooling/go.mod b/build.assets/tooling/go.mod
index 7b0ef9b9e695b..bbcfb9870f768 100644
--- a/build.assets/tooling/go.mod
+++ b/build.assets/tooling/go.mod
@@ -5,46 +5,46 @@ go 1.18
 require (
 	github.com/alecthomas/kingpin/v2 v2.3.2 // replaced
 	github.com/bmatcuk/doublestar/v4 v4.6.0
-	github.com/bradleyfalzon/ghinstallation/v2 v2.4.0
+	github.com/bradleyfalzon/ghinstallation/v2 v2.5.0
 	github.com/google/go-github/v41 v41.0.0
 	github.com/google/uuid v1.3.0
 	github.com/gravitational/trace v1.2.1
 	github.com/hashicorp/go-hclog v1.5.0
-	github.com/hashicorp/go-retryablehttp v0.7.2
-	github.com/sirupsen/logrus v1.9.2
+	github.com/hashicorp/go-retryablehttp v0.7.4
+	github.com/sirupsen/logrus v1.9.3
 	github.com/stretchr/testify v1.8.4
 	github.com/waigani/diffparser v0.0.0-20190828052634-7391f219313d
-	golang.org/x/exp v0.0.0-20221114191408-850992195362
-	golang.org/x/mod v0.10.0
-	golang.org/x/oauth2 v0.8.0
+	golang.org/x/exp v0.0.0-20230626212559-97b1e661b5df
+	golang.org/x/mod v0.11.0
+	golang.org/x/oauth2 v0.9.0
 	howett.net/plist v1.0.0
 )
 
 require (
-	github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20230626094100-7e9e0395ebec // indirect
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
 	github.com/cloudflare/circl v1.3.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/fatih/color v1.13.0 // indirect
+	github.com/fatih/color v1.15.0 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/go-github/v52 v52.0.0 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/go-github/v53 v53.2.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-multierror v1.0.0 // indirect
-	github.com/jonboulle/clockwork v0.2.2 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/jonboulle/clockwork v0.4.0 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/mitchellh/gon v0.2.5
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
-	golang.org/x/crypto v0.7.0 // indirect
-	golang.org/x/net v0.10.0 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/term v0.8.0 // indirect
+	golang.org/x/crypto v0.10.0 // indirect
+	golang.org/x/net v0.11.0 // indirect
+	golang.org/x/sys v0.9.0 // indirect
+	golang.org/x/term v0.9.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/build.assets/tooling/go.sum b/build.assets/tooling/go.sum
index f39e63581fb51..db8b940990774 100644
--- a/build.assets/tooling/go.sum
+++ b/build.assets/tooling/go.sum
@@ -2,8 +2,9 @@ cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMT
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 h1:wPbRQzjjwFc0ih8puEVAOFGELsn1zoIIYdxvML7mDxA=
 github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8/go.mod h1:I0gYDMZ6Z5GRU7l58bNFSkPTFN6Yl12dsUlAZ8xy98g=
+github.com/ProtonMail/go-crypto v0.0.0-20230626094100-7e9e0395ebec h1:vV3RryLxt42+ZIVOFbYJCH1jsZNTNmj2NYru5zfx+4E=
+github.com/ProtonMail/go-crypto v0.0.0-20230626094100-7e9e0395ebec/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
 github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
@@ -12,9 +13,10 @@ github.com/apparentlymart/go-dump v0.0.0-20180507223929-23540a00eaa3/go.mod h1:o
 github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
 github.com/bmatcuk/doublestar/v4 v4.6.0 h1:HTuxyug8GyFbRkrffIpzNCSK4luc0TY3wzXvzIZhEXc=
 github.com/bmatcuk/doublestar/v4 v4.6.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
-github.com/bradleyfalzon/ghinstallation/v2 v2.4.0 h1:zYSzkoIwekCQAr6GT6KxISLt4YRS6kd4/ixfzMN+7yc=
-github.com/bradleyfalzon/ghinstallation/v2 v2.4.0/go.mod h1:4MwZLSgBJJgg4i3nJwZJ95AMooSqN8fJDmegLVn9Q2U=
+github.com/bradleyfalzon/ghinstallation/v2 v2.5.0 h1:yaYcGQ7yEIGbsJfW/9z7v1sLiZg/5rSNNXwmMct5XaE=
+github.com/bradleyfalzon/ghinstallation/v2 v2.5.0/go.mod h1:amcvPQMrRkWNdueWOjPytGL25xQGzox7425qMgzo+Vo=
 github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
@@ -37,8 +39,9 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
+github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
@@ -59,8 +62,9 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -74,8 +78,9 @@ github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-github/v41 v41.0.0 h1:HseJrM2JFf2vfiZJ8anY2hqBjdfY1Vlj/K27ueww4gg=
 github.com/google/go-github/v41 v41.0.0/go.mod h1:XgmCA5H323A9rtgExdTcnDkcqp6S30AVACCBDOonIxg=
-github.com/google/go-github/v52 v52.0.0 h1:uyGWOY+jMQ8GVGSX8dkSwCzlehU3WfdxQ7GweO/JP7M=
-github.com/google/go-github/v52 v52.0.0/go.mod h1:WJV6VEEUPuMo5pXqqa2ZCZEdbQqua4zAk2MZTIo+m+4=
+github.com/google/go-github/v53 v53.0.0/go.mod h1:XhFRObz+m/l+UCm9b7KSIC3lT3NWSXGt7mOsAWEloao=
+github.com/google/go-github/v53 v53.2.0 h1:wvz3FyF53v4BK+AsnvCmeNhf8AkTaeh2SoYu/XUvTtI=
+github.com/google/go-github/v53 v53.2.0/go.mod h1:XhFRObz+m/l+UCm9b7KSIC3lT3NWSXGt7mOsAWEloao=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -86,8 +91,9 @@ github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33/go.mod
 github.com/gravitational/trace v1.2.1 h1:Iaf43aqbKV5H8bdiRs1qByjEHgAfADJ0lt0JwRyu+q8=
 github.com/gravitational/trace v1.2.1/go.mod h1:n0ijrq6psJY0sOI/NzLp+xdd8xl79jjwzVOFHDY6+kQ=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
@@ -95,15 +101,17 @@ github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrj
 github.com/hashicorp/go-hclog v0.9.3-0.20191025211905-234833755cb2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
 github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uPribsnS6o=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-retryablehttp v0.6.3/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
-github.com/hashicorp/go-retryablehttp v0.7.2 h1:AcYqCvkpalPnPF2pn0KamgwamS42TqUDDYFRKq/RAd0=
-github.com/hashicorp/go-retryablehttp v0.7.2/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
+github.com/hashicorp/go-retryablehttp v0.7.4 h1:ZQgVdpTdAL7WpMIwLzCfbalOcSUdkDZnpUv3/+BxzFA=
+github.com/hashicorp/go-retryablehttp v0.7.4/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
 github.com/hashicorp/hcl/v2 v2.0.0/go.mod h1:oVVDG71tEinNGYCxinCYadcmKU9bglqW9pV3txagJ90=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ=
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
+github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=
+github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
@@ -113,13 +121,16 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/gon v0.2.5 h1:mVWtqTzV03W0avJqmqjk9M0qls3TDUXfc9ETJaPIOWY=
 github.com/mitchellh/gon v0.2.5/go.mod h1:Ua18ZhqjZHg8VyqZo8kNHAY331ntV6nNJ9mT3s2mIo8=
@@ -131,8 +142,8 @@ github.com/sebdah/goldie v1.0.0 h1:9GNhIat69MSlz/ndaBg48vl9dF5fI+NBB6kfOxgfkMc=
 github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.2 h1:oxx1eChJGI6Uks2ZC4W1zpLlVgqB8ner4EuQwV4Ik1Y=
-github.com/sirupsen/logrus v1.9.2/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
@@ -157,18 +168,20 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
+golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20221114191408-850992195362 h1:NoHlPRbyl1VFI6FjwHtPQCN7wAMXI6cKcqrmXhOOfBQ=
-golang.org/x/exp v0.0.0-20221114191408-850992195362/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
+golang.org/x/exp v0.0.0-20230626212559-97b1e661b5df h1:UA2aFVmmsIlefxMk29Dp2juaUSth8Pyn3Tq5Y5mJGME=
+golang.org/x/exp v0.0.0-20230626212559-97b1e661b5df/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
-golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.11.0 h1:bUO06HqtnRcc/7l71XBe4WcqTZ+3AH1J59zWDDwLKgU=
+golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -183,16 +196,17 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU=
+golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
-golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
+golang.org/x/oauth2 v0.9.0 h1:BPpt2kU7oMRq3kCHAA1tbSEshXRw1LpG2ztgDwrzuAs=
+golang.org/x/oauth2 v0.9.0/go.mod h1:qYgFZaFiu6Wg24azG8bdV52QJXJGbZzIIsRCdVKzbLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -221,23 +235,28 @@ golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
+golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
-golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28=
+golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
@@ -278,8 +297,9 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
diff --git a/constants.go b/constants.go
index 25be2bb6cb452..24d3dc1049b2d 100644
--- a/constants.go
+++ b/constants.go
@@ -38,8 +38,8 @@ const (
 	// SSHTeleportUser is the current Teleport user that is logged in.
 	SSHTeleportUser = "SSH_TELEPORT_USER"
 
-	// SSHSessionWebproxyAddr is the address the web proxy.
-	SSHSessionWebproxyAddr = "SSH_SESSION_WEBPROXY_ADDR"
+	// SSHSessionWebProxyAddr is the address the web proxy.
+	SSHSessionWebProxyAddr = "SSH_SESSION_WEBPROXY_ADDR"
 
 	// SSHTeleportClusterName is the name of the cluster this node belongs to.
 	SSHTeleportClusterName = "SSH_TELEPORT_CLUSTER_NAME"
@@ -270,6 +270,9 @@ const (
 	// ComponentProxySecureGRPC represents secure gRPC server running on Proxy (used for Kube).
 	ComponentProxySecureGRPC = "proxy:secure-grpc"
 
+	// ComponentAssist represents Teleport Assist
+	ComponentAssist = "assist"
+
 	// VerboseLogEnvVar forces all logs to be verbose (down to DEBUG level)
 	VerboseLogsEnvVar = "TELEPORT_DEBUG"
 
@@ -613,13 +616,31 @@ const (
 	// reading cluster events and playing back session records.
 	PresetAuditorRoleName = "auditor"
 
+	// PresetReviewerRoleName is a name of a preset role that allows
+	// for reviewing access requests.
+	PresetReviewerRoleName = "reviewer"
+
+	// PresetRequesterRoleName is a name of a preset role that allows
+	// for requesting access to resources.
+	PresetRequesterRoleName = "requester"
+
 	// PresetGroupAccessRoleName is a name of a preset role that allows
 	// access to all user groups.
 	PresetGroupAccessRoleName = "group-access"
+
+	// SystemAutomaticAccessApprovalRoleName names a preset role that may
+	// automatically approve any Role Access Request
+	SystemAutomaticAccessApprovalRoleName = "@teleport-access-approver"
 )
 
 var PresetRoles = []string{PresetEditorRoleName, PresetAccessRoleName, PresetAuditorRoleName}
 
+const (
+	// SystemAccessApproverUserName names a Teleport user that acts as
+	// an Access Request approver for access plugins
+	SystemAccessApproverUserName = "@teleport-access-approval-bot"
+)
+
 // MinClientVersion is the minimum client version required by the server.
 var MinClientVersion string
 
diff --git a/devbox.json b/devbox.json
new file mode 100644
index 0000000000000..a7c03bf584a73
--- /dev/null
+++ b/devbox.json
@@ -0,0 +1,41 @@
+{
+  "packages": [
+    "addlicense@1.0.0",
+    "bats@1.3.0",
+    "github:nixos/nixpkgs/d7f28652048b3bed6a512542e62ea1a50691e349#buf",
+    "clang@11.1.0",
+    "gci@0.9.1",
+    "github:nixos/nixpkgs/deb3d80ae0ccafe4f19d3edf32e2eb7fda283978#go",
+    "github:nixos/nixpkgs/22540da6c19a41512dd6bc575858e1215baeb3f9#golangci-lint",
+    "libiconvReal@1.16",
+    "libfido2@1.13.0",
+    "nodejs@16.18.1",
+    "github:nixos/nixpkgs/b39bfdc033e1d79f2b58e1630530e5d54b19e698#openssl",
+    "patchelf@0.15.0",
+    "protobuf3_20@3.20.3",
+    "python@3.11.2",
+    "shellcheck@0.9.0",
+    "yamllint@1.28.0",
+    "zlib@1.2.13",
+    "path:build.assets/flake#conditional",
+    "path:build.assets/flake#grpc-tools",
+    "path:build.assets/flake#helm",
+    "path:build.assets/flake#libpcsclite",
+    "path:build.assets/flake#node-protoc-ts",
+    "path:build.assets/flake#protoc-gen-gogo",
+    "path:build.assets/flake#rust",
+    "path:build.assets/flake#yarn",
+    "bash@latest",
+    "git@latest"
+  ],
+  "shell": {
+    "init_hook": [
+      "export TELEPORT_DEVBOX=1",
+      "export PATH=\"$HOME/.cargo/bin:$PATH\"",
+      "unset GOROOT"
+    ]
+  },
+  "nixpkgs": {
+    "commit": "b3f5bcf0be3e15226b0e9d698aa734ee098aa08f"
+  }
+}
diff --git a/devbox.lock b/devbox.lock
new file mode 100644
index 0000000000000..133fbccc32d08
--- /dev/null
+++ b/devbox.lock
@@ -0,0 +1,77 @@
+{
+  "lockfile_version": "1",
+  "packages": {
+    "addlicense@1.0.0": {
+      "last_modified": "2022-06-30T00:42:12Z",
+      "resolved": "github:NixOS/nixpkgs/d3248619647234b5dc74a6921bcdf6dd8323eb22#addlicense",
+      "version": "1.0.0"
+    },
+    "bash@latest": {
+      "resolved": "github:NixOS/nixpkgs/f91ee3065de91a3531329a674a45ddcb3467a650#bash"
+    },
+    "bats@1.3.0": {
+      "last_modified": "2021-09-01T12:51:06Z",
+      "resolved": "github:NixOS/nixpkgs/6cc260cfd60f094500b79e279069b499806bf6d8#bats",
+      "version": "1.3.0"
+    },
+    "clang@11.1.0": {
+      "last_modified": "2023-05-01T16:53:22Z",
+      "resolved": "github:NixOS/nixpkgs/8670e496ffd093b60e74e7fa53526aa5920d09eb#clang",
+      "version": "11.1.0"
+    },
+    "gci@0.9.1": {
+      "last_modified": "2023-02-28T22:11:13Z",
+      "resolved": "github:NixOS/nixpkgs/995edc972ad3a1e291ac22d74b9610821357175f#gci",
+      "version": "0.9.1"
+    },
+    "git@latest": {
+      "resolved": "github:NixOS/nixpkgs/f91ee3065de91a3531329a674a45ddcb3467a650#git"
+    },
+    "libfido2@1.13.0": {
+      "last_modified": "2023-05-01T16:53:22Z",
+      "resolved": "github:NixOS/nixpkgs/8670e496ffd093b60e74e7fa53526aa5920d09eb#libfido2",
+      "version": "1.13.0"
+    },
+    "libiconvReal@1.16": {
+      "last_modified": "2023-05-01T16:53:22Z",
+      "resolved": "github:NixOS/nixpkgs/8670e496ffd093b60e74e7fa53526aa5920d09eb#libiconvReal",
+      "version": "1.16"
+    },
+    "nodejs@16.18.1": {
+      "last_modified": "2023-01-02T04:31:48Z",
+      "resolved": "github:NixOS/nixpkgs/a4379d2b0deefedc8dba360897557707ea9ee9a7#nodejs-16_x",
+      "version": "16.18.1"
+    },
+    "patchelf@0.15.0": {
+      "last_modified": "2023-05-01T16:53:22Z",
+      "resolved": "github:NixOS/nixpkgs/8670e496ffd093b60e74e7fa53526aa5920d09eb#patchelf",
+      "version": "0.15.0"
+    },
+    "protobuf3_20@3.20.3": {
+      "last_modified": "2023-05-01T16:53:22Z",
+      "resolved": "github:NixOS/nixpkgs/8670e496ffd093b60e74e7fa53526aa5920d09eb#protobuf3_20",
+      "version": "3.20.3"
+    },
+    "python@3.11.2": {
+      "last_modified": "2023-03-31T22:52:29Z",
+      "plugin_version": "0.0.1",
+      "resolved": "github:NixOS/nixpkgs/242246ee1e58f54d2322227fc5eef53b4a616a31#python311",
+      "version": "3.11.2"
+    },
+    "shellcheck@0.9.0": {
+      "last_modified": "2023-05-01T16:53:22Z",
+      "resolved": "github:NixOS/nixpkgs/8670e496ffd093b60e74e7fa53526aa5920d09eb#shellcheck",
+      "version": "0.9.0"
+    },
+    "yamllint@1.28.0": {
+      "last_modified": "2023-02-28T22:11:13Z",
+      "resolved": "github:NixOS/nixpkgs/995edc972ad3a1e291ac22d74b9610821357175f#yamllint",
+      "version": "1.28.0"
+    },
+    "zlib@1.2.13": {
+      "last_modified": "2023-05-01T16:53:22Z",
+      "resolved": "github:NixOS/nixpkgs/8670e496ffd093b60e74e7fa53526aa5920d09eb#zlib",
+      "version": "1.2.13"
+    }
+  }
+}
\ No newline at end of file
diff --git a/docs/config.json b/docs/config.json
index ebc5c1cd51685..e88ea882e97f8 100644
--- a/docs/config.json
+++ b/docs/config.json
@@ -4,13 +4,9 @@
       "icon": "home",
       "title": "Home",
       "entries": [
-        {
-          "title": "Introduction",
-          "slug": "/"
-        },
         {
           "title": "Get Started with Teleport",
-          "slug": "/get-started/"
+          "slug": "/"
         },
         {
           "title": "Core Concepts",
@@ -35,9 +31,7 @@
         {
           "title": "Teleport Assist",
           "slug": "/ai-assist/",
-          "forScopes": [
-            "oss"
-          ]
+          "forScopes": ["oss"]
         }
       ]
     },
@@ -49,10 +43,10 @@
           "title": "Introduction",
           "slug": "/choose-an-edition/introduction/"
         },
-	{
-	  "title": "Teleport Team",
-	  "slug": "/choose-an-edition/teleport-team/"
-	},
+        {
+          "title": "Teleport Team",
+          "slug": "/choose-an-edition/teleport-team/"
+        },
         {
           "title": "Teleport Enterprise Cloud",
           "slug": "/choose-an-edition/teleport-cloud/introduction/",
@@ -61,53 +55,39 @@
             {
               "title": "Architecture",
               "slug": "/choose-an-edition/teleport-cloud/architecture/",
-              "forScopes": [
-                "cloud"
-              ]
+              "forScopes": ["cloud"]
             },
             {
               "title": "Downloads",
               "slug": "/choose-an-edition/teleport-cloud/downloads/",
-              "forScopes": [
-                "cloud"
-              ]
+              "forScopes": ["cloud"]
             },
             {
               "title": "FAQ",
               "slug": "/choose-an-edition/teleport-cloud/faq/",
-              "forScopes": [
-                "cloud"
-              ]
+              "forScopes": ["cloud"]
             }
           ]
         },
         {
           "title": "Teleport Enterprise",
           "slug": "/choose-an-edition/teleport-enterprise/introduction/",
-          "forScopes": [
-            "enterprise"
-          ],
+          "forScopes": ["enterprise"],
           "entries": [
             {
               "title": "HSM",
               "slug": "/choose-an-edition/teleport-enterprise/hsm/",
-              "forScopes": [
-                "enterprise"
-              ]
+              "forScopes": ["enterprise"]
             },
             {
               "title": "Google Cloud KMS",
               "slug": "/choose-an-edition/teleport-enterprise/gcp-kms/",
-              "forScopes": [
-                "enterprise"
-              ]
+              "forScopes": ["enterprise"]
             },
             {
               "title": "Enterprise License File",
               "slug": "/choose-an-edition/teleport-enterprise/license/",
-              "forScopes": [
-                "enterprise"
-              ]
+              "forScopes": ["enterprise"]
             }
           ]
         }
@@ -124,116 +104,74 @@
         {
           "title": "High Availability Deployments",
           "slug": "/deploy-a-cluster/high-availability/",
-          "forScopes": [
-            "oss",
-            "enterprise"
-          ]
+          "forScopes": ["oss", "enterprise"]
         },
         {
           "title": "Deploy with Helm",
           "slug": "/deploy-a-cluster/helm-deployments/",
-          "forScopes": [
-            "oss",
-            "enterprise"
-          ],
+          "forScopes": ["oss", "enterprise"],
           "entries": [
             {
               "title": "Deploy Teleport on Kubernetes",
               "slug": "/deploy-a-cluster/helm-deployments/kubernetes-cluster/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "AWS EKS Cluster",
               "slug": "/deploy-a-cluster/helm-deployments/aws/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "Google Cloud GKE Cluster",
               "slug": "/deploy-a-cluster/helm-deployments/gcp/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "DigitalOcean Kubernetes Cluster",
               "slug": "/deploy-a-cluster/helm-deployments/digitalocean/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "Customize Deployment Config",
               "slug": "/deploy-a-cluster/helm-deployments/custom/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "Migrating from v11 to v12",
               "slug": "/deploy-a-cluster/helm-deployments/migration-v12/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "Kubernetes 1.25 and PSP removal",
               "slug": "/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             }
           ]
         },
         {
           "title": "Deploy to your Cloud",
           "slug": "/deploy-a-cluster/deployments/",
-          "forScopes": [
-            "oss",
-            "enterprise"
-          ],
+          "forScopes": ["oss", "enterprise"],
           "entries": [
             {
               "title": "AWS Terraform",
               "slug": "/deploy-a-cluster/deployments/aws-terraform/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "AWS Multi-Region Proxy Deployment",
               "slug": "/deploy-a-cluster/deployments/aws-gslb-proxy-peering-ha-deployment/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "GCP",
               "slug": "/deploy-a-cluster/deployments/gcp/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "IBM",
               "slug": "/deploy-a-cluster/deployments/ibm/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             }
           ]
         }
@@ -278,10 +216,7 @@
             {
               "title": "Dual Authorization",
               "slug": "/access-controls/guides/dual-authz/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Impersonation",
@@ -290,26 +225,12 @@
             {
               "title": "Moderated Sessions",
               "slug": "/access-controls/guides/moderated-sessions/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Hardware Key Support (Preview)",
               "slug": "/access-controls/guides/hardware-key-support/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
-            },
-            {
-              "title": "Device Trust (Preview)",
-              "slug": "/access-controls/guides/device-trust/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Headless WebAuthn (Preview)",
@@ -318,160 +239,136 @@
             {
               "title": "IP Pinning (Preview)",
               "slug": "/access-controls/guides/ip-pinning/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             }
           ]
         },
         {
           "title": "Single Sign-On (SSO)",
           "slug": "/access-controls/sso/",
-          "forScopes": [
-            "enterprise",
-            "oss",
-            "cloud"
-          ],
+          "forScopes": ["enterprise", "oss", "cloud"],
           "entries": [
             {
               "title": "Active Directory (ADFS)",
               "slug": "/access-controls/sso/adfs/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Azure Active Directory",
               "slug": "/access-controls/sso/azuread/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "GitHub",
               "slug": "/access-controls/sso/github-sso/",
-              "forScopes": [
-                "enterprise",
-                "cloud",
-                "oss"
-              ]
+              "forScopes": ["enterprise", "cloud", "oss"]
             },
             {
               "title": "GitLab",
               "slug": "/access-controls/sso/gitlab/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Google Workspace",
               "slug": "/access-controls/sso/google-workspace/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "OIDC",
               "slug": "/access-controls/sso/oidc/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Okta",
               "slug": "/access-controls/sso/okta/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "OneLogin",
               "slug": "/access-controls/sso/one-login/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             }
           ]
         },
         {
           "title": "Teleport as an IdP",
           "slug": "/access-controls/idps/",
-          "forScopes": [
-            "enterprise",
-            "cloud"
-          ],
+          "forScopes": ["enterprise", "cloud"],
           "entries": [
             {
               "title": "SAML Identity Provider Guide",
               "slug": "/access-controls/idps/saml-guide/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Authenticate to Grafana with Teleport SAML",
               "slug": "/access-controls/idps/saml-grafana/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "SAML Identity Provider Reference",
               "slug": "/access-controls/idps/saml-reference/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             }
           ]
         },
         {
           "title": "Login Rules",
           "slug": "/access-controls/login-rules/",
-          "forScopes": [
-            "enterprise",
-            "cloud"
-          ],
+          "forScopes": ["enterprise", "cloud"],
           "entries": [
             {
               "title": "Set Up Login Rules",
               "slug": "/access-controls/login-rules/guide/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Login Rules Reference",
               "slug": "/access-controls/login-rules/reference/",
+              "forScopes": ["enterprise", "cloud"]
+            },
+            {
+              "title": "Terraform",
+              "slug": "/access-controls/login-rules/terraform/",
+              "forScopes": ["enterprise", "cloud"]
+            },
+            {
+              "title": "Kubernetes Operator",
+              "slug": "/access-controls/login-rules/kubernetes/",
+              "forScopes": ["enterprise"]
+            }
+          ]
+        },
+        {
+          "title": "Device Trust",
+          "slug": "/access-controls/device-trust/",
+          "forScopes": [
+            "enterprise",
+            "cloud"
+          ],
+          "entries": [
+            {
+              "title": "Set Up Device Trust",
+              "slug": "/access-controls/device-trust/guide/",
               "forScopes": [
                 "enterprise",
                 "cloud"
               ]
             },
             {
-              "title": "Terraform",
-              "slug": "/access-controls/login-rules/terraform/",
+              "title": "Set Up Auto-Enrollment",
+              "slug": "/access-controls/device-trust/auto-enrollment/",
               "forScopes": [
                 "enterprise",
                 "cloud"
               ]
             },
             {
-              "title": "Kubernetes Operator",
-              "slug": "/access-controls/login-rules/kubernetes/",
+              "title": "Jamf Integration",
+              "slug": "/access-controls/device-trust/jamf-integration/",
               "forScopes": [
-                "enterprise"
+                "enterprise",
+                "cloud"
               ]
             }
           ]
@@ -479,11 +376,7 @@
         {
           "title": "Access Requests",
           "slug": "/access-controls/access-requests/",
-          "forScopes": [
-            "oss",
-            "enterprise",
-            "cloud"
-          ],
+          "forScopes": ["oss", "enterprise", "cloud"],
           "entries": [
             {
               "title": "Role Requests",
@@ -492,110 +385,71 @@
             {
               "title": "Resource Requests",
               "slug": "/access-controls/access-requests/resource-requests/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Role Requests in OSS Teleport",
               "slug": "/access-controls/access-requests/oss-role-requests/",
-              "forScopes": [
-                "oss",
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["oss", "enterprise", "cloud"]
             }
           ]
         },
         {
           "title": "Access Request Plugins",
           "slug": "/access-controls/access-request-plugins/",
-          "forScopes": [
-            "enterprise",
-            "cloud"
-          ],
+          "forScopes": ["enterprise", "cloud"],
           "entries": [
             {
               "title": "Mattermost",
               "slug": "/access-controls/access-request-plugins/ssh-approval-mattermost/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Microsoft Teams",
               "slug": "/access-controls/access-request-plugins/ssh-approval-msteams/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "PagerDuty",
               "slug": "/access-controls/access-request-plugins/ssh-approval-pagerduty/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Jira",
               "slug": "/access-controls/access-request-plugins/ssh-approval-jira/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Slack",
               "slug": "/access-controls/access-request-plugins/ssh-approval-slack/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Email",
               "slug": "/access-controls/access-request-plugins/ssh-approval-email/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Discord",
               "slug": "/access-controls/access-request-plugins/ssh-approval-discord/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             }
           ]
         },
         {
           "title": "Compliance Frameworks",
           "slug": "/access-controls/compliance-frameworks/",
-          "forScopes": [
-            "enterprise",
-            "cloud"
-          ],
+          "forScopes": ["enterprise", "cloud"],
           "entries": [
             {
               "title": "FedRAMP",
               "slug": "/access-controls/compliance-frameworks/fedramp/",
-              "forScopes": [
-                "enterprise"
-              ]
+              "forScopes": ["enterprise"]
             },
             {
               "title": "SOC 2",
               "slug": "/access-controls/compliance-frameworks/soc2/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             }
           ]
         },
@@ -613,40 +467,20 @@
           "title": "Introduction",
           "slug": "/management/introduction/"
         },
-        {
-          "title": "Joining Teleport Services",
-          "slug": "/management/join-services-to-your-cluster/",
-          "entries": [
-            {
-              "title": "Via AWS EC2",
-              "slug": "/management/join-services-to-your-cluster/aws-ec2/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
-            },
-            {
-              "title": "Via AWS IAM",
-              "slug": "/management/join-services-to-your-cluster/aws-iam/"
-            },
-            {
-              "title": "Via Azure",
-              "slug": "/management/join-services-to-your-cluster/azure/"
-            },
-            {
-              "title": "Joining Services via Kubernetes ServiceAccount",
-              "slug": "/management/join-services-to-your-cluster/kubernetes/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+	{
+	  "title": "Using Dynamic Resources",
+	  "slug": "/management/dynamic-resources/",
+	  "entries": [            
+	    {
+              "title": "Kubernetes Operator (Preview)",
+              "slug": "/management/dynamic-resources/teleport-operator/"
             },
             {
-              "title": "Via a Join Token",
-              "slug": "/management/join-services-to-your-cluster/join-token/"
+              "title": "Terraform Provider",
+              "slug": "/management/dynamic-resources/terraform-provider/"
             }
-          ]
-        },
+	  ]
+	},
         {
           "title": "Admin Guides",
           "slug": "/management/admin/",
@@ -666,11 +500,7 @@
             {
               "title": "Troubleshooting",
               "slug": "/management/admin/troubleshooting/",
-              "forScopes": [
-                "oss",
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["oss", "enterprise", "cloud"]
             },
             {
               "title": "Upgrading the Teleport Binary",
@@ -697,10 +527,7 @@
             {
               "title": "Scaling",
               "slug": "/management/operations/scaling/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "Upgrading a Cluster",
@@ -709,10 +536,7 @@
             {
               "title": "Backup and Restore",
               "slug": "/management/operations/backup-restore/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "Cert Authority Rotation",
@@ -721,32 +545,22 @@
             {
               "title": "TLS Routing Migration",
               "slug": "/management/operations/tls-routing/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "Proxy Peering Migration (Preview)",
               "slug": "/management/operations/proxy-peering/",
-              "forScopes": [
-                "enterprise"
-              ]
+              "forScopes": ["enterprise"]
             },
             {
               "title": "Self-hosted automatic updates",
               "slug": "/management/operations/self-hosted-automatic-agent-updates/",
-              "forScopes": [
-                "enterprise"
-              ]
+              "forScopes": ["enterprise"]
             },
             {
               "title": "Enroll agent in automatic updates",
               "slug": "/management/operations/enroll-agent-into-automatic-updates/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             }
           ]
         },
@@ -764,14 +578,6 @@
           "title": "Integrations",
           "slug": "/management/guides/",
           "entries": [
-            {
-              "title": "Kubernetes Operator (Preview)",
-              "slug": "/management/guides/teleport-operator/"
-            },
-            {
-              "title": "Terraform Provider",
-              "slug": "/management/guides/terraform-provider/"
-            },
             {
               "title": "EC2 Tags",
               "slug": "/management/guides/ec2-tags/"
@@ -789,38 +595,22 @@
             {
               "title": "Health Monitoring",
               "slug": "/management/diagnostics/monitoring/",
-              "forScopes": [
-                "oss",
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["oss", "enterprise", "cloud"]
             },
             {
               "title": "Metrics",
               "slug": "/management/diagnostics/metrics/",
-              "forScopes": [
-                "oss",
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["oss", "enterprise", "cloud"]
             },
             {
               "title": "Collecting Profiles",
               "slug": "/management/diagnostics/profiles/",
-              "forScopes": [
-                "oss",
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["oss", "enterprise", "cloud"]
             },
             {
               "title": "Distributed Tracing",
               "slug": "/management/diagnostics/tracing/",
-              "forScopes": [
-                "oss",
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["oss", "enterprise", "cloud"]
             }
           ]
         },
@@ -831,34 +621,22 @@
             {
               "title": "Export Audit Events to Fluentd",
               "slug": "/management/export-audit-events/fluentd/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Export Audit Events to Datadog",
               "slug": "/management/export-audit-events/datadog/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Export Audit Events to the Elastic Stack",
               "slug": "/management/export-audit-events/elastic-stack/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Export Audit Events to Splunk",
               "slug": "/management/export-audit-events/splunk/",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ]
+              "forScopes": ["enterprise", "cloud"]
             }
           ]
         }
@@ -890,6 +668,50 @@
         }
       ]
     },
+    {
+      "title": "Run Teleport Agents",
+      "icon": "layers",
+      "entries": [
+        {
+          "title": "Introduction",
+          "slug": "/agents/introduction/"
+        },
+        {
+          "title": "Deploy via Terraform",
+          "slug": "/agents/deploy-agents-terraform/"
+        },
+        {
+          "title": "Join Services to Your Cluster",
+          "slug": "/agents/join-services-to-your-cluster/",
+          "entries": [
+            {
+              "title": "Via AWS EC2",
+              "slug": "/agents/join-services-to-your-cluster/aws-ec2/"
+            },
+            {
+              "title": "Via AWS IAM",
+              "slug": "/agents/join-services-to-your-cluster/aws-iam/"
+            },
+            {
+              "title": "Via Azure",
+              "slug": "/agents/join-services-to-your-cluster/azure/"
+            },
+            {
+              "title": "Joining Services via Kubernetes ServiceAccount",
+              "slug": "/agents/join-services-to-your-cluster/kubernetes/"
+            },
+            {
+              "title": "Via GCP",
+              "slug": "/agents/join-services-to-your-cluster/gcp/"
+            },
+            {
+              "title": "Via a Join Token",
+              "slug": "/agents/join-services-to-your-cluster/join-token/"
+            }
+          ]
+        }
+      ]
+    },
     {
       "icon": "window",
       "title": "Application Access",
@@ -971,18 +793,22 @@
         {
           "title": "Protect Okta Applications and Groups (Preview)",
           "slug": "/application-access/okta/",
+          "forScopes": ["enterprise", "cloud"],
           "entries": [
             {
               "title": "Okta Service",
-              "slug": "/application-access/okta/guide/"
+              "slug": "/application-access/okta/guide/",
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Architecture",
-              "slug": "/application-access/okta/architecture/"
+              "slug": "/application-access/okta/architecture/",
+              "forScopes": ["enterprise", "cloud"]
             },
             {
               "title": "Reference",
-              "slug": "/application-access/okta/reference/"
+              "slug": "/application-access/okta/reference/",
+              "forScopes": ["enterprise", "cloud"]
             }
           ]
         },
@@ -1023,10 +849,7 @@
             {
               "title": "Recording Proxy Mode",
               "slug": "/server-access/guides/recording-proxy-mode/",
-              "forScopes": [
-                "oss",
-                "enterprise"
-              ]
+              "forScopes": ["oss", "enterprise"]
             },
             {
               "title": "BPF Session Recording",
@@ -1157,12 +980,12 @@
           "slug": "/database-access/guides/",
           "entries": [
             {
-               "title": "AWS Cross-Account",
-               "slug": "/database-access/guides/aws-cross-account/"
+              "title": "AWS Cross-Account",
+              "slug": "/database-access/guides/aws-cross-account/"
             },
             {
-               "title": "AWS DynamoDB",
-               "slug": "/database-access/guides/aws-dynamodb/"
+              "title": "AWS DynamoDB",
+              "slug": "/database-access/guides/aws-dynamodb/"
             },
             {
               "title": "AWS ElastiCache & MemoryDB",
@@ -1266,10 +1089,7 @@
             },
             {
               "title": "Self-Hosted Oracle (Preview)",
-              "forScopes": [
-                "enterprise",
-                "cloud"
-              ],
+              "forScopes": ["enterprise", "cloud"],
               "slug": "/database-access/guides/oracle-self-hosted/"
             },
             {
@@ -1339,10 +1159,7 @@
         {
           "title": "Getting Started",
           "slug": "/desktop-access/getting-started/",
-          "forScopes": [
-            "enterprise",
-            "cloud"
-          ]
+          "forScopes": ["enterprise", "cloud"]
         },
         {
           "title": "Active Directory",
@@ -1551,10 +1368,7 @@
         {
           "title": "Storage Backends",
           "slug": "/reference/backends/",
-          "forScopes": [
-            "oss",
-            "enterprise"
-          ]
+          "forScopes": ["oss", "enterprise"]
         },
         {
           "title": "Networking",
@@ -1663,10 +1477,10 @@
               "title": "How to Contribute",
               "slug": "/contributing/documentation/how-to-contribute/"
             },
-	    {
-	       "title": "Reviewing Documentation Changes",
-	       "slug": "/contributing/documentation/reviewing-docs/"
-	    },
+            {
+              "title": "Reviewing Documentation Changes",
+              "slug": "/contributing/documentation/reviewing-docs/"
+            },
             {
               "title": "Creating Documentation Issues",
               "slug": "/contributing/documentation/issues/"
@@ -1693,8 +1507,8 @@
       "aws_secret_access_key": "zyxw9876-this-is-an-example"
     },
     "cloud": {
-      "version": "12.4.5",
-      "major_version": "12",
+      "version": "13.1.5",
+      "major_version": "13",
       "sla": {
         "monthly_percentage": "99.9%",
         "monthly_downtime": "44 minutes"
@@ -1873,7 +1687,7 @@
     },
     {
       "source": "/cloud/",
-      "destination": "/choose-an-edition/teleport-cloud/",
+      "destination": "/choose-an-edition/teleport-cloud/introduction/",
       "permanent": true
     },
     {
@@ -1898,7 +1712,7 @@
     },
     {
       "source": "/quickstart/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
@@ -1908,7 +1722,7 @@
     },
     {
       "source": "/preview/cloud/",
-      "destination": "/choose-an-edition/teleport-cloud/",
+      "destination": "/choose-an-edition/teleport-cloud/introduction/",
       "permanent": true
     },
     {
@@ -1963,7 +1777,7 @@
     },
     {
       "source": "/setup/guides/joining-nodes-aws/",
-      "destination": "/management/join-services-to-your-cluster/aws-iam/",
+      "destination": "/agents/join-services-to-your-cluster/aws-iam/",
       "permanent": true
     },
     {
@@ -1998,7 +1812,7 @@
     },
     {
       "source": "/getting-started/digitalocean/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
@@ -2203,7 +2017,7 @@
     },
     {
       "source": "/setup/deployments/digitalocean/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
@@ -2253,7 +2067,7 @@
     },
     {
       "source": "/getting-started/linux-server/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
@@ -2278,7 +2092,7 @@
     },
     {
       "source": "/cloud/introduction/",
-      "destination": "/choose-an-edition/teleport-cloud/",
+      "destination": "/choose-an-edition/teleport-cloud/introduction/",
       "permanent": true
     },
     {
@@ -2313,7 +2127,7 @@
     },
     {
       "source": "/setup/admin/adding-nodes/",
-      "destination": "/management/join-services-to-your-cluster/join-token/",
+      "destination": "/agents/join-services-to-your-cluster/join-token/",
       "permanent": true
     },
     {
@@ -2368,12 +2182,12 @@
     },
     {
       "source": "/setup/guides/joining-nodes-aws-ec2/",
-      "destination": "/management/join-services-to-your-cluster/aws-ec2/",
+      "destination": "/agents/join-services-to-your-cluster/aws-ec2/",
       "permanent": true
     },
     {
       "source": "/setup/guides/joining-nodes-aws-iam/",
-      "destination": "/management/join-services-to-your-cluster/aws-iam/",
+      "destination": "/agents/join-services-to-your-cluster/aws-iam/",
       "permanent": true
     },
     {
@@ -2383,12 +2197,12 @@
     },
     {
       "source": "/setup/guides/teleport-operator/",
-      "destination": "/management/guides/teleport-operator/",
+      "destination": "/management/dynamic-resources/teleport-operator/",
       "permanent": true
     },
     {
       "source": "/setup/guides/terraform-provider/",
-      "destination": "/management/guides/terraform-provider/",
+      "destination": "/management/dynamic-resources/terraform-provider/",
       "permanent": true
     },
     {
@@ -2508,12 +2322,12 @@
     },
     {
       "source": "/getting-started/docker-compose/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
       "source": "/getting-started/local-kubernetes/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
@@ -2548,7 +2362,7 @@
     },
     {
       "source": "/deploy-a-cluster/teleport-cloud/introduction/",
-      "destination": "/choose-an-edition/teleport-cloud/",
+      "destination": "/choose-an-edition/teleport-cloud/introduction/",
       "permanent": true
     },
     {
@@ -2578,17 +2392,17 @@
     },
     {
       "source": "/deploy-a-cluster/deployments/digitalocean/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
       "source": "/deploy-a-cluster/open-source/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
       "source": "/getting-started/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
@@ -2653,7 +2467,7 @@
     },
     {
       "source": "/try-out-teleport/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
@@ -2718,52 +2532,52 @@
     },
     {
       "source": "/management/guides/joining-nodes-aws-ec2/",
-      "destination": "/management/join-services-to-your-cluster/aws-ec2/",
+      "destination": "/agents/join-services-to-your-cluster/aws-ec2/",
       "permanent": true
     },
     {
       "source": "/management/guides/joining-nodes-aws-iam/",
-      "destination": "/management/join-services-to-your-cluster/aws-iam/",
+      "destination": "/agents/join-services-to-your-cluster/aws-iam/",
       "permanent": true
     },
     {
       "source": "/management/admin/adding-nodes/",
-      "destination": "/management/join-services-to-your-cluster/join-token/",
+      "destination": "/agents/join-services-to-your-cluster/join-token/",
       "permanent": true
     },
     {
       "source": "/management/guides/joining-nodes-azure/",
-      "destination": "/management/join-services-to-your-cluster/azure/",
+      "destination": "/agents/join-services-to-your-cluster/azure/",
       "permanent": true
     },
     {
       "source": "/management/guides/joining-services-kubernetes-serviceaccount/",
-      "destination": "/management/join-services-to-your-cluster/kubernetes/",
+      "destination": "/agents/join-services-to-your-cluster/kubernetes/",
       "permanent": true
     },
     {
       "source": "/try-out-teleport/browser-labs/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
       "source": "/try-out-teleport/digitalocean/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
       "source": "/try-out-teleport/docker-compose/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
       "source": "/try-out-teleport/introduction/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
       "source": "/try-out-teleport/local-kubernetes/",
-      "destination": "/get-started/",
+      "destination": "/",
       "permanent": true
     },
     {
@@ -2790,6 +2604,26 @@
       "source": "/choose-an-edition/teleport-cloud/",
       "destination": "/choose-an-edition/teleport-cloud/introduction/",
       "permanent": true
+    },
+    {
+      "source": "/access-controls/guides/device-trust/",
+      "destination": "/access-controls/device-trust/guide/",
+      "permanent": true
+    },
+    {
+      "source": "/management/guides/teleport-operator/",
+      "destination": "/management/dynamic-resources/teleport-operator/",
+      "permanent": true
+    },
+    {
+      "source": "/management/guides/terraform-provider/",
+      "destination": "/management/dynamic-resources/terraform-provider/",
+      "permanent": true
+    },
+    {
+      "source": "/get-started/",
+      "destination": "/",
+      "permanent": true
     }
   ]
 }
diff --git a/docs/cspell.json b/docs/cspell.json
index 8ad3564be15e6..7ebcf3eb9d828 100644
--- a/docs/cspell.json
+++ b/docs/cspell.json
@@ -8,6 +8,7 @@
     "AICPA",
     "AICPA’s",
     "AKIA",
+    "ALPN",
     "AMAZ",
     "ANPAW",
     "APPDATA",
@@ -21,7 +22,6 @@
     "Aqxs",
     "Archlinux",
     "Authy",
-    "autoload",
     "BDRVJUSUZ",
     "BSFD",
     "BUCKETNAME",
@@ -33,8 +33,8 @@
     "CHANGEME",
     "CLOUDSDK",
     "CTAP",
+    "CXXXXXXXXX",
     "Cgajq",
-    "compinit",
     "DBSIZE",
     "DEBU",
     "DHDR",
@@ -48,11 +48,13 @@
     "Divio's",
     "EBSCSI",
     "ECMWF",
+    "EKCert",
     "ERRO",
     "Elastcsearch",
     "Elasticvue",
     "Exrch",
     "FGHIJ",
+    "FIPS",
     "FLUSHALL",
     "FLUSHDB",
     "FMPFM",
@@ -64,12 +66,12 @@
     "GCP's",
     "GENPASS",
     "GHES",
+    "GODEBUG",
     "GOMAXPROCS",
+    "GSLB",
     "Gbps",
     "Goland",
     "Grafana's",
-    "gslb",
-    "GSLB",
     "Gtczk",
     "HSTS",
     "Hqlo",
@@ -89,6 +91,7 @@
     "JDBC",
     "JWTs",
     "JYAUAA",
+    "Jamf",
     "Jetstack",
     "Jlbm",
     "Jlbn",
@@ -118,18 +121,19 @@
     "NOKEY",
     "NOPASSWD",
     "NVGJ",
-    "Obxo",
     "ODBC",
     "OIDC",
+    "OTLP",
+    "Obxo",
     "Olsi",
     "Olsia",
     "OpenAI",
     "Opsgenie",
     "Orapki",
-    "OTLP",
     "PFDEBUG",
     "PFSELFTEST",
     "PGPASSWORD",
+    "POSIX",
     "POSTALCODE",
     "PSUBSCRIBE",
     "PSYNC",
@@ -145,17 +149,20 @@
     "REPLCONF",
     "REPLICAOF",
     "RPID",
+    "RSQL",
     "Rdik",
     "Relogging",
     "Relogin",
     "SAMLIDP",
     "SECURITYADMIN",
     "SIEM",
+    "SIGINT",
     "SLAVEOF",
     "SLOWLOG",
     "SSUBSCRIBE",
     "SSWS",
     "SUNSUBSCRIBE",
+    "SUPATH",
     "Shockbyte",
     "Slackbot",
     "Sllavd",
@@ -168,16 +175,17 @@
     "TCPS",
     "TELEPORTING",
     "TENANTID",
+    "TESTDEVICE",
     "TOTP",
     "TOUCHID",
     "Tele",
     "Templating",
-    "TESTDEVICE",
     "Tmkx",
     "Toboth",
     "Traefik",
     "Upsert",
     "Upserted",
+    "Upserts",
     "Uwhp",
     "VSVZY",
     "Vhka",
@@ -237,8 +245,10 @@
     "authteleportconfig",
     "authz",
     "autodiscovery",
+    "autoload",
     "automount",
     "autoscale",
+    "awly",
     "awsapp",
     "awsathena",
     "awscli",
@@ -248,6 +258,7 @@
     "azuread",
     "azuredatabases",
     "backoff",
+    "backported",
     "backporting",
     "backports",
     "behaviour",
@@ -255,6 +266,7 @@
     "bfhunter",
     "bjoerger",
     "bluemix",
+    "boltdb",
     "boto",
     "buildbox",
     "cacerts",
@@ -291,6 +303,8 @@
     "clusterroles",
     "cockroachdb",
     "codingllama",
+    "compat",
+    "compinit",
     "cond",
     "configmap",
     "connectorname",
@@ -310,6 +324,7 @@
     "dbeaver",
     "dbgroup",
     "dbname",
+    "dbreviewer",
     "dbuser",
     "deanonymize",
     "deregisters",
@@ -360,6 +375,7 @@
     "fedmeatadataxml",
     "fedramp",
     "fedrampfips",
+    "fips",
     "firstname",
     "fklvk",
     "flexi",
@@ -380,11 +396,13 @@
     "goroutines",
     "goteleport",
     "gots",
+    "goxmldsig",
     "gpupdate",
     "grafana",
     "grav",
     "groupclaim",
     "gserviceaccount",
+    "gslb",
     "gsutil",
     "gworkspace",
     "hashfile",
@@ -448,6 +466,8 @@
     "libcloudhsm",
     "libdefaults",
     "libfido",
+    "libgcc",
+    "libm",
     "lmnop",
     "loadbalancer",
     "localca",
@@ -491,6 +511,7 @@
     "myauth",
     "mycluster",
     "mycommand",
+    "mydevice",
     "myelastic",
     "myendpoint",
     "mygroup",
@@ -561,8 +582,8 @@
     "pagerduty",
     "pagerdutyapikey",
     "pagerdutyapikeyfromsecret",
-    "pastable",
     "parquetlog",
+    "pastable",
     "pasteable",
     "pgaadauth",
     "pidof",
@@ -595,6 +616,7 @@
     "rbacv",
     "rdbms",
     "rdns",
+    "rdpsnd",
     "rdsca",
     "rdsproxy",
     "readall",
@@ -608,6 +630,7 @@
     "relogged",
     "replaceall",
     "replicaset",
+    "requestable",
     "requirepass",
     "reversetunnel",
     "reviewee",
@@ -621,6 +644,7 @@
     "rtrzn",
     "runcommand",
     "runscript",
+    "russellhaering",
     "russjones",
     "sadas",
     "samlauthentication",
@@ -640,6 +664,7 @@
     "serviceaccountname",
     "serviceaccounts",
     "serviceacct",
+    "servicecfg",
     "serviceid",
     "session",
     "setspn",
@@ -663,14 +688,18 @@
     "storageenabled",
     "strslice",
     "structs",
+    "subgroups",
     "subkind",
     "sudoer",
     "syscalls",
+    "sysvinit",
     "tadmin",
     "tbot",
     "tbotrole",
+    "tcpip",
     "tcpout",
     "tctl",
+    "teleadmins",
     "telenode",
     "teleportauditlogssofailed",
     "teleportdemo",
@@ -682,6 +711,7 @@
     "teleportyaml",
     "tenantname",
     "testuser",
+    "tfvars",
     "thisisunsafe",
     "thred",
     "timechart",
@@ -710,11 +740,13 @@
     "updaterversionserver",
     "uqcje",
     "urandom",
+    "userdata",
     "userdel",
     "usermod",
     "usernameclaim",
     "usernameless",
     "userprincipalname",
+    "utmp",
     "uuidgen",
     "viewstore",
     "vkxz",
@@ -723,6 +755,7 @@
     "walkthrough",
     "watcherjob",
     "webapi",
+    "webapps",
     "webauthn",
     "webauthnwin",
     "webclient",
@@ -731,10 +764,12 @@
     "webproxy",
     "webui",
     "westeurope",
+    "winadj",
     "windowsaccountname",
     "windowsdesktop",
     "winserver",
     "workgroups",
+    "wtmp",
     "xample",
     "xauth",
     "xclip",
@@ -751,9 +786,8 @@
     "yubikey",
     "yubishm",
     "znmqk",
-    "zxvf"
+    "zxvf",
+    "zztop"
   ],
-  "flagWords": [
-    "hte"
-  ]
-}
\ No newline at end of file
+  "flagWords": ["hte"]
+}
diff --git a/docs/img/access-controls/device-trust/jamf-setup-1.png b/docs/img/access-controls/device-trust/jamf-setup-1.png
new file mode 100644
index 0000000000000..473c83906e787
Binary files /dev/null and b/docs/img/access-controls/device-trust/jamf-setup-1.png differ
diff --git a/docs/img/access-controls/device-trust/jamf-setup-2.png b/docs/img/access-controls/device-trust/jamf-setup-2.png
new file mode 100644
index 0000000000000..fb376dee8e5ae
Binary files /dev/null and b/docs/img/access-controls/device-trust/jamf-setup-2.png differ
diff --git a/docs/img/adfs-add-provider-trust.png b/docs/img/adfs-add-provider-trust.png
new file mode 100644
index 0000000000000..4822b79ed16f8
Binary files /dev/null and b/docs/img/adfs-add-provider-trust.png differ
diff --git a/docs/img/adfs-add-teleport-cert.png b/docs/img/adfs-add-teleport-cert.png
new file mode 100644
index 0000000000000..7b38942ee2d5a
Binary files /dev/null and b/docs/img/adfs-add-teleport-cert.png differ
diff --git a/docs/img/database-access/guides/atlas/atlas-add-aws-iam-user.png b/docs/img/database-access/guides/atlas/atlas-add-aws-iam-user.png
new file mode 100644
index 0000000000000..6d6f0b75ea746
Binary files /dev/null and b/docs/img/database-access/guides/atlas/atlas-add-aws-iam-user.png differ
diff --git a/docs/img/desktop-access/session-recording@2x.png b/docs/img/desktop-access/session-recording@2x.png
index 9126c554bfe32..c7830c584e963 100644
Binary files a/docs/img/desktop-access/session-recording@2x.png and b/docs/img/desktop-access/session-recording@2x.png differ
diff --git a/docs/img/googleoidc/clientid-creation.png b/docs/img/googleoidc/clientid-creation.png
deleted file mode 100644
index f6e16f2588717..0000000000000
Binary files a/docs/img/googleoidc/clientid-creation.png and /dev/null differ
diff --git a/docs/img/googleoidc/clientid-data.png b/docs/img/googleoidc/clientid-data.png
deleted file mode 100644
index ba00ce48d2d0a..0000000000000
Binary files a/docs/img/googleoidc/clientid-data.png and /dev/null differ
diff --git a/docs/img/googleoidc/consent-screen-1.png b/docs/img/googleoidc/consent-screen-1.png
deleted file mode 100644
index fb1794813a46c..0000000000000
Binary files a/docs/img/googleoidc/consent-screen-1.png and /dev/null differ
diff --git a/docs/img/googleoidc/consent-screen-2.png b/docs/img/googleoidc/consent-screen-2.png
deleted file mode 100644
index 7cb9429d690b1..0000000000000
Binary files a/docs/img/googleoidc/consent-screen-2.png and /dev/null differ
diff --git a/docs/img/googleoidc/domainwidedelegation.png b/docs/img/googleoidc/domainwidedelegation.png
deleted file mode 100644
index 4dc6186007079..0000000000000
Binary files a/docs/img/googleoidc/domainwidedelegation.png and /dev/null differ
diff --git a/docs/img/googleoidc/new-project.png b/docs/img/googleoidc/new-project.png
deleted file mode 100644
index a455bc4340ef8..0000000000000
Binary files a/docs/img/googleoidc/new-project.png and /dev/null differ
diff --git a/docs/img/googleoidc/serviceacct-creation.png b/docs/img/googleoidc/serviceacct-creation.png
deleted file mode 100644
index 521096416591c..0000000000000
Binary files a/docs/img/googleoidc/serviceacct-creation.png and /dev/null differ
diff --git a/docs/img/googleoidc/serviceacct-key.png b/docs/img/googleoidc/serviceacct-key.png
deleted file mode 100644
index bd1da8d008044..0000000000000
Binary files a/docs/img/googleoidc/serviceacct-key.png and /dev/null differ
diff --git a/docs/img/googleoidc/serviceacct-uniqueid.png b/docs/img/googleoidc/serviceacct-uniqueid.png
deleted file mode 100644
index d0259621095e7..0000000000000
Binary files a/docs/img/googleoidc/serviceacct-uniqueid.png and /dev/null differ
diff --git a/docs/img/linux-server-diagram.png b/docs/img/linux-server-diagram.png
new file mode 100644
index 0000000000000..fb8cb23ea2519
Binary files /dev/null and b/docs/img/linux-server-diagram.png differ
diff --git a/docs/img/management/spacelift/apply-success.png b/docs/img/management/spacelift/apply-success.png
new file mode 100644
index 0000000000000..84be9b4cca6f9
Binary files /dev/null and b/docs/img/management/spacelift/apply-success.png differ
diff --git a/docs/img/management/spacelift/id-file.png b/docs/img/management/spacelift/id-file.png
new file mode 100644
index 0000000000000..7b321912356c1
Binary files /dev/null and b/docs/img/management/spacelift/id-file.png differ
diff --git a/docs/img/management/spacelift/newstack.png b/docs/img/management/spacelift/newstack.png
new file mode 100644
index 0000000000000..0d7aeba18146e
Binary files /dev/null and b/docs/img/management/spacelift/newstack.png differ
diff --git a/docs/img/management/spacelift/pr-run.png b/docs/img/management/spacelift/pr-run.png
new file mode 100644
index 0000000000000..07aeb918b0aa3
Binary files /dev/null and b/docs/img/management/spacelift/pr-run.png differ
diff --git a/docs/img/sso/gitlab/gitlab-oidc-0.png b/docs/img/sso/gitlab/gitlab-oidc-0.png
index 48fba082abefd..214e15cb9d248 100644
Binary files a/docs/img/sso/gitlab/gitlab-oidc-0.png and b/docs/img/sso/gitlab/gitlab-oidc-0.png differ
diff --git a/docs/img/sso/gitlab/gitlab-oidc-1.png b/docs/img/sso/gitlab/gitlab-oidc-1.png
index e783af931ce99..e3219584d73f0 100644
Binary files a/docs/img/sso/gitlab/gitlab-oidc-1.png and b/docs/img/sso/gitlab/gitlab-oidc-1.png differ
diff --git a/docs/img/sso/googleoidc/clientid-creation.png b/docs/img/sso/googleoidc/clientid-creation.png
new file mode 100644
index 0000000000000..dae4d7b62b8fe
Binary files /dev/null and b/docs/img/sso/googleoidc/clientid-creation.png differ
diff --git a/docs/img/sso/googleoidc/clientid-data.png b/docs/img/sso/googleoidc/clientid-data.png
new file mode 100644
index 0000000000000..623f2f68564be
Binary files /dev/null and b/docs/img/sso/googleoidc/clientid-data.png differ
diff --git a/docs/img/sso/googleoidc/consent-screen-1.png b/docs/img/sso/googleoidc/consent-screen-1.png
new file mode 100644
index 0000000000000..5089bd2b43721
Binary files /dev/null and b/docs/img/sso/googleoidc/consent-screen-1.png differ
diff --git a/docs/img/sso/googleoidc/consent-screen-2.png b/docs/img/sso/googleoidc/consent-screen-2.png
new file mode 100644
index 0000000000000..b0b63a948abad
Binary files /dev/null and b/docs/img/sso/googleoidc/consent-screen-2.png differ
diff --git a/docs/img/sso/googleoidc/create-oauth-client-id.png b/docs/img/sso/googleoidc/create-oauth-client-id.png
new file mode 100644
index 0000000000000..972d6343429f2
Binary files /dev/null and b/docs/img/sso/googleoidc/create-oauth-client-id.png differ
diff --git a/docs/img/sso/googleoidc/create-service-account.png b/docs/img/sso/googleoidc/create-service-account.png
new file mode 100644
index 0000000000000..a935d6eb7526a
Binary files /dev/null and b/docs/img/sso/googleoidc/create-service-account.png differ
diff --git a/docs/img/sso/googleoidc/domainwidedelegation.png b/docs/img/sso/googleoidc/domainwidedelegation.png
new file mode 100644
index 0000000000000..dc310832502b0
Binary files /dev/null and b/docs/img/sso/googleoidc/domainwidedelegation.png differ
diff --git a/docs/img/sso/googleoidc/new-project.png b/docs/img/sso/googleoidc/new-project.png
new file mode 100644
index 0000000000000..0b4798a003abe
Binary files /dev/null and b/docs/img/sso/googleoidc/new-project.png differ
diff --git a/docs/img/sso/googleoidc/serviceacct-creation.png b/docs/img/sso/googleoidc/serviceacct-creation.png
new file mode 100644
index 0000000000000..bfe362ac6ae26
Binary files /dev/null and b/docs/img/sso/googleoidc/serviceacct-creation.png differ
diff --git a/docs/img/sso/googleoidc/serviceacct-key.png b/docs/img/sso/googleoidc/serviceacct-key.png
new file mode 100644
index 0000000000000..2791620e3d07b
Binary files /dev/null and b/docs/img/sso/googleoidc/serviceacct-key.png differ
diff --git a/docs/img/sso/googleoidc/serviceacct-uniqueid.png b/docs/img/sso/googleoidc/serviceacct-uniqueid.png
new file mode 100644
index 0000000000000..a04d789860bb4
Binary files /dev/null and b/docs/img/sso/googleoidc/serviceacct-uniqueid.png differ
diff --git a/docs/img/sso/okta/setup-redirection.png b/docs/img/sso/okta/setup-redirection.png
index 026d926d5fe58..b70d53c96595c 100644
Binary files a/docs/img/sso/okta/setup-redirection.png and b/docs/img/sso/okta/setup-redirection.png differ
diff --git a/docs/img/sso/teleportauditlogssofailed.png b/docs/img/sso/teleportauditlogssofailed.png
index 6488882188ed3..af386991364bf 100644
Binary files a/docs/img/sso/teleportauditlogssofailed.png and b/docs/img/sso/teleportauditlogssofailed.png differ
diff --git a/docs/pages/access-controls/access-request-plugins/ssh-approval-slack.mdx b/docs/pages/access-controls/access-request-plugins/ssh-approval-slack.mdx
index 8bc1c324f0cbb..e3ddb2a5c5709 100644
--- a/docs/pages/access-controls/access-request-plugins/ssh-approval-slack.mdx
+++ b/docs/pages/access-controls/access-request-plugins/ssh-approval-slack.mdx
@@ -5,9 +5,9 @@ description: How to set up Teleport's Slack plugin for privilege elevation appro
 
 This guide will explain how to set up Slack to receive Access Request messages
 from Teleport. Teleport's Slack integration notifies individuals and channels of
-Access Requests. Users can then approve and deny Access Requests from within
-Slack, making it easier to implement security best practices without
-compromising productivity.
+Access Requests. Users are then directed to log in to the Teleport cluster where
+they can approve and deny Access Requests, making it easier to implement security 
+best practices without compromising productivity.
 
 (!docs/pages/includes/plugins/diagram.mdx api="Slack" action="Listen for Access Requests" messages="Slack messages" !)
 
diff --git a/docs/pages/access-controls/access-requests/resource-requests.mdx b/docs/pages/access-controls/access-requests/resource-requests.mdx
index 92c7bf621324e..74f5be34441d2 100644
--- a/docs/pages/access-controls/access-requests/resource-requests.mdx
+++ b/docs/pages/access-controls/access-requests/resource-requests.mdx
@@ -41,6 +41,14 @@ upgraded to version 10.
 
 ## Step 1/8. Create the requester role
 
+<Admonition type="note">
+As of version 13.1.2, Teleport comes with built-in `reviewer` and `requester` roles that
+are defined similarly to the ones presented here. If you are looking to quickly try out
+Access Requests, you can skip to step 3 and use these built-in roles. However, if you are
+using an earlier version of Teleport or you are looking to get general guidance for creating
+roles for Access Requests, steps 1 and 2 are still useful.
+</Admonition>
+
 This role allows the requester to search for resources accessible by the
 `access` role (all resources by default) and request access to them.
 
diff --git a/docs/pages/access-controls/compliance-frameworks/soc2.mdx b/docs/pages/access-controls/compliance-frameworks/soc2.mdx
index 46f998acedc00..1ebbc51a4b06e 100644
--- a/docs/pages/access-controls/compliance-frameworks/soc2.mdx
+++ b/docs/pages/access-controls/compliance-frameworks/soc2.mdx
@@ -56,7 +56,7 @@ Each principle has many “Points of Focus” which will apply differently to di
 | CC6.1 - Manages Points of Access | Points of access by outside entities and the types of data that flow through the points of access are identified, inventoried, and managed. The types of individuals and systems using each point of access are identified, documented, and managed. | [Label Nodes to inventory and create rules](../../management/admin/labels.mdx) <br/><br/> [Create Labels from AWS Tags](../../management/guides/ec2-tags.mdx) <br/><br/>Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time. |
 | CC6.1 - Restricts Access to Information Assets | Combinations of data classification, separate data structures, port restrictions, access protocol restrictions, user identification, and digital certificates are used to establish access-control rules for information assets. | [Teleport uses Certificates to grant access and create access control rules](../../core-concepts.mdx) | 
 | CC6.1 - Manages Identification and Authentication | Identification and authentication requirements are established, documented, and managed for individuals and systems accessing entity information, infrastructure, and software. | Teleport makes setting policies for SSH requirements easy since it works in the cloud and on premise with the same authentication security standards. | 
-| CC6.1 - Manages Credentials for Infrastructure and Software | New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use. | [Invite nodes to your cluster with short lived tokens](../../management/join-services-to-your-cluster/join-token.mdx) | 
+| CC6.1 - Manages Credentials for Infrastructure and Software | New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use. | [Invite nodes to your cluster with short lived tokens](../../agents/join-services-to-your-cluster/join-token.mdx) | 
 | CC6.1 - Uses Encryption to Protect Data | The entity uses encryption to supplement other measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk. | Teleport Audit logs can use DynamoDB encryption at rest. | 
 | CC6.1 - Protects Encryption Keys | Processes are in place to protect encryption keys during generation, storage, use, and destruction. | Teleport acts as a Certificate Authority to issue SSH and x509 user certificates that are signed by the CA and are (by default) short-lived. SSH host certificates are also signed by the CA and rotated automatically  | 
 | CC6.2 - Controls Access Credentials to Protected Assets | Information asset access credentials are created based on an authorization from the system&#39;s asset owner or authorized custodian. | [Request Approval from the command line](../../reference/cli.mdx#tctl-request-approve) <br/><br/> [Build Approval Workflows with Access Requests](../../access-controls/access-requests.mdx) <br/><br/> [Use Plugins to send approvals to tools like Slack or Jira](../../access-controls/access-requests.mdx) |
diff --git a/docs/pages/access-controls/device-trust.mdx b/docs/pages/access-controls/device-trust.mdx
new file mode 100644
index 0000000000000..7bffc3c6c8c3a
--- /dev/null
+++ b/docs/pages/access-controls/device-trust.mdx
@@ -0,0 +1,31 @@
+---
+title: Device Trust (Preview)
+description: Use and enforce trusted devices with Teleport
+layout: tocless-doc
+---
+
+<Admonition type="warning">
+Device Trust is currently in Preview mode.
+</Admonition>
+
+Device Trust allows Teleport admins to enforce the use of trusted devices.
+Resources protected by the device mode "required" will enforce the use of a
+trusted device, in addition to establishing the user's identity and enforcing
+the necessary roles. Furthermore, users using a trusted device leave audit
+trails that include the device's information.
+
+The device trust preview works on macOS and Windows devices and supports the
+following Teleport features:
+
+- SSH access enforcement
+- Database access enforcement
+- Kubernetes access enforcement
+
+Support for other operating systems and access features is planned for upcoming
+Teleport versions.
+
+## Guides
+
+- [Set Up Device Trust](./device-trust/guide.mdx)
+- [Set Up Auto-Enrollment](./device-trust/auto-enrollment.mdx)
+- [Jamf Integration](./device-trust/jamf-integration.mdx)
diff --git a/docs/pages/access-controls/device-trust/auto-enrollment.mdx b/docs/pages/access-controls/device-trust/auto-enrollment.mdx
new file mode 100644
index 0000000000000..13fbdd107a9f3
--- /dev/null
+++ b/docs/pages/access-controls/device-trust/auto-enrollment.mdx
@@ -0,0 +1,88 @@
+---
+title: Set Up Auto-Enrollment (Preview)
+description: Set Up Automatic Enrollment for Registered Devices
+---
+
+Auto-enrollment allows `tsh` to automatically enroll devices already registered
+in Teleport during the user's login. The registration may be
+[manual](./guide.mdx#step-12-register-a-trusted-device) or performed using an
+integration, like the [Jamf integration](./jamf-integration.mdx).
+
+<Admonition type="warning">
+Device Trust is currently in Preview mode.
+</Admonition>
+
+## Prerequisites
+
+(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+
+(!docs/pages/includes/device-trust/prereqs.mdx!)
+
+- [A previously-registered device](
+  ./guide.mdx#step-12-register-a-trusted-device) is necessary for
+  auto-enrollment to take place.
+
+## Step 1/2. Enable auto-enrollment
+
+Enable auto-enrollment in your cluster settings:
+
+<Tabs dropDownCaption="Teleport Deployment">
+<TabItem label="Dynamic Resources" options="Self-Hosted,Teleport Enterprise Cloud" >
+Modify the dynamic config resource using `tctl edit cluster_auth_preference`:
+
+```diff
+kind: cluster_auth_preference
+version: v2
+metadata:
+  name: cluster-auth-preference
+spec:
+  # ...
+  device_trust:
+    mode: "required"
++   auto_enroll: true
+```
+
+</TabItem>
+<TabItem label="Static Config" options="Self-Hosted">
+Edit the Auth Server's `teleport.yaml` file:
+
+```diff
+auth_service:
+  authentication:
+    # ...
+    device_trust:
++     auto_enroll: true
+```
+
+After saving the changes, restart the Teleport service.
+
+</TabItem>
+</Tabs>
+
+## Step 2/2. Login using a registered device
+
+Using a device previously registered in Teleport, logout and login again:
+
+```code
+$ tsh logout
+$ tsh login --proxy=teleport.example.com --user=alice
+All users logged out.
+Enter password for Teleport user alice:
+Tap any security key
+Detected security key tap
+> Profile URL:        https://teleport.example.com:443
+  Logged in as:       alice
+  Cluster:            teleport.example.com
+  Roles:              access, editor
+  Logins:             alice
+  Kubernetes:         enabled
+  Valid until:        2023-06-23 02:47:05 -0300 -03 [valid for 12h0m0s]
+  Extensions:         teleport-device-asset-tag, teleport-device-credential-id, teleport-device-id
+```
+
+The presence of the **teleport-device-\*** extensions shows that the device was
+successfully enrolled and authenticated.
+
+## Troubleshooting
+
+(!docs/pages/includes/device-trust/auto-enroll-troubleshooting.mdx!)
diff --git a/docs/pages/access-controls/guides/device-trust.mdx b/docs/pages/access-controls/device-trust/guide.mdx
similarity index 58%
rename from docs/pages/access-controls/guides/device-trust.mdx
rename to docs/pages/access-controls/device-trust/guide.mdx
index d4e30b2250c81..6f399b50a69ce 100644
--- a/docs/pages/access-controls/guides/device-trust.mdx
+++ b/docs/pages/access-controls/device-trust/guide.mdx
@@ -1,36 +1,27 @@
 ---
-title: "Device Trust (Preview)"
+title: Set Up Device Trust (Preview)
 description: Learn how to use and enforce trusted devices with Teleport
 videoBanner: gBQyj_X1LVw
 ---
 
 <Admonition type="warning">
 Device Trust is currently in Preview mode.
-
-Device Trust requires Teleport Enterprise v12+.
 </Admonition>
 
-Device Trust allows Teleport admins to enforce the use of trusted devices.
-Resources protected by the device mode "required" will enforce the use of a
-trusted device, in addition to establishing the user's identity and enforcing
-the necessary roles. Furthermore, users using a trusted device leave audit
-trails that include the device's information.
-
-The device trust preview works only with macOS devices and supports the
-following Teleport features:
-
-- SSH access enforcement
-- Database access enforcement
-- Kubernetes access enforcement
+## Concepts
 
-Support for other operating systems and access features is planned for upcoming
-Teleport versions.
+Device Trust leverages dedicated secure hardware in devices to store sensitive
+credentials. The specific implementation varies between types of devices.
 
-## Concepts
+On macOS devices, Device Trust uses the Secure Enclave in order to store a
+device private key. That key is used to solve device challenges issued by the
+Teleport Auth Server, proving the identity of the trusted device.
 
-Device Trust uses the Secure Enclave in macOS devices to store a device private
-key. That key is used to solve device challenges issued by the Teleport Auth
-Server, proving the identity of the trusted device.
+On Windows devices, a Trusted Platform Module (TPM) is used to perform an
+attestation as to the state of the device. This attestation is signed by a
+private key that is also protected by the TPM. The signed attestation ensures
+that the Teleport Auth Server knows both the state of the device and that the
+request has come from the device.
 
 Device management is divided into two separate phases: inventory management and
 device enrollment.
@@ -63,9 +54,7 @@ layer of protection.
 
 (!docs/pages/includes/commercial-prereqs-tabs.mdx!)
 
-- A signed and notarized `tsh` binary for enrollment.
-  [Download the macOS tsh installer](../../installation.mdx#macos).
-- A macOS device to register and enroll.
+(!docs/pages/includes/device-trust/prereqs.mdx!)
 
 ## Step 1/2. Register a trusted device
 
@@ -115,39 +104,64 @@ demonstrated in the following section.
 
 Make sure your user has the `device-admin` role:
 
-```code
-$ tctl edit users/alice
-```
-
-```diff
-kind: user
-metadata:
-  name: alice
-  # unrelated fields omitted.
-spec:
-  roles:
-  - access
-+ - device-admin # add this line
-version: v2
-```
+(!/docs/pages/includes/add-role-to-user.mdx role="device-admin"!)
 
 Relogin to fetch updated certificates:
 
 ```code
-$ tsh logout; tsh login --proxy=example.com --user=alice
+$ tsh logout; tsh login --proxy=teleport.example.com --user=alice
 ```
 
-Having the necessary permissions, let's add a device to the inventory. Replace
-the `$SERIAL` below with your macOS device serial number (visible under Apple ->
-"About This Mac" -> "Serial number", or use the command below).
+Before you can enroll the device, you need to register it. To register
+a device, you first need to determine its serial number.
+
+<Tabs>
+  <TabItem label="macOS">
+    The serial number of a macOS device can be determined in two ways.
+
+    Through the UI, visible under Apple -> "About This Mac" -> "Serial number".
+
+    Through the terminal:
+    ```code
+    $ ioreg -c IOPlatformExpertDevice -d 2 | grep -i IOPlatformSerialNumber | awk -F'"' '{print $4}'
+    (=devicetrust.asset_tag=)
+    ```
+  </TabItem>
+
+  <TabItem label="Windows">
+    Determining the serial number for a device running Windows is a little more
+    complicated than on macOS. This is because Windows devices can have multiple
+    serial numbers depending on the configuration made by the manufacturer.
+
+    Teleport will pick the first available value from the following:
+
+    - System asset tag
+    - System serial number
+    - Baseboard serial number
+
+    To find the value chosen by Teleport, run the following command:
+
+    ```code
+    $ tsh device collect
+    DeviceCollectedData {
+      ...
+      "serial_number": "(=devicetrust.asset_tag=)",
+      ...
+    }
+    ```
+  </TabItem>
+</Tabs>
+
+Replace <Var name="(=devicetrust.asset_tag=)" description="The serial number to be registered"/>
+with the serial number obtained from the device you wish to enroll and <Var name="OS" description="The OS of the device being registered"/>
+with `macos` or `windows`, and execute the following command:
 
 ```code
-$ SERIAL="$(ioreg -c IOPlatformExpertDevice -d 2 | grep -i IOPlatformSerialNumber | awk -F'"' '{print $4}')"
-$ tctl devices add --os=macos --asset-tag="$SERIAL"
-Device (=devicetrust.asset_tag=)/macOS added to the inventory
+$ tctl devices add --os="<Var name="OS"/> --asset-tag=<Var name="(=devicetrust.asset_tag=)"/>"
+Device <Var name="(=devicetrust.asset_tag=)"/>/<Var name="OS"/> added to the inventory
 ```
 
-View registered devices:
+Use `tctl` to check that the device has been registered:
 
 ```code
 $ tctl devices ls
@@ -156,9 +170,6 @@ Asset Tag    OS    Enroll Status Device ID
 (=devicetrust.asset_tag=) macOS not enrolled  (=devicetrust.device_id=)
 ```
 
-A registered device is a device that Teleport knows about. Once a registered
-device is enrolled, it becomes a trusted device.
-
 <Admonition type="tip" title="Removing Devices">
 A device that is no longer in use may be removed using `tctl devices rm
 --device-id=<ID>` or `tctl devices rm --asset-tag=<SERIAL>`.
@@ -170,8 +181,9 @@ A registered device becomes a trusted device after it goes through the
 enrollment ceremony. Enrollment exchanges an enrollment token, created by a
 device admin, for the opportunity to enroll the corresponding device.
 
-macOS enrollments are tied to the current user in the device. If the same device
-is handed to a new user, they will need to perform enrollment again.
+A device enrollment is specifically linked to the user who performed the
+enrollment. If the same device is handed to a new user, that user must enroll
+the device again.
 
 To create an enrollment token run the following command, where `--asset-tag` is
 the serial number of the device we want to enroll.
@@ -189,11 +201,95 @@ command printed by `tctl devices enroll`:
 $ tsh device enroll --token=(=devicetrust.enroll_token=)
 Device "(=devicetrust.asset_tag=)"/macOS enrolled
 
-$ tsh logout; tsh login --proxy=example.com --user=alice # fetch new certificates
+$ tsh logout
+$ tsh login --proxy=teleport.example.com --user=alice # fetch new certificates
 ```
 
+<Admonition type="warning" title="Windows">
+On Windows, the `tsh device enroll` command attempts to elevate to
+administrator privileges on the device. Privilege elevation is required to
+perform a TPM Credential Activation. This step is only required for
+enrollment and is not required on future device authentications.
+</Admonition>
+
 The device above is now a trusted device.
 
+## Recommended: Configuring a TPM EKCert CA allow-list
+
+This advice only applies to Device Trust on platforms that use TPMs. For now,
+this is just Windows.
+
+Some TPMs include a certificate—known as an EKCert—signed by the
+manufacturer's certificate authority (CA). This certificate allows a third party
+(such a Teleport cluster) to know that the TPM it is communicating with is
+legitimate. This significantly reduces the burden on the administrator to ensure
+that the device has not been tampered with prior to enrollment.
+
+By default, the Teleport cluster does not verify the EKCert. This is because
+not all TPMs include an EKCert, and it is not possible to verify an EKCert
+without knowledge of the manufacturer's CA. This verification is enabled by the
+inclusion of the Teleport configuration field called `ekcert_allowed_cas`.
+
+Once configured, only devices that include a TPM with an EKCert signed by a
+CA specified in the field will be able to enroll. Previously-enrolled devices
+will not be affected.
+
+To configure `ekcert_allowed_cas`, you must first obtain the CA certificate in
+PEM format from the manufacturer of the TPM included in your devices. This step
+varies from manufacturer to manufacturer.
+
+After you obtain the CA certificate in PEM format, there are two ways of
+configuring `ekcert_allowed_cas`:
+
+- Statically using the Teleport configuration file. This is the simplest
+  option, but is not possible for Teleport Cloud clusters and not recommended
+  for clusters in a highly available configuration.
+- Dynamically using `cluster_auth_preference` resource. This works with all
+  clusters and is the most flexible.
+
+<Tabs dropDownCaption="Teleport Deployment">
+<TabItem label="Dynamic Resources" options="Self-Hosted,Teleport Enterprise Cloud" >
+Modify the dynamic config resource using `tctl edit cluster_auth_preference`:
+
+```diff
+kind: cluster_auth_preference
+version: v2
+metadata:
+  name: cluster-auth-preference
+spec:
+  ...
+  device_trust:
+    mode: "required" # add this line
++    ekcert_allowed_cas:
++      # The CA is configured inline within the resource:
++      - |
++        -----BEGIN CERTIFICATE-----
++        --snip--
++        -----END CERTIFICATE-----
+```
+
+</TabItem>
+<TabItem label="Static Config" options="Self-Hosted">
+Edit the Auth Server's `teleport.yaml` file and restart:
+
+```diff
+auth_service:
+  authentication:
+    ...
+    device_trust:
++      ekcert_allowed_cas:
++      # The CA can be configured inline within the configuration file:
++      - |
++        -----BEGIN CERTIFICATE-----
++        --snip--
++        -----END CERTIFICATE-----
++      # Or, it can be configured in the configuration file using a path:
++      - /path/to/my/ekcert-ca.pem
+```
+
+</TabItem>
+</Tabs>
+
 ## Optional: Cluster-wide trusted device enforcement
 
 Cluster-wide configuration enforces trusted device access at the cluster level.
@@ -202,8 +298,8 @@ by the `device_trust.mode` authentication setting:
 
 - `off` - disables device trust. Device authentication is not performed and
   device-aware audit logs are absent.
-- `optional` - enables device authentication and device-aware audit, but does not
-  require a trusted device to access resources.
+- `optional` - enables device authentication and device-aware audit, but does
+  not require a trusted device to access resources.
 - `required` - enables device authentication and device-aware audit.
   Additionally, it requires a trusted device for all SSH, Database and
   Kubernetes connections.
@@ -234,7 +330,7 @@ spec:
   type: local
   second_factor: "on"
   webauthn:
-    rp_id: example.com
+    rp_id: teleport.example.com
   device_trust:
 +   mode: "required" # add this line
 ```
@@ -262,7 +358,7 @@ auth_service:
     type: local
     second_factor: "on"
     webauthn:
-      rp_id: example.com
+      rp_id: teleport.example.com
     device_trust:
 +     mode: "required" # add this line
 ```
@@ -292,9 +388,10 @@ leaf clusters.
 Role-based configuration enforces trusted device access at the role level. It
 can be configured with the `spec.options.device_trust_mode` (`required`,
 `optional`, `off`) option and applies to the resources in its `allow` rules. It
-works similar to [`require_session_mfa`](./per-session-mfa.mdx).
+works similar to [`require_session_mfa`](../guides/per-session-mfa.mdx).
 
-To enforce authenticated device checks for a specific role, update the role with the following:
+To enforce authenticated device checks for a specific role, update the role with
+the following:
 
 ```diff
 kind: role
@@ -325,8 +422,8 @@ trusted device.
 
 ## Optional: Locking a device
 
-Similar to [session and identity locking](./locking.mdx), a device can be locked
-using `tctl lock`.
+Similar to [session and identity locking](../guides/locking.mdx), a device can
+be locked using `tctl lock`.
 
 Locking blocks certificate issuance and ongoing or future accesses originating
 from a locked device. Locking a device only works if device trust is enabled and
@@ -348,28 +445,18 @@ $ tctl lock --device (=devicetrust.device_id=) --ttl=12h
 Created a lock with name "5444970a-39a0-4814-968d-e58b4a8fa686".
 ```
 
-Now, if a user on that device tries to access an SSH server for example, Teleport will deny access:
+Now, if a user on that device tries to access an SSH server for example,
+Teleport will deny access:
 
 ```code
 $ tsh ssh server1
 ERROR: ssh: rejected: administratively prohibited (lock targeting Device:"(=devicetrust.device_id=)" is in force)
 ```
 
-## Troubleshooting
+## Optional: Enable auto-enrollment
 
-### "binary missing signature or entitlements" on `tsh device enroll`
+Refer to the [auto-enrollment guide](./auto-enrollment.mdx).
 
-A signed and notarized `tsh` binary is necessary to enroll and use a a trusted
-device. [Download the macOS tsh installer](../../installation.mdx#macos) to fix
-the problem.
-
-### "unauthorized device" errors using a trusted device
-
-A signed and notarized `tsh` binary is necessary to use a trusted device. Make
-sure to download and use the
-[macOS tsh installer](../../installation.mdx#macos).
+## Troubleshooting
 
-A trusted device needs to be registered and enrolled before it is recognized by
-Teleport as such. Follow the [registration](#step-12-register-a-trusted-device)
-and [enrollment steps](#step-22-enroll-a-trusted-device) and make sure to `tsh
-logout` and `tsh login` after enrollment is done.
+(!docs/pages/includes/device-trust/auto-enroll-troubleshooting.mdx!)
diff --git a/docs/pages/access-controls/device-trust/jamf-integration.mdx b/docs/pages/access-controls/device-trust/jamf-integration.mdx
new file mode 100644
index 0000000000000..34533a9815bab
--- /dev/null
+++ b/docs/pages/access-controls/device-trust/jamf-integration.mdx
@@ -0,0 +1,303 @@
+---
+title: Jamf Integration (Preview)
+description: Sync your Jamf inventory into Teleport
+---
+
+Device Trust Jamf integration lets you automatically sync your Jamf computer
+inventory into Teleport.
+
+The Teleport Jamf service is a distinct `teleport` process that periodically
+reads your computer inventory from Jamf and syncs it to Teleport. It performs
+both incremental (called "partial") and full syncs, as well as removals from
+Teleport if a computer is removed from Jamf.
+
+Syncing devices from Jamf is an **inventory management** step, equivalent to
+automatically running the corresponding `tctl devices add` commands. If you want
+to automatically enroll synced devices on user login, refer to the
+[auto-enrollment](#optional-enable-auto-enrollment) section.
+
+See the [Device Trust guide](./guide.mdx) for fundamental Device Trust concepts
+and behavior.
+
+## Prerequisites
+
+(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
+
+(!docs/pages/includes/device-trust/prereqs.mdx!)
+
+## Step 1/4. Create a Jamf user
+
+Create a readonly Jamf user for inventory sync.
+
+1. Access `https://yourtenant.jamfcloud.com/accounts.html`, replacing
+   `yourtenant` with your Jamf Pro account.
+
+2. Create a new Standard Account with the following settings:
+
+   - Username: teleport (change as desired)
+   - Access Level: Full Access
+   - Privilege Set: Custom
+   - Access Status: Enabled
+   - Password: (a strong password of your choice)
+   - Privileges:
+     - Advanced Computer Searches: Read
+     - Computers: Read
+
+   Take note of the user and password created here for the next step.
+
+   User account setup: ![Jamf user setup](
+   ../../../img/access-controls/device-trust/jamf-setup-1.png)
+
+   Privileges setup: ![Jamf privileges setup](
+   ../../../img/access-controls/device-trust/jamf-setup-2.png)
+
+## Step 2/4. Configure Jamf service
+
+Jamf inventory sync is performed by a separate `teleport` process, configured
+using the `jamf_service` key. It is recommended to run the service isolated from
+other Teleport processes, as it requires the Jamf credentials created in the
+step above.
+
+Save the following file as `/var/lib/teleport.yaml` and edit as needed:
+
+```yaml
+version: v3
+teleport:
+  # Necessary to write devices back to Teleport.
+  proxy_server: teleport.example.com:443 # CHANGEME
+
+jamf_service:
+  enabled: true
+  name: jamf
+  api_endpoint: https://yourtenant.jamfcloud.com # CHANGEME
+  username: teleport                             # CHANGEME
+  password_file: /var/lib/teleport/jamf_password.txt
+
+auth_service:
+  enabled: false
+
+proxy_service:
+  enabled: false
+
+ssh_service:
+  enabled: false
+```
+
+Change the following settings, as appropriate:
+
+- teleport.proxy_server
+- jamf_service.api_endpoint
+- jamf_service.username
+
+Finally, write your Jamf password to the `/var/lib/teleport/jamf_password` file:
+
+```code
+$ nano /var/lib/teleport/jamf_password # or use your favorite editor
+
+# Only the OS user that runs `teleport` should have access to the password file.
+$ chmod 400 /var/lib/teleport/jamf_password
+$ chown teleport /var/lib/teleport/jamf_password
+```
+
+## Step 3/4. Create a join token
+
+Jamf service requires an MDM token to write devices to Teleport.
+On your local workstation, create the token as shown below:
+
+```code
+$ tctl tokens add --type=mdm
+The invite token: 07c0565aa280595d7645b2964c36ebd1
+This token will expire in 30 minutes.
+
+From the Jamf service host, use this token to add an MDM service to Teleport.
+
+> teleport start \
+   --token=(=presets.tokens.second=) \
+   --ca-pin=(=presets.ca_pin=)\
+   --config=/path/to/teleport.yaml
+```
+
+## Step 4/4. Start Jamf service
+
+Using the token created above, start the service:
+
+```code
+$ teleport start --config=/var/lib/teleport.yaml \
+   --token=07c0565aa280595d7645b2964c36ebd1 \
+   --ca-pin=sha256:4b32d9c54b2b3332019d5f0720b8f9a603de03ace07d308bcd743465eee1f200
+```
+
+The initial sync should happen in a few minutes. You can confirm from the Teleport service logs:
+
+```
+2023-06-21T17:26:40-03:00 INFO [JAMF:1]    Jamf service successfully started pid:25757.1 service/service.go:228
+2023-06-21T17:26:40-03:00 INFO [JAMF:1]    Starting sync CutTime:0001-01-01 00:00:00 +0000 UTC FilterRSQL: Mode:1 OnMissing:DELETE pid:25757.1 service/service.go:261
+2023-06-21T17:26:40-03:00 INFO [JAMF:1]    Device sync report, page #0 deletes:0 failures:0 pid:25757.1 upserts:1 service/service.go:666
+2023-06-21T17:26:40-03:00 INFO [JAMF:1]    Sync complete pid:25757.1 service/service.go:277
+```
+
+Using the default configuration, the service will sync devices from Jamf every
+few hours. Once a day a full inventory sync is performed, enumerating all
+devices from Jamf and reflecting any additions or removals on Teleport.
+
+After the initial sync happens, you may verify the synced devices using `tctl
+devices ls`:
+
+```code
+$ tctl devices ls
+Asset Tag    OS      Enroll Status Device ID
+------------ ------- ------------- ------------------------------------
+CXXXXXXXXX17 macOS   not enrolled  20ec6373-9e8e-46e0-8f1c-47ad6b06a768
+CXXXXXXXXX2T macOS   not enrolled  79755778-7cbe-4e2c-83ec-7eaa3d4d7e36
+CXXXXXXXXX3T macOS   not enrolled  665e59d5-393a-4894-841d-edad06329717
+CXXXXXXXXX4T macOS   not enrolled  dd032e90-bfb0-47d5-bce5-e57545f6788f
+CXXXXXXXXX5T macOS   not enrolled  bf189863-a94a-40dc-9013-d96f8dada2f1
+(...)
+```
+
+## Optional: Customize the sync schedule
+
+When using the minimal configuration, described in the steps above, Jamf service
+utilizes a default sync schedule. It is possible to customize sync intervals, as
+well as the set of devices synced from Jamf, by applying RSQL filters provided
+by the [Jamf Pro API](
+https://developer.jamf.com/jamf-pro/reference/get_v1-computers-inventory).
+
+The default "inventory" configuration is roughly equivalent to the one below:
+
+```yaml
+jamf_service:
+  enabled: true
+  # ...
+  inventory:
+  - sync_period_partial: 6h
+    sync_period_full: 24h
+    on_missing: DELETE
+    filter_rsql: general.remoteManagement.managed==true
+```
+
+Unpacking the configuration, we have the following keys:
+
+### `sync_period_*`
+
+- `sync_period_partial`: period for partial syncs. A partial sync attempts to
+  fetch new and modified devices, but won't scan the entire Jamf inventory.
+- `sync_period_full`: period for full syncs. A full sync scans the entire Jamf
+  inventory, processing new/modified devices and removals from Jamf.
+
+Both sync periods may be disabled by setting the period to `0` or `-1`. It is
+recommended to do a full sync with some regularity, so Teleport has the chance
+to fully synchronize both inventories.
+
+### `on_missing`
+
+The `on_missing` key determines what to do with devices deleted from Jamf, but
+present in Teleport. The possible actions are:
+
+- `DELETE`: devices removed from Jamf are eventually removed from Teleport.
+  (Requires a full sync.)
+- `NOOP`: devices removed from Jamf are allowed to remain in the Teleport
+  inventory.
+
+Only devices synced by Jamf are susceptible to deletion in this manner. Devices
+written manually via `tctl devices add` or written by other sources won't be
+deleted.
+
+For immediate removal of unwanted devices first lock the device on Teleport,
+then remove it from Jamf:
+
+```code
+$ tctl devices lock --asset-tag=SERIAL_NUMBER --message='reason for locking'
+Created a lock with name "a2f1491c-4a3e-4daf-9c83-2fe931668076".
+```
+
+Manual removal via `tctl devices rm` is possible, but note that if the device is
+still in the Jamf inventory, it'll be recreated during the next sync.
+
+### `filter_rsql`
+
+The `filter_rsql` key applies a Jamf Pro API filter when querying for devices.
+Refer to
+https://developer.jamf.com/jamf-pro/reference/get_v1-computers-inventory for the
+possible filter values.
+
+## Optional: Sync multiple sources
+
+When syncing inventory, Jamf service claims ownership of all synced devices.
+This can be verified by inspecting a device's `source` field:
+
+```yaml
+# tctl get device/mydevice
+kind: device
+metadata:
+  name: 20ec6373-9e8e-46e0-8f1c-47ad6b06a768
+spec:
+  asset_tag: mydevice
+  os_type: macos
+  # ...
+  source:         # Set during inventory sync
+    name: jamf    # Copied from jamf_service.name
+    origin: jamf  # Always "jamf" for Jamf service
+  update_time: "2023-06-21T19:44:40.40601Z"
+version: v1
+```
+
+Device ownership is important in a few situations, but it is particularly
+important when running "on\_missing=DELETE" syncs, as only the devices owned by
+the sync source are considered for deletion.
+
+If you want to run multiple Jamf sources you can simply run multiple Jamf
+services, each with its configuration and credentials. Just make sure that each
+service has a different "jamf\_service.name". For example:
+
+`teleport.yaml` - Service #1:
+
+```diff
+version: v3
+teleport:
+  proxy_server: teleport.example.com:443
+
+jamf_service:
+  enabled: true
++ name: jamf1
++ api_endpoint: https://tenant1.jamfcloud.com
++ username: tenant1
++ password_file: /var/lib/teleport/jamf1_password.txt
+
+auth_service:
+  enabled: false
+
+proxy_service:
+  enabled: false
+
+ssh_service:
+  enabled: false
+```
+
+`teleport.yaml` - Service #2:
+
+```diff
+version: v3
+teleport:
+  proxy_server: teleport.example.com:443
+
+jamf_service:
+  enabled: true
++ name: jamf2
++ api_endpoint: https://tenant2.jamfcloud.com
++ username: tenant2
++ password_file: /var/lib/teleport/jamf2_password.txt
+
+auth_service:
+  enabled: false
+
+proxy_service:
+  enabled: false
+
+ssh_service:
+  enabled: false
+```
+
+## Optional: Enable auto-enrollment
+
+Refer to the [auto-enrollment guide](./auto-enrollment.mdx).
diff --git a/docs/pages/access-controls/getting-started.mdx b/docs/pages/access-controls/getting-started.mdx
index 0e308d1cb921e..28aca2be7ab8f 100644
--- a/docs/pages/access-controls/getting-started.mdx
+++ b/docs/pages/access-controls/getting-started.mdx
@@ -20,19 +20,38 @@ wrap up with creating your own role.
 
 ## Step 1/3. Add local users with preset roles
 
-Teleport provides several preset roles: `editor`, `auditor` and `access`. The
-`editor` role authorizes users to modify cluster configuration, the `auditor`
-role to view audit logs, and `access` role to access cluster resources.
+Teleport provides several preset roles: `editor`, `auditor`, and `access`.
 
+- The `editor` role authorizes users to modify cluster configuration.
+- The `auditor` role authorizes users to view audit logs.
+- The `access` role authorizes users to access cluster resources.
+
+<Details title='Enterprise built in roles'>
+Teleport Enterprise contains two additional preset roles: `reviewer` and `requester`.
+
+- The `reviewer` role authorizes users to review Access Requests.
+- The `requester` role authorizes users to request resources.
+</Details>
+
+<ScopedBlock scope={["oss"]}>
 Invite the local user Alice as cluster `editor`:
 
 ```code
 $ tctl users add alice --roles=editor
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+Invite the local user Alice as cluster `editor` and `reviewer`:
+
+```code
+$ tctl users add alice --roles=editor,reviewer
+```
+</ScopedBlock>
 
 Once Alice signs up, she will be able to edit cluster configuration. You can list
 users and their roles using `tctl users ls`.
 
+<ScopedBlock scope={"oss"}>
 ```code
 $ tctl users ls
 
@@ -40,15 +59,33 @@ $ tctl users ls
 # -------------------- --------------
 # alice                editor
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+```code
+$ tctl users ls
+
+# User                 Roles
+# -------------------- --------------
+# alice                editor, reviewer
+```
+</ScopedBlock>
 
 You can update the user's roles using the `tctl users update` command:
 
+<ScopedBlock scope={"oss"}>
 ```code
 # Once Alice logs back in, she will be able to view audit logs
 $ tctl users update alice --set-roles=editor,auditor
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+```code
+# Once Alice logs back in, she will be able to view audit logs
+$ tctl users update alice --set-roles=editor,reviewer,auditor
+```
+</ScopedBlock>
 
-Because Alice has two roles, permissions from those roles create a union. She
+Because Alice has two or more roles, permissions from those roles create a union. She
 will be able to act as a system administrator and auditor at the same time.
 
 ## Step 2/3. Map SSO users to roles
diff --git a/docs/pages/access-controls/guides/dual-authz.mdx b/docs/pages/access-controls/guides/dual-authz.mdx
index 59f0bcdabb849..8ce47c6a3fc13 100644
--- a/docs/pages/access-controls/guides/dual-authz.mdx
+++ b/docs/pages/access-controls/guides/dual-authz.mdx
@@ -117,13 +117,13 @@ Alice and Ivan are reviewers. They can approve requests for assuming role
 `dbadmin`. Bob is a DevOps engineer and can assume the `dbadmin` role if two members
 of the `reviewer` role approve the request.
 
-Create the following `dbadmin`, `reviewer` and `devops` roles:
+Create the following `dbadmin`, `dbreviewer` and `devops` roles:
 
 ```yaml
 kind: role
 version: v5
 metadata:
-  name: reviewer
+  name: dbreviewer
 spec:
   allow:
     review_requests:
@@ -157,8 +157,8 @@ The commands below create the local users Bob, Alice, and Ivan.
 
 ```code
 $ tctl users add bob@example.com --roles=devops
-$ tctl users add alice@example.com --roles=reviewer
-$ tctl users add ivan@example.com --roles=reviewer
+$ tctl users add alice@example.com --roles=dbreviewer
+$ tctl users add ivan@example.com --roles=dbreviewer
 ```
 
 ### Create an Access Request
diff --git a/docs/pages/access-controls/guides/hardware-key-support.mdx b/docs/pages/access-controls/guides/hardware-key-support.mdx
index 8adc155a72e43..17b73a8a1f945 100644
--- a/docs/pages/access-controls/guides/hardware-key-support.mdx
+++ b/docs/pages/access-controls/guides/hardware-key-support.mdx
@@ -111,7 +111,7 @@ Once hardware key support is enforced, affected users will be required to have t
 
 These users will be prompted to connect and touch their YubiKey on log in:
 
-<ScopedBlock scope={["oss","enterprise"]}>
+<ScopedBlock scope={["oss"]}>
 
 ```code
 $ tsh login --user=dev --proxy=proxy.example.com:3080
@@ -129,6 +129,24 @@ $ tsh login --user=dev --proxy=proxy.example.com:3080
 
 </ScopedBlock>
 
+<ScopedBlock scope={["enterprise"]}>
+
+```code
+$ tsh login --user=dev --proxy=proxy.example.com:3080
+# Enter password for Teleport user dev:
+# Tap your YubiKey
+# > Profile URL:        https://example.com
+#   Logged in as:       dev
+#   Cluster:            example.com
+#   Roles:              access, editor, reviewer
+#   Logins:             bjoerger
+#   Kubernetes:         enabled
+#   Valid until:        2022-10-11 01:53:44 -0700 PDT [valid for 8h0m0s]
+#   Extensions:         permit-X11-forwarding, permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
+```
+
+</ScopedBlock>
+
 <ScopedBlock scope={["cloud"]}>
 
 ```code
@@ -138,7 +156,7 @@ $ tsh login --proxy=mytenant.teleport.sh
 # > Profile URL:        https://example.com
 #   Logged in as:       dev
 #   Cluster:            example.com
-#   Roles:              access, editor
+#   Roles:              access, editor, reviewer
 #   Logins:             bjoerger
 #   Kubernetes:         enabled
 #   Valid until:        2022-10-11 01:53:44 -0700 PDT [valid for 8h0m0s]
diff --git a/docs/pages/access-controls/guides/headless.mdx b/docs/pages/access-controls/guides/headless.mdx
index 1916b2e8b5460..3fd5b30440350 100644
--- a/docs/pages/access-controls/guides/headless.mdx
+++ b/docs/pages/access-controls/guides/headless.mdx
@@ -32,8 +32,9 @@ For example:
 - A v12.2+ Teleport cluster with WebAuthn configured.
   See the [Second Factor: WebAuthn](./webauthn.mdx) guide.
 - WebAuthn hardware device, such as YubiKey.
-- A Web browser with [WebAuthn support](
-  https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/).
+- Machines for Headless WebAuthn activities have [Linux](../../installation.mdx#linux), [macOS](../../installation.mdx#macos) or [Windows](../../installation.mdx#windows-tsh-client-only) `tsh` binary v12.2+ installed.
+- Machines used to approve Headless WebAuthn requests have a Web browser with [WebAuthn support](
+  https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/) or `tsh` binary v12.2+ installed.
 
 ## Step 1/3. Configuration
 
@@ -102,6 +103,14 @@ $ tctl create -f cap.yaml
 
 ## Step 2/3. Initiate Headless WebAuthn
 
+First open a terminal on the remote machine and confirm the `tsh` binary 
+is v12.2+ with `tsh version`.
+
+```code
+$ tsh version
+Teleport v(=teleport.version=) git: go(=teleport.golang=)
+```
+
 Run a headless `tsh` command with the `--headless` flag. This will initiate
 headless authentication, printing a URL and `tsh` command.
 
@@ -127,6 +136,7 @@ Unlike a standard login session, headless sessions are only available for the
 lifetime of a single `tsh` request. This means that for each `tsh --headless`
 command, you will need to go through the Headless WebAuthn flow:
 
+### Example: Listing SSH servers
 ```code 
 $ tsh ls --headless --proxy=proxy.example.com --user=alice
 # Complete headless authentication in your local web browser:
@@ -140,8 +150,11 @@ $ tsh ls --headless --proxy=proxy.example.com --user=alice
 # Node Name Address        Labels                                                                             
 # --------- -------------- -----------
 # server01  127.0.0.1:3022 arch=x86_64
-#
-$ tsh ssh --headless --proxy=proxy.example.com --user=alice server01
+```
+
+### Example: Initiating an SSH session
+```code
+$ tsh ssh --headless --proxy=proxy.example.com --user=alice alice@server01
 # Complete headless authentication in your local web browser:
 # 
 # https://proxy.example.com:3080/web/headless/864cccd9-2425-46d9-a9f2-636387e66ebf
@@ -149,9 +162,23 @@ $ tsh ssh --headless --proxy=proxy.example.com --user=alice server01
 # or execute this command in your local terminal:
 # 
 # tsh headless approve --user=alice --proxy=proxy.example.com 864cccd9-2425-46d9-a9f2-636387e66ebf
-# # User approves through link
+# # User approves through link and a ssh terminal starts
+alice@server01 $
 ```
 
+<Notice type="note">
+  The Teleport user, `--user` parameter, is the Teleport user requesting Headless WebAuthn activity. 
+  If no `--user` parameter or environment variables set the OS user in the machine terminal is used.
+
+  The login username, `--login` parameter or login@hostname, for `tsh ssh` commands is the user
+  to open a SSH session as. If no login username for the SSH session is set the OS terminal username is used. 
+  A Teleport user must have access to that login user for that server or they will receive 
+  an access denied message. The user could receive an access denied message after being approved
+  for their Headless WebAuthn activity since the same access rights are granted or denied as if running from
+  your local terminal.
+</Notice>
+
+
 ## Troubleshooting
 
 ### "WARN: Failed to lock system memory for headless login: ..."
@@ -183,4 +210,4 @@ for the best level of security on shared machines.
 If the above solutions are not feasible in your environment, you can also disable
 the memory locking requirement by setting the `--mlock` flag or `TELEPORT_MLOCK_MODE`
 environment variable to `off` or `best_effort`. This is not recommended in production
-environments on shared systems where a memory swap attack is possible.
\ No newline at end of file
+environments on shared systems where a memory swap attack is possible.
diff --git a/docs/pages/access-controls/guides/locking.mdx b/docs/pages/access-controls/guides/locking.mdx
index a9e701207d02f..e51edd869103e 100644
--- a/docs/pages/access-controls/guides/locking.mdx
+++ b/docs/pages/access-controls/guides/locking.mdx
@@ -1,6 +1,6 @@
 ---
 title: Session and Identity Locking
-description: How to lock compromised users or nodes
+description: How to lock compromised users or agents
 ---
 
 <Details
@@ -15,7 +15,7 @@ description: How to lock compromised users or nodes
   deployment.
 </Details>
 
-System administrators can disable a compromised user or node—or
+System administrators can disable a compromised user or Teleport agent—or
 prevent access during cluster maintenance—by placing a lock
 on a session, user or host identity.
 
@@ -27,10 +27,11 @@ A lock can target the following objects or attributes:
 
 - a Teleport user by the user's name
 - a Teleport [RBAC](../reference.mdx) role by the role's name
-- a Teleport [trusted device](device-trust.mdx#optional-locking-a-device) by the device ID
+- a Teleport [trusted device](
+  ../device-trust/guide.mdx#optional-locking-a-device) by the device ID
 - an MFA device by the device's UUID
 - an OS/UNIX login
-- a Teleport Node by the Node's UUID (effectively unregistering it from the
+- a Teleport agent by the agent's server UUID (effectively unregistering it from the
   cluster)
 - a Windows desktop by the desktop's name
 - an [Access Request](../access-requests.mdx) by UUID
@@ -74,10 +75,10 @@ with one of the following options:
   # Created a lock with name "d6c06a18-e147-4232-9dfe-6f83a28d5850".
   ```
   </TabItem>
-  <TabItem label="Node">
-  All connections to the specified node will be locked.
+  <TabItem label="Agent">
+  All connections to the specified agent will be locked and the agent will be excluded from the Teleport cluster.
   ```code
-  $ tctl lock --node=363256df-f78a-4d99-803c-bae19da9ede4 --message="The node is under investigation." --ttl=10h
+  $ tctl lock --server-id=363256df-f78a-4d99-803c-bae19da9ede4 --message="The server running the Kubernetes Service and Database Service is under investigation." --ttl=10h
   # Created a lock with name "dc7cee9d-fe5e-4534-a90d-db770f0234a1".
   ```
   </TabItem>
diff --git a/docs/pages/access-controls/guides/passwordless.mdx b/docs/pages/access-controls/guides/passwordless.mdx
index b365b4e6c40f7..d484ee6d3e84a 100644
--- a/docs/pages/access-controls/guides/passwordless.mdx
+++ b/docs/pages/access-controls/guides/passwordless.mdx
@@ -69,6 +69,7 @@ between `tsh`, the Teleport Web UI, and different computers.
 
 Authenticate using your passwordless credential:
 
+<ScopedBlock scope={["oss"]}>
 ```code
 $ tsh login --proxy=example.com --auth=passwordless
 # Tap your security key
@@ -81,6 +82,21 @@ $ tsh login --proxy=example.com --auth=passwordless
 #   Valid until:        2021-10-04 23:32:29 -0700 PDT [valid for 12h0m0s]
 #   Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+```code
+$ tsh login --proxy=example.com --auth=passwordless
+# Tap your security key
+# > Profile URL:        https://example.com
+#   Logged in as:       codingllama
+#   Cluster:            example.com
+#   Roles:              access, editor, reviewer
+#   Logins:             codingllama
+#   Kubernetes:         enabled
+#   Valid until:        2021-10-04 23:32:29 -0700 PDT [valid for 12h0m0s]
+#   Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+</ScopedBlock>
 
 A fully passwordless cluster defaults to passwordless logins, making
 `--auth=passwordless` unnecessary. See the next section to learn how to enable
diff --git a/docs/pages/access-controls/guides/role-templates.mdx b/docs/pages/access-controls/guides/role-templates.mdx
index 9fb7ff07dfde3..999e6a7fc5d88 100644
--- a/docs/pages/access-controls/guides/role-templates.mdx
+++ b/docs/pages/access-controls/guides/role-templates.mdx
@@ -332,7 +332,7 @@ spec:
 
     # Functions transform variables.
     database_users: ['{{email.local(external.email)}}']
-    database_labels:
+    db_labels:
       'env': '{{regexp.replace(external.access["env"], "^(staging)$", "$1")}}'
 
     # Labels can mix template and hard-coded values.
@@ -372,7 +372,7 @@ spec:
     database_users: ['alice']
 
     # The function regexp.replace will transform and filter only matching values.
-    database_labels:
+    db_labels:
       'env': 'staging'
 
     # Node labels have 'env' replaced from a variable and 'region' hard-coded.
diff --git a/docs/pages/access-controls/guides/webauthn.mdx b/docs/pages/access-controls/guides/webauthn.mdx
index aa4e3822d7aa0..44966f99334d6 100644
--- a/docs/pages/access-controls/guides/webauthn.mdx
+++ b/docs/pages/access-controls/guides/webauthn.mdx
@@ -179,7 +179,7 @@ Reference](../../reference/cli.mdx#tsh-global-flags) page.
 
 Once a WebAuthn device is registered, the user will be prompted for it on login:
 
-<ScopedBlock scope={["oss", "enterprise"]}>
+<ScopedBlock scope={["oss"]}>
 
 ```code
 $ tsh login --proxy=example.com
@@ -197,6 +197,24 @@ $ tsh login --proxy=example.com
 
 </ScopedBlock>
 
+<ScopedBlock scope={["enterprise"]}>
+
+```code
+$ tsh login --proxy=example.com
+# Enter password for Teleport user codingllama:
+# Tap any security key or enter a code from a OTP device:
+# > Profile URL:        https://example.com
+#   Logged in as:       codingllama
+#   Cluster:            example.com
+#   Roles:              access, editor, reviewer
+#   Logins:             codingllama
+#   Kubernetes:         enabled
+#   Valid until:        2021-10-04 23:32:29 -0700 PDT [valid for 12h0m0s]
+#   Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+
+</ScopedBlock>
+
 <ScopedBlock scope={["cloud"]}>
 
 ```code
@@ -206,7 +224,7 @@ $ tsh login --proxy=mytenant.teleport.sh
 # > Profile URL:        https://mytenant.teleport.sh
 #   Logged in as:       codingllama
 #   Cluster:            mytenant.teleport.sh
-#   Roles:              access, editor
+#   Roles:              access, editor, reviewer
 #   Logins:             codingllama
 #   Kubernetes:         enabled
 #   Valid until:        2021-10-04 23:32:29 -0700 PDT [valid for 12h0m0s]
diff --git a/docs/pages/access-controls/idps/saml-grafana.mdx b/docs/pages/access-controls/idps/saml-grafana.mdx
index 6a1ba82e57700..249735a24b7f7 100644
--- a/docs/pages/access-controls/idps/saml-grafana.mdx
+++ b/docs/pages/access-controls/idps/saml-grafana.mdx
@@ -66,6 +66,8 @@ From the Grafana host, edit `grafana.ini` by adding a `[auth.saml]` section:
 [auth.saml]
 enabled = true
 auto_login = false
+allow_idp_initiated = true
+relay_state = ""
 private_key_path = '/path/to/certs/grafana-host-key.pem'
 certificate_path = '/path/to/certs/grafana-host.pem'
 idp_metadata = 'PEVudGl0eURl.....'
@@ -75,14 +77,16 @@ assertion_attribute_email = uid
 assertion_attribute_groups = eduPersonAffiliation
 ```
 
-| Key                | Value                                                          |
-|--------------------|----------------------------------------------------------------|
-| `enabled`          | Set to `true` to enable SAML authentication.                   |
-| `auto_login`       | When set to `true`, enables auto-login using SAML.             |
-| `private_key_path` | Path to the TLS key used to identify Grafana.                  |
-| `certificate_path` | Path to the TLS certificate used to identify Grafana.          |
-| `idp_metadata`     | The base64-encoded contents of the Teleport metadata XML file. |
-| `assertion_*`      | Various Grafana user fields to be mapped to SAML assertions.   |
+| Key                   | Value                                                                                 |
+|-----------------------|---------------------------------------------------------------------------------------|
+| `enabled`             | Set to `true` to enable SAML authentication.                                          |
+| `auto_login`          | When set to `true`, enables auto-login using SAML.                                    |
+| `allow_idp_initiated` | Set to `true` to allow IdP-initiated login.                                           |
+| `relay_state`         | Relay state for IdP-initiated login. Must be set to `""` to work with Teleport's IdP. |
+| `private_key_path`    | Path to the TLS key used to identify Grafana.                                         |
+| `certificate_path`    | Path to the TLS certificate used to identify Grafana.                                 |
+| `idp_metadata`        | The base64-encoded contents of the Teleport metadata XML file.                        |
+| `assertion_*`         | Various Grafana user fields to be mapped to SAML assertions.                          |
 
 For more information on editing `grafana.ini` for SAML, you can review their [Configure
 SAML authentication in Grafana](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/saml/)
diff --git a/docs/pages/access-controls/introduction.mdx b/docs/pages/access-controls/introduction.mdx
index 50c5802b14a25..3e1d53d274eab 100644
--- a/docs/pages/access-controls/introduction.mdx
+++ b/docs/pages/access-controls/introduction.mdx
@@ -6,7 +6,7 @@ layout: tocless-doc
 
 After [deploying a Teleport cluster](../deploy-a-cluster/introduction.mdx), the
 next step is to manage the access that Teleport users have to resources in your
-infrastructure. 
+infrastructure.
 
 Teleport's role-based access control (RBAC) enables you to set fine-grained
 policies for who can perform certain actions against specific resources. For
@@ -16,7 +16,7 @@ example:
   database.
 - Interns can't access production databases.
 - SREs can access a production server only when using a [trusted hardware
-  device](./guides/device-trust.mdx).
+  device](./device-trust/guide.mdx).
 - Members of a team can access the production Kubernetes cluster if approved by
   someone else from the same team.
 
@@ -30,7 +30,7 @@ Started](./getting-started.mdx) guide.
 The heart of Teleport's RBAC system is the **role**, a configuration document
 that specifies access policies for resources in your Teleport cluster.
 Assigning a role to a Teleport user applies the policies listed in the role to
-the user. 
+the user.
 
 See the [Cluster Access and RBAC](./guides.mdx) section for instructions on
 setting up Teleport roles.
@@ -39,7 +39,7 @@ setting up Teleport roles.
 
 While you can create Teleport users directly on the Auth Service, the more
 scalable approach is to integrate Teleport with a Single Sign-On identity
-provider (IdP), such as Okta or GitHub. 
+provider (IdP), such as Okta or GitHub.
 
 When a user authenticates to your Teleport cluster via your IdP, Teleport
 automatically assigns roles to the user based on data provided by the IdP. This
diff --git a/docs/pages/access-controls/login-rules/kubernetes.mdx b/docs/pages/access-controls/login-rules/kubernetes.mdx
index 16cbe2520bedd..e1405b88f795b 100644
--- a/docs/pages/access-controls/login-rules/kubernetes.mdx
+++ b/docs/pages/access-controls/login-rules/kubernetes.mdx
@@ -44,7 +44,7 @@ This guide is applicable if you self-host Teleport in Kubernetes using the
   </Admonition>
 
 - Follow Step 1 of the
-  [Teleport operator guide](../../management/guides/teleport-operator.mdx#step-13-install-teleport-cluster-helm-chart-with-the-operator)
+  [Teleport operator guide](../../management/dynamic-resources/teleport-operator.mdx#step-13-install-teleport-cluster-helm-chart-with-the-operator)
   to install the Teleport Operator in your Kubernetes cluster.
   Make sure to follow the Enterprise instructions.
 
@@ -250,7 +250,7 @@ logins:
 
 ## Next Steps
 
-- Read the [Teleport Operator Guide](../../management/guides/teleport-operator.mdx) to
+- Read the [Teleport Operator Guide](../../management/dynamic-resources/teleport-operator.mdx) to
   learn more about the Teleport Operator.
 - Read the [Login Rules reference](./reference.mdx) to learn mode about the
   Login Rule expression syntax.
diff --git a/docs/pages/access-controls/login-rules/terraform.mdx b/docs/pages/access-controls/login-rules/terraform.mdx
index 913faf0a26e6a..d406714584625 100644
--- a/docs/pages/access-controls/login-rules/terraform.mdx
+++ b/docs/pages/access-controls/login-rules/terraform.mdx
@@ -31,7 +31,7 @@ For simplicity, this guide will configure the Terraform provider to use your
 current logged-in user's Teleport credentials obtained from `tsh login`.
 
 <Admonition type="note">
-The [Terraform provider guide](../../management/guides/terraform-provider.mdx)
+The [Terraform provider guide](../../management/dynamic-resources/terraform-provider.mdx)
 includes instructions for configuring a dedicated `terraform` user and role,
 which is a better option when running Terraform in a non-interactive
 environment.
@@ -156,7 +156,7 @@ logins:
 
 ## Next Steps
 
-- Read the [Terraform Guide](../../management/guides/terraform-provider.mdx) to
+- Read the [Terraform Guide](../../management/dynamic-resources/terraform-provider.mdx) to
   learn more about configuring the Terraform provider.
 - Read the [Login Rules reference](./reference.mdx) to learn mode about the
   Login Rule expression syntax.
diff --git a/docs/pages/access-controls/reference.mdx b/docs/pages/access-controls/reference.mdx
index 64f70654605e9..e6e556c2aec7b 100644
--- a/docs/pages/access-controls/reference.mdx
+++ b/docs/pages/access-controls/reference.mdx
@@ -12,7 +12,7 @@ controls (RBAC) in your Teleport cluster.
 A Teleport `role` works by having two lists of rules: `allow` rules and `deny` rules.
 When declaring access rules, keep in mind the following:
 
-- Everything is denied by default.
+- Nothing is allowed by default.
 - Deny rules get evaluated first and take priority.
 
 A rule consists of two parts: the resources and verbs. Here's an example of an
@@ -25,10 +25,10 @@ allow:
     verbs: [list]
 ```
 
-If this rule was declared in the `deny` section of a role definition, it
-would prohibit users from getting a list of Trusted Clusters and
-sessions. You can see all of the available resources and verbs under the `allow`
-section in the example role configuration below.
+If this rule was declared in the `deny` section of a role definition, it would
+prohibit users from getting a list of active sessions. You can see all of the
+available resources and verbs under the `allow` section in the example role
+configuration below.
 
 To manage cluster roles, a Teleport administrator can use the Web UI or the
 command line using [tctl resource commands](../reference/resources.mdx).
@@ -116,7 +116,7 @@ The table below documents the behavior of each option if multiple roles are assi
 | `desktop_clipboard` | Allow clipboard sharing for desktop sessions | Logical "AND" i.e. evaluates to "yes" if all roles enable clipboard sharing |
 | `pin_source_ip` | Enable source IP pinning for SSH certificates. **Note:** IP pinning is currently in Preview mode | Logical "OR" i.e. evaluates to "yes" if at least one role requires session termination |
 | `cert_extensions` | Specifies extensions to be included in SSH certificates | |
-| `create_host_user` | Allow users to be automatically created on a host |  Logical "AND" i.e. evaluates to "yes" if all roles matching a Node enable host user creation |
+| `create_host_user_mode` | Allow users to be automatically created on a host |  Logical "AND" i.e. if all roles matching a server specify host user creation (`off`, `drop`, `keep`), it will evaluate to the option specified by all of the roles. If some roles specify both `drop` or `keep` it will evaluate to `keep`|
 
 ## Preset roles
 
@@ -127,6 +127,8 @@ Teleport provides several pre-defined roles out-of-the-box:
 | `editor` | Allows editing of cluster configuration settings. |
 | `auditor`| Allows reading cluster events, audit logs, and playing back session records. |
 | `access`| Allows access to cluster resources. |
+| `requester`| Enterprise-only role that allows a user to create Access Requests. |
+| `reviewer`| Enterprise-only role that allows review of Access Requests. |
 
 ### Role versions
 
@@ -140,7 +142,7 @@ Label              | `v3` Default   | `v4`, `v5` and `v6` Default
 `node_labels`       | `[{"*": "*"}]` if the role has any logins, else `[]` | `[]`
 `app_labels`        | `[{"*": "*"}]` | `[]`
 `kubernetes_labels` | `[{"*": "*"}]` | `[]`
-`database_labels`   | `[{"*": "*"}]` | `[]`
+`db_labels`         | `[{"*": "*"}]` | `[]`
 
 Role `v6` introduced a new field `kubernetes_resources` that allows
 fine-grained control over Kubernetes resources. See [Kubernetes RBAC](../kubernetes-access/manage-access/rbac.mdx) for more details.
@@ -151,15 +153,17 @@ Label              | `v3`, `v4` and `v5` Default   | `v6` Default
 
 ## RBAC for resources
 
-A Teleport role defines which resources (e.g., applications, servers, and databases) a user can have access to.
-This works by [labeling resources](../management/admin/labels.mdx) and listing
-allow/deny labels in a role definition.
+A Teleport role defines which resources (e.g., applications, servers, and
+databases) a user can access.
+This works by [labeling resources](../management/admin/labels.mdx) and
+configuring allow/deny labels in a role definition.
 
 Consider the following use case:
 
 The infrastructure is split into staging/production environments using labels
-like `environment=production` and `environment=staging`. You can create roles
-that only have access to one environment. Let's say you create an intern role with the allow rule for label `environment=staging`.
+like `environment=production` and `environment=staging`.
+You can create roles that only have access to one environment.
+Let's say you create an intern role with the allow rule for label `environment=staging`.
 
 ### Example
 
@@ -187,8 +191,8 @@ spec:
 ```
 
 Teleport handles multiple label entries with logical "AND" operations.
-As an example this entry would match to databases that have the `env: prod` label and a
-`region` label of either `us-west-1` or `eu-central-1`:
+As an example, this entry would match to databases that have the `env: prod`
+label *and* a `region` label of either `us-west-1` or `eu-central-1`:
 
 ```yaml
     db_labels:
@@ -200,12 +204,13 @@ As an example this entry would match to databases that have the `env: prod` labe
   type="tip"
   title="Dynamic RBAC"
 >
-  Resource labels can be dynamic, i.e. determined at runtime by an output of an executable. In this case, you can implement "permissions follow workload"
+  Resource labels can be dynamic, i.e. determined at runtime by an output of an executable.
+  In this case, you can implement "permissions follow workload"
   policies (eg., any server where PostgreSQL is running becomes *automatically*
   accessible only by the members of the "DBA" group and nobody else).
 </Admonition>
 
-### Extended labels syntax
+### Extended label matching syntax
 
 Below are a few examples for more complex filtering using various regexes.
 
@@ -228,6 +233,65 @@ spec:
       'environment': '^test|staging$'
 ```
 
+### Label expressions
+
+<Admonition type="warning">
+Label expressions are available starting in Teleport version `13.1.1`.
+All components of your Teleport cluster must be upgraded to version `13.1.1`
+or newer before you will be able to use label expressions.
+This includes the Auth Service and **all** Teleport agents.
+</Admonition>
+
+Teleport roles also support matching resource labels with predicate expressions
+when you need to:
+
+- combine logic with OR and AND operators
+- perform matching on label keys
+- implement negative matches
+
+The following example role would allow access to any nodes labeled `env=staging`
+or labeled `team=<team>`, where `<team>` is one of the values of the user's
+`teams` trait:
+
+```yaml
+kind: role
+version: v6
+metadata:
+  name: example-role
+spec:
+  allow:
+    node_labels_expression: |
+      labels["env"] == "staging" ||
+      contains(user.spec.traits["teams"], labels["team"])
+```
+
+The `<kind>_labels_expression` fields have the same purpose of the
+matching `<kind>_labels` fields, but support predicate expressions instead
+of label matchers.
+They can be used in the following fields of role `spec.allow` and `spec.deny`
+conditions:
+
+- `node_labels_expression`
+- `app_labels_expression`
+- `cluster_labels_expression`
+- `kubernetes_labels_expression`
+- `db_labels_expression`
+- `db_service_labels_expression`
+- `windows_desktop_labels_expression`
+- `group_labels_expression`
+
+Check out our
+[predicate language](../reference/predicate-language.mdx#label-expressions)
+guide for a more in depth explanation of the language.
+
+Typically you will only want to use one of `<kind>_labels` or
+`<kind>_labels_expression` in a single role, but you are allowed to specify
+both.
+If you have both in a deny rule, the matching is greedy, if either one matches
+access will be denied.
+In an allow rule, the matching is not greedy, if both are set they both have to
+match for access to be allowed.
+
 ## Teleport resources
 
 RBAC lets teams limit what resources are available to Teleport users. This can be helpful if, for example,
diff --git a/docs/pages/access-controls/sso.mdx b/docs/pages/access-controls/sso.mdx
index 75b1c11997362..301f98989defb 100644
--- a/docs/pages/access-controls/sso.mdx
+++ b/docs/pages/access-controls/sso.mdx
@@ -453,7 +453,7 @@ flow. These provider-specific changes can be enabled by setting the
 values to match your identity provider:
 
 - `adfs` (SAML): Required for compatibility with Active Directory (ADFS); refer
-  to the full [ADFS guide](./sso/adfs.mdx#create-teleport-roles) for details.
+  to the full [ADFS guide](./sso/adfs.mdx#step-23-create-teleport-roles) for details.
 - `netiq` (OIDC): Used to enable NetIQ-specific ACR value processing; refer to
   the [OIDC guide](./sso/oidc.mdx#optional-acr-values) for details.
 - `ping` (SAML and OIDC): Required for compatibility with Ping Identity (including
diff --git a/docs/pages/access-controls/sso/adfs.mdx b/docs/pages/access-controls/sso/adfs.mdx
index 7d3c75fd3183a..d2603056f6464 100644
--- a/docs/pages/access-controls/sso/adfs.mdx
+++ b/docs/pages/access-controls/sso/adfs.mdx
@@ -1,15 +1,14 @@
 ---
 title: SSO with Active Directory Federation Services
-description: How to configure SSH access with Active Directory Federation Services using Teleport
+description: How to configure Teleport access with Active Directory Federation Services
 h1: Single Sign-On with Active Directory Federation Services
 ---
 
 This guide will explain how to configure Active Directory Federation Services
 ([ADFS](https://en.wikipedia.org/wiki/Active_Directory_Federation_Services)) to be
-a single sign-on (SSO) provider to issue
-SSH credentials to specific groups of users. When used in combination with role
-based access control (RBAC), it allows SSH administrators to define policies
-like:
+a single sign-on (SSO) provider to issue login credentials to specific groups
+of users. When used in combination with role based access control (RBAC), it
+allows Teleport administrators to define policies like:
 
 - Only members of "DBA" group can SSH into machines running PostgreSQL.
 - Developers must never SSH into production servers.
@@ -23,42 +22,49 @@ like:
 
 - (!docs/pages/includes/tctl.mdx!)
 
-(!docs/pages/includes/enterprise/samlauthentication.mdx!)
-
-## Configure ADFS
+## Step 1/3. Configure ADFS
 
 You'll need to configure ADFS to export claims about a user (Claims Provider
 Trust in ADFS terminology) and you'll need to configure ADFS to trust
 Teleport (a Relying Party Trust in ADFS terminology).
 
-For Claims Provider Trust configuration, you'll need to specify at least the
-following two incoming claims: `Name ID` and `Group`. `Name ID` should be a
-mapping of the LDAP Attribute `E-Mail-Addresses` to `Name ID`. A group
-membership claim should be used to map users to roles (for example to
-separate normal users and admins).
+For Claims Provider Trust configuration, open the **AD FS** management window.
+Under **Claims Provider Trusts**, right-click on **Active Directory** and
+select **Edit Claim Rules**. You'll need to specify at least the following two
+incoming claims: `Name ID` and `Group`.
+
+- `Name ID` should be a mapping of the LDAP Attribute `E-Mail-Addresses` to
+  `Name ID`.
+
+  ![Name ID Configuration](../../../img/adfs-1.png)
+
+- A group membership claim should be used to map users to roles (for example to
+  separate normal users and admins).
 
-![Name ID Configuration](../../../img/adfs-1.png)
-![Group Configuration](../../../img/adfs-2.png)
+  ![Group Configuration](../../../img/adfs-2.png)
 
-In addition, if you are using dynamic roles (see below), it may be useful to map
-the LDAP Attribute `SAM-Account-Name` to `Windows account name` and create
-another mapping of `E-Mail-Addresses` to `UPN`.
+- If you are using dynamic roles (see below), it may be useful to map the LDAP
+  Attribute `SAM-Account-Name` to `Windows account name`:
 
-![WAN Configuration](../../../img/adfs-3.png)
-![UPN Configuration](../../../img/adfs-4.png)
+  ![WAN Configuration](../../../img/adfs-3.png)
+
+- And create another mapping of `E-Mail-Addresses` to `UPN`:
+
+  ![UPN Configuration](../../../img/adfs-4.png)
 
 You'll also need to create a Relying Party Trust. Use the below information to
-help guide you through the Wizard. Note that for development purposes we recommend
-using `https://localhost:3080/v1/webapi/saml/acs` as the Assertion Consumer
-Service (ACS) URL, but for production you'll want to change this to a domain
-that can be accessed by other users as well.
+help guide you through the Wizard.
 
-- Create a claims aware trust.
+- Create a Relaying Party Trust:
+  ![Add a Claims Provider Trust](../../../img/adfs-add-provider-trust.png)
 - Enter data about the relying party manually.
 - Set the display name to something along the lines of `Teleport`.
 - Skip the token encryption certificate.
-- Select *"Enable support for SAML 2.0 Web SSO protocol"* and set the URL to `https://localhost:3080/v1/webapi/saml/acs`.
-- Set the relying party trust identifier to `https://localhost:3080/v1/webapi/saml/acs` as well.
+- Select *"Enable support for SAML 2.0 Web SSO protocol"* and set the URL to
+  `https://teleport.example.com/v1/webapi/saml/acs`, replacing the domain name
+  with your Teleport proxy URL.
+- Set the relying party trust identifier to
+  `https://teleport.example.com/v1/webapi/saml/acs` as well.
 - For access control policy select *"Permit everyone"*.
 
 Once the Relying Party Trust has been created, update the Claim Issuance Policy
@@ -72,7 +78,7 @@ associated with it. To check this open Server Manager then
 *"Tools -> Active Directory Users and Computers"* and select the user and right
 click and open properties. Make sure the email address field is filled out.
 
-## Create Teleport roles
+## Step 2/3. Create Teleport roles
 
 Let's create two Teleport roles: one for administrators and the other for
 normal users. You can create them using the `tctl create {file name}` CLI command
@@ -121,17 +127,24 @@ This role declares:
   re-configure the Teleport cluster.
 
 The login
-`{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}`
+<nobr>`{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}`</nobr>
 configures Teleport to look at the
 `http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname`
 ADFS claim and use that field as an allowed login for each user. Note the
 double quotes (`"`) and square brackets (`[]`) around the claim name—these are
 important.
 
-Next, create a SAML connector [resource](../../reference/resources.mdx):
+## Step 3/3. Create a SAML connector
 
-```yaml
-(!examples/resources/adfs-connector.yaml!)
+Create a SAML connector resource using `tctl`:
+
+```code
+$ tctl sso configure saml --acs https://teleport.example.com/v1/webapi/saml/acs \
+  --preset adfs \
+  --entity-descriptor https://adfs.example.com/FederationMetadata/2007-06/FederationMetadata.xml \
+  --attributes-to-roles http://schemas.xmlsoap.org/claims/Group,teleadmins,editor \
+  --attributes-to-roles http://schemas.xmlsoap.org/claims/Group,Users,access \
+  > adfs.yaml
 ```
 
 The `acs` field should match the value you set in ADFS earlier and you can
@@ -139,23 +152,31 @@ obtain the `entity_descriptor_url` from ADFS under *"ADFS -> Service -> Endpoint
 
 The `attributes_to_roles` is used to map attributes to the Teleport roles you
 just created. In our situation, we are mapping the *"Group"* attribute whose full
-name is `http://schemas.xmlsoap.org/claims/Group` with a value of *"admins"*
-to the *"admin"* role. Groups with the value *"users"* is being mapped to the
+name is `http://schemas.xmlsoap.org/claims/Group` with a value of *"teleadmins"*
+to the *"editor"* role. Groups with the value *"users"* is being mapped to the
 *"users"* role.
 
-## Export the signing key
+You can test this connector before applying it (`cat adfs.yaml | tctl sso test`),
+but until we complete the next step the authentication process will not complete.
+
+Apply the connector:
+
+```code
+$ tctl create -f adfs.yaml
+```
+
+### Export the signing key
 
 For the last step, you'll need to export the signing key:
 
 ```code
-$ tctl saml export adfs
+$ tctl saml export adfs > saml.cer
 ```
 
-Save the output to a file named `saml.crt`, return back to ADFS, open the
-"Relying Party Trust" and add this file as one of the signature verification
-certificates.
+Copy `saml.cer`, to ADFS server, open the "Relying Party Trust" and add this
+file as one of the signature verification certificates:
 
-## Testing
+![adfs-add-teleport-cert.png](../../../img/adfs-add-teleport-cert.png)
 
 The Web UI will now contain a new button: "Login with MS Active Directory". The CLI is
 the same as before:
@@ -175,6 +196,8 @@ automatically in a browser.
   can be passed via `tsh login --auth=connector_name`
 </Admonition>
 
+(!docs/pages/includes/enterprise/samlauthentication.mdx!)
+
 ## Troubleshooting
 
 (!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)
diff --git a/docs/pages/access-controls/sso/github-sso.mdx b/docs/pages/access-controls/sso/github-sso.mdx
index 2b93ce3bc7331..870a3ff08433a 100644
--- a/docs/pages/access-controls/sso/github-sso.mdx
+++ b/docs/pages/access-controls/sso/github-sso.mdx
@@ -10,10 +10,13 @@ Teleport.
 
 ## Prerequisites
 
-- A GitHub organization with at least one team. <ScopedBlock scope="oss">This organization must not have external SSO set up, or Teleport
-will refuse to create the GitHub authentication connector.</ScopedBlock><ScopedBlock scope={["enterprise", "cloud"]}>This organization can be hosted
-from either GitHub Cloud or GitHub Enterprise Server.</ScopedBlock>
-- Teleport role with access to maintaining `github` resources for using `tctl` from the Desktop. This is available in the default `editor` role.
+- A GitHub organization with at least one team. <ScopedBlock scope="oss">This
+  organization must not have external SSO set up, or Teleport will refuse to
+  create the GitHub authentication connector.</ScopedBlock><ScopedBlock
+  scope={["enterprise", "cloud"]}>This organization can be hosted from either
+  GitHub Cloud or GitHub Enterprise Server.</ScopedBlock>
+- Teleport role with access to maintaining `github` resources for using `tctl`
+  from the Desktop. This is available in the default `editor` role.
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
@@ -32,6 +35,9 @@ https://PROXY_ADDRESS/v1/webapi/github/
 address of the Teleport Proxy Service</ScopedBlock><ScopedBlock
 scope="cloud">your Teleport Cloud tenant address</ScopedBlock>.
 
+The app must have the `read:org` scope in order to be able to read org and team
+membership details.
+
 Instructions for creating a GitHub OAuth app are available in [GitHub's
 documentation](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
 
@@ -43,6 +49,7 @@ Create a client secret to use along with the client ID in the next step:
 
 Define a GitHub authentication connector using `tctl`. Update this example
 command with:
+
 - Your OAuth app's client ID and client secret created during the previous step.
 - The roles you want to map from your GitHub organization to Teleport roles.
   Roles are defined in the **Repository roles** section of your organization's
@@ -61,6 +68,30 @@ $ tctl sso configure github \
 
 The contents of `github.yaml` should resemble the following:
 
+<ScopedBlock scope={["oss"]}>
+```yaml
+kind: github
+metadata:
+  name: github
+spec:
+  api_endpoint_url: ""
+  client_id: <client-id>
+  client_secret: <client-secret>
+  display: GitHub
+  endpoint_url: ""
+  redirect_url: https://<proxy-address>/v1/webapi/github/callback
+  teams_to_logins: null
+  teams_to_roles:
+    - organization: ORG-NAME
+      roles:
+        - access
+        - editor
+      team: GITHUB-TEAM
+version: v3
+```
+</ScopedBlock>
+
+<ScopedBlock scope={["enterprise", "cloud"]}>
 ```yaml
 kind: github
 metadata:
@@ -78,9 +109,11 @@ spec:
       roles:
         - access
         - editor
+        - reviewer
       team: GITHUB-TEAM
 version: v3
 ```
+</ScopedBlock>
 
 <Details title="Mapping multiple roles">
 You can add multiple instances of the `--teams-to-roles` flag or edit the connector
@@ -245,14 +278,32 @@ After logging in successfully, you will see the following:
 
 You will receive the details of your user session within the CLI:
 
-<ScopedBlock scope={["oss", "enterprise"]}>
+<ScopedBlock scope={["oss"]}>
 
 ```code
 > Profile URL:        https://tele.example.com:443
   Logged in as:       jeff
   Cluster:            tele.example.com
   Roles:              access
-  Logins:             jeff, ubuntu, debian, -teleport-internal-join
+  Logins:             jeff, ubuntu, debian
+  Kubernetes:         enabled
+  Kubernetes users:   dev
+  Kubernetes groups:  developer
+  Valid until:        2023-03-08 17:13:50 -0600 CST [valid for 7h51m0s]
+  Extensions:         permit-port-forwarding, permit-pty, private-key-policy
+```
+
+</ScopedBlock>
+
+
+<ScopedBlock scope={["enterprise"]}>
+
+```code
+> Profile URL:        https://tele.example.com:443
+  Logged in as:       jeff
+  Cluster:            tele.example.com
+  Roles:              access, requester
+  Logins:             jeff, ubuntu, debian
   Kubernetes:         enabled
   Kubernetes users:   dev
   Kubernetes groups:  developer
@@ -268,8 +319,8 @@ You will receive the details of your user session within the CLI:
 > Profile URL:        https://mytenant.teleport.sh:443
   Logged in as:       jeff
   Cluster:            mytenant.teleport.sh
-  Roles:              access
-  Logins:             jeff, ubuntu, debian, -teleport-internal-join
+  Roles:              access, requester
+  Logins:             jeff, ubuntu, debian
   Kubernetes:         enabled
   Kubernetes users:   dev
   Kubernetes groups:  developer
diff --git a/docs/pages/access-controls/sso/gitlab.mdx b/docs/pages/access-controls/sso/gitlab.mdx
index 160225fa6ef8e..f92a35ea23823 100644
--- a/docs/pages/access-controls/sso/gitlab.mdx
+++ b/docs/pages/access-controls/sso/gitlab.mdx
@@ -4,60 +4,92 @@ description: How to configure Teleport access using GitLab for SSO
 h1: Teleport SSO Authentication with GitLab
 ---
 
-## How to use GitLab as a single sign-on (SSO) provider with Teleport
-
 This guide will cover how to configure [GitLab](https://www.gitlab.com/) to issue
-SSH credentials to specific groups of users. When used in combination with role
+credentials to specific groups of users. When used in combination with role
 based access control (RBAC), it allows administrators to define policies
 like:
 
-- Only members of "DBA" group can SSH into machines running PostgreSQL.
+- Only members of the "DBA" group can access PostgreSQL databases.
 - Only members of "ProductionKubernetes" can access production Kubernetes clusters
 - Developers must never SSH into production servers.
 
 ## Prerequisites
 
-- At least two groups in GitLab with users assigned.
-- Teleport role with access to maintaining `oidc` resources.  This is available in the default `editor` role.
+- At least two groups in GitLab with users assigned. In our examples below,
+  we'll assume a group named `company` with two subgroups, `admin` and `dev`.
+- Teleport role with access to maintaining `oidc` resources.  This is available
+  in the default `editor` role.
 
 (!docs/pages/includes/commercial-prereqs-tabs.mdx!)
 
 - (!docs/pages/includes/tctl.mdx!)
 
-## Enable default OIDC authentication
-
-(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
-
 ## Configure GitLab
 
-You should have at least one group configured in GitLab to map to Teleport roles. In this example we use the names `gitlab-dev` and `gitlab-admin`.  Assign users to each of these groups.
-
-1. Create a Application in one of your Groups that will allow using GitLab as a OAuth provider to Teleport.
+You should have at least one group configured in GitLab to map to Teleport roles.
+In this example we use the names `gitlab-dev` and `gitlab-admin`.  Assign users
+to each of these groups.
 
-Settings
+1. Create an application in one of your groups (**Group overview** ->
+   **Settings** -> **Applications**) that will allow using GitLab as an OAuth
+   provider to Teleport.
 
-- Redirect URL `https://<proxy url>/v1/webapi/oidc/callback` such as `https://teleport.example.com:3080/v1/webapi/oidc/callback`
-- Check `Confidential`, `openid`, `profile`, and `email`.
+   Settings:
 
-![Create App](../../../img/sso/gitlab/gitlab-oidc-0.png)
+   - Redirect URL: `https://<proxy url>/v1/webapi/oidc/callback`.
+   - Check `Confidential`, `openid`, `profile`, and `email`.
 
-2. Collect the `Application ID` and `Secret` in the Application
+   ![Create App](../../../img/sso/gitlab/gitlab-oidc-0.png)
 
-These will be used in the Teleport OIDC Auth Connector.
+2. Collect the `Application ID` and `Secret` in the Application. These will be
+   used in the Teleport OIDC auth connector:
 
-![Collection Information](../../../img/sso/gitlab/gitlab-oidc-1.png)
+   ![Collection Information](../../../img/sso/gitlab/gitlab-oidc-1.png)
 
-3. Confirm the GitLab Issuer Address
+3. Confirm the GitLab issuer address.
 
-For GitLab cloud that is `https://gitlab.com`. That allows accessing the Open-ID configuration at `https://gitlab.com/.well-known/openid-configuration`.
-If you are self hosting that is likely another local address.
+   For GitLab.com, the issuer address is `https://gitlab.com`. This allows
+   Teleport to access the Open-ID configuration at
+   `https://gitlab.com/.well-known/openid-configuration`. If you are self
+   hosting the issuer address is the path to your GitLab instance.
 
 ## Configure Teleport
 
 ### Create a OIDC Connector
 
-Create a OIDC connector [resource](../../reference/resources.mdx):
-Replace the Application ID and the Secret with the values from GitLab.
+Create an OIDC connector resource using `tctl`.
+
+<Tabs>
+<TabItem label="GitLab.com">
+Replace the application ID and secret with the values from GitLab:
+
+```code
+$ tctl sso configure oidc --preset gitlab \
+--id <APPLICATION-ID> \
+--secret <APPLICATION-SECRET> \
+--claims-to-roles groups,company/admin,admin \
+--claims-to-roles groups,company/dev,dev > oidc.yaml
+```
+
+</TabItem>
+<TabItem label="Self-hosted">
+Replace the application ID and secret with the values from GitLab, and replace
+`https://gitlab.company.com` with the path to your self-hosted GitLab instance:
+
+```code
+$ tctl sso configure oidc --preset gitlab \
+--id <APPLICATION-ID> \
+--issuer-url https://gitlab.company.com \
+--secret <APPLICATION-SECRET> \
+--claims-to-roles groups,company/admin,admin \
+--claims-to-roles groups,company/dev,dev > oidc.yaml
+```
+
+</TabItem>
+</Tabs>
+
+This example maps the two subgroups `admin` and `dev` of the parent group
+`company` to the `admin` and `dev` roles in Teleport, and creates the `oidc.yaml` file:
 
 ```yaml
 kind: oidc
@@ -68,33 +100,35 @@ spec:
   - claim: groups
     roles:
     - admin
-    value: gitlab-admin
+    value: company/admin
   - claim: groups
     roles:
     - dev
-    value: gitlab-dev
-  client_id: Application_ID
-  client_secret: Secret
-  display: GitLab
+    value: company/gitlab-dev
+  client_id: <APPLICATION-ID>
+  client_secret: <APPLICATION-SECRET>
+  display: Gitlab
   issuer_url: https://gitlab.com
-  prompt: "none"
-  redirect_url: https://teleport.example.com:3080/v1/webapi/oidc/callback
-  scope:
-  - email
-version: v2
+  prompt: none
+  redirect_url: https://teleport.example.com:443/v1/webapi/oidc/callback
+version: v3
+
 ```
 
-<Admonition
-  type="note"
-  title="IMPORTANT"
->
-  The `prompt` value must be `none`.  Setting to `none` means Teleport will not send this as a parameter sending the `select_account` parameter will result in an error from GitLab.
-</Admonition>
+Test the connector resource by piping the file to `tctl sso test`:
+
+```code
+$ cat oidc.yaml | tctl sso test
+```
+
+After authorizing the application in GitLab you should get a
+**Login Successful** message in your web browser. Otherwise, consult the output
+of the command to diagnose.
 
 Create the connector using `tctl` tool:
 
 ```code
-$ tctl create oidc-connector.yaml
+$ tctl create -f oidc.yaml.yaml
 ```
 
 ## Create Teleport Roles
@@ -145,11 +179,13 @@ spec:
 Create both roles on the auth server:
 
 ```code
-$ tctl create admin.yaml
-$ tctl create dev.yaml
+$ tctl create -f admin.yaml
+$ tctl create -f dev.yaml
 ```
 
-## Testing
+## Enable default OIDC authentication
+
+(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
 
 The Web UI will now contain a new button: "Login with GitLab". The CLI is
 the same as before:
diff --git a/docs/pages/access-controls/sso/google-workspace.mdx b/docs/pages/access-controls/sso/google-workspace.mdx
index a1e5c513e24d9..7d127cf918b90 100644
--- a/docs/pages/access-controls/sso/google-workspace.mdx
+++ b/docs/pages/access-controls/sso/google-workspace.mdx
@@ -1,36 +1,35 @@
 ---
-title: SSH Authentication With Google Workspace (G Suite)
-description: How to configure SSH access with Google Workspace (formerly known as G Suite) using Teleport
-h1: SSH Authentication with Google Workspace (G Suite)
+title: Teleport Authentication with Google Workspace (G Suite)
+description: How to configure Teleport access with Google Workspace (formerly known as G Suite)
 videoBanner: WTLWc6nnPfk
 ---
 
-This guide will explain how to configure [Google Workspace](https://workspace.google.com/) to be a
-single sign-on (SSO) provider to issue SSH credentials to specific groups of users.
-When used in combination with role based access control (RBAC) it allows SSH administrators
-to define policies like:
+This guide will explain how to configure [Google Workspace](https://workspace.google.com/)
+to be a single sign-on (SSO) provider to issue Teleport credentials to specific
+groups of users. When used in combination with role-based access control (RBAC)
+it allows Teleport administrators to define policies like:
 
-- Only members of "DBA" Google group can SSH into machines running PostgreSQL.
+- Only members of the "DBA" Google group can connect to PostgreSQL databases.
 - Developers must never SSH into production servers.
 
 ## Prerequisites
 
 Before you get started you’ll need:
 
-- A Google Workspace super administrator account. We recommend setting up a separate super admin account with 2FA as opposed to granting your daily user super admin privileges.
-- Ability to create a Google Cloud project, which requires signing up for Google Cloud. Note that this guide will not require using any paid Google Cloud services.
+- A Google Workspace super administrator account. We recommend setting up a
+  separate super admin account with 2FA as opposed to granting your daily user
+  super admin privileges.
+- Ability to create a Google Cloud project, which requires signing up for Google
+  Cloud. Note that this guide will not require using any paid Google Cloud services.
 - Ability to set up Google Workspace groups.
-- Teleport role with access to maintaining `oidc` resources.  This is available in the default `editor` role.
+- Teleport role with access to maintaining `oidc` resources.  This is available
+  in the default `editor` role.
 
 (!docs/pages/includes/commercial-prereqs-tabs.mdx!)
 
 - (!docs/pages/includes/tctl.mdx!)
 
-## Step 1/4. Enable default OIDC authentication
-
-(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
-
-## Step 2/4. Configure Google Workspace
+## Step 1/4. Configure Google Workspace
 
 The setup will consist of:
 
@@ -80,19 +79,8 @@ We will show you how to configure the connector later in the
 guide, but for now, you should ensure that your Google Workspace plan allows you
 to use Teleport as you intend.
 
-We currently support OIDC connector versions `v2` and `v3`.
-
-<Notice type="tip">
-
-Teleport versions prior to 8.1.2 only support `v2` of the OIDC connector.
-
-</Notice>
-
-<Tabs>
-<TabItem label="v3">
-
-The OIDC connector maps a user's roles to the Google Workspace groups they
-belong to.
+We currently support version `v3` of the OIDC connector. The OIDC connector maps a
+user's roles to the Google Workspace groups they belong to.
 
 In order to list a user's Google Workspace groups, Teleport will first attempt to
 fetch credentials for calling Cloud Identity API methods, then use these
@@ -103,25 +91,13 @@ Directory API instead, and will use this API to list the user's groups in your
 entire Google Workspace account. Groups that the user belongs to that are
 external to the workspace will not be listed.
 
-</TabItem>
-<TabItem label="v2">
-
-The OIDC connector maps a user's roles to the Google Workspace groups they belong to.
-
-If these credentials do not exist, Teleport will fetch credentials for the
-Directory API instead, and will use this API to list the user's groups within
-your Google Workspace domain. Any group registered on a different domain or
-subdomain than the user's will be ignored.
-
-</TabItem>
-</Tabs>
-
 #### How to check your current plan
 
 To troubleshoot whether your Google Workspace plan supports querying transitive
 group memberships, you can visit the
 [Groups Inspection](https://admin.google.com/ac/groupsinspection) page in the
-Google Admin Console, which relies on the Cloud Identity API.
+Google Admin Console, which relies on the Cloud Identity API. Select "List all
+groups for a member" and "Include external groups" to test.
 
 If your Google Workspace plan does not support the Cloud Identity API, you must
 ensure that your RBAC does not depend on transitive group memberships.
@@ -134,9 +110,9 @@ all groups external to the workspace) will prevent users from logging in.
 
 ### Create a new project
 
-In the GCP console, choose to [Create a new project](https://console.cloud.google.com/projectselector2/apis/dashboard).
+In the GCP console, choose the project dropdown menu, and [create a new project](https://console.cloud.google.com/projectselector2/apis/dashboard).
 
-  ![creation of a Google Cloud Platform project](../../../img/googleoidc/new-project.png)
+  ![creation of a Google Cloud Platform project](../../../img/sso/googleoidc/new-project.png)
 
 ### Configure OAuth consent
 
@@ -144,14 +120,17 @@ On the
 [OAuth consent screen](https://console.cloud.google.com/apis/credentials/consent)
 page of the GCP console, select"Internal" as your User Type.
 
-![configuration of the OAuth consent screen](../../../img/googleoidc/consent-screen-1.png)
+![configuration of the OAuth consent screen](../../../img/sso/googleoidc/consent-screen-1.png)
 
-  Configure the appearance of your connector by picking a visible name, user support email, etc.
+On the next page, configure the appearance of your connector by picking a
+visible name, user support email, etc.
 
 ### Select scopes
 
+On the next page, click on **ADD OR REMOVE SCOPES**.
 Select the `.../auth/userinfo.email` and `openid` scopes.
-    ![select email and openid scopes](../../../img/googleoidc/consent-screen-2.png)
+
+![select email and openid scopes](../../../img/sso/googleoidc/consent-screen-2.png)
 
 Enable the
 [Cloud Identity API](https://console.cloud.google.com/apis/library/cloudidentity.googleapis.com)
@@ -170,87 +149,226 @@ correct Google Workspace plan.
 
 ### Create an OAuth client ID
 
-In the [Create an OAuth client ID](https://console.cloud.google.com/apis/credentials/oauthclient) page of the GCP console, select "Web application" as the Application type, pick a name, then add the following as an authorized redirect URI.
+Under **Credentials**, select **CREATE CREDENTIALS**, then **OAuth client ID**:
 
-```txt
-https://<address of proxy server>:3080/v1/webapi/oidc/callback
-```
+![Create an OAuth Client ID](../../../img/sso/googleoidc/create-oauth-client-id.png)
+
+Select "Web application" as the Application type, pick a name, then set the
+redirect URI based on the address of your Teleport Proxy Service or cloud tenant:
+<nobr><Var name="https://example.teleport.sh"/>`/v1/webapi/oidc/callback`</nobr>
 
-    ![OAuth client ID creation](../../../img/googleoidc/clientid-creation.png)
+![OAuth client ID creation](../../../img/sso/googleoidc/clientid-creation.png)
 
-  Copy the Client ID and Client Secret from the next screen or by clicking "Download OAuth client".
-    ![OAuth client data](../../../img/googleoidc/clientid-data.png)
+Copy the Client ID and Client Secret from the next screen or click **DOWNLOAD JSON**:
+
+![OAuth client data](../../../img/sso/googleoidc/clientid-data.png)
 
 ### Create a service account
 
-On the [Create a service account](https://console.cloud.google.com/iam-admin/serviceaccounts/create) page, pick a name for your service account. Leave project access grants and user access grants empty.
-    ![service account creation](../../../img/googleoidc/serviceacct-creation.png)
+From the GCP **IAM & Admin** menu select **Service Accounts**. From the kebab
+menu click **CREATE SERVICE ACCOUNT**:
+
+![Create a service account](../../../img/sso/googleoidc/create-service-account.png)
+
+On the [Create a
+service account](https://console.cloud.google.com/iam-admin/serviceaccounts/create)
+page, pick a name for your service account. Leave project access grants and user
+access grants empty.
+
+![service account creation](../../../img/sso/googleoidc/serviceacct-creation.png)
 
-  Click the newly-created account to view its details, and copy the Unique ID for later.
-    ![service account unique ID](../../../img/googleoidc/serviceacct-uniqueid.png)
+Click the newly-created account to view its details, and copy the Unique ID for later.
 
-  Create a new key for the service account, select JSON as the key type, and save the resulting JSON file.
-    ![service account key creation](../../../img/googleoidc/serviceacct-key.png)
-    Later, we will make this JSON available to the Teleport Auth Server via the OIDC Connector configuration, either by referencing a local file or pasting the JSON into the configuration YAML. If you plan to take the first approach, you will need to upload the JSON to the Auth Server.
+![service account unique ID](../../../img/sso/googleoidc/serviceacct-uniqueid.png)
+
+Create a new key for the service account, select JSON as the key type, and save
+the resulting JSON file.
+
+![service account key creation](../../../img/sso/googleoidc/serviceacct-key.png)
+
+Later, we will make this JSON available to the Teleport Auth Service via the
+OIDC Connector configuration, either by referencing a local file or pasting the
+JSON into the `tctl` command creating the connector. If you plan to take the
+first approach, you will need to upload the JSON to the Auth Service.
 
 <Admonition type="note">
-  Teleport requires the service account JSON to be available to all Teleport Auth Server hosts when deploying Teleport in a High Availability configuration. Unless you paste the JSON into the OIDC Connector configuration, you will need to upload the JSON file to all Auth Server hosts.
+Teleport requires the service account JSON to be available to all Teleport Auth
+Service hosts when deploying Teleport in a High Availability configuration.
+For high availability or cloud deployments, we suggest providing the JSON when
+creating the connector resource.
 </Admonition>
 
 ### Configure domain-wide delegation
 
 Configure [domain-wide
-  delegation](https://admin.google.com/ac/owl/domainwidedelegation) for your
-  newly-created service account:
+delegation](https://admin.google.com/ac/owl/domainwidedelegation) for your
+newly-created service account:
 
-  Click "Add new" and add the numeric Unique ID that you've copied earlier.
-    ![domain-wide delegation](../../../img/googleoidc/domainwidedelegation.png)
+Click "Add new" and add the numeric Unique ID that you've copied earlier from
+the service account:
 
-  Add either the
-    `https://www.googleapis.com/auth/cloud-identity.groups.readonly` scope or
-    the `https://www.googleapis.com/auth/admin.directory.group.readonly` scope.
-    The scope granted to the service account will determine if Teleport will
-    fetch both direct and indirect groups or just direct groups, respectively.
+![domain-wide delegation](../../../img/sso/googleoidc/domainwidedelegation.png)
 
-## Step 3/4. Create an OIDC connector
+Add **one** of the following scopes depending on your Google Workspace:
+- Direct and Indirect Groups (*Transitive Group Membership Support*)
+  - `https://www.googleapis.com/auth/cloud-identity.groups.readonly`
+- Direct Groups Only
+  - `https://www.googleapis.com/auth/admin.directory.group.readonly`
 
-Create the following OIDC connector [resource spec](../../reference/resources.mdx) as `gworkspace-connector.yaml`. We will explain how to choose values for fields within the resource spec below.
+## Step 2/4. Create an OIDC connector
+
+Create the OIDC connector resource using `tctl`. We will explain how to choose
+values for fields within the resource spec below:
 
 <Tabs>
-  <TabItem scope={["oss", "enterprise"]} label="Self Hosted">
-    ```yaml
-    (!examples/resources/gworkspace-connector.yaml!)
-    ```
-  </TabItem>
-
-  <TabItem scope={["cloud"]} label="Teleport Cloud">
-    ```yaml
-    (!examples/resources/gworkspace-connector-inline.yaml!)
-    ```
-  </TabItem>
+<TabItem scope={["oss", "enterprise", "cloud"]} label="Embedded JSON">
+
+Use this method to define the service account JSON in the connector resource.
+This method doesn't require providing the JSON file to the host(s) running the
+Auth Service.
+
+```code
+$ tctl sso configure oidc --preset google --id <CLIENT-ID> \
+--secret <CLIENT-SECRET> \
+--claims-to-roles groups,auditor@example.com,auditor \
+--claims-to-roles groups,teleport-developers@example.com,access \
+--google-admin=<GOOGLE-WORKSPACE-ADMIN-EMAIL> \
+--google-acc '
+{
+  "type": "service_account",
+  ...
+  "universe_domain": "googleapis.com"
+}'
+```
+
+The file created will resemble:
+
+```yaml
+kind: oidc
+metadata:
+  name: google
+spec:
+  claims_to_roles:
+  - claim: groups
+    roles:
+    - auditor
+    value: auditor@example.com
+  - claim: groups
+    roles:
+    - access
+    value: teleport-developers@example.com
+  client_id: <CLIENT-ID>
+  client_secret: <CLIENT-SECRET>
+  display: Google
+  google_admin_email: <GOOGLE-WORKSPACE-ADMIN-EMAIL>
+  google_service_account: |2-
+
+    {
+      "type": "service_account",
+      ...
+      "universe_domain": "googleapis.com"
+    }
+  issuer_url: https://accounts.google.com
+  redirect_url: https://example.teleport.sh:443/v1/webapi/oidc/callback
+version: v3
+```
+
+</TabItem>
+<TabItem scope={["oss", "enterprise"]} label="Uploaded JSON file">
+
+Use this method for single self-hosted Teleport Auth instances, or when you can
+easily and reliably make the JSON file available to all hosts running the Auth
+service.
+
+```code
+$ tctl sso configure oidc --preset google --id <CLIENT-ID> \
+--secret <CLIENT-SECRET> \
+--google-acc-uri <PATH/TO/SERVICE-ACCOUNT-KEY>.json \
+--claims-to-roles groups,auditor@example.com,auditor \
+--claims-to-roles groups,teleport-developers@example.com,access \
+--google-admin=<GOOGLE-WORKSPACE-ADMIN-EMAIL> > gworkspace-connector.yaml
+```
+
+The file created will resemble:
+
+```yaml
+kind: oidc
+metadata:
+  name: google
+spec:
+  claims_to_roles:
+  - claim: groups
+    roles:
+    - auditor
+    value: auditor@example.com
+  - claim: groups
+    roles:
+    - access
+    value: teleport-developers@example.com
+  client_id: <CLIENT-ID>
+  client_secret: <CLIENT-SECRET>
+  display: Google
+  google_admin_email: <GOOGLE-WORKSPACE-ADMIN-EMAIL>
+  google_service_account_uri: /PATH/TO/SERVICE-ACCOUNT-KEY.json
+  issuer_url: https://accounts.google.com
+  redirect_url: https://teleport.example.com/v1/webapi/oidc/callback
+version: v3
+```
+
+</TabItem>
 </Tabs>
 
-The email that you set for `google_admin_email` **must** be the email address of a user that has permission to list all groups, users, and group membership in your Google Workspace account. This user will generally need super admin or group admin privileges.
+<Admonition
+  type="tip"
+  title="Copy/Paste Tip"
+>
+  Be sure to remove < > brackets around tokens in the sample configuration above.
+  For example, replace `<GOOGLE-WORKSPACE-ADMIN-EMAIL>` with `admin@yourdomain.com`.
+</Admonition>
+
+The email that you set for `google_admin_email` **must** be the email address of
+a user that has permission to list all groups, users, and group membership in
+your Google Workspace account. This user will generally need super admin or group
+admin privileges.
+
+Do not use the email of the service account for `google_admin_email`. The
+configuration display will look the same, but the service account will not have
+the required domain-wide delegation.
+
+The `client_id` field must be the unique ID number captured from the Google Cloud
+Platform UI. An indicator that this is misconfigured is if you see "invalid Google
+Workspace credentials for scopes [...]" in your audit log, accessible from the
+Auth service host or the **Management** section of the web UI.
 
-Do not use the email of the service account for `google_admin_email`. The configuration display will look the same, but the service account will not have the required domain-wide delegation.
+Test the connector:
 
-The `client_id` field must be the unique ID number captured from the Google Cloud Platform UI. An indicator that this is misconfigured is if you see "invalid Google Workspace credentials for scopes [...]" in your log.
+```code
+$ cat gworkspace-connector.yaml | tctl sso test
+```
+
+This will open your browser and attempt to sign you in to your Teleport cluster
+using Google. If it fails, the CLI output will provide useful troubleshooting
+information.
 
 Create the connector using the `tctl` tool:
 
 ```code
-$ tctl create gworkspace-connector.yaml
+$ tctl create -f gworkspace-connector.yaml
 ```
 
-If you have a configured connector from a version of Teleport older than 8.1.2, you can upgrade your connector from `v2` to `v3`:
+<Details title="Upgrading from Teleport < 8.1.2?">
+If you have a configured connector from a version of Teleport older than 8.1.2,
+you can upgrade your connector from `v2` to `v3`:
 
 First, fetch the connector data:
+
 ```code
 $ umask 077
 $ tctl get --with-secrets oidc/connectorname > connector.yaml
 ```
 
-Next, edit `connector.yaml` to change the version number from `v2` to `v3`, and then update the connector:
+Next, edit `connector.yaml` to change the version number from `v2` to `v3`, and
+then update the connector:
 
 ```code
 $ tctl create -f connector.yaml
@@ -269,25 +387,23 @@ While a `v3` connector is configured, you can no longer downgrade Teleport to a
 version before 8.1.2. Before such a downgrade, follow the above instructions and
 change the version number back to `v2`.
 
-## Step 4/4. Test your Google Workspace OIDC connector
+</Details>
 
-The Web UI will now contain a new button: "Login with Google". The CLI is
-the same as before:
+## Step 3/4. Test your Google Workspace OIDC connector
+
+The Web UI will now contain a new button: "Login with Google". To log in with
+the CLI:
 
 ```code
-$ tsh --proxy=proxy.example.com login
+$ tsh --proxy=proxy.example.com login --auth=google
 ```
 
 This command will print the SSO login URL (and will try to open it
 automatically in a browser).
 
-<Admonition
-  type="tip"
-  title="Tip"
->
-  Teleport can use multiple OIDC connectors. In this case a connector name
-  can be passed via `tsh login --auth=google`
-</Admonition>
+## Step 4/4. Enable default OIDC authentication
+
+(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
 
 ## Troubleshooting
 
@@ -298,4 +414,3 @@ automatically in a browser).
 - [Google Workspace Cloud Identity API](https://cloud.google.com/identity)
 - [Google Workspace Directory API](https://developers.google.com/admin-sdk/directory)
 - [How nested Google Workspace groups work](https://support.google.com/a/answer/167100?hl=en)
-
diff --git a/docs/pages/access-controls/sso/okta.mdx b/docs/pages/access-controls/sso/okta.mdx
index 14de1ab57b606..365a47d7923fc 100644
--- a/docs/pages/access-controls/sso/okta.mdx
+++ b/docs/pages/access-controls/sso/okta.mdx
@@ -23,7 +23,16 @@ Teleport administrators to define policies like:
 
 - A Teleport role with access to edit and maintain `saml` resources. This is
   available in the default `editor` role.
-- (!docs/pages/includes/tctl.mdx!)
+
+<Tabs>
+<TabItem label="Teleport Enterprise (Self-Hosted)" scope="enterprise">
+- (!docs/pages/includes/enterprise/tctl-tsh-prerequisite.mdx!)
+</TabItem>
+<TabItem label="Teleport Cloud" scope="cloud">
+- (!docs/pages/includes/cloud/tctl-tsh-prerequisite.mdx!)
+</TabItem>
+</Tabs>
+
 
 (!docs/pages/includes/enterprise/samlauthentication.mdx!)
 
@@ -67,13 +76,14 @@ Provide the following values to their respective fields:
 
 #### General
 
-- Single sign on URL: `https://<cluster-url>/v1/webapi/saml/acs/new_saml_connector`
-- Audience URI (SP Entity ID): <nobr>`https://<cluster-url>/v1/webapi/saml/acs/new_saml_connector`</nobr>
+- Single sign on URL: `https://<cluster-url>:<port>/v1/webapi/saml/acs/okta`
+- Audience URI (SP Entity ID): <nobr>`https://<cluster-url>:<port>/v1/webapi/saml/acs/okta`</nobr>
 - Name ID format `EmailAddress`
 - Application username `Okta username`
 
 Replace `<cluster-url>` with your Teleport Proxy Service address or Enterprise
-Cloud tenant (e.g. `mytenant.teleport.sh`).
+Cloud tenant (e.g. `mytenant.teleport.sh`). Replace `<port>` with your Proxy
+Service listening port (`443` by default).
 
 #### Attribute Statements
 
@@ -134,22 +144,98 @@ You can also right click on the "View IdP metadata" link and select
 
 ## Step 3/4. Create a SAML connector
 
-Define a SAML connector resource in a local file named `okta-connector.yaml`:
+Define an Okta SAML connector using `tctl`. Update this example command with
+the path to your metadata file, and edit the `--attributes-to-roles` values for
+custom group assignment to roles. See [tctl sso configure
+saml](../../reference/cli.mdx#tctl-sso-configure-saml) for a full reference of
+flags for this command:
 
-```yaml
-(!examples/resources/saml-connector.yaml!)
+```code
+$ tctl sso configure saml --preset=okta \
+--entity-descriptor <Var name="https://example.okta.com/app/000000/sso/saml/metadata"/> \
+--attributes-to-roles=groups,okta-admin,editor \
+--attributes-to-roles=groups,okta-dev,access > okta.yaml
 ```
 
-Update the value of `acs` with your Teleport Proxy address or Enterprise Cloud tenant
-(e.g. `mytenant.teleport.sh`), and replace the value of `entity_descriptor_url`
-with the path you copied in the previous step.
+The contents of `okta.yaml` should resemble the following:
+
+```yaml
+kind: saml
+metadata:
+  name: okta
+spec:
+  acs: https://teleport.example.com:443/v1/webapi/saml/acs/okta
+  attributes_to_roles:
+  - name: groups
+    roles:
+    - editor
+    value: okta-admin
+  - name: groups
+    roles:
+    - access
+    value: okta-dev
+  audience: https://teleport.example.com:443/v1/webapi/saml/acs/okta
+  cert: ""
+  display: "Okta"
+  entity_descriptor: ""
+  entity_descriptor_url: https://example.okta.com/app/000000/sso/saml/metadata
+  issuer: ""
+  service_provider_issuer: https://teleport.example.com:443/v1/webapi/saml/acs/okta
+  sso: ""
+version: v2
+```
 
 The `attributes_to_roles` field in the connector resource maps key/value-like attributes of
 the assertion from Okta into a list of Teleport roles to apply to the session.
 
 (!docs/pages/includes/sso/idp-initiated.mdx!)
 
-Create the connector using `tctl` tool:
+You can test the connector before applying it to your cluster. This is strongly
+encouraged to avoid interruption to active clusters:
+
+```code
+$ cat okta.yaml | tctl sso test
+If browser window does not open automatically, open it by clicking on the link:
+ http://127.0.0.1:52519/0222b1ca...
+Success! Logged in as: alice@example.com
+--------------------------------------------------------------------------------
+Authentication details:
+   roles:
+   - editor
+   - access
+   traits:
+     groups:
+     - Everyone
+     - okta-admin
+     - okta-dev
+     username:
+     - alice@example.com
+   username: alice@example.com
+--------------------------------------------------------------------------------
+[SAML] Attributes to roles:
+- name: groups
+  roles:
+  - editor
+  value: okta-admin
+- name: groups
+  roles:
+  - access
+  value: okta-dev
+
+--------------------------------------------------------------------------------
+[SAML] Attributes statements:
+groups:
+- Everyone
+- okta-admin
+- okta-dev
+username:
+- alice@example.com
+
+--------------------------------------------------------------------------------
+For more details repeat the command with --debug flag.
+```
+
+Create the connector using `tctl`:
 
 ```code
 $ tctl create okta-connector.yaml
diff --git a/docs/pages/agents/deploy-agents-terraform.mdx b/docs/pages/agents/deploy-agents-terraform.mdx
new file mode 100644
index 0000000000000..ae40ca7ac31b4
--- /dev/null
+++ b/docs/pages/agents/deploy-agents-terraform.mdx
@@ -0,0 +1,308 @@
+---
+title: "Deploy Teleport Agents with Terraform"
+description: "In this guide, we will show you how to deploy a pool of Teleport agents so you can apply dynamic resources to enroll your infrastructure with Teleport."
+---
+
+An agent is a Teleport instance configured to run one or more Teleport services
+in order to proxy infrastructure resources. For a brief architectural overview
+of how agents run in a Teleport cluster, read the [Introduction to Teleport
+Agents](introduction.mdx).
+
+This guide shows you how to deploy a pool of Teleport agents by declaring it as
+code using Terraform.
+
+There are several methods you can use to join a Teleport agent to your cluster,
+which we discuss in the [Joining Services to your
+Cluster](join-services-to-your-cluster.mdx) guide. In this guide, we will use
+the **join token** method, where the operator stores a secure token on the Auth
+Service, and an agent presents the token in order to join a cluster.
+
+No matter which join method you use, it will involve the following Terraform
+resources:
+
+- Compute instances to run Teleport services
+- A join token for each compute instance in the agent pool
+
+```mermaid
+flowchart TB
+subgraph agent1["Teleport agent"]
+  service1["Teleport service"]
+  service2["Teleport service"]
+  join1["Join token"]
+end
+
+subgraph agent2["Teleport agent"]
+  join2["Join token"]
+  service3["Teleport service"]
+  service4["Teleport service"]
+end
+
+subgraph auth["Auth Service"]
+  join3["Join token"]
+  join4["Join token"]
+end
+
+join1<-.Matches.->join3
+join2<-.Matches.->join4
+```
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+<Admonition type="tip">
+
+We recommend following this guide on a fresh Teleport demo cluster so you can
+see how an agent pool works. After you are familiar with the setup, apply the
+lessons from this guide to protect your infrastructure. You can get started with
+a demo cluster using:
+- A demo deployment on a [Linux server](../index.mdx)
+- A [Teleport Team trial](https://goteleport.com/signup)
+
+</Admonition>
+
+- An AWS account with permissions to create EC2 instances.
+- Terraform v(=terraform.version=).
+- An identity file for the Teleport Terraform provider. Make sure you are
+  familiar with [how to set up the Teleport Terraform
+  provider](../management/dynamic-resources/terraform-provider.mdx) before following this
+  guide.
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/3. Fetch the example Terraform configuration
+
+Fetch the Teleport code repository and copy the example Terraform configuration
+for this project into your current working directory:
+
+```code
+$ git clone --depth=1 https://github.com/gravitational/teleport
+$ cp -R teleport/examples/agent-pool-terraform .
+$ rm -rf teleport
+```
+
+Move the identity file for the Teleport Terraform provider into your project
+directory so the Terraform provider an access it. Name the file
+`terraform-identity`.
+
+<Notice type="warning">
+
+If you don't have an identify file available, make sure you have followed the
+[prerequisites for this guide](#prerequisites).
+
+</Notice>
+
+## Step 2/3. Prepare your Terraform configuration
+
+After you have copied the example Terraform configuration, you will assign input
+variables and apply your new resources. First, we will explain the Terraform
+resource configuration you copied so you can understand how to deploy an agent
+pool in your infrastructure.
+
+### Instances and tokens
+
+The file `agent-pool.tf` configures EC2 instances and Teleport join tokens:
+
+```text
+(!examples/agent-pool-terraform/agent-pool.tf!)
+```
+
+In this minimal example, we deploy one EC2 instance for each Teleport agent.
+Each agent joins the cluster using a token. We create each token using the
+`teleport_provision_token` Terraform resource, specifying the token's value with
+a `random_string` resource.
+
+When we apply the `teleport_provision_token` resources, the Teleport Terraform
+provider creates them on the Teleport Auth Service backend. Each EC2 instance
+presents the token in order to establish trust with the cluster. 
+
+The Auth Service associates the join token with one or more roles, identifying
+the Teleport service that is allowed to use the token. The configuration above
+generates tokens for the following Teleport services:
+
+- Teleport SSH Service (`Node`)
+- Teleport Application Service (`App`)
+- Teleport Database Service (`Db`)
+- Teleport Kubernetes Service (`Kube`)
+
+### Startup script
+
+Each EC2 instance runs a script on startup, which we configured above using the
+`user_data` field within the `aws_instance.teleport_agent` resource
+(`examples/agent-pool-terraform/userdata`):
+
+```text
+(!examples/agent-pool-terraform/userdata!)
+```
+
+This script installs Teleport Community Edition on the host, then writes a
+configuration file to the default location, `/etc/teleport.yaml`. The
+configuration file enables each Teleport service we associated with our token.
+
+The configuration also adds the `role: agent-pool` label to the Teleport SSH
+Service on each instance. This will make it easier to access hosts in the agent
+pool later.
+
+Finally, the script restarts Teleport on the host to apply the new
+configuration.
+
+### Input variables
+
+The Terraform configuration we show in this guide relies on the following inputs
+(`examples/agent-pool-terraform/inputs.tf`):
+
+```text
+(!examples/agent-pool-terraform/inputs.tf!)
+```
+
+In your `agent-pool-terraform` project directory, create a file called
+`main.auto.tfvars` with the following content:
+
+```text
+agent_count=2
+proxy_service_address="mytenant.teleport.sh"
+aws_region=""
+teleport_version=(=teleport.version=)
+subnet_id=""
+```
+
+Assign `agent_count` to `2` for high availability. As you scale your Teleport
+usage, you can increase this count to ease the load on each agent. You can
+consider adding your agents to an Auto Scaling group as well.
+
+Assign `proxy_service_address` to the host and HTTPS port of your Teleport Proxy
+Service, e.g., `mytenant.teleport.sh:443`.
+
+<Notice type="tip">
+
+Make sure to include the port.
+
+</Notice>
+
+Assign `aws_region` to your AWS region, e.g., `us-east-1`.
+
+For `subnet_id`, include the ID of the AWS subnet where you will deploy Teleport
+agents.
+
+Finally, make sure you are using the latest supported version of the Teleport
+Terraform provider. The `required_providers` block for the Teleport provider
+includes a placeholder value:
+
+```text
+(!examples/agent-pool-terraform/provider.tf!)
+```
+
+Replace the placeholder value with the latest version:
+
+```code
+$ sed -i "" "s/TELEPORT_VERSION/(=teleport.plugin.version=)/" provider.tf
+```
+
+## Step 3/3. Verify the deployment
+
+Make sure your AWS credentials are available to Terraform using the standard
+approach for your organization.
+
+Apply the Terraform configuration:
+
+```code
+$ terraform apply
+```
+
+Once the `apply` command completes, run the following command to verify that the
+two agents have deployed successfully:
+
+```code
+$ tsh ls role=agent-pool
+Node Name                  Address    Labels
+-------------------------- ---------- ---------------
+ip-10-1-1-187.ec2.internal ⟵ Tunnel   role=agent-pool
+ip-10-1-1-24.ec2.internal  ⟵ Tunnel   role=agent-pool
+```
+
+## Next step: Enroll infrastructure resources
+
+There are two ways to configure your agent pool to protect infrastructure
+resources with Teleport, which we describe below.
+
+### Define dynamic resources in Terraform 
+
+You can declare Terraform resources that enroll your infrastructure with
+Teleport. The Teleport Terraform provider currently supports the following:
+
+|Infrastructure Resource|Terraform Resource|
+|---|---|
+|Application|`teleport_app`|
+|Database|`teleport_database`|
+
+To declare a dynamic resource with Terraform, add a configuration block similar
+to the ones below to a `*.tf` file in your `agent-pool-terraform` project
+directory. 
+
+The Teleport Terraform provider creates these on the Auth Service backend, and
+the relevant Teleport services query them in order to proxy user traffic. For a
+full list of supported resources and fields, see the [Terraform provider
+reference](../reference/terraform-provider.mdx).
+
+<Tabs>
+<TabItem label="Application">
+
+```text
+resource "teleport_app" "example" {
+  metadata = {
+    name        = "example"
+    description = "Test app"
+    labels = {
+      // Teleport adds this label by default, so add it here to
+      // ensure a consistent state.
+      "teleport.dev/origin" = "dynamic"
+    }
+  }
+
+  spec = {
+    uri = "localhost:3000"
+  }
+}
+```
+
+</TabItem>
+<TabItem label="Database">
+
+```text
+resource "teleport_database" "example" {
+  metadata = {
+    name        = "example"
+    description = "Test database"
+    labels = {
+      // Teleport adds this label by default, so add it here to
+      // ensure a consistent state.
+      "teleport.dev/origin" = "dynamic"
+    }
+  }
+
+  spec = {
+    protocol = "postgres"
+    uri      = "localhost"
+  }
+}
+```
+
+</TabItem>
+</Tabs>
+
+### Configure Teleport services in the agent pool
+
+Each Teleport service reads its local configuration file (`/etc/teleport.yaml`
+by default) to determine which infrastructure resources to proxy. You can edit
+this configuration file to enroll resources with Teleport.
+
+In the setup we explored in this guide, you can edit the user data script for
+each instance to add configuration settings to, for example, the
+`database_service` or `kubernetes_service` sections.
+
+To see how to configure each service, read its section of the documentation:
+
+- [SSH Service](../server-access/introduction.mdx)
+- [Database Service](../database-access/introduction.mdx)
+- [Kubernetes Service](../kubernetes-access/introduction.mdx)
+- [Windows Desktop Service](../desktop-access/introduction.mdx)
+- [Application Service](../application-access/introduction.mdx)
diff --git a/docs/pages/agents/introduction.mdx b/docs/pages/agents/introduction.mdx
new file mode 100644
index 0000000000000..e32a0156a6c2b
--- /dev/null
+++ b/docs/pages/agents/introduction.mdx
@@ -0,0 +1,101 @@
+---
+title: "Teleport Agents"
+description: Deploy agents to enroll resources in your infrastructure with Teleport. You can run multiple Teleport services per agent."
+---
+
+Teleport agents are Teleport instances that are configured to proxy traffic to
+resources in your infrastructure, such as servers, databases, and Kubernetes
+clusters. 
+
+This section shows you how to use Teleport agents to enable secure access to
+your infrastructure.
+
+## Architecture overview
+
+### Services
+
+Each Teleport agent can run one or more services.  A Teleport instance runs a
+service if it is enabled within the instance's configuration file. See the
+[Teleport Configuration
+Reference](../reference/config.mdx#enabling-teleport-services) for which
+services are enabled by default and how to enable a particular service.
+
+### Agent pools
+
+Agents typically run in the same private networks as the resources they proxy.
+They should be the only clients that can access a resource without Teleport.
+
+In this setup, agents dial the Teleport Proxy Service in order to establish
+reverse SSH tunnels. While the Proxy Service remains open to the public internet
+via its HTTPS port, agents require no open ports or public address.
+
+The Teleport Proxy Service uses these reverse tunnels to forward traffic in
+Teleport's supported protocols to an available agent. Agents apply RBAC
+rules and forward the traffic to resources in your infrastructure.
+
+```mermaid
+%%{init: {"flowchart": {"curve": "linear"}}}%%
+flowchart LR
+  proxy["Teleport Proxy Service"]
+  Clients--->proxy
+  subgraph private["Private network"]
+    db["Self-hosted database"]
+    app["Internal web application"]
+    subgraph agent2["Teleport agent"]
+      service3["Teleport Database Service"]
+      service4["Teleport Application Service"]
+    end
+
+    subgraph agent1["Teleport agent"]
+      service1["Teleport Kubernetes Service"]
+      service2["Teleport SSH Service"]
+    end
+
+    kubernetes["Kubernetes API server"]
+    ssh["SSH server"]
+    agent1 -.-> kubernetes & ssh
+    agent2 -.-> db
+    agent2 -.-> app
+  end
+
+  agent1 & agent2--Reverse tunnel---->proxy
+  agent2-.->cloud["Cloud provider API"]
+```
+
+Read our guide for how to use Terraform to [deploy a pool of
+agents](deploy-agents-terraform.mdx). 
+
+## Joining agents
+
+Teleport agents need to establish trust with the Teleport Auth Service in order
+to authorize users to access your infrastructure. There are several ways to join
+an agent to your Teleport cluster, making it possible to automate the join
+process for your environment. Read about the available join methods in our [Join
+Services to your Cluster](./join-services-to-your-cluster.mdx) guides.
+
+## Enrolling infrastructure
+
+There are two ways to enroll infrastructure resources with Teleport agents:
+
+1. **Static**: Edit an agent's configuration file to configure a specific
+   infrastructure resource to proxy.
+2. **Dynamic**: Apply a [configuration
+   resource](../management/dynamic-resources.mdx) that configures a resource to
+   proxy.
+
+The dynamic method allows Teleport to discover resources automatically.  The
+Discovery Service polls your cloud provider APIs and modifies dynamic
+infrastructure resources as required.
+
+[Read our guide](deploy-agents-terraform.mdx) to deploying a pool of agents
+via Terraform and enrolling infrastructure resources dynamically.
+
+To learn how to enroll resources via static configuration files, plus all the
+ways Teleport supports enrolling infrastructure, consult our guides to each of
+Teleport's services:
+
+- [SSH Service](../server-access/introduction.mdx)
+- [Database Service](../database-access/introduction.mdx)
+- [Kubernetes Service](../kubernetes-access/introduction.mdx)
+- [Windows Desktop Service](../desktop-access/introduction.mdx)
+- [Application Service](../application-access/introduction.mdx)
diff --git a/docs/pages/management/join-services-to-your-cluster.mdx b/docs/pages/agents/join-services-to-your-cluster.mdx
similarity index 90%
rename from docs/pages/management/join-services-to-your-cluster.mdx
rename to docs/pages/agents/join-services-to-your-cluster.mdx
index a5a540091d9f8..2c746f9fa6ab3 100644
--- a/docs/pages/management/join-services-to-your-cluster.mdx
+++ b/docs/pages/agents/join-services-to-your-cluster.mdx
@@ -17,5 +17,6 @@ Service. Choose the method that best suits your infrastructure:
 |[AWS IAM](./join-services-to-your-cluster/aws-iam.mdx)|A Teleport process uses AWS credentials to join the cluster, whether running on EC2 or not.|At least some of your infrastructure runs on AWS and your Teleport cluster is self hosted.|
 |[Azure Managed Identity](./join-services-to-your-cluster/azure.mdx)|A Teleport process demonstrates that it runs in your Azure subscription by sending a signed attested data document and access token to the Teleport Auth Service.|Your Teleport process will run on Azure.|
 |[Kubernetes ServiceAccount](./join-services-to-your-cluster/kubernetes.mdx)|A Teleport process uses a Kubernetes-signed proof to establish a trust relationship with your Teleport cluster.|Your Teleport process will run on Kubernetes.|
+|[GCP IAM](./join-services-to-your-cluster/gcp.mdx)|A Teleport process uses a GCP-signed token to establish a trust relationship with your Teleport cluster.|Your Teleport process will run on a GCP VM.|
 |[Join Token](./join-services-to-your-cluster/join-token.mdx)|A Teleport process presents a join token provided when starting the service.|There is no other supported method for your cloud provider.|
 
diff --git a/docs/pages/management/join-services-to-your-cluster/aws-ec2.mdx b/docs/pages/agents/join-services-to-your-cluster/aws-ec2.mdx
similarity index 100%
rename from docs/pages/management/join-services-to-your-cluster/aws-ec2.mdx
rename to docs/pages/agents/join-services-to-your-cluster/aws-ec2.mdx
diff --git a/docs/pages/management/join-services-to-your-cluster/aws-iam.mdx b/docs/pages/agents/join-services-to-your-cluster/aws-iam.mdx
similarity index 100%
rename from docs/pages/management/join-services-to-your-cluster/aws-iam.mdx
rename to docs/pages/agents/join-services-to-your-cluster/aws-iam.mdx
diff --git a/docs/pages/management/join-services-to-your-cluster/azure.mdx b/docs/pages/agents/join-services-to-your-cluster/azure.mdx
similarity index 100%
rename from docs/pages/management/join-services-to-your-cluster/azure.mdx
rename to docs/pages/agents/join-services-to-your-cluster/azure.mdx
diff --git a/docs/pages/agents/join-services-to-your-cluster/gcp.mdx b/docs/pages/agents/join-services-to-your-cluster/gcp.mdx
new file mode 100644
index 0000000000000..a5d922d5adc09
--- /dev/null
+++ b/docs/pages/agents/join-services-to-your-cluster/gcp.mdx
@@ -0,0 +1,101 @@
+---
+title: Join Services with GCP
+description: Use the GCP join method to add services to your Teleport cluster.
+---
+
+This guide will explain how to use the **GCP join method** to configure Teleport
+processes to join your Teleport cluster without sharing any secrets when they
+are running in a GCP VM.
+
+The GCP join method is available to any Teleport process running on a GCP VM.
+The VM must have a
+[service account](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances)
+assigned to it (the default service account is fine). No IAM roles are required
+on the Teleport process joining the cluster.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+
+- A GCP VM to host a Teleport service, with a service account assigned to it
+  and with the Teleport binary installed.
+- (!docs/pages/includes/tctl.mdx!)
+
+## Step 1/3. Create the GCP joining token
+
+Configure your Teleport Auth Service with a special dynamic token which will
+allow services from your GCP projects to join your Teleport cluster.
+
+Under the hood, services will prove that they are running in your GCP project
+by sending a signed ID token which matches an allow rule configured in your GCP
+joining token.
+
+Create the following `token.yaml` file with a `gcp.allow` rule specifying your GCP
+project ID(s), service account(s), and location(s) in which your GCP instances
+will run:
+
+```yaml
+# token.yaml
+kind: token
+version: v2
+metadata:
+  # the token name is not a secret because instances must prove that they are
+  # running in your GCP project to use this token
+  name: gcp-token
+spec:
+  # use the minimal set of roles required (e.g. Node, Proxy, App, Kube, DB, WindowsDesktop)
+  roles: [Node]
+
+  # set the join method allowed for this token
+  join_method: gcp
+
+  gcp:
+    allow:
+      # The GCP project ID(s) that VMs can join from.
+      - project_ids: ["example-project-id"]
+        # (Optional) The locations that VMs can join from. Note: both regions and
+        # zones are accepted.
+        locations: ["us-west1", "us-west2-a"]
+        # (Optional) The email addresses of service accounts that VMs can join
+        # with.
+        service_accounts: ["example@example.com"]
+```
+
+Run the following command to create the token:
+
+```code
+$ tctl create token.yaml
+```
+
+## Step 2/3. Configure your services
+
+The GCP join method can be used for Teleport processes running the SSH (`Node`), Proxy,
+Kubernetes, Application, Database, or Windows Desktop Services. The Teleport
+process should be run directly on a GCP VM.
+
+Configure your Teleport process with a custom `teleport.yaml` file. Use the
+`join_params` section with `token_name` matching your token created in Step 1
+and `method: gcp` as shown in the following example config:
+
+```yaml
+# /etc/teleport.yaml
+version: v3
+teleport:
+  join_params:
+    token_name: gcp-token
+    method: gcp
+  proxy_server: https://teleport.example.com:443
+ssh_service:
+  enabled: yes
+auth_service:
+  enabled: no
+proxy_service:
+  enabled: no
+```
+
+## Step 3/3. Launch your Teleport process
+
+(!docs/pages/includes/start-teleport.mdx!)
+
+Once you have started Teleport, confirm that your service is able to connect to
+and join your cluster.
\ No newline at end of file
diff --git a/docs/pages/management/join-services-to-your-cluster/join-token.mdx b/docs/pages/agents/join-services-to-your-cluster/join-token.mdx
similarity index 99%
rename from docs/pages/management/join-services-to-your-cluster/join-token.mdx
rename to docs/pages/agents/join-services-to-your-cluster/join-token.mdx
index d4ab0145c92d6..67ca62d13f17f 100644
--- a/docs/pages/management/join-services-to-your-cluster/join-token.mdx
+++ b/docs/pages/agents/join-services-to-your-cluster/join-token.mdx
@@ -335,4 +335,4 @@ $ tctl tokens rm <Var name="token-to-delete"/>
 
 - If you have workloads split across different networks or clouds, we recommend
   setting up Trusted Clusters. Read how to get started in our [Trusted Clusters
-  guide](../admin/trustedclusters.mdx).
+  guide](../../management/admin/trustedclusters.mdx).
diff --git a/docs/pages/management/join-services-to-your-cluster/kubernetes.mdx b/docs/pages/agents/join-services-to-your-cluster/kubernetes.mdx
similarity index 100%
rename from docs/pages/management/join-services-to-your-cluster/kubernetes.mdx
rename to docs/pages/agents/join-services-to-your-cluster/kubernetes.mdx
diff --git a/docs/pages/ai-assist.mdx b/docs/pages/ai-assist.mdx
index 875ff3fa94c72..d24a7f0489a83 100644
--- a/docs/pages/ai-assist.mdx
+++ b/docs/pages/ai-assist.mdx
@@ -35,7 +35,7 @@ Community Edition.
 Before you get started with Teleport Assist, make sure you have the following:
 
 - A running Teleport Community Edition cluster. For details on how to set this
-  up, see one of our [Getting Started](/docs/getting-started) guides.
+  up, see our [Getting Started](./index.mdx) guide.
 - **OpenAI Account**: You will need an active OpenAI account with GPT-4 API
   access as Teleport Assist relies on OpenAI services.
 
@@ -45,13 +45,9 @@ Assist by signing up for a
 [Teleport Team plan](https://goteleport.com/pricing/).
 </Notice>
 
-Teleport Assist currently doesn't support:
-- Teleport clusters using the etcd backend
-- Per-session MFA (support coming soon)
-
-If your installation is using etcd or requires per-session MFA, you can create a
-new cluster with any other backend without per-session MFA or sign up for the
-Teleport Team plan.
+Teleport Assist currently doesn't support Teleport clusters using the etcd backend.
+If your installation is using etcd, you can create a new cluster with
+any other backend or sign up for the Teleport Team plan.
 
 ## Step 1/3. Generate an OpenAI API key
 
@@ -104,7 +100,7 @@ proxy_service:
 
 
 Make sure that your Teleport user has the `assistant` permission. By default, users
-with built-in `auditor` and `editor` roles have this permission. You can also
+with built-in `access` and `editor` roles have this permission. You can also
 add it to a custom role. Here is an example:
 
 ```yaml
diff --git a/docs/pages/api/automatically-register-agents.mdx b/docs/pages/api/automatically-register-agents.mdx
index 0132cd5d34fca..933b7e806bbf8 100644
--- a/docs/pages/api/automatically-register-agents.mdx
+++ b/docs/pages/api/automatically-register-agents.mdx
@@ -216,7 +216,7 @@ The program, which you can find in
 |---|---|
 |`context`|Includes the `context.Context` type. `context.Context` is an abstraction for controlling long-running routines, such as connections to external services, that might fail or time out. Programs can cancel contexts or assign them timeouts and metadata. |
 |`crypto/rand`|Includes cryptographic randomization functions, which we will use to generate join tokens for Application Services to use to establish trust with the Teleport Auth Service.|
-|<nobr>`encoding/hex`</nobr>|The number generator we use from `crypto/rand` returns data in bytes, so we will encode these as hexadecimal strings using this package.|
+|`encoding/hex`|The number generator we use from `crypto/rand` returns data in bytes, so we will encode these as hexadecimal strings using this package.|
 |`fmt`|Formats data for printing, strings, or errors.|
 |`net`|Deals with network I/O.|
 |`net/url`|Parses URLs.|
@@ -228,7 +228,7 @@ The client imports the following third-party code:
 |Package|Description|
 |---|---|
 |`github.com/docker/docker/api/types`|Types used in the Docker daemon API. Aliased as `dtypes` here. |
-|<nobr>`github.com/docker/docker/api/types/container`</nobr>|Container-specific types used in the Docker daemon API.|
+|`github.com/docker/docker/api/types/container`|Container-specific types used in the Docker daemon API.|
 |`github.com/docker/docker/api/types/filters`|Types used for filtering containers in the Docker daemon API.|
 |`github.com/docker/docker/api/types/strslice`|A utility package for working with slices of strings in Docker's API client library. (In Go, slices are similar to arrays, but with variable lengths and capacities. Arrays have a fixed size.)|
 |`github.com/docker/docker/client`|The Docker API client library, aliased as `docker` here.|
@@ -266,7 +266,7 @@ want to change later, including:
 |`proxyAddr`|The host and port of the Teleport Proxy Service, e.g., `mytenant.teleport.sh:443`, which we will use to connect the client to your cluster. **Assign this to your own Proxy Service's host and port.**|
 |`teleportImage`|The name of the Teleport container image, which the program will use to run instances of the Teleport Application Service.|
 |`initTimeout`|The timeout for connecting to the Teleport cluster (30 seconds).|
-|<nobr>`updateInterval`</nobr>|How often the program will wait between reconciling Application Service instances and application containers (5 seconds).|
+|`updateInterval`|How often the program will wait between reconciling Application Service instances and application containers (5 seconds).|
 |`tokenTTL`|How long of a TTL to set for join tokens that Application Service instances will use to establish trust with the Teleport cluster. This client application will use join tokens immediately after creating them, so we can set this TTL to a small value (5 minutes) to prevent this credential from leaking.|
 |`networkName`|The name of the Docker network to search for application containers. `bridge` is the default local network managed by the Docker daemon.|
 |`managementPort`|The management API port of our RabbitMQ containers.|
@@ -529,8 +529,9 @@ corresponding role permissions with the `create` verb:
 |Resource|Method|Within a Role|
 |---|---|---|
 |Database|`*client.Client.CreateDatabase`|`db`|
-|Kubernetes cluster|<nobr>`*client.Client.CreateKubernetesCluster`</nobr>|`kube_cluster`|
-|Windows Desktop|`*client.Client.CreateWindowsDesktop`|<nobr>`windows_desktop`</nobr>|
+|Kubernetes cluster|`*client.Client.CreateKubernetesCluster`|`kube_cluster`|
+|Windows Desktop|`*client.Client.CreateWindowsDesktop`|`windows_desktop`|
+
 Since a server must run an instance of the Teleport Service in order to join
 a Teleport cluster, API clients can only register servers by using tokens.
 
diff --git a/docs/pages/api/rbac.mdx b/docs/pages/api/rbac.mdx
index 8d09ff8a7c52b..06a7c3f2ebf9b 100644
--- a/docs/pages/api/rbac.mdx
+++ b/docs/pages/api/rbac.mdx
@@ -445,7 +445,7 @@ Here are the packages our client application imports from Go's standard library:
 
 |Package|Description|
 |---|---|
-| <nobr>`context`</nobr> |Includes the `context.Context` type. `context.Context` is an abstraction for controlling long-running routines, such as connections to external services, that might fail or time out. Programs can cancel contexts or assign them timeouts and metadata.|
+| `context`|Includes the `context.Context` type. `context.Context` is an abstraction for controlling long-running routines, such as connections to external services, that might fail or time out. Programs can cancel contexts or assign them timeouts and metadata.|
 |`fmt`|Formatting data for printing, strings, or errors.|
 |`io`|Dealing with I/O operations, e.g., reading files or network sockets.|
 |`os`|Interacting with the operating system, e.g., to open files.|
@@ -455,12 +455,12 @@ The client imports the following third-party code:
 
 |Package|Description|
 |---|---|
-|`github.com/gravitational/`<nobr>`teleport/api/client`</nobr>|A library for authenticating to the Auth Service's gRPC API and making requests, aliased as `teleport`.|
-|`github.com/gravitational/`<nobr>`teleport/api/types`</nobr>|Types used in the Auth Service API, e.g., Application Service records.|
+|`github.com/gravitational/teleport/api/client`|A library for authenticating to the Auth Service's gRPC API and making requests, aliased as `teleport`.|
+|`github.com/gravitational/teleport/api/types`|Types used in the Auth Service API, e.g., Application Service records.|
 |`github.com/gravitational/trace`|Presenting errors with more useful detail than the standard library provides.|
 |`google.golang.org/grpc`|The gRPC client and server library.|
 |`k8s.io/api/rbac/v1`|The Kubernetes RBAC API client library.|
-|`k8s.io/apimachinery/`<nobr>`pkg/apis/meta/v1`</nobr>|Code common to Kubernetes' API client libraries.|
+|`k8s.io/apimachinery/pkg/apis/meta/v1`|Code common to Kubernetes' API client libraries.|
 |`k8s.io/client-go/kubernetes`|Setting up an general-purpose Kubernetes client.|
 |`k8s.io/client-go/kubernetes/typed/rbac/v1`|Types for the Kubernetes RBAC API.|
 |`k8s.io/client-go/tools/clientcmd`|Another general-purpose Kubernetes client library.|
@@ -490,7 +490,7 @@ want to change later, including:
 |`initTimeout`|The timeout for connecting to the Teleport cluster. We have defined this as 30 seconds.|
 |`identityFilePath`|The path to the Teleport identity file you created earlier.|
 |`clusterName`|The name of the Kubernetes cluster you will fetch RBAC resources from. In this guide, the cluster's name is `minikube`.|
-|<nobr>`roleAnnotationKey`</nobr>|In Kubernetes, annotations are arbitrary key/value pairs that you can add to resources. The role and cluster role bindings we created earlier have the annotation key we specify here so our client application can fetch them.|
+|`roleAnnotationKey`|In Kubernetes, annotations are arbitrary key/value pairs that you can add to resources. The role and cluster role bindings we created earlier have the annotation key we specify here so our client application can fetch them.|
 
 ### Initializing a Kubernetes RBAC client
 
@@ -615,7 +615,7 @@ client's role type, based on the cluster role binding:
 |---|---|---|
 |`allow.kubernetes_labels`|Labels for Teleport-registered Kubernetes clusters that a user with this role is allowed to access.|Based on the Teleport-registered Kubernetes cluster that the cluster role binding belongs to.|
 |`allow.kubernetes_resources`|Kubernetes pods in specific namespaces that that a user with this role is allowed to access.|Allow access to all namespaces, since cluster role bindings are not restricted by namespace.|
-|<nobr>`allow.kubernetes_users`</nobr> and `allow.kubernetes_groups`|The Kubernetes groups and users that a Teleport user with this role will assume when interacting with the Kubernetes cluster.|Supply the names of any users or groups connected to the cluster role binding.|
+|`allow.kubernetes_users` and `allow.kubernetes_groups`|The Kubernetes groups and users that a Teleport user with this role will assume when interacting with the Kubernetes cluster.|Supply the names of any users or groups connected to the cluster role binding.|
 
 ### Creating a Teleport role from a Kubernetes role binding
 
diff --git a/docs/pages/application-access/getting-started.mdx b/docs/pages/application-access/getting-started.mdx
index 8b2b318998acc..c20fee2f19120 100644
--- a/docs/pages/application-access/getting-started.mdx
+++ b/docs/pages/application-access/getting-started.mdx
@@ -6,15 +6,15 @@ videoBanner: 5Uwhp3IQMHY
 
 Let's connect to Grafana using Teleport in three steps:
 
-- Launch Grafana in a Docker container.
-- Install the Teleport Application Service on a node and configure it to proxy Grafana.
+- Launch Grafana in a Docker container or Kubernetes cluster.
+- Install the Teleport Application Service and configure it to proxy Grafana.
 - Access Grafana through Teleport.
 
 <ScopedBlock scope={["oss", "enterprise"]}>
 ![Teleport Application Access Grafana Self-Hosted](../../img/application-access/grafana_selfhosted.png)
 </ScopedBlock>
 <ScopedBlock scope={["cloud"]}>
-![Teleport Database Access CockroachDB Cloud](../../img/application-access/grafana_cloud.png)
+![Teleport Application Access Grafana Cloud](../../img/application-access/grafana_cloud.png)
 </ScopedBlock>
 
 ## Prerequisites
@@ -22,102 +22,208 @@ Let's connect to Grafana using Teleport in three steps:
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
 
 - (!docs/pages/includes/tctl.mdx!)
-- A Docker installation, which we will use to launch Grafana in a container. Alternatively, if you have another web application you'd like to protect with Teleport, you can use that instead.
 - A host where you will run the Teleport Application Service.
 
+<Tabs>
+<TabItem label="Docker">
+- A Docker installation, which we will use to launch Grafana in a container.
+  Alternatively, if you have another web application you'd like to protect with
+  Teleport, you can use that instead.
+</TabItem>
+<TabItem label="Kubernetes Cluster">
+
+(!docs/pages/includes/kubernetes-access/helm-k8s.mdx!)
+
+- Administrative rights to deploy within a cluster.
+
+</TabItem>
+</Tabs>
+
 <Admonition type="tip" title="Not yet a Teleport user?">
-If you have not yet deployed the Auth Service and Proxy Service, you should follow one of our [getting started guides](../get-started.mdx) or try our Teleport Application Access [interactive learning track](https://play.instruqt.com/teleport/invite/rgvuva4gzkon). 
+{/*lint ignore messaging*/}
+If you have not yet deployed the Auth Service and Proxy Service, you should
+follow one of our [getting started guides](../index.mdx) or try our
+Teleport Application Access [interactive learning track](https://play.instruqt.com/teleport/invite/rgvuva4gzkon).
 </Admonition>
 
-We will assume your Teleport cluster is accessible at `teleport.example.com` and `*.teleport.example.com`. You can substitute the address of your Teleport Proxy Service. (For Teleport Cloud customers, this will be similar to `mytenant.teleport.sh`.)
+<Admonition type="note" title="Application Access and DNS for Self-Hosted Clusters">
 
-<Admonition type="note" title="Application Access and DNS">
 (!docs/pages/includes/dns-app-access.mdx!)
+
+Teleport Cloud will automatically provide a subdomain and signed TLS certificate
+for your application under your tenant address.
 </Admonition>
 
-## Step 1/3. Start Grafana
+## Step 1/4. Generate a token
+
+A join token is required to authorize a Teleport Application Service instance to
+join the cluster. Generate a short-lived join token and save it, for example,
+in `/tmp/token`:
+
+```code
+$ tctl tokens add \
+    --type=app \
+    --app-name=grafana \
+    --app-uri=http://localhost:3000
+```
+
+<Tabs>
+<TabItem label="Docker">
+
+## Step 2/4. Start Grafana
 
 We've picked Grafana for this tutorial since it's very easy to run with zero
 configuration required. If you have another web application you'd like to
-expose, skip over to **Step 2**.
+expose, skip over to **Step 3**.
 
 Grafana can be launched in a Docker container with a single command:
 
 ```code
-$ docker run -d -p 3000:3000 grafana/grafana
+$ docker run -d --name grafana -p 3000:3000 grafana/grafana
 ```
 
-## Step 2/3. Install and configure Teleport
-(!docs/pages/includes/permission-warning.mdx!)
+Next, we need to edit `/etc/grafana/grafana.ini` in the container. Under
+`[server]`, uncomment the `domain` key and set the value to your Teleport
+cluster domain, (e.g., `teleport.example.com`). Since there is no text editor
+installed in the container, we can do this with `sed`:
 
-On your Application Service host, download the latest version of Teleport for
-your platform from our
-[downloads page](https://goteleport.com/download).
+```code
+$ docker exec -u 0 grafana sed -i 's/;domain = localhost/domain = teleport.example.com/g' /etc/grafana/grafana.ini
+```
 
-### Generate a token
+Replace `teleport.example.com` with your Teleport cluster domain.
 
-A join token is required to authorize a Teleport Application Service instance to
-join the cluster. Generate a short-lived join token and save it, for example,
-in `/tmp/token` on your Teleport Application Service host:
+## Step 3/4. Install and configure Teleport
 
-```code
-$ tctl tokens add \
-    --type=app \
-    --app-name=grafana \
-    --app-uri=http://localhost:3000
-```
+(!docs/pages/includes/permission-warning.mdx!)
 
-### Start Teleport
+### Configure and Start Teleport
 
 Install Teleport on the host where you will run the Teleport Application Service. See our [Installation](../installation.mdx) page for options besides Linux servers.
 
 (!docs/pages/includes/install-linux.mdx!)
 
-Now start Teleport and point it to the application endpoint:
+Create the Teleport Application Service configuration at `/etc/teleport.yaml`.
+Replace <Var name="teleport.example.com" /> with your Teleport Proxy Service
+address (`teleport.example.com`) or Teleport Cloud tenant (e.g. `mytenant.teleport.sh`).
 
 ```code
-$ sudo teleport app start \
-  --name=grafana \
+$ sudo teleport configure \
+  -o file \
+  --proxy=<Var name="teleport.example.com" />:443 \
   --token=/tmp/token \
-  --uri=http://localhost:3000 \
-  --auth-server=https://teleport.example.com:3080
+  --roles=app \
+  --app-name=grafana \
+  --app-uri=http://localhost:3000
+```
+  
+Make sure to update `--app-name` and `--app-uri` accordingly if you're using your
+own web application.
+
+The `--token` flag points to the file on the Application Service host where we
+stored the token that we generated earlier.
+
+(!docs/pages/includes/start-teleport.mdx service="the Teleport Application Service"!)
+
+</TabItem>
+<TabItem label="Kubernetes cluster">
+
+## Step 2/4. Start Grafana
+
+We've picked Grafana for this tutorial since it's very easy to run with zero
+configuration required. If you have another web application you'd like to
+expose, skip over to **Step 3**. Install Grafana with these helm instructions
+and it will be available at `http://example-grafana.example-grafana.svc.cluster.local`
+within the Kubernetes cluster.
+
+```code
+$ helm repo add grafana https://grafana.github.io/helm-charts
+$ helm repo update
+$ helm install example-grafana grafana/grafana \
+    --create-namespace \
+    --namespace example-grafana
+```
+
+## Step 3/4. Install and configure Teleport
+
+  (!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
+
+<ScopedBlock scope={["oss", "enterprise"]}>
+Install the Teleport Kubernetes Service into your Kubernetes Cluster
+with the Teleport Application Service configuration.
+Replace <Var name="teleport.example.com" /> with
+your Teleport Proxy Service address (`teleport.example.com`) or your
+Teleport Enterprise Cloud tenant (e.g. `mytenant.teleport.sh`):
+
+```code
+$ JOIN_TOKEN=$(cat /tmp/token)
+$ helm install teleport-kube-agent teleport/teleport-kube-agent \
+  --create-namespace \
+  --namespace teleport-agent \
+  --set roles=app \
+  --set proxyAddr=<Var name="teleport.example.com" />:443 \
+  --set authToken=${JOIN_TOKEN?} \
+  --set "apps[0].name=grafana" \
+  --set "apps[0].uri=http://example-grafana.example-grafana.svc.cluster.local" \
+  --set "labels.env=dev" \
+  --version (=teleport.version=)
 ```
 
-Change `https://teleport.example.com:3080` to the address and port of your Teleport Proxy Server. If you are a Teleport Cloud customer, use port 443 of your tenant's subdomain, e.g., `mytenant.teleport.sh:443`.
+</ScopedBlock>
+<ScopedBlock scope={["cloud"]}>
+Install the Teleport Kubernetes Service into your Kubernetes Cluster
+with the Teleport Application Service configuration.
+Replace <Var name="teleport.example.com" /> with
+your Teleport Enterprise Cloud tenant address (`mytenant.teleport.sh`)
+```code
+$ JOIN_TOKEN=$(cat /tmp/token)
+$ helm install teleport-kube-agent teleport/teleport-kube-agent \
+  --create-namespace \
+  --namespace teleport-agent \
+  --set roles=app \
+  --set proxyAddr=<Var name="teleport.example.com" />:443 \
+  --set authToken=${JOIN_TOKEN?} \
+  --set "apps[0].name=grafana" \
+  --set "apps[0].uri=http://example-grafana.example-grafana.svc.cluster.local" \
+  --set "labels.env=dev" \
+  --version (=cloud.version=)
+```
+</ScopedBlock>
 
-Make sure to update `--app-name` and `--app-uri` accordingly if you're using your own web application.
+Make sure to update `apps[0].name` and `apps[0].uri` accordingly if you're using
+your own web application.
 
-The `--token` flag points to the file on the Application Service host where we stored the token that we generated earlier.
+</TabItem>
+</Tabs>
 
 ### Create a user
 
-Next, let's create a user to access the application we've just connected. Teleport has a built-in role called `access` that allows users to access cluster resources. Create a local user assigned this role:
+Next, let's create a user to access the application we've just connected.
+Teleport has a built-in role called `access` that allows users to access
+cluster resources. Create a local user assigned this role:
 
 ```code
 $ tctl users add --roles=access alice
 ```
 
-The command will output a signup link. Use it to choose a password and set up a second factor. After that, it will take you to the Teleport Web UI.
+The command will output a signup link. Use it to choose a password and set up a
+second factor. After that, it will take you to the Teleport Web UI.
 
-## Step 3/3. Access the application
+## Step 4/4. Access the application
 
 There are a couple of ways to access the proxied application.
 
-Every application is assigned a public address that you can use to navigate to
-the application directly. In our sample Grafana application we have provided a public address with
-the `--app-public-addr` flag, so go to `https://grafana.teleport.example.com`
-to access the app. 
-
-Replace `grafana` with the value of the `--app-name` flag you used when starting the Teleport Application Service and `teleport.example.com` with the address of your Proxy Service.
-
-If you're not logged into Teleport,
-you will need to authenticate before the application will show.
+Log in to the Teleport Web UI at your Proxy Service address. All available
+applications are displayed on the Applications tab. Click Launch on the Grafana
+application tile to access it.
 
-Alternatively, log in to the Teleport Web Interface at `https://teleport.example.com` (replace with your Proxy Service's public address). All available applications are displayed on the Applications tab. Click on the Grafana application tile to access it.
+Alternatively call the application directly with its name as the sub-domain,
+e.g. `https://grafana.teleport.example.com` or `https://grafana.mytenant.teleport.sh`
+for a Teleport Cloud tenant. You will need to log in if you weren't already authenticated.
 
 ## Next steps
 
-Dive deeper into the topics relevant to your Application Access use-case:
+Dive deeper into protecting applications with Teleport:
 
 - Learn in more detail about [connecting applications](./guides/connecting-apps.mdx).
 - Learn about integrating with [JWT tokens](./jwt/introduction.mdx) for auth.
diff --git a/docs/pages/application-access/guides/connecting-apps.mdx b/docs/pages/application-access/guides/connecting-apps.mdx
index b2f14109173c3..7508b65242eea 100644
--- a/docs/pages/application-access/guides/connecting-apps.mdx
+++ b/docs/pages/application-access/guides/connecting-apps.mdx
@@ -96,6 +96,12 @@ a reverse tunnel.
 
 ### Application name
 
+{/*
+Note: this section of the docs is linked to from error messages in the product.
+Please make sure to update lib/srv/servicecfg/app.go if you change this section
+header or move this page.
+*/}
+
 An application name should make a valid sub-domain (\<=63 characters, no spaces, only `a-z 0-9 -` allowed).
 
 After Teleport is running, users can access the app at `app-name.proxy_public_addr.com`
diff --git a/docs/pages/application-access/okta/guide.mdx b/docs/pages/application-access/okta/guide.mdx
index 9318b466343c4..4cccb29ed1591 100644
--- a/docs/pages/application-access/okta/guide.mdx
+++ b/docs/pages/application-access/okta/guide.mdx
@@ -16,13 +16,48 @@ configurations to enable it.
 
 ## Prerequisites
 
-(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+(!docs/pages/includes/commercial-prereqs-tabs.mdx!)
 
 - (!docs/pages/includes/tctl.mdx!)
-- An Okta organization with an [Okta API token](https://developer.okta.com/docs/guides/create-an-api-token) provisioned.
 - A running Teleport cluster with Okta login configured.
 - An instance where you will run the Okta Service. This can live anywhere
   with outbound access to Okta and must be running Linux.
+- An Okta organization with an [Okta API token](https://developer.okta.com/docs/guides/create-an-api-token) created.
+
+<Details title="Okta API token permissions">
+
+Okta API tokens inherit the permissions of the user who created them. These can
+be controlled by using [custom admin roles](https://help.okta.com/en-us/Content/Topics/Security/custom-admin-role/about-creating-custom-admin-roles.htm)
+and assigning them to a user who will then create the API token. We recommend
+creating a user dedicated to the Teleport Okta API service to manage this token.
+
+The permissions required are:
+
+### User permissions
+
+- View users and their details
+- Edit users' group membership
+- Edit users' application assignments
+
+### Group permissions
+
+- View groups and their details
+- Manage group membership
+
+### Application permissions
+
+- View applications and their details
+- Edit application's user assignments
+
+Additionally, the resource set associated with the target user must have unconstrained
+access to Users, Applications, and Groups.
+
+One caveat here is that it's impossible to assign API token creation permissions to a
+custom role. However, the Okta built in role "Group Membership Admin" has permissions
+to create an API token. See more information about built in roles
+[here](https://help.okta.com/en-us/Content/Topics/Security/administrators-admin-comparison.htm).
+
+</Details>
 
 ## Step 1/3. Create Okta import rules
 
@@ -30,7 +65,7 @@ Before setting up the Okta Service, you should create Okta import rules in order
 to ensure that our Okta applications are set up with appropriate labeling before
 you attempt to synchronize them. First, you'll need to get the group and application
 IDs from Okta. The easiest way to do this is to use the <Var name="okta-api-token" />
-provisioned earlier.
+that was created when when evaluating the prerequisites.
 
 To get group IDs:
 
@@ -152,8 +187,8 @@ ssh_service:
   enabled: no
 okta_service:
   enabled: yes
-  api_endpoint: <Var name="okta-endpoint-url" />
-  api_token_path: <Var name="okta-api-token-path" />
+  api_endpoint: <replace-with-okta-endpoint-url>
+  api_token_path: <replace-with-okta-api-token-path>
 ```
 
 Edit `/etc/teleport.yaml` to replace `teleport.example.com:443` with the host
diff --git a/docs/pages/architecture/authentication.mdx b/docs/pages/architecture/authentication.mdx
index 7a66f3c2546c9..e229f47e07f2d 100644
--- a/docs/pages/architecture/authentication.mdx
+++ b/docs/pages/architecture/authentication.mdx
@@ -143,7 +143,7 @@ services and rotates SSH and X.509 certificates.
 
 Teleport internal services - Auth, Proxy and Nodes use certificates to identify themselves
 within a cluster. To join proxies and nodes to the cluster and receive certificates, admins should use
-[short-lived tokens or cloud identity services](../management/join-services-to-your-cluster/join-token.mdx).
+[short-lived tokens or cloud identity services](../agents/join-services-to-your-cluster/join-token.mdx).
 
 Unlike users and services, internal services receive long-lived certificates.
 
diff --git a/docs/pages/architecture/authorization.mdx b/docs/pages/architecture/authorization.mdx
index 06b8b09881a51..41db7ead8f275 100644
--- a/docs/pages/architecture/authorization.mdx
+++ b/docs/pages/architecture/authorization.mdx
@@ -62,7 +62,7 @@ This list is called "role mappings".
 Teleport supports non-interactive users for automation services, e.g. Jenkins or micro-services
 running in your organization.
 
-### Local non-interactive users
+#### Local non-interactive users
 
 Local non-interactive users also have a user entry that maps their name to roles,
 but they do not have credentials stored in the database.
@@ -79,7 +79,7 @@ of non-interactive users:
 ![Certificates for services](../../img/architecture/certs-machine-id@1.8x.svg)
 </Figure>
 
-### External non-interactive users
+#### External non-interactive users
 
 External non-interactive users behave just like local ones, but it is another
 cluster or certificate authority that issues certificates for them.
diff --git a/docs/pages/architecture/session-recording.mdx b/docs/pages/architecture/session-recording.mdx
index 95f948c50cc04..c1f49e4d6b599 100644
--- a/docs/pages/architecture/session-recording.mdx
+++ b/docs/pages/architecture/session-recording.mdx
@@ -10,18 +10,41 @@ configuration options that apply to session recordings.
 
 The content that is captured depends on the type of the session.
 
-- SSH sessions: Teleport captures the entire pseudo-terminal (PTY) output
-  of the session.
-- Kubernetes sessions: Teleport captures the entire PTY output for
-  `kubectl exec` invocations.
-- Desktop sessions: Teleport captures the contents of the desktop screen
-  and any mouse input. Teleport does not capture keystrokes in the remote
-  desktop.
-- App sessions: Teleport captures a stream of `app.session.request`
-  audit events related to application access. The audit events are
-  bucketed into 5-minute time intervals informally referred to as "chunks."
-- Database sessions: Teleport captures a stream of audit events
-  related to the database being accessed.
+### SSH sessions
+
+Teleport captures the entire pseudo-terminal (PTY) output of the session. The
+intention is for session recording to document what a user saw when they ran a
+session.
+
+Note that the design of session recording carries some security risks. Namely,
+users can conceal terminal commands by encoding them (e.g., using `base64`),
+running scripts from disk or the internet, or changing the terminal settings. If
+this presents an issue for your environment, consider using the BPF-based
+[Enhanced Session Recording](../server-access/guides/bpf-session-recording.mdx)
+instead.
+
+### Kubernetes sessions
+
+Teleport captures the entire PTY output for `kubectl exec` invocations.
+
+Kubernetes session recording carries the same security risks as SSH session
+recording.
+
+### Desktop sessions
+
+Teleport captures the contents of the desktop screen and any mouse input.
+Teleport does not capture keystrokes in the remote desktop.
+
+### App sessions
+
+Teleport captures a stream of `app.session.request` audit events related to
+application access. The audit events are bucketed into 5-minute time intervals
+informally referred to as "chunks."
+
+### Database sessions
+
+Teleport captures a stream of audit events related to the database being
+accessed.
 
 ## Session recording configurations
 
@@ -41,7 +64,7 @@ Teleport cluster. It can be configured by setting `session_recording`
 in the `auth_service` section of your `teleport.yaml`, or dynamically via
 the the `session_recording_config` resource. If you need to apply different
 recording configuration to different sets of resources, we recommend setting up
-[Trusted Clusters](/docs/management/admin/trustedclusters/) with their own
+[Trusted Clusters](../management/admin/trustedclusters.mdx) with their own
 recording configurations.
 
 <Admonition type="note">
diff --git a/docs/pages/choose-an-edition/introduction.mdx b/docs/pages/choose-an-edition/introduction.mdx
index 08e95222c77fa..9df77665bd3e8 100644
--- a/docs/pages/choose-an-edition/introduction.mdx
+++ b/docs/pages/choose-an-edition/introduction.mdx
@@ -38,7 +38,7 @@ compliance.
 We provide a free, open source distribution of Teleport that enables you to get
 secure access to databases, Windows desktops, Kubernetes clusters, and more.
 
-[Try out Teleport on a Linux server](../get-started.mdx). If you would like to
+[Try out Teleport on a Linux server](../index.mdx). If you would like to
 take a look at the source, visit the [Teleport GitHub
 repository](https://github.com/gravitational/teleport).
 
diff --git a/docs/pages/choose-an-edition/teleport-cloud/downloads.mdx b/docs/pages/choose-an-edition/teleport-cloud/downloads.mdx
index 329299dcd697c..c3d2d18b97d12 100644
--- a/docs/pages/choose-an-edition/teleport-cloud/downloads.mdx
+++ b/docs/pages/choose-an-edition/teleport-cloud/downloads.mdx
@@ -19,7 +19,14 @@ Binaries include:
 |`teleport`| The Teleport binary that you can run within your private networks to enable access to resources in your infrastructure|
 |`tctl`| A client tool for managing Teleport resources|
 |`tsh`| A client tool for accessing resources within your cluster|
-|`tbot`| A client tool you will use to associate a bot user with a machine identity|
+|`tbot`| The agent for [Teleport's Machine ID](../../machine-id/introduction.mdx)|
+
+<Notice title="macOS installations">
+For macOS, `tsh` comes in the main Teleport package and also in a separate client-only package.
+The client-only package includes a signed variant of `tsh`. Certain functionality, such as Touch ID support,
+only works when `tsh` has been signed. Therefore, if you are installing the main Teleport package on a macOS system,
+we recommend you first install the main Teleport package and then install the client-only package over this.
+</Notice>
 
 Here are the available archives:
 
@@ -27,7 +34,7 @@ Description                        | | | | |
 -----------------------------------|-|-|-|-|
 Linux (Debian/Ubuntu compatible)   | [amd64](https://cdn.teleport.dev/teleport-ent-v(=cloud.version=)-linux-amd64-bin.tar.gz) | [arm64](https://cdn.teleport.dev/teleport-ent-v(=cloud.version=)-linux-arm64-bin.tar.gz) | [armv7](https://cdn.teleport.dev/teleport-ent-v(=cloud.version=)-linux-arm-bin.tar.gz) | [i386](https://cdn.teleport.dev/teleport-ent-v(=cloud.version=)-linux-386-bin.tar.gz) |
 Linux (RHEL/CentOS 7.x compatible) | [amd64](https://cdn.teleport.dev/teleport-ent-v(=cloud.version=)-linux-amd64-centos7-bin.tar.gz) |
-macOS                              | [amd64](https://cdn.teleport.dev/teleport-ent-v(=cloud.version=)-darwin-amd64-bin.tar.gz) |
+macOS                              | [universal amd64/arm64](https://cdn.teleport.dev/teleport-ent-v(=cloud.version=)-darwin-universal-bin.tar.gz) | [amd64](https://cdn.teleport.dev/teleport-ent-v(=cloud.version=)-darwin-amd64-bin.tar.gz) | [arm64](https://cdn.teleport.dev/teleport-v(=cloud.version=)-darwin-arm64-bin.tar.gz) |
 
 ## Teleport packages
 
@@ -41,7 +48,7 @@ Binaries include:
 |`teleport`| The Teleport binary that you can run within your private networks to enable access to resources in your infrastructure|
 |`tctl`| A client tool for managing Teleport resources|
 |`tsh`| A client tool for accessing resources within your cluster|
-|`tbot`| A client tool you will use to associate a bot user with a machine identity|
+|`tbot`| The agent for [Teleport's Machine ID](../../machine-id/introduction.mdx)|
 
 Here are the available archives:
 
@@ -49,47 +56,14 @@ Description                        | | | | |
 -----------------------------------|-|-|-|-|
 Linux Debian Packages              | [amd64](https://cdn.teleport.dev/teleport-ent_(=cloud.version=)_amd64.deb) | [arm64](https://cdn.teleport.dev/teleport-ent_(=cloud.version=)_arm64.deb) | [armv7](https://cdn.teleport.dev/teleport-ent_(=cloud.version=)_arm.deb) | [i386](https://cdn.teleport.dev/teleport-ent_(=cloud.version=)_i386.deb) |
 Linux RPM Packages                 | [amd64](https://cdn.teleport.dev/teleport-ent-(=cloud.version=)-1.x86_64.rpm) | [arm64](https://cdn.teleport.dev/teleport-ent-(=cloud.version=)-1.arm64.rpm) | [armv7](https://cdn.teleport.dev/teleport-ent-(=cloud.version=)-1.arm.rpm) | [i386](https://cdn.teleport.dev/teleport-ent-(=cloud.version=)-1.i386.rpm) |
-macOS Packages                     | [amd64](https://cdn.teleport.dev/teleport-ent-(=cloud.version=).pkg) |
+macOS Packages                     | [universal amd64/arm64](https://cdn.teleport.dev/teleport-ent-(=cloud.version=).pkg) |
 
 ## Teleport package repositories
 
 Teleport currently maintains DEB and RPM package repositories. Follow these
 instructions to add a package repository and install Teleport.
 
-<Tabs>
-    <TabItem label="Debian/Ubuntu (DEB)">
-        ```code
-        # Download Teleport's PGP public key
-        $ sudo curl https://apt.releases.teleport.dev/gpg \
-          -o /usr/share/keyrings/teleport-archive-keyring.asc
-        # Source variables about OS version
-        $ source /etc/os-release
-        # Add the Teleport APT repository for v(=cloud.major_version=). You'll need to update this
-        # file for each major (breaking) release of Teleport.
-        # Note: if using a fork of Debian or Ubuntu you may need to use '$ID_LIKE'
-        # and the codename your distro was forked from instead of '$ID' and '$VERSION_CODENAME'.
-        # Supported versions are listed here: https://github.com/gravitational/teleport/blob/master/build.assets/tooling/cmd/build-apt-repos/main.go#L26
-        $ echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] \
-          https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/v(=cloud.major_version=)" \
-        | sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null
-        $ sudo apt-get update
-        $ sudo apt-get install teleport-ent
-        ```
-    </TabItem>
-    <TabItem label="Amazon Linux 2/RHEL (RPM)">
-        ```code
-        # Source variables about OS version
-        $ source /etc/os-release
-        # Add the Teleport YUM repository for v(=cloud.major_version=). You'll need to update this
-        # file for each major release of Teleport.
-        # Note: if using a fork of RHEL/CentOS or Amazon Linux you may need to use '$ID_LIKE'
-        # and the codename your distro was forked from instead of '$ID'
-        $ sudo yum-config-manager \
-            --add-repo $(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v(=cloud.major_version=)/teleport.repo")
-        $ sudo yum install teleport-ent
-        ```
-    </TabItem>
-</Tabs>
+(!docs/pages/includes/cloud/install-linux-cloud.mdx!)
 
 ## Teleport client-only packages
 
@@ -106,5 +80,5 @@ Here are the available archives:
 
 Description                        | |
 -----------------------------------|-|
-macOS                              | [amd64](https://cdn.teleport.dev/tsh-(=cloud.version=).pkg) |
+macOS                              | [universal amd64/arm64 signed](https://cdn.teleport.dev/tsh-(=cloud.version=).pkg) |
 Windows                            | [amd64](https://cdn.teleport.dev/teleport-v(=cloud.version=)-windows-amd64-bin.zip) |
diff --git a/docs/pages/choose-an-edition/teleport-cloud/faq.mdx b/docs/pages/choose-an-edition/teleport-cloud/faq.mdx
index 019d508d2a1e3..8b752cfc3cb65 100644
--- a/docs/pages/choose-an-edition/teleport-cloud/faq.mdx
+++ b/docs/pages/choose-an-edition/teleport-cloud/faq.mdx
@@ -35,8 +35,7 @@ related information on the [Teleport Trust Portal](https://trust.goteleport.com)
 
 ### How do you store passwords?
 
-Password hashes are generated using
-[Golang's bcrypt](https://pkg.go.dev/golang.org/x/crypto/bcrypt).
+Password hashes are generated using [bcrypt](https://pkg.go.dev/golang.org/x/crypto/bcrypt).
 
 ### Do you encrypt data at rest?
 
@@ -61,9 +60,9 @@ Enterprise Cloud.
 
 We do not have plans to offer support for inbound connection IP allowlists.
 
-We believe mTLS with strong user and [device
-identity](../../access-controls/guides/device-trust.mdx) provides the best
-available security for client authentication.
+We believe mTLS with strong user and [device identity](
+../../access-controls/device-trust/guide.mdx) provides the best available
+security for client authentication.
 
 For customers that require IP-based control for compliance purposes, we do
 support IP Pinning. For more information see `pin_source_ip` in our [Teleport
@@ -77,8 +76,9 @@ S3, are established using encryption provided by AWS, both at rest and in transi
 
 ### How do I add resources to Teleport Enterprise Cloud?
 
-You can connect servers, Kubernetes clusters, databases and applications using
-[reverse tunnels](../../management/join-services-to-your-cluster.mdx).
+You can connect servers, Kubernetes clusters, databases, desktops, and
+applications using [reverse
+tunnels](../../agents/join-services-to-your-cluster.mdx).
 
 There is no need to open any ports on your infrastructure for inbound traffic.
 
@@ -89,7 +89,7 @@ If you plan on connecting more than 10,000 nodes or agents, please contact your
 ### Are dynamic node tokens available?
 
 After [connecting](#how-can-i-access-the-tctl-admin-tool) `tctl` to Teleport Enterprise Cloud, users can generate
-[dynamic tokens](../../management/join-services-to-your-cluster/join-token.mdx):
+[dynamic tokens](../../agents/join-services-to-your-cluster/join-token.mdx):
 
 ```code
 $ tctl nodes add --ttl=5m --roles=node,proxy --token=$(uuid)
@@ -135,8 +135,8 @@ The ability to download recordings for offline viewing will be available in a fu
 
 ### Will Teleport be automatically upgraded with each release?
 
-Teleport Cloud follows the Teleport [Production
-readiness](../../upcoming-releases.mdx) guidelines.
+Teleport Cloud follows the Teleport [Upcoming
+Releases](../../upcoming-releases.mdx) timelines.
 
 - Major version upgrades for customer Auth and Proxy Servers occur after the
   first minor release (for example (=teleport.major_version=).1.0) of Teleport.
@@ -144,6 +144,8 @@ readiness](../../upcoming-releases.mdx) guidelines.
   becoming available.
 - After the first minor release, subsequent minor and patch upgrades typically
   occur within a week.
+- Your Teleport tenant will NOT be automatically upgraded to the next major version if any
+  Teleport agents connected to the cluster are not compatible (> 1 major version behind).
 
 ### Are upgrades times configurable for my Teleport Enterprise Cloud tenant?
 
@@ -299,5 +301,3 @@ address traffic to any individual software instance within the cluster.
 ### How do I set up recovery codes for my account so I don't lose access?
 
 We have a [short step-by-step guide](https://github.com/gravitational/teleport/discussions/12379) on setting up recovery codes.
-
-
diff --git a/docs/pages/choose-an-edition/teleport-cloud/introduction.mdx b/docs/pages/choose-an-edition/teleport-cloud/introduction.mdx
index 9ce2191030607..fde45c015d001 100644
--- a/docs/pages/choose-an-edition/teleport-cloud/introduction.mdx
+++ b/docs/pages/choose-an-edition/teleport-cloud/introduction.mdx
@@ -7,9 +7,10 @@ videoBanner: 1jhKOtBinm4
 Teleport Enterprise Cloud is a managed service to provide access to secure
 infrastructure all over the world without passwords or shared secrets.
 
-When you [sign up for a Teleport Enterprise Cloud account](https://goteleport.com/signup/), you will receive a subdomain of
-`teleport.sh` that is dedicated to your tenant and points to the Teleport Proxy
-Service. 
+When you [sign up for a Teleport Team account](https://goteleport.com/signup/)
+(which you can upgrade to a Teleport Enterprise Cloud account), you will receive
+a subdomain of `teleport.sh` that is dedicated to your tenant and points to the
+Teleport Proxy Service. 
 
 Our Teleport Enterprise Cloud team handles the following tasks for you:
 
diff --git a/docs/pages/choose-an-edition/teleport-enterprise/introduction.mdx b/docs/pages/choose-an-edition/teleport-enterprise/introduction.mdx
index e03695dc77990..d1f30d94db181 100644
--- a/docs/pages/choose-an-edition/teleport-enterprise/introduction.mdx
+++ b/docs/pages/choose-an-edition/teleport-enterprise/introduction.mdx
@@ -22,7 +22,14 @@ The table below gives a quick overview of the benefits of Teleport Enterprise.
   type="tip"
   title="Contact Information"
 >
-  Try Teleport Enterprise for [free in the cloud](https://goteleport.com/signup/) or [contact sales](https://goteleport.com/signup/enterprise/).
+
+  To get started with self-hosted Teleport Enterprise, [contact
+  sales](https://goteleport.com/signup/enterprise/).
+
+  You can also sign up for a [free trial](https://goteleport.com/signup) of
+  Teleport Team, which manages the Auth Service and Proxy Service for you. You
+  can then upgrade your account to Teleport Enterprise Cloud.
+
 </Admonition>
 
 ## SSO
@@ -53,13 +60,6 @@ Moreover, SSO can be used in combination with role-based access control (RBAC)
 to enforce SSH access policies like *"developers must not touch production data"*.
 See the [SSO](../../access-controls/sso.mdx) chapter for more details.
 
-<Admonition
-  type="tip"
-  title="Contact Information"
->
-  Try Teleport Enterprise for [free in the cloud](https://goteleport.com/signup/) or [contact sales](https://goteleport.com/signup/enterprise/).
-</Admonition>
-
 ## FedRAMP/FIPS
 
 With Teleport we have built the foundation to meet FedRAMP requirements for the purposes of accessing infrastructure. This includes support for [FIPS 140-2](https://en.wikipedia.org/wiki/FIPS\_140-2), also known as the Federal Information Processing Standard, which is the US government approved standard for cryptographic modules.
@@ -123,5 +123,5 @@ Unless your organization requires the Enterprise-specific features we outlined
 above, you can use Teleport Enterprise Cloud to achieve secure access to your
 infrastructure without needing to maintain the Auth and Proxy Services. 
 
-[Sign up for a free trial of Teleport Enterprise
-Cloud](https://goteleport.com/signup/).
+[Sign up for a free trial of Teleport Team](https://goteleport.com/signup/),
+which you can upgrade to a Teleport Enterprise Cloud account.
diff --git a/docs/pages/choose-an-edition/teleport-team.mdx b/docs/pages/choose-an-edition/teleport-team.mdx
index 9d25d01b276b7..35f7089976d23 100644
--- a/docs/pages/choose-an-edition/teleport-team.mdx
+++ b/docs/pages/choose-an-edition/teleport-team.mdx
@@ -217,24 +217,15 @@ infrastructure by registering a server with your Teleport Team cluster. From
 here, you can explore more of the documentation to see how to set up secure
 access for your infrastructure.
 
-### Register resources
+To enroll your infrastructure with Teleport, you deploy one or more Teleport
+**agents**, which proxy traffic to resources like servers, databases, Kubernetes
+clusters, cloud provider APIs, and Windows desktops.
 
-Read about how you can register resources in your infrastructure, including:
+You can use Terraform to declare a pool of Teleport agents and configure them to
+proxy your infrastructure. Read [Deploy Teleport Agents with
+Terraform](../agents/deploy-agents-terraform.mdx).
 
-  - [Additional SSH servers](../server-access/introduction.mdx)
-  - [Cloud provider tools and internal web applications](../application-access/introduction.mdx)
-  - [Databases](../database-access/introduction.mdx)
-  - [Kubernetes clusters](../kubernetes-access/introduction.mdx)
-  - [Service accounts](../machine-id/introduction.mdx)
-  - [Windows desktops](../desktop-access/introduction.mdx)
-
-### Connect to your infrastructure
-
-Aside from `tsh` and the Web UI, you can also connect to Teleport with our
-desktop application, [Teleport
-Connect](../connect-your-client/teleport-connect.mdx).
-
-### Subscribe
+## Subscribe
 
 After you finish your free trial, Teleport Team will charge based on usage.
 Check the [pricing page](https://goteleport.com/pricing/) for detailed
diff --git a/docs/pages/connect-your-client/introduction.mdx b/docs/pages/connect-your-client/introduction.mdx
index 0bb8476056230..a0640106c4be4 100644
--- a/docs/pages/connect-your-client/introduction.mdx
+++ b/docs/pages/connect-your-client/introduction.mdx
@@ -17,6 +17,7 @@ Teleport, and includes links to more detailed documentation at the end.
 [downloading](https://goteleport.com/download/) and installing `tsh`, sign in to
 your Teleport cluster:
 
+<ScopedBlock scope={["oss"]}>
 <Tabs>
 <TabItem label="Local user">
 ```code
@@ -33,6 +34,48 @@ Tap any security key
   Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
 ```
 
+</TabItem>
+<TabItem label="GitHub user">
+
+```code
+$ tsh login --proxy=<Var name="teleport.example.com"/> --auth=github
+If browser window does not open automatically, open it by clicking on the link:
+ http://127.0.0.1:49927/1d80e257-ec61-4ed2-9403-784f8d35b2fe
+> Profile URL:        https://teleport.example.com:443
+  Logged in as:       user@example.com
+  Cluster:            example.com
+  Roles:              access
+  Logins:             ubuntu, ec2-user
+  Kubernetes:         enabled
+  Valid until:        2022-11-01 22:37:05 -0500 CDT [valid for 12h0m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
+```
+
+Depending on how Teleport was configured for your network, you may not need
+the additional flags `--auth`. Your administrator should provide the details
+required for your particular use case.
+
+</TabItem>
+</Tabs>
+</ScopedBlock>
+
+<ScopedBlock scope={["enterprise", "cloud"]}>
+<Tabs>
+<TabItem label="Local user">
+```code
+$ tsh login --proxy=<Var name="teleport.example.com" description="Your Teleport Proxy Service or Teleport Cloud tenant address"/> --user=<Var name="user" description="Your Teleport username"/>
+Enter password for Teleport user alice:
+Tap any security key
+> Profile URL:        https://teleport.example.com:443
+  Logged in as:       alice
+  Cluster:            example.com
+  Roles:              access, requester
+  Logins:             ubuntu, ec2-user
+  Kubernetes:         enabled
+  Valid until:        2022-11-01 22:37:05 -0500 CDT [valid for 12h0m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
+```
+
 </TabItem>
 <TabItem label="SAML / OIDC / GitHub user">
 
@@ -43,7 +86,7 @@ If browser window does not open automatically, open it by clicking on the link:
 > Profile URL:        https://teleport.example.com:443
   Logged in as:       user@example.com
   Cluster:            example.com
-  Roles:              access
+  Roles:              access, requester
   Logins:             ubuntu, ec2-user
   Kubernetes:         enabled
   Valid until:        2022-11-01 22:37:05 -0500 CDT [valid for 12h0m0s]
@@ -56,6 +99,7 @@ required for your particular use case.
 
 </TabItem>
 </Tabs>
+</ScopedBlock>
 
 ### Teleport Connect
 
diff --git a/docs/pages/connect-your-client/teleport-connect.mdx b/docs/pages/connect-your-client/teleport-connect.mdx
index 94d1c166d75dc..6acd9b7e8c737 100644
--- a/docs/pages/connect-your-client/teleport-connect.mdx
+++ b/docs/pages/connect-your-client/teleport-connect.mdx
@@ -196,6 +196,9 @@ Below is the list of the supported config properties.
 
 | Property                      | Default                                                                                                              | Description                                                            |
 |-------------------------------|----------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------|
+| `theme`                       | `system`                                                                                                             | Color theme for the app. Available modes: `light`, `dark`, `system`.   |
+| `terminal.fontFamily`         | `Menlo, Monaco, monospace` on macOS<br/>`Consolas, monospace` on Windows<br/>`'Droid Sans Mono', monospace` on Linux | Font family for the terminal.                                          |
+| `terminal.fontSize`           | 15                                                                                                                   | Font size for the terminal.                                            |
 | `usageReporting.enabled`      | `false`                                                                                                              | Enables collecting anonymous usage data (see [Telemetry](#telemetry)). |
 | `keymap.tab1` - `keymap.tab9` | `Command+1` - `Command+9` on macOS <br/> `Ctrl+1` - `Ctrl+9` on Windows<br/>`Alt+1` - `Alt+9` on Linux               | Shortcut to open tab 1–9.                                              |
 | `keymap.closeTab`             | `Command+W` on macOS<br/>`Ctrl+W` on Windows/Linux                                                                   | Shortcut to close a tab.                                               |
@@ -207,8 +210,6 @@ Below is the list of the supported config properties.
 | `keymap.openClusters`         | `Command+E` on macOS<br/>`Ctrl+E` on Windows/Linux                                                                   | Shortcut to open the cluster selector.                                 |
 | `keymap.openProfiles`         | `Command+I` on macOS<br/>`Ctrl+I` on Windows/Linux                                                                   | Shortcut to open the profile selector.                                 |
 | `keymap.openSearchBar`        | `Command+K` on macOS<br/>`Ctrl+K` on Windows/Linux                                                                   | Shortcut to open the search bar.                                       |
-| `terminal.fontFamily`         | `Menlo, Monaco, monospace` on macOS<br/>`Consolas, monospace` on Windows<br/>`'Droid Sans Mono', monospace` on Linux | Font family for the terminal.                                          |
-| `terminal.fontSize`           | 15                                                                                                                   | Font size for the terminal.                                            |
 
 <Admonition
   type="note"
diff --git a/docs/pages/connect-your-client/tsh.mdx b/docs/pages/connect-your-client/tsh.mdx
index 315259f67161a..35930231bf776 100644
--- a/docs/pages/connect-your-client/tsh.mdx
+++ b/docs/pages/connect-your-client/tsh.mdx
@@ -80,9 +80,27 @@ to call [`tsh login`](../reference/cli.mdx#tsh-login) in the beginning.
 
 ## Installing tsh
 
-Follow [these install instructions](../installation.mdx) to obtain the `tsh`
-binary. Ideally, install `tsh` of the same version as the version used in your
-Teleport cluster.
+Follow the instructions below to install the `tsh` binary. 
+
+We recommend installing `tsh` of the same major version as the version used in
+your Teleport cluster. 
+
+To find the version number, either:
+
+- In the Web UI, select your username in the upper right, then click
+  **Help & Support**. You will see the version of your Teleport
+  cluster under **CLUSTER INFORMATION**.
+
+- Use `curl` and `jq`. Replace <Var name="teleport.example.com" />
+  with your Proxy Service address (e.g. `mytenant.teleport.sh` for Teleport
+  Enterprise Cloud):
+  
+  ```code
+  $ curl https://<Var name="teleport.example.com" />/webapi/find | jq '.server_version'
+  "(=teleport.version=)"
+  ```
+
+(!docs/pages/includes/install-tsh.mdx!)
 
 ## User identities
 
@@ -149,7 +167,7 @@ $ tsh login --proxy=mytenant.teleport.sh
 
 | Port | Description |
 | - | - |
-| https_proxy_port | the HTTPS port the proxy host is listening to (defaults to `3080`). |
+| https_proxy_port | the HTTPS port the proxy host is listening to (defaults to `443` and `3080`). |
 
 The login command retrieves a user's certificate and stores it in `~/.tsh`
 directory as well as in the [ssh agent](https://en.wikipedia.org/wiki/Ssh-agent) if there is one running.
@@ -878,5 +896,11 @@ exit
 end of session playback
 ```
 
+## Uninstalling tsh
+
+To remove `tsh` and associated user data see
+[Uninstalling Teleport](../management/admin/uninstall-teleport.mdx).
+
 ## Further reading
 - [CLI Reference](../reference/cli.mdx).
+
diff --git a/docs/pages/core-concepts.mdx b/docs/pages/core-concepts.mdx
index 3ebe6080c6ac8..b6868be61cacd 100644
--- a/docs/pages/core-concepts.mdx
+++ b/docs/pages/core-concepts.mdx
@@ -17,7 +17,7 @@ within your infrastructure, such as Kubernetes clusters and Windows desktops.
 A minimal Teleport cluster consists of the **Teleport Auth Service** and
 **Teleport Proxy Service**. In a demo environment, you can run these two
 services from a single `teleport` process on a [Linux
-host](./get-started.mdx).
+host](./index.mdx).
 
 ### Teleport Auth Service
 
diff --git a/docs/pages/database-access/getting-started.mdx b/docs/pages/database-access/getting-started.mdx
index 360f822c8ac8f..38d5caf3f1e2c 100644
--- a/docs/pages/database-access/getting-started.mdx
+++ b/docs/pages/database-access/getting-started.mdx
@@ -167,9 +167,16 @@ EOF
 
 Create the Teleport user assigned the `db` role we've just created:
 
+<ScopedBlock scope={["oss"]}>
 ```code
 $ tctl users add --roles=access,db alice
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+```code
+$ tctl users add --roles=access,requester,db alice
+```
+</ScopedBlock>
 
 ## Step 4/4. Connect
 
diff --git a/docs/pages/database-access/guides/aws-cassandra-keyspaces.mdx b/docs/pages/database-access/guides/aws-cassandra-keyspaces.mdx
index ee21c7f4640bc..0a860ca91cd40 100644
--- a/docs/pages/database-access/guides/aws-cassandra-keyspaces.mdx
+++ b/docs/pages/database-access/guides/aws-cassandra-keyspaces.mdx
@@ -33,7 +33,6 @@ This guide will help you to:
 - AWS Account with AWS Keyspaces database and permissions to create and attach IAM policies
 - The `cqlsh` Cassandra client installed and added to your system's `PATH` environment variable.
 - A host, e.g., an Amazon EC2 instance, where you will run the Teleport Database Service.
-
 - (!docs/pages/includes/tctl.mdx!)
 
 ## Step 1/5. Set up the Teleport Database Service
diff --git a/docs/pages/database-access/guides/aws-dynamodb.mdx b/docs/pages/database-access/guides/aws-dynamodb.mdx
index 00eaacd981637..0cd6435f0aa8a 100644
--- a/docs/pages/database-access/guides/aws-dynamodb.mdx
+++ b/docs/pages/database-access/guides/aws-dynamodb.mdx
@@ -31,7 +31,6 @@ This guide will help you to:
 - A host, e.g., an EC2 instance, where you will run the Teleport Database Service.
   This guide assumes an EC2 instance when creating and applying IAM roles, and
   must be adjusted accordingly for custom configurations.
-
 - (!docs/pages/includes/tctl.mdx!)
 
 <Admonition type="note" title="Example Access Control">
diff --git a/docs/pages/database-access/guides/aws-opensearch.mdx b/docs/pages/database-access/guides/aws-opensearch.mdx
index 7e1e616794788..321908968f370 100644
--- a/docs/pages/database-access/guides/aws-opensearch.mdx
+++ b/docs/pages/database-access/guides/aws-opensearch.mdx
@@ -177,8 +177,8 @@ Teleport:
 
 - [Configure Teleport to Automatically Enroll EC2 instances (Preview)](../../server-access/guides/ec2-discovery.mdx)
 - [Joining Nodes via AWS IAM
-  Role](../../management/join-services-to-your-cluster/aws-iam.mdx)
-- [Joining Nodes via AWS EC2 Identity Document](../../management/join-services-to-your-cluster/aws-ec2.mdx)
+  Role](../../agents/join-services-to-your-cluster/aws-iam.mdx)
+- [Joining Nodes via AWS EC2 Identity Document](../../agents/join-services-to-your-cluster/aws-ec2.mdx)
 
 </Details>
 
diff --git a/docs/pages/database-access/guides/azure-postgres-mysql.mdx b/docs/pages/database-access/guides/azure-postgres-mysql.mdx
index 17b0830eae930..bb288df65f07c 100644
--- a/docs/pages/database-access/guides/azure-postgres-mysql.mdx
+++ b/docs/pages/database-access/guides/azure-postgres-mysql.mdx
@@ -142,9 +142,9 @@ spec:
 
 | Flag                       | Description                                                                                                                              |
 |----------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
-| <nobr>`--db-users`</nobr>  | List of database usernames the user will be allowed to use when connecting to the databases. A wildcard allows any user.                 |
-| <nobr>`--db-names`</nobr>  | List of logical databases (aka schemas) the user will be allowed to connect to within a database server. A wildcard allows any database. |
-| <nobr>`--db-labels`</nobr> | List of labels assigned to the database the user will be able to access. A wildcard entry allows any database.                           |
+| `--db-users` | List of database usernames the user will be allowed to use when connecting to the databases. A wildcard allows any user.                 |
+| `--db-names` | List of logical databases (aka schemas) the user will be allowed to connect to within a database server. A wildcard allows any database. |
+| `--db-labels` | List of labels assigned to the database the user will be able to access. A wildcard entry allows any database.                           |
 
 Save this file and apply it to your Teleport cluster:
 
diff --git a/docs/pages/database-access/guides/cassandra-self-hosted.mdx b/docs/pages/database-access/guides/cassandra-self-hosted.mdx
index 1988e25321b93..18cb6099d4682 100644
--- a/docs/pages/database-access/guides/cassandra-self-hosted.mdx
+++ b/docs/pages/database-access/guides/cassandra-self-hosted.mdx
@@ -145,7 +145,7 @@ databases:
 <ScopedBlock scope={["oss", "enterprise"]}>
 
   ```code
-  $ tsh login --proxy=teleport.example.com --user=testuser
+  $ tsh login --proxy=teleport.example.com --user=alice
   $ tsh db ls
   # Name      Description       Allowed Users Labels  Connect
   # --------- ----------------- ------------- ------- -------
@@ -156,7 +156,7 @@ databases:
 <ScopedBlock scope={["cloud"]}>
 
   ```code
-  $ tsh login --proxy=mytenant.teleport.sh --user=testuser
+  $ tsh login --proxy=mytenant.teleport.sh --user=alice
   $ tsh db ls
   # Name      Description       Allowed Users Labels  Connect
   # --------- ----------------- ------------- ------- -------
diff --git a/docs/pages/database-access/guides/mongodb-atlas.mdx b/docs/pages/database-access/guides/mongodb-atlas.mdx
index bf401306bfde3..2f0071818ebee 100644
--- a/docs/pages/database-access/guides/mongodb-atlas.mdx
+++ b/docs/pages/database-access/guides/mongodb-atlas.mdx
@@ -7,7 +7,7 @@ videoBanner: mu_ZKTjnFJ8
 In this guide you will:
 
 1. Configure Teleport for accessing your MongoDB Atlas cluster.
-2. Configure self-managed X.509 authentication on your Atlas cluster.
+2. Configure MongoDB Atlas authentication.
 3. Connect to your Atlas cluster via Teleport.
 
 <ScopedBlock scope={["oss", "enterprise"]}>
@@ -183,13 +183,17 @@ You can then use `/tmp/isrgrootx1.pem` as the value of the `db_service.databases
 
 (!docs/pages/includes/database-access/create-user.mdx!)
 
-## Step 3/4. Configure Atlas
+(!docs/pages/includes/database-access/mongodb-required-database-access.mdx!)
 
-### Enable self-managed X.509 authentication
+## Step 3/4. Configure Atlas
 
-Teleport will authenticate with MongoDB Atlas using
-[self-managed X.509 authentication](https://docs.atlas.mongodb.com/security-self-managed-x509/).
+Teleport MongoDB Atlas integration supports two methods of authentication:
+- Self-managed X.509: This method relies on certificates for authentication,
+  with MongoDB Atlas trusting the Teleport certificates.
+- AWS IAM: The authentication is done using AWS credentials fetched by Teleport.
 
+<Tabs>
+<TabItem label="Self-managed X.509">
 First, obtain Teleport CA certificate by running the following `tctl auth sign`
 command against your Teleport cluster:
 
@@ -209,8 +213,9 @@ toggle "Self-managed X.509 Authentication" on:
 Paste the contents of `mongo.cas` file in the Certificate Authority edit box and
 click Save.
 
-### Create MongoDB user
+### Create a MongoDB user
 
+{/*lint ignore messaging*/}
 On the Security / Database Access page add a new database user with Certificate
 authentication method:
 
@@ -225,6 +230,58 @@ certificate with `CN=alice` subject.
   Case matters so make sure to specify Common Name in the username with capital
   letters `CN=`.
 </Admonition>
+</TabItem>
+
+<TabItem label="AWS IAM">
+
+You must provide the Teleport Database Service access to AWS credentials.
+
+(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)
+
+### Create a MongoDB IAM role
+
+Navigate to the [AWS IAM console](https://console.aws.amazon.com/iam/). In the
+navigation pane, choose **Roles** and then choose **Create role**. Next, select
+the "Custom trust policy" type. Edit the trust policy to allow the Teleport
+Database service IAM role to assume this role so that the Teleport can fetch the
+necessary credentials to authenticate to MongoDB:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "Statement1",
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::111111111111:role/teleport-database-access",
+                "Service": "ec2.amazonaws.com"
+            },
+            "Action": "sts:AssumeRole"
+        }
+    ]
+}
+```
+
+Your role won’t require any permission, so you can leave it empty on the
+**Add Permissions** step. Then, choose a name for it and create it. In this
+guide, we will the name `teleport-access`.
+
+### Create a MongoDB User
+
+{/*lint ignore messaging*/}
+On the Security / Database Access page add a new database user with **AWS IAM**
+authentication method, and choose "IAM Role" as the **IAM User type**. Then, fill in
+the AWS ARN field with the ARN of the newly created IAM role. In the **Database
+User Privileges** section, give the user sufficient privileges to access the
+desired database data.
+
+![Create AWS IAM database user](../../../img/database-access/guides/atlas/atlas-add-aws-iam-user.png)
+
+Please note that Teleport does not support authentication using AWS IAM users;
+it exclusively supports authentication using AWS IAM roles.
+</TabItem>
+</Tabs>
 
 ## Step 4/4. Connect
 
@@ -253,6 +310,8 @@ $ tsh db ls
 </TabItem>
 </Tabs>
 
+<Tabs>
+<TabItem label="Self-managed X.509 authentication">
 To retrieve credentials for a database and connect to it:
 
 ```code
@@ -265,6 +324,23 @@ when connecting to the database instance:
 ```code
 $ tsh db connect --db-user=alice mongodb-atlas
 ```
+</TabItem>
+<TabItem label="AWS IAM authentication">
+To retrieve credentials for a database and connect to it, you must provide the
+database username in the `role/<role-name>` format:
+
+```code
+$ tsh db connect --db-user=role/teleport-access mongodb-atlas
+```
+
+Alternatively, you provide the full ARN as the database username when connecting
+to the database instance:
+
+```code
+$ tsh db connect --db-user=arn:aws:iam::111111111111:role/teleport-access mongodb-atlas
+```
+</TabItem>
+</Tabs>
 
 <Admonition type="note" title="Preparing your client environment">
   Either the `mongosh` or `mongo` command-line clients should be available in `PATH` in order to be
@@ -288,3 +364,5 @@ $ tsh db logout
 
 ## Further reading
 - [Which certificate authority signs MongoDB Atlas cluster TLS certificates?](https://docs.atlas.mongodb.com/reference/faq/security/#which-certificate-authority-signs-mongodb-atlas-cluster-tls-certificates-)
+- [Self-managed X.509 authentication](https://docs.atlas.mongodb.com/security-self-managed-x509/)
+- [AWS IAM authentication](https://www.mongodb.com/docs/atlas/security/passwordless-authentication/)
diff --git a/docs/pages/database-access/guides/mongodb-self-hosted.mdx b/docs/pages/database-access/guides/mongodb-self-hosted.mdx
index 371899b0587d2..bf0db20f8134a 100644
--- a/docs/pages/database-access/guides/mongodb-self-hosted.mdx
+++ b/docs/pages/database-access/guides/mongodb-self-hosted.mdx
@@ -79,6 +79,8 @@ $ --uri="mongodb://mongo1.example.com:27017,mongo2.example.com:27017/?replicaSet
 
 (!docs/pages/includes/database-access/create-user.mdx!)
 
+(!docs/pages/includes/database-access/mongodb-required-database-access.mdx!)
+
 ## Step 2/3. Configure MongoDB
 
 ### Create a MongoDB user
diff --git a/docs/pages/database-access/guides/mysql-self-hosted.mdx b/docs/pages/database-access/guides/mysql-self-hosted.mdx
index 12bb81d129fa8..d088c7e774bb9 100644
--- a/docs/pages/database-access/guides/mysql-self-hosted.mdx
+++ b/docs/pages/database-access/guides/mysql-self-hosted.mdx
@@ -164,7 +164,7 @@ databases:
 <ScopedBlock scope={["oss", "enterprise"]}>
 
 ```code
-$ tsh login --proxy=teleport.example.com --user=testuser
+$ tsh login --proxy=teleport.example.com --user=alice
 $ tsh db ls
 # Name          Description   Labels
 # ------------- ------------- --------
@@ -175,7 +175,7 @@ $ tsh db ls
 <ScopedBlock scope={["cloud"]}>
 
 ```code
-$ tsh login --proxy=mytenant.teleport.sh --user=testuser
+$ tsh login --proxy=mytenant.teleport.sh --user=alice
 $ tsh db ls
 # Name          Description   Labels
 # ------------- ------------- --------
diff --git a/docs/pages/database-access/guides/oracle-self-hosted.mdx b/docs/pages/database-access/guides/oracle-self-hosted.mdx
index 1e78196cb6027..82148b432aa0f 100644
--- a/docs/pages/database-access/guides/oracle-self-hosted.mdx
+++ b/docs/pages/database-access/guides/oracle-self-hosted.mdx
@@ -115,7 +115,7 @@ databases:
 
 <ScopedBlock scope={["oss", "enterprise"]}>
 ```code
-$ tsh login --proxy=teleport.example.com --user=testuser
+$ tsh login --proxy=teleport.example.com --user=alice
 $ tsh db ls
 # Name   Description    Allowed Users Labels  Connect
 # ------ -------------- ------------- ------- -------
@@ -124,7 +124,7 @@ $ tsh db ls
 </ScopedBlock>
 <ScopedBlock scope={["cloud"]}>
 ```code
-$ tsh login --proxy=mytenant.teleport.sh --user=testuser
+$ tsh login --proxy=mytenant.teleport.sh --user=alice
 $ tsh db ls
 # Name   Description    Allowed Users Labels  Connect
 # ------ -------------- ------------- ------- -------
diff --git a/docs/pages/database-access/guides/postgres-cloudsql.mdx b/docs/pages/database-access/guides/postgres-cloudsql.mdx
index 73fea24d5013a..b58682d07c1b6 100644
--- a/docs/pages/database-access/guides/postgres-cloudsql.mdx
+++ b/docs/pages/database-access/guides/postgres-cloudsql.mdx
@@ -206,6 +206,7 @@ teleport:
   # because the Database Service always connects to the cluster over a reverse
   # tunnel.
   proxy_server: teleport.example.com:3080
+  auth_token: "/tmp/token"
 db_service:
   enabled: "yes"
   # This section contains definitions of all databases proxied by this
@@ -248,6 +249,7 @@ teleport:
   nodename: test
   # Proxy address to connect to. Use your Teleport Cloud tenant address here.
   proxy_server: mytenant.teleport.sh:443
+  auth_token: "/tmp/token"
 db_service:
   enabled: "yes"
   # This section contains definitions of all databases proxied by this
@@ -308,6 +310,12 @@ earlier.
 See [Authenticating as a service account](https://cloud.google.com/docs/authentication/production)
 in the Google Cloud documentation for more details.
 
+If you are using `systemd` to start `teleport`, then you should edit the service's `EnvironmentFile`
+to include the following env var:
+```code
+$ echo 'GOOGLE_APPLICATION_CREDENTIALS=/path/to/credentials.json' | sudo tee -a /etc/default/teleport
+```
+
 ## Step 7/7. Connect
 
 Once the Database Service has joined the cluster, log in to see the available
diff --git a/docs/pages/database-access/guides/postgres-self-hosted.mdx b/docs/pages/database-access/guides/postgres-self-hosted.mdx
index d9b0b826a083c..50edb728d08c4 100644
--- a/docs/pages/database-access/guides/postgres-self-hosted.mdx
+++ b/docs/pages/database-access/guides/postgres-self-hosted.mdx
@@ -113,7 +113,7 @@ databases:
 <ScopedBlock scope={["oss", "enterprise"]}>
 
 ```code
-$ tsh login --proxy=teleport.example.com --user=testuser
+$ tsh login --proxy=teleport.example.com --user=alice
 $ tsh db ls
 # Name             Description        Labels
 # ---------------- ------------------ --------
@@ -124,7 +124,7 @@ $ tsh db ls
 <ScopedBlock scope={["cloud"]}>
 
 ```code
-$ tsh login --proxy=mytenant.teleport.sh --user=testuser
+$ tsh login --proxy=mytenant.teleport.sh --user=alice
 $ tsh db ls
 # Name             Description        Labels
 # ---------------- ------------------ --------
diff --git a/docs/pages/database-access/guides/redis-cluster.mdx b/docs/pages/database-access/guides/redis-cluster.mdx
index bb643d89137ed..c328a8343de13 100644
--- a/docs/pages/database-access/guides/redis-cluster.mdx
+++ b/docs/pages/database-access/guides/redis-cluster.mdx
@@ -195,16 +195,16 @@ returns the <nobr>`ERR Teleport: command not supported`</nobr> error.
 Teleport conducts additional processing on the following commands before 
 communicating with Redis Cluster:
 
-| Command                      | Description                                                                                                                                                                                                  |
-|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `DBSIZE`                     | Sends the query to all nodes and returns the number of keys in the whole cluster.                                                                                                                            |
-| `KEYS`                       | Sends the query to all nodes and returns a list of all keys in the whole cluster.                                                                                                                            |
-| `MGET`                       | Translates the commands to multiple `GET`s and sends them to multiple nodes. Result is merged in Teleport and returned back to the client. If Teleport fails to fetch at least one key an error is returned. |
-| `FLUSHDB`                    | Sends the query to all nodes.                                                                                                                                                                                |
-| `FLUSHALL`                   | Works the same as `FLUSHDB`.                                                                                                                                                                                 |
-| <nobr>`SCRIPT EXISTS`</nobr> | Sends the query to all nodes. `1` is returned only if script exists on all nodes.                                                                                                                            |
-| <nobr>`SCRIPT LOAD`</nobr>   | Sends the script to all nodes.                                                                                                                                                                               |
-| <nobr>`SCRIPT FLUSH`</nobr>  | Sends the query to all nodes. `ASYNC` parameter is ignored.                                                                                                                                                  |
+| Command         | Description                                                                        |
+|-----------------|------------------------------------------------------------------------------------|
+| `DBSIZE`        | Sends the query to all nodes and returns the number of keys in the whole cluster.  |
+| `KEYS`          | Sends the query to all nodes and returns a list of all keys in the whole cluster.  |
+| `MGET`          | Translates the commands to multiple `GET`s and sends them to multiple nodes. Result is merged in Teleport and returned back to the client. If Teleport fails to fetch at least one key an error is returned. |
+| `FLUSHDB`       | Sends the query to all nodes.                                                      |
+| `FLUSHALL`      | Works the same as `FLUSHDB`.                                                       |
+| `SCRIPT EXISTS` | Sends the query to all nodes. `1` is returned only if script exists on all nodes.  |
+| `SCRIPT LOAD`   | Sends the script to all nodes.                                                     |
+| `SCRIPT FLUSH`  | Sends the query to all nodes. `ASYNC` parameter is ignored.                        |
 
 ## Next steps
 
diff --git a/docs/pages/deploy-a-cluster/deployments/aws-terraform.mdx b/docs/pages/deploy-a-cluster/deployments/aws-terraform.mdx
index 4ad11b3098b28..54bfd380b6378 100644
--- a/docs/pages/deploy-a-cluster/deployments/aws-terraform.mdx
+++ b/docs/pages/deploy-a-cluster/deployments/aws-terraform.mdx
@@ -487,6 +487,7 @@ $ ssh -i ${TF_VAR_key_name}.pem -o ProxyCommand="ssh -i ${TF_VAR_key_name}.pem -
 
 4 - Use the `tctl` command to create an admin user for Teleport:
 
+<ScopedBlock scope={["oss"]}>
 ```code
 # From EC2 host
 $ sudo tctl users add teleport-admin --roles=editor,access --logins=root
@@ -494,8 +495,20 @@ $ sudo tctl users add teleport-admin --roles=editor,access --logins=root
 # https://teleport.example.com:443/web/newuser/6489ae886babf4232826076279bcb2fb
 
 # NOTE: Make sure teleport.example.com:443 points at a Teleport proxy which users can access.
-# When the user 'teleport-admin' activates their account, they will be assigned roles [admin]
+# When the user 'teleport-admin' activates their account, they will be assigned roles [editor, access]
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+```code
+# From EC2 host
+$ sudo tctl users add teleport-admin --roles=editor,access,reviewer --logins=root
+# Signup token has been created and is valid for 1 hours. Share this URL with the user:
+# https://teleport.example.com:443/web/newuser/6489ae886babf4232826076279bcb2fb
+
+# NOTE: Make sure teleport.example.com:443 points at a Teleport proxy which users can access.
+# When the user 'teleport-admin' activates their account, they will be assigned roles [editor, access, reviewer]
+```
+</ScopedBlock>
 
 5 - Click the link to launch the Teleport web UI and finish setting up your user. You will need to scan the QR
 code with an TOTP-compatible app like Google Authenticator or Authy. You will also set a password for the
@@ -511,6 +524,7 @@ You can [download the Teleport package containing the `tsh` client from here](ht
 
 - the client is the same for both OSS and Enterprise versions of Teleport.
 
+<ScopedBlock scope={["oss"]}>
 ```code
 $ tsh login --proxy=${TF_VAR_route53_domain} --user=teleport-admin
 # Enter password for Teleport user teleport-admin:
@@ -532,6 +546,30 @@ $ tsh ls
 $ tsh ssh root@ip-172-31-11-69-ec2-internal
 # [root@ip-172-31-11-69 ~]#
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+```code
+$ tsh login --proxy=${TF_VAR_route53_domain} --user=teleport-admin
+# Enter password for Teleport user teleport-admin:
+# Enter your OTP token:
+# 567989
+# > Profile URL:  https://teleport.example.com:443
+#  Logged in as: teleport-admin
+#  Cluster:      example-cluster
+#  Roles:        editor,access,reviewer
+#  Logins:       root
+#  Valid until:  2020-03-06 22:07:11 -0400 AST [valid for 12h0m0s]
+#  Extensions:   permit-agent-forwarding, permit-port-forwarding, permit-pty
+
+$ tsh ls
+# Node Name                    Address           Labels
+# ---------------------------- ----------------- ------
+# ip-172-31-11-69-ec2-internal 172.31.11.69:3022
+
+$ tsh ssh root@ip-172-31-11-69-ec2-internal
+# [root@ip-172-31-11-69 ~]#
+```
+</ScopedBlock>
 
 ## Restarting/checking Teleport services
 
@@ -730,7 +768,7 @@ To add new nodes/EC2 servers that you can "SSH into" you'll need to:
 - [Run Teleport - we recommend using systemd](../../management/admin/daemon.mdx)
 - [Set the correct settings in /etc/teleport.yaml](../../reference/config.mdx)
 - [Add Nodes to the Teleport
-  cluster](../../management/join-services-to-your-cluster.mdx)
+  cluster](../../agents/join-services-to-your-cluster.mdx)
 
 ### Getting the CA pin hash
 
@@ -752,7 +790,7 @@ $ aws ssm get-parameter --region ${TF_VAR_region} --name "/teleport/${TF_VAR_clu
 # 992a9725-0a64-428d-8e5e-308e6877743d
 ```
 
-You can also generate a Node join token using `tctl tokens add --type=node` [as detailed here in our admin guide](../../management/join-services-to-your-cluster/join-token.mdx).
+You can also generate a Node join token using `tctl tokens add --type=node` [as detailed here in our admin guide](../../agents/join-services-to-your-cluster/join-token.mdx).
 
 ### Joining Nodes via the Teleport Auth Service
 
@@ -773,7 +811,7 @@ auth_server: example-cluster-auth-c5b0fc2764ee015b.elb.us-east-1.amazonaws.com:3
 ### Joining Nodes via Teleport IoT/Node tunneling
 
 To join Teleport Nodes from outside the same VPC, you will either need to investigate VPC peering/gateways (out of scope
-for this document) or join your nodes using [Teleport's node tunneling](../../management/join-services-to-your-cluster/join-token.mdx) functionality.
+for this document) or join your nodes using [Teleport's node tunneling](../../agents/join-services-to-your-cluster/join-token.mdx) functionality.
 
 With this method, you can join the nodes using the public facing proxy address - `teleport.example.com:443` for our
 example.
diff --git a/docs/pages/deploy-a-cluster/helm-deployments/aws.mdx b/docs/pages/deploy-a-cluster/helm-deployments/aws.mdx
index 88cbf780cb040..d80df9a170839 100644
--- a/docs/pages/deploy-a-cluster/helm-deployments/aws.mdx
+++ b/docs/pages/deploy-a-cluster/helm-deployments/aws.mdx
@@ -3,8 +3,7 @@ title: Running an HA Teleport cluster using AWS, EKS, and Helm
 description: Install and configure an HA Teleport cluster using an AWS EKS cluster
 ---
 
-In this guide, we'll go through how to set up a High Availability Teleport cluster with multiple replicas in Kubernetes
-using Teleport Helm charts and AWS products (DynamoDB and S3).
+In this guide, we'll use Teleport Helm charts to set up a high-availability Teleport cluster that runs on AWS EKS.
 
 <Admonition type="tip" title="Have an existing Teleport cluster?">
 If you are already running Teleport on another platform, you can use your
@@ -19,23 +18,18 @@ cluster to Teleport.
 
 (!docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx!)
 
-## Step 1/7. Install Helm
-
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
-
-## Step 2/7. Add the Teleport Helm chart repository
+## Step 1/6. Add the Teleport Helm chart repository
 
 (!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
 
-## Step 3/7. Set up AWS IAM configuration
+## Step 2/6. Set up AWS IAM configuration
 
 For Teleport to be able to manage the DynamoDB tables, indexes, and the S3
 storage bucket it needs, you'll need to configure AWS IAM policies to allow
 access.
 
 <Admonition type="note">
-  These IAM policies should be added to your AWS account, then granted to the instance role associated with the
-  EKS nodegroups which are running your Kubernetes nodes.
+  Add these IAM policies to your AWS account and then grant it to the role associated with your EKS node group(s).
 </Admonition>
 
 ### DynamoDB IAM policy
@@ -46,7 +40,7 @@ access.
 
 (!docs/pages/includes/s3-iam-policy.mdx!)
 
-## Step 4/7. Configure TLS certificates for Teleport
+## Step 3/6. Configure TLS certificates for Teleport
 
 The `teleport-cluster` chart deploys a Kubernetes `LoadBalancer` to handle incoming connections to the Teleport Proxy Service.
 
@@ -261,7 +255,7 @@ Edit your `values.yaml` file to refer to the name of your secret:
 </TabItem>
 </Tabs>
 
-## Step 5/7. Set values to configure the cluster
+## Step 4/6. Set values to configure the cluster
 
 <ScopedBlock scope="enterprise">
 
@@ -430,7 +424,7 @@ replicaset.apps/teleport-auth-57989d4cbd   2         2         2       22h
 replicaset.apps/teleport-proxy-c6bf55cfc   2         2         2       22h
 ```
 
-## Step 6/7. Set up DNS
+## Step 5/6. Set up DNS
 
 You'll need to set up a DNS `A` record for `teleport.example.com`. In our example, this record is an alias to an ELB.
 
@@ -498,11 +492,12 @@ $ aws route53 get-change --id "${CHANGEID?}" | jq '.ChangeInfo.Status'
 # "INSYNC"
 ```
 
-## Step 7/7. Create a Teleport user
+## Step 6/6. Create a Teleport user
 
 Create a user to be able to log into Teleport. This needs to be done on the Teleport auth server,
 so we can run the command using `kubectl`:
 
+<ScopedBlock scope={["oss"]}>
 ```code
 $ kubectl --namespace teleport exec deploy/teleport-auth -- tctl users add test --roles=access,editor
 
@@ -511,6 +506,17 @@ https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
 
 NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+```code
+$ kubectl --namespace teleport exec deploy/teleport-auth -- tctl users add test --roles=access,editor,reviewer
+
+User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
+
+NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
+```
+</ScopedBlock>
 
 Load the user creation link to create a password and set up 2-factor authentication for the Teleport user via the web UI.
 
@@ -621,4 +627,4 @@ users and setting up RBAC.
 
 See the [high availability section of our Helm chart reference](../../reference/helm-reference/teleport-cluster.mdx#highavailability) for more details on high availability.
 
-Read the [`cert-manager` documentation](https://cert-manager.io/docs/).
+Read the [`cert-manager` documentation](https://cert-manager.io/docs/).
\ No newline at end of file
diff --git a/docs/pages/deploy-a-cluster/helm-deployments/custom.mdx b/docs/pages/deploy-a-cluster/helm-deployments/custom.mdx
index 8838d16f0cd7e..11ffab03db172 100644
--- a/docs/pages/deploy-a-cluster/helm-deployments/custom.mdx
+++ b/docs/pages/deploy-a-cluster/helm-deployments/custom.mdx
@@ -28,15 +28,11 @@ of this page to choose the correct version.
 
 (!docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx!)
 
-## Step 1/4. Install Helm
-
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
-
-## Step 2/4. Add the Teleport Helm chart repository
+## Step 1/3. Add the Teleport Helm chart repository
 
 (!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
 
-## Step 3/4. Setting up a Teleport cluster with Helm using a custom config
+## Step 2/3. Setting up a Teleport cluster with Helm using a custom config
 
 `teleport-cluster` deploys two sets of pods: one for the Proxy Service and one for the Auth Service. You can provide two configurations, one for each pod type.
 
@@ -208,12 +204,13 @@ replicaset.apps/teleport-auth-57989d4cbd   1         1         1       22h
 replicaset.apps/teleport-proxy-c6bf55cfc   2         2         2       22h
 ```
 
-## Step 4/4. Create a Teleport user (optional)
+## Step 3/3. Create a Teleport user (optional)
 
 If you're not migrating an existing Teleport cluster, you'll need to create a
 user to be able to log into Teleport. This needs to be done on the Teleport
 auth server, so we can run the command using `kubectl`:
 
+<ScopedBlock scope={["oss"]}>
 ```code
 $ kubectl --namespace teleport exec deployment/teleport-auth -- tctl users add test --roles=access,editor
 
@@ -222,6 +219,17 @@ https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
 
 NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+```code
+$ kubectl --namespace teleport exec deployment/teleport-auth -- tctl users add test --roles=access,editor,reviewer
+
+User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
+
+NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
+```
+</ScopedBlock>
 
 <Admonition type="note">
 If you didn't set up DNS for your hostname earlier, remember to replace
diff --git a/docs/pages/deploy-a-cluster/helm-deployments/digitalocean.mdx b/docs/pages/deploy-a-cluster/helm-deployments/digitalocean.mdx
index 471c76fa40cae..3803136b9ed4e 100644
--- a/docs/pages/deploy-a-cluster/helm-deployments/digitalocean.mdx
+++ b/docs/pages/deploy-a-cluster/helm-deployments/digitalocean.mdx
@@ -123,6 +123,7 @@ Once you get the value for the external IP (it may take a few minutes for this f
 ## Step 3/4. Create and set up Teleport user
 Now we create a Teleport user by executing the `tctl` command with `kubectl`.
 
+<ScopedBlock scope={["oss"]}>
 ```code
 $ kubectl --namespace teleport-cluster exec deployment/teleport-cluster-auth -- tctl users add tadmin --roles=access,editor --logins=ubuntu
 
@@ -131,6 +132,17 @@ https://tele.example.com:443/web/invite/<invite-token>
 
 NOTE: Make sure tele.example.com:443 points at a Teleport proxy which users can access.
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+```code
+$ kubectl --namespace teleport-cluster exec deployment/teleport-cluster-auth -- tctl users add tadmin --roles=access,editor,reviewer --logins=ubuntu
+
+User "tadmin" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://tele.example.com:443/web/invite/<invite-token>
+
+NOTE: Make sure tele.example.com:443 points at a Teleport proxy which users can access.
+```
+</ScopedBlock>
 
 Copy the link shown after executing the above command and open the link in a web browser to complete the user registration process (the link is `https://tele.example.com:443/web/invite/<invite-token>` in the above case).
 <Figure align="left" bordered caption="Set up user">
@@ -201,6 +213,7 @@ $ export KUBECONFIG=${HOME?}/teleport-kubeconfig.yaml
 
 </Admonition>
 
+<ScopedBlock scope={["oss"]}>
 ```code 
 $ tsh login --proxy=tele.example.com:443 --auth=local --user=tadmin
 Enter password for Teleport user tadmin:
@@ -215,6 +228,23 @@ Enter your OTP token:
   Valid until:        2021-10-27 06:37:15 +0000 UTC [valid for 12h0m0s]
   Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+```code 
+$ tsh login --proxy=tele.example.com:443 --auth=local --user=tadmin
+Enter password for Teleport user tadmin:
+Enter your OTP token:
+540255
+> Profile URL:        https://tele.example.com:443
+  Logged in as:       tadmin
+  Cluster:            tele.example.com
+  Roles:              access, editor, reviewer, member
+  Logins:             ubuntu
+  Kubernetes:         enabled
+  Valid until:        2021-10-27 06:37:15 +0000 UTC [valid for 12h0m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+</ScopedBlock>
 
 ### Select the Kubernetes cluster
 
diff --git a/docs/pages/deploy-a-cluster/helm-deployments/gcp.mdx b/docs/pages/deploy-a-cluster/helm-deployments/gcp.mdx
index 5415b356406d1..5ddf416553f04 100644
--- a/docs/pages/deploy-a-cluster/helm-deployments/gcp.mdx
+++ b/docs/pages/deploy-a-cluster/helm-deployments/gcp.mdx
@@ -17,11 +17,7 @@ cluster to Teleport.
 
 (!docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx!)
 
-## Step 1/7. Install Helm
-
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
-
-## Step 2/7. Add the Teleport Helm chart repository
+## Step 1/6. Add the Teleport Helm chart repository
 
 (!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
 
@@ -32,7 +28,7 @@ cluster to Teleport.
   The steps below apply to Google Cloud Google Kubernetes Engine (GKE) Standard deployments.
 </Admonition>
 
-## Step 3/7. Google Cloud IAM configuration
+## Step 2/6. Google Cloud IAM configuration
 
 For Teleport to be able to create the Firestore collections, indexes, and the Google Cloud Storage bucket it needs,
 you'll need to configure a Google Cloud service account with permissions to use these services.
@@ -207,7 +203,7 @@ secret/teleport-gcp-credentials created
  The credentials file stored in any secret used must have the key name `gcp-credentials.json`.
 </Admonition>
 
-## Step 4/7. Install and configure cert-manager
+## Step 3/6. Install and configure cert-manager
 
 Reference the [cert-manager docs](https://cert-manager.io/docs/).
 
@@ -275,7 +271,7 @@ After you have created the `Issuer` and updated the values, add it to your clust
 $ kubectl --namespace teleport create -f gcp-issuer.yaml
 ```
 
-## Step 5/7. Set values to configure the cluster
+## Step 4/6. Set values to configure the cluster
 
 <Details title="License Secret" scopeOnly={false} scope={"enterprise"} opened={true}>
 
@@ -388,7 +384,7 @@ replicaset.apps/teleport-auth-57989d4cbd   2         2         2       22h
 replicaset.apps/teleport-proxy-c6bf55cfc   2         2         2       22h
 ```
 
-## Step 6/7. Set up DNS
+## Step 5/6. Set up DNS
 
 You'll need to set up a DNS `A` record for `teleport.example.com`.
 
@@ -414,19 +410,31 @@ $ gcloud dns record-sets transaction describe --zone="${MYZONE?}"
 $ gcloud dns record-sets transaction execute --zone="${MYZONE?}"
 ```
 
-## Step 7/7. Create a Teleport user
+## Step 6/6. Create a Teleport user
 
 Create a user to be able to log into Teleport. This needs to be done on the Teleport auth server,
 so we can run the command using `kubectl`:
 
+<ScopedBlock scope={["oss"]}>
+```code
+$ kubectl --namespace teleport exec deploy/teleport-auth -- tctl users add test --roles=access,editor
+
+User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
+
+NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
+```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
 ```code
-$ kubectl --namespace teleport exec deployment/teleport-auth -- tctl users add test --roles=access,editor
+$ kubectl --namespace teleport exec deploy/teleport-auth -- tctl users add test --roles=access,editor,reviewer
 
 User "test" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
 https://teleport.example.com:443/web/invite/91cfbd08bc89122275006e48b516cc68
 
-NOTE: Make sure teleport.example.com:443 points at a Teleport proxy which users can access.
+NOTE: Make sure teleport.example.com:443 points at a Teleport proxy that users can access.
 ```
+</ScopedBlock>
 
 Load the user creation link to create a password and set up 2-factor authentication for the Teleport user via the web UI.
 
diff --git a/docs/pages/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx b/docs/pages/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx
index ecc9a4a67c787..03ba38243d212 100644
--- a/docs/pages/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx
+++ b/docs/pages/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx
@@ -226,9 +226,9 @@ Obtain the address of your load balancer by following the instructions below.
 Get information about the Proxy Service load balancer:
 
 ```code
-$ kubectl get services/teleport-cluster-proxy
-NAME                    TYPE           CLUSTER-IP   EXTERNAL-IP      PORT(S)                        AGE
-teleport-cluster-proxy  LoadBalancer   10.4.4.73    192.0.2.0        443:31204/TCP                  89s
+$ kubectl get services/teleport-cluster
+NAME              TYPE           CLUSTER-IP   EXTERNAL-IP      PORT(S)                        AGE
+teleport-cluster  LoadBalancer   10.4.4.73    192.0.2.0        443:31204/TCP                  89s
 ```
 
 The `teleport-cluster` service directs traffic to the Teleport Proxy Service.
diff --git a/docs/pages/deploy-a-cluster/high-availability.mdx b/docs/pages/deploy-a-cluster/high-availability.mdx
index 7e83ce50cb6a7..fb82f05e7998e 100644
--- a/docs/pages/deploy-a-cluster/high-availability.mdx
+++ b/docs/pages/deploy-a-cluster/high-availability.mdx
@@ -161,7 +161,7 @@ These ports are required:
 
 | Load Balancer Port | Proxy Service Port | Description |
 | - | - | - |
-| <nobr>`3023`</nobr> | <nobr>`3023`</nobr> | SSH port for clients connect to. |
+| `3023` | `3023` | SSH port for clients connect to. |
 | `3024` | `3024` | SSH port used to create reverse SSH tunnels from behind-firewall environments. |
 | `443` | `3080` | HTTPS connections to authenticate `tsh` users into the cluster. The same connection is used to serve a Web UI. |
 
@@ -183,7 +183,7 @@ services:
 The Auth Service load balancer must forward traffic to the Auth Service's gRPC
 port. In this guide, we are assuming that you have configured the Auth Service
 load balancer to forward traffic from port `3025` to port `3025` on an available
-Auth Service instance. 
+Auth Service instance.
 
 ## Cluster state backend
 
@@ -497,7 +497,7 @@ Ensure that, on each Auth Service instance, the following ports are open:
 
 | Port | Description |
 | - | - |
-| <nobr>`3025`</nobr> | gRPC port to open to Proxy Service instances.|
+| `3025` | gRPC port to open to Proxy Service instances.|
 
 #### License file
 
@@ -507,7 +507,7 @@ and make it available to your Teleport Auth Service instances.
 (!docs/pages/includes//enterprise/obtainlicense.mdx!)
 
 The license file must be available to each Teleport Auth Service instance at
-`/var/lib/teleport/license.pem`. 
+`/var/lib/teleport/license.pem`.
 
 #### Configuration
 
@@ -516,9 +516,9 @@ instances at `/etc/teleport.yaml`. We will explain the required configuration
 fields for a high-availability Teleport deployment below. These are the minimum
 requirements, and when planning your high-availability deployment, you will want
 to follow a more specific [deployment guide](introduction.mdx) for your
-environment. 
+environment.
 
-#### `storage` 
+#### `storage`
 
 The first configuration section to write is the `storage` section, which
 configures the cluster state backend and session recording backend for the Auth
diff --git a/docs/pages/desktop-access/active-directory-manual.mdx b/docs/pages/desktop-access/active-directory-manual.mdx
index 967658f64d6e5..7c0b8fa998473 100644
--- a/docs/pages/desktop-access/active-directory-manual.mdx
+++ b/docs/pages/desktop-access/active-directory-manual.mdx
@@ -193,7 +193,7 @@ certificate-based smart card authentication, and ensuring RDP is enabled.
 
 The following step requires an existing cluster. If you don't already have a
 Teleport cluster up and running, see our general [Getting
-Started](../get-started.mdx) guide to set up a demo cluster.
+Started](../index.mdx) guide to set up a demo cluster.
 
 <Admonition type="note" title="User CA Rotation">
 These steps will need to be repeated if Teleport's user certificate authority is rotated.
@@ -204,7 +204,7 @@ machine where you can manage your group policy, assigning <Var name="proxy" />
 to the address of your Teleport Proxy Service:
 
 ```code
-$ curl 'https://<Var name="proxy"/>/webapi/auth/export?type=windows' > user-ca.cer
+$ curl -o user-ca.cer https://<Var name="proxy"/>/webapi/auth/export?type=windows
 ```
 
 <Admonition type="note" title="Take note of the location">
diff --git a/docs/pages/desktop-access/directory-sharing.mdx b/docs/pages/desktop-access/directory-sharing.mdx
index 72d57016b448c..b434fd38d2843 100644
--- a/docs/pages/desktop-access/directory-sharing.mdx
+++ b/docs/pages/desktop-access/directory-sharing.mdx
@@ -27,6 +27,7 @@ after the session ends.
   your cluster. If you have not yet configured Desktop Access, read [Getting
   Started with Desktop Access](./getting-started.mdx) before beginning this
   guide.
+
 - A browser on your local machine that supports the File System Access API,
   which Teleport uses for Directory Sharing. We support the latest versions of
   Chromium-based browsers like Google Chrome, Brave, and Microsoft Edge.
diff --git a/docs/pages/desktop-access/getting-started.mdx b/docs/pages/desktop-access/getting-started.mdx
index 2189757bfa025..db843155794a5 100644
--- a/docs/pages/desktop-access/getting-started.mdx
+++ b/docs/pages/desktop-access/getting-started.mdx
@@ -50,22 +50,9 @@ Export the Teleport user certificate authority by running the following from
 `cmd.exe` on your Windows system:
 
 ```code
-$ curl -o teleport.cer 'https://teleport-proxy.example.com:443/webapi/auth/export?type=windows'
+$ curl -o teleport.cer https://teleport-proxy.example.com/webapi/auth/export?type=windows
 ```
 
-<Admonition type="warning" title="PowerShell">
-Be sure to run the above command in `cmd.exe`. In PowerShell, `curl` is an alias for
-[`Invoke-WebRequest`](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.3)
-which has different semantics.
-
-If you must use PowerShell, remove the alias before running curl with the
-following command:
-
-```
-> Remove-Item alias:curl
-```
-</Admonition>
-
 ### Install the Teleport service for Windows
 
 From the Windows system, download the [Teleport Windows Auth
diff --git a/docs/pages/desktop-access/reference/sessions.mdx b/docs/pages/desktop-access/reference/sessions.mdx
index 7b2dbb348f967..c73af58ae628a 100644
--- a/docs/pages/desktop-access/reference/sessions.mdx
+++ b/docs/pages/desktop-access/reference/sessions.mdx
@@ -15,9 +15,8 @@ To disable session recording at the cluster level, edit your `teleport.yaml`
 configuration file.
 
 ```yaml
-teleport:
-  auth_service:
-    session_recording: off
+auth_service:
+  session_recording: off
 ```
 
 <Admonition type="warning">
@@ -59,9 +58,9 @@ for all possible settings in the `record_session` section.
 
 ## Playback
 
-Recorded sessions can be viewed in the *Session Recordings* page. Desktop
-recordings show a desktop icon in the first column to distinguish them from
-SSH recordings.
+Recorded sessions can be viewed in the *Session Recordings* page under the 
+*Activity* section in the *Management* area. Desktop recordings show a
+desktop icon in the first column to distinguish them from SSH recordings.
 
 ![Desktop Session Recording](../../../img/desktop-access/session-recording@2x.png)
 
diff --git a/docs/pages/desktop-access/troubleshooting.mdx b/docs/pages/desktop-access/troubleshooting.mdx
index 7db9fb8522e8d..ac0fd9502290b 100644
--- a/docs/pages/desktop-access/troubleshooting.mdx
+++ b/docs/pages/desktop-access/troubleshooting.mdx
@@ -59,7 +59,7 @@ Teleport CA was rotated since the last import, you will have to fetch the
 new CA using the following command, assigning <Var name="proxy" /> to the address of your Teleport Proxy Service:
 
 ```code
-$ curl 'https://<Var name="proxy"/>/webapi/auth/export?type=windows' > user-ca.cer
+$ curl -o user-ca.cer https://<Var name="proxy"/>/webapi/auth/export?type=windows
 ```
 
 If that doesn't help, log into the target host directly, open PowerShell and
diff --git a/docs/pages/faq.mdx b/docs/pages/faq.mdx
index 3ccdc3d451ca5..a8b70da1fab24 100644
--- a/docs/pages/faq.mdx
+++ b/docs/pages/faq.mdx
@@ -13,29 +13,18 @@ the stability of Teleport from a security perspective.
 
 ## Can Teleport be deployed in agentless mode?
 
-Yes.
+Yes. All Teleport services support agentless mode, where the service proxies
+traffic to an upstream infrastructure resource not available on `localhost`.
 
 With Teleport in agentless mode, you can easily control access to SSH servers,
-Kubernetes clusters, desktops, databases, and internal applications without running any
-additional software on your servers. Agentless mode supports session recordings
-and audit logs for deep understanding into user behavior.
-
-For capabilities such as kernel-level logging and user provisioning,
-we recommend Teleport as a drop in replacement for OpenSSH. Since Teleport
-replaces the OpenSSH agent while preserving OpenSSH's functionality, you get
-more functionality without a net addition of an agent on your system.
-
-Here are details about running each of Teleport's resource services in agentless
-mode. All resource services except for the Node/SSH Service act as proxies for
-client traffic:
-
-|Service|Supports agent mode|Supports agentless mode|Notes|
-|---|---|---|---|
-|[Application Service](./application-access/introduction.mdx)|&#10004;|&#10004;|Proxies HTTP requests to a user-configured list of applications, which can run on the same host as the `teleport` daemon or at a remote endpoint.|
-|[Database Service](./database-access/introduction.mdx)|&#10004;|&#10004;|Proxies database-specific protocol traffic to a user-configured list of databases, which can run on the same host as the `teleport` daemon or at a remote endpoint.|
-|[Kubernetes Service](./kubernetes-access/introduction.mdx)|&#10006;|&#10004;|Proxies client traffic to the API server of a registered Kubernetes cluster.|
-|[Node/SSH Service](./server-access/introduction.mdx)|&#10004;|&#10004;|You can configure OpenSSH clients and servers to trust Teleport's CA. See our [OpenSSH guide](./server-access/guides/openssh.mdx).<br/><br/>For full functionality, you can run the Node Service, which implements SSH, on each server in your infrastructure.|
-|[Windows Desktop Service](./desktop-access/introduction.mdx)|&#10006;|&#10004;|Proxies RDP traffic from client browsers to remote Windows servers.|
+Kubernetes clusters, desktops, databases, and internal applications without
+running any additional software on your servers. Agentless mode supports session
+recordings and audit logs for deep understanding into user behavior.
+
+For capabilities such as kernel-level logging and user provisioning, we
+recommend Teleport as a drop in replacement for OpenSSH. Since Teleport replaces
+the OpenSSH agent while preserving OpenSSH's functionality, you get more
+functionality without a net addition of an agent on your system.
 
 ## Can I use OpenSSH with a Teleport cluster?
 
@@ -54,7 +43,7 @@ Yes. When running a Teleport agent, use the `--auth-server` flag to point to the
 Proxy Service address (this would be `public_addr` and `web_listen_addr` in your
 file configuration). For more information, see
 [Adding Nodes to the
-Cluster](./management/join-services-to-your-cluster/join-token.mdx).
+Cluster](./agents/join-services-to-your-cluster/join-token.mdx).
 
 ## Can Nodes use a single port for reverse tunnels?
 
@@ -63,6 +52,12 @@ Yes, Teleport supports tunnel multiplexing on a single port. Set the
 setting in the `proxy_service` configuration. Teleport will automatically use
 multiplexing with that configuration.
 
+## Can I copy files from one Teleport node to another?
+
+Yes, Teleport supports [Headless WebAuthn authentication](./access-controls/guides/headless.mdx),
+which allows you to perform operations like `tsh ssh` or `tsh scp` from remote systems where you
+are not logged in to Teleport or may not have access to a browser.
+
 ## I'm getting `ssh: subsystem request failed` while I try to copy files, what to do?
 
 Make sure that all Teleport components are at least at version 10.3.0. Older versions
diff --git a/docs/pages/get-started.mdx b/docs/pages/get-started.mdx
deleted file mode 100644
index b950b25bbd10e..0000000000000
--- a/docs/pages/get-started.mdx
+++ /dev/null
@@ -1,257 +0,0 @@
----
-title: Try out Teleport on a Linux Server
-description: This tutorial will guide you through the steps needed to install and run Teleport on a Linux server
-videoBanner: BJWbSqiDLeU
----
-
-This tutorial will show you how to install and run a demo Teleport cluster
-(=teleport.version=) on a Linux host using Teleport Community Edition. Once you
-deploy the cluster, you can configure RBAC, register resources, and protect your
-small-scale demo environments or home lab.
-
-We will run the following Teleport services:
-
-- **Teleport Auth Service:** The certificate authority for your cluster. It
-  issues certificates and conducts authentication challenges. The Auth Service
-  is typically inaccessible outside your private network.
-- **Teleport Proxy Service:** The cluster frontend, which handles user requests,
-  forwards user credentials to the Auth Service, and communicates with Teleport
-  instances that enable access to specific resources in your infrastructure.
-- **Teleport SSH Service:** An SSH server implementation that takes advantage of
-  Teleport's short-lived certificates, sophisticated RBAC, session recording,
-  and other features.
-
-(!docs/pages/includes/cloud/call-to-action.mdx!)
-
-## Prerequisites
-
-- A Linux host with only port `443` open to ingress traffic. You must be able
-  to install and run software on the host. Either configure access to the host
-  via SSH for the initial setup (and open an SSH port in addition port `443`)
-  or enter the commands in this guide into an Amazon EC2 [user data
-  script](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html),
-  Google Compute Engine [startup
-  script](https://cloud.google.com/compute/docs/instances/startup-scripts),
-  or similar.
-
-  <Admonition type="tip" title="Quick demo environments">
-
-  For a quick demo environment you can use to follow this guide, consider
-  installing our DigitalOcean 1-Click droplet. View the installation page on
-  [DigitalOcean
-  Marketplace](https://marketplace.digitalocean.com/apps/teleport). Once your
-  droplet is ready, SSH into the droplet and follow the configuration wizard.
-
-  </Admonition>
-
-- A two-factor authenticator app such as [Authy](https://authy.com/download/),
-  [Google Authenticator](https://www.google.com/landing/2step/), or [Microsoft
-  Authenticator](https://www.microsoft.com/en-us/account/authenticator)
-
-You must also have one of the following:
-- A registered domain name.
-- An authoritative DNS nameserver managed by your organization, plus an existing
-  certificate authority. If using this approach, ensure that your browser is
-  configured to use your organization's nameserver.
-
-This guide is not intended for local deployments. If your environment doesn't
-meet the prerequisites above, you can get started with Teleport by signing up
-for a [free trial of Teleport Enterprise Cloud](https://goteleport.com/signup/).
-
-## Step 1/4. Configure DNS
-
-Teleport uses TLS to provide secure access to its Proxy Service and Auth
-Service, and this requires a domain name that clients can use to verify
-Teleport's certificate. Set up two DNS `A` records, each pointing to the IP
-address of your Linux host. Assuming `teleport.example.com` is your domain name,
-set up records for:
-
-|Domain|Reason|
-|---|---|
-|`teleport.example.com`|Traffic to the Proxy Service from users and services.|
-|`*.teleport.example.com`|Traffic to web applications registered with Teleport. Teleport issues a subdomain of your cluster's domain name to each application.|
-
-## Step 2/4. Set up Teleport on your Linux host
-
-### Install Teleport
-
-On your Linux host, run the following command to install the Teleport binary:
-
-```code
-$ curl https://goteleport.com/static/install.sh | bash -s (=teleport.version=)
-```
-
-### Configure Teleport
-
-Generate a configuration file for Teleport using the `teleport configure` command.
-This command requires information about a TLS certificate and private key.
-
-(!docs/pages/includes/tls-certificate-setup.mdx!)
-
-### Start Teleport
-
-(!docs/pages/includes/start-teleport.mdx!)
-
-Access Teleport's Web UI via HTTPS at the domain you created earlier (e.g.,
-`https://teleport.example.com`). You should see a welcome screen similar to the
-following:
-
-![Teleport Welcome Screen](../img/quickstart/welcome.png)
-
-## Step 3/4. Create a Teleport user and set up two-factor authentication
-
-In this step, we'll create a new Teleport user, `teleport-admin`, which is
-allowed to log into SSH hosts as any of the principals `root`, `ubuntu`, or
-`ec2-user`.
-
-On your Linux host, run the following command:
-
-```code
-# tctl is an administrative tool that is used to configure Teleport's auth service.
-$ sudo tctl users add teleport-admin --roles=editor,access --logins=root,ubuntu,ec2-user
-```
-
-The command prints a message similar to the following:
-
-```text
-User "teleport-admin" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
-https://teleport.example.com:443/web/invite/123abc456def789ghi123abc456def78
-
-NOTE: Make sure teleport.example.com:443 points at a Teleport proxy which users can access.
-```
-
-Visit the provided URL in order to create your Teleport user.
-
-<Admonition
-  type="tip"
-  title="OS User Mappings"
->
-
-  The users that you specify in the `logins` flag (e.g., `root`, `ubuntu` and
-  `ec2-user` in our examples) must exist on your Linux host. Otherwise, you
-  will get authentication errors later in this tutorial.
-
-  If a user does not already exist, you can create it with `adduser <login>` or
-  use [host user creation](./server-access/guides/host-user-creation.mdx).
-
-  If you do not have the permission to create new users on the Linux host, run
-  `tctl users add teleport $(whoami)` to explicitly allow Teleport to
-  authenticate as the user that you have currently logged in as.
-
-</Admonition>
-
-Teleport enforces the use of two-factor authentication by default. It supports
-one-time passwords (OTP) and second-factor authenticators (WebAuthn). In this
-guide, you will need to enroll an OTP authenticator application using the QR
-code on the Teleport welcome screen.
-
-<Details title="Logging in via the CLI">
-
-In addition to Teleport's Web UI, you can access resources in your
-infrastructure via the `tsh` client tool.
-
-Install `tsh` on your local workstation:
-
-<Tabs>
-  <TabItem label="Mac">
-    [Download the MacOS .pkg installer](https://goteleport.com/download?os=mac) (`tsh` client only, signed) and double-click to run it.
-  </TabItem>
-
-  <TabItem label="Mac - Homebrew">
-    ```code
-    $ brew install teleport
-    ```
-
-    <Admonition type="note">
-      The Teleport package in Homebrew is not maintained by Teleport and we can't
-      guarantee its reliability or security. We recommend the use of our [own Teleport packages](https://goteleport.com/download?os=mac).
-
-      If you choose to use Homebrew, you must verify that the versions of `tsh` and
-      `tctl` are compatible with the versions you run server-side. Homebrew usually
-      ships the latest release of Teleport, which may be incompatible with older
-      versions. See our [compatibility policy](./management/operations/upgrading.mdx#component-compatibility) for details.
-    </Admonition>
-  </TabItem>
-
-  <TabItem label="Windows - Powershell">
-    ```code
-    $ curl -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-windows-amd64-bin.zip
-    # Unzip the archive and move `tsh.exe` to your %PATH%
-    ```
-  </TabItem>
-
-  <TabItem label="Linux">
-    For more options (including RPM/DEB packages and downloads for i386/ARM/ARM64) please see our [installation page](./installation.mdx).
-
-    ```code
-    $ curl -O https://get.gravitational.com/teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
-    $ tar -xzf teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
-    $ cd teleport
-    $ sudo ./install
-    # Teleport binaries have been copied to /usr/local/bin
-    # To configure the systemd service for Teleport take a look at examples/systemd/README.mdx
-    ```
-  </TabItem>
-</Tabs>
-
-Log in to receive short-lived certificates from Teleport:
-
-```code
-# Replace teleport.example.com with your Teleport cluster's public address as configured above.
-$ tsh login --proxy=<Var name="teleport.example.com" /> --user=teleport-admin
-> Profile URL:        https://teleport.example.com:443
-  Logged in as:       teleport-admin
-  Cluster:            teleport.example.com
-  Roles:              access, editor
-  Logins:             root, ubuntu, ec2-user
-  Kubernetes:         enabled
-  Valid until:        2022-04-26 03:04:46 -0400 EDT [valid for 12h0m0s]
-  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
-```
-
-
-</Details>
-
-## Step 4/4. Enroll your infrastructure
-
-With Teleport, you can protect all of the resources in your infrastructure
-behind a single identity-aware access proxy, including servers, databases,
-applications, Kubernetes clusters, Windows desktops, and cloud provider APIs.
-
-To enroll a resource with Teleport, visit the Web UI and click the name of a
-resource on the sidebar, e.g., **Servers**, **Applications**, and
-**Kubernetes**. The Web UI will show you the steps you can take to enroll that
-resource.
-
-![Adding resources](../img/add-resources.png)
-
-In the **Servers** tab, you can see that you have already enrolled your Linux
-server. 
-
-## Next steps
-
-Now that you have launched your Teleport cluster and added your first resources,
-see how to use Teleport to set up secure access to your infrastructure. 
-
-Read the [Manage Access](./access-controls/introduction.mdx) documentation to
-get started setting up role-based access controls for all of the resources you
-registered.
-
-To learn about common Day Two operations when managing a Teleport cluster, read
-the [Manage your Cluster](./management/introduction.mdx) guides.
-
-You can also read more about how to protect your infrastructure with Teleport,
-including:
-
-- [Applications](./application-access/introduction.mdx)
-- [Databases](./database-access/introduction.mdx)
-- [Kubernetes clusters](./kubernetes-access/introduction.mdx)
-- [Servers](./server-access/introduction.mdx)
-- [Windows desktops](./desktop-access/introduction.mdx)
-- [Service accounts](./machine-id/introduction.mdx) (via Machine ID)
-
-## Further reading
-
-- How Let's Encrypt uses the [ACME protocol](https://letsencrypt.org/how-it-works/) to issue certificates.
-- Configuration for the `teleport` daemon relies on [systemd](https://www.freedesktop.org/wiki/Software/systemd/). For more information on how the
-`teleport` service daemon is configured, see our guide on how to [Run Teleport as a Daemon](management/admin/daemon.mdx).
diff --git a/docs/pages/includes/access-control-guides.mdx b/docs/pages/includes/access-control-guides.mdx
index 01c1439da73e0..08ec27eb66071 100644
--- a/docs/pages/includes/access-control-guides.mdx
+++ b/docs/pages/includes/access-control-guides.mdx
@@ -7,6 +7,6 @@
 - [Locking](../access-controls/guides/locking.mdx): Lock access to active user sessions or hosts.
 - [Moderated Sessions](../access-controls/guides/moderated-sessions.mdx): Require session auditors and allow fine-grained live session access.
 - [Hardware Key Support (Preview)](../access-controls/guides/hardware-key-support.mdx): Enforce the use of hardware-based private keys.
-- [Device Trust (Preview)](../access-controls/guides/device-trust.mdx): Register and enforce trusted devices.
+- [Device Trust (Preview)](../access-controls/device-trust/guide.mdx): Register and enforce trusted devices.
 - [Headless WebAuthn (Preview)](../access-controls/guides/headless.mdx): Login with Webauthn from a remote device.
 - [IP Pinning (Preview)](../access-controls/guides/ip-pinning.mdx): Pin a user's certificates to a login IP address.
diff --git a/docs/pages/includes/cloud/call-to-action.mdx b/docs/pages/includes/cloud/call-to-action.mdx
index 169dbd7bbbf60..9e595dfaf4d0a 100644
--- a/docs/pages/includes/cloud/call-to-action.mdx
+++ b/docs/pages/includes/cloud/call-to-action.mdx
@@ -3,10 +3,10 @@ type="tip"
 scope={["oss", "enterprise"]} 
 >
 
-Teleport Cloud takes care of this setup for you so you can provide secure access
+Teleport Team takes care of this setup for you so you can provide secure access
 to your infrastructure right away.
 
 Get started with a [free trial](https://goteleport.com/signup?t_source=docs) of
-Teleport Cloud.
+Teleport Team.
 
 </Notice>
diff --git a/docs/pages/includes/cloud/install-linux-cloud.mdx b/docs/pages/includes/cloud/install-linux-cloud.mdx
new file mode 100644
index 0000000000000..e964a0a8e80e7
--- /dev/null
+++ b/docs/pages/includes/cloud/install-linux-cloud.mdx
@@ -0,0 +1,74 @@
+  <Tabs>
+  <TabItem label="Debian 8+/Ubuntu 16.04+ (apt)">
+
+  Add the Teleport repository to your repository list:
+
+  ```code
+  # Download Teleport's PGP public key
+  $ sudo curl https://apt.releases.teleport.dev/gpg \
+  -o /usr/share/keyrings/teleport-archive-keyring.asc
+  # Source variables about OS version
+  $ source /etc/os-release
+  # Add the Teleport apt repository for cloud.
+  $ echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] \
+  https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/cloud" \
+  | sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null
+
+  $ sudo apt-get update
+  $ sudo apt-get install teleport-ent
+  ```
+
+  </TabItem>
+  <TabItem label="Amazon Linux 2/RHEL 7 (yum)">
+
+  ```code
+  # Source variables about OS version
+  $ source /etc/os-release
+  # Add the Teleport yum repository for cloud.
+  # First, get the major version from $VERSION_ID so this fetches the correct
+  # package version.
+  $ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
+  $ sudo yum-config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/cloud/teleport.repo")"
+  $ sudo yum install teleport-ent
+  #
+  # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
+  # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
+  ```
+
+  </TabItem>
+  <TabItem label="Amazon Linux 2023/RHEL 8+ (dnf)">
+
+  ```code
+  # Source variables about OS version
+  $ source /etc/os-release
+  # Add the Teleport yum repository for cloud.
+  # Use the dnf config manager plugin to add the teleport RPM repo
+  $ sudo dnf config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/cloud/teleport.repo")"
+  
+  # Install teleport
+  $ sudo dnf install teleport-ent
+  
+  # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
+  # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
+  ```
+
+  </TabItem>
+  <TabItem label="Tarball">
+
+  In the example commands below, update `$SYSTEM_ARCH` with the appropriate
+  value (`amd64`, `arm64`, or `arm`). All example commands using this variable
+  will update after one is filled out.
+
+  ```code
+  $ curl https://get.gravitational.com/teleport-ent-v(=cloud.version=)-linux-<Var name="$SYSTEM_ARCH"/>-bin.tar.gz.sha256
+  # <checksum> <filename>
+  $ curl -O https://cdn.teleport.dev/teleport-ent-v(=cloud.version=)-linux-amd64-bin.tar.gz
+  $ shasum -a 256 teleport-ent-v(=cloud.version=)-linux-amd64-bin.tar.gz
+  # Verify that the checksums match
+  $ tar -xvf teleport-ent-v(=cloud.version=)-linux-amd64-bin.tar.gz
+  $ cd teleport-ent
+  $ sudo ./install
+  ```
+
+  </TabItem>
+  </Tabs>
\ No newline at end of file
diff --git a/docs/pages/includes/cloud/install-macos.mdx b/docs/pages/includes/cloud/install-macos.mdx
new file mode 100644
index 0000000000000..3482e4f8411e5
--- /dev/null
+++ b/docs/pages/includes/cloud/install-macos.mdx
@@ -0,0 +1,20 @@
+  You can download one of the following .pkg installers for macOS:
+
+  | Link                                                                                                      | Binaries                                   |
+  |-----------------------------------------------------------------------------------------------------------|--------------------------------------------|
+  | [`teleport-ent-(=cloud.version=).pkg`](https://cdn.teleport.dev/teleport-ent-(=cloud.version=).pkg) | `teleport`<br/>`tctl`<br/>`tsh`<br/>`tbot` |
+  | [`tsh-(=cloud.version=).pkg`](https://cdn.teleport.dev/tsh-(=cloud.version=).pkg)                   | `tsh`                                      |
+
+  You can also fetch an installer from the command line:
+
+  ```code
+  $ curl -O https://cdn.teleport.dev/teleport-ent-(=cloud.version=).pkg
+  # Install on Macintosh HD
+  $ sudo installer -pkg teleport-ent-(=cloud.version=).pkg -target / 
+  Password:
+  installer: Package name is teleport-ent-(=cloud.version=)
+  installer: Upgrading at base path /
+  installer: The upgrade was successful.
+  $ which teleport
+  /usr/local/bin/teleport
+  ```
diff --git a/docs/pages/includes/commercial-prereqs-tabs.mdx b/docs/pages/includes/commercial-prereqs-tabs.mdx
index e2d61a277385c..e5f3cdfb0a5d2 100644
--- a/docs/pages/includes/commercial-prereqs-tabs.mdx
+++ b/docs/pages/includes/commercial-prereqs-tabs.mdx
@@ -4,7 +4,7 @@
 
 - A running Teleport Enterprise cluster, including the Auth Service and Proxy Service. For
   details on how to set this up, see our Enterprise [Getting
-  Started](/docs/enterprise/getting-started) guide.
+  Started](../choose-an-edition/teleport-enterprise/introduction.mdx) guide.
 
 - The Enterprise `tctl` admin tool and `tsh` client tool version >= (=teleport.version=),
   which you can download by visiting your [Teleport account](https://teleport.sh).
@@ -19,11 +19,11 @@
 
 </TabItem>
 <TabItem scope={["cloud"]}
-  label="Teleport Cloud">
+  label="Teleport Enterprise Cloud">
 
-- A Teleport Cloud account, which includes a running Auth Service and Proxy
-  Service. If you do not have a Teleport Cloud account, visit the [sign up
-  page](https://goteleport.com/signup/) to begin your free trial.
+- A Teleport Enterprise Cloud account. If you do not have one, visit the [signup
+  page](https://goteleport.com/signup/) to begin a free trial of Teleport Team
+  and upgrade to Teleport Enterprise Cloud. 
 
 - The `tctl` admin tool and `tsh` client tool version >= (=cloud.version=).
   To download these tools, visit the [Downloads](../choose-an-edition/teleport-cloud/downloads.mdx) page.
diff --git a/docs/pages/includes/config-reference/auth-service.yaml b/docs/pages/includes/config-reference/auth-service.yaml
index d47ebc0551989..7f705240f75c5 100644
--- a/docs/pages/includes/config-reference/auth-service.yaml
+++ b/docs/pages/includes/config-reference/auth-service.yaml
@@ -238,6 +238,11 @@ auth_service:
           #   and Kubernetes connections.
           mode: optional # always "off" for OSS
 
+        # Determines the default time to live for user certificates
+        # issued by this auth server, defaults to 12 hours.  Examples:
+        # "14h30m", "1h" etc.
+        default_session_ttl: 12h
+
     # IP and the port to bind to. Other Teleport Nodes will be connecting to
     # this port (AKA "Auth API" or "Cluster API") to validate client
     # certificates
diff --git a/docs/pages/includes/config-reference/desktop-config.yaml b/docs/pages/includes/config-reference/desktop-config.yaml
index 4d00e03fd17df..6915b8599c85a 100644
--- a/docs/pages/includes/config-reference/desktop-config.yaml
+++ b/docs/pages/includes/config-reference/desktop-config.yaml
@@ -69,16 +69,15 @@ windows_desktop_service:
   # objects in Teleport. These hosts must be part of the Active Directory
   # domain configured to grant Teleport access.
   hosts:
-  - win1.example.com
-  - win2.example.com
-  - ...
+  - win1.dev.example.com
+  - win2.dev.example.com
   # (optional) non_ad_hosts is a list of hostnames that are not part of an
   # Active Diretory domain to register as WindowsDesktop objects in Teleport.
   # These hosts require the Teleport CA certificate and service, as described in
   # https://goteleport.com/docs/desktop-access/getting-started/
   non_ad_hosts:
-  - win3.example.com
-  - win4.example.com
+  - win3.prod.example.com
+  - win4.prod.example.com
   # (optional) settings for enabling automatic desktop discovery via LDAP
   discovery:
     # The wildcard '*' character tells Teleport to discover all the hosts in
@@ -97,13 +96,20 @@ windows_desktop_service:
   # Rules for applying labels to Windows hosts based on regular expressions
   # matched against the host name. If multiple rules match, the desktop will
   # get the union of all matching labels.
+  # 
+  # The rules for matching static hosts (hosts and non_ad_hosts) and discovered hosts
+  # are slightly different. See https://goteleport.com/docs/desktop-access/rbac/
+  # for details.
   host_labels:
-  - match: '^.*\.dev\.example\.com$'
+  - match: '^.*\.dev\.example\.com'
     labels:
       environment: dev
-  - match: '^.*\.prod\.example\.com$'
+  - match: '^.*\.prod\.example\.com'
     labels:
       environment: prod
+  - match: '^EC2AMAZ-'
+    labels:
+      environment: discovered-in-aws
 
   # Labels to attach to the Windows Desktop Service. This is used internally, so
   # any custom labels added won't affect the Windows hosts.
diff --git a/docs/pages/includes/config-reference/jamf-service.yaml b/docs/pages/includes/config-reference/jamf-service.yaml
new file mode 100644
index 0000000000000..96477304c80e6
--- /dev/null
+++ b/docs/pages/includes/config-reference/jamf-service.yaml
@@ -0,0 +1,70 @@
+# This section configures the Jamf service.
+jamf_service:
+  # Enables the Jamf service. Default is 'no'
+  enabled: yes
+
+  # Name of the sync source corresponding to the service.
+  # Jamf service sources with the same name manage the same devices, which is
+  # particularly relevant during device removal.
+  # If you have multiple Jamf sources, make sure to give them distinct,
+  # descriptive names.
+  # Default is 'jamf'.
+  name: jamf
+
+  # API endpoint for the Jamf Pro API.
+  # Required.
+  api_endpoint: https://yourtenant.jamfcloud.com
+
+  # Username for the Jamf Pro API.
+  # Required.
+  username: teleport
+
+  # Path to a file containing the password for the Jamf Pro API.
+  # It is recommended to set the permissions for the file as restrictively as
+  # possible.
+  # Required.
+  password_file: /var/lib/teleport/jamf_password.txt
+
+  # Delay for initial syncs.
+  # Set to zero for syncs to start after a short random delay (a couple minutes
+  # max).
+  # Set to -1 for immediate syncs on startup.
+  # Default is '0'.
+  sync_delay: 0
+
+  # If `true` the Teleport process runs all Jamf syncs immediately and exits as
+  # soon as they are done. Implies `sync_delay=-1`.
+  # Useful for cron-like executions of Jamf syncs.
+  # Default is `false`.
+  exit_on_sync: false
+
+  # Inventory sync entries.
+  # Each entry corresponds to its own sync schedule and may have different
+  # filters and intervals.
+  # If the inventory section is absent a preset sync configuration is used.
+  inventory:
+    # Sync period for partial syncs.
+    # A partial sync attempts to fetch new and modified devices, but won't scan
+    # the entire Jamf inventory.
+    # Set to zero or -1 to disable partial syncs.
+  - sync_period_partial: 6h
+
+    # Sync period for full syncs.
+    # A full sync scans the entire Jamf inventory, processing new/modified
+    # devices and removals from Jamf.
+    # Set to zero or -1 to disable partial syncs.
+    sync_period_full: 24h
+
+    # Action to take against devices missing from Jamf but present in Teleport.
+    # Valid options are:
+    # 'DELETE' - devices removed from Jamf are removed from Teleport.
+    #            (Requires a full sync.)
+    # 'NOOP' - devices removed from Jamf are left in Teleport.
+    # Default is 'NOOP'.
+    on_missing: NOOP
+
+    # Device filters forwarded to the Jamf Pro API queries.
+    # Refer to https://developer.jamf.com/jamf-pro/reference/get_v1-computers-inventory
+    # for the possible filter values.
+    # Default is ''
+    filter_rsql: ''
diff --git a/docs/pages/includes/configure-event-handler.mdx b/docs/pages/includes/configure-event-handler.mdx
index 28045e0bdf76a..ef7cf67e77446 100644
--- a/docs/pages/includes/configure-event-handler.mdx
+++ b/docs/pages/includes/configure-event-handler.mdx
@@ -5,7 +5,7 @@ Run the `configure` command to generate a sample configuration. Replace
 `mytenant.teleport.sh` with the DNS name of your Teleport Enterprise Cloud tenant:
 
 ```code
-$ ./teleport-event-handler configure . mytenant.teleport.sh:443
+$ teleport-event-handler configure . mytenant.teleport.sh:443
 ```
 
 </TabItem>
@@ -16,7 +16,7 @@ Run the `configure` command to generate a sample configuration. Replace
 Service:
 
 ```code
-$ ./teleport-event-handler configure . teleport.example.com:443
+$ teleport-event-handler configure . teleport.example.com:443
 ```
 
 </TabItem>
@@ -54,10 +54,6 @@ Teleport event handler (=teleport.version=)
 [2] Generated sample teleport-event-handler role and user file teleport-event-handler-role.yaml
 [3] Generated sample fluentd configuration file fluent.conf
 [4] Generated plugin configuration file teleport-event-handler.toml
-
-Follow-along with our getting started guide:
-
-https://goteleport.com/docs/management/export-audit-events/fluentd/
 ```
 
 The plugin generates several setup files:
@@ -82,3 +78,30 @@ $ ls -l
 | `client.crt` and `client.key`      | Fluentd client certificate and key, all signed by the generated CA  |
 | `teleport-event-handler-role.yaml` | `user` and `role` resource definitions for Teleport's event handler |
 | `fluent.conf`                      | Fluentd plugin configuration                                        |
+
+<Details title="Running the Event Handler separately from the log forwarder">
+
+This guide assumes that you are running the Event Handler on the same host or
+Kubernetes pod as your log forwarder. If you are not, you will need to instruct
+the Event Handler to generate mTLS certificates for subjects besides
+`localhost`. To do this, use the `--cn` and `--dns-names` flags of the
+`teleport-event-handler` configure command.
+
+For example, if your log forwarder is addressable at `forwarder.example.com` and the
+Event Handler at `handler.example.com`, you would run the following `configure`
+command:
+
+```code
+$ teleport-event-handler configure --cn=handler.example.com --dns-names=forwarder.example.com
+```
+
+The command generates client and server certificates with the subjects set to
+the value of `--cn`.
+
+The `--dns-names` flag accepts a comma-separated list of DNS names. It will
+append subject alternative names (SANs) to the server certificate (the one you
+will provide to your log forwarder) for each DNS name in the list. The Event
+Handler looks up each DNS name before appending it as an SAN and exits with an
+error if the lookup fails.
+
+</Details>
diff --git a/docs/pages/includes/database-access/alternative-methods-join.mdx b/docs/pages/includes/database-access/alternative-methods-join.mdx
index 6c43c748266ae..c4d46cac6011b 100644
--- a/docs/pages/includes/database-access/alternative-methods-join.mdx
+++ b/docs/pages/includes/database-access/alternative-methods-join.mdx
@@ -6,7 +6,7 @@ Teleport:
 
 - [Configure Teleport to Automatically Enroll EC2 instances (Preview)](../../server-access/guides/ec2-discovery.mdx)
 - [Joining Teleport Services via AWS IAM
-  Role](../../management/join-services-to-your-cluster/aws-iam.mdx)
-- [Joining Teleport Services via AWS EC2 Identity Document](../../management/join-services-to-your-cluster/aws-ec2.mdx)
+  Role](../../agents/join-services-to-your-cluster/aws-iam.mdx)
+- [Joining Teleport Services via AWS EC2 Identity Document](../../agents/join-services-to-your-cluster/aws-ec2.mdx)
 
 </Details>
diff --git a/docs/pages/includes/database-access/create-user.mdx b/docs/pages/includes/database-access/create-user.mdx
index a790902ad872a..395f602b4462f 100644
--- a/docs/pages/includes/database-access/create-user.mdx
+++ b/docs/pages/includes/database-access/create-user.mdx
@@ -4,6 +4,7 @@ To modify an existing user to provide access to the Database Service, see [Datab
 
 </Admonition>
 
+<ScopedBlock scope={["oss"]}>
 Create a local Teleport user with the built-in `access` role:
 
 ```code
@@ -13,12 +14,24 @@ $ tctl users add \
   --db-names=\* \
   alice
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+Create a local Teleport user with the built-in `access` and `requester` roles:
 
-| Flag                      | Description                                                                                                                              |
-|---------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
-| <nobr>`--roles`</nobr>    | List of roles to assign to the user. The builtin `access` role allows them to connect to any database server registered with Teleport.   |
-| <nobr>`--db-users`</nobr> | List of database usernames the user will be allowed to use when connecting to the databases. A wildcard allows any user.                 |
-| <nobr>`--db-names`</nobr> | List of logical databases (aka schemas) the user will be allowed to connect to within a database server. A wildcard allows any database. |
+```code
+$ tctl users add \
+  --roles=access,requester \
+  --db-users=\* \
+  --db-names=\* \
+  alice
+```
+</ScopedBlock>
+
+| Flag         | Description                                                                                                                              |
+|--------------|------------------------------------------------------------------------------------------------------------------------------------------|
+| `--roles`    | List of roles to assign to the user. The builtin `access` role allows them to connect to any database server registered with Teleport.   |
+| `--db-users` | List of database usernames the user will be allowed to use when connecting to the databases. A wildcard allows any user.                 |
+| `--db-names` | List of logical databases (aka schemas) the user will be allowed to connect to within a database server. A wildcard allows any database. |
 
 <Admonition type="warning">
   Database names are only enforced for PostgreSQL and MongoDB databases.
diff --git a/docs/pages/includes/database-access/mongodb-required-database-access.mdx b/docs/pages/includes/database-access/mongodb-required-database-access.mdx
new file mode 100644
index 0000000000000..702db32442872
--- /dev/null
+++ b/docs/pages/includes/database-access/mongodb-required-database-access.mdx
@@ -0,0 +1,5 @@
+If you opt for a stricter selection of database names for your user, which
+differs from the wildcard approach illustrated in this guide, it is essential
+to include the `admin` database. This ensures MongoDB clients won't have
+issues while connecting and executing operations such as retrieving server
+information, listing databases, and aborting transactions.
diff --git a/docs/pages/includes/device-trust/auto-enroll-troubleshooting.mdx b/docs/pages/includes/device-trust/auto-enroll-troubleshooting.mdx
new file mode 100644
index 0000000000000..5f7d9dbd25a6f
--- /dev/null
+++ b/docs/pages/includes/device-trust/auto-enroll-troubleshooting.mdx
@@ -0,0 +1,18 @@
+### "binary missing signature or entitlements" on `tsh device enroll`
+
+A signed and notarized `tsh` binary is necessary to enroll and use a a trusted
+device. [Download the macOS tsh installer](../../installation.mdx#macos) to fix
+the problem.
+
+### "unauthorized device" errors using a trusted device
+
+A signed and notarized `tsh` binary is necessary to use a trusted device. Make
+sure to download and use the
+[macOS tsh installer](../../installation.mdx#macos).
+
+A trusted device needs to be registered and enrolled before it is recognized by
+Teleport as such. Follow the [registration](
+../../access-controls/device-trust/guide.mdx#step-12-register-a-trusted-device) and
+[enrollment](
+../../access-controls/device-trust/guide.mdx#step-22-enroll-a-trusted-device) steps
+and make sure to `tsh logout` and `tsh login` after enrollment is done.
diff --git a/docs/pages/includes/device-trust/prereqs.mdx b/docs/pages/includes/device-trust/prereqs.mdx
new file mode 100644
index 0000000000000..276397c3b9694
--- /dev/null
+++ b/docs/pages/includes/device-trust/prereqs.mdx
@@ -0,0 +1,9 @@
+- To enroll a macOS device, you need:
+  - A signed and notarized `tsh` binary for enrollment.
+    [Download the macOS tsh installer](../../installation.mdx#macos).
+  - A Teleport version newer than v12.0.0.
+- To enroll a Windows device, you need:
+  - A device that includes a TPM with 2.0 support.
+  - `tsh` installed on the device. [Download the Windows tsh installer](../../installation.mdx#windows-tsh-client-only).
+  - Credentials for a user with administrator privileges for the device. This is only required during enrollment.
+  - A Teleport version newer than v13.1.2.
diff --git a/docs/pages/includes/docker-images-oss.mdx b/docs/pages/includes/docker-images-oss.mdx
deleted file mode 100644
index a7c86c82f03ca..0000000000000
--- a/docs/pages/includes/docker-images-oss.mdx
+++ /dev/null
@@ -1,27 +0,0 @@
-We provide a pre-built multi-arch Docker image for every version of Teleport,
-including images for `amd64`, `arm`, and `arm64` architectures. Our images contain only Teleport binaries
-and their application dependencies.
-
-These images are hosted on Amazon ECR Public. All tags under `public.ecr.aws/gravitational/teleport-distroless` [are Teleport Open Source images](https://gallery.ecr.aws/gravitational/teleport-distroless).
-
-The table below gives an idea of how our image naming scheme works. We offer
-images that point to a static version of Teleport as well as images that are
-automatically rebuilt every night. These nightly images point to the latest
-version of Teleport from the three most recent release branches. They are
-stable, and we recommend their use to keep your Teleport installation up to
-date.
-
-|Image name|Teleport version|Image automatically updated?|Troubleshooting Tools?|Image base|
-|-|-|-|-|-|
-|`public.ecr.aws/gravitational/teleport-distroless:(=teleport.major_version=)`|The latest version of Teleport Open Source|Yes|No|[Distroless Debian 11](https://github.com/GoogleContainerTools/distroless)|
-|`public.ecr.aws/gravitational/teleport-distroless-debug:(=teleport.major_version=)`|The latest version of Teleport Open Source|Yes|Yes|[Distroless Debian 11](https://github.com/GoogleContainerTools/distroless)|
-|`(=teleport.latest_oss_docker_image=)`|The version specified in the image's tag (i.e. (=teleport.version=))|No|No|[Distroless Debian 11](https://github.com/GoogleContainerTools/distroless)|
-|`(=teleport.latest_oss_debug_docker_image=)`|The version specified in the image's tag (i.e. (=teleport.version=))|No|Yes|[Distroless Debian 11](https://github.com/GoogleContainerTools/distroless)|
-
-For testing, we always recommend that you use the latest released version of Teleport, which is currently `(=teleport.latest_oss_docker_image=)`.
-
-The `*-debug` images include a Busybox shell and tool suite in addition to Teleport, and are intended for troubleshooting deployments only. They are not intended for production use.
-
-[Ubuntu 20.04](https://hub.docker.com/\_/ubuntu)-based images are available from our 
-[Legacy Amazon ECR Public repository](https://gallery.ecr.aws/gravitational/teleport-ent).
-Their use is considered deprecated, and they may be removed in future releases.
diff --git a/docs/pages/includes/edition-comparison.mdx b/docs/pages/includes/edition-comparison.mdx
index 170bea097eca6..0df80bff8e2ae 100644
--- a/docs/pages/includes/edition-comparison.mdx
+++ b/docs/pages/includes/edition-comparison.mdx
@@ -6,7 +6,7 @@
 |[Single Sign-On](../access-controls/sso.mdx)|GitHub|GitHub, Google Workspace, OIDC, SAML, Teleport|GitHub, Google Workspace, OIDC, SAML, Teleport|GitHub, Teleport|
 |[Role-Based Access Control](../access-controls/guides/role-templates.mdx)|✔|✔|✔|✔|
 |[Moderated Sessions](../access-controls/guides/moderated-sessions.mdx)|✖|✔|✔|✖|
-|[Device Trust](../access-controls/guides/device-trust.mdx)|✖|✔|✔|✖|
+|[Device Trust](../access-controls/device-trust/guide.mdx)|✖|✔|✔|✖|
 |[Dual Authorization](../access-controls/guides/dual-authz.mdx)|✖|✔|✔|✖|
 |[Hardware Key Support](../access-controls/guides/hardware-key-support.mdx)|✖|✔|✔|✖|
 
diff --git a/docs/pages/includes/edition-prereqs-tabs.mdx b/docs/pages/includes/edition-prereqs-tabs.mdx
index 8b5da01f95639..a460fc8c36581 100644
--- a/docs/pages/includes/edition-prereqs-tabs.mdx
+++ b/docs/pages/includes/edition-prereqs-tabs.mdx
@@ -1,13 +1,8 @@
-{/*
-TODO: Since we can't control the directory level of the page that uses this
-partial, and it is currently not possible to include absolute paths to MDX
-files in partials, this partial uses relative URL paths instead.
-*/}
 <Tabs>
 <TabItem scope={["oss"]} label="Open Source">
 
-- A running Teleport cluster. For details on how to set this up, see one of our
-  [Getting Started](/docs/getting-started) guides.
+- A running Teleport cluster. For details on how to set this up, see our
+  [Getting Started](../index.mdx) guide.
 
 - The `tctl` admin tool and `tsh` client tool version >= (=teleport.version=).
 
@@ -19,14 +14,14 @@ files in partials, this partial uses relative URL paths instead.
   # Teleport v(=teleport.version=) go(=teleport.golang=)
   ```
 
-  See [Installation](/docs/installation.mdx) for details.
+  See [Installation](../installation.mdx) for details.
 
 </TabItem>
 <TabItem
   scope={["enterprise"]} label="Enterprise">
 
 - A running Teleport Enterprise cluster. For details on how to set this up, see our Enterprise
-  [Getting Started](/docs/enterprise/getting-started) guide.
+  [Getting Started](../choose-an-edition/teleport-enterprise/introduction.mdx) guide.
 
 - The Enterprise `tctl` admin tool and `tsh` client tool version >= (=teleport.version=),
   which you can download by visiting your [Teleport account](https://teleport.sh).
@@ -43,8 +38,9 @@ files in partials, this partial uses relative URL paths instead.
 <TabItem scope={["cloud"]}
   label="Teleport Cloud">
 
-- A Teleport Cloud account. If you do not have one, visit the
-  [sign up page](https://goteleport.com/signup/) to begin your free trial.
+- A Teleport Enterprise Cloud account. If you do not have one, visit the [signup
+  page](https://goteleport.com/signup/) to begin a free trial of Teleport Team
+  and upgrade to Teleport Enterprise Cloud. 
 
 - The Enterprise `tctl` admin tool and `tsh` client tool version >= (=cloud.version=).
   To download these tools, visit the [Downloads](../choose-an-edition/teleport-cloud/downloads.mdx) page.
diff --git a/docs/pages/includes/enterprise/docker-images.mdx b/docs/pages/includes/enterprise/docker-images.mdx
deleted file mode 100644
index 25ad0334044ed..0000000000000
--- a/docs/pages/includes/enterprise/docker-images.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
-This table gives an idea of how our image naming scheme works. We offer images
-which point to a static version of Teleport Enterprise, as well as images which are
-automatically rebuilt every night.  Our images contain only Teleport binaries and their application dependencies.
-
-Nightly images point to the latest version of Teleport Enterprise from the three
-most recent release branches. They are stable, and we recommend their use to easily
-keep your Teleport Enterprise installation up to date.
-
-These images are hosted on our [Amazon ECR Public repository](https://gallery.ecr.aws/gravitational/teleport-ent-distroless).
-All tags under `public.ecr.aws/gravitational/teleport-ent-distroless` are
-Teleport Enterprise images. Each tag points to a multi-arch image, containing
-Teleport for `arm`, `arm64` and `amd64`.
-
-FIPS images are still posted to our [Legacy Amazon ECR Public repository](https://gallery.ecr.aws/gravitational/teleport-ent).
-You can specify the architecture of a Teleport FIPS Docker image by adding a
-postfix to the image tag, e.g., `public.ecr.aws/gravitational/teleport:(=teleport.major_version=)-arm64`.
-Versions without an architecture postfix use the `amd64` architecture, e.g.,
-`public.ecr.aws/gravitational/teleport:(=teleport.major_version=)`. 
-
-| Image name | Open Source or Enterprise? | Teleport version | Image automatically updated? | Includes troubleshooting tools | Image base |
-| - | - | - | - | - | - |
-| `public.ecr.aws/gravitational/teleport-ent-distroless:(=teleport.major_version=)` | Enterprise | The latest version of Teleport Enterprise (=teleport.major_version=) | Yes | No | [Distroless Debian 11](https://github.com/GoogleContainerTools/distroless) |
-| `public.ecr.aws/gravitational/teleport-ent-distroless-debug:(=teleport.major_version=)` | Enterprise | The latest version of Teleport Enterprise (=teleport.major_version=) | Yes | Yes | [Distroless Debian 11](https://github.com/GoogleContainerTools/distroless) |
-| `public.ecr.aws/gravitational/teleport-ent:(=teleport.major_version=)-fips` | Enterprise FIPS | The latest version of Teleport Enterprise (=teleport.major_version=) FIPS | Yes | Yes | [Ubuntu 20.04](https://hub.docker.com/\_/ubuntu) |
-| `(=teleport.latest_ent_docker_image=)` | Enterprise | The version specified in the image's tag (i.e. (=teleport.version=)) | No | No | [Distroless Debian 11](https://github.com/GoogleContainerTools/distroless) |
-| `(=teleport.latest_ent_debug_docker_image=)` | Enterprise | The version specified in the image's tag (i.e. (=teleport.version=)) | No | Yes | [Distroless Debian 11](https://github.com/GoogleContainerTools/distroless) |
-| `(=teleport.latest_ent_docker_image=)-fips` | Enterprise FIPS | The version specified in the image's tag (i.e. (=teleport.version=)) | No | Yes | [Ubuntu 20.04](https://hub.docker.com/\_/ubuntu) |
-
-For testing, we always recommend that you use the latest release version of
-Teleport Enterprise, which is currently `(=teleport.latest_ent_docker_image=)`.
-
-[Ubuntu 20.04](https://hub.docker.com/\_/ubuntu)-based images for non-FIPS 
-Teleport are available from our [Legacy Amazon ECR Public repository](https://gallery.ecr.aws/gravitational/teleport-ent).
-
-The `*-debug` images include a Busybox shell and tool suite in addition to Teleport,
-and are intended for troubleshooting deployments only. They are not intended for production use.
-
diff --git a/docs/pages/includes/enterprise/samlauthentication.mdx b/docs/pages/includes/enterprise/samlauthentication.mdx
index b9b8fbb8b247a..f105e636f6ef6 100644
--- a/docs/pages/includes/enterprise/samlauthentication.mdx
+++ b/docs/pages/includes/enterprise/samlauthentication.mdx
@@ -8,18 +8,7 @@ user database.
   </ScopedBlock>
 
   <Tabs>
-  <TabItem label="Static Config (Self-Hosted)" scope={["oss", "enterprise"]}>
-
-  Update `/etc/teleport.yaml` in the `auth_service` section and restart the `teleport` daemon.
-
-  ```yaml
-  auth_service:
-    authentication:
-      type: saml
-  ```
-
-  </TabItem>
-  <TabItem scope={["cloud"]} label="Dynamic Resources (All Editions)">
+  <TabItem scope={["cloud", "oss", "enterprise"]} label="Dynamic Resources (All Editions)">
 
   Use `tctl` to edit the `cluster_auth_preference` value:
 
@@ -47,5 +36,22 @@ user database.
   cluster auth preference has been updated
   ```
 
+  </TabItem>
+  <TabItem label="Static Config (Self-Hosted)" scope={["oss", "enterprise"]}>
+
+  Update `/etc/teleport.yaml` in the `auth_service` section and restart the `teleport` daemon.
+
+  ```yaml
+  auth_service:
+    authentication:
+      type: saml
+  ```
+
   </TabItem>
   </Tabs>
+
+  <Admonition type="tip">
+
+  If you need to log in again before configuring your SAML provider, use the flag <nobr>`--auth=local`</nobr>.
+
+  </Admonition>
diff --git a/docs/pages/includes/install-event-handler.mdx b/docs/pages/includes/install-event-handler.mdx
index 8e6550f8c01a9..9fb579b495e6b 100644
--- a/docs/pages/includes/install-event-handler.mdx
+++ b/docs/pages/includes/install-event-handler.mdx
@@ -4,6 +4,7 @@
 ```code
 $ curl -L -O https://get.gravitational.com/teleport-event-handler-v(=teleport.plugin.version=)-linux-amd64-bin.tar.gz
 $ tar -zxvf teleport-event-handler-v(=teleport.plugin.version=)-linux-amd64-bin.tar.gz
+$ sudo ./teleport-event-handler/install
 ```
 
 We currently only build the Event Handler plugin for amd64 machines. For ARM
@@ -16,6 +17,7 @@ architecture, you can build from source.
 ```code
 $ curl -L -O https://get.gravitational.com/teleport-event-handler-v(=teleport.plugin.version=)-darwin-amd64-bin.tar.gz
 $ tar -zxvf teleport-event-handler-v(=teleport.plugin.version=)-darwin-amd64-bin.tar.gz
+$ sudo ./teleport-event-handler/install
 ```
 
 We currently only build the event handler plugin for amd64 machines. If your
diff --git a/docs/pages/includes/install-linux.mdx b/docs/pages/includes/install-linux.mdx
index c2c08cb642d53..054ebf1f59c0a 100644
--- a/docs/pages/includes/install-linux.mdx
+++ b/docs/pages/includes/install-linux.mdx
@@ -1,77 +1,12 @@
-Use the appropriate commands for your environment to install your package.
+Use the appropriate commands for your environment to install your package:
 
 <Tabs dropdownView dropdownCaption="Teleport Edition">
   <TabItem label="Open Source" scope="oss">
-  <Tabs>
-  <TabItem label="Debian 8+/Ubuntu 16.04+ (apt)" scope="oss">
 
   ```code
-  # Download Teleport's PGP public key
-  $ sudo curl https://apt.releases.teleport.dev/gpg \
-  -o /usr/share/keyrings/teleport-archive-keyring.asc
-  # Source variables about OS version
-  $ source /etc/os-release
-  # Add the Teleport APT repository for v(=teleport.major_version=). You'll need to update this
-  # file for each major release of Teleport.
-  $ echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] \
-  https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/v(=teleport.major_version=)" \
-  | sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null
-
-  $ sudo apt-get update
-  $ sudo apt-get install teleport
+  $ curl https://goteleport.com/static/install.sh | bash -s (=teleport.version=)
   ```
 
-  </TabItem>
-  <TabItem label="Amazon Linux 2/RHEL 7 (yum)" scope="oss">
-
-  ```code
-  # Source variables about OS version
-  $ source /etc/os-release
-  # Add the Teleport YUM repository for v(=teleport.major_version=). You'll need to update this
-  # file for each major release of Teleport.
-  $ sudo yum-config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v(=teleport.major_version=)/teleport.repo")"
-  $ sudo yum install teleport
-  #
-  # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
-  # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
-  ```
-  </TabItem>
-  <TabItem label="Amazon Linux 2023/RHEL 8+ (dnf)" scope="oss">
-
-  ```code
-  # Source variables about OS version
-  $ source /etc/os-release
-  # Add the Teleport YUM repository for v(=teleport.major_version=). You'll need to update this
-  # file for each major release of Teleport.
-  # Use the dnf config manager plugin to add the teleport RPM repo
-  $ sudo dnf config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v(=teleport.major_version=)/teleport.repo")"
-  
-  # Install teleport
-  $ sudo dnf install teleport
-  
-  # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
-  # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
-  ```
-  </TabItem>
-  <TabItem label="Tarball" scope="oss">
-
-  In the example commands below, update `$SYSTEM_ARCH` with the appropriate
-  value (`amd64`, `arm64`, or `arm`). All example commands using this variable
-  will update after one is filled out.
-
-  ```code
-  $ curl https://get.gravitational.com/teleport-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH" description="The CPU architecture of the system Teleport will be installed on"/>-bin.tar.gz.sha256
-  # <checksum> <filename>
-  $ curl -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH"/>-bin.tar.gz
-  $ shasum -a 256 teleport-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH"/>-bin.tar.gz
-  # Verify that the checksums match
-  $ tar -xvf teleport-v(=teleport.version=)-linux-<Var name="$SYSTEM_ARCH"/>-bin.tar.gz
-  $ cd teleport
-  $ sudo ./install
-  ```
-
-  </TabItem>
-  </Tabs>
   </TabItem>
   <TabItem label="Enterprise" scope="enterprise">
   <Tabs>
@@ -107,6 +42,9 @@ Use the appropriate commands for your environment to install your package.
   $ source /etc/os-release
   # Add the Teleport YUM repository for v(=teleport.major_version=). You'll need to update this
   # file for each major release of Teleport.
+  # First, get the major version from $VERSION_ID so this fetches the correct
+  # package version.
+  $ VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
   $ sudo yum-config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v(=teleport.major_version=)/teleport.repo")"
   $ sudo yum install teleport-ent
   #
@@ -180,77 +118,7 @@ Use the appropriate commands for your environment to install your package.
   </Tabs>
   </TabItem>
   <TabItem label="Cloud" scope="cloud">
-  <Tabs>
-  <TabItem label="Debian 8+/Ubuntu 16.04+ (apt)" scope="cloud">
-
-  Add the Teleport repository to your repository list:
-
-  ```code
-  # Download Teleport's PGP public key
-  $ sudo curl https://apt.releases.teleport.dev/gpg \
-  -o /usr/share/keyrings/teleport-archive-keyring.asc
-  # Source variables about OS version
-  $ source /etc/os-release
-  # Add the Teleport apt repository for cloud.
-  $ echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] \
-  https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/cloud" \
-  | sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null
-
-  $ sudo apt-get update
-  $ sudo apt-get install teleport-ent
-  ```
-
-  </TabItem>
-  <TabItem label="Amazon Linux 2/RHEL 7 (yum)" scope="cloud">
-
-  ```code
-  # Source variables about OS version
-  $ source /etc/os-release
-  # Add the Teleport yum repository for cloud.
-  $ sudo yum-config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/cloud/teleport.repo")"
-  $ sudo yum install teleport-ent
-  #
-  # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
-  # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
-  ```
-
-  </TabItem>
-  <TabItem label="Amazon Linux 2023/RHEL 8+ (dnf)" scope="oss">
-
-  ```code
-  # Source variables about OS version
-  $ source /etc/os-release
-  # Add the Teleport yum repository for cloud.
-  # Use the dnf config manager plugin to add the teleport RPM repo
-  $ sudo dnf config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/cloud/teleport.repo")"
-  
-  # Install teleport
-  $ sudo dnf install teleport-ent
-  
-  # Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
-  # echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
-  ```
-
-  </TabItem>
-  <TabItem label="Tarball" scope="cloud">
-
-  In the example commands below, update `$SYSTEM_ARCH` with the appropriate
-  value (`amd64`, `arm64`, or `arm`). All example commands using this variable
-  will update after one is filled out.
-
-  ```code
-  $ curl https://get.gravitational.com/teleport-ent-v(=cloud.version=)-linux-<Var name="$SYSTEM_ARCH"/>-bin.tar.gz.sha256
-  # <checksum> <filename>
-  $ curl -O https://cdn.teleport.dev/teleport-ent-v(=cloud.version=)-linux-amd64-bin.tar.gz
-  $ shasum -a 256 teleport-ent-v(=cloud.version=)-linux-amd64-bin.tar.gz
-  # Verify that the checksums match
-  $ tar -xvf teleport-ent-v(=cloud.version=)-linux-amd64-bin.tar.gz
-  $ cd teleport-ent
-  $ sudo ./install
-  ```
-
-  </TabItem>
-  </Tabs>
+(!docs/pages/includes/cloud/install-linux-cloud.mdx!)
   <Details title="Is my Teleport instance compatible with Teleport Cloud?">
 
   Before installing a `teleport` binary with a version besides v(=cloud.major_version=),
diff --git a/docs/pages/includes/install-tsh.mdx b/docs/pages/includes/install-tsh.mdx
new file mode 100644
index 0000000000000..23fa63dc08059
--- /dev/null
+++ b/docs/pages/includes/install-tsh.mdx
@@ -0,0 +1,46 @@
+<Tabs>
+  <TabItem label="Mac">
+    Download the signed macOS .pkg installer for `tsh`. In Finder double-click the `pkg` file to install it:
+ 
+    ```code
+    $ curl -O https://cdn.teleport.dev/tsh-(=teleport.version=).pkg
+    ```
+
+  </TabItem>
+
+  <TabItem label="Mac - Homebrew">
+    ```code
+    $ brew install teleport
+    ```
+
+    <Admonition type="note">
+      The Teleport package in Homebrew is not maintained by Teleport and we can't
+      guarantee its reliability or security. We recommend the use of our [own Teleport packages](https://goteleport.com/download?os=mac).
+
+      If you choose to use Homebrew, you must verify that the versions of `tsh` and
+      `tctl` are compatible with the versions you run server-side. Homebrew usually
+      ships the latest release of Teleport, which may be incompatible with older
+      versions. See our [compatibility policy](../management/operations/upgrading.mdx#component-compatibility) for details.
+    </Admonition>
+  </TabItem>
+
+  <TabItem label="Windows - Powershell">
+    ```code
+    $ curl.exe -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-windows-amd64-bin.zip
+    # Unzip the archive and move `tsh.exe` to your %PATH%
+    ```
+  </TabItem>
+
+  <TabItem label="Linux">
+    `tsh` is included with all of the Teleport binaries in Linux installations.
+    For more options (including RPM/DEB packages and downloads for i386/ARM/ARM64) please see our [installation page](../installation.mdx).
+
+    ```code
+    $ curl -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
+    $ tar -xzf teleport-v(=teleport.version=)-linux-amd64-bin.tar.gz
+    $ cd teleport
+    $ sudo ./install
+    # Teleport binaries have been copied to /usr/local/bin
+    ```
+  </TabItem>
+</Tabs>
diff --git a/docs/pages/includes/install-windows-tsh.mdx b/docs/pages/includes/install-windows-tsh.mdx
new file mode 100644
index 0000000000000..c62c1208e5131
--- /dev/null
+++ b/docs/pages/includes/install-windows-tsh.mdx
@@ -0,0 +1,28 @@
+  ```code
+  # Set the TLS level to TLS 1.2 (required on Windows Server 2016 and lower)
+  $ [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+  # Get the expected checksum for the Windows tsh package
+  $ $Resp = Invoke-WebRequest https://get.gravitational.com/teleport-v{{ version }}-windows-amd64-bin.zip.sha256
+  # PowerShell will return the binary representation of the response content
+  # by default, so you need to convert it to a string
+  $ [System.Text.Encoding]::UTF8.getstring($Resp.Content)
+  # <checksum> <filename>
+  $ Invoke-WebRequest -OutFile teleport-v{{ version }}-windows-amd64-bin.zip -Uri https://cdn.teleport.dev/teleport-v{{ version }}-windows-amd64-bin.zip
+  $ certUtil -hashfile teleport-v{{ version }}-windows-amd64-bin.zip SHA256
+  # SHA256 hash of teleport-v{{ version }}-windows-amd64-bin.zip:
+  # <checksum>
+  # CertUtil: -hashfile command completed successfully.
+  ```
+
+  After you have verified that the checksums match, you can extract the archive.
+  The executable will be available at
+  `teleport-v{{ version }}-windows-amd64-bin\teleport\tsh.exe`.
+
+  ```code
+  $ Expand-Archive teleport-v{{ .version }}-windows-amd64-bin.zip
+  $ cd teleport-v{{ version }}-windows-amd64-bin\teleport
+  $ .\tsh.exe version
+  Teleport v{{ version }} git:v{{ .version }} go(=teleport.golang=)
+  ```
+
+  Make sure to move `tsh.exe` into your PATH.
\ No newline at end of file
diff --git a/docs/pages/includes/install-windows.mdx b/docs/pages/includes/install-windows.mdx
index 16eecad304ad6..b7920e0822071 100644
--- a/docs/pages/includes/install-windows.mdx
+++ b/docs/pages/includes/install-windows.mdx
@@ -1,32 +1,23 @@
-Starting with Teleport v7.2.0, most `tsh` features are supported for Windows 10
-1607+. The `tsh ssh` command can be run under `cmd.exe`, PowerShell, and Windows
-Terminal.
+Most `tsh` features are supported for Windows 10 1607+. The `tsh ssh` command
+can be run under `cmd.exe`, PowerShell, and Windows Terminal.
 
-To install `tsh` on Windows, run the following commands in PowerShell:
+To install `tsh` on Windows, run the following commands in **PowerShell** (these commands will not work in `cmd.exe`):
 
-  ```code
-  # Get the expected checksum for the Windows tsh package
-  $ $Resp = Invoke-WebRequest https://get.gravitational.com/teleport-v(=teleport.version=)-windows-amd64-bin.zip.sha256
-  # PowerShell will return the binary representation of the response content
-  # by default, so you need to convert it to a string
-  $ [System.Text.Encoding]::UTF8.getstring($Resp.Content)
-  # <checksum> <filename>
-  $ curl -O https://cdn.teleport.dev/teleport-v(=teleport.version=)-windows-amd64-bin.zip
-  $ certUtil -hashfile teleport-v(=teleport.version=)-windows-amd64-bin.zip SHA256
-  # SHA256 hash of teleport-v(=teleport.version=)-windows-amd64-bin.zip:
-  # <checksum>
-  # CertUtil: -hashfile command completed successfully.
-  ```
+<Tabs dropdownView dropdownCaption="Teleport Edition">
+<TabItem label="Open Source" scope="oss">
 
-  After you have verified that the checksums match, you can extract the archive.
-  The executable will be available at
-  `teleport-v(=teleport.version=)-windows-amd64-bin\teleport\tsh.exe`.
+  (!docs/pages/includes/install-windows-tsh.mdx version="(=teleport.version=)" !)
+ 
+   </TabItem>
+<TabItem label="Enterprise" scope="enterprise">
 
-  ```code
-  $ Expand-Archive teleport-v(=teleport.version=)-windows-amd64-bin.zip
-  $ cd teleport-v(=teleport.version=)-windows-amd64-bin\teleport
-  $ .\tsh.exe version
-  Teleport v(=teleport.version=) git:v(=teleport.version=) go(=teleport.golang=)
-  ```
+  (!docs/pages/includes/install-windows-tsh.mdx version="(=teleport.version=)" !)
+ 
+   </TabItem>
 
-  Make sure to move `tsh.exe` into your PATH.
+<TabItem  label="Cloud" scope="cloud">
+ 
+  (!docs/pages/includes/install-windows-tsh.mdx version="(=cloud.version=)" !)
+ 
+  </TabItem>
+  </Tabs>
diff --git a/docs/pages/includes/metrics.mdx b/docs/pages/includes/metrics.mdx
index 3b0c924966264..11d4e6c48f45e 100644
--- a/docs/pages/includes/metrics.mdx
+++ b/docs/pages/includes/metrics.mdx
@@ -15,7 +15,7 @@
 | `backend_batch_write_seconds`                            | histogram | cache               | Latency for backend batch write operations.                                                        |
 | `backend_read_requests_total`                            | counter   | cache               | Number of read requests to the backend.                                                            |
 | `backend_read_seconds`                                   | histogram | cache               | Latency for read operations.                                                                       |
-| `backend_requests`                                       | counter   | cache               | Number of write requests to the backend.                                                           |
+| `backend_requests`                                       | counter   | cache               | Number of requests to the backend (reads, writes, and keepalives).                                                           |
 | `backend_write_seconds`                                  | histogram | cache               | Latency for backend write operations.                                                              |
 | `cluster_name_not_found_total`                           | counter   | Teleport Auth       | Number of times a cluster was not found.                                                           |
 | `dynamo_requests_total`                                  | counter   | DynamoDB            | Total number of requests to the DynamoDB API.                                                      |
@@ -114,6 +114,7 @@
 
 | Name | Type | Component | Description |
 | - | - | - | - |
+| `process_state` | gauge | Teleport | State of the teleport process: 0 - ok, 1 - recovering, 2 - degraded, 3 - starting. |
 | `certificate_mismatch_total` | counter | Teleport | Number of SSH server login failures due to a certificate mismatch. |
 | `reversetunnel_connected_proxies` | gauge | Teleport | Number of known proxies being sought. |
 | `rx` | counter | Teleport | Number of bytes received during an SSH connection. |
@@ -123,45 +124,47 @@
 | `teleport_cache_stale_events` | counter | Teleport | Number of stale events received by a Teleport service cache. A high percentage of stale events can indicate a degraded backend. |
 | `tx` | counter | Teleport | Number of bytes transmitted during an SSH connection. |
 
-## Golang runtime metrics
+## Go runtime metrics
+
+These metrics are surfaced by the Go runtime and are not specific to Teleport.
 
 | Name | Type | Component | Description |
 | - | - | - | - |
-| `go_gc_duration_seconds` | summary | Internal Golang | A summary of GC invocation durations. |
-| `go_goroutines` | gauge | Internal Golang | Number of goroutines that currently exist. |
-| `go_info` | gauge | Internal Golang | Information about the Go environment. |
-| `go_memstats_alloc_bytes_total` | counter | Internal Golang | Total number of bytes allocated, even if freed. |
-| `go_memstats_alloc_bytes` | gauge | Internal Golang | Number of bytes allocated and still in use. |
-| `go_memstats_buck_hash_sys_bytes` | gauge | Internal Golang | Number of bytes used by the profiling bucket hash table. |
-| `go_memstats_frees_total` | counter | Internal Golang | Total number of frees. |
-| `go_memstats_gc_cpu_fraction` | gauge | Internal Golang | The fraction of this program's available CPU time used by the GC since the program started. |
-| `go_memstats_gc_sys_bytes` | gauge | Internal Golang | Number of bytes used for garbage collection system metadata. |
-| `go_memstats_heap_alloc_bytes` | gauge | Internal Golang | Number of heap bytes allocated and still in use. |
-| `go_memstats_heap_idle_bytes` | gauge | Internal Golang | Number of heap bytes waiting to be used. |
-| `go_memstats_heap_inuse_bytes` | gauge | Internal Golang | Number of heap bytes that are in use. |
-| `go_memstats_heap_objects` | gauge | Internal Golang | Number of allocated objects. |
-| `go_memstats_heap_released_bytes` | gauge | Internal Golang | Number of heap bytes released to the OS. |
-| `go_memstats_heap_sys_bytes` | gauge | Internal Golang | Number of heap bytes obtained from the system. |
-| `go_memstats_last_gc_time_seconds` | gauge | Internal Golang | Number of seconds since the Unix epoch of the last garbage collection. |
-| `go_memstats_lookups_total` | counter | Internal Golang | Total number of pointer lookups. |
-| `go_memstats_mallocs_total` | counter | Internal Golang | Total number of mallocs. |
-| `go_memstats_mcache_inuse_bytes` | gauge | Internal Golang | Number of bytes in use by mcache structures. |
-| `go_memstats_mcache_sys_bytes` | gauge | Internal Golang | Number of bytes used for mcache structures obtained from system. |
-| `go_memstats_mspan_inuse_bytes` | gauge | Internal Golang | Number of bytes in use by mspan structures. |
-| `go_memstats_mspan_sys_bytes` | gauge | Internal Golang | Number of bytes used for mspan structures obtained from system. |
-| `go_memstats_next_gc_bytes` | gauge | Internal Golang | Number of heap bytes when next the garbage collection will take place. |
-| `go_memstats_other_sys_bytes` | gauge | Internal Golang | Number of bytes used for other system allocations. |
-| `go_memstats_stack_inuse_bytes` | gauge | Internal Golang | Number of bytes in use by the stack allocator. |
-| `go_memstats_stack_sys_bytes` | gauge | Internal Golang | Number of bytes obtained from the system for stack allocator. |
-| `go_memstats_sys_bytes` | gauge | Internal Golang | Number of bytes obtained from the system. |
-| `go_threads` | gauge | Internal Golang | Number of OS threads created. |
-| `process_cpu_seconds_total` | counter | Internal Golang | Total user and system CPU time spent in seconds. |
-| `process_max_fds` | gauge | Internal Golang | Maximum number of open file descriptors. |
-| `process_open_fds` | gauge | Internal Golang | Number of open file descriptors. |
-| `process_resident_memory_bytes` | gauge | Internal Golang | Resident memory size in bytes. |
-| `process_start_time_seconds` | gauge | Internal Golang | Start time of the process since the Unix epoch in seconds. |
-| `process_virtual_memory_bytes` | gauge | Internal Golang | Virtual memory size in bytes. |
-| `process_virtual_memory_max_bytes` | gauge | Internal Golang | Maximum amount of virtual memory available in bytes. |
+| `go_gc_duration_seconds` | summary | Internal Go | A summary of GC invocation durations. |
+| `go_goroutines` | gauge | Internal Go | Number of goroutines that currently exist. |
+| `go_info` | gauge | Internal Go | Information about the Go environment. |
+| `go_memstats_alloc_bytes_total` | counter | Internal Go | Total number of bytes allocated, even if freed. |
+| `go_memstats_alloc_bytes` | gauge | Internal Go | Number of bytes allocated and still in use. |
+| `go_memstats_buck_hash_sys_bytes` | gauge | Internal Go | Number of bytes used by the profiling bucket hash table. |
+| `go_memstats_frees_total` | counter | Internal Go | Total number of frees. |
+| `go_memstats_gc_cpu_fraction` | gauge | Internal Go | The fraction of this program's available CPU time used by the GC since the program started. |
+| `go_memstats_gc_sys_bytes` | gauge | Internal Go | Number of bytes used for garbage collection system metadata. |
+| `go_memstats_heap_alloc_bytes` | gauge | Internal Go | Number of heap bytes allocated and still in use. |
+| `go_memstats_heap_idle_bytes` | gauge | Internal Go | Number of heap bytes waiting to be used. |
+| `go_memstats_heap_inuse_bytes` | gauge | Internal Go | Number of heap bytes that are in use. |
+| `go_memstats_heap_objects` | gauge | Internal Go | Number of allocated objects. |
+| `go_memstats_heap_released_bytes` | gauge | Internal Go | Number of heap bytes released to the OS. |
+| `go_memstats_heap_sys_bytes` | gauge | Internal Go | Number of heap bytes obtained from the system. |
+| `go_memstats_last_gc_time_seconds` | gauge | Internal Go | Number of seconds since the Unix epoch of the last garbage collection. |
+| `go_memstats_lookups_total` | counter | Internal Go | Total number of pointer lookups. |
+| `go_memstats_mallocs_total` | counter | Internal Go | Total number of mallocs. |
+| `go_memstats_mcache_inuse_bytes` | gauge | Internal Go | Number of bytes in use by mcache structures. |
+| `go_memstats_mcache_sys_bytes` | gauge | Internal Go | Number of bytes used for mcache structures obtained from system. |
+| `go_memstats_mspan_inuse_bytes` | gauge | Internal Go | Number of bytes in use by mspan structures. |
+| `go_memstats_mspan_sys_bytes` | gauge | Internal Go | Number of bytes used for mspan structures obtained from system. |
+| `go_memstats_next_gc_bytes` | gauge | Internal Go | Number of heap bytes when next the garbage collection will take place. |
+| `go_memstats_other_sys_bytes` | gauge | Internal Go | Number of bytes used for other system allocations. |
+| `go_memstats_stack_inuse_bytes` | gauge | Internal Go | Number of bytes in use by the stack allocator. |
+| `go_memstats_stack_sys_bytes` | gauge | Internal Go | Number of bytes obtained from the system for stack allocator. |
+| `go_memstats_sys_bytes` | gauge | Internal Go | Number of bytes obtained from the system. |
+| `go_threads` | gauge | Internal Go | Number of OS threads created. |
+| `process_cpu_seconds_total` | counter | Internal Go | Total user and system CPU time spent in seconds. |
+| `process_max_fds` | gauge | Internal Go | Maximum number of open file descriptors. |
+| `process_open_fds` | gauge | Internal Go | Number of open file descriptors. |
+| `process_resident_memory_bytes` | gauge | Internal Go | Resident memory size in bytes. |
+| `process_start_time_seconds` | gauge | Internal Go | Start time of the process since the Unix epoch in seconds. |
+| `process_virtual_memory_bytes` | gauge | Internal Go | Virtual memory size in bytes. |
+| `process_virtual_memory_max_bytes` | gauge | Internal Go | Maximum amount of virtual memory available in bytes. |
 
 ## Prometheus
 
diff --git a/docs/pages/includes/okta-import-rule.mdx b/docs/pages/includes/okta-import-rule.mdx
index 81ba42837e8fd..c68bcc96c248d 100644
--- a/docs/pages/includes/okta-import-rule.mdx
+++ b/docs/pages/includes/okta-import-rule.mdx
@@ -27,4 +27,16 @@ spec:
     # These labels will be added to the groups.
     add_labels:
       label1: value1
+  - match:
+    # Regexes based on the app name can be used to create matches.
+    - app_name_regexes: ["^okta.*$", "app*"]
+    # These labels will be added to matching applications.
+    add_labels:
+      app_label: app_label_value
+  - match:
+    # Similarly, regexes based on the group name can be used as well.
+    - group_name_regexes: ["^okta.*$", "app*"]
+    # These labels will be added to the groups.
+    add_labels:
+      label1: value1
 ```
\ No newline at end of file
diff --git a/docs/pages/includes/permission-warning.mdx b/docs/pages/includes/permission-warning.mdx
index ab9fb6b934fa9..f3c08a4b3a586 100644
--- a/docs/pages/includes/permission-warning.mdx
+++ b/docs/pages/includes/permission-warning.mdx
@@ -12,7 +12,10 @@
     numbered < `1024` (e.g. `443`).
   - Follow the "Principle of Least Privilege" (PoLP). Don't give users
     permissive roles when giving them more restrictive roles will do instead.
-    For example, assign users the built-in `access,editor` roles.
+    For example, don't assign users the built-in `access,editor` roles, which give
+    them permissions to access and edit all cluster resources. Instead, define 
+    RBAC roles with the minimum required permissions for each user and configure
+    Access Requests for elevated permissions.
   - When joining a Teleport resource service (e.g., the Database Service or
     Application Service) to a cluster, save the invitation token to a file.
     Otherwise, the token will be visible when examining the `teleport` command
diff --git a/docs/pages/includes/plugins/identity-export.mdx b/docs/pages/includes/plugins/identity-export.mdx
index 2c8ead98c5605..813e1b2561a05 100644
--- a/docs/pages/includes/plugins/identity-export.mdx
+++ b/docs/pages/includes/plugins/identity-export.mdx
@@ -1,6 +1,8 @@
-Like all Teleport users, `{{ user }}` needs signed credentials in
-order to connect to your Teleport cluster. You will use the `tctl auth sign`
-command to request these credentials for your plugin.
+{{ client="The plugin" }}
+
+Like all Teleport users, `{{ user }}` needs signed credentials in order to
+connect to your Teleport cluster. You will use the `tctl auth sign` command to
+request these credentials.
 
 The following `tctl auth sign` command impersonates the `{{ user }}` user,
 generates signed credentials, and writes an identity file to the local
@@ -10,16 +12,14 @@ directory:
 $ tctl auth sign --user={{ user }} --out=auth.pem
 ```
 
-The plugin connects to the Teleport Auth Service's gRPC endpoint over TLS.
+{{ client }} connects to the Teleport Auth Service's gRPC endpoint over TLS.
 
-The identity file, `auth.pem`, includes both TLS and SSH credentials. The plugin
+The identity file, `auth.pem`, includes both TLS and SSH credentials. {{ client }}
 uses the SSH credentials to connect to the Proxy Service, which establishes a
-reverse tunnel connection to the Auth Service. The plugin uses this reverse
+reverse tunnel connection to the Auth Service. {{ client }}  uses this reverse
 tunnel, along with your TLS credentials, to connect to the Auth Service's gRPC
 endpoint.
 
-You will refer to this file later when configuring the plugin.
-
 <Admonition
   title="Certificate Lifetime"
 >
diff --git a/docs/pages/includes/role-spec.mdx b/docs/pages/includes/role-spec.mdx
index 3ecdb82b34931..d0c30867150db 100644
--- a/docs/pages/includes/role-spec.mdx
+++ b/docs/pages/includes/role-spec.mdx
@@ -98,7 +98,9 @@ spec:
        name: login@github.com
        value: "{{ external.github_login }}"
     # Controls whether this role supports auto provisioning of SSH users.
-    create_host_user: true
+    # Options: drop (remove user on session end), keep (keep users at session end)
+    #          and off (disable host user creation)
+    create_host_user_mode: drop    create_host_user: true
     # Controls whether this role requires automatic database user provisioning.
     create_db_user: true
     # Specifies role specific options for identity provider access.
@@ -120,7 +122,7 @@ spec:
     windows_desktop_logins: [Administrator, '{{internal.logins}}']
 
     # node_labels: a user with this role will be allowed to connect to
-    # SSH nodes, which labels match expressions below.
+    # SSH nodes with labels matching below.
     node_labels:
       # literal strings:
       'env': 'test'
@@ -128,9 +130,11 @@ spec:
       '*': '*'
       # a list of alternative options:
       'region': ['us-west-1', 'eu-central-1']
-      # regular expressions start with ^ and end with $
-      # Teleport uses golang regexp syntax.
-      # of the list example above can be expressed as:
+      # Regular expressions start with ^ and end with $.
+      # Teleport uses Go's regular expression syntax:
+      # https://github.com/google/re2/wiki/Syntax
+      # The list example above can be expressed as:
+      # 'region': '^us-west-1|eu-central-1$'
       'reg': '^us-west-1|eu-central-1$'
 
     # kubernetes_groups specifies Kubernetes groups a user with this role will assume.
@@ -143,14 +147,17 @@ spec:
     kubernetes_users: ['IAM#{{external.foo}};']
 
     # kubernetes_labels: a user with this role will be allowed to connect to
-    # k8s clusters, which labels match expressions below.
+    # k8s clusters with labels matching below.
     kubernetes_labels:
       # A user can only access prod environments
       'env': 'prod'
       # User can access any region in us-west, e.g us-west-1, us-west-2
       'region': 'us-west-*'
-      # regular expressions start with ^ and ending with $
-      # Teleport uses golang regexp syntax.
+      # Regular expressions start with ^ and end with $.
+      # Teleport uses Go's regular expression syntax:
+      # https://github.com/google/re2/wiki/Syntax
+      # The list example above can be expressed as:
+      # 'region': '^us-west-1|eu-central-1$'
       'cluster_name': '^us.*\.example\.com$'
 
     # kubernetes_resources indicates the Kubernetes resources that a user with
@@ -178,7 +185,7 @@ spec:
       'env': '{{regexp.replace(external.access["env"], "^(staging)$", "$1")}}'
 
     # app_labels: a user with this role will be allowed to connect to
-    # applications, which labels match expressions below.
+    # applications with labels matching below.
     app_labels:
       # A user can only access prod environments
       'env': 'prod'
@@ -198,6 +205,30 @@ spec:
       # A user is given group membership to production related groups.
       'env': 'prod'
 
+    # cluster_labels: a user with this role will be allowed to connect to remote
+    # clusters with labels matching below.
+    cluster_labels:
+      'env': 'prod'
+
+    # node_labels_expression has the same purpose as node_labels but
+    # supports predicate expressions to configure custom logic.
+    # A user with this role will be allowed to access nodes if they are in the
+    # staging environment *or* if they belong to one of the user's own teams.
+    node_labels_expression: |
+      labels["env"] == "staging" ||
+      contains(user.spec.traits["teams"] , labels["team"])
+
+    # The below <kind>_labels_expression fields have the same purpose of the
+    # matching <kind>_labels fields, but support predicate expressions instead
+    # of label matchers.
+    app_labels_expression: 'labels["env"] == "staging"'
+    cluster_labels_expression: 'labels["env"] == "staging"'
+    kubernetes_labels_expression: 'labels["env"] == "staging"'
+    db_labels_expression: 'labels["env"] == "staging"'
+    db_service_labels_expression: 'labels["env"] == "staging"'
+    windows_desktop_labels_expression: 'labels["env"] == "staging"'
+    group_labels_expression: 'labels["env"] == "staging"'
+
     # aws_role_arns allows a user with this role to assume AWS roles when
     # accessing AWS console using UI or AWS API using CLI
     aws_role_arns:
@@ -245,12 +276,12 @@ spec:
 
       # the `claims_to_roles` mapping works the same as it does in
       # the OIDC connector, with the added benefit that the roles being mapped to
-      # can also be matchers. 
+      # can also be matchers.
       #
-      # This example leverages Teleport's regular expression support, which allows 
+      # This example leverages Teleport's regular expression support, which allows
       # for dynamic mapping from claims. The below mapping says that users with
-      # claims that match "projects: project-(.*)" can request roles that match 
-      # "$1-admin", where "$1" is the first capture group in the 
+      # claims that match "projects: product-(.*)" can request roles that match
+      # "$1-admin", where "$1" is the first capture group in the
       # regular expression.
       # Example: the "projects: product-foo" claim allows a user to request the
       # "foo-admin" role
diff --git a/docs/pages/includes/server-access/custom-installer.mdx b/docs/pages/includes/server-access/custom-installer.mdx
new file mode 100644
index 0000000000000..5a8816b5e0e6a
--- /dev/null
+++ b/docs/pages/includes/server-access/custom-installer.mdx
@@ -0,0 +1,84 @@
+{{ cloud="foo" matcher="bar" matchTypes="baz" }}
+To customize the default installer script, execute the following command on
+your workstation:
+
+```code
+$ tctl get installer/default-installer > teleport-default-installer.yaml
+```
+
+The resulting `teleport-default-installer.yaml` can be edited to
+change what gets executed when enrolling discovered instances.
+
+After making the desired changes to the default installer, the
+resource can be updated by executing:
+
+```code
+$ tctl create -f teleport-default-installer.yaml
+```
+
+Multiple `installer` resources can exist and be specified in the
+`{{ matcher }}.install.script_name` section of a `discovery_service.{{ matcher }}` list item in
+`teleport.yaml`:
+
+```yaml
+discovery_service:
+  {{ matcher }}:
+    - types: {{ matchTypes }}
+      tags:
+       - "env": "prod"
+      install: # optional section when default-installer is used.
+        script_name: "default-installer"
+    - types: {{ matchTypes }}
+      tags:
+       - "env": "devel"
+      install:
+        script_name: "devel-installer"
+```
+
+---
+
+The `installer` resource has the following templating options:
+
+- `{{ .MajorVersion }}`: the major version of Teleport to use when
+  installing from the repository.
+- `{{ .PublicProxyAddr }}`: the public address of the Teleport Proxy Service to
+connect to.
+- `{{ .RepoChannel }}`: Optional package repository (apt/yum) channel name.
+Has format `<channel>/<version>` e.g. stable/v(=teleport.major_version=). See [installation](../../installation.mdx#linux) for more details.
+- `{{ .AutomaticUpgrades }}`: indicates whether Automatic Upgrades are enabled or disabled.
+  Its value is either `true` or `false`. See
+  [self-hosted automatic agent updates](../../management/operations/self-hosted-automatic-agent-updates.mdx)
+  for more information.
+- `{{ .TeleportPackage }}`: the Teleport package to use.
+  Its value is either `teleport-ent` or `teleport` depending on whether the
+  cluster is enterprise or not.
+
+These can be used as follows:
+
+```yaml
+kind: installer
+metadata:
+  name: default-installer
+spec:
+  script: |
+    echo {{ .PublicProxyAddr }}
+    echo Teleport-{{ .MajorVersion }}
+    echo Repository Channel: {{ .RepoChannel }}
+version: v1
+```
+
+Which, when retrieved for installation, will evaluate to a script
+with the following contents:
+
+```sh
+echo teleport.example.com
+echo Teleport-(=teleport.version=)
+echo Repository Channel: stable/v(=teleport.version=)
+```
+
+The default installer will take the following actions:
+
+- Add an official Teleport repository to supported Linux distributions.
+- Install Teleport via `apt` or `yum`.
+- Generate the Teleport config file and write it to `/etc/teleport.yaml`.
+- Enable and start the Teleport service.
diff --git a/docs/pages/includes/sso/idp-initiated.mdx b/docs/pages/includes/sso/idp-initiated.mdx
index 9af9706df51ce..9003c75652bba 100644
--- a/docs/pages/includes/sso/idp-initiated.mdx
+++ b/docs/pages/includes/sso/idp-initiated.mdx
@@ -1,5 +1,5 @@
 <Details title="IdP-initiated SSO">
-    Enabling the `allow_idp_initiated` flag in SAML connectors allows users to
+    Enabling the `spec.allow_idp_initiated` flag in SAML connectors allows users to
     log in to Teleport with one click from the dashboard provided by the IdP.
 
     This feature is potentially unsafe and should be used with caution.
diff --git a/docs/pages/includes/sso/loginerrortroubleshooting.mdx b/docs/pages/includes/sso/loginerrortroubleshooting.mdx
index 322f30b8a01b5..6a3897e7ee9fe 100644
--- a/docs/pages/includes/sso/loginerrortroubleshooting.mdx
+++ b/docs/pages/includes/sso/loginerrortroubleshooting.mdx
@@ -17,7 +17,8 @@ If something is not working, we recommend to:
 ### Using the Web UI
 
 If you get "access denied" or other login errors, the number one place to check is the Audit
-Log. You can access it in the **Activity** tab of the Teleport Web UI.
+Log. Under the **Management** area you can access it within the **Activity** tab in the
+Teleport Web UI. 
 
 ![Audit Log Entry for SSO Login error](../../../img/sso/teleportauditlogssofailed.png)
 
diff --git a/docs/pages/includes/tls-certificate-setup.mdx b/docs/pages/includes/tls-certificate-setup.mdx
index 7387db5b5fce5..ca362e7483b5e 100644
--- a/docs/pages/includes/tls-certificate-setup.mdx
+++ b/docs/pages/includes/tls-certificate-setup.mdx
@@ -12,26 +12,13 @@ deployments, use your own private key and certificate.
     verification process when it starts up.
 
     On the host where you will start the Teleport Auth Service and Proxy Service,
-    run the following `teleport configure` command, where `tele.example.com` is the
-    domain name of your Teleport cluster and `user@example.com` is an email address
-    used for notifications (you can use any domain):
+    run the following `teleport configure` command. Assign 
+    <Var name="tele.example.com" /> to the
+    domain name of your Teleport cluster and <Var name="user@example.com" /> to
+    an email address used for notifications (you can use any domain):
 
     ```code
-    $ teleport configure --acme --acme-email=<Var name="user@example.com" description="Your email address to register with Let's Encrypt for TLS certificates" /> --cluster-name=<Var name="tele.example.com" description="The domain name of your Teleport cluster" /> | \
-    sudo tee /etc/teleport.yaml > /dev/null
-    ```
-
-    The `--acme`, `--acme-email`, and `--cluster-name` flags will add the following
-    settings to your Teleport configuration file:
-
-    ```yaml
-    proxy_service:
-      enabled: "yes"
-      web_listen_addr: 0.0.0.0:443
-      public_addr: tele.example.com:443
-      acme:
-        enabled: "yes"
-        email: user@example.com
+    $ teleport configure --acme --acme-email=<Var name="user@example.com" description="Your email address to register with Let's Encrypt for TLS certificates" /> --cluster-name=<Var name="tele.example.com" description="The domain name of your Teleport cluster" /> | sudo tee /etc/teleport.yaml > /dev/null
     ```
 
     Port 443 on your Teleport Proxy Service host must allow traffic from all sources.
@@ -43,12 +30,14 @@ deployments, use your own private key and certificate.
 
   The leaf certificate must have a subject that corresponds to the domain of your Teleport host, e.g., `*.teleport.example.com`.
 
-  Configure Teleport, changing the values of the `--cluster-name` and `--public-addr` flags to match the domain name of your Teleport host.
+  On the host where you will start the Teleport Auth Service and Proxy Service,
+  run the following `teleport configure` command. Assign <Var
+  name="tele.example.com" /> to the domain name of your Teleport cluster.
 
   ```code
   $ sudo teleport configure -o file \
-      --cluster-name=tele.example.com \
-      --public-addr=tele.example.com:443 \
+      --cluster-name=<Var name="tele.example.com" /> \
+      --public-addr=<Var name="tele.example.com" />:443 \
       --cert-file=/var/lib/teleport/fullchain.pem \
       --key-file=/var/lib/teleport/privkey.pem
   ```
diff --git a/docs/pages/index.mdx b/docs/pages/index.mdx
index 188710951857b..671f19769f0dc 100644
--- a/docs/pages/index.mdx
+++ b/docs/pages/index.mdx
@@ -1,175 +1,220 @@
 ---
-title: Introduction to Teleport
-description: Teleport is an identity-aware, multi-protocol access proxy with native support for SSH, RDP, Kubernetes, and more. Get started with the Teleport documentation.
-layout: tocless-doc
-videoBanner: ki-uVTSocGE
+title: Get Started with Teleport
+description: This tutorial will guide you through the steps needed to install and run Teleport on a Linux server
+videoBanner: BJWbSqiDLeU
+tocDepth: 3
 ---
 
 Teleport is an identity-aware, multi-protocol access proxy. Teleport understands
 the SSH, HTTPS, RDP, Kubernetes API, MySQL, MongoDB and PostgreSQL wire
-protocols, plus many others.
+protocols, plus many others. It can integrate with Single Sign-On providers and
+enables you to apply access policies using infrastructure-as-code and GitOps
+tools.
 
-With Teleport you can:
+See how Teleport works by completing the tutorial below. This shows you how to
+spin up a single-instance Teleport cluster on a Linux server using Teleport
+Community Edition. Once you deploy the cluster, you can configure RBAC, register
+resources, and protect your small-scale demo environments or home lab.
 
-- Replace a mix of vaults, passwords, API keys and tokens with short-lived SSH and X.509 certs.
-- Have a single access point and Single-Sign-On provider for all of your
-  infrastructure, including SSH servers, Kubernetes clusters, databases,
-  desktops, web applications, and more.
-- Write policies with Terraform or Kubernetes resources for all clouds,
-  environments and protocols and manage them with GitOps.
-- Record SSH and `kubectl exec` sessions, DB queries, Windows desktop sessions,
-  web sessions and API requests.
-- Use mutual TLS tunnels to protect your infrastructure endpoints.
+You can also get started right away with a production-ready Teleport cluster by
+signing up for a [free trial of Teleport
+Team](./choose-an-edition/teleport-team.mdx).
 
-<Notice type="info">
+## Set up a demo cluster
 
-If your organization is already using Teleport and you want to learn how to
-access infrastructure, read our [Connect your
-Client](./connect-your-client/introduction.mdx) guides for instructions.
+<Figure width="700">
+![Architecture of the setup you will complete in this
+guide](../img/linux-server-diagram.png)
+</Figure>
+
+We will run the following Teleport services:
+
+- **Teleport Auth Service:** The certificate authority for your cluster. It
+  issues certificates and conducts authentication challenges. The Auth Service
+  is typically inaccessible outside your private network.
+- **Teleport Proxy Service:** The cluster frontend, which handles user requests,
+  forwards user credentials to the Auth Service, and communicates with Teleport
+  instances that enable access to specific resources in your infrastructure.
+- **Teleport SSH Service:** An SSH server implementation that takes advantage of
+  Teleport's short-lived certificates, sophisticated RBAC, session recording,
+  and other features.
+
+### Prerequisites
+
+<Notice type="tip">
+
+You will need the following to deploy a demo Teleport cluster. If your
+environment doesn't meet the prerequisites above, you can get started with
+Teleport by signing up for a [free trial of Teleport
+Team](https://goteleport.com/signup/).
 
 </Notice>
 
-## Try out Teleport
+- A Linux host with only port `443` open to ingress traffic. You must be able
+  to install and run software on the host. Either configure access to the host
+  via SSH for the initial setup (and open an SSH port in addition port `443`)
+  or enter the commands in this guide into an Amazon EC2 [user data
+  script](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html),
+  Google Compute Engine [startup
+  script](https://cloud.google.com/compute/docs/instances/startup-scripts),
+  or similar.
 
-If you are curious to see how Teleport works, you can get started by [spinning
-up a demo cluster](./get-started.mdx) on a Linux server. After seeing how your
-demo Teleport cluster lets you securely access a server and play back your SSH
-sessions, you can configure RBAC, add resources, and protect your home lab with
-Teleport.
+  <Admonition type="tip" title="Quick demo environments">
 
-You can also get started right away with a production-ready Teleport cluster.
-[Sign up for a free trial](https://goteleport.com/signup/) of Teleport
-Team.
+  For a quick demo environment you can use to follow this guide, consider
+  installing our DigitalOcean 1-Click droplet. View the installation page on
+  [DigitalOcean
+  Marketplace](https://marketplace.digitalocean.com/apps/teleport). Once your
+  droplet is ready, SSH into the droplet and follow the configuration wizard.
 
-Once you are ready to learn more about Teleport, read our [Core Concepts
-guide](./core-concepts.mdx), which introduces the components of a Teleport
-cluster. You can refer to this glossary as you continue through the
-documentation.
+  </Admonition>
 
-## Choose an edition
+- A two-factor authenticator app such as [Authy](https://authy.com/download/),
+  [Google Authenticator](https://www.google.com/landing/2step/), or
+  [1Password](https://support.1password.com/one-time-passwords/).
 
-After trying out Teleport, you are ready to deploy a cluster to your
-infrastructure. Teleport has four editions: 
+You must also have **one** of the following:
+- A registered domain name.
+- An authoritative DNS nameserver managed by your organization, plus an existing
+  certificate authority. If using this approach, ensure that your browser is
+  configured to use your organization's nameserver.
 
-- Teleport Team
-- Teleport Enterprise Cloud
-- Teleport Enterprise
-- Teleport Community Edition
+### Step 1/4. Configure DNS
 
-You can compare these in our [Choose an
-Edition](./choose-an-edition/introduction.mdx) section.
+Teleport uses TLS to provide secure access to its Proxy Service and Auth
+Service, and this requires a domain name that clients can use to verify
+Teleport's certificate. Set up two DNS `A` records, each pointing to the IP
+address of your Linux host. Assuming `teleport.example.com` is your domain name,
+set up records for:
 
-<Notice type="tip">
+|Domain|Reason|
+|---|---|
+|`teleport.example.com`|Traffic to the Proxy Service from users and services.|
+|`*.teleport.example.com`|Traffic to web applications registered with Teleport. Teleport issues a subdomain of your cluster's domain name to each application.|
 
-You can view information specific to an edition of Teleport by using the "Open
-Source", "Enterprise", and "Cloud" buttons at the top of the page.
+### Step 2/4. Set up Teleport on your Linux host
 
-</Notice>
+#### Install Teleport
+
+On your Linux host, run the following command to install the Teleport binary:
+
+```code
+$ curl https://goteleport.com/static/install.sh | bash -s (=teleport.version=)
+```
+
+#### Configure Teleport
+
+Generate a configuration file for Teleport using the `teleport configure` command.
+This command requires information about a TLS certificate and private key.
+
+(!docs/pages/includes/tls-certificate-setup.mdx!)
+
+#### Start Teleport
+
+(!docs/pages/includes/start-teleport.mdx!)
+
+Access Teleport's Web UI via HTTPS at the domain you created earlier (e.g.,
+`https://teleport.example.com`). You should see a welcome screen similar to the
+following:
+
+![Teleport Welcome Screen](../img/quickstart/welcome.png)
+
+### Step 3/4. Create a Teleport user and set up two-factor authentication
+
+In this step, we'll create a new Teleport user, `teleport-admin`, which is
+allowed to log into SSH hosts as any of the principals `root`, `ubuntu`, or
+`ec2-user`.
+
+On your Linux host, run the following command:
+
+```code
+# tctl is an administrative tool that is used to configure Teleport's auth service.
+$ sudo tctl users add teleport-admin --roles=editor,access --logins=root,ubuntu,ec2-user
+```
+
+The command prints a message similar to the following:
+
+```text
+User "teleport-admin" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
+https://teleport.example.com:443/web/invite/123abc456def789ghi123abc456def78
+
+NOTE: Make sure teleport.example.com:443 points at a Teleport proxy which users can access.
+```
+
+Visit the provided URL in order to create your Teleport user.
+
+<Admonition
+  type="tip"
+  title="OS User Mappings"
+>
+
+  The users that you specify in the `logins` flag (e.g., `root`, `ubuntu` and
+  `ec2-user` in our examples) must exist on your Linux host. Otherwise, you
+  will get authentication errors later in this tutorial.
+
+  If a user does not already exist, you can create it with `adduser <login>` or
+  use [host user creation](./server-access/guides/host-user-creation.mdx).
+
+  If you do not have the permission to create new users on the Linux host, run
+  `tctl users add teleport $(whoami)` to explicitly allow Teleport to
+  authenticate as the user that you have currently logged in as.
+
+</Admonition>
+
+Teleport enforces the use of two-factor authentication by default. It supports
+one-time passwords (OTP) and second-factor authenticators (WebAuthn). In this
+guide, you will need to enroll an OTP authenticator application using the QR
+code on the Teleport welcome screen.
+
+<Details title="Logging in via the CLI">
+
+In addition to Teleport's Web UI, you can access resources in your
+infrastructure via the `tsh` client tool.
+
+Install `tsh` on your local workstation:
+
+(!docs/pages/includes/install-tsh.mdx!)
+
+Log in to receive short-lived certificates from Teleport:
+
+```code
+# Replace teleport.example.com with your Teleport cluster's public address as configured above.
+$ tsh login --proxy=<Var name="teleport.example.com" /> --user=teleport-admin
+> Profile URL:        https://teleport.example.com:443
+  Logged in as:       teleport-admin
+  Cluster:            teleport.example.com
+  Roles:              access, editor
+  Logins:             root, ubuntu, ec2-user
+  Kubernetes:         enabled
+  Valid until:        2022-04-26 03:04:46 -0400 EDT [valid for 12h0m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+
+</Details>
+
+### Step 4/4. Enroll your infrastructure
+
+With Teleport, you can protect all of the resources in your infrastructure
+behind a single identity-aware access proxy, including servers, databases,
+applications, Kubernetes clusters, Windows desktops, and cloud provider APIs.
+
+To enroll a resource with Teleport, visit the Web UI and click the name of a
+resource on the sidebar, e.g., **Servers**, **Applications**, and
+**Kubernetes**. The Web UI will show you the steps you can take to enroll that
+resource.
+
+![Adding resources](../img/add-resources.png)
+
+In the **Servers** tab, you can see that you have already enrolled your Linux
+server. 
+
+### Next step: deploy agents
+
+Teleport **agents** proxy traffic to infrastructure resources like servers,
+databases, Kubernetes clusters, cloud provider APIs, and Windows desktops. 
 
-## Deploy a cluster
-
-Once you know which edition you would like to deploy, read our [Deploy a
-Cluster](./deploy-a-cluster/introduction.mdx) documentation for how to launch a
-fully fledged Teleport cluster in production. (If you are using Teleport
-Enterprise Cloud, you can skip this step.) This section shows you the best
-practices to follow for a high-availability Teleport cluster, and how to deploy
-Teleport on your cloud provider of choice.
-
-## Manage access
-
-Now that you have a running Teleport cluster, set up role-based access controls
-to enable secure access to your infrastructure.  You can define roles with
-granular permissions and use Teleport's integrations with Single Sign-On
-providers to automatically map these roles to users. You can also set up Access
-Requests to enable just-in-time access to your infrastructure. Read [Manage
-Access](./access-controls/introduction.mdx) to get started.
-
-## Manage your cluster
-
-With your Teleport cluster configured, you can now begin Day Two operations
-such as upgrades, adding agents to the cluster, and integrating Teleport with
-third-party tools. Read [Manage your
-Cluster](./management/introduction.mdx) for more information.
-
-## Add your infrastructure
-
-Teleport is protocol aware and provides functionality that is unique to each
-protocol it supports. To enable access to a protocol, deploy the appropriate
-Teleport service and configure it to communicate with resources in your
-infrastructure. 
-
-Read about how to enable access to:
-
-- [Servers](./server-access/getting-started.mdx), including OpenSSH servers that
-  [do not have Teleport installed](./server-access/guides/openssh.mdx)
-- [Kubernetes clusters](./kubernetes-access/introduction.mdx)
-- [Databases](./database-access/introduction.mdx)
-- [Applications](./application-access/introduction.mdx)
-- [Remote desktops](./desktop-access/introduction.mdx)
-
-You can also set up [Machine ID](./machine-id/introduction.mdx) to enable
-service accounts to access resources in your infrastructure with short-lived
-credentials.
-
-## Extend Teleport for your organization
-
-Teleport is highly customizable, exposing much of its functionality via a gRPC
-API. For example, you can build API clients to register infrastructure
-automatically or manage Access Requests using your organization's unique
-workflows. Read how to build applications that interact with Teleport's API in
-our [API guides](./api/introduction.mdx).
-
-## Learn more about Teleport
-
-Get more information about Teleport by reading our library of architecture,
-reference, and developer guides. See the
-[Upcoming Releases](./upcoming-releases.mdx) section for a glimpse of features we
-will release in the next Teleport version. Consult our
-[Reference](./reference/introduction.mdx) guides for comprehensive lists of
-configuration options, CLI flags, and more. For detailed explanations of how
-Teleport works, see the [Architecture](./architecture/introduction.mdx) section.
-
-Finally, if you're interested in adding to Teleport's documentation, view
-our [contribution guide](./contributing/documentation.mdx). 
-
-<TileSet>
-    <TileList title="For developers" icon="stack">
-        <TileListItem href="./connect-your-client/tsh.mdx#sharing-sessions">
-            Collaborate through session sharing.
-        </TileListItem>
-        <TileListItem href="./management/admin/labels.mdx">
-            Discover servers and clusters with dynamic labels.
-        </TileListItem>
-        <TileListItem href="./management/admin/adding-nodes.mdx#adding-a-node-located-behind-nat">
-            Connect to computing resources located behind firewalls or without static IPs.
-        </TileListItem>
-    </TileList>
-    <TileList title="For security teams" icon="lock">
-        <TileListItem href="./server-access/guides/openssh.mdx">
-            Capture sessions and manage certificates for an existing OpenSSH fleet.
-        </TileListItem>
-        <TileListItem href="./architecture/authentication.mdx#issuing-user-certificates">
-            Replace static keys and passwords with short-lived certificates.
-        </TileListItem>
-        <TileListItem href="./access-controls/guides/webauthn.mdx">
-            Enforce two-factor authentication for all of your infrastructure.
-        </TileListItem>
-    </TileList>
-    <TileList title="Reach out" icon="question">
-        <TileListItem href="https://github.com/gravitational/teleport/discussions">
-            Ask a question in the discussion forum.
-        </TileListItem>
-        <TileListItem href="https://goteleport.com/slack">
-            Join our Slack channel to get help with your setup.
-        </TileListItem>
-        <TileListItem href="https://github.com/gravitational/teleport/">
-            Create an issue on GitHub.
-        </TileListItem>
-        <TileListItem href="https://goteleport.com/get-started/">
-            Reach out to sales for a demo of Teleport Enterprise.
-        </TileListItem>
-        <TileListItem href="https://goteleport.com/signup/">
-            Start a free trial of Teleport Cloud.
-        </TileListItem>
-    </TileList>
-</TileSet>
+Step 4 showed you how to install agents manually, and you can also launch agents
+and enroll resources with them using infrastructure-as-code tools. For example,
+you can use Terraform to declare a pool of Teleport agents and configure them to
+proxy your infrastructure. Read [Deploy Teleport Agents with
+Terraform](agents/deploy-agents-terraform.mdx) to get started.
diff --git a/docs/pages/installation.mdx b/docs/pages/installation.mdx
index 5212be1ff35a5..3429d6dc6cb7c 100644
--- a/docs/pages/installation.mdx
+++ b/docs/pages/installation.mdx
@@ -2,7 +2,7 @@
 title: Installing Teleport
 description: How to install Teleport and Teleport's client tools on your platform, including binaries and instructions for Docker and Helm.
 h1: Installation
-videoBanner: VifXROQFjwg
+videoBanner: fjk29wqXm1A
 ---
 
 This guide shows you how to install Teleport binaries on your platform,
@@ -13,7 +13,7 @@ including:
 - `tbot`
 
 If you are new to Teleport, we recommend following our [getting started
-guide](./get-started.mdx).
+guide](./index.mdx).
 
 For best results, Teleport clients (`tsh`, `tctl`, `tbot`) should be the same major
 version as the cluster they are connecting to. Teleport servers are compatible
@@ -35,8 +35,8 @@ running Teleport on UNIX variants other than Linux \[1].
 | macOS v10.13+  (High Sierra)| yes | yes | yes | yes | yes |
 | Windows 10+ (rev. 1607) \[4] | no | no | yes | yes | no |
 
-\[1] *Teleport is written in Go and it's possible to build it on
-any OS supported by the [Golang toolchain](https://github.com/golang/go/wiki/MinimumRequirements)*.
+\[1] *Teleport is written in Go and many of these system requirements are due to the requirements
+of the [Go toolchain](https://github.com/golang/go/wiki/MinimumRequirements)*.
 
 \[2] *`tsh` is a Command Line Client (CLI) and Teleport Connect is a Graphical User Interface (GUI) desktop client. See
   [Using Teleport Connect](connect-your-client/teleport-connect.mdx) for usage and installation*.
@@ -107,21 +107,230 @@ information on obtaining Teleport binaries compatible with Teleport Cloud.
 
 ## Docker
 
+### Images
+
+We provide a pre-built Docker image for every version of Teleport. This section
+describes the available Docker images.
+
+These images are hosted on [Amazon ECR
+Public](https://gallery.ecr.aws/gravitational).
+
+#### Image suffixes
+
+For each of the image names listed in this section, you can specify attributes
+of the image by appending a suffix to the repository name or tag.
+
+Images with the `-distroless` suffix within the repository name include only the
+`teleport` binary and its runtime dependencies, with no shell or utility
+applications. An example is `public.ecr.aws/gravitational/teleport-distroless`
+for Teleport Community Edition.
+
+Images with the `*-distroless-debug` suffix within the repository name include a
+Busybox shell and tool suite in addition to Teleport, and are intended for
+troubleshooting deployments only. They are not intended for production use. An
+example is `public.ecr.aws/gravitational/teleport-distroless-debug`.
+
+You can specify the architecture of an image by appending a suffix to its tag.
+We support the following architecture suffixes: `amd64`, `arm`, and `arm64`. For
+example, if you want to pull the ARM64 image for
+`public.ecr.aws/gravitational/teleport`, you can use
+`public.ecr.aws/gravitational/teleport:(=teleport.version=)-arm64`. 
+
+`*-distroless` and `*-distroless-debug` images support multiple architectures
+natively, and do not require (or support) image suffixes. You can specify an
+architecture using the `--platform` flag of `docker pull` to pull the `arm`,
+`arm64` or `amd64` version of an image.
+
+#### Version tags
+
+Images point to a static version of Teleport. Use the image's tag to specify
+either:
+
+- The major, minor, and patch version (e.g., `(=teleport.version=)` for the
+  latest version of Teleport Community Edition).
+- The major version only, which implies the latest minor and patch numbers for
+  that major version. For example, `(=teleport.major_version=)` implies
+  `(=teleport.version=)`.
+
 <Tabs>
-<TabItem scope={["oss"]} label="Open Source">
+<TabItem label="Open Source" scope={["cloud", "enterprise"]}>
 
-(!docs/pages/includes/docker-images-oss.mdx!)
+|Image name|Troubleshooting Tools?|Image base|
+|-|-|-|
+|`(=teleport.latest_oss_docker_image=)`|No|[Distroless Debian 11](https://github.com/GoogleContainerTools/distroless)|
+|`(=teleport.latest_oss_debug_docker_image=)`|Yes|[Distroless Debian 11](https://github.com/GoogleContainerTools/distroless)|
+
+For testing, we always recommend that you use the latest released version of
+Teleport, which is currently `(=teleport.latest_oss_docker_image=)`.
+
+[Ubuntu 20.04](https://hub.docker.com/\_/ubuntu)-based images are available from
+our [Legacy Amazon ECR Public
+repository](https://gallery.ecr.aws/gravitational/teleport-ent).  Their use is
+considered deprecated, and they may be removed in future releases.
 
 </TabItem>
-<TabItem scope={["enterprise", "cloud"]} label="Commercial">
+<TabItem label="Enterprise" scope={["cloud", "enterprise"]}>
+
+| Image name | Includes troubleshooting tools | Image base |
+| - | - | - |
+| `(=teleport.latest_ent_docker_image=)` | No | [Distroless Debian 11](https://github.com/GoogleContainerTools/distroless) |
+| `(=teleport.latest_ent_debug_docker_image=)` | Yes | [Distroless Debian 11](https://github.com/GoogleContainerTools/distroless) |
 
-We provide pre-built `amd64`, `arm`, and `arm64` Docker images for every version of Teleport Enterprise.
+We also provide the following images for FIPS builds of Teleport Enterprise:
 
-(!docs/pages/includes/enterprise/docker-images.mdx!)
+| Image name | Includes troubleshooting tools | Image base |
+| - | - | - |
+| `gravitational/teleport-ent-fips-distroless` | No | [Distroless Debian 11](https://github.com/GoogleContainerTools/distroless) |
+| `gravitational/teleport-ent-fips-distroless-debug` | Yes | [Distroless Debian 11](https://github.com/GoogleContainerTools/distroless) |
+
+For testing, we always recommend that you use the latest release version of
+Teleport Enterprise, which is currently `(=teleport.latest_ent_docker_image=)`.
+
+[Ubuntu 20.04](https://hub.docker.com/\_/ubuntu)-based images for non-FIPS 
+Teleport are available from our [Legacy Amazon ECR Public repository](https://gallery.ecr.aws/gravitational/teleport-ent).
 
 </TabItem>
 </Tabs>
 
+### Running Teleport on Docker
+
+When running a container from one of the images listed above, consider the
+container equivalent to running the `teleport` binary. The Teleport container
+requires access to a file system and network ports.
+
+#### Configuration
+
+Teleport processes read their configuration from a local file path, which is
+`/etc/teleport.yaml` by default. Make sure this file path is mounted to your
+Teleport container.
+
+#### Data directory
+
+All Teleport processes read from and write to a data directory, which by default
+is `/var/lib/teleport`. Make sure the data directory is mounted to your Teleport
+container.
+
+#### License file
+
+If your Teleport Enterprise container runs the Auth Service, you will need to
+give it access to a license file at the path named in the configuration, which
+is `/var/lib/teleport/license.pem` by default. Make sure a license exists at
+this location in the Teleport container's data directory.
+
+#### Other file paths
+
+Depending on the configuration settings you assign on your Teleport container,
+you will need to make sure that any file paths you name are mounted on the
+container. 
+
+For example, if you are running the Teleport Proxy Service on a container, you
+need to mount the directory containing TLS credentials to your Teleport
+container, then assign the following fields in the container's configuration
+file to the appropriate paths:
+
+```yaml
+proxy_service:
+  https_keypairs:
+  - key_file: /my/path/key.pem
+    cert_file: /my/path/cert.pem
+```
+
+See the Teleport [Configuration Reference](reference/config.mdx) for whether a
+field you would like to assign requires a file path.
+
+#### Ports
+
+A single Teleport process can run multiple services, each of which listens on a
+specific set of ports depending on your configuration. See our [Networking
+Reference](reference/networking.mdx#ports) for the ports on your Teleport
+container to expose.
+
+### Example of running a Teleport container
+
+In this example, we will show you how to run the Teleport Auth and Proxy
+Services on a local Docker container using Teleport Community Edition. 
+
+Since this container uses a self-signed certificate, we do not recommend using
+this configuration to protect any infrastructure outside your workstation. You
+can, however, join other local Docker containers to it using the [token
+method](./agents/join-services-to-your-cluster/join-token.mdx).
+
+First, create directories in your home directory to mount to the container. The
+Teleport container will write its configuration and data to these directories:
+
+```code
+$ mkdir -p ~/teleport/config ~/teleport/data
+```
+
+Run `teleport configure` from the Teleport container to generate a configuration
+file. This sets the container's name to `localhost` so your browser can trust
+the Proxy Service's self-signed TLS certificate:
+
+```code
+$ docker run --hostname localhost --rm \
+  --entrypoint=/usr/local/bin/teleport \
+  <Var name="(=teleport.latest_oss_docker_image=)" /> configure --roles=proxy,auth > ~/teleport/config/teleport.yaml
+```
+
+Start Teleport on your container:
+
+```code
+$ docker run --hostname localhost --name teleport \
+  -v ~/teleport/config:/etc/teleport \
+  -v ~/teleport/data:/var/lib/teleport \
+  -p 3025:3025 -p 3080:3080 \
+  <Var name="(=teleport.latest_oss_docker_image=)" />
+```
+
+From there, open another terminal and make sure your Teleport container's web
+API is functioning as intended:
+
+```code
+$ curl --insecure https://localhost:3080/webapi/ping
+```
+
+You should see JSON output similar to the following:
+
+```json
+{
+  "auth": {
+    "type": "local",
+    "second_factor": "otp",
+    "preferred_local_mfa": "otp",
+    "local": {
+      "name": ""
+    },
+    "private_key_policy": "none",
+    "device_trust_disabled": true,
+    "has_motd": false
+  },
+  "proxy": {
+    "kube": {
+      "enabled": true,
+      "listen_addr": "0.0.0.0:3080"
+    },
+    "ssh": {
+      "listen_addr": "0.0.0.0:3080",
+      "tunnel_listen_addr": "0.0.0.0:3080",
+      "web_listen_addr": "0.0.0.0:3080"
+    },
+    "db": {
+      "postgres_listen_addr": "0.0.0.0:3080",
+      "mysql_listen_addr": "0.0.0.0:3080"
+    },
+    "tls_routing_enabled": true
+  },
+  "server_version": "12.1.5",
+  "min_client_version": "11.0.0",
+  "cluster_name": "localhost",
+  "automatic_upgrades": false
+}
+```
+
+We are using the `--insecure` flag to trust Teleport's self-signed certificate.
+In production, you will want to provision TLS credentials to the Proxy Service
+from a trusted CA, e.g., Let's Encrypt.
+
 ## Helm
 
 (!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
@@ -136,8 +345,10 @@ chart.
 
 ## macOS
 
-<Tabs dropdownCaption="Teleport Edition">
-<TabItem label="Installer" options="Open Source" scope="oss">
+<Tabs dropdownView dropdownCaption="Teleport Edition">
+<TabItem label="Open Source" scope="oss">
+  <Tabs>
+  <TabItem label="Teleport package" >
   You can download one of the following .pkg installers for macOS:
 
   |Link|Binaries|
@@ -160,7 +371,7 @@ chart.
   ```
 
 </TabItem>
-<TabItem label="Homebrew" options="Open Source">
+<TabItem label="Homebrew">
 
   <Notice type="danger">
 
@@ -200,10 +411,17 @@ chart.
   against `tsh version` and `tctl version`.
 
 </TabItem>
-<TabItem label="Installer " options="Enterprise,Cloud"  scope={["enterprise", "cloud"]}>
+</Tabs>
+</TabItem>
+<TabItem label="Enterprise" scope="enterprise">
 
 (!docs/pages/includes/enterprise/install-macos.mdx!)
 
+</TabItem>
+<TabItem label="Cloud" scope="cloud">
+
+(!docs/pages/includes/cloud/install-macos.mdx!)
+
 </TabItem>
 </Tabs>
 
diff --git a/docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx b/docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx
index 0c49b5efbf7d0..8131a74d02107 100644
--- a/docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx
+++ b/docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx
@@ -1,6 +1,6 @@
 - [Kubernetes](https://kubernetes.io) >= v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
 - [Helm](https://helm.sh) >= v(=helm.version=)
 
-Verify that Helm and Kubernetes are installed and up to date.
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
 
-(!docs/pages/includes/permission-warning.mdx!)
\ No newline at end of file
+(!docs/pages/includes/permission-warning.mdx!)
diff --git a/docs/pages/kubernetes-access/register-clusters/iam-joining.mdx b/docs/pages/kubernetes-access/register-clusters/iam-joining.mdx
index a530f1c92a8d4..cbbcf628bde4f 100644
--- a/docs/pages/kubernetes-access/register-clusters/iam-joining.mdx
+++ b/docs/pages/kubernetes-access/register-clusters/iam-joining.mdx
@@ -74,9 +74,9 @@ Then create the IAM policy:
 $ aws iam create-policy --policy-name <Var name="kube-iam-policy"/> --policy-document file://iam-policy.json
 {
     "Policy": {
-        "PolicyName": "kube-iam-policy",
+        "PolicyName": "<Var name="kube-iam-policy"/>",
         "PolicyId": "ANPAW2Y2Q2Y2Y2Y2Y2Y2Y",
-        "Arn": "arn:aws:iam::aws:policy/kube-iam-policy",
+        "Arn": "arn:aws:iam::aws:policy/<Var name="kube-iam-policy"/>",
         "Path": "/",
         "DefaultVersionId": "v1",
         "AttachmentCount": 0,
@@ -133,10 +133,10 @@ Kubernetes service account.
 
 ```code
 $ kubectl create ns <Var name="teleport-agent"/>
-namespace/teleport-agent created
+namespace/<Var name="teleport-agent"/> created
 
 $ kubectl create sa <Var name="teleport-kube-agent-sa"/> -n  <Var name="teleport-agent"/>
-serviceaccount/teleport-kube-agent-sa created
+serviceaccount/<Var name="teleport-kube-agent-sa"/> created
 ```
 
 Then we need to create the IAM role and trust relationship. For that, we need
diff --git a/docs/pages/machine-id/getting-started.mdx b/docs/pages/machine-id/getting-started.mdx
index 37f002eef4f69..471c4a3df2720 100644
--- a/docs/pages/machine-id/getting-started.mdx
+++ b/docs/pages/machine-id/getting-started.mdx
@@ -71,7 +71,7 @@ auditor no-login-6566121f-b602-47f1-a118-c9c618ee5aec             session:list,r
 editor                                                            user:list,create,read,update,delete,...
 ```
 
-Machine ID can join with a token or the [IAM Method](../management/join-services-to-your-cluster/aws-iam.mdx) on AWS.
+Machine ID can join with a token or the [IAM Method](../agents/join-services-to-your-cluster/aws-iam.mdx) on AWS.
 
 Assuming that you are using the default `access` role, ensure that you use the 
 `--logins` flag when adding your bot to specify the SSH logins that you wish to 
diff --git a/docs/pages/machine-id/guides/host-certificate.mdx b/docs/pages/machine-id/guides/host-certificate.mdx
index f8f0222439cea..3c25b06cf0afc 100644
--- a/docs/pages/machine-id/guides/host-certificate.mdx
+++ b/docs/pages/machine-id/guides/host-certificate.mdx
@@ -389,7 +389,7 @@ The Machine ID host is now fully configured to accept connections from a `tsh` u
 To confirm this, enter the following command from your local machine logged into the cluster using `tsh`:
 
 ```code
-$ tsh ssh root@nodename.my.domain.com:22
+$ tsh ssh -p 22 root@nodename.my.domain.com
 ```
 
 The connection should successfully complete without the need to manually enter any additional credentials.
@@ -402,6 +402,6 @@ to connect to OpenSSH with Teleport, see the following documentation:
 - [Using Teleport With OpenSSH](../../server-access/guides/openssh.mdx)
 - [Using SSH Host Certificates](https://goteleport.com/blog/how-to-ssh-properly/)
 - [Machine ID Configuration Reference](../reference/configuration.mdx)
-- [Joining Nodes using the IAM method](../../management/join-services-to-your-cluster/aws-ec2.mdx)
+- [Joining Nodes using the IAM method](../../agents/join-services-to-your-cluster/aws-ec2.mdx)
 
 [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../reference/telemetry.mdx)
diff --git a/docs/pages/machine-id/guides/jenkins.mdx b/docs/pages/machine-id/guides/jenkins.mdx
index 53ec34d93a0c4..28526225c6e69 100644
--- a/docs/pages/machine-id/guides/jenkins.mdx
+++ b/docs/pages/machine-id/guides/jenkins.mdx
@@ -17,7 +17,6 @@ You will need the following tools to use Teleport with Jenkins.
 
 - `ssh` OpenSSH tool
 - Jenkins
-
 - (!docs/pages/includes/tctl.mdx!)
 
 ## Architecture
diff --git a/docs/pages/management/admin/labels.mdx b/docs/pages/management/admin/labels.mdx
index b54588ebc3a52..ceb1d7c718472 100644
--- a/docs/pages/management/admin/labels.mdx
+++ b/docs/pages/management/admin/labels.mdx
@@ -181,7 +181,7 @@ your Node.
 
 Run the following command to get the current logins for your user:
 
-<ScopedBlock scope={["oss", "enterprise"]}>
+<ScopedBlock scope={["oss"]}>
 
 ```code
 $ tsh status
@@ -195,6 +195,21 @@ $ tsh status
   Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
 ```
 
+</ScopedBlock>
+<ScopedBlock scope={["enterprise"]}>
+
+```code
+$ tsh status
+> Profile URL:        https://teleport.example.com:443
+  Logged in as:       myuser
+  Cluster:            teleport.example.com
+  Roles:              access, editor, reviewer
+  Logins:             -teleport-nologin-d4bc1dad-ce49-4bbe-925d-a67f8d2d6afe
+  Kubernetes:         enabled
+  Valid until:        2022-04-27 22:26:50 -0400 EDT [valid for 11h40m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+
 </ScopedBlock>
 <ScopedBlock scope={["cloud"]}>
 
@@ -203,7 +218,7 @@ tsh status
 > Profile URL:        https://mytenant.teleport.sh:443
   Logged in as:       myuser
   Cluster:            mytenant.teleport.sh
-  Roles:              access, editor
+  Roles:              access, editor, reviewer
   Logins:             -teleport-nologin-d4bc1dad-ce49-4bbe-925d-a67f8d2d6afe
   Kubernetes:         enabled
   Valid until:        2022-04-27 22:26:50 -0400 EDT [valid for 11h40m0s]
diff --git a/docs/pages/management/admin/self-signed-certs.mdx b/docs/pages/management/admin/self-signed-certs.mdx
index 03904d263c8e3..d833d07968cfd 100644
--- a/docs/pages/management/admin/self-signed-certs.mdx
+++ b/docs/pages/management/admin/self-signed-certs.mdx
@@ -33,8 +33,8 @@ to the Proxy Service.
 <Tabs>
 <TabItem scope={["oss"]} label="Open Source">
 
-- A running Teleport cluster. For details on how to set this up, see one of our
-  [Getting Started](/docs/getting-started) guides (skip TLS certificate setup).
+- A running Teleport cluster. For details on how to set this up, see our
+  [Getting Started](../../index.mdx) guide (skip TLS certificate setup).
 
 - A Teleport Proxy Service which does not have certificates or ACME automatic certificates configured.
 For example, this Teleport Proxy Service configuration would use self-signed certs:
@@ -50,14 +50,14 @@ For example, this Teleport Proxy Service configuration would use self-signed cer
 
 - (!docs/pages/includes/tctl-tsh-prerequisite.mdx!)
 
-  See [Installation](/docs/installation.mdx) for details.
+  See [Installation](../../installation.mdx) for details.
 
 </TabItem>
 <TabItem
   scope={["enterprise"]} label="Enterprise">
 
 - A running Teleport cluster. For details on how to set this up, see our Enterprise
-  [Getting Started](/docs/enterprise/getting-started) guide.
+  [Getting Started](../../choose-an-edition/teleport-enterprise/introduction.mdx) guide.
 
 - A Teleport Proxy Service which does not have certificates or ACME automatic certificates configured.
 For example, this Teleport Proxy Service configuration would use self-signed certs:
@@ -205,7 +205,7 @@ flag](../../connect-your-client/teleport-connect.mdx#skipping-tls-certificate-ve
 
 ## Further reading
 
-- [Configuring Teleport TLS Certs](../../get-started.mdx#configure-teleport)
+- [Configuring Teleport TLS Certs](../../index.mdx#configure-teleport)
 - [Run Teleport as a systemd Daemon](./daemon.mdx)
 - [Teleport Proxy Service](../../architecture/proxy.mdx)
 - [Teleport Authentication](../../architecture/authentication.mdx)
diff --git a/docs/pages/management/admin/trustedclusters.mdx b/docs/pages/management/admin/trustedclusters.mdx
index da1d1f990837e..6db59f01a06a1 100644
--- a/docs/pages/management/admin/trustedclusters.mdx
+++ b/docs/pages/management/admin/trustedclusters.mdx
@@ -27,7 +27,7 @@ A leaf cluster always creates an outbound reverse SSH tunnel to the root cluster
 <Notice type="tip">
 Individual nodes and proxies can create reverse tunnels to proxy services without creating a new cluster.
 You don't need to set up a trusted cluster just to connect a couple of servers, kubernetes clusters or
-databases behind a firewall. For more information, see [Adding Nodes to the Cluster](../join-services-to-your-cluster/join-token.mdx).
+databases behind a firewall. For more information, see how to [join a service to your cluster](../../agents/join-services-to-your-cluster.mdx).
 </Notice>
 
 When a user tries to connect to any resource inside the leaf cluster using the root's proxy
@@ -45,43 +45,46 @@ This guide will explain how to:
 <TabItem scope={["oss"]} label="Open Source">
 
 - Two running Teleport clusters. For details on how to set up your clusters, see
-  one of our [Getting Started](/docs/getting-started) guides.
+  our [Getting Started](../../index.mdx) guide.
 
 - (!docs/pages/includes/tctl-tsh-prerequisite.mdx!)
 
-  See [Installation](/docs/installation.mdx) for details.
+  See [Installation](../../installation.mdx) for details.
 
-- A Teleport Node that is joined to one of your clusters. We will refer to this
+- A Teleport agent that is joined to one of your clusters. We will refer to this
   cluster as the **leaf cluster** throughout this guide.
 
-  See [Adding Nodes](../join-services-to-your-cluster.mdx) for how to launch a
-  Teleport Node in your cluster.
+  See [Join Services to your
+  Cluster](../../agents/join-services-to-your-cluster.mdx) for how to launch a
+  Teleport agent in your cluster.
 
 </TabItem>
 <TabItem
   scope={["enterprise"]} label="Enterprise">
 
 - Two running Teleport clusters. For details on how to set up your clusters, see
-  our Enterprise [Getting Started](/docs/enterprise/getting-started) guide.
+  our Enterprise [Getting
+  Started](../../choose-an-edition/teleport-enterprise/introduction.mdx) guide.
 
 - (!docs/pages/includes/enterprise/tctl-tsh-prerequisite.mdx!)
 
 - A Teleport Node that is joined to one of your clusters. We will refer to this
   cluster as the **leaf cluster** throughout this guide.
 
-  See [Adding Nodes](../join-services-to-your-cluster.mdx) for how to launch a Teleport Node in
+  See [Join Services to your Cluster](../../agents/join-services-to-your-cluster.mdx) for how to launch a Teleport agent in
   your cluster.
 
 </TabItem>
 <TabItem scope={["cloud"]}
   label="Teleport Cloud">
 
-- A Teleport Cloud account. If you do not have one, visit the
-  [sign up page](https://goteleport.com/signup/) to begin your free trial.
+- A Teleport Enterprise Cloud account. If you do not have one, visit the [sign
+  up page](https://goteleport.com/signup/) to begin a free trial of Teleport
+  Team and upgrade to Teleport Enterprise Cloud. 
 
 - A second Teleport cluster, which will act as the leaf cluster. For details on
-how to set up this cluster, see one of our
-[Getting Started](/docs/getting-started) guides.
+how to set up this cluster, see our
+[Getting Started](../../index.mdx) guide.
 
   As an alternative, you can set up a second Teleport Cloud account.
 
@@ -90,8 +93,8 @@ how to set up this cluster, see one of our
 - A Teleport Node that is joined to one of your clusters. We will refer to this
   cluster as the **leaf cluster** throughout this guide.
 
-  See [Adding Nodes](../join-services-to-your-cluster.mdx) for how to launch a
-  Teleport Node in your cluster.
+  See [Join Services to your Cluster](../../agents/join-services-to-your-cluster.mdx) for how to launch a
+  Teleport agent in your cluster.
 
 </TabItem>
 </Tabs>
@@ -240,7 +243,7 @@ You can create a join token using the `tctl` tool.
 
 First, log out of all clusters and log in to the root cluster.
 
-<ScopedBlock scope={["oss", "enterprise"]}>
+<ScopedBlock scope={["oss"]}>
 
 ```code
 $ tsh logout
@@ -255,6 +258,22 @@ $ tsh login --user=myuser --proxy=rootcluster.example.com
   Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
 ```
 
+</ScopedBlock>
+<ScopedBlock scope={["enterprise"]}>
+
+```code
+$ tsh logout
+$ tsh login --user=myuser --proxy=rootcluster.example.com
+> Profile URL:        https://rootcluster.example.com:443
+  Logged in as:       myuser
+  Cluster:            rootcluster.example.com
+  Roles:              access, auditor, editor, reviewer
+  Logins:             root
+  Kubernetes:         enabled
+  Valid until:        2022-04-29 03:07:22 -0400 EDT [valid for 12h0m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+
 </ScopedBlock>
 <ScopedBlock scope={["cloud"]}>
 
@@ -263,7 +282,7 @@ $ tsh login --user=myuser --proxy=myrootclustertenant.teleport.sh
 > Profile URL:        https://rootcluster.teleport.sh:443
   Logged in as:       myuser
   Cluster:            rootcluster.teleport.sh
-  Roles:              access, auditor, editor
+  Roles:              access, auditor, editor, reviewer
   Logins:             root
   Kubernetes:         enabled
   Valid until:        2022-04-29 03:07:22 -0400 EDT [valid for 12h0m0s]
@@ -276,9 +295,9 @@ Execute the following command on your development machine:
 
 ```code
 # Generates a Trusted Cluster token to allow an inbound connection from a leaf cluster:
-$ tctl tokens add --type=trusted_cluster --ttl=15m
+$ tctl tokens add --type=trusted_cluster --ttl=5m
 The cluster invite token: (=presets.tokens.first=)
-This token will expire in 15 minutes
+This token will expire in 5 minutes
 
 Use this token when defining a trusted cluster resource on a remote cluster.
 ```
@@ -286,6 +305,12 @@ Use this token when defining a trusted cluster resource on a remote cluster.
 This command generates a Trusted Cluster join token. The token can be used
 multiple times and has an expiration time of 5 minutes.
 
+<Details title="Optional: Add labels">
+The `--labels` flag will add labels to the trusted cluster. This lets teams use
+the same RBAC controls used on individual resources to approve or deny access
+to clusters.
+</Details>
+
 Copy the join token for later use. If you need to display your join token again,
 run the following command against your root cluster:
 
@@ -751,7 +776,7 @@ certificate authority. A certificate contains four important pieces of data:
 - Metadata (certificate extensions): additional data protected by the signature
   above. Teleport uses the metadata to store the list of user roles and SSH
   options like "permit-agent-forwarding".
-- The expiration date.
+- The expiration date, or time-to-live (**TTL**).
 
 When a user from the root cluster attempts to access a Node in the leaf cluster,
 the leaf cluster's Auth Service authenticates the user's certificate and reads
@@ -762,7 +787,7 @@ these pieces of data from it. It then performs the following actions:
   cluster with one of the remote user's roles.
 - Checks if the local role allows the requested identity (Unix login) to have
   access.
-- Checks that the certificate has not expired.
+- Checks that the certificate has not expired. The TTL is set by the root cluster.
 
 </Details>
 
@@ -786,10 +811,12 @@ these pieces of data from it. It then performs the following actions:
   type="tip"
   title="Note"
 >
+Trusted Clusters work only in one direction. In the example above, users from
+the leaf cluster cannot see or connect to Nodes in the root cluster.
 
-  Trusted Clusters work only in one direction. In the example above, users from
-  the leaf cluster cannot see or connect to Nodes in the root cluster.
-
+The Teleport root cluster's Web UI will not populate available OS users for
+leaf cluster Nodes. When using the web UI, type in the host user when creating
+SSH sessions.
 </Admonition>
 
 ## Step 5/5. Remove trust between your clusters
diff --git a/docs/pages/management/admin/users.mdx b/docs/pages/management/admin/users.mdx
index 2c6f700c1e626..914687c44e67b 100644
--- a/docs/pages/management/admin/users.mdx
+++ b/docs/pages/management/admin/users.mdx
@@ -37,9 +37,16 @@ Let's look at this table:
 
 Let's add a new user to Teleport using the `tctl` tool:
 
+<ScopedBlock scope={["oss"]}>
 ```code
 $ tctl users add joe --logins=joe,root --roles=access,editor
 ```
+</ScopedBlock>
+<ScopedBlock scope={["enterprise", "cloud"]}>
+```code
+$ tctl users add joe --logins=joe,root --roles=access,editor,reviewer
+```
+</ScopedBlock>
 
 Teleport generates an auto-expiring token (with a TTL of one hour) and prints
 the token URL, which must be used before the TTL expires.
diff --git a/docs/pages/management/dynamic-resources.mdx b/docs/pages/management/dynamic-resources.mdx
new file mode 100644
index 0000000000000..ff813489cf200
--- /dev/null
+++ b/docs/pages/management/dynamic-resources.mdx
@@ -0,0 +1,279 @@
+---
+title: Using Dynamic Resources
+description: An introduction to Teleport's dynamic resources, which make it possible to apply settings to remote clusters using infrastructure as code.
+tocDepth: 3
+---
+
+This section explains how to manage Teleport's **dynamic resources**, which make
+it possible to adjust the behavior of your Teleport cluster as your
+infrastructure changes.
+
+## What is a dynamic resource?
+
+There are two ways to configure a Teleport cluster:
+
+- **Static configuration file:** At startup, a Teleport process reads a
+  configuration file from the local filesystem (the default path is
+  `/etc/teleport.yaml`). Static configuration settings control aspects of a
+  cluster that are not expected to change frequently, like the ports that
+  services listen on. 
+- **Dynamic resources:** Dynamic resources control aspects of your cluster that
+  are likely to change over time, such as roles, local users, and registered
+  infrastructure resources.
+
+This approach makes it possible to incrementally adjust your Teleport
+configuration without restarting Teleport instances. 
+
+```mermaid
+flowchart LR
+subgraph backend["Cluster state backend"]
+  direction LR
+  resources["Dynamic resources"]
+end 
+
+subgraph cluster[Teleport cluster]
+  subgraph auth[Auth Service]
+    conf1["Static config"]
+  end 
+  subgraph proxy[Proxy Service]
+    conf2["Static config"]
+  end 
+end
+
+auth-->backend
+subgraph clients["API clients"]
+  terraform["Terraform Provider"]
+  operator["Kubernetes Operator"]
+  tctl
+end
+terraform & operator & tctl-->proxy
+proxy-.->auth
+```
+
+A cluster is composed of different objects (i.e., resources) and there are three
+common operations that can be performed on them: `get` , `create` , and `remove`
+.
+
+Every resource in Teleport has three required fields:
+
+- `kind`: The type of resource
+- `name`: A required field in the `metadata` to uniquely identify the resource
+- `version`: The version of the resource format
+
+All other fields are specific to a resource.
+
+While Teleport Enterprise Cloud and Teleport Team do not expose the static
+configuration file to operators, they do use a static configuration file for
+certain settings. Read how Teleport [reconciles static and dynamic
+resources](#reconciling-the-configuration-file-with-dynamic-resources) to
+understand how to see the values of static configuration settings that also
+appear in dynamic resources.
+
+When examining a dynamic resource, note that some of the fields you will see are
+used only internally and are not meant to be changed. Others are reserved for
+future use.
+
+## Managing dynamic resources
+
+Teleport provides three methods for applying dynamic resources: the `tctl`
+client tool, Teleport Terraform provider, and Kubernetes Operator.
+
+All three methods connect to the Teleport Auth Service's gRPC endpoint in order
+to manipulate cluster resources stored on the Auth Service backend. The design
+of Teleport's configuration interface makes it well suited for
+infrastructure-as-code and GitOps approaches.
+
+### YAML documents with `tctl`
+
+You can define resources as YAML documents and apply them using the `tctl`
+client tool. Here is an example of a `role` resource that allows access to
+servers with the label `env:test`:
+
+```yaml
+kind: role
+version: v6
+metadata:
+  name: developer
+spec:
+  allow:
+    logins: ['ubuntu', 'debian', '{{internal.logins}}']
+    node_labels:
+      'env': 'test'
+```
+
+Since `tctl` works from the local filesystem, you can write commands that apply
+all configuration documents in a directory tree. See the [CLI
+reference](../reference/cli.mdx#tctl) for more information on `tctl`.
+
+### Teleport Terraform provider
+
+Teleport's Terraform provider lets you manage your Teleport resources within the
+same infrastructure-as-code source as the rest of your infrastructure. There is
+a Terraform resource for each Teleport configuration resource. For example:
+
+```text
+resource "teleport_role" "developer" {
+  metadata = {
+    name = "developer"
+  }
+
+  spec = {
+    allow = {
+      logins = ["ubuntu", "debian", "{{internal.logins}}"]
+
+      node_labels = {
+        key   = ["env"]
+        value = ["test"]
+      }
+    }
+  }
+}
+```
+
+- [Get started with the Terraform
+  provider](./dynamic-configuration/terraform-provider.mdx).
+- [Use Teleport's Terraform provider with
+  Spacelift](./dynamic-configuration/spacelift.mdx).
+
+### Teleport Kubernetes Operator
+
+The Teleport Kubernetes Operator lets you apply Teleport resources as Kubernetes
+resources so you can manage your Teleport settings alongside the rest of your
+Kubernetes infrastructure. Here is an example of a `TeleportRole` resource,
+which is equivalent to the two roles shown above:
+
+```yaml
+apiVersion: resources.teleport.dev/v5
+kind: TeleportRole
+metadata:
+  name: developer
+spec:
+  allow:
+    logins: ['ubuntu', 'debian', '{{internal.logins}}']
+    node_labels:
+      'env': 'test'
+```
+
+[Get started with the Kubernetes Operator](dynamic-resources/teleport-operator.mdx). 
+
+## Reconciling the configuration file with dynamic resources
+
+Some dynamic resources assign the same settings as fields within
+Teleport's static configuration file. For these fields, the Teleport Auth
+Service reconciles static and dynamic configurations on startup and when you
+create or remove a Teleport resource.
+
+### Configuration resources that apply to static configuration fields
+
+There are four dynamic resources that share fields with the
+static configuration file:
+
+- `session_recording_config`
+- `cluster_auth_preference`
+- `cluster_networking_config`
+- `ui_config`
+
+#### `session_recording_config`
+
+|Dynamic resource field|Static configuration field|
+|---|---|
+|`spec.mode`|`auth_service.session_recording`|
+|`spec.proxy_checks_host_keys`|`auth_service.proxy_checks_host_keys`|
+
+#### `cluster_auth_preference`
+
+|Dynamic resource field|Static configuration field|
+|---|---|
+|`spec.type`|`auth_service.authentication.type`|
+|`spec.second_factor`|`auth_service.authentication.second_factor`|
+|`spec.connector_name`|`auth_service.authentication.connector_name`
+|`spec.u2f`|`auth_service.authentication.u2f`|
+|`spec.disconnect_expired_cert`|`auth_service.disconnect_expired_cert`|
+|`spec.allow_local_auth`|`auth_service.authentication.local_auth`|
+|`spec.message_of_the_day`|`auth_service.message_of_the_day`|
+|`spec.locking_mode`|`auth_service.authentication.locking_mode`|
+|`spec.webauthn`|`auth_service.authentication.webauthn`|
+|`spec.require_session_mfa`|`auth_service.authentication.require_session_mfa`|
+|`spec.allow_passwordless`|`auth_service.authentication.passwordless`|
+|`spec.device_trust`|`auth_service.authentication.device_trust`|
+|`spec.idp`|`proxy_service.idp`|
+|`spec.allow_headless`|`auth_service.authentication.headless`|
+
+#### `cluster_networking_config`
+
+|Dynamic resource field|Static configuration field|
+|---|---|
+|`spec.client_idle_timeout`|`auth_service.client_idle_timeout`|
+|`spec.keep_alive_interval`|`auth_service.keep_alive_interval`|
+|`spec.keep_alive_count_max`|`auth_service.keep_alive_count_max`|
+|`spec.session_control_timeout`|`auth_service.session_control_timeout`|
+|`spec.idle_timeout_message`|`auth_service.client_idle_timeout_message`|
+|`spec.web_idle_timeout`|`auth_service.web_idle_timeout`|
+|`spec.proxy_listener_mode`|`auth_service.proxy_listener_mode`|
+|`spec.routing_strategy`|`auth_service.routing_strategy`|
+|`spec.tunnel_strategy`|`auth_service.tunnel_strategy`|
+|`spec.proxy_ping_interval`|`auth_service.proxy_ping_interval`|
+
+#### `ui_config`
+
+|Dynamic resource field|Static configuration field|
+|---|---|
+|`spec.scrollback_lines`|`proxy_service.ui.scrollback_lines`|
+
+### Origin labels
+
+The Teleport Auth Service applies the `teleport.dev/origin` label to
+configuration resources to indicate whether they originated from the static
+configuration file, a dynamic configuration resource, or the default value.
+
+Here are possible values of the `teleport.dev/origin` label:
+
+- `defaults`
+- `config-file`
+- `dynamic`
+
+When the Auth Service starts up, it looks up the values of static configuration
+fields that correspond to fields in dynamic configuration resources. If any of
+these have values, it creates the corresponding dynamic configuration resources
+and stores them in its backend. 
+
+For any static configuration fields without a value, the Auth Service checks
+whether the backend contains the corresponding dynamic configuration resource.
+If not, it creates one with default values and the
+`teleport.dev/origin=defaults` label.
+
+If you attempt to create a dynamic configuration resource after the Auth Service
+has already loaded the configuration from a static configuration file, the Auth
+Service will return an error.
+
+If you remove a dynamic configuration resource, the Auth Service will restore
+its configuration fields to the default values and add the
+`teleport.dev/origin=defaults` label.
+
+<Notice type="tip">
+
+Cloud-hosted Teleport deployments use configuration files, but these are not
+available for operators to modify. Users of Teleport Enterprise Cloud and
+Teleport Team may see configuration resources with the
+`teleport.dev/origin=config-file` label.
+
+</Notice>
+
+## Further reading
+
+### Configuration references
+
+- For a comprehensive reference of Teleport's static configuration options, read
+  the [Configuration Reference](../reference/config.mdx).
+- To see the dynamic configuration resources available to apply, read the
+  [Configuration Resource Reference](../reference/resources.mdx). There are also
+  dedicated configuration resource references for
+  [applications](../application-access/reference.mdx#application-resource) and
+  [databases](../database-access/reference/configuration.mdx#database-resource).
+
+### Other ways to use the Teleport API
+
+The Teleport Kubernetes Operator, Terraform provider, and `tctl` are all clients
+of the Teleport Auth Service's gRPC API. To build your own API client to extend
+Teleport for your organization's needs, read our [API
+guides](../api/introduction.mdx).
diff --git a/docs/pages/management/dynamic-resources/spacelift.mdx b/docs/pages/management/dynamic-resources/spacelift.mdx
new file mode 100644
index 0000000000000..a7e605f6cc96d
--- /dev/null
+++ b/docs/pages/management/dynamic-resources/spacelift.mdx
@@ -0,0 +1,289 @@
+---
+title: "Manage Dynamic Configuration Resources with Spacelift"
+description: "Learn how to set up Spacelift to manage dynamic configuration resources via GitOps and Teleport's Terraform provider."
+---
+
+You can use Spacelift with Teleport's Terraform provider to manage dynamic
+configuration resources via GitOps and infrastructure as code. This gives you an
+audit trail of changes to your Teleport configuration and a single source of
+truth for operators to examine.
+
+```mermaid
+flowchart TB
+subgraph Spacelift
+  idfile["Teleport Identity File"]-->spacelift["Spacelift Worker"]
+end
+
+repo["GitHub Repo"]--"Configuration Resources (Terraform)"--->spacelift
+
+spacelift-->proxy["Teleport Proxy Service"]
+proxy-- "gRPC API Traffic" -->auth["Teleport Auth Service"]
+```
+
+This guide will show you how to set up the GitOps platform Spacelift with the
+Teleport Terraform provider. While following this guide, you will create a
+Teleport user and role with no privileges in order to demonstrate using
+Spacelift to create dynamic resources. 
+
+If you are using another GitOps platform, the setup should be similar:
+
+- Create a Teleport user and role for the GitOps platform with permissions to
+  manage configuration resources.
+- Upload a Teleport identify file to the GitOps platform that it will use to
+  authenticate as the Teleport user and role you created.
+- Configure the GitOps platform to read from a GitHub repository with a
+  Terraform configuration that tells the Teleport provider where to find your
+  identity file and Teleport Proxy Service.
+- Define Teleport configuration resources as Terraform resources within the
+  GitHub repository, prompting the GitOps platform to apply your Terraform
+  configuration.
+
+## Prerequisites
+
+(!docs/pages/includes/edition-prereqs-tabs.mdx!)
+- A Spacelift account with permissions to create stacks.
+- A GitHub repository where you will store your Terraform configuration. For the
+  purpose of the demo project we show in this guide, the repository should be
+  empty, though you can use an existing repository connected to Spacelift as
+  well.
+- The GitHub app for Spacelift installed for your GitHub repository. Install
+  this app by visiting its [page on
+  GitHub](https://github.com/apps/spacelift-io/).
+- (!docs/pages/includes/tctl.mdx!)
+
+<Admonition type="tip" title="Using identify files">
+
+For simplicity, the identify file we will export in this guide will have a long
+time to live. In a production environment, you will want to provision
+short-lived identify files via Machine ID.
+
+After getting familiar with this guide, read our [Machine ID Getting Started
+Guide](../../machine-id/getting-started.mdx) to get started with Machine ID. You
+will need to run your own compute workload to upload Teleport identity files to
+Spacelift using the `spacectl stack environment mount` command of the
+[`spacectl`](https://github.com/spacelift-io/spacectl) CLI (or another method
+that takes advantage of Spacelift's GraphQL API).
+
+</Admonition>
+
+## Step 1/4. Add a Terraform configuration to your repository
+
+Clone your GitHub repository. Add the following to a file called `main.tf`,
+which configures the Teleport Terraform provider:
+
+```text
+terraform {
+  required_providers {
+    teleport = {
+      source  = "terraform.releases.teleport.dev/gravitational/teleport"
+      version = ">= (=teleport.plugin.version=)"
+    }
+  }
+}
+
+provider "teleport" {
+  addr               = "proxy.example.com:443"
+  identity_file_path = "/mnt/workspace/auth.pem"
+}
+```
+
+Change `proxy.example.com:443` to the host and HTTPS port of your Teleport Proxy
+Service.
+
+Commit the change, merge it to your `main` branch, and push to your remote
+repository (or use a pull request).
+
+## Step 2/4. Create a Spacelift stack
+
+From the Spacelift web UI, click **Stacks > Add stack**.
+
+In the **NAME STACK** tab, for "Name", use "Teleport" and click **CONTINUE**. 
+
+In the **INTEGRATE VCS** tab, make sure the **Repository** field points to the
+repository you chose for this guide.  Select your GitHub repository and the
+branch you plan to use as the base branch for pull requests. Click **CONTINUE**.
+
+In the **CONFIGURE BACKEND** tab, leave all settings at their defaults and click
+**CONTINUE**. Do the same with the **DEFINE BEHAVIOR** tab and click **SAVE
+STACK**.
+
+Your new stack should resemble the following:
+
+![New Spacelift stack](../../../img/management/spacelift/newstack.png)
+
+## Step 3/4. Grant Teleport permissions to Spacelift
+
+In this section, you will create a Teleport user and role for Spacelift, plus a
+role that can *impersonate* the Spacelift user in order to export an identity
+file. You will then export an identity file and upload it to Spacelift.
+
+Since Teleport manages RBAC permissions via configuration resources, and you
+have not set up Spacelift yet, you must create the resources in this section
+outside of Spacelift. After that, Spacelift can manage all of your Teleport
+configuration resources.
+
+### Create a Spacelift user and role
+
+Create a local Teleport user named `spacelift` and a matching role granting the
+necessary permissions for Terraform to manage resources in your cluster.
+
+On your workstation, _outside_ the git repository you connected to Spacelift,
+add the following content to a file called `spacelift.yaml`:
+
+```yaml
+kind: role
+metadata:
+  name: spacelift
+spec:
+  allow:
+    rules:
+      - resources:
+        - role
+        - user
+        verbs: ['list','create','read','update','delete']
+version: v6
+---
+kind: user
+metadata:
+  name: spacelift
+spec:
+  roles: ['spacelift']
+version: v2
+```
+
+This is a minimal version of the configuration you will need to provide to
+Spacelift, and is only permitted to manage Teleport roles. 
+
+Create the `spacelift` user and role.
+
+```code
+$ tctl create spacelift.yaml
+role 'spacelift' has been created
+user "spacelift" has been created
+```
+
+### Enable impersonation
+
+The `spacelift` user cannot log in to Teleport to retreive credentials, so
+another user must **impersonate** this user in order to request credentials on
+`spacelift`'s behalf.
+
+Create a role that enables your user to impersonate the Terraform user. Paste
+the following YAML document into a file called `spacelift-impersonator.yaml`:
+
+```yaml
+kind: role
+version: v6
+metadata:
+  name: spacelift-impersonator
+spec:
+  allow:
+    impersonate:
+      users: ['spacelift']
+      roles: ['spacelift']
+```
+
+Next, create the role:
+
+```code
+$ tctl create spacelift-impersonator.yaml
+```
+
+(!docs/pages/includes/add-role-to-user.mdx role="spacelift-impersonator"!)
+
+### Export an identity file
+
+(!docs/pages/includes/plugins/identity-export.mdx user="spacelift" client="Spacelift"!)
+
+### Provide an identity file to Spacelift
+
+In the Spacelift web UI, click **Stacks > Teleport**. Click the **Environment**
+tab, then **Edit**. Set the dropdown menu that follows to **Mounted file**, and
+the path to `/mnt/workspace/auth.pem`.
+
+Click **Upload file** and select the file called `auth.pem` that you exported
+earlier.
+
+Make sure you click **Secret** next to the entry for the mounted file:
+
+![Uploading the identity file](../../../img/management/spacelift/id-file.png)
+
+## Step 4/4. Declare configuration resources
+
+In a clone of your GitHub repository, check out a branch from your main branch
+and add the following to `main.tf`:
+
+```text
+resource "teleport_role" "terraform_test" {
+  metadata = {
+    name        = "terraform-test"
+    description = "Terraform test role"
+    labels = {
+      example = "yes"
+    }
+  }
+}
+
+resource "teleport_user" "terraform-test" {
+  metadata = {
+    name        = "terraform-test"
+    description = "Terraform test user"
+
+    labels = {
+      test = "true"
+    }
+  }
+
+  spec = {
+    roles = [teleport_role.terraform_test.id]
+  }
+}
+```
+
+Commit your changes and push the branch to GitHub, then open a pull request
+against the `main` branch. (Do not merge it just yet.)
+
+In the Spacelift UI, click **Stacks > Teleport > PRs**, then click the name of
+the PR you opened.
+
+You should see a Terraform plan that includes the user and role you defined
+above:
+
+![Terraform plan](../../../img/management/spacelift/pr-run.png)
+
+When running `terraform plan`, Spacelift uses the identity file you mounted
+earlier to authenticate to Teleport.
+
+Merge the PR, then click **Stacks > Teleport > Runs**. Click the status of the
+first run, which corresponds to merging your PR, to visit the page for the run.
+Click **Confirm** to begin applying your Terraform plan.
+
+You should see output indicating success:
+
+![Successful apply](../../../img/management/spacelift/apply-success.png)
+
+Verify that Spacelift has created the new user and role by running the following
+commands, which should return YAML data for each resource:
+
+```code
+$ tctl get roles/terraform-test
+$ tctl get users/terraform-test
+```
+
+## Next steps
+
+- If you plan to configure Spacelift to manage dynamic configuration resources
+  besides users and roles, you will need to grant additional permissions to the
+  Teleport role you assigned to Spacelift.  See the [Teleport Role
+  Reference](../../access-controls/reference.mdx#teleport-resources) for the
+  resources you can allow access to in a Teleport role.
+- Now that you know how to manage Teleport configuration resources with
+  Terraform and Spacelift, read our [Terraform resource
+  reference](../../reference/terraform-provider.mdx) so you can flesh out your
+  configuration.
+- The Teleport Terraform provider is an example of a Teleport API client. Other
+  API clients include Teleport's [Access Request
+  plugins](../../access-controls/access-request-plugins.mdx) and the [Event
+  Handler](../export-audit-events.mdx). Learn how to [build your own API
+  client](../../api/introduction.mdx) so you can manage Teleport configuration
+  resources via your organization's unique workflows.
diff --git a/docs/pages/management/guides/teleport-operator.mdx b/docs/pages/management/dynamic-resources/teleport-operator.mdx
similarity index 100%
rename from docs/pages/management/guides/teleport-operator.mdx
rename to docs/pages/management/dynamic-resources/teleport-operator.mdx
diff --git a/docs/pages/management/guides/terraform-provider.mdx b/docs/pages/management/dynamic-resources/terraform-provider.mdx
similarity index 98%
rename from docs/pages/management/guides/terraform-provider.mdx
rename to docs/pages/management/dynamic-resources/terraform-provider.mdx
index ba55b9820b330..557bb1377934d 100644
--- a/docs/pages/management/guides/terraform-provider.mdx
+++ b/docs/pages/management/dynamic-resources/terraform-provider.mdx
@@ -65,15 +65,17 @@ spec:
         - cluster_auth_preference
         - cluster_networking_config
         - db
+        - device
         - github
+        - login_rule
         - oidc
+        - okta_import_rule
         - role
         - saml
         - session_recording_config
         - token
         - trusted_cluster
         - user
-        - login_rule
         verbs: ['list','create','read','update','delete']
 version: v6
 ---
diff --git a/docs/pages/management/export-audit-events/datadog.mdx b/docs/pages/management/export-audit-events/datadog.mdx
index 2b480fec1305a..c7f921631d468 100644
--- a/docs/pages/management/export-audit-events/datadog.mdx
+++ b/docs/pages/management/export-audit-events/datadog.mdx
@@ -239,7 +239,7 @@ identity = "identity"
 To start the event handler, run the following command:
 
 ```code
-$ ./teleport-event-handler start --config teleport-event-handler.toml
+$ teleport-event-handler start --config teleport-event-handler.toml
 ```
 
 </TabItem>
@@ -265,7 +265,7 @@ identity = "identity"
 To start the event handler, run the following command:
 
 ```code
-$ ./teleport-event-handler start --config teleport-event-handler.toml
+$ teleport-event-handler start --config teleport-event-handler.toml
 ```
 
 </TabItem>
@@ -313,7 +313,7 @@ $ helm install teleport-plugin-event-handler teleport/teleport-plugin-event-hand
 This example will start exporting from `May 5th 2021`:
 
 ```code
-$ ./teleport-event-handler start --config teleport-event-handler.toml --start-time "2022-02-02T00:00:00Z"
+$ teleport-event-handler start --config teleport-event-handler.toml --start-time "2022-02-02T00:00:00Z"
 ```
 
 The start time can be set only once, on the first run of the tool.
diff --git a/docs/pages/management/export-audit-events/fluentd.mdx b/docs/pages/management/export-audit-events/fluentd.mdx
index 94747dbfe1110..6254d5d39b1ad 100644
--- a/docs/pages/management/export-audit-events/fluentd.mdx
+++ b/docs/pages/management/export-audit-events/fluentd.mdx
@@ -257,7 +257,7 @@ identity = "identity"
 To start the event handler, run the following command:
 
 ```code
-$ ./teleport-event-handler start --config teleport-event-handler.toml
+$ teleport-event-handler start --config teleport-event-handler.toml
 ```
 
 </TabItem>
@@ -283,7 +283,7 @@ identity = "identity"
 To start the Event Handler, run the following command:
 
 ```code
-$ ./teleport-event-handler start --config teleport-event-handler.toml
+$ teleport-event-handler start --config teleport-event-handler.toml
 ```
 
 </TabItem>
@@ -331,7 +331,7 @@ $ helm install teleport-plugin-event-handler teleport/teleport-plugin-event-hand
 This example will start exporting from `May 5th 2021`:
 
 ```code
-$ ./teleport-event-handler start --config teleport-event-handler.toml --start-time "2021-05-05T00:00:00Z"
+$ teleport-event-handler start --config teleport-event-handler.toml --start-time "2021-05-05T00:00:00Z"
 ```
 
 The start time can be set only once, on the first run of the tool.
diff --git a/docs/pages/management/guides.mdx b/docs/pages/management/guides.mdx
index 47d9c9118275e..66dc8665edf60 100644
--- a/docs/pages/management/guides.mdx
+++ b/docs/pages/management/guides.mdx
@@ -1,10 +1,15 @@
 ---
-title: Setup Guides
-description: Teleport Installation and Configuration Guides.
+title: Integrations
+description: Miscellaneous guides for integrating Teleport with third-party tools.
 layout: tocless-doc
 ---
 
-  - [Kubernetes Operator (Preview)](./guides/teleport-operator.mdx). How to add the Teleport Kubernetes Operator to your Kubernetes cluster.
-  - [Terraform Provider](./guides/terraform-provider.mdx). How to configure Teleport Cloud, Open Source, and Enterprise with the Terraform Provider for Teleport.
-  - [EC2 tags as Teleport Nodes](./guides/ec2-tags.mdx). How to set up Teleport Node labels based on EC2 tags.
-  - [Using Teleport's Certificate Authority with GitHub](./guides/ssh-key-extensions.mdx). Use Teleport's short-lived certificates with GitHub's Certificate Authority.
+You can integrate Teleport with third-party tools in order to complete various
+tasks in your cluster. These guides describe Teleport integrations that are not
+documented elsewhere:
+
+  - [EC2 tags as Teleport Node labels](./guides/ec2-tags.mdx). How to set up
+    Teleport Node labels based on EC2 tags.
+  - [Using Teleport's Certificate Authority with
+    GitHub](./guides/ssh-key-extensions.mdx). Use Teleport's short-lived
+    certificates with GitHub's Certificate Authority.
diff --git a/docs/pages/management/guides/ec2-tags.mdx b/docs/pages/management/guides/ec2-tags.mdx
index 94e90b40879bf..3a5da6a11e467 100644
--- a/docs/pages/management/guides/ec2-tags.mdx
+++ b/docs/pages/management/guides/ec2-tags.mdx
@@ -27,8 +27,8 @@ fakehost.example.com 127.0.0.1:3022 env=example,hostname=ip-172-31-53-70,aws/Nam
 ## Prerequisites
 
 (!docs/pages/includes/edition-prereqs-tabs.mdx!)
-- One Teleport Node running on an Amazon EC2 instance. See
-  [Adding Nodes](../join-services-to-your-cluster.mdx) for how to set up a Teleport Node.
+- One Teleport agent running on an Amazon EC2 instance. See
+  [our guides](../../agents/join-services-to-your-cluster.mdx) for how to set up Teleport agents.
 
 ## Enable tags in instance metadata
 
diff --git a/docs/pages/management/introduction.mdx b/docs/pages/management/introduction.mdx
index c6cc95f160702..8c53e3ae3244e 100644
--- a/docs/pages/management/introduction.mdx
+++ b/docs/pages/management/introduction.mdx
@@ -7,14 +7,20 @@ layout: tocless-doc
 In this section, you can find guides on managing a Teleport cluster after
 deploying it. 
 
-## Join Teleport services to your cluster
-
-Protect resources in your infrastructure with Teleport by joining Teleport
-services to proxy those resources. To do this, start a Teleport process that
-runs one or more services. The Teleport process establishes a trust relationship
-with your Teleport cluster through a variety of methods. Read [Joining Teleport
-Services to a Cluster](./join-services-to-your-cluster.mdx) for a detailed
-explanation of each method.
+## Use dynamic resources
+
+In Teleport, **dynamic resources** let you adjust the behavior of your Teleport
+cluster as your infrastructure changes. Teleport provides three methods for
+applying dynamic resources: the `tctl` client tool, Teleport Terraform provider,
+and Kubernetes Operator. Read [Using Dynamic Resources](./dynamic-resources.mdx)
+for more information.
+
+## Configure your cluster
+
+Get to know the [tools you can use](./dynamic-resources.mdx) to apply
+settings to your cluster, all of which work well with infrastructure-as-code
+solutions, including the `tctl` client, Terraform provider, and Kubernetes
+Operator.
 
 ## Admin guides
 
diff --git a/docs/pages/management/operations/ca-rotation.mdx b/docs/pages/management/operations/ca-rotation.mdx
index a075c55ac8844..eb52527fc24bb 100644
--- a/docs/pages/management/operations/ca-rotation.mdx
+++ b/docs/pages/management/operations/ca-rotation.mdx
@@ -14,7 +14,7 @@ description: How to rotate Teleport's certificate authority
 This section will show you how to rotate Teleport's certificate authority.
 
 If you are joining Teleport processes to a cluster via the Teleport Auth Service
-using a [join token](../join-services-to-your-cluster/join-token.mdx), each
+using a [join token](../../agents/join-services-to-your-cluster/join-token.mdx), each
 Teleport process will need a CA pin to trust the Auth Service. The CA pin will
 change after each CA rotation. Make sure you use the *new* CA pin when adding
 Teleport services after rotation.
diff --git a/docs/pages/management/operations/tls-routing.mdx b/docs/pages/management/operations/tls-routing.mdx
index 2ab18f62fa656..33b5a83909dec 100644
--- a/docs/pages/management/operations/tls-routing.mdx
+++ b/docs/pages/management/operations/tls-routing.mdx
@@ -33,9 +33,9 @@ Teleport installation to TLS routing.
 
 <Notice type="tip">
 
-Teleport Cloud manages the Proxy Service's networking configuration for you.
+Teleport Team manages the Proxy Service's networking configuration for you.
 Get started with a [free trial](https://goteleport.com/signup?t_source=docs) of
-Teleport Cloud.
+Teleport Team.
 
 To see which ports and networking settings the Proxy Service is configured to
 use in your Teleport Cloud tenant, run the following command, replacing
diff --git a/docs/pages/reference/authentication.mdx b/docs/pages/reference/authentication.mdx
index 796c9b0d05908..a246dcac8d963 100644
--- a/docs/pages/reference/authentication.mdx
+++ b/docs/pages/reference/authentication.mdx
@@ -121,6 +121,50 @@ $ tctl create -f cap.yaml
 </TabItem>
 </Tabs>
 
+### Local user login failure rules
+
+A local user is blocked from attempting logins if, within a 30 minute window, a local user has multiple:
+
+- failed login attempts or
+- failed password resets
+
+The block lasts 20 minutes. After the block has expired the user may attempt to log in again.
+
+Overriding a block is available to users with rights to maintain `user` resources,
+available in the built-in `editor` role. To turn off a block, update the user entry,
+following these steps.
+
+Retrieve the user entry so you can edit the status:
+
+```code
+$ tctl get users/<Var name="username" /> > user.yaml
+```
+
+The file `user.yaml` should resemble the following:
+
+```yaml
+kind: user
+metadata:
+  name: jeff
+spec:
+  roles:
+  - access
+  status:
+    is_locked: true
+    lock_expires: "2023-04-22T01:55:02.228158166Z"
+    locked_message: user has exceeded maximum failed login attempts
+version: v2
+```
+
+Update the `is_locked` field under `status` to `false` and save the file. Now
+update the user entry with the command below:
+
+```code
+$ tctl create -f user.yaml
+```
+
+The user will now be unblocked from login attempts and can attempt to authenticate again.
+
 ## Authentication connectors
 
 <Tabs>
diff --git a/docs/pages/reference/backends.mdx b/docs/pages/reference/backends.mdx
index 5ec35d87bba54..d9eab63aa2b05 100644
--- a/docs/pages/reference/backends.mdx
+++ b/docs/pages/reference/backends.mdx
@@ -225,12 +225,33 @@ Service reads these parameters to configure its interactions with S3:
 `s3://bucket/path?region=us-east-1&endpoint=mys3.example.com&insecure=false&disablesse=false&acl=private&use_fips_endpoint=true`
 
 - `region=us-east-1` - set the Amazon region to use.
+
 - `endpoint=mys3.example.com` - connect to a custom S3 endpoint. Optional.
-- `insecure=true` - set to `true` or `false`. If `true`, TLS will be disabled. Default value is `false`.
-- `disablesse=true` - set to `true` or `false`. If `true`, S3 server-side encryption will be disabled. If `false`, aws:kms (Key Management Service) will be used for server-side encryption. Other SSE types are not supported at this time. Setting `insecure=true` implicitly sets `disablesse=true`.
-- `sse_kms_key=kms_key_id` - If set to a valid AWS KMS CMK key ID all objects uploaded to S3 will be encrypted with this key. Details can be found below.
-- `acl=private` - set the [canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#canned-acl) to use. Must be one of the predefined ACL values.
-- `use_fips_endpoint=true` -  [Configure S3 FIPS endpoints](#configuring-aws-fips-endpoints)
+
+- `insecure=true` - set to `true` or `false`. If `true`, TLS will be disabled.
+  Default value is `false`.
+
+- `disablesse=true` - set to `true` or `false`. The Auth Service checks this
+  value before uploading an object to an S3 bucket. 
+
+  If this is `false`, the Auth Service will set the server-side encryption
+  configuration of the upload to use AWS Key Management Service and, if
+  `sse_kms_key` is set, configure the upload to use this key.
+
+  If this value is `true`, the Auth Service will not set an explicit server-side
+  encryption configuration for the object upload, meaning that the upload will
+  use the bucket-level server-side encryption configuration.
+
+- `sse_kms_key=kms_key_id` - If set to a valid AWS KMS CMK key ID, all objects
+  uploaded to S3 will be encrypted with this key (as long as `disablesse` is
+  `false`). Details can be found below.
+
+- `acl=private` - set the [canned
+  ACL](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#canned-acl)
+  to use. Must be one of the predefined ACL values.
+
+- `use_fips_endpoint=true` -  [Configure S3 FIPS
+  endpoints](#configuring-aws-fips-endpoints)
 
 ### S3 IAM policy
 
@@ -487,11 +508,13 @@ The optional `GET` parameters shown below control how Teleport interacts with a
 
 ### DynamoDB autoscaling
 
-When setting up DynamoDB it's important to set up backups. Autoscaling is optional with Teleport,
-and it is advised to collect some production usage data before enabling autoscaling.
+When setting up DynamoDB it's important to set up backups. Autoscaling is
+optional with Teleport, and it is advised to collect some production usage data
+before enabling autoscaling.
 
-Autoscaling and backup can be configured on DynamoDB directly. We also make setup simpler by allowing AWS DynamoDB
-settings to be set automatically during Teleport startup. The configuration is described below.
+Autoscaling and backup can be configured on DynamoDB directly. We also make
+setup simpler by allowing AWS DynamoDB settings to be set automatically during
+Teleport startup. The configuration is described below.
 
 **DynamoDB Continuous Backups**
 
@@ -501,6 +524,16 @@ settings to be set automatically during Teleport startup. The configuration is d
 
 - [AWS Docs - Managing Throughput Capacity Automatically with DynamoDB Auto Scaling](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/AutoScaling.html)
 
+<Notice type="danger">
+
+AWS can throttle DynamoDB if more than two processes are reading from the same
+stream's shard simultaneously, so you must not deploy more than two Auth Service
+instances that read from a DynamoDB backend. For details on DynamoDB Streams,
+read the [AWS
+documentation](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Streams.html).
+
+</Notice>
+
 ```yaml
 # ...
 teleport:
diff --git a/docs/pages/reference/cli.mdx b/docs/pages/reference/cli.mdx
index 9372495592225..8e9cdf6232bd2 100644
--- a/docs/pages/reference/cli.mdx
+++ b/docs/pages/reference/cli.mdx
@@ -331,7 +331,7 @@ $ tsh gcloud [--app] [<command>]
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-| <nobr>`--app`</nobr> | Currently logged in Google Cloud application | The name of a Google Cloud application as listed via `tsh apps ls`. | The Google Cloud application to run the command against, if logged in to multiple Google Cloud applications. |
+| `--app` | Currently logged in Google Cloud application | The name of a Google Cloud application as listed via `tsh apps ls`. | The Google Cloud application to run the command against, if logged in to multiple Google Cloud applications. |
 
 #### Global flags
 
@@ -363,7 +363,7 @@ $ tsh gsutil [--app] [<command>]
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-| <nobr>`--app`</nobr> | Currently logged in Google Cloud application | The name of a Google Cloud application as listed via `tsh apps ls`. | The Google Cloud application to run the command against, if logged in to multiple Google Cloud applications. |
+| `--app` | Currently logged in Google Cloud application | The name of a Google Cloud application as listed via `tsh apps ls`. | The Google Cloud application to run the command against, if logged in to multiple Google Cloud applications. |
 
 #### Global flags
 
@@ -741,6 +741,7 @@ Access](../application-access/cloud-apis/azure.mdx).
 This command does not accept any arguments.
 
 #### Flags
+
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
 | `--app` | none | string | Name of the Teleport application representing Azure (i.e., based on `tsh apps ls`). Use this flag if your Teleport user has access to multiple Azure applications. |
@@ -766,9 +767,9 @@ $ tsh proxy aws [<flags>]
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
 | `--app` | Currently logged in AWS app | string | Optional name of the AWS application (as shown in `tsh apps ls`) to use if logged in to multiple |
-| `-p, --port` | none | port number | Specify the source port for the local proxy |
-| ` -e, --endpoint-url` | HTTP Proxy | Endpoint URL | Run the local proxy to serve as an AWS endpoint URL. If not specified, the local proxy serves as an HTTPS proxy. |
-| `-f, --format` | unix | `text`, `unix`, `command-prompt`, or `powershell` | Optional format for printing environment variables for the AWS proxy |
+| `-p`, `--port` | none | port number | Specify the source port for the local proxy |
+| `-e`, `--endpoint-url` | HTTP Proxy | Endpoint URL | Run the local proxy to serve as an AWS endpoint URL. If not specified, the local proxy serves as an HTTPS proxy. |
+| `-f`, `--format` | unix | `text`, `unix`, `command-prompt`, or `powershell` | Optional format for printing environment variables for the AWS proxy |
 
 #### [Global Flags](#tsh-global-flags)
 
@@ -806,9 +807,9 @@ $ tsh proxy gcloud [<flags>]
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
 | `--app` | Currently logged in Google Cloud app | string | Optional name of the Google Cloud application (as shown in `tsh apps ls`) to use if logged in to multiple |
-| `-p, --port` | none | port number | Specify the source port for the local proxy |
-| <nobr>`-e, --endpoint-url`</nobr> | HTTP Proxy | Endpoint URL | Run the local proxy to serve as a Google Cloud endpoint URL. If not specified, the local proxy serves as an HTTPS proxy. |
-| `-f, --format` | unix | `text`, `unix`, `command-prompt`, or `powershell` | Optional format for printing environment variables for the Google Cloud proxy |
+| `-p`, `--port` | none | port number | Specify the source port for the local proxy |
+| `-e`, `--endpoint-url` | HTTP Proxy | Endpoint URL | Run the local proxy to serve as a Google Cloud endpoint URL. If not specified, the local proxy serves as an HTTPS proxy. |
+| `-f`, `--format` | unix | `text`, `unix`, `command-prompt`, or `powershell` | Optional format for printing environment variables for the Google Cloud proxy |
 
 #### [Global Flags](#tsh-global-flags)
 
@@ -851,7 +852,7 @@ $ tsh scp [<flags>] <source>... <dest>
 
 #### Global flags
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version, --debug, --jumphost`.
+These flags are available for all commands `--login`, `--proxy`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 #### Examples
@@ -859,6 +860,7 @@ Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags)
 ```code
 $ tsh --proxy=proxy.example.com scp example.txt user@host:/destination/dir
 ```
+
 <Admonition type="note">
   `tsh scp` will not work from the CLI if the user requires session moderation. You can transfer files in a moderated session by joining the SSH session from the Web UI and requesting the file transfer there. Both the session initiator and moderators must be present in the Web UI in order to approve the file transfer request.
 </Admonition>
@@ -890,7 +892,7 @@ $ tsh ls [<flags>] [<label>]
 
 #### Global flags
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version, --debug, --jumphost`.
+These flags are available for all commands `--login`, `--proxy`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 #### Examples
@@ -953,7 +955,7 @@ $ tsh clusters [<flags>]
 
 #### Global flags
 
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version, --debug, --jumphost`.
+These flags are available for all commands `--login`, `--proxy`, `--user`, `--ttl`, `--identity`, `--cert-format`, `--insecure`, `--auth`, `--skip-version-check`, `--debug`, `--jumphost`.
 Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags).
 
 #### Examples
@@ -1010,7 +1012,7 @@ Run `tsh help <subcommand>` or see the [Global Flags section](#tsh-global-flags)
 *The proxy endpoint can take a https and ssh port in this format `host:https_port[,ssh_proxy_port]`*
 
 ```code
-# Try Toboth ports 443 and 3080 for https
+# Try both ports 443 and 3080 for https
 $ tsh --proxy=proxy.example.com login
 
 # Use ports 8080 and 8023 for https and SSH proxy:
@@ -1484,8 +1486,8 @@ ERROR: proxy jump contains {{proxy}} variable but did not match any of the templ
 
 If the proxy variable `-J {{proxy}}` is not explicitly provided, then `tsh` will 
 still attempt to match a template, but will not fail when there is no match.
-Additionally, it will not replace the `proxy` or `cluster` values when explicitly
-set by the client.
+Additionally, it will not replace the `proxy` value when explicitly set by the
+client.
 
 ```bash
 $ tsh ssh -J leaf2.us.example.com:443 node1.leaf2
@@ -1672,9 +1674,9 @@ These flags are available for all commands `--debug, --config`. Run
 ```code
 # Adds teleport user "joe" with mappings to
 # OS users and {{ internal.logins }} to "joe" and "ubuntu"
-$ tctl users add joe --roles=access joe,ubuntu
+$ tctl users add joe --roles=access,requester joe,ubuntu
 # Adds Teleport user "joe" with mappings to the editor role
-$ tctl users add joe --roles=editor
+$ tctl users add joe --roles=editor,reviewer
 ```
 
 ### tctl users update
@@ -1897,10 +1899,11 @@ $ tctl tokens add --type=TYPE [<flags>]
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
+| <nobr>`--format`</nobr> | none | `text`, `json`, `yaml` | Output format |
+| `--labels` | none | `text` | Sets token labels |
+| `--ttl` | 1h | Duration like 5s, 2m, or 3h | Sets how long the token is valid for. |
 | `--type` | none | `proxy`, `auth`, `trusted_cluster`, `node`,  `db`, `kube`, `app`, `windowsdesktop` | Type of token to add |
 | `--value` | none | **string** token value | Value of token to add |
-| `--ttl` | 1h | relative duration like 5s, 2m, or 3h | Set expiration time for token |
-| `--format` | none | `text`, `json`, `yaml` | Output format |
 
 #### Global flags
 
@@ -1913,7 +1916,7 @@ These flags are available for all commands `--debug, --config` . Run
 # Generate an invite token for a trusted_cluster
 $ tctl tokens add --type=trusted_cluster --ttl=5m
 # Generate an invite token for a trusted_cluster with labels
-$ tctl tokens add --type=trusted_cluster --labels=env=prod
+$ tctl tokens add --type=trusted_cluster --labels=env=prod,region=us-west
 # Generate an invite token for a node
 # This is equivalent to `tctl nodes add`
 $ tctl tokens add --type=node
diff --git a/docs/pages/reference/config.mdx b/docs/pages/reference/config.mdx
index 49f9e0e37a6ee..78daf5f85ee0b 100644
--- a/docs/pages/reference/config.mdx
+++ b/docs/pages/reference/config.mdx
@@ -67,6 +67,7 @@ Teleport supports the following services:
 |SSH Service|`ssh_service`|✅|
 |Desktop Service|`windows_desktop_service`|❌|
 |Okta Service|`okta_service`|❌|
+|Jamf Service|`jamf_service`|❌|
 
 Teleport Cloud manages the Auth Service and Proxy Service for you. Instances of
 Teleport services (e.g., the Application Service and Database Service) should
@@ -177,6 +178,14 @@ These settings apply to the Okta Service:
 (!docs/pages/includes/config-reference/okta-service.yaml!)
 ```
 
+### Jamf Service
+
+These settings apply to the Jamf Service:
+
+```yaml
+(!docs/pages/includes/config-reference/jamf-service.yaml!)
+```
+
 ## Configuration versions
 
 In order to avoid breaking existing configurations, Teleport's configuration is
diff --git a/docs/pages/reference/helm-reference/teleport-cluster.mdx b/docs/pages/reference/helm-reference/teleport-cluster.mdx
index 32014ad9cf657..906284721f494 100644
--- a/docs/pages/reference/helm-reference/teleport-cluster.mdx
+++ b/docs/pages/reference/helm-reference/teleport-cluster.mdx
@@ -996,7 +996,7 @@ cluster deployed in HA mode.
   You must install and configure `cert-manager` in your Kubernetes cluster yourself.
 
   See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
-  and the relevant sections of the [AWS](../../deploy-a-cluster/helm-deployments/aws.mdx#step-47-configure-tls-certificates-for-teleport) and [GCP](../../deploy-a-cluster/helm-deployments/gcp.mdx#step-47-install-and-configure-cert-manager) guides for more information.
+  and the relevant sections of the [AWS](../../deploy-a-cluster/helm-deployments/aws.mdx#step-36-configure-tls-certificates-for-teleport) and [GCP](../../deploy-a-cluster/helm-deployments/gcp.mdx#step-36-install-and-configure-cert-manager) guides for more information.
 </Admonition>
 
 ### `highAvailability.certManager.addCommonName`
@@ -1011,7 +1011,7 @@ Setting `highAvailability.certManager.addCommonName` to `true` will instruct `ce
   You must install and configure `cert-manager` in your Kubernetes cluster yourself.
 
   See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
-  and the relevant sections of the [AWS](../../deploy-a-cluster/helm-deployments/aws.mdx#step-47-configure-tls-certificates-for-teleport) and [GCP](../../deploy-a-cluster/helm-deployments/gcp.mdx#step-47-install-and-configure-cert-manager) guides for more information.
+  and the relevant sections of the [AWS](../../deploy-a-cluster/helm-deployments/aws.mdx#step-36-configure-tls-certificates-for-teleport) and [GCP](../../deploy-a-cluster/helm-deployments/gcp.mdx#step-36-install-and-configure-cert-manager) guides for more information.
 </Admonition>
 
 `values.yaml` example:
@@ -1036,7 +1036,7 @@ Sets the name of the `cert-manager` `Issuer` or `ClusterIssuer` to use for issui
   You must install configure an appropriate `Issuer` supporting a DNS01 challenge yourself.
 
   Please see the [cert-manager DNS01 docs](https://cert-manager.io/docs/configuration/acme/dns01/#supported-dns01-providers) and the relevant sections
-  of the [AWS](../../deploy-a-cluster/helm-deployments/aws.mdx#step-47-configure-tls-certificates-for-teleport) and [GCP](../../deploy-a-cluster/helm-deployments/gcp.mdx#step-47-install-and-configure-cert-manager) guides for more information.
+  of the [AWS](../../deploy-a-cluster/helm-deployments/aws.mdx#step-36-configure-tls-certificates-for-teleport) and [GCP](../../deploy-a-cluster/helm-deployments/gcp.mdx#step-36-install-and-configure-cert-manager) guides for more information.
 </Admonition>
 
 `values.yaml` example:
diff --git a/docs/pages/reference/helm-reference/teleport-kube-agent.mdx b/docs/pages/reference/helm-reference/teleport-kube-agent.mdx
index f6ac27fb46d92..e0c4643da0c9f 100644
--- a/docs/pages/reference/helm-reference/teleport-kube-agent.mdx
+++ b/docs/pages/reference/helm-reference/teleport-kube-agent.mdx
@@ -89,16 +89,32 @@ This parameter is not mandatory to preserve backwards compatibility with older c
   ```yaml
   roles: kube,app,db
   ```
+  
+## `enterprise`
 
-If you specify a role here, you may also need to specify some other settings which are detailed in this reference.
+| Type     | Default value |
+|----------|---------------|
+| `bool`   | `false`       |
+
+When `enterprise` is set to `true`, the container image used for Teleport agent
+pods run by the `teleport-kube-agent` chart will be the enterprise version.
+This should be set to `true` for connecting to Teleport Cloud and self-hosted
+Teleport Enterprise clusters to use enterprise features within the Kube Agent. 
 
+`values.yaml` example:
+
+  ```yaml
+  enterprise: true
+  ```  
+  
 ## `updater`
 
 `updater` controls whether the Kube Agent Updater should be deployed alongside
 the `teleport-kube-agent`. The updater fetches the target version, validates the
-image signature, and updates the teleport deployment.
+image signature, and updates the teleport deployment. The `enterprise` value should 
+have been set to `true`.
 
-All kubernetes-specific fields such as `tolerations`, `affinity`, `nodeSelector`,
+All Kubernetes-specific fields such as `tolerations`, `affinity`, `nodeSelector`,
 ... default to the agent values. However, they can be overridden from the
 `updater` object. For example:
 
@@ -146,9 +162,9 @@ You must not enable this if:
 
 ### `updater.versionServer`
 
-| Type     | Default value                         | Required?                       |
-|----------|---------------------------------------|---------------------------------|
-| `string` | "https://update.gravitational.io/v1/" | Yes if not using Teleport Cloud |
+| Type     | Default value                               | Required?                       |
+|----------|---------------------------------------------|---------------------------------|
+| `string` | "https://updates.releases.teleport.dev/v1/" | Yes if not using Teleport Cloud |
 
 `updater.versionServer` is the URL of the version server the agent fetches the
 target version from. The complete version endpoint is built by concatenating
@@ -285,9 +301,9 @@ These sub-values must be configured for the agent to connect to a cluster.
 Possible values are `token`, `iam` and `ec2`.
 
 - For `iam`, see [Joining Nodes Via AWS IAM
-  Role](../../management/join-services-to-your-cluster/aws-iam.mdx).
+  Role](../../agents/join-services-to-your-cluster/aws-iam.mdx).
 - For `ec2`, see [Joining Nodes Via AWS IAM
-  Role](../../management/join-services-to-your-cluster/aws-ec2.mdx).
+  Role](../../agents/join-services-to-your-cluster/aws-ec2.mdx).
 - For `token` (default value), the token must be provided through `joinParams.tokenName` or
   [through an existing Kubernetes Secret](#joinTokenSecret).
 
@@ -676,7 +692,7 @@ If you want to run Teleport version `X.Y.Z`, you should use
 When `caPin` is set, the Teleport pod will use its values to check the
 Auth Service's identity when first joining a cluster. This enables a more secure
 way of adding new Teleport instances to a cluster. See
-["Adding Nodes to the Cluster"](../../management/join-services-to-your-cluster/join-token.mdx).
+["Adding Nodes to the Cluster"](../../agents/join-services-to-your-cluster/join-token.mdx).
 
 Each list element can be the pin itself (recommended, works out of the box),
 or a path to a file containing the pin. For the latter it is your
@@ -956,9 +972,9 @@ connecting to a Teleport Cloud instance enrolled in automatic updates.
 
 ## `imagePullSecrets`
 
-| Type   | Default value | Can be used in `custom` mode? |
-|--------|---------------|-------------------------------|
-| `list` | `[]`          | ✅                             |
+| Type   | Default value |
+|--------|---------------|
+| `list` | `[]`          |
 
 [Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod)
 
@@ -1116,9 +1132,9 @@ Ensures that this number of replicas is available during voluntary disruptions,
 
 ## `serviceAccount.create`
 
-| Type      | Default value | Required? | Can be used in `custom` mode? |
-|-----------|---------------|-----------|-------------------------------|
-| `boolean` | `true`        | No        | ✅                             |
+| Type      | Default value | Required? |
+|-----------|---------------|-----------|
+| `boolean` | `true`        | No        |
 
 [Kubernetes reference](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/)
 
@@ -1135,9 +1151,9 @@ When off, the `serviceAccount.name` parameter should be set to the existing `Ser
 
 ## `serviceAccount.name`
 
-| Type     | Default value | Required? | Can be used in `custom` mode? |
-|----------|---------------|-----------|-------------------------------|
-| `string` | `""`          | No        | ✅                             |
+| Type     | Default value | Required? |
+|----------|---------------|-----------|
+| `string` | `""`          | No        |
 
 `serviceAccount.name` provides a custom name for the `ServiceAccount` resource
 that the `teleport-kube-agent` chart creates for the Teleport pod. By default,
@@ -1230,9 +1246,9 @@ The default is `INFO`, which is recommended in production.
 
 ### `log.output`
 
-| Type     | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-|----------|---------------|-------------------------------|----------------------------|
-| `string` | `stderr`      | ❌                             | `teleport.log.output`      |
+| Type     | Default value | `teleport.yaml` equivalent |
+|----------|---------------|----------------------------|
+| `string` | `stderr`      | `teleport.log.output`      |
 
 `log.output` sets the output destination for the Teleport process.
 
@@ -1249,9 +1265,9 @@ The value can also be set to a file path (such as `/var/log/teleport.log`) to wr
 
 ### `log.format`
 
-| Type     | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent   |
-|----------|---------------|-------------------------------|------------------------------|
-| `string` | `text`        | ❌                             | `teleport.log.format.output` |
+| Type     | Default value | `teleport.yaml` equivalent   |
+|----------|---------------|------------------------------|
+| `string` | `text`        | `teleport.log.format.output` |
 
 `log.format` sets the output type for the Teleport process.
 
@@ -1266,9 +1282,9 @@ Possible values are `text` (default) or `json`.
 
 ### `log.extraFields`
 
-| Type   | Default value                                   | Can be used in `custom` mode? | `teleport.yaml` equivalent         |
-|--------|-------------------------------------------------|-------------------------------|------------------------------------|
-| `list` | `["timestamp", "level", "component", "caller"]` | ❌                             | `teleport.log.format.extra_fields` |
+| Type   | Default value                                   | `teleport.yaml` equivalent         |
+|--------|-------------------------------------------------|------------------------------------|
+| `list` | `["timestamp", "level", "component", "caller"]` | `teleport.log.format.extra_fields` |
 
 `log.extraFields` sets the fields used in logging for the Teleport process.
 
@@ -1567,19 +1583,14 @@ chart for the Teleport pod.
 
 ## `annotations.config`
 
-| Type     | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-|----------|---------------|-------------------------------|----------------------------|
-| `object` | `{}`          | ❌                             | None                       |
+| Type     | Default value | `teleport.yaml` equivalent |
+|----------|---------------|----------------------------|
+| `object` | `{}`          | None                       |
 
 [Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
 
 Kubernetes annotations which should be applied to the `ConfigMap` created by the chart.
 
-<Admonition type="note">
-  These annotations will not be applied in `custom` mode, as the `ConfigMap` is not managed by the chart.
-  In this instance, you should apply annotations manually to your created `ConfigMap`.
-</Admonition>
-
 `values.yaml` example:
 
   ```yaml
@@ -1590,9 +1601,9 @@ Kubernetes annotations which should be applied to the `ConfigMap` created by the
 
 ## `annotations.deployment`
 
-| Type     | Default value | Can be used in `custom` mode? |
-|----------|---------------|-------------------------------|
-| `object` | `{}`          | ✅                             |
+| Type     | Default value |
+|----------|---------------|
+| `object` | `{}`          |
 
 [Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
 
@@ -1608,9 +1619,9 @@ Kubernetes annotations which should be applied to the `Deployment` created by th
 
 ## `annotations.pod`
 
-| Type     | Default value | Can be used in `custom` mode? |
-|----------|---------------|-------------------------------|
-| `object` | `{}`          | ✅                             |
+| Type     | Default value |
+|----------|---------------|
+| `object` | `{}`          |
 
 [Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
 
@@ -1626,9 +1637,9 @@ Kubernetes annotations which should be applied to each `Pod` created by the char
 
 ## `annotations.serviceAccount`
 
-| Type     | Default value | Can be used in `custom` mode? |
-|----------|---------------|-------------------------------|
-| `object` | `{}`          | ✅                             |
+| Type     | Default value |
+|----------|---------------|
+| `object` | `{}`          |
 
 [Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
 
@@ -1644,9 +1655,9 @@ Kubernetes annotations which should be applied to the `ServiceAccount` created b
 
 ## `extraVolumes`
 
-| Type   | Default value | Can be used in `custom` mode? |
-|--------|---------------|-------------------------------|
-| `list` | `[]`          | ✅                             |
+| Type   | Default value |
+|--------|---------------|
+| `list` | `[]`          |
 
 [Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
 
@@ -1697,9 +1708,9 @@ A list of extra environment variables to be set on the main Teleport container.
 
 ## `extraVolumeMounts`
 
-| Type   | Default value | Can be used in `custom` mode? |
-|--------|---------------|-------------------------------|
-| `list` | `[]`          | ✅                             |
+| Type   | Default value |
+|--------|---------------|
+| `list` | `[]`          |
 
 [Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
 
@@ -1714,11 +1725,36 @@ mounts will also be mounted into any `initContainers` configured by the chart.
     mountPath: /path/to/mount/volume
   ```
 
+## `hostAliases`
+
+| Type   | Default value |
+|--------|---------------|
+| `list` | `[]`          |
+
+Configure aliases in the pod's `/etc/hosts`.
+This can be used to have the agent join the Teleport cluster through a different
+non-public route, or to allow the agent to access applications or databases that
+are not resolvable. See [the Kubernetes documentation
+](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/) for
+more details.
+
+```yaml
+hostAliases:
+  - ip: "127.0.0.1"
+    hostnames:
+      - "foo.local"
+      - "bar.local"
+  - ip: "10.1.2.3"
+    hostnames:
+      - "foo.remote"
+      - "bar.remote"
+```
+
 ## `imagePullPolicy`
 
-| Type     | Default value  | Can be used in `custom` mode? |
-|----------|----------------|-------------------------------|
-| `string` | `IfNotPresent` | ✅                             |
+| Type     | Default value  |
+|----------|----------------|
+| `string` | `IfNotPresent` |
 
 [Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
 
@@ -1732,9 +1768,9 @@ Allows the `imagePullPolicy` for any pods created by the chart to be overridden.
 
 ## `initContainers`
 
-| Type   | Default value | Can be used in `custom` mode? |
-|--------|---------------|-------------------------------|
-| `list` | `[]`          | ✅                             |
+| Type   | Default value |
+|--------|---------------|
+| `list` | `[]`          |
 
 [Kubernetes reference](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
 
@@ -1751,9 +1787,9 @@ A list of `initContainers` which will be run before the main Teleport container
 
 ## `resources`
 
-| Type     | Default value | Can be used in `custom` mode? |
-|----------|---------------|-------------------------------|
-| `object` | `{}`          | ✅                             |
+| Type     | Default value |
+|----------|---------------|
+| `object` | `{}`          |
 
 [Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
 
@@ -1809,9 +1845,9 @@ To unset the security context, set it to `null` or `~`.
 
 ## `tolerations`
 
-| Type   | Default value | Can be used in `custom` mode? |
-|--------|---------------|-------------------------------|
-| `list` | `[]`          | ✅                             |
+| Type   | Default value |
+|--------|---------------|
+| `list` | `[]`          |
 
 [Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
 
diff --git a/docs/pages/reference/predicate-language.mdx b/docs/pages/reference/predicate-language.mdx
index 28099c77fd48e..4d70344ecb2b3 100644
--- a/docs/pages/reference/predicate-language.mdx
+++ b/docs/pages/reference/predicate-language.mdx
@@ -10,10 +10,12 @@ The predicate language uses a slightly different syntax depending on whether it
 
 - [Role resources](#scoping-allowdeny-rules-in-role-resources)
 - [Resource filtering](#resource-filtering)
+- [Label expressions](#label-expressions)
 
 ## Scoping allow/deny rules in role resources
 
-Some fields in Teleport's role resources use the predicate language to define the scope of a role's permissions:
+Some fields in Teleport's role resources use the predicate language to define
+the scope of a role's permissions:
 
 - [Dynamic Impersonation](../access-controls/guides/impersonation.mdx#filter-fields)
 - [RBAC for sessions](../access-controls/reference.mdx#filter-fields)
@@ -37,8 +39,8 @@ The language also supports the following functions:
 
 ## Resource filtering
 
-Both the [`tsh`](cli.mdx#tsh) and [`tctl`](cli.mdx#tctl) CLI tools allow you to filter nodes, 
-applications, databases, and Kubernetes resources using the `--query` flag. The `--query` flag allows you to 
+Both the [`tsh`](cli.mdx#tsh) and [`tctl`](cli.mdx#tctl) CLI tools allow you to filter nodes,
+applications, databases, and Kubernetes resources using the `--query` flag. The `--query` flag allows you to
 perform more sophisticated searches using the predicate language.
 
 For common resource fields, we defined shortened field names that can easily be accessed by:
@@ -68,3 +70,54 @@ The language also supports the following functions:
 | `search("foo", "bar", "some phrase")` | fuzzy match against common resource fields                 |
 
 See some [examples](cli.mdx#filter-examples) of the different ways you can filter resources.
+
+## Label expressions
+
+<Admonition type="warning">
+Label expressions are available starting in Teleport version `13.1.1`.
+All components of your Teleport cluster must be upgraded to version `13.1.1`
+or newer before you will be able to use label expressions.
+This includes the Auth Service and **all** Teleport agents.
+</Admonition>
+
+Label expressions can be used in Teleport roles to define access to resources
+with custom logic.
+Check out the Access Controls
+[reference page](../access-controls/reference.mdx#label-expressions)
+for an overview of label expressions and where they can be used.
+
+Label expressions support a predicate language with the following fields
+available:
+
+| Field              | Type                    | Description |
+|--------------------|-------------------------|-------------|
+| `labels`           | `map[string]string`     | Combined static and dynamic labels of the resource (server, application, etc.) being accessed. |
+| `user.spec.traits` | `map[string][]string`   | All traits of the user accessing the resource (referred to as `external` or `internal` in role template expressions). |
+
+The language supports the following functions:
+
+| Syntax | Return type | Description | Example |
+|--------|-------------|-------------|---------|
+| `contains(list, item)` | Boolean | Returns true if `list` contains an exact match for `item` | `contains(user.spec.traits[teams], labels["team"])` |
+| `regexp.match(list, re)` | Boolean | Returns true if `list` contains a match for `re` | `regexp.match(labels["team"], "dev-team-\d+$")` |
+| `regexp.replace(list,` `re, replacement)` | `[]string` | Replaces all matches of `re` with replacement for all items in `list` | `contains(regexp.replace(user.spec.traits["allowed-env"],` `"^env-(.*)$", "$1"), labels["env"])`
+| `email.local(list)` | `[]string` | Returns the local part of each email in `list`, or an error if any email fails to parse | `contains(email.local(user.spec.traits["email"]),` `labels["owner"])`
+| `strings.upper(list)` | `[]string` | Converts all items of the list to uppercase | `contains(strings.upper(user.spec.traits["username"]),` `labels["owner"])`
+| `strings.lower(list)` | `[]string` | Converts all items of the list to lowercase | `contains(strings.lower(user.spec.traits["username"]),` `labels["owner"])`
+| `labels_matching(re)` | `[]string` | Returns the aggregate of all label values with keys matching `re`, which can be a glob or a regular expression | `contains(labels_matching("^project-(team\|label)$"),` `"security")`
+| `contains_any(list, items)` | Boolean | Returns true if `list` contains an exact match for any element of `items` | `contains_any(user.spec.traits["projects"],` `labels_matching("project-*"))` |
+| `contains_all(list, items)` | Boolean | Returns true if `list` contains an exact match for all elements of `items` | `contains_all(user.spec.traits["projects"],` `labels_matching("project-*"))` |
+
+Above, any argument named `list` can accept a list of values (like the list of
+values for a specific user trait) or a single value (like the value of a
+resource label or a string literal).
+
+The language also supports the following operators:
+
+| Operator | Meaning                             | Example |
+|----------|-------------------------------------|---------|
+| ==       | equal to                            | `labels["env"] == "staging"` |
+| !=       | not equal to                        | `labels["env"] != "production"` |
+| \|\|      | or (any one condition should match) | `labels["env"] == "staging" \|\| labels["env"] == "test"` |
+| &&       | and (all conditions must match)     | `labels["env"] == "staging" && labels["team"] == "dev"` |
+| !        | not (logical negation)              | `!regexp.match(user.spec.traits["teams"], "contractor")` |
diff --git a/docs/pages/reference/resources.mdx b/docs/pages/reference/resources.mdx
index 692ba1f7ba1c9..c6fb8daf53282 100644
--- a/docs/pages/reference/resources.mdx
+++ b/docs/pages/reference/resources.mdx
@@ -1,129 +1,13 @@
 ---
-title: Teleport Resources Reference
-description: The detailed reference documentation for Teleport Configuration Resources
-h1: Teleport Configuration Resources Reference
+title: Teleport Resource Reference
+description: Reference documentation for Teleport resources
 ---
 
-## Introduction
+This reference guide lists dynamic resources you can manage with Teleport. For
+more information on dynamic resources, see our guide to [Using Dynamic
+Resources](../management/dynamic-resources.mdx).
 
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-A Teleport administrator has two tools to configure a Teleport cluster:
-
-- The [configuration file](./config.mdx) is used for static configuration
-  settings such as the cluster name.
-- The [`tctl`](./cli.mdx#tctl) admin tool is used for configuring the Teleport
-  Auth Service, and can be used to manage dynamic records like Teleport users.
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Cloud">
-
-A Teleport administrator can configure a Teleport cluster by using the
-[`tctl`](./cli.mdx#tctl) admin tool to manage dynamic records like Teleport
-users.
-
-</TabItem>
-</Tabs>
-
-- (!docs/pages/includes/tctl.mdx!)
-
-### `tctl` concepts
-
-[`tctl`](./cli.mdx#tctl) has convenient sub-commands for dynamic
-configuration, such as `tctl users` or `tctl nodes`.
-
-For more advanced management tasks, like connecting clusters together or
-troubleshooting trust, [`tctl`](./cli.mdx#tctl) offers the more powerful,
-lower-level CLI interface called `resources`.
-
-The concept is borrowed from the REST programming pattern. A cluster is composed
-of different objects (i.e., resources) and there are three common operations
-that can be performed on them: `get` , `create` , and `remove` .
-
-A resource is defined as a [YAML](https://en.wikipedia.org/wiki/YAML) file.
-Every resource in Teleport has three required fields:
-
-- `kind`: The type of resource
-- `name`: A required field in the `metadata` to uniquely identify the resource
-- `version`: The version of the resource format
-
-Everything else is resource specific and any component of a Teleport cluster can
-be manipulated with just three CLI commands:
-
-| Command | Description | Examples |
-| - | - | - |
-| [`tctl get`](./cli.mdx#tctl-get) | Get one or multiple resources. | `tctl get users` or `tctl get user/joe` |
-| [`tctl rm`](./cli.mdx#tctl-rm) | Delete a resource by type/name. | `tctl rm user/joe` |
-| [`tctl create`](./cli.mdx#tctl-create) | Create a new resource from a YAML file. Use the `-f` flag to update existing resources. | `tctl create -f joe.yaml` |
-
-<Admonition
-  type="warning"
-  title="YAML Format"
->
-
-  By default, Teleport uses [YAML format](https://en.wikipedia.org/wiki/YAML) to
-  describe resources. YAML is a human-readable alternative to JSON or XML, but
-  it's sensitive to white space. Pay attention to spaces versus tabs.
-
-</Admonition>
-
-### `tctl` example
-
-Here's an example of a YAML resource definition for a user named `joe`. It can
-be retrieved by executing `tctl get user/joe`.
-
-```yaml
-kind: user
-version: v2
-metadata:
-  name: joe
-spec:
-  roles: admin
-  status:
-    # Users can be temporarily locked in a Teleport system, but this
-    # functionality is reserved for internal use for now.
-    is_locked: false
-    lock_expires: 0001-01-01T00:00:00Z
-    locked_time: 0001-01-01T00:00:00Z
-  traits:
-    # These are "allowed logins" which are usually specified as the
-    # last argument to `tctl users add`.
-    logins:
-    - joe
-    - root
-  # Any resource in Teleport can automatically expire.
-  expires: 0001-01-01T00:00:00Z
-  # For internal use only
-  created_by:
-    time: 0001-01-01T00:00:00Z
-    user:
-      name: builtin-Admin
-```
-
-<Admonition
-  type="tip"
-  title="Note"
->
-  Some of the fields you will see when printing resources are used only internally and are not meant to be changed. Others are reserved for future use.
-</Admonition>
-
-## Dynamic resources
-
-Here's the list of resources currently exposed via [`tctl`](./cli.mdx#tctl):
-
-| Resource Kind | Description |
-| - | - |
-| [user](#user) | A user record in the internal Teleport user DB. |
-| [role](#role) | A role assumed by interactive and non-interactive users. |
-| connector | Authentication connectors for [Single Sign-On](../access-controls/sso.mdx) (SSO) for SAML, OIDC and GitHub. |
-| node | A registered SSH node. The same record is displayed via `tctl nodes ls` |
-| cluster | A trusted cluster. See [here](../management/admin/trustedclusters.mdx) for more details on connecting clusters together. |
-| login_rule | A Login Rule, see the [Login Rules guide](../access-controls/login-rules.mdx) for more info. |
-| device | A Teleport Trusted Device, see the [Device Trust guide](../access-controls/guides/device-trust.mdx) for more info. |
-| [ui_config](#ui-config) | Configuration for the Web UI served by the Proxy Service |
-
-**Examples:**
+Examples of applying dynamic resources with `tctl`:
 
 ```code
 # List all connectors:
@@ -149,13 +33,32 @@ $ tctl get devices
 
 # Fetch a specific device:
 $ tctl get devices/<asset-tag>
+
+# Fetch the cluster auth preferences
+$ tctl get cluster_auth_preference
 ```
 
 <Admonition type="note">
   Although `tctl get connectors` will show you every connector, when working with an individual connector you must use the correct `kind`, such as `saml` or `oidc`. You can see each connector's `kind` at the top of its YAML output from `tctl get connectors`.
 </Admonition>
 
-### User
+## List of dynamic resources
+
+Here's the list of resources currently exposed via [`tctl`](./cli.mdx#tctl):
+
+| Resource Kind | Description |
+| - | - |
+| [user](#user) | A user record in the internal Teleport user DB. |
+| [role](#role) | A role assumed by interactive and non-interactive users. |
+| connector | Authentication connectors for [Single Sign-On](../access-controls/sso.mdx) (SSO) for SAML, OIDC and GitHub. |
+| node | A registered SSH node. The same record is displayed via `tctl nodes ls` |
+| cluster | A trusted cluster. See [here](../management/admin/trustedclusters.mdx) for more details on connecting clusters together. |
+| login_rule | A Login Rule, see the [Login Rules guide](../access-controls/login-rules.mdx) for more info. |
+| device | A Teleport Trusted Device, see the [Device Trust guide](../access-controls/device-trust/guide.mdx) for more info. |
+| [ui_config](#ui-config) | Configuration for the Web UI served by the Proxy Service |
+| cluster_auth_preference | Configuration for the cluster's auth preferences. |
+
+## User
 
 Teleport supports interactive local users, non-interactive local users (bots)
 and single-sign on users that are represented as a resource.
@@ -191,7 +94,7 @@ spec:
       name: builtin-Admin
 ```
 
-### Role
+## Role
 
 Interactive and non-interactive users (bots) assume one or many roles.
 
@@ -199,26 +102,113 @@ Roles govern access to databases, SSH servers, Kubernetes clusters, web services
 
 (!docs/pages/includes/role-spec.mdx!)
 
-### Login Rules
+## Login Rules
 
 Login rules contain logic to transform SSO user traits during login.
 
 (!docs/pages/includes/login-rule-spec.mdx!)
 
-### Device
+## Device
 
 Device contains information identifying a trusted device.
 
 (!docs/pages/includes/device-spec.mdx!)
 
-### UI config
+## UI config
 
 Global configuration options for the Web UI served by the Proxy Service. This resource is not set by default, which means a `tctl get ui` will result in an error if used before this resource has been set.
 
 (!docs/pages/includes/ui-config-spec.mdx!)
 
-### Cluster Maintenance Config
+## Cluster maintenance config
 
 Global configuration options for the agents enrolled into automatic updates.
 
 (!docs/pages/includes/cluster-maintenance-config-spec.mdx!)
+
+## Cluster auth preferences
+
+Global cluster configuration options for authentication.
+
+```yaml
+metadata:
+  name: cluster-auth-preference
+spec:
+  # Sets the type of second factor to use.
+  # Possible values: "on", "off", "otp", "webauthn" and "optional".
+  # If "on" is set, all 2FA protocols are supported.
+  second_factor: "otp"
+
+  # The name of the OIDC or SAML connector. if this is not set, the first connector in the backend is used.
+  connector_name: ""
+
+  # webauthn is the settings for server-side Web authentication support.
+  webauthn:
+    # rp_id is the ID of the Relying Party.
+    # It should be set to the domain name of the Teleport installation.
+    #
+    # IMPORTANT: rp_id must never change in the lifetime of the cluster, because
+    # it's recorded in the registration data on the WebAuthn device. If the
+    # ri_id changes, all existing WebAuthn key registrations will become invalid
+    # and all users who use WebAuthn as the second factor will need to
+    # re-register.
+    rp_id: teleport.example.com
+    # Allow list of device attestation CAs in PEM format.
+    # If present, only devices whose attestation certificates match the
+    # certificates specified here may be registered (existing registrations are
+    # unchanged).
+    # If supplied in conjunction with `attestation_denied_cas`, then both
+    # conditions need to be true for registration to be allowed (the device
+    # MUST match an allowed CA and MUST NOT match a denied CA).
+    # By default all devices are allowed.
+    attestation_allowed_cas: []
+    # Deny list of device attestation CAs in PEM format.
+    # If present, only devices whose attestation certificates don't match the
+    # certificates specified here may be registered (existing registrations are
+    # unchanged).
+    attestation_denied_cas: []
+
+  # Enforce per-session MFA or PIV-hardware key restrictions on user login sessions.
+  # Possible values: true, false, "hardware_key", "hardware_key_touch"
+  require_mfa_type: "off"
+
+  # Sets whether connections with expired client certificates will be disconnected.
+  disconnect_expired_cert: false
+
+  # Sets whether headless authentication is allowed.
+  # Headless authentication requires WebAuthn.
+  # Defaults to true if webauthn is configured.
+  allow_headless: false
+
+  # Sets whether local auth is enabled alongside any other authentication
+  # type.
+  allow_local_auth: true
+
+  # Sets whether passwordless authentication is allowed.
+  # Requires Webauthn to work.
+  allow_passwordless: false
+
+  # Sets the message of the day for the cluster.
+  message_of_the_day: ""
+
+  # idp is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise
+  idp:
+    # options related to the Teleport SAML IdP.
+    saml:
+      # enables access to the Teleport SAML IdP.
+      enabled: true
+
+  # locking_mode is the cluster-wide locking mode default.
+  # Possible values: "strict" or "best_effort"
+  locking_mode: best_effort
+
+  # default_session_ttl defines the default TTL (time to live) of certificates
+  # issued to the users on this cluster.
+  default_session_ttl: "12h"
+
+  # The type of authentication to use for this cluster.
+  # Possible values: "local", "oidc", "saml" and "github"
+  type: local
+
+version: v2
+```
diff --git a/docs/pages/server-access/getting-started.mdx b/docs/pages/server-access/getting-started.mdx
index 6d620ce62fd04..ff12b839c16b7 100644
--- a/docs/pages/server-access/getting-started.mdx
+++ b/docs/pages/server-access/getting-started.mdx
@@ -133,19 +133,19 @@ configuration:
 Run the following command to create a user that can access the Teleport Web UI:
 
 ```code
-$ sudo tctl users add tele-admin --roles=editor,access --logins=root,ubuntu,ec2-user
+$ tctl users add myuser --roles=editor,access,reviewer --logins=root,ubuntu,ec2-user
 ```
 
 This will generate an initial login link where you can create a password and set
-up two-factor authentication for `tele-admin`.
+up two-factor authentication for `myuser`.
 
 <Admonition type="note" title="Note">
-We've only given `tele-admin` the roles `editor` and `access` according to the
+We've only given `myuser` the roles `editor` and `access` according to the
 Principle of Least Privilege.
 </Admonition>
 
 You should now be able to view your server in the Teleport Web UI after
-logging in as `tele-admin`:
+logging in as `myuser`:
 
    <Figure
      align="center"
@@ -171,7 +171,7 @@ On your local machine, log in to your cluster through `tsh`, assigning the
 
 ```code
 # Log in through tsh
-$ tsh login --proxy=tele.example.com --user=tele-admin
+$ tsh login --proxy=tele.example.com --user=myuser
 ```
 
 </ScopedBlock>
@@ -182,7 +182,7 @@ On your local machine, log in to your cluster through `tsh`, assigning the
 
 ```code
 # Log in through tsh
-$ tsh login --proxy=mytenant.teleport.sh:443 --user=tele-admin
+$ tsh login --proxy=mytenant.teleport.sh:443 --user=myuser
 ```
 
 </ScopedBlock>
@@ -190,13 +190,13 @@ $ tsh login --proxy=mytenant.teleport.sh:443 --user=tele-admin
 You'll be prompted to supply the password and second factor we set up
 previously.
 
-`tele-admin` will now see something similar to:
+`myuser` will now see something similar to:
 
 <ScopedBlock scope={["oss", "enterprise"]}>
 
 ```txt
 > Profile URL:      https://tele.example.com:443
-Logged in as:       tele-admin
+Logged in as:       myuser
 Cluster:            tele.example.com
 Roles:              access, editor
 Logins:             root, ubuntu, ec2-user
@@ -205,7 +205,7 @@ Valid until:        2021-04-30 06:39:13 -0500 CDT [valid for 12h0m0s]
 Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
 ```
 
-In this example, `tele-admin` is now logged into the `tele.example.com` cluster
+In this example, `myuser` is now logged into the `tele.example.com` cluster
 through Teleport SSH.
 
 </ScopedBlock>
@@ -213,7 +213,7 @@ through Teleport SSH.
 
 ```txt
 > Profile URL:        https://mytenant.teleport.sh:443
-Logged in as:       tele-admin
+Logged in as:       myuser
 Cluster:            mytenant.teleport.sh
 Roles:              access, editor
 Logins:             root, ubuntu, ec2-user
@@ -222,14 +222,14 @@ Valid until:        2021-04-30 06:39:13 -0500 CDT [valid for 12h0m0s]
 Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
 ```
 
-In this example, `tele-admin` is now logged into the `mytenant.teleport.sh`
+In this example, `myuser` is now logged into the `mytenant.teleport.sh`
 cluster through Teleport SSH.
 
 </ScopedBlock>
 
 ### Display cluster resources
 
-`tele-admin` can now execute the following to find the cluster's server names,
+`myuser` can now execute the following to find the cluster's server names,
 which are used for establishing SSH connections:
 
    ```code
@@ -248,7 +248,7 @@ which are used for establishing SSH connections:
 
 ### Connect to a server
 
-`tele-admin` can SSH into the bastion host server by running the following command locally:
+`myuser` can SSH into the bastion host server by running the following command locally:
 
 ```code
 # Use tsh to ssh into a server
@@ -262,7 +262,7 @@ Now, they can:
 - Traverse the Linux file system.
 - Execute desired commands.
 
-All commands executed by `tele-admin` are recorded and can be replayed in the
+All commands executed by `myuser` are recorded and can be replayed in the
 Teleport Web UI.
 
 The `tsh ssh` command allows users to do anything they could if they were to SSH
@@ -278,17 +278,22 @@ into a server using a third-party tool. Compare the two equivalent commands:
   </TabItem>
   <TabItem label="ssh">
 
+  To use the `ssh` client generate a SSH configuration file and postfix
+  the cluster name after the node name.
+
   <ScopedBlock scope={["oss", "enterprise"]}>
 
     ```code
-    $ ssh -J tele.example.com root@ip-172-31-41-144
+    $ tsh config > ssh_config_teleport
+    $ ssh -F ssh_config_teleport root@ip-172-31-41-144.tele.example.com
     ```
 
    </ScopedBlock>
   <ScopedBlock scope={["cloud"]}>
 
     ```code
-    $ ssh -J mytenant.teleport.sh root@ip-172-31-41-144
+    $ tsh config > ssh_config_teleport
+    $ ssh -F ssh_config_teleport root@ip-172-31-41-144.mytenant.teleport.sh
     ```
 
    </ScopedBlock>
@@ -298,7 +303,7 @@ into a server using a third-party tool. Compare the two equivalent commands:
 
 ## Step 4/4. Use tsh and the unified resource catalog to introspect the cluster
 
-Now, `tele-admin` has the ability to SSH into other servers within the cluster,
+Now, `myuser` has the ability to SSH into other servers within the cluster,
 traverse the Linux file system, and execute commands.
 
 - They have visibility into all resources within the cluster due to their
@@ -312,7 +317,7 @@ Execute the following command within your bastion host console:
 
 ```code
 # List servers
-$ sudo tctl nodes ls
+$ tctl nodes ls
 ```
 
 This displays the unified resource catalog with all queried resources in one
@@ -325,7 +330,7 @@ ip-172-31-35-170 4980899c-d260-414f-9aea-874feef71747
 ip-172-31-41-144 f3d2a65f-3fa7-451d-b516-68d189ff9ae5 127.0.0.1:3022 env=example,hostname=ip-172-31-41-144
 ```
 
-Note the "Labels" column on the farthest side. `tele-admin` can query all
+Note the "Labels" column on the farthest side. `myuser` can query all
 resources with a shared label using the command:
 
 ```code
@@ -342,7 +347,7 @@ that label since it remains unchanged.
 
 ### Run commands on all servers with a label
 
-`tele-admin` can also execute commands on all servers that share a label, vastly
+`myuser` can also execute commands on all servers that share a label, vastly
 simplifying repeated operations. For example, the following command will execute
 the `ls` command on each server and display the results in your terminal:
 
diff --git a/docs/pages/server-access/guides/azure-discovery.mdx b/docs/pages/server-access/guides/azure-discovery.mdx
index 6748a686938da..f6ffe016d0cc2 100644
--- a/docs/pages/server-access/guides/azure-discovery.mdx
+++ b/docs/pages/server-access/guides/azure-discovery.mdx
@@ -250,82 +250,7 @@ discovery_service:
 
 ## Step 5/5. [Optional] Customize the default installer script
 
-To customize the default installer script, execute the following command on
-your workstation:
-
-```code
-$ tctl get installer/default-installer > teleport-default-installer.yaml
-```
-
-The resulting `teleport-default-installer.yaml` can the be edited to
-change what gets executed when enrolling discovered Azure instances.
-
-After making the desired changes to the default installer, the
-resource can be updated by executing:
-
-```code
-$ tctl create -f teleport-default-installer.yaml
-```
-
-Multiple `installer` resources can exist and be specified in the
-`azure.install.script_name` section of a `discovery_service.azure` list item in
-`teleport.yaml`:
-
-```yaml
-discovery_service:
-  azure:
-    - types: ["vm"] 
-      tags:
-       - "env": "prod"
-      install: # optional section when default-installer is used.
-        script_name: "default-installer"
-    - types: ["vm"] 
-      tags:
-       - "env": "devel"
-      install:
-        script_name: "devel-installer"
-```
-
----
-
-The `installer` resource has the following templating options:
-
-- `{{ .MajorVersion }}`: the major version of Teleport to use when
-  installing from the repository.
-- `{{ .PublicProxyAddr }}`: the public address of the Teleport Proxy Service to
-connect to.
-- `{{ .RepoChannel }}`: Optional package repository (apt/yum) channel name.
-Has format `<channel>/<version>` e.g. stable/v(=teleport.major_version=). See [installation](../../installation.mdx#linux) for more details.
-
-These can be used as follows:
-
-```yaml
-kind: installer
-metadata:
-  name: default-installer
-spec:
-  script: |
-    echo {{ .PublicProxyAddr }}
-    echo Teleport-{{ .MajorVersion }}
-    echo Repository Channel: {{ .RepoChannel }}
-version: v1
-```
-
-Which, when retrieved by the Systems Manager document will evaluate to a script
-with the following contents:
-
-```sh
-echo teleport.example.com
-echo Teleport-(=teleport.version=)
-echo Repository Channel: stable/v(=teleport.version=)
-```
-
-The default installer will take the following actions:
-
-- Add an official Teleport repository to supported Linux distributions.
-- Install Teleport via `apt` or `yum`.
-- Generate the Teleport config file and write it to `/etc/teleport.yaml`.
-- Enable and start the Teleport service.
+(!docs/pages/includes/server-access/custom-installer.mdx cloud="Azure" matcher="azure" matchTypes="[\"vm\"]"!)
 
 ## Troubleshooting
 
@@ -340,7 +265,7 @@ for more information.
 
 ## Next steps
 
-- Read [Joining Nodes via Azure Managed Identity](../../management/join-services-to-your-cluster/azure.mdx)
+- Read [Joining Nodes via Azure Managed Identity](../../agents/join-services-to-your-cluster/azure.mdx)
   for more information on Azure tokens.
 - Full documentation on Azure discovery configuration can be found through the [
   config file reference documentation](../../reference/config.mdx).
diff --git a/docs/pages/server-access/guides/ec2-discovery.mdx b/docs/pages/server-access/guides/ec2-discovery.mdx
index 8eee57f4488ef..05846c8e0860c 100644
--- a/docs/pages/server-access/guides/ec2-discovery.mdx
+++ b/docs/pages/server-access/guides/ec2-discovery.mdx
@@ -294,82 +294,7 @@ This policy includes the following permissions:
 
 ## Step 6/7. [Optional] Customize the default installer script
 
-To customize the default installer script, execute the following command on
-your workstation:
-
-```code
-$ tctl get installer/default-installer > teleport-default-installer.yaml
-```
-
-The resulting `teleport-default-installer.yaml` can the be edited to
-change what gets executed when enrolling discovered EC2 instances.
-
-After making the desired changes to the default installer, the
-resource can be updated by executing:
-
-```code
-$ tctl create -f teleport-default-installer.yaml
-```
-
-Multiple `installer` resources can exist and be specified in the
-`aws.install.script_name` section of a `discovery_service.aws` list item in
-`teleport.yaml`:
-
-```yaml
-discovery_service:
-  aws:
-    - types: ["ec2"] 
-      tags:
-       - "env": "prod"
-      install: # optional section when default-installer is used.
-        script_name: "default-installer"
-    - types: ["ec2"] 
-      tags:
-       - "env": "devel"
-      install:
-        script_name: "devel-installer"
-```
-
----
-
-The `installer` resource has the following templating options:
-
-- `{{ .MajorVersion }}`: the major version of Teleport to use when
-  installing from the repository.
-- `{{ .PublicProxyAddr }}`: the public address of the Teleport Proxy Service to
-connect to.
-- `{{ .RepoChannel }}`: Optional package repository (apt/yum) channel name.
-Has format `<channel>/<version>` e.g. stable/v(=teleport.major_version=). See [installation](../../installation.mdx#linux) for more details.
-
-These can be used as follows:
-
-```yaml
-kind: installer
-metadata:
-  name: default-installer
-spec:
-  script: |
-    echo {{ .PublicProxyAddr }}
-    echo Teleport-{{ .MajorVersion }}
-    echo Repository Channel: {{ .RepoChannel }}
-version: v1
-```
-
-Which, when retrieved by the Systems Manager document will evaluate to a script
-with the following contents:
-
-```sh
-echo teleport.example.com
-echo Teleport-(=teleport.version=)
-echo Repository Channel: stable/v(=teleport.version=)
-```
-
-The default installer will take the following actions:
-
-- Add an official Teleport repository to supported Linux distributions.
-- Install Teleport via `apt` or `yum`.
-- Generate the Teleport config file and write it to `/etc/teleport.yaml`.
-- Enable and start the Teleport service.
+(!docs/pages/includes/server-access/custom-installer.mdx cloud="AWS" matcher="aws" matchTypes="[\"ec2\"]"!)
 
 ## Step 7/7. Start Teleport
 
@@ -413,7 +338,7 @@ See SSM RunCommand error codes and troubleshooting information in AWS documentat
 ## Next steps
 
 - Read [Joining Nodes via AWS IAM
-  Role](../../management/join-services-to-your-cluster/aws-iam.mdx)
+  Role](../../agents/join-services-to-your-cluster/aws-iam.mdx)
 for more information on IAM Invite Tokens.
 - Information on IAM best practices on EC2 instances managed by Systems
 Manager can be found for in the [AWS Cloud Operations & Migrations Blog
diff --git a/docs/pages/server-access/guides/host-user-creation.mdx b/docs/pages/server-access/guides/host-user-creation.mdx
index 11b0481ba9a2d..dc04a243c187b 100644
--- a/docs/pages/server-access/guides/host-user-creation.mdx
+++ b/docs/pages/server-access/guides/host-user-creation.mdx
@@ -6,17 +6,10 @@ description: How to configure Teleport to automatically create transient host us
 Teleport's SSH Service can be configured to automatically create local Unix users
 upon login.
 
-Host users created by Teleport are transient and will be deleted at the end of an SSH
-session. This feature has overlap with the [PAM](./ssh-pam.mdx) integration, however
-it provides some additional convenience of not having to manually configure a PAM
-script to create and delete users.
-
-It also has benefits over manually creating users as it allows for separate host
-users for each member of an organization. This provides more fine-grained control
-of permissions on a given host.
-
-Refer to the [Desktop Access RBAC guide](../../desktop-access/rbac.mdx#automatic-user-creation)
-for how to automatically create local users in Windows machines.
+This saves you from having to manually create users for each member of an
+organization and provides more fine-grained control of permissions on a given
+host. Host users created by Teleport are transient and will be deleted at the
+end of an SSH session.
 
 ## Prerequisites
 
@@ -35,8 +28,11 @@ since it must execute these commands in order to create transient users:
 
 ## Step 1/2. Configure a role
 
-First, create a role with `create_host_user` set to `true`. This will allow users
-with this role to have transient host users created at login time.
+First, create a role with `create_host_user_mode` set to `drop` or `keep`.
+
+Setting the option to `drop` will create transient users that are deleted once the
+session ends. Setting it to `keep` will create permanent users on the host at
+login time.
 
 The following role specification will allow users to log in as `nginxrestarter` on
 any matching Node. The host user will be created and added to the groups listed in
@@ -53,7 +49,7 @@ metadata:
 spec:
   options:
     # Allow automatic creation of users.
-    create_host_user: true
+    create_host_user_mode: drop
   allow:
     logins: [ "nginxrestarter" ]
     # List of host groups the created user will be added to. Any that don't already exist are created.
@@ -81,10 +77,15 @@ of the Linux distribution being used. See [User/Group Name Syntax](https://syste
 
 <Admonition type="warning">
 
-When a Teleport user accesses an SSH Service instance, Teleport checks each of
-the user's roles that match the instance. If at least one role matches the
-instance but does not include `create_host_user: true`, automatic user creation
-will be disabled. Roles that do not match the Node will not be checked.
+When a Teleport user accesses an SSH Service instance, Teleport checks each of the
+user's roles that match the instance. If at least one role matches the instance
+but does not specify `create_host_user_mode` to be either `keep` or `drop`,
+automatic user creation will be disabled. Roles that do not match the server will
+not be checked.
+
+If multiple roles match where one might specify `keep` and another `drop`,
+Teleport will default to `keep`, retaining the user on the server after the session
+ends.
 
 </Admonition>
 
@@ -106,7 +107,7 @@ metadata:
   name: auto-users
 spec:
   options:
-    create_host_user: true
+    create_host_user_mode: drop
   deny:
     host_sudoers: [
        "*" # ensure that users in this role never have sudoers files created on matching Nodes
@@ -135,6 +136,7 @@ ssh_service:
 
 When you connect to a remote Node via `tsh`, and host user creation is enabled, the
 Teleport SSH Service will automatically create a user on the host:
+
 ```code
 $ tsh login
 $ tsh ssh nginxrestarter@develnode
@@ -149,18 +151,36 @@ $ echo $?
 # 1
 ```
 
-When logging in, the `nginxrestarter` user and any groups that do not already exist
-will be created on the host. The `nginxrestarter` user will be added to the `ubuntu`,
-`nginx` and `other` groups as specified in the `host_groups` field.
+When the user above logs in, the `nginxrestarter` user and any groups that do
+not already exist are created on the host. The `nginxrestarter` user is added to
+the `ubuntu`, `nginx`, and `other` groups, as specified in the `host_groups`
+field.
 
-A file will also be created in `/etc/sudoers.d` with the contents of the
-`host_sudoers` file written with one entry per line, each prefixed with the username
-of the user that has logged in.
+The Teleport SSH Service executes `useradd` to create new users on the host, and
+returns an error if it cannot find the `useradd` binary. The `useradd` command
+creates a new home directory with the name of the new host user and adds the
+user to the groups specified in the Teleport user's roles.
+
+Aside from specifying a home directory and groups, the SSH Service executes
+`useradd` with the system defaults. For example, it associates the user with the
+default login shell for the host, which you can specify by setting the `SHELL`
+field in `/etc/default/useradd`. See the `useradd` manual for your system for a
+full description of the default behavior.
+
+The Teleport SSH Service also creates a file in `/etc/sudoers.d` with the
+contents of the `host_sudoers` file written with one entry per line, each
+prefixed with the username of the user that has logged in.
 
 The session can then proceed as usual, however once the SSH session ends, the user
-will be automatically removed and their home directory will be deleted. Files owned
-by the deleted user, created outside the home directory, will remain in place. Groups
-that were created will remain on the system after the session ends.
+will be automatically removed and their home directory will be deleted, as the
+matching role specified they should be dropped. Files owned by the deleted user,
+created outside the home directory, will remain in place. Groups that were created
+will remain on the system after the session ends.
 
 Should a Teleport SSH instance be restarted while a session is in progress, the user
 will be cleaned up at the next Teleport restart.
+
+## Next steps
+
+- Configure automatic user provisioning for [Database Access](../../database-access/rbac/configuring-auto-user-provisioning.mdx).
+- Configure automatic user provisioning for [Desktop Access](../../desktop-access/rbac.mdx#automatic-user-creation).
diff --git a/docs/pages/server-access/guides/openssh.mdx b/docs/pages/server-access/guides/openssh.mdx
index d9786f728558f..b43b6e9ea286a 100644
--- a/docs/pages/server-access/guides/openssh.mdx
+++ b/docs/pages/server-access/guides/openssh.mdx
@@ -17,6 +17,16 @@ and running, but in the long run, we would recommend replacing `sshd` with `tele
 - [Advanced session recording](bpf-session-recording.mdx)
 - [Restricting outbound network connections in SSH sessions](restricted-session.mdx)
 
+Teleport supports OpenSSH by proxying SSH connections through the Proxy Service. When a Teleport user requests to connect to an OpenSSH node, the Proxy Service checks the user's Teleport roles. 
+
+If the RBAC checks succeed, the Proxy Service authenticates to the OpenSSH node with a dynamically generated certificate signed by a Teleport CA. This allows the
+Proxy Service to record and audit connections to OpenSSH nodes. 
+
+The Proxy Service prevents Teleport users from bypassing auditing by requiring
+a certificate signed by a Teleport CA that only the Auth Service possesses.
+
+In this setup, the Teleport SSH Service performs RBAC checks as well as audits and records sessions on its host, which eliminates the need for connection termination when recording SSH sessions.
+
 ## Prerequisites
 
 - OpenSSH version 6.9 or above on your local machine. View your OpenSSH version
@@ -33,230 +43,30 @@ and running, but in the long run, we would recommend replacing `sshd` with `tele
   Teleport Proxy Service host.
 - (!docs/pages/includes/tctl.mdx!)
 
-## Step 1/5. Add a node resource to your Teleport cluster
-
-When you request an SSH connection to a OpenSSH node, Teleport needs to be able
-to find the node's IP address so it can establish a connection to it.
-
-Declare a `node` resource so Teleport knows how to reach your OpenSSH server.
-On your local machine, create a file called `openssh-node-resource.yaml` with the following content:
-
-```yaml
-kind: node
-version: v2
-sub_kind: openssh
-metadata:
-  name: a100fdd0-52db-4eca-a7ab-c3afa7a1564a
-  labels:
-    env: prod
-spec:
-  addr: 1.2.3.4:22
-  hostname: openssh-node
-```
-
-`spec.addr` and `spec.hostname` are mandatory. Assign `spec.addr` to the address and port of your node
-and `spec.hostname` to the name of the node as you would like users to see it in Teleport.
+## Step 1/3. Configure `sshd`
 
-The `metadata.labels` field labels the SSH Service instance so you can apply RBAC rules to it.
+Teleport only allows access to resources in your infrastructure via Teleport
+processes that that have joined the cluster.
 
-The `metadata.name` field isn't mandatory, but setting it here will save you some work later.
-
-To generate a new universal unique identifier (UUID) suitable for a `node` name, use the `uuidgen`
-on Linux or MacOS, or use the `New-Guid` cmdlet in Powershell on Windows.
-
-Create the node resource:
+On the machine the cluster's Proxy Service is running on, use the `tctl` tool to generate a new token. In the
+following example, a new token is created with a TTL of five minutes:
 
 ```code
-$ tctl create openssh-node-resource.yaml
+$ tctl tokens add --ttl=5m --type=node --format=text
+(=presets.tokens.first=)
 ```
 
-## Step 2/5. Configure `sshd` to trust the Teleport CA
-
-Later in this guide, we will generate an SSH client configuration that will use
-a certificate signed by the Teleport Auth Service to authenticate to your SSH
-server. For this to work, `sshd` must be told to allow users to log in with
-certificates generated by the Teleport Auth Service.
-
-Start by exporting the Teleport CA public key.
-
-On the host where you are running `sshd`, run the following commands, assigning <Var name="proxy" /> to the address of your Teleport Proxy Service:
+Copy the `teleport` binary to your `sshd` host. Configure `sshd` and create a node
+resource on your cluster with the following command, assigning <Var name="proxy" /> to the address of your Teleport Proxy Service,
+and <Var name="node" /> to the name of the node that will join the cluster:
 
 ```code
-$ export KEY=$(curl 'https://<Var name="proxy"/>/webapi/auth/export?type=openssh' | sed "s/cert-authority\ //")
+$ teleport join openssh --address <Var name="node" /> --proxy-server <Var name="proxy" /> --join-method token --token <TOKEN>
 ```
 
-Make the public key accessible to `sshd`:
+Note that both the Teleport Proxy Service and node addresses must contain a host and a port.
 
-```code
-$ sudo bash -c "echo \"$KEY\" > /etc/ssh/teleport_user_ca.pub"
-$ sudo bash -c "echo 'TrustedUserCAKeys /etc/ssh/teleport_user_ca.pub' >> /etc/ssh/sshd_config"
-```
-
-Restart `sshd`. For systemd-enabled hosts, run the following command:
-
-```code
-$ sudo systemctl restart sshd
-```
-
-Now, `sshd` will trust users who present a Teleport-issued certificate.
-
-## Step 3/5. Configure host authentication
-
-Next, ask Teleport to issue a valid host certificate for your `sshd` host. Later
-in this guide, we will configure your SSH client to trust the certificate,
-authenticating your `sshd` host for your SSH client. Like the user certificate
-we created earlier, the host certificate will be signed by the Teleport Auth
-Service.
-
-### Ensure that your user has the correct privileges
-
-Your user must be authorized to read and write host certificates.
-
-On your local machine, create a file called `host-certifier.yaml` with the
-following content:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: host-certifier
-spec:
-  allow:
-    rules:
-      - resources:
-          - host_cert
-        verbs:
-          - list
-          - create
-          - read
-          - update
-          - delete
-```
-
-Create the role resource:
-
-```code
-$ tctl create host-certifier.yaml
-# role 'host-certifier' has been created
-```
-
-(!docs/pages/includes/add-role-to-user.mdx role="host-certifier"!)
-
-You will now have the required permissions to export a host key for your `sshd`
-host.
-
-### Issue a host certificate
-
-<Details title="Find your node's UUID">
-
-When you created a `node` resource and if you didn't set the `metadata.name` field earlier,
-the Teleport Auth Service generated a universal unique identifier (UUID) for that node.
-Teleport Proxy Services uses the UUID to differentiate nodes with the same hostname, so
-it must be added to the host certificate. To find your node's UUID, first determine if its hostname is unique:
-
-```code
-$ tctl get node/openssh-node --format text
-```
-
-If only one node is displayed and you have `jq` installed, you can run the
-following command to get your node's UUID:
-
-```code
-$ tctl get node/openssh-node --format=json | jq -r ".[0].metadata.name"
-```
-
-Otherwise, find your node's UUID in the `metadata.name` field of the YAML
-output of this command:
-
-```code
-$ tctl get node/openssh-node
-```
-
-</Details>
-
-#### Create the host certificate
-
-When creating host certificates, it is important to specify all the domain names
-and addresses that refer to your node. If you try to connect to a node with a
-name or address that was not specified when creating it's host certificate,
-Teleport will reject the SSH connection.
-
-On your local machine, assign the IP address, fully qualified domain name of
-your node, and the node's UUID to an environment variable. If you won't be
-connecting to your node with its hostname, you can safely omit it.
-
-```code
-$ ADDR=1.2.3.4,openssh-node,a100fdd0-52db-4eca-a7ab-c3afa7a1564a
-```
-
-Run the following `tctl` command to generate a host certificate:
-
-```code
-$ tctl auth sign \
-      --host=${ADDR?} \
-      --format=openssh \
-      --out=myhost
-
-# The credentials have been written to myhost, myhost-cert.pub
-```
-
-The above command will result in a private key and certificate.
-
-<Details title="Issuing certificates for multiple hosts">
-
-To generate certificates for multiple hosts, assign the `host` flag to a
-comma-separated list of addresses. Certificates for wildcard domains are not
-supported by OpenSSH, so each domain must be fully qualified.
-
-</Details>
-
-Use `ssh-keygen` to verify the contents of the certificate:
-
-```code
-$ ssh-keygen -L -f myhost-cert.pub
-```
-
-The `Principals` section should contain the address you assigned to `ADDR`
-earlier:
-
-```
-myhost-cert.pub:
-        Type: ssh-rsa-cert-v01@openssh.com host certificate
-        Public key: RSA-CERT SHA256:nHkp6SnrAW4AV00VUaqPgR6SgdyvV9MmjUrYnwZ779A
-        Signing CA: RSA SHA256:euqx2Y8Pq+r0c94GKVNXAklBVTmAJtaQUn3/ehrfEJE (using rsa-sha2-512)
-        Key ID: ""
-        Serial: 0
-        Valid: after 2022-04-22T11:14:16
-        Principals:
-                1.2.3.4
-                openssh-node
-                a100fdd0-52db-4eca-a7ab-c3afa7a1564a
-        Critical Options: (none)
-        Extensions:
-                x-teleport-authority UNKNOWN OPTION (len 33)
-                x-teleport-role UNKNOWN OPTION (len 8)
-```
-
-Copy the host key and certificate to your `sshd` host, placing them in the
-directory `/etc/ssh`.
-
-Make sure these files have the correct permissions:
-
-```code
-$ sudo chmod 0600 /etc/ssh/myhost
-$ sudo chmod 0600 /etc/ssh/myhost-cert.pub
-```
-
-Then add the following lines to `/etc/ssh/sshd_config` on your `sshd` host:
-
-```yaml
-HostKey /etc/ssh/myhost
-HostCertificate /etc/ssh/myhost-cert.pub
-```
-
-Restart `sshd`.
-
-## Step 4/5. Generate an SSH client configuration
+## Step 2/3. Generate an SSH client configuration
 
 The next step is to configure your OpenSSH client to connect to your `sshd` host
 using credentials managed by Teleport. This configuration will use your user's
@@ -265,7 +75,7 @@ authenticate the `sshd` host using the host certificate you generated earlier.
 
 First, make sure you have logged in to your Teleport cluster:
 
-<ScopedBlock scope={["oss","enterprise"]}>
+<ScopedBlock scope={["oss"]}>
 
 ```code
 $ tsh status
@@ -279,6 +89,21 @@ $ tsh status
   Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
 ```
 
+</ScopedBlock>
+<ScopedBlock scope={["enterprise"]}>
+
+```code
+$ tsh status
+> Profile URL:        https://teleport.example.com:443
+  Logged in as:       myuser
+  Cluster:            teleport.example.com
+  Roles:              access, auditor, editor, reviewer, host-certifier
+  Logins:             ubuntu, root
+  Kubernetes:         enabled
+  Valid until:        2022-05-06 22:54:01 -0400 EDT [valid for 11h53m0s]
+  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
+```
+
 </ScopedBlock>
 <ScopedBlock scope={["cloud"]}>
 
@@ -287,7 +112,7 @@ $ tsh status
 > Profile URL:        https://mytenant.teleport.sh:443
   Logged in as:       myuser
   Cluster:            mytenant.teleport.sh
-  Roles:              access, auditor, editor, host-certifier
+  Roles:              access, auditor, editor, reviewer, host-certifier
   Logins:             ubuntu, root
   Kubernetes:         enabled
   Valid until:        2022-05-06 22:54:01 -0400 EDT [valid for 11h53m0s]
@@ -383,7 +208,7 @@ authenticate the host via the certificate we generated earlier.
 
 </Admonition>
 
-## Step 5/5. Connect to your `sshd` host
+## Step 3/3. Connect to your `sshd` host
 
 Once you have appended the new text to your OpenSSH client configuration file,
 you can log in to your `sshd` host using the configuration we generated earlier.
diff --git a/docs/pages/server-access/guides/ssh-pam.mdx b/docs/pages/server-access/guides/ssh-pam.mdx
index 9a099a88b0971..91da8c2063846 100644
--- a/docs/pages/server-access/guides/ssh-pam.mdx
+++ b/docs/pages/server-access/guides/ssh-pam.mdx
@@ -177,6 +177,12 @@ $ cat /etc/motd
 
 ## Create local Unix users on login
 
+<Admonition type="warning">
+Using PAM to create local users on login is obsolete and will be removed in a future version. Refer to the
+[Host user creation](./host-user-creation.mdx) guide to learn how to configure
+Teleport to automatically create local Linux users without PAM.
+</Admonition>
+
 Teleport has the ability to create local Unix users on login. This is
 very helpful if you're a large organization and want to provision local users and home
 directories on the fly.
diff --git a/docs/pages/server-access/guides/vscode.mdx b/docs/pages/server-access/guides/vscode.mdx
index 065ec34c125df..64dc25f3a03e7 100644
--- a/docs/pages/server-access/guides/vscode.mdx
+++ b/docs/pages/server-access/guides/vscode.mdx
@@ -13,7 +13,7 @@ This guide explains how to use Teleport and Visual Studio Code's remote SSH exte
 - OpenSSH client.
 - Visual Studio Code with the [Remote - SSH extension](https://code.visualstudio.com/docs/remote/ssh#_system-requirements)
   for the Remote - SSH extension.
-- One or more Teleport Nodes with Server Access enabled. If you have not yet
+- One or more Teleport agents running the Teleport SSH Service. If you have not yet
   done this, read the
   [Server Access Getting Started Guide](../getting-started.mdx) to learn how.
 
diff --git a/docs/pages/server-access/rbac.mdx b/docs/pages/server-access/rbac.mdx
index 1760125511527..c9bb313c9f8a5 100644
--- a/docs/pages/server-access/rbac.mdx
+++ b/docs/pages/server-access/rbac.mdx
@@ -48,7 +48,7 @@ spec:
       # a list of allowed values:
       'region': ['us-west-1', 'eu-central-1']
       # regular expressions start with ^ and end with $
-      # Teleport uses Golang's regexp syntax.
+      # Teleport uses Go's regexp syntax (https://github.com/google/re2/wiki/Syntax)
       # the list example above can be expressed as:
       'reg': '^us-west-1|eu-central-1$'
 
@@ -82,7 +82,7 @@ providers. For OIDC logins, `{{external.xyz}}` refers to the "xyz" claim; for
 SAML logins, `{{external.xyz}}` refers to the "xyz" assertion.
 
 For example, here is what a role may look like if you want to assign allowed
-server environment types and allowed logins from the user's Okta `environments` and 
+server environment types and allowed logins from the user's Okta `environments` and
 `allowedlogins` assertions:
 
 ```yaml
@@ -132,7 +132,9 @@ spec:
     #....
   options:
     # Controls whether this role supports auto provisioning of users.
-    create_host_user: true
+    # Options: drop (remove user on session end), keep (keep users at session end)
+    #          and off (disable host user creation)
+    create_host_user_mode: drop
     # forward_agent controls whether SSH agent forwarding is allowed
     forward_agent: true
     # port_forwarding controls whether TCP port forwarding is allowed for SSH
@@ -173,7 +175,7 @@ spec:
       # Optional: the default session recording mode to use when a
       # protocol-specific mode is not set.
       default: best_effort|strict
-      # Optional: Session recording mode for SSH sessions. 
+      # Optional: Session recording mode for SSH sessions.
       # If not set, the value set on default will be used.
       ssh: best_effort|strict
     # Enterprise-only: when enabled, the source IP that was used to log in is embedded in the user
diff --git a/docs/postrelease.md b/docs/postrelease.md
index da4e753de941b..3c280cd8914b4 100644
--- a/docs/postrelease.md
+++ b/docs/postrelease.md
@@ -6,8 +6,9 @@ This checklist is to be run after cutting a release.
 
 - [ ] Create PR to update default Teleport version in Teleport docs
   - Example: https://github.com/gravitational/teleport/pull/7033
-- [ ] Create PR to update default AMI versions in Makefile and AMIs.md under https://github.com/gravitational/teleport/blob/master/assets/aws
-  - Example command: `TELEPORT_VERSION=6.2.0 make -C assets/aws create-update-pr`
+- [ ] Create PR to update default AMI versions in Makefile and AMIs.md. This can
+  be done by manually triggering the
+  [GitHub Action](https://github.com/gravitational/teleport/actions/workflows/update-ami-ids.yaml)
 
 ### Major releases only
 
diff --git a/dronegen/buildbox.go b/dronegen/buildbox.go
index b4a696ca03feb..293ab96f7d449 100644
--- a/dronegen/buildbox.go
+++ b/dronegen/buildbox.go
@@ -52,8 +52,8 @@ func buildboxPipelineSteps() []step {
 
 	for _, name := range []string{"buildbox", "buildbox-arm", "buildbox-centos7"} {
 		for _, fips := range []bool{false, true} {
-			// FIPS is unsupported on ARM/ARM64
-			if name == "buildbox-arm" && fips {
+			// FIPS is only supported on centos7
+			if fips && name != "buildbox-centos7" {
 				continue
 			}
 			steps = append(steps, buildboxPipelineStep(name, fips))
diff --git a/dronegen/promote.go b/dronegen/promote.go
index 8540a04581d76..f528a94035ab3 100644
--- a/dronegen/promote.go
+++ b/dronegen/promote.go
@@ -37,9 +37,28 @@ func promoteBuildPipelines() []pipeline {
 		},
 	})
 	ociPipeline.Trigger.Target.Include = append(ociPipeline.Trigger.Target.Include, "promote-distroless")
-
 	promotePipelines = append(promotePipelines, ociPipeline)
 
+	amiPipeline := ghaBuildPipeline(ghaBuildType{
+		buildType:    buildType{os: "linux", fips: false},
+		trigger:      triggerPromote,
+		pipelineName: "promote-teleport-hardened-amis",
+		workflows: []ghaWorkflow{
+			{
+				name:              "promote-teleport-hardened-amis.yaml",
+				timeout:           150 * time.Minute,
+				ref:               "${DRONE_TAG}",
+				srcRefVar:         "DRONE_TAG",
+				shouldTagWorkflow: true,
+				inputs: map[string]string{
+					"release-source-tag": "${DRONE_TAG}",
+				},
+			},
+		},
+	})
+	amiPipeline.Trigger.Target.Include = append(amiPipeline.Trigger.Target.Include, "promote-hardened-amis")
+	promotePipelines = append(promotePipelines, amiPipeline)
+
 	updaterPipeline := ghaBuildPipeline(ghaBuildType{
 		buildType:    buildType{os: "linux", fips: false},
 		trigger:      triggerPromote,
@@ -57,7 +76,6 @@ func promoteBuildPipelines() []pipeline {
 		},
 	})
 	updaterPipeline.Trigger.Target.Include = append(updaterPipeline.Trigger.Target.Include, "promote-updater")
-
 	promotePipelines = append(promotePipelines, updaterPipeline)
 
 	return promotePipelines
diff --git a/dronegen/tag.go b/dronegen/tag.go
index bed5568e00b33..18ac3e049598c 100644
--- a/dronegen/tag.go
+++ b/dronegen/tag.go
@@ -213,7 +213,9 @@ func tagPipelines() []pipeline {
 		dependsOn: []string{
 			tagCleanupPipelineName,
 			"build-linux-amd64-deb",
+			"build-linux-amd64-fips-deb",
 			"build-linux-arm64-deb",
+			"build-linux-arm-deb",
 		},
 		workflows: []ghaWorkflow{
 			{
@@ -226,6 +228,26 @@ func tagPipelines() []pipeline {
 		},
 	}))
 
+	ps = append(ps, ghaBuildPipeline(ghaBuildType{
+		buildType:    buildType{os: "linux", fips: false},
+		trigger:      triggerTag,
+		pipelineName: "build-teleport-hardened-amis",
+		dependsOn: []string{
+			tagCleanupPipelineName,
+			"build-linux-amd64-deb",
+			"build-linux-amd64-fips-deb",
+		},
+		workflows: []ghaWorkflow{
+			{
+				name:              "release-teleport-hardened-amis.yaml",
+				srcRefVar:         "DRONE_TAG",
+				ref:               "${DRONE_TAG}",
+				timeout:           150 * time.Minute,
+				shouldTagWorkflow: true,
+			},
+		},
+	}))
+
 	ps = append(ps, ghaBuildPipeline(ghaBuildType{
 		buildType:    buildType{os: "linux", fips: false},
 		trigger:      triggerTag,
diff --git a/e b/e
index 7fcae62338a03..7c71465e23f50 160000
--- a/e
+++ b/e
@@ -1 +1 @@
-Subproject commit 7fcae62338a038dffd220ce2f24b2a19c0cdea61
+Subproject commit 7c71465e23f507aab03a1b6416c3cddb8b54e369
diff --git a/examples/agent-pool-terraform/agent-pool.tf b/examples/agent-pool-terraform/agent-pool.tf
new file mode 100644
index 0000000000000..3c93d1cb29cbb
--- /dev/null
+++ b/examples/agent-pool-terraform/agent-pool.tf
@@ -0,0 +1,40 @@
+resource "random_string" "token" {
+  count  = var.agent_count
+  length = 32
+}
+
+resource "teleport_provision_token" "agent" {
+  count = var.agent_count
+  spec = {
+    roles = [
+      "Node",
+      "App",
+      "Db",
+      "Kube",
+    ]
+    name = random_string.token[count.index].result
+  }
+}
+
+resource "aws_instance" "teleport_agent" {
+  count = var.agent_count
+  # Amazon Linux 2023 64-bit x86
+  ami           = "ami-04a0ae173da5807d3"
+  instance_type = "t3.small"
+  subnet_id     = var.subnet_id
+  user_data = templatefile("./userdata", {
+    token                 = teleport_provision_token.agent[count.index].id
+    proxy_service_address = var.proxy_service_address
+    teleport_version      = var.teleport_version
+  })
+
+  // The following two blocks adhere to security best practices.
+
+  metadata_options {
+    http_tokens = "required"
+  }
+
+  root_block_device {
+    encrypted = true
+  }
+}
diff --git a/examples/agent-pool-terraform/inputs.tf b/examples/agent-pool-terraform/inputs.tf
new file mode 100644
index 0000000000000..963241c6a167a
--- /dev/null
+++ b/examples/agent-pool-terraform/inputs.tf
@@ -0,0 +1,24 @@
+variable "agent_count" {
+  type        = number
+  description = "Number of agents to deploy"
+}
+
+variable "proxy_service_address" {
+  type        = string
+  description = "Host and HTTPS port of the Teleport Proxy Service"
+}
+
+variable "aws_region" {
+  type        = string
+  description = "Region in which to deploy AWS resources"
+}
+
+variable "teleport_version" {
+  type        = string
+  description = "Version of Teleport to install on each agent"
+}
+
+variable "subnet_id" {
+  type        = string
+  description = "ID of the AWS subnet for deploying Teleport agents"
+}
diff --git a/examples/agent-pool-terraform/provider.tf b/examples/agent-pool-terraform/provider.tf
new file mode 100644
index 0000000000000..aba52f2cee641
--- /dev/null
+++ b/examples/agent-pool-terraform/provider.tf
@@ -0,0 +1,23 @@
+terraform {
+  required_providers {
+    teleport = {
+      source  = "terraform.releases.teleport.dev/gravitational/teleport"
+      version = "TELEPORT_VERSION"
+    }
+
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 4.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.aws_region
+}
+
+provider "teleport" {
+  # Update addr to point to your Teleport Cloud tenant URL's host:port
+  addr               = var.proxy_service_address
+  identity_file_path = "terraform-identity"
+}
diff --git a/examples/agent-pool-terraform/userdata b/examples/agent-pool-terraform/userdata
new file mode 100644
index 0000000000000..499a953079e43
--- /dev/null
+++ b/examples/agent-pool-terraform/userdata
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+curl https://goteleport.com/static/install.sh | bash -s ${teleport_version}
+
+echo ${token} > /var/lib/teleport/token
+cat<<EOF >/etc/teleport.yaml
+version: v3
+teleport:
+  auth_token: /var/lib/teleport/token
+  proxy_server: ${proxy_service_address}
+app_service:
+  enabled: true
+  resources:
+  - labels:
+      "*": "*"
+auth_service:
+  enabled: false
+db_service:
+  enabled: true
+  resources:
+  - labels:
+      "*": "*"
+discovery_service:
+  enabled: true
+kubernetes_service:
+  enabled: true
+  resources:
+  - labels:
+      "*": "*"
+proxy_service:
+  enabled: false
+ssh_service:
+  labels:
+    role: agent-pool
+EOF
+
+systemctl restart teleport;
diff --git a/examples/aws/terraform/AMIS.md b/examples/aws/terraform/AMIS.md
index 36c273c94e9ec..82b2cbafa26fa 100644
--- a/examples/aws/terraform/AMIS.md
+++ b/examples/aws/terraform/AMIS.md
@@ -6,65 +6,65 @@ is updated when new AMI versions are released.
 ### OSS
 
 ```
-# eu-north-1 v13.0.4 OSS: ami-0e456970c3d8ce778
-# ap-south-1 v13.0.4 OSS: ami-0f20e4b9f46e6bef8
-# eu-west-1 v13.0.4 OSS: ami-087c8ffe4195869c1
-# eu-west-2 v13.0.4 OSS: ami-0a5d70dadc59b2c93
-# eu-west-3 v13.0.4 OSS: ami-0dc0413eca7ce22c4
-# ap-northeast-1 v13.0.4 OSS: ami-0c7411d796ef186d5
-# ap-northeast-2 v13.0.4 OSS: ami-0d2aafe908106fb97
-# ap-northeast-3 v13.0.4 OSS: ami-0c5b613328c3abb6b
-# sa-east-1 v13.0.4 OSS: ami-0c8b9cd11c3dba792
-# ca-central-1 v13.0.4 OSS: ami-0bc93eaf421705203
-# ap-southeast-1 v13.0.4 OSS: ami-023d8130cdb70b1ef
-# ap-southeast-2 v13.0.4 OSS: ami-061859d1766458f9c
-# eu-central-1 v13.0.4 OSS: ami-058aecfcc59f80275
-# us-east-1 v13.0.4 OSS: ami-0f95177773657a929
-# us-east-2 v13.0.4 OSS: ami-0afa281e768a43c5d
-# us-west-1 v13.0.4 OSS: ami-0fa589e805ede5661
-# us-west-2 v13.0.4 OSS: ami-03d23486fadfe6773
+# eu-north-1 v13.1.5 OSS: ami-0ab7fd02c23626733
+# ap-south-1 v13.1.5 OSS: ami-05ac109a994299014
+# eu-west-1 v13.1.5 OSS: ami-01a1be585e6bf08db
+# eu-west-2 v13.1.5 OSS: ami-01fb07b1a72822e56
+# eu-west-3 v13.1.5 OSS: ami-032c11ce46a9425c5
+# ap-northeast-1 v13.1.5 OSS: ami-0ca8eb11a6a74b637
+# ap-northeast-2 v13.1.5 OSS: ami-0b6e74fe3fe492ef6
+# ap-northeast-3 v13.1.5 OSS: ami-0f84cc7a49ecad4b2
+# sa-east-1 v13.1.5 OSS: ami-0631f43957ef286ac
+# ca-central-1 v13.1.5 OSS: ami-0067512c2515556bf
+# ap-southeast-1 v13.1.5 OSS: ami-0668a58f8e725340b
+# ap-southeast-2 v13.1.5 OSS: ami-0ccc6f54993da34db
+# eu-central-1 v13.1.5 OSS: ami-01ba23f2b188ba2f9
+# us-east-1 v13.1.5 OSS: ami-03a820b1082b402c9
+# us-east-2 v13.1.5 OSS: ami-0b9fe88d3c3a92976
+# us-west-1 v13.1.5 OSS: ami-0a793f60fd0fe8d7e
+# us-west-2 v13.1.5 OSS: ami-0f72a8daabb54afe1
 ```
 
 ### Enterprise
 
 ```
-# eu-north-1 v13.0.4 Enterprise: ami-01b7de62d934a1efd
-# ap-south-1 v13.0.4 Enterprise: ami-0f2d744d5812f0fbe
-# eu-west-1 v13.0.4 Enterprise: ami-0801f805b0476432c
-# eu-west-2 v13.0.4 Enterprise: ami-06696868d5c37d1de
-# eu-west-3 v13.0.4 Enterprise: ami-043a1463ed41328c3
-# ap-northeast-1 v13.0.4 Enterprise: ami-0b454fb373a19151e
-# ap-northeast-2 v13.0.4 Enterprise: ami-046fec63f7c708f39
-# ap-northeast-3 v13.0.4 Enterprise: ami-0cdc2aaa352e8bb0f
-# sa-east-1 v13.0.4 Enterprise: ami-07f1c87192a12adc6
-# ca-central-1 v13.0.4 Enterprise: ami-05dd46a37f75dbce6
-# ap-southeast-1 v13.0.4 Enterprise: ami-0aade401d9b5ba430
-# ap-southeast-2 v13.0.4 Enterprise: ami-05c8b26976d9b19c5
-# eu-central-1 v13.0.4 Enterprise: ami-0ff0739e080204e6d
-# us-east-1 v13.0.4 Enterprise: ami-089846cfb1a11df51
-# us-east-2 v13.0.4 Enterprise: ami-0c3412828c9a380c1
-# us-west-1 v13.0.4 Enterprise: ami-0471846535bce1dff
-# us-west-2 v13.0.4 Enterprise: ami-07db20fc56711995f
+# eu-north-1 v13.1.5 Enterprise: ami-0db9e7bbe5e09d950
+# ap-south-1 v13.1.5 Enterprise: ami-0e735ef7e583190c7
+# eu-west-1 v13.1.5 Enterprise: ami-0d371bce827d6bfa6
+# eu-west-2 v13.1.5 Enterprise: ami-0f1d1c2e0ed55a058
+# eu-west-3 v13.1.5 Enterprise: ami-04b2a7174120def1a
+# ap-northeast-1 v13.1.5 Enterprise: ami-039d05a3a619417dd
+# ap-northeast-2 v13.1.5 Enterprise: ami-0964e55b89b625e1d
+# ap-northeast-3 v13.1.5 Enterprise: ami-0664f0c33632f33d0
+# sa-east-1 v13.1.5 Enterprise: ami-0c132a23ff13bf32c
+# ca-central-1 v13.1.5 Enterprise: ami-0c1f0a01369e0c9fc
+# ap-southeast-1 v13.1.5 Enterprise: ami-02590376ac57b7455
+# ap-southeast-2 v13.1.5 Enterprise: ami-04253b2c2d0fbf584
+# eu-central-1 v13.1.5 Enterprise: ami-030f177b7fb62e16e
+# us-east-1 v13.1.5 Enterprise: ami-0ba645aa461a46541
+# us-east-2 v13.1.5 Enterprise: ami-02726918d5d538ab3
+# us-west-1 v13.1.5 Enterprise: ami-027d115ebf419e135
+# us-west-2 v13.1.5 Enterprise: ami-0f634319c26dbf491
 ```
 
 ### Enterprise FIPS
 
 ```
-# eu-north-1 v13.0.4 Enterprise FIPS: ami-09664af279ca808e1
-# ap-south-1 v13.0.4 Enterprise FIPS: ami-02aadf400ce519527
-# eu-west-1 v13.0.4 Enterprise FIPS: ami-066c4060ea6e7a984
-# eu-west-2 v13.0.4 Enterprise FIPS: ami-0c153171ed647073e
-# eu-west-3 v13.0.4 Enterprise FIPS: ami-011a0b378cb8bae23
-# ap-northeast-1 v13.0.4 Enterprise FIPS: ami-095fde202b0594474
-# ap-northeast-2 v13.0.4 Enterprise FIPS: ami-0ce2306c7f43abdd2
-# ap-northeast-3 v13.0.4 Enterprise FIPS: ami-08f2e49e6a6f22a9a
-# sa-east-1 v13.0.4 Enterprise FIPS: ami-0cd3188e182d0f4bd
-# ca-central-1 v13.0.4 Enterprise FIPS: ami-0ad38b83fa7e2609e
-# ap-southeast-1 v13.0.4 Enterprise FIPS: ami-0152211344c373795
-# ap-southeast-2 v13.0.4 Enterprise FIPS: ami-0bc2ddd11544f86dd
-# eu-central-1 v13.0.4 Enterprise FIPS: ami-05aeaaeac457510d5
-# us-east-1 v13.0.4 Enterprise FIPS: ami-0214561cd39839ab8
-# us-east-2 v13.0.4 Enterprise FIPS: ami-0c1529de044da6497
-# us-west-1 v13.0.4 Enterprise FIPS: ami-0181a475426ada22a
-# us-west-2 v13.0.4 Enterprise FIPS: ami-03e8f8edd6a8cb7ed
+# eu-north-1 v13.1.5 Enterprise FIPS: ami-01879f86bc6311c6c
+# ap-south-1 v13.1.5 Enterprise FIPS: ami-05c2aaf54614bc9a1
+# eu-west-1 v13.1.5 Enterprise FIPS: ami-06395c9a08314ae65
+# eu-west-2 v13.1.5 Enterprise FIPS: ami-0c748eeb75f7c9f49
+# eu-west-3 v13.1.5 Enterprise FIPS: ami-0d442cca6c63bbfd5
+# ap-northeast-1 v13.1.5 Enterprise FIPS: ami-05def040a1e977594
+# ap-northeast-2 v13.1.5 Enterprise FIPS: ami-01c69f0b50f784c75
+# ap-northeast-3 v13.1.5 Enterprise FIPS: ami-095eae851c8ec33a2
+# sa-east-1 v13.1.5 Enterprise FIPS: ami-04771677602b36ecf
+# ca-central-1 v13.1.5 Enterprise FIPS: ami-0b03fe997fe760a93
+# ap-southeast-1 v13.1.5 Enterprise FIPS: ami-08b6db13afcb43a73
+# ap-southeast-2 v13.1.5 Enterprise FIPS: ami-0c2000c643dd58aa6
+# eu-central-1 v13.1.5 Enterprise FIPS: ami-09730ffcadecd4700
+# us-east-1 v13.1.5 Enterprise FIPS: ami-05584727caeef07c1
+# us-east-2 v13.1.5 Enterprise FIPS: ami-02c419cf050c40437
+# us-west-1 v13.1.5 Enterprise FIPS: ami-04f1149ed5b7bd862
+# us-west-2 v13.1.5 Enterprise FIPS: ami-09f4ec09c0835aa43
 ```
diff --git a/examples/aws/terraform/ha-autoscale-cluster/README.md b/examples/aws/terraform/ha-autoscale-cluster/README.md
index 204be8a786a60..e9e55325877f0 100644
--- a/examples/aws/terraform/ha-autoscale-cluster/README.md
+++ b/examples/aws/terraform/ha-autoscale-cluster/README.md
@@ -46,7 +46,7 @@ export TF_VAR_cluster_name="teleport.example.com"
 # OSS: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss*'
 # Enterprise: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent*'
 # FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
-export TF_VAR_ami_name="gravitational-teleport-ami-ent-13.0.4"
+export TF_VAR_ami_name="gravitational-teleport-ami-ent-13.1.5"
 
 # AWS SSH key name to provision in installed instances, should be available in the region
 export TF_VAR_key_name="example"
diff --git a/examples/aws/terraform/starter-cluster/README.md b/examples/aws/terraform/starter-cluster/README.md
index 83f2aeafa83de..13cb9a894706d 100644
--- a/examples/aws/terraform/starter-cluster/README.md
+++ b/examples/aws/terraform/starter-cluster/README.md
@@ -86,7 +86,7 @@ TF_VAR_license_path ?= "/path/to/license"
 # OSS: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss*'
 # Enterprise: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent*'
 # FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
-TF_VAR_ami_name ?= "gravitational-teleport-ami-ent-13.0.4"
+TF_VAR_ami_name ?= "gravitational-teleport-ami-ent-13.1.5"
 
 # Route 53 hosted zone to use, must be a root zone registered in AWS, e.g. example.com
 TF_VAR_route53_zone ?= "example.com"
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/templates/resources.teleport.dev_oktaimportrules.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/templates/resources.teleport.dev_oktaimportrules.yaml
new file mode 100644
index 0000000000000..ef701ae310395
--- /dev/null
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/templates/resources.teleport.dev_oktaimportrules.yaml
@@ -0,0 +1,180 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  name: teleportoktaimportrules.resources.teleport.dev
+spec:
+  group: resources.teleport.dev
+  names:
+    kind: TeleportOktaImportRule
+    listKind: TeleportOktaImportRuleList
+    plural: teleportoktaimportrules
+    shortNames:
+    - oktaimportrule
+    - oktaimportrules
+    singular: teleportoktaimportrule
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: OktaImportRule is the Schema for the oktaimportrules API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: OktaImportRule resource definition v1 from Teleport
+            properties:
+              mappings:
+                description: Mappings is a list of matches that will map match conditions
+                  to labels.
+                items:
+                  properties:
+                    add_labels:
+                      description: AddLabels specifies which labels to add if any
+                        of the previous matches match.
+                      nullable: true
+                      additionalProperties:
+                        type: string
+                      type: object
+                    match:
+                      description: Match is a set of matching rules for this mapping.
+                        If any of these match, then the mapping will be applied.
+                      items:
+                        properties:
+                          app_ids:
+                            description: AppIDs is a list of app IDs to match against.
+                            items:
+                              type: string
+                            nullable: true
+                            type: array
+                          app_name_regexes:
+                            description: AppNameRegexes is a list of regexes to match
+                              against app names.
+                            items:
+                              type: string
+                            nullable: true
+                            type: array
+                          group_ids:
+                            description: GroupIDs is a list of group IDs to match
+                              against.
+                            items:
+                              type: string
+                            nullable: true
+                            type: array
+                          group_name_regexes:
+                            description: GroupNameRegexes is a list of regexes to
+                              match against group names.
+                            items:
+                              type: string
+                            nullable: true
+                            type: array
+                        type: object
+                      nullable: true
+                      type: array
+                  type: object
+                nullable: true
+                type: array
+              priority:
+                description: Priority represents the priority of the rule application.
+                  Lower numbered rules will be applied first.
+                format: int32
+                type: integer
+            type: object
+          status:
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of an object's state
+                items:
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource. --- This struct is intended for direct
+                    use as an array at the field path .status.conditions.  For example,
+                    \n type FooStatus struct{ // Represents the observations of a
+                    foo's current state. // Known .status.conditions.type are: \"Available\",
+                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
+                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
+                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
+                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
+                  properties:
+                    lastTransitionTime:
+                      description: lastTransitionTime is the last time the condition
+                        transitioned from one status to another. This should be when
+                        the underlying condition changed.  If that is not known, then
+                        using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: message is a human readable message indicating
+                        details about the transition. This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: observedGeneration represents the .metadata.generation
+                        that the condition was set based upon. For instance, if .metadata.generation
+                        is currently 12, but the .status.conditions[x].observedGeneration
+                        is 9, the condition is out of date with respect to the current
+                        state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: reason contains a programmatic identifier indicating
+                        the reason for the condition's last transition. Producers
+                        of specific condition types may define expected values and
+                        meanings for this field, and whether the values are considered
+                        a guaranteed API. The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        --- Many .condition.type values are consistent across resources
+                        like Available, but because arbitrary conditions can be useful
+                        (see .node.status.conditions), the ability to deconflict is
+                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              teleportResourceID:
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/templates/resources.teleport.dev_roles.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/templates/resources.teleport.dev_roles.yaml
index 3c62a33cf1ca2..5567ada89f4d5 100644
--- a/examples/chart/teleport-cluster/charts/teleport-operator/templates/resources.teleport.dev_roles.yaml
+++ b/examples/chart/teleport-cluster/charts/teleport-operator/templates/resources.teleport.dev_roles.yaml
@@ -41,6 +41,10 @@ spec:
                     description: AppLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  app_labels_expression:
+                    description: AppLabelsExpression is a predicate expression used
+                      to allow/deny access to Apps.
+                    type: string
                   aws_role_arns:
                     description: AWSRoleARNs is a list of AWS role ARNs this role
                       is allowed to assume.
@@ -61,12 +65,20 @@ spec:
                     description: ClusterLabels is a map of node labels (used to dynamically
                       grant access to clusters).
                     type: object
+                  cluster_labels_expression:
+                    description: ClusterLabelsExpression is a predicate expression
+                      used to allow/deny access to remote Teleport clusters.
+                    type: string
                   db_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
                     description: DatabaseLabels are used in RBAC system to allow/deny
                       access to databases.
                     type: object
+                  db_labels_expression:
+                    description: DatabaseLabelsExpression is a predicate expression
+                      used to allow/deny access to Databases.
+                    type: string
                   db_names:
                     description: DatabaseNames is a list of database names this role
                       is allowed to connect to.
@@ -87,6 +99,10 @@ spec:
                     description: DatabaseServiceLabels are used in RBAC system to
                       allow/deny access to Database Services.
                     type: object
+                  db_service_labels_expression:
+                    description: DatabaseServiceLabelsExpression is a predicate expression
+                      used to allow/deny access to Database Services.
+                    type: string
                   db_users:
                     description: DatabaseUsers is a list of databases users this role
                       is allowed to connect as.
@@ -114,6 +130,10 @@ spec:
                     description: GroupLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  group_labels_expression:
+                    description: GroupLabelsExpression is a predicate expression used
+                      to allow/deny access to user groups.
+                    type: string
                   host_groups:
                     description: HostGroups is a list of groups for created users
                       to be added to
@@ -196,6 +216,10 @@ spec:
                     description: KubernetesLabels is a map of kubernetes cluster labels
                       used for RBAC.
                     type: object
+                  kubernetes_labels_expression:
+                    description: KubernetesLabelsExpression is a predicate expression
+                      used to allow/deny access to kubernetes clusters.
+                    type: string
                   kubernetes_resources:
                     description: KubernetesResources is the Kubernetes Resources this
                       Role grants access to.
@@ -232,6 +256,10 @@ spec:
                     description: NodeLabels is a map of node labels (used to dynamically
                       grant access to nodes).
                     type: object
+                  node_labels_expression:
+                    description: NodeLabelsExpression is a predicate expression used
+                      to allow/deny access to SSH nodes.
+                    type: string
                   request:
                     nullable: true
                     properties:
@@ -439,6 +467,10 @@ spec:
                     description: WindowsDesktopLabels are used in the RBAC system
                       to allow/deny access to Windows desktops.
                     type: object
+                  windows_desktop_labels_expression:
+                    description: WindowsDesktopLabelsExpression is a predicate expression
+                      used to allow/deny access to Windows desktops.
+                    type: string
                   windows_desktop_logins:
                     description: WindowsDesktopLogins is a list of desktop login names
                       allowed/denied for Windows desktops.
@@ -457,6 +489,10 @@ spec:
                     description: AppLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  app_labels_expression:
+                    description: AppLabelsExpression is a predicate expression used
+                      to allow/deny access to Apps.
+                    type: string
                   aws_role_arns:
                     description: AWSRoleARNs is a list of AWS role ARNs this role
                       is allowed to assume.
@@ -477,12 +513,20 @@ spec:
                     description: ClusterLabels is a map of node labels (used to dynamically
                       grant access to clusters).
                     type: object
+                  cluster_labels_expression:
+                    description: ClusterLabelsExpression is a predicate expression
+                      used to allow/deny access to remote Teleport clusters.
+                    type: string
                   db_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
                     description: DatabaseLabels are used in RBAC system to allow/deny
                       access to databases.
                     type: object
+                  db_labels_expression:
+                    description: DatabaseLabelsExpression is a predicate expression
+                      used to allow/deny access to Databases.
+                    type: string
                   db_names:
                     description: DatabaseNames is a list of database names this role
                       is allowed to connect to.
@@ -503,6 +547,10 @@ spec:
                     description: DatabaseServiceLabels are used in RBAC system to
                       allow/deny access to Database Services.
                     type: object
+                  db_service_labels_expression:
+                    description: DatabaseServiceLabelsExpression is a predicate expression
+                      used to allow/deny access to Database Services.
+                    type: string
                   db_users:
                     description: DatabaseUsers is a list of databases users this role
                       is allowed to connect as.
@@ -530,6 +578,10 @@ spec:
                     description: GroupLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  group_labels_expression:
+                    description: GroupLabelsExpression is a predicate expression used
+                      to allow/deny access to user groups.
+                    type: string
                   host_groups:
                     description: HostGroups is a list of groups for created users
                       to be added to
@@ -612,6 +664,10 @@ spec:
                     description: KubernetesLabels is a map of kubernetes cluster labels
                       used for RBAC.
                     type: object
+                  kubernetes_labels_expression:
+                    description: KubernetesLabelsExpression is a predicate expression
+                      used to allow/deny access to kubernetes clusters.
+                    type: string
                   kubernetes_resources:
                     description: KubernetesResources is the Kubernetes Resources this
                       Role grants access to.
@@ -648,6 +704,10 @@ spec:
                     description: NodeLabels is a map of node labels (used to dynamically
                       grant access to nodes).
                     type: object
+                  node_labels_expression:
+                    description: NodeLabelsExpression is a predicate expression used
+                      to allow/deny access to SSH nodes.
+                    type: string
                   request:
                     nullable: true
                     properties:
@@ -855,6 +915,10 @@ spec:
                     description: WindowsDesktopLabels are used in the RBAC system
                       to allow/deny access to Windows desktops.
                     type: object
+                  windows_desktop_labels_expression:
+                    description: WindowsDesktopLabelsExpression is a predicate expression
+                      used to allow/deny access to Windows desktops.
+                    type: string
                   windows_desktop_logins:
                     description: WindowsDesktopLogins is a list of desktop login names
                       allowed/denied for Windows desktops.
@@ -1018,7 +1082,7 @@ spec:
                     type: string
                   request_prompt:
                     description: RequestPrompt is an optional message which tells
-                      users what they aught to
+                      users what they aught to request.
                     type: string
                   require_session_mfa:
                     description: RequireMFAType is the type of MFA requirement enforced
@@ -1143,6 +1207,10 @@ spec:
                     description: AppLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  app_labels_expression:
+                    description: AppLabelsExpression is a predicate expression used
+                      to allow/deny access to Apps.
+                    type: string
                   aws_role_arns:
                     description: AWSRoleARNs is a list of AWS role ARNs this role
                       is allowed to assume.
@@ -1163,12 +1231,20 @@ spec:
                     description: ClusterLabels is a map of node labels (used to dynamically
                       grant access to clusters).
                     type: object
+                  cluster_labels_expression:
+                    description: ClusterLabelsExpression is a predicate expression
+                      used to allow/deny access to remote Teleport clusters.
+                    type: string
                   db_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
                     description: DatabaseLabels are used in RBAC system to allow/deny
                       access to databases.
                     type: object
+                  db_labels_expression:
+                    description: DatabaseLabelsExpression is a predicate expression
+                      used to allow/deny access to Databases.
+                    type: string
                   db_names:
                     description: DatabaseNames is a list of database names this role
                       is allowed to connect to.
@@ -1189,6 +1265,10 @@ spec:
                     description: DatabaseServiceLabels are used in RBAC system to
                       allow/deny access to Database Services.
                     type: object
+                  db_service_labels_expression:
+                    description: DatabaseServiceLabelsExpression is a predicate expression
+                      used to allow/deny access to Database Services.
+                    type: string
                   db_users:
                     description: DatabaseUsers is a list of databases users this role
                       is allowed to connect as.
@@ -1216,6 +1296,10 @@ spec:
                     description: GroupLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  group_labels_expression:
+                    description: GroupLabelsExpression is a predicate expression used
+                      to allow/deny access to user groups.
+                    type: string
                   host_groups:
                     description: HostGroups is a list of groups for created users
                       to be added to
@@ -1298,6 +1382,10 @@ spec:
                     description: KubernetesLabels is a map of kubernetes cluster labels
                       used for RBAC.
                     type: object
+                  kubernetes_labels_expression:
+                    description: KubernetesLabelsExpression is a predicate expression
+                      used to allow/deny access to kubernetes clusters.
+                    type: string
                   kubernetes_resources:
                     description: KubernetesResources is the Kubernetes Resources this
                       Role grants access to.
@@ -1334,6 +1422,10 @@ spec:
                     description: NodeLabels is a map of node labels (used to dynamically
                       grant access to nodes).
                     type: object
+                  node_labels_expression:
+                    description: NodeLabelsExpression is a predicate expression used
+                      to allow/deny access to SSH nodes.
+                    type: string
                   request:
                     nullable: true
                     properties:
@@ -1541,6 +1633,10 @@ spec:
                     description: WindowsDesktopLabels are used in the RBAC system
                       to allow/deny access to Windows desktops.
                     type: object
+                  windows_desktop_labels_expression:
+                    description: WindowsDesktopLabelsExpression is a predicate expression
+                      used to allow/deny access to Windows desktops.
+                    type: string
                   windows_desktop_logins:
                     description: WindowsDesktopLogins is a list of desktop login names
                       allowed/denied for Windows desktops.
@@ -1559,6 +1655,10 @@ spec:
                     description: AppLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  app_labels_expression:
+                    description: AppLabelsExpression is a predicate expression used
+                      to allow/deny access to Apps.
+                    type: string
                   aws_role_arns:
                     description: AWSRoleARNs is a list of AWS role ARNs this role
                       is allowed to assume.
@@ -1579,12 +1679,20 @@ spec:
                     description: ClusterLabels is a map of node labels (used to dynamically
                       grant access to clusters).
                     type: object
+                  cluster_labels_expression:
+                    description: ClusterLabelsExpression is a predicate expression
+                      used to allow/deny access to remote Teleport clusters.
+                    type: string
                   db_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
                     description: DatabaseLabels are used in RBAC system to allow/deny
                       access to databases.
                     type: object
+                  db_labels_expression:
+                    description: DatabaseLabelsExpression is a predicate expression
+                      used to allow/deny access to Databases.
+                    type: string
                   db_names:
                     description: DatabaseNames is a list of database names this role
                       is allowed to connect to.
@@ -1605,6 +1713,10 @@ spec:
                     description: DatabaseServiceLabels are used in RBAC system to
                       allow/deny access to Database Services.
                     type: object
+                  db_service_labels_expression:
+                    description: DatabaseServiceLabelsExpression is a predicate expression
+                      used to allow/deny access to Database Services.
+                    type: string
                   db_users:
                     description: DatabaseUsers is a list of databases users this role
                       is allowed to connect as.
@@ -1632,6 +1744,10 @@ spec:
                     description: GroupLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  group_labels_expression:
+                    description: GroupLabelsExpression is a predicate expression used
+                      to allow/deny access to user groups.
+                    type: string
                   host_groups:
                     description: HostGroups is a list of groups for created users
                       to be added to
@@ -1714,6 +1830,10 @@ spec:
                     description: KubernetesLabels is a map of kubernetes cluster labels
                       used for RBAC.
                     type: object
+                  kubernetes_labels_expression:
+                    description: KubernetesLabelsExpression is a predicate expression
+                      used to allow/deny access to kubernetes clusters.
+                    type: string
                   kubernetes_resources:
                     description: KubernetesResources is the Kubernetes Resources this
                       Role grants access to.
@@ -1750,6 +1870,10 @@ spec:
                     description: NodeLabels is a map of node labels (used to dynamically
                       grant access to nodes).
                     type: object
+                  node_labels_expression:
+                    description: NodeLabelsExpression is a predicate expression used
+                      to allow/deny access to SSH nodes.
+                    type: string
                   request:
                     nullable: true
                     properties:
@@ -1957,6 +2081,10 @@ spec:
                     description: WindowsDesktopLabels are used in the RBAC system
                       to allow/deny access to Windows desktops.
                     type: object
+                  windows_desktop_labels_expression:
+                    description: WindowsDesktopLabelsExpression is a predicate expression
+                      used to allow/deny access to Windows desktops.
+                    type: string
                   windows_desktop_logins:
                     description: WindowsDesktopLogins is a list of desktop login names
                       allowed/denied for Windows desktops.
@@ -2120,7 +2248,7 @@ spec:
                     type: string
                   request_prompt:
                     description: RequestPrompt is an optional message which tells
-                      users what they aught to
+                      users what they aught to request.
                     type: string
                   require_session_mfa:
                     description: RequireMFAType is the type of MFA requirement enforced
diff --git a/examples/chart/teleport-cluster/templates/auth/_config.common.tpl b/examples/chart/teleport-cluster/templates/auth/_config.common.tpl
index 60b6f3d03a5ec..bdfda15fc0f69 100644
--- a/examples/chart/teleport-cluster/templates/auth/_config.common.tpl
+++ b/examples/chart/teleport-cluster/templates/auth/_config.common.tpl
@@ -55,6 +55,7 @@ auth_service:
   proxy_listener_mode: {{ .Values.proxyListenerMode }}
 {{- end }}
 teleport:
+  auth_server: 127.0.0.1:3025
   log:
     severity: {{ $logLevel }}
     output: {{ .Values.log.output }}
diff --git a/examples/chart/teleport-cluster/templates/auth/clusterrole.yaml b/examples/chart/teleport-cluster/templates/auth/clusterrole.yaml
index ad6ffdcd18068..6bf0886b437ab 100644
--- a/examples/chart/teleport-cluster/templates/auth/clusterrole.yaml
+++ b/examples/chart/teleport-cluster/templates/auth/clusterrole.yaml
@@ -43,6 +43,8 @@ rules:
   - teleportloginrules/status
   - teleportprovisiontokens
   - teleportprovisiontokens/status
+  - teleportoktaimportrules
+  - teleportoktaimportrules/status
   verbs:
   - get
   - list
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap
index d6debffac98fc..75650c0cdb89d 100644
--- a/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap
@@ -42,6 +42,8 @@ adds operator permissions to ClusterRole:
       - teleportloginrules/status
       - teleportprovisiontokens
       - teleportprovisiontokens/status
+      - teleportoktaimportrules
+      - teleportoktaimportrules/status
       verbs:
       - get
       - list
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap
index 93271ea29e945..4472337c26713 100644
--- a/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap
@@ -35,6 +35,7 @@ matches snapshot for acme-off.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -69,6 +70,7 @@ matches snapshot for acme-on.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -103,6 +105,7 @@ matches snapshot for acme-uri-staging.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -138,6 +141,7 @@ matches snapshot for auth-connector-name.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -170,6 +174,7 @@ matches snapshot for auth-disable-local.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -205,6 +210,7 @@ matches snapshot for auth-locking-mode.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -240,6 +246,7 @@ matches snapshot for auth-passwordless.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -274,6 +281,7 @@ matches snapshot for auth-type-legacy.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -308,6 +316,7 @@ matches snapshot for auth-type.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -346,6 +355,7 @@ matches snapshot for auth-webauthn-legacy.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -384,6 +394,7 @@ matches snapshot for auth-webauthn.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -418,6 +429,7 @@ matches snapshot for aws-dynamodb-autoscaling.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -469,6 +481,7 @@ matches snapshot for aws-ha-acme.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -514,6 +527,7 @@ matches snapshot for aws-ha-antiaffinity.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -559,6 +573,7 @@ matches snapshot for aws-ha-log.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -605,6 +620,7 @@ matches snapshot for aws-ha.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -650,6 +666,7 @@ matches snapshot for aws.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -693,6 +710,7 @@ matches snapshot for existing-tls-secret-with-ca.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -727,6 +745,7 @@ matches snapshot for existing-tls-secret.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -763,6 +782,7 @@ matches snapshot for gcp-ha-acme.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -807,6 +827,7 @@ matches snapshot for gcp-ha-antiaffinity.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -851,6 +872,7 @@ matches snapshot for gcp-ha-log.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -896,6 +918,7 @@ matches snapshot for gcp.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -938,6 +961,7 @@ matches snapshot for initcontainers.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -972,6 +996,7 @@ matches snapshot for kube-cluster-name.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1006,6 +1031,7 @@ matches snapshot for log-basic.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1040,6 +1066,7 @@ matches snapshot for log-extra.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1074,6 +1101,7 @@ matches snapshot for log-legacy.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1108,6 +1136,7 @@ matches snapshot for priority-class-name.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1142,6 +1171,7 @@ matches snapshot for proxy-listener-mode-multiplex.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1176,6 +1206,7 @@ matches snapshot for proxy-listener-mode-separate.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1210,6 +1241,7 @@ matches snapshot for public-addresses.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1244,6 +1276,7 @@ matches snapshot for separate-mongo-listener.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1278,6 +1311,7 @@ matches snapshot for separate-postgres-listener.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1312,6 +1346,7 @@ matches snapshot for service.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1347,6 +1382,7 @@ matches snapshot for session-recording.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1383,6 +1419,7 @@ matches snapshot for standalone-customsize.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1419,6 +1456,7 @@ matches snapshot for standalone-existingpvc.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1453,6 +1491,7 @@ matches snapshot for tolerations.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1499,6 +1538,7 @@ matches snapshot for version-override.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
@@ -1533,6 +1573,7 @@ matches snapshot for volumes.yaml:
       ssh_service:
         enabled: false
       teleport:
+        auth_server: 127.0.0.1:3025
         log:
           format:
             extra_fields:
diff --git a/examples/chart/teleport-kube-agent/.lint/host-aliases.yaml b/examples/chart/teleport-kube-agent/.lint/host-aliases.yaml
new file mode 100644
index 0000000000000..21faa7193009b
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/.lint/host-aliases.yaml
@@ -0,0 +1,11 @@
+proxyAddr: proxy.example.com:3080
+kubeClusterName: test-kube-cluster-name
+hostAliases:
+  - ip: "127.0.0.1"
+    hostnames:
+      - "foo.local"
+      - "bar.local"
+  - ip: "10.1.2.3"
+    hostnames:
+      - "foo.remote"
+      - "bar.remote"
diff --git a/examples/chart/teleport-kube-agent/templates/_helpers.tpl b/examples/chart/teleport-kube-agent/templates/_helpers.tpl
index 6502590b3bc29..8827f3454912e 100644
--- a/examples/chart/teleport-kube-agent/templates/_helpers.tpl
+++ b/examples/chart/teleport-kube-agent/templates/_helpers.tpl
@@ -17,6 +17,14 @@ if serviceAccount is not defined or serviceAccount.name is empty, use .Release.N
 {{- coalesce .Values.serviceAccount.name .Values.serviceAccountName .Release.Name -}}
 {{- end -}}
 
+{{/*
+Create the name of the service account to use for the post-delete hook
+if serviceAccount is not defined or serviceAccount.name is empty, use .Release.Name-delete-hook
+*/}}
+{{- define "teleport-kube-agent.deleteHookServiceAccountName" -}}
+{{- coalesce .Values.serviceAccount.name .Values.serviceAccountName (printf "%s-delete-hook" .Release.Name) -}}
+{{- end -}}
+
 {{- define "teleport-kube-agent.version" -}}
 {{- if .Values.teleportVersionOverride -}}
   {{- .Values.teleportVersionOverride -}}
diff --git a/examples/chart/teleport-kube-agent/templates/delete_hook.yaml b/examples/chart/teleport-kube-agent/templates/delete_hook.yaml
index 3adacc4960a13..0b8cd06cc9eb6 100644
--- a/examples/chart/teleport-kube-agent/templates/delete_hook.yaml
+++ b/examples/chart/teleport-kube-agent/templates/delete_hook.yaml
@@ -1,13 +1,16 @@
+{{- if .Values.serviceAccount.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ .Release.Name }}-delete-hook
+  name: {{ template "teleport-kube-agent.deleteHookServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
   annotations:
     "helm.sh/hook": post-delete
     "helm.sh/hook-weight": "-4"
     "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
 ---
+{{- end }}
+{{- if .Values.rbac.create }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -40,6 +43,7 @@ subjects:
   name: {{ .Release.Name }}-delete-hook
   namespace: {{ .Release.Namespace }}
 ---
+{{- end }}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -61,7 +65,7 @@ spec:
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
-      serviceAccountName: {{ .Release.Name }}-delete-hook
+      serviceAccountName: {{ template "teleport-kube-agent.deleteHookServiceAccountName" . }}
       restartPolicy: OnFailure
 {{- if .Values.tolerations }}
       tolerations:
diff --git a/examples/chart/teleport-kube-agent/templates/deployment.yaml b/examples/chart/teleport-kube-agent/templates/deployment.yaml
index 35423e0ac0698..30b7924fe8b84 100644
--- a/examples/chart/teleport-kube-agent/templates/deployment.yaml
+++ b/examples/chart/teleport-kube-agent/templates/deployment.yaml
@@ -43,6 +43,9 @@ spec:
       {{- if .Values.dnsPolicy }}
       dnsPolicy: {{ .Values.dnsPolicy | quote }}
       {{- end }}
+      {{- if .Values.hostAliases }}
+      hostAliases: {{- toYaml .Values.hostAliases | nindent 8 }}
+      {{- end }}
       {{- if or .Values.affinity (gt (int $replicaCount) 1) }}
       affinity:
         {{- if .Values.affinity }}
diff --git a/examples/chart/teleport-kube-agent/templates/statefulset.yaml b/examples/chart/teleport-kube-agent/templates/statefulset.yaml
index dbec1d2ade4c9..4f310106233fe 100644
--- a/examples/chart/teleport-kube-agent/templates/statefulset.yaml
+++ b/examples/chart/teleport-kube-agent/templates/statefulset.yaml
@@ -39,6 +39,9 @@ spec:
       {{- if .Values.dnsPolicy }}
       dnsPolicy: {{ .Values.dnsPolicy | quote }}
       {{- end }}
+      {{- if .Values.hostAliases }}
+      hostAliases: {{- toYaml .Values.hostAliases | nindent 8 }}
+      {{- end }}
       securityContext:
         fsGroup: 9807
       {{- if or .Values.affinity (gt (int $replicaCount) 1) }}
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap
index 77ba33df7ceed..4bffc5ddf4cf8 100644
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap
@@ -1,3 +1,150 @@
+should create ServiceAccount for post-delete hook by default:
+  1: |
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        helm.sh/hook: post-delete
+        helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+        helm.sh/hook-weight: "-4"
+      name: RELEASE-NAME-delete-hook
+      namespace: NAMESPACE
+? should inherit ServiceAccount name from values and not create serviceAccount if
+  serviceAccount.create is false and serviceAccount.name is set
+: 1: |
+    containers:
+    - args:
+      - kube-state
+      - delete
+      command:
+      - teleport
+      env:
+      - name: KUBE_NAMESPACE
+        valueFrom:
+          fieldRef:
+            fieldPath: metadata.namespace
+      - name: RELEASE_NAME
+        value: RELEASE-NAME
+      image: public.ecr.aws/gravitational/teleport-distroless:14.0.0-dev
+      imagePullPolicy: IfNotPresent
+      name: post-delete-job
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+    restartPolicy: OnFailure
+    serviceAccountName: lint-serviceaccount
+should not create ServiceAccount for post-delete hook if serviceAccount.create is false:
+  1: |
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: Role
+    metadata:
+      annotations:
+        helm.sh/hook: post-delete
+        helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+        helm.sh/hook-weight: "-3"
+      name: RELEASE-NAME-delete-hook
+      namespace: NAMESPACE
+    rules:
+    - apiGroups:
+      - ""
+      resources:
+      - secrets
+      verbs:
+      - get
+      - delete
+      - list
+  2: |
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata:
+      annotations:
+        helm.sh/hook: post-delete
+        helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+        helm.sh/hook-weight: "-2"
+      name: RELEASE-NAME-delete-hook
+      namespace: NAMESPACE
+    roleRef:
+      apiGroup: rbac.authorization.k8s.io
+      kind: Role
+      name: RELEASE-NAME-delete-hook
+    subjects:
+    - kind: ServiceAccount
+      name: RELEASE-NAME-delete-hook
+      namespace: NAMESPACE
+  3: |
+    apiVersion: batch/v1
+    kind: Job
+    metadata:
+      annotations:
+        helm.sh/hook: post-delete
+        helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+        helm.sh/hook-weight: "-1"
+      name: RELEASE-NAME-delete-hook
+      namespace: NAMESPACE
+    spec:
+      template:
+        metadata:
+          name: RELEASE-NAME-delete-hook
+        spec:
+          containers:
+          - args:
+            - kube-state
+            - delete
+            command:
+            - teleport
+            env:
+            - name: KUBE_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: RELEASE_NAME
+              value: RELEASE-NAME
+            image: public.ecr.aws/gravitational/teleport-distroless:14.0.0-dev
+            imagePullPolicy: IfNotPresent
+            name: post-delete-job
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - all
+              readOnlyRootFilesystem: true
+              runAsNonRoot: true
+              runAsUser: 9807
+          restartPolicy: OnFailure
+          serviceAccountName: lint-serviceaccount
+should not create ServiceAccount, Role or RoleBinding for post-delete hook if serviceAccount.create and rbac.create are false:
+  1: |
+    containers:
+    - args:
+      - kube-state
+      - delete
+      command:
+      - teleport
+      env:
+      - name: KUBE_NAMESPACE
+        valueFrom:
+          fieldRef:
+            fieldPath: metadata.namespace
+      - name: RELEASE_NAME
+        value: RELEASE-NAME
+      image: public.ecr.aws/gravitational/teleport-distroless:14.0.0-dev
+      imagePullPolicy: IfNotPresent
+      name: post-delete-job
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+    restartPolicy: OnFailure
+    serviceAccountName: lint-serviceaccount
 should set nodeSelector in post-delete hook:
   1: |
     containers:
diff --git a/examples/chart/teleport-kube-agent/tests/job_test.yaml b/examples/chart/teleport-kube-agent/tests/job_test.yaml
index a2c0371f6e652..997dc79267085 100644
--- a/examples/chart/teleport-kube-agent/tests/job_test.yaml
+++ b/examples/chart/teleport-kube-agent/tests/job_test.yaml
@@ -5,9 +5,27 @@ templates:
 release:
   upgrade: true
 tests:
+  - it: should create ServiceAccount, Role, RoleBinding and Job for post-delete hook by default
+    template: delete_hook.yaml
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    assets:
+      - containsDocument:
+          kind: ServiceAccount
+          apiVersion: v1
+      - containsDocument:
+          kind: Role
+          apiVersion: rbac.authorization.k8s.io/v1
+      - containsDocument:
+          kind: RoleBinding
+          apiVersion: rbac.authorization.k8s.io/v1
+      - containsDocument:
+          kind: Job
+          apiVersion: batch/v1
+
   - it: should set securityContext in post-delete hook
     template: delete_hook.yaml
-    # first 3 items are ServiceAccount, Role, RoleBinding, 3rd (zero-indexed) is the Job
+    # documentIndex: 0=ServiceAccount 1=Role 2=RoleBinding 3=Job
     documentIndex: 3
     values:
       - ../.lint/backwards-compatibility.yaml
@@ -34,7 +52,7 @@ tests:
 
   - it: should set nodeSelector in post-delete hook
     template: delete_hook.yaml
-    # first 3 items are ServiceAccount, Role, RoleBinding, 3rd (zero-indexed) is the Job
+    # documentIndex: 0=ServiceAccount 1=Role 2=RoleBinding 3=Job
     documentIndex: 3
     values:
       - ../.lint/node-selector.yaml
@@ -45,3 +63,146 @@ tests:
             gravitational.io/k8s-role: node
       - matchSnapshot:
           path: spec.template.spec
+
+  - it: should create ServiceAccount for post-delete hook by default
+    template: delete_hook.yaml
+    # documentIndex: 0=ServiceAccount 1=Role 2=RoleBinding 3=Job
+    documentIndex: 0
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    asserts:
+      - containsDocument:
+          kind: ServiceAccount
+          apiVersion: v1
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-delete-hook
+      - matchSnapshot:
+        path: spec.template.spec
+
+  - it: should create ServiceAccount for post-delete hook with a custom name if serviceAccount.name is set and serviceAccount.create is true
+    template: delete_hook.yaml
+    # documentIndex: 0=ServiceAccount 1=Role 2=RoleBinding 3=Job
+    documentIndex: 0
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      serviceAccount:
+        create: true
+        name: lint-serviceaccount
+    asserts:
+      - containsDocument:
+          kind: ServiceAccount
+          apiVersion: v1
+      - equal:
+          path: metadata.name
+          value: lint-serviceaccount
+
+  - it: should create Role for post-delete hook by default
+    template: delete_hook.yaml
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    asserts:
+      - containsDocument:
+          kind: Role
+          apiVersion: rbac.authorization.k8s.io/v1
+
+  - it: should create RoleBinding for post-delete hook by default
+    template: delete_hook.yaml
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    asserts:
+      - containsDocument:
+          kind: RoleBinding
+          apiVersion: rbac.authorization.k8s.io/v1
+
+  - it: should not create ServiceAccount for post-delete hook if serviceAccount.create is false
+    template: delete_hook.yaml
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      serviceAccount:
+        create: false
+        name: lint-serviceaccount
+    asserts:
+      - not: true
+        containsDocument:
+          kind: ServiceAccount
+          apiVersion: v1
+      - matchSnapshot:
+        path: spec.template.spec
+
+  - it: should inherit ServiceAccount name from values and not create serviceAccount if serviceAccount.create is false and serviceAccount.name is set
+    template: delete_hook.yaml
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      serviceAccount:
+        create: false
+        name: lint-serviceaccount
+    asserts:
+      - not: true
+        containsDocument:
+          kind: ServiceAccount
+          apiVersion: v1
+      # ServiceAccount is not created in this mode
+      # documentIndex: 0=Role 1=RoleBinding 2=Job
+      - documentIndex: 2
+        equal:
+          path: spec.template.spec.serviceAccountName
+          value: lint-serviceaccount
+      - documentIndex: 2
+        matchSnapshot:
+          path: spec.template.spec
+
+  - it: should not create Role for post-delete hook if rbac.create is false
+    template: delete_hook.yaml
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      rbac:
+        create: false
+    asserts:
+      - not: true
+        containsDocument:
+          kind: Role
+          apiVersion: rbac.authorization.k8s.io/v1
+
+  - it: should not create RoleBinding for post-delete hook if rbac.create is false
+    template: delete_hook.yaml
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      rbac:
+        create: false
+    asserts:
+      - not: true
+        containsDocument:
+          kind: RoleBinding
+          apiVersion: rbac.authorization.k8s.io/v1
+
+  - it: should not create ServiceAccount, Role or RoleBinding for post-delete hook if serviceAccount.create and rbac.create are false
+    template: delete_hook.yaml
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      rbac:
+        create: false
+      serviceAccount:
+        create: false
+        name: lint-serviceaccount
+    asserts:
+      - not: true
+        containsDocument:
+          kind: ServiceAccount
+          apiVersion: v1
+      - not: true
+        containsDocument:
+          kind: Role
+          apiVersion: rbac.authorization.k8s.io/v1
+      - not: true
+        containsDocument:
+          kind: RoleBinding
+          apiVersion: rbac.authorization.k8s.io/v1
+      - matchSnapshot:
+          path: spec.template.spec
diff --git a/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml b/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
index 85f5b7e8a2ba3..b950b97a8ce08 100644
--- a/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
+++ b/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
@@ -701,3 +701,21 @@ tests:
           content:
             name: TELEPORT_INSTALL_METHOD_HELM_KUBE_AGENT
             value: "true"
+
+  - it: should set the hostAliases when specified
+    template: statefulset.yaml
+    values:
+      - ../.lint/stateful.yaml
+      - ../.lint/host-aliases.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.hostAliases
+          value:
+            - ip: "127.0.0.1"
+              hostnames:
+                - "foo.local"
+                - "bar.local"
+            - ip: "10.1.2.3"
+              hostnames:
+                - "foo.remote"
+                - "bar.remote"
diff --git a/examples/chart/teleport-kube-agent/values.schema.json b/examples/chart/teleport-kube-agent/values.schema.json
index 3602816475553..f022d39268a36 100644
--- a/examples/chart/teleport-kube-agent/values.schema.json
+++ b/examples/chart/teleport-kube-agent/values.schema.json
@@ -578,6 +578,11 @@
             "type": "array",
             "default": []
         },
+        "hostAliases": {
+            "$id": "#/properties/hostAliases",
+            "type": "array",
+            "default": []
+        },
         "imagePullPolicy": {
             "$id": "#/properties/imagePullPolicy",
             "type": "string",
diff --git a/examples/chart/teleport-kube-agent/values.yaml b/examples/chart/teleport-kube-agent/values.yaml
index 52bc63a53973e..257f35003e06e 100644
--- a/examples/chart/teleport-kube-agent/values.yaml
+++ b/examples/chart/teleport-kube-agent/values.yaml
@@ -146,7 +146,7 @@ updater:
   # `updater.versionServer` is the URL of the version server the agent fetches
   # the target version from. The complete version endpoint is built by
   # concatenating `versionServer` and `releaseChannel`.
-  versionServer: "https://update.gravitational.io/v1/"
+  versionServer: "https://updates.releases.teleport.dev/v1/"
   # Release channel the agent subscribes to.
   releaseChannel: "stable/cloud"
   image: public.ecr.aws/gravitational/teleport-kube-agent-updater
@@ -366,6 +366,17 @@ extraVolumeMounts: []
 # - name: myvolume
 #   mountPath: /path/on/host
 
+# Pod Host aliases (see https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/)
+hostAliases: []
+# - ip: "127.0.0.1"
+#   hostnames:
+#     - "foo.local"
+#     - "bar.local"
+# - ip: "10.1.2.3"
+#   hostnames:
+#     - "foo.remote"
+#     - "bar.remote"
+
 # Allow the imagePullPolicy to be overridden
 imagePullPolicy: IfNotPresent
 
diff --git a/examples/dynamoathenamigration/README.md b/examples/dynamoathenamigration/README.md
new file mode 100644
index 0000000000000..53144581845a0
--- /dev/null
+++ b/examples/dynamoathenamigration/README.md
@@ -0,0 +1,90 @@
+# Dynamomigration tool
+
+Dynamomigration tool allows to export Teleport audit events logs from DynamoDB
+table into Athena Audit log.
+It's using DynamoDB export to S3 to export data.
+
+Requirements:
+
+* Point-in-time recovery (PITR) on DynamoDB table
+* Writable filesystem on machine where script will be executed
+* IAM permissions:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "AllowDynamoExportAndList",
+            "Effect": "Allow",
+            "Action": [
+                "dynamodb:ExportTableToPointInTime"
+            ],
+            "Resource": "arn:aws:dynamodb:region:account:table/tablename"
+        },
+        {
+            "Sid": "AllowDynamoExportDescribe",
+            "Effect": "Allow",
+            "Action": [
+                "dynamodb:DescribeExport"
+            ],
+            "Resource": "arn:aws:dynamodb:region:account:table/tablename/*"
+        },
+        {
+            "Sid": "AllowWriteReadDestinationBucket",
+            "Effect": "Allow",
+            "Action": [
+                "s3:AbortMultipartUpload",
+                "s3:PutObject",
+                "s3:PutObjectAcl",
+                "s3:GetObject"
+            ],
+            "Resource": "arn:aws:s3:::export-bucket/*"
+        },
+        {
+            "Sid": "AllowWriteLargePayloadsBucket",
+            "Effect": "Allow",
+            "Action": [
+                "s3:AbortMultipartUpload",
+                "s3:PutObject",
+                "s3:PutObjectAcl"
+            ],
+            "Resource": "arn:aws:s3:::large-payloads-bucket/*"
+        },
+        {
+            "Sid": "AllowPublishToAthenaTopic",
+            "Effect": "Allow",
+            "Action": [
+                "sns:Publish"
+            ],
+            "Resource": "arn:aws:sns:region:account:topicname"
+        }
+    ]
+}
+```
+
+## Example usage
+
+Build: `cd examples/dynamoathenamigration/cmd && go build -o dynamoathenamigration`.
+
+It is recommended to test export first using `-dryRun` flag. DryRun does not emit any events,
+it makes sure that export is in valid format and events can be parsed.
+
+Dry run example:
+
+```shell
+./dynamoathenamigration -dynamoARN='arn:aws:dynamodb:region:account:table/tablename' \
+  -exportPath='s3://bucket/prefix' \
+  -dryRun
+```
+
+Full migration:
+
+```shell
+./dynamoathenamigration -dynamoARN='arn:aws:dynamodb:region:account:table/tablename' \
+  -exportPath='s3://bucket/prefix' \
+  -snsTopicARN=arn:aws:sns:region:account:topicname \
+  -largePayloadsPath=s3://bucket/prefix
+```
+
+To reuse existing export without triggering new one, use `-exportARN=xxx`.
diff --git a/examples/dynamoathenamigration/cmd/main.go b/examples/dynamoathenamigration/cmd/main.go
new file mode 100644
index 0000000000000..d8d3a7499c398
--- /dev/null
+++ b/examples/dynamoathenamigration/cmd/main.go
@@ -0,0 +1,104 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"context"
+	"flag"
+	"net/url"
+	"os"
+	"os/signal"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/gravitational/teleport/examples/dynamoathenamigration"
+)
+
+func main() {
+	timeStr := flag.String("exportTime", "", "exportTime is time (RFC3339 format) in the past from which to export table data, empty for the current time")
+	exportARN := flag.String("exportARN", "", "exportARN allows to reuse already finished export without triggering new")
+	dynamoARN := flag.String("dynamoARN", "", "ARN of DynamoDB table to export")
+	s3exportPath := flag.String("exportPath", "", "S3 address where export should be placed, in format s3://bucket/optional_prefix")
+	snsTopicARN := flag.String("snsTopicARN", "", "SNS topic ARN configured in athena logger")
+	s3largePayloadsPath := flag.String("largePayloadsPath", "", "S3 address configured in athena logger for placing large events payloads, in format s3://bucket/optional_prefix")
+	dryRun := flag.Bool("dryRun", false, "dryRun means export will be triggered and verified, however events won't be published on SNS topic")
+	noOfEmitWorker := flag.Int("noOfEmitWorker", 5, "noOfEmitWorker defines number of workers emitting events to athena logger")
+	checkpointPath := flag.String("checkpointPath", "", "checkpointPath defines where checkpoint file will be stored")
+	exportLocalDir := flag.String("exportLocalDir", "", "exportLocalDir defines directory where export will be downloaded")
+	debug := flag.Bool("d", false, "debug logs")
+	flag.Parse()
+
+	level := log.InfoLevel
+	if *debug {
+		level = log.DebugLevel
+	}
+	logger := log.New()
+	logger.SetLevel(level)
+
+	cfg := dynamoathenamigration.Config{
+		ExportARN:       *exportARN,
+		DynamoTableARN:  *dynamoARN,
+		DryRun:          *dryRun,
+		NoOfEmitWorkers: *noOfEmitWorker,
+		TopicARN:        *snsTopicARN,
+		ExportLocalDir:  *exportLocalDir,
+		Logger:          logger,
+	}
+	var err error
+	if *timeStr != "" {
+		cfg.ExportTime, err = time.Parse(time.RFC3339, *timeStr)
+		if err != nil {
+			logger.Fatal(err)
+		}
+	}
+
+	if *s3exportPath != "" {
+		u, err := url.Parse(*s3exportPath)
+		if err != nil {
+			logger.Fatal(err)
+		}
+
+		if u.Scheme != "s3" {
+			logger.Fatal("invalid scheme for s3 export path")
+		}
+		cfg.Bucket = u.Host
+		cfg.Prefix = strings.TrimSuffix(strings.TrimPrefix(u.Path, "/"), "/")
+	}
+
+	if *s3largePayloadsPath != "" {
+		u, err := url.Parse(*s3largePayloadsPath)
+		if err != nil {
+			logger.Fatal(err)
+		}
+
+		if u.Scheme != "s3" {
+			logger.Fatal("invalid scheme for s3 large payloads path")
+		}
+		cfg.LargePayloadBucket = u.Host
+		cfg.LargePayloadPrefix = strings.TrimSuffix(strings.TrimPrefix(u.Path, "/"), "/")
+	}
+
+	if *checkpointPath != "" {
+		cfg.CheckpointPath = *checkpointPath
+	}
+
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer cancel()
+	if err := dynamoathenamigration.Migrate(ctx, cfg); err != nil {
+		logger.Fatal(err)
+	}
+}
diff --git a/examples/dynamoathenamigration/dynamo_deserializer.go b/examples/dynamoathenamigration/dynamo_deserializer.go
new file mode 100644
index 0000000000000..b116c91ab9d69
--- /dev/null
+++ b/examples/dynamoathenamigration/dynamo_deserializer.go
@@ -0,0 +1,370 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package dynamoathenamigration
+
+import (
+	"encoding/base64"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go-v2/service/dynamodb/types"
+)
+
+// awsAwsjson10_deserializeDocumentAttributeMap is copied from aws-sdk-go-v2/service/dynamodb/deserializers.go
+// AWS SDK does not expose fn to convert from dynamo json export format to types.AttributeValue.
+func awsAwsjson10_deserializeDocumentAttributeMap(v *map[string]types.AttributeValue, value interface{}) error {
+	if v == nil {
+		return fmt.Errorf("unexpected nil of type %T", v)
+	}
+	if value == nil {
+		return nil
+	}
+
+	shape, ok := value.(map[string]interface{})
+	if !ok {
+		return fmt.Errorf("unexpected JSON type %v", value)
+	}
+
+	var mv map[string]types.AttributeValue
+	if *v == nil {
+		mv = map[string]types.AttributeValue{}
+	} else {
+		mv = *v
+	}
+
+	for key, value := range shape {
+		var parsedVal types.AttributeValue
+		mapVar := parsedVal
+		if err := awsAwsjson10_deserializeDocumentAttributeValue(&mapVar, value); err != nil {
+			return err
+		}
+		parsedVal = mapVar
+		mv[key] = parsedVal
+
+	}
+	*v = mv
+	return nil
+}
+
+func awsAwsjson10_deserializeDocumentAttributeValue(v *types.AttributeValue, value interface{}) error {
+	if v == nil {
+		return fmt.Errorf("unexpected nil of type %T", v)
+	}
+	if value == nil {
+		return nil
+	}
+
+	shape, ok := value.(map[string]interface{})
+	if !ok {
+		return fmt.Errorf("unexpected JSON type %v", value)
+	}
+
+	var uv types.AttributeValue
+loop:
+	for key, value := range shape {
+		if value == nil {
+			continue
+		}
+		switch key {
+		case "B":
+			var mv []byte
+			if value != nil {
+				jtv, ok := value.(string)
+				if !ok {
+					return fmt.Errorf("expected BinaryAttributeValue to be []byte, got %T instead", value)
+				}
+				dv, err := base64.StdEncoding.DecodeString(jtv)
+				if err != nil {
+					return fmt.Errorf("failed to base64 decode BinaryAttributeValue, %w", err)
+				}
+				mv = dv
+			}
+			uv = &types.AttributeValueMemberB{Value: mv}
+			break loop
+
+		case "BOOL":
+			var mv bool
+			if value != nil {
+				jtv, ok := value.(bool)
+				if !ok {
+					return fmt.Errorf("expected BooleanAttributeValue to be of type *bool, got %T instead", value)
+				}
+				mv = jtv
+			}
+			uv = &types.AttributeValueMemberBOOL{Value: mv}
+			break loop
+
+		case "BS":
+			var mv [][]byte
+			if err := awsAwsjson10_deserializeDocumentBinarySetAttributeValue(&mv, value); err != nil {
+				return err
+			}
+			uv = &types.AttributeValueMemberBS{Value: mv}
+			break loop
+
+		case "L":
+			var mv []types.AttributeValue
+			if err := awsAwsjson10_deserializeDocumentListAttributeValue(&mv, value); err != nil {
+				return err
+			}
+			uv = &types.AttributeValueMemberL{Value: mv}
+			break loop
+
+		case "M":
+			var mv map[string]types.AttributeValue
+			if err := awsAwsjson10_deserializeDocumentMapAttributeValue(&mv, value); err != nil {
+				return err
+			}
+			uv = &types.AttributeValueMemberM{Value: mv}
+			break loop
+
+		case "N":
+			var mv string
+			if value != nil {
+				jtv, ok := value.(string)
+				if !ok {
+					return fmt.Errorf("expected NumberAttributeValue to be of type string, got %T instead", value)
+				}
+				mv = jtv
+			}
+			uv = &types.AttributeValueMemberN{Value: mv}
+			break loop
+
+		case "NS":
+			var mv []string
+			if err := awsAwsjson10_deserializeDocumentNumberSetAttributeValue(&mv, value); err != nil {
+				return err
+			}
+			uv = &types.AttributeValueMemberNS{Value: mv}
+			break loop
+
+		case "NULL":
+			var mv bool
+			if value != nil {
+				jtv, ok := value.(bool)
+				if !ok {
+					return fmt.Errorf("expected NullAttributeValue to be of type *bool, got %T instead", value)
+				}
+				mv = jtv
+			}
+			uv = &types.AttributeValueMemberNULL{Value: mv}
+			break loop
+
+		case "S":
+			var mv string
+			if value != nil {
+				jtv, ok := value.(string)
+				if !ok {
+					return fmt.Errorf("expected StringAttributeValue to be of type string, got %T instead", value)
+				}
+				mv = jtv
+			}
+			uv = &types.AttributeValueMemberS{Value: mv}
+			break loop
+
+		case "SS":
+			var mv []string
+			if err := awsAwsjson10_deserializeDocumentStringSetAttributeValue(&mv, value); err != nil {
+				return err
+			}
+			uv = &types.AttributeValueMemberSS{Value: mv}
+			break loop
+
+		default:
+			uv = &types.UnknownUnionMember{Tag: key}
+			break loop
+
+		}
+	}
+	*v = uv
+	return nil
+}
+
+func awsAwsjson10_deserializeDocumentStringSetAttributeValue(v *[]string, value interface{}) error {
+	if v == nil {
+		return fmt.Errorf("unexpected nil of type %T", v)
+	}
+	if value == nil {
+		return nil
+	}
+
+	shape, ok := value.([]interface{})
+	if !ok {
+		return fmt.Errorf("unexpected JSON type %v", value)
+	}
+
+	var cv []string
+	if *v == nil {
+		cv = []string{}
+	} else {
+		cv = *v
+	}
+
+	for _, value := range shape {
+		var col string
+		if value != nil {
+			jtv, ok := value.(string)
+			if !ok {
+				return fmt.Errorf("expected StringAttributeValue to be of type string, got %T instead", value)
+			}
+			col = jtv
+		}
+		cv = append(cv, col)
+
+	}
+	*v = cv
+	return nil
+}
+
+func awsAwsjson10_deserializeDocumentNumberSetAttributeValue(v *[]string, value interface{}) error {
+	if v == nil {
+		return fmt.Errorf("unexpected nil of type %T", v)
+	}
+	if value == nil {
+		return nil
+	}
+
+	shape, ok := value.([]interface{})
+	if !ok {
+		return fmt.Errorf("unexpected JSON type %v", value)
+	}
+
+	var cv []string
+	if *v == nil {
+		cv = []string{}
+	} else {
+		cv = *v
+	}
+
+	for _, value := range shape {
+		var col string
+		if value != nil {
+			jtv, ok := value.(string)
+			if !ok {
+				return fmt.Errorf("expected NumberAttributeValue to be of type string, got %T instead", value)
+			}
+			col = jtv
+		}
+		cv = append(cv, col)
+
+	}
+	*v = cv
+	return nil
+}
+
+func awsAwsjson10_deserializeDocumentBinarySetAttributeValue(v *[][]byte, value interface{}) error {
+	if v == nil {
+		return fmt.Errorf("unexpected nil of type %T", v)
+	}
+	if value == nil {
+		return nil
+	}
+
+	shape, ok := value.([]interface{})
+	if !ok {
+		return fmt.Errorf("unexpected JSON type %v", value)
+	}
+
+	var cv [][]byte
+	if *v == nil {
+		cv = [][]byte{}
+	} else {
+		cv = *v
+	}
+
+	for _, value := range shape {
+		var col []byte
+		if value != nil {
+			jtv, ok := value.(string)
+			if !ok {
+				return fmt.Errorf("expected BinaryAttributeValue to be []byte, got %T instead", value)
+			}
+			dv, err := base64.StdEncoding.DecodeString(jtv)
+			if err != nil {
+				return fmt.Errorf("failed to base64 decode BinaryAttributeValue, %w", err)
+			}
+			col = dv
+		}
+		cv = append(cv, col)
+
+	}
+	*v = cv
+	return nil
+}
+
+func awsAwsjson10_deserializeDocumentMapAttributeValue(v *map[string]types.AttributeValue, value interface{}) error {
+	if v == nil {
+		return fmt.Errorf("unexpected nil of type %T", v)
+	}
+	if value == nil {
+		return nil
+	}
+
+	shape, ok := value.(map[string]interface{})
+	if !ok {
+		return fmt.Errorf("unexpected JSON type %v", value)
+	}
+
+	var mv map[string]types.AttributeValue
+	if *v == nil {
+		mv = map[string]types.AttributeValue{}
+	} else {
+		mv = *v
+	}
+
+	for key, value := range shape {
+		var parsedVal types.AttributeValue
+		mapVar := parsedVal
+		if err := awsAwsjson10_deserializeDocumentAttributeValue(&mapVar, value); err != nil {
+			return err
+		}
+		parsedVal = mapVar
+		mv[key] = parsedVal
+
+	}
+	*v = mv
+	return nil
+}
+
+func awsAwsjson10_deserializeDocumentListAttributeValue(v *[]types.AttributeValue, value interface{}) error {
+	if v == nil {
+		return fmt.Errorf("unexpected nil of type %T", v)
+	}
+	if value == nil {
+		return nil
+	}
+
+	shape, ok := value.([]interface{})
+	if !ok {
+		return fmt.Errorf("unexpected JSON type %v", value)
+	}
+
+	var cv []types.AttributeValue
+	if *v == nil {
+		cv = []types.AttributeValue{}
+	} else {
+		cv = *v
+	}
+
+	for _, value := range shape {
+		var col types.AttributeValue
+		if err := awsAwsjson10_deserializeDocumentAttributeValue(&col, value); err != nil {
+			return err
+		}
+		cv = append(cv, col)
+
+	}
+	*v = cv
+	return nil
+}
diff --git a/examples/dynamoathenamigration/migration.go b/examples/dynamoathenamigration/migration.go
new file mode 100644
index 0000000000000..952cc9067209a
--- /dev/null
+++ b/examples/dynamoathenamigration/migration.go
@@ -0,0 +1,611 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package dynamoathenamigration
+
+import (
+	"bufio"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"sync"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/ratelimit"
+	"github.com/aws/aws-sdk-go-v2/aws/retry"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue"
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/dynamodb"
+	dynamoTypes "github.com/aws/aws-sdk-go-v2/service/dynamodb/types"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/sns"
+	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/maps"
+	"golang.org/x/exp/slices"
+	"golang.org/x/sync/errgroup"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/events/athena"
+	"github.com/gravitational/teleport/lib/utils/prompt"
+)
+
+type Config struct {
+	// ExportTime is time in the past from which to export table data.
+	ExportTime time.Time
+
+	// ExportARN allows to use already finished export without triggering new.
+	ExportARN string
+
+	// DynamoTableARN that will be exported.
+	DynamoTableARN string
+
+	// ExportLocalDir specifies where export files will be downloaded (it must exists).
+	// If empty os.TempDir() will be used.
+	ExportLocalDir string
+
+	// Bucket used to store export.
+	Bucket string
+	// Prefix is s3 prefix where to store export inside bucket.
+	Prefix string
+
+	// DryRun allows to generate export and convert it to AuditEvents.
+	// Nothing is published to athena publisher.
+	// Can be used to test if export is valid.
+	DryRun bool
+
+	// NoOfEmitWorkers defines how many workers are used to emit audit events.
+	NoOfEmitWorkers int
+	bufferSize      int
+
+	// CheckpointPath is full path of file where checkpoint data should be stored.
+	// Defaults to file in current directory (athenadynamomigration.json)
+	// Checkpoint allow to resume export which failed during emitting.
+	CheckpointPath string
+
+	// TopicARN is topic of athena logger.
+	TopicARN string
+	// LargePayloadBucket is s3 bucket configured for large payloads in athena logger.
+	LargePayloadBucket string
+	// LargePayloadPrefix is s3 prefix configured for large payloads in athena logger.
+	LargePayloadPrefix string
+
+	Logger log.FieldLogger
+}
+
+const defaultCheckpointPath = "athenadynamomigration.json"
+
+func (cfg *Config) CheckAndSetDefaults() error {
+	if cfg.ExportTime.IsZero() {
+		cfg.ExportTime = time.Now()
+	}
+	if cfg.DynamoTableARN == "" && cfg.ExportARN == "" {
+		return trace.BadParameter("either DynamoTableARN or ExportARN is required")
+	}
+	if cfg.Bucket == "" {
+		return trace.BadParameter("missing export bucket")
+	}
+	if cfg.NoOfEmitWorkers == 0 {
+		cfg.NoOfEmitWorkers = 3
+	}
+	if cfg.bufferSize == 0 {
+		cfg.bufferSize = 10 * cfg.NoOfEmitWorkers
+	}
+	if !cfg.DryRun {
+		if cfg.TopicARN == "" {
+			return trace.BadParameter("missing Athena logger SNS Topic ARN")
+		}
+
+		if cfg.LargePayloadBucket == "" {
+			return trace.BadParameter("missing Athena logger large payload bucket")
+		}
+	}
+	if cfg.CheckpointPath == "" {
+		cfg.CheckpointPath = defaultCheckpointPath
+	}
+
+	if cfg.Logger == nil {
+		cfg.Logger = log.New()
+	}
+	return nil
+}
+
+type task struct {
+	Config
+	dynamoClient  *dynamodb.Client
+	s3Downloader  s3downloader
+	eventsEmitter eventsEmitter
+}
+
+type s3downloader interface {
+	Download(ctx context.Context, w io.WriterAt, input *s3.GetObjectInput, options ...func(*manager.Downloader)) (n int64, err error)
+}
+
+type eventsEmitter interface {
+	EmitAuditEvent(ctx context.Context, in apievents.AuditEvent) error
+}
+
+func newMigrateTask(ctx context.Context, cfg Config, awsCfg aws.Config) (*task, error) {
+	s3Client := s3.NewFromConfig(awsCfg)
+	return &task{
+		Config:       cfg,
+		dynamoClient: dynamodb.NewFromConfig(awsCfg),
+		s3Downloader: manager.NewDownloader(s3Client),
+		eventsEmitter: athena.NewPublisher(athena.PublisherConfig{
+			TopicARN: cfg.TopicARN,
+			SNSPublisher: sns.NewFromConfig(awsCfg, func(o *sns.Options) {
+				o.Retryer = retry.NewStandard(func(so *retry.StandardOptions) {
+					so.MaxAttempts = 30
+					so.MaxBackoff = 1 * time.Minute
+					// Use bigger rate limit to handle default sdk throttling: https://github.com/aws/aws-sdk-go-v2/issues/1665
+					so.RateLimiter = ratelimit.NewTokenRateLimit(1000000)
+				})
+			}),
+			Uploader:      manager.NewUploader(s3Client),
+			PayloadBucket: cfg.LargePayloadBucket,
+			PayloadPrefix: cfg.LargePayloadPrefix,
+		}),
+	}, nil
+}
+
+// Migrate executed dynamodb -> athena migration.
+func Migrate(ctx context.Context, cfg Config) error {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	awsCfg, err := config.LoadDefaultConfig(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(MigrateWithAWS(ctx, cfg, awsCfg))
+}
+
+// MigrateWithAWS executed dynamodb -> athena migration. Provide your own awsCfg
+func MigrateWithAWS(ctx context.Context, cfg Config, awsCfg aws.Config) error {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	t, err := newMigrateTask(ctx, cfg, awsCfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	exportInfo, err := t.GetOrStartExportAndWaitForResults(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := t.ProcessDataObjects(ctx, exportInfo); err != nil {
+		return trace.Wrap(err)
+	}
+
+	t.Logger.Info("Migration finished")
+	return nil
+}
+
+// GetOrStartExportAndWaitForResults return export results.
+// It can either reused existing export or start new one, depending on FreshnessWindow.
+func (t *task) GetOrStartExportAndWaitForResults(ctx context.Context) (*exportInfo, error) {
+	exportARN := t.Config.ExportARN
+	if exportARN == "" {
+		var err error
+		exportARN, err = t.startExportJob(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	manifest, err := t.waitForCompletedExport(ctx, exportARN)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	t.Logger.Debugf("Using export manifest %s", manifest)
+	dataObjectsInfo, err := t.getDataObjectsInfo(ctx, manifest)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &exportInfo{
+		ExportARN:       exportARN,
+		DataObjectsInfo: dataObjectsInfo,
+	}, nil
+}
+
+// ProcessDataObjects takes dataObjectInfo from export summary, downloads data files
+// from s3, ungzip them and emitt them on SNS using athena publisher.
+func (t *task) ProcessDataObjects(ctx context.Context, exportInfo *exportInfo) error {
+	eventsC := make(chan apievents.AuditEvent, t.bufferSize)
+
+	eg, egCtx := errgroup.WithContext(ctx)
+	eg.Go(func() error {
+		err := t.getEventsFromDataFiles(egCtx, exportInfo, eventsC)
+		close(eventsC)
+		return trace.Wrap(err)
+	})
+
+	eg.Go(func() error {
+		err := t.emitEvents(egCtx, eventsC, exportInfo.ExportARN)
+		return trace.Wrap(err)
+	})
+
+	return trace.Wrap(eg.Wait())
+}
+
+func (t *task) waitForCompletedExport(ctx context.Context, exportARN string) (exportManifest string, err error) {
+	req := &dynamodb.DescribeExportInput{
+		ExportArn: aws.String(exportARN),
+	}
+	for {
+		exportStatusOutput, err := t.dynamoClient.DescribeExport(ctx, req)
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
+
+		if exportStatusOutput == nil || exportStatusOutput.ExportDescription == nil {
+			return "", errors.New("dynamo DescribeExport returned unexpected nil on response")
+		}
+
+		exportStatus := exportStatusOutput.ExportDescription.ExportStatus
+		switch exportStatus {
+		case dynamoTypes.ExportStatusCompleted:
+			return aws.ToString(exportStatusOutput.ExportDescription.ExportManifest), nil
+		case dynamoTypes.ExportStatusFailed:
+			return "", trace.Errorf("export %s returned failed status", exportARN)
+		case dynamoTypes.ExportStatusInProgress:
+			select {
+			case <-ctx.Done():
+				return "", trace.Wrap(ctx.Err())
+			case <-time.After(10 * time.Second):
+				t.Logger.Debug("Export job still in progress...")
+			}
+		}
+
+	}
+}
+
+func (t *task) startExportJob(ctx context.Context) (arn string, err error) {
+	exportOutput, err := t.dynamoClient.ExportTableToPointInTime(ctx, &dynamodb.ExportTableToPointInTimeInput{
+		S3Bucket:     aws.String(t.Bucket),
+		TableArn:     aws.String(t.DynamoTableARN),
+		ExportFormat: dynamoTypes.ExportFormatDynamodbJson,
+		ExportTime:   aws.Time(t.ExportTime),
+		S3Prefix:     aws.String(t.Prefix),
+	})
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	if exportOutput == nil || exportOutput.ExportDescription == nil {
+		return "", errors.New("dynamo ExportTableToPointInTime returned unexpected nil on response")
+	}
+
+	exportArn := aws.ToString(exportOutput.ExportDescription.ExportArn)
+	t.Logger.Infof("Started export %s", exportArn)
+	return exportArn, nil
+}
+
+type exportInfo struct {
+	ExportARN       string
+	DataObjectsInfo []dataObjectInfo
+}
+
+type dataObjectInfo struct {
+	DataFileS3Key string `json:"dataFileS3Key"`
+	ItemCount     int    `json:"itemCount"`
+}
+
+// getDataObjectsInfo downloads manifest-files.json and get data object info from it.
+func (t *task) getDataObjectsInfo(ctx context.Context, manifestPath string) ([]dataObjectInfo, error) {
+	// summary file is small, we can use in-memory buffer.
+	writeAtBuf := manager.NewWriteAtBuffer([]byte{})
+	if _, err := t.s3Downloader.Download(ctx, writeAtBuf, &s3.GetObjectInput{
+		Bucket: aws.String(t.Bucket),
+		// AWS SDK returns manifest-summary.json path. We are interested in
+		// manifest-files.json because it's contains references about data export files.
+		Key: aws.String(path.Dir(manifestPath) + "/manifest-files.json"),
+	}); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var out []dataObjectInfo
+	scanner := bufio.NewScanner(bytes.NewBuffer(writeAtBuf.Bytes()))
+	// manifest-files are JSON lines files, that why it's scanned line by line.
+	for scanner.Scan() {
+		var obj dataObjectInfo
+		err := json.Unmarshal(scanner.Bytes(), &obj)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		out = append(out, obj)
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return out, nil
+}
+
+func (t *task) getEventsFromDataFiles(ctx context.Context, exportInfo *exportInfo, eventsC chan<- apievents.AuditEvent) error {
+	checkpoint, err := t.loadEmitterCheckpoint(ctx, exportInfo.ExportARN)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if checkpoint != nil {
+		if checkpoint.FinishedWithError {
+			reuse, err := prompt.Confirmation(ctx, os.Stdout, prompt.Stdin(), fmt.Sprintf("It seems that previous migration %s stopped with error, do you want to resume it?", exportInfo.ExportARN))
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			if reuse {
+				t.Logger.Info("Resuming emitting from checkpoint")
+			} else {
+				// selected not reuse
+				checkpoint = nil
+			}
+		} else {
+			// migration completed without any error, no sense of reusing checkpoint.
+			t.Logger.Info("Skipping checkpoint because previous migration finished without error")
+			checkpoint = nil
+		}
+	}
+
+	// afterCheckpoint is used to pass information between fromS3ToChan calls
+	// if checkpoint was reached.
+	var afterCheckpoint bool
+	for _, dataObj := range exportInfo.DataObjectsInfo {
+		t.Logger.Debugf("Downloading %s", dataObj.DataFileS3Key)
+		afterCheckpoint, err = t.fromS3ToChan(ctx, dataObj, eventsC, checkpoint, afterCheckpoint)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	return nil
+}
+
+func (t *task) fromS3ToChan(ctx context.Context, dataObj dataObjectInfo, eventsC chan<- apievents.AuditEvent, checkpoint *checkpointData, afterCheckpointIn bool) (afterCheckpointOut bool, err error) {
+	f, err := t.downloadFromS3(ctx, dataObj.DataFileS3Key)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	defer f.Close()
+
+	gzipReader, err := gzip.NewReader(f)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	defer gzipReader.Close()
+
+	checkpointValues := checkpoint.checkpointValues()
+	afterCheckpoint := afterCheckpointIn
+
+	scanner := bufio.NewScanner(gzipReader)
+	t.Logger.Debugf("Scanning %d events", dataObj.ItemCount)
+	count := 0
+	for scanner.Scan() {
+		count++
+		ev, err := exportedDynamoItemToAuditEvent(ctx, scanner.Bytes())
+		if err != nil {
+			return false, trace.Wrap(err)
+		}
+
+		// if checkpoint is present, it means that previous run ended with error
+		// and we want to continue from last valid checkpoint.
+		// We have list of checkpoints because processing is done in async way with
+		// multiple workers. We are looking for first id among checkpoints.
+		if checkpoint != nil && !afterCheckpoint {
+			if !slices.Contains(checkpointValues, ev.GetID()) {
+				// skipping because was processed in previous run.
+				continue
+			} else {
+				t.Logger.Debugf("Event %s is last checkpoint, will start emitting from next event on the list", ev.GetID())
+				// id is on list of valid checkpoints
+				afterCheckpoint = true
+				// This was last completed, skip it and from next iteration emit everything.
+				continue
+			}
+		}
+
+		select {
+		case eventsC <- ev:
+		case <-ctx.Done():
+			return false, ctx.Err()
+		}
+
+		if count%100 == 0 {
+			t.Logger.Debugf("Sent on buffer %d/%d events from %s", count, dataObj.ItemCount, dataObj.DataFileS3Key)
+		}
+	}
+
+	if err := scanner.Err(); err != nil {
+		return false, trace.Wrap(err)
+	}
+	return afterCheckpoint, nil
+}
+
+// exportedDynamoItemToAuditEvent converts single line of dynamo export into AuditEvent.
+func exportedDynamoItemToAuditEvent(ctx context.Context, in []byte) (apievents.AuditEvent, error) {
+	var itemMap map[string]map[string]any
+	if err := json.Unmarshal(in, &itemMap); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var attributeMap map[string]dynamoTypes.AttributeValue
+	if err := awsAwsjson10_deserializeDocumentAttributeMap(&attributeMap, itemMap["Item"]); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var eventFields events.EventFields
+	if err := attributevalue.Unmarshal(attributeMap["FieldsMap"], &eventFields); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	event, err := events.FromEventFields(eventFields)
+	return event, trace.Wrap(err)
+}
+
+func (t *task) downloadFromS3(ctx context.Context, key string) (*os.File, error) {
+	originalName := path.Base(key)
+
+	var dir string
+	if t.Config.ExportLocalDir != "" {
+		dir = t.Config.ExportLocalDir
+	} else {
+		dir = os.TempDir()
+	}
+	path := path.Join(dir, originalName)
+
+	f, err := os.Create(path)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if _, err := t.s3Downloader.Download(ctx, f, &s3.GetObjectInput{
+		Bucket: aws.String(t.Bucket),
+		Key:    aws.String(key),
+	}); err != nil {
+		f.Close()
+		return nil, trace.Wrap(err)
+	}
+	return f, nil
+}
+
+type checkpointData struct {
+	ExportARN         string `json:"export_arn"`
+	FinishedWithError bool   `json:"finished_with_error"`
+	// Checkpoints key represents worker index.
+	// Checkpoints value represents last valid event id.
+	Checkpoints map[int]string `json:"checkpoints"`
+}
+
+func (c *checkpointData) checkpointValues() []string {
+	if c == nil {
+		return nil
+	}
+	return maps.Values(c.Checkpoints)
+}
+
+func (t *task) storeEmitterCheckpoint(in checkpointData) error {
+	bb, err := json.Marshal(in)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return trace.Wrap(os.WriteFile(t.CheckpointPath, bb, 0o755))
+}
+
+func (t *task) loadEmitterCheckpoint(ctx context.Context, exportARN string) (*checkpointData, error) {
+	bb, err := os.ReadFile(t.CheckpointPath)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil, nil
+		}
+		return nil, trace.Wrap(err)
+	}
+	var out checkpointData
+	if err := json.Unmarshal(bb, &out); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// There are checkpoints for different export, assume there is no checkpoint saved.
+	if exportARN != out.ExportARN {
+		return nil, nil
+	}
+
+	return &out, nil
+}
+
+func (t *task) emitEvents(ctx context.Context, eventsC <-chan apievents.AuditEvent, exportARN string) error {
+	if t.DryRun {
+		// in dryRun we just want to count events, validation is done when reading from file.
+		var count int
+		var oldest, newest apievents.AuditEvent
+		for event := range eventsC {
+			count++
+			if oldest == nil && newest == nil {
+				// first iteration, initialize values with first event.
+				oldest = event
+				newest = event
+			}
+			if oldest.GetTime().After(event.GetTime()) {
+				oldest = event
+			}
+			if newest.GetTime().Before(event.GetTime()) {
+				newest = event
+			}
+		}
+		if count == 0 {
+			return errors.New("there were not events from export")
+		}
+		t.Logger.Infof("Dry run: there are %d events from %v to %v", count, oldest.GetTime(), newest.GetTime())
+		return nil
+	}
+	// mu protects checkpointsPerWorker.
+	var mu sync.Mutex
+	checkpointsPerWorker := map[int]string{}
+
+	errG, workerCtx := errgroup.WithContext(ctx)
+
+	for i := 0; i < t.NoOfEmitWorkers; i++ {
+		i := i
+		errG.Go(func() error {
+			for {
+				select {
+				case <-workerCtx.Done():
+					return trace.Wrap(ctx.Err())
+				case e, ok := <-eventsC:
+					if !ok {
+						return nil
+					}
+					if err := t.eventsEmitter.EmitAuditEvent(workerCtx, e); err != nil {
+						return trace.Wrap(err)
+					} else {
+						mu.Lock()
+						checkpointsPerWorker[i] = e.GetID()
+						mu.Unlock()
+					}
+				}
+			}
+		})
+	}
+
+	workersErr := errG.Wait()
+	// workersErr is handled below because we want to store checkpoint on error.
+
+	// If there is missing data from at least one worker, it means that worker
+	// does not have any valid checkpoint to store. Without any valid checkpoint
+	// we won't be able to calculate min checkpoint, so does not store checkpoint at all.
+	if len(checkpointsPerWorker) < t.NoOfEmitWorkers {
+		t.Logger.Warnf("Not enough checkpoints from workers, got %d, expected %d", len(checkpointsPerWorker), t.NoOfEmitWorkers)
+		return trace.Wrap(workersErr)
+	}
+
+	checkpoint := checkpointData{
+		FinishedWithError: workersErr != nil || ctx.Err() != nil,
+		ExportARN:         exportARN,
+		Checkpoints:       checkpointsPerWorker,
+	}
+	if err := t.storeEmitterCheckpoint(checkpoint); err != nil {
+		t.Logger.Errorf("Failed to store checkpoint: %v", err)
+	}
+	return trace.Wrap(workersErr)
+}
diff --git a/examples/dynamoathenamigration/migration_test.go b/examples/dynamoathenamigration/migration_test.go
new file mode 100644
index 0000000000000..3368d5d5df2c3
--- /dev/null
+++ b/examples/dynamoathenamigration/migration_test.go
@@ -0,0 +1,432 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package dynamoathenamigration
+
+import (
+	"bytes"
+	"compress/gzip"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"math/rand"
+	"path"
+	"sort"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/prompt"
+)
+
+func TestMigrateProcessDataObjects(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	// testDataObjects represents how dynamo export data using JSON lines format.
+	testDataObjects := map[string]string{
+		"testdata/dataObj1.json.gz": `{ "Item": { "EventIndex": { "N": "2147483647" }, "SessionID": { "S": "4298bd54-a747-4d53-b850-83ba17caae5a" }, "CreatedAtDate": { "S": "2023-05-22" }, "FieldsMap": { "M": { "cluster_name": { "S": "test.example.local" }, "uid": { "S": "850d0dd5-7d6b-415e-a404-c4f79cdf27c9" }, "code": { "S": "T2005I" }, "ei": { "N": "2147483647" }, "time": { "S": "2023-05-22T12:12:21.966Z" }, "event": { "S": "session.upload" }, "sid": { "S": "4298bd54-a747-4d53-b850-83ba17caae5a" } } }, "EventType": { "S": "session.upload" }, "EventNamespace": { "S": "default" }, "CreatedAt": { "N": "1684757541" } } }
+{ "Item": { "EventIndex": { "N": "2147483647" }, "SessionID": { "S": "f81a2fda-4ede-4abc-86f9-7a58e189038e" }, "CreatedAtDate": { "S": "2023-05-22" }, "FieldsMap": { "M": { "cluster_name": { "S": "test.example.local" }, "uid": { "S": "19ab6e90-602c-4dcc-88b3-de5f28753f88" }, "code": { "S": "T2005I" }, "ei": { "N": "2147483647" }, "time": { "S": "2023-05-22T12:12:21.966Z" }, "event": { "S": "session.upload" }, "sid": { "S": "f81a2fda-4ede-4abc-86f9-7a58e189038e" } } }, "EventType": { "S": "session.upload" }, "EventNamespace": { "S": "default" }, "CreatedAt": { "N": "1684757541" } } }`,
+		"testdata/dataObj2.json.gz": `{ "Item": { "EventIndex": { "N": "2147483647" }, "SessionID": { "S": "35f35254-92f9-46a2-9b05-8c13f712389b" }, "CreatedAtDate": { "S": "2023-05-22" }, "FieldsMap": { "M": { "cluster_name": { "S": "test.example.local" }, "uid": { "S": "46c03b4f-4ef5-4d86-80aa-4b53c7efc28f" }, "code": { "S": "T2005I" }, "ei": { "N": "2147483647" }, "time": { "S": "2023-05-22T12:12:21.966Z" }, "event": { "S": "session.upload" }, "sid": { "S": "35f35254-92f9-46a2-9b05-8c13f712389b" } } }, "EventType": { "S": "session.upload" }, "EventNamespace": { "S": "default" }, "CreatedAt": { "N": "1684757541" } } }`,
+	}
+	emitter := &mockEmitter{}
+	mt := &task{
+		s3Downloader: &fakeDownloader{
+			dataObjects: testDataObjects,
+		},
+		eventsEmitter: emitter,
+		Config: Config{
+			Logger:          utils.NewLoggerForTests(),
+			NoOfEmitWorkers: 5,
+			bufferSize:      10,
+			CheckpointPath:  path.Join(t.TempDir(), "migration-tests.json"),
+		},
+	}
+	err := mt.ProcessDataObjects(ctx, &exportInfo{
+		ExportARN: "export-arn",
+		DataObjectsInfo: []dataObjectInfo{
+			{DataFileS3Key: "testdata/dataObj1.json.gz", ItemCount: 2},
+			{DataFileS3Key: "testdata/dataObj2.json.gz", ItemCount: 1},
+		},
+	})
+	require.NoError(t, err)
+	wantEventTimestamp := time.Date(2023, 5, 22, 12, 12, 21, 966000000, time.UTC)
+	requireEventsEqualInAnyOrder(t, []apievents.AuditEvent{
+		&apievents.SessionUpload{
+			Metadata: apievents.Metadata{
+				Index:       2147483647,
+				Type:        "session.upload",
+				ID:          "850d0dd5-7d6b-415e-a404-c4f79cdf27c9",
+				Code:        "T2005I",
+				Time:        wantEventTimestamp,
+				ClusterName: "test.example.local",
+			},
+			SessionMetadata: apievents.SessionMetadata{
+				SessionID: "4298bd54-a747-4d53-b850-83ba17caae5a",
+			},
+		},
+		&apievents.SessionUpload{
+			Metadata: apievents.Metadata{
+				Index:       2147483647,
+				Type:        "session.upload",
+				ID:          "19ab6e90-602c-4dcc-88b3-de5f28753f88",
+				Code:        "T2005I",
+				Time:        wantEventTimestamp,
+				ClusterName: "test.example.local",
+			},
+			SessionMetadata: apievents.SessionMetadata{
+				SessionID: "f81a2fda-4ede-4abc-86f9-7a58e189038e",
+			},
+		},
+		&apievents.SessionUpload{
+			Metadata: apievents.Metadata{
+				Index:       2147483647,
+				Type:        "session.upload",
+				ID:          "46c03b4f-4ef5-4d86-80aa-4b53c7efc28f",
+				Code:        "T2005I",
+				Time:        wantEventTimestamp,
+				ClusterName: "test.example.local",
+			},
+			SessionMetadata: apievents.SessionMetadata{
+				SessionID: "35f35254-92f9-46a2-9b05-8c13f712389b",
+			},
+		},
+	}, emitter.events)
+}
+
+type fakeDownloader struct {
+	dataObjects map[string]string
+}
+
+func (f *fakeDownloader) Download(ctx context.Context, w io.WriterAt, input *s3.GetObjectInput, options ...func(*manager.Downloader)) (int64, error) {
+	data, ok := f.dataObjects[*input.Key]
+	if !ok {
+		return 0, errors.New("object does not exists")
+	}
+	var buf bytes.Buffer
+	zw := gzip.NewWriter(&buf)
+	_, err := zw.Write([]byte(data))
+	if err != nil {
+		return 0, err
+	}
+	if err := zw.Close(); err != nil {
+		return 0, err
+	}
+
+	n, err := w.WriteAt(buf.Bytes(), 0)
+	return int64(n), err
+}
+
+type mockEmitter struct {
+	mu     sync.Mutex
+	events []apievents.AuditEvent
+
+	// failAfterNCalls if greater than 0, will cause failure of emitter after n calls
+	failAfterNCalls int
+}
+
+func (m *mockEmitter) EmitAuditEvent(ctx context.Context, in apievents.AuditEvent) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.failAfterNCalls > 0 && len(m.events) >= m.failAfterNCalls {
+		return errors.New("emitter failure")
+	}
+	m.events = append(m.events, in)
+	// Simulate some work by sleeping during emitting.
+	// It helps redistribute task processing among all workers and requires
+	// less iterations in tests to generate checkpoint file from all workers.
+	// Without it, in rare cases after 50 events still some worker were not able
+	// to read message because of other processing it immediately.
+	select {
+	case <-time.After(time.Duration(rand.Intn(50)+50) * time.Microsecond):
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+// requireEventsEqualInAnyOrder compares slices of auditevents ignoring order.
+// It's useful in tests because consumer does not guarantee order.
+func requireEventsEqualInAnyOrder(t *testing.T, want, got []apievents.AuditEvent) {
+	sort.Slice(want, func(i, j int) bool {
+		return want[i].GetID() < want[j].GetID()
+	})
+	sort.Slice(got, func(i, j int) bool {
+		return got[i].GetID() < got[j].GetID()
+	})
+	require.Empty(t, cmp.Diff(want, got))
+}
+
+func TestMigrationCheckpoint(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	// There is confirmation prompt in migration when reusing checkpoint, that's why
+	// Stdin is overwritten in tests.
+	oldStdin := prompt.Stdin()
+	t.Cleanup(func() { prompt.SetStdin(oldStdin) })
+
+	noOfWorkers := 3
+	defaultConfig := Config{
+		Logger:          utils.NewLoggerForTests(),
+		NoOfEmitWorkers: noOfWorkers,
+		bufferSize:      noOfWorkers * 5,
+		CheckpointPath:  path.Join(t.TempDir(), "migration-tests.json"),
+	}
+
+	t.Run("no migration checkpoint, emit every event", func(t *testing.T) {
+		prompt.SetStdin(prompt.NewFakeReader())
+		testDataObjects := map[string]string{
+			"testdata/dataObj1.json.gz": generateDynamoExportData(100),
+			"testdata/dataObj2.json.gz": generateDynamoExportData(100),
+		}
+		emitter := &mockEmitter{}
+		mt := &task{
+			s3Downloader: &fakeDownloader{
+				dataObjects: testDataObjects,
+			},
+			eventsEmitter: emitter,
+			Config:        defaultConfig,
+		}
+		err := mt.ProcessDataObjects(ctx, &exportInfo{
+			ExportARN: uuid.NewString(),
+			DataObjectsInfo: []dataObjectInfo{
+				{DataFileS3Key: "testdata/dataObj1.json.gz"},
+				{DataFileS3Key: "testdata/dataObj2.json.gz"},
+			},
+		})
+		require.NoError(t, err)
+		require.Len(t, emitter.events, 200, "unexpected number of emitted events")
+	})
+
+	t.Run("failure after 50 calls, reuse checkpoint", func(t *testing.T) {
+		// y to prompt on if reuse checkpoint
+		prompt.SetStdin(prompt.NewFakeReader().AddString("y"))
+		exportARN := uuid.NewString()
+		testDataObjects := map[string]string{
+			"testdata/dataObj1.json.gz": generateDynamoExportData(100),
+			"testdata/dataObj2.json.gz": generateDynamoExportData(100),
+		}
+		emitter := &mockEmitter{
+			failAfterNCalls: 50,
+		}
+		mt := &task{
+			s3Downloader: &fakeDownloader{
+				dataObjects: testDataObjects,
+			},
+			eventsEmitter: emitter,
+			Config:        defaultConfig,
+		}
+		err := mt.ProcessDataObjects(ctx, &exportInfo{
+			ExportARN: exportARN,
+			DataObjectsInfo: []dataObjectInfo{
+				{DataFileS3Key: "testdata/dataObj1.json.gz"},
+				{DataFileS3Key: "testdata/dataObj2.json.gz"},
+			},
+		})
+		require.Error(t, err)
+		require.Len(t, emitter.events, 50, "unexpected number of emitted events")
+
+		newEmitter := &mockEmitter{}
+		newMigration := task{
+			s3Downloader: &fakeDownloader{
+				dataObjects: testDataObjects,
+			},
+			eventsEmitter: newEmitter,
+			Config:        defaultConfig,
+		}
+		err = newMigration.ProcessDataObjects(ctx, &exportInfo{
+			ExportARN: exportARN,
+			DataObjectsInfo: []dataObjectInfo{
+				{DataFileS3Key: "testdata/dataObj1.json.gz"},
+				{DataFileS3Key: "testdata/dataObj2.json.gz"},
+			},
+		})
+		require.NoError(t, err)
+		// There was 200 events, first migration finished after 50, so this one should emit at least 150.
+		// We are using range (150,199) to check because of checkpoint is stored per worker and we are using
+		// first from list so we expect up to noOfWorkers-1 more events, but in some condition it can be more (on worker processing faster).
+		require.GreaterOrEqual(t, len(newEmitter.events), 150, "unexpected number of emitted events")
+		require.Less(t, len(newEmitter.events), 199, "unexpected number of emitted events")
+	})
+	t.Run("failure after 150 calls (from 2nd export file), reuse checkpoint", func(t *testing.T) {
+		// y to prompt on if reuse checkpoint
+		prompt.SetStdin(prompt.NewFakeReader().AddString("y"))
+		exportARN := uuid.NewString()
+		testDataObjects := map[string]string{
+			"testdata/dataObj1.json.gz": generateDynamoExportData(100),
+			"testdata/dataObj2.json.gz": generateDynamoExportData(100),
+		}
+		emitter := &mockEmitter{
+			failAfterNCalls: 150,
+		}
+		mt := &task{
+			s3Downloader: &fakeDownloader{
+				dataObjects: testDataObjects,
+			},
+			eventsEmitter: emitter,
+			Config:        defaultConfig,
+		}
+		err := mt.ProcessDataObjects(ctx, &exportInfo{
+			ExportARN: exportARN,
+			DataObjectsInfo: []dataObjectInfo{
+				{DataFileS3Key: "testdata/dataObj1.json.gz"},
+				{DataFileS3Key: "testdata/dataObj2.json.gz"},
+			},
+		})
+		require.Error(t, err)
+		require.Len(t, emitter.events, 150, "unexpected number of emitted events")
+
+		newEmitter := &mockEmitter{}
+		newMigration := task{
+			s3Downloader: &fakeDownloader{
+				dataObjects: testDataObjects,
+			},
+			eventsEmitter: newEmitter,
+			Config:        defaultConfig,
+		}
+		err = newMigration.ProcessDataObjects(ctx, &exportInfo{
+			ExportARN: exportARN,
+			DataObjectsInfo: []dataObjectInfo{
+				{DataFileS3Key: "testdata/dataObj1.json.gz"},
+				{DataFileS3Key: "testdata/dataObj2.json.gz"},
+			},
+		})
+		require.NoError(t, err)
+		// There was 200 events, first migration finished after 150, so this one should emit at least 50.
+		// We are using range (50,99) to check because of checkpoint is stored per worker and we are using
+		// first from list so we expect up to noOfWorkers-1 more events, but in some condition it can be more (on worker processing faster).
+		require.GreaterOrEqual(t, len(newEmitter.events), 50, "unexpected number of emitted events")
+		require.Less(t, len(newEmitter.events), 99, "unexpected number of emitted events")
+	})
+	t.Run("checkpoint from export1 is not reused on export2", func(t *testing.T) {
+		prompt.SetStdin(prompt.NewFakeReader())
+		exportARN1 := uuid.NewString()
+		testDataObjects1 := map[string]string{
+			"testdata/dataObj11.json.gz": generateDynamoExportData(100),
+			"testdata/dataObj12.json.gz": generateDynamoExportData(100),
+		}
+		emitter := &mockEmitter{
+			// To use checkpoint.
+			failAfterNCalls: 50,
+		}
+		mt := &task{
+			s3Downloader: &fakeDownloader{
+				dataObjects: testDataObjects1,
+			},
+			eventsEmitter: emitter,
+			Config:        defaultConfig,
+		}
+		err := mt.ProcessDataObjects(ctx, &exportInfo{
+			ExportARN: exportARN1,
+			DataObjectsInfo: []dataObjectInfo{
+				{DataFileS3Key: "testdata/dataObj11.json.gz"},
+				{DataFileS3Key: "testdata/dataObj12.json.gz"},
+			},
+		})
+		require.Error(t, err)
+		require.Len(t, emitter.events, 50, "unexpected number of emitted events")
+
+		exportARN2 := uuid.NewString()
+		testDataObjects2 := map[string]string{
+			"testdata/dataObj21.json.gz": generateDynamoExportData(100),
+			"testdata/dataObj22.json.gz": generateDynamoExportData(100),
+		}
+		newEmitter := &mockEmitter{}
+		newMigration := task{
+			s3Downloader: &fakeDownloader{
+				dataObjects: testDataObjects2,
+			},
+			eventsEmitter: newEmitter,
+			Config:        defaultConfig,
+		}
+		err = newMigration.ProcessDataObjects(ctx, &exportInfo{
+			ExportARN: exportARN2,
+			DataObjectsInfo: []dataObjectInfo{
+				{DataFileS3Key: "testdata/dataObj21.json.gz"},
+				{DataFileS3Key: "testdata/dataObj22.json.gz"},
+			},
+		})
+		require.NoError(t, err)
+		require.Len(t, newEmitter.events, 200, "unexpected number of emitted events")
+	})
+	t.Run("failure after 50 calls, refuse to reuse checkpoint", func(t *testing.T) {
+		// y to prompt on if reuse checkpoint
+		prompt.SetStdin(prompt.NewFakeReader().AddString("n"))
+		exportARN := uuid.NewString()
+		testDataObjects := map[string]string{
+			"testdata/dataObj1.json.gz": generateDynamoExportData(100),
+			"testdata/dataObj2.json.gz": generateDynamoExportData(100),
+		}
+		emitter := &mockEmitter{
+			failAfterNCalls: 50,
+		}
+		mt := &task{
+			s3Downloader: &fakeDownloader{
+				dataObjects: testDataObjects,
+			},
+			eventsEmitter: emitter,
+			Config:        defaultConfig,
+		}
+		err := mt.ProcessDataObjects(ctx, &exportInfo{
+			ExportARN: exportARN,
+			DataObjectsInfo: []dataObjectInfo{
+				{DataFileS3Key: "testdata/dataObj1.json.gz"},
+				{DataFileS3Key: "testdata/dataObj2.json.gz"},
+			},
+		})
+		require.Error(t, err)
+		require.Len(t, emitter.events, 50, "unexpected number of emitted events")
+
+		newEmitter := &mockEmitter{}
+		newMigration := task{
+			s3Downloader: &fakeDownloader{
+				dataObjects: testDataObjects,
+			},
+			eventsEmitter: newEmitter,
+			Config:        defaultConfig,
+		}
+		err = newMigration.ProcessDataObjects(ctx, &exportInfo{
+			ExportARN: exportARN,
+			DataObjectsInfo: []dataObjectInfo{
+				{DataFileS3Key: "testdata/dataObj1.json.gz"},
+				{DataFileS3Key: "testdata/dataObj2.json.gz"},
+			},
+		})
+		require.NoError(t, err)
+		require.Len(t, newEmitter.events, 200, "unexpected number of emitted events")
+	})
+}
+
+func generateDynamoExportData(n int) string {
+	if n < 1 {
+		panic("number of events to generate must be > 0")
+	}
+	lineFmt := `{ "Item": { "EventIndex": { "N": "2147483647" }, "SessionID": { "S": "4298bd54-a747-4d53-b850-83ba17caae5a" }, "CreatedAtDate": { "S": "2023-05-22" }, "FieldsMap": { "M": { "cluster_name": { "S": "test.example.local" }, "uid": { "S": "%s" }, "code": { "S": "T2005I" }, "ei": { "N": "2147483647" }, "time": { "S": "2023-05-22T12:12:21.966Z" }, "event": { "S": "session.upload" }, "sid": { "S": "4298bd54-a747-4d53-b850-83ba17caae5a" } } }, "EventType": { "S": "session.upload" }, "EventNamespace": { "S": "default" }, "CreatedAt": { "N": "1684757541" } } }`
+	sb := strings.Builder{}
+	for i := 0; i < n; i++ {
+		sb.WriteString(fmt.Sprintf(lineFmt+"\n", uuid.NewString()))
+	}
+	return sb.String()
+}
diff --git a/examples/load-tests/values/node-agents.yaml b/examples/load-tests/values/node-agents.yaml
deleted file mode 100644
index 86076fec5adec..0000000000000
--- a/examples/load-tests/values/node-agents.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-replicaCount: 30
-agentsPerPod: 15
-
-minReadySeconds: 30
-
-image:
-  # TODO: remove after v12 is released
-  tag: 12.0.0-hugochartsplit.2
-
-joinParams:
-  method: token
-  token_name: "qwertyuiop"
-
-tolerations:
-- key: "role"
-  operator: "Equal"
-  value: "agent"
-  effect: "NoSchedule"
-
-affinity:
-  nodeAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      nodeSelectorTerms:
-      - matchExpressions:
-        - key: role
-          operator: In
-          values:
-            - agent
-
diff --git a/examples/resources/gworkspace-connector-inline.yaml b/examples/resources/gworkspace-connector-inline.yaml
index eee3e98913260..f1ea91b7d2ea2 100644
--- a/examples/resources/gworkspace-connector-inline.yaml
+++ b/examples/resources/gworkspace-connector-inline.yaml
@@ -6,30 +6,30 @@ spec:
   - claim: groups
     roles:
     - auditor
-    value: <auditor@google-workspace-group-email>
+    value: auditor@google-workspace-group-email.com
   - claim: groups
     roles:
     - access
     value: teleport-developers@example.com
-  client_id: <GOOGLE_WORKSPACE_CLIENT_ID>.apps.googleusercontent.com
-  client_secret: <OAUTH_CLIENT_SECRET>
+  client_id: <GOOGLE-WORKSPACE-CLIENT-ID>.apps.googleusercontent.com
+  client_secret: <OAUTH-CLIENT-SECRET>
   display: Google
-  google_admin_email: <GOOGLE_WORKSPACE_ADMIN_EMAIL>
+  google_admin_email: <GOOGLE-WORKSPACE-ADMIN-EMAIL>
   google_service_account: |
     {
      "type": "service_account",
-     "project_id": "<project_id>",
-     "private_key_id": "<private_key_id>",
-     "private_key": "-----BEGIN PRIVATE KEY-----\n<private key contents>\n-----END PRIVATE KEY-----\n",
-     "client_email": "<teleport service account email>",
-     "client_id": "<client_id>",
+     "project_id": "<PROJECT-ID>",
+     "private_key_id": "<PRIVATE-KEY-ID>",
+     "private_key": "-----BEGIN PRIVATE KEY-----\n<PRIVATE-KEY-CONTENTS>\n-----END PRIVATE KEY-----\n",
+     "client_email": "<TELEPORT-SERVICE-ACCOUNT-EMAIL>",
+     "client_id": "<CLIENT-ID>",
      "auth_uri": "https://accounts.google.com/o/oauth2/auth",
      "token_uri": "https://oauth2.googleapis.com/token",
      "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
      "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/teleport-service-account%40access-304316.iam.gserviceaccount.com"
     }
   issuer_url: https://accounts.google.com
-  redirect_url: https://<cluster-url>:3080/v1/webapi/oidc/callback
+  redirect_url: https://<SELF-HOSTED-CLUSTER-URL|TENANT-ID.teleport.sh>/v1/webapi/oidc/callback
   scope:
   - openid
   - email
diff --git a/examples/resources/gworkspace-connector.yaml b/examples/resources/gworkspace-connector.yaml
index 9f6e4b7e42f4c..5e31b8b6b5148 100644
--- a/examples/resources/gworkspace-connector.yaml
+++ b/examples/resources/gworkspace-connector.yaml
@@ -6,18 +6,18 @@ spec:
   - claim: groups
     roles:
     - auditor
-    value: <auditor@google-workspace-group-email>
+    value: auditor@google-apps-domain.com
   - claim: groups
     roles:
     - access
     value: teleport-developers@example.com
-  client_id: <GOOGLE_WORKSPACE_CLIENT_ID>.apps.googleusercontent.com
-  client_secret: <OAUTH_CLIENT_SECRET>
+  client_id: <GOOGLE-WORKSPACE-CLIENT-ID>.apps.googleusercontent.com
+  client_secret: <OAUTH-CLIENT-SECRET>
   display: Google
-  google_admin_email: <GOOGLE_WORKSPACE_ADMIN_EMAIL>
+  google_admin_email: <GOOGLE-WORKSPACE-ADMIN-EMAIL>
   google_service_account_uri: file:///var/lib/teleport/gworkspace-creds.json
   issuer_url: https://accounts.google.com
-  redirect_url: https://<cluster-url>:3080/v1/webapi/oidc/callback
+  redirect_url: https://<SELF-HOSTED-CLUSTER-URL|TENANT-ID.teleport.sh>/v1/webapi/oidc/callback
   scope:
   - openid
   - email
diff --git a/examples/resources/plugins/teleport-slack.toml b/examples/resources/plugins/teleport-slack.toml
index c2058d2362695..11066ae852a30 100644
--- a/examples/resources/plugins/teleport-slack.toml
+++ b/examples/resources/plugins/teleport-slack.toml
@@ -1,9 +1,6 @@
-# Copied from https://github.com/gravitational/teleport-plugins/blob/master/access/slack/example_config.toml
-
 # Example Slack plugin configuration TOML file
 
 [teleport]
-# This section 
 
 # Teleport Auth/Proxy Server address.
 # addr = "example.com:3025"
@@ -39,4 +36,4 @@ token = "xoxb-11xx"
 
 [log]
 output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/slack.log"
-severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
\ No newline at end of file
+severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
diff --git a/examples/teleport-usage/README.md b/examples/teleport-usage/README.md
index 66cb8399ecd7d..56c4c4efcab73 100644
--- a/examples/teleport-usage/README.md
+++ b/examples/teleport-usage/README.md
@@ -24,20 +24,15 @@ The following information is required:
 | `AWS_REGION`         | AWS Region where the dynamoDB table is deployed                     |
 | `START_DATE`         | The date for when to start the query. The format must be YYYY-MM-DD |
 
-Optionally, the environment variable `SHOW_USERS` can be set to `true` to display a list of users for each protocol.
-
 ## Running Docker Container
 
-With prompt:
-
-```console
-$ docker run -it --rm public.ecr.aws/gravitational/teleport-usage:<VERSION>
-```
+This script is dependent of environment variables being set. Below is an example on how to run the script in Docker using environment variables:
 
-With environment variables:
+> **_NOTE:_** The latest container image version can be found at the top of this page. This version is independent of your Teleport cluster.
 
 ```console
-$ docker run -it --rm public.ecr.aws/gravitational/teleport-usage:<VERSION> \
--e "TABLE_NAME=cluster-events" -e "AWS_REGION=us-east-1" \
--e "START_DATE=2022-12-01"
+$ docker run -it --rm -e "TABLE_NAME=cluster-events" \
+    -e "AWS_REGION=us-east-1" \
+    -e "START_DATE=2022-12-01" \ 
+    public.ecr.aws/gravitational/teleport-usage:<container-version>
 ```
diff --git a/fuzz/oss-fuzz-build.sh b/fuzz/oss-fuzz-build.sh
index ca202da6b06b6..cef839c8fd3f1 100755
--- a/fuzz/oss-fuzz-build.sh
+++ b/fuzz/oss-fuzz-build.sh
@@ -41,6 +41,9 @@ build_teleport_fuzzers() {
   compile_native_go_fuzzer $TELEPORT_PREFIX/lib/sshutils/x11 \
     FuzzParseDisplay fuzz_parse_display
 
+  compile_native_go_fuzzer $TELEPORT_PREFIX/lib/utils/aws \
+    FuzzParseSigV4 fuzz_parse_sig_v4
+
   compile_native_go_fuzzer $TELEPORT_PREFIX/lib/utils/parse \
     FuzzNewExpression fuzz_new_expression
 
@@ -84,6 +87,9 @@ build_teleport_fuzzers() {
 #  compile_native_go_fuzzer $TELEPORT_PREFIX/lib/srv/db/mongodb/protocol \
 #   FuzzMongoRead fuzz_mongo_read
 
+  compile_native_go_fuzzer $TELEPORT_PREFIX/lib/srv/db/opensearch \
+    FuzzPathToMatcher fuzz_opensearch_path_to_matcher
+
   compile_native_go_fuzzer $TELEPORT_PREFIX/lib/auth/webauthn \
     FuzzParseCredentialCreationResponseBody fuzz_parse_credential_creation_response_body
 
@@ -114,6 +120,18 @@ build_teleport_api_fuzzers() {
   compile_native_go_fuzzer $TELEPORT_PREFIX/api/utils/aws \
     FuzzParseDynamoDBEndpoint fuzz_parse_dynamodb_endpoint
 
+  compile_native_go_fuzzer $TELEPORT_PREFIX/api/utils/azure \
+    FuzzParseDatabaseEndpoint fuzz_azure_parse_database_endpoint
+
+  compile_native_go_fuzzer $TELEPORT_PREFIX/api/utils/azure \
+    FuzzParseCacheForRedisEndpoint fuzz_azure_parse_cache_for_redis_endpoint
+
+  compile_native_go_fuzzer $TELEPORT_PREFIX/api/utils/azure \
+    FuzzNormalizeLocation fuzz_azure_normalize_location
+
+  compile_native_go_fuzzer $TELEPORT_PREFIX/api/utils/azure \
+    FuzzParseMSSQLEndpoint fuzz_azure_parse_mssql_endpoint
+
   cd -
 
 }
diff --git a/gen/proto/go/prehog/v1alpha/prehogv1alphaconnect/teleport.connect.go b/gen/proto/go/prehog/v1alpha/prehogv1alphaconnect/teleport.connect.go
index e63a771bda3e2..0c9cae989666a 100644
--- a/gen/proto/go/prehog/v1alpha/prehogv1alphaconnect/teleport.connect.go
+++ b/gen/proto/go/prehog/v1alpha/prehogv1alphaconnect/teleport.connect.go
@@ -61,8 +61,19 @@ const (
 // TeleportReportingServiceClient is a client for the prehog.v1alpha.TeleportReportingService
 // service.
 type TeleportReportingServiceClient interface {
+	// equivalent to SubmitEvents with a single event, should be unused by now
+	//
 	// Deprecated: do not use.
 	SubmitEvent(context.Context, *connect_go.Request[v1alpha.SubmitEventRequest]) (*connect_go.Response[v1alpha.SubmitEventResponse], error)
+	// encodes and forwards usage events to the PostHog event database; each
+	// event is annotated with some properties that depend on the identity of the
+	// caller:
+	//   - tp.account_id (UUID in string form, can be empty if missing from the
+	//     license)
+	//   - tp.license_name (should always be a UUID)
+	//   - tp.license_authority (name of the authority that signed the license file
+	//     used for authentication)
+	//   - tp.is_cloud (boolean)
 	SubmitEvents(context.Context, *connect_go.Request[v1alpha.SubmitEventsRequest]) (*connect_go.Response[v1alpha.SubmitEventsResponse], error)
 	HelloTeleport(context.Context, *connect_go.Request[v1alpha.HelloTeleportRequest]) (*connect_go.Response[v1alpha.HelloTeleportResponse], error)
 }
@@ -122,8 +133,19 @@ func (c *teleportReportingServiceClient) HelloTeleport(ctx context.Context, req
 // TeleportReportingServiceHandler is an implementation of the
 // prehog.v1alpha.TeleportReportingService service.
 type TeleportReportingServiceHandler interface {
+	// equivalent to SubmitEvents with a single event, should be unused by now
+	//
 	// Deprecated: do not use.
 	SubmitEvent(context.Context, *connect_go.Request[v1alpha.SubmitEventRequest]) (*connect_go.Response[v1alpha.SubmitEventResponse], error)
+	// encodes and forwards usage events to the PostHog event database; each
+	// event is annotated with some properties that depend on the identity of the
+	// caller:
+	//   - tp.account_id (UUID in string form, can be empty if missing from the
+	//     license)
+	//   - tp.license_name (should always be a UUID)
+	//   - tp.license_authority (name of the authority that signed the license file
+	//     used for authentication)
+	//   - tp.is_cloud (boolean)
 	SubmitEvents(context.Context, *connect_go.Request[v1alpha.SubmitEventsRequest]) (*connect_go.Response[v1alpha.SubmitEventsResponse], error)
 	HelloTeleport(context.Context, *connect_go.Request[v1alpha.HelloTeleportRequest]) (*connect_go.Response[v1alpha.HelloTeleportResponse], error)
 }
diff --git a/gen/proto/go/prehog/v1alpha/teleport.pb.go b/gen/proto/go/prehog/v1alpha/teleport.pb.go
index fd63f35230492..593bcf6b73c97 100644
--- a/gen/proto/go/prehog/v1alpha/teleport.pb.go
+++ b/gen/proto/go/prehog/v1alpha/teleport.pb.go
@@ -40,13 +40,22 @@ const (
 type ResourceKind int32
 
 const (
-	ResourceKind_RESOURCE_KIND_UNSPECIFIED     ResourceKind = 0
-	ResourceKind_RESOURCE_KIND_NODE            ResourceKind = 1
-	ResourceKind_RESOURCE_KIND_APP_SERVER      ResourceKind = 2
-	ResourceKind_RESOURCE_KIND_KUBE_SERVER     ResourceKind = 3
-	ResourceKind_RESOURCE_KIND_DB_SERVER       ResourceKind = 4
+	ResourceKind_RESOURCE_KIND_UNSPECIFIED ResourceKind = 0
+	// PostHog property value: "node"
+	ResourceKind_RESOURCE_KIND_NODE ResourceKind = 1
+	// PostHog property value: "app_server"
+	ResourceKind_RESOURCE_KIND_APP_SERVER ResourceKind = 2
+	// PostHog property value: "kube_server"
+	ResourceKind_RESOURCE_KIND_KUBE_SERVER ResourceKind = 3
+	// PostHog property value: "db_server"
+	ResourceKind_RESOURCE_KIND_DB_SERVER ResourceKind = 4
+	// PostHog property value: "windows_desktop"
 	ResourceKind_RESOURCE_KIND_WINDOWS_DESKTOP ResourceKind = 5
-	ResourceKind_RESOURCE_KIND_NODE_OPENSSH    ResourceKind = 6
+	// ServerV3 ("node") heartbeat with a subkind of "openssh" (as opposed to
+	// empty or "teleport"); not used in keepalives
+	//
+	// PostHog property value: "node.openssh"
+	ResourceKind_RESOURCE_KIND_NODE_OPENSSH ResourceKind = 6
 )
 
 // Enum value maps for ResourceKind.
@@ -139,6 +148,7 @@ const (
 	DiscoverResource_DISCOVER_RESOURCE_DOC_DATABASE_RDS_PROXY                DiscoverResource = 34
 	DiscoverResource_DISCOVER_RESOURCE_DOC_DATABASE_HIGH_AVAILABILITY        DiscoverResource = 35
 	DiscoverResource_DISCOVER_RESOURCE_DOC_DATABASE_DYNAMIC_REGISTRATION     DiscoverResource = 36
+	DiscoverResource_DISCOVER_RESOURCE_SAML_APPLICATION                      DiscoverResource = 37
 )
 
 // Enum value maps for DiscoverResource.
@@ -181,6 +191,7 @@ var (
 		34: "DISCOVER_RESOURCE_DOC_DATABASE_RDS_PROXY",
 		35: "DISCOVER_RESOURCE_DOC_DATABASE_HIGH_AVAILABILITY",
 		36: "DISCOVER_RESOURCE_DOC_DATABASE_DYNAMIC_REGISTRATION",
+		37: "DISCOVER_RESOURCE_SAML_APPLICATION",
 	}
 	DiscoverResource_value = map[string]int32{
 		"DISCOVER_RESOURCE_UNSPECIFIED":                           0,
@@ -220,6 +231,7 @@ var (
 		"DISCOVER_RESOURCE_DOC_DATABASE_RDS_PROXY":                34,
 		"DISCOVER_RESOURCE_DOC_DATABASE_HIGH_AVAILABILITY":        35,
 		"DISCOVER_RESOURCE_DOC_DATABASE_DYNAMIC_REGISTRATION":     36,
+		"DISCOVER_RESOURCE_SAML_APPLICATION":                      37,
 	}
 )
 
@@ -324,6 +336,7 @@ const (
 	CTA_CTA_PREMIUM_SUPPORT CTA = 4
 	CTA_CTA_TRUSTED_DEVICES CTA = 5
 	CTA_CTA_UPGRADE_BANNER  CTA = 6
+	CTA_CTA_BILLING_SUMMARY CTA = 7
 )
 
 // Enum value maps for CTA.
@@ -336,6 +349,7 @@ var (
 		4: "CTA_PREMIUM_SUPPORT",
 		5: "CTA_TRUSTED_DEVICES",
 		6: "CTA_UPGRADE_BANNER",
+		7: "CTA_BILLING_SUMMARY",
 	}
 	CTA_value = map[string]int32{
 		"CTA_UNSPECIFIED":     0,
@@ -345,6 +359,7 @@ var (
 		"CTA_PREMIUM_SUPPORT": 4,
 		"CTA_TRUSTED_DEVICES": 5,
 		"CTA_UPGRADE_BANNER":  6,
+		"CTA_BILLING_SUMMARY": 7,
 	}
 )
 
@@ -453,16 +468,191 @@ func (IntegrationEnrollKind) EnumDescriptor() ([]byte, []int) {
 	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{4}
 }
 
+// EditorChangeStatus is the possible value of an EditorChangeEvent event status
+type EditorChangeStatus int32
+
+const (
+	EditorChangeStatus_EDITOR_CHANGE_STATUS_UNSPECIFIED EditorChangeStatus = 0
+	// Status when the editor role is granted
+	EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_GRANTED EditorChangeStatus = 1
+	// Status when the editor role is removed
+	EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_REMOVED EditorChangeStatus = 2
+)
+
+// Enum value maps for EditorChangeStatus.
+var (
+	EditorChangeStatus_name = map[int32]string{
+		0: "EDITOR_CHANGE_STATUS_UNSPECIFIED",
+		1: "EDITOR_CHANGE_STATUS_ROLE_GRANTED",
+		2: "EDITOR_CHANGE_STATUS_ROLE_REMOVED",
+	}
+	EditorChangeStatus_value = map[string]int32{
+		"EDITOR_CHANGE_STATUS_UNSPECIFIED":  0,
+		"EDITOR_CHANGE_STATUS_ROLE_GRANTED": 1,
+		"EDITOR_CHANGE_STATUS_ROLE_REMOVED": 2,
+	}
+)
+
+func (x EditorChangeStatus) Enum() *EditorChangeStatus {
+	p := new(EditorChangeStatus)
+	*p = x
+	return p
+}
+
+func (x EditorChangeStatus) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (EditorChangeStatus) Descriptor() protoreflect.EnumDescriptor {
+	return file_prehog_v1alpha_teleport_proto_enumTypes[5].Descriptor()
+}
+
+func (EditorChangeStatus) Type() protoreflect.EnumType {
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[5]
+}
+
+func (x EditorChangeStatus) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use EditorChangeStatus.Descriptor instead.
+func (EditorChangeStatus) EnumDescriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{5}
+}
+
+// DeployMethod describes the method used to deploy a service.
+type UIDiscoverDeployServiceEvent_DeployMethod int32
+
+const (
+	// DEPLOY_METHOD_UNSPECIFIED means there was an existing service
+	// so deploying step got skipped.
+	UIDiscoverDeployServiceEvent_DEPLOY_METHOD_UNSPECIFIED UIDiscoverDeployServiceEvent_DeployMethod = 0
+	// DEPLOY_METHOD_AUTO means Teleport deployed a service for the user.
+	UIDiscoverDeployServiceEvent_DEPLOY_METHOD_AUTO UIDiscoverDeployServiceEvent_DeployMethod = 1
+	// DEPLOY_METHOD_MANUAL means a user deployed a service by themselves.
+	UIDiscoverDeployServiceEvent_DEPLOY_METHOD_MANUAL UIDiscoverDeployServiceEvent_DeployMethod = 2
+)
+
+// Enum value maps for UIDiscoverDeployServiceEvent_DeployMethod.
+var (
+	UIDiscoverDeployServiceEvent_DeployMethod_name = map[int32]string{
+		0: "DEPLOY_METHOD_UNSPECIFIED",
+		1: "DEPLOY_METHOD_AUTO",
+		2: "DEPLOY_METHOD_MANUAL",
+	}
+	UIDiscoverDeployServiceEvent_DeployMethod_value = map[string]int32{
+		"DEPLOY_METHOD_UNSPECIFIED": 0,
+		"DEPLOY_METHOD_AUTO":        1,
+		"DEPLOY_METHOD_MANUAL":      2,
+	}
+)
+
+func (x UIDiscoverDeployServiceEvent_DeployMethod) Enum() *UIDiscoverDeployServiceEvent_DeployMethod {
+	p := new(UIDiscoverDeployServiceEvent_DeployMethod)
+	*p = x
+	return p
+}
+
+func (x UIDiscoverDeployServiceEvent_DeployMethod) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (UIDiscoverDeployServiceEvent_DeployMethod) Descriptor() protoreflect.EnumDescriptor {
+	return file_prehog_v1alpha_teleport_proto_enumTypes[6].Descriptor()
+}
+
+func (UIDiscoverDeployServiceEvent_DeployMethod) Type() protoreflect.EnumType {
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[6]
+}
+
+func (x UIDiscoverDeployServiceEvent_DeployMethod) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use UIDiscoverDeployServiceEvent_DeployMethod.Descriptor instead.
+func (UIDiscoverDeployServiceEvent_DeployMethod) EnumDescriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{23, 0}
+}
+
+// DeployType describes the type of deployment.
+type UIDiscoverDeployServiceEvent_DeployType int32
+
+const (
+	// DEPLOY_METHOD_UNSPECIFIED means there was an existing service
+	// so deploying step got skipped.
+	UIDiscoverDeployServiceEvent_DEPLOY_TYPE_UNSPECIFIED UIDiscoverDeployServiceEvent_DeployType = 0
+	// DEPLOY_TYPE_INSTALL_SCRIPT means service was deployed using an
+	// install script.
+	UIDiscoverDeployServiceEvent_DEPLOY_TYPE_INSTALL_SCRIPT UIDiscoverDeployServiceEvent_DeployType = 1
+	// DEPLOY_TYPE_AMAZON_ECS means service was deployed using amazon's
+	// elastic container service.
+	UIDiscoverDeployServiceEvent_DEPLOY_TYPE_AMAZON_ECS UIDiscoverDeployServiceEvent_DeployType = 2
+)
+
+// Enum value maps for UIDiscoverDeployServiceEvent_DeployType.
+var (
+	UIDiscoverDeployServiceEvent_DeployType_name = map[int32]string{
+		0: "DEPLOY_TYPE_UNSPECIFIED",
+		1: "DEPLOY_TYPE_INSTALL_SCRIPT",
+		2: "DEPLOY_TYPE_AMAZON_ECS",
+	}
+	UIDiscoverDeployServiceEvent_DeployType_value = map[string]int32{
+		"DEPLOY_TYPE_UNSPECIFIED":    0,
+		"DEPLOY_TYPE_INSTALL_SCRIPT": 1,
+		"DEPLOY_TYPE_AMAZON_ECS":     2,
+	}
+)
+
+func (x UIDiscoverDeployServiceEvent_DeployType) Enum() *UIDiscoverDeployServiceEvent_DeployType {
+	p := new(UIDiscoverDeployServiceEvent_DeployType)
+	*p = x
+	return p
+}
+
+func (x UIDiscoverDeployServiceEvent_DeployType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (UIDiscoverDeployServiceEvent_DeployType) Descriptor() protoreflect.EnumDescriptor {
+	return file_prehog_v1alpha_teleport_proto_enumTypes[7].Descriptor()
+}
+
+func (UIDiscoverDeployServiceEvent_DeployType) Type() protoreflect.EnumType {
+	return &file_prehog_v1alpha_teleport_proto_enumTypes[7]
+}
+
+func (x UIDiscoverDeployServiceEvent_DeployType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use UIDiscoverDeployServiceEvent_DeployType.Descriptor instead.
+func (UIDiscoverDeployServiceEvent_DeployType) EnumDescriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{23, 1}
+}
+
+// a successful user login
+//
+// PostHog event: tp.user.login
 type UserLoginEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// anonymized
+	// anonymized Teleport username, 32 bytes (HMAC-SHA-256) encoded in base64;
+	// should always be a real user as bots and service accounts with long-term
+	// credentials don't ever login
+	//
+	// PostHog property: tp.user_name
 	UserName string `protobuf:"bytes,1,opt,name=user_name,json=userName,proto3" json:"user_name,omitempty"`
-	// local/github/saml/oidc
+	// type of the auth connector used in the login, should be
+	// "local"/"github"/"saml"/"oidc"
+	//
+	// PostHog property: tp.connector_type
 	ConnectorType string `protobuf:"bytes,2,opt,name=connector_type,json=connectorType,proto3" json:"connector_type,omitempty"`
-	// The anonymized device ID, for logins where device trust is enabled.
+	// anonymized device ID, empty or 32 bytes (HMAC-SHA-256) encoded in base64;
+	// for logins where device trust is enabled
+	//
+	// PostHog property: tp.device_id
 	DeviceId string `protobuf:"bytes,3,opt,name=device_id,json=deviceId,proto3" json:"device_id,omitempty"`
 }
 
@@ -618,15 +808,27 @@ func (x *ResourceCreateEvent) GetResourceType() string {
 
 // a heartbeat for a resource served by a Teleport instance outside of the
 // control plane (i.e. not auth, not proxy)
+//
+// PostHog event: tp.resource.hb
 type ResourceHeartbeatEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// anonymized, 32 bytes (HMAC-SHA-256)
-	ResourceName []byte       `protobuf:"bytes,1,opt,name=resource_name,json=resourceName,proto3" json:"resource_name,omitempty"`
+	// anonymized name of the resource, 32 bytes (HMAC-SHA-256); the name is the
+	// host ID for nodes but the actual user-facing name for other resources, so
+	// an app or a database served by multiple agents won't be counted multiple
+	// times
+	//
+	// PreHog property: tp.resource_name (in base64)
+	ResourceName []byte `protobuf:"bytes,1,opt,name=resource_name,json=resourceName,proto3" json:"resource_name,omitempty"`
+	// kind of the resource (node, app, db)
+	//
+	// PostHog property: tp.resource_type (as a string, see ResourceKind)
 	ResourceKind ResourceKind `protobuf:"varint,2,opt,name=resource_kind,json=resourceKind,proto3,enum=prehog.v1alpha.ResourceKind" json:"resource_kind,omitempty"`
 	// true if the heartbeat has no expiration
+	//
+	// PostHog property: tp.is_static
 	Static bool `protobuf:"varint,3,opt,name=static,proto3" json:"static,omitempty"`
 }
 
@@ -683,14 +885,32 @@ func (x *ResourceHeartbeatEvent) GetStatic() bool {
 	return false
 }
 
+// an event representing one of several audit events: session.start, port,
+// app.session.start, db.session.start, windows.desktop.session.start; i.e. a
+// SSH shell or port-forward, kubectl exec or kubectl port-forward, DB, App or
+// Desktop connection
+//
+// an earlier encoding (as "tp.session.start") mixed SSH sessions and kubectl
+// execs under a session type of "ssh"
+//
+// PostHog event: tp.session.start
 type SessionStartEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// anonymized
+	// anonymized Teleport username, 32 bytes (HMAC-SHA-256) encoded in base64
+	//
+	// PostHog property: tp.user_name
 	UserName string `protobuf:"bytes,1,opt,name=user_name,json=userName,proto3" json:"user_name,omitempty"`
-	// ssh/kube/desktop, maybe db?
+	// type of the session, should be "ssh"/"k8s"/"db"/"app"/"desktop" (matching
+	// the values for api/types.SessionKind) or "app_tcp", "ssh_port_v2" or
+	// "k8s_port" for TCP Application Access connections, SSH port forwards and
+	// kubectl port-forward respectively; a type of "ssh_port" represents either a
+	// SSH port forwarding connection or a kubectl port-forward (not used in new
+	// events)
+	//
+	// PostHog property: tp.session_type
 	SessionType string `protobuf:"bytes,2,opt,name=session_type,json=sessionType,proto3" json:"session_type,omitempty"`
 }
 
@@ -740,25 +960,37 @@ func (x *SessionStartEvent) GetSessionType() string {
 	return ""
 }
 
+// the issuance of a user certificate from the user CA
+//
+// PostHog event: tp.certificate.issued
 type UserCertificateIssuedEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// The anonymized username/principal of the entity that requested the
-	// certificate.
+	// anonymized Teleport username, 32 bytes (HMAC-SHA-256) encoded in base64; it
+	// can be the username of a bot user rather than of a regular user
+	//
+	// PostHog property: tp.user_name
 	UserName string `protobuf:"bytes,1,opt,name=user_name,json=userName,proto3" json:"user_name,omitempty"`
-	// The issued certificate TTL.
+	// the TTL of the issued certificate, typically 8 or 12 hours
+	//
+	// PostHog property: tp.ttl_minutes (in minutes, rounded up)
 	Ttl *durationpb.Duration `protobuf:"bytes,2,opt,name=ttl,proto3" json:"ttl,omitempty"`
 	// If true, the certificate was requested by a bot (i.e. Machine ID) user.
+	// PostHog property: tp.is_bot
 	IsBot bool `protobuf:"varint,3,opt,name=is_bot,json=isBot,proto3" json:"is_bot,omitempty"`
 	// If true, the certificate usage is restricted to database access.
+	// PostHog property: tp.usage_database
 	UsageDatabase bool `protobuf:"varint,4,opt,name=usage_database,json=usageDatabase,proto3" json:"usage_database,omitempty"`
 	// If true, the certificate usage is restricted to app access.
+	// PostHog property: tp.usage_app
 	UsageApp bool `protobuf:"varint,5,opt,name=usage_app,json=usageApp,proto3" json:"usage_app,omitempty"`
 	// If true, the certificate usage is restricted to Kubernetes access.
+	// PostHog property: tp.usage_kubernetes
 	UsageKubernetes bool `protobuf:"varint,6,opt,name=usage_kubernetes,json=usageKubernetes,proto3" json:"usage_kubernetes,omitempty"`
 	// If true, the certificate usage is restricted to desktop access.
+	// PostHog property: tp.usage_desktop
 	UsageDesktop bool `protobuf:"varint,7,opt,name=usage_desktop,json=usageDesktop,proto3" json:"usage_desktop,omitempty"`
 }
 
@@ -843,6 +1075,8 @@ func (x *UserCertificateIssuedEvent) GetUsageDesktop() bool {
 	return false
 }
 
+// UIBannerClickEvent is a usage event sent by the UI when the upgrade
+// banner is clicked.
 type UIBannerClickEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -900,6 +1134,8 @@ func (x *UIBannerClickEvent) GetAlert() string {
 	return ""
 }
 
+// UIOnboardCompleteGoToDashboardClickEvent is a UI event sent when initial
+// registration is complete.
 type UIOnboardCompleteGoToDashboardClickEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -948,6 +1184,8 @@ func (x *UIOnboardCompleteGoToDashboardClickEvent) GetUserName() string {
 	return ""
 }
 
+// UIOnboardAddFirstResourceClickEvent is a UI event sent when a user clicks the
+// "add first resource" button.
 type UIOnboardAddFirstResourceClickEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -996,6 +1234,8 @@ func (x *UIOnboardAddFirstResourceClickEvent) GetUserName() string {
 	return ""
 }
 
+// UIOnboardAddFirstResourceLaterClickEvent is a UI event sent when a user
+// clicks the "add first resource later" button.
 type UIOnboardAddFirstResourceLaterClickEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1044,6 +1284,8 @@ func (x *UIOnboardAddFirstResourceLaterClickEvent) GetUserName() string {
 	return ""
 }
 
+// UIOnboardSetCredentialSubmitEvent is a UI event sent during registration when
+// users configure their credentials.
 type UIOnboardSetCredentialSubmitEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1092,6 +1334,8 @@ func (x *UIOnboardSetCredentialSubmitEvent) GetUserName() string {
 	return ""
 }
 
+// UIOnboardRegisterChallengeSubmitEvent is a UI event sent during registration
+// when the MFA challenge is completed.
 type UIOnboardRegisterChallengeSubmitEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1156,6 +1400,58 @@ func (x *UIOnboardRegisterChallengeSubmitEvent) GetLoginFlow() string {
 	return ""
 }
 
+// UIOnboardQuestionnaireSubmitEvent is a UI event sent during registration when
+// user submits their onboarding questionnaire.
+type UIOnboardQuestionnaireSubmitEvent struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// anonymized
+	UserName string `protobuf:"bytes,1,opt,name=user_name,json=userName,proto3" json:"user_name,omitempty"`
+}
+
+func (x *UIOnboardQuestionnaireSubmitEvent) Reset() {
+	*x = UIOnboardQuestionnaireSubmitEvent{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UIOnboardQuestionnaireSubmitEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UIOnboardQuestionnaireSubmitEvent) ProtoMessage() {}
+
+func (x *UIOnboardQuestionnaireSubmitEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UIOnboardQuestionnaireSubmitEvent.ProtoReflect.Descriptor instead.
+func (*UIOnboardQuestionnaireSubmitEvent) Descriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *UIOnboardQuestionnaireSubmitEvent) GetUserName() string {
+	if x != nil {
+		return x.UserName
+	}
+	return ""
+}
+
+// UIRecoveryCodesContinueClickEvent is a UI event sent during
+// registration when the user configures cluster recovery codes.
 type UIRecoveryCodesContinueClickEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1168,7 +1464,7 @@ type UIRecoveryCodesContinueClickEvent struct {
 func (x *UIRecoveryCodesContinueClickEvent) Reset() {
 	*x = UIRecoveryCodesContinueClickEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[12]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1181,7 +1477,7 @@ func (x *UIRecoveryCodesContinueClickEvent) String() string {
 func (*UIRecoveryCodesContinueClickEvent) ProtoMessage() {}
 
 func (x *UIRecoveryCodesContinueClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[12]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1194,7 +1490,7 @@ func (x *UIRecoveryCodesContinueClickEvent) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use UIRecoveryCodesContinueClickEvent.ProtoReflect.Descriptor instead.
 func (*UIRecoveryCodesContinueClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{12}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *UIRecoveryCodesContinueClickEvent) GetUserName() string {
@@ -1204,6 +1500,8 @@ func (x *UIRecoveryCodesContinueClickEvent) GetUserName() string {
 	return ""
 }
 
+// UIRecoveryCodesCopyClickEvent is a UI event sent during
+// registration when the user copies recovery codes.
 type UIRecoveryCodesCopyClickEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1216,7 +1514,7 @@ type UIRecoveryCodesCopyClickEvent struct {
 func (x *UIRecoveryCodesCopyClickEvent) Reset() {
 	*x = UIRecoveryCodesCopyClickEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[13]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1229,7 +1527,7 @@ func (x *UIRecoveryCodesCopyClickEvent) String() string {
 func (*UIRecoveryCodesCopyClickEvent) ProtoMessage() {}
 
 func (x *UIRecoveryCodesCopyClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[13]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1242,7 +1540,7 @@ func (x *UIRecoveryCodesCopyClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIRecoveryCodesCopyClickEvent.ProtoReflect.Descriptor instead.
 func (*UIRecoveryCodesCopyClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{13}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *UIRecoveryCodesCopyClickEvent) GetUserName() string {
@@ -1252,6 +1550,8 @@ func (x *UIRecoveryCodesCopyClickEvent) GetUserName() string {
 	return ""
 }
 
+// UIRecoveryCodesPrintClickEvent is a UI event sent during
+// registration when the user prints recovery codes.
 type UIRecoveryCodesPrintClickEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1264,7 +1564,7 @@ type UIRecoveryCodesPrintClickEvent struct {
 func (x *UIRecoveryCodesPrintClickEvent) Reset() {
 	*x = UIRecoveryCodesPrintClickEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[14]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1277,7 +1577,7 @@ func (x *UIRecoveryCodesPrintClickEvent) String() string {
 func (*UIRecoveryCodesPrintClickEvent) ProtoMessage() {}
 
 func (x *UIRecoveryCodesPrintClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[14]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1290,7 +1590,7 @@ func (x *UIRecoveryCodesPrintClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIRecoveryCodesPrintClickEvent.ProtoReflect.Descriptor instead.
 func (*UIRecoveryCodesPrintClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{14}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *UIRecoveryCodesPrintClickEvent) GetUserName() string {
@@ -1318,7 +1618,7 @@ type DiscoverMetadata struct {
 func (x *DiscoverMetadata) Reset() {
 	*x = DiscoverMetadata{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[15]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1331,7 +1631,7 @@ func (x *DiscoverMetadata) String() string {
 func (*DiscoverMetadata) ProtoMessage() {}
 
 func (x *DiscoverMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[15]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1344,7 +1644,7 @@ func (x *DiscoverMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DiscoverMetadata.ProtoReflect.Descriptor instead.
 func (*DiscoverMetadata) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{15}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *DiscoverMetadata) GetId() string {
@@ -1381,7 +1681,7 @@ type DiscoverResourceMetadata struct {
 func (x *DiscoverResourceMetadata) Reset() {
 	*x = DiscoverResourceMetadata{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[16]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1394,7 +1694,7 @@ func (x *DiscoverResourceMetadata) String() string {
 func (*DiscoverResourceMetadata) ProtoMessage() {}
 
 func (x *DiscoverResourceMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[16]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1407,7 +1707,7 @@ func (x *DiscoverResourceMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DiscoverResourceMetadata.ProtoReflect.Descriptor instead.
 func (*DiscoverResourceMetadata) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{16}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *DiscoverResourceMetadata) GetResource() DiscoverResource {
@@ -1434,7 +1734,7 @@ type DiscoverStepStatus struct {
 func (x *DiscoverStepStatus) Reset() {
 	*x = DiscoverStepStatus{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[17]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1447,7 +1747,7 @@ func (x *DiscoverStepStatus) String() string {
 func (*DiscoverStepStatus) ProtoMessage() {}
 
 func (x *DiscoverStepStatus) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[17]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1460,7 +1760,7 @@ func (x *DiscoverStepStatus) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DiscoverStepStatus.ProtoReflect.Descriptor instead.
 func (*DiscoverStepStatus) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{17}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *DiscoverStepStatus) GetStatus() DiscoverStatus {
@@ -1490,7 +1790,7 @@ type UIDiscoverStartedEvent struct {
 func (x *UIDiscoverStartedEvent) Reset() {
 	*x = UIDiscoverStartedEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[18]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[19]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1503,7 +1803,7 @@ func (x *UIDiscoverStartedEvent) String() string {
 func (*UIDiscoverStartedEvent) ProtoMessage() {}
 
 func (x *UIDiscoverStartedEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[18]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[19]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1516,7 +1816,7 @@ func (x *UIDiscoverStartedEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverStartedEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverStartedEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{18}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *UIDiscoverStartedEvent) GetMetadata() *DiscoverMetadata {
@@ -1548,7 +1848,7 @@ type UIDiscoverResourceSelectionEvent struct {
 func (x *UIDiscoverResourceSelectionEvent) Reset() {
 	*x = UIDiscoverResourceSelectionEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[19]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[20]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1561,7 +1861,7 @@ func (x *UIDiscoverResourceSelectionEvent) String() string {
 func (*UIDiscoverResourceSelectionEvent) ProtoMessage() {}
 
 func (x *UIDiscoverResourceSelectionEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[19]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[20]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1574,7 +1874,7 @@ func (x *UIDiscoverResourceSelectionEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverResourceSelectionEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverResourceSelectionEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{19}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *UIDiscoverResourceSelectionEvent) GetMetadata() *DiscoverMetadata {
@@ -1614,7 +1914,7 @@ type UIDiscoverIntegrationAWSOIDCConnectEvent struct {
 func (x *UIDiscoverIntegrationAWSOIDCConnectEvent) Reset() {
 	*x = UIDiscoverIntegrationAWSOIDCConnectEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[20]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[21]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1627,7 +1927,7 @@ func (x *UIDiscoverIntegrationAWSOIDCConnectEvent) String() string {
 func (*UIDiscoverIntegrationAWSOIDCConnectEvent) ProtoMessage() {}
 
 func (x *UIDiscoverIntegrationAWSOIDCConnectEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[20]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[21]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1640,7 +1940,7 @@ func (x *UIDiscoverIntegrationAWSOIDCConnectEvent) ProtoReflect() protoreflect.M
 
 // Deprecated: Use UIDiscoverIntegrationAWSOIDCConnectEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverIntegrationAWSOIDCConnectEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{20}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *UIDiscoverIntegrationAWSOIDCConnectEvent) GetMetadata() *DiscoverMetadata {
@@ -1680,7 +1980,7 @@ type UIDiscoverDatabaseRDSEnrollEvent struct {
 func (x *UIDiscoverDatabaseRDSEnrollEvent) Reset() {
 	*x = UIDiscoverDatabaseRDSEnrollEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[21]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[22]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1693,7 +1993,7 @@ func (x *UIDiscoverDatabaseRDSEnrollEvent) String() string {
 func (*UIDiscoverDatabaseRDSEnrollEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDatabaseRDSEnrollEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[21]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[22]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1706,7 +2006,7 @@ func (x *UIDiscoverDatabaseRDSEnrollEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverDatabaseRDSEnrollEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDatabaseRDSEnrollEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{21}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *UIDiscoverDatabaseRDSEnrollEvent) GetMetadata() *DiscoverMetadata {
@@ -1749,15 +2049,17 @@ type UIDiscoverDeployServiceEvent struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Metadata *DiscoverMetadata         `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
-	Resource *DiscoverResourceMetadata `protobuf:"bytes,2,opt,name=resource,proto3" json:"resource,omitempty"`
-	Status   *DiscoverStepStatus       `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
+	Metadata     *DiscoverMetadata                         `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	Resource     *DiscoverResourceMetadata                 `protobuf:"bytes,2,opt,name=resource,proto3" json:"resource,omitempty"`
+	Status       *DiscoverStepStatus                       `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
+	DeployMethod UIDiscoverDeployServiceEvent_DeployMethod `protobuf:"varint,4,opt,name=deploy_method,json=deployMethod,proto3,enum=prehog.v1alpha.UIDiscoverDeployServiceEvent_DeployMethod" json:"deploy_method,omitempty"`
+	DeployType   UIDiscoverDeployServiceEvent_DeployType   `protobuf:"varint,5,opt,name=deploy_type,json=deployType,proto3,enum=prehog.v1alpha.UIDiscoverDeployServiceEvent_DeployType" json:"deploy_type,omitempty"`
 }
 
 func (x *UIDiscoverDeployServiceEvent) Reset() {
 	*x = UIDiscoverDeployServiceEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[22]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[23]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1770,7 +2072,7 @@ func (x *UIDiscoverDeployServiceEvent) String() string {
 func (*UIDiscoverDeployServiceEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDeployServiceEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[22]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[23]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1783,7 +2085,7 @@ func (x *UIDiscoverDeployServiceEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverDeployServiceEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDeployServiceEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{22}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *UIDiscoverDeployServiceEvent) GetMetadata() *DiscoverMetadata {
@@ -1807,6 +2109,20 @@ func (x *UIDiscoverDeployServiceEvent) GetStatus() *DiscoverStepStatus {
 	return nil
 }
 
+func (x *UIDiscoverDeployServiceEvent) GetDeployMethod() UIDiscoverDeployServiceEvent_DeployMethod {
+	if x != nil {
+		return x.DeployMethod
+	}
+	return UIDiscoverDeployServiceEvent_DEPLOY_METHOD_UNSPECIFIED
+}
+
+func (x *UIDiscoverDeployServiceEvent) GetDeployType() UIDiscoverDeployServiceEvent_DeployType {
+	if x != nil {
+		return x.DeployType
+	}
+	return UIDiscoverDeployServiceEvent_DEPLOY_TYPE_UNSPECIFIED
+}
+
 // UIDiscoverDatabaseRegisterEvent is emitted when a user is finished with the step that registers a database resource.
 type UIDiscoverDatabaseRegisterEvent struct {
 	state         protoimpl.MessageState
@@ -1821,7 +2137,7 @@ type UIDiscoverDatabaseRegisterEvent struct {
 func (x *UIDiscoverDatabaseRegisterEvent) Reset() {
 	*x = UIDiscoverDatabaseRegisterEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[23]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[24]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1834,7 +2150,7 @@ func (x *UIDiscoverDatabaseRegisterEvent) String() string {
 func (*UIDiscoverDatabaseRegisterEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDatabaseRegisterEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[23]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[24]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1847,7 +2163,7 @@ func (x *UIDiscoverDatabaseRegisterEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverDatabaseRegisterEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDatabaseRegisterEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{23}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *UIDiscoverDatabaseRegisterEvent) GetMetadata() *DiscoverMetadata {
@@ -1885,7 +2201,7 @@ type UIDiscoverDatabaseConfigureMTLSEvent struct {
 func (x *UIDiscoverDatabaseConfigureMTLSEvent) Reset() {
 	*x = UIDiscoverDatabaseConfigureMTLSEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[24]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[25]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1898,7 +2214,7 @@ func (x *UIDiscoverDatabaseConfigureMTLSEvent) String() string {
 func (*UIDiscoverDatabaseConfigureMTLSEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDatabaseConfigureMTLSEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[24]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[25]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1911,7 +2227,7 @@ func (x *UIDiscoverDatabaseConfigureMTLSEvent) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use UIDiscoverDatabaseConfigureMTLSEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDatabaseConfigureMTLSEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{24}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *UIDiscoverDatabaseConfigureMTLSEvent) GetMetadata() *DiscoverMetadata {
@@ -1949,7 +2265,7 @@ type UIDiscoverDesktopActiveDirectoryToolsInstallEvent struct {
 func (x *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) Reset() {
 	*x = UIDiscoverDesktopActiveDirectoryToolsInstallEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[25]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[26]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1962,7 +2278,7 @@ func (x *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) String() string {
 func (*UIDiscoverDesktopActiveDirectoryToolsInstallEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[25]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[26]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1975,7 +2291,7 @@ func (x *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) ProtoReflect() proto
 
 // Deprecated: Use UIDiscoverDesktopActiveDirectoryToolsInstallEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDesktopActiveDirectoryToolsInstallEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{25}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *UIDiscoverDesktopActiveDirectoryToolsInstallEvent) GetMetadata() *DiscoverMetadata {
@@ -2013,7 +2329,7 @@ type UIDiscoverDesktopActiveDirectoryConfigureEvent struct {
 func (x *UIDiscoverDesktopActiveDirectoryConfigureEvent) Reset() {
 	*x = UIDiscoverDesktopActiveDirectoryConfigureEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[26]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[27]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2026,7 +2342,7 @@ func (x *UIDiscoverDesktopActiveDirectoryConfigureEvent) String() string {
 func (*UIDiscoverDesktopActiveDirectoryConfigureEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDesktopActiveDirectoryConfigureEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[26]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[27]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2039,7 +2355,7 @@ func (x *UIDiscoverDesktopActiveDirectoryConfigureEvent) ProtoReflect() protoref
 
 // Deprecated: Use UIDiscoverDesktopActiveDirectoryConfigureEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDesktopActiveDirectoryConfigureEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{26}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *UIDiscoverDesktopActiveDirectoryConfigureEvent) GetMetadata() *DiscoverMetadata {
@@ -2079,7 +2395,7 @@ type UIDiscoverAutoDiscoveredResourcesEvent struct {
 func (x *UIDiscoverAutoDiscoveredResourcesEvent) Reset() {
 	*x = UIDiscoverAutoDiscoveredResourcesEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[27]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[28]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2092,7 +2408,7 @@ func (x *UIDiscoverAutoDiscoveredResourcesEvent) String() string {
 func (*UIDiscoverAutoDiscoveredResourcesEvent) ProtoMessage() {}
 
 func (x *UIDiscoverAutoDiscoveredResourcesEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[27]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[28]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2105,7 +2421,7 @@ func (x *UIDiscoverAutoDiscoveredResourcesEvent) ProtoReflect() protoreflect.Mes
 
 // Deprecated: Use UIDiscoverAutoDiscoveredResourcesEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverAutoDiscoveredResourcesEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{27}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *UIDiscoverAutoDiscoveredResourcesEvent) GetMetadata() *DiscoverMetadata {
@@ -2150,7 +2466,7 @@ type UIDiscoverDatabaseConfigureIAMPolicyEvent struct {
 func (x *UIDiscoverDatabaseConfigureIAMPolicyEvent) Reset() {
 	*x = UIDiscoverDatabaseConfigureIAMPolicyEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[28]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[29]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2163,7 +2479,7 @@ func (x *UIDiscoverDatabaseConfigureIAMPolicyEvent) String() string {
 func (*UIDiscoverDatabaseConfigureIAMPolicyEvent) ProtoMessage() {}
 
 func (x *UIDiscoverDatabaseConfigureIAMPolicyEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[28]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[29]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2176,7 +2492,7 @@ func (x *UIDiscoverDatabaseConfigureIAMPolicyEvent) ProtoReflect() protoreflect.
 
 // Deprecated: Use UIDiscoverDatabaseConfigureIAMPolicyEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverDatabaseConfigureIAMPolicyEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{28}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *UIDiscoverDatabaseConfigureIAMPolicyEvent) GetMetadata() *DiscoverMetadata {
@@ -2214,7 +2530,7 @@ type UIDiscoverPrincipalsConfigureEvent struct {
 func (x *UIDiscoverPrincipalsConfigureEvent) Reset() {
 	*x = UIDiscoverPrincipalsConfigureEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[29]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[30]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2227,7 +2543,7 @@ func (x *UIDiscoverPrincipalsConfigureEvent) String() string {
 func (*UIDiscoverPrincipalsConfigureEvent) ProtoMessage() {}
 
 func (x *UIDiscoverPrincipalsConfigureEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[29]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[30]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2240,7 +2556,7 @@ func (x *UIDiscoverPrincipalsConfigureEvent) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use UIDiscoverPrincipalsConfigureEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverPrincipalsConfigureEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{29}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *UIDiscoverPrincipalsConfigureEvent) GetMetadata() *DiscoverMetadata {
@@ -2279,7 +2595,7 @@ type UIDiscoverTestConnectionEvent struct {
 func (x *UIDiscoverTestConnectionEvent) Reset() {
 	*x = UIDiscoverTestConnectionEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[30]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[31]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2292,7 +2608,7 @@ func (x *UIDiscoverTestConnectionEvent) String() string {
 func (*UIDiscoverTestConnectionEvent) ProtoMessage() {}
 
 func (x *UIDiscoverTestConnectionEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[30]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[31]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2305,7 +2621,7 @@ func (x *UIDiscoverTestConnectionEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverTestConnectionEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverTestConnectionEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{30}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *UIDiscoverTestConnectionEvent) GetMetadata() *DiscoverMetadata {
@@ -2343,7 +2659,7 @@ type UIDiscoverCompletedEvent struct {
 func (x *UIDiscoverCompletedEvent) Reset() {
 	*x = UIDiscoverCompletedEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[31]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[32]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2356,7 +2672,7 @@ func (x *UIDiscoverCompletedEvent) String() string {
 func (*UIDiscoverCompletedEvent) ProtoMessage() {}
 
 func (x *UIDiscoverCompletedEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[31]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[32]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2369,7 +2685,7 @@ func (x *UIDiscoverCompletedEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIDiscoverCompletedEvent.ProtoReflect.Descriptor instead.
 func (*UIDiscoverCompletedEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{31}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *UIDiscoverCompletedEvent) GetMetadata() *DiscoverMetadata {
@@ -2408,7 +2724,7 @@ type RoleCreateEvent struct {
 func (x *RoleCreateEvent) Reset() {
 	*x = RoleCreateEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[32]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[33]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2421,7 +2737,7 @@ func (x *RoleCreateEvent) String() string {
 func (*RoleCreateEvent) ProtoMessage() {}
 
 func (x *RoleCreateEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[32]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[33]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2434,7 +2750,7 @@ func (x *RoleCreateEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RoleCreateEvent.ProtoReflect.Descriptor instead.
 func (*RoleCreateEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{32}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *RoleCreateEvent) GetUserName() string {
@@ -2451,6 +2767,172 @@ func (x *RoleCreateEvent) GetRoleName() string {
 	return ""
 }
 
+// BotCreateEvent is emitted when user creates a bot.
+type BotCreateEvent struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// user_name is the anonymized name of the user who created the bot
+	UserName string `protobuf:"bytes,1,opt,name=user_name,json=userName,proto3" json:"user_name,omitempty"`
+	// anonymized
+	BotUserName string `protobuf:"bytes,2,opt,name=bot_user_name,json=botUserName,proto3" json:"bot_user_name,omitempty"`
+	// role_name is the anonymized name of the bot role that was created.
+	RoleName string `protobuf:"bytes,3,opt,name=role_name,json=roleName,proto3" json:"role_name,omitempty"`
+	// role_count is the number of roles that the bot role can impersonate on
+	// creation.
+	RoleCount int64 `protobuf:"varint,4,opt,name=role_count,json=roleCount,proto3" json:"role_count,omitempty"`
+	// join_method is the join method of the token associated with the bot on
+	// creation.
+	JoinMethod string `protobuf:"bytes,5,opt,name=join_method,json=joinMethod,proto3" json:"join_method,omitempty"`
+	// bot_name is the anonymised name of the bot.
+	BotName string `protobuf:"bytes,6,opt,name=bot_name,json=botName,proto3" json:"bot_name,omitempty"`
+}
+
+func (x *BotCreateEvent) Reset() {
+	*x = BotCreateEvent{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[34]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BotCreateEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BotCreateEvent) ProtoMessage() {}
+
+func (x *BotCreateEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[34]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BotCreateEvent.ProtoReflect.Descriptor instead.
+func (*BotCreateEvent) Descriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{34}
+}
+
+func (x *BotCreateEvent) GetUserName() string {
+	if x != nil {
+		return x.UserName
+	}
+	return ""
+}
+
+func (x *BotCreateEvent) GetBotUserName() string {
+	if x != nil {
+		return x.BotUserName
+	}
+	return ""
+}
+
+func (x *BotCreateEvent) GetRoleName() string {
+	if x != nil {
+		return x.RoleName
+	}
+	return ""
+}
+
+func (x *BotCreateEvent) GetRoleCount() int64 {
+	if x != nil {
+		return x.RoleCount
+	}
+	return 0
+}
+
+func (x *BotCreateEvent) GetJoinMethod() string {
+	if x != nil {
+		return x.JoinMethod
+	}
+	return ""
+}
+
+func (x *BotCreateEvent) GetBotName() string {
+	if x != nil {
+		return x.BotName
+	}
+	return ""
+}
+
+// BotJoinEvent is emitted when a bot joins a Teleport cluster.
+type BotJoinEvent struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// bot_name is the anonymised name of the bot.
+	BotName string `protobuf:"bytes,1,opt,name=bot_name,json=botName,proto3" json:"bot_name,omitempty"`
+	// join_method is the join method of the token associated with the bot on
+	// creation. This will be the string value of `api/types.JoinMethod`.
+	JoinMethod string `protobuf:"bytes,2,opt,name=join_method,json=joinMethod,proto3" json:"join_method,omitempty"`
+	// join_token_name is the anonymised name of the token used to join
+	// the cluster.
+	JoinTokenName string `protobuf:"bytes,3,opt,name=join_token_name,json=joinTokenName,proto3" json:"join_token_name,omitempty"`
+}
+
+func (x *BotJoinEvent) Reset() {
+	*x = BotJoinEvent{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[35]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BotJoinEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BotJoinEvent) ProtoMessage() {}
+
+func (x *BotJoinEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[35]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BotJoinEvent.ProtoReflect.Descriptor instead.
+func (*BotJoinEvent) Descriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{35}
+}
+
+func (x *BotJoinEvent) GetBotName() string {
+	if x != nil {
+		return x.BotName
+	}
+	return ""
+}
+
+func (x *BotJoinEvent) GetJoinMethod() string {
+	if x != nil {
+		return x.JoinMethod
+	}
+	return ""
+}
+
+func (x *BotJoinEvent) GetJoinTokenName() string {
+	if x != nil {
+		return x.JoinTokenName
+	}
+	return ""
+}
+
+// UICreateNewRoleClickEvent is an event that can be triggered during custom role creation
 type UICreateNewRoleClickEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2463,7 +2945,7 @@ type UICreateNewRoleClickEvent struct {
 func (x *UICreateNewRoleClickEvent) Reset() {
 	*x = UICreateNewRoleClickEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[33]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[36]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2476,7 +2958,7 @@ func (x *UICreateNewRoleClickEvent) String() string {
 func (*UICreateNewRoleClickEvent) ProtoMessage() {}
 
 func (x *UICreateNewRoleClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[33]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[36]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2489,7 +2971,7 @@ func (x *UICreateNewRoleClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UICreateNewRoleClickEvent.ProtoReflect.Descriptor instead.
 func (*UICreateNewRoleClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{33}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *UICreateNewRoleClickEvent) GetUserName() string {
@@ -2499,6 +2981,7 @@ func (x *UICreateNewRoleClickEvent) GetUserName() string {
 	return ""
 }
 
+// UICreateNewRoleSaveClickEvent is an event that can be triggered during custom role creation
 type UICreateNewRoleSaveClickEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2511,7 +2994,7 @@ type UICreateNewRoleSaveClickEvent struct {
 func (x *UICreateNewRoleSaveClickEvent) Reset() {
 	*x = UICreateNewRoleSaveClickEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[34]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[37]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2524,7 +3007,7 @@ func (x *UICreateNewRoleSaveClickEvent) String() string {
 func (*UICreateNewRoleSaveClickEvent) ProtoMessage() {}
 
 func (x *UICreateNewRoleSaveClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[34]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[37]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2537,7 +3020,7 @@ func (x *UICreateNewRoleSaveClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UICreateNewRoleSaveClickEvent.ProtoReflect.Descriptor instead.
 func (*UICreateNewRoleSaveClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{34}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{37}
 }
 
 func (x *UICreateNewRoleSaveClickEvent) GetUserName() string {
@@ -2547,6 +3030,7 @@ func (x *UICreateNewRoleSaveClickEvent) GetUserName() string {
 	return ""
 }
 
+// UICreateNewRoleCancelClickEvent is an event that can be triggered during custom role creation
 type UICreateNewRoleCancelClickEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2559,7 +3043,7 @@ type UICreateNewRoleCancelClickEvent struct {
 func (x *UICreateNewRoleCancelClickEvent) Reset() {
 	*x = UICreateNewRoleCancelClickEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[35]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[38]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2572,7 +3056,7 @@ func (x *UICreateNewRoleCancelClickEvent) String() string {
 func (*UICreateNewRoleCancelClickEvent) ProtoMessage() {}
 
 func (x *UICreateNewRoleCancelClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[35]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[38]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2585,7 +3069,7 @@ func (x *UICreateNewRoleCancelClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UICreateNewRoleCancelClickEvent.ProtoReflect.Descriptor instead.
 func (*UICreateNewRoleCancelClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{35}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *UICreateNewRoleCancelClickEvent) GetUserName() string {
@@ -2595,6 +3079,7 @@ func (x *UICreateNewRoleCancelClickEvent) GetUserName() string {
 	return ""
 }
 
+// UICreateNewRoleViewDocumentationClickEvent is an event that can be triggered during custom role creation
 type UICreateNewRoleViewDocumentationClickEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2607,7 +3092,7 @@ type UICreateNewRoleViewDocumentationClickEvent struct {
 func (x *UICreateNewRoleViewDocumentationClickEvent) Reset() {
 	*x = UICreateNewRoleViewDocumentationClickEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[36]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[39]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2620,7 +3105,7 @@ func (x *UICreateNewRoleViewDocumentationClickEvent) String() string {
 func (*UICreateNewRoleViewDocumentationClickEvent) ProtoMessage() {}
 
 func (x *UICreateNewRoleViewDocumentationClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[36]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[39]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2633,7 +3118,7 @@ func (x *UICreateNewRoleViewDocumentationClickEvent) ProtoReflect() protoreflect
 
 // Deprecated: Use UICreateNewRoleViewDocumentationClickEvent.ProtoReflect.Descriptor instead.
 func (*UICreateNewRoleViewDocumentationClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{36}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *UICreateNewRoleViewDocumentationClickEvent) GetUserName() string {
@@ -2657,7 +3142,7 @@ type UICallToActionClickEvent struct {
 func (x *UICallToActionClickEvent) Reset() {
 	*x = UICallToActionClickEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[37]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[40]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2670,7 +3155,7 @@ func (x *UICallToActionClickEvent) String() string {
 func (*UICallToActionClickEvent) ProtoMessage() {}
 
 func (x *UICallToActionClickEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[37]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[40]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2683,7 +3168,7 @@ func (x *UICallToActionClickEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UICallToActionClickEvent.ProtoReflect.Descriptor instead.
 func (*UICallToActionClickEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{37}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{40}
 }
 
 func (x *UICallToActionClickEvent) GetUserName() string {
@@ -2700,19 +3185,25 @@ func (x *UICallToActionClickEvent) GetCta() CTA {
 	return CTA_CTA_UNSPECIFIED
 }
 
+// a request forwarded to a kube cluster's API server (other than exec and
+// port-forward)
+//
+// PostHog event: tp.kube.request
 type KubeRequestEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// anonymized
+	// anonymized Teleport username, 32 bytes (HMAC-SHA-256) encoded in base64
+	//
+	// PostHog property: tp.user_name
 	UserName string `protobuf:"bytes,1,opt,name=user_name,json=userName,proto3" json:"user_name,omitempty"`
 }
 
 func (x *KubeRequestEvent) Reset() {
 	*x = KubeRequestEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[38]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[41]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2725,7 +3216,7 @@ func (x *KubeRequestEvent) String() string {
 func (*KubeRequestEvent) ProtoMessage() {}
 
 func (x *KubeRequestEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[38]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[41]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2738,7 +3229,7 @@ func (x *KubeRequestEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KubeRequestEvent.ProtoReflect.Descriptor instead.
 func (*KubeRequestEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{38}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *KubeRequestEvent) GetUserName() string {
@@ -2748,12 +3239,17 @@ func (x *KubeRequestEvent) GetUserName() string {
 	return ""
 }
 
+// an sftp event, represents a single operation on a file
+//
+// PostHog event: tp.sftp
 type SFTPEvent struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// anonymized
+	// anonymized Teleport username, 32 bytes (HMAC-SHA-256) encoded in base64
+	//
+	// PostHog property: tp.user_name
 	UserName string `protobuf:"bytes,1,opt,name=user_name,json=userName,proto3" json:"user_name,omitempty"`
 	// matching SFTPAction in teleport/api/types/events/events.proto
 	Action int32 `protobuf:"varint,2,opt,name=action,proto3" json:"action,omitempty"`
@@ -2762,7 +3258,7 @@ type SFTPEvent struct {
 func (x *SFTPEvent) Reset() {
 	*x = SFTPEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[39]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[42]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2775,7 +3271,7 @@ func (x *SFTPEvent) String() string {
 func (*SFTPEvent) ProtoMessage() {}
 
 func (x *SFTPEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[39]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[42]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2788,7 +3284,7 @@ func (x *SFTPEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SFTPEvent.ProtoReflect.Descriptor instead.
 func (*SFTPEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{39}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{42}
 }
 
 func (x *SFTPEvent) GetUserName() string {
@@ -2826,7 +3322,7 @@ type AgentMetadataEvent struct {
 func (x *AgentMetadataEvent) Reset() {
 	*x = AgentMetadataEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[40]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[43]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2839,7 +3335,7 @@ func (x *AgentMetadataEvent) String() string {
 func (*AgentMetadataEvent) ProtoMessage() {}
 
 func (x *AgentMetadataEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[40]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[43]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2852,7 +3348,7 @@ func (x *AgentMetadataEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AgentMetadataEvent.ProtoReflect.Descriptor instead.
 func (*AgentMetadataEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{40}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{43}
 }
 
 func (x *AgentMetadataEvent) GetVersion() string {
@@ -2955,7 +3451,7 @@ type AssistCompletionEvent struct {
 func (x *AssistCompletionEvent) Reset() {
 	*x = AssistCompletionEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[41]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[44]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2968,7 +3464,7 @@ func (x *AssistCompletionEvent) String() string {
 func (*AssistCompletionEvent) ProtoMessage() {}
 
 func (x *AssistCompletionEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[41]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[44]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2981,7 +3477,7 @@ func (x *AssistCompletionEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AssistCompletionEvent.ProtoReflect.Descriptor instead.
 func (*AssistCompletionEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{41}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{44}
 }
 
 func (x *AssistCompletionEvent) GetUserName() string {
@@ -3038,7 +3534,7 @@ type IntegrationEnrollMetadata struct {
 func (x *IntegrationEnrollMetadata) Reset() {
 	*x = IntegrationEnrollMetadata{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[42]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[45]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3051,7 +3547,7 @@ func (x *IntegrationEnrollMetadata) String() string {
 func (*IntegrationEnrollMetadata) ProtoMessage() {}
 
 func (x *IntegrationEnrollMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[42]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[45]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3064,7 +3560,7 @@ func (x *IntegrationEnrollMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IntegrationEnrollMetadata.ProtoReflect.Descriptor instead.
 func (*IntegrationEnrollMetadata) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{42}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{45}
 }
 
 func (x *IntegrationEnrollMetadata) GetId() string {
@@ -3101,7 +3597,7 @@ type UIIntegrationEnrollStartEvent struct {
 func (x *UIIntegrationEnrollStartEvent) Reset() {
 	*x = UIIntegrationEnrollStartEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[43]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[46]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3114,7 +3610,7 @@ func (x *UIIntegrationEnrollStartEvent) String() string {
 func (*UIIntegrationEnrollStartEvent) ProtoMessage() {}
 
 func (x *UIIntegrationEnrollStartEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[43]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[46]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3127,7 +3623,7 @@ func (x *UIIntegrationEnrollStartEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIIntegrationEnrollStartEvent.ProtoReflect.Descriptor instead.
 func (*UIIntegrationEnrollStartEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{43}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *UIIntegrationEnrollStartEvent) GetMetadata() *IntegrationEnrollMetadata {
@@ -3150,7 +3646,7 @@ type UIIntegrationEnrollCompleteEvent struct {
 func (x *UIIntegrationEnrollCompleteEvent) Reset() {
 	*x = UIIntegrationEnrollCompleteEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[44]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[47]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3163,7 +3659,7 @@ func (x *UIIntegrationEnrollCompleteEvent) String() string {
 func (*UIIntegrationEnrollCompleteEvent) ProtoMessage() {}
 
 func (x *UIIntegrationEnrollCompleteEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[44]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[47]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3176,7 +3672,7 @@ func (x *UIIntegrationEnrollCompleteEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UIIntegrationEnrollCompleteEvent.ProtoReflect.Descriptor instead.
 func (*UIIntegrationEnrollCompleteEvent) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{44}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{47}
 }
 
 func (x *UIIntegrationEnrollCompleteEvent) GetMetadata() *IntegrationEnrollMetadata {
@@ -3186,15 +3682,79 @@ func (x *UIIntegrationEnrollCompleteEvent) GetMetadata() *IntegrationEnrollMetad
 	return nil
 }
 
+// EditorChangeEvent is an event that is emitted when a user role set changes resulting in
+// a editor role being added on removed
+type EditorChangeEvent struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// anonymized user name
+	UserName string             `protobuf:"bytes,1,opt,name=user_name,json=userName,proto3" json:"user_name,omitempty"`
+	Status   EditorChangeStatus `protobuf:"varint,2,opt,name=status,proto3,enum=prehog.v1alpha.EditorChangeStatus" json:"status,omitempty"`
+}
+
+func (x *EditorChangeEvent) Reset() {
+	*x = EditorChangeEvent{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[48]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EditorChangeEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EditorChangeEvent) ProtoMessage() {}
+
+func (x *EditorChangeEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[48]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EditorChangeEvent.ProtoReflect.Descriptor instead.
+func (*EditorChangeEvent) Descriptor() ([]byte, []int) {
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{48}
+}
+
+func (x *EditorChangeEvent) GetUserName() string {
+	if x != nil {
+		return x.UserName
+	}
+	return ""
+}
+
+func (x *EditorChangeEvent) GetStatus() EditorChangeStatus {
+	if x != nil {
+		return x.Status
+	}
+	return EditorChangeStatus_EDITOR_CHANGE_STATUS_UNSPECIFIED
+}
+
 type SubmitEventRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// anonymized
+	// anonymized, 32 bytes (HMAC-SHA-256) encoded in base64
+	//
+	// PostHog property: tp.cluster_name (still in base64)
 	ClusterName string `protobuf:"bytes,1,opt,name=cluster_name,json=clusterName,proto3" json:"cluster_name,omitempty"`
 	// optional, will default to the ingest time if unset
+	//
+	// PostHog timestamp
 	Timestamp *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// the event being submitted
+	//
 	// Types that are assignable to Event:
 	//
 	//	*SubmitEventRequest_UserLogin
@@ -3239,13 +3799,17 @@ type SubmitEventRequest struct {
 	//	*SubmitEventRequest_AssistCompletion
 	//	*SubmitEventRequest_UiIntegrationEnrollStartEvent
 	//	*SubmitEventRequest_UiIntegrationEnrollCompleteEvent
+	//	*SubmitEventRequest_EditorChangeEvent
+	//	*SubmitEventRequest_BotCreate
+	//	*SubmitEventRequest_UiOnboardQuestionnaireSubmit
+	//	*SubmitEventRequest_BotJoin
 	Event isSubmitEventRequest_Event `protobuf_oneof:"event"`
 }
 
 func (x *SubmitEventRequest) Reset() {
 	*x = SubmitEventRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[45]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[49]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3258,7 +3822,7 @@ func (x *SubmitEventRequest) String() string {
 func (*SubmitEventRequest) ProtoMessage() {}
 
 func (x *SubmitEventRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[45]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[49]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3271,7 +3835,7 @@ func (x *SubmitEventRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubmitEventRequest.ProtoReflect.Descriptor instead.
 func (*SubmitEventRequest) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{45}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{49}
 }
 
 func (x *SubmitEventRequest) GetClusterName() string {
@@ -3589,9 +4153,37 @@ func (x *SubmitEventRequest) GetUiIntegrationEnrollCompleteEvent() *UIIntegratio
 	return nil
 }
 
-type isSubmitEventRequest_Event interface {
-	isSubmitEventRequest_Event()
-}
+func (x *SubmitEventRequest) GetEditorChangeEvent() *EditorChangeEvent {
+	if x, ok := x.GetEvent().(*SubmitEventRequest_EditorChangeEvent); ok {
+		return x.EditorChangeEvent
+	}
+	return nil
+}
+
+func (x *SubmitEventRequest) GetBotCreate() *BotCreateEvent {
+	if x, ok := x.GetEvent().(*SubmitEventRequest_BotCreate); ok {
+		return x.BotCreate
+	}
+	return nil
+}
+
+func (x *SubmitEventRequest) GetUiOnboardQuestionnaireSubmit() *UIOnboardQuestionnaireSubmitEvent {
+	if x, ok := x.GetEvent().(*SubmitEventRequest_UiOnboardQuestionnaireSubmit); ok {
+		return x.UiOnboardQuestionnaireSubmit
+	}
+	return nil
+}
+
+func (x *SubmitEventRequest) GetBotJoin() *BotJoinEvent {
+	if x, ok := x.GetEvent().(*SubmitEventRequest_BotJoin); ok {
+		return x.BotJoin
+	}
+	return nil
+}
+
+type isSubmitEventRequest_Event interface {
+	isSubmitEventRequest_Event()
+}
 
 type SubmitEventRequest_UserLogin struct {
 	UserLogin *UserLoginEvent `protobuf:"bytes,3,opt,name=user_login,json=userLogin,proto3,oneof"`
@@ -3766,6 +4358,22 @@ type SubmitEventRequest_UiIntegrationEnrollCompleteEvent struct {
 	UiIntegrationEnrollCompleteEvent *UIIntegrationEnrollCompleteEvent `protobuf:"bytes,45,opt,name=ui_integration_enroll_complete_event,json=uiIntegrationEnrollCompleteEvent,proto3,oneof"`
 }
 
+type SubmitEventRequest_EditorChangeEvent struct {
+	EditorChangeEvent *EditorChangeEvent `protobuf:"bytes,46,opt,name=editor_change_event,json=editorChangeEvent,proto3,oneof"`
+}
+
+type SubmitEventRequest_BotCreate struct {
+	BotCreate *BotCreateEvent `protobuf:"bytes,47,opt,name=bot_create,json=botCreate,proto3,oneof"`
+}
+
+type SubmitEventRequest_UiOnboardQuestionnaireSubmit struct {
+	UiOnboardQuestionnaireSubmit *UIOnboardQuestionnaireSubmitEvent `protobuf:"bytes,48,opt,name=ui_onboard_questionnaire_submit,json=uiOnboardQuestionnaireSubmit,proto3,oneof"`
+}
+
+type SubmitEventRequest_BotJoin struct {
+	BotJoin *BotJoinEvent `protobuf:"bytes,49,opt,name=bot_join,json=botJoin,proto3,oneof"`
+}
+
 func (*SubmitEventRequest_UserLogin) isSubmitEventRequest_Event() {}
 
 func (*SubmitEventRequest_SsoCreate) isSubmitEventRequest_Event() {}
@@ -3852,6 +4460,14 @@ func (*SubmitEventRequest_UiIntegrationEnrollStartEvent) isSubmitEventRequest_Ev
 
 func (*SubmitEventRequest_UiIntegrationEnrollCompleteEvent) isSubmitEventRequest_Event() {}
 
+func (*SubmitEventRequest_EditorChangeEvent) isSubmitEventRequest_Event() {}
+
+func (*SubmitEventRequest_BotCreate) isSubmitEventRequest_Event() {}
+
+func (*SubmitEventRequest_UiOnboardQuestionnaireSubmit) isSubmitEventRequest_Event() {}
+
+func (*SubmitEventRequest_BotJoin) isSubmitEventRequest_Event() {}
+
 type SubmitEventResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -3861,7 +4477,7 @@ type SubmitEventResponse struct {
 func (x *SubmitEventResponse) Reset() {
 	*x = SubmitEventResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[46]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[50]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3874,7 +4490,7 @@ func (x *SubmitEventResponse) String() string {
 func (*SubmitEventResponse) ProtoMessage() {}
 
 func (x *SubmitEventResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[46]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[50]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3887,7 +4503,7 @@ func (x *SubmitEventResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubmitEventResponse.ProtoReflect.Descriptor instead.
 func (*SubmitEventResponse) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{46}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{50}
 }
 
 type SubmitEventsRequest struct {
@@ -3895,13 +4511,14 @@ type SubmitEventsRequest struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
+	// individual events to be submitted in a batch, up to 500 at once
 	Events []*SubmitEventRequest `protobuf:"bytes,1,rep,name=events,proto3" json:"events,omitempty"`
 }
 
 func (x *SubmitEventsRequest) Reset() {
 	*x = SubmitEventsRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[47]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[51]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3914,7 +4531,7 @@ func (x *SubmitEventsRequest) String() string {
 func (*SubmitEventsRequest) ProtoMessage() {}
 
 func (x *SubmitEventsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[47]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[51]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3927,7 +4544,7 @@ func (x *SubmitEventsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubmitEventsRequest.ProtoReflect.Descriptor instead.
 func (*SubmitEventsRequest) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{47}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *SubmitEventsRequest) GetEvents() []*SubmitEventRequest {
@@ -3946,7 +4563,7 @@ type SubmitEventsResponse struct {
 func (x *SubmitEventsResponse) Reset() {
 	*x = SubmitEventsResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[48]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[52]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3959,7 +4576,7 @@ func (x *SubmitEventsResponse) String() string {
 func (*SubmitEventsResponse) ProtoMessage() {}
 
 func (x *SubmitEventsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[48]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[52]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3972,7 +4589,7 @@ func (x *SubmitEventsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubmitEventsResponse.ProtoReflect.Descriptor instead.
 func (*SubmitEventsResponse) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{48}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{52}
 }
 
 type HelloTeleportRequest struct {
@@ -3984,7 +4601,7 @@ type HelloTeleportRequest struct {
 func (x *HelloTeleportRequest) Reset() {
 	*x = HelloTeleportRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[49]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[53]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3997,7 +4614,7 @@ func (x *HelloTeleportRequest) String() string {
 func (*HelloTeleportRequest) ProtoMessage() {}
 
 func (x *HelloTeleportRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[49]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[53]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4010,7 +4627,7 @@ func (x *HelloTeleportRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use HelloTeleportRequest.ProtoReflect.Descriptor instead.
 func (*HelloTeleportRequest) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{49}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{53}
 }
 
 type HelloTeleportResponse struct {
@@ -4022,7 +4639,7 @@ type HelloTeleportResponse struct {
 func (x *HelloTeleportResponse) Reset() {
 	*x = HelloTeleportResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[50]
+		mi := &file_prehog_v1alpha_teleport_proto_msgTypes[54]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4035,7 +4652,7 @@ func (x *HelloTeleportResponse) String() string {
 func (*HelloTeleportResponse) ProtoMessage() {}
 
 func (x *HelloTeleportResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[50]
+	mi := &file_prehog_v1alpha_teleport_proto_msgTypes[54]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4048,7 +4665,7 @@ func (x *HelloTeleportResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use HelloTeleportResponse.ProtoReflect.Descriptor instead.
 func (*HelloTeleportResponse) Descriptor() ([]byte, []int) {
-	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{50}
+	return file_prehog_v1alpha_teleport_proto_rawDescGZIP(), []int{54}
 }
 
 var File_prehog_v1alpha_teleport_proto protoreflect.FileDescriptor
@@ -4138,76 +4755,51 @@ var file_prehog_v1alpha_teleport_proto_rawDesc = []byte{
 	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6d, 0x66, 0x61, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1d,
 	0x0a, 0x0a, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x66, 0x6c, 0x6f, 0x77, 0x18, 0x03, 0x20, 0x01,
 	0x28, 0x09, 0x52, 0x09, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x22, 0x40, 0x0a,
-	0x21, 0x55, 0x49, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x73,
-	0x43, 0x6f, 0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65,
+	0x21, 0x55, 0x49, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x51, 0x75, 0x65, 0x73, 0x74, 0x69,
+	0x6f, 0x6e, 0x6e, 0x61, 0x69, 0x72, 0x65, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65,
 	0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
 	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22,
-	0x3c, 0x0a, 0x1d, 0x55, 0x49, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64,
-	0x65, 0x73, 0x43, 0x6f, 0x70, 0x79, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74,
-	0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x3d, 0x0a,
-	0x1e, 0x55, 0x49, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x73,
-	0x50, 0x72, 0x69, 0x6e, 0x74, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12,
-	0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x51, 0x0a, 0x10,
-	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a,
-	0x03, 0x73, 0x73, 0x6f, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x73, 0x73, 0x6f, 0x22,
-	0x58, 0x0a, 0x18, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x3c, 0x0a, 0x08, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e,
-	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44,
-	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
-	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x62, 0x0a, 0x12, 0x44, 0x69, 0x73,
-	0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
-	0x36, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x1e, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
-	0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52,
-	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22, 0x92, 0x01,
-	0x0a, 0x16, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x61, 0x72,
-	0x74, 0x65, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65,
-	0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63,
-	0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
-	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
-	0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x22, 0xe2, 0x01, 0x0a, 0x20, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
-	0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68,
-	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67,
-	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
-	0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72,
-	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73,
-	0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52,
-	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xea, 0x01, 0x0a, 0x28, 0x55, 0x49, 0x44, 0x69,
-	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x41, 0x57, 0x53, 0x4f, 0x49, 0x44, 0x43, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
-	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
-	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31,
-	0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
+	0x40, 0x0a, 0x21, 0x55, 0x49, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64,
+	0x65, 0x73, 0x43, 0x6f, 0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d,
+	0x65, 0x22, 0x3c, 0x0a, 0x1d, 0x55, 0x49, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43,
+	0x6f, 0x64, 0x65, 0x73, 0x43, 0x6f, 0x70, 0x79, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65,
+	0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22,
+	0x3d, 0x0a, 0x1e, 0x55, 0x49, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64,
+	0x65, 0x73, 0x50, 0x72, 0x69, 0x6e, 0x74, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e,
+	0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x51,
+	0x0a, 0x10, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12,
+	0x10, 0x0a, 0x03, 0x73, 0x73, 0x6f, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x73, 0x73,
+	0x6f, 0x22, 0x58, 0x0a, 0x18, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x3c, 0x0a,
+	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x62, 0x0a, 0x12, 0x44,
+	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x12, 0x36, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x1e, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72,
+	0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22,
+	0x92, 0x01, 0x0a, 0x16, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74,
+	0x61, 0x72, 0x74, 0x65, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70,
+	0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69,
+	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
 	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76,
 	0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x22, 0x9c, 0x02, 0x0a, 0x20, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x52, 0x44, 0x53, 0x45, 0x6e,
-	0x72, 0x6f, 0x6c, 0x6c, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x22, 0xe2, 0x01, 0x0a, 0x20, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f,
+	0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x6c, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74,
 	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72,
 	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73,
 	0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d,
@@ -4219,104 +4811,80 @@ var file_prehog_v1alpha_teleport_proto_rawDesc = []byte{
 	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e,
 	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44,
 	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x38, 0x0a, 0x18, 0x73, 0x65, 0x6c,
-	0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x5f,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x16, 0x73, 0x65, 0x6c,
-	0x65, 0x63, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x43, 0x6f,
-	0x75, 0x6e, 0x74, 0x22, 0xde, 0x01, 0x0a, 0x1c, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76,
-	0x65, 0x72, 0x44, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
-	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
-	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31,
-	0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
+	0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xea, 0x01, 0x0a, 0x28, 0x55, 0x49,
+	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x41, 0x57, 0x53, 0x4f, 0x49, 0x44, 0x43, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
 	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76,
-	0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x22, 0xe1, 0x01, 0x0a, 0x1f, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x52, 0x65, 0x67, 0x69, 0x73,
-	0x74, 0x65, 0x72, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65,
+	0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65,
 	0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63,
-	0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
-	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76,
-	0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06,
-	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70,
-	0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69,
-	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xe6, 0x01, 0x0a, 0x24, 0x55, 0x49, 0x44,
-	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x4d, 0x54, 0x4c, 0x53, 0x45, 0x76, 0x65, 0x6e,
-	0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61,
-	0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12,
-	0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
-	0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76,
-	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53,
-	0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x22, 0xf3, 0x01, 0x0a, 0x31, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
-	0x44, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x44, 0x69, 0x72,
-	0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x54, 0x6f, 0x6f, 0x6c, 0x73, 0x49, 0x6e, 0x73, 0x74, 0x61,
-	0x6c, 0x6c, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68,
-	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67,
-	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
-	0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72,
+	0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x9c, 0x02, 0x0a, 0x20, 0x55, 0x49, 0x44, 0x69, 0x73,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x52, 0x44, 0x53,
+	0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e,
+	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44,
+	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72,
 	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73,
-	0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52,
-	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xf0, 0x01, 0x0a, 0x2e, 0x55, 0x49, 0x44, 0x69,
-	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x41, 0x63, 0x74,
-	0x69, 0x76, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x75, 0x72, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70,
-	0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69,
-	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08,
-	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12,
+	0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x38, 0x0a, 0x18, 0x73,
+	0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x73, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x16, 0x73,
+	0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x43, 0x6f, 0x75, 0x6e, 0x74, 0x22, 0xe0, 0x04, 0x0a, 0x1c, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63,
+	0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
+	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76,
+	0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65,
 	0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63,
-	0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a,
-	0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22,
-	0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e,
-	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x91, 0x02, 0x0a, 0x26, 0x55,
-	0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x41, 0x75, 0x74, 0x6f, 0x44, 0x69, 0x73,
-	0x63, 0x6f, 0x76, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67,
-	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
-	0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76,
-	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52,
-	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61,
-	0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68,
-	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x22, 0xeb,
-	0x01, 0x0a, 0x29, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74,
-	0x61, 0x62, 0x61, 0x73, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x49, 0x41,
-	0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08,
+	0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x5e, 0x0a, 0x0d, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79,
+	0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x39, 0x2e,
+	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55,
+	0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x65, 0x70, 0x6c,
+	0x6f, 0x79, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52, 0x0c, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79,
+	0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x58, 0x0a, 0x0b, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79,
+	0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x37, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44,
+	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x65, 0x70, 0x6c, 0x6f, 0x79,
+	0x54, 0x79, 0x70, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x54, 0x79, 0x70, 0x65,
+	0x22, 0x5f, 0x0a, 0x0c, 0x44, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64,
+	0x12, 0x1d, 0x0a, 0x19, 0x44, 0x45, 0x50, 0x4c, 0x4f, 0x59, 0x5f, 0x4d, 0x45, 0x54, 0x48, 0x4f,
+	0x44, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
+	0x16, 0x0a, 0x12, 0x44, 0x45, 0x50, 0x4c, 0x4f, 0x59, 0x5f, 0x4d, 0x45, 0x54, 0x48, 0x4f, 0x44,
+	0x5f, 0x41, 0x55, 0x54, 0x4f, 0x10, 0x01, 0x12, 0x18, 0x0a, 0x14, 0x44, 0x45, 0x50, 0x4c, 0x4f,
+	0x59, 0x5f, 0x4d, 0x45, 0x54, 0x48, 0x4f, 0x44, 0x5f, 0x4d, 0x41, 0x4e, 0x55, 0x41, 0x4c, 0x10,
+	0x02, 0x22, 0x65, 0x0a, 0x0a, 0x44, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x54, 0x79, 0x70, 0x65, 0x12,
+	0x1b, 0x0a, 0x17, 0x44, 0x45, 0x50, 0x4c, 0x4f, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55,
+	0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1e, 0x0a, 0x1a,
+	0x44, 0x45, 0x50, 0x4c, 0x4f, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x4e, 0x53, 0x54,
+	0x41, 0x4c, 0x4c, 0x5f, 0x53, 0x43, 0x52, 0x49, 0x50, 0x54, 0x10, 0x01, 0x12, 0x1a, 0x0a, 0x16,
+	0x44, 0x45, 0x50, 0x4c, 0x4f, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x41, 0x4d, 0x41, 0x5a,
+	0x4f, 0x4e, 0x5f, 0x45, 0x43, 0x53, 0x10, 0x02, 0x22, 0xe1, 0x01, 0x0a, 0x1f, 0x55, 0x49, 0x44,
+	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x52,
+	0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08,
 	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20,
 	0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e,
 	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
@@ -4328,23 +4896,9 @@ var file_prehog_v1alpha_teleport_proto_rawDesc = []byte{
 	0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
 	0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xe4, 0x01, 0x0a,
-	0x22, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x50, 0x72, 0x69, 0x6e, 0x63,
-	0x69, 0x70, 0x61, 0x6c, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x45, 0x76,
-	0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76,
-	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61,
-	0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67,
-	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
-	0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61,
-	0x74, 0x75, 0x73, 0x22, 0xdf, 0x01, 0x0a, 0x1d, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76,
-	0x65, 0x72, 0x54, 0x65, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xe6, 0x01, 0x0a,
+	0x24, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62,
+	0x61, 0x73, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x4d, 0x54, 0x4c, 0x53,
 	0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
 	0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67,
 	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
@@ -4357,589 +4911,732 @@ var file_prehog_v1alpha_teleport_proto_rawDesc = []byte{
 	0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68,
 	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f,
 	0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xda, 0x01, 0x0a, 0x18, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63,
-	0x6f, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x45, 0x76, 0x65,
-	0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31,
-	0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
-	0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xf3, 0x01, 0x0a, 0x31, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63,
+	0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x41, 0x63, 0x74, 0x69, 0x76,
+	0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x54, 0x6f, 0x6f, 0x6c, 0x73, 0x49,
+	0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e,
+	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44,
+	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12,
+	0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xf0, 0x01, 0x0a, 0x2e,
+	0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x73, 0x6b, 0x74, 0x6f,
+	0x70, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c,
+	0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28,
+	0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e,
+	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x91,
+	0x02, 0x0a, 0x26, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x41, 0x75, 0x74,
+	0x6f, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68,
+	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f,
+	0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a,
+	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e,
+	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44,
+	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x0e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x43, 0x6f, 0x75,
+	0x6e, 0x74, 0x22, 0xeb, 0x01, 0x0a, 0x29, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
+	0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75,
+	0x72, 0x65, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44,
+	0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74,
+	0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x22, 0xe4, 0x01, 0x0a, 0x22, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x50,
+	0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61, 0x6c, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75,
+	0x72, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68,
+	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f,
+	0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
+	0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52,
+	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xdf, 0x01, 0x0a, 0x1d, 0x55, 0x49, 0x44, 0x69,
+	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x54, 0x65, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68,
+	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f,
+	0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a,
+	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e,
+	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44,
+	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xda, 0x01, 0x0a, 0x18, 0x55, 0x49,
+	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65,
+	0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
+	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76,
+	0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
 	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
-	0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x22, 0x4b, 0x0a, 0x0f, 0x52, 0x6f, 0x6c, 0x65, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61,
-	0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x72, 0x6f, 0x6c, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x72, 0x6f, 0x6c, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x22,
-	0x38, 0x0a, 0x19, 0x55, 0x49, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f,
-	0x6c, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09,
-	0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x3c, 0x0a, 0x1d, 0x55, 0x49, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x53, 0x61, 0x76, 0x65,
-	0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73,
-	0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75,
-	0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x3e, 0x0a, 0x1f, 0x55, 0x49, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c,
-	0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73,
-	0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75,
-	0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x49, 0x0a, 0x2a, 0x55, 0x49, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x56, 0x69, 0x65, 0x77, 0x44, 0x6f,
-	0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x69, 0x63, 0x6b,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61,
-	0x6d, 0x65, 0x22, 0x5e, 0x0a, 0x18, 0x55, 0x49, 0x43, 0x61, 0x6c, 0x6c, 0x54, 0x6f, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b,
-	0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x25, 0x0a, 0x03, 0x63,
-	0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x13, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
-	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x43, 0x54, 0x41, 0x52, 0x03, 0x63,
-	0x74, 0x61, 0x22, 0x2f, 0x0a, 0x10, 0x4b, 0x75, 0x62, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65,
+	0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x44, 0x69, 0x73, 0x63,
+	0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x65, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x4b, 0x0a, 0x0f, 0x52, 0x6f, 0x6c, 0x65, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65,
+	0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73,
+	0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x72, 0x6f, 0x6c, 0x65, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x72, 0x6f, 0x6c, 0x65, 0x4e,
+	0x61, 0x6d, 0x65, 0x22, 0xc9, 0x01, 0x0a, 0x0e, 0x42, 0x6f, 0x74, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e,
 	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e,
-	0x61, 0x6d, 0x65, 0x22, 0x40, 0x0a, 0x09, 0x53, 0x46, 0x54, 0x50, 0x45, 0x76, 0x65, 0x6e, 0x74,
-	0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a,
-	0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x9e, 0x03, 0x0a, 0x12, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x18, 0x0a, 0x07,
-	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x17, 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x68, 0x6f, 0x73, 0x74, 0x49, 0x64, 0x12,
-	0x1a, 0x0a, 0x08, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x08, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x0e, 0x0a, 0x02, 0x6f,
-	0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x6f, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x6f,
-	0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x09, 0x6f, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2b, 0x0a, 0x11, 0x68, 0x6f,
-	0x73, 0x74, 0x5f, 0x61, 0x72, 0x63, 0x68, 0x69, 0x74, 0x65, 0x63, 0x74, 0x75, 0x72, 0x65, 0x18,
-	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x68, 0x6f, 0x73, 0x74, 0x41, 0x72, 0x63, 0x68, 0x69,
-	0x74, 0x65, 0x63, 0x74, 0x75, 0x72, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x67, 0x6c, 0x69, 0x62, 0x63,
-	0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
-	0x67, 0x6c, 0x69, 0x62, 0x63, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x27, 0x0a, 0x0f,
-	0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x18,
-	0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x4d, 0x65,
-	0x74, 0x68, 0x6f, 0x64, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
-	0x65, 0x72, 0x5f, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x10, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x75, 0x6e, 0x74, 0x69,
-	0x6d, 0x65, 0x12, 0x35, 0x0a, 0x16, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x5f,
-	0x6f, 0x72, 0x63, 0x68, 0x65, 0x73, 0x74, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x0a, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x15, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x4f, 0x72, 0x63,
-	0x68, 0x65, 0x73, 0x74, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x2b, 0x0a, 0x11, 0x63, 0x6c, 0x6f,
-	0x75, 0x64, 0x5f, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x0b,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x45, 0x6e, 0x76, 0x69, 0x72,
-	0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x22, 0xd2, 0x01, 0x0a, 0x15, 0x41, 0x73, 0x73, 0x69, 0x73,
-	0x74, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x61, 0x6d, 0x65, 0x12, 0x22, 0x0a, 0x0d, 0x62, 0x6f, 0x74, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x62, 0x6f, 0x74, 0x55,
+	0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x72, 0x6f, 0x6c, 0x65, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x72, 0x6f, 0x6c, 0x65,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x72, 0x6f, 0x6c, 0x65, 0x5f, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x72, 0x6f, 0x6c, 0x65, 0x43, 0x6f,
+	0x75, 0x6e, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x6a, 0x6f, 0x69, 0x6e, 0x5f, 0x6d, 0x65, 0x74, 0x68,
+	0x6f, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6a, 0x6f, 0x69, 0x6e, 0x4d, 0x65,
+	0x74, 0x68, 0x6f, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x62, 0x6f, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x62, 0x6f, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x22,
+	0x72, 0x0a, 0x0c, 0x42, 0x6f, 0x74, 0x4a, 0x6f, 0x69, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12,
+	0x19, 0x0a, 0x08, 0x62, 0x6f, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x62, 0x6f, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6a, 0x6f,
+	0x69, 0x6e, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0a, 0x6a, 0x6f, 0x69, 0x6e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x26, 0x0a, 0x0f, 0x6a,
+	0x6f, 0x69, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x6a, 0x6f, 0x69, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x4e,
+	0x61, 0x6d, 0x65, 0x22, 0x38, 0x0a, 0x19, 0x55, 0x49, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e,
+	0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74,
 	0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x27, 0x0a,
-	0x0f, 0x63, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x74, 0x6f,
-	0x74, 0x61, 0x6c, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x70, 0x72, 0x6f,
-	0x6d, 0x70, 0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03,
-	0x52, 0x0c, 0x70, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x2b,
-	0x0a, 0x11, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x63, 0x6f, 0x6d, 0x70, 0x6c,
-	0x65, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x22, 0x83, 0x01, 0x0a, 0x19,
-	0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c,
-	0x6c, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x39, 0x0a, 0x04, 0x6b, 0x69, 0x6e,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67,
-	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x4b, 0x69, 0x6e, 0x64, 0x52, 0x04,
-	0x6b, 0x69, 0x6e, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d,
-	0x65, 0x22, 0x66, 0x0a, 0x1d, 0x55, 0x49, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72, 0x74, 0x45, 0x76, 0x65,
-	0x6e, 0x74, 0x12, 0x45, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31,
-	0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52,
-	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x69, 0x0a, 0x20, 0x55, 0x49, 0x49,
-	0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c,
-	0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x45, 0x0a,
-	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x29, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
-	0x2e, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x72, 0x6f,
-	0x6c, 0x6c, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x22, 0xab, 0x27, 0x0a, 0x12, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x63,
-	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0b, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x38,
-	0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74,
-	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x3f, 0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72,
-	0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x70,
-	0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x73,
-	0x65, 0x72, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x09,
-	0x75, 0x73, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x3f, 0x0a, 0x0a, 0x73, 0x73, 0x6f,
-	0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e,
-	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53,
-	0x53, 0x4f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52,
-	0x09, 0x73, 0x73, 0x6f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x4e, 0x0a, 0x0f, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61,
-	0x6c, 0x70, 0x68, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x0e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x48, 0x0a, 0x0d, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x21, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
-	0x68, 0x61, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53,
-	0x74, 0x61, 0x72, 0x74, 0x12, 0x4c, 0x0a, 0x0f, 0x75, 0x69, 0x5f, 0x62, 0x61, 0x6e, 0x6e, 0x65,
-	0x72, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e,
-	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55,
-	0x49, 0x42, 0x61, 0x6e, 0x6e, 0x65, 0x72, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e,
-	0x74, 0x48, 0x00, 0x52, 0x0d, 0x75, 0x69, 0x42, 0x61, 0x6e, 0x6e, 0x65, 0x72, 0x43, 0x6c, 0x69,
-	0x63, 0x6b, 0x12, 0x92, 0x01, 0x0a, 0x29, 0x75, 0x69, 0x5f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72,
-	0x64, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x5f, 0x67, 0x6f, 0x5f, 0x74, 0x6f,
-	0x5f, 0x64, 0x61, 0x73, 0x68, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b,
-	0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
-	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72,
-	0x64, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x47, 0x6f, 0x54, 0x6f, 0x44, 0x61, 0x73,
-	0x68, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74,
-	0x48, 0x00, 0x52, 0x23, 0x75, 0x69, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x43, 0x6f, 0x6d,
-	0x70, 0x6c, 0x65, 0x74, 0x65, 0x47, 0x6f, 0x54, 0x6f, 0x44, 0x61, 0x73, 0x68, 0x62, 0x6f, 0x61,
-	0x72, 0x64, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x82, 0x01, 0x0a, 0x23, 0x75, 0x69, 0x5f, 0x6f,
-	0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x5f, 0x66, 0x69, 0x72, 0x73, 0x74,
-	0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18,
-	0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76,
-	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64,
-	0x41, 0x64, 0x64, 0x46, 0x69, 0x72, 0x73, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1e, 0x75, 0x69,
-	0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x41, 0x64, 0x64, 0x46, 0x69, 0x72, 0x73, 0x74, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x92, 0x01, 0x0a,
-	0x29, 0x75, 0x69, 0x5f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x5f,
-	0x66, 0x69, 0x72, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x6c,
-	0x61, 0x74, 0x65, 0x72, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x38, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
-	0x61, 0x2e, 0x55, 0x49, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x41, 0x64, 0x64, 0x46, 0x69,
-	0x72, 0x73, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4c, 0x61, 0x74, 0x65, 0x72,
-	0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x23, 0x75, 0x69,
-	0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x41, 0x64, 0x64, 0x46, 0x69, 0x72, 0x73, 0x74, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4c, 0x61, 0x74, 0x65, 0x72, 0x43, 0x6c, 0x69, 0x63,
-	0x6b, 0x12, 0x7b, 0x0a, 0x20, 0x75, 0x69, 0x5f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f,
-	0x73, 0x65, 0x74, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73,
-	0x75, 0x62, 0x6d, 0x69, 0x74, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x70, 0x72,
-	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x4f,
-	0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x53, 0x65, 0x74, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x61, 0x6c, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00,
-	0x52, 0x1c, 0x75, 0x69, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x53, 0x65, 0x74, 0x43, 0x72,
-	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x12, 0x87,
-	0x01, 0x0a, 0x24, 0x75, 0x69, 0x5f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f, 0x72, 0x65,
-	0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65,
-	0x5f, 0x73, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x35, 0x2e,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x3c, 0x0a,
+	0x1d, 0x55, 0x49, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65,
+	0x53, 0x61, 0x76, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b,
+	0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x3e, 0x0a, 0x1f, 0x55,
+	0x49, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x43, 0x61,
+	0x6e, 0x63, 0x65, 0x6c, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b,
+	0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x49, 0x0a, 0x2a, 0x55,
+	0x49, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x56, 0x69,
+	0x65, 0x77, 0x44, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43,
+	0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65,
+	0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73,
+	0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x5e, 0x0a, 0x18, 0x55, 0x49, 0x43, 0x61, 0x6c, 0x6c,
+	0x54, 0x6f, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65,
+	0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12,
+	0x25, 0x0a, 0x03, 0x63, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x13, 0x2e, 0x70,
+	0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x43, 0x54,
+	0x41, 0x52, 0x03, 0x63, 0x74, 0x61, 0x22, 0x2f, 0x0a, 0x10, 0x4b, 0x75, 0x62, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73,
+	0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75,
+	0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x40, 0x0a, 0x09, 0x53, 0x46, 0x54, 0x50, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d,
+	0x65, 0x12, 0x16, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x9e, 0x03, 0x0a, 0x12, 0x41, 0x67,
+	0x65, 0x6e, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x17, 0x0a, 0x07, 0x68, 0x6f,
+	0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x68, 0x6f, 0x73,
+	0x74, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18,
+	0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12,
+	0x0e, 0x0a, 0x02, 0x6f, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x6f, 0x73, 0x12,
+	0x1d, 0x0a, 0x0a, 0x6f, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x6f, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2b,
+	0x0a, 0x11, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x61, 0x72, 0x63, 0x68, 0x69, 0x74, 0x65, 0x63, 0x74,
+	0x75, 0x72, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x68, 0x6f, 0x73, 0x74, 0x41,
+	0x72, 0x63, 0x68, 0x69, 0x74, 0x65, 0x63, 0x74, 0x75, 0x72, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x67,
+	0x6c, 0x69, 0x62, 0x63, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0c, 0x67, 0x6c, 0x69, 0x62, 0x63, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x12, 0x27, 0x0a, 0x0f, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x5f, 0x6d, 0x65, 0x74, 0x68,
+	0x6f, 0x64, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x69, 0x6e, 0x73, 0x74, 0x61,
+	0x6c, 0x6c, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x5f, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x09,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52,
+	0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x35, 0x0a, 0x16, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69,
+	0x6e, 0x65, 0x72, 0x5f, 0x6f, 0x72, 0x63, 0x68, 0x65, 0x73, 0x74, 0x72, 0x61, 0x74, 0x6f, 0x72,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x4f, 0x72, 0x63, 0x68, 0x65, 0x73, 0x74, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x2b, 0x0a,
+	0x11, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x5f, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65,
+	0x6e, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x45,
+	0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x22, 0xd2, 0x01, 0x0a, 0x15, 0x41,
+	0x73, 0x73, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d,
+	0x65, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x6f, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x6f, 0x6e, 0x76,
+	0x65, 0x72, 0x73, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x6f,
+	0x74, 0x61, 0x6c, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x0b, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x23, 0x0a,
+	0x0d, 0x70, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x03, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x63,
+	0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x22,
+	0x83, 0x01, 0x0a, 0x19, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45,
+	0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x39, 0x0a,
+	0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x49, 0x6e, 0x74,
+	0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x4b, 0x69,
+	0x6e, 0x64, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65,
+	0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x66, 0x0a, 0x1d, 0x55, 0x49, 0x49, 0x6e, 0x74, 0x65, 0x67,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72,
+	0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x45, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
+	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x69, 0x0a,
+	0x20, 0x55, 0x49, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e,
+	0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x45, 0x76, 0x65, 0x6e,
+	0x74, 0x12, 0x45, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x6c, 0x0a, 0x11, 0x45, 0x64, 0x69, 0x74,
+	0x6f, 0x72, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a,
+	0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65,
+	0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x45, 0x64, 0x69, 0x74,
+	0x6f, 0x72, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xf8, 0x29, 0x0a, 0x12, 0x53, 0x75, 0x62, 0x6d, 0x69,
+	0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a,
+	0x0c, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65,
+	0x12, 0x38, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
+	0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x3f, 0x0a, 0x0a, 0x75, 0x73,
+	0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e,
+	0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e,
+	0x55, 0x73, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00,
+	0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x3f, 0x0a, 0x0a, 0x73,
+	0x73, 0x6f, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1e, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x2e, 0x53, 0x53, 0x4f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48,
+	0x00, 0x52, 0x09, 0x73, 0x73, 0x6f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x4e, 0x0a, 0x0f,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x0e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x48, 0x0a, 0x0d,
+	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x06, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x72,
+	0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x4c, 0x0a, 0x0f, 0x75, 0x69, 0x5f, 0x62, 0x61, 0x6e,
+	0x6e, 0x65, 0x72, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x2e, 0x55, 0x49, 0x42, 0x61, 0x6e, 0x6e, 0x65, 0x72, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76,
+	0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x0d, 0x75, 0x69, 0x42, 0x61, 0x6e, 0x6e, 0x65, 0x72, 0x43,
+	0x6c, 0x69, 0x63, 0x6b, 0x12, 0x92, 0x01, 0x0a, 0x29, 0x75, 0x69, 0x5f, 0x6f, 0x6e, 0x62, 0x6f,
+	0x61, 0x72, 0x64, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x5f, 0x67, 0x6f, 0x5f,
+	0x74, 0x6f, 0x5f, 0x64, 0x61, 0x73, 0x68, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f, 0x63, 0x6c, 0x69,
+	0x63, 0x6b, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
+	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x4f, 0x6e, 0x62, 0x6f,
+	0x61, 0x72, 0x64, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x47, 0x6f, 0x54, 0x6f, 0x44,
+	0x61, 0x73, 0x68, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65,
+	0x6e, 0x74, 0x48, 0x00, 0x52, 0x23, 0x75, 0x69, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x43,
+	0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x47, 0x6f, 0x54, 0x6f, 0x44, 0x61, 0x73, 0x68, 0x62,
+	0x6f, 0x61, 0x72, 0x64, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x82, 0x01, 0x0a, 0x23, 0x75, 0x69,
+	0x5f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x5f, 0x66, 0x69, 0x72,
+	0x73, 0x74, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x63, 0x6c, 0x69, 0x63,
+	0x6b, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x4f, 0x6e, 0x62, 0x6f, 0x61,
+	0x72, 0x64, 0x41, 0x64, 0x64, 0x46, 0x69, 0x72, 0x73, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1e,
+	0x75, 0x69, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x41, 0x64, 0x64, 0x46, 0x69, 0x72, 0x73,
+	0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x92,
+	0x01, 0x0a, 0x29, 0x75, 0x69, 0x5f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f, 0x61, 0x64,
+	0x64, 0x5f, 0x66, 0x69, 0x72, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x5f, 0x6c, 0x61, 0x74, 0x65, 0x72, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x0b, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x38, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x41, 0x64, 0x64,
+	0x46, 0x69, 0x72, 0x73, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4c, 0x61, 0x74,
+	0x65, 0x72, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x23,
+	0x75, 0x69, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x41, 0x64, 0x64, 0x46, 0x69, 0x72, 0x73,
+	0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4c, 0x61, 0x74, 0x65, 0x72, 0x43, 0x6c,
+	0x69, 0x63, 0x6b, 0x12, 0x7b, 0x0a, 0x20, 0x75, 0x69, 0x5f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72,
+	0x64, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
+	0x5f, 0x73, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e,
 	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55,
-	0x49, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72,
-	0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x20, 0x75, 0x69, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72,
-	0x64, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e,
-	0x67, 0x65, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x12, 0x7b, 0x0a, 0x20, 0x75, 0x69, 0x5f, 0x72,
-	0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x73, 0x5f, 0x63, 0x6f,
-	0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x0e, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x31, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
-	0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f,
-	0x64, 0x65, 0x73, 0x43, 0x6f, 0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1c, 0x75, 0x69, 0x52, 0x65, 0x63, 0x6f, 0x76,
-	0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x73, 0x43, 0x6f, 0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65,
-	0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x6f, 0x0a, 0x1c, 0x75, 0x69, 0x5f, 0x72, 0x65, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x73, 0x5f, 0x63, 0x6f, 0x70, 0x79, 0x5f,
-	0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x70, 0x72,
-	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x52,
-	0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x73, 0x43, 0x6f, 0x70, 0x79,
-	0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x18, 0x75, 0x69,
-	0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x73, 0x43, 0x6f, 0x70,
-	0x79, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x72, 0x0a, 0x1d, 0x75, 0x69, 0x5f, 0x72, 0x65, 0x63,
-	0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x73, 0x5f, 0x70, 0x72, 0x69, 0x6e,
-	0x74, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x10, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e,
+	0x49, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x53, 0x65, 0x74, 0x43, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x48, 0x00, 0x52, 0x1c, 0x75, 0x69, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x53, 0x65, 0x74,
+	0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74,
+	0x12, 0x87, 0x01, 0x0a, 0x24, 0x75, 0x69, 0x5f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f,
+	0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e,
+	0x67, 0x65, 0x5f, 0x73, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x35, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x2e, 0x55, 0x49, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74,
+	0x65, 0x72, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x53, 0x75, 0x62, 0x6d, 0x69,
+	0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x20, 0x75, 0x69, 0x4f, 0x6e, 0x62, 0x6f,
+	0x61, 0x72, 0x64, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x43, 0x68, 0x61, 0x6c, 0x6c,
+	0x65, 0x6e, 0x67, 0x65, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x12, 0x7b, 0x0a, 0x20, 0x75, 0x69,
+	0x5f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x73, 0x5f,
+	0x63, 0x6f, 0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x0e,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79,
+	0x43, 0x6f, 0x64, 0x65, 0x73, 0x43, 0x6f, 0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65, 0x43, 0x6c, 0x69,
+	0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1c, 0x75, 0x69, 0x52, 0x65, 0x63,
+	0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x73, 0x43, 0x6f, 0x6e, 0x74, 0x69, 0x6e,
+	0x75, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x6f, 0x0a, 0x1c, 0x75, 0x69, 0x5f, 0x72, 0x65,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x73, 0x5f, 0x63, 0x6f, 0x70,
+	0x79, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e,
 	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55,
-	0x49, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x73, 0x50, 0x72,
-	0x69, 0x6e, 0x74, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52,
-	0x19, 0x75, 0x69, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x73,
-	0x50, 0x72, 0x69, 0x6e, 0x74, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x63, 0x0a, 0x19, 0x75, 0x69,
-	0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65,
-	0x64, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x11, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e,
+	0x49, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x73, 0x43, 0x6f,
+	0x70, 0x79, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x18,
+	0x75, 0x69, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x73, 0x43,
+	0x6f, 0x70, 0x79, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x72, 0x0a, 0x1d, 0x75, 0x69, 0x5f, 0x72,
+	0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x73, 0x5f, 0x70, 0x72,
+	0x69, 0x6e, 0x74, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x10, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x2e, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x2e, 0x55, 0x49, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x73,
+	0x50, 0x72, 0x69, 0x6e, 0x74, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48,
+	0x00, 0x52, 0x19, 0x75, 0x69, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64,
+	0x65, 0x73, 0x50, 0x72, 0x69, 0x6e, 0x74, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x63, 0x0a, 0x19,
+	0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x73, 0x74, 0x61, 0x72,
+	0x74, 0x65, 0x64, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x11, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x26, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x61, 0x72, 0x74,
+	0x65, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x16, 0x75, 0x69, 0x44, 0x69, 0x73,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x45, 0x76, 0x65, 0x6e,
+	0x74, 0x12, 0x82, 0x01, 0x0a, 0x24, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
+	0x72, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x12, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x30, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76, 0x65,
+	0x6e, 0x74, 0x48, 0x00, 0x52, 0x20, 0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x6f, 0x0a, 0x1d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x63,
+	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x73, 0x73, 0x75, 0x65,
+	0x64, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x13, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e,
 	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55,
-	0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x16, 0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x53, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12,
-	0x82, 0x01, 0x0a, 0x24, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x12, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30,
-	0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e,
-	0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74,
-	0x48, 0x00, 0x52, 0x20, 0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x12, 0x6f, 0x0a, 0x1d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x63, 0x65, 0x72,
-	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x5f,
-	0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x13, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x70, 0x72,
-	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x73, 0x65,
+	0x73, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x49, 0x73,
+	0x73, 0x75, 0x65, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1a, 0x75, 0x73, 0x65,
 	0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x49, 0x73, 0x73, 0x75,
-	0x65, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1a, 0x75, 0x73, 0x65, 0x72, 0x43,
-	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x4d, 0x0a, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x76, 0x32, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x21, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
-	0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x45, 0x76, 0x65,
-	0x6e, 0x74, 0x48, 0x00, 0x52, 0x0e, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61,
-	0x72, 0x74, 0x56, 0x32, 0x12, 0x76, 0x0a, 0x20, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x5f, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x15, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c,
-	0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e,
-	0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x70, 0x6c, 0x6f, 0x79,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1c,
-	0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x70, 0x6c, 0x6f, 0x79,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x7f, 0x0a, 0x23,
-	0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x64, 0x61, 0x74, 0x61,
-	0x62, 0x61, 0x73, 0x65, 0x5f, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x65, 0x76,
-	0x65, 0x6e, 0x74, 0x18, 0x16, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x70, 0x72, 0x65, 0x68,
-	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73,
-	0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x52, 0x65, 0x67,
-	0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1f, 0x75, 0x69,
-	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65,
-	0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x8f, 0x01,
-	0x0a, 0x29, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x64, 0x61,
-	0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65,
-	0x5f, 0x6d, 0x74, 0x6c, 0x73, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x17, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x34, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
-	0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74,
-	0x61, 0x62, 0x61, 0x73, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x4d, 0x54,
-	0x4c, 0x53, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x24, 0x75, 0x69, 0x44, 0x69, 0x73,
-	0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x4d, 0x74, 0x6c, 0x73, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12,
-	0xb8, 0x01, 0x0a, 0x38, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f,
-	0x64, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x64,
-	0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x5f, 0x74, 0x6f, 0x6f, 0x6c, 0x73, 0x5f, 0x69,
-	0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x18, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x41, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
-	0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65,
-	0x73, 0x6b, 0x74, 0x6f, 0x70, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63,
-	0x74, 0x6f, 0x72, 0x79, 0x54, 0x6f, 0x6f, 0x6c, 0x73, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x31, 0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x44, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65,
-	0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x54, 0x6f, 0x6f, 0x6c, 0x73, 0x49, 0x6e,
-	0x73, 0x74, 0x61, 0x6c, 0x6c, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0xae, 0x01, 0x0a, 0x34, 0x75,
-	0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x64, 0x65, 0x73, 0x6b, 0x74,
-	0x6f, 0x70, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74,
-	0x6f, 0x72, 0x79, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x5f, 0x65, 0x76,
-	0x65, 0x6e, 0x74, 0x18, 0x19, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x3e, 0x2e, 0x70, 0x72, 0x65, 0x68,
-	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73,
+	0x65, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x4d, 0x0a, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x76, 0x32, 0x18, 0x14, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x21, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x0e, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53,
+	0x74, 0x61, 0x72, 0x74, 0x56, 0x32, 0x12, 0x76, 0x0a, 0x20, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x5f, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x15, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x2c, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x70, 0x6c,
+	0x6f, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00,
+	0x52, 0x1c, 0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x70, 0x6c,
+	0x6f, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x7f,
+	0x0a, 0x23, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x64, 0x61,
+	0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x5f,
+	0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x16, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44,
+	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x52,
+	0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1f,
+	0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61,
+	0x73, 0x65, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12,
+	0x8f, 0x01, 0x0a, 0x29, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f,
+	0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75,
+	0x72, 0x65, 0x5f, 0x6d, 0x74, 0x6c, 0x73, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x17, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44,
+	0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65,
+	0x4d, 0x54, 0x4c, 0x53, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x24, 0x75, 0x69, 0x44,
+	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x4d, 0x74, 0x6c, 0x73, 0x45, 0x76, 0x65, 0x6e,
+	0x74, 0x12, 0xb8, 0x01, 0x0a, 0x38, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
+	0x72, 0x5f, 0x64, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65,
+	0x5f, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x5f, 0x74, 0x6f, 0x6f, 0x6c, 0x73,
+	0x5f, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x18,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x41, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
+	0x44, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x44, 0x69, 0x72,
+	0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x54, 0x6f, 0x6f, 0x6c, 0x73, 0x49, 0x6e, 0x73, 0x74, 0x61,
+	0x6c, 0x6c, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x31, 0x75, 0x69, 0x44, 0x69, 0x73,
 	0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x41, 0x63, 0x74, 0x69,
-	0x76, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x75, 0x72, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x2e, 0x75, 0x69, 0x44,
+	0x76, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x54, 0x6f, 0x6f, 0x6c, 0x73,
+	0x49, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0xae, 0x01, 0x0a,
+	0x34, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x64, 0x65, 0x73,
+	0x6b, 0x74, 0x6f, 0x70, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x64, 0x69, 0x72, 0x65,
+	0x63, 0x74, 0x6f, 0x72, 0x79, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x5f,
+	0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x19, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x3e, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44,
 	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x41, 0x63,
 	0x74, 0x69, 0x76, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x95, 0x01, 0x0a, 0x2b,
-	0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x61, 0x75, 0x74, 0x6f,
-	0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x1a, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x36, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
-	0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x41, 0x75, 0x74,
-	0x6f, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x73, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x26, 0x75, 0x69, 0x44,
-	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x41, 0x75, 0x74, 0x6f, 0x44, 0x69, 0x73, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x45, 0x76,
-	0x65, 0x6e, 0x74, 0x12, 0x9f, 0x01, 0x0a, 0x2f, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x5f, 0x69, 0x61, 0x6d, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x1b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x39, 0x2e,
+	0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x2e, 0x75,
+	0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70,
+	0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x95, 0x01,
+	0x0a, 0x2b, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x61, 0x75,
+	0x74, 0x6f, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x1a, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x41,
+	0x75, 0x74, 0x6f, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x26, 0x75,
+	0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x41, 0x75, 0x74, 0x6f, 0x44, 0x69, 0x73,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x9f, 0x01, 0x0a, 0x2f, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x5f, 0x69, 0x61, 0x6d, 0x5f, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x1b, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x39, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62,
+	0x61, 0x73, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x49, 0x41, 0x4d, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x29, 0x75, 0x69,
+	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x88, 0x01, 0x0a, 0x26, 0x75, 0x69, 0x5f, 0x64,
+	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x70, 0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61,
+	0x6c, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x5f, 0x65, 0x76, 0x65,
+	0x6e, 0x74, 0x18, 0x1c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
+	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63,
+	0x6f, 0x76, 0x65, 0x72, 0x50, 0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61, 0x6c, 0x73, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x22,
+	0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x50, 0x72, 0x69, 0x6e, 0x63, 0x69,
+	0x70, 0x61, 0x6c, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x45, 0x76, 0x65,
+	0x6e, 0x74, 0x12, 0x79, 0x0a, 0x21, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
+	0x72, 0x5f, 0x74, 0x65, 0x73, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x1d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e,
 	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55,
-	0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73,
-	0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x29, 0x75, 0x69, 0x44, 0x69,
-	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x88, 0x01, 0x0a, 0x26, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73,
-	0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x70, 0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61, 0x6c, 0x73,
-	0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74,
-	0x18, 0x1c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
-	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76,
-	0x65, 0x72, 0x50, 0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61, 0x6c, 0x73, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x75, 0x72, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x22, 0x75, 0x69,
-	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x50, 0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61,
-	0x6c, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74,
-	0x12, 0x79, 0x0a, 0x21, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f,
-	0x74, 0x65, 0x73, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
-	0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x1d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x70, 0x72,
-	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44,
-	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x54, 0x65, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1d, 0x75, 0x69,
-	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x54, 0x65, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x6e,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x69, 0x0a, 0x1b, 0x75,
-	0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x6c,
-	0x65, 0x74, 0x65, 0x64, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
-	0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70,
-	0x6c, 0x65, 0x74, 0x65, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x18, 0x75, 0x69,
-	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65,
-	0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x42, 0x0a, 0x0b, 0x72, 0x6f, 0x6c, 0x65, 0x5f, 0x63,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x18, 0x1f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x72,
-	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x52, 0x6f, 0x6c,
-	0x65, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x0a,
-	0x72, 0x6f, 0x6c, 0x65, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x63, 0x0a, 0x18, 0x75, 0x69,
-	0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x6e, 0x65, 0x77, 0x5f, 0x72, 0x6f, 0x6c, 0x65,
-	0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x20, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x70,
+	0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x54, 0x65, 0x73, 0x74, 0x43, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1d,
+	0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x54, 0x65, 0x73, 0x74, 0x43, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x69, 0x0a,
+	0x1b, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6d,
+	0x70, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x1e, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x43, 0x6f,
+	0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x18,
+	0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65,
+	0x74, 0x65, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x42, 0x0a, 0x0b, 0x72, 0x6f, 0x6c, 0x65,
+	0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x18, 0x1f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
+	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x52,
+	0x6f, 0x6c, 0x65, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00,
+	0x52, 0x0a, 0x72, 0x6f, 0x6c, 0x65, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x63, 0x0a, 0x18,
+	0x75, 0x69, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x6e, 0x65, 0x77, 0x5f, 0x72, 0x6f,
+	0x6c, 0x65, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x20, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29,
+	0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e,
+	0x55, 0x49, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x43,
+	0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x14, 0x75, 0x69, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x43, 0x6c, 0x69, 0x63,
+	0x6b, 0x12, 0x70, 0x0a, 0x1d, 0x75, 0x69, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x6e,
+	0x65, 0x77, 0x5f, 0x72, 0x6f, 0x6c, 0x65, 0x5f, 0x73, 0x61, 0x76, 0x65, 0x5f, 0x63, 0x6c, 0x69,
+	0x63, 0x6b, 0x18, 0x21, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
+	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x53, 0x61, 0x76, 0x65, 0x43, 0x6c, 0x69,
+	0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x18, 0x75, 0x69, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x53, 0x61, 0x76, 0x65, 0x43, 0x6c,
+	0x69, 0x63, 0x6b, 0x12, 0x76, 0x0a, 0x1f, 0x75, 0x69, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x5f, 0x6e, 0x65, 0x77, 0x5f, 0x72, 0x6f, 0x6c, 0x65, 0x5f, 0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c,
+	0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x22, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x70,
 	0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x43, 0x6c, 0x69,
-	0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x14, 0x75, 0x69, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12,
-	0x70, 0x0a, 0x1d, 0x75, 0x69, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x6e, 0x65, 0x77,
-	0x5f, 0x72, 0x6f, 0x6c, 0x65, 0x5f, 0x73, 0x61, 0x76, 0x65, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b,
-	0x18, 0x21, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
-	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x53, 0x61, 0x76, 0x65, 0x43, 0x6c, 0x69, 0x63, 0x6b,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x18, 0x75, 0x69, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x53, 0x61, 0x76, 0x65, 0x43, 0x6c, 0x69, 0x63,
-	0x6b, 0x12, 0x76, 0x0a, 0x1f, 0x75, 0x69, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x6e,
-	0x65, 0x77, 0x5f, 0x72, 0x6f, 0x6c, 0x65, 0x5f, 0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x5f, 0x63,
-	0x6c, 0x69, 0x63, 0x6b, 0x18, 0x22, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x70, 0x72, 0x65,
-	0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x43, 0x61, 0x6e, 0x63, 0x65,
-	0x6c, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1a, 0x75,
-	0x69, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x43, 0x61,
-	0x6e, 0x63, 0x65, 0x6c, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x98, 0x01, 0x0a, 0x2b, 0x75, 0x69,
-	0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x6e, 0x65, 0x77, 0x5f, 0x72, 0x6f, 0x6c, 0x65,
-	0x5f, 0x76, 0x69, 0x65, 0x77, 0x5f, 0x64, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x23, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x3a, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
-	0x2e, 0x55, 0x49, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x43, 0x61, 0x6e,
+	0x63, 0x65, 0x6c, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52,
+	0x1a, 0x75, 0x69, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65,
+	0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x98, 0x01, 0x0a, 0x2b,
+	0x75, 0x69, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x6e, 0x65, 0x77, 0x5f, 0x72, 0x6f,
+	0x6c, 0x65, 0x5f, 0x76, 0x69, 0x65, 0x77, 0x5f, 0x64, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x18, 0x23, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x3a, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x2e, 0x55, 0x49, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f,
+	0x6c, 0x65, 0x56, 0x69, 0x65, 0x77, 0x44, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52,
+	0x25, 0x75, 0x69, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65,
 	0x56, 0x69, 0x65, 0x77, 0x44, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x25, 0x75,
-	0x69, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x77, 0x52, 0x6f, 0x6c, 0x65, 0x56, 0x69,
-	0x65, 0x77, 0x44, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43,
-	0x6c, 0x69, 0x63, 0x6b, 0x12, 0x45, 0x0a, 0x0c, 0x6b, 0x75, 0x62, 0x65, 0x5f, 0x72, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x18, 0x24, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x65,
-	0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x4b, 0x75, 0x62, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x0b,
-	0x6b, 0x75, 0x62, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2f, 0x0a, 0x04, 0x73,
-	0x66, 0x74, 0x70, 0x18, 0x25, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x72, 0x65, 0x68,
-	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x46, 0x54, 0x50, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x04, 0x73, 0x66, 0x74, 0x70, 0x12, 0x56, 0x0a, 0x14,
-	0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x65,
-	0x76, 0x65, 0x6e, 0x74, 0x18, 0x26, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x65,
-	0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x41, 0x67, 0x65, 0x6e,
-	0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00,
-	0x52, 0x12, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x12, 0x57, 0x0a, 0x12, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x5f, 0x68, 0x65, 0x61, 0x72, 0x74, 0x62, 0x65, 0x61, 0x74, 0x18, 0x27, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x26, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
-	0x61, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x48, 0x65, 0x61, 0x72, 0x74, 0x62,
-	0x65, 0x61, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x11, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x48, 0x65, 0x61, 0x72, 0x74, 0x62, 0x65, 0x61, 0x74, 0x12, 0x9c, 0x01,
-	0x0a, 0x2e, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x69, 0x6e,
-	0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x77, 0x73, 0x5f, 0x6f, 0x69,
-	0x64, 0x63, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74,
-	0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
-	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76,
-	0x65, 0x72, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x57, 0x53,
-	0x4f, 0x49, 0x44, 0x43, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74,
-	0x48, 0x00, 0x52, 0x28, 0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x49, 0x6e,
-	0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x77, 0x73, 0x4f, 0x69, 0x64, 0x63,
-	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x83, 0x01, 0x0a,
-	0x25, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x64, 0x61, 0x74,
-	0x61, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x72, 0x64, 0x73, 0x5f, 0x65, 0x6e, 0x72, 0x6f, 0x6c, 0x6c,
-	0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x29, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x70,
-	0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49,
-	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65,
-	0x52, 0x44, 0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00,
-	0x52, 0x20, 0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61,
-	0x62, 0x61, 0x73, 0x65, 0x52, 0x64, 0x73, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x45, 0x76, 0x65,
-	0x6e, 0x74, 0x12, 0x6b, 0x0a, 0x1d, 0x75, 0x69, 0x5f, 0x63, 0x61, 0x6c, 0x6c, 0x5f, 0x74, 0x6f,
-	0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x5f, 0x65, 0x76,
-	0x65, 0x6e, 0x74, 0x18, 0x2a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x65, 0x68,
-	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x43, 0x61, 0x6c,
-	0x6c, 0x54, 0x6f, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76,
-	0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x18, 0x75, 0x69, 0x43, 0x61, 0x6c, 0x6c, 0x54, 0x6f, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12,
-	0x54, 0x0a, 0x11, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65,
-	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x2b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x70, 0x72, 0x65,
-	0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x41, 0x73, 0x73, 0x69,
-	0x73, 0x74, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76, 0x65, 0x6e,
-	0x74, 0x48, 0x00, 0x52, 0x10, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6d, 0x70, 0x6c,
-	0x65, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x79, 0x0a, 0x21, 0x75, 0x69, 0x5f, 0x69, 0x6e, 0x74, 0x65,
-	0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x5f, 0x73,
-	0x74, 0x61, 0x72, 0x74, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x2c, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x2d, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
-	0x61, 0x2e, 0x55, 0x49, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45,
-	0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48,
-	0x00, 0x52, 0x1d, 0x75, 0x69, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74,
-	0x12, 0x82, 0x01, 0x0a, 0x24, 0x75, 0x69, 0x5f, 0x69, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x6c,
-	0x65, 0x74, 0x65, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x2d, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x30, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
-	0x2e, 0x55, 0x49, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e,
-	0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x45, 0x76, 0x65, 0x6e,
-	0x74, 0x48, 0x00, 0x52, 0x20, 0x75, 0x69, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x42, 0x07, 0x0a, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4a, 0x04,
-	0x08, 0x08, 0x10, 0x09, 0x52, 0x1c, 0x75, 0x69, 0x5f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64,
-	0x5f, 0x67, 0x65, 0x74, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x63, 0x6c, 0x69,
-	0x63, 0x6b, 0x22, 0x15, 0x0a, 0x13, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e,
-	0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x51, 0x0a, 0x13, 0x53, 0x75, 0x62,
-	0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x3a, 0x0a, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
-	0x61, 0x2e, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x52, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x16, 0x0a, 0x14,
-	0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x16, 0x0a, 0x14, 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x54, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x17, 0x0a, 0x15,
-	0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x54, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a, 0xe2, 0x01, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x1d, 0x0a, 0x19, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52,
-	0x43, 0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
-	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x16, 0x0a, 0x12, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43,
-	0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x4e, 0x4f, 0x44, 0x45, 0x10, 0x01, 0x12, 0x1c, 0x0a,
-	0x18, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x41,
-	0x50, 0x50, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x10, 0x02, 0x12, 0x1d, 0x0a, 0x19, 0x52,
-	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x4b, 0x55, 0x42,
-	0x45, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x10, 0x03, 0x12, 0x1b, 0x0a, 0x17, 0x52, 0x45,
-	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x44, 0x42, 0x5f, 0x53,
-	0x45, 0x52, 0x56, 0x45, 0x52, 0x10, 0x04, 0x12, 0x21, 0x0a, 0x1d, 0x52, 0x45, 0x53, 0x4f, 0x55,
-	0x52, 0x43, 0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x57, 0x49, 0x4e, 0x44, 0x4f, 0x57, 0x53,
-	0x5f, 0x44, 0x45, 0x53, 0x4b, 0x54, 0x4f, 0x50, 0x10, 0x05, 0x12, 0x1e, 0x0a, 0x1a, 0x52, 0x45,
-	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x4e, 0x4f, 0x44, 0x45,
-	0x5f, 0x4f, 0x50, 0x45, 0x4e, 0x53, 0x53, 0x48, 0x10, 0x06, 0x2a, 0xed, 0x0d, 0x0a, 0x10, 0x44,
-	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12,
-	0x21, 0x0a, 0x1d, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f,
-	0x55, 0x52, 0x43, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
-	0x10, 0x00, 0x12, 0x1c, 0x0a, 0x18, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52,
-	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x10, 0x01,
-	0x12, 0x20, 0x0a, 0x1c, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53,
-	0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x4b, 0x55, 0x42, 0x45, 0x52, 0x4e, 0x45, 0x54, 0x45, 0x53,
-	0x10, 0x02, 0x12, 0x33, 0x0a, 0x2f, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52,
-	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45,
-	0x5f, 0x50, 0x4f, 0x53, 0x54, 0x47, 0x52, 0x45, 0x53, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48,
-	0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x03, 0x12, 0x30, 0x0a, 0x2c, 0x44, 0x49, 0x53, 0x43, 0x4f,
-	0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54,
-	0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x4d, 0x59, 0x53, 0x51, 0x4c, 0x5f, 0x53, 0x45, 0x4c, 0x46,
-	0x5f, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x04, 0x12, 0x32, 0x0a, 0x2e, 0x44, 0x49, 0x53,
-	0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44,
-	0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x4d, 0x4f, 0x4e, 0x47, 0x4f, 0x44, 0x42, 0x5f,
-	0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x05, 0x12, 0x2b, 0x0a,
-	0x27, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52,
-	0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x50, 0x4f, 0x53, 0x54,
-	0x47, 0x52, 0x45, 0x53, 0x5f, 0x52, 0x44, 0x53, 0x10, 0x06, 0x12, 0x28, 0x0a, 0x24, 0x44, 0x49,
-	0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f,
-	0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x4d, 0x59, 0x53, 0x51, 0x4c, 0x5f, 0x52,
-	0x44, 0x53, 0x10, 0x07, 0x12, 0x26, 0x0a, 0x22, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52,
-	0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x41, 0x50, 0x50, 0x4c, 0x49, 0x43,
-	0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x10, 0x08, 0x12, 0x25, 0x0a, 0x21,
-	0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43,
-	0x45, 0x5f, 0x41, 0x50, 0x50, 0x4c, 0x49, 0x43, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x54, 0x43,
-	0x50, 0x10, 0x09, 0x12, 0x25, 0x0a, 0x21, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f,
-	0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x57, 0x49, 0x4e, 0x44, 0x4f, 0x57, 0x53,
-	0x5f, 0x44, 0x45, 0x53, 0x4b, 0x54, 0x4f, 0x50, 0x10, 0x0a, 0x12, 0x2c, 0x0a, 0x28, 0x44, 0x49,
-	0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f,
-	0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x53, 0x51, 0x4c, 0x53, 0x45, 0x52, 0x56,
-	0x45, 0x52, 0x5f, 0x52, 0x44, 0x53, 0x10, 0x0b, 0x12, 0x30, 0x0a, 0x2c, 0x44, 0x49, 0x53, 0x43,
+	0x6e, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x12, 0x45, 0x0a, 0x0c, 0x6b, 0x75, 0x62, 0x65, 0x5f, 0x72,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x24, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70,
+	0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x4b, 0x75,
+	0x62, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00,
+	0x52, 0x0b, 0x6b, 0x75, 0x62, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2f, 0x0a,
+	0x04, 0x73, 0x66, 0x74, 0x70, 0x18, 0x25, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x46, 0x54,
+	0x50, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x04, 0x73, 0x66, 0x74, 0x70, 0x12, 0x56,
+	0x0a, 0x14, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x26, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70,
+	0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x41, 0x67,
+	0x65, 0x6e, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x48, 0x00, 0x52, 0x12, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x57, 0x0a, 0x12, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x5f, 0x68, 0x65, 0x61, 0x72, 0x74, 0x62, 0x65, 0x61, 0x74, 0x18, 0x27, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x26, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x48, 0x65, 0x61, 0x72,
+	0x74, 0x62, 0x65, 0x61, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x11, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x48, 0x65, 0x61, 0x72, 0x74, 0x62, 0x65, 0x61, 0x74, 0x12,
+	0x9c, 0x01, 0x0a, 0x2e, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f,
+	0x69, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x77, 0x73, 0x5f,
+	0x6f, 0x69, 0x64, 0x63, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x76, 0x65,
+	0x6e, 0x74, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f,
+	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x44, 0x69, 0x73, 0x63,
+	0x6f, 0x76, 0x65, 0x72, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x41,
+	0x57, 0x53, 0x4f, 0x49, 0x44, 0x43, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x45, 0x76, 0x65,
+	0x6e, 0x74, 0x48, 0x00, 0x52, 0x28, 0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
+	0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x77, 0x73, 0x4f, 0x69,
+	0x64, 0x63, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x83,
+	0x01, 0x0a, 0x25, 0x75, 0x69, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x5f, 0x64,
+	0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x72, 0x64, 0x73, 0x5f, 0x65, 0x6e, 0x72, 0x6f,
+	0x6c, 0x6c, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x29, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30,
+	0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e,
+	0x55, 0x49, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61,
+	0x73, 0x65, 0x52, 0x44, 0x53, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x48, 0x00, 0x52, 0x20, 0x75, 0x69, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x44, 0x61,
+	0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x52, 0x64, 0x73, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x12, 0x6b, 0x0a, 0x1d, 0x75, 0x69, 0x5f, 0x63, 0x61, 0x6c, 0x6c, 0x5f,
+	0x74, 0x6f, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6c, 0x69, 0x63, 0x6b, 0x5f,
+	0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x2a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x43,
+	0x61, 0x6c, 0x6c, 0x54, 0x6f, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x69, 0x63, 0x6b,
+	0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x18, 0x75, 0x69, 0x43, 0x61, 0x6c, 0x6c, 0x54,
+	0x6f, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x69, 0x63, 0x6b, 0x45, 0x76, 0x65, 0x6e,
+	0x74, 0x12, 0x54, 0x0a, 0x11, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x5f, 0x63, 0x6f, 0x6d, 0x70,
+	0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x2b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x70,
+	0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x41, 0x73,
+	0x73, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76,
+	0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x10, 0x61, 0x73, 0x73, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6d,
+	0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x79, 0x0a, 0x21, 0x75, 0x69, 0x5f, 0x69, 0x6e,
+	0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x72, 0x6f, 0x6c, 0x6c,
+	0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x2c, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72, 0x74, 0x45, 0x76, 0x65, 0x6e,
+	0x74, 0x48, 0x00, 0x52, 0x1d, 0x75, 0x69, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72, 0x74, 0x45, 0x76, 0x65,
+	0x6e, 0x74, 0x12, 0x82, 0x01, 0x0a, 0x24, 0x75, 0x69, 0x5f, 0x69, 0x6e, 0x74, 0x65, 0x67, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x5f, 0x63, 0x6f, 0x6d,
+	0x70, 0x6c, 0x65, 0x74, 0x65, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x2d, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x30, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x2e, 0x55, 0x49, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x45, 0x76,
+	0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x20, 0x75, 0x69, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65,
+	0x74, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x53, 0x0a, 0x13, 0x65, 0x64, 0x69, 0x74, 0x6f,
+	0x72, 0x5f, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x2e,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x45, 0x64, 0x69, 0x74, 0x6f, 0x72, 0x43, 0x68, 0x61, 0x6e,
+	0x67, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x11, 0x65, 0x64, 0x69, 0x74, 0x6f,
+	0x72, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3f, 0x0a, 0x0a,
+	0x62, 0x6f, 0x74, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x18, 0x2f, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1e, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x2e, 0x42, 0x6f, 0x74, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x48, 0x00, 0x52, 0x09, 0x62, 0x6f, 0x74, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x7a, 0x0a,
+	0x1f, 0x75, 0x69, 0x5f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x69, 0x6f, 0x6e, 0x6e, 0x61, 0x69, 0x72, 0x65, 0x5f, 0x73, 0x75, 0x62, 0x6d, 0x69, 0x74,
+	0x18, 0x30, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x55, 0x49, 0x4f, 0x6e, 0x62, 0x6f, 0x61, 0x72,
+	0x64, 0x51, 0x75, 0x65, 0x73, 0x74, 0x69, 0x6f, 0x6e, 0x6e, 0x61, 0x69, 0x72, 0x65, 0x53, 0x75,
+	0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x1c, 0x75, 0x69, 0x4f,
+	0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x51, 0x75, 0x65, 0x73, 0x74, 0x69, 0x6f, 0x6e, 0x6e, 0x61,
+	0x69, 0x72, 0x65, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x12, 0x39, 0x0a, 0x08, 0x62, 0x6f, 0x74,
+	0x5f, 0x6a, 0x6f, 0x69, 0x6e, 0x18, 0x31, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x42, 0x6f, 0x74,
+	0x4a, 0x6f, 0x69, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x07, 0x62, 0x6f, 0x74,
+	0x4a, 0x6f, 0x69, 0x6e, 0x42, 0x07, 0x0a, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x4a, 0x04, 0x08,
+	0x08, 0x10, 0x09, 0x52, 0x1c, 0x75, 0x69, 0x5f, 0x6f, 0x6e, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x5f,
+	0x67, 0x65, 0x74, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x63, 0x6c, 0x69, 0x63,
+	0x6b, 0x22, 0x15, 0x0a, 0x13, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x51, 0x0a, 0x13, 0x53, 0x75, 0x62, 0x6d,
+	0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x3a, 0x0a, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x2e, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x52, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x16, 0x0a, 0x14, 0x53,
+	0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x16, 0x0a, 0x14, 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x54, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x17, 0x0a, 0x15, 0x48,
+	0x65, 0x6c, 0x6c, 0x6f, 0x54, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x2a, 0xe2, 0x01, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x1d, 0x0a, 0x19, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43,
+	0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
+	0x45, 0x44, 0x10, 0x00, 0x12, 0x16, 0x0a, 0x12, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45,
+	0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x4e, 0x4f, 0x44, 0x45, 0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18,
+	0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x41, 0x50,
+	0x50, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x10, 0x02, 0x12, 0x1d, 0x0a, 0x19, 0x52, 0x45,
+	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x4b, 0x55, 0x42, 0x45,
+	0x5f, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x10, 0x03, 0x12, 0x1b, 0x0a, 0x17, 0x52, 0x45, 0x53,
+	0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x44, 0x42, 0x5f, 0x53, 0x45,
+	0x52, 0x56, 0x45, 0x52, 0x10, 0x04, 0x12, 0x21, 0x0a, 0x1d, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52,
+	0x43, 0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x57, 0x49, 0x4e, 0x44, 0x4f, 0x57, 0x53, 0x5f,
+	0x44, 0x45, 0x53, 0x4b, 0x54, 0x4f, 0x50, 0x10, 0x05, 0x12, 0x1e, 0x0a, 0x1a, 0x52, 0x45, 0x53,
+	0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x4e, 0x4f, 0x44, 0x45, 0x5f,
+	0x4f, 0x50, 0x45, 0x4e, 0x53, 0x53, 0x48, 0x10, 0x06, 0x2a, 0x95, 0x0e, 0x0a, 0x10, 0x44, 0x69,
+	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x21,
+	0x0a, 0x1d, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55,
+	0x52, 0x43, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
+	0x00, 0x12, 0x1c, 0x0a, 0x18, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45,
+	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x10, 0x01, 0x12,
+	0x20, 0x0a, 0x1c, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f,
+	0x55, 0x52, 0x43, 0x45, 0x5f, 0x4b, 0x55, 0x42, 0x45, 0x52, 0x4e, 0x45, 0x54, 0x45, 0x53, 0x10,
+	0x02, 0x12, 0x33, 0x0a, 0x2f, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45,
+	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f,
+	0x50, 0x4f, 0x53, 0x54, 0x47, 0x52, 0x45, 0x53, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f,
+	0x53, 0x54, 0x45, 0x44, 0x10, 0x03, 0x12, 0x30, 0x0a, 0x2c, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56,
+	0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41,
+	0x42, 0x41, 0x53, 0x45, 0x5f, 0x4d, 0x59, 0x53, 0x51, 0x4c, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f,
+	0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x04, 0x12, 0x32, 0x0a, 0x2e, 0x44, 0x49, 0x53, 0x43,
 	0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41,
-	0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x50, 0x4f, 0x53, 0x54, 0x47, 0x52, 0x45, 0x53, 0x5f,
-	0x52, 0x45, 0x44, 0x53, 0x48, 0x49, 0x46, 0x54, 0x10, 0x0c, 0x12, 0x34, 0x0a, 0x30, 0x44, 0x49,
-	0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f,
-	0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x53, 0x51, 0x4c, 0x53, 0x45, 0x52, 0x56,
-	0x45, 0x52, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x0d,
-	0x12, 0x30, 0x0a, 0x2c, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53,
-	0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x52,
-	0x45, 0x44, 0x49, 0x53, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44,
-	0x10, 0x0e, 0x12, 0x2b, 0x0a, 0x27, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52,
-	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45,
-	0x5f, 0x50, 0x4f, 0x53, 0x54, 0x47, 0x52, 0x45, 0x53, 0x5f, 0x47, 0x43, 0x50, 0x10, 0x0f, 0x12,
-	0x28, 0x0a, 0x24, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f,
-	0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x4d, 0x59,
-	0x53, 0x51, 0x4c, 0x5f, 0x47, 0x43, 0x50, 0x10, 0x10, 0x12, 0x2c, 0x0a, 0x28, 0x44, 0x49, 0x53,
+	0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x4d, 0x4f, 0x4e, 0x47, 0x4f, 0x44, 0x42, 0x5f, 0x53,
+	0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x05, 0x12, 0x2b, 0x0a, 0x27,
+	0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43,
+	0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x50, 0x4f, 0x53, 0x54, 0x47,
+	0x52, 0x45, 0x53, 0x5f, 0x52, 0x44, 0x53, 0x10, 0x06, 0x12, 0x28, 0x0a, 0x24, 0x44, 0x49, 0x53,
+	0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44,
+	0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x4d, 0x59, 0x53, 0x51, 0x4c, 0x5f, 0x52, 0x44,
+	0x53, 0x10, 0x07, 0x12, 0x26, 0x0a, 0x22, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f,
+	0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x41, 0x50, 0x50, 0x4c, 0x49, 0x43, 0x41,
+	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x10, 0x08, 0x12, 0x25, 0x0a, 0x21, 0x44,
+	0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45,
+	0x5f, 0x41, 0x50, 0x50, 0x4c, 0x49, 0x43, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x54, 0x43, 0x50,
+	0x10, 0x09, 0x12, 0x25, 0x0a, 0x21, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52,
+	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x57, 0x49, 0x4e, 0x44, 0x4f, 0x57, 0x53, 0x5f,
+	0x44, 0x45, 0x53, 0x4b, 0x54, 0x4f, 0x50, 0x10, 0x0a, 0x12, 0x2c, 0x0a, 0x28, 0x44, 0x49, 0x53,
 	0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44,
 	0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x53, 0x51, 0x4c, 0x53, 0x45, 0x52, 0x56, 0x45,
-	0x52, 0x5f, 0x47, 0x43, 0x50, 0x10, 0x11, 0x12, 0x3b, 0x0a, 0x37, 0x44, 0x49, 0x53, 0x43, 0x4f,
+	0x52, 0x5f, 0x52, 0x44, 0x53, 0x10, 0x0b, 0x12, 0x30, 0x0a, 0x2c, 0x44, 0x49, 0x53, 0x43, 0x4f,
 	0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54,
 	0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x50, 0x4f, 0x53, 0x54, 0x47, 0x52, 0x45, 0x53, 0x5f, 0x52,
-	0x45, 0x44, 0x53, 0x48, 0x49, 0x46, 0x54, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x4c, 0x45,
-	0x53, 0x53, 0x10, 0x12, 0x12, 0x2d, 0x0a, 0x29, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52,
-	0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41,
-	0x53, 0x45, 0x5f, 0x50, 0x4f, 0x53, 0x54, 0x47, 0x52, 0x45, 0x53, 0x5f, 0x41, 0x5a, 0x55, 0x52,
-	0x45, 0x10, 0x13, 0x12, 0x27, 0x0a, 0x23, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f,
-	0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53,
-	0x45, 0x5f, 0x44, 0x59, 0x4e, 0x41, 0x4d, 0x4f, 0x44, 0x42, 0x10, 0x14, 0x12, 0x32, 0x0a, 0x2e,
-	0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43,
-	0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x43, 0x41, 0x53, 0x53, 0x41,
-	0x4e, 0x44, 0x52, 0x41, 0x5f, 0x4b, 0x45, 0x59, 0x53, 0x50, 0x41, 0x43, 0x45, 0x53, 0x10, 0x15,
-	0x12, 0x34, 0x0a, 0x30, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53,
-	0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x43,
-	0x41, 0x53, 0x53, 0x41, 0x4e, 0x44, 0x52, 0x41, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f,
-	0x53, 0x54, 0x45, 0x44, 0x10, 0x16, 0x12, 0x38, 0x0a, 0x34, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56,
-	0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41,
-	0x42, 0x41, 0x53, 0x45, 0x5f, 0x45, 0x4c, 0x41, 0x53, 0x54, 0x49, 0x43, 0x53, 0x45, 0x41, 0x52,
-	0x43, 0x48, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x17,
-	0x12, 0x30, 0x0a, 0x2c, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53,
-	0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x52,
-	0x45, 0x44, 0x49, 0x53, 0x5f, 0x45, 0x4c, 0x41, 0x53, 0x54, 0x49, 0x43, 0x41, 0x43, 0x48, 0x45,
-	0x10, 0x18, 0x12, 0x2d, 0x0a, 0x29, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52,
-	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45,
-	0x5f, 0x52, 0x45, 0x44, 0x49, 0x53, 0x5f, 0x4d, 0x45, 0x4d, 0x4f, 0x52, 0x59, 0x44, 0x42, 0x10,
-	0x19, 0x12, 0x30, 0x0a, 0x2c, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45,
-	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f,
-	0x52, 0x45, 0x44, 0x49, 0x53, 0x5f, 0x41, 0x5a, 0x55, 0x52, 0x45, 0x5f, 0x43, 0x41, 0x43, 0x48,
-	0x45, 0x10, 0x1a, 0x12, 0x38, 0x0a, 0x34, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f,
-	0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53,
-	0x45, 0x5f, 0x52, 0x45, 0x44, 0x49, 0x53, 0x5f, 0x43, 0x4c, 0x55, 0x53, 0x54, 0x45, 0x52, 0x5f,
-	0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x1b, 0x12, 0x2a, 0x0a,
-	0x26, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52,
-	0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x4d, 0x59, 0x53, 0x51,
-	0x4c, 0x5f, 0x41, 0x5a, 0x55, 0x52, 0x45, 0x10, 0x1c, 0x12, 0x2e, 0x0a, 0x2a, 0x44, 0x49, 0x53,
-	0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44,
-	0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x53, 0x51, 0x4c, 0x53, 0x45, 0x52, 0x56, 0x45,
-	0x52, 0x5f, 0x41, 0x5a, 0x55, 0x52, 0x45, 0x10, 0x1d, 0x12, 0x32, 0x0a, 0x2e, 0x44, 0x49, 0x53,
+	0x45, 0x44, 0x53, 0x48, 0x49, 0x46, 0x54, 0x10, 0x0c, 0x12, 0x34, 0x0a, 0x30, 0x44, 0x49, 0x53,
 	0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44,
 	0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x53, 0x51, 0x4c, 0x53, 0x45, 0x52, 0x56, 0x45,
-	0x52, 0x5f, 0x4d, 0x49, 0x43, 0x52, 0x4f, 0x53, 0x4f, 0x46, 0x54, 0x10, 0x1e, 0x12, 0x36, 0x0a,
-	0x32, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52,
-	0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x43, 0x4f, 0x43, 0x4b,
-	0x52, 0x4f, 0x41, 0x43, 0x48, 0x44, 0x42, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53,
-	0x54, 0x45, 0x44, 0x10, 0x1f, 0x12, 0x2c, 0x0a, 0x28, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45,
-	0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42,
-	0x41, 0x53, 0x45, 0x5f, 0x4d, 0x4f, 0x4e, 0x47, 0x4f, 0x44, 0x42, 0x5f, 0x41, 0x54, 0x4c, 0x41,
-	0x53, 0x10, 0x20, 0x12, 0x28, 0x0a, 0x24, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f,
+	0x52, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x0d, 0x12,
+	0x30, 0x0a, 0x2c, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f,
+	0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x52, 0x45,
+	0x44, 0x49, 0x53, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10,
+	0x0e, 0x12, 0x2b, 0x0a, 0x27, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45,
+	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f,
+	0x50, 0x4f, 0x53, 0x54, 0x47, 0x52, 0x45, 0x53, 0x5f, 0x47, 0x43, 0x50, 0x10, 0x0f, 0x12, 0x28,
+	0x0a, 0x24, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55,
+	0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x4d, 0x59, 0x53,
+	0x51, 0x4c, 0x5f, 0x47, 0x43, 0x50, 0x10, 0x10, 0x12, 0x2c, 0x0a, 0x28, 0x44, 0x49, 0x53, 0x43,
+	0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41,
+	0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x53, 0x51, 0x4c, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52,
+	0x5f, 0x47, 0x43, 0x50, 0x10, 0x11, 0x12, 0x3b, 0x0a, 0x37, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56,
+	0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41,
+	0x42, 0x41, 0x53, 0x45, 0x5f, 0x50, 0x4f, 0x53, 0x54, 0x47, 0x52, 0x45, 0x53, 0x5f, 0x52, 0x45,
+	0x44, 0x53, 0x48, 0x49, 0x46, 0x54, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x4c, 0x45, 0x53,
+	0x53, 0x10, 0x12, 0x12, 0x2d, 0x0a, 0x29, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f,
 	0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53,
-	0x45, 0x5f, 0x53, 0x4e, 0x4f, 0x57, 0x46, 0x4c, 0x41, 0x4b, 0x45, 0x10, 0x21, 0x12, 0x2c, 0x0a,
-	0x28, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52,
-	0x43, 0x45, 0x5f, 0x44, 0x4f, 0x43, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f,
-	0x52, 0x44, 0x53, 0x5f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x10, 0x22, 0x12, 0x34, 0x0a, 0x30, 0x44,
+	0x45, 0x5f, 0x50, 0x4f, 0x53, 0x54, 0x47, 0x52, 0x45, 0x53, 0x5f, 0x41, 0x5a, 0x55, 0x52, 0x45,
+	0x10, 0x13, 0x12, 0x27, 0x0a, 0x23, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52,
+	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45,
+	0x5f, 0x44, 0x59, 0x4e, 0x41, 0x4d, 0x4f, 0x44, 0x42, 0x10, 0x14, 0x12, 0x32, 0x0a, 0x2e, 0x44,
 	0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45,
-	0x5f, 0x44, 0x4f, 0x43, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x48, 0x49,
-	0x47, 0x48, 0x5f, 0x41, 0x56, 0x41, 0x49, 0x4c, 0x41, 0x42, 0x49, 0x4c, 0x49, 0x54, 0x59, 0x10,
-	0x23, 0x12, 0x37, 0x0a, 0x33, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45,
-	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x4f, 0x43, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42,
-	0x41, 0x53, 0x45, 0x5f, 0x44, 0x59, 0x4e, 0x41, 0x4d, 0x49, 0x43, 0x5f, 0x52, 0x45, 0x47, 0x49,
-	0x53, 0x54, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x10, 0x24, 0x2a, 0xa3, 0x01, 0x0a, 0x0e, 0x44,
-	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x1f, 0x0a,
-	0x1b, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
-	0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1b,
-	0x0a, 0x17, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55,
-	0x53, 0x5f, 0x53, 0x55, 0x43, 0x43, 0x45, 0x53, 0x53, 0x10, 0x01, 0x12, 0x1b, 0x0a, 0x17, 0x44,
-	0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x53,
-	0x4b, 0x49, 0x50, 0x50, 0x45, 0x44, 0x10, 0x02, 0x12, 0x19, 0x0a, 0x15, 0x44, 0x49, 0x53, 0x43,
-	0x4f, 0x56, 0x45, 0x52, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x45, 0x52, 0x52, 0x4f,
-	0x52, 0x10, 0x03, 0x12, 0x1b, 0x0a, 0x17, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f,
-	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x41, 0x42, 0x4f, 0x52, 0x54, 0x45, 0x44, 0x10, 0x04,
-	0x2a, 0xae, 0x01, 0x0a, 0x03, 0x43, 0x54, 0x41, 0x12, 0x13, 0x0a, 0x0f, 0x43, 0x54, 0x41, 0x5f,
-	0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x16, 0x0a,
-	0x12, 0x43, 0x54, 0x41, 0x5f, 0x41, 0x55, 0x54, 0x48, 0x5f, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43,
-	0x54, 0x4f, 0x52, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x43, 0x54, 0x41, 0x5f, 0x41, 0x43, 0x54,
-	0x49, 0x56, 0x45, 0x5f, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x10, 0x02, 0x12, 0x17,
-	0x0a, 0x13, 0x43, 0x54, 0x41, 0x5f, 0x41, 0x43, 0x43, 0x45, 0x53, 0x53, 0x5f, 0x52, 0x45, 0x51,
-	0x55, 0x45, 0x53, 0x54, 0x53, 0x10, 0x03, 0x12, 0x17, 0x0a, 0x13, 0x43, 0x54, 0x41, 0x5f, 0x50,
-	0x52, 0x45, 0x4d, 0x49, 0x55, 0x4d, 0x5f, 0x53, 0x55, 0x50, 0x50, 0x4f, 0x52, 0x54, 0x10, 0x04,
-	0x12, 0x17, 0x0a, 0x13, 0x43, 0x54, 0x41, 0x5f, 0x54, 0x52, 0x55, 0x53, 0x54, 0x45, 0x44, 0x5f,
-	0x44, 0x45, 0x56, 0x49, 0x43, 0x45, 0x53, 0x10, 0x05, 0x12, 0x16, 0x0a, 0x12, 0x43, 0x54, 0x41,
-	0x5f, 0x55, 0x50, 0x47, 0x52, 0x41, 0x44, 0x45, 0x5f, 0x42, 0x41, 0x4e, 0x4e, 0x45, 0x52, 0x10,
-	0x06, 0x2a, 0xd2, 0x03, 0x0a, 0x15, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x43, 0x41, 0x53, 0x53, 0x41, 0x4e,
+	0x44, 0x52, 0x41, 0x5f, 0x4b, 0x45, 0x59, 0x53, 0x50, 0x41, 0x43, 0x45, 0x53, 0x10, 0x15, 0x12,
+	0x34, 0x0a, 0x30, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f,
+	0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x43, 0x41,
+	0x53, 0x53, 0x41, 0x4e, 0x44, 0x52, 0x41, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53,
+	0x54, 0x45, 0x44, 0x10, 0x16, 0x12, 0x38, 0x0a, 0x34, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45,
+	0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42,
+	0x41, 0x53, 0x45, 0x5f, 0x45, 0x4c, 0x41, 0x53, 0x54, 0x49, 0x43, 0x53, 0x45, 0x41, 0x52, 0x43,
+	0x48, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x17, 0x12,
+	0x30, 0x0a, 0x2c, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f,
+	0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x52, 0x45,
+	0x44, 0x49, 0x53, 0x5f, 0x45, 0x4c, 0x41, 0x53, 0x54, 0x49, 0x43, 0x41, 0x43, 0x48, 0x45, 0x10,
+	0x18, 0x12, 0x2d, 0x0a, 0x29, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45,
+	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f,
+	0x52, 0x45, 0x44, 0x49, 0x53, 0x5f, 0x4d, 0x45, 0x4d, 0x4f, 0x52, 0x59, 0x44, 0x42, 0x10, 0x19,
+	0x12, 0x30, 0x0a, 0x2c, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53,
+	0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x52,
+	0x45, 0x44, 0x49, 0x53, 0x5f, 0x41, 0x5a, 0x55, 0x52, 0x45, 0x5f, 0x43, 0x41, 0x43, 0x48, 0x45,
+	0x10, 0x1a, 0x12, 0x38, 0x0a, 0x34, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52,
+	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45,
+	0x5f, 0x52, 0x45, 0x44, 0x49, 0x53, 0x5f, 0x43, 0x4c, 0x55, 0x53, 0x54, 0x45, 0x52, 0x5f, 0x53,
+	0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x1b, 0x12, 0x2a, 0x0a, 0x26,
+	0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43,
+	0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x4d, 0x59, 0x53, 0x51, 0x4c,
+	0x5f, 0x41, 0x5a, 0x55, 0x52, 0x45, 0x10, 0x1c, 0x12, 0x2e, 0x0a, 0x2a, 0x44, 0x49, 0x53, 0x43,
+	0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41,
+	0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x53, 0x51, 0x4c, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52,
+	0x5f, 0x41, 0x5a, 0x55, 0x52, 0x45, 0x10, 0x1d, 0x12, 0x32, 0x0a, 0x2e, 0x44, 0x49, 0x53, 0x43,
+	0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41,
+	0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x53, 0x51, 0x4c, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52,
+	0x5f, 0x4d, 0x49, 0x43, 0x52, 0x4f, 0x53, 0x4f, 0x46, 0x54, 0x10, 0x1e, 0x12, 0x36, 0x0a, 0x32,
+	0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43,
+	0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x43, 0x4f, 0x43, 0x4b, 0x52,
+	0x4f, 0x41, 0x43, 0x48, 0x44, 0x42, 0x5f, 0x53, 0x45, 0x4c, 0x46, 0x5f, 0x48, 0x4f, 0x53, 0x54,
+	0x45, 0x44, 0x10, 0x1f, 0x12, 0x2c, 0x0a, 0x28, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52,
+	0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41,
+	0x53, 0x45, 0x5f, 0x4d, 0x4f, 0x4e, 0x47, 0x4f, 0x44, 0x42, 0x5f, 0x41, 0x54, 0x4c, 0x41, 0x53,
+	0x10, 0x20, 0x12, 0x28, 0x0a, 0x24, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52,
+	0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45,
+	0x5f, 0x53, 0x4e, 0x4f, 0x57, 0x46, 0x4c, 0x41, 0x4b, 0x45, 0x10, 0x21, 0x12, 0x2c, 0x0a, 0x28,
+	0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43,
+	0x45, 0x5f, 0x44, 0x4f, 0x43, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x52,
+	0x44, 0x53, 0x5f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x10, 0x22, 0x12, 0x34, 0x0a, 0x30, 0x44, 0x49,
+	0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f,
+	0x44, 0x4f, 0x43, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41, 0x53, 0x45, 0x5f, 0x48, 0x49, 0x47,
+	0x48, 0x5f, 0x41, 0x56, 0x41, 0x49, 0x4c, 0x41, 0x42, 0x49, 0x4c, 0x49, 0x54, 0x59, 0x10, 0x23,
+	0x12, 0x37, 0x0a, 0x33, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53,
+	0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x44, 0x4f, 0x43, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x42, 0x41,
+	0x53, 0x45, 0x5f, 0x44, 0x59, 0x4e, 0x41, 0x4d, 0x49, 0x43, 0x5f, 0x52, 0x45, 0x47, 0x49, 0x53,
+	0x54, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x10, 0x24, 0x12, 0x26, 0x0a, 0x22, 0x44, 0x49, 0x53,
+	0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x52, 0x45, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x53,
+	0x41, 0x4d, 0x4c, 0x5f, 0x41, 0x50, 0x50, 0x4c, 0x49, 0x43, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x10,
+	0x25, 0x2a, 0xa3, 0x01, 0x0a, 0x0e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x12, 0x1f, 0x0a, 0x1b, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52,
+	0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
+	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1b, 0x0a, 0x17, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45,
+	0x52, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x53, 0x55, 0x43, 0x43, 0x45, 0x53, 0x53,
+	0x10, 0x01, 0x12, 0x1b, 0x0a, 0x17, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x53,
+	0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x53, 0x4b, 0x49, 0x50, 0x50, 0x45, 0x44, 0x10, 0x02, 0x12,
+	0x19, 0x0a, 0x15, 0x44, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x53, 0x54, 0x41, 0x54,
+	0x55, 0x53, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x03, 0x12, 0x1b, 0x0a, 0x17, 0x44, 0x49,
+	0x53, 0x43, 0x4f, 0x56, 0x45, 0x52, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x41, 0x42,
+	0x4f, 0x52, 0x54, 0x45, 0x44, 0x10, 0x04, 0x2a, 0xc7, 0x01, 0x0a, 0x03, 0x43, 0x54, 0x41, 0x12,
+	0x13, 0x0a, 0x0f, 0x43, 0x54, 0x41, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
+	0x45, 0x44, 0x10, 0x00, 0x12, 0x16, 0x0a, 0x12, 0x43, 0x54, 0x41, 0x5f, 0x41, 0x55, 0x54, 0x48,
+	0x5f, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x4f, 0x52, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13,
+	0x43, 0x54, 0x41, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x56, 0x45, 0x5f, 0x53, 0x45, 0x53, 0x53, 0x49,
+	0x4f, 0x4e, 0x53, 0x10, 0x02, 0x12, 0x17, 0x0a, 0x13, 0x43, 0x54, 0x41, 0x5f, 0x41, 0x43, 0x43,
+	0x45, 0x53, 0x53, 0x5f, 0x52, 0x45, 0x51, 0x55, 0x45, 0x53, 0x54, 0x53, 0x10, 0x03, 0x12, 0x17,
+	0x0a, 0x13, 0x43, 0x54, 0x41, 0x5f, 0x50, 0x52, 0x45, 0x4d, 0x49, 0x55, 0x4d, 0x5f, 0x53, 0x55,
+	0x50, 0x50, 0x4f, 0x52, 0x54, 0x10, 0x04, 0x12, 0x17, 0x0a, 0x13, 0x43, 0x54, 0x41, 0x5f, 0x54,
+	0x52, 0x55, 0x53, 0x54, 0x45, 0x44, 0x5f, 0x44, 0x45, 0x56, 0x49, 0x43, 0x45, 0x53, 0x10, 0x05,
+	0x12, 0x16, 0x0a, 0x12, 0x43, 0x54, 0x41, 0x5f, 0x55, 0x50, 0x47, 0x52, 0x41, 0x44, 0x45, 0x5f,
+	0x42, 0x41, 0x4e, 0x4e, 0x45, 0x52, 0x10, 0x06, 0x12, 0x17, 0x0a, 0x13, 0x43, 0x54, 0x41, 0x5f,
+	0x42, 0x49, 0x4c, 0x4c, 0x49, 0x4e, 0x47, 0x5f, 0x53, 0x55, 0x4d, 0x4d, 0x41, 0x52, 0x59, 0x10,
+	0x07, 0x2a, 0xd2, 0x03, 0x0a, 0x15, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f,
 	0x6e, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x27, 0x0a, 0x23, 0x49,
 	0x4e, 0x54, 0x45, 0x47, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x45, 0x4e, 0x52, 0x4f, 0x4c,
 	0x4c, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
@@ -4968,40 +5665,48 @@ var file_prehog_v1alpha_teleport_proto_rawDesc = []byte{
 	0x4e, 0x5f, 0x45, 0x4e, 0x52, 0x4f, 0x4c, 0x4c, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x4f, 0x4b,
 	0x54, 0x41, 0x10, 0x0a, 0x12, 0x20, 0x0a, 0x1c, 0x49, 0x4e, 0x54, 0x45, 0x47, 0x52, 0x41, 0x54,
 	0x49, 0x4f, 0x4e, 0x5f, 0x45, 0x4e, 0x52, 0x4f, 0x4c, 0x4c, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f,
-	0x4a, 0x41, 0x4d, 0x46, 0x10, 0x0b, 0x32, 0xb4, 0x02, 0x0a, 0x18, 0x54, 0x65, 0x6c, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x12, 0x5b, 0x0a, 0x0b, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65,
-	0x6e, 0x74, 0x12, 0x22, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
-	0x70, 0x68, 0x61, 0x2e, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e,
-	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76,
-	0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x03, 0x88, 0x02, 0x01,
-	0x12, 0x5b, 0x0a, 0x0c, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73,
-	0x12, 0x23, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x4a, 0x41, 0x4d, 0x46, 0x10, 0x0b, 0x2a, 0x88, 0x01, 0x0a, 0x12, 0x45, 0x64, 0x69, 0x74, 0x6f,
+	0x72, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x24, 0x0a,
+	0x20, 0x45, 0x44, 0x49, 0x54, 0x4f, 0x52, 0x5f, 0x43, 0x48, 0x41, 0x4e, 0x47, 0x45, 0x5f, 0x53,
+	0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45,
+	0x44, 0x10, 0x00, 0x12, 0x25, 0x0a, 0x21, 0x45, 0x44, 0x49, 0x54, 0x4f, 0x52, 0x5f, 0x43, 0x48,
+	0x41, 0x4e, 0x47, 0x45, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x52, 0x4f, 0x4c, 0x45,
+	0x5f, 0x47, 0x52, 0x41, 0x4e, 0x54, 0x45, 0x44, 0x10, 0x01, 0x12, 0x25, 0x0a, 0x21, 0x45, 0x44,
+	0x49, 0x54, 0x4f, 0x52, 0x5f, 0x43, 0x48, 0x41, 0x4e, 0x47, 0x45, 0x5f, 0x53, 0x54, 0x41, 0x54,
+	0x55, 0x53, 0x5f, 0x52, 0x4f, 0x4c, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x56, 0x45, 0x44, 0x10,
+	0x02, 0x32, 0xb4, 0x02, 0x0a, 0x18, 0x54, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5b,
+	0x0a, 0x0b, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x22, 0x2e,
+	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53,
+	0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x23, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x2e, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x03, 0x88, 0x02, 0x01, 0x12, 0x5b, 0x0a, 0x0c, 0x53,
+	0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x23, 0x2e, 0x70, 0x72,
+	0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x75, 0x62,
+	0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x24, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
 	0x61, 0x2e, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76,
-	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x75, 0x62, 0x6d, 0x69, 0x74, 0x45, 0x76, 0x65,
-	0x6e, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5e, 0x0a,
-	0x0d, 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x54, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x24,
-	0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e,
-	0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x54, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31,
-	0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x54, 0x65, 0x6c, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xc9, 0x01,
-	0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61,
-	0x6c, 0x70, 0x68, 0x61, 0x42, 0x0d, 0x54, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x50, 0x72,
-	0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
-	0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f,
-	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61,
-	0x6c, 0x70, 0x68, 0x61, 0x3b, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x76, 0x31, 0x61, 0x6c, 0x70,
-	0x68, 0x61, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x0e, 0x50, 0x72, 0x65, 0x68, 0x6f,
-	0x67, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0xca, 0x02, 0x0e, 0x50, 0x72, 0x65, 0x68,
-	0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0xe2, 0x02, 0x1a, 0x50, 0x72, 0x65,
-	0x68, 0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x5c, 0x47, 0x50, 0x42, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x50, 0x72, 0x65, 0x68, 0x6f, 0x67,
-	0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5e, 0x0a, 0x0d, 0x48, 0x65, 0x6c, 0x6c,
+	0x6f, 0x54, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x24, 0x2e, 0x70, 0x72, 0x65, 0x68,
+	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x48, 0x65, 0x6c, 0x6c, 0x6f,
+	0x54, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x25, 0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x2e, 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x54, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xc9, 0x01, 0x0a, 0x12, 0x63, 0x6f, 0x6d,
+	0x2e, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x42,
+	0x0d, 0x54, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
+	0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61,
+	0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f,
+	0x2f, 0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x3b,
+	0x70, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0xa2, 0x02, 0x03,
+	0x50, 0x58, 0x58, 0xaa, 0x02, 0x0e, 0x50, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x2e, 0x56, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0xca, 0x02, 0x0e, 0x50, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x5c, 0x56, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0xe2, 0x02, 0x1a, 0x50, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x5c, 0x56,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0xea, 0x02, 0x0f, 0x50, 0x72, 0x65, 0x68, 0x6f, 0x67, 0x3a, 0x3a, 0x56, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -5016,173 +5721,187 @@ func file_prehog_v1alpha_teleport_proto_rawDescGZIP() []byte {
 	return file_prehog_v1alpha_teleport_proto_rawDescData
 }
 
-var file_prehog_v1alpha_teleport_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
-var file_prehog_v1alpha_teleport_proto_msgTypes = make([]protoimpl.MessageInfo, 51)
+var file_prehog_v1alpha_teleport_proto_enumTypes = make([]protoimpl.EnumInfo, 8)
+var file_prehog_v1alpha_teleport_proto_msgTypes = make([]protoimpl.MessageInfo, 55)
 var file_prehog_v1alpha_teleport_proto_goTypes = []interface{}{
-	(ResourceKind)(0),                                         // 0: prehog.v1alpha.ResourceKind
-	(DiscoverResource)(0),                                     // 1: prehog.v1alpha.DiscoverResource
-	(DiscoverStatus)(0),                                       // 2: prehog.v1alpha.DiscoverStatus
-	(CTA)(0),                                                  // 3: prehog.v1alpha.CTA
-	(IntegrationEnrollKind)(0),                                // 4: prehog.v1alpha.IntegrationEnrollKind
-	(*UserLoginEvent)(nil),                                    // 5: prehog.v1alpha.UserLoginEvent
-	(*SSOCreateEvent)(nil),                                    // 6: prehog.v1alpha.SSOCreateEvent
-	(*ResourceCreateEvent)(nil),                               // 7: prehog.v1alpha.ResourceCreateEvent
-	(*ResourceHeartbeatEvent)(nil),                            // 8: prehog.v1alpha.ResourceHeartbeatEvent
-	(*SessionStartEvent)(nil),                                 // 9: prehog.v1alpha.SessionStartEvent
-	(*UserCertificateIssuedEvent)(nil),                        // 10: prehog.v1alpha.UserCertificateIssuedEvent
-	(*UIBannerClickEvent)(nil),                                // 11: prehog.v1alpha.UIBannerClickEvent
-	(*UIOnboardCompleteGoToDashboardClickEvent)(nil),          // 12: prehog.v1alpha.UIOnboardCompleteGoToDashboardClickEvent
-	(*UIOnboardAddFirstResourceClickEvent)(nil),               // 13: prehog.v1alpha.UIOnboardAddFirstResourceClickEvent
-	(*UIOnboardAddFirstResourceLaterClickEvent)(nil),          // 14: prehog.v1alpha.UIOnboardAddFirstResourceLaterClickEvent
-	(*UIOnboardSetCredentialSubmitEvent)(nil),                 // 15: prehog.v1alpha.UIOnboardSetCredentialSubmitEvent
-	(*UIOnboardRegisterChallengeSubmitEvent)(nil),             // 16: prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent
-	(*UIRecoveryCodesContinueClickEvent)(nil),                 // 17: prehog.v1alpha.UIRecoveryCodesContinueClickEvent
-	(*UIRecoveryCodesCopyClickEvent)(nil),                     // 18: prehog.v1alpha.UIRecoveryCodesCopyClickEvent
-	(*UIRecoveryCodesPrintClickEvent)(nil),                    // 19: prehog.v1alpha.UIRecoveryCodesPrintClickEvent
-	(*DiscoverMetadata)(nil),                                  // 20: prehog.v1alpha.DiscoverMetadata
-	(*DiscoverResourceMetadata)(nil),                          // 21: prehog.v1alpha.DiscoverResourceMetadata
-	(*DiscoverStepStatus)(nil),                                // 22: prehog.v1alpha.DiscoverStepStatus
-	(*UIDiscoverStartedEvent)(nil),                            // 23: prehog.v1alpha.UIDiscoverStartedEvent
-	(*UIDiscoverResourceSelectionEvent)(nil),                  // 24: prehog.v1alpha.UIDiscoverResourceSelectionEvent
-	(*UIDiscoverIntegrationAWSOIDCConnectEvent)(nil),          // 25: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent
-	(*UIDiscoverDatabaseRDSEnrollEvent)(nil),                  // 26: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent
-	(*UIDiscoverDeployServiceEvent)(nil),                      // 27: prehog.v1alpha.UIDiscoverDeployServiceEvent
-	(*UIDiscoverDatabaseRegisterEvent)(nil),                   // 28: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent
-	(*UIDiscoverDatabaseConfigureMTLSEvent)(nil),              // 29: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent
-	(*UIDiscoverDesktopActiveDirectoryToolsInstallEvent)(nil), // 30: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent
-	(*UIDiscoverDesktopActiveDirectoryConfigureEvent)(nil),    // 31: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent
-	(*UIDiscoverAutoDiscoveredResourcesEvent)(nil),            // 32: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent
-	(*UIDiscoverDatabaseConfigureIAMPolicyEvent)(nil),         // 33: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent
-	(*UIDiscoverPrincipalsConfigureEvent)(nil),                // 34: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent
-	(*UIDiscoverTestConnectionEvent)(nil),                     // 35: prehog.v1alpha.UIDiscoverTestConnectionEvent
-	(*UIDiscoverCompletedEvent)(nil),                          // 36: prehog.v1alpha.UIDiscoverCompletedEvent
-	(*RoleCreateEvent)(nil),                                   // 37: prehog.v1alpha.RoleCreateEvent
-	(*UICreateNewRoleClickEvent)(nil),                         // 38: prehog.v1alpha.UICreateNewRoleClickEvent
-	(*UICreateNewRoleSaveClickEvent)(nil),                     // 39: prehog.v1alpha.UICreateNewRoleSaveClickEvent
-	(*UICreateNewRoleCancelClickEvent)(nil),                   // 40: prehog.v1alpha.UICreateNewRoleCancelClickEvent
-	(*UICreateNewRoleViewDocumentationClickEvent)(nil),        // 41: prehog.v1alpha.UICreateNewRoleViewDocumentationClickEvent
-	(*UICallToActionClickEvent)(nil),                          // 42: prehog.v1alpha.UICallToActionClickEvent
-	(*KubeRequestEvent)(nil),                                  // 43: prehog.v1alpha.KubeRequestEvent
-	(*SFTPEvent)(nil),                                         // 44: prehog.v1alpha.SFTPEvent
-	(*AgentMetadataEvent)(nil),                                // 45: prehog.v1alpha.AgentMetadataEvent
-	(*AssistCompletionEvent)(nil),                             // 46: prehog.v1alpha.AssistCompletionEvent
-	(*IntegrationEnrollMetadata)(nil),                         // 47: prehog.v1alpha.IntegrationEnrollMetadata
-	(*UIIntegrationEnrollStartEvent)(nil),                     // 48: prehog.v1alpha.UIIntegrationEnrollStartEvent
-	(*UIIntegrationEnrollCompleteEvent)(nil),                  // 49: prehog.v1alpha.UIIntegrationEnrollCompleteEvent
-	(*SubmitEventRequest)(nil),                                // 50: prehog.v1alpha.SubmitEventRequest
-	(*SubmitEventResponse)(nil),                               // 51: prehog.v1alpha.SubmitEventResponse
-	(*SubmitEventsRequest)(nil),                               // 52: prehog.v1alpha.SubmitEventsRequest
-	(*SubmitEventsResponse)(nil),                              // 53: prehog.v1alpha.SubmitEventsResponse
-	(*HelloTeleportRequest)(nil),                              // 54: prehog.v1alpha.HelloTeleportRequest
-	(*HelloTeleportResponse)(nil),                             // 55: prehog.v1alpha.HelloTeleportResponse
-	(*durationpb.Duration)(nil),                               // 56: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),                             // 57: google.protobuf.Timestamp
+	(ResourceKind)(0),          // 0: prehog.v1alpha.ResourceKind
+	(DiscoverResource)(0),      // 1: prehog.v1alpha.DiscoverResource
+	(DiscoverStatus)(0),        // 2: prehog.v1alpha.DiscoverStatus
+	(CTA)(0),                   // 3: prehog.v1alpha.CTA
+	(IntegrationEnrollKind)(0), // 4: prehog.v1alpha.IntegrationEnrollKind
+	(EditorChangeStatus)(0),    // 5: prehog.v1alpha.EditorChangeStatus
+	(UIDiscoverDeployServiceEvent_DeployMethod)(0),            // 6: prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod
+	(UIDiscoverDeployServiceEvent_DeployType)(0),              // 7: prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType
+	(*UserLoginEvent)(nil),                                    // 8: prehog.v1alpha.UserLoginEvent
+	(*SSOCreateEvent)(nil),                                    // 9: prehog.v1alpha.SSOCreateEvent
+	(*ResourceCreateEvent)(nil),                               // 10: prehog.v1alpha.ResourceCreateEvent
+	(*ResourceHeartbeatEvent)(nil),                            // 11: prehog.v1alpha.ResourceHeartbeatEvent
+	(*SessionStartEvent)(nil),                                 // 12: prehog.v1alpha.SessionStartEvent
+	(*UserCertificateIssuedEvent)(nil),                        // 13: prehog.v1alpha.UserCertificateIssuedEvent
+	(*UIBannerClickEvent)(nil),                                // 14: prehog.v1alpha.UIBannerClickEvent
+	(*UIOnboardCompleteGoToDashboardClickEvent)(nil),          // 15: prehog.v1alpha.UIOnboardCompleteGoToDashboardClickEvent
+	(*UIOnboardAddFirstResourceClickEvent)(nil),               // 16: prehog.v1alpha.UIOnboardAddFirstResourceClickEvent
+	(*UIOnboardAddFirstResourceLaterClickEvent)(nil),          // 17: prehog.v1alpha.UIOnboardAddFirstResourceLaterClickEvent
+	(*UIOnboardSetCredentialSubmitEvent)(nil),                 // 18: prehog.v1alpha.UIOnboardSetCredentialSubmitEvent
+	(*UIOnboardRegisterChallengeSubmitEvent)(nil),             // 19: prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent
+	(*UIOnboardQuestionnaireSubmitEvent)(nil),                 // 20: prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent
+	(*UIRecoveryCodesContinueClickEvent)(nil),                 // 21: prehog.v1alpha.UIRecoveryCodesContinueClickEvent
+	(*UIRecoveryCodesCopyClickEvent)(nil),                     // 22: prehog.v1alpha.UIRecoveryCodesCopyClickEvent
+	(*UIRecoveryCodesPrintClickEvent)(nil),                    // 23: prehog.v1alpha.UIRecoveryCodesPrintClickEvent
+	(*DiscoverMetadata)(nil),                                  // 24: prehog.v1alpha.DiscoverMetadata
+	(*DiscoverResourceMetadata)(nil),                          // 25: prehog.v1alpha.DiscoverResourceMetadata
+	(*DiscoverStepStatus)(nil),                                // 26: prehog.v1alpha.DiscoverStepStatus
+	(*UIDiscoverStartedEvent)(nil),                            // 27: prehog.v1alpha.UIDiscoverStartedEvent
+	(*UIDiscoverResourceSelectionEvent)(nil),                  // 28: prehog.v1alpha.UIDiscoverResourceSelectionEvent
+	(*UIDiscoverIntegrationAWSOIDCConnectEvent)(nil),          // 29: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent
+	(*UIDiscoverDatabaseRDSEnrollEvent)(nil),                  // 30: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent
+	(*UIDiscoverDeployServiceEvent)(nil),                      // 31: prehog.v1alpha.UIDiscoverDeployServiceEvent
+	(*UIDiscoverDatabaseRegisterEvent)(nil),                   // 32: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent
+	(*UIDiscoverDatabaseConfigureMTLSEvent)(nil),              // 33: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent
+	(*UIDiscoverDesktopActiveDirectoryToolsInstallEvent)(nil), // 34: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent
+	(*UIDiscoverDesktopActiveDirectoryConfigureEvent)(nil),    // 35: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent
+	(*UIDiscoverAutoDiscoveredResourcesEvent)(nil),            // 36: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent
+	(*UIDiscoverDatabaseConfigureIAMPolicyEvent)(nil),         // 37: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent
+	(*UIDiscoverPrincipalsConfigureEvent)(nil),                // 38: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent
+	(*UIDiscoverTestConnectionEvent)(nil),                     // 39: prehog.v1alpha.UIDiscoverTestConnectionEvent
+	(*UIDiscoverCompletedEvent)(nil),                          // 40: prehog.v1alpha.UIDiscoverCompletedEvent
+	(*RoleCreateEvent)(nil),                                   // 41: prehog.v1alpha.RoleCreateEvent
+	(*BotCreateEvent)(nil),                                    // 42: prehog.v1alpha.BotCreateEvent
+	(*BotJoinEvent)(nil),                                      // 43: prehog.v1alpha.BotJoinEvent
+	(*UICreateNewRoleClickEvent)(nil),                         // 44: prehog.v1alpha.UICreateNewRoleClickEvent
+	(*UICreateNewRoleSaveClickEvent)(nil),                     // 45: prehog.v1alpha.UICreateNewRoleSaveClickEvent
+	(*UICreateNewRoleCancelClickEvent)(nil),                   // 46: prehog.v1alpha.UICreateNewRoleCancelClickEvent
+	(*UICreateNewRoleViewDocumentationClickEvent)(nil),        // 47: prehog.v1alpha.UICreateNewRoleViewDocumentationClickEvent
+	(*UICallToActionClickEvent)(nil),                          // 48: prehog.v1alpha.UICallToActionClickEvent
+	(*KubeRequestEvent)(nil),                                  // 49: prehog.v1alpha.KubeRequestEvent
+	(*SFTPEvent)(nil),                                         // 50: prehog.v1alpha.SFTPEvent
+	(*AgentMetadataEvent)(nil),                                // 51: prehog.v1alpha.AgentMetadataEvent
+	(*AssistCompletionEvent)(nil),                             // 52: prehog.v1alpha.AssistCompletionEvent
+	(*IntegrationEnrollMetadata)(nil),                         // 53: prehog.v1alpha.IntegrationEnrollMetadata
+	(*UIIntegrationEnrollStartEvent)(nil),                     // 54: prehog.v1alpha.UIIntegrationEnrollStartEvent
+	(*UIIntegrationEnrollCompleteEvent)(nil),                  // 55: prehog.v1alpha.UIIntegrationEnrollCompleteEvent
+	(*EditorChangeEvent)(nil),                                 // 56: prehog.v1alpha.EditorChangeEvent
+	(*SubmitEventRequest)(nil),                                // 57: prehog.v1alpha.SubmitEventRequest
+	(*SubmitEventResponse)(nil),                               // 58: prehog.v1alpha.SubmitEventResponse
+	(*SubmitEventsRequest)(nil),                               // 59: prehog.v1alpha.SubmitEventsRequest
+	(*SubmitEventsResponse)(nil),                              // 60: prehog.v1alpha.SubmitEventsResponse
+	(*HelloTeleportRequest)(nil),                              // 61: prehog.v1alpha.HelloTeleportRequest
+	(*HelloTeleportResponse)(nil),                             // 62: prehog.v1alpha.HelloTeleportResponse
+	(*durationpb.Duration)(nil),                               // 63: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),                             // 64: google.protobuf.Timestamp
 }
 var file_prehog_v1alpha_teleport_proto_depIdxs = []int32{
-	0,  // 0: prehog.v1alpha.ResourceHeartbeatEvent.resource_kind:type_name -> prehog.v1alpha.ResourceKind
-	56, // 1: prehog.v1alpha.UserCertificateIssuedEvent.ttl:type_name -> google.protobuf.Duration
-	1,  // 2: prehog.v1alpha.DiscoverResourceMetadata.resource:type_name -> prehog.v1alpha.DiscoverResource
-	2,  // 3: prehog.v1alpha.DiscoverStepStatus.status:type_name -> prehog.v1alpha.DiscoverStatus
-	20, // 4: prehog.v1alpha.UIDiscoverStartedEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	22, // 5: prehog.v1alpha.UIDiscoverStartedEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 6: prehog.v1alpha.UIDiscoverResourceSelectionEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 7: prehog.v1alpha.UIDiscoverResourceSelectionEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 8: prehog.v1alpha.UIDiscoverResourceSelectionEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 9: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 10: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 11: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 12: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 13: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 14: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 15: prehog.v1alpha.UIDiscoverDeployServiceEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 16: prehog.v1alpha.UIDiscoverDeployServiceEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 17: prehog.v1alpha.UIDiscoverDeployServiceEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 18: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 19: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 20: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 21: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 22: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 23: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 24: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 25: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 26: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 27: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 28: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 29: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 30: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 31: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 32: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 33: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 34: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 35: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 36: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 37: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 38: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 39: prehog.v1alpha.UIDiscoverTestConnectionEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 40: prehog.v1alpha.UIDiscoverTestConnectionEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 41: prehog.v1alpha.UIDiscoverTestConnectionEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	20, // 42: prehog.v1alpha.UIDiscoverCompletedEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
-	21, // 43: prehog.v1alpha.UIDiscoverCompletedEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
-	22, // 44: prehog.v1alpha.UIDiscoverCompletedEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
-	3,  // 45: prehog.v1alpha.UICallToActionClickEvent.cta:type_name -> prehog.v1alpha.CTA
-	4,  // 46: prehog.v1alpha.IntegrationEnrollMetadata.kind:type_name -> prehog.v1alpha.IntegrationEnrollKind
-	47, // 47: prehog.v1alpha.UIIntegrationEnrollStartEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
-	47, // 48: prehog.v1alpha.UIIntegrationEnrollCompleteEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
-	57, // 49: prehog.v1alpha.SubmitEventRequest.timestamp:type_name -> google.protobuf.Timestamp
-	5,  // 50: prehog.v1alpha.SubmitEventRequest.user_login:type_name -> prehog.v1alpha.UserLoginEvent
-	6,  // 51: prehog.v1alpha.SubmitEventRequest.sso_create:type_name -> prehog.v1alpha.SSOCreateEvent
-	7,  // 52: prehog.v1alpha.SubmitEventRequest.resource_create:type_name -> prehog.v1alpha.ResourceCreateEvent
-	9,  // 53: prehog.v1alpha.SubmitEventRequest.session_start:type_name -> prehog.v1alpha.SessionStartEvent
-	11, // 54: prehog.v1alpha.SubmitEventRequest.ui_banner_click:type_name -> prehog.v1alpha.UIBannerClickEvent
-	12, // 55: prehog.v1alpha.SubmitEventRequest.ui_onboard_complete_go_to_dashboard_click:type_name -> prehog.v1alpha.UIOnboardCompleteGoToDashboardClickEvent
-	13, // 56: prehog.v1alpha.SubmitEventRequest.ui_onboard_add_first_resource_click:type_name -> prehog.v1alpha.UIOnboardAddFirstResourceClickEvent
-	14, // 57: prehog.v1alpha.SubmitEventRequest.ui_onboard_add_first_resource_later_click:type_name -> prehog.v1alpha.UIOnboardAddFirstResourceLaterClickEvent
-	15, // 58: prehog.v1alpha.SubmitEventRequest.ui_onboard_set_credential_submit:type_name -> prehog.v1alpha.UIOnboardSetCredentialSubmitEvent
-	16, // 59: prehog.v1alpha.SubmitEventRequest.ui_onboard_register_challenge_submit:type_name -> prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent
-	17, // 60: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_continue_click:type_name -> prehog.v1alpha.UIRecoveryCodesContinueClickEvent
-	18, // 61: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_copy_click:type_name -> prehog.v1alpha.UIRecoveryCodesCopyClickEvent
-	19, // 62: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_print_click:type_name -> prehog.v1alpha.UIRecoveryCodesPrintClickEvent
-	23, // 63: prehog.v1alpha.SubmitEventRequest.ui_discover_started_event:type_name -> prehog.v1alpha.UIDiscoverStartedEvent
-	24, // 64: prehog.v1alpha.SubmitEventRequest.ui_discover_resource_selection_event:type_name -> prehog.v1alpha.UIDiscoverResourceSelectionEvent
-	10, // 65: prehog.v1alpha.SubmitEventRequest.user_certificate_issued_event:type_name -> prehog.v1alpha.UserCertificateIssuedEvent
-	9,  // 66: prehog.v1alpha.SubmitEventRequest.session_start_v2:type_name -> prehog.v1alpha.SessionStartEvent
-	27, // 67: prehog.v1alpha.SubmitEventRequest.ui_discover_deploy_service_event:type_name -> prehog.v1alpha.UIDiscoverDeployServiceEvent
-	28, // 68: prehog.v1alpha.SubmitEventRequest.ui_discover_database_register_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseRegisterEvent
-	29, // 69: prehog.v1alpha.SubmitEventRequest.ui_discover_database_configure_mtls_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent
-	30, // 70: prehog.v1alpha.SubmitEventRequest.ui_discover_desktop_active_directory_tools_install_event:type_name -> prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent
-	31, // 71: prehog.v1alpha.SubmitEventRequest.ui_discover_desktop_active_directory_configure_event:type_name -> prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent
-	32, // 72: prehog.v1alpha.SubmitEventRequest.ui_discover_auto_discovered_resources_event:type_name -> prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent
-	33, // 73: prehog.v1alpha.SubmitEventRequest.ui_discover_database_configure_iam_policy_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent
-	34, // 74: prehog.v1alpha.SubmitEventRequest.ui_discover_principals_configure_event:type_name -> prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent
-	35, // 75: prehog.v1alpha.SubmitEventRequest.ui_discover_test_connection_event:type_name -> prehog.v1alpha.UIDiscoverTestConnectionEvent
-	36, // 76: prehog.v1alpha.SubmitEventRequest.ui_discover_completed_event:type_name -> prehog.v1alpha.UIDiscoverCompletedEvent
-	37, // 77: prehog.v1alpha.SubmitEventRequest.role_create:type_name -> prehog.v1alpha.RoleCreateEvent
-	38, // 78: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_click:type_name -> prehog.v1alpha.UICreateNewRoleClickEvent
-	39, // 79: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_save_click:type_name -> prehog.v1alpha.UICreateNewRoleSaveClickEvent
-	40, // 80: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_cancel_click:type_name -> prehog.v1alpha.UICreateNewRoleCancelClickEvent
-	41, // 81: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_view_documentation_click:type_name -> prehog.v1alpha.UICreateNewRoleViewDocumentationClickEvent
-	43, // 82: prehog.v1alpha.SubmitEventRequest.kube_request:type_name -> prehog.v1alpha.KubeRequestEvent
-	44, // 83: prehog.v1alpha.SubmitEventRequest.sftp:type_name -> prehog.v1alpha.SFTPEvent
-	45, // 84: prehog.v1alpha.SubmitEventRequest.agent_metadata_event:type_name -> prehog.v1alpha.AgentMetadataEvent
-	8,  // 85: prehog.v1alpha.SubmitEventRequest.resource_heartbeat:type_name -> prehog.v1alpha.ResourceHeartbeatEvent
-	25, // 86: prehog.v1alpha.SubmitEventRequest.ui_discover_integration_aws_oidc_connect_event:type_name -> prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent
-	26, // 87: prehog.v1alpha.SubmitEventRequest.ui_discover_database_rds_enroll_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent
-	42, // 88: prehog.v1alpha.SubmitEventRequest.ui_call_to_action_click_event:type_name -> prehog.v1alpha.UICallToActionClickEvent
-	46, // 89: prehog.v1alpha.SubmitEventRequest.assist_completion:type_name -> prehog.v1alpha.AssistCompletionEvent
-	48, // 90: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_start_event:type_name -> prehog.v1alpha.UIIntegrationEnrollStartEvent
-	49, // 91: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_complete_event:type_name -> prehog.v1alpha.UIIntegrationEnrollCompleteEvent
-	50, // 92: prehog.v1alpha.SubmitEventsRequest.events:type_name -> prehog.v1alpha.SubmitEventRequest
-	50, // 93: prehog.v1alpha.TeleportReportingService.SubmitEvent:input_type -> prehog.v1alpha.SubmitEventRequest
-	52, // 94: prehog.v1alpha.TeleportReportingService.SubmitEvents:input_type -> prehog.v1alpha.SubmitEventsRequest
-	54, // 95: prehog.v1alpha.TeleportReportingService.HelloTeleport:input_type -> prehog.v1alpha.HelloTeleportRequest
-	51, // 96: prehog.v1alpha.TeleportReportingService.SubmitEvent:output_type -> prehog.v1alpha.SubmitEventResponse
-	53, // 97: prehog.v1alpha.TeleportReportingService.SubmitEvents:output_type -> prehog.v1alpha.SubmitEventsResponse
-	55, // 98: prehog.v1alpha.TeleportReportingService.HelloTeleport:output_type -> prehog.v1alpha.HelloTeleportResponse
-	96, // [96:99] is the sub-list for method output_type
-	93, // [93:96] is the sub-list for method input_type
-	93, // [93:93] is the sub-list for extension type_name
-	93, // [93:93] is the sub-list for extension extendee
-	0,  // [0:93] is the sub-list for field type_name
+	0,   // 0: prehog.v1alpha.ResourceHeartbeatEvent.resource_kind:type_name -> prehog.v1alpha.ResourceKind
+	63,  // 1: prehog.v1alpha.UserCertificateIssuedEvent.ttl:type_name -> google.protobuf.Duration
+	1,   // 2: prehog.v1alpha.DiscoverResourceMetadata.resource:type_name -> prehog.v1alpha.DiscoverResource
+	2,   // 3: prehog.v1alpha.DiscoverStepStatus.status:type_name -> prehog.v1alpha.DiscoverStatus
+	24,  // 4: prehog.v1alpha.UIDiscoverStartedEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	26,  // 5: prehog.v1alpha.UIDiscoverStartedEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 6: prehog.v1alpha.UIDiscoverResourceSelectionEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 7: prehog.v1alpha.UIDiscoverResourceSelectionEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 8: prehog.v1alpha.UIDiscoverResourceSelectionEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 9: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 10: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 11: prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 12: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 13: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 14: prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 15: prehog.v1alpha.UIDiscoverDeployServiceEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 16: prehog.v1alpha.UIDiscoverDeployServiceEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 17: prehog.v1alpha.UIDiscoverDeployServiceEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	6,   // 18: prehog.v1alpha.UIDiscoverDeployServiceEvent.deploy_method:type_name -> prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod
+	7,   // 19: prehog.v1alpha.UIDiscoverDeployServiceEvent.deploy_type:type_name -> prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType
+	24,  // 20: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 21: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 22: prehog.v1alpha.UIDiscoverDatabaseRegisterEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 23: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 24: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 25: prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 26: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 27: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 28: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 29: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 30: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 31: prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 32: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 33: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 34: prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 35: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 36: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 37: prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 38: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 39: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 40: prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 41: prehog.v1alpha.UIDiscoverTestConnectionEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 42: prehog.v1alpha.UIDiscoverTestConnectionEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 43: prehog.v1alpha.UIDiscoverTestConnectionEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	24,  // 44: prehog.v1alpha.UIDiscoverCompletedEvent.metadata:type_name -> prehog.v1alpha.DiscoverMetadata
+	25,  // 45: prehog.v1alpha.UIDiscoverCompletedEvent.resource:type_name -> prehog.v1alpha.DiscoverResourceMetadata
+	26,  // 46: prehog.v1alpha.UIDiscoverCompletedEvent.status:type_name -> prehog.v1alpha.DiscoverStepStatus
+	3,   // 47: prehog.v1alpha.UICallToActionClickEvent.cta:type_name -> prehog.v1alpha.CTA
+	4,   // 48: prehog.v1alpha.IntegrationEnrollMetadata.kind:type_name -> prehog.v1alpha.IntegrationEnrollKind
+	53,  // 49: prehog.v1alpha.UIIntegrationEnrollStartEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
+	53,  // 50: prehog.v1alpha.UIIntegrationEnrollCompleteEvent.metadata:type_name -> prehog.v1alpha.IntegrationEnrollMetadata
+	5,   // 51: prehog.v1alpha.EditorChangeEvent.status:type_name -> prehog.v1alpha.EditorChangeStatus
+	64,  // 52: prehog.v1alpha.SubmitEventRequest.timestamp:type_name -> google.protobuf.Timestamp
+	8,   // 53: prehog.v1alpha.SubmitEventRequest.user_login:type_name -> prehog.v1alpha.UserLoginEvent
+	9,   // 54: prehog.v1alpha.SubmitEventRequest.sso_create:type_name -> prehog.v1alpha.SSOCreateEvent
+	10,  // 55: prehog.v1alpha.SubmitEventRequest.resource_create:type_name -> prehog.v1alpha.ResourceCreateEvent
+	12,  // 56: prehog.v1alpha.SubmitEventRequest.session_start:type_name -> prehog.v1alpha.SessionStartEvent
+	14,  // 57: prehog.v1alpha.SubmitEventRequest.ui_banner_click:type_name -> prehog.v1alpha.UIBannerClickEvent
+	15,  // 58: prehog.v1alpha.SubmitEventRequest.ui_onboard_complete_go_to_dashboard_click:type_name -> prehog.v1alpha.UIOnboardCompleteGoToDashboardClickEvent
+	16,  // 59: prehog.v1alpha.SubmitEventRequest.ui_onboard_add_first_resource_click:type_name -> prehog.v1alpha.UIOnboardAddFirstResourceClickEvent
+	17,  // 60: prehog.v1alpha.SubmitEventRequest.ui_onboard_add_first_resource_later_click:type_name -> prehog.v1alpha.UIOnboardAddFirstResourceLaterClickEvent
+	18,  // 61: prehog.v1alpha.SubmitEventRequest.ui_onboard_set_credential_submit:type_name -> prehog.v1alpha.UIOnboardSetCredentialSubmitEvent
+	19,  // 62: prehog.v1alpha.SubmitEventRequest.ui_onboard_register_challenge_submit:type_name -> prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent
+	21,  // 63: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_continue_click:type_name -> prehog.v1alpha.UIRecoveryCodesContinueClickEvent
+	22,  // 64: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_copy_click:type_name -> prehog.v1alpha.UIRecoveryCodesCopyClickEvent
+	23,  // 65: prehog.v1alpha.SubmitEventRequest.ui_recovery_codes_print_click:type_name -> prehog.v1alpha.UIRecoveryCodesPrintClickEvent
+	27,  // 66: prehog.v1alpha.SubmitEventRequest.ui_discover_started_event:type_name -> prehog.v1alpha.UIDiscoverStartedEvent
+	28,  // 67: prehog.v1alpha.SubmitEventRequest.ui_discover_resource_selection_event:type_name -> prehog.v1alpha.UIDiscoverResourceSelectionEvent
+	13,  // 68: prehog.v1alpha.SubmitEventRequest.user_certificate_issued_event:type_name -> prehog.v1alpha.UserCertificateIssuedEvent
+	12,  // 69: prehog.v1alpha.SubmitEventRequest.session_start_v2:type_name -> prehog.v1alpha.SessionStartEvent
+	31,  // 70: prehog.v1alpha.SubmitEventRequest.ui_discover_deploy_service_event:type_name -> prehog.v1alpha.UIDiscoverDeployServiceEvent
+	32,  // 71: prehog.v1alpha.SubmitEventRequest.ui_discover_database_register_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseRegisterEvent
+	33,  // 72: prehog.v1alpha.SubmitEventRequest.ui_discover_database_configure_mtls_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent
+	34,  // 73: prehog.v1alpha.SubmitEventRequest.ui_discover_desktop_active_directory_tools_install_event:type_name -> prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent
+	35,  // 74: prehog.v1alpha.SubmitEventRequest.ui_discover_desktop_active_directory_configure_event:type_name -> prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent
+	36,  // 75: prehog.v1alpha.SubmitEventRequest.ui_discover_auto_discovered_resources_event:type_name -> prehog.v1alpha.UIDiscoverAutoDiscoveredResourcesEvent
+	37,  // 76: prehog.v1alpha.SubmitEventRequest.ui_discover_database_configure_iam_policy_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseConfigureIAMPolicyEvent
+	38,  // 77: prehog.v1alpha.SubmitEventRequest.ui_discover_principals_configure_event:type_name -> prehog.v1alpha.UIDiscoverPrincipalsConfigureEvent
+	39,  // 78: prehog.v1alpha.SubmitEventRequest.ui_discover_test_connection_event:type_name -> prehog.v1alpha.UIDiscoverTestConnectionEvent
+	40,  // 79: prehog.v1alpha.SubmitEventRequest.ui_discover_completed_event:type_name -> prehog.v1alpha.UIDiscoverCompletedEvent
+	41,  // 80: prehog.v1alpha.SubmitEventRequest.role_create:type_name -> prehog.v1alpha.RoleCreateEvent
+	44,  // 81: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_click:type_name -> prehog.v1alpha.UICreateNewRoleClickEvent
+	45,  // 82: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_save_click:type_name -> prehog.v1alpha.UICreateNewRoleSaveClickEvent
+	46,  // 83: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_cancel_click:type_name -> prehog.v1alpha.UICreateNewRoleCancelClickEvent
+	47,  // 84: prehog.v1alpha.SubmitEventRequest.ui_create_new_role_view_documentation_click:type_name -> prehog.v1alpha.UICreateNewRoleViewDocumentationClickEvent
+	49,  // 85: prehog.v1alpha.SubmitEventRequest.kube_request:type_name -> prehog.v1alpha.KubeRequestEvent
+	50,  // 86: prehog.v1alpha.SubmitEventRequest.sftp:type_name -> prehog.v1alpha.SFTPEvent
+	51,  // 87: prehog.v1alpha.SubmitEventRequest.agent_metadata_event:type_name -> prehog.v1alpha.AgentMetadataEvent
+	11,  // 88: prehog.v1alpha.SubmitEventRequest.resource_heartbeat:type_name -> prehog.v1alpha.ResourceHeartbeatEvent
+	29,  // 89: prehog.v1alpha.SubmitEventRequest.ui_discover_integration_aws_oidc_connect_event:type_name -> prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent
+	30,  // 90: prehog.v1alpha.SubmitEventRequest.ui_discover_database_rds_enroll_event:type_name -> prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent
+	48,  // 91: prehog.v1alpha.SubmitEventRequest.ui_call_to_action_click_event:type_name -> prehog.v1alpha.UICallToActionClickEvent
+	52,  // 92: prehog.v1alpha.SubmitEventRequest.assist_completion:type_name -> prehog.v1alpha.AssistCompletionEvent
+	54,  // 93: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_start_event:type_name -> prehog.v1alpha.UIIntegrationEnrollStartEvent
+	55,  // 94: prehog.v1alpha.SubmitEventRequest.ui_integration_enroll_complete_event:type_name -> prehog.v1alpha.UIIntegrationEnrollCompleteEvent
+	56,  // 95: prehog.v1alpha.SubmitEventRequest.editor_change_event:type_name -> prehog.v1alpha.EditorChangeEvent
+	42,  // 96: prehog.v1alpha.SubmitEventRequest.bot_create:type_name -> prehog.v1alpha.BotCreateEvent
+	20,  // 97: prehog.v1alpha.SubmitEventRequest.ui_onboard_questionnaire_submit:type_name -> prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent
+	43,  // 98: prehog.v1alpha.SubmitEventRequest.bot_join:type_name -> prehog.v1alpha.BotJoinEvent
+	57,  // 99: prehog.v1alpha.SubmitEventsRequest.events:type_name -> prehog.v1alpha.SubmitEventRequest
+	57,  // 100: prehog.v1alpha.TeleportReportingService.SubmitEvent:input_type -> prehog.v1alpha.SubmitEventRequest
+	59,  // 101: prehog.v1alpha.TeleportReportingService.SubmitEvents:input_type -> prehog.v1alpha.SubmitEventsRequest
+	61,  // 102: prehog.v1alpha.TeleportReportingService.HelloTeleport:input_type -> prehog.v1alpha.HelloTeleportRequest
+	58,  // 103: prehog.v1alpha.TeleportReportingService.SubmitEvent:output_type -> prehog.v1alpha.SubmitEventResponse
+	60,  // 104: prehog.v1alpha.TeleportReportingService.SubmitEvents:output_type -> prehog.v1alpha.SubmitEventsResponse
+	62,  // 105: prehog.v1alpha.TeleportReportingService.HelloTeleport:output_type -> prehog.v1alpha.HelloTeleportResponse
+	103, // [103:106] is the sub-list for method output_type
+	100, // [100:103] is the sub-list for method input_type
+	100, // [100:100] is the sub-list for extension type_name
+	100, // [100:100] is the sub-list for extension extendee
+	0,   // [0:100] is the sub-list for field type_name
 }
 
 func init() { file_prehog_v1alpha_teleport_proto_init() }
@@ -5336,7 +6055,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIRecoveryCodesContinueClickEvent); i {
+			switch v := v.(*UIOnboardQuestionnaireSubmitEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5348,7 +6067,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIRecoveryCodesCopyClickEvent); i {
+			switch v := v.(*UIRecoveryCodesContinueClickEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5360,7 +6079,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIRecoveryCodesPrintClickEvent); i {
+			switch v := v.(*UIRecoveryCodesCopyClickEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5372,7 +6091,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DiscoverMetadata); i {
+			switch v := v.(*UIRecoveryCodesPrintClickEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5384,7 +6103,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DiscoverResourceMetadata); i {
+			switch v := v.(*DiscoverMetadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5396,7 +6115,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DiscoverStepStatus); i {
+			switch v := v.(*DiscoverResourceMetadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5408,7 +6127,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverStartedEvent); i {
+			switch v := v.(*DiscoverStepStatus); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5420,7 +6139,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverResourceSelectionEvent); i {
+			switch v := v.(*UIDiscoverStartedEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5432,7 +6151,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverIntegrationAWSOIDCConnectEvent); i {
+			switch v := v.(*UIDiscoverResourceSelectionEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5444,7 +6163,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverDatabaseRDSEnrollEvent); i {
+			switch v := v.(*UIDiscoverIntegrationAWSOIDCConnectEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5456,7 +6175,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverDeployServiceEvent); i {
+			switch v := v.(*UIDiscoverDatabaseRDSEnrollEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5468,7 +6187,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverDatabaseRegisterEvent); i {
+			switch v := v.(*UIDiscoverDeployServiceEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5480,7 +6199,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverDatabaseConfigureMTLSEvent); i {
+			switch v := v.(*UIDiscoverDatabaseRegisterEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5492,7 +6211,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverDesktopActiveDirectoryToolsInstallEvent); i {
+			switch v := v.(*UIDiscoverDatabaseConfigureMTLSEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5504,7 +6223,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverDesktopActiveDirectoryConfigureEvent); i {
+			switch v := v.(*UIDiscoverDesktopActiveDirectoryToolsInstallEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5516,7 +6235,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverAutoDiscoveredResourcesEvent); i {
+			switch v := v.(*UIDiscoverDesktopActiveDirectoryConfigureEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5528,7 +6247,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverDatabaseConfigureIAMPolicyEvent); i {
+			switch v := v.(*UIDiscoverAutoDiscoveredResourcesEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5540,7 +6259,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverPrincipalsConfigureEvent); i {
+			switch v := v.(*UIDiscoverDatabaseConfigureIAMPolicyEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5552,7 +6271,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverTestConnectionEvent); i {
+			switch v := v.(*UIDiscoverPrincipalsConfigureEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5564,7 +6283,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIDiscoverCompletedEvent); i {
+			switch v := v.(*UIDiscoverTestConnectionEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5576,7 +6295,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RoleCreateEvent); i {
+			switch v := v.(*UIDiscoverCompletedEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5588,7 +6307,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UICreateNewRoleClickEvent); i {
+			switch v := v.(*RoleCreateEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5600,7 +6319,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UICreateNewRoleSaveClickEvent); i {
+			switch v := v.(*BotCreateEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5612,7 +6331,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UICreateNewRoleCancelClickEvent); i {
+			switch v := v.(*BotJoinEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5624,7 +6343,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UICreateNewRoleViewDocumentationClickEvent); i {
+			switch v := v.(*UICreateNewRoleClickEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5636,7 +6355,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UICallToActionClickEvent); i {
+			switch v := v.(*UICreateNewRoleSaveClickEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5648,7 +6367,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*KubeRequestEvent); i {
+			switch v := v.(*UICreateNewRoleCancelClickEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5660,7 +6379,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[39].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SFTPEvent); i {
+			switch v := v.(*UICreateNewRoleViewDocumentationClickEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5672,7 +6391,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[40].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AgentMetadataEvent); i {
+			switch v := v.(*UICallToActionClickEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5684,7 +6403,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[41].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AssistCompletionEvent); i {
+			switch v := v.(*KubeRequestEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5696,7 +6415,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[42].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*IntegrationEnrollMetadata); i {
+			switch v := v.(*SFTPEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5708,7 +6427,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[43].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIIntegrationEnrollStartEvent); i {
+			switch v := v.(*AgentMetadataEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5720,7 +6439,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[44].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UIIntegrationEnrollCompleteEvent); i {
+			switch v := v.(*AssistCompletionEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5732,7 +6451,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[45].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SubmitEventRequest); i {
+			switch v := v.(*IntegrationEnrollMetadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5744,7 +6463,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[46].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SubmitEventResponse); i {
+			switch v := v.(*UIIntegrationEnrollStartEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5756,7 +6475,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SubmitEventsRequest); i {
+			switch v := v.(*UIIntegrationEnrollCompleteEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5768,7 +6487,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SubmitEventsResponse); i {
+			switch v := v.(*EditorChangeEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5780,7 +6499,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HelloTeleportRequest); i {
+			switch v := v.(*SubmitEventRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5792,6 +6511,54 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 		file_prehog_v1alpha_teleport_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SubmitEventResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_prehog_v1alpha_teleport_proto_msgTypes[51].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SubmitEventsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_prehog_v1alpha_teleport_proto_msgTypes[52].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SubmitEventsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_prehog_v1alpha_teleport_proto_msgTypes[53].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HelloTeleportRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_prehog_v1alpha_teleport_proto_msgTypes[54].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*HelloTeleportResponse); i {
 			case 0:
 				return &v.state
@@ -5804,7 +6571,7 @@ func file_prehog_v1alpha_teleport_proto_init() {
 			}
 		}
 	}
-	file_prehog_v1alpha_teleport_proto_msgTypes[45].OneofWrappers = []interface{}{
+	file_prehog_v1alpha_teleport_proto_msgTypes[49].OneofWrappers = []interface{}{
 		(*SubmitEventRequest_UserLogin)(nil),
 		(*SubmitEventRequest_SsoCreate)(nil),
 		(*SubmitEventRequest_ResourceCreate)(nil),
@@ -5847,14 +6614,18 @@ func file_prehog_v1alpha_teleport_proto_init() {
 		(*SubmitEventRequest_AssistCompletion)(nil),
 		(*SubmitEventRequest_UiIntegrationEnrollStartEvent)(nil),
 		(*SubmitEventRequest_UiIntegrationEnrollCompleteEvent)(nil),
+		(*SubmitEventRequest_EditorChangeEvent)(nil),
+		(*SubmitEventRequest_BotCreate)(nil),
+		(*SubmitEventRequest_UiOnboardQuestionnaireSubmit)(nil),
+		(*SubmitEventRequest_BotJoin)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_prehog_v1alpha_teleport_proto_rawDesc,
-			NumEnums:      5,
-			NumMessages:   51,
+			NumEnums:      8,
+			NumMessages:   55,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/access_request.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/access_request.pb.go
index 7a7a5be0c592b..8dbe0b4d4e3ef 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/access_request.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/access_request.pb.go
@@ -343,7 +343,8 @@ type ResourceDetails struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Hostname string `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	Hostname     string `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	FriendlyName string `protobuf:"bytes,2,opt,name=friendly_name,json=friendlyName,proto3" json:"friendly_name,omitempty"`
 }
 
 func (x *ResourceDetails) Reset() {
@@ -385,6 +386,13 @@ func (x *ResourceDetails) GetHostname() string {
 	return ""
 }
 
+func (x *ResourceDetails) GetFriendlyName() string {
+	if x != nil {
+		return x.FriendlyName
+	}
+	return ""
+}
+
 type Resource struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -505,24 +513,26 @@ var file_teleport_lib_teleterm_v1_access_request_proto_rawDesc = []byte{
 	0x73, 0x74, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2a, 0x0a, 0x11, 0x73, 0x75, 0x62, 0x5f,
 	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20,
 	0x01, 0x28, 0x09, 0x52, 0x0f, 0x73, 0x75, 0x62, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x4e, 0x61, 0x6d, 0x65, 0x22, 0x2d, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x4e, 0x61, 0x6d, 0x65, 0x22, 0x52, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
 	0x44, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e,
 	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e,
-	0x61, 0x6d, 0x65, 0x22, 0x85, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x12, 0x34, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74,
+	0x61, 0x6d, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x66, 0x72, 0x69, 0x65, 0x6e, 0x64, 0x6c, 0x79, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x66, 0x72, 0x69, 0x65,
+	0x6e, 0x64, 0x6c, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x85, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x34, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62,
+	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x07, 0x64,
+	0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x74,
 	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65,
 	0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c,
-	0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
-	0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e,
-	0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x44, 0x65, 0x74, 0x61, 0x69,
-	0x6c, 0x73, 0x52, 0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x42, 0x54, 0x5a, 0x52, 0x67,
-	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
-	0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65,
-	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x6c, 0x69, 0x62, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x72, 0x6d, 0x2f, 0x76, 0x31, 0x3b, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x76,
-	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x44, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x52, 0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73,
+	0x42, 0x54, 0x5a, 0x52, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67,
+	0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
+	0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x6c, 0x69, 0x62, 0x2f,
+	0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2f, 0x76, 0x31, 0x3b, 0x74, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x72, 0x6d, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/cluster.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/cluster.pb.go
index 2e7b5ee9bdef6..d6804c21933b4 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/cluster.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/cluster.pb.go
@@ -261,8 +261,6 @@ type ACL struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// sessions defines access to recorded sessions
-	Sessions *ResourceAccess `protobuf:"bytes,1,opt,name=sessions,proto3" json:"sessions,omitempty"`
 	// auth_connectors defines access to auth.connectors
 	AuthConnectors *ResourceAccess `protobuf:"bytes,2,opt,name=auth_connectors,json=authConnectors,proto3" json:"auth_connectors,omitempty"`
 	// Roles defines access to roles
@@ -285,6 +283,10 @@ type ACL struct {
 	Kubeservers *ResourceAccess `protobuf:"bytes,11,opt,name=kubeservers,proto3" json:"kubeservers,omitempty"`
 	// access_requests defines access to access requests
 	AccessRequests *ResourceAccess `protobuf:"bytes,12,opt,name=access_requests,json=accessRequests,proto3" json:"access_requests,omitempty"`
+	// recorded_sessions defines access to recorded sessions.
+	RecordedSessions *ResourceAccess `protobuf:"bytes,13,opt,name=recorded_sessions,json=recordedSessions,proto3" json:"recorded_sessions,omitempty"`
+	// active_sessions defines access to active sessions.
+	ActiveSessions *ResourceAccess `protobuf:"bytes,14,opt,name=active_sessions,json=activeSessions,proto3" json:"active_sessions,omitempty"`
 }
 
 func (x *ACL) Reset() {
@@ -319,13 +321,6 @@ func (*ACL) Descriptor() ([]byte, []int) {
 	return file_teleport_lib_teleterm_v1_cluster_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *ACL) GetSessions() *ResourceAccess {
-	if x != nil {
-		return x.Sessions
-	}
-	return nil
-}
-
 func (x *ACL) GetAuthConnectors() *ResourceAccess {
 	if x != nil {
 		return x.AuthConnectors
@@ -403,6 +398,20 @@ func (x *ACL) GetAccessRequests() *ResourceAccess {
 	return nil
 }
 
+func (x *ACL) GetRecordedSessions() *ResourceAccess {
+	if x != nil {
+		return x.RecordedSessions
+	}
+	return nil
+}
+
+func (x *ACL) GetActiveSessions() *ResourceAccess {
+	if x != nil {
+		return x.ActiveSessions
+	}
+	return nil
+}
+
 // ResourceAccess describes access verbs
 type ResourceAccess struct {
 	state         protoimpl.MessageState
@@ -419,6 +428,8 @@ type ResourceAccess struct {
 	Create bool `protobuf:"varint,4,opt,name=create,proto3" json:"create,omitempty"`
 	// delete determines "delete" access
 	Delete bool `protobuf:"varint,5,opt,name=delete,proto3" json:"delete,omitempty"`
+	// use determines "use" access
+	Use bool `protobuf:"varint,6,opt,name=use,proto3" json:"use,omitempty"`
 }
 
 func (x *ResourceAccess) Reset() {
@@ -488,14 +499,23 @@ func (x *ResourceAccess) GetDelete() bool {
 	return false
 }
 
+func (x *ResourceAccess) GetUse() bool {
+	if x != nil {
+		return x.Use
+	}
+	return false
+}
+
 // Features describes the auth servers features
 type Features struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// AdvancedAccessWorkflows enables search-based access requests
+	// advanced_access_workflows enables search-based access requests
 	AdvancedAccessWorkflows bool `protobuf:"varint,1,opt,name=advanced_access_workflows,json=advancedAccessWorkflows,proto3" json:"advanced_access_workflows,omitempty"`
+	// is_usage_based_billing determines if the cloud user subscription is usage-based (pay-as-you-go).
+	IsUsageBasedBilling bool `protobuf:"varint,2,opt,name=is_usage_based_billing,json=isUsageBasedBilling,proto3" json:"is_usage_based_billing,omitempty"`
 }
 
 func (x *Features) Reset() {
@@ -537,6 +557,13 @@ func (x *Features) GetAdvancedAccessWorkflows() bool {
 	return false
 }
 
+func (x *Features) GetIsUsageBasedBilling() bool {
+	if x != nil {
+		return x.IsUsageBasedBilling
+	}
+	return false
+}
+
 var File_teleport_lib_teleterm_v1_cluster_proto protoreflect.FileDescriptor
 
 var file_teleport_lib_teleterm_v1_cluster_proto_rawDesc = []byte{
@@ -580,79 +607,91 @@ var file_teleport_lib_teleterm_v1_cluster_proto_rawDesc = []byte{
 	0x67, 0x67, 0x65, 0x73, 0x74, 0x65, 0x64, 0x52, 0x65, 0x76, 0x69, 0x65, 0x77, 0x65, 0x72, 0x73,
 	0x12, 0x2b, 0x0a, 0x11, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x5f,
 	0x72, 0x6f, 0x6c, 0x65, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x72, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x6c, 0x65, 0x73, 0x22, 0xd4, 0x06,
-	0x0a, 0x03, 0x41, 0x43, 0x4c, 0x12, 0x44, 0x0a, 0x08, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
+	0x75, 0x65, 0x73, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x6c, 0x65, 0x73, 0x22, 0xc8, 0x07,
+	0x0a, 0x03, 0x41, 0x43, 0x4c, 0x12, 0x51, 0x0a, 0x0f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28,
+	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x43, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x12, 0x3e, 0x0a, 0x05, 0x72, 0x6f, 0x6c, 0x65,
+	0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
 	0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e,
 	0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x52, 0x08, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x51, 0x0a, 0x0f, 0x61,
-	0x75, 0x74, 0x68, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
-	0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0e,
-	0x61, 0x75, 0x74, 0x68, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x12, 0x3e,
-	0x0a, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e,
-	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x12, 0x3e,
-	0x0a, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e,
+	0x73, 0x52, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x05, 0x75, 0x73, 0x65, 0x72,
+	0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e,
+	0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x52, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x12, 0x53, 0x0a, 0x10, 0x74, 0x72, 0x75, 0x73,
+	0x74, 0x65, 0x64, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69,
+	0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0f, 0x74, 0x72,
+	0x75, 0x73, 0x74, 0x65, 0x64, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x12, 0x40, 0x0a,
+	0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e,
 	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c,
 	0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x12, 0x53,
-	0x0a, 0x10, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65,
-	0x72, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d,
-	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x52, 0x0f, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x43, 0x6c, 0x75, 0x73, 0x74,
-	0x65, 0x72, 0x73, 0x12, 0x40, 0x0a, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x06, 0x20,
+	0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x12,
+	0x40, 0x0a, 0x06, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x06, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
+	0x73, 0x12, 0x42, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x08, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69,
+	0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x07, 0x73, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x3c, 0x0a, 0x04, 0x61, 0x70, 0x70, 0x73, 0x18, 0x09, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c,
 	0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x06, 0x65,
-	0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x40, 0x0a, 0x06, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
-	0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31,
-	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52,
-	0x06, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x42, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d,
-	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x52, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x3c, 0x0a, 0x04, 0x61,
-	0x70, 0x70, 0x73, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x04, 0x61,
+	0x70, 0x70, 0x73, 0x12, 0x3a, 0x0a, 0x03, 0x64, 0x62, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e,
+	0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x03, 0x64, 0x62, 0x73, 0x12,
+	0x4a, 0x0a, 0x0b, 0x6b, 0x75, 0x62, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x0b,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
+	0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0b,
+	0x6b, 0x75, 0x62, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x51, 0x0a, 0x0f, 0x61,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x0c,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
+	0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0e,
+	0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x12, 0x55,
+	0x0a, 0x11, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x65, 0x64, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65,
 	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72,
 	0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63,
-	0x65, 0x73, 0x73, 0x52, 0x04, 0x61, 0x70, 0x70, 0x73, 0x12, 0x3a, 0x0a, 0x03, 0x64, 0x62, 0x73,
-	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
-	0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76,
-	0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x52, 0x03, 0x64, 0x62, 0x73, 0x12, 0x4a, 0x0a, 0x0b, 0x6b, 0x75, 0x62, 0x65, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x52, 0x0b, 0x6b, 0x75, 0x62, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x73, 0x12, 0x51, 0x0a, 0x0f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x72, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x52, 0x0e, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x73, 0x22, 0x7c, 0x0a, 0x0e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x65,
-	0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x72, 0x65, 0x61, 0x64, 0x12, 0x12,
-	0x0a, 0x04, 0x65, 0x64, 0x69, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x65, 0x64,
-	0x69, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x06, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x64, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x22, 0x46, 0x0a, 0x08, 0x46, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x12, 0x3a,
-	0x0a, 0x19, 0x61, 0x64, 0x76, 0x61, 0x6e, 0x63, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x17, 0x61, 0x64, 0x76, 0x61, 0x6e, 0x63, 0x65, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x57, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x73, 0x42, 0x54, 0x5a, 0x52, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f,
-	0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x6c, 0x69, 0x62, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x72, 0x6d, 0x2f, 0x76, 0x31, 0x3b, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x76, 0x31,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x73, 0x73, 0x52, 0x10, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x65, 0x64, 0x53, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x51, 0x0a, 0x0f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f,
+	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28,
+	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x52, 0x08,
+	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x8e, 0x01, 0x0a, 0x0e, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6c,
+	0x69, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x12,
+	0x12, 0x0a, 0x04, 0x72, 0x65, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x72,
+	0x65, 0x61, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x65, 0x64, 0x69, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x04, 0x65, 0x64, 0x69, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12,
+	0x16, 0x0a, 0x06, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x06, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x73, 0x65, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x75, 0x73, 0x65, 0x22, 0x7b, 0x0a, 0x08, 0x46, 0x65, 0x61,
+	0x74, 0x75, 0x72, 0x65, 0x73, 0x12, 0x3a, 0x0a, 0x19, 0x61, 0x64, 0x76, 0x61, 0x6e, 0x63, 0x65,
+	0x64, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f,
+	0x77, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x17, 0x61, 0x64, 0x76, 0x61, 0x6e, 0x63,
+	0x65, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x57, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77,
+	0x73, 0x12, 0x33, 0x0a, 0x16, 0x69, 0x73, 0x5f, 0x75, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x62, 0x61,
+	0x73, 0x65, 0x64, 0x5f, 0x62, 0x69, 0x6c, 0x6c, 0x69, 0x6e, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x13, 0x69, 0x73, 0x55, 0x73, 0x61, 0x67, 0x65, 0x42, 0x61, 0x73, 0x65, 0x64, 0x42,
+	0x69, 0x6c, 0x6c, 0x69, 0x6e, 0x67, 0x42, 0x54, 0x5a, 0x52, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x67, 0x65, 0x6e, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2f, 0x6c, 0x69, 0x62, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2f, 0x76,
+	0x31, 0x3b, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -679,23 +718,24 @@ var file_teleport_lib_teleterm_v1_cluster_proto_depIdxs = []int32{
 	1,  // 0: teleport.lib.teleterm.v1.Cluster.logged_in_user:type_name -> teleport.lib.teleterm.v1.LoggedInUser
 	4,  // 1: teleport.lib.teleterm.v1.Cluster.features:type_name -> teleport.lib.teleterm.v1.Features
 	2,  // 2: teleport.lib.teleterm.v1.LoggedInUser.acl:type_name -> teleport.lib.teleterm.v1.ACL
-	3,  // 3: teleport.lib.teleterm.v1.ACL.sessions:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	3,  // 4: teleport.lib.teleterm.v1.ACL.auth_connectors:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	3,  // 5: teleport.lib.teleterm.v1.ACL.roles:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	3,  // 6: teleport.lib.teleterm.v1.ACL.users:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	3,  // 7: teleport.lib.teleterm.v1.ACL.trusted_clusters:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	3,  // 8: teleport.lib.teleterm.v1.ACL.events:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	3,  // 9: teleport.lib.teleterm.v1.ACL.tokens:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	3,  // 10: teleport.lib.teleterm.v1.ACL.servers:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	3,  // 11: teleport.lib.teleterm.v1.ACL.apps:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	3,  // 12: teleport.lib.teleterm.v1.ACL.dbs:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	3,  // 13: teleport.lib.teleterm.v1.ACL.kubeservers:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	3,  // 14: teleport.lib.teleterm.v1.ACL.access_requests:type_name -> teleport.lib.teleterm.v1.ResourceAccess
-	15, // [15:15] is the sub-list for method output_type
-	15, // [15:15] is the sub-list for method input_type
-	15, // [15:15] is the sub-list for extension type_name
-	15, // [15:15] is the sub-list for extension extendee
-	0,  // [0:15] is the sub-list for field type_name
+	3,  // 3: teleport.lib.teleterm.v1.ACL.auth_connectors:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 4: teleport.lib.teleterm.v1.ACL.roles:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 5: teleport.lib.teleterm.v1.ACL.users:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 6: teleport.lib.teleterm.v1.ACL.trusted_clusters:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 7: teleport.lib.teleterm.v1.ACL.events:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 8: teleport.lib.teleterm.v1.ACL.tokens:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 9: teleport.lib.teleterm.v1.ACL.servers:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 10: teleport.lib.teleterm.v1.ACL.apps:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 11: teleport.lib.teleterm.v1.ACL.dbs:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 12: teleport.lib.teleterm.v1.ACL.kubeservers:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 13: teleport.lib.teleterm.v1.ACL.access_requests:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 14: teleport.lib.teleterm.v1.ACL.recorded_sessions:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	3,  // 15: teleport.lib.teleterm.v1.ACL.active_sessions:type_name -> teleport.lib.teleterm.v1.ResourceAccess
+	16, // [16:16] is the sub-list for method output_type
+	16, // [16:16] is the sub-list for method input_type
+	16, // [16:16] is the sub-list for extension type_name
+	16, // [16:16] is the sub-list for extension extendee
+	0,  // [0:16] is the sub-list for field type_name
 }
 
 func init() { file_teleport_lib_teleterm_v1_cluster_proto_init() }
diff --git a/gen/proto/js/prehog/v1alpha/teleport_grpc_pb.js b/gen/proto/js/prehog/v1alpha/teleport_grpc_pb.js
index b075793a9573b..a8bee0db58140 100644
--- a/gen/proto/js/prehog/v1alpha/teleport_grpc_pb.js
+++ b/gen/proto/js/prehog/v1alpha/teleport_grpc_pb.js
@@ -89,7 +89,8 @@ function deserialize_prehog_v1alpha_SubmitEventsResponse(buffer_arg) {
 
 
 var TeleportReportingServiceService = exports.TeleportReportingServiceService = {
-  submitEvent: {
+  // equivalent to SubmitEvents with a single event, should be unused by now
+submitEvent: {
     path: '/prehog.v1alpha.TeleportReportingService/SubmitEvent',
     requestStream: false,
     responseStream: false,
@@ -100,7 +101,16 @@ var TeleportReportingServiceService = exports.TeleportReportingServiceService =
     responseSerialize: serialize_prehog_v1alpha_SubmitEventResponse,
     responseDeserialize: deserialize_prehog_v1alpha_SubmitEventResponse,
   },
-  submitEvents: {
+  // encodes and forwards usage events to the PostHog event database; each
+// event is annotated with some properties that depend on the identity of the
+// caller:
+// - tp.account_id (UUID in string form, can be empty if missing from the
+//   license)
+// - tp.license_name (should always be a UUID)
+// - tp.license_authority (name of the authority that signed the license file
+//   used for authentication)
+// - tp.is_cloud (boolean)
+submitEvents: {
     path: '/prehog.v1alpha.TeleportReportingService/SubmitEvents',
     requestStream: false,
     responseStream: false,
diff --git a/gen/proto/js/prehog/v1alpha/teleport_pb.d.ts b/gen/proto/js/prehog/v1alpha/teleport_pb.d.ts
index c90d9c7be8089..dfb86b7a0d3ca 100644
--- a/gen/proto/js/prehog/v1alpha/teleport_pb.d.ts
+++ b/gen/proto/js/prehog/v1alpha/teleport_pb.d.ts
@@ -321,6 +321,27 @@ export namespace UIOnboardRegisterChallengeSubmitEvent {
     }
 }
 
+export class UIOnboardQuestionnaireSubmitEvent extends jspb.Message { 
+    getUserName(): string;
+    setUserName(value: string): UIOnboardQuestionnaireSubmitEvent;
+
+
+    serializeBinary(): Uint8Array;
+    toObject(includeInstance?: boolean): UIOnboardQuestionnaireSubmitEvent.AsObject;
+    static toObject(includeInstance: boolean, msg: UIOnboardQuestionnaireSubmitEvent): UIOnboardQuestionnaireSubmitEvent.AsObject;
+    static extensions: {[key: number]: jspb.ExtensionFieldInfo<jspb.Message>};
+    static extensionsBinary: {[key: number]: jspb.ExtensionFieldBinaryInfo<jspb.Message>};
+    static serializeBinaryToWriter(message: UIOnboardQuestionnaireSubmitEvent, writer: jspb.BinaryWriter): void;
+    static deserializeBinary(bytes: Uint8Array): UIOnboardQuestionnaireSubmitEvent;
+    static deserializeBinaryFromReader(message: UIOnboardQuestionnaireSubmitEvent, reader: jspb.BinaryReader): UIOnboardQuestionnaireSubmitEvent;
+}
+
+export namespace UIOnboardQuestionnaireSubmitEvent {
+    export type AsObject = {
+        userName: string,
+    }
+}
+
 export class UIRecoveryCodesContinueClickEvent extends jspb.Message { 
     getUserName(): string;
     setUserName(value: string): UIRecoveryCodesContinueClickEvent;
@@ -627,6 +648,12 @@ export class UIDiscoverDeployServiceEvent extends jspb.Message {
     getStatus(): DiscoverStepStatus | undefined;
     setStatus(value?: DiscoverStepStatus): UIDiscoverDeployServiceEvent;
 
+    getDeployMethod(): UIDiscoverDeployServiceEvent.DeployMethod;
+    setDeployMethod(value: UIDiscoverDeployServiceEvent.DeployMethod): UIDiscoverDeployServiceEvent;
+
+    getDeployType(): UIDiscoverDeployServiceEvent.DeployType;
+    setDeployType(value: UIDiscoverDeployServiceEvent.DeployType): UIDiscoverDeployServiceEvent;
+
 
     serializeBinary(): Uint8Array;
     toObject(includeInstance?: boolean): UIDiscoverDeployServiceEvent.AsObject;
@@ -643,7 +670,22 @@ export namespace UIDiscoverDeployServiceEvent {
         metadata?: DiscoverMetadata.AsObject,
         resource?: DiscoverResourceMetadata.AsObject,
         status?: DiscoverStepStatus.AsObject,
+        deployMethod: UIDiscoverDeployServiceEvent.DeployMethod,
+        deployType: UIDiscoverDeployServiceEvent.DeployType,
+    }
+
+    export enum DeployMethod {
+    DEPLOY_METHOD_UNSPECIFIED = 0,
+    DEPLOY_METHOD_AUTO = 1,
+    DEPLOY_METHOD_MANUAL = 2,
+    }
+
+    export enum DeployType {
+    DEPLOY_TYPE_UNSPECIFIED = 0,
+    DEPLOY_TYPE_INSTALL_SCRIPT = 1,
+    DEPLOY_TYPE_AMAZON_ECS = 2,
     }
+
 }
 
 export class UIDiscoverDatabaseRegisterEvent extends jspb.Message { 
@@ -1017,6 +1059,76 @@ export namespace RoleCreateEvent {
     }
 }
 
+export class BotCreateEvent extends jspb.Message { 
+    getUserName(): string;
+    setUserName(value: string): BotCreateEvent;
+
+    getBotUserName(): string;
+    setBotUserName(value: string): BotCreateEvent;
+
+    getRoleName(): string;
+    setRoleName(value: string): BotCreateEvent;
+
+    getRoleCount(): number;
+    setRoleCount(value: number): BotCreateEvent;
+
+    getJoinMethod(): string;
+    setJoinMethod(value: string): BotCreateEvent;
+
+    getBotName(): string;
+    setBotName(value: string): BotCreateEvent;
+
+
+    serializeBinary(): Uint8Array;
+    toObject(includeInstance?: boolean): BotCreateEvent.AsObject;
+    static toObject(includeInstance: boolean, msg: BotCreateEvent): BotCreateEvent.AsObject;
+    static extensions: {[key: number]: jspb.ExtensionFieldInfo<jspb.Message>};
+    static extensionsBinary: {[key: number]: jspb.ExtensionFieldBinaryInfo<jspb.Message>};
+    static serializeBinaryToWriter(message: BotCreateEvent, writer: jspb.BinaryWriter): void;
+    static deserializeBinary(bytes: Uint8Array): BotCreateEvent;
+    static deserializeBinaryFromReader(message: BotCreateEvent, reader: jspb.BinaryReader): BotCreateEvent;
+}
+
+export namespace BotCreateEvent {
+    export type AsObject = {
+        userName: string,
+        botUserName: string,
+        roleName: string,
+        roleCount: number,
+        joinMethod: string,
+        botName: string,
+    }
+}
+
+export class BotJoinEvent extends jspb.Message { 
+    getBotName(): string;
+    setBotName(value: string): BotJoinEvent;
+
+    getJoinMethod(): string;
+    setJoinMethod(value: string): BotJoinEvent;
+
+    getJoinTokenName(): string;
+    setJoinTokenName(value: string): BotJoinEvent;
+
+
+    serializeBinary(): Uint8Array;
+    toObject(includeInstance?: boolean): BotJoinEvent.AsObject;
+    static toObject(includeInstance: boolean, msg: BotJoinEvent): BotJoinEvent.AsObject;
+    static extensions: {[key: number]: jspb.ExtensionFieldInfo<jspb.Message>};
+    static extensionsBinary: {[key: number]: jspb.ExtensionFieldBinaryInfo<jspb.Message>};
+    static serializeBinaryToWriter(message: BotJoinEvent, writer: jspb.BinaryWriter): void;
+    static deserializeBinary(bytes: Uint8Array): BotJoinEvent;
+    static deserializeBinaryFromReader(message: BotJoinEvent, reader: jspb.BinaryReader): BotJoinEvent;
+}
+
+export namespace BotJoinEvent {
+    export type AsObject = {
+        botName: string,
+        joinMethod: string,
+        joinTokenName: string,
+    }
+}
+
 export class UICreateNewRoleClickEvent extends jspb.Message { 
     getUserName(): string;
     setUserName(value: string): UICreateNewRoleClickEvent;
@@ -1351,6 +1463,31 @@ export namespace UIIntegrationEnrollCompleteEvent {
     }
 }
 
+export class EditorChangeEvent extends jspb.Message { 
+    getUserName(): string;
+    setUserName(value: string): EditorChangeEvent;
+
+    getStatus(): EditorChangeStatus;
+    setStatus(value: EditorChangeStatus): EditorChangeEvent;
+
+
+    serializeBinary(): Uint8Array;
+    toObject(includeInstance?: boolean): EditorChangeEvent.AsObject;
+    static toObject(includeInstance: boolean, msg: EditorChangeEvent): EditorChangeEvent.AsObject;
+    static extensions: {[key: number]: jspb.ExtensionFieldInfo<jspb.Message>};
+    static extensionsBinary: {[key: number]: jspb.ExtensionFieldBinaryInfo<jspb.Message>};
+    static serializeBinaryToWriter(message: EditorChangeEvent, writer: jspb.BinaryWriter): void;
+    static deserializeBinary(bytes: Uint8Array): EditorChangeEvent;
+    static deserializeBinaryFromReader(message: EditorChangeEvent, reader: jspb.BinaryReader): EditorChangeEvent;
+}
+
+export namespace EditorChangeEvent {
+    export type AsObject = {
+        userName: string,
+        status: EditorChangeStatus,
+    }
+}
+
 export class SubmitEventRequest extends jspb.Message { 
     getClusterName(): string;
     setClusterName(value: string): SubmitEventRequest;
@@ -1614,6 +1751,30 @@ export class SubmitEventRequest extends jspb.Message {
     setUiIntegrationEnrollCompleteEvent(value?: UIIntegrationEnrollCompleteEvent): SubmitEventRequest;
 
 
+    hasEditorChangeEvent(): boolean;
+    clearEditorChangeEvent(): void;
+    getEditorChangeEvent(): EditorChangeEvent | undefined;
+    setEditorChangeEvent(value?: EditorChangeEvent): SubmitEventRequest;
+
+
+    hasBotCreate(): boolean;
+    clearBotCreate(): void;
+    getBotCreate(): BotCreateEvent | undefined;
+    setBotCreate(value?: BotCreateEvent): SubmitEventRequest;
+
+
+    hasUiOnboardQuestionnaireSubmit(): boolean;
+    clearUiOnboardQuestionnaireSubmit(): void;
+    getUiOnboardQuestionnaireSubmit(): UIOnboardQuestionnaireSubmitEvent | undefined;
+    setUiOnboardQuestionnaireSubmit(value?: UIOnboardQuestionnaireSubmitEvent): SubmitEventRequest;
+
+
+    hasBotJoin(): boolean;
+    clearBotJoin(): void;
+    getBotJoin(): BotJoinEvent | undefined;
+    setBotJoin(value?: BotJoinEvent): SubmitEventRequest;
+
+
     getEventCase(): SubmitEventRequest.EventCase;
 
     serializeBinary(): Uint8Array;
@@ -1672,6 +1833,10 @@ export namespace SubmitEventRequest {
         assistCompletion?: AssistCompletionEvent.AsObject,
         uiIntegrationEnrollStartEvent?: UIIntegrationEnrollStartEvent.AsObject,
         uiIntegrationEnrollCompleteEvent?: UIIntegrationEnrollCompleteEvent.AsObject,
+        editorChangeEvent?: EditorChangeEvent.AsObject,
+        botCreate?: BotCreateEvent.AsObject,
+        uiOnboardQuestionnaireSubmit?: UIOnboardQuestionnaireSubmitEvent.AsObject,
+        botJoin?: BotJoinEvent.AsObject,
     }
 
     export enum EventCase {
@@ -1761,6 +1926,14 @@ export namespace SubmitEventRequest {
 
     UI_INTEGRATION_ENROLL_COMPLETE_EVENT = 45,
 
+    EDITOR_CHANGE_EVENT = 46,
+
+    BOT_CREATE = 47,
+
+    UI_ONBOARD_QUESTIONNAIRE_SUBMIT = 48,
+
+    BOT_JOIN = 49,
+
     }
 
 }
@@ -1904,6 +2077,7 @@ export enum DiscoverResource {
     DISCOVER_RESOURCE_DOC_DATABASE_RDS_PROXY = 34,
     DISCOVER_RESOURCE_DOC_DATABASE_HIGH_AVAILABILITY = 35,
     DISCOVER_RESOURCE_DOC_DATABASE_DYNAMIC_REGISTRATION = 36,
+    DISCOVER_RESOURCE_SAML_APPLICATION = 37,
 }
 
 export enum DiscoverStatus {
@@ -1922,6 +2096,7 @@ export enum CTA {
     CTA_PREMIUM_SUPPORT = 4,
     CTA_TRUSTED_DEVICES = 5,
     CTA_UPGRADE_BANNER = 6,
+    CTA_BILLING_SUMMARY = 7,
 }
 
 export enum IntegrationEnrollKind {
@@ -1938,3 +2113,9 @@ export enum IntegrationEnrollKind {
     INTEGRATION_ENROLL_KIND_OKTA = 10,
     INTEGRATION_ENROLL_KIND_JAMF = 11,
 }
+
+export enum EditorChangeStatus {
+    EDITOR_CHANGE_STATUS_UNSPECIFIED = 0,
+    EDITOR_CHANGE_STATUS_ROLE_GRANTED = 1,
+    EDITOR_CHANGE_STATUS_ROLE_REMOVED = 2,
+}
diff --git a/gen/proto/js/prehog/v1alpha/teleport_pb.js b/gen/proto/js/prehog/v1alpha/teleport_pb.js
index 27dacdf5b5e81..1a9d15b88a381 100644
--- a/gen/proto/js/prehog/v1alpha/teleport_pb.js
+++ b/gen/proto/js/prehog/v1alpha/teleport_pb.js
@@ -21,12 +21,16 @@ var google_protobuf_timestamp_pb = require('google-protobuf/google/protobuf/time
 goog.object.extend(proto, google_protobuf_timestamp_pb);
 goog.exportSymbol('proto.prehog.v1alpha.AgentMetadataEvent', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.AssistCompletionEvent', null, global);
+goog.exportSymbol('proto.prehog.v1alpha.BotCreateEvent', null, global);
+goog.exportSymbol('proto.prehog.v1alpha.BotJoinEvent', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.CTA', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.DiscoverMetadata', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.DiscoverResource', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.DiscoverResourceMetadata', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.DiscoverStatus', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.DiscoverStepStatus', null, global);
+goog.exportSymbol('proto.prehog.v1alpha.EditorChangeEvent', null, global);
+goog.exportSymbol('proto.prehog.v1alpha.EditorChangeStatus', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.HelloTeleportRequest', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.HelloTeleportResponse', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.IntegrationEnrollKind', null, global);
@@ -57,6 +61,8 @@ goog.exportSymbol('proto.prehog.v1alpha.UIDiscoverDatabaseConfigureMTLSEvent', n
 goog.exportSymbol('proto.prehog.v1alpha.UIDiscoverDatabaseRDSEnrollEvent', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.UIDiscoverDatabaseRegisterEvent', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.UIDiscoverDeployServiceEvent', null, global);
+goog.exportSymbol('proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod', null, global);
+goog.exportSymbol('proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.UIDiscoverDesktopActiveDirectoryConfigureEvent', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.UIDiscoverDesktopActiveDirectoryToolsInstallEvent', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.UIDiscoverIntegrationAWSOIDCConnectEvent', null, global);
@@ -69,6 +75,7 @@ goog.exportSymbol('proto.prehog.v1alpha.UIIntegrationEnrollStartEvent', null, gl
 goog.exportSymbol('proto.prehog.v1alpha.UIOnboardAddFirstResourceClickEvent', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.UIOnboardAddFirstResourceLaterClickEvent', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.UIOnboardCompleteGoToDashboardClickEvent', null, global);
+goog.exportSymbol('proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.UIOnboardSetCredentialSubmitEvent', null, global);
 goog.exportSymbol('proto.prehog.v1alpha.UIRecoveryCodesContinueClickEvent', null, global);
@@ -328,6 +335,27 @@ if (goog.DEBUG && !COMPILED) {
    */
   proto.prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent.displayName = 'proto.prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent';
 }
+/**
+ * Generated by JsPbCodeGenerator.
+ * @param {Array=} opt_data Optional initial data array, typically from a
+ * server response, or constructed directly in Javascript. The array is used
+ * in place and becomes part of the constructed object. It is not cloned.
+ * If no data is provided, the constructed object will be empty, but still
+ * valid.
+ * @extends {jspb.Message}
+ * @constructor
+ */
+proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent = function(opt_data) {
+  jspb.Message.initialize(this, opt_data, 0, -1, null, null);
+};
+goog.inherits(proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent, jspb.Message);
+if (goog.DEBUG && !COMPILED) {
+  /**
+   * @public
+   * @override
+   */
+  proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.displayName = 'proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent';
+}
 /**
  * Generated by JsPbCodeGenerator.
  * @param {Array=} opt_data Optional initial data array, typically from a
@@ -769,6 +797,48 @@ if (goog.DEBUG && !COMPILED) {
    */
   proto.prehog.v1alpha.RoleCreateEvent.displayName = 'proto.prehog.v1alpha.RoleCreateEvent';
 }
+/**
+ * Generated by JsPbCodeGenerator.
+ * @param {Array=} opt_data Optional initial data array, typically from a
+ * server response, or constructed directly in Javascript. The array is used
+ * in place and becomes part of the constructed object. It is not cloned.
+ * If no data is provided, the constructed object will be empty, but still
+ * valid.
+ * @extends {jspb.Message}
+ * @constructor
+ */
+proto.prehog.v1alpha.BotCreateEvent = function(opt_data) {
+  jspb.Message.initialize(this, opt_data, 0, -1, null, null);
+};
+goog.inherits(proto.prehog.v1alpha.BotCreateEvent, jspb.Message);
+if (goog.DEBUG && !COMPILED) {
+  /**
+   * @public
+   * @override
+   */
+  proto.prehog.v1alpha.BotCreateEvent.displayName = 'proto.prehog.v1alpha.BotCreateEvent';
+}
+/**
+ * Generated by JsPbCodeGenerator.
+ * @param {Array=} opt_data Optional initial data array, typically from a
+ * server response, or constructed directly in Javascript. The array is used
+ * in place and becomes part of the constructed object. It is not cloned.
+ * If no data is provided, the constructed object will be empty, but still
+ * valid.
+ * @extends {jspb.Message}
+ * @constructor
+ */
+proto.prehog.v1alpha.BotJoinEvent = function(opt_data) {
+  jspb.Message.initialize(this, opt_data, 0, -1, null, null);
+};
+goog.inherits(proto.prehog.v1alpha.BotJoinEvent, jspb.Message);
+if (goog.DEBUG && !COMPILED) {
+  /**
+   * @public
+   * @override
+   */
+  proto.prehog.v1alpha.BotJoinEvent.displayName = 'proto.prehog.v1alpha.BotJoinEvent';
+}
 /**
  * Generated by JsPbCodeGenerator.
  * @param {Array=} opt_data Optional initial data array, typically from a
@@ -1021,6 +1091,27 @@ if (goog.DEBUG && !COMPILED) {
    */
   proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.displayName = 'proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent';
 }
+/**
+ * Generated by JsPbCodeGenerator.
+ * @param {Array=} opt_data Optional initial data array, typically from a
+ * server response, or constructed directly in Javascript. The array is used
+ * in place and becomes part of the constructed object. It is not cloned.
+ * If no data is provided, the constructed object will be empty, but still
+ * valid.
+ * @extends {jspb.Message}
+ * @constructor
+ */
+proto.prehog.v1alpha.EditorChangeEvent = function(opt_data) {
+  jspb.Message.initialize(this, opt_data, 0, -1, null, null);
+};
+goog.inherits(proto.prehog.v1alpha.EditorChangeEvent, jspb.Message);
+if (goog.DEBUG && !COMPILED) {
+  /**
+   * @public
+   * @override
+   */
+  proto.prehog.v1alpha.EditorChangeEvent.displayName = 'proto.prehog.v1alpha.EditorChangeEvent';
+}
 /**
  * Generated by JsPbCodeGenerator.
  * @param {Array=} opt_data Optional initial data array, typically from a
@@ -3175,6 +3266,136 @@ proto.prehog.v1alpha.UIOnboardRegisterChallengeSubmitEvent.prototype.setLoginFlo
 
 
 
+if (jspb.Message.GENERATE_TO_OBJECT) {
+/**
+ * Creates an object representation of this proto.
+ * Field names that are reserved in JavaScript and will be renamed to pb_name.
+ * Optional fields that are not set will be set to undefined.
+ * To access a reserved field use, foo.pb_<name>, eg, foo.pb_default.
+ * For the list of reserved names please see:
+ *     net/proto2/compiler/js/internal/generator.cc#kKeyword.
+ * @param {boolean=} opt_includeInstance Deprecated. whether to include the
+ *     JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @return {!Object}
+ */
+proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.prototype.toObject = function(opt_includeInstance) {
+  return proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.toObject(opt_includeInstance, this);
+};
+
+
+/**
+ * Static version of the {@see toObject} method.
+ * @param {boolean|undefined} includeInstance Deprecated. Whether to include
+ *     the JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @param {!proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent} msg The msg instance to transform.
+ * @return {!Object}
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.toObject = function(includeInstance, msg) {
+  var f, obj = {
+    userName: jspb.Message.getFieldWithDefault(msg, 1, "")
+  };
+
+  if (includeInstance) {
+    obj.$jspbMessageInstance = msg;
+  }
+  return obj;
+};
+}
+
+
+/**
+ * Deserializes binary data (in protobuf wire format).
+ * @param {jspb.ByteSource} bytes The bytes to deserialize.
+ * @return {!proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent}
+ */
+proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.deserializeBinary = function(bytes) {
+  var reader = new jspb.BinaryReader(bytes);
+  var msg = new proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent;
+  return proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.deserializeBinaryFromReader(msg, reader);
+};
+
+
+/**
+ * Deserializes binary data (in protobuf wire format) from the
+ * given reader into the given message object.
+ * @param {!proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent} msg The message object to deserialize into.
+ * @param {!jspb.BinaryReader} reader The BinaryReader to use.
+ * @return {!proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent}
+ */
+proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.deserializeBinaryFromReader = function(msg, reader) {
+  while (reader.nextField()) {
+    if (reader.isEndGroup()) {
+      break;
+    }
+    var field = reader.getFieldNumber();
+    switch (field) {
+    case 1:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setUserName(value);
+      break;
+    default:
+      reader.skipField();
+      break;
+    }
+  }
+  return msg;
+};
+
+
+/**
+ * Serializes the message to binary data (in protobuf wire format).
+ * @return {!Uint8Array}
+ */
+proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.prototype.serializeBinary = function() {
+  var writer = new jspb.BinaryWriter();
+  proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.serializeBinaryToWriter(this, writer);
+  return writer.getResultBuffer();
+};
+
+
+/**
+ * Serializes the given message to binary data (in protobuf wire
+ * format), writing to the given BinaryWriter.
+ * @param {!proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent} message
+ * @param {!jspb.BinaryWriter} writer
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.serializeBinaryToWriter = function(message, writer) {
+  var f = undefined;
+  f = message.getUserName();
+  if (f.length > 0) {
+    writer.writeString(
+      1,
+      f
+    );
+  }
+};
+
+
+/**
+ * optional string user_name = 1;
+ * @return {string}
+ */
+proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.prototype.getUserName = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 1, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent} returns this
+ */
+proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.prototype.setUserName = function(value) {
+  return jspb.Message.setProto3StringField(this, 1, value);
+};
+
+
+
+
+
 if (jspb.Message.GENERATE_TO_OBJECT) {
 /**
  * Creates an object representation of this proto.
@@ -5067,7 +5288,9 @@ proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.toObject = function(includeIns
   var f, obj = {
     metadata: (f = msg.getMetadata()) && proto.prehog.v1alpha.DiscoverMetadata.toObject(includeInstance, f),
     resource: (f = msg.getResource()) && proto.prehog.v1alpha.DiscoverResourceMetadata.toObject(includeInstance, f),
-    status: (f = msg.getStatus()) && proto.prehog.v1alpha.DiscoverStepStatus.toObject(includeInstance, f)
+    status: (f = msg.getStatus()) && proto.prehog.v1alpha.DiscoverStepStatus.toObject(includeInstance, f),
+    deployMethod: jspb.Message.getFieldWithDefault(msg, 4, 0),
+    deployType: jspb.Message.getFieldWithDefault(msg, 5, 0)
   };
 
   if (includeInstance) {
@@ -5119,6 +5342,14 @@ proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.deserializeBinaryFromReader =
       reader.readMessage(value,proto.prehog.v1alpha.DiscoverStepStatus.deserializeBinaryFromReader);
       msg.setStatus(value);
       break;
+    case 4:
+      var value = /** @type {!proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod} */ (reader.readEnum());
+      msg.setDeployMethod(value);
+      break;
+    case 5:
+      var value = /** @type {!proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType} */ (reader.readEnum());
+      msg.setDeployType(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -5172,8 +5403,40 @@ proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.serializeBinaryToWriter = func
       proto.prehog.v1alpha.DiscoverStepStatus.serializeBinaryToWriter
     );
   }
+  f = message.getDeployMethod();
+  if (f !== 0.0) {
+    writer.writeEnum(
+      4,
+      f
+    );
+  }
+  f = message.getDeployType();
+  if (f !== 0.0) {
+    writer.writeEnum(
+      5,
+      f
+    );
+  }
+};
+
+
+/**
+ * @enum {number}
+ */
+proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod = {
+  DEPLOY_METHOD_UNSPECIFIED: 0,
+  DEPLOY_METHOD_AUTO: 1,
+  DEPLOY_METHOD_MANUAL: 2
 };
 
+/**
+ * @enum {number}
+ */
+proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType = {
+  DEPLOY_TYPE_UNSPECIFIED: 0,
+  DEPLOY_TYPE_INSTALL_SCRIPT: 1,
+  DEPLOY_TYPE_AMAZON_ECS: 2
+};
 
 /**
  * optional DiscoverMetadata metadata = 1;
@@ -5286,6 +5549,42 @@ proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.prototype.hasStatus = function
 };
 
 
+/**
+ * optional DeployMethod deploy_method = 4;
+ * @return {!proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod}
+ */
+proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.prototype.getDeployMethod = function() {
+  return /** @type {!proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod} */ (jspb.Message.getFieldWithDefault(this, 4, 0));
+};
+
+
+/**
+ * @param {!proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployMethod} value
+ * @return {!proto.prehog.v1alpha.UIDiscoverDeployServiceEvent} returns this
+ */
+proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.prototype.setDeployMethod = function(value) {
+  return jspb.Message.setProto3EnumField(this, 4, value);
+};
+
+
+/**
+ * optional DeployType deploy_type = 5;
+ * @return {!proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType}
+ */
+proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.prototype.getDeployType = function() {
+  return /** @type {!proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType} */ (jspb.Message.getFieldWithDefault(this, 5, 0));
+};
+
+
+/**
+ * @param {!proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.DeployType} value
+ * @return {!proto.prehog.v1alpha.UIDiscoverDeployServiceEvent} returns this
+ */
+proto.prehog.v1alpha.UIDiscoverDeployServiceEvent.prototype.setDeployType = function(value) {
+  return jspb.Message.setProto3EnumField(this, 5, value);
+};
+
+
 
 
 
@@ -7769,8 +8068,8 @@ if (jspb.Message.GENERATE_TO_OBJECT) {
  *     http://goto/soy-param-migration
  * @return {!Object}
  */
-proto.prehog.v1alpha.UICreateNewRoleClickEvent.prototype.toObject = function(opt_includeInstance) {
-  return proto.prehog.v1alpha.UICreateNewRoleClickEvent.toObject(opt_includeInstance, this);
+proto.prehog.v1alpha.BotCreateEvent.prototype.toObject = function(opt_includeInstance) {
+  return proto.prehog.v1alpha.BotCreateEvent.toObject(opt_includeInstance, this);
 };
 
 
@@ -7779,13 +8078,18 @@ proto.prehog.v1alpha.UICreateNewRoleClickEvent.prototype.toObject = function(opt
  * @param {boolean|undefined} includeInstance Deprecated. Whether to include
  *     the JSPB instance for transitional soy proto support:
  *     http://goto/soy-param-migration
- * @param {!proto.prehog.v1alpha.UICreateNewRoleClickEvent} msg The msg instance to transform.
+ * @param {!proto.prehog.v1alpha.BotCreateEvent} msg The msg instance to transform.
  * @return {!Object}
  * @suppress {unusedLocalVariables} f is only used for nested messages
  */
-proto.prehog.v1alpha.UICreateNewRoleClickEvent.toObject = function(includeInstance, msg) {
+proto.prehog.v1alpha.BotCreateEvent.toObject = function(includeInstance, msg) {
   var f, obj = {
-    userName: jspb.Message.getFieldWithDefault(msg, 1, "")
+    userName: jspb.Message.getFieldWithDefault(msg, 1, ""),
+    botUserName: jspb.Message.getFieldWithDefault(msg, 2, ""),
+    roleName: jspb.Message.getFieldWithDefault(msg, 3, ""),
+    roleCount: jspb.Message.getFieldWithDefault(msg, 4, 0),
+    joinMethod: jspb.Message.getFieldWithDefault(msg, 5, ""),
+    botName: jspb.Message.getFieldWithDefault(msg, 6, "")
   };
 
   if (includeInstance) {
@@ -7799,23 +8103,23 @@ proto.prehog.v1alpha.UICreateNewRoleClickEvent.toObject = function(includeInstan
 /**
  * Deserializes binary data (in protobuf wire format).
  * @param {jspb.ByteSource} bytes The bytes to deserialize.
- * @return {!proto.prehog.v1alpha.UICreateNewRoleClickEvent}
+ * @return {!proto.prehog.v1alpha.BotCreateEvent}
  */
-proto.prehog.v1alpha.UICreateNewRoleClickEvent.deserializeBinary = function(bytes) {
+proto.prehog.v1alpha.BotCreateEvent.deserializeBinary = function(bytes) {
   var reader = new jspb.BinaryReader(bytes);
-  var msg = new proto.prehog.v1alpha.UICreateNewRoleClickEvent;
-  return proto.prehog.v1alpha.UICreateNewRoleClickEvent.deserializeBinaryFromReader(msg, reader);
+  var msg = new proto.prehog.v1alpha.BotCreateEvent;
+  return proto.prehog.v1alpha.BotCreateEvent.deserializeBinaryFromReader(msg, reader);
 };
 
 
 /**
  * Deserializes binary data (in protobuf wire format) from the
  * given reader into the given message object.
- * @param {!proto.prehog.v1alpha.UICreateNewRoleClickEvent} msg The message object to deserialize into.
+ * @param {!proto.prehog.v1alpha.BotCreateEvent} msg The message object to deserialize into.
  * @param {!jspb.BinaryReader} reader The BinaryReader to use.
- * @return {!proto.prehog.v1alpha.UICreateNewRoleClickEvent}
+ * @return {!proto.prehog.v1alpha.BotCreateEvent}
  */
-proto.prehog.v1alpha.UICreateNewRoleClickEvent.deserializeBinaryFromReader = function(msg, reader) {
+proto.prehog.v1alpha.BotCreateEvent.deserializeBinaryFromReader = function(msg, reader) {
   while (reader.nextField()) {
     if (reader.isEndGroup()) {
       break;
@@ -7826,14 +8130,479 @@ proto.prehog.v1alpha.UICreateNewRoleClickEvent.deserializeBinaryFromReader = fun
       var value = /** @type {string} */ (reader.readString());
       msg.setUserName(value);
       break;
-    default:
-      reader.skipField();
+    case 2:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setBotUserName(value);
       break;
-    }
-  }
-  return msg;
-};
-
+    case 3:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setRoleName(value);
+      break;
+    case 4:
+      var value = /** @type {number} */ (reader.readInt64());
+      msg.setRoleCount(value);
+      break;
+    case 5:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setJoinMethod(value);
+      break;
+    case 6:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setBotName(value);
+      break;
+    default:
+      reader.skipField();
+      break;
+    }
+  }
+  return msg;
+};
+
+
+/**
+ * Serializes the message to binary data (in protobuf wire format).
+ * @return {!Uint8Array}
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.serializeBinary = function() {
+  var writer = new jspb.BinaryWriter();
+  proto.prehog.v1alpha.BotCreateEvent.serializeBinaryToWriter(this, writer);
+  return writer.getResultBuffer();
+};
+
+
+/**
+ * Serializes the given message to binary data (in protobuf wire
+ * format), writing to the given BinaryWriter.
+ * @param {!proto.prehog.v1alpha.BotCreateEvent} message
+ * @param {!jspb.BinaryWriter} writer
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.prehog.v1alpha.BotCreateEvent.serializeBinaryToWriter = function(message, writer) {
+  var f = undefined;
+  f = message.getUserName();
+  if (f.length > 0) {
+    writer.writeString(
+      1,
+      f
+    );
+  }
+  f = message.getBotUserName();
+  if (f.length > 0) {
+    writer.writeString(
+      2,
+      f
+    );
+  }
+  f = message.getRoleName();
+  if (f.length > 0) {
+    writer.writeString(
+      3,
+      f
+    );
+  }
+  f = message.getRoleCount();
+  if (f !== 0) {
+    writer.writeInt64(
+      4,
+      f
+    );
+  }
+  f = message.getJoinMethod();
+  if (f.length > 0) {
+    writer.writeString(
+      5,
+      f
+    );
+  }
+  f = message.getBotName();
+  if (f.length > 0) {
+    writer.writeString(
+      6,
+      f
+    );
+  }
+};
+
+
+/**
+ * optional string user_name = 1;
+ * @return {string}
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.getUserName = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 1, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.prehog.v1alpha.BotCreateEvent} returns this
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.setUserName = function(value) {
+  return jspb.Message.setProto3StringField(this, 1, value);
+};
+
+
+/**
+ * optional string bot_user_name = 2;
+ * @return {string}
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.getBotUserName = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 2, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.prehog.v1alpha.BotCreateEvent} returns this
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.setBotUserName = function(value) {
+  return jspb.Message.setProto3StringField(this, 2, value);
+};
+
+
+/**
+ * optional string role_name = 3;
+ * @return {string}
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.getRoleName = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 3, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.prehog.v1alpha.BotCreateEvent} returns this
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.setRoleName = function(value) {
+  return jspb.Message.setProto3StringField(this, 3, value);
+};
+
+
+/**
+ * optional int64 role_count = 4;
+ * @return {number}
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.getRoleCount = function() {
+  return /** @type {number} */ (jspb.Message.getFieldWithDefault(this, 4, 0));
+};
+
+
+/**
+ * @param {number} value
+ * @return {!proto.prehog.v1alpha.BotCreateEvent} returns this
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.setRoleCount = function(value) {
+  return jspb.Message.setProto3IntField(this, 4, value);
+};
+
+
+/**
+ * optional string join_method = 5;
+ * @return {string}
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.getJoinMethod = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 5, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.prehog.v1alpha.BotCreateEvent} returns this
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.setJoinMethod = function(value) {
+  return jspb.Message.setProto3StringField(this, 5, value);
+};
+
+
+/**
+ * optional string bot_name = 6;
+ * @return {string}
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.getBotName = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 6, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.prehog.v1alpha.BotCreateEvent} returns this
+ */
+proto.prehog.v1alpha.BotCreateEvent.prototype.setBotName = function(value) {
+  return jspb.Message.setProto3StringField(this, 6, value);
+};
+
+
+
+
+
+if (jspb.Message.GENERATE_TO_OBJECT) {
+/**
+ * Creates an object representation of this proto.
+ * Field names that are reserved in JavaScript and will be renamed to pb_name.
+ * Optional fields that are not set will be set to undefined.
+ * To access a reserved field use, foo.pb_<name>, eg, foo.pb_default.
+ * For the list of reserved names please see:
+ *     net/proto2/compiler/js/internal/generator.cc#kKeyword.
+ * @param {boolean=} opt_includeInstance Deprecated. whether to include the
+ *     JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @return {!Object}
+ */
+proto.prehog.v1alpha.BotJoinEvent.prototype.toObject = function(opt_includeInstance) {
+  return proto.prehog.v1alpha.BotJoinEvent.toObject(opt_includeInstance, this);
+};
+
+
+/**
+ * Static version of the {@see toObject} method.
+ * @param {boolean|undefined} includeInstance Deprecated. Whether to include
+ *     the JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @param {!proto.prehog.v1alpha.BotJoinEvent} msg The msg instance to transform.
+ * @return {!Object}
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.prehog.v1alpha.BotJoinEvent.toObject = function(includeInstance, msg) {
+  var f, obj = {
+    botName: jspb.Message.getFieldWithDefault(msg, 1, ""),
+    joinMethod: jspb.Message.getFieldWithDefault(msg, 2, ""),
+    joinTokenName: jspb.Message.getFieldWithDefault(msg, 3, "")
+  };
+
+  if (includeInstance) {
+    obj.$jspbMessageInstance = msg;
+  }
+  return obj;
+};
+}
+
+
+/**
+ * Deserializes binary data (in protobuf wire format).
+ * @param {jspb.ByteSource} bytes The bytes to deserialize.
+ * @return {!proto.prehog.v1alpha.BotJoinEvent}
+ */
+proto.prehog.v1alpha.BotJoinEvent.deserializeBinary = function(bytes) {
+  var reader = new jspb.BinaryReader(bytes);
+  var msg = new proto.prehog.v1alpha.BotJoinEvent;
+  return proto.prehog.v1alpha.BotJoinEvent.deserializeBinaryFromReader(msg, reader);
+};
+
+
+/**
+ * Deserializes binary data (in protobuf wire format) from the
+ * given reader into the given message object.
+ * @param {!proto.prehog.v1alpha.BotJoinEvent} msg The message object to deserialize into.
+ * @param {!jspb.BinaryReader} reader The BinaryReader to use.
+ * @return {!proto.prehog.v1alpha.BotJoinEvent}
+ */
+proto.prehog.v1alpha.BotJoinEvent.deserializeBinaryFromReader = function(msg, reader) {
+  while (reader.nextField()) {
+    if (reader.isEndGroup()) {
+      break;
+    }
+    var field = reader.getFieldNumber();
+    switch (field) {
+    case 1:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setBotName(value);
+      break;
+    case 2:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setJoinMethod(value);
+      break;
+    case 3:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setJoinTokenName(value);
+      break;
+    default:
+      reader.skipField();
+      break;
+    }
+  }
+  return msg;
+};
+
+
+/**
+ * Serializes the message to binary data (in protobuf wire format).
+ * @return {!Uint8Array}
+ */
+proto.prehog.v1alpha.BotJoinEvent.prototype.serializeBinary = function() {
+  var writer = new jspb.BinaryWriter();
+  proto.prehog.v1alpha.BotJoinEvent.serializeBinaryToWriter(this, writer);
+  return writer.getResultBuffer();
+};
+
+
+/**
+ * Serializes the given message to binary data (in protobuf wire
+ * format), writing to the given BinaryWriter.
+ * @param {!proto.prehog.v1alpha.BotJoinEvent} message
+ * @param {!jspb.BinaryWriter} writer
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.prehog.v1alpha.BotJoinEvent.serializeBinaryToWriter = function(message, writer) {
+  var f = undefined;
+  f = message.getBotName();
+  if (f.length > 0) {
+    writer.writeString(
+      1,
+      f
+    );
+  }
+  f = message.getJoinMethod();
+  if (f.length > 0) {
+    writer.writeString(
+      2,
+      f
+    );
+  }
+  f = message.getJoinTokenName();
+  if (f.length > 0) {
+    writer.writeString(
+      3,
+      f
+    );
+  }
+};
+
+
+/**
+ * optional string bot_name = 1;
+ * @return {string}
+ */
+proto.prehog.v1alpha.BotJoinEvent.prototype.getBotName = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 1, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.prehog.v1alpha.BotJoinEvent} returns this
+ */
+proto.prehog.v1alpha.BotJoinEvent.prototype.setBotName = function(value) {
+  return jspb.Message.setProto3StringField(this, 1, value);
+};
+
+
+/**
+ * optional string join_method = 2;
+ * @return {string}
+ */
+proto.prehog.v1alpha.BotJoinEvent.prototype.getJoinMethod = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 2, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.prehog.v1alpha.BotJoinEvent} returns this
+ */
+proto.prehog.v1alpha.BotJoinEvent.prototype.setJoinMethod = function(value) {
+  return jspb.Message.setProto3StringField(this, 2, value);
+};
+
+
+/**
+ * optional string join_token_name = 3;
+ * @return {string}
+ */
+proto.prehog.v1alpha.BotJoinEvent.prototype.getJoinTokenName = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 3, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.prehog.v1alpha.BotJoinEvent} returns this
+ */
+proto.prehog.v1alpha.BotJoinEvent.prototype.setJoinTokenName = function(value) {
+  return jspb.Message.setProto3StringField(this, 3, value);
+};
+
+
+
+
+
+if (jspb.Message.GENERATE_TO_OBJECT) {
+/**
+ * Creates an object representation of this proto.
+ * Field names that are reserved in JavaScript and will be renamed to pb_name.
+ * Optional fields that are not set will be set to undefined.
+ * To access a reserved field use, foo.pb_<name>, eg, foo.pb_default.
+ * For the list of reserved names please see:
+ *     net/proto2/compiler/js/internal/generator.cc#kKeyword.
+ * @param {boolean=} opt_includeInstance Deprecated. whether to include the
+ *     JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @return {!Object}
+ */
+proto.prehog.v1alpha.UICreateNewRoleClickEvent.prototype.toObject = function(opt_includeInstance) {
+  return proto.prehog.v1alpha.UICreateNewRoleClickEvent.toObject(opt_includeInstance, this);
+};
+
+
+/**
+ * Static version of the {@see toObject} method.
+ * @param {boolean|undefined} includeInstance Deprecated. Whether to include
+ *     the JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @param {!proto.prehog.v1alpha.UICreateNewRoleClickEvent} msg The msg instance to transform.
+ * @return {!Object}
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.prehog.v1alpha.UICreateNewRoleClickEvent.toObject = function(includeInstance, msg) {
+  var f, obj = {
+    userName: jspb.Message.getFieldWithDefault(msg, 1, "")
+  };
+
+  if (includeInstance) {
+    obj.$jspbMessageInstance = msg;
+  }
+  return obj;
+};
+}
+
+
+/**
+ * Deserializes binary data (in protobuf wire format).
+ * @param {jspb.ByteSource} bytes The bytes to deserialize.
+ * @return {!proto.prehog.v1alpha.UICreateNewRoleClickEvent}
+ */
+proto.prehog.v1alpha.UICreateNewRoleClickEvent.deserializeBinary = function(bytes) {
+  var reader = new jspb.BinaryReader(bytes);
+  var msg = new proto.prehog.v1alpha.UICreateNewRoleClickEvent;
+  return proto.prehog.v1alpha.UICreateNewRoleClickEvent.deserializeBinaryFromReader(msg, reader);
+};
+
+
+/**
+ * Deserializes binary data (in protobuf wire format) from the
+ * given reader into the given message object.
+ * @param {!proto.prehog.v1alpha.UICreateNewRoleClickEvent} msg The message object to deserialize into.
+ * @param {!jspb.BinaryReader} reader The BinaryReader to use.
+ * @return {!proto.prehog.v1alpha.UICreateNewRoleClickEvent}
+ */
+proto.prehog.v1alpha.UICreateNewRoleClickEvent.deserializeBinaryFromReader = function(msg, reader) {
+  while (reader.nextField()) {
+    if (reader.isEndGroup()) {
+      break;
+    }
+    var field = reader.getFieldNumber();
+    switch (field) {
+    case 1:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setUserName(value);
+      break;
+    default:
+      reader.skipField();
+      break;
+    }
+  }
+  return msg;
+};
+
 
 /**
  * Serializes the message to binary data (in protobuf wire format).
@@ -9621,20 +10390,171 @@ proto.prehog.v1alpha.IntegrationEnrollMetadata.prototype.setKind = function(valu
 
 
 /**
- * optional string user_name = 3;
- * @return {string}
+ * optional string user_name = 3;
+ * @return {string}
+ */
+proto.prehog.v1alpha.IntegrationEnrollMetadata.prototype.getUserName = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 3, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.prehog.v1alpha.IntegrationEnrollMetadata} returns this
+ */
+proto.prehog.v1alpha.IntegrationEnrollMetadata.prototype.setUserName = function(value) {
+  return jspb.Message.setProto3StringField(this, 3, value);
+};
+
+
+
+
+
+if (jspb.Message.GENERATE_TO_OBJECT) {
+/**
+ * Creates an object representation of this proto.
+ * Field names that are reserved in JavaScript and will be renamed to pb_name.
+ * Optional fields that are not set will be set to undefined.
+ * To access a reserved field use, foo.pb_<name>, eg, foo.pb_default.
+ * For the list of reserved names please see:
+ *     net/proto2/compiler/js/internal/generator.cc#kKeyword.
+ * @param {boolean=} opt_includeInstance Deprecated. whether to include the
+ *     JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @return {!Object}
+ */
+proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.toObject = function(opt_includeInstance) {
+  return proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.toObject(opt_includeInstance, this);
+};
+
+
+/**
+ * Static version of the {@see toObject} method.
+ * @param {boolean|undefined} includeInstance Deprecated. Whether to include
+ *     the JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @param {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent} msg The msg instance to transform.
+ * @return {!Object}
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.toObject = function(includeInstance, msg) {
+  var f, obj = {
+    metadata: (f = msg.getMetadata()) && proto.prehog.v1alpha.IntegrationEnrollMetadata.toObject(includeInstance, f)
+  };
+
+  if (includeInstance) {
+    obj.$jspbMessageInstance = msg;
+  }
+  return obj;
+};
+}
+
+
+/**
+ * Deserializes binary data (in protobuf wire format).
+ * @param {jspb.ByteSource} bytes The bytes to deserialize.
+ * @return {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent}
+ */
+proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.deserializeBinary = function(bytes) {
+  var reader = new jspb.BinaryReader(bytes);
+  var msg = new proto.prehog.v1alpha.UIIntegrationEnrollStartEvent;
+  return proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.deserializeBinaryFromReader(msg, reader);
+};
+
+
+/**
+ * Deserializes binary data (in protobuf wire format) from the
+ * given reader into the given message object.
+ * @param {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent} msg The message object to deserialize into.
+ * @param {!jspb.BinaryReader} reader The BinaryReader to use.
+ * @return {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent}
+ */
+proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.deserializeBinaryFromReader = function(msg, reader) {
+  while (reader.nextField()) {
+    if (reader.isEndGroup()) {
+      break;
+    }
+    var field = reader.getFieldNumber();
+    switch (field) {
+    case 1:
+      var value = new proto.prehog.v1alpha.IntegrationEnrollMetadata;
+      reader.readMessage(value,proto.prehog.v1alpha.IntegrationEnrollMetadata.deserializeBinaryFromReader);
+      msg.setMetadata(value);
+      break;
+    default:
+      reader.skipField();
+      break;
+    }
+  }
+  return msg;
+};
+
+
+/**
+ * Serializes the message to binary data (in protobuf wire format).
+ * @return {!Uint8Array}
+ */
+proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.serializeBinary = function() {
+  var writer = new jspb.BinaryWriter();
+  proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.serializeBinaryToWriter(this, writer);
+  return writer.getResultBuffer();
+};
+
+
+/**
+ * Serializes the given message to binary data (in protobuf wire
+ * format), writing to the given BinaryWriter.
+ * @param {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent} message
+ * @param {!jspb.BinaryWriter} writer
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.serializeBinaryToWriter = function(message, writer) {
+  var f = undefined;
+  f = message.getMetadata();
+  if (f != null) {
+    writer.writeMessage(
+      1,
+      f,
+      proto.prehog.v1alpha.IntegrationEnrollMetadata.serializeBinaryToWriter
+    );
+  }
+};
+
+
+/**
+ * optional IntegrationEnrollMetadata metadata = 1;
+ * @return {?proto.prehog.v1alpha.IntegrationEnrollMetadata}
+ */
+proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.getMetadata = function() {
+  return /** @type{?proto.prehog.v1alpha.IntegrationEnrollMetadata} */ (
+    jspb.Message.getWrapperField(this, proto.prehog.v1alpha.IntegrationEnrollMetadata, 1));
+};
+
+
+/**
+ * @param {?proto.prehog.v1alpha.IntegrationEnrollMetadata|undefined} value
+ * @return {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent} returns this
+*/
+proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.setMetadata = function(value) {
+  return jspb.Message.setWrapperField(this, 1, value);
+};
+
+
+/**
+ * Clears the message field making it undefined.
+ * @return {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent} returns this
  */
-proto.prehog.v1alpha.IntegrationEnrollMetadata.prototype.getUserName = function() {
-  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 3, ""));
+proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.clearMetadata = function() {
+  return this.setMetadata(undefined);
 };
 
 
 /**
- * @param {string} value
- * @return {!proto.prehog.v1alpha.IntegrationEnrollMetadata} returns this
+ * Returns whether this field is set.
+ * @return {boolean}
  */
-proto.prehog.v1alpha.IntegrationEnrollMetadata.prototype.setUserName = function(value) {
-  return jspb.Message.setProto3StringField(this, 3, value);
+proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.hasMetadata = function() {
+  return jspb.Message.getField(this, 1) != null;
 };
 
 
@@ -9654,8 +10574,8 @@ if (jspb.Message.GENERATE_TO_OBJECT) {
  *     http://goto/soy-param-migration
  * @return {!Object}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.toObject = function(opt_includeInstance) {
-  return proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.toObject(opt_includeInstance, this);
+proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.toObject = function(opt_includeInstance) {
+  return proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.toObject(opt_includeInstance, this);
 };
 
 
@@ -9664,11 +10584,11 @@ proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.toObject = function
  * @param {boolean|undefined} includeInstance Deprecated. Whether to include
  *     the JSPB instance for transitional soy proto support:
  *     http://goto/soy-param-migration
- * @param {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent} msg The msg instance to transform.
+ * @param {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent} msg The msg instance to transform.
  * @return {!Object}
  * @suppress {unusedLocalVariables} f is only used for nested messages
  */
-proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.toObject = function(includeInstance, msg) {
+proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.toObject = function(includeInstance, msg) {
   var f, obj = {
     metadata: (f = msg.getMetadata()) && proto.prehog.v1alpha.IntegrationEnrollMetadata.toObject(includeInstance, f)
   };
@@ -9684,23 +10604,23 @@ proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.toObject = function(includeIn
 /**
  * Deserializes binary data (in protobuf wire format).
  * @param {jspb.ByteSource} bytes The bytes to deserialize.
- * @return {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent}
+ * @return {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.deserializeBinary = function(bytes) {
+proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.deserializeBinary = function(bytes) {
   var reader = new jspb.BinaryReader(bytes);
-  var msg = new proto.prehog.v1alpha.UIIntegrationEnrollStartEvent;
-  return proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.deserializeBinaryFromReader(msg, reader);
+  var msg = new proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent;
+  return proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.deserializeBinaryFromReader(msg, reader);
 };
 
 
 /**
  * Deserializes binary data (in protobuf wire format) from the
  * given reader into the given message object.
- * @param {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent} msg The message object to deserialize into.
+ * @param {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent} msg The message object to deserialize into.
  * @param {!jspb.BinaryReader} reader The BinaryReader to use.
- * @return {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent}
+ * @return {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.deserializeBinaryFromReader = function(msg, reader) {
+proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.deserializeBinaryFromReader = function(msg, reader) {
   while (reader.nextField()) {
     if (reader.isEndGroup()) {
       break;
@@ -9725,9 +10645,9 @@ proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.deserializeBinaryFromReader =
  * Serializes the message to binary data (in protobuf wire format).
  * @return {!Uint8Array}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.serializeBinary = function() {
+proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.serializeBinary = function() {
   var writer = new jspb.BinaryWriter();
-  proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.serializeBinaryToWriter(this, writer);
+  proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.serializeBinaryToWriter(this, writer);
   return writer.getResultBuffer();
 };
 
@@ -9735,11 +10655,11 @@ proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.serializeBinary = f
 /**
  * Serializes the given message to binary data (in protobuf wire
  * format), writing to the given BinaryWriter.
- * @param {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent} message
+ * @param {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent} message
  * @param {!jspb.BinaryWriter} writer
  * @suppress {unusedLocalVariables} f is only used for nested messages
  */
-proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.serializeBinaryToWriter = function(message, writer) {
+proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.serializeBinaryToWriter = function(message, writer) {
   var f = undefined;
   f = message.getMetadata();
   if (f != null) {
@@ -9756,7 +10676,7 @@ proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.serializeBinaryToWriter = fun
  * optional IntegrationEnrollMetadata metadata = 1;
  * @return {?proto.prehog.v1alpha.IntegrationEnrollMetadata}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.getMetadata = function() {
+proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.getMetadata = function() {
   return /** @type{?proto.prehog.v1alpha.IntegrationEnrollMetadata} */ (
     jspb.Message.getWrapperField(this, proto.prehog.v1alpha.IntegrationEnrollMetadata, 1));
 };
@@ -9764,18 +10684,18 @@ proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.getMetadata = funct
 
 /**
  * @param {?proto.prehog.v1alpha.IntegrationEnrollMetadata|undefined} value
- * @return {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent} returns this
+ * @return {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent} returns this
 */
-proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.setMetadata = function(value) {
+proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.setMetadata = function(value) {
   return jspb.Message.setWrapperField(this, 1, value);
 };
 
 
 /**
  * Clears the message field making it undefined.
- * @return {!proto.prehog.v1alpha.UIIntegrationEnrollStartEvent} returns this
+ * @return {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent} returns this
  */
-proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.clearMetadata = function() {
+proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.clearMetadata = function() {
   return this.setMetadata(undefined);
 };
 
@@ -9784,7 +10704,7 @@ proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.clearMetadata = fun
  * Returns whether this field is set.
  * @return {boolean}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.prototype.hasMetadata = function() {
+proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.hasMetadata = function() {
   return jspb.Message.getField(this, 1) != null;
 };
 
@@ -9805,8 +10725,8 @@ if (jspb.Message.GENERATE_TO_OBJECT) {
  *     http://goto/soy-param-migration
  * @return {!Object}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.toObject = function(opt_includeInstance) {
-  return proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.toObject(opt_includeInstance, this);
+proto.prehog.v1alpha.EditorChangeEvent.prototype.toObject = function(opt_includeInstance) {
+  return proto.prehog.v1alpha.EditorChangeEvent.toObject(opt_includeInstance, this);
 };
 
 
@@ -9815,13 +10735,14 @@ proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.toObject = funct
  * @param {boolean|undefined} includeInstance Deprecated. Whether to include
  *     the JSPB instance for transitional soy proto support:
  *     http://goto/soy-param-migration
- * @param {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent} msg The msg instance to transform.
+ * @param {!proto.prehog.v1alpha.EditorChangeEvent} msg The msg instance to transform.
  * @return {!Object}
  * @suppress {unusedLocalVariables} f is only used for nested messages
  */
-proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.toObject = function(includeInstance, msg) {
+proto.prehog.v1alpha.EditorChangeEvent.toObject = function(includeInstance, msg) {
   var f, obj = {
-    metadata: (f = msg.getMetadata()) && proto.prehog.v1alpha.IntegrationEnrollMetadata.toObject(includeInstance, f)
+    userName: jspb.Message.getFieldWithDefault(msg, 1, ""),
+    status: jspb.Message.getFieldWithDefault(msg, 2, 0)
   };
 
   if (includeInstance) {
@@ -9835,23 +10756,23 @@ proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.toObject = function(includ
 /**
  * Deserializes binary data (in protobuf wire format).
  * @param {jspb.ByteSource} bytes The bytes to deserialize.
- * @return {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent}
+ * @return {!proto.prehog.v1alpha.EditorChangeEvent}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.deserializeBinary = function(bytes) {
+proto.prehog.v1alpha.EditorChangeEvent.deserializeBinary = function(bytes) {
   var reader = new jspb.BinaryReader(bytes);
-  var msg = new proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent;
-  return proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.deserializeBinaryFromReader(msg, reader);
+  var msg = new proto.prehog.v1alpha.EditorChangeEvent;
+  return proto.prehog.v1alpha.EditorChangeEvent.deserializeBinaryFromReader(msg, reader);
 };
 
 
 /**
  * Deserializes binary data (in protobuf wire format) from the
  * given reader into the given message object.
- * @param {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent} msg The message object to deserialize into.
+ * @param {!proto.prehog.v1alpha.EditorChangeEvent} msg The message object to deserialize into.
  * @param {!jspb.BinaryReader} reader The BinaryReader to use.
- * @return {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent}
+ * @return {!proto.prehog.v1alpha.EditorChangeEvent}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.deserializeBinaryFromReader = function(msg, reader) {
+proto.prehog.v1alpha.EditorChangeEvent.deserializeBinaryFromReader = function(msg, reader) {
   while (reader.nextField()) {
     if (reader.isEndGroup()) {
       break;
@@ -9859,9 +10780,12 @@ proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.deserializeBinaryFromReade
     var field = reader.getFieldNumber();
     switch (field) {
     case 1:
-      var value = new proto.prehog.v1alpha.IntegrationEnrollMetadata;
-      reader.readMessage(value,proto.prehog.v1alpha.IntegrationEnrollMetadata.deserializeBinaryFromReader);
-      msg.setMetadata(value);
+      var value = /** @type {string} */ (reader.readString());
+      msg.setUserName(value);
+      break;
+    case 2:
+      var value = /** @type {!proto.prehog.v1alpha.EditorChangeStatus} */ (reader.readEnum());
+      msg.setStatus(value);
       break;
     default:
       reader.skipField();
@@ -9876,9 +10800,9 @@ proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.deserializeBinaryFromReade
  * Serializes the message to binary data (in protobuf wire format).
  * @return {!Uint8Array}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.serializeBinary = function() {
+proto.prehog.v1alpha.EditorChangeEvent.prototype.serializeBinary = function() {
   var writer = new jspb.BinaryWriter();
-  proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.serializeBinaryToWriter(this, writer);
+  proto.prehog.v1alpha.EditorChangeEvent.serializeBinaryToWriter(this, writer);
   return writer.getResultBuffer();
 };
 
@@ -9886,57 +10810,62 @@ proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.serializeBinary
 /**
  * Serializes the given message to binary data (in protobuf wire
  * format), writing to the given BinaryWriter.
- * @param {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent} message
+ * @param {!proto.prehog.v1alpha.EditorChangeEvent} message
  * @param {!jspb.BinaryWriter} writer
  * @suppress {unusedLocalVariables} f is only used for nested messages
  */
-proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.serializeBinaryToWriter = function(message, writer) {
+proto.prehog.v1alpha.EditorChangeEvent.serializeBinaryToWriter = function(message, writer) {
   var f = undefined;
-  f = message.getMetadata();
-  if (f != null) {
-    writer.writeMessage(
+  f = message.getUserName();
+  if (f.length > 0) {
+    writer.writeString(
       1,
-      f,
-      proto.prehog.v1alpha.IntegrationEnrollMetadata.serializeBinaryToWriter
+      f
+    );
+  }
+  f = message.getStatus();
+  if (f !== 0.0) {
+    writer.writeEnum(
+      2,
+      f
     );
   }
 };
 
 
 /**
- * optional IntegrationEnrollMetadata metadata = 1;
- * @return {?proto.prehog.v1alpha.IntegrationEnrollMetadata}
+ * optional string user_name = 1;
+ * @return {string}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.getMetadata = function() {
-  return /** @type{?proto.prehog.v1alpha.IntegrationEnrollMetadata} */ (
-    jspb.Message.getWrapperField(this, proto.prehog.v1alpha.IntegrationEnrollMetadata, 1));
+proto.prehog.v1alpha.EditorChangeEvent.prototype.getUserName = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 1, ""));
 };
 
 
 /**
- * @param {?proto.prehog.v1alpha.IntegrationEnrollMetadata|undefined} value
- * @return {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent} returns this
-*/
-proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.setMetadata = function(value) {
-  return jspb.Message.setWrapperField(this, 1, value);
+ * @param {string} value
+ * @return {!proto.prehog.v1alpha.EditorChangeEvent} returns this
+ */
+proto.prehog.v1alpha.EditorChangeEvent.prototype.setUserName = function(value) {
+  return jspb.Message.setProto3StringField(this, 1, value);
 };
 
 
 /**
- * Clears the message field making it undefined.
- * @return {!proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent} returns this
+ * optional EditorChangeStatus status = 2;
+ * @return {!proto.prehog.v1alpha.EditorChangeStatus}
  */
-proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.clearMetadata = function() {
-  return this.setMetadata(undefined);
+proto.prehog.v1alpha.EditorChangeEvent.prototype.getStatus = function() {
+  return /** @type {!proto.prehog.v1alpha.EditorChangeStatus} */ (jspb.Message.getFieldWithDefault(this, 2, 0));
 };
 
 
 /**
- * Returns whether this field is set.
- * @return {boolean}
+ * @param {!proto.prehog.v1alpha.EditorChangeStatus} value
+ * @return {!proto.prehog.v1alpha.EditorChangeEvent} returns this
  */
-proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.hasMetadata = function() {
-  return jspb.Message.getField(this, 1) != null;
+proto.prehog.v1alpha.EditorChangeEvent.prototype.setStatus = function(value) {
+  return jspb.Message.setProto3EnumField(this, 2, value);
 };
 
 
@@ -9949,7 +10878,7 @@ proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.prototype.hasMetadata = fu
  * @private {!Array<!Array<number>>}
  * @const
  */
-proto.prehog.v1alpha.SubmitEventRequest.oneofGroups_ = [[3,4,5,6,7,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45]];
+proto.prehog.v1alpha.SubmitEventRequest.oneofGroups_ = [[3,4,5,6,7,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49]];
 
 /**
  * @enum {number}
@@ -9997,7 +10926,11 @@ proto.prehog.v1alpha.SubmitEventRequest.EventCase = {
   UI_CALL_TO_ACTION_CLICK_EVENT: 42,
   ASSIST_COMPLETION: 43,
   UI_INTEGRATION_ENROLL_START_EVENT: 44,
-  UI_INTEGRATION_ENROLL_COMPLETE_EVENT: 45
+  UI_INTEGRATION_ENROLL_COMPLETE_EVENT: 45,
+  EDITOR_CHANGE_EVENT: 46,
+  BOT_CREATE: 47,
+  UI_ONBOARD_QUESTIONNAIRE_SUBMIT: 48,
+  BOT_JOIN: 49
 };
 
 /**
@@ -10081,7 +11014,11 @@ proto.prehog.v1alpha.SubmitEventRequest.toObject = function(includeInstance, msg
     uiCallToActionClickEvent: (f = msg.getUiCallToActionClickEvent()) && proto.prehog.v1alpha.UICallToActionClickEvent.toObject(includeInstance, f),
     assistCompletion: (f = msg.getAssistCompletion()) && proto.prehog.v1alpha.AssistCompletionEvent.toObject(includeInstance, f),
     uiIntegrationEnrollStartEvent: (f = msg.getUiIntegrationEnrollStartEvent()) && proto.prehog.v1alpha.UIIntegrationEnrollStartEvent.toObject(includeInstance, f),
-    uiIntegrationEnrollCompleteEvent: (f = msg.getUiIntegrationEnrollCompleteEvent()) && proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.toObject(includeInstance, f)
+    uiIntegrationEnrollCompleteEvent: (f = msg.getUiIntegrationEnrollCompleteEvent()) && proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.toObject(includeInstance, f),
+    editorChangeEvent: (f = msg.getEditorChangeEvent()) && proto.prehog.v1alpha.EditorChangeEvent.toObject(includeInstance, f),
+    botCreate: (f = msg.getBotCreate()) && proto.prehog.v1alpha.BotCreateEvent.toObject(includeInstance, f),
+    uiOnboardQuestionnaireSubmit: (f = msg.getUiOnboardQuestionnaireSubmit()) && proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.toObject(includeInstance, f),
+    botJoin: (f = msg.getBotJoin()) && proto.prehog.v1alpha.BotJoinEvent.toObject(includeInstance, f)
   };
 
   if (includeInstance) {
@@ -10337,6 +11274,26 @@ proto.prehog.v1alpha.SubmitEventRequest.deserializeBinaryFromReader = function(m
       reader.readMessage(value,proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.deserializeBinaryFromReader);
       msg.setUiIntegrationEnrollCompleteEvent(value);
       break;
+    case 46:
+      var value = new proto.prehog.v1alpha.EditorChangeEvent;
+      reader.readMessage(value,proto.prehog.v1alpha.EditorChangeEvent.deserializeBinaryFromReader);
+      msg.setEditorChangeEvent(value);
+      break;
+    case 47:
+      var value = new proto.prehog.v1alpha.BotCreateEvent;
+      reader.readMessage(value,proto.prehog.v1alpha.BotCreateEvent.deserializeBinaryFromReader);
+      msg.setBotCreate(value);
+      break;
+    case 48:
+      var value = new proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent;
+      reader.readMessage(value,proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.deserializeBinaryFromReader);
+      msg.setUiOnboardQuestionnaireSubmit(value);
+      break;
+    case 49:
+      var value = new proto.prehog.v1alpha.BotJoinEvent;
+      reader.readMessage(value,proto.prehog.v1alpha.BotJoinEvent.deserializeBinaryFromReader);
+      msg.setBotJoin(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -10717,6 +11674,38 @@ proto.prehog.v1alpha.SubmitEventRequest.serializeBinaryToWriter = function(messa
       proto.prehog.v1alpha.UIIntegrationEnrollCompleteEvent.serializeBinaryToWriter
     );
   }
+  f = message.getEditorChangeEvent();
+  if (f != null) {
+    writer.writeMessage(
+      46,
+      f,
+      proto.prehog.v1alpha.EditorChangeEvent.serializeBinaryToWriter
+    );
+  }
+  f = message.getBotCreate();
+  if (f != null) {
+    writer.writeMessage(
+      47,
+      f,
+      proto.prehog.v1alpha.BotCreateEvent.serializeBinaryToWriter
+    );
+  }
+  f = message.getUiOnboardQuestionnaireSubmit();
+  if (f != null) {
+    writer.writeMessage(
+      48,
+      f,
+      proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent.serializeBinaryToWriter
+    );
+  }
+  f = message.getBotJoin();
+  if (f != null) {
+    writer.writeMessage(
+      49,
+      f,
+      proto.prehog.v1alpha.BotJoinEvent.serializeBinaryToWriter
+    );
+  }
 };
 
 
@@ -12329,6 +13318,154 @@ proto.prehog.v1alpha.SubmitEventRequest.prototype.hasUiIntegrationEnrollComplete
 };
 
 
+/**
+ * optional EditorChangeEvent editor_change_event = 46;
+ * @return {?proto.prehog.v1alpha.EditorChangeEvent}
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.getEditorChangeEvent = function() {
+  return /** @type{?proto.prehog.v1alpha.EditorChangeEvent} */ (
+    jspb.Message.getWrapperField(this, proto.prehog.v1alpha.EditorChangeEvent, 46));
+};
+
+
+/**
+ * @param {?proto.prehog.v1alpha.EditorChangeEvent|undefined} value
+ * @return {!proto.prehog.v1alpha.SubmitEventRequest} returns this
+*/
+proto.prehog.v1alpha.SubmitEventRequest.prototype.setEditorChangeEvent = function(value) {
+  return jspb.Message.setOneofWrapperField(this, 46, proto.prehog.v1alpha.SubmitEventRequest.oneofGroups_[0], value);
+};
+
+
+/**
+ * Clears the message field making it undefined.
+ * @return {!proto.prehog.v1alpha.SubmitEventRequest} returns this
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.clearEditorChangeEvent = function() {
+  return this.setEditorChangeEvent(undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.hasEditorChangeEvent = function() {
+  return jspb.Message.getField(this, 46) != null;
+};
+
+
+/**
+ * optional BotCreateEvent bot_create = 47;
+ * @return {?proto.prehog.v1alpha.BotCreateEvent}
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.getBotCreate = function() {
+  return /** @type{?proto.prehog.v1alpha.BotCreateEvent} */ (
+    jspb.Message.getWrapperField(this, proto.prehog.v1alpha.BotCreateEvent, 47));
+};
+
+
+/**
+ * @param {?proto.prehog.v1alpha.BotCreateEvent|undefined} value
+ * @return {!proto.prehog.v1alpha.SubmitEventRequest} returns this
+*/
+proto.prehog.v1alpha.SubmitEventRequest.prototype.setBotCreate = function(value) {
+  return jspb.Message.setOneofWrapperField(this, 47, proto.prehog.v1alpha.SubmitEventRequest.oneofGroups_[0], value);
+};
+
+
+/**
+ * Clears the message field making it undefined.
+ * @return {!proto.prehog.v1alpha.SubmitEventRequest} returns this
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.clearBotCreate = function() {
+  return this.setBotCreate(undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.hasBotCreate = function() {
+  return jspb.Message.getField(this, 47) != null;
+};
+
+
+/**
+ * optional UIOnboardQuestionnaireSubmitEvent ui_onboard_questionnaire_submit = 48;
+ * @return {?proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent}
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.getUiOnboardQuestionnaireSubmit = function() {
+  return /** @type{?proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent} */ (
+    jspb.Message.getWrapperField(this, proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent, 48));
+};
+
+
+/**
+ * @param {?proto.prehog.v1alpha.UIOnboardQuestionnaireSubmitEvent|undefined} value
+ * @return {!proto.prehog.v1alpha.SubmitEventRequest} returns this
+*/
+proto.prehog.v1alpha.SubmitEventRequest.prototype.setUiOnboardQuestionnaireSubmit = function(value) {
+  return jspb.Message.setOneofWrapperField(this, 48, proto.prehog.v1alpha.SubmitEventRequest.oneofGroups_[0], value);
+};
+
+
+/**
+ * Clears the message field making it undefined.
+ * @return {!proto.prehog.v1alpha.SubmitEventRequest} returns this
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.clearUiOnboardQuestionnaireSubmit = function() {
+  return this.setUiOnboardQuestionnaireSubmit(undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.hasUiOnboardQuestionnaireSubmit = function() {
+  return jspb.Message.getField(this, 48) != null;
+};
+
+
+/**
+ * optional BotJoinEvent bot_join = 49;
+ * @return {?proto.prehog.v1alpha.BotJoinEvent}
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.getBotJoin = function() {
+  return /** @type{?proto.prehog.v1alpha.BotJoinEvent} */ (
+    jspb.Message.getWrapperField(this, proto.prehog.v1alpha.BotJoinEvent, 49));
+};
+
+
+/**
+ * @param {?proto.prehog.v1alpha.BotJoinEvent|undefined} value
+ * @return {!proto.prehog.v1alpha.SubmitEventRequest} returns this
+*/
+proto.prehog.v1alpha.SubmitEventRequest.prototype.setBotJoin = function(value) {
+  return jspb.Message.setOneofWrapperField(this, 49, proto.prehog.v1alpha.SubmitEventRequest.oneofGroups_[0], value);
+};
+
+
+/**
+ * Clears the message field making it undefined.
+ * @return {!proto.prehog.v1alpha.SubmitEventRequest} returns this
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.clearBotJoin = function() {
+  return this.setBotJoin(undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.prehog.v1alpha.SubmitEventRequest.prototype.hasBotJoin = function() {
+  return jspb.Message.getField(this, 49) != null;
+};
+
+
 
 
 
@@ -12946,7 +14083,8 @@ proto.prehog.v1alpha.DiscoverResource = {
   DISCOVER_RESOURCE_DATABASE_SNOWFLAKE: 33,
   DISCOVER_RESOURCE_DOC_DATABASE_RDS_PROXY: 34,
   DISCOVER_RESOURCE_DOC_DATABASE_HIGH_AVAILABILITY: 35,
-  DISCOVER_RESOURCE_DOC_DATABASE_DYNAMIC_REGISTRATION: 36
+  DISCOVER_RESOURCE_DOC_DATABASE_DYNAMIC_REGISTRATION: 36,
+  DISCOVER_RESOURCE_SAML_APPLICATION: 37
 };
 
 /**
@@ -12970,7 +14108,8 @@ proto.prehog.v1alpha.CTA = {
   CTA_ACCESS_REQUESTS: 3,
   CTA_PREMIUM_SUPPORT: 4,
   CTA_TRUSTED_DEVICES: 5,
-  CTA_UPGRADE_BANNER: 6
+  CTA_UPGRADE_BANNER: 6,
+  CTA_BILLING_SUMMARY: 7
 };
 
 /**
@@ -12991,4 +14130,13 @@ proto.prehog.v1alpha.IntegrationEnrollKind = {
   INTEGRATION_ENROLL_KIND_JAMF: 11
 };
 
+/**
+ * @enum {number}
+ */
+proto.prehog.v1alpha.EditorChangeStatus = {
+  EDITOR_CHANGE_STATUS_UNSPECIFIED: 0,
+  EDITOR_CHANGE_STATUS_ROLE_GRANTED: 1,
+  EDITOR_CHANGE_STATUS_ROLE_REMOVED: 2
+};
+
 goog.object.extend(exports, proto.prehog.v1alpha);
diff --git a/gen/proto/js/teleport/lib/teleterm/v1/access_request_pb.d.ts b/gen/proto/js/teleport/lib/teleterm/v1/access_request_pb.d.ts
index d478a30e0a97f..2d9e8b1f3d8a6 100644
--- a/gen/proto/js/teleport/lib/teleterm/v1/access_request_pb.d.ts
+++ b/gen/proto/js/teleport/lib/teleterm/v1/access_request_pb.d.ts
@@ -173,6 +173,9 @@ export class ResourceDetails extends jspb.Message {
     getHostname(): string;
     setHostname(value: string): ResourceDetails;
 
+    getFriendlyName(): string;
+    setFriendlyName(value: string): ResourceDetails;
+
 
     serializeBinary(): Uint8Array;
     toObject(includeInstance?: boolean): ResourceDetails.AsObject;
@@ -187,6 +190,7 @@ export class ResourceDetails extends jspb.Message {
 export namespace ResourceDetails {
     export type AsObject = {
         hostname: string,
+        friendlyName: string,
     }
 }
 
diff --git a/gen/proto/js/teleport/lib/teleterm/v1/access_request_pb.js b/gen/proto/js/teleport/lib/teleterm/v1/access_request_pb.js
index ff0982d41f0f0..b9289d9ec8acd 100644
--- a/gen/proto/js/teleport/lib/teleterm/v1/access_request_pb.js
+++ b/gen/proto/js/teleport/lib/teleterm/v1/access_request_pb.js
@@ -1341,7 +1341,8 @@ proto.teleport.lib.teleterm.v1.ResourceDetails.prototype.toObject = function(opt
  */
 proto.teleport.lib.teleterm.v1.ResourceDetails.toObject = function(includeInstance, msg) {
   var f, obj = {
-    hostname: jspb.Message.getFieldWithDefault(msg, 1, "")
+    hostname: jspb.Message.getFieldWithDefault(msg, 1, ""),
+    friendlyName: jspb.Message.getFieldWithDefault(msg, 2, "")
   };
 
   if (includeInstance) {
@@ -1382,6 +1383,10 @@ proto.teleport.lib.teleterm.v1.ResourceDetails.deserializeBinaryFromReader = fun
       var value = /** @type {string} */ (reader.readString());
       msg.setHostname(value);
       break;
+    case 2:
+      var value = /** @type {string} */ (reader.readString());
+      msg.setFriendlyName(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -1418,6 +1423,13 @@ proto.teleport.lib.teleterm.v1.ResourceDetails.serializeBinaryToWriter = functio
       f
     );
   }
+  f = message.getFriendlyName();
+  if (f.length > 0) {
+    writer.writeString(
+      2,
+      f
+    );
+  }
 };
 
 
@@ -1439,6 +1451,24 @@ proto.teleport.lib.teleterm.v1.ResourceDetails.prototype.setHostname = function(
 };
 
 
+/**
+ * optional string friendly_name = 2;
+ * @return {string}
+ */
+proto.teleport.lib.teleterm.v1.ResourceDetails.prototype.getFriendlyName = function() {
+  return /** @type {string} */ (jspb.Message.getFieldWithDefault(this, 2, ""));
+};
+
+
+/**
+ * @param {string} value
+ * @return {!proto.teleport.lib.teleterm.v1.ResourceDetails} returns this
+ */
+proto.teleport.lib.teleterm.v1.ResourceDetails.prototype.setFriendlyName = function(value) {
+  return jspb.Message.setProto3StringField(this, 2, value);
+};
+
+
 
 
 
diff --git a/gen/proto/js/teleport/lib/teleterm/v1/cluster_pb.d.ts b/gen/proto/js/teleport/lib/teleterm/v1/cluster_pb.d.ts
index 85b6adc668ccf..4a4be80028a28 100644
--- a/gen/proto/js/teleport/lib/teleterm/v1/cluster_pb.d.ts
+++ b/gen/proto/js/teleport/lib/teleterm/v1/cluster_pb.d.ts
@@ -121,12 +121,6 @@ export namespace LoggedInUser {
 
 export class ACL extends jspb.Message { 
 
-    hasSessions(): boolean;
-    clearSessions(): void;
-    getSessions(): ResourceAccess | undefined;
-    setSessions(value?: ResourceAccess): ACL;
-
-
     hasAuthConnectors(): boolean;
     clearAuthConnectors(): void;
     getAuthConnectors(): ResourceAccess | undefined;
@@ -193,6 +187,18 @@ export class ACL extends jspb.Message {
     setAccessRequests(value?: ResourceAccess): ACL;
 
 
+    hasRecordedSessions(): boolean;
+    clearRecordedSessions(): void;
+    getRecordedSessions(): ResourceAccess | undefined;
+    setRecordedSessions(value?: ResourceAccess): ACL;
+
+
+    hasActiveSessions(): boolean;
+    clearActiveSessions(): void;
+    getActiveSessions(): ResourceAccess | undefined;
+    setActiveSessions(value?: ResourceAccess): ACL;
+
+
     serializeBinary(): Uint8Array;
     toObject(includeInstance?: boolean): ACL.AsObject;
     static toObject(includeInstance: boolean, msg: ACL): ACL.AsObject;
@@ -205,7 +211,6 @@ export class ACL extends jspb.Message {
 
 export namespace ACL {
     export type AsObject = {
-        sessions?: ResourceAccess.AsObject,
         authConnectors?: ResourceAccess.AsObject,
         roles?: ResourceAccess.AsObject,
         users?: ResourceAccess.AsObject,
@@ -217,6 +222,8 @@ export namespace ACL {
         dbs?: ResourceAccess.AsObject,
         kubeservers?: ResourceAccess.AsObject,
         accessRequests?: ResourceAccess.AsObject,
+        recordedSessions?: ResourceAccess.AsObject,
+        activeSessions?: ResourceAccess.AsObject,
     }
 }
 
@@ -236,6 +243,9 @@ export class ResourceAccess extends jspb.Message {
     getDelete(): boolean;
     setDelete(value: boolean): ResourceAccess;
 
+    getUse(): boolean;
+    setUse(value: boolean): ResourceAccess;
+
 
     serializeBinary(): Uint8Array;
     toObject(includeInstance?: boolean): ResourceAccess.AsObject;
@@ -254,6 +264,7 @@ export namespace ResourceAccess {
         edit: boolean,
         create: boolean,
         pb_delete: boolean,
+        use: boolean,
     }
 }
 
@@ -261,6 +272,9 @@ export class Features extends jspb.Message {
     getAdvancedAccessWorkflows(): boolean;
     setAdvancedAccessWorkflows(value: boolean): Features;
 
+    getIsUsageBasedBilling(): boolean;
+    setIsUsageBasedBilling(value: boolean): Features;
+
 
     serializeBinary(): Uint8Array;
     toObject(includeInstance?: boolean): Features.AsObject;
@@ -275,5 +289,6 @@ export class Features extends jspb.Message {
 export namespace Features {
     export type AsObject = {
         advancedAccessWorkflows: boolean,
+        isUsageBasedBilling: boolean,
     }
 }
diff --git a/gen/proto/js/teleport/lib/teleterm/v1/cluster_pb.js b/gen/proto/js/teleport/lib/teleterm/v1/cluster_pb.js
index 2bfabf8c1d228..b8887c319c83d 100644
--- a/gen/proto/js/teleport/lib/teleterm/v1/cluster_pb.js
+++ b/gen/proto/js/teleport/lib/teleterm/v1/cluster_pb.js
@@ -972,7 +972,6 @@ proto.teleport.lib.teleterm.v1.ACL.prototype.toObject = function(opt_includeInst
  */
 proto.teleport.lib.teleterm.v1.ACL.toObject = function(includeInstance, msg) {
   var f, obj = {
-    sessions: (f = msg.getSessions()) && proto.teleport.lib.teleterm.v1.ResourceAccess.toObject(includeInstance, f),
     authConnectors: (f = msg.getAuthConnectors()) && proto.teleport.lib.teleterm.v1.ResourceAccess.toObject(includeInstance, f),
     roles: (f = msg.getRoles()) && proto.teleport.lib.teleterm.v1.ResourceAccess.toObject(includeInstance, f),
     users: (f = msg.getUsers()) && proto.teleport.lib.teleterm.v1.ResourceAccess.toObject(includeInstance, f),
@@ -983,7 +982,9 @@ proto.teleport.lib.teleterm.v1.ACL.toObject = function(includeInstance, msg) {
     apps: (f = msg.getApps()) && proto.teleport.lib.teleterm.v1.ResourceAccess.toObject(includeInstance, f),
     dbs: (f = msg.getDbs()) && proto.teleport.lib.teleterm.v1.ResourceAccess.toObject(includeInstance, f),
     kubeservers: (f = msg.getKubeservers()) && proto.teleport.lib.teleterm.v1.ResourceAccess.toObject(includeInstance, f),
-    accessRequests: (f = msg.getAccessRequests()) && proto.teleport.lib.teleterm.v1.ResourceAccess.toObject(includeInstance, f)
+    accessRequests: (f = msg.getAccessRequests()) && proto.teleport.lib.teleterm.v1.ResourceAccess.toObject(includeInstance, f),
+    recordedSessions: (f = msg.getRecordedSessions()) && proto.teleport.lib.teleterm.v1.ResourceAccess.toObject(includeInstance, f),
+    activeSessions: (f = msg.getActiveSessions()) && proto.teleport.lib.teleterm.v1.ResourceAccess.toObject(includeInstance, f)
   };
 
   if (includeInstance) {
@@ -1020,11 +1021,6 @@ proto.teleport.lib.teleterm.v1.ACL.deserializeBinaryFromReader = function(msg, r
     }
     var field = reader.getFieldNumber();
     switch (field) {
-    case 1:
-      var value = new proto.teleport.lib.teleterm.v1.ResourceAccess;
-      reader.readMessage(value,proto.teleport.lib.teleterm.v1.ResourceAccess.deserializeBinaryFromReader);
-      msg.setSessions(value);
-      break;
     case 2:
       var value = new proto.teleport.lib.teleterm.v1.ResourceAccess;
       reader.readMessage(value,proto.teleport.lib.teleterm.v1.ResourceAccess.deserializeBinaryFromReader);
@@ -1080,6 +1076,16 @@ proto.teleport.lib.teleterm.v1.ACL.deserializeBinaryFromReader = function(msg, r
       reader.readMessage(value,proto.teleport.lib.teleterm.v1.ResourceAccess.deserializeBinaryFromReader);
       msg.setAccessRequests(value);
       break;
+    case 13:
+      var value = new proto.teleport.lib.teleterm.v1.ResourceAccess;
+      reader.readMessage(value,proto.teleport.lib.teleterm.v1.ResourceAccess.deserializeBinaryFromReader);
+      msg.setRecordedSessions(value);
+      break;
+    case 14:
+      var value = new proto.teleport.lib.teleterm.v1.ResourceAccess;
+      reader.readMessage(value,proto.teleport.lib.teleterm.v1.ResourceAccess.deserializeBinaryFromReader);
+      msg.setActiveSessions(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -1109,14 +1115,6 @@ proto.teleport.lib.teleterm.v1.ACL.prototype.serializeBinary = function() {
  */
 proto.teleport.lib.teleterm.v1.ACL.serializeBinaryToWriter = function(message, writer) {
   var f = undefined;
-  f = message.getSessions();
-  if (f != null) {
-    writer.writeMessage(
-      1,
-      f,
-      proto.teleport.lib.teleterm.v1.ResourceAccess.serializeBinaryToWriter
-    );
-  }
   f = message.getAuthConnectors();
   if (f != null) {
     writer.writeMessage(
@@ -1205,43 +1203,22 @@ proto.teleport.lib.teleterm.v1.ACL.serializeBinaryToWriter = function(message, w
       proto.teleport.lib.teleterm.v1.ResourceAccess.serializeBinaryToWriter
     );
   }
-};
-
-
-/**
- * optional ResourceAccess sessions = 1;
- * @return {?proto.teleport.lib.teleterm.v1.ResourceAccess}
- */
-proto.teleport.lib.teleterm.v1.ACL.prototype.getSessions = function() {
-  return /** @type{?proto.teleport.lib.teleterm.v1.ResourceAccess} */ (
-    jspb.Message.getWrapperField(this, proto.teleport.lib.teleterm.v1.ResourceAccess, 1));
-};
-
-
-/**
- * @param {?proto.teleport.lib.teleterm.v1.ResourceAccess|undefined} value
- * @return {!proto.teleport.lib.teleterm.v1.ACL} returns this
-*/
-proto.teleport.lib.teleterm.v1.ACL.prototype.setSessions = function(value) {
-  return jspb.Message.setWrapperField(this, 1, value);
-};
-
-
-/**
- * Clears the message field making it undefined.
- * @return {!proto.teleport.lib.teleterm.v1.ACL} returns this
- */
-proto.teleport.lib.teleterm.v1.ACL.prototype.clearSessions = function() {
-  return this.setSessions(undefined);
-};
-
-
-/**
- * Returns whether this field is set.
- * @return {boolean}
- */
-proto.teleport.lib.teleterm.v1.ACL.prototype.hasSessions = function() {
-  return jspb.Message.getField(this, 1) != null;
+  f = message.getRecordedSessions();
+  if (f != null) {
+    writer.writeMessage(
+      13,
+      f,
+      proto.teleport.lib.teleterm.v1.ResourceAccess.serializeBinaryToWriter
+    );
+  }
+  f = message.getActiveSessions();
+  if (f != null) {
+    writer.writeMessage(
+      14,
+      f,
+      proto.teleport.lib.teleterm.v1.ResourceAccess.serializeBinaryToWriter
+    );
+  }
 };
 
 
@@ -1652,6 +1629,80 @@ proto.teleport.lib.teleterm.v1.ACL.prototype.hasAccessRequests = function() {
 };
 
 
+/**
+ * optional ResourceAccess recorded_sessions = 13;
+ * @return {?proto.teleport.lib.teleterm.v1.ResourceAccess}
+ */
+proto.teleport.lib.teleterm.v1.ACL.prototype.getRecordedSessions = function() {
+  return /** @type{?proto.teleport.lib.teleterm.v1.ResourceAccess} */ (
+    jspb.Message.getWrapperField(this, proto.teleport.lib.teleterm.v1.ResourceAccess, 13));
+};
+
+
+/**
+ * @param {?proto.teleport.lib.teleterm.v1.ResourceAccess|undefined} value
+ * @return {!proto.teleport.lib.teleterm.v1.ACL} returns this
+*/
+proto.teleport.lib.teleterm.v1.ACL.prototype.setRecordedSessions = function(value) {
+  return jspb.Message.setWrapperField(this, 13, value);
+};
+
+
+/**
+ * Clears the message field making it undefined.
+ * @return {!proto.teleport.lib.teleterm.v1.ACL} returns this
+ */
+proto.teleport.lib.teleterm.v1.ACL.prototype.clearRecordedSessions = function() {
+  return this.setRecordedSessions(undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.teleport.lib.teleterm.v1.ACL.prototype.hasRecordedSessions = function() {
+  return jspb.Message.getField(this, 13) != null;
+};
+
+
+/**
+ * optional ResourceAccess active_sessions = 14;
+ * @return {?proto.teleport.lib.teleterm.v1.ResourceAccess}
+ */
+proto.teleport.lib.teleterm.v1.ACL.prototype.getActiveSessions = function() {
+  return /** @type{?proto.teleport.lib.teleterm.v1.ResourceAccess} */ (
+    jspb.Message.getWrapperField(this, proto.teleport.lib.teleterm.v1.ResourceAccess, 14));
+};
+
+
+/**
+ * @param {?proto.teleport.lib.teleterm.v1.ResourceAccess|undefined} value
+ * @return {!proto.teleport.lib.teleterm.v1.ACL} returns this
+*/
+proto.teleport.lib.teleterm.v1.ACL.prototype.setActiveSessions = function(value) {
+  return jspb.Message.setWrapperField(this, 14, value);
+};
+
+
+/**
+ * Clears the message field making it undefined.
+ * @return {!proto.teleport.lib.teleterm.v1.ACL} returns this
+ */
+proto.teleport.lib.teleterm.v1.ACL.prototype.clearActiveSessions = function() {
+  return this.setActiveSessions(undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.teleport.lib.teleterm.v1.ACL.prototype.hasActiveSessions = function() {
+  return jspb.Message.getField(this, 14) != null;
+};
+
+
 
 
 
@@ -1688,7 +1739,8 @@ proto.teleport.lib.teleterm.v1.ResourceAccess.toObject = function(includeInstanc
     read: jspb.Message.getBooleanFieldWithDefault(msg, 2, false),
     edit: jspb.Message.getBooleanFieldWithDefault(msg, 3, false),
     create: jspb.Message.getBooleanFieldWithDefault(msg, 4, false),
-    pb_delete: jspb.Message.getBooleanFieldWithDefault(msg, 5, false)
+    pb_delete: jspb.Message.getBooleanFieldWithDefault(msg, 5, false),
+    use: jspb.Message.getBooleanFieldWithDefault(msg, 6, false)
   };
 
   if (includeInstance) {
@@ -1745,6 +1797,10 @@ proto.teleport.lib.teleterm.v1.ResourceAccess.deserializeBinaryFromReader = func
       var value = /** @type {boolean} */ (reader.readBool());
       msg.setDelete(value);
       break;
+    case 6:
+      var value = /** @type {boolean} */ (reader.readBool());
+      msg.setUse(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -1809,6 +1865,13 @@ proto.teleport.lib.teleterm.v1.ResourceAccess.serializeBinaryToWriter = function
       f
     );
   }
+  f = message.getUse();
+  if (f) {
+    writer.writeBool(
+      6,
+      f
+    );
+  }
 };
 
 
@@ -1902,6 +1965,24 @@ proto.teleport.lib.teleterm.v1.ResourceAccess.prototype.setDelete = function(val
 };
 
 
+/**
+ * optional bool use = 6;
+ * @return {boolean}
+ */
+proto.teleport.lib.teleterm.v1.ResourceAccess.prototype.getUse = function() {
+  return /** @type {boolean} */ (jspb.Message.getBooleanFieldWithDefault(this, 6, false));
+};
+
+
+/**
+ * @param {boolean} value
+ * @return {!proto.teleport.lib.teleterm.v1.ResourceAccess} returns this
+ */
+proto.teleport.lib.teleterm.v1.ResourceAccess.prototype.setUse = function(value) {
+  return jspb.Message.setProto3BooleanField(this, 6, value);
+};
+
+
 
 
 
@@ -1934,7 +2015,8 @@ proto.teleport.lib.teleterm.v1.Features.prototype.toObject = function(opt_includ
  */
 proto.teleport.lib.teleterm.v1.Features.toObject = function(includeInstance, msg) {
   var f, obj = {
-    advancedAccessWorkflows: jspb.Message.getBooleanFieldWithDefault(msg, 1, false)
+    advancedAccessWorkflows: jspb.Message.getBooleanFieldWithDefault(msg, 1, false),
+    isUsageBasedBilling: jspb.Message.getBooleanFieldWithDefault(msg, 2, false)
   };
 
   if (includeInstance) {
@@ -1975,6 +2057,10 @@ proto.teleport.lib.teleterm.v1.Features.deserializeBinaryFromReader = function(m
       var value = /** @type {boolean} */ (reader.readBool());
       msg.setAdvancedAccessWorkflows(value);
       break;
+    case 2:
+      var value = /** @type {boolean} */ (reader.readBool());
+      msg.setIsUsageBasedBilling(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -2011,6 +2097,13 @@ proto.teleport.lib.teleterm.v1.Features.serializeBinaryToWriter = function(messa
       f
     );
   }
+  f = message.getIsUsageBasedBilling();
+  if (f) {
+    writer.writeBool(
+      2,
+      f
+    );
+  }
 };
 
 
@@ -2032,4 +2125,22 @@ proto.teleport.lib.teleterm.v1.Features.prototype.setAdvancedAccessWorkflows = f
 };
 
 
+/**
+ * optional bool is_usage_based_billing = 2;
+ * @return {boolean}
+ */
+proto.teleport.lib.teleterm.v1.Features.prototype.getIsUsageBasedBilling = function() {
+  return /** @type {boolean} */ (jspb.Message.getBooleanFieldWithDefault(this, 2, false));
+};
+
+
+/**
+ * @param {boolean} value
+ * @return {!proto.teleport.lib.teleterm.v1.Features} returns this
+ */
+proto.teleport.lib.teleterm.v1.Features.prototype.setIsUsageBasedBilling = function(value) {
+  return jspb.Message.setProto3BooleanField(this, 2, value);
+};
+
+
 goog.object.extend(exports, proto.teleport.lib.teleterm.v1);
diff --git a/gen/proto/js/teleport/lib/teleterm/v1/service_grpc_pb.js b/gen/proto/js/teleport/lib/teleterm/v1/service_grpc_pb.js
index 4a53e9962de72..57877a288204c 100644
--- a/gen/proto/js/teleport/lib/teleterm/v1/service_grpc_pb.js
+++ b/gen/proto/js/teleport/lib/teleterm/v1/service_grpc_pb.js
@@ -534,7 +534,12 @@ function deserialize_teleport_lib_teleterm_v1_UpdateTshdEventsServerAddressRespo
 }
 
 
-// TerminalService describes Teleterm service
+// TerminalService is used by the Electron app to communicate with the tsh daemon.
+//
+// While we aim to preserve backwards compatibility in order to satisfy CI checks and follow the
+// proto practices used within the company, this service is not guaranteed to be stable across
+// versions. The packaging process of Teleport Connect ensures that the server and the client use
+// the same version of the service.
 var TerminalServiceService = exports.TerminalServiceService = {
   // UpdateTshdEventsServerAddress lets the Electron app update the address the tsh daemon is
 // supposed to use when connecting to the tshd events gRPC service. This RPC needs to be made
diff --git a/go.mod b/go.mod
index 6bf6e92870e37..f8237f340e81d 100644
--- a/go.mod
+++ b/go.mod
@@ -4,10 +4,10 @@ go 1.20
 
 require (
 	cloud.google.com/go/compute/metadata v0.2.3
-	cloud.google.com/go/container v1.18.1
+	cloud.google.com/go/container v1.21.0
 	cloud.google.com/go/firestore v1.10.0
 	cloud.google.com/go/iam v1.1.0
-	cloud.google.com/go/kms v1.10.2
+	cloud.google.com/go/kms v1.12.1
 	cloud.google.com/go/storage v1.30.1
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.0
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0
@@ -17,7 +17,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/mysql/armmysqlflexibleservers v1.1.1
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresql v1.1.1
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresqlflexibleservers v1.1.0
-	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redis/armredis/v2 v2.2.1
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redis/armredis/v2 v2.3.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redisenterprise/armredisenterprise v1.1.1
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.1.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.1.0
@@ -29,37 +29,42 @@ require (
 	github.com/alicebob/miniredis/v2 v2.30.2
 	github.com/aquasecurity/libbpfgo v0.4.5-libbpf-1.0.1
 	github.com/armon/go-radix v1.0.0
-	github.com/aws/aws-sdk-go v1.44.271
-	github.com/aws/aws-sdk-go-v2 v1.18.0
-	github.com/aws/aws-sdk-go-v2/config v1.18.25
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.24
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3
+	github.com/aws/aws-sdk-go v1.44.280
+	github.com/aws/aws-sdk-go-v2 v1.18.1
+	github.com/aws/aws-sdk-go-v2/config v1.18.27
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.26
+	github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.25
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.67
-	github.com/aws/aws-sdk-go-v2/service/athena v1.28.0
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.98.0
-	github.com/aws/aws-sdk-go-v2/service/glue v1.50.0
+	github.com/aws/aws-sdk-go-v2/service/athena v1.30.2
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.102.0
+	github.com/aws/aws-sdk-go-v2/service/ecs v1.27.1
+	github.com/aws/aws-sdk-go-v2/service/glue v1.51.0
+	github.com/aws/aws-sdk-go-v2/service/iam v1.20.3
 	github.com/aws/aws-sdk-go-v2/service/rds v1.44.1
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.33.1
-	github.com/aws/aws-sdk-go-v2/service/sns v1.20.11
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.35.0
+	github.com/aws/aws-sdk-go-v2/service/sns v1.20.13
 	github.com/aws/aws-sdk-go-v2/service/sqs v1.22.0
-	github.com/aws/aws-sdk-go-v2/service/sts v1.19.0
+	github.com/aws/aws-sdk-go-v2/service/sts v1.19.2
 	github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin v0.0.0-20220331165046-e4d000c0d6a6
+	github.com/aws/smithy-go v1.13.5
 	github.com/beevik/etree v1.2.0
 	github.com/bufbuild/connect-go v1.7.0
+	github.com/buildkite/bintest/v3 v3.1.1
 	github.com/coreos/go-oidc v2.1.0+incompatible // replaced
 	github.com/coreos/go-semver v0.3.1
 	github.com/creack/pty v1.1.18
 	github.com/crewjam/saml v0.4.14-0.20230420111643-34930b26d33b
 	github.com/datastax/go-cassandra-native-protocol v0.0.0-20220706104457-5e8aad05cf90
 	github.com/dustin/go-humanize v1.0.1
-	github.com/elastic/go-elasticsearch/v8 v8.8.0
+	github.com/elastic/go-elasticsearch/v8 v8.8.1
 	github.com/flynn/hid v0.0.0-20190502022136-f1b9b6cc019a
 	github.com/flynn/u2f v0.0.0-20180613185708-15554eb68e5d
 	github.com/fsouza/fake-gcs-server v1.45.2
 	github.com/fxamacker/cbor/v2 v2.4.0
 	github.com/ghodss/yaml v1.0.0
 	github.com/gizak/termui/v3 v3.1.0
-	github.com/go-ldap/ldap/v3 v3.4.4
+	github.com/go-ldap/ldap/v3 v3.4.5
 	github.com/go-logr/logr v1.2.4
 	github.com/go-mysql-org/go-mysql v1.5.0 // replaced
 	github.com/go-piv/piv-go v1.11.0
@@ -67,7 +72,7 @@ require (
 	github.com/go-resty/resty/v2 v2.7.0
 	github.com/go-webauthn/webauthn v0.5.0
 	github.com/gobuffalo/flect v1.0.2 // indirect
-	github.com/gocql/gocql v1.4.0
+	github.com/gocql/gocql v1.5.2
 	github.com/gofrs/flock v0.8.1
 	github.com/gogo/protobuf v1.3.2 // replaced
 	github.com/golang-jwt/jwt/v4 v4.5.0
@@ -78,7 +83,7 @@ require (
 	github.com/google/go-tpm-tools v0.3.12
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/google/uuid v1.3.0
-	github.com/googleapis/gax-go/v2 v2.10.0
+	github.com/googleapis/gax-go/v2 v2.11.0
 	github.com/gorilla/websocket v1.5.0
 	github.com/gravitational/configure v0.0.0-20180808141939-c3428bd84c23
 	github.com/gravitational/form v0.0.0-20151109031454-c4048f792f70
@@ -104,6 +109,7 @@ require (
 	github.com/json-iterator/go v1.1.12
 	github.com/julienschmidt/httprouter v1.3.0 // replaced
 	github.com/keys-pub/go-libfido2 v1.5.3-0.20220306005615-8ab03fb1ec27 // replaced
+	github.com/kyroy/kdtree v0.0.0-20200419114247-70830f883f1d
 	github.com/mailgun/lemma v0.0.0-20170619173223-4214099fb348
 	github.com/mailgun/timetools v0.0.0-20170619190023-f3a7b8ffff47
 	github.com/mailgun/ttlmap v0.0.0-20170619185759-c1c17f74874f
@@ -124,20 +130,19 @@ require (
 	github.com/prometheus/common v0.44.0
 	github.com/russellhaering/gosaml2 v0.9.1
 	github.com/russellhaering/goxmldsig v1.4.0
-	github.com/sashabaranov/go-openai v1.9.5
+	github.com/sashabaranov/go-openai v1.10.1
 	github.com/schollz/progressbar/v3 v3.13.1
+	github.com/segmentio/parquet-go v0.0.0-20230622230624-510764ae9e80
 	github.com/sethvargo/go-diceware v0.3.0
 	github.com/sirupsen/logrus v1.9.3
-	github.com/snowflakedb/gosnowflake v1.6.21
+	github.com/snowflakedb/gosnowflake v1.6.22
 	github.com/spf13/cobra v1.7.0
 	github.com/stretchr/testify v1.8.3
 	github.com/ucarion/urlpath v0.0.0-20200424170820-7ccc79b76bbb
 	github.com/vulcand/predicate v1.2.0 // replaced
-	github.com/xitongsys/parquet-go v1.6.2
-	github.com/xitongsys/parquet-go-source v0.0.0-20230312005205-fbbcdea5f512
 	go.etcd.io/etcd/api/v3 v3.5.9
 	go.etcd.io/etcd/client/v3 v3.5.9
-	go.mongodb.org/mongo-driver v1.10.6
+	go.mongodb.org/mongo-driver v1.12.0
 	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
 	go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws v0.42.0
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0
@@ -148,37 +153,38 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.16.0
 	go.opentelemetry.io/otel/sdk v1.16.0
 	go.opentelemetry.io/otel/trace v1.16.0
-	go.opentelemetry.io/proto/otlp v0.19.0
-	golang.org/x/crypto v0.9.0 // replaced
+	go.opentelemetry.io/proto/otlp v0.20.0
+	golang.org/x/crypto v0.10.0 // replaced
 	golang.org/x/exp v0.0.0-20230213192124-5e25df0256eb
 	golang.org/x/mod v0.10.0
-	golang.org/x/net v0.10.0
+	golang.org/x/net v0.11.0
 	golang.org/x/oauth2 v0.8.0
 	golang.org/x/sync v0.2.0
-	golang.org/x/sys v0.8.0
-	golang.org/x/term v0.8.0
-	golang.org/x/text v0.9.0
+	golang.org/x/sys v0.9.0
+	golang.org/x/term v0.9.0
+	golang.org/x/text v0.10.0
 	golang.org/x/time v0.3.0
-	google.golang.org/api v0.125.0
+	google.golang.org/api v0.128.0
 	google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc // indirect
-	google.golang.org/grpc v1.55.0
+	google.golang.org/grpc v1.56.1
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0
 	google.golang.org/grpc/examples v0.0.0-20221010194801-c67245195065
 	google.golang.org/protobuf v1.30.0
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
+	gopkg.in/dnaeon/go-vcr.v3 v3.1.2
 	gopkg.in/ini.v1 v1.67.0
 	gopkg.in/square/go-jose.v2 v2.6.0
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.27.2
+	k8s.io/api v0.27.3
 	k8s.io/apiextensions-apiserver v0.27.2
-	k8s.io/apimachinery v0.27.2
-	k8s.io/apiserver v0.27.2
-	k8s.io/cli-runtime v0.27.2
-	k8s.io/client-go v0.27.2
-	k8s.io/component-base v0.27.2
+	k8s.io/apimachinery v0.27.3
+	k8s.io/apiserver v0.27.3
+	k8s.io/cli-runtime v0.27.3
+	k8s.io/client-go v0.27.3
+	k8s.io/component-base v0.27.3
 	k8s.io/klog/v2 v2.100.1
-	k8s.io/kubectl v0.27.2
+	k8s.io/kubectl v0.27.3
 	sigs.k8s.io/controller-runtime v0.15.0
 	sigs.k8s.io/controller-tools v0.12.0
 	sigs.k8s.io/yaml v1.3.0
@@ -201,7 +207,7 @@ require (
 	github.com/99designs/keyring v1.2.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0 // indirect
-	github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 // indirect
 	github.com/BurntSushi/toml v1.1.0 // indirect
 	github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c // indirect
@@ -209,23 +215,22 @@ require (
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
 	github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a // indirect
 	github.com/andybalholm/brotli v1.0.4 // indirect
-	github.com/apache/arrow/go/arrow v0.0.0-20200730104253-651201b0f516 // indirect
 	github.com/apache/arrow/go/v12 v12.0.0 // indirect
 	github.com/apache/thrift v0.16.0 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.25 // indirect
-	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.19.7 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.35 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.26 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.19.7
+	github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.14.11 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.28 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.29 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.27 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.12.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10 // indirect
-	github.com/aws/smithy-go v1.13.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.12.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.12 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/boombuler/barcode v1.0.1 // indirect
@@ -242,7 +247,7 @@ require (
 	github.com/dlclark/regexp2 v1.9.0 // indirect
 	github.com/docker/distribution v2.8.2+incompatible // indirect
 	github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
-	github.com/elastic/elastic-transport-go/v8 v8.2.0 // indirect
+	github.com/elastic/elastic-transport-go/v8 v8.3.0 // indirect
 	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
@@ -276,12 +281,12 @@ require (
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/renameio/v2 v2.0.0 // indirect
 	github.com/google/s2a-go v0.1.4 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.4 // indirect
 	github.com/gorilla/handlers v1.5.1 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
 	github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.0-rc.2.0.20220308023801-e4a6915ea237 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
 	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
 	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
@@ -308,6 +313,8 @@ require (
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/kyroy/priority-queue v0.0.0-20180327160706-6e21825e7e0c // indirect
+	github.com/lib/pq v1.10.4 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/lithammer/dedent v1.1.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
@@ -330,9 +337,11 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/nsf/termbox-go v1.1.1 // indirect
+	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/patrickmn/go-cache v0.0.0-20180815053127-5633e0862627 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
+	github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 // indirect
 	github.com/pierrec/lz4/v4 v4.1.17 // indirect
 	github.com/pingcap/errors v0.11.5-0.20201126102027-b0a155152ca3 // indirect
 	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
@@ -346,17 +355,19 @@ require (
 	github.com/rs/zerolog v1.28.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 // indirect
+	github.com/sasha-s/go-deadlock v0.0.0-20180226215254-237a9547c8a5 // indirect
+	github.com/segmentio/encoding v0.3.5 // indirect
 	github.com/shabbyrobe/gocovmerge v0.0.0-20190829150210-3e036491d500 // indirect
 	github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726 // indirect
 	github.com/siddontang/go-log v0.0.0-20180807004314-8d05993dda07 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/stretchr/objx v0.5.0 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
-	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tiktoken-go/tokenizer v0.1.0
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
-	github.com/xdg-go/scram v1.1.1 // indirect
-	github.com/xdg-go/stringprep v1.0.3 // indirect
+	github.com/xdg-go/scram v1.1.2 // indirect
+	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	github.com/xlab/treeprint v1.1.0 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d // indirect
@@ -378,9 +389,9 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22 // indirect
-	k8s.io/component-helpers v0.27.2 // indirect
+	k8s.io/component-helpers v0.27.3 // indirect
 	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
-	k8s.io/metrics v0.27.2 // indirect
+	k8s.io/metrics v0.27.3 // indirect
 	k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/kustomize/api v0.13.2 // indirect
@@ -404,7 +415,7 @@ replace (
 	// replace module github.com/moby/spdystream until https://github.com/moby/spdystream/pull/91 merges and deps are updated
 	// otherwise tests fail with a data race detection.
 	github.com/moby/spdystream => github.com/gravitational/spdystream v0.0.0-20230512133543-4e46862ca9bf
-	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.0
+	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.1
 	// Use our internal crypto fork, to work around the issue with OpenSSH <= 7.6 mentioned here: https://github.com/golang/go/issues/53391
 	golang.org/x/crypto => github.com/gravitational/crypto v0.6.0-1
 )
diff --git a/go.sum b/go.sum
index 99384c2497a72..fa6c02472ba73 100644
--- a/go.sum
+++ b/go.sum
@@ -24,7 +24,6 @@ cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPT
 cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
 cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
 cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
-cloud.google.com/go v0.82.0/go.mod h1:vlKccHJGuFBFufnAnuB08dfEH9Y3H7dzDzRECFdC2TA=
 cloud.google.com/go v0.83.0/go.mod h1:Z7MJUsANfY0pYPdw0lbnivPx4/vhy/e2FEkSkF7vAVY=
 cloud.google.com/go v0.84.0/go.mod h1:RazrYuxIK6Kb7YrzzhPoLmCVzl7Sup4NrbKPg8KHSUM=
 cloud.google.com/go v0.87.0/go.mod h1:TpDYlFy7vuLzZMMZ+B6iRiELaY7z/gJPaqbMx6mlWcY=
@@ -32,11 +31,6 @@ cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aD
 cloud.google.com/go v0.92.2/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go v0.92.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
-cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
-cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
-cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
-cloud.google.com/go v0.100.1/go.mod h1:fs4QogzfH5n2pBXBP9vRiU+eCny7lD2vmFZy79Iuw1U=
-cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
 cloud.google.com/go v0.110.2 h1:sdFPBr6xG9/wkBbfhmUz/JmZC7X6LavQgcrVINrKiVA=
 cloud.google.com/go v0.110.2/go.mod h1:k04UEeEtb6ZBRTv3dZz4CeJC3jKGxyhl0sAiVVquxiw=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
@@ -45,45 +39,31 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
-cloud.google.com/go/compute v1.2.0/go.mod h1:xlogom/6gr8RJGBe7nT2eGsQYAFUbbv8dbC29qE3Xmw=
-cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJWM7YD99wM=
-cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
 cloud.google.com/go/compute v1.19.3 h1:DcTwsFgGev/wV5+q8o2fzgcHOaac+DKGC91ZlvpsQds=
 cloud.google.com/go/compute v1.19.3/go.mod h1:qxvISKp/gYnXkSAD1ppcSOveRAmzxicEv/JlizULFrI=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-cloud.google.com/go/container v1.18.1 h1:kiWpJohdRQ38NpjNgdgBUCCQQZURXSJ8qcrLfMEw6C8=
-cloud.google.com/go/container v1.18.1/go.mod h1:SquvRVfP3NA5yd8hiKe8SSB5mXXIx3uX4QAXu3oFn4A=
+cloud.google.com/go/container v1.21.0 h1:5p7wasyCmFQvFHBunDS4WFYwkZy6CakJ3OxsldjF3Ls=
+cloud.google.com/go/container v1.21.0/go.mod h1:LjZELlCa9EVDYe1x10jNwTf5d37p9bpBMap7yb829LM=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
-cloud.google.com/go/firestore v1.6.1/go.mod h1:asNXNOzBdyVQmEU+ggO8UPodTkEVFW5Qx+rwHnAz+EY=
 cloud.google.com/go/firestore v1.10.0 h1:FG5C49ukKKqyljY+XNRZGae1HZaiVe7aoqi2BipnBuM=
 cloud.google.com/go/firestore v1.10.0/go.mod h1:eAeoQCV8F35Mcy4k8ZrQbcSYZOayIwoiU7ZJ6xzH1+o=
-cloud.google.com/go/iam v0.1.0/go.mod h1:vcUNEa0pEm0qRVpmWepWaFMIAI8/hjB9mO8rNCJtF6c=
-cloud.google.com/go/iam v0.1.1/go.mod h1:CKqrcnI/suGpybEHxZ7BMehL0oA4LpdyJdUlTl9jVMw=
-cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
 cloud.google.com/go/iam v1.1.0 h1:67gSqaPukx7O8WLLHMa0PNs3EBGd2eE4d+psbO/CO94=
 cloud.google.com/go/iam v1.1.0/go.mod h1:nxdHjaKfCr7fNYx/HJMM8LgiMugmveWlkatear5gVyk=
-cloud.google.com/go/kms v1.1.0/go.mod h1:WdbppnCDMDpOvoYBMn1+gNmOeEoZYqAv+HeuKARGCXI=
-cloud.google.com/go/kms v1.4.0/go.mod h1:fajBHndQ+6ubNw6Ss2sSd+SWvjL26RNo/dr7uxsnnOA=
-cloud.google.com/go/kms v1.10.2 h1:8UePKEypK3SQ6g+4mn/s/VgE5L7XOh+FwGGRUqvY3Hw=
-cloud.google.com/go/kms v1.10.2/go.mod h1:9mX3Q6pdroWzL20pbK6RaOdBbXBEhMNgK4Pfz2bweb4=
+cloud.google.com/go/kms v1.12.1 h1:xZmZuwy2cwzsocmKDOPu4BL7umg8QXagQx6fKVmf45U=
+cloud.google.com/go/kms v1.12.1/go.mod h1:c9J991h5DTl+kg7gi3MYomh12YEENGrf48ee/N/2CDM=
 cloud.google.com/go/longrunning v0.4.2 h1:WDKiiNXFTaQ6qz/G8FCOkuY9kJmOJGY67wPUC1M2RbE=
 cloud.google.com/go/longrunning v0.4.2/go.mod h1:OHrnaYyLUV6oqwh0xiS7e5sLQhP1m0QU9R+WhGDMgIQ=
 cloud.google.com/go/monitoring v0.1.0/go.mod h1:Hpm3XfzJv+UTiXzCG5Ffp0wijzHTC7Cv4eR7o3x/fEE=
-cloud.google.com/go/monitoring v1.1.0/go.mod h1:L81pzz7HKn14QCMaCs6NTQkdBnE87TElyanS95vIcl4=
-cloud.google.com/go/monitoring v1.4.0/go.mod h1:y6xnxfwI3hTFWOdkOaD7nfJVlwuC3/mS/5kvtT131p4=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
 cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
 cloud.google.com/go/pubsub v1.5.0/go.mod h1:ZEwJccE3z93Z2HWvstpri00jOg7oO4UZDtKhwDwqF0w=
-cloud.google.com/go/pubsub v1.19.0/go.mod h1:/O9kmSe9bb9KRnIAWkzmqhPjHo6LtzGOBYd/kr06XSs=
 cloud.google.com/go/pubsub v1.31.0 h1:aXdyyJz90kA+bor9+6+xHAciMD5mj8v15WqFZ5E0sek=
 cloud.google.com/go/pubsub v1.31.0/go.mod h1:dYmJ3K97NCQ/e4OwZ20rD4Ym3Bu8Gu9m/aJdWQjdcks=
-cloud.google.com/go/secretmanager v1.3.0/go.mod h1:+oLTkouyiYiabAQNugCeTS3PAArGiMJuBqvJnJsyH+U=
 cloud.google.com/go/spanner v1.7.0/go.mod h1:sd3K2gZ9Fd0vMPLXzeCrF6fq4i63Q7aTLW/lBIfBkIk=
 cloud.google.com/go/spanner v1.17.0/go.mod h1:+17t2ixFwRG4lWRwE+5kipDR9Ef07Jkmc8z0IbMDKUs=
 cloud.google.com/go/spanner v1.18.0/go.mod h1:LvAjUXPeJRGNuGpikMULjhLj/t9cRvdc+fxRoLiugXA=
@@ -93,23 +73,17 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.21.0/go.mod h1:XmRlxkgPjlBONznT2dDUU/5XlpU2OjMnKuqnZI01LAA=
 cloud.google.com/go/storage v1.30.1 h1:uOdMxAs8HExqBlnLtnQyP0YkvbiDpdGShGKtx6U/oNM=
 cloud.google.com/go/storage v1.30.1/go.mod h1:NfxhC0UJE1aXSx7CIIbCf7y9HKT7BiccwkR7+P7gN8E=
 cloud.google.com/go/trace v0.1.0/go.mod h1:wxEwsoeRVPbeSkt7ZC9nWCgmoKQRAoySN7XHW2AmI7g=
-cloud.google.com/go/trace v1.0.0/go.mod h1:4iErSByzxkyHWzzlAj63/Gmjz0NH1ASqhJguHpGcr6A=
-cloud.google.com/go/trace v1.2.0/go.mod h1:Wc8y/uYyOhPy12KEnXG9XGrvfMz5F5SrYecQlbW1rwM=
 code.gitea.io/sdk/gitea v0.11.3/go.mod h1:z3uwDV/b9Ls47NGukYM9XhnHtqPh/J+t40lsUrR6JDY=
 contrib.go.opencensus.io/exporter/aws v0.0.0-20181029163544-2befc13012d0/go.mod h1:uu1P0UCM/6RbsMrgPa98ll8ZcHM858i/AD06a9aLRCA=
-contrib.go.opencensus.io/exporter/aws v0.0.0-20200617204711-c478e41e60e9/go.mod h1:uu1P0UCM/6RbsMrgPa98ll8ZcHM858i/AD06a9aLRCA=
 contrib.go.opencensus.io/exporter/ocagent v0.5.0/go.mod h1:ImxhfLRpxoYiSq891pBrLVhN+qmP8BTVvdH2YLs7Gl0=
 contrib.go.opencensus.io/exporter/stackdriver v0.12.1/go.mod h1:iwB6wGarfphGGe/e5CWqyUk/cLzKnWsOKPVW3no6OTw=
 contrib.go.opencensus.io/exporter/stackdriver v0.13.4/go.mod h1:aXENhDJ1Y4lIg4EUaVTwzvYETVNZk10Pu26tevFKLUc=
 contrib.go.opencensus.io/exporter/stackdriver v0.13.5/go.mod h1:aXENhDJ1Y4lIg4EUaVTwzvYETVNZk10Pu26tevFKLUc=
 contrib.go.opencensus.io/exporter/stackdriver v0.13.8/go.mod h1:huNtlWx75MwO7qMs0KrMxPZXzNNWebav1Sq/pm02JdQ=
-contrib.go.opencensus.io/exporter/stackdriver v0.13.10/go.mod h1:I5htMbyta491eUxufwwZPQdcKvvgzMB4O9ni41YnIM8=
 contrib.go.opencensus.io/integrations/ocsql v0.1.4/go.mod h1:8DsSdjz3F+APR+0z0WkU1aRorQCFfRxvqjUUPMbF3fE=
-contrib.go.opencensus.io/integrations/ocsql v0.1.7/go.mod h1:8DsSdjz3F+APR+0z0WkU1aRorQCFfRxvqjUUPMbF3fE=
 contrib.go.opencensus.io/resource v0.1.1/go.mod h1:F361eGI91LCmW1I/Saf+rX0+OFcigGlFvXwEGEnkRLA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:/vQbFIOMbk2FiG/kXiLl8BRyzTWDw7gX/Hz7Dd5eDMs=
@@ -117,28 +91,17 @@ github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:hN
 github.com/99designs/keyring v1.2.2 h1:pZd3neh/EmUzWONb35LxQfvuY7kiSXAq3HQd97+XBn0=
 github.com/99designs/keyring v1.2.2/go.mod h1:wes/FrByc8j7lFOAGLGSNEg8f/PaI3cgTBqhFkHUrPk=
 github.com/Azure/azure-amqp-common-go/v2 v2.1.0/go.mod h1:R8rea+gJRuJR6QxTir/XuEd+YuKoUiazDC/N96FiDEU=
-github.com/Azure/azure-amqp-common-go/v3 v3.2.1/go.mod h1:O6X1iYHP7s2x7NjUKsXVhkwWrQhxrd+d8/3rRadj4CI=
-github.com/Azure/azure-amqp-common-go/v3 v3.2.2/go.mod h1:O6X1iYHP7s2x7NjUKsXVhkwWrQhxrd+d8/3rRadj4CI=
 github.com/Azure/azure-pipeline-go v0.2.1/go.mod h1:UGSo8XybXnIGZ3epmeBw7Jdz+HiUVpqIlpz/HKHylF4=
-github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=
 github.com/Azure/azure-sdk-for-go v29.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
+github.com/Azure/azure-sdk-for-go v30.1.0+incompatible h1:HyYPft8wXpxMd0kfLtXo6etWcO+XuPbLkcgx9g2cqxU=
 github.com/Azure/azure-sdk-for-go v30.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
-github.com/Azure/azure-sdk-for-go v51.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
-github.com/Azure/azure-sdk-for-go v59.3.0+incompatible h1:dPIm0BO4jsMXFcCI/sLTPkBtE7mk8WMuRHA0JeWhlcQ=
-github.com/Azure/azure-sdk-for-go v59.3.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.0.0/go.mod h1:uGG2W01BaETf0Ozp+QxxKJdMBNRWPdstHG0Fmdwn1/U=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.1.1/go.mod h1:uGG2W01BaETf0Ozp+QxxKJdMBNRWPdstHG0Fmdwn1/U=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.3.0/go.mod h1:tZoQYdDZNOiIjdSn0dVWVfl0NEPGOJqVLzSrcFk4Is0=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.0 h1:8kDqDngH+DmVBiCtIjCFTGa7MBnsIOkF9IccInFEbjk=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.0/go.mod h1:bjGvMhVMb+EEm3VRNQawDMUyMMjo+S5ewNjflkep/0Q=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.11.0/go.mod h1:HcM1YX14R7CJcghJGOYCgdezslRSVzqwLf/q+4Y2r/0=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.0.0/go.mod h1:+6sju8gk8FRmSajX3Oz4G5Gm7P+mbqE9FVaXXFYTkCM=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.1.0/go.mod h1:bhXu1AjYL+wutSL/kpSq6s7733q2Rb0yuot9Zgfqa/0=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0/go.mod h1:NBanQUfSWiWn3QEpWDTCU0IjBECKOYvl2R8xdRtMtiM=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 h1:vcYCAze6p19qBW7MhZybIsqD8sMV8js0NyQM8JDnVtg=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0/go.mod h1:OQeznEEkTZ9OrhHJoDD8ZDq51FHgXjqtP9z6bEwBq9U=
-github.com/Azure/azure-sdk-for-go/sdk/internal v0.7.0/go.mod h1:yqy467j36fJxcRV2TzfVZ1pCb5vxm4BtZPUdYWe/Xo8=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.0/go.mod h1:eWRD7oawr1Mu1sLCawqVc0CUiF43ia3qQMxLscsKQ9w=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.1/go.mod h1:eWRD7oawr1Mu1sLCawqVc0CUiF43ia3qQMxLscsKQ9w=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 h1:sXr+ck84g/ZlZUOZiNELInmMgOsuGwdjjVkEIde0OtY=
@@ -157,8 +120,8 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresql v
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresql v1.1.1/go.mod h1:XuVagOJ3SVFrcbWgteWmWc9688zWn16w4sVkxdIu7sw=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresqlflexibleservers v1.1.0 h1:HzqcSJWx32XQdr8KtxAu/SZJj0PqDo9tKf2YGPdynV0=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/postgresql/armpostgresqlflexibleservers v1.1.0/go.mod h1:nKcJObAisSPDrO9lMuuCBoYY7Ki7ADt8p6XmBhpKNTk=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redis/armredis/v2 v2.2.1 h1:A91PbIt7bzfBRlfBSe8Yx0XCU7Qu2xT6IfO+ioiqgu8=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redis/armredis/v2 v2.2.1/go.mod h1:FMVQhV2nfxsI9cDUBqn/rWfN5y1KxwZ/+q1Bl1oqko0=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redis/armredis/v2 v2.3.0 h1:/DeaPA3K0LQXaFGsGJMBeCswc2arEsM1SsueqAJIwe8=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redis/armredis/v2 v2.3.0/go.mod h1:FMVQhV2nfxsI9cDUBqn/rWfN5y1KxwZ/+q1Bl1oqko0=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redisenterprise/armredisenterprise v1.1.1 h1:YJ85UcbuFt2quyUS6NntBPuXMk8ob2zHOeFlXZysSwA=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/redisenterprise/armredisenterprise v1.1.1/go.mod h1:Xv4zciAMUA5eyLkWrsvDai7VLndnthFMRkPDmDNNF0I=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.0.0 h1:ECsQtyERDVz3NP3kvDOTLvbQhqWp/x9EsGKtb4ogUr8=
@@ -166,38 +129,15 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.1.0 h1:G2MvN
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.1.0/go.mod h1:f/IvRlQ/eFP31UXVUwh3BzTOOC2cEo6/u+7g9+KTzPk=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.1.0 h1:pYhaMoTHP/zYIJGDA1sWsfyTDjdglaoYjIFMOEcL+/U=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.1.0/go.mod h1:iLq8GwpQhj09gpI4EdELwifR9kHrb/Q0LThq6iQq9yY=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v0.4.1/go.mod h1:eZ4g6GUvXiGulfIbbhh1Xr4XwUYaYaWMqzGD/284wCA=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0 h1:u/LLAOFgsMv7HmNL4Qufg58y+qElGOt5qv0z1mURkRY=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0/go.mod h1:2e8rMJtl2+2j+HXbTBwnyGpm5Nou7KhvSfxOq8JpTag=
 github.com/Azure/azure-service-bus-go v0.9.1/go.mod h1:yzBx6/BUGfjfeqbRZny9AQIbIe3AcV9WZbAdpkoXOa0=
-github.com/Azure/azure-service-bus-go v0.11.5/go.mod h1:MI6ge2CuQWBVq+ly456MY7XqNLJip5LO1iSFodbNLbU=
 github.com/Azure/azure-storage-blob-go v0.8.0/go.mod h1:lPI3aLPpuLTeUwh1sViKXFxwl2B6teiRqI0deQUvsw0=
-github.com/Azure/azure-storage-blob-go v0.14.0/go.mod h1:SMqIBi+SuiQH32bvyjngEewEeXoPfKMgWlBDaYf6fck=
-github.com/Azure/go-amqp v0.16.0/go.mod h1:9YJ3RhxRT1gquYnzpZO1vcYMMpAdJT+QEg6fwmw9Zlg=
-github.com/Azure/go-amqp v0.16.4/go.mod h1:9YJ3RhxRT1gquYnzpZO1vcYMMpAdJT+QEg6fwmw9Zlg=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-autorest v12.0.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
-github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
-github.com/Azure/go-autorest/autorest v0.11.18/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA=
-github.com/Azure/go-autorest/autorest v0.11.19/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA=
-github.com/Azure/go-autorest/autorest v0.11.22/go.mod h1:BAWYUWGPEtKPzjVkp0Q6an0MJcJDsoh5Z1BFAEFs4Xs=
-github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
-github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
-github.com/Azure/go-autorest/autorest/adal v0.9.14/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
-github.com/Azure/go-autorest/autorest/adal v0.9.17/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ=
-github.com/Azure/go-autorest/autorest/azure/auth v0.5.9/go.mod h1:hg3/1yw0Bq87O3KvvnJoAh34/0zbP7SFizX/qN5JvjU=
-github.com/Azure/go-autorest/autorest/azure/cli v0.4.2/go.mod h1:7qkJkT+j6b+hIpzMOwPChJhTqS8VbsqqgULzMNRugoM=
-github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
-github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
-github.com/Azure/go-autorest/autorest/to v0.4.0/go.mod h1:fE8iZBn7LQR7zH/9XU2NcPR4o9jEImooCeWJcYV/zLE=
-github.com/Azure/go-autorest/autorest/validation v0.3.1/go.mod h1:yhLgjC0Wda5DYXl6JAsWyUe4KVNffhoDhG0zVzUMo3E=
-github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
-github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
-github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e h1:NeAW1fUYUEWhft7pkxDf6WoUvEZJ/uOKsvtpjLnn8MU=
-github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
-github.com/AzureAD/microsoft-authentication-library-for-go v0.4.0/go.mod h1:Vt9sXTKwMyGcOxSmLDMnGPgqsUg7m8pe215qMLrDXw4=
-github.com/AzureAD/microsoft-authentication-library-for-go v0.5.1/go.mod h1:Vt9sXTKwMyGcOxSmLDMnGPgqsUg7m8pe215qMLrDXw4=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0/go.mod h1:BDJ5qMFKx9DugEg3+uQSDCdbYPr5s9vBTrL9P8TpqOU=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 h1:OBhqkivkhkMqLPymWEppkm7vgPQY2XsHoEkaMQ0AdZY=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0/go.mod h1:kgDmCTgBzIEPFElEF+FK0SdjAor06dRq2Go927dnQ6o=
@@ -206,7 +146,6 @@ github.com/BurntSushi/toml v1.1.0 h1:ksErzDEI1khOiGPgpwuI7x2ebx/uXQNw7xJpn9Eq1+I
 github.com/BurntSushi/toml v1.1.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/GoogleCloudPlatform/cloudsql-proxy v0.0.0-20191009163259-e802c2cb94ae/go.mod h1:mjwGPas4yKduTyubHvD1Atl9r1rUq8DfVy+gkVvZ+oo=
-github.com/GoogleCloudPlatform/cloudsql-proxy v1.29.0/go.mod h1:spvB9eLJH9dutlbPSRmHvSXXHOwGRyeXh1jVdquA2G8=
 github.com/HdrHistogram/hdrhistogram-go v1.1.2 h1:5IcZpTvzydCQeHzK4Ef/D5rrSqwxob0t8PQPMybUNFM=
 github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXYg9BVp4O+o5f6V/ehm6Oo=
 github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
@@ -243,6 +182,8 @@ github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRF
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a h1:HbKu58rmZpUGpz5+4FfNmIU+FmZg2P3Xaj2v2bfNWmk=
 github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
 github.com/alicebob/miniredis/v2 v2.30.2 h1:lc1UAUT9ZA7h4srlfBmBt2aorm5Yftk9nBjxz7EyY9I=
@@ -253,16 +194,12 @@ github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYU
 github.com/antihax/optional v0.0.0-20180407024304-ca021399b1a6/go.mod h1:V8iCPQYkqmusNa815XgQio277wI47sdRh1dUOLdyC6Q=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/aokoli/goutils v1.0.1/go.mod h1:SijmP0QR8LtwsmDs8Yii5Z/S4trXFGFC2oO5g9DP+DQ=
-github.com/apache/arrow/go/arrow v0.0.0-20200730104253-651201b0f516 h1:byKBBF2CKWBjjA4J1ZL2JXttJULvWSl50LegTyRZ728=
-github.com/apache/arrow/go/arrow v0.0.0-20200730104253-651201b0f516/go.mod h1:QNYViu/X0HXDHw7m3KXzWSVXIbfUvJqBFe6Gj8/pYA0=
 github.com/apache/arrow/go/v12 v12.0.0 h1:xtZE63VWl7qLdB0JObIXvvhGjoVNrQ9ciIHG2OK5cmc=
 github.com/apache/arrow/go/v12 v12.0.0/go.mod h1:d+tV/eHZZ7Dz7RPrFKtPK02tpr+c9/PEd/zm8mDS9Vg=
 github.com/apache/beam v2.28.0+incompatible/go.mod h1:/8NX3Qi8vGstDLLaeaU7+lzVEu/ACaQhYjeefzQ0y1o=
 github.com/apache/beam v2.32.0+incompatible/go.mod h1:/8NX3Qi8vGstDLLaeaU7+lzVEu/ACaQhYjeefzQ0y1o=
-github.com/apache/thrift v0.0.0-20181112125854-24918abba929/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
 github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
 github.com/apache/thrift v0.13.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
-github.com/apache/thrift v0.14.2/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
 github.com/apache/thrift v0.16.0 h1:qEy6UW60iVOlUy+b9ZR0d5WzUWYGOo4HfopoyBaNmoY=
 github.com/apache/thrift v0.16.0/go.mod h1:PHK3hniurgQaNMZYaCLEqXKsYK8upmhPbmdP2FXSqgU=
 github.com/apex/log v1.1.4/go.mod h1:AlpoD9aScyQfJDVHmLMEcx4oU6LqzkWp4Mg9GdAcEvQ=
@@ -290,89 +227,88 @@ github.com/aws/aws-sdk-go v1.23.20/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpi
 github.com/aws/aws-sdk-go v1.25.11/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.25.37/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
-github.com/aws/aws-sdk-go v1.30.19/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
 github.com/aws/aws-sdk-go v1.37.0/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
-github.com/aws/aws-sdk-go v1.43.31/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go v1.44.263/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
-github.com/aws/aws-sdk-go v1.44.271 h1:aa+Nu2JcnFmW1TLIz/67SS7KPq1I1Adl4RmExSMjGVo=
-github.com/aws/aws-sdk-go v1.44.271/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go v1.44.280 h1:UYl/yxhDxP8naok6ftWyQ9/9ZzNwjC9dvEs/j8BkGhw=
+github.com/aws/aws-sdk-go v1.44.280/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
-github.com/aws/aws-sdk-go-v2 v1.16.2/go.mod h1:ytwTPBG6fXTZLxxeeCCWj2/EMYp/xDUgX+OET6TLNNU=
-github.com/aws/aws-sdk-go-v2 v1.18.0 h1:882kkTpSFhdgYRKVZ/VCgf7sd0ru57p2JCxz4/oN5RY=
 github.com/aws/aws-sdk-go-v2 v1.18.0/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.1/go.mod h1:n8Bs1ElDD2wJ9kCRTczA83gYbBmjSwZp3umc6zF4EeM=
+github.com/aws/aws-sdk-go-v2 v1.18.1 h1:+tefE750oAb7ZQGzla6bLkOwfcQCEtC5y2RqoqCeqKo=
+github.com/aws/aws-sdk-go-v2 v1.18.1/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 h1:dK82zF6kkPeCo8J1e+tGx4JdvDIQzj7ygIoLg8WMuGs=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10/go.mod h1:VeTZetY5KRJLuD/7fkQXMU6Mw7H5m/KP2J5Iy9osMno=
-github.com/aws/aws-sdk-go-v2/config v1.15.3/go.mod h1:9YL3v07Xc/ohTsxFXzan9ZpFpdTOFl4X65BAKYaz8jg=
-github.com/aws/aws-sdk-go-v2/config v1.18.25 h1:JuYyZcnMPBiFqn87L2cRppo+rNwgah6YwD3VuyvaW6Q=
 github.com/aws/aws-sdk-go-v2/config v1.18.25/go.mod h1:dZnYpD5wTW/dQF0rRNLVypB396zWCcPiBIvdvSWHEg4=
-github.com/aws/aws-sdk-go-v2/credentials v1.11.2/go.mod h1:j8YsY9TXTm31k4eFhspiQicfXPLZ0gYXA50i4gxPE8g=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.24 h1:PjiYyls3QdCrzqUN35jMWtUK1vqVZ+zLfdOa/UPFDp0=
+github.com/aws/aws-sdk-go-v2/config v1.18.27 h1:Az9uLwmssTE6OGTpsFqOnaGpLnKDqNYOJzWuC6UAYzA=
+github.com/aws/aws-sdk-go-v2/config v1.18.27/go.mod h1:0My+YgmkGxeqjXZb5BYme5pc4drjTnM+x1GJ3zv42Nw=
 github.com/aws/aws-sdk-go-v2/credentials v1.13.24/go.mod h1:jYPYi99wUOPIFi0rhiOvXeSEReVOzBqFNOX5bXYoG2o=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.3/go.mod h1:uk1vhHHERfSVCUnqSqz8O48LBYDSC+k6brng09jcMOk=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3 h1:jJPgroehGvjrde3XufFIJUZVK5A2L9a3KwSFgKy9n8w=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.26 h1:qmU+yhKmOCyujmuPY7tf5MxR/RKyZrOPO3V4DobiTUk=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.26/go.mod h1:GoXt2YC8jHUBbA4jr+W3JiemnIbkXOfxSXcisUsZ3os=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.25 h1:/+Z/dCO+1QHOlCm7m9G61snvIaDRUTv/HXp+8HdESiY=
+github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.25/go.mod h1:JQ0HJ+3LaAKHx3uwRUAfR/tb/gOlgAGPT6mZfIq55Ec=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3/go.mod h1:4Q0UFP0YJf0NrsEuEYHpM9fTSEVnD16Z3uyEF7J9JGM=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.3/go.mod h1:0dHuD2HZZSiwfJSy1FO5bX1hQ1TxVV1QXXjpn3XUE44=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4 h1:LxK/bitrAr4lnh9LnIS6i7zWbCOdMsfzKFBI6LUCS0I=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4/go.mod h1:E1hLXN/BL2e6YizK1zFlYd8vsfi2GTjbjBazinMmeaM=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.67 h1:fI9/5BDEaAv/pv1VO1X1n3jfP9it+IGqWsCuuBQI8wM=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.67/go.mod h1:zQClPRIwQZfJlZq6WZve+s4Tb4JW+3V6eS+4+KrYeP8=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.9/go.mod h1:AnVH5pvai0pAF4lXRq0bmhbes1u9R8wTE+g+183bZNM=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33 h1:kG5eQilShqmJbv11XL1VpyDbaEJzWxd4zRiCG30GSn4=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33/go.mod h1:7i0PF1ME/2eUPFcjkVIwq+DOygHEoK92t5cDqNgYbIw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.3/go.mod h1:ssOhaLpRlh88H3UmEcsBoVKq309quMvm3Ds8e9d4eJM=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27 h1:vFQlirhuM8lLlpI7imKOMsjdQLuN9CPi+k44F/OFVsk=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34 h1:A5UqQEmPaCFpedKouS4v+dHCTUo2sKqhoKO9U5kxyWo=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34/go.mod h1:wZpTEecJe0Btj3IYnDx/VlUzor9wm3fJHyvLpQF0VwY=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27/go.mod h1:UrHnn3QV/d0pBZ6QBAEQcqFLf8FAzLmoUfPVIueOvoM=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.10/go.mod h1:8DcYQcz0+ZJaSxANlHIsbbi6S+zMwjwdDqwW3r9AzaE=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 h1:gGLG7yKaXG02/jBlg210R7VgQIotiQntNhsCFejawx8=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28 h1:srIVS45eQuewqz6fKKu6ZGXaq6FuFg5NzgQBAM6g8Y4=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28/go.mod h1:7VRpKQQedkfIEXb4k52I7swUnZP0wohVajJMRn3vsUw=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34/go.mod h1:Etz2dj6UHYuw+Xw830KfzCfWGMzqvUTCjUj5b76GVDc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.25 h1:AzwRi5OKKwo4QNqPf7TjeO+tK8AyOK3GVSwmRPo7/Cs=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.35 h1:LWA+3kDM8ly001vJ1X1waCuLJdtTl48gwkPKWy9sosI=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.35/go.mod h1:0Eg1YjxE0Bhn56lx+SHJwCzhW+2JGtizsrx+lCqrfm0=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.25/go.mod h1:SUbB4wcbSEyCvqBxv/O/IBf93RbEze7U7OnoTlpPB+g=
-github.com/aws/aws-sdk-go-v2/service/athena v1.28.0 h1:fG77b1smde0usA1F7hM6VX3wK+NagrFWdbFOUhS63RQ=
-github.com/aws/aws-sdk-go-v2/service/athena v1.28.0/go.mod h1:97btS9UBEnajlbXXJkaCAFIu1j3vfJKdQCnIhs853xY=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.26 h1:wscW+pnn3J1OYnanMnza5ZVYXLX4cKk5rAvUAl4Qu+c=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.26/go.mod h1:MtYiox5gvyB+OyP0Mr0Sm/yzbEAIPL9eijj/ouHAPw0=
+github.com/aws/aws-sdk-go-v2/service/athena v1.30.2 h1:DQU1rX6yPczsF9Xow7124U51aTR9C+GCX5mBQ2F/H1E=
+github.com/aws/aws-sdk-go-v2/service/athena v1.30.2/go.mod h1:1wNfeJcbxrsrC/Oa3CjL1j8+0P1a6z//XZgcbYnCs/U=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.19.7 h1:yb2o8oh3Y+Gg2g+wlzrWS3pB89+dHrXayT/d9cs8McU=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.19.7/go.mod h1:1MNss6sqoIsFGisX92do/5doiUCBrN7EjhZCS/8DUjI=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.98.0 h1:WblDV33AG9dhv0zFEPEmGtD5UECSNpKMxtdENULfR8M=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.98.0/go.mod h1:L3ZT0N/vBsw77mOAawXmRnREpEjcHd2v5Hzf7AkIH8M=
-github.com/aws/aws-sdk-go-v2/service/glue v1.50.0 h1:GF6Lsy9g1+Ig2e1TpGygl00+oBcdYHIMyTHoKZa9VGE=
-github.com/aws/aws-sdk-go-v2/service/glue v1.50.0/go.mod h1:agadckFdb7BwFqeN4CXt3yrMtoFvY/8b2F+8FNeHVOc=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.1/go.mod h1:GeUru+8VzrTXV/83XyMJ80KpH8xO89VPoUileyNQ+tc=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.14.11 h1:WHi9VKMYGtWt2DzqeYHXzt55aflymO2EZ6axuKla8oU=
+github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.14.11/go.mod h1:pP+91QTpJMvcFTqGky6puHrkBs8oqoB3XOCiGRDaXwI=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.102.0 h1:P4dyjm49F2kKws0FpouBC6fjVImACXKt752+CWa01lM=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.102.0/go.mod h1:tIctCeX9IbzsUTKHt53SVEcgyfxV2ElxJeEB+QUbc4M=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.27.1 h1:54QSuWR3Pot7HqBRXd+c1yF97h2bqzDBID8qFSAkTlE=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.27.1/go.mod h1:SB6YszwN1iKvyt/Qk+ICeKsfBxjd0CTEwwkmej9qoa0=
+github.com/aws/aws-sdk-go-v2/service/glue v1.51.0 h1:ezO4k5Nnowpedvk1LGtYQUWiXaWx+zq+CCmbcTcZBoI=
+github.com/aws/aws-sdk-go-v2/service/glue v1.51.0/go.mod h1:wMCE0B6l8eHb57l2DMYCGxt0rHIfcu3RvIY7SAfc+Fs=
+github.com/aws/aws-sdk-go-v2/service/iam v1.20.3 h1:oO895XrrD1khVUv0fUFTpbvCK+/IS9nnlhie5WYXPgw=
+github.com/aws/aws-sdk-go-v2/service/iam v1.20.3/go.mod h1:aQZ8BI+reeaY7RI/QQp7TKCSUHOesTdrzzylp3CW85c=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11 h1:y2+VQzC6Zh2ojtV2LoC0MNwHWc6qXv/j2vrQtlftkdA=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11/go.mod h1:iV4q2hsqtNECrfmlXyord9u4zyuFEJX9eLgLpSPzWA8=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.3/go.mod h1:Seb8KNmD6kVTjwRjVEgOT5hPin6sq+v4C2ycJQDwuH8=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.28 h1:vGWm5vTpMr39tEZfQeDiDAMgk+5qsnvRny3FjLpnH5w=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.28/go.mod h1:spfrICMD6wCAhjhzHuy6DOZZ+LAIY10UxhUmLzpJTTs=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.29 h1:zZSLP3v3riMOP14H7b4XP0uyfREDQOYv2cqIrvTXDNQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.29/go.mod h1:z7EjRjVwZ6pWcWdI2H64dKttvzaP99jRIj5hphW0M5U=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.27 h1:QmyPCRZNMR1pFbiOi9kBZWZuKrKB9LD4cxltxQk4tNE=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.27/go.mod h1:DfuVY36ixXnsG+uTqnoLWunXAKJ4qjccoFrXUPpj+hs=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.3/go.mod h1:wlY6SVjuwvh3TVRpTqdy4I1JpBFLX4UGeKZdWntaocw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27 h1:0iKliEXAcCa2qVtRs7Ot5hItA2MsufrphbRFlz1Owxo=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27/go.mod h1:EOwBD4J4S5qYszS5/3DpkejfuK+Z5/1uzICfPaZLtqw=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.3/go.mod h1:Bm/v2IaN6rZ+Op7zX+bOUMdL4fsrYZiD0dsjLhNKwZc=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.2 h1:NbWkRxEEIRSCqxhsHQuMiTH7yo+JZW1gp8v3elSVMTQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28 h1:bkRyG4a929RCnpVSTvLM2j/T4ls015ZhhYApbmYs15s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28/go.mod h1:jj7znCIg05jXlaGBlFMGP8+7UN3VtCkRBG2spnmRQkU=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.2/go.mod h1:4tfW5l4IAB32VWCDEBxCRtR9T4BWy4I4kr1spr8NgZM=
-github.com/aws/aws-sdk-go-v2/service/kms v1.16.3/go.mod h1:QuiHPBqlOFCi4LqdSskYYAWpQlx3PKmohy+rE2F+o5g=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.3 h1:dBL3StFxHtpBzJJ/mNEsjXVgfO+7jR0dAIEwLqMapEA=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.3/go.mod h1:f1QyiAsvIv4B49DmCqrhlXqyaR+0IxMmyX+1P+AnzOM=
 github.com/aws/aws-sdk-go-v2/service/rds v1.44.1 h1:9nhtGFhgKBBqcsbHXCVxrFKZgb4EmVF30hG3s2WEdD8=
 github.com/aws/aws-sdk-go-v2/service/rds v1.44.1/go.mod h1:rS6T0DrjdZ5LDr8ZC/J9iZdD1oSbie5reWWzqv5zLOw=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.26.3/go.mod h1:g1qvDuRsJY+XghsV6zg00Z4KJ7DtFFCx8fJD2a491Ak=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.33.1 h1:O+9nAy9Bb6bJFTpeNFtd9UfHbgxO1o4ZDAM9rQp5NsY=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.33.1/go.mod h1:J9kLNzEiHSeGMyN7238EjJmBpCniVzFda75Gxl/NqB8=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.15.4/go.mod h1:PJc8s+lxyU8rrre0/4a0pn2wgwiDvOEzoOjcJUBr67o=
-github.com/aws/aws-sdk-go-v2/service/sns v1.17.4/go.mod h1:kElt+uCcXxcqFyc+bQqZPFD9DME/eC6oHBXvFzQ9Bcw=
-github.com/aws/aws-sdk-go-v2/service/sns v1.20.11 h1:kUKAkuOhCCq/Av372Dtzg0oaAD5VEUYdDtU4lGIYKkw=
-github.com/aws/aws-sdk-go-v2/service/sns v1.20.11/go.mod h1:WjBcrd28zNbbuAcIRO/n89sSeOxTuOZPiuxNXU/2WrI=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.18.3/go.mod h1:skmQo0UPvsjsuYYSYMVmrPc1HWCbHUJyrCEp+ZaLzqM=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.35.0 h1:ya7fmrN2fE7s1P2gaPbNg5MTkERVWfsH8ToP1YC4Z9o=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.35.0/go.mod h1:aVbf0sko/TsLWHx30c/uVu7c62+0EAJ3vbxaJga0xCw=
+github.com/aws/aws-sdk-go-v2/service/sns v1.20.13 h1:+ADGcDhddHTKyu6Qp3oZKootryteS7D3ODo2ZPDBgjQ=
+github.com/aws/aws-sdk-go-v2/service/sns v1.20.13/go.mod h1:rWrvp9i8y/lX94lS7Kn/0iu9RY6vXzeKRqS/knVX8/c=
 github.com/aws/aws-sdk-go-v2/service/sqs v1.22.0 h1:ikSvot5NdywduxtkOwOa2GJFzFuJq1ZjXsGjoIA82Ao=
 github.com/aws/aws-sdk-go-v2/service/sqs v1.22.0/go.mod h1:ujUjm+PrcKUeIiKu2PT7MWjcyY0D6YZRZF3fSswiO+0=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.24.1/go.mod h1:NR/xoKjdbRJ+qx0pMR4mI+N/H1I1ynHwXnO6FowXJc0=
-github.com/aws/aws-sdk-go-v2/service/sso v1.11.3/go.mod h1:7UQ/e69kU7LDPtY40OyoHYgRmgfGM4mgsLYtcObdveU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.10 h1:UBQjaMTCKwyUYwiVnUt6toEJwGXsLBI6al083tpjJzY=
 github.com/aws/aws-sdk-go-v2/service/sso v1.12.10/go.mod h1:ouy2P4z6sJN70fR3ka3wD3Ro3KezSxU6eKGQI2+2fjI=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10 h1:PkHIIJs8qvq0e5QybnZoG1K/9QTrLr9OsqCIo59jOBA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.12 h1:nneMBM2p79PGWBQovYO/6Xnc2ryRMw3InnDJq1FHkSY=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.12/go.mod h1:HuCOxYsF21eKrerARYO6HapNeh9GBNq7fius2AcwodY=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10/go.mod h1:AFvkxc8xfBe8XA+5St5XIHHrQQtkxqrRincx4hmMHOk=
-github.com/aws/aws-sdk-go-v2/service/sts v1.16.3/go.mod h1:bfBj0iVmsUyUg4weDB4NxktD9rDGeKSVWnjTnwbx9b8=
-github.com/aws/aws-sdk-go-v2/service/sts v1.19.0 h1:2DQLAKDteoEDI8zpCzqBMaZlJuoE9iTYD0gFmXVax9E=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.12 h1:2qTR7IFk7/0IN/adSFhYu9Xthr0zVFTgBrmPldILn80=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.12/go.mod h1:E4VrHCPzmVB/KFXtqBGKb3c8zpbNBgKe3fisDNLAW5w=
 github.com/aws/aws-sdk-go-v2/service/sts v1.19.0/go.mod h1:BgQOMsg8av8jset59jelyPW7NoZcZXLVpDsXunGDrk8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.19.2 h1:XFJ2Z6sNUUcAz9poj+245DMkrHE4h2j5I9/xD50RHfE=
+github.com/aws/aws-sdk-go-v2/service/sts v1.19.2/go.mod h1:dp0yLPsLBOi++WTxzCjA/oZqi6NPIhoR+uF7GeMU9eg=
 github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin v0.0.0-20220331165046-e4d000c0d6a6 h1:+AQtpMAj/wOpgdmXSGKSBVozGsYbvaf73gTz4aSK9vM=
 github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin v0.0.0-20220331165046-e4d000c0d6a6/go.mod h1:Y5LTHeZGpeKFaXYfPYNfVqdpAjejlvXLhGqFqSJRQYc=
-github.com/aws/smithy-go v1.11.2/go.mod h1:3xHYmszWVx2c0kIwQeEVf9uSm4fYZt67FBJnwub1bgM=
 github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
 github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59/go.mod h1:q/89r3U2H7sSsE2t6Kca0lfwTK8JdoNGS/yzM/4iH5I=
@@ -402,6 +338,8 @@ github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl
 github.com/bufbuild/connect-go v1.7.0 h1:MGp82v7SCza+3RhsVhV7aMikwxvI3ZfD72YiGt8FYJo=
 github.com/bufbuild/connect-go v1.7.0/go.mod h1:GmMJYR6orFqD0Y6ZgX8pwQ8j9baizDrIQMm1/a6LnHk=
 github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
+github.com/buildkite/bintest/v3 v3.1.1 h1:bS924OU8Ljm46DesONXzxxTBMjbliQRnPB+H4DOeUDE=
+github.com/buildkite/bintest/v3 v3.1.1/go.mod h1:T3Et1VwEizryWfwLLruFqExHsEU+wjkxOlL54283ccc=
 github.com/caarlos0/ctrlc v1.0.0/go.mod h1:CdXpj4rmq0q/1Eb44M9zi2nKB0QraNKuRGYGrrHhcQw=
 github.com/campoy/unique v0.0.0-20180121183637-88950e537e7e/go.mod h1:9IOqJGCPMSc6E5ydlp5NIonxObaeu/Iub/X03EKPVYo=
 github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
@@ -433,6 +371,7 @@ github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 h1:/inchEIKaYC1Akx+H+gqO04wryn5h75LSazbRlnya1k=
 github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
@@ -440,7 +379,6 @@ github.com/cockroachdb/datadriven v0.0.0-20200714090401-bf6692d28da5/go.mod h1:h
 github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoCr5oaCLELYA=
 github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI=
 github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
-github.com/colinmarc/hdfs/v2 v2.1.1/go.mod h1:M3x+k8UKKmxtFu++uAZ0OtDU8jR3jnaZIAc6yK4Ue0c=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
@@ -490,14 +428,12 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/daviddengcn/go-colortext v1.0.0 h1:ANqDyC0ys6qCSvuEK7l3g5RaehL/Xck9EX8ATG8oKsE=
 github.com/daviddengcn/go-colortext v1.0.0/go.mod h1:zDqEI5NVUop5QPpVJUxE9UO10hRnmkD5G4Pmri9+m4c=
 github.com/dchest/uniuri v1.2.0/go.mod h1:fSzm4SLHzNZvWLvWJew423PhAzkpNQYq+uNLq4kxhkY=
-github.com/denisenkom/go-mssqldb v0.12.0/go.mod h1:iiK0YP1ZeepvmBQk/QpLEhhTNJgfzrpArPY/aFvc9yU=
 github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
-github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
 github.com/dlclark/regexp2 v1.9.0 h1:pTK/l/3qYIKaRXuHnEnIf7Y5NxfRPfpb7dis6/gdlVI=
 github.com/dlclark/regexp2 v1.9.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dnaeon/go-vcr v1.1.0/go.mod h1:M7tiix8f0r6mKKJ3Yq/kqU1OYf3MnfmBWVbPx/yU9ko=
@@ -516,11 +452,10 @@ github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5m
 github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
 github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
 github.com/edsrzf/mmap-go v1.0.0/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
-github.com/elastic/elastic-transport-go/v8 v8.0.0-20230329154755-1a3c63de0db6/go.mod h1:87Tcz8IVNe6rVSLdBux1o/PEItLtyabHU3naC7IoqKI=
-github.com/elastic/elastic-transport-go/v8 v8.2.0 h1:hkK5IIs/15mpSXzd5THWVlWTKJyMw6cbCWM3T/B2S5E=
-github.com/elastic/elastic-transport-go/v8 v8.2.0/go.mod h1:87Tcz8IVNe6rVSLdBux1o/PEItLtyabHU3naC7IoqKI=
-github.com/elastic/go-elasticsearch/v8 v8.8.0 h1:yNBPlXNo6wstMG7I3KiZPbLFgA82RMryYqkh1xBMV3A=
-github.com/elastic/go-elasticsearch/v8 v8.8.0/go.mod h1:NGmpvohKiRHXI0Sw4fuUGn6hYOmAXlyCphKpzVBiqDE=
+github.com/elastic/elastic-transport-go/v8 v8.3.0 h1:DJGxovyQLXGr62e9nDMPSxRyWION0Bh6d9eCFBriiHo=
+github.com/elastic/elastic-transport-go/v8 v8.3.0/go.mod h1:87Tcz8IVNe6rVSLdBux1o/PEItLtyabHU3naC7IoqKI=
+github.com/elastic/go-elasticsearch/v8 v8.8.1 h1:/OiP5Yex40q5eWpzFVQIS8jRE7SaEZrFkG9JbE6TXtY=
+github.com/elastic/go-elasticsearch/v8 v8.8.1/go.mod h1:GU1BJHO7WeamP7UhuElYwzzHtvf9SDmeVpSSy9+o6Qg=
 github.com/emicklei/go-restful/v3 v3.9.0 h1:XwGDlfxEnQZzuopoqxwSEllNcCOM9DhhFyhFIIGKwxE=
 github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
@@ -536,6 +471,7 @@ github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.
 github.com/envoyproxy/protoc-gen-validate v0.0.14/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.3.0-java/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v0.10.1 h1:c0g45+xCJhdgFGw7a5QAfdS4byAbud7miNWJ1WwEVf8=
 github.com/etcd-io/gofail v0.0.0-20190801230047-ad7f989257ca/go.mod h1:49H/RkXP8pKaZy4h0d+NW16rSLhyVBt4o6VLJbmOqDE=
 github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
 github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
@@ -562,11 +498,11 @@ github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoD
 github.com/form3tech-oss/jwt-go v3.2.5+incompatible h1:/l4kBbb4/vGSsdtB5nUe8L7B9mImVMaBPw9L/0TBHU8=
 github.com/form3tech-oss/jwt-go v3.2.5+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/fortytw2/leaktest v1.2.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
+github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
 github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/fsouza/fake-gcs-server v1.45.2 h1:m4hkghNBY7lmPtpgE41nZa1mOo2PedAZnw3Hd2RfsGk=
@@ -586,8 +522,6 @@ github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.5.0/go.mod h1:Nd6IXA8m5kNZdNEHMBd93KT+mdY3+bewLgRvmCsR2Do=
-github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
-github.com/gin-gonic/gin v1.7.3/go.mod h1:jD2toBW3GZUr5UMcdrwQA10I7RuaFOl/SGeDjXkfUtY=
 github.com/gizak/termui/v3 v3.1.0 h1:ZZmVDgwHl7gR7elfKf1xc4IudXZ5qqfDh4wExk4Iajc=
 github.com/gizak/termui/v3 v3.1.0/go.mod h1:bXQEBkJpzxUAKf0+xq9MSWAvWZlE7c+aidmyFlkYTrY=
 github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
@@ -603,8 +537,8 @@ github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.10.0/go.mod h1:xUsJbQ/Fp4kEt7AFgCuvyX4a71u8h9jB8tj/ORgOZ7o=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs=
-github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
+github.com/go-ldap/ldap/v3 v3.4.5 h1:ekEKmaDrpvR2yf5Nc/DClsGG9lAmdDixe44mLzlW5r8=
+github.com/go-ldap/ldap/v3 v3.4.5/go.mod h1:bMGIq3AGbytbaMwf8wdv5Phdxz0FWHTIYMSzyrYgnQs=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
@@ -624,13 +558,8 @@ github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
 github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
 github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
-github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.12.1/go.mod h1:IUMDtCfWo/w/mtMfIE/IG2K+Ey3ygWanZIBtBW0W2TM=
-github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
 github.com/go-playground/universal-translator v0.16.0/go.mod h1:1AnU7NaIRDWWzGEKwgtJRd2xk99HeFyHw3yid4rvQIY=
-github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
-github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
-github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn9GlaMV7XkbRSipzJ0Ii4=
 github.com/go-redis/redis v6.15.8+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
 github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
 github.com/go-resty/resty/v2 v2.7.0 h1:me+K9p3uhSmXtrBZ4k9jcEAfJmuC8IivWHwaLZwPrFY=
@@ -649,14 +578,11 @@ github.com/go-webauthn/webauthn v0.5.0 h1:Tbmp37AGIhYbQmcy2hEffo3U3cgPClqvxJ7cLU
 github.com/go-webauthn/webauthn v0.5.0/go.mod h1:0CBq/jNfPS9l033j4AxMk8K8MluiMsde9uGNSPFLEVE=
 github.com/gobuffalo/flect v1.0.2 h1:eqjPGSo2WmjgY2XlpGwo2NXgL3RucAKo4k4qQMNA5sA=
 github.com/gobuffalo/flect v1.0.2/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs=
-github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
-github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
 github.com/goccy/go-json v0.10.0 h1:mXKd9Qw4NuzShiRlOXKews24ufknHO7gx30lsDyokKA=
 github.com/goccy/go-json v0.10.0/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/gocql/gocql v0.0.0-20200624222514-34081eda590e/go.mod h1:DL0ekTmBSTdlNF25Orwt/JMzqIq3EJ4MVa/J/uK64OY=
-github.com/gocql/gocql v1.4.0 h1:NIlXAJXsjzjGvVn36njh9OLYWzS3D7FdvsifLj4eDEY=
-github.com/gocql/gocql v1.4.0/go.mod h1:3gM2c4D3AnkISwBxGnMMsS8Oy4y2lhbPRsH4xnJrHG8=
+github.com/gocql/gocql v1.5.2 h1:WnKf8xRQImcT/KLaEWG2pjEeryDB7K0qQN9mPs1C58Q=
+github.com/gocql/gocql v1.5.2/go.mod h1:3gM2c4D3AnkISwBxGnMMsS8Oy4y2lhbPRsH4xnJrHG8=
 github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 h1:ZpnhV/YsD2/4cESfV5+Hoeu/iUR3ruzNvZ+yQfO03a0=
 github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
 github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
@@ -666,22 +592,16 @@ github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14j
 github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/googleapis v1.1.0/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=
-github.com/golang-jwt/jwt v3.2.1+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
-github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
-github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
-github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
-github.com/golang-sql/sqlexp v0.0.0-20170517235910-f1bb20e5a188/go.mod h1:vXjM/+wXQnTPR4KqTKDgJukSZ6amVRtWMPEjE6sQoK8=
 github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
 github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
 github.com/golang/glog v1.1.0 h1:/d3pCKDPWNnvIWe0vVUpNP32qc8U3PDVxySP/y360qE=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -698,7 +618,6 @@ github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
 github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
-github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -742,7 +661,6 @@ github.com/google/certificate-transparency-go v1.1.2-0.20210422104406-9f33727a7a
 github.com/google/certificate-transparency-go v1.1.2-0.20210512142713-bed466244fa6/go.mod h1:aF2dp7Dh81mY8Y/zpzyXps4fQW5zQbDu2CxfpJB6NkI=
 github.com/google/certificate-transparency-go v1.1.2 h1:4hE0GEId6NAW28dFpC+LrRGwQX5dtmXQGDbg8+/MZOM=
 github.com/google/certificate-transparency-go v1.1.2/go.mod h1:3OL+HKDqHPUfdKrHVQxO6T8nDLO0HF7LRTlkIWXaWvQ=
-github.com/google/flatbuffers v1.11.0/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/flatbuffers v23.1.21+incompatible h1:bUqzx/MXCDxuS0hRJL2EfjyZL3uQrPbMocUa8zGqsTA=
 github.com/google/flatbuffers v23.1.21+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/gnostic v0.6.9 h1:ZK/5VhkoX835RikCHpSUJV9a+S3e1zLh59YnyWeBW+0=
@@ -772,9 +690,7 @@ github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/go-replayers/grpcreplay v0.1.0/go.mod h1:8Ig2Idjpr6gifRd6pNVggX6TC1Zw6Jx74AKp7QNH2QE=
-github.com/google/go-replayers/grpcreplay v1.1.0/go.mod h1:qzAvJ8/wi57zq7gWqaE6AwLM6miiXUQwP1S+I9icmhk=
 github.com/google/go-replayers/httpreplay v0.1.0/go.mod h1:YKZViNhiGgqdBlUbI2MwGpq4pXxNmhJLPHQ7cv2b5no=
-github.com/google/go-replayers/httpreplay v1.1.1/go.mod h1:gN9GeLIs7l6NUoVaSSnv2RiqK1NiwAmD0MrKeC9IIks=
 github.com/google/go-sev-guest v0.6.1 h1:NajHkAaLqN9/aW7bCFSUplUMtDgk2+HcN7jC2btFtk0=
 github.com/google/go-tpm v0.1.2-0.20190725015402-ae6dd98980d4/go.mod h1:H9HbmUG2YgV/PHITkO7p6wxEEj/v5nlsVWIwumwH2NI=
 github.com/google/go-tpm v0.3.0/go.mod h1:iVLWvrPp/bHeEkxTFi9WG6K9w0iy2yIszHwZGHPbzAw=
@@ -801,7 +717,6 @@ github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIG
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
 github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw=
-github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -815,7 +730,6 @@ github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210506205249-923b5ab0fc1a/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
@@ -837,21 +751,16 @@ github.com/google/uuid v0.0.0-20161128191214-064e2069ce9c/go.mod h1:TIyPZe4Mgqvf
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.3.0/go.mod h1:i1DMg/Lu8Sz5yYl25iOdmc5CT5qusaa+zmRWs16741s=
-github.com/google/wire v0.5.0/go.mod h1:ngWDr9Qvq3yZA10YrxfyGELY/AFWGVpy9c1LTRi1EoU=
-github.com/googleapis/enterprise-certificate-proxy v0.2.3 h1:yk9/cqRKtT9wXZSsRH9aurXEpJX+U6FLtpYTdC3R06k=
-github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
+github.com/googleapis/enterprise-certificate-proxy v0.2.4 h1:uGy6JWR/uMIILU8wbf+OkstIrNiMjGpEIyhx8f6W7s4=
+github.com/googleapis/enterprise-certificate-proxy v0.2.4/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
 github.com/googleapis/gax-go v2.0.2+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
-github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
-github.com/googleapis/gax-go/v2 v2.2.0/go.mod h1:as02EH8zWkzwUoLbBaFeQ+arQaj/OthfcblKl4IGNaM=
-github.com/googleapis/gax-go/v2 v2.10.0 h1:ebSgKfMxynOdxw8QQuFOKMgomqeLGPqNLQox2bo42zg=
-github.com/googleapis/gax-go/v2 v2.10.0/go.mod h1:4UOEnMCrxsSqQ940WnTiD6qJ63le2ev3xfyagutxiPw=
+github.com/googleapis/gax-go/v2 v2.11.0 h1:9V9PWXEsWnPpQhu/PeQIkS4eGzMlTLGgt80cUUI8Ki4=
+github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gordonklaus/ineffassign v0.0.0-20200309095847-7953dde2c7bf/go.mod h1:cuNKsD1zp2v6XfE/orVX2QE1LC+i254ceGcVeDT3pTU=
 github.com/goreleaser/goreleaser v0.134.0/go.mod h1:ZT6Y2rSYa6NxQzIsdfWWNWAlYGXGbreo66NmE+3X3WQ=
@@ -897,8 +806,8 @@ github.com/gravitational/license v0.0.0-20210218173955-6d8fb49b117a h1:PN5vAN1ZA
 github.com/gravitational/license v0.0.0-20210218173955-6d8fb49b117a/go.mod h1:jaxS7X2ouXfNd2Pxpybd01qNQK15UmkixKj4vtpp7f8=
 github.com/gravitational/oxy v0.0.0-20221029012416-9fbf4c444680 h1:acbjjEJoR2vu1cuSE15Q9YDgWZxWRFj7nr2Vsi/Pn18=
 github.com/gravitational/oxy v0.0.0-20221029012416-9fbf4c444680/go.mod h1:SP8xfwGas4wleDVXDmeVpfn/Fv+wD8rrb2SqN/DlNXQ=
-github.com/gravitational/predicate v1.3.0 h1:n1lmH6YU1oX/Y546qHQNJb50FJy6Ou/+MvW8W9ICrlw=
-github.com/gravitational/predicate v1.3.0/go.mod h1:wPNu01gNYh2LRVtIGmFBvRpfBzl4nI2EaxbYDG8Mm4w=
+github.com/gravitational/predicate v1.3.1 h1:f1uGg2FF6z5wZbcafYpLZJ1gl+82I0MlSd0cQKDPQe0=
+github.com/gravitational/predicate v1.3.1/go.mod h1:H5e9dUW7zb/cuKkkhfnyT9SsI/WHWJ8Ra011La16DTY=
 github.com/gravitational/protobuf v1.3.2-teleport.1 h1:h5mh+UOKPurqDxn1hRVcr1WzSkmBi+D9qkXpaXA9PFM=
 github.com/gravitational/protobuf v1.3.2-teleport.1/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gravitational/redis/v9 v9.0.0-teleport.3 h1:Eg/j3jiNUZ558KDXOqzF682EFmf97vxAFFnMgZ0YHns=
@@ -930,15 +839,12 @@ github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t
 github.com/grpc-ecosystem/grpc-gateway v1.12.1/go.mod h1:8XEsbTttt/W+VvjtQhLACqCisSPWTxCZ7sBRjU6iH9c=
 github.com/grpc-ecosystem/grpc-gateway v1.14.6/go.mod h1:zdiPV4Yse/1gnckTHtghG4GkDEdKCRJduHpTxT3/jcw=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 h1:lLT7ZLSzGLI08vc9cpd+tYmNWjdKDqyr/2L+f6U12Fk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
 github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c h1:6rhixN/i8ZofjG1Y75iExal34USq5p+wiN1tpie8IrU=
 github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c/go.mod h1:NMPJylDgVpX0MLRlPy15sqSwOFv/U1GZ2m21JhFfek0=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
-github.com/hanwen/go-fuse v1.0.0/go.mod h1:unqXarDXqzAk0rt98O2tVndEPIpUgLD9+rwFisZH3Ok=
-github.com/hanwen/go-fuse/v2 v2.1.0/go.mod h1:oRyA5eK+pvJyv5otpO/DgccS8y/RvYMaO00GgRLGryc=
 github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
 github.com/hashicorp/consul/api v1.3.0/go.mod h1:MmDNSzIMUjNpY/mQ398R4bk2FnqQLoPndWW5VkKPlCE=
 github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
@@ -953,7 +859,6 @@ github.com/hashicorp/go-retryablehttp v0.6.4/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER
 github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
 github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
-github.com/hashicorp/go-uuid v0.0.0-20180228145832-27454136f036/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
@@ -972,6 +877,7 @@ github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
 github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/huandu/xstrings v1.0.0/go.mod h1:4qWG/gcEcfX4z/mBDHJ++3ReCw9ibxbsNJbcucJdbSo=
 github.com/huandu/xstrings v1.2.0/go.mod h1:DvyZB1rfVYsBIigL8HwpZgxHwXozlTgGqn63UyNX5k4=
@@ -999,7 +905,6 @@ github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsU
 github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
 github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
 github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
-github.com/jackc/pgconn v1.11.0/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
 github.com/jackc/pgconn v1.14.0 h1:vrbA9Ud87g6JdFWkHTJXppVce58qPIdP7N8y0Ml/A7Q=
 github.com/jackc/pgconn v1.14.0/go.mod h1:9mBNlny0UvkgJdCDvdVHYSjI+8tD2rnKK69Wz8ti++E=
 github.com/jackc/pgerrcode v0.0.0-20220416144525-469b46aa5efa h1:s+4MhCQ6YrzisK6hFJUX53drDT4UsSW3DEhKn0ifuHw=
@@ -1019,7 +924,6 @@ github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvW
 github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
 github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.2.0/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.3.2 h1:7eY55bdBeCz1F2fTzSz69QC+pG46jYq9/jtSPiJ5nn0=
 github.com/jackc/pgproto3/v2 v2.3.2/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
@@ -1029,20 +933,17 @@ github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01C
 github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
 github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
 github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
-github.com/jackc/pgtype v1.10.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
 github.com/jackc/pgtype v1.14.0 h1:y+xUdabmyMkJLyApYuPj38mW+aAIqCe5uuBB51rH3Vw=
 github.com/jackc/pgtype v1.14.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
 github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
 github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
 github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
 github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
-github.com/jackc/pgx/v4 v4.15.0/go.mod h1:D/zyOyXiaM1TmVWnOM18p0xdDtdakRBa0RsVGI3U3bw=
 github.com/jackc/pgx/v4 v4.18.1 h1:YP7G1KABtKpB5IHrO9vYwSrCOhs7p3uqhvhhQBptya0=
 github.com/jackc/pgx/v4 v4.18.1/go.mod h1:FydWkUyadDmdNH/mHnGob881GawxeEm7TcMCzkb+qQE=
 github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.2.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.3.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jarcoal/httpmock v1.0.5/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
@@ -1050,7 +951,6 @@ github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFK
 github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
 github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
 github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
-github.com/jcmturner/gofork v0.0.0-20180107083740-2aebee971930/go.mod h1:MK8+TM0La+2rjBD4jE12Kj1pCCxK7d2LK/UM3ncEo0o=
 github.com/jcmturner/gofork v1.0.0/go.mod h1:MK8+TM0La+2rjBD4jE12Kj1pCCxK7d2LK/UM3ncEo0o=
 github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
 github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
@@ -1067,7 +967,6 @@ github.com/jhump/protoreflect v1.8.2/go.mod h1:7GcYQDdMU/O/BBrl/cX6PNHpXh6cenjd8
 github.com/jhump/protoreflect v1.9.0/go.mod h1:7GcYQDdMU/O/BBrl/cX6PNHpXh6cenjd8pneu5yW7Tg=
 github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
@@ -1105,6 +1004,8 @@ github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/X
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/juju/ratelimit v1.0.1/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
 github.com/jung-kurt/gofpdf v1.0.3-0.20190309125859-24315acbbda5/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
+github.com/jupp0r/go-priority-queue v0.0.0-20160601094913-ab1073853bde h1:+5PMaaQtDUwOcJIUlmX89P0J3iwTvErTmyn5WghzXAQ=
+github.com/jupp0r/go-priority-queue v0.0.0-20160601094913-ab1073853bde/go.mod h1:RDgD/dfPmIwFH0qdUOjw71HjtWg56CtyLIoHL+R1wJw=
 github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213/go.mod h1:vNUNkEQ1e29fT/6vq2aBdFsgNPmy8qMdSay1npru+Sw=
 github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
 github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
@@ -1113,17 +1014,9 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/asmfmt v1.3.2 h1:4Ri7ox3EwapiOjCki+hw14RyKk201CN4rzyCJRFLpK4=
 github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j0HLHbNSE=
-github.com/klauspost/compress v1.9.7/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.13.1/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
 github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
-github.com/klauspost/compress v1.15.1/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
-github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
 github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
 github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
-github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.0.4/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.1.0/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
 github.com/klauspost/cpuid/v2 v2.2.4 h1:acbojRNwl3o09bUq+yDCtZFc1aiwaAAxtcn8YkZXnvk=
 github.com/klauspost/cpuid/v2 v2.2.4/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -1143,11 +1036,13 @@ github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/kyroy/kdtree v0.0.0-20200419114247-70830f883f1d h1:1n5M/49q9H6QtNJiiVL/W5mqgT1UdlGQ7oLP+DkJ1vs=
+github.com/kyroy/kdtree v0.0.0-20200419114247-70830f883f1d/go.mod h1:6oJGQK7VSg3RxSQ7QspgqpCmKjIbAslgT2wBXbFJUZw=
+github.com/kyroy/priority-queue v0.0.0-20180327160706-6e21825e7e0c h1:1c7+XOOGQ19cXjZ1Ss/irljQxgPvb+8z+jNEprCXl20=
+github.com/kyroy/priority-queue v0.0.0-20180327160706-6e21825e7e0c/go.mod h1:R477L6j2/dUcE0q0aftk0kR5Xt93W7g1066AodcJhEo=
 github.com/leodido/go-urn v1.1.0/go.mod h1:+cyI34gQWZcE1eQU7NVgKkkzdXDQHr1dBMtdAPozLkw=
-github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
 github.com/letsencrypt/pkcs11key/v4 v4.0.0/go.mod h1:EFUvBDay26dErnNb70Nd0/VW3tJiIbETBPTl9ATXQag=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
@@ -1189,7 +1084,6 @@ github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-ieproxy v0.0.0-20190610004146-91bb50d98149/go.mod h1:31jz6HNzdxOmlERGGEc4v/dMssOfmp2p5bT/okiKFFc=
-github.com/mattn/go-ieproxy v0.0.1/go.mod h1:pYabZ6IHcRpFh7vIaLfK7rdcWgFEb3SFJ6/gNWuh88E=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
@@ -1234,10 +1128,7 @@ github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8/go.mod h1:mC1jAcs
 github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3 h1:+n/aFZefKZp7spd8DFdX7uMikMLXX4oubIzJF4kv/wI=
 github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8IeTMnF8JTXieKnO4Z6JCsikNEzj0DwauVzE=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
-github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.0.34/go.mod h1:nCrRzjoSUQh8hgKKtu3Y708OLvRLtuASMg2/nvmbarw=
 github.com/minio/minio-go/v7 v7.0.55 h1:ZXqUO/8cgfHzI+08h/zGuTTFpISSA32BZmBE3FCLJas=
-github.com/minio/sha256-simd v1.0.0/go.mod h1:OuYzVNI5vcoYIAmbIvHPl3N3jUzVedXbKy5RFepssQM=
 github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
@@ -1253,8 +1144,6 @@ github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS4
 github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
@@ -1293,7 +1182,6 @@ github.com/nats-io/nats.go v1.9.1/go.mod h1:ZjDU1L/7fJ09jvUSRVBR2e7+RnLiiIQyqyzE
 github.com/nats-io/nkeys v0.1.0/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
 github.com/nats-io/nkeys v0.1.3/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
-github.com/ncw/swift v1.0.52/go.mod h1:23YIA4yWVnGwv2dQlN4bB7egfYX6YLn0Yo/S6zZO/ZM=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nishanths/predeclared v0.0.0-20190419143655-18a43bb90ffc/go.mod h1:62PewwiQTlm/7Rj+cxVYqZvDIUc+JjZq6GHAC1fsObQ=
 github.com/nishanths/predeclared v0.0.0-20200524104333-86fad755b4d3/go.mod h1:nt3d53pc1VYcphSCIaYAJtnPYnr3Zyn8fMq2wvPGPso=
@@ -1310,6 +1198,7 @@ github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:v
 github.com/olekukonko/tablewriter v0.0.1/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
 github.com/olekukonko/tablewriter v0.0.2/go.mod h1:rSAaSIOAGT9odnlyGlUfAJaoc5w2fSBUmeGDbRWPxyQ=
 github.com/olekukonko/tablewriter v0.0.4/go.mod h1:zq6QwlOf5SlnkVbMSr5EoBv3636FWnp+qbPhuoO21uA=
+github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
@@ -1344,7 +1233,6 @@ github.com/patrickmn/go-cache v0.0.0-20180815053127-5633e0862627 h1:pSCLCl6joCFR
 github.com/patrickmn/go-cache v0.0.0-20180815053127-5633e0862627/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pavlo-v-chernykh/keystore-go/v4 v4.4.1 h1:FyBdsRqqHH4LctMLL+BL2oGO+ONcIPwn96ctofCVtNE=
 github.com/pavlo-v-chernykh/keystore-go/v4 v4.4.1/go.mod h1:lAVhWwbNaveeJmxrxuSTxMgKpF6DjnuVpn6T8WiBwYQ=
-github.com/pborman/getopt v0.0.0-20180729010549-6fdd0a2c7117/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
 github.com/pborman/uuid v1.2.0 h1:J7Q5mO4ysT1dv8hyrUGHb9+ooztCXu1D8MY8DZYsu3g=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-buffruneio v0.2.0/go.mod h1:JkE26KsDizTr40EUHkXVtNPvgGtbSNq5BcowyYOWdKo=
@@ -1354,9 +1242,10 @@ github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCko
 github.com/performancecopilot/speed v3.0.0+incompatible/go.mod h1:/CLtqpZ5gBg1M9iaPbIdPPGyKcA8hKdoy6hAWba7Yac=
 github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 h1:q2e307iGHPdTGp0hoxKjt1H5pDo6utceo3dQVK3I5XQ=
+github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5/go.mod h1:jvVRKCrJTQWu0XVbaOlby/2lO20uSCHEMzzplHXte1o=
 github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
-github.com/pierrec/lz4/v4 v4.1.8/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pierrec/lz4/v4 v4.1.17 h1:kV4Ip+/hUBC+8T6+2EgburRtkE9ef4nbY3f4dFhGjMc=
 github.com/pierrec/lz4/v4 v4.1.17/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pingcap/check v0.0.0-20190102082844-67f458068fc8 h1:USx2/E1bX46VG32FIw034Au6seQ2fY9NEILmNh/UlQg=
@@ -1368,7 +1257,6 @@ github.com/pingcap/errors v0.11.5-0.20201126102027-b0a155152ca3/go.mod h1:G7x87l
 github.com/pingcap/log v0.0.0-20200511115504-543df19646ad/go.mod h1:4rbK1p9ILyIfb6hU7OG2CiWSqMXnp3JMbiaVJ6mvoY8=
 github.com/pingcap/log v0.0.0-20210317133921-96f4fcab92a4/go.mod h1:4rbK1p9ILyIfb6hU7OG2CiWSqMXnp3JMbiaVJ6mvoY8=
 github.com/pingcap/parser v0.0.0-20210415081931-48e7f467fd74/go.mod h1:xZC8I7bug4GJ5KtHhgAikjTfU4kBv1Sbo3Pf1MZ6lVw=
-github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
 github.com/pkg/browser v0.0.0-20210115035449-ce105d075bb4/go.mod h1:N6UoU20jOqggOuDwUaBQpluzLNDqif3kq9z2wpdYEfQ=
 github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
 github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
@@ -1473,13 +1361,20 @@ github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb
 github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 h1:GHRpF1pTW19a8tTFrMLUcfWwyC0pnifVo2ClaLq+hP8=
 github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46/go.mod h1:uAQ5PCi+MFsC7HjREoAz1BU+Mq60+05gifQSsHSDG/8=
 github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
-github.com/sashabaranov/go-openai v1.9.5 h1:z1VCMXsfnug+U0ceTTIXr/L26AYl9jafqA9lptlSX0c=
-github.com/sashabaranov/go-openai v1.9.5/go.mod h1:lj5b/K+zjTSFxVLijLSTDZuP7adOgerWeFyZLUhAKRg=
+github.com/sasha-s/go-deadlock v0.0.0-20180226215254-237a9547c8a5 h1:T7hUw7pBSINuHQyWwMdfIWZZH5M3ju4yXIbuV/Upp+4=
+github.com/sasha-s/go-deadlock v0.0.0-20180226215254-237a9547c8a5/go.mod h1:StQn567HiB1fF2yJ44N9au7wOhrPS3iZqiDbRupzT10=
+github.com/sashabaranov/go-openai v1.10.1 h1:6WyHJaNzF266VaEEuW6R4YW+Ei0wpMnqRYPGK7fhuhQ=
+github.com/sashabaranov/go-openai v1.10.1/go.mod h1:lj5b/K+zjTSFxVLijLSTDZuP7adOgerWeFyZLUhAKRg=
 github.com/sassoftware/go-rpmutils v0.0.0-20190420191620-a8f1baeba37b/go.mod h1:am+Fp8Bt506lA3Rk3QCmSqmYmLMnPDhdDUcosQCAx+I=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/schollz/progressbar/v3 v3.13.1 h1:o8rySDYiQ59Mwzy2FELeHY5ZARXZTVJC7iHD6PEFUiE=
 github.com/schollz/progressbar/v3 v3.13.1/go.mod h1:xvrbki8kfT1fzWzBT/UZd9L6GA+jdL7HAgq2RFnO6fQ=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
+github.com/segmentio/asm v1.1.3/go.mod h1:Ld3L4ZXGNcSLRg4JBsZ3//1+f/TjYl0Mzen/DQy1EJg=
+github.com/segmentio/encoding v0.3.5 h1:UZEiaZ55nlXGDL92scoVuw00RmiRCazIEmvPSbSvt8Y=
+github.com/segmentio/encoding v0.3.5/go.mod h1:n0JeuIqEQrQoPDGsjo8UNd1iA0U8d8+oHAA4E3G3OxM=
+github.com/segmentio/parquet-go v0.0.0-20230622230624-510764ae9e80 h1:d09YiLivaPHjCyYDGLI5BQbl+carOqUg/U0noDQQBmo=
+github.com/segmentio/parquet-go v0.0.0-20230622230624-510764ae9e80/go.mod h1:+J0xQnJjm8DuQUHBO7t57EnmPbstT6+b45+p3DC9k1Q=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
@@ -1503,7 +1398,6 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
@@ -1511,8 +1405,8 @@ github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUr
 github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/smartystreets/gunit v1.0.0/go.mod h1:qwPWnhz6pn0NnRBP++URONOVyNkPyr4SauJk4cUOwJs=
-github.com/snowflakedb/gosnowflake v1.6.21 h1:OEn5/P+voj3P/STW+R/gGktJlEpfP127GzrxvtAJ5II=
-github.com/snowflakedb/gosnowflake v1.6.21/go.mod h1:P2fE/xiD2kQXpr48OdgnazkzPsKD6aVtnHD3WP8yD9c=
+github.com/snowflakedb/gosnowflake v1.6.22 h1:2crLpqmFVyV03NPAxxAtzQBMFn6wUPqOJ1uRl4ruOJ4=
+github.com/snowflakedb/gosnowflake v1.6.22/go.mod h1:P2fE/xiD2kQXpr48OdgnazkzPsKD6aVtnHD3WP8yD9c=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
 github.com/soheilhy/cmux v0.1.5-0.20210205191134-5ec6847320e5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
@@ -1520,7 +1414,6 @@ github.com/sony/gobreaker v0.4.1/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJ
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/afero v1.2.1/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
-github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
@@ -1549,7 +1442,6 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS
 github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v0.0.0-20170130113145-4d4bfba8f1d1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.2.0/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -1557,7 +1449,6 @@ github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
@@ -1566,9 +1457,6 @@ github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg=
 github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
-github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
-github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
-github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tiktoken-go/tokenizer v0.1.0 h1:c1fXriHSR/NmhMDTwUDLGiNhHwTV+ElABGvqhCWLRvY=
 github.com/tiktoken-go/tokenizer v0.1.0/go.mod h1:7SZW3pZUKWLJRilTvWCa86TOVIiiJhYj3FQ5V3alWcg=
 github.com/tj/assert v0.0.0-20171129193455-018094318fb0/go.mod h1:mZ9/Rh9oLWpLLDRpvE+3b7gP/C2YyLFYxNmcLnPTMe0=
@@ -1597,10 +1485,10 @@ github.com/xanzy/go-gitlab v0.31.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfD
 github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
 github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
-github.com/xdg-go/scram v1.1.1 h1:VOMT+81stJgXW3CpHyqHN3AXDYIMsx56mEFrB37Mb/E=
-github.com/xdg-go/scram v1.1.1/go.mod h1:RaEWvsqvNKKvBPvcKeFjrG2cJqOkHTiyTpzz23ni57g=
-github.com/xdg-go/stringprep v1.0.3 h1:kdwGpVNwPFtjs98xCGkHjQtGKh86rDcRZN17QEMCOIs=
-github.com/xdg-go/stringprep v1.0.3/go.mod h1:W3f5j4i+9rC0kuIEJL0ky1VpHXQU3ocBgklLGvcBnW8=
+github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
+github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
+github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
+github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
@@ -1608,13 +1496,6 @@ github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8
 github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
-github.com/xitongsys/parquet-go v1.5.1/go.mod h1:xUxwM8ELydxh4edHGegYq1pA8NnMKDx0K/GyB0o2bww=
-github.com/xitongsys/parquet-go v1.6.2 h1:MhCaXii4eqceKPu9BwrjLqyK10oX9WF+xGhwvwbw7xM=
-github.com/xitongsys/parquet-go v1.6.2/go.mod h1:IulAQyalCm0rPiZVNnCgm/PCL64X2tdSVGMQ/UeKqWA=
-github.com/xitongsys/parquet-go-source v0.0.0-20190524061010-2b72cbee77d5/go.mod h1:xxCx7Wpym/3QCo6JhujJX51dzSXrwmb0oH6FQb39SEA=
-github.com/xitongsys/parquet-go-source v0.0.0-20200817004010-026bad9b25d0/go.mod h1:HYhIKsdns7xz80OgkbgJYrtQY7FjHWHKH6cvN7+czGE=
-github.com/xitongsys/parquet-go-source v0.0.0-20230312005205-fbbcdea5f512 h1:ghvb6MV6j1i4i/CVeQyaNTM6Egiw65O9gYBGQseeLs0=
-github.com/xitongsys/parquet-go-source v0.0.0-20230312005205-fbbcdea5f512/go.mod h1:d87JD+hvj9dzdbZNd9zJb9ThSLQfoUNx50KQ6nuf9Wg=
 github.com/xlab/treeprint v1.1.0 h1:G/1DjNkPpfZCFt9CSh6b5/nY4VimlbHF3Rh4obvtzDk=
 github.com/xlab/treeprint v1.1.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
@@ -1666,8 +1547,8 @@ go.etcd.io/etcd/tests/v3 v3.5.0-alpha.0/go.mod h1:HnrHxjyCuZ8YDt8PYVyQQ5d1ZQfzJV
 go.etcd.io/etcd/tests/v3 v3.5.0/go.mod h1:f+mtZ1bE1YPvgKdOJV2BKy4JQW0nAFnQehgOE7+WyJE=
 go.etcd.io/etcd/v3 v3.5.0-alpha.0/go.mod h1:JZ79d3LV6NUfPjUxXrpiFAYcjhT+06qqw+i28snx8To=
 go.etcd.io/etcd/v3 v3.5.0/go.mod h1:FldM0/VzcxYWLvWx1sdA7ghKw7C3L2DvUTzGrcEtsC4=
-go.mongodb.org/mongo-driver v1.10.6 h1:d/XGSUi/++VkvvU7+QpFqJZzuccp+rUSYMJ5Q3rjx8I=
-go.mongodb.org/mongo-driver v1.10.6/go.mod h1:z4XpeoU6w+9Vht+jAFyLgVrD+jGSQQe0+CBWFHNiHt8=
+go.mongodb.org/mongo-driver v1.12.0 h1:aPx33jmn/rQuJXPQLZQ8NtfPQG8CaqgLThFtqRb0PiE=
+go.mongodb.org/mongo-driver v1.12.0/go.mod h1:AZkxhPnFJUoH7kZlFkVKucV20K387miPfm7oimrSmK0=
 go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 h1:CCriYyAfq1Br1aIYettdHZTy8mBTIPo7We18TuO/bak=
 go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
 go.opencensus.io v0.15.0/go.mod h1:UffZAU+4sDEINUGP/B7UfBBkq4fqLu9zXAX7ke6CHW0=
@@ -1716,8 +1597,8 @@ go.opentelemetry.io/otel/trace v0.20.0/go.mod h1:6GjCW8zgDjwGHGa6GkyeB8+/5vjT16g
 go.opentelemetry.io/otel/trace v1.16.0 h1:8JRpaObFoW0pxuVPapkgH8UhHQj+bJW8jJsCZEu5MQs=
 go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLkqr2QVwea0ef0=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJPI1Nnw=
-go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
+go.opentelemetry.io/proto/otlp v0.20.0 h1:BLOA1cZBAGSbRiNuGCCKiFrCdYB7deeHDeD1SueyOfA=
+go.opentelemetry.io/proto/otlp v0.20.0/go.mod h1:3QgjzPALBIv9pcknj2EXGPXjYPFdUh/RQfF8Lz3+Vnw=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
@@ -1744,11 +1625,9 @@ go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
 go.uber.org/zap v1.15.0/go.mod h1:Mb2vm2krFEG5DV0W9qcHBYFtp/Wku1cvYaqPsS/WYfc=
 go.uber.org/zap v1.16.0/go.mod h1:MA8QOfq0BHJwdXa996Y4dYkAqRKB8/1K1QMMZVaNZjQ=
 go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
-go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
 go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
 go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
 gocloud.dev v0.19.0/go.mod h1:SmKwiR8YwIMMJvQBKLsC3fHNyMwXLw3PMDO+VVteJMI=
-gocloud.dev v0.26.0/go.mod h1:mkUgejbnbLotorqDyvedJO20XcZNTynmSeVSQS9btVg=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1791,7 +1670,6 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
 golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
@@ -1820,7 +1698,6 @@ golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191002035440-2ec189313ef0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191112182307-2180aed22343/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191119073136-fc4aabc6c914/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -1850,20 +1727,15 @@ golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLd
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210423184538-5f58ad60dda6/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211020060615-d418f374d309/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211029224645-99673261e6eb/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220401154927-543a649e0bdd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU=
+golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1883,11 +1755,6 @@ golang.org/x/oauth2 v0.0.0-20210427180440-81ed05c6b58c/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1934,7 +1801,6 @@ golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191112214154-59a1497f0cea/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191119060738-e882bf8e40c2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191220142924-d4481acd189f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1957,7 +1823,6 @@ golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200828194041-157a740278f4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1991,22 +1856,10 @@ golang.org/x/sys v0.0.0-20210629170331-7dc0b73dc9fb/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210819135213-f52c844e1c1c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210917161153-d61c044b1678/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211110154304-99a53858aa08/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220204135822-1c1b9b1eba6a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -2017,15 +1870,15 @@ golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
+golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28=
+golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2038,8 +1891,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58=
+golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -2047,8 +1900,6 @@ golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220224211638-0e9765cccd65/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -2181,23 +2032,8 @@ google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtuk
 google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
 google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU=
 google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
-google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdrMgI=
-google.golang.org/api v0.58.0/go.mod h1:cAbP2FsxoGVNwtgNAmmn3y5G1TWAiVYRmg4yku3lv+E=
-google.golang.org/api v0.59.0/go.mod h1:sT2boj7M9YJxZzgeZqXogmhfmRWDtPzT31xkieUbuZU=
-google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
-google.golang.org/api v0.63.0/go.mod h1:gs4ij2ffTRXwuzzgJl/56BdwJaA194ijkfn++9tDuPo=
-google.golang.org/api v0.64.0/go.mod h1:931CdxA8Rm4t6zqTFGSsgwbAEZ2+GMYurbndwSimebM=
-google.golang.org/api v0.66.0/go.mod h1:I1dmXYpX7HGwz/ejRxwQp2qj5bFAz93HiCU1C1oYd9M=
-google.golang.org/api v0.67.0/go.mod h1:ShHKP8E60yPsKNw/w8w+VYaj9H6buA5UqDp8dhbQZ6g=
-google.golang.org/api v0.68.0/go.mod h1:sOM8pTpwgflXRhz+oC8H2Dr+UcbMqkPPWNJo88Q7TH8=
-google.golang.org/api v0.69.0/go.mod h1:boanBiw+h5c3s+tBPgEzLDRHfFLWV0qXxRHz3ws7C80=
-google.golang.org/api v0.70.0/go.mod h1:Bs4ZM2HGifEvXwd50TtW70ovgJffJYw2oRCOFU/SkfA=
-google.golang.org/api v0.71.0/go.mod h1:4PyU6e6JogV1f9eA4voyrTY2batOLdgZ5qZ5HOCc4j8=
-google.golang.org/api v0.74.0/go.mod h1:ZpfMZOVRMywNyvJFeqL9HRWBgAuRfSjJFpe9QtRRyDs=
-google.golang.org/api v0.125.0 h1:7xGvEY4fyWbhWMHf3R2/4w7L4fXyfpRGE9g6lp8+DCk=
-google.golang.org/api v0.125.0/go.mod h1:mBwVAtz+87bEN6CbA1GtZPDOqY2R5ONPqJeIlvyo4Aw=
+google.golang.org/api v0.128.0 h1:RjPESny5CnQRn9V6siglged+DZCgfu9l6mO9dkX9VOg=
+google.golang.org/api v0.128.0/go.mod h1:Y611qgqaE92On/7g65MQgxYul3c0rEB894kniWLY750=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -2267,7 +2103,6 @@ google.golang.org/genproto v0.0.0-20210413151531-c14fb6ef47c3/go.mod h1:P3QM42oQ
 google.golang.org/genproto v0.0.0-20210427215850-f767ed18ee4d/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
 google.golang.org/genproto v0.0.0-20210429181445-86c259c2b4ab/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
 google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
-google.golang.org/genproto v0.0.0-20210517163617-5e0236093d7a/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
 google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
 google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
 google.golang.org/genproto v0.0.0-20210608205507-b6d2f5bf0d7d/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
@@ -2278,36 +2113,7 @@ google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKr
 google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
 google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwySK631ADgubI+/XFU/xp8FD5KIVV4rj8UC5w=
 google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210903162649-d08c68adba83/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210917145530-b395a37504d4/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210921142501-181ce0d877f6/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211008145708-270636b82663/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211018162055-cf77aa76bad2/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211028162531-8db9c33dc351/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211221195035-429b39de9b1c/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211223182754-3ac035c7e7cb/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220111164026-67b88f271998/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220126215142-9970aeb2e350/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220201184016-50beb8ab5c44/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220204002441-d6cc3cc0770e/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220207164111-0872dc986b00/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220211171837-173942840c17/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220216160803-4663080d8bc8/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220222213610-43724f9ea8cf/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220304144024-325a89244dc8/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220310185008-1973136f34c6/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220324131243-acbaeb5b85eb/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
-google.golang.org/genproto v0.0.0-20220401170504-314d38edb7de/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
 google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc h1:8DyZCyvI8mE1IdLy/60bS+52xfymkE72wv1asokgtao=
 google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:xZnkP7mREFX5MORlOPEzLMr+90PPZQ2QWzrVTWfAq64=
 google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc h1:kVKPf/IiYSBWEWtkIn6wZXwWGCnLKcC8oWfZvXjsGnM=
@@ -2349,13 +2155,10 @@ google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQ
 google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
-google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
+google.golang.org/grpc v1.56.1 h1:z0dNfjIl0VpaZ9iSVjA6daGatAYwPGstTjt5vkRMFkQ=
+google.golang.org/grpc v1.56.1/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0 h1:rNBFJjBCOgVr9pWD7rs/knKL4FRTKgpZmsRfV214zcA=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0/go.mod h1:Dk1tviKTvMCz5tvh7t+fh94dhmQVHuCt2OzJB3CTW9Y=
@@ -2377,7 +2180,6 @@ google.golang.org/protobuf v1.25.1-0.20200805231151-a709e31e5d12/go.mod h1:9JNX7
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
@@ -2390,6 +2192,8 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntN
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
 gopkg.in/cheggaaa/pb.v1 v1.0.28/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
+gopkg.in/dnaeon/go-vcr.v3 v3.1.2 h1:F1smfXBqQqwpVifDfUBQG6zzaGjzT+EnVZakrOdr5wA=
+gopkg.in/dnaeon/go-vcr.v3 v3.1.2/go.mod h1:2IMOnnlx9I6u9x+YBsM3tAMx6AlOxnJ0pWxQAzZ79Ag=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/gcfg.v1 v1.2.3/go.mod h1:yesOnuUOFQAhST5vPY4nbZsb/huCgGGXlipJsBn0b3o=
@@ -2399,14 +2203,8 @@ gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:a
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/ini.v1 v1.66.6/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/jcmturner/aescts.v1 v1.0.1/go.mod h1:nsR8qBOg+OucoIW+WMhB3GspUQXq9XorLnQb9XtvcOo=
-gopkg.in/jcmturner/dnsutils.v1 v1.0.1/go.mod h1:m3v+5svpVOhtFAP/wSz+yzh4Mc0Fg7eRhxkJMWSIz9Q=
-gopkg.in/jcmturner/goidentity.v3 v3.0.0/go.mod h1:oG2kH0IvSYNIu80dVAyu/yoefjq1mNfM5bm88whjWx4=
-gopkg.in/jcmturner/gokrb5.v7 v7.3.0/go.mod h1:l8VISx+WGYp+Fp7KRbsiUuXTTOnxIc3Tuvyavf11/WM=
-gopkg.in/jcmturner/rpc.v1 v1.1.0/go.mod h1:YIdkC4XfD6GXbzje11McwsDuOlZQSb9W4vfLvuNnlv8=
 gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce/go.mod h1:yeKp02qBN3iKW1OzL3MGk2IdtZzaj7SFntXj72NppTA=
 gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22 h1:VpOs+IwYnYBaFnrNAeB8UUWtL3vEUnzSCL1nVjPhqrw=
 gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22/go.mod h1:yeKp02qBN3iKW1OzL3MGk2IdtZzaj7SFntXj72NppTA=
@@ -2449,34 +2247,33 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.27.2 h1:+H17AJpUMvl+clT+BPnKf0E3ksMAzoBBg7CntpSuADo=
-k8s.io/api v0.27.2/go.mod h1:ENmbocXfBT2ADujUXcBhHV55RIT31IIEvkntP6vZKS4=
+k8s.io/api v0.27.3 h1:yR6oQXXnUEBWEWcvPWS0jQL575KoAboQPfJAuKNrw5Y=
+k8s.io/api v0.27.3/go.mod h1:C4BNvZnQOF7JA/0Xed2S+aUyJSfTGkGFxLXz9MnpIpg=
 k8s.io/apiextensions-apiserver v0.27.2 h1:iwhyoeS4xj9Y7v8YExhUwbVuBhMr3Q4bd/laClBV6Bo=
 k8s.io/apiextensions-apiserver v0.27.2/go.mod h1:Oz9UdvGguL3ULgRdY9QMUzL2RZImotgxvGjdWRq6ZXQ=
-k8s.io/apimachinery v0.27.2 h1:vBjGaKKieaIreI+oQwELalVG4d8f3YAMNpWLzDXkxeg=
-k8s.io/apimachinery v0.27.2/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
-k8s.io/apiserver v0.27.2 h1:p+tjwrcQEZDrEorCZV2/qE8osGTINPuS5ZNqWAvKm5E=
-k8s.io/apiserver v0.27.2/go.mod h1:EsOf39d75rMivgvvwjJ3OW/u9n1/BmUMK5otEOJrb1Y=
-k8s.io/cli-runtime v0.27.2 h1:9HI8gfReNujKXt16tGOAnb8b4NZ5E+e0mQQHKhFGwYw=
-k8s.io/cli-runtime v0.27.2/go.mod h1:9UecpyPDTkhiYY4d9htzRqN+rKomJgyb4wi0OfrmCjw=
-k8s.io/client-go v0.27.2 h1:vDLSeuYvCHKeoQRhCXjxXO45nHVv2Ip4Fe0MfioMrhE=
-k8s.io/client-go v0.27.2/go.mod h1:tY0gVmUsHrAmjzHX9zs7eCjxcBsf8IiNe7KQ52biTcQ=
-k8s.io/component-base v0.27.2 h1:neju+7s/r5O4x4/txeUONNTS9r1HsPbyoPBAtHsDCpo=
-k8s.io/component-base v0.27.2/go.mod h1:5UPk7EjfgrfgRIuDBFtsEFAe4DAvP3U+M8RTzoSJkpo=
-k8s.io/component-helpers v0.27.2 h1:i9TgWJ6TH8lQ9x4ExHOwhVitrRpBOr7Wn8aZLbBWxkc=
-k8s.io/component-helpers v0.27.2/go.mod h1:NwcpSKo1xzXtUtrUjj5NTSVWex84UPua/z0PYDcCzNo=
+k8s.io/apimachinery v0.27.3 h1:Ubye8oBufD04l9QnNtW05idcOe9Z3GQN8+7PqmuVcUM=
+k8s.io/apimachinery v0.27.3/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
+k8s.io/apiserver v0.27.3 h1:AxLvq9JYtveYWK+D/Dz/uoPCfz8JC9asR5z7+I/bbQ4=
+k8s.io/apiserver v0.27.3/go.mod h1:Y61+EaBMVWUBJtxD5//cZ48cHZbQD+yIyV/4iEBhhNA=
+k8s.io/cli-runtime v0.27.3 h1:h592I+2eJfXj/4jVYM+tu9Rv8FEc/dyCoD80UJlMW2Y=
+k8s.io/cli-runtime v0.27.3/go.mod h1:LzXud3vFFuDFXn2LIrWnscPgUiEj7gQQcYZE2UPn9Kw=
+k8s.io/client-go v0.27.3 h1:7dnEGHZEJld3lYwxvLl7WoehK6lAq7GvgjxpA3nv1E8=
+k8s.io/client-go v0.27.3/go.mod h1:2MBEKuTo6V1lbKy3z1euEGnhPfGZLKTS9tiJ2xodM48=
+k8s.io/component-base v0.27.3 h1:g078YmdcdTfrCE4fFobt7qmVXwS8J/3cI1XxRi/2+6k=
+k8s.io/component-base v0.27.3/go.mod h1:JNiKYcGImpQ44iwSYs6dysxzR9SxIIgQalk4HaCNVUY=
+k8s.io/component-helpers v0.27.3 h1:oK7+AlwBKsSUIIRC5Vv8/4HEtmgzXNQD+zLbsOUwVso=
+k8s.io/component-helpers v0.27.3/go.mod h1:uxhXqoWHh4eBVcPj+LKWjtQq0V/vP5ihn4xmf5xNZso=
 k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
 k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg=
 k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg=
-k8s.io/kubectl v0.27.2 h1:sSBM2j94MHBFRWfHIWtEXWCicViQzZsb177rNsKBhZg=
-k8s.io/kubectl v0.27.2/go.mod h1:GCOODtxPcrjh+EC611MqREkU8RjYBh10ldQCQ6zpFKw=
-k8s.io/metrics v0.27.2 h1:TD6z3dhhN9bgg5YkbTh72bPiC1BsxipBLPBWyC3VQAU=
-k8s.io/metrics v0.27.2/go.mod h1:v3OT7U0DBvoAzWVzGZWQhdV4qsRJWchzs/LeVN8bhW4=
+k8s.io/kubectl v0.27.3 h1:HyC4o+8rCYheGDWrkcOQHGwDmyLKR5bxXFgpvF82BOw=
+k8s.io/kubectl v0.27.3/go.mod h1:g9OQNCC2zxT+LT3FS09ZYqnDhlvsKAfFq76oyarBcq4=
+k8s.io/metrics v0.27.3 h1:pBVKgQjfui8xzfTidIxiOmLHwcCk3KbeuWowo/Oh0t0=
+k8s.io/metrics v0.27.3/go.mod h1:pXj63OTdOjpYgSc95p+88fB3t4krLybM7MOeqIksI6o=
 k8s.io/utils v0.0.0-20230209194617-a36077c30491 h1:r0BAOLElQnnFhE/ApUsg3iHdVYYPBjNSSOMowRZxxsY=
 k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 launchpad.net/gocheck v0.0.0-20140225173054-000000000087 h1:Izowp2XBH6Ya6rv+hqbceQyw/gSGoXfH/UPoTGduL54=
-nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
 pack.ag/amqp v0.11.2/go.mod h1:4/cbmt4EJXSKlG6LCfWHoqmN0uFdy5i/+YFz+fTfhV4=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
diff --git a/integration/appaccess/appaccess_test.go b/integration/appaccess/appaccess_test.go
index 499cd266dccb2..e9007782417eb 100644
--- a/integration/appaccess/appaccess_test.go
+++ b/integration/appaccess/appaccess_test.go
@@ -29,7 +29,6 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/google/uuid"
-	"github.com/gravitational/oxy/forward"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
@@ -39,6 +38,7 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
@@ -405,10 +405,10 @@ func testRewriteHeadersRoot(p *Pack, t *testing.T) {
 	require.NotEqual(t, req.Header.Get(teleport.AppJWTHeader), "rewritten-app-jwt-header")
 	require.NotEqual(t, req.Header.Get(teleport.AppCFHeader), "rewritten-app-cf-header")
 	require.NotEqual(t, req.Header.Get(common.TeleportAPIErrorHeader), "rewritten-x-teleport-api-error")
-	require.NotEqual(t, req.Header.Get(forward.XForwardedFor), "rewritten-x-forwarded-for-header")
-	require.NotEqual(t, req.Header.Get(forward.XForwardedHost), "rewritten-x-forwarded-host-header")
-	require.NotEqual(t, req.Header.Get(forward.XForwardedProto), "rewritten-x-forwarded-proto-header")
-	require.NotEqual(t, req.Header.Get(forward.XForwardedServer), "rewritten-x-forwarded-server-header")
+	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedFor), "rewritten-x-forwarded-for-header")
+	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedHost), "rewritten-x-forwarded-host-header")
+	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedProto), "rewritten-x-forwarded-proto-header")
+	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedServer), "rewritten-x-forwarded-server-header")
 	require.NotEqual(t, req.Header.Get(common.XForwardedSSL), "rewritten-x-forwarded-ssl")
 
 	// Verify JWT tokens.
@@ -444,10 +444,10 @@ func testRewriteHeadersLeaf(p *Pack, t *testing.T) {
 	require.NotEqual(t, req.Header.Get(teleport.AppCFHeader), "rewritten-app-cf-header")
 	require.NotEqual(t, req.Header.Get(common.TeleportAPIErrorHeader), "rewritten-x-teleport-api-error")
 	require.NotEqual(t, req.Header.Get(common.XForwardedSSL), "rewritten-x-forwarded-ssl")
-	require.NotEqual(t, req.Header.Get(forward.XForwardedFor), "rewritten-x-forwarded-for-header")
-	require.NotEqual(t, req.Header.Get(forward.XForwardedHost), "rewritten-x-forwarded-host-header")
-	require.NotEqual(t, req.Header.Get(forward.XForwardedProto), "rewritten-x-forwarded-proto-header")
-	require.NotEqual(t, req.Header.Get(forward.XForwardedServer), "rewritten-x-forwarded-server-header")
+	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedFor), "rewritten-x-forwarded-for-header")
+	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedHost), "rewritten-x-forwarded-host-header")
+	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedProto), "rewritten-x-forwarded-proto-header")
+	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedServer), "rewritten-x-forwarded-server-header")
 }
 
 // testLogout verifies the session is removed from the backend when the user logs out.
diff --git a/integration/appaccess/pack.go b/integration/appaccess/pack.go
index a10ef45bacfad..0af7ddf7127a6 100644
--- a/integration/appaccess/pack.go
+++ b/integration/appaccess/pack.go
@@ -30,7 +30,6 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/gorilla/websocket"
-	"github.com/gravitational/oxy/forward"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
@@ -45,7 +44,8 @@ import (
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/httplib/csrf"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
@@ -55,6 +55,7 @@ import (
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/web"
 	"github.com/gravitational/teleport/lib/web/app"
+	websession "github.com/gravitational/teleport/lib/web/session"
 )
 
 // Pack contains identity as well as initialized Teleport clusters and instances.
@@ -243,7 +244,7 @@ func (p *Pack) initWebSession(t *testing.T) {
 	// Extract session cookie and bearer token.
 	require.Len(t, resp.Cookies(), 1)
 	cookie := resp.Cookies()[0]
-	require.Equal(t, cookie.Name, web.CookieName)
+	require.Equal(t, cookie.Name, websession.CookieName)
 
 	p.webCookie = cookie.Value
 	p.webToken = csResp.Token
@@ -347,7 +348,7 @@ func (p *Pack) makeWebapiRequest(method, endpoint string, payload []byte) (int,
 	}
 
 	req.AddCookie(&http.Cookie{
-		Name:  web.CookieName,
+		Name:  websession.CookieName,
 		Value: p.webCookie,
 	})
 	req.Header.Add("Authorization", fmt.Sprintf("Bearer %v", p.webToken))
@@ -701,19 +702,19 @@ func (p *Pack) startRootAppServers(t *testing.T, count int, opts AppTestOptions)
 							Value: "rewritten-x-teleport-api-error",
 						},
 						{
-							Name:  forward.XForwardedFor,
+							Name:  reverseproxy.XForwardedFor,
 							Value: "rewritten-x-forwarded-for-header",
 						},
 						{
-							Name:  forward.XForwardedHost,
+							Name:  reverseproxy.XForwardedHost,
 							Value: "rewritten-x-forwarded-host-header",
 						},
 						{
-							Name:  forward.XForwardedProto,
+							Name:  reverseproxy.XForwardedProto,
 							Value: "rewritten-x-forwarded-proto-header",
 						},
 						{
-							Name:  forward.XForwardedServer,
+							Name:  reverseproxy.XForwardedServer,
 							Value: "rewritten-x-forwarded-server-header",
 						},
 						{
@@ -721,7 +722,7 @@ func (p *Pack) startRootAppServers(t *testing.T, count int, opts AppTestOptions)
 							Value: "rewritten-x-forwarded-ssl-header",
 						},
 						{
-							Name:  forward.XForwardedPort,
+							Name:  reverseproxy.XForwardedPort,
 							Value: "rewritten-x-forwarded-port-header",
 						},
 						// Make sure we can insert JWT token in custom header.
@@ -752,7 +753,7 @@ func (p *Pack) startRootAppServers(t *testing.T, count int, opts AppTestOptions)
 	return servers
 }
 
-func waitForAppServer(t *testing.T, tunnel reversetunnel.Server, name string, hostUUID string, apps []servicecfg.App) {
+func waitForAppServer(t *testing.T, tunnel reversetunnelclient.Server, name string, hostUUID string, apps []servicecfg.App) {
 	// Make sure that the app server is ready to accept connections.
 	// The remote site cache needs to be filled with new registered application services.
 	waitForAppRegInRemoteSiteCache(t, tunnel, name, apps, hostUUID)
@@ -844,19 +845,19 @@ func (p *Pack) startLeafAppServers(t *testing.T, count int, opts AppTestOptions)
 							Value: "rewritten-x-teleport-api-error",
 						},
 						{
-							Name:  forward.XForwardedFor,
+							Name:  reverseproxy.XForwardedFor,
 							Value: "rewritten-x-forwarded-for-header",
 						},
 						{
-							Name:  forward.XForwardedHost,
+							Name:  reverseproxy.XForwardedHost,
 							Value: "rewritten-x-forwarded-host-header",
 						},
 						{
-							Name:  forward.XForwardedProto,
+							Name:  reverseproxy.XForwardedProto,
 							Value: "rewritten-x-forwarded-proto-header",
 						},
 						{
-							Name:  forward.XForwardedServer,
+							Name:  reverseproxy.XForwardedServer,
 							Value: "rewritten-x-forwarded-server-header",
 						},
 						{
@@ -864,7 +865,7 @@ func (p *Pack) startLeafAppServers(t *testing.T, count int, opts AppTestOptions)
 							Value: "rewritten-x-forwarded-ssl-header",
 						},
 						{
-							Name:  forward.XForwardedPort,
+							Name:  reverseproxy.XForwardedPort,
 							Value: "rewritten-x-forwarded-port-header",
 						},
 					},
@@ -890,7 +891,7 @@ func (p *Pack) startLeafAppServers(t *testing.T, count int, opts AppTestOptions)
 	return servers
 }
 
-func waitForAppRegInRemoteSiteCache(t *testing.T, tunnel reversetunnel.Server, clusterName string, cfgApps []servicecfg.App, hostUUID string) {
+func waitForAppRegInRemoteSiteCache(t *testing.T, tunnel reversetunnelclient.Server, clusterName string, cfgApps []servicecfg.App, hostUUID string) {
 	require.Eventually(t, func() bool {
 		site, err := tunnel.GetSite(clusterName)
 		require.NoError(t, err)
diff --git a/integration/helpers/instance.go b/integration/helpers/instance.go
index 056e938180a0f..3a3d9dd8f9f18 100644
--- a/integration/helpers/instance.go
+++ b/integration/helpers/instance.go
@@ -56,6 +56,7 @@ import (
 	"github.com/gravitational/teleport/lib/httplib/csrf"
 	"github.com/gravitational/teleport/lib/observability/tracing"
 	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
@@ -64,6 +65,7 @@ import (
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/web"
+	websession "github.com/gravitational/teleport/lib/web/session"
 )
 
 const (
@@ -257,7 +259,7 @@ type TeleInstance struct {
 	// Internal stuff...
 	Process              *service.TeleportProcess
 	Config               *servicecfg.Config
-	Tunnel               reversetunnel.Server
+	Tunnel               reversetunnelclient.Server
 	RemoteClusterWatcher *reversetunnel.RemoteClusterTunnelManager
 
 	// Nodes is a list of additional nodes
@@ -1032,7 +1034,7 @@ type ProxyConfig struct {
 }
 
 // StartProxy starts another Proxy Server and connects it to the cluster.
-func (i *TeleInstance) StartProxy(cfg ProxyConfig, opts ...Option) (reversetunnel.Server, *service.TeleportProcess, error) {
+func (i *TeleInstance) StartProxy(cfg ProxyConfig, opts ...Option) (reversetunnelclient.Server, *service.TeleportProcess, error) {
 	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName+"-"+cfg.Name)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
@@ -1106,12 +1108,12 @@ func (i *TeleInstance) StartProxy(cfg ProxyConfig, opts ...Option) (reversetunne
 	log.Debugf("Teleport proxy (in instance %v) started: %v/%v events received.",
 		i.Secrets.SiteName, len(expectedEvents), len(receivedEvents))
 
-	// Extract and set reversetunnel.Server and reversetunnel.AgentPool upon
+	// Extract and set reversetunnelclient.Server and reversetunnel.AgentPool upon
 	// receipt of a ProxyReverseTunnelReady event
 	for _, re := range receivedEvents {
 		switch re.Name {
 		case service.ProxyReverseTunnelReady:
-			ts, ok := re.Payload.(reversetunnel.Server)
+			ts, ok := re.Payload.(reversetunnelclient.Server)
 			if ok {
 				return ts, process, nil
 			}
@@ -1219,12 +1221,12 @@ func (i *TeleInstance) Start() error {
 		return trace.Wrap(err)
 	}
 
-	// Extract and set reversetunnel.Server and reversetunnel.AgentPool upon
+	// Extract and set reversetunnelclient.Server and reversetunnel.AgentPool upon
 	// receipt of a ProxyReverseTunnelReady and ProxyAgentPoolReady respectively.
 	for _, re := range receivedEvents {
 		switch re.Name {
 		case service.ProxyReverseTunnelReady:
-			ts, ok := re.Payload.(reversetunnel.Server)
+			ts, ok := re.Payload.(reversetunnelclient.Server)
 			if ok {
 				i.Tunnel = ts
 			}
@@ -1243,6 +1245,8 @@ func (i *TeleInstance) Start() error {
 
 // ClientConfig is a client configuration
 type ClientConfig struct {
+	// TeleportUser is Teleport username
+	TeleportUser string
 	// Login is SSH login name
 	Login string
 	// Cluster is a cluster name to connect to
@@ -1322,8 +1326,12 @@ func (i *TeleInstance) NewUnauthenticatedClient(cfg ClientConfig) (tc *client.Te
 		fwdAgentMode = client.ForwardAgentYes
 	}
 
+	if cfg.TeleportUser == "" {
+		cfg.TeleportUser = cfg.Login
+	}
+
 	cconf := &client.Config{
-		Username:                      cfg.Login,
+		Username:                      cfg.TeleportUser,
 		Host:                          cfg.Host,
 		HostPort:                      cfg.Port,
 		HostLogin:                     cfg.Login,
@@ -1407,8 +1415,8 @@ func (i *TeleInstance) NewWebClient(cfg ClientConfig) (*WebClient, error) {
 		return nil, trace.BadParameter("unexpected number of cookies returned; got %d, want %d", len(cookies), 1)
 	}
 	cookie := cookies[0]
-	if cookie.Name != web.CookieName {
-		return nil, trace.BadParameter("unexpected session cookies returned; got %s, want %s", cookie.Name, web.CookieName)
+	if cookie.Name != websession.CookieName {
+		return nil, trace.BadParameter("unexpected session cookies returned; got %s, want %s", cookie.Name, websession.CookieName)
 	}
 
 	tc, err := i.NewUnauthenticatedClient(cfg)
@@ -1554,21 +1562,22 @@ func (w *WebClient) SSH(termReq web.TerminalRequest) (*web.TerminalStream, error
 		return nil, trace.Wrap(err)
 	}
 
-	stream, err := web.NewTerminalStream(ws)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
+	stream := web.NewTerminalStream(context.Background(), ws, utils.NewLoggerForTests())
 	return stream, nil
 }
 
 // AddClientCredentials adds authenticated credentials to a client.
 // (server CAs and signed session key).
 func (i *TeleInstance) AddClientCredentials(tc *client.TeleportClient, cfg ClientConfig) (*client.TeleportClient, error) {
+	login := cfg.Login
+	if cfg.TeleportUser != "" {
+		login = cfg.TeleportUser
+	}
+
 	// Generate certificates for the user simulating login.
 	creds, err := GenerateUserCreds(UserCredsRequest{
 		Process:  i.Process,
-		Username: cfg.Login,
+		Username: login,
 		SourceIP: cfg.SourceIP,
 	})
 	if err != nil {
diff --git a/integration/helpers/proxy.go b/integration/helpers/proxy.go
index 359f4caf1c0cd..7d08aacc70f99 100644
--- a/integration/helpers/proxy.go
+++ b/integration/helpers/proxy.go
@@ -18,7 +18,6 @@ import (
 	"context"
 	"crypto/tls"
 	"fmt"
-	"io"
 	"net"
 	"net/http"
 	"net/url"
@@ -31,81 +30,12 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/fixtures"
+	apitesthelpers "github.com/gravitational/teleport/api/testhelpers"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
-type ProxyHandler struct {
-	sync.Mutex
-	count int
-}
-
-// ServeHTTP only accepts the CONNECT verb and will tunnel your connection to
-// the specified host. Also tracks the number of connections that it proxies for
-// debugging purposes.
-func (p *ProxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	// Validate http connect parameters.
-	if r.Method != http.MethodConnect {
-		trace.WriteError(w, trace.BadParameter("%v not supported", r.Method))
-		return
-	}
-	if r.Host == "" {
-		trace.WriteError(w, trace.BadParameter("host not set"))
-		return
-	}
-
-	// Dial to the target host, this is done before hijacking the connection to
-	// ensure the target host is accessible.
-	dconn, err := net.Dial("tcp", r.Host)
-	if err != nil {
-		trace.WriteError(w, err)
-		return
-	}
-	defer dconn.Close()
-
-	// Once the client receives 200 OK, the rest of the data will no longer be
-	// http, but whatever protocol is being tunneled.
-	w.WriteHeader(http.StatusOK)
-
-	// Hijack request so we can get underlying connection.
-	hj, ok := w.(http.Hijacker)
-	if !ok {
-		trace.WriteError(w, trace.AccessDenied("unable to hijack connection"))
-		return
-	}
-	sconn, _, err := hj.Hijack()
-	if err != nil {
-		trace.WriteError(w, err)
-		return
-	}
-	defer sconn.Close()
-
-	// Success, we're proxying data now.
-	p.Lock()
-	p.count++
-	p.Unlock()
-
-	// Copy from src to dst and dst to src.
-	errc := make(chan error, 2)
-	replicate := func(dst io.Writer, src io.Reader) {
-		_, err := io.Copy(dst, src)
-		errc <- err
-	}
-	go replicate(sconn, dconn)
-	go replicate(dconn, sconn)
-
-	// Wait until done, error, or 10 second.
-	select {
-	case <-time.After(10 * time.Second):
-	case <-errc:
-	}
-}
-
-// Count returns the number of requests that have been proxied.
-func (p *ProxyHandler) Count() int {
-	p.Lock()
-	defer p.Unlock()
-	return p.count
-}
+// ProxyHandler is a http.Handler that implements a simple HTTP proxy server.
+type ProxyHandler = apitesthelpers.ProxyHandler
 
 type ProxyAuthorizer struct {
 	next     http.Handler
diff --git a/integration/helpers/trustedclusters.go b/integration/helpers/trustedclusters.go
index cdcd1ceb0112b..42781025a64ca 100644
--- a/integration/helpers/trustedclusters.go
+++ b/integration/helpers/trustedclusters.go
@@ -28,7 +28,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/lib/auth"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 )
 
 // WaitForTunnelConnections waits for remote tunnels connections
@@ -76,7 +76,7 @@ func TryCreateTrustedCluster(t *testing.T, authServer *auth.Server, trustedClust
 	require.FailNow(t, "Timeout creating trusted cluster")
 }
 
-func WaitForClusters(tun reversetunnel.Server, expected int) func() bool {
+func WaitForClusters(tun reversetunnelclient.Server, expected int) func() bool {
 	return func() bool {
 		clusters, err := tun.GetSites()
 		if err != nil {
@@ -129,7 +129,7 @@ func WaitForNodeCount(ctx context.Context, t *TeleInstance, clusterName string,
 }
 
 // WaitForActiveTunnelConnections waits for remote cluster to report a minimum number of active connections
-func WaitForActiveTunnelConnections(t *testing.T, tunnel reversetunnel.Server, clusterName string, expectedCount int) {
+func WaitForActiveTunnelConnections(t *testing.T, tunnel reversetunnelclient.Server, clusterName string, expectedCount int) {
 	require.Eventually(t, func() bool {
 		cluster, err := tunnel.GetSite(clusterName)
 		if err != nil {
diff --git a/integration/helpers/web.go b/integration/helpers/web.go
index e1cfbc85cb4ac..c9392c76a2d83 100644
--- a/integration/helpers/web.go
+++ b/integration/helpers/web.go
@@ -30,6 +30,7 @@ import (
 	"github.com/gravitational/teleport/lib/httplib/csrf"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/web"
+	websession "github.com/gravitational/teleport/lib/web/session"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
@@ -91,7 +92,7 @@ func LoginWebClient(t *testing.T, host, username, password string) *WebClientPac
 	// Extract session cookie and bearer token.
 	require.Len(t, resp.Cookies(), 1)
 	cookie := resp.Cookies()[0]
-	require.Equal(t, cookie.Name, web.CookieName)
+	require.Equal(t, cookie.Name, websession.CookieName)
 
 	webClient := &WebClientPack{
 		clt:         client,
@@ -127,7 +128,7 @@ func (w *WebClientPack) DoRequest(t *testing.T, method, endpoint string, payload
 	require.NoError(t, err)
 
 	req.AddCookie(&http.Cookie{
-		Name:  web.CookieName,
+		Name:  websession.CookieName,
 		Value: w.webCookie,
 	})
 	req.Header.Add("Authorization", fmt.Sprintf("Bearer %v", w.bearerToken))
diff --git a/integration/hostuser_test.go b/integration/hostuser_test.go
index ace73ca5adc46..f77e3219f160f 100644
--- a/integration/hostuser_test.go
+++ b/integration/hostuser_test.go
@@ -125,7 +125,7 @@ func TestRootHostUsersBackend(t *testing.T) {
 		require.NoError(t, err)
 		invalidSudoersEntry := []byte("yipee i broke sudo!!!!")
 		err = backend.CheckSudoers(invalidSudoersEntry)
-		require.EqualError(t, err, "parse error in stdin near line 1\n\n\tvisudo: invalid sudoers file")
+		require.Contains(t, err.Error(), "visudo: invalid sudoers file")
 		// test sudoers entry containing . or ~
 		require.NoError(t, backend.WriteSudoersFile("user.name", validSudoersEntry))
 		_, err = os.Stat(filepath.Join(sudoersTestDir, "teleport-hostuuid-user_name"))
@@ -175,7 +175,7 @@ func TestRootHostUsers(t *testing.T) {
 		users := srv.NewHostUsers(context.Background(), presence, "host_uuid")
 
 		testGroups := []string{"group1", "group2"}
-		_, closer, err := users.CreateUser(testuser, &services.HostUsersInfo{Groups: testGroups})
+		closer, err := users.CreateUser(testuser, &services.HostUsersInfo{Groups: testGroups, Mode: types.CreateHostUserMode_HOST_USER_MODE_DROP})
 		require.NoError(t, err)
 
 		testGroups = append(testGroups, types.TeleportServiceGroup)
@@ -205,9 +205,10 @@ func TestRootHostUsers(t *testing.T) {
 			os.Remove(sudoersPath(testuser, uuid))
 			host.UserDel(testuser)
 		})
-		_, closer, err := users.CreateUser(testuser,
+		closer, err := users.CreateUser(testuser,
 			&services.HostUsersInfo{
 				Sudoers: []string{"ALL=(ALL) ALL"},
+				Mode:    types.CreateHostUserMode_HOST_USER_MODE_DROP,
 			})
 		require.NoError(t, err)
 		_, err = os.Stat(sudoersPath(testuser, uuid))
@@ -219,9 +220,10 @@ func TestRootHostUsers(t *testing.T) {
 		require.True(t, os.IsNotExist(err))
 
 		// ensure invalid sudoers entries dont get written
-		_, closer, err = users.CreateUser(testuser,
+		closer, err = users.CreateUser(testuser,
 			&services.HostUsersInfo{
 				Sudoers: []string{"badsudoers entry!!!"},
+				Mode:    types.CreateHostUserMode_HOST_USER_MODE_DROP,
 			})
 		require.Error(t, err)
 		defer closer.Close()
@@ -235,11 +237,16 @@ func TestRootHostUsers(t *testing.T) {
 
 		deleteableUsers := []string{"teleport-user1", "teleport-user2", "teleport-user3"}
 		for _, user := range deleteableUsers {
-			_, _, err := users.CreateUser(user, &services.HostUsersInfo{})
+			_, err := users.CreateUser(user, &services.HostUsersInfo{Mode: types.CreateHostUserMode_HOST_USER_MODE_DROP})
 			require.NoError(t, err)
 		}
-		_, err = host.UserAdd("teleport-user4", []string{})
+
+		// this user should not be in the service group as it was created with mode keep.
+		closer, err := users.CreateUser("teleport-user4", &services.HostUsersInfo{
+			Mode: types.CreateHostUserMode_HOST_USER_MODE_KEEP,
+		})
 		require.NoError(t, err)
+		require.Nil(t, closer)
 
 		t.Cleanup(cleanupUsersAndGroups(
 			[]string{"teleport-user1", "teleport-user2", "teleport-user3", "teleport-user4"},
diff --git a/integration/integration_test.go b/integration/integration_test.go
index b8d32d1911ba6..5f6f4bfebe663 100644
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -72,8 +72,11 @@ import (
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/mocku2f"
 	"github.com/gravitational/teleport/lib/auth/native"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
+	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
 	"github.com/gravitational/teleport/lib/bpf"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/cloud"
@@ -81,7 +84,7 @@ import (
 	"github.com/gravitational/teleport/lib/events/filesessions"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/pam"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
@@ -90,6 +93,7 @@ import (
 	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/prompt"
 	"github.com/gravitational/teleport/lib/web"
 )
 
@@ -128,6 +132,7 @@ func TestIntegrations(t *testing.T) {
 	t.Run("BPFExec", suite.bind(testBPFExec))
 	t.Run("BPFInteractive", suite.bind(testBPFInteractive))
 	t.Run("BPFSessionDifferentiation", suite.bind(testBPFSessionDifferentiation))
+	t.Run("ClientIdleConnection", suite.bind(testClientIdleConnection))
 	t.Run("CmdLabels", suite.bind(testCmdLabels))
 	t.Run("ControlMaster", suite.bind(testControlMaster))
 	t.Run("CustomReverseTunnel", suite.bind(testCustomReverseTunnel))
@@ -149,6 +154,7 @@ func TestIntegrations(t *testing.T) {
 	t.Run("JumpTrustedClustersWithLabels", suite.bind(testJumpTrustedClustersWithLabels))
 	t.Run("List", suite.bind(testList))
 	t.Run("MapRoles", suite.bind(testMapRoles))
+	t.Run("ModeratedSessions", suite.bind(testModeratedSessions))
 	t.Run("MultiplexingTrustedClusters", suite.bind(testMultiplexingTrustedClusters))
 	t.Run("PAM", suite.bind(testPAM))
 	t.Run("PortForwarding", suite.bind(testPortForwarding))
@@ -1809,6 +1815,114 @@ type disconnectTestCase struct {
 	verifyError errorVerifier
 }
 
+// repeatingReader is an [io.ReadCloser] that produces the
+// provided output at the configured interval until closed.
+// For example, all calls to Read on the following reader will
+// block for a minute and then return "hi" to the caller. Once
+// Closed an `io.EOF` will be returned from Read
+//
+// r := repeatingReader{output: hi, interval:time.Minute}
+// n, err := r.Read(out)
+type repeatingReader struct {
+	output   string
+	interval time.Duration
+	closed   chan struct{}
+}
+
+func newRepeatingReader(output string, interval time.Duration) repeatingReader {
+	return repeatingReader{
+		interval: interval,
+		output:   output,
+		closed:   make(chan struct{}),
+	}
+}
+
+func (r repeatingReader) Read(p []byte) (int, error) {
+	if len(p) == 0 {
+		return 0, nil
+	}
+
+	select {
+	case <-time.After(r.interval):
+	case <-r.closed:
+		return 0, io.EOF
+	}
+
+	end := len(r.output)
+	if end > len(p) {
+		end = len(p)
+	}
+
+	n := copy(p, r.output[:end])
+	return n, nil
+}
+
+func (r repeatingReader) Close() error {
+	close(r.closed)
+	return nil
+}
+
+// testClientIdleConnection validates that if a user is active beyond
+// the client idle timeout that the session is not terminated.
+func testClientIdleConnection(t *testing.T, suite *integrationTestSuite) {
+	netConfig := types.DefaultClusterNetworkingConfig()
+	netConfig.SetClientIdleTimeout(time.Second)
+
+	tconf := servicecfg.MakeDefaultConfig()
+	tconf.SSH.Enabled = true
+	tconf.Log = utils.NewLoggerForTests()
+	tconf.Proxy.DisableWebService = true
+	tconf.Proxy.DisableWebInterface = true
+	tconf.Auth.NetworkingConfig = netConfig
+	tconf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
+	tconf.InstanceMetadataClient = cloud.NewDisabledIMDSClient()
+
+	instance := suite.NewTeleportWithConfig(t, nil, nil, tconf)
+	t.Cleanup(func() { require.NoError(t, instance.StopAll()) })
+
+	var output bytes.Buffer
+
+	// SSH into the server, and stay active for longer than
+	// the client idle timeout.
+	sessionErr := make(chan error)
+	openSession := func() {
+		cl, err := instance.NewClient(helpers.ClientConfig{
+			Login:   suite.Me.Username,
+			Cluster: helpers.Site,
+			Host:    Host,
+		})
+		if err != nil {
+			sessionErr <- trace.Wrap(err)
+			return
+		}
+		cl.Stdout = &output
+		// Execute a command 10x faster than the idle timeout to stay active.
+		reader := newRepeatingReader("echo txlxport | sed 's/x/e/g'\n", netConfig.GetClientIdleTimeout()/10)
+		defer func() { reader.Close() }()
+		cl.Stdin = reader
+
+		// Terminate the session after 3x the idle timeout
+		ctx, cancel := context.WithTimeout(context.Background(), netConfig.GetClientIdleTimeout()*3)
+		defer cancel()
+		sessionErr <- cl.SSH(ctx, nil, false)
+	}
+
+	go openSession()
+
+	// Wait for the sessions to end - we expect an error
+	// since we are canceling the context.
+	err := waitForError(sessionErr, time.Second*10)
+	require.Error(t, err)
+
+	// Ensure that the session was alive beyond the idle timeout by
+	// counting the number of times "teleport" was output. If the session
+	// was alive past the idle timeout then there should be at least 11 occurrences
+	// since the command is run at 1/10 the idle timeout.
+	require.NotEmpty(t, output)
+	count := strings.Count(output.String(), "teleport")
+	require.Greater(t, count, 10)
+}
+
 // TestDisconnectScenarios tests multiple scenarios with client disconnects
 func testDisconnectScenarios(t *testing.T, suite *integrationTestSuite) {
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
@@ -2070,15 +2184,15 @@ func enterInput(ctx context.Context, person *Terminal, command, pattern string)
 	}
 }
 
-// TestInvalidLogins validates that you can't login with invalid login or
-// with invalid 'site' parameter
+// testEnvironmentVariables validates that session specific environment
+// variables set by Teleport are present.
 func testEnvironmentVariables(t *testing.T, suite *integrationTestSuite) {
 	ctx := context.Background()
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
 	s := suite.newTeleport(t, nil, true)
-	defer s.StopAll()
+	t.Cleanup(func() { require.NoError(t, s.StopAll()) })
 
 	// make sure sessions set run command
 	tc, err := s.NewClient(helpers.ClientConfig{
@@ -2089,25 +2203,27 @@ func testEnvironmentVariables(t *testing.T, suite *integrationTestSuite) {
 	})
 	require.NoError(t, err)
 
-	// if SessionID is provided, it should be set in the session env vars.
 	tc.SessionID = uuid.NewString()
-	cmd := []string{"printenv", sshutils.SessionEnvVar}
+
+	// The SessionID and Web address should be set in the session env vars.
+	cmd := []string{"printenv", sshutils.SessionEnvVar, ";", "printenv", teleport.SSHSessionWebProxyAddr}
 	out := &bytes.Buffer{}
 	tc.Stdout = out
 	tc.Stdin = nil
 	err = tc.SSH(ctx, cmd, false /* runLocally */)
-
 	require.NoError(t, err)
-	require.Equal(t, tc.SessionID, strings.TrimSpace(out.String()))
-
-	// The proxy url should be set in the session env vars.
-	cmd = []string{"printenv", teleport.SSHSessionWebproxyAddr}
-	out = &bytes.Buffer{}
-	tc.Stdout = out
-	err = tc.SSH(ctx, cmd, false /* runLocally */)
+	output := out.String()
+	require.Contains(t, output, tc.SessionID)
+	require.Contains(t, output, tc.WebProxyAddr)
 
+	term := NewTerminal(250)
+	tc.Stdout = term
+	tc.Stdin = strings.NewReader(strings.Join(cmd, " ") + "\r\nexit\r\n")
+	err = tc.SSH(ctx, nil, false /* runLocally */)
 	require.NoError(t, err)
-	require.Equal(t, tc.WebProxyAddr, strings.TrimSpace(out.String()))
+	output = term.AllOutput()
+	require.Contains(t, output, tc.SessionID)
+	require.Contains(t, output, tc.WebProxyAddr)
 }
 
 // TestInvalidLogins validates that you can't login with invalid login or
@@ -2276,7 +2392,7 @@ func twoClustersTunnel(t *testing.T, suite *integrationTestSuite, now time.Time,
 	require.Equal(t, "hello world\n", outputA.String())
 
 	// Update trusted CAs.
-	err = tc.UpdateTrustedCA(ctx, a.Secrets.SiteName)
+	err = tc.UpdateTrustedCA(ctx, a.GetSiteAPI(a.Secrets.SiteName))
 	require.NoError(t, err)
 
 	// The known_hosts file should have two certificates, the way bytes.Split
@@ -3694,7 +3810,7 @@ func testDiscoveryRecovers(t *testing.T, suite *integrationTestSuite) {
 	var reverseTunnelAddr string
 
 	// Helper function for adding a new proxy to "main".
-	addNewMainProxy := func(name string) (reversetunnel.Server, helpers.ProxyConfig) {
+	addNewMainProxy := func(name string) (reversetunnelclient.Server, helpers.ProxyConfig) {
 		t.Logf("adding main proxy %q...", name)
 		newConfig := helpers.ProxyConfig{
 			Name:              name,
@@ -8152,3 +8268,216 @@ func TestConnectivityWithoutAuth(t *testing.T) {
 		})
 	}
 }
+
+func testModeratedSessions(t *testing.T, suite *integrationTestSuite) {
+	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+
+	const password = "supersecretpassword"
+	inputReader := prompt.NewFakeReader().
+		AddString(password).
+		AddReply(func(ctx context.Context) (string, error) {
+			panic("this should not be called")
+		})
+
+	oldStdin, oldWebauthn := prompt.Stdin(), *client.PromptWebauthn
+	t.Cleanup(func() {
+		prompt.SetStdin(oldStdin)
+		*client.PromptWebauthn = oldWebauthn
+	})
+
+	device, err := mocku2f.Create()
+	require.NoError(t, err)
+	device.SetPasswordless()
+
+	prompt.SetStdin(inputReader)
+	*client.PromptWebauthn = func(ctx context.Context, realOrigin string, assertion *wanlib.CredentialAssertion, prompt wancli.LoginPrompt, _ *wancli.LoginOpts) (*proto.MFAAuthenticateResponse, string, error) {
+		car, err := device.SignAssertion("https://127.0.0.1", assertion) // use the fake origin to prevent a mismatch
+		if err != nil {
+			return nil, "", err
+		}
+		return &proto.MFAAuthenticateResponse{
+			Response: &proto.MFAAuthenticateResponse_Webauthn{
+				Webauthn: wanlib.CredentialAssertionResponseToProto(car),
+			},
+		}, "", nil
+	}
+
+	// Enable web service.
+	cfg := suite.defaultServiceConfig()
+	cfg.Auth.Enabled = true
+	cfg.Auth.Preference.SetSecondFactor("on")
+	cfg.Auth.Preference.(*types.AuthPreferenceV2).Spec.RequireMFAType = types.RequireMFAType_SESSION
+	cfg.Auth.Preference.SetWebauthn(&types.Webauthn{RPID: "127.0.0.1"})
+	cfg.Proxy.DisableWebService = false
+	cfg.Proxy.DisableWebInterface = true
+	cfg.Proxy.Enabled = true
+	cfg.SSH.Enabled = true
+
+	instance := suite.NewTeleportWithConfig(t, nil, nil, cfg)
+
+	ctx, cancel := context.WithCancelCause(context.Background())
+	defer cancel(nil)
+
+	peerRole, err := types.NewRole("moderated", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			RequireSessionJoin: []*types.SessionRequirePolicy{
+				{
+					Name:   "moderated",
+					Filter: "contains(user.roles, \"moderator\")",
+					Kinds:  []string{string(types.SSHSessionKind)},
+					Count:  1,
+					Modes:  []string{string(types.SessionModeratorMode)},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.NoError(t, instance.Process.GetAuthServer().UpsertRole(ctx, peerRole))
+
+	moderatorRole, err := types.NewRole("moderator", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			JoinSessions: []*types.SessionJoinPolicy{
+				{
+					Name:  "moderated",
+					Roles: []string{peerRole.GetName()},
+					Kinds: []string{string(types.SSHSessionKind)},
+					Modes: []string{string(types.SessionModeratorMode), string(types.SessionObserverMode)},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.NoError(t, instance.Process.GetAuthServer().UpsertRole(ctx, moderatorRole))
+
+	setupUser := func(user, role string, asrv *auth.Server) {
+		u, err := types.NewUser(user)
+		require.NoError(t, err)
+		u.SetRoles([]string{"access", role})
+		u.SetLogins([]string{suite.Me.Username, user})
+
+		require.NoError(t, asrv.CreateUser(ctx, u))
+
+		token, err := asrv.CreateResetPasswordToken(ctx, auth.CreateUserTokenRequest{
+			Name: user,
+		})
+		require.NoError(t, err)
+		tokenID := token.GetName()
+		res, err := asrv.CreateRegisterChallenge(ctx, &proto.CreateRegisterChallengeRequest{
+			TokenID:     tokenID,
+			DeviceType:  proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
+			DeviceUsage: proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS,
+		})
+		require.NoError(t, err)
+		cc := wanlib.CredentialCreationFromProto(res.GetWebauthn())
+
+		ccr, err := device.SignCredentialCreation("https://127.0.0.1", cc)
+		require.NoError(t, err)
+		_, err = asrv.ChangeUserAuthentication(ctx, &proto.ChangeUserAuthenticationRequest{
+			TokenID:     tokenID,
+			NewPassword: []byte(password),
+			NewMFARegisterResponse: &proto.MFARegisterResponse{
+				Response: &proto.MFARegisterResponse_Webauthn{
+					Webauthn: wanlib.CredentialCreationResponseToProto(ccr),
+				},
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	setupUser("peer", peerRole.GetName(), instance.Process.GetAuthServer())
+	setupUser("moderator", moderatorRole.GetName(), instance.Process.GetAuthServer())
+
+	peerTerminal := NewTerminal(250)
+	moderatorTerminal := NewTerminal(250)
+
+	// get a reference to site obj:
+	site := instance.GetSiteAPI(helpers.Site)
+	require.NotNil(t, site)
+
+	// PersonA: SSH into the server, wait one second, then type some commands on stdin:
+	openSession := func() {
+		cl, err := instance.NewClient(helpers.ClientConfig{
+			TeleportUser: "peer",
+			Login:        suite.Me.Username,
+			Cluster:      helpers.Site,
+			Host:         Host,
+		})
+		if err != nil {
+			cancel(trace.Wrap(err, "failed to create peer client"))
+			return
+		}
+
+		cl.Stdout = peerTerminal
+		cl.Stdin = peerTerminal
+		if err := cl.SSH(ctx, []string{}, false); err != nil {
+			cancel(trace.Wrap(err, "peer session failed"))
+			return
+		}
+	}
+
+	// PersonB: wait for a session to become available, then join:
+	joinSession := func() {
+		sessionTimeoutCtx, sessionTimeoutCancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer sessionTimeoutCancel()
+		sessions, err := waitForSessionToBeEstablished(sessionTimeoutCtx, defaults.Namespace, site)
+		if err != nil {
+			cancel(trace.Wrap(err, "failed waiting for peer session to be established"))
+			return
+		}
+
+		sessionID := sessions[0].GetSessionID()
+		cl, err := instance.NewClient(helpers.ClientConfig{
+			TeleportUser: "moderator",
+			Login:        suite.Me.Username,
+			Cluster:      helpers.Site,
+			Host:         Host,
+		})
+		if err != nil {
+			cancel(trace.Wrap(err, "failed to create peer client"))
+			return
+		}
+
+		cl.Stdout = moderatorTerminal
+		cl.Stdin = moderatorTerminal
+		if err := cl.Join(ctx, types.SessionModeratorMode, defaults.Namespace, session.ID(sessionID), moderatorTerminal); err != nil {
+			cancel(trace.Wrap(err, "moderator session failed"))
+		}
+	}
+
+	go openSession()
+	go joinSession()
+
+	require.Eventually(t, func() bool {
+		ss, err := site.GetActiveSessionTrackers(ctx)
+		if err != nil {
+			return false
+		}
+
+		if len(ss) != 1 {
+			return false
+		}
+
+		return len(ss[0].GetParticipants()) == 2
+	}, 5*time.Second, 100*time.Millisecond)
+
+	peerTerminal.Type("echo llamas\n\r")
+
+	require.Eventually(t, func() bool {
+		return strings.Contains(moderatorTerminal.AllOutput(), "llamas")
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// terminate the session
+	moderatorTerminal.Type("t\n\r")
+
+	select {
+	case <-ctx.Done():
+		err = context.Cause(ctx)
+		require.Contains(t, err.Error(), "Process exited with status 255")
+		p := peerTerminal.AllOutput()
+		require.Contains(t, p, "Forcefully terminating session...")
+		m := moderatorTerminal.AllOutput()
+		require.Contains(t, m, "Forcefully terminating session...")
+	case <-time.After(5 * time.Second):
+		t.Fatal("Timeout waiting for session to be terminated.")
+	}
+}
diff --git a/integration/proxy/proxy_helpers.go b/integration/proxy/proxy_helpers.go
index ee42ca1bf82f3..cac224aefda46 100644
--- a/integration/proxy/proxy_helpers.go
+++ b/integration/proxy/proxy_helpers.go
@@ -55,7 +55,7 @@ import (
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/fixtures"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/alpnproxy"
@@ -602,7 +602,7 @@ func makeNodeConfig(nodeName, proxyAddr string) *servicecfg.Config {
 }
 
 // waitForActivePeerProxyConnections waits for remote cluster to report a minimum number of active proxy peer connections
-func waitForActivePeerProxyConnections(t *testing.T, tunnel reversetunnel.Server, expectedCount int) { //nolint:unused // Only used by skipped test TestProxyTunnelStrategyProxyPeering
+func waitForActivePeerProxyConnections(t *testing.T, tunnel reversetunnelclient.Server, expectedCount int) { //nolint:unused // Only used by skipped test TestProxyTunnelStrategyProxyPeering
 	require.Eventually(t, func() bool {
 		return tunnel.GetProxyPeerClient().GetConnectionsCount() >= expectedCount
 	},
diff --git a/integrations/access/common/teleport/client.go b/integrations/access/common/teleport/client.go
index 2398f491bb430..df3485c4a4493 100644
--- a/integrations/access/common/teleport/client.go
+++ b/integrations/access/common/teleport/client.go
@@ -29,4 +29,5 @@ type Client interface {
 	plugindata.Client
 	types.Events
 	Ping(context.Context) (proto.PingResponse, error)
+	SubmitAccessReview(ctx context.Context, params types.AccessReviewSubmission) (types.AccessRequest, error)
 }
diff --git a/integrations/access/pagerduty/app.go b/integrations/access/pagerduty/app.go
index e3e64eacdc4d6..ccc42421afa65 100644
--- a/integrations/access/pagerduty/app.go
+++ b/integrations/access/pagerduty/app.go
@@ -31,6 +31,8 @@ import (
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/integrations/access/common"
+	"github.com/gravitational/teleport/integrations/access/common/teleport"
 	"github.com/gravitational/teleport/integrations/lib"
 	"github.com/gravitational/teleport/integrations/lib/backoff"
 	"github.com/gravitational/teleport/integrations/lib/credentials"
@@ -58,20 +60,27 @@ const (
 // Special kind of error that can be ignored.
 var errSkip = errors.New("")
 
-// App contains global application state.
+// App contains global application state of the PagerDuty plugin.
 type App struct {
 	conf Config
 
-	apiClient *client.Client
-	pagerduty Pagerduty
-	mainJob   lib.ServiceJob
+	teleport   teleport.Client
+	pagerduty  Pagerduty
+	statusSink common.StatusSink
+	mainJob    lib.ServiceJob
 
 	*lib.Process
 }
 
+// NewApp constructs a new PagerDuty App.
 func NewApp(conf Config) (*App, error) {
-	app := &App{conf: conf}
+	app := &App{
+		conf:       conf,
+		teleport:   conf.Client,
+		statusSink: conf.StatusSink,
+	}
 	app.mainJob = lib.NewServiceJob(app.run)
+
 	return app, nil
 }
 
@@ -98,14 +107,14 @@ func (a *App) run(ctx context.Context) error {
 	var err error
 
 	log := logger.Get(ctx)
-	log.Infof("Starting Teleport Access PagerDuty Plugin %s:%s", Version, Gitref)
+	log.Infof("Starting Teleport Access PagerDuty Plugin")
 
 	if err = a.init(ctx); err != nil {
 		return trace.Wrap(err)
 	}
 
 	watcherJob := watcherjob.NewJob(
-		a.apiClient,
+		a.teleport,
 		watcherjob.Config{
 			Watch:            types.Watch{Kinds: []types.WatchKind{types.WatchKind{Kind: types.KindAccessRequest}}},
 			EventFuncTimeout: handlerTimeout,
@@ -150,17 +159,19 @@ func (a *App) init(ctx context.Context) error {
 		pong proto.PingResponse
 	)
 
-	bk := grpcbackoff.DefaultConfig
-	bk.MaxDelay = grpcBackoffMaxDelay
-	if a.apiClient, err = client.New(ctx, client.Config{
-		Addrs:       a.conf.Teleport.GetAddrs(),
-		Credentials: a.conf.Teleport.Credentials(),
-		DialOpts: []grpc.DialOption{
-			grpc.WithConnectParams(grpc.ConnectParams{Backoff: bk, MinConnectTimeout: initTimeout}),
-			grpc.WithReturnConnectionError(),
-		},
-	}); err != nil {
-		return trace.Wrap(err)
+	if a.teleport == nil {
+		bk := grpcbackoff.DefaultConfig
+		bk.MaxDelay = grpcBackoffMaxDelay
+		if a.teleport, err = client.New(ctx, client.Config{
+			Addrs:       a.conf.Teleport.GetAddrs(),
+			Credentials: a.conf.Teleport.Credentials(),
+			DialOpts: []grpc.DialOption{
+				grpc.WithConnectParams(grpc.ConnectParams{Backoff: bk, MinConnectTimeout: initTimeout}),
+				grpc.WithReturnConnectionError(),
+			},
+		}); err != nil {
+			return trace.Wrap(err)
+		}
 	}
 
 	if pong, err = a.checkTeleportVersion(ctx); err != nil {
@@ -171,7 +182,7 @@ func (a *App) init(ctx context.Context) error {
 	if pong.ServerFeatures.AdvancedAccessWorkflows {
 		webProxyAddr = pong.ProxyPublicAddr
 	}
-	a.pagerduty, err = NewPagerdutyClient(a.conf.Pagerduty, pong.ClusterName, webProxyAddr)
+	a.pagerduty, err = NewPagerdutyClient(a.conf.Pagerduty, pong.ClusterName, webProxyAddr, a.statusSink)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -188,7 +199,8 @@ func (a *App) init(ctx context.Context) error {
 func (a *App) checkTeleportVersion(ctx context.Context) (proto.PingResponse, error) {
 	log := logger.Get(ctx)
 	log.Debug("Checking Teleport server version")
-	pong, err := a.apiClient.Ping(ctx)
+
+	pong, err := a.teleport.Ping(ctx)
 	if err != nil {
 		if trace.IsNotImplemented(err) {
 			return pong, trace.Wrap(err, "server version must be at least %s", minServerVersion)
@@ -324,16 +336,18 @@ func (a *App) getOnCallServiceNames(req types.AccessRequest) ([]string, error) {
 }
 
 func (a *App) tryNotifyService(ctx context.Context, req types.AccessRequest) (bool, error) {
+	log := logger.Get(ctx)
+
 	serviceName, err := a.getNotifyServiceName(req)
 	if err != nil {
-		logger.Get(ctx).Debugf("Skipping the notification: %s", err)
+		log.Debugf("Skipping the notification: %s", err)
 		return false, trace.Wrap(errSkip)
 	}
 
 	ctx, _ = logger.WithField(ctx, "pd_service_name", serviceName)
 	service, err := a.pagerduty.FindServiceByName(ctx, serviceName)
 	if err != nil {
-		return false, trace.Wrap(err)
+		return false, trace.Wrap(err, "finding pagerduty service %s", serviceName)
 	}
 
 	reqID := req.GetName()
@@ -352,12 +366,12 @@ func (a *App) tryNotifyService(ctx context.Context, req types.AccessRequest) (bo
 		return PluginData{RequestData: reqData}, true
 	})
 	if err != nil {
-		return isNew, trace.Wrap(err)
+		return isNew, trace.Wrap(err, "updating plugin data")
 	}
 
 	if isNew {
 		if err = a.createIncident(ctx, service.ID, reqID, reqData); err != nil {
-			return isNew, trace.Wrap(err)
+			return isNew, trace.Wrap(err, "creating PagerDuty incident")
 		}
 	}
 
@@ -503,9 +517,10 @@ func (a *App) tryApproveRequest(ctx context.Context, req types.AccessRequest) er
 		}
 	}
 
-	if _, err := a.apiClient.SubmitAccessReview(ctx, types.AccessReviewSubmission{
+	if _, err := a.teleport.SubmitAccessReview(ctx, types.AccessReviewSubmission{
 		RequestID: req.GetName(),
 		Review: types.AccessReview{
+			Author:        a.conf.TeleportUser,
 			ProposedState: types.RequestState_APPROVED,
 			Reason: fmt.Sprintf("Access requested by user %s (%s) which is on call in service(s) %s",
 				user.Name,
@@ -519,7 +534,7 @@ func (a *App) tryApproveRequest(ctx context.Context, req types.AccessRequest) er
 			log.Debug("Already reviewed the request")
 			return nil
 		}
-		return trace.Wrap(err)
+		return trace.Wrap(err, "submitting access request")
 	}
 
 	log.Info("Successfully submitted a request approval")
@@ -606,7 +621,7 @@ func (a *App) modifyPluginData(ctx context.Context, reqID string, fn func(data *
 
 // getPluginData loads a plugin data for a given access request. It returns nil if it's not found.
 func (a *App) getPluginData(ctx context.Context, reqID string) (*PluginData, error) {
-	dataMaps, err := a.apiClient.GetPluginData(ctx, types.PluginDataFilter{
+	dataMaps, err := a.teleport.GetPluginData(ctx, types.PluginDataFilter{
 		Kind:     types.KindAccessRequest,
 		Resource: reqID,
 		Plugin:   pluginName,
@@ -627,7 +642,7 @@ func (a *App) getPluginData(ctx context.Context, reqID string) (*PluginData, err
 
 // updatePluginData updates an existing plugin data or sets a new one if it didn't exist.
 func (a *App) updatePluginData(ctx context.Context, reqID string, data PluginData, expectData PluginData) error {
-	return a.apiClient.UpdatePluginData(ctx, types.PluginDataUpdateParams{
+	return a.teleport.UpdatePluginData(ctx, types.PluginDataUpdateParams{
 		Kind:     types.KindAccessRequest,
 		Resource: reqID,
 		Plugin:   pluginName,
diff --git a/integrations/access/pagerduty/client.go b/integrations/access/pagerduty/client.go
index 6f2714a17916b..34bc41a0d2d25 100644
--- a/integrations/access/pagerduty/client.go
+++ b/integrations/access/pagerduty/client.go
@@ -30,6 +30,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/integrations/access/common"
 	"github.com/gravitational/teleport/integrations/lib"
 	"github.com/gravitational/teleport/integrations/lib/logger"
 	"github.com/gravitational/teleport/integrations/lib/stringset"
@@ -41,6 +42,8 @@ const (
 	pdListLimit   = uint(100)
 
 	pdIncidentKeyPrefix = "teleport-access-request"
+
+	pdStatusUpdateTimeout time.Duration = 10 * time.Second
 )
 
 var incidentBodyTemplate = template.Must(template.New("incident body").Parse(
@@ -68,7 +71,7 @@ type Pagerduty struct {
 	webProxyURL *url.URL
 }
 
-func NewPagerdutyClient(conf PagerdutyConfig, clusterName, webProxyAddr string) (Pagerduty, error) {
+func NewPagerdutyClient(conf PagerdutyConfig, clusterName, webProxyAddr string, statusSink common.StatusSink) (Pagerduty, error) {
 	var (
 		webProxyURL *url.URL
 		err         error
@@ -84,31 +87,20 @@ func NewPagerdutyClient(conf PagerdutyConfig, clusterName, webProxyAddr string)
 		Transport: &http.Transport{
 			MaxConnsPerHost:     pdMaxConns,
 			MaxIdleConnsPerHost: pdMaxConns,
-		},
-	})
-	// APIEndpoint parameter is set only in tests
-	if conf.APIEndpoint != "" {
-		client.SetBaseURL(conf.APIEndpoint)
-	} else {
-		client.SetBaseURL("https://api.pagerduty.com")
+		}}).
+		SetBaseURL(conf.APIEndpoint).
+		SetHeader("Accept", "application/vnd.pagerduty+json;version=2").
+		SetHeader("Content-Type", "application/json").
+		SetHeader("Authorization", "Token token="+conf.APIKey).
+		OnBeforeRequest(func(_ *resty.Client, req *resty.Request) error {
+			req.SetError(&ErrorResult{})
+			return nil
+		})
+
+	if statusSink != nil {
+		client.OnAfterResponse(onAfterPagerDutyResponse(statusSink))
 	}
-	client.SetHeader("Accept", "application/vnd.pagerduty+json;version=2")
-	client.SetHeader("Content-Type", "application/json")
-	client.SetHeader("Authorization", "Token token="+conf.APIKey)
-	client.OnBeforeRequest(func(_ *resty.Client, req *resty.Request) error {
-		req.SetError(&ErrorResult{})
-		return nil
-	})
-	client.OnAfterResponse(func(_ *resty.Client, resp *resty.Response) error {
-		if resp.IsError() {
-			result := resp.Error()
-			if result, ok := result.(*ErrorResult); ok {
-				return trace.Errorf("http error code=%v, err_code=%v, message=%v, errors=[%v]", resp.StatusCode(), result.Code, result.Message, strings.Join(result.Errors, ", "))
-			}
-			return trace.Errorf("unknown error result %#v", result)
-		}
-		return nil
-	})
+
 	return Pagerduty{
 		client:      client,
 		clusterName: clusterName,
@@ -117,8 +109,64 @@ func NewPagerdutyClient(conf PagerdutyConfig, clusterName, webProxyAddr string)
 	}, nil
 }
 
+func statusFromStatusCode(httpCode int) types.PluginStatus {
+	var code types.PluginStatusCode
+	switch {
+	case httpCode == http.StatusUnauthorized:
+		code = types.PluginStatusCode_UNAUTHORIZED
+	case httpCode >= 200 && httpCode < 400:
+		code = types.PluginStatusCode_RUNNING
+	default:
+		code = types.PluginStatusCode_OTHER_ERROR
+	}
+	return &types.PluginStatusV1{Code: code}
+}
+
+func onAfterPagerDutyResponse(sink common.StatusSink) resty.ResponseMiddleware {
+	return func(_ *resty.Client, resp *resty.Response) error {
+		log := logger.Get(resp.Request.Context())
+		status := statusFromStatusCode(resp.StatusCode())
+
+		// No usable context in scope, use background with a reasonable timeout
+		ctx, cancel := context.WithTimeout(context.Background(), pdStatusUpdateTimeout)
+		defer cancel()
+
+		if err := sink.Emit(ctx, status); err != nil {
+			log.WithError(err).Errorf("Error while emitting PagerDuty plugin status: %v", err)
+		}
+
+		if resp.IsError() {
+			var details string
+			switch result := resp.Error().(type) {
+			case *ErrorResult:
+				// Do we have a formatted PagerDuty API error response? We set
+				// an empty `ErrorResult` in the pre-request hook, and if the
+				// HTTP server returns an error, the `resty` middleware will
+				// attempt to unmarshal the error response into it.
+				details = fmt.Sprintf("http error code=%v, err_code=%v, message=%v, errors=[%v]", resp.StatusCode(), result.Code, result.Message, strings.Join(result.Errors, ", "))
+			default:
+				details = fmt.Sprintf("unknown error result %#v", result)
+			}
+
+			if status.GetCode() == types.PluginStatusCode_UNAUTHORIZED {
+				return trace.AccessDenied(details)
+			}
+			return trace.Errorf(details)
+		}
+		return nil
+	}
+}
+
 func (p Pagerduty) HealthCheck(ctx context.Context) error {
-	// TODO: decide what to check.
+	var result ListAbilitiesResult
+	_, err := p.client.NewRequest().
+		SetContext(ctx).
+		SetResult(&result).
+		Get("abilities")
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
 	return nil
 }
 
@@ -141,7 +189,6 @@ func (p Pagerduty) CreateIncident(ctx context.Context, serviceID, reqID string,
 		},
 	}
 	var result IncidentResult
-
 	_, err = p.client.NewRequest().
 		SetContext(ctx).
 		SetHeader("From", p.from).
@@ -222,7 +269,7 @@ func (p Pagerduty) GetUserInfo(ctx context.Context, userID string) (User, error)
 }
 
 // GetUserByEmail finds a user by email.
-func (p Pagerduty) FindUserByEmail(ctx context.Context, userEmail string) (User, error) {
+func (p *Pagerduty) FindUserByEmail(ctx context.Context, userEmail string) (User, error) {
 	userEmail = strings.ToLower(userEmail)
 	usersQuery, err := query.Values(ListUsersQuery{
 		Query: userEmail,
@@ -258,7 +305,7 @@ func (p Pagerduty) FindUserByEmail(ctx context.Context, userEmail string) (User,
 }
 
 // FindServiceByName finds a service by its name (case-insensitive).
-func (p Pagerduty) FindServiceByName(ctx context.Context, serviceName string) (Service, error) {
+func (p *Pagerduty) FindServiceByName(ctx context.Context, serviceName string) (Service, error) {
 	// In PagerDuty service names are unique and in fact case-insensitive.
 	serviceName = strings.ToLower(serviceName)
 	servicesQuery, err := query.Values(ListServicesQuery{Query: serviceName})
@@ -301,7 +348,7 @@ func (p Pagerduty) FindServicesByNames(ctx context.Context, serviceNames []strin
 }
 
 // RangeOnCallPolicies iterates over the escalation policy IDs for which a given user is currently on-call.
-func (p Pagerduty) FilterOnCallPolicies(ctx context.Context, userID string, escalationPolicyIDs []string) ([]string, error) {
+func (p *Pagerduty) FilterOnCallPolicies(ctx context.Context, userID string, escalationPolicyIDs []string) ([]string, error) {
 	policyIDSet := stringset.New(escalationPolicyIDs...)
 	filteredIDSet := stringset.New()
 
diff --git a/integrations/access/pagerduty/config.go b/integrations/access/pagerduty/config.go
index 0e99a9d0caa95..04e9a8a5b56cf 100644
--- a/integrations/access/pagerduty/config.go
+++ b/integrations/access/pagerduty/config.go
@@ -17,11 +17,10 @@ limitations under the License.
 package pagerduty
 
 import (
-	"strings"
-
 	"github.com/gravitational/trace"
-	"github.com/pelletier/go-toml"
 
+	"github.com/gravitational/teleport/integrations/access/common"
+	"github.com/gravitational/teleport/integrations/access/common/teleport"
 	"github.com/gravitational/teleport/integrations/lib"
 	"github.com/gravitational/teleport/integrations/lib/logger"
 )
@@ -30,6 +29,19 @@ type Config struct {
 	Teleport  lib.TeleportConfig `toml:"teleport"`
 	Pagerduty PagerdutyConfig    `toml:"pagerduty"`
 	Log       logger.Config      `toml:"log"`
+
+	// Teleport is a handle to the client to use when communicating with
+	// the Teleport auth server. The PagerDuty app will create a GRPC-
+	// based client on startup if this is not set.
+	Client teleport.Client
+
+	// StatusSink receives any status updates from the plugin for
+	// further processing. Status updates will be ignored if not set.
+	StatusSink common.StatusSink
+
+	// TeleportUser is the name of the Teleport user that will act
+	// as the access request approver
+	TeleportUser string
 }
 
 type PagerdutyConfig struct {
@@ -45,27 +57,6 @@ type PagerdutyConfig struct {
 const NotifyServiceDefaultAnnotation = "pagerduty_notify_service"
 const ServicesDefaultAnnotation = "pagerduty_services"
 
-func LoadConfig(filepath string) (*Config, error) {
-	t, err := toml.LoadFile(filepath)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	conf := &Config{}
-	if err := t.Unmarshal(conf); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if strings.HasPrefix(conf.Pagerduty.APIKey, "/") {
-		conf.Pagerduty.APIKey, err = lib.ReadPassword(conf.Pagerduty.APIKey)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-	if err := conf.CheckAndSetDefaults(); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return conf, nil
-}
-
 func (c *Config) CheckAndSetDefaults() error {
 	if err := c.Teleport.CheckAndSetDefaults(); err != nil {
 		return trace.Wrap(err)
diff --git a/integrations/access/pagerduty/pagerduty_test.go b/integrations/access/pagerduty/pagerduty_test.go
index c3efd52ae9e18..77536cbd6c116 100644
--- a/integrations/access/pagerduty/pagerduty_test.go
+++ b/integrations/access/pagerduty/pagerduty_test.go
@@ -596,7 +596,12 @@ func (s *PagerdutySuite) assertNewEvent(watcher types.Watcher, opType types.OpTy
 			assert.Equal(t, resourceKind, ev.Resource.GetKind())
 			assert.Equal(t, resourceName, ev.Resource.GetName())
 		} else {
-			assert.Nil(t, ev.Resource)
+			switch r := ev.Resource.(type) {
+			case nil:
+			case *types.WatchStatusV1:
+			default:
+				t.Errorf("expected nil or *WatchStatusV1, got %T instead", r)
+			}
 		}
 	case <-s.Context().Done():
 		t.Error(t, "No events received", s.Context().Err())
diff --git a/integrations/access/pagerduty/types.go b/integrations/access/pagerduty/types.go
index f0603cbbb45cf..0ee6115d81254 100644
--- a/integrations/access/pagerduty/types.go
+++ b/integrations/access/pagerduty/types.go
@@ -195,3 +195,9 @@ type ListOnCallsResult struct {
 	PaginationResult
 	OnCalls []OnCall `json:"oncalls"`
 }
+
+// ListAbilitiesResult describes the output of the PagerDuty /abilities
+// API call.
+type ListAbilitiesResult struct {
+	Abilities []string `json:"abilities"`
+}
diff --git a/integrations/kube-agent-updater/cmd/teleport-kube-agent-updater/main.go b/integrations/kube-agent-updater/cmd/teleport-kube-agent-updater/main.go
index 95b56bb603f26..eb061b42c9c72 100644
--- a/integrations/kube-agent-updater/cmd/teleport-kube-agent-updater/main.go
+++ b/integrations/kube-agent-updater/cmd/teleport-kube-agent-updater/main.go
@@ -72,7 +72,7 @@ func main() {
 	flag.DurationVar(&syncPeriod, "sync-period", 10*time.Hour, "Operator sync period (format: https://pkg.go.dev/time#ParseDuration)")
 	flag.BoolVar(&insecureNoVerify, "insecure-no-verify-image", false, "Disable image signature verification.")
 	flag.BoolVar(&disableLeaderElection, "disable-leader-election", false, "Disable leader election, used when running the kube-agent-updater outside of Kubernetes.")
-	flag.StringVar(&versionServer, "version-server", "https://update.gravitational.io/v1/", "URL of the HTTP server advertising target version and critical maintenances. Trailing slash is optional.")
+	flag.StringVar(&versionServer, "version-server", "https://updates.releases.teleport.dev/v1/", "URL of the HTTP server advertising target version and critical maintenances. Trailing slash is optional.")
 	flag.StringVar(&versionChannel, "version-channel", "cloud/stable", "Version channel to get updates from.")
 	flag.StringVar(&baseImageName, "base-image", "public.ecr.aws/gravitational/teleport", "Image reference containing registry and repository.")
 
diff --git a/integrations/kube-agent-updater/go.mod b/integrations/kube-agent-updater/go.mod
index 851dc6d939f26..1867353d0e2eb 100644
--- a/integrations/kube-agent-updater/go.mod
+++ b/integrations/kube-agent-updater/go.mod
@@ -5,17 +5,17 @@ go 1.19
 require (
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/docker/distribution v2.8.2+incompatible
-	github.com/google/go-containerregistry v0.14.1-0.20230409045903-ed5c185df419
+	github.com/google/go-containerregistry v0.15.2
 	github.com/gravitational/trace v1.2.1
 	github.com/jonboulle/clockwork v0.4.0
 	github.com/opencontainers/go-digest v1.0.0
-	github.com/sigstore/cosign/v2 v2.0.2
-	github.com/sigstore/sigstore v1.6.4
+	github.com/sigstore/cosign/v2 v2.1.0
+	github.com/sigstore/sigstore v1.7.0
 	github.com/stretchr/testify v1.8.4
-	golang.org/x/exp v0.0.0-20230213192124-5e25df0256eb
-	golang.org/x/mod v0.10.0
-	k8s.io/api v0.27.2
-	k8s.io/apimachinery v0.27.2
+	golang.org/x/exp v0.0.0-20230321023759-10a507213a29
+	golang.org/x/mod v0.11.0
+	k8s.io/api v0.27.3
+	k8s.io/apimachinery v0.27.3
 	sigs.k8s.io/controller-runtime v0.15.0
 )
 
@@ -38,6 +38,7 @@ require (
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
 	github.com/go-chi/chi v4.1.2+incompatible // indirect
 	github.com/go-logr/logr v1.2.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@@ -50,31 +51,31 @@ require (
 	github.com/go-openapi/runtime v0.26.0 // indirect
 	github.com/go-openapi/spec v0.20.9 // indirect
 	github.com/go-openapi/strfmt v0.21.7 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-openapi/swag v0.22.4 // indirect
 	github.com/go-openapi/validate v0.22.1 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.13.0 // indirect
+	github.com/go-playground/validator/v10 v10.14.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/certificate-transparency-go v1.1.4 // indirect
+	github.com/google/certificate-transparency-go v1.1.6 // indirect
 	github.com/google/gnostic v0.5.7-v3refs // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/trillian v1.5.1 // indirect
+	github.com/google/pprof v0.0.0-20221103000818-d260c55eee4c // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/huandu/xstrings v1.3.3 // indirect
-	github.com/imdario/mergo v0.3.12 // indirect
+	github.com/imdario/mergo v0.3.15 // indirect
 	github.com/in-toto/in-toto-golang v0.9.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.16.5 // indirect
-	github.com/leodido/go-urn v1.2.3 // indirect
+	github.com/leodido/go-urn v1.2.4 // indirect
 	github.com/letsencrypt/boulder v0.0.0-20221109233200-85aa52084eaf // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
@@ -86,10 +87,11 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opencontainers/image-spec v1.1.0-rc3 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_golang v1.15.1 // indirect
@@ -100,39 +102,40 @@ require (
 	github.com/secure-systems-lab/go-securesystemslib v0.6.0 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/sigstore/rekor v1.1.1 // indirect
-	github.com/sigstore/timestamp-authority v1.0.0 // indirect
-	github.com/sirupsen/logrus v1.9.0 // indirect
-	github.com/spf13/afero v1.9.3 // indirect
-	github.com/spf13/cast v1.5.0 // indirect
+	github.com/sigstore/rekor v1.2.2-0.20230530122220-67cc9e58bd23 // indirect
+	github.com/sigstore/timestamp-authority v1.1.1 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/spf13/afero v1.9.5 // indirect
+	github.com/spf13/cast v1.5.1 // indirect
 	github.com/spf13/cobra v1.7.0 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/spf13/viper v1.15.0 // indirect
+	github.com/spf13/viper v1.16.0 // indirect
 	github.com/subosito/gotenv v1.4.2 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
 	github.com/theupdateframework/go-tuf v0.5.2 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
-	github.com/transparency-dev/merkle v0.0.1 // indirect
+	github.com/transparency-dev/merkle v0.0.2 // indirect
 	github.com/vbatts/tar-split v0.11.3 // indirect
 	go.mongodb.org/mongo-driver v1.11.3 // indirect
-	go.opentelemetry.io/otel v1.14.0 // indirect
-	go.opentelemetry.io/otel/trace v1.14.0 // indirect
+	go.opentelemetry.io/otel v1.16.0 // indirect
+	go.opentelemetry.io/otel/metric v1.16.0 // indirect
+	go.opentelemetry.io/otel/trace v1.16.0 // indirect
 	go.uber.org/atomic v1.10.0 // indirect
-	go.uber.org/multierr v1.9.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.24.0 // indirect
-	golang.org/x/crypto v0.8.0 // indirect
-	golang.org/x/net v0.10.0 // indirect
-	golang.org/x/oauth2 v0.7.0 // indirect
-	golang.org/x/sync v0.1.0 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/term v0.8.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/crypto v0.10.0 // indirect
+	golang.org/x/net v0.11.0 // indirect
+	golang.org/x/oauth2 v0.9.0 // indirect
+	golang.org/x/sync v0.3.0 // indirect
+	golang.org/x/sys v0.9.0 // indirect
+	golang.org/x/term v0.9.0 // indirect
+	golang.org/x/text v0.10.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.3.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
-	google.golang.org/grpc v1.54.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
+	google.golang.org/grpc v1.56.0 // indirect
 	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
@@ -140,11 +143,11 @@ require (
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/apiextensions-apiserver v0.27.2 // indirect
-	k8s.io/client-go v0.27.2 // indirect
+	k8s.io/client-go v0.27.3 // indirect
 	k8s.io/component-base v0.27.2 // indirect
-	k8s.io/klog/v2 v2.90.1 // indirect
+	k8s.io/klog/v2 v2.100.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
-	k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
+	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
diff --git a/integrations/kube-agent-updater/go.sum b/integrations/kube-agent-updater/go.sum
index 9b20b99a63336..06788ad5f571d 100644
--- a/integrations/kube-agent-updater/go.sum
+++ b/integrations/kube-agent-updater/go.sum
@@ -24,12 +24,12 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute v1.19.0 h1:+9zda3WGgW1ZSTlVppLCYFIr48Pa35q1uG2N1itbCEQ=
+cloud.google.com/go/compute v1.19.3 h1:DcTwsFgGev/wV5+q8o2fzgcHOaac+DKGC91ZlvpsQds=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/iam v0.13.0 h1:+CmB+K0J/33d0zSQ9SlFWUeCCEn5XJA0ZMZ3pHE9u8k=
-cloud.google.com/go/kms v1.10.1 h1:7hm1bRqGCA1GBRQUrp831TwJ9TWhP+tvLuP497CQS2g=
+cloud.google.com/go/iam v1.1.0 h1:67gSqaPukx7O8WLLHMa0PNs3EBGd2eE4d+psbO/CO94=
+cloud.google.com/go/kms v1.12.0 h1:IEYV44WsGc6yVO1PlvnRlYzsHM2ImpB598Cglh/3uGw=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
@@ -44,16 +44,12 @@ dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7
 filippo.io/edwards25519 v1.0.0 h1:0wAIcmJUqRdI8IJ/3eGi5/HwXZWPujYXXlkrQogz0Ek=
 github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230329111138-12e09aba5ebd h1:1tbEqR4NyQLgiod7vLXSswHteGetAVZrMGCqrJxLKRs=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
-github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
-github.com/Azure/go-autorest/autorest v0.11.29 h1:I4+HL/JDvErx2LjyzaVxllw2lRDB5/BT2Bm4g20iqYw=
-github.com/Azure/go-autorest/autorest/adal v0.9.22 h1:/GblQdIudfEM3AWWZ0mrYJQSd7JS4S/Mbzh6F0ov0Xc=
-github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 h1:wkAZRgT/pn8HhFyzfe9UnqOjJYqlembgCTi72Bm/xKk=
-github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 h1:w77/uPk80ZET2F+AfQExZyEWtn+0Rk/uw17m9fv5Ajc=
-github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
-github.com/Azure/go-autorest/autorest/to v0.4.0 h1:oXVqrxakqqV1UZdSazDOPOLvOIz+XA683u8EctwboHk=
-github.com/Azure/go-autorest/autorest/validation v0.3.1 h1:AgyqjAd94fwNAoTjl/WQXg4VvFeRFpO+UhNyRXqF1ac=
-github.com/Azure/go-autorest/logger v0.2.1 h1:IG7i4p/mDa2Ce4TRyAO8IHnVhAVF3RFU+ZtXWSmf4Tg=
-github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.1 h1:SEy2xmstIphdPwNBUi7uhvjyjhVKISfwjfOJmuy7kg4=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 h1:vcYCAze6p19qBW7MhZybIsqD8sMV8js0NyQM8JDnVtg=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 h1:sXr+ck84g/ZlZUOZiNELInmMgOsuGwdjjVkEIde0OtY=
+github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0 h1:m/sWOGCREuSBqg2htVQTBY8nOZpyajYztF0vUvSZTuM=
+github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 h1:FbH3BbSb4bvGluTesZZ+ttN/MDsnMmQP36OSnDuSXqw=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 h1:OBhqkivkhkMqLPymWEppkm7vgPQY2XsHoEkaMQ0AdZY=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
@@ -69,19 +65,19 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd
 github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.44.257 h1:HwelXYZZ8c34uFFhgVw3ybu2gB5fkk8KLj2idTvzZb8=
-github.com/aws/aws-sdk-go-v2 v1.18.0 h1:882kkTpSFhdgYRKVZ/VCgf7sd0ru57p2JCxz4/oN5RY=
-github.com/aws/aws-sdk-go-v2/config v1.18.23 h1:gc3lPsAnZpwfi2exupmgHfva0JiAY2BWDg5JWYlmA28=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.22 h1:Hp9rwJS4giQ48xqonRV/s7QcDf/wxF6UY7osRmBabvI=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3 h1:jJPgroehGvjrde3XufFIJUZVK5A2L9a3KwSFgKy9n8w=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33 h1:kG5eQilShqmJbv11XL1VpyDbaEJzWxd4zRiCG30GSn4=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27 h1:vFQlirhuM8lLlpI7imKOMsjdQLuN9CPi+k44F/OFVsk=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 h1:gGLG7yKaXG02/jBlg210R7VgQIotiQntNhsCFejawx8=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27 h1:0iKliEXAcCa2qVtRs7Ot5hItA2MsufrphbRFlz1Owxo=
-github.com/aws/aws-sdk-go-v2/service/kms v1.21.1 h1:Q03Jqh1enA8keCiGZpLetpk58Ll9iGejE5bOErxyGAU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.10 h1:UBQjaMTCKwyUYwiVnUt6toEJwGXsLBI6al083tpjJzY=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10 h1:PkHIIJs8qvq0e5QybnZoG1K/9QTrLr9OsqCIo59jOBA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.18.11 h1:uBE+Zj478pfxV98L6SEpvxYiADNjTlMNY714PJLE7uo=
+github.com/aws/aws-sdk-go v1.44.284 h1:Oc5Kubi43/VCkerlt3ZU3KpBju6BpNkoG3s7E8vj/O8=
+github.com/aws/aws-sdk-go-v2 v1.18.1 h1:+tefE750oAb7ZQGzla6bLkOwfcQCEtC5y2RqoqCeqKo=
+github.com/aws/aws-sdk-go-v2/config v1.18.26 h1:ivCHcSmKd1+9rBlqVsxZHB35eCW88KWbMdG2VL3BuBw=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.25 h1:5wROoMcUC7nAE66e0b3IIht6Tos76M4HC+GQw8MeqxU=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4 h1:LxK/bitrAr4lnh9LnIS6i7zWbCOdMsfzKFBI6LUCS0I=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34 h1:A5UqQEmPaCFpedKouS4v+dHCTUo2sKqhoKO9U5kxyWo=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28 h1:srIVS45eQuewqz6fKKu6ZGXaq6FuFg5NzgQBAM6g8Y4=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.35 h1:LWA+3kDM8ly001vJ1X1waCuLJdtTl48gwkPKWy9sosI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28 h1:bkRyG4a929RCnpVSTvLM2j/T4ls015ZhhYApbmYs15s=
+github.com/aws/aws-sdk-go-v2/service/kms v1.22.1 h1:JV2csVfMP5pxbVG1DIvRKGdW+x/K0CNLcvZoo5lOdqE=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.11 h1:cNrMc266RsZJ8V1u1OQQONKcf9HmfxQFqgcpY7ZJBhY=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.11 h1:h2VhtCE5PBiJefmlVCjJRSzBfFcQeAE10SXIGkXw1jQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.19.1 h1:ehPTnLR/es8TL1fpBfq8qw9cAwOpQr47fLmZD9yhHjk=
 github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
 github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
@@ -121,7 +117,6 @@ github.com/digitorus/pkcs7 v0.0.0-20221212123742-001c36b64ec3 h1:rjCXeRWazGsbcBl
 github.com/digitorus/pkcs7 v0.0.0-20221212123742-001c36b64ec3/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
 github.com/digitorus/timestamp v0.0.0-20221019182153-ef3b63b79b31 h1:3go0tpsBpbs9L/oysk3jDwRprlLRRkpSU7YxKlTfU+o=
 github.com/digitorus/timestamp v0.0.0-20221019182153-ef3b63b79b31/go.mod h1:6V2ND8Yf8TOJ4h+9pmUlx8kXvNLBB2QplToVVZQ3rF0=
-github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=
 github.com/docker/cli v23.0.6+incompatible h1:CScadyCJ2ZKUDpAMZta6vK8I+6/m60VIjGIV7Wg/Eu4=
 github.com/docker/cli v23.0.6+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
@@ -147,12 +142,14 @@ github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2Vvl
 github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a h1:yDWHCSQ40h88yih2JAcL6Ls/kVkSE8GFACTGVnMPruw=
 github.com/facebookgo/limitgroup v0.0.0-20150612190941-6abd8d71ec01 h1:IeaD1VDVBPlx3viJT9Md8if8IxxJnO+x0JCGb054heg=
 github.com/facebookgo/muster v0.0.0-20150708232844-fd3d7953fd52 h1:a4DFiKFJiDRGFD1qIcqGLX/WlUMD9dyLSLDt+9QZgt8=
-github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
+github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
+github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
+github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-chi/chi v4.1.2+incompatible h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec=
 github.com/go-chi/chi v4.1.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
@@ -201,8 +198,9 @@ github.com/go-openapi/strfmt v0.21.7/go.mod h1:adeGTkxE44sPyLk0JV235VQAO/ZXUr8KA
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.19.15/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
 github.com/go-openapi/swag v0.21.1/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
+github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
 github.com/go-openapi/validate v0.22.1 h1:G+c2ub6q47kfX1sOBLwIQwzBVt8qmOAARyo/9Fqs9NU=
 github.com/go-openapi/validate v0.22.1/go.mod h1:rjnrwK57VJ7A8xqfpAOEKRH8yQSGUriMu5/zuPSQ1hg=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
@@ -210,9 +208,8 @@ github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/o
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.13.0 h1:cFRQdfaSMCOSfGCCLB20MHvuoHb/s5G8L5pu2ppK5AQ=
-github.com/go-playground/validator/v10 v10.13.0/go.mod h1:dwu7+CG8/CtBiJFZDz4e+5Upb6OLw04gtBYw0mcG/z4=
-github.com/go-sql-driver/mysql v1.7.0 h1:ueSltNNllEqE3qcWBTD0iQd3IpL/6U+mJxLkazJ7YPc=
+github.com/go-playground/validator/v10 v10.14.0 h1:vgvQWe3XCz3gIeFDm/HnTIbj6UGmg/+t63MyGU2n5js=
+github.com/go-playground/validator/v10 v10.14.0/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
@@ -257,7 +254,6 @@ github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -281,8 +277,8 @@ github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/certificate-transparency-go v1.1.4 h1:hCyXHDbtqlr/lMXU0D4WgbalXL0Zk4dSWWMbPV8VrqY=
-github.com/google/certificate-transparency-go v1.1.4/go.mod h1:D6lvbfwckhNrbM9WVl1EVeMOyzC19mpIjMOI4nxBHtQ=
+github.com/google/certificate-transparency-go v1.1.6 h1:SW5K3sr7ptST/pIvNkSVWMiJqemRmkjJPPT0jzXdOOY=
+github.com/google/certificate-transparency-go v1.1.6/go.mod h1:0OJjOsOk+wj6aYQgP7FU0ioQ0AJUmnWPFMqTjQeazPQ=
 github.com/google/gnostic v0.5.7-v3refs h1:FhTMOKj2VhjpouxvWJAV1TL304uMlb9zcDqkl6cEI54=
 github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -295,11 +291,10 @@ github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-containerregistry v0.14.1-0.20230409045903-ed5c185df419 h1:gMlTWagRJgCJ3EnISyF5+p9phYpFyWEI70Z56T+o2MY=
-github.com/google/go-containerregistry v0.14.1-0.20230409045903-ed5c185df419/go.mod h1:ETSJmRH9iO4Q0WQILIMkDUiKk+CaxItZW+gEDjyw8Ug=
+github.com/google/go-containerregistry v0.15.2 h1:MMkSh+tjSdnmJZO7ljvEqV1DjfekB6VUEAZgy3a+TQE=
+github.com/google/go-containerregistry v0.15.2/go.mod h1:wWK+LnOv4jXMM23IT/F1wdYftGWGr47Is8CG+pmHK1Q=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -317,20 +312,19 @@ github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
+github.com/google/pprof v0.0.0-20221103000818-d260c55eee4c h1:lvddKcYTQ545ADhBujtIJmqQrZBDsGo7XIMbAQe/sNY=
+github.com/google/pprof v0.0.0-20221103000818-d260c55eee4c/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/s2a-go v0.1.3 h1:FAgZmpLl/SXurPEZyCMPBIiiYeTbqfjlbdnCNTAkbGE=
+github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc=
 github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
-github.com/google/trillian v1.5.1 h1:2p1l13f0eWd7eOShwarwIxutYYnGzY/5S+xYewQIPkU=
-github.com/google/trillian v1.5.1/go.mod h1:EcDttN8nf+EoAiyLigBAp9ebncZI6rhJPyxZ+dQ6HSo=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.2.3 h1:yk9/cqRKtT9wXZSsRH9aurXEpJX+U6FLtpYTdC3R06k=
+github.com/googleapis/enterprise-certificate-proxy v0.2.4 h1:uGy6JWR/uMIILU8wbf+OkstIrNiMjGpEIyhx8f6W7s4=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.8.0 h1:UBtEZqx1bjXtOQ5BVTkuYghXrr3N4V123VKJK67vJZc=
+github.com/googleapis/gax-go/v2 v2.11.0 h1:9V9PWXEsWnPpQhu/PeQIkS4eGzMlTLGgt80cUUI8Ki4=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
 github.com/gravitational/trace v1.2.1 h1:Iaf43aqbKV5H8bdiRs1qByjEHgAfADJ0lt0JwRyu+q8=
 github.com/gravitational/trace v1.2.1/go.mod h1:n0ijrq6psJY0sOI/NzLp+xdd8xl79jjwzVOFHDY6+kQ=
@@ -347,7 +341,7 @@ github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/vault/api v1.9.1 h1:LtY/I16+5jVGU8rufyyAkwopgq/HpUnxFBg+QLOAV38=
+github.com/hashicorp/vault/api v1.9.2 h1:YjkZLJ7K3inKgMZ0wzCU9OHqc+UqMQyXsPXnf3Cl2as=
 github.com/honeycombio/beeline-go v1.10.0 h1:cUDe555oqvw8oD76BQJ8alk7FP0JZ/M/zXpNvOEDLDc=
 github.com/honeycombio/libhoney-go v1.16.0 h1:kPpqoz6vbOzgp7jC6SR7SkNj7rua7rgxvznI6M3KdHc=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@@ -356,8 +350,8 @@ github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
-github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
+github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/in-toto/in-toto-golang v0.9.0 h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ9EBM1XU=
 github.com/in-toto/in-toto-golang v0.9.0/go.mod h1:xsBVrVsHNsB61++S6Dy2vWosKhuA3lUTQd+eF9HdeMo=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
@@ -397,11 +391,11 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/leodido/go-urn v1.2.3 h1:6BE2vPT0lqoz3fmOesHZiaiFh7889ssCo2GMvLCfiuA=
-github.com/leodido/go-urn v1.2.3/go.mod h1:7ZrI8mTSeBSHl/UaRyKQW1qZeMgak41ANeCNaVckg+4=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/leodido/go-urn v1.2.4 h1:XlAE/cm/ms7TE/VMVoduSpNBoyc2dOxHs5MZSwAN63Q=
+github.com/leodido/go-urn v1.2.4/go.mod h1:7ZrI8mTSeBSHl/UaRyKQW1qZeMgak41ANeCNaVckg+4=
 github.com/letsencrypt/boulder v0.0.0-20221109233200-85aa52084eaf h1:ndns1qx/5dL43g16EQkPV/i8+b3l5bYQwLeoSBe7tS8=
 github.com/letsencrypt/boulder v0.0.0-20221109233200-85aa52084eaf/go.mod h1:aGkAgvWY/IUcVFfuly53REpfv5edu25oij+qHRFaraA=
-github.com/lib/pq v1.10.7 h1:p7ZhMD+KsSRozJr34udlUrhboJwWAgCg34+/ZZNvZZw=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
@@ -434,6 +428,8 @@ github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJ
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481 h1:Up6+btDp321ZG5/zdSLo48H9Iaq0UQGthrhWC6pCxzE=
+github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481/go.mod h1:yKZQO8QE2bHlgozqWDiRVqTFlLQSj30K/6SAK8EeYFw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
@@ -458,8 +454,9 @@ github.com/opencontainers/image-spec v1.1.0-rc3/go.mod h1:X4pATf0uXsnn3g5aiGIsVn
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/pelletier/go-toml v1.7.0/go.mod h1:vwGMzjaWMwyfHwgIBhI2YUM4fB6nL6lVAvS1LBMMhTE=
-github.com/pelletier/go-toml/v2 v2.0.6 h1:nrzqCb7j9cDFj2coyLNLaZuJTLjWjlaz6nvTvIwycIU=
-github.com/pelletier/go-toml/v2 v2.0.6/go.mod h1:eumQOmlWiOPt5WriQQqoM5y18pDHwha2N+QD+EUNTek=
+github.com/pelletier/go-toml/v2 v2.0.8 h1:0ctb6s9mE31h0/lhu+J6OPmVeDxJn+kYnJc2jZR9tGQ=
+github.com/pelletier/go-toml/v2 v2.0.8/go.mod h1:vuYfssBdrU2XDZ9bYydBu6t+6a6PYNcZljzZR9VXg+4=
+github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -491,25 +488,30 @@ github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh
 github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
 github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/sigstore/cosign/v2 v2.0.2 h1:Ttaj/OkJAy+ummhnHG2F+JSFeZQj8i0P6o8j2RY9NG4=
-github.com/sigstore/cosign/v2 v2.0.2/go.mod h1:yJXtRmWrumyQA/XPjTTjOufnNckI87mmmVxv9rtEqgE=
-github.com/sigstore/rekor v1.1.1 h1:JCeSss+qUHnCATmwAZh4zT9k0Frdyq0BjmRwewSfEy4=
-github.com/sigstore/rekor v1.1.1/go.mod h1:x/xK+HK08MiuJv+v4OxY/Oo3bhuz1DtJXNJrV7hrzvs=
-github.com/sigstore/sigstore v1.6.4 h1:jH4AzR7qlEH/EWzm+opSpxCfuUcjHL+LJPuQE7h40WE=
-github.com/sigstore/sigstore v1.6.4/go.mod h1:pjR64lBxnjoSrAr+Ydye/FV73IfrgtoYlAI11a8xMfA=
-github.com/sigstore/timestamp-authority v1.0.0 h1:UisIGA9anE6xyWctJaiEmsk1M+txQ6kAPQDCyu+ieQw=
-github.com/sigstore/timestamp-authority v1.0.0/go.mod h1:DvyJt4w4by/hsutEi+th0MsK2tB3IwCPVr9ACrJAgIA=
+github.com/sigstore/cosign/v2 v2.1.0 h1:MU8gTKScV4NY3uUw+PMKgp6f1ZDmEDfDm/gHbGPMU0c=
+github.com/sigstore/cosign/v2 v2.1.0/go.mod h1:6pkFfXT/M+FY70DK4QSYa7JAmJEgK4XxsPR69phC7t8=
+github.com/sigstore/rekor v1.2.2-0.20230530122220-67cc9e58bd23 h1:eZY7mQFcc0VvNr0fiAK3/n7kh73+T06KzBEIUYzFSDQ=
+github.com/sigstore/rekor v1.2.2-0.20230530122220-67cc9e58bd23/go.mod h1:h1tOLhldpfILtziWpUDgGBu0vulWk9Kh72t6XzBGJok=
+github.com/sigstore/sigstore v1.7.0 h1:0jLlzxX68LtirwSTWAwRPMKhulT0aWVLmFU5ofnbtYA=
+github.com/sigstore/sigstore v1.7.0/go.mod h1:0PmMzfJP2Y9+lugD0wer4e7TihR5tM7NcIs3bQNk5xg=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.7.0 h1:fRv9grFx22NsmXTkfhF8/+UzqkrCND8JI/QfCpYjEnc=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.7.0 h1:ST1G207w73d1t4nXHyXGM9LvRDjSQUtnANbkoGRaBi4=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.7.0 h1:rYJ7+nRDGxSneFcawUzYyVcRKvGrqqdMUbjZMLI6iCc=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.7.0 h1:mKNyQ5b/G0KgwJ9HSYpGvkXmpeuC/2DYFKsp/mKmtXs=
+github.com/sigstore/timestamp-authority v1.1.1 h1:EldrdeBED0edNzDMvYZDf5CyWgtSchtR9DKYyksNR8M=
+github.com/sigstore/timestamp-authority v1.1.1/go.mod h1:cEDLEHl/L3ppqKDaiZ3Cg4ikcaYleuq90I/BFNePzF0=
 github.com/sirupsen/logrus v1.4.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/spf13/afero v1.9.3 h1:41FoI0fD7OR7mGcKE/aOiLkGreyf8ifIOQmJANWogMk=
-github.com/spf13/afero v1.9.3/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/spf13/afero v1.9.5 h1:stMpOSZFs//0Lv29HduCmli3GUfpFoF3Y1Q/aXj/wVM=
+github.com/spf13/afero v1.9.5/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
-github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
+github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
+github.com/spf13/cast v1.5.1/go.mod h1:b9PdjNptOpzXr7Rq1q9gJML/2cdGQAo69NKzQ10KN48=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
 github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
@@ -518,8 +520,8 @@ github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.15.0 h1:js3yy885G8xwJa6iOISGFwd+qlUo5AvyXb7CiihdtiU=
-github.com/spf13/viper v1.15.0/go.mod h1:fFcTBJxvhhzSJiZy8n+PeW6t8l+KeT/uTARa0jHOQLA=
+github.com/spf13/viper v1.16.0 h1:rGGH0XDZhdUOryiDWjmIvUSWpbNqisK8Wk0Vyefw8hc=
+github.com/spf13/viper v1.16.0/go.mod h1:yg78JgCJcbrQOvV9YLXgkLaZqUidkY9K+Dd1FofRzQg=
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -536,6 +538,7 @@ github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1F
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
@@ -548,8 +551,8 @@ github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhV
 github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
-github.com/transparency-dev/merkle v0.0.1 h1:T9/9gYB8uZl7VOJIhdwjALeRWlxUxSfDEysjfmx+L9E=
-github.com/transparency-dev/merkle v0.0.1/go.mod h1:B8FIw5LTq6DaULoHsVFRzYIUDkl8yuSwCdZnOZGKL/A=
+github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4=
+github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A=
 github.com/urfave/cli v1.22.12/go.mod h1:sSBEIC79qR6OvcmsD4U3KABeOTxDqQtdDnaFuUN30b8=
 github.com/vbatts/tar-split v0.11.3 h1:hLFqsOLQ1SsppQNTMpkpPXClLDfC2A3Zgy9OUU+RVck=
 github.com/vbatts/tar-split v0.11.3/go.mod h1:9QlHN18E+fEH7RdG+QAJJcuya3rqT7eXSTY7wGrAokY=
@@ -579,21 +582,23 @@ go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
-go.opentelemetry.io/otel v1.14.0 h1:/79Huy8wbf5DnIPhemGB+zEPVwnN6fuQybr/SRXa6hM=
-go.opentelemetry.io/otel v1.14.0/go.mod h1:o4buv+dJzx8rohcUeRmWUZhqupFvzWis188WlggnNeU=
+go.opentelemetry.io/otel v1.16.0 h1:Z7GVAX/UkAXPKsy94IU+i6thsQS4nb7LviLpnaNeW8s=
+go.opentelemetry.io/otel v1.16.0/go.mod h1:vl0h9NUa1D5s1nv3A5vZOYWn8av4K8Ml6JDeHrT/bx4=
+go.opentelemetry.io/otel/metric v1.16.0 h1:RbrpwVG1Hfv85LgnZ7+txXioPDoh6EdbZHo26Q3hqOo=
+go.opentelemetry.io/otel/metric v1.16.0/go.mod h1:QE47cpOmkwipPiefDwo2wDzwJrlfxxNYodqc4xnGCo4=
 go.opentelemetry.io/otel/sdk v1.14.0 h1:PDCppFRDq8A1jL9v6KMI6dYesaq+DFcDZvjsoGvxGzY=
-go.opentelemetry.io/otel/trace v1.14.0 h1:wp2Mmvj41tDsyAJXiWDWpfNsOiIyd38fy85pyKcFq/M=
-go.opentelemetry.io/otel/trace v1.14.0/go.mod h1:8avnQLK+CG77yNLUae4ea2JDQ6iT+gozhnZjy/rw9G8=
+go.opentelemetry.io/otel/trace v1.16.0 h1:8JRpaObFoW0pxuVPapkgH8UhHQj+bJW8jJsCZEu5MQs=
+go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLkqr2QVwea0ef0=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.step.sm/crypto v0.29.3 h1:lFCsFQQGic1VZIa0B/87iMCDy67+LW8eEl119GTyeWI=
+go.step.sm/crypto v0.32.1 h1:kAiL21zTqAgYu1geOYxH+ApUCUX+oclB25TccnNEYTU=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
 go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/multierr v1.9.0 h1:7fIwc/ZtS0q++VgcfqFDxSBZVv/Xo49/SYnDFupUwlI=
-go.uber.org/multierr v1.9.0/go.mod h1:X2jQV1h+kxSjClGpnseKVIxpmcjrj7MNnI0bnlfKTVQ=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
 go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -606,12 +611,12 @@ golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.8.0 h1:pd9TJtTueMTVQXzk8E2XESSMQDj/U7OUu0PqJqPXQjQ=
-golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
+golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
+golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -622,8 +627,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20230213192124-5e25df0256eb h1:PaBZQdo+iSDyHT053FjUCgZQ/9uqVwPOcl7KSWhKn6w=
-golang.org/x/exp v0.0.0-20230213192124-5e25df0256eb/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29 h1:ooxPy7fPvB4kwsA2h+iBNHkAbp/4JxTSwCmvdjEYmug=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -649,8 +654,8 @@ golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
-golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.11.0 h1:bUO06HqtnRcc/7l71XBe4WcqTZ+3AH1J59zWDDwLKgU=
+golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -693,8 +698,8 @@ golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU=
+golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -704,8 +709,8 @@ golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.7.0 h1:qe6s0zUXlPX80/dITx3440hWZ7GwMwgDDyrSGTPJG/g=
-golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
+golang.org/x/oauth2 v0.9.0 h1:BPpt2kU7oMRq3kCHAA1tbSEshXRw1LpG2ztgDwrzuAs=
+golang.org/x/oauth2 v0.9.0/go.mod h1:qYgFZaFiu6Wg24azG8bdV52QJXJGbZzIIsRCdVKzbLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -719,8 +724,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -779,13 +784,13 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
+golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28=
+golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -796,8 +801,8 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58=
+golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -859,7 +864,7 @@ golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo=
+golang.org/x/tools v0.9.3 h1:Gn1I8+64MsuTb/HpH+LmQtNas23LhUVr3rYZ0eKuaMM=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -886,7 +891,7 @@ google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz513
 google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
 google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
 google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/api v0.121.0 h1:8Oopoo8Vavxx6gt+sgs8s8/X60WBAtKQq6JqnkF+xow=
+google.golang.org/api v0.128.0 h1:RjPESny5CnQRn9V6siglged+DZCgfu9l6mO9dkX9VOg=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -933,8 +938,10 @@ google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A=
-google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
+google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc h1:8DyZCyvI8mE1IdLy/60bS+52xfymkE72wv1asokgtao=
+google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc h1:kVKPf/IiYSBWEWtkIn6wZXwWGCnLKcC8oWfZvXjsGnM=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc h1:XSJ8Vk1SWuNr8S18z1NZSziL0CPIXLCCMDOEFtHBOFc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -954,8 +961,8 @@ google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA5
 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.54.0 h1:EhTqbhiYeixwWQtAEZAxmV9MGqcjEU2mFx52xCzNyag=
-google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
+google.golang.org/grpc v1.56.0 h1:+y7Bs8rtMd07LeXmL3NxcTLn7mUkbKZqEpPhMNkwJEE=
+google.golang.org/grpc v1.56.0/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1008,22 +1015,22 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.27.2 h1:+H17AJpUMvl+clT+BPnKf0E3ksMAzoBBg7CntpSuADo=
-k8s.io/api v0.27.2/go.mod h1:ENmbocXfBT2ADujUXcBhHV55RIT31IIEvkntP6vZKS4=
+k8s.io/api v0.27.3 h1:yR6oQXXnUEBWEWcvPWS0jQL575KoAboQPfJAuKNrw5Y=
+k8s.io/api v0.27.3/go.mod h1:C4BNvZnQOF7JA/0Xed2S+aUyJSfTGkGFxLXz9MnpIpg=
 k8s.io/apiextensions-apiserver v0.27.2 h1:iwhyoeS4xj9Y7v8YExhUwbVuBhMr3Q4bd/laClBV6Bo=
 k8s.io/apiextensions-apiserver v0.27.2/go.mod h1:Oz9UdvGguL3ULgRdY9QMUzL2RZImotgxvGjdWRq6ZXQ=
-k8s.io/apimachinery v0.27.2 h1:vBjGaKKieaIreI+oQwELalVG4d8f3YAMNpWLzDXkxeg=
-k8s.io/apimachinery v0.27.2/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
-k8s.io/client-go v0.27.2 h1:vDLSeuYvCHKeoQRhCXjxXO45nHVv2Ip4Fe0MfioMrhE=
-k8s.io/client-go v0.27.2/go.mod h1:tY0gVmUsHrAmjzHX9zs7eCjxcBsf8IiNe7KQ52biTcQ=
+k8s.io/apimachinery v0.27.3 h1:Ubye8oBufD04l9QnNtW05idcOe9Z3GQN8+7PqmuVcUM=
+k8s.io/apimachinery v0.27.3/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
+k8s.io/client-go v0.27.3 h1:7dnEGHZEJld3lYwxvLl7WoehK6lAq7GvgjxpA3nv1E8=
+k8s.io/client-go v0.27.3/go.mod h1:2MBEKuTo6V1lbKy3z1euEGnhPfGZLKTS9tiJ2xodM48=
 k8s.io/component-base v0.27.2 h1:neju+7s/r5O4x4/txeUONNTS9r1HsPbyoPBAtHsDCpo=
 k8s.io/component-base v0.27.2/go.mod h1:5UPk7EjfgrfgRIuDBFtsEFAe4DAvP3U+M8RTzoSJkpo=
-k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw=
-k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
+k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg=
 k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg=
-k8s.io/utils v0.0.0-20230209194617-a36077c30491 h1:r0BAOLElQnnFhE/ApUsg3iHdVYYPBjNSSOMowRZxxsY=
-k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 h1:qY1Ad8PODbnymg2pRbkyMT/ylpTrCM8P2RJ0yroCyIk=
+k8s.io/utils v0.0.0-20230406110748-d93618cff8a2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/integrations/kube-agent-updater/pkg/img/cosign_test.go b/integrations/kube-agent-updater/pkg/img/cosign_test.go
index 71b4f22e2043e..8129da851b9cd 100644
--- a/integrations/kube-agent-updater/pkg/img/cosign_test.go
+++ b/integrations/kube-agent-updater/pkg/img/cosign_test.go
@@ -51,7 +51,6 @@ func Test_cosignKeyValidator_ValidateAndResolveDigest(t *testing.T) {
 	// This is the worst case scenario and also reduces the amount of noise and failed calls in the logs.
 	testRegistry := httptest.NewServer(registry.New(registry.WithReferrersSupport(true)))
 	t.Cleanup(testRegistry.Close)
-	t.Log(testRegistry.URL)
 
 	// Put test layers and manifests into the registry
 	for digest, contents := range blobs {
diff --git a/integrations/lib/logger/logger.go b/integrations/lib/logger/logger.go
index fbc5b3caf27c3..80e71e2f5524f 100644
--- a/integrations/lib/logger/logger.go
+++ b/integrations/lib/logger/logger.go
@@ -76,6 +76,10 @@ func Setup(conf Config) error {
 	return nil
 }
 
+func WithLogger(ctx context.Context, logger log.FieldLogger) context.Context {
+	return withLogger(ctx, logger)
+}
+
 func withLogger(ctx context.Context, logger log.FieldLogger) context.Context {
 	return context.WithValue(ctx, contextKey{}, logger)
 }
diff --git a/integrations/lib/tctl/resources.go b/integrations/lib/tctl/resources.go
index c9b5876aa081f..b747cdc33ea24 100644
--- a/integrations/lib/tctl/resources.go
+++ b/integrations/lib/tctl/resources.go
@@ -89,7 +89,7 @@ func (res *streamResource) UnmarshalJSON(raw []byte) error {
 		}
 	case types.KindRole:
 		switch header.Version {
-		case types.V4, types.V5, types.V6:
+		case types.V4, types.V5, types.V6, types.V7:
 			resource = &types.RoleV6{}
 		default:
 			return trace.BadParameter("unsupported resource version %s", header.Version)
diff --git a/integrations/lib/testing/integration/integration.go b/integrations/lib/testing/integration/integration.go
index d0824b996ae54..7be831ed638ff 100644
--- a/integrations/lib/testing/integration/integration.go
+++ b/integrations/lib/testing/integration/integration.go
@@ -195,12 +195,6 @@ func NewFromEnv(ctx context.Context) (*Integration, error) {
 
 	var paths BinPaths
 
-	if os.Getenv("CI") != "" {
-		if licenseStr == "" {
-			return nil, trace.AccessDenied("tests on CI should run with enterprise license")
-		}
-	}
-
 	if version := os.Getenv("TELEPORT_GET_VERSION"); version == "" {
 		paths = BinPaths{
 			Teleport: os.Getenv("TELEPORT_BINARY"),
diff --git a/integrations/lib/testing/integration/integration_test.go b/integrations/lib/testing/integration/integration_test.go
index 0668f6c26dd2d..c5aca598143b5 100644
--- a/integrations/lib/testing/integration/integration_test.go
+++ b/integrations/lib/testing/integration/integration_test.go
@@ -40,7 +40,7 @@ func (s *IntegrationSuite) TestVersion() {
 
 	versionMin, err := version.NewVersion("v11.0.0")
 	require.NoError(t, err)
-	versionMax, err := version.NewVersion("v13")
+	versionMax, err := version.NewVersion("v14")
 	require.NoError(t, err)
 
 	assert.True(t, s.Integration.Version().GreaterThanOrEqual(versionMin))
diff --git a/integrations/lib/testing/integration/ssh_test.go b/integrations/lib/testing/integration/ssh_test.go
index c86349aaf948d..431ba369e0b17 100644
--- a/integrations/lib/testing/integration/ssh_test.go
+++ b/integrations/lib/testing/integration/ssh_test.go
@@ -77,8 +77,6 @@ func (s *IntegrationSSHSuite) TestSSH() {
 	require.NoError(t, err)
 
 	err = cmd.Wait()
-	t.Log("STDOUT", cmdStdout.String())
-	t.Log("STDERR", cmdStderr.String())
 	require.NoError(t, err)
 
 	require.Contains(t, cmdStdout.String(), fmt.Sprintf("MYUSER=%s", user.GetName()))
diff --git a/integrations/operator/README.md b/integrations/operator/README.md
index 6f69a8d4361ae..7ba038d16bc34 100644
--- a/integrations/operator/README.md
+++ b/integrations/operator/README.md
@@ -143,7 +143,7 @@ spec:
 ```
 
 ```bash
-kubcetl apply -f roles.yaml
+kubectl apply -f roles.yaml
 ```
 
 And now check if the role was created in Teleport and K8S (`teleport-cluster` namespace).
diff --git a/integrations/operator/apis/resources/v1/okta_import_rule.go b/integrations/operator/apis/resources/v1/okta_import_rule.go
new file mode 100644
index 0000000000000..8cb6445aeb3e1
--- /dev/null
+++ b/integrations/operator/apis/resources/v1/okta_import_rule.go
@@ -0,0 +1,117 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/integrations/operator/apis/resources"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func init() {
+	SchemeBuilder.Register(&TeleportOktaImportRule{}, &TeleportOktaImportRuleList{})
+}
+
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+
+// TeleportOktaImportRule holds the kubernetes custom resources for okta import rules.
+type TeleportOktaImportRule struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   TeleportOktaImportRuleSpec   `json:"spec,omitempty"`
+	Status TeleportOktaImportRuleStatus `json:"status,omitempty"`
+}
+
+// TeleportOktaImportRuleSpec matches the JSON of generated CRD spec
+type TeleportOktaImportRuleSpec struct {
+	Priority int32                           `json:"priority,omitempty"`
+	Mappings []TeleportOktaImportRuleMapping `json:"mappings,omitempty"`
+}
+
+// TeleportOktaImportRuleMapping matches the JSON of a mapping definition
+type TeleportOktaImportRuleMapping struct {
+	Match     []TeleportOktaImportRuleMatch `json:"match,omitempty"`
+	AddLabels map[string]string             `json:"add_labels,omitempty"`
+}
+
+// TeleportOktaImportRuleMatch matches the JSON of a match definition.
+type TeleportOktaImportRuleMatch struct {
+	AppIDs           []string `json:"app_ids,omitempty"`
+	GroupIDs         []string `json:"group_ids,omitempty"`
+	AppNameRegexes   []string `json:"app_name_regexes,omitempty"`
+	GroupNameRegexes []string `json:"group_name_regexes,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// TeleportOktaImportRuleList contains a list of TeleportOktaImportRule
+type TeleportOktaImportRuleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []TeleportOktaImportRule `json:"items"`
+}
+
+type TeleportOktaImportRuleStatus struct {
+	// Conditions represent the latest available observations of an object's state
+	// +optional
+	Conditions []metav1.Condition `json:"conditions,omitempty"`
+	// +optional
+	TeleportResourceID int64 `json:"teleportResourceID,omitempty"`
+}
+
+// ToTeleport returns an OktaImportRule, which wraps the actual
+// [types.OktaImportRuleV1] and implements the necessary interface methods used
+// by the TeleportResourceReconciler.
+func (o TeleportOktaImportRule) ToTeleport() types.OktaImportRule {
+	importRule := &types.OktaImportRuleV1{
+		ResourceHeader: types.ResourceHeader{
+			Metadata: types.Metadata{
+				Name:        o.Name,
+				Labels:      o.Labels,
+				Description: o.Annotations[resources.DescriptionKey],
+			},
+			Version: types.V1,
+		},
+		Spec: types.OktaImportRuleSpecV1{
+			Priority: o.Spec.Priority,
+			Mappings: make([]*types.OktaImportRuleMappingV1, len(o.Spec.Mappings)),
+		},
+	}
+
+	for i, mapping := range o.Spec.Mappings {
+		matches := make([]*types.OktaImportRuleMatchV1, len(mapping.Match))
+		for j, match := range mapping.Match {
+			matches[j] = &types.OktaImportRuleMatchV1{
+				AppIDs:           match.AppIDs,
+				GroupIDs:         match.GroupIDs,
+				AppNameRegexes:   match.AppNameRegexes,
+				GroupNameRegexes: match.GroupNameRegexes,
+			}
+		}
+		importRule.Spec.Mappings[i] = &types.OktaImportRuleMappingV1{
+			Match:     matches,
+			AddLabels: utils.CopyStringsMap(mapping.AddLabels),
+		}
+	}
+	return importRule
+}
+
+func (l *TeleportOktaImportRule) StatusConditions() *[]metav1.Condition {
+	return &l.Status.Conditions
+}
diff --git a/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go b/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go
index 18ecc3f37068d..769a018e3250f 100644
--- a/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go
+++ b/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go
@@ -136,3 +136,170 @@ func (in *TeleportLoginRuleStatus) DeepCopy() *TeleportLoginRuleStatus {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TeleportOktaImportRule) DeepCopyInto(out *TeleportOktaImportRule) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportOktaImportRule.
+func (in *TeleportOktaImportRule) DeepCopy() *TeleportOktaImportRule {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportOktaImportRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TeleportOktaImportRule) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TeleportOktaImportRuleList) DeepCopyInto(out *TeleportOktaImportRuleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TeleportOktaImportRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportOktaImportRuleList.
+func (in *TeleportOktaImportRuleList) DeepCopy() *TeleportOktaImportRuleList {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportOktaImportRuleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TeleportOktaImportRuleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TeleportOktaImportRuleMapping) DeepCopyInto(out *TeleportOktaImportRuleMapping) {
+	*out = *in
+	if in.Match != nil {
+		in, out := &in.Match, &out.Match
+		*out = make([]TeleportOktaImportRuleMatch, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.AddLabels != nil {
+		in, out := &in.AddLabels, &out.AddLabels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportOktaImportRuleMapping.
+func (in *TeleportOktaImportRuleMapping) DeepCopy() *TeleportOktaImportRuleMapping {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportOktaImportRuleMapping)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TeleportOktaImportRuleMatch) DeepCopyInto(out *TeleportOktaImportRuleMatch) {
+	*out = *in
+	if in.AppIDs != nil {
+		in, out := &in.AppIDs, &out.AppIDs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.GroupIDs != nil {
+		in, out := &in.GroupIDs, &out.GroupIDs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.AppNameRegexes != nil {
+		in, out := &in.AppNameRegexes, &out.AppNameRegexes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.GroupNameRegexes != nil {
+		in, out := &in.GroupNameRegexes, &out.GroupNameRegexes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportOktaImportRuleMatch.
+func (in *TeleportOktaImportRuleMatch) DeepCopy() *TeleportOktaImportRuleMatch {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportOktaImportRuleMatch)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TeleportOktaImportRuleSpec) DeepCopyInto(out *TeleportOktaImportRuleSpec) {
+	*out = *in
+	if in.Mappings != nil {
+		in, out := &in.Mappings, &out.Mappings
+		*out = make([]TeleportOktaImportRuleMapping, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportOktaImportRuleSpec.
+func (in *TeleportOktaImportRuleSpec) DeepCopy() *TeleportOktaImportRuleSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportOktaImportRuleSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TeleportOktaImportRuleStatus) DeepCopyInto(out *TeleportOktaImportRuleStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]metav1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportOktaImportRuleStatus.
+func (in *TeleportOktaImportRuleStatus) DeepCopy() *TeleportOktaImportRuleStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TeleportOktaImportRuleStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_oktaimportrules.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_oktaimportrules.yaml
new file mode 100644
index 0000000000000..071d62895c100
--- /dev/null
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_oktaimportrules.yaml
@@ -0,0 +1,183 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  name: teleportoktaimportrules.resources.teleport.dev
+spec:
+  group: resources.teleport.dev
+  names:
+    kind: TeleportOktaImportRule
+    listKind: TeleportOktaImportRuleList
+    plural: teleportoktaimportrules
+    shortNames:
+    - oktaimportrule
+    - oktaimportrules
+    singular: teleportoktaimportrule
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: OktaImportRule is the Schema for the oktaimportrules API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: OktaImportRule resource definition v1 from Teleport
+            properties:
+              mappings:
+                description: Mappings is a list of matches that will map match conditions
+                  to labels.
+                items:
+                  properties:
+                    add_labels:
+                      description: AddLabels specifies which labels to add if any
+                        of the previous matches match.
+                      nullable: true
+                      properties:
+                        key:
+                          type: string
+                        value:
+                          type: string
+                      type: object
+                    match:
+                      description: Match is a set of matching rules for this mapping.
+                        If any of these match, then the mapping will be applied.
+                      items:
+                        properties:
+                          app_ids:
+                            description: AppIDs is a list of app IDs to match against.
+                            items:
+                              type: string
+                            nullable: true
+                            type: array
+                          app_name_regexes:
+                            description: AppNameRegexes is a list of regexes to match
+                              against app names.
+                            items:
+                              type: string
+                            nullable: true
+                            type: array
+                          group_ids:
+                            description: GroupIDs is a list of group IDs to match
+                              against.
+                            items:
+                              type: string
+                            nullable: true
+                            type: array
+                          group_name_regexes:
+                            description: GroupNameRegexes is a list of regexes to
+                              match against group names.
+                            items:
+                              type: string
+                            nullable: true
+                            type: array
+                        type: object
+                      nullable: true
+                      type: array
+                  type: object
+                nullable: true
+                type: array
+              priority:
+                description: Priority represents the priority of the rule application.
+                  Lower numbered rules will be applied first.
+                format: int32
+                type: integer
+            type: object
+          status:
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of an object's state
+                items:
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource. --- This struct is intended for direct
+                    use as an array at the field path .status.conditions.  For example,
+                    \n type FooStatus struct{ // Represents the observations of a
+                    foo's current state. // Known .status.conditions.type are: \"Available\",
+                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
+                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
+                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
+                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
+                  properties:
+                    lastTransitionTime:
+                      description: lastTransitionTime is the last time the condition
+                        transitioned from one status to another. This should be when
+                        the underlying condition changed.  If that is not known, then
+                        using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: message is a human readable message indicating
+                        details about the transition. This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: observedGeneration represents the .metadata.generation
+                        that the condition was set based upon. For instance, if .metadata.generation
+                        is currently 12, but the .status.conditions[x].observedGeneration
+                        is 9, the condition is out of date with respect to the current
+                        state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: reason contains a programmatic identifier indicating
+                        the reason for the condition's last transition. Producers
+                        of specific condition types may define expected values and
+                        meanings for this field, and whether the values are considered
+                        a guaranteed API. The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        --- Many .condition.type values are consistent across resources
+                        like Available, but because arbitrary conditions can be useful
+                        (see .node.status.conditions), the ability to deconflict is
+                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              teleportResourceID:
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_roles.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_roles.yaml
index 6019214c48b0d..3e7d0fc8ab40a 100644
--- a/integrations/operator/config/crd/bases/resources.teleport.dev_roles.yaml
+++ b/integrations/operator/config/crd/bases/resources.teleport.dev_roles.yaml
@@ -41,6 +41,10 @@ spec:
                     description: AppLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  app_labels_expression:
+                    description: AppLabelsExpression is a predicate expression used
+                      to allow/deny access to Apps.
+                    type: string
                   aws_role_arns:
                     description: AWSRoleARNs is a list of AWS role ARNs this role
                       is allowed to assume.
@@ -61,12 +65,20 @@ spec:
                     description: ClusterLabels is a map of node labels (used to dynamically
                       grant access to clusters).
                     type: object
+                  cluster_labels_expression:
+                    description: ClusterLabelsExpression is a predicate expression
+                      used to allow/deny access to remote Teleport clusters.
+                    type: string
                   db_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
                     description: DatabaseLabels are used in RBAC system to allow/deny
                       access to databases.
                     type: object
+                  db_labels_expression:
+                    description: DatabaseLabelsExpression is a predicate expression
+                      used to allow/deny access to Databases.
+                    type: string
                   db_names:
                     description: DatabaseNames is a list of database names this role
                       is allowed to connect to.
@@ -87,6 +99,10 @@ spec:
                     description: DatabaseServiceLabels are used in RBAC system to
                       allow/deny access to Database Services.
                     type: object
+                  db_service_labels_expression:
+                    description: DatabaseServiceLabelsExpression is a predicate expression
+                      used to allow/deny access to Database Services.
+                    type: string
                   db_users:
                     description: DatabaseUsers is a list of databases users this role
                       is allowed to connect as.
@@ -114,6 +130,10 @@ spec:
                     description: GroupLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  group_labels_expression:
+                    description: GroupLabelsExpression is a predicate expression used
+                      to allow/deny access to user groups.
+                    type: string
                   host_groups:
                     description: HostGroups is a list of groups for created users
                       to be added to
@@ -196,6 +216,10 @@ spec:
                     description: KubernetesLabels is a map of kubernetes cluster labels
                       used for RBAC.
                     type: object
+                  kubernetes_labels_expression:
+                    description: KubernetesLabelsExpression is a predicate expression
+                      used to allow/deny access to kubernetes clusters.
+                    type: string
                   kubernetes_resources:
                     description: KubernetesResources is the Kubernetes Resources this
                       Role grants access to.
@@ -232,6 +256,10 @@ spec:
                     description: NodeLabels is a map of node labels (used to dynamically
                       grant access to nodes).
                     type: object
+                  node_labels_expression:
+                    description: NodeLabelsExpression is a predicate expression used
+                      to allow/deny access to SSH nodes.
+                    type: string
                   request:
                     nullable: true
                     properties:
@@ -439,6 +467,10 @@ spec:
                     description: WindowsDesktopLabels are used in the RBAC system
                       to allow/deny access to Windows desktops.
                     type: object
+                  windows_desktop_labels_expression:
+                    description: WindowsDesktopLabelsExpression is a predicate expression
+                      used to allow/deny access to Windows desktops.
+                    type: string
                   windows_desktop_logins:
                     description: WindowsDesktopLogins is a list of desktop login names
                       allowed/denied for Windows desktops.
@@ -457,6 +489,10 @@ spec:
                     description: AppLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  app_labels_expression:
+                    description: AppLabelsExpression is a predicate expression used
+                      to allow/deny access to Apps.
+                    type: string
                   aws_role_arns:
                     description: AWSRoleARNs is a list of AWS role ARNs this role
                       is allowed to assume.
@@ -477,12 +513,20 @@ spec:
                     description: ClusterLabels is a map of node labels (used to dynamically
                       grant access to clusters).
                     type: object
+                  cluster_labels_expression:
+                    description: ClusterLabelsExpression is a predicate expression
+                      used to allow/deny access to remote Teleport clusters.
+                    type: string
                   db_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
                     description: DatabaseLabels are used in RBAC system to allow/deny
                       access to databases.
                     type: object
+                  db_labels_expression:
+                    description: DatabaseLabelsExpression is a predicate expression
+                      used to allow/deny access to Databases.
+                    type: string
                   db_names:
                     description: DatabaseNames is a list of database names this role
                       is allowed to connect to.
@@ -503,6 +547,10 @@ spec:
                     description: DatabaseServiceLabels are used in RBAC system to
                       allow/deny access to Database Services.
                     type: object
+                  db_service_labels_expression:
+                    description: DatabaseServiceLabelsExpression is a predicate expression
+                      used to allow/deny access to Database Services.
+                    type: string
                   db_users:
                     description: DatabaseUsers is a list of databases users this role
                       is allowed to connect as.
@@ -530,6 +578,10 @@ spec:
                     description: GroupLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  group_labels_expression:
+                    description: GroupLabelsExpression is a predicate expression used
+                      to allow/deny access to user groups.
+                    type: string
                   host_groups:
                     description: HostGroups is a list of groups for created users
                       to be added to
@@ -612,6 +664,10 @@ spec:
                     description: KubernetesLabels is a map of kubernetes cluster labels
                       used for RBAC.
                     type: object
+                  kubernetes_labels_expression:
+                    description: KubernetesLabelsExpression is a predicate expression
+                      used to allow/deny access to kubernetes clusters.
+                    type: string
                   kubernetes_resources:
                     description: KubernetesResources is the Kubernetes Resources this
                       Role grants access to.
@@ -648,6 +704,10 @@ spec:
                     description: NodeLabels is a map of node labels (used to dynamically
                       grant access to nodes).
                     type: object
+                  node_labels_expression:
+                    description: NodeLabelsExpression is a predicate expression used
+                      to allow/deny access to SSH nodes.
+                    type: string
                   request:
                     nullable: true
                     properties:
@@ -855,6 +915,10 @@ spec:
                     description: WindowsDesktopLabels are used in the RBAC system
                       to allow/deny access to Windows desktops.
                     type: object
+                  windows_desktop_labels_expression:
+                    description: WindowsDesktopLabelsExpression is a predicate expression
+                      used to allow/deny access to Windows desktops.
+                    type: string
                   windows_desktop_logins:
                     description: WindowsDesktopLogins is a list of desktop login names
                       allowed/denied for Windows desktops.
@@ -1018,7 +1082,7 @@ spec:
                     type: string
                   request_prompt:
                     description: RequestPrompt is an optional message which tells
-                      users what they aught to
+                      users what they aught to request.
                     type: string
                   require_session_mfa:
                     description: RequireMFAType is the type of MFA requirement enforced
@@ -1143,6 +1207,10 @@ spec:
                     description: AppLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  app_labels_expression:
+                    description: AppLabelsExpression is a predicate expression used
+                      to allow/deny access to Apps.
+                    type: string
                   aws_role_arns:
                     description: AWSRoleARNs is a list of AWS role ARNs this role
                       is allowed to assume.
@@ -1163,12 +1231,20 @@ spec:
                     description: ClusterLabels is a map of node labels (used to dynamically
                       grant access to clusters).
                     type: object
+                  cluster_labels_expression:
+                    description: ClusterLabelsExpression is a predicate expression
+                      used to allow/deny access to remote Teleport clusters.
+                    type: string
                   db_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
                     description: DatabaseLabels are used in RBAC system to allow/deny
                       access to databases.
                     type: object
+                  db_labels_expression:
+                    description: DatabaseLabelsExpression is a predicate expression
+                      used to allow/deny access to Databases.
+                    type: string
                   db_names:
                     description: DatabaseNames is a list of database names this role
                       is allowed to connect to.
@@ -1189,6 +1265,10 @@ spec:
                     description: DatabaseServiceLabels are used in RBAC system to
                       allow/deny access to Database Services.
                     type: object
+                  db_service_labels_expression:
+                    description: DatabaseServiceLabelsExpression is a predicate expression
+                      used to allow/deny access to Database Services.
+                    type: string
                   db_users:
                     description: DatabaseUsers is a list of databases users this role
                       is allowed to connect as.
@@ -1216,6 +1296,10 @@ spec:
                     description: GroupLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  group_labels_expression:
+                    description: GroupLabelsExpression is a predicate expression used
+                      to allow/deny access to user groups.
+                    type: string
                   host_groups:
                     description: HostGroups is a list of groups for created users
                       to be added to
@@ -1298,6 +1382,10 @@ spec:
                     description: KubernetesLabels is a map of kubernetes cluster labels
                       used for RBAC.
                     type: object
+                  kubernetes_labels_expression:
+                    description: KubernetesLabelsExpression is a predicate expression
+                      used to allow/deny access to kubernetes clusters.
+                    type: string
                   kubernetes_resources:
                     description: KubernetesResources is the Kubernetes Resources this
                       Role grants access to.
@@ -1334,6 +1422,10 @@ spec:
                     description: NodeLabels is a map of node labels (used to dynamically
                       grant access to nodes).
                     type: object
+                  node_labels_expression:
+                    description: NodeLabelsExpression is a predicate expression used
+                      to allow/deny access to SSH nodes.
+                    type: string
                   request:
                     nullable: true
                     properties:
@@ -1541,6 +1633,10 @@ spec:
                     description: WindowsDesktopLabels are used in the RBAC system
                       to allow/deny access to Windows desktops.
                     type: object
+                  windows_desktop_labels_expression:
+                    description: WindowsDesktopLabelsExpression is a predicate expression
+                      used to allow/deny access to Windows desktops.
+                    type: string
                   windows_desktop_logins:
                     description: WindowsDesktopLogins is a list of desktop login names
                       allowed/denied for Windows desktops.
@@ -1559,6 +1655,10 @@ spec:
                     description: AppLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  app_labels_expression:
+                    description: AppLabelsExpression is a predicate expression used
+                      to allow/deny access to Apps.
+                    type: string
                   aws_role_arns:
                     description: AWSRoleARNs is a list of AWS role ARNs this role
                       is allowed to assume.
@@ -1579,12 +1679,20 @@ spec:
                     description: ClusterLabels is a map of node labels (used to dynamically
                       grant access to clusters).
                     type: object
+                  cluster_labels_expression:
+                    description: ClusterLabelsExpression is a predicate expression
+                      used to allow/deny access to remote Teleport clusters.
+                    type: string
                   db_labels:
                     additionalProperties:
                       x-kubernetes-preserve-unknown-fields: true
                     description: DatabaseLabels are used in RBAC system to allow/deny
                       access to databases.
                     type: object
+                  db_labels_expression:
+                    description: DatabaseLabelsExpression is a predicate expression
+                      used to allow/deny access to Databases.
+                    type: string
                   db_names:
                     description: DatabaseNames is a list of database names this role
                       is allowed to connect to.
@@ -1605,6 +1713,10 @@ spec:
                     description: DatabaseServiceLabels are used in RBAC system to
                       allow/deny access to Database Services.
                     type: object
+                  db_service_labels_expression:
+                    description: DatabaseServiceLabelsExpression is a predicate expression
+                      used to allow/deny access to Database Services.
+                    type: string
                   db_users:
                     description: DatabaseUsers is a list of databases users this role
                       is allowed to connect as.
@@ -1632,6 +1744,10 @@ spec:
                     description: GroupLabels is a map of labels used as part of the
                       RBAC system.
                     type: object
+                  group_labels_expression:
+                    description: GroupLabelsExpression is a predicate expression used
+                      to allow/deny access to user groups.
+                    type: string
                   host_groups:
                     description: HostGroups is a list of groups for created users
                       to be added to
@@ -1714,6 +1830,10 @@ spec:
                     description: KubernetesLabels is a map of kubernetes cluster labels
                       used for RBAC.
                     type: object
+                  kubernetes_labels_expression:
+                    description: KubernetesLabelsExpression is a predicate expression
+                      used to allow/deny access to kubernetes clusters.
+                    type: string
                   kubernetes_resources:
                     description: KubernetesResources is the Kubernetes Resources this
                       Role grants access to.
@@ -1750,6 +1870,10 @@ spec:
                     description: NodeLabels is a map of node labels (used to dynamically
                       grant access to nodes).
                     type: object
+                  node_labels_expression:
+                    description: NodeLabelsExpression is a predicate expression used
+                      to allow/deny access to SSH nodes.
+                    type: string
                   request:
                     nullable: true
                     properties:
@@ -1957,6 +2081,10 @@ spec:
                     description: WindowsDesktopLabels are used in the RBAC system
                       to allow/deny access to Windows desktops.
                     type: object
+                  windows_desktop_labels_expression:
+                    description: WindowsDesktopLabelsExpression is a predicate expression
+                      used to allow/deny access to Windows desktops.
+                    type: string
                   windows_desktop_logins:
                     description: WindowsDesktopLogins is a list of desktop login names
                       allowed/denied for Windows desktops.
@@ -2120,7 +2248,7 @@ spec:
                     type: string
                   request_prompt:
                     description: RequestPrompt is an optional message which tells
-                      users what they aught to
+                      users what they aught to request.
                     type: string
                   require_session_mfa:
                     description: RequireMFAType is the type of MFA requirement enforced
diff --git a/integrations/operator/controllers/resources/okta_import_rule_controller.go b/integrations/operator/controllers/resources/okta_import_rule_controller.go
new file mode 100644
index 0000000000000..07f8cdd78e6cf
--- /dev/null
+++ b/integrations/operator/controllers/resources/okta_import_rule_controller.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resources
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	kclient "sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/gravitational/teleport/api/types"
+	resourcesv1 "github.com/gravitational/teleport/integrations/operator/apis/resources/v1"
+	"github.com/gravitational/teleport/integrations/operator/sidecar"
+)
+
+// oktaImportRuleClient implements TeleportResourceClient and offers CRUD methods needed to reconcile okta_import_rules
+type oktaImportRuleClient struct {
+	TeleportClientAccessor sidecar.ClientAccessor
+}
+
+// Get gets the Teleport okta_import_rule of a given name
+func (r oktaImportRuleClient) Get(ctx context.Context, name string) (types.OktaImportRule, error) {
+	teleportClient, err := r.TeleportClientAccessor(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	importRule, err := teleportClient.OktaClient().GetOktaImportRule(ctx, name)
+	return importRule, trace.Wrap(err)
+}
+
+// Create creates a Teleport okta_import_rule
+func (r oktaImportRuleClient) Create(ctx context.Context, importRule types.OktaImportRule) error {
+	teleportClient, err := r.TeleportClientAccessor(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	_, err = teleportClient.OktaClient().CreateOktaImportRule(ctx, importRule)
+	return trace.Wrap(err)
+}
+
+// Update updates a Teleport okta_import_rule
+func (r oktaImportRuleClient) Update(ctx context.Context, importRule types.OktaImportRule) error {
+	teleportClient, err := r.TeleportClientAccessor(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	_, err = teleportClient.OktaClient().UpdateOktaImportRule(ctx, importRule)
+	return trace.Wrap(err)
+}
+
+// Delete deletes a Teleport okta_import_rule
+func (r oktaImportRuleClient) Delete(ctx context.Context, name string) error {
+	teleportClient, err := r.TeleportClientAccessor(ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(teleportClient.OktaClient().DeleteOktaImportRule(ctx, name))
+}
+
+// NewOktaImportRuleReconciler instantiates a new Kubernetes controller reconciling okta_import_rule resources
+func NewOktaImportRuleReconciler(client kclient.Client, accessor sidecar.ClientAccessor) *TeleportResourceReconciler[types.OktaImportRule, *resourcesv1.TeleportOktaImportRule] {
+	oktaImportRuleClient := &oktaImportRuleClient{
+		TeleportClientAccessor: accessor,
+	}
+
+	resourceReconciler := NewTeleportResourceReconciler[types.OktaImportRule, *resourcesv1.TeleportOktaImportRule](
+		client,
+		oktaImportRuleClient,
+	)
+
+	return resourceReconciler
+}
diff --git a/integrations/operator/controllers/resources/okta_import_rule_controller_test.go b/integrations/operator/controllers/resources/okta_import_rule_controller_test.go
new file mode 100644
index 0000000000000..4ddfb91e4e2c8
--- /dev/null
+++ b/integrations/operator/controllers/resources/okta_import_rule_controller_test.go
@@ -0,0 +1,178 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resources_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kclient "sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/gravitational/teleport/api/types"
+	resourcesv1 "github.com/gravitational/teleport/integrations/operator/apis/resources/v1"
+	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+var oktaImportRuleSpec = types.OktaImportRuleSpecV1{
+	Priority: 100,
+	Mappings: []*types.OktaImportRuleMappingV1{
+		{
+			Match: []*types.OktaImportRuleMatchV1{
+				{
+					AppIDs: []string{"1", "2", "3"},
+				},
+			},
+			AddLabels: map[string]string{
+				"label1": "value1",
+			},
+		},
+		{
+			Match: []*types.OktaImportRuleMatchV1{
+				{
+					GroupIDs: []string{"1", "2", "3"},
+				},
+			},
+			AddLabels: map[string]string{
+				"label2": "value2",
+			},
+		},
+	},
+}
+
+type oktaImportRuleTestingPrimitives struct {
+	setup *testSetup
+}
+
+func (g *oktaImportRuleTestingPrimitives) Init(setup *testSetup) {
+	g.setup = setup
+}
+
+func (g *oktaImportRuleTestingPrimitives) SetupTeleportFixtures(ctx context.Context) error {
+	return nil
+}
+
+func (g *oktaImportRuleTestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
+	importRule, err := types.NewOktaImportRule(types.Metadata{
+		Name: name,
+	}, oktaImportRuleSpec)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	importRule.SetOrigin(types.OriginKubernetes)
+	_, err = g.setup.TeleportClient.OktaClient().CreateOktaImportRule(ctx, importRule)
+	return trace.Wrap(err)
+}
+
+func (g *oktaImportRuleTestingPrimitives) GetTeleportResource(ctx context.Context, name string) (types.OktaImportRule, error) {
+	return g.setup.TeleportClient.OktaClient().GetOktaImportRule(ctx, name)
+}
+
+func (g *oktaImportRuleTestingPrimitives) DeleteTeleportResource(ctx context.Context, name string) error {
+	return trace.Wrap(g.setup.TeleportClient.OktaClient().DeleteOktaImportRule(ctx, name))
+}
+
+func (g *oktaImportRuleTestingPrimitives) CreateKubernetesResource(ctx context.Context, name string) error {
+	spec := resourcesv1.TeleportOktaImportRuleSpec{
+		Priority: oktaImportRuleSpec.Priority,
+		Mappings: make([]resourcesv1.TeleportOktaImportRuleMapping, len(oktaImportRuleSpec.Mappings)),
+	}
+
+	for i, mapping := range oktaImportRuleSpec.Mappings {
+		matches := make([]resourcesv1.TeleportOktaImportRuleMatch, len(mapping.Match))
+		for j, match := range mapping.Match {
+			matches[j] = resourcesv1.TeleportOktaImportRuleMatch{
+				AppIDs:           match.AppIDs,
+				GroupIDs:         match.GroupIDs,
+				AppNameRegexes:   match.AppNameRegexes,
+				GroupNameRegexes: match.GroupNameRegexes,
+			}
+		}
+		spec.Mappings[i] = resourcesv1.TeleportOktaImportRuleMapping{
+			Match:     matches,
+			AddLabels: utils.CopyStringsMap(mapping.AddLabels),
+		}
+	}
+
+	importRule := &resourcesv1.TeleportOktaImportRule{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: g.setup.Namespace.Name,
+		},
+		Spec: spec,
+	}
+	return trace.Wrap(g.setup.K8sClient.Create(ctx, importRule))
+}
+
+func (g *oktaImportRuleTestingPrimitives) DeleteKubernetesResource(ctx context.Context, name string) error {
+	oidc := &resourcesv1.TeleportOktaImportRule{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: g.setup.Namespace.Name,
+		},
+	}
+	return trace.Wrap(g.setup.K8sClient.Delete(ctx, oidc))
+}
+
+func (g *oktaImportRuleTestingPrimitives) GetKubernetesResource(ctx context.Context, name string) (*resourcesv1.TeleportOktaImportRule, error) {
+	importRule := &resourcesv1.TeleportOktaImportRule{}
+	obj := kclient.ObjectKey{
+		Name:      name,
+		Namespace: g.setup.Namespace.Name,
+	}
+	err := g.setup.K8sClient.Get(ctx, obj, importRule)
+	return importRule, trace.Wrap(err)
+}
+
+func (g *oktaImportRuleTestingPrimitives) ModifyKubernetesResource(ctx context.Context, name string) error {
+	importRule, err := g.GetKubernetesResource(ctx, name)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	importRule.Spec.Priority = 50
+	return g.setup.K8sClient.Update(ctx, importRule)
+}
+
+func (g *oktaImportRuleTestingPrimitives) CompareTeleportAndKubernetesResource(tResource types.OktaImportRule, kubeResource *resourcesv1.TeleportOktaImportRule) (bool, string) {
+	teleportMap, _ := teleportResourceToMap(tResource)
+	kubernetesMap, _ := teleportResourceToMap(kubeResource.ToTeleport())
+
+	equal := cmp.Equal(teleportMap["spec"], kubernetesMap["spec"])
+	if !equal {
+		return equal, cmp.Diff(teleportMap["spec"], kubernetesMap["spec"])
+	}
+
+	return equal, ""
+}
+
+func TestOktaImportRuleCreation(t *testing.T) {
+	test := &oktaImportRuleTestingPrimitives{}
+	testlib.ResourceCreationTest[types.OktaImportRule, *resourcesv1.TeleportOktaImportRule](t, test)
+}
+
+func TestOktaImportRuleDeletionDrift(t *testing.T) {
+	test := &oktaImportRuleTestingPrimitives{}
+	testlib.ResourceDeletionDriftTest[types.OktaImportRule, *resourcesv1.TeleportOktaImportRule](t, test)
+}
+
+func TestOktaImportRuleUpdate(t *testing.T) {
+	test := &oktaImportRuleTestingPrimitives{}
+	testlib.ResourceUpdateTest[types.OktaImportRule, *resourcesv1.TeleportOktaImportRule](t, test)
+}
diff --git a/integrations/operator/controllers/resources/testlib/env.go b/integrations/operator/controllers/resources/testlib/env.go
index 58dc63856089e..8d5af5d06abfd 100644
--- a/integrations/operator/controllers/resources/testlib/env.go
+++ b/integrations/operator/controllers/resources/testlib/env.go
@@ -28,7 +28,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	core "k8s.io/api/core/v1"
-	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	apiruntime "k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@@ -55,7 +54,7 @@ import (
 var scheme = apiruntime.NewScheme()
 
 func init() {
-	utilruntime.Must(v1.AddToScheme(scheme))
+	utilruntime.Must(core.AddToScheme(scheme))
 	utilruntime.Must(resourcesv1.AddToScheme(scheme))
 	utilruntime.Must(resourcesv2.AddToScheme(scheme))
 	utilruntime.Must(resourcesv3.AddToScheme(scheme))
@@ -117,11 +116,12 @@ func defaultTeleportServiceConfig(t *testing.T) (*helpers.TeleInstance, string)
 	role, err := types.NewRole(roleName, types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
-				types.NewRule("role", unrestricted),
-				types.NewRule("user", unrestricted),
-				types.NewRule("auth_connector", unrestricted),
-				types.NewRule("login_rule", unrestricted),
-				types.NewRule("token", unrestricted),
+				types.NewRule(types.KindRole, unrestricted),
+				types.NewRule(types.KindUser, unrestricted),
+				types.NewRule(types.KindAuthConnector, unrestricted),
+				types.NewRule(types.KindLoginRule, unrestricted),
+				types.NewRule(types.KindToken, unrestricted),
+				types.NewRule(types.KindOktaImportRule, unrestricted),
 			},
 		},
 	})
@@ -208,6 +208,9 @@ func (s *TestSetup) StartKubernetesOperator(t *testing.T) {
 	err = resources.NewProvisionTokenReconciler(s.K8sClient, clientAccessor).SetupWithManager(k8sManager)
 	require.NoError(t, err)
 
+	err = resources.NewOktaImportRuleReconciler(s.K8sClient, clientAccessor).SetupWithManager(k8sManager)
+	require.NoError(t, err)
+
 	ctx, ctxCancel := context.WithCancel(context.Background())
 
 	s.Operator = k8sManager
diff --git a/integrations/operator/crdgen/main.go b/integrations/operator/crdgen/main.go
index b1cb94ec98cf4..78328008810f2 100644
--- a/integrations/operator/crdgen/main.go
+++ b/integrations/operator/crdgen/main.go
@@ -111,6 +111,7 @@ func generateSchema(file *File, groupName string, resp *gogoplugin.CodeGenerator
 			},
 		},
 		{name: "ProvisionTokenV2"},
+		{name: "OktaImportRuleV1"},
 	}
 
 	for _, resource := range resources {
diff --git a/integrations/operator/crdgen/testdata/golden/resources.teleport.dev_oktaimportrules.yaml b/integrations/operator/crdgen/testdata/golden/resources.teleport.dev_oktaimportrules.yaml
new file mode 100644
index 0000000000000..0952ba0343b94
--- /dev/null
+++ b/integrations/operator/crdgen/testdata/golden/resources.teleport.dev_oktaimportrules.yaml
@@ -0,0 +1,169 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  name: teleportoktaimportrules.resources.teleport.dev
+spec:
+  group: resources.teleport.dev
+  names:
+    kind: TeleportOktaImportRule
+    listKind: TeleportOktaImportRuleList
+    plural: teleportoktaimportrules
+    shortNames:
+    - oktaimportrule
+    - oktaimportrules
+    singular: teleportoktaimportrule
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: OktaImportRule is the Schema for the oktaimportrules API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: OktaImportRule resource definition v1 from Teleport
+            properties:
+              mappings:
+                description: Mappings is a list of matches that will map match conditions
+                  to labels.
+                items:
+                  properties:
+                    add_labels:
+                      description: AddLabels specifies which labels to add if any
+                        of the previous matches match.
+                      nullable: true
+                      properties:
+                        key:
+                          type: string
+                        value:
+                          type: string
+                      type: object
+                    match:
+                      description: Match is a set of matching rules for this mapping.
+                        If any of these match, then the mapping will be applied.
+                      items:
+                        properties:
+                          app_ids:
+                            description: AppIDs is a list of app IDs to match against.
+                            items:
+                              type: string
+                            nullable: true
+                            type: array
+                          group_ids:
+                            description: GroupIDs is a list of group IDs to match
+                              against.
+                            items:
+                              type: string
+                            nullable: true
+                            type: array
+                        type: object
+                      nullable: true
+                      type: array
+                  type: object
+                nullable: true
+                type: array
+              priority:
+                description: Priority represents the priority of the rule application.
+                  Lower numbered rules will be applied first.
+                format: int32
+                type: integer
+            type: object
+          status:
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of an object's state
+                items:
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource. --- This struct is intended for direct
+                    use as an array at the field path .status.conditions.  For example,
+                    \n type FooStatus struct{ // Represents the observations of a
+                    foo's current state. // Known .status.conditions.type are: \"Available\",
+                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
+                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
+                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
+                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
+                  properties:
+                    lastTransitionTime:
+                      description: lastTransitionTime is the last time the condition
+                        transitioned from one status to another. This should be when
+                        the underlying condition changed.  If that is not known, then
+                        using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: message is a human readable message indicating
+                        details about the transition. This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: observedGeneration represents the .metadata.generation
+                        that the condition was set based upon. For instance, if .metadata.generation
+                        is currently 12, but the .status.conditions[x].observedGeneration
+                        is 9, the condition is out of date with respect to the current
+                        state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: reason contains a programmatic identifier indicating
+                        the reason for the condition's last transition. Producers
+                        of specific condition types may define expected values and
+                        meanings for this field, and whether the values are considered
+                        a guaranteed API. The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        --- Many .condition.type values are consistent across resources
+                        like Available, but because arbitrary conditions can be useful
+                        (see .node.status.conditions), the ability to deconflict is
+                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              teleportResourceID:
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/integrations/operator/main.go b/integrations/operator/main.go
index 2d1f07d99cab6..4f8c51ffd6c5f 100644
--- a/integrations/operator/main.go
+++ b/integrations/operator/main.go
@@ -27,6 +27,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
@@ -190,6 +191,12 @@ func main() {
 		os.Exit(1)
 	}
 
+	if err = resources.NewOktaImportRuleReconciler(mgr.GetClient(), bot.GetClient).
+		SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "TeleportOktaImportRule")
+		os.Exit(1)
+	}
+
 	//+kubebuilder:scaffold:builder
 	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
 		setupLog.Error(err, "unable to set up health check")
diff --git a/integrations/operator/sidecar/sidecar.go b/integrations/operator/sidecar/sidecar.go
index 972e756b02f4e..f3ee3d2c6a856 100644
--- a/integrations/operator/sidecar/sidecar.go
+++ b/integrations/operator/sidecar/sidecar.go
@@ -114,8 +114,15 @@ func sidecarRole(roleName string) (types.Role, error) {
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
-					Resources: []string{"role", "user", "auth_connector", "login_rule", "token"},
-					Verbs:     []string{"*"},
+					Resources: []string{
+						types.KindRole,
+						types.KindUser,
+						types.KindAuthConnector,
+						types.KindLoginRule,
+						types.KindToken,
+						types.KindOktaImportRule,
+					},
+					Verbs: []string{"*"},
 				},
 			},
 		},
diff --git a/integrations/operator/sidecar/tbot.go b/integrations/operator/sidecar/tbot.go
index a0f956b5607c9..726fed6694c7e 100644
--- a/integrations/operator/sidecar/tbot.go
+++ b/integrations/operator/sidecar/tbot.go
@@ -65,30 +65,26 @@ func (b *Bot) initializeConfig() {
 
 	// Initialize tbot config
 	b.cfg = &config.BotConfig{
-		Onboarding: &config.OnboardingConfig{
+		Onboarding: config.OnboardingConfig{
 			TokenValue: "",         // Field should be populated later, before running
 			CAPins:     []string{}, // Field should be populated later, before running
 			JoinMethod: types.JoinMethodToken,
 		},
 		Storage: &config.StorageConfig{
-			DestinationMixin: config.DestinationMixin{
-				Memory: rootMemoryStore,
-			},
+			Destination: rootMemoryStore,
 		},
-		Destinations: []*config.DestinationConfig{
-			{
-				DestinationMixin: config.DestinationMixin{
-					Memory: destMemoryStore,
-				},
+		Outputs: []config.Output{
+			&config.IdentityOutput{
+				Destination: destMemoryStore,
 			},
 		},
+
 		Debug:           false,
 		AuthServer:      b.opts.Addr,
 		CertificateTTL:  DefaultCertificateTTL,
 		RenewalInterval: DefaultRenewalInterval,
 		Oneshot:         false,
 	}
-
 	// We do our own init because config's "CheckAndSetDefaults" is too linked with tbot logic and invokes
 	// `addRequiredConfigs` on each Storage Destination
 	rootMemoryStore.CheckAndSetDefaults()
@@ -107,10 +103,11 @@ func (b *Bot) GetClient(ctx context.Context) (*client.Client, error) {
 	}
 	// If the bot has not joined the cluster yet or not generated client certs we bail out
 	// This is either temporary or the bot is dead and the manager will shut down everything.
-	if botCert, err := b.cfg.Storage.Memory.Read(identity.TLSCertKey); err != nil || len(botCert) == 0 {
+	storageDestination := b.cfg.Storage.Destination
+	if botCert, err := storageDestination.Read(identity.TLSCertKey); err != nil || len(botCert) == 0 {
 		return nil, trace.Retry(err, "bot cert not yet present")
 	}
-	if cert, err := b.cfg.Destinations[0].Memory.Read(identity.TLSCertKey); err != nil || len(cert) == 0 {
+	if cert, err := b.cfg.Outputs[0].GetDestination().Read(identity.TLSCertKey); err != nil || len(cert) == 0 {
 		return nil, trace.Retry(err, "cert not yet present")
 	}
 
@@ -119,18 +116,18 @@ func (b *Bot) GetClient(ctx context.Context) (*client.Client, error) {
 	// We loop over missing artifacts and are loading them from the bot storage to the destination
 	for _, artifact := range identity.GetArtifacts() {
 		if artifact.Kind == identity.KindBotInternal {
-			value, err := b.cfg.Storage.Memory.Read(artifact.Key)
+			value, err := storageDestination.Read(artifact.Key)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-			if err := b.cfg.Destinations[0].Memory.Write(artifact.Key, value); err != nil {
+			if err := b.cfg.Outputs[0].GetDestination().Write(artifact.Key, value); err != nil {
 				return nil, trace.Wrap(err)
 			}
 
 		}
 	}
 
-	id, err := identity.LoadIdentity(b.cfg.Destinations[0].Memory, identity.BotKinds()...)
+	id, err := identity.LoadIdentity(b.cfg.Outputs[0].GetDestination(), identity.BotKinds()...)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -184,8 +181,7 @@ func (b *Bot) Start(ctx context.Context) error {
 
 	b.cfg.Onboarding.CAPins = caPins
 
-	reloadChan := make(chan struct{})
-	realBot := tbot.New(b.cfg, log.StandardLogger(), reloadChan)
+	realBot := tbot.New(b.cfg, log.StandardLogger())
 
 	b.running = true
 	log.Info("Running tbot")
@@ -240,18 +236,14 @@ func CreateAndBootstrapBot(ctx context.Context, opts Options) (*Bot, *proto.Feat
 // See https://github.com/gravitational/teleport/issues/13091
 func createOrReplaceBot(ctx context.Context, opts Options, authClient auth.ClientI) (string, error) {
 	var token string
-	botPresent, err := botExists(ctx, opts, authClient)
-	if err != nil {
+	// We remove the bot and its role. If this is the first operator to run,
+	// this throws a "NotFound" error.
+	botRoleName := fmt.Sprintf("bot-%s", opts.Name)
+	if err := authClient.DeleteBot(ctx, opts.Name); err != nil && !trace.IsNotFound(err) {
 		return "", trace.Wrap(err)
 	}
-	if botPresent {
-		if err := authClient.DeleteBot(ctx, opts.Name); err != nil {
-			return "", trace.Wrap(err)
-		}
-		if err := authClient.DeleteRole(ctx, fmt.Sprintf("bot-%s", opts.Name)); err != nil {
-			return "", trace.Wrap(err)
-		}
-
+	if err := authClient.DeleteRole(ctx, botRoleName); err != nil && !trace.IsNotFound(err) {
+		return "", trace.Wrap(err)
 	}
 	response, err := authClient.CreateBot(ctx, &proto.CreateBotRequest{
 		Name:  opts.Name,
@@ -264,17 +256,3 @@ func createOrReplaceBot(ctx context.Context, opts Options, authClient auth.Clien
 
 	return token, nil
 }
-
-func botExists(ctx context.Context, opts Options, authClient auth.ClientI) (bool, error) {
-	botUsers, err := authClient.GetBotUsers(ctx)
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
-	for _, botUser := range botUsers {
-
-		if botUser.GetName() == fmt.Sprintf("bot-%s", opts.Name) {
-			return true, nil
-		}
-	}
-	return false, nil
-}
diff --git a/lib/ai/chat.go b/lib/ai/chat.go
index 6d8424e49be2b..dd2691f914f95 100644
--- a/lib/ai/chat.go
+++ b/lib/ai/chat.go
@@ -18,38 +18,30 @@ package ai
 
 import (
 	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"strings"
 
 	"github.com/gravitational/trace"
 	"github.com/sashabaranov/go-openai"
 	"github.com/tiktoken-go/tokenizer"
-)
 
-const maxResponseTokens = 2000
+	"github.com/gravitational/teleport/lib/ai/model"
+)
 
 // Chat represents a conversation between a user and an assistant with context memory.
 type Chat struct {
 	client    *Client
 	messages  []openai.ChatCompletionMessage
 	tokenizer tokenizer.Codec
+	agent     *model.Agent
 }
 
-// Insert inserts a message into the conversation. This is commonly in the
-// form of a user's input but may also take the form of a system messages used for instructions.
-func (chat *Chat) Insert(role string, content string) Message {
+// Insert inserts a message into the conversation. Returns the index of the message.
+func (chat *Chat) Insert(role string, content string) int {
 	chat.messages = append(chat.messages, openai.ChatCompletionMessage{
 		Role:    role,
 		Content: content,
 	})
 
-	return Message{
-		Role:    role,
-		Content: content,
-		Idx:     len(chat.messages) - 1,
-	}
+	return len(chat.messages) - 1
 }
 
 // GetMessages returns the messages in the conversation.
@@ -57,157 +49,37 @@ func (chat *Chat) GetMessages() []openai.ChatCompletionMessage {
 	return chat.messages
 }
 
-// PromptTokens uses the chat's tokenizer to calculate
-// the total number of tokens in the prompt
-//
-// Ref: https://github.com/openai/openai-cookbook/blob/594fc6c952425810e9ea5bd1a275c8ca5f32e8f9/examples/How_to_count_tokens_with_tiktoken.ipynb
-func (chat *Chat) PromptTokens() (int, error) {
-	// perRequest is the number of tokens used up for each completion request
-	const perRequest = 3
-	// perRole is the number of tokens used to encode a message's role
-	const perRole = 1
-	// perMessage is the token "overhead" for each message
-	const perMessage = 3
-
-	sum := perRequest
-	for _, m := range chat.messages {
-		tokens, _, err := chat.tokenizer.Encode(m.Content)
-		if err != nil {
-			return 0, trace.Wrap(err)
-		}
-		sum += len(tokens)
-		sum += perRole
-		sum += perMessage
-	}
-
-	return sum, nil
-}
-
-// Complete completes the conversation with a message from the assistant based on the current context.
+// Complete completes the conversation with a message from the assistant based on the current context and user input.
 // On success, it returns the message.
 // Returned types:
-// - Message: the message from the assistant
+// - message: one of the message types below
 // - error: an error if one occurred
 // Message types:
 // - CompletionCommand: a command from the assistant
-// - StreamingMessage: a message that is streamed from the assistant
-func (chat *Chat) Complete(ctx context.Context) (any, error) {
-	var numTokens int
-
+// - Message: a text message from the assistant
+func (chat *Chat) Complete(ctx context.Context, userInput string, progressUpdates func(*model.AgentAction)) (any, error) {
 	// if the chat is empty, return the initial response we predefine instead of querying GPT-4
 	if len(chat.messages) == 1 {
-		return &Message{
-			Role:    openai.ChatMessageRoleAssistant,
-			Content: initialAIResponse,
-			Idx:     len(chat.messages) - 1,
+		return &model.Message{
+			Content:    model.InitialAIResponse,
+			TokensUsed: &model.TokensUsed{},
 		}, nil
 	}
 
-	// if not, copy the current chat log to a new slice and append the suffix instruction
-	messages := make([]openai.ChatCompletionMessage, len(chat.messages)+1)
-	copy(messages, chat.messages)
-	messages[len(messages)-1] = openai.ChatCompletionMessage{
+	userMessage := openai.ChatCompletionMessage{
 		Role:    openai.ChatMessageRoleUser,
-		Content: promptExtractInstruction,
+		Content: userInput,
 	}
 
-	// create a streaming completion request, we do this to optimistically stream the response when
-	// we don't believe it's a payload
-	stream, err := chat.client.svc.CreateChatCompletionStream(
-		ctx,
-		openai.ChatCompletionRequest{
-			Model:     openai.GPT4,
-			Messages:  messages,
-			MaxTokens: maxResponseTokens,
-			Stream:    true,
-		},
-	)
+	response, err := chat.agent.PlanAndExecute(ctx, chat.client.svc, chat.messages, userMessage, progressUpdates)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	var (
-		response openai.ChatCompletionStreamResponse
-		trimmed  string
-	)
-	for trimmed == "" {
-		// fetch the first delta to check for a possible JSON payload
-		response, err = stream.Recv()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		numTokens++
-
-		trimmed = strings.TrimSpace(response.Choices[0].Delta.Content)
-	}
-
-	// if it looks like a JSON payload, let's wait for the entire response and try to parse it
-	if strings.HasPrefix(trimmed, "{") {
-		payload := strings.Builder{}
-		payload.WriteString(response.Choices[0].Delta.Content)
-
-		for {
-			response, err := stream.Recv()
-			if errors.Is(err, io.EOF) {
-				break
-			}
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			numTokens++
-
-			payload.WriteString(response.Choices[0].Delta.Content)
-		}
-
-		// if we can parse it, return the parsed payload, otherwise return a non-streaming message
-		var c CompletionCommand
-		err = json.Unmarshal([]byte(payload.String()), &c)
-		switch err {
-		case nil:
-			c.NumTokens = numTokens
-			return &c, nil
-		default:
-			return &Message{
-				Role:      openai.ChatMessageRoleAssistant,
-				Content:   payload.String(),
-				Idx:       len(chat.messages) - 1,
-				NumTokens: numTokens,
-			}, nil
-		}
-	}
-
-	// if it doesn't look like a JSON payload, return a streaming message to the caller
-	chunks := make(chan string, 1)
-	errCh := make(chan error)
-	chunks <- response.Choices[0].Delta.Content
-	go func() {
-		defer close(chunks)
-
-		for {
-			response, err := stream.Recv()
-			switch {
-			case errors.Is(err, io.EOF):
-				return
-			case err != nil:
-				select {
-				case <-ctx.Done():
-				case errCh <- trace.Wrap(err):
-				}
-				return
-			}
-
-			select {
-			case chunks <- response.Choices[0].Delta.Content:
-			case <-ctx.Done():
-				return
-			}
-		}
-	}()
+	return response, nil
+}
 
-	return &StreamingMessage{
-		Role:   openai.ChatMessageRoleAssistant,
-		Idx:    len(chat.messages) - 1,
-		Chunks: chunks,
-		Error:  errCh,
-	}, nil
+// Clear clears the conversation.
+func (chat *Chat) Clear() {
+	chat.messages = []openai.ChatCompletionMessage{}
 }
diff --git a/lib/ai/chat_test.go b/lib/ai/chat_test.go
index 19aacd5be2368..a016574d7ba5c 100644
--- a/lib/ai/chat_test.go
+++ b/lib/ai/chat_test.go
@@ -18,13 +18,16 @@ package ai
 
 import (
 	"context"
+	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
 	"github.com/sashabaranov/go-openai"
 	"github.com/stretchr/testify/require"
-	"github.com/tiktoken-go/tokenizer/codec"
+
+	"github.com/gravitational/teleport/lib/ai/model"
 )
 
 func TestChat_PromptTokens(t *testing.T) {
@@ -34,12 +37,11 @@ func TestChat_PromptTokens(t *testing.T) {
 		name     string
 		messages []openai.ChatCompletionMessage
 		want     int
-		wantErr  bool
 	}{
 		{
 			name:     "empty",
 			messages: []openai.ChatCompletionMessage{},
-			want:     3,
+			want:     0,
 		},
 		{
 			name: "only system message",
@@ -49,7 +51,7 @@ func TestChat_PromptTokens(t *testing.T) {
 					Content: "Hello",
 				},
 			},
-			want: 8,
+			want: 697,
 		},
 		{
 			name: "system and user messages",
@@ -63,21 +65,21 @@ func TestChat_PromptTokens(t *testing.T) {
 					Content: "Hi LLM.",
 				},
 			},
-			want: 16,
+			want: 705,
 		},
 		{
 			name: "tokenize our prompt",
 			messages: []openai.ChatCompletionMessage{
 				{
 					Role:    openai.ChatMessageRoleSystem,
-					Content: promptCharacter("Bob"),
+					Content: model.PromptCharacter("Bob"),
 				},
 				{
 					Role:    openai.ChatMessageRoleUser,
 					Content: "Show me free disk space on localhost node.",
 				},
 			},
-			want: 187,
+			want: 908,
 		},
 	}
 
@@ -86,12 +88,39 @@ func TestChat_PromptTokens(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			chat := &Chat{
-				messages:  tt.messages,
-				tokenizer: codec.NewCl100kBase(),
+			responses := []string{
+				generateCommandResponse(),
 			}
-			usedTokens, err := chat.PromptTokens()
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "text/event-stream")
+
+				require.GreaterOrEqual(t, len(responses), 1, "Unexpected request")
+				dataBytes := responses[0]
+				_, err := w.Write([]byte(dataBytes))
+				require.NoError(t, err, "Write error")
+
+				responses = responses[1:]
+			}))
+
+			t.Cleanup(server.Close)
+
+			cfg := openai.DefaultConfig("secret-test-token")
+			cfg.BaseURL = server.URL + "/v1"
+
+			client := NewClientFromConfig(cfg)
+			chat := client.NewChat(nil, "Bob")
+
+			for _, message := range tt.messages {
+				chat.Insert(message.Role, message.Content)
+			}
+
+			ctx := context.Background()
+			message, err := chat.Complete(ctx, "", func(aa *model.AgentAction) {})
 			require.NoError(t, err)
+			msg, ok := message.(interface{ UsedTokens() *model.TokensUsed })
+			require.True(t, ok)
+
+			usedTokens := msg.UsedTokens().Completion + msg.UsedTokens().Prompt
 			require.Equal(t, tt.want, usedTokens)
 		})
 	}
@@ -101,8 +130,8 @@ func TestChat_Complete(t *testing.T) {
 	t.Parallel()
 
 	responses := [][]byte{
-		generateTextResponse(),
-		generateCommandResponse(),
+		[]byte(generateTextResponse()),
+		[]byte(generateCommandResponse()),
 	}
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "text/event-stream")
@@ -121,43 +150,32 @@ func TestChat_Complete(t *testing.T) {
 	cfg.BaseURL = server.URL + "/v1"
 	client := NewClientFromConfig(cfg)
 
-	chat := client.NewChat("Bob")
+	chat := client.NewChat(nil, "Bob")
 
-	t.Run("initial message", func(t *testing.T) {
-		msg, err := chat.Complete(context.Background())
-		require.NoError(t, err)
+	ctx := context.Background()
+	_, err := chat.Complete(ctx, "Hello", func(aa *model.AgentAction) {})
+	require.NoError(t, err)
 
-		expectedResp := &Message{Role: "assistant",
-			Content: "Hey, I'm Teleport - a powerful tool that can assist you in managing your Teleport cluster via OpenAI GPT-4.",
-			Idx:     0,
-		}
-		require.Equal(t, expectedResp, msg)
-	})
+	chat.Insert(openai.ChatMessageRoleUser, "Show me free disk space on localhost node.")
 
 	t.Run("text completion", func(t *testing.T) {
-		chat.Insert(openai.ChatMessageRoleUser, "Show me free disk space")
-
-		msg, err := chat.Complete(context.Background())
+		msg, err := chat.Complete(ctx, "Show me free disk space", func(aa *model.AgentAction) {})
 		require.NoError(t, err)
 
-		require.IsType(t, &StreamingMessage{}, msg)
-		streamingMessage := msg.(*StreamingMessage)
-		require.Equal(t, openai.ChatMessageRoleAssistant, streamingMessage.Role)
-
-		require.Equal(t, "Which ", <-streamingMessage.Chunks)
-		require.Equal(t, "node do ", <-streamingMessage.Chunks)
-		require.Equal(t, "you want ", <-streamingMessage.Chunks)
-		require.Equal(t, "use?", <-streamingMessage.Chunks)
+		require.IsType(t, &model.StreamingMessage{}, msg)
+		streamingMessage := msg.(*model.StreamingMessage)
+		require.Equal(t, "Which ", <-streamingMessage.Parts)
+		require.Equal(t, "node do ", <-streamingMessage.Parts)
+		require.Equal(t, "you want ", <-streamingMessage.Parts)
+		require.Equal(t, "use?", <-streamingMessage.Parts)
 	})
 
 	t.Run("command completion", func(t *testing.T) {
-		chat.Insert(openai.ChatMessageRoleUser, "localhost")
-
-		msg, err := chat.Complete(context.Background())
+		msg, err := chat.Complete(ctx, "localhost", func(aa *model.AgentAction) {})
 		require.NoError(t, err)
 
-		require.IsType(t, &CompletionCommand{}, msg)
-		command := msg.(*CompletionCommand)
+		require.IsType(t, &model.CompletionCommand{}, msg)
+		command := msg.(*model.CompletionCommand)
 		require.Equal(t, "df -h", command.Command)
 		require.Len(t, command.Nodes, 1)
 		require.Equal(t, "localhost", command.Nodes[0])
@@ -165,11 +183,11 @@ func TestChat_Complete(t *testing.T) {
 }
 
 // generateTextResponse generates a response for a text completion
-func generateTextResponse() []byte {
+func generateTextResponse() string {
 	dataBytes := []byte{}
 	dataBytes = append(dataBytes, []byte("event: message\n")...)
 
-	data := `{"id":"1","object":"completion","created":1598069254,"model":"gpt-4","choices":[{"index": 0, "delta":{"content": "Which ", "role": "assistant"}}]}`
+	data := `{"id":"1","object":"completion","created":1598069254,"model":"gpt-4","choices":[{"index": 0, "delta":{"content": "<FINAL RESPONSE>Which ", "role": "assistant"}}]}`
 	dataBytes = append(dataBytes, []byte("data: "+data+"\n\n")...)
 	dataBytes = append(dataBytes, []byte("event: message\n")...)
 
@@ -187,24 +205,43 @@ func generateTextResponse() []byte {
 
 	dataBytes = append(dataBytes, []byte("data: [DONE]\n\n")...)
 
-	return dataBytes
+	return string(dataBytes)
 }
 
 // generateCommandResponse generates a response for the command "df -h" on the node "localhost"
-func generateCommandResponse() []byte {
+func generateCommandResponse() string {
 	dataBytes := []byte{}
 	dataBytes = append(dataBytes, []byte("event: message\n")...)
 
-	data := `{"id":"1","object":"completion","created":1598069254,"model":"gpt-4","choices":[{"index": 0, "delta":{"content": "{\"command\": \"df -h\",", "role": "assistant"}}]}`
-	dataBytes = append(dataBytes, []byte("data: "+data+"\n\n")...)
+	actionObj := model.PlanOutput{
+		Action: "Command Execution",
+		ActionInput: struct {
+			Command string   `json:"command"`
+			Nodes   []string `json:"nodes"`
+		}{"df -h", []string{"localhost"}},
+	}
+	actionJson, err := json.Marshal(actionObj)
+	if err != nil {
+		panic(err)
+	}
 
-	dataBytes = append(dataBytes, []byte("event: message\n")...)
+	obj := struct {
+		Content string `json:"content"`
+		Role    string `json:"role"`
+	}{
+		Content: string(actionJson),
+		Role:    "assistant",
+	}
+	json, err := json.Marshal(obj)
+	if err != nil {
+		panic(err)
+	}
 
-	data = `{"id":"2","object":"completion","created":1598069254,"model":"gpt-4","choices":[{"index": 0, "delta":{"content": "\"nodes\": [\"localhost\"]}", "role": "assistant"}}]}`
+	data := fmt.Sprintf(`{"id":"1","object":"completion","created":1598069254,"model":"gpt-4","choices":[{"index": 0, "delta":%v}]}`, string(json))
 	dataBytes = append(dataBytes, []byte("data: "+data+"\n\n")...)
 
 	dataBytes = append(dataBytes, []byte("event: done\n")...)
 	dataBytes = append(dataBytes, []byte("data: [DONE]\n\n")...)
 
-	return dataBytes
+	return string(dataBytes)
 }
diff --git a/lib/ai/client.go b/lib/ai/client.go
index 39b2b0f050d00..72f72925e7102 100644
--- a/lib/ai/client.go
+++ b/lib/ai/client.go
@@ -22,6 +22,9 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/sashabaranov/go-openai"
 	"github.com/tiktoken-go/tokenizer/codec"
+
+	"github.com/gravitational/teleport/api/gen/proto/go/assist/v1"
+	"github.com/gravitational/teleport/lib/ai/model"
 )
 
 // Client is a client for OpenAI API.
@@ -41,18 +44,20 @@ func NewClientFromConfig(config openai.ClientConfig) *Client {
 
 // NewChat creates a new chat. The username is set in the conversation context,
 // so that the AI can use it to personalize the conversation.
-func (client *Client) NewChat(username string) *Chat {
+// embeddingServiceClient is used to get the embeddings from the Auth Server.
+func (client *Client) NewChat(embeddingServiceClient assist.AssistEmbeddingServiceClient, username string) *Chat {
 	return &Chat{
 		client: client,
 		messages: []openai.ChatCompletionMessage{
 			{
 				Role:    openai.ChatMessageRoleSystem,
-				Content: promptCharacter(username),
+				Content: model.PromptCharacter(username),
 			},
 		},
 		// Initialize a tokenizer for prompt token accounting.
 		// Cl100k is used by GPT-3 and GPT-4.
 		tokenizer: codec.NewCl100kBase(),
+		agent:     model.NewAgent(embeddingServiceClient, username),
 	}
 }
 
@@ -63,7 +68,49 @@ func (client *Client) Summary(ctx context.Context, message string) (string, erro
 		openai.ChatCompletionRequest{
 			Model: openai.GPT4,
 			Messages: []openai.ChatCompletionMessage{
-				{Role: openai.ChatMessageRoleSystem, Content: promptSummarizeTitle},
+				{Role: openai.ChatMessageRoleSystem, Content: model.PromptSummarizeTitle},
+				{Role: openai.ChatMessageRoleUser, Content: message},
+			},
+		},
+	)
+
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return resp.Choices[0].Message.Content, nil
+}
+
+// CommandSummary creates a command summary based on the command output.
+// The message history is also passed to the model in order to keep context
+// and extract relevant information from the output.
+func (client *Client) CommandSummary(ctx context.Context, messages []openai.ChatCompletionMessage, output map[string][]byte) (string, error) {
+	messages = append(messages, openai.ChatCompletionMessage{
+		Role: openai.ChatMessageRoleUser, Content: model.ConversationCommandResult(output)})
+
+	resp, err := client.svc.CreateChatCompletion(
+		ctx,
+		openai.ChatCompletionRequest{
+			Model:    openai.GPT4,
+			Messages: messages,
+		},
+	)
+
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return resp.Choices[0].Message.Content, nil
+}
+
+// ClassifyMessage takes a user message, a list of categories, and uses the AI mode as a zero shot classifier.
+func (client *Client) ClassifyMessage(ctx context.Context, message string, classes map[string]string) (string, error) {
+	resp, err := client.svc.CreateChatCompletion(
+		ctx,
+		openai.ChatCompletionRequest{
+			Model: openai.GPT4,
+			Messages: []openai.ChatCompletionMessage{
+				{Role: openai.ChatMessageRoleSystem, Content: model.MessageClassificationPrompt(classes)},
 				{Role: openai.ChatMessageRoleUser, Content: message},
 			},
 		},
diff --git a/lib/ai/embedding.go b/lib/ai/embedding.go
new file mode 100644
index 0000000000000..c145024256593
--- /dev/null
+++ b/lib/ai/embedding.go
@@ -0,0 +1,155 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ai
+
+import (
+	"context"
+	"crypto/sha256"
+
+	"github.com/gravitational/trace"
+	"github.com/sashabaranov/go-openai"
+
+	embeddingpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/embedding/v1"
+	"github.com/gravitational/teleport/lib/backend"
+)
+
+const (
+	maxOpenAIEmbeddingsPerRequest = 1000
+)
+
+// EmbeddingHash is the hash function that should be used to compute embedding
+// hashes.
+var EmbeddingHash = sha256.Sum256
+
+// Sha256Hash is the hash of the embedded content. This hash allows to detect if
+// the embedding is still up-to-date or if the content changed and the resource
+// must be re-embedded.
+type Sha256Hash = [sha256.Size]byte
+
+// Vector32 is an array of float64 that contains the result of the
+// embedding process. OpenAI client returns []float32, hence Vector32 is the
+// main type for handling vector data.
+type Vector32 = []float32
+
+// Vector64 is an array of float64 that contains the result of the embedding
+// process. While OpenAI returns us 32-bit floats, the vector index uses methods
+// requiring 64-bit floats.
+type Vector64 = []float64
+
+// Embedding contains a Teleport resource embedding. Embeddings are small semantic
+// representations of larger and more complex data. Embeddings can be compared,
+// the smaller the distance between two vectors, the closer the concepts are.
+// Teleport Assist embeds resources to perform semantic search.
+// The Embedding is named after the embedded resource id and kind. For example
+// the SSH node "bastion-01" has the embedding "node/bastion-01".
+type Embedding embeddingpb.Embedding
+
+// GetEmbeddedKind returns the kind of the resource that was embedded.
+func (e *Embedding) GetEmbeddedKind() string {
+	return e.EmbeddedKind
+}
+
+// GetName returns the Embedding name, composed of the embedded resource kind
+// and the embedded resource ID.
+func (e *Embedding) GetName() string {
+	return e.EmbeddedKind + string(backend.Separator) + e.EmbeddedId
+}
+
+// GetEmbeddedID returns the ID of the resource that was embedded.
+func (e *Embedding) GetEmbeddedID() string {
+	return e.EmbeddedId
+}
+
+// GetVector returns the embedding vector
+func (e *Embedding) GetVector() Vector64 {
+	return e.Vector
+}
+
+// NewEmbedding is an Embedding constructor.
+func NewEmbedding(kind, id string, vector Vector64, hash Sha256Hash) *Embedding {
+	return &Embedding{
+		EmbeddedKind: kind,
+		EmbeddedId:   id,
+		EmbeddedHash: hash[:],
+		Vector:       vector,
+	}
+}
+
+// Embedder is implemented for batch text embedding. Embedding can happen in
+// place (with an embedding model, for example) or be done by a remote embedding
+// service like OpenAI.
+type Embedder interface {
+	// ComputeEmbeddings computes the embeddings of multiple strings.
+	// The embedding list follows the input order (e.g., result[i] is the
+	// embedding of input[i]).
+	ComputeEmbeddings(ctx context.Context, input []string) ([]Vector64, error)
+}
+
+// ComputeEmbeddings taxes a map of nodes and calls openAI to generate
+// embeddings for those nodes. ComputeEmbeddings is responsible for
+// implementing a retry mechanism if the embedding computation is flaky.
+func (client *Client) ComputeEmbeddings(ctx context.Context, input []string) ([]Vector64, error) {
+	var results []Vector64
+	for i := 0; maxOpenAIEmbeddingsPerRequest*i < len(input); i++ {
+		result, err := client.computeEmbeddings(ctx, paginateInput(input, i, maxOpenAIEmbeddingsPerRequest))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		for _, vector := range result {
+			results = append(results, vector32to64(vector))
+		}
+	}
+	return results, nil
+}
+
+func paginateInput(input []string, page, pageSize int) []string {
+	begin := page * pageSize
+	var end int
+	if len(input) < (page+1)*pageSize {
+		end = len(input)
+	} else {
+		end = (page + 1) * pageSize
+	}
+	return input[begin:end]
+}
+
+func vector32to64(vector32 Vector32) Vector64 {
+	vector64 := make(Vector64, len(vector32))
+	for i, dimension := range vector32 {
+		vector64[i] = float64(dimension)
+	}
+	return vector64
+}
+
+// computeEmbeddings calls the openAI embedding model with the provided input.
+// This function should not be called directly, use ComputeEmbeddings instead
+// to ensure input is properly batched.
+func (client *Client) computeEmbeddings(ctx context.Context, input []string) ([]Vector32, error) {
+	req := openai.EmbeddingRequest{
+		Input: input,
+		Model: openai.AdaEmbeddingV2,
+	}
+
+	// Execute the query
+	resp, err := client.svc.CreateEmbeddings(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	result := make([]Vector32, len(input))
+	for i, item := range resp.Data {
+		result[i] = item.Embedding
+	}
+	return result, nil
+}
diff --git a/lib/ai/embeddings.go b/lib/ai/embeddings.go
new file mode 100644
index 0000000000000..3e8f0a21298db
--- /dev/null
+++ b/lib/ai/embeddings.go
@@ -0,0 +1,345 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package ai
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/sirupsen/logrus"
+	"google.golang.org/protobuf/proto"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/api/defaults"
+	embeddingpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/embedding/v1"
+	"github.com/gravitational/teleport/api/internalutils/stream"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	streamutils "github.com/gravitational/teleport/lib/utils/stream"
+)
+
+// maxEmbeddingAPISize is the maximum number of entities that can be embedded in a single API call.
+const maxEmbeddingAPISize = 1000
+
+// Embeddings implements the minimal interface used by the Embedding processor.
+type Embeddings interface {
+	// GetEmbeddings returns all embeddings for a given kind.
+	GetEmbeddings(ctx context.Context, kind string) stream.Stream[*Embedding]
+	// UpsertEmbedding creates or update a single ai.Embedding in the backend.
+	UpsertEmbedding(ctx context.Context, embedding *Embedding) (*Embedding, error)
+}
+
+// NodesStreamGetter is a service that gets nodes.
+type NodesStreamGetter interface {
+	// GetNodeStream returns a list of registered servers.
+	GetNodeStream(ctx context.Context, namespace string) stream.Stream[types.Server]
+}
+
+// MarshalEmbedding marshals the ai.Embedding resource to binary ProtoBuf.
+func MarshalEmbedding(embedding *Embedding) ([]byte, error) {
+	data, err := proto.Marshal((*embeddingpb.Embedding)(embedding))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return data, nil
+}
+
+// UnmarshalEmbedding unmarshals binary ProtoBuf into an ai.Embedding resource.
+func UnmarshalEmbedding(bytes []byte) (*Embedding, error) {
+	if len(bytes) == 0 {
+		return nil, trace.BadParameter("missing embedding data")
+	}
+	var embedding embeddingpb.Embedding
+	err := proto.Unmarshal(bytes, &embedding)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return (*Embedding)(&embedding), nil
+}
+
+// EmbeddingHashMatches returns true if the hash of the embedding matches the
+// given hash.
+func EmbeddingHashMatches(embedding *Embedding, hash Sha256Hash) bool {
+	if len(embedding.EmbeddedHash) != 32 {
+		return false
+	}
+
+	return *(*Sha256Hash)(embedding.EmbeddedHash) == hash
+}
+
+// SerializeNode converts a type.Server into text ready to be fed to an
+// embedding model. The YAML serialization function was chosen over JSON and
+// CSV as it provided better results.
+func SerializeNode(node types.Server) ([]byte, error) {
+	a := struct {
+		Name    string            `yaml:"name"`
+		Kind    string            `yaml:"kind"`
+		SubKind string            `yaml:"subkind"`
+		Labels  map[string]string `yaml:"labels"`
+	}{
+		// Create artificial Name file for the node "name". Using node.GetName() as Name seems to confuse the model.
+		Name:    node.GetHostname(),
+		Kind:    types.KindNode,
+		SubKind: node.GetSubKind(),
+		Labels:  node.GetAllLabels(),
+	}
+	text, err := yaml.Marshal(&a)
+	return text, trace.Wrap(err)
+}
+
+// BatchReducer is a helper that processes data in batches.
+type BatchReducer[T, V any] struct {
+	data      []T
+	batchSize int
+	processFn func(ctx context.Context, data []T) (V, error)
+}
+
+// NewBatchReducer is a BatchReducer constructor.
+func NewBatchReducer[T, V any](processFn func(ctx context.Context, data []T) (V, error), batchSize int) *BatchReducer[T, V] {
+	return &BatchReducer[T, V]{
+		data:      make([]T, 0),
+		batchSize: batchSize,
+		processFn: processFn,
+	}
+}
+
+// Add adds a new item to the batch. If the batch is full, it will be processed
+// and the result will be returned. Otherwise, a zero value will be returned.
+// Finalize must be called to process the remaining data in the batch.
+func (b *BatchReducer[T, V]) Add(ctx context.Context, data T) (V, error) {
+	b.data = append(b.data, data)
+	if len(b.data) >= b.batchSize {
+		val, err := b.processFn(ctx, b.data)
+		b.data = b.data[:0]
+		return val, trace.Wrap(err)
+	}
+
+	var def V
+	return def, nil
+}
+
+// Finalize processes the remaining data in the batch and returns the result.
+func (b *BatchReducer[T, V]) Finalize(ctx context.Context) (V, error) {
+	if len(b.data) > 0 {
+		val, err := b.processFn(ctx, b.data)
+		b.data = b.data[:0]
+		return val, trace.Wrap(err)
+	}
+
+	var def V
+	return def, nil
+}
+
+// EmbeddingProcessorConfig is the configuration for EmbeddingProcessor.
+type EmbeddingProcessorConfig struct {
+	AIClient            Embedder
+	EmbeddingSrv        Embeddings
+	EmbeddingsRetriever *SimpleRetriever
+	NodeSrv             NodesStreamGetter
+	Log                 logrus.FieldLogger
+	Jitter              retryutils.Jitter
+}
+
+// EmbeddingProcessor is responsible for processing nodes, generating embeddings
+// and storing their embeddings in the backend.
+type EmbeddingProcessor struct {
+	aiClient            Embedder
+	embeddingSrv        Embeddings
+	embeddingsRetriever *SimpleRetriever
+	nodeSrv             NodesStreamGetter
+	log                 logrus.FieldLogger
+	jitter              retryutils.Jitter
+}
+
+// NewEmbeddingProcessor returns a new EmbeddingProcessor.
+func NewEmbeddingProcessor(cfg *EmbeddingProcessorConfig) *EmbeddingProcessor {
+	return &EmbeddingProcessor{
+		aiClient:            cfg.AIClient,
+		embeddingSrv:        cfg.EmbeddingSrv,
+		embeddingsRetriever: cfg.EmbeddingsRetriever,
+		nodeSrv:             cfg.NodeSrv,
+		log:                 cfg.Log,
+		jitter:              cfg.Jitter,
+	}
+}
+
+// nodeStringPair is a helper struct that pairs a node with a data string.
+type nodeStringPair struct {
+	node types.Server
+	data string
+}
+
+// mapProcessFn is a helper function that maps a slice of nodeStringPair,
+// compute embeddings and return them as a slice of ai.Embedding.
+func (e *EmbeddingProcessor) mapProcessFn(ctx context.Context, data []*nodeStringPair) ([]*Embedding, error) {
+	dataBatch := make([]string, 0, len(data))
+	for _, pair := range data {
+		dataBatch = append(dataBatch, pair.data)
+	}
+
+	embeddings, err := e.aiClient.ComputeEmbeddings(ctx, dataBatch)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	results := make([]*Embedding, 0, len(embeddings))
+	for i, embedding := range embeddings {
+		emb := NewEmbedding(types.KindNode,
+			data[i].node.GetName(), embedding,
+			EmbeddingHash([]byte(data[i].data)),
+		)
+		results = append(results, emb)
+	}
+
+	return results, nil
+}
+
+// Run runs the EmbeddingProcessor.
+func (e *EmbeddingProcessor) Run(ctx context.Context, initialDelay, period time.Duration) error {
+	initTimer := time.NewTimer(initialDelay)
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-initTimer.C:
+			// Stop the timer after the initial delay.
+			initTimer.Stop()
+			e.process(ctx)
+		case <-time.After(e.jitter(period)):
+			e.process(ctx)
+		}
+	}
+}
+
+func (e *EmbeddingProcessor) process(ctx context.Context) {
+	batch := NewBatchReducer(e.mapProcessFn,
+		maxEmbeddingAPISize, // Max batch size allowed by OpenAI API,
+	)
+
+	e.log.Debugf("embedding processor started")
+	defer e.log.Debugf("embedding processor finished")
+
+	embeddingsStream := e.embeddingSrv.GetEmbeddings(ctx, types.KindNode)
+	nodesStream := e.nodeSrv.GetNodeStream(ctx, defaults.Namespace)
+
+	s := streamutils.NewZipStreams(
+		nodesStream,
+		embeddingsStream,
+		// On new node callback. Add the node to the batch.
+		func(node types.Server) error {
+			nodeData, err := SerializeNode(node)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			vectors, err := batch.Add(ctx, &nodeStringPair{node, string(nodeData)})
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			if err := e.upsertEmbeddings(ctx, vectors); err != nil {
+				return trace.Wrap(err)
+			}
+
+			return nil
+		},
+		// On equal node callback. Check if the node's embedding hash matches
+		// the one in the backend. If not, add the node to the batch.
+		func(node types.Server, embedding *Embedding) error {
+			nodeData, err := SerializeNode(node)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			nodeHash := EmbeddingHash(nodeData)
+
+			if !EmbeddingHashMatches(embedding, nodeHash) {
+				vectors, err := batch.Add(ctx, &nodeStringPair{node, string(nodeData)})
+				if err != nil {
+					return trace.Wrap(err)
+				}
+				if err := e.upsertEmbeddings(ctx, vectors); err != nil {
+					return trace.Wrap(err)
+				}
+			}
+			return nil
+		},
+		// On compare keys callback. Compare the keys for iteration.
+		func(node types.Server, embeddings *Embedding) int {
+			if node.GetName() == embeddings.GetName() {
+				return 0
+			}
+
+			return strings.Compare(node.GetName(), embeddings.GetName())
+		},
+	)
+
+	if err := s.Process(); err != nil {
+		e.log.Warnf("Failed to generate nodes embedding: %v", err)
+	}
+
+	// Process the remaining nodes in the batch
+	vectors, err := batch.Finalize(ctx)
+	if err != nil {
+		e.log.Warnf("Failed to add node to batch: %v", err)
+		return
+	}
+
+	if err := e.upsertEmbeddings(ctx, vectors); err != nil {
+		e.log.Warnf("Failed to upsert embeddings: %v", err)
+
+	}
+
+	if err := e.updateMemIndex(ctx); err != nil {
+		e.log.Warnf("Failed to update memory index: %v", err)
+	}
+}
+
+// updateMemIndex is a helper function that updates the in-memory index with the
+// latest embeddings. The new index is created and then swapped with the old one.
+func (e *EmbeddingProcessor) updateMemIndex(ctx context.Context) error {
+	embeddingsIndex := NewSimpleRetriever()
+	embeddingsStream := e.embeddingSrv.GetEmbeddings(ctx, types.KindNode)
+
+	for embeddingsStream.Next() {
+		embedding := embeddingsStream.Item()
+		if !embeddingsIndex.Insert(embedding.GetEmbeddedID(), embedding) {
+			e.log.Warnf("Embeddings index is full, some resources can be missing")
+			break
+		}
+	}
+
+	if err := embeddingsStream.Done(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	e.embeddingsRetriever.Swap(embeddingsIndex)
+
+	return nil
+}
+
+// upsertEmbeddings is a helper function that upserts the embeddings into the backend.
+func (e *EmbeddingProcessor) upsertEmbeddings(ctx context.Context, rawEmbeddings []*Embedding) error {
+	// Store the new embeddings into the backend
+	for _, embedding := range rawEmbeddings {
+		_, err := e.embeddingSrv.UpsertEmbedding(ctx, embedding)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+	return nil
+}
diff --git a/lib/ai/embeddings_test.go b/lib/ai/embeddings_test.go
new file mode 100644
index 0000000000000..c2c369ad05c22
--- /dev/null
+++ b/lib/ai/embeddings_test.go
@@ -0,0 +1,258 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package ai_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/internalutils/stream"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/ai"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/services/local"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// MockEmbedder returns embeddings based on the sha256 hash function. Those
+// embeddings have no semantic meaning but ensure different embedded content
+// provides different embeddings.
+type MockEmbedder struct{}
+
+func (m MockEmbedder) ComputeEmbeddings(_ context.Context, input []string) ([]ai.Vector64, error) {
+	result := make([]ai.Vector64, len(input))
+	for i, text := range input {
+		hash := sha256.Sum256([]byte(text))
+		vector := make(ai.Vector64, len(hash))
+		for j, x := range hash {
+			vector[j] = 1 / float64(int(x)+1)
+		}
+		result[i] = vector
+	}
+	return result, nil
+}
+
+func TestNodeEmbeddingGeneration(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	clock := clockwork.NewFakeClock()
+
+	// Test setup: crate a backend, presence service, the node watcher and
+	// the embeddings service.
+	bk, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clock,
+	})
+	require.NoError(t, err)
+
+	embedder := MockEmbedder{}
+	presence := local.NewPresenceService(bk)
+	embeddings := local.NewEmbeddingsService(bk)
+
+	processor := ai.NewEmbeddingProcessor(&ai.EmbeddingProcessorConfig{
+		AIClient:            &embedder,
+		EmbeddingSrv:        embeddings,
+		EmbeddingsRetriever: ai.NewSimpleRetriever(),
+		NodeSrv:             presence,
+		Log:                 utils.NewLoggerForTests(),
+		Jitter:              retryutils.NewSeventhJitter(),
+	})
+
+	done := make(chan struct{})
+	go func() {
+		err := processor.Run(ctx, 100*time.Millisecond, time.Second)
+		assert.ErrorIs(t, context.Canceled, err)
+		close(done)
+	}()
+
+	// Add some node servers.
+	const numNodes = 5
+	nodes := make([]types.Server, 0, numNodes)
+	for i := 0; i < numNodes; i++ {
+		node, _ := types.NewServer(fmt.Sprintf("node%d", i), types.KindNode, types.ServerSpecV2{
+			Addr:     "127.0.0.1:1234",
+			Hostname: fmt.Sprintf("node%d", i),
+			CmdLabels: map[string]types.CommandLabelV2{
+				"version":  {Result: "v8"},
+				"hostname": {Result: fmt.Sprintf("node%d.example.com", i)},
+			},
+		})
+		_, err = presence.UpsertNode(ctx, node)
+		require.NoError(t, err)
+		nodes = append(nodes, node)
+	}
+
+	require.Eventually(t, func() bool {
+		items, err := stream.Collect(embeddings.GetEmbeddings(ctx, types.KindNode))
+		assert.NoError(t, err)
+		return (len(items) == numNodes) && (len(nodes) == numNodes)
+	}, 7*time.Second, 200*time.Millisecond)
+
+	cancel()
+
+	waitForDone(t, done, "timed out waiting for processor to stop")
+
+	validateEmbeddings(t,
+		presence.GetNodeStream(ctx, defaults.Namespace),
+		embeddings.GetEmbeddings(ctx, types.KindNode))
+}
+
+func TestMarshallUnmarshallEmbedding(t *testing.T) {
+	// We test that float precision is above six digits
+	initial := ai.NewEmbedding(types.KindNode, "foo", ai.Vector64{0.1234567, 1, 1}, sha256.Sum256([]byte("test")))
+
+	marshaled, err := ai.MarshalEmbedding(initial)
+	require.NoError(t, err)
+
+	final, err := ai.UnmarshalEmbedding(marshaled)
+	require.NoError(t, err)
+
+	require.Equal(t, initial.EmbeddedId, final.EmbeddedId)
+	require.Equal(t, initial.EmbeddedKind, final.EmbeddedKind)
+	require.Equal(t, initial.EmbeddedHash, final.EmbeddedHash)
+	require.Equal(t, initial.Vector, final.Vector)
+}
+
+func waitForDone(t *testing.T, done chan struct{}, errMsg string) {
+	t.Helper()
+
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatal(errMsg)
+	}
+}
+
+func validateEmbeddings(t *testing.T, nodesStream stream.Stream[types.Server], embeddingsStream stream.Stream[*ai.Embedding]) {
+	t.Helper()
+
+	nodes, err := stream.Collect(nodesStream)
+	require.NoError(t, err)
+
+	embeddings, err := stream.Collect(embeddingsStream)
+	require.NoError(t, err)
+
+	require.Equal(t, len(nodes), len(embeddings), "Number of nodes and embeddings should be equal")
+
+	for i, node := range nodes {
+		emb := embeddings[i]
+
+		require.Equal(t, node.GetName(), emb.GetEmbeddedID(), "Node ID and embedding ID should be equal")
+		require.Equal(t, types.KindNode, emb.GetEmbeddedKind(), "Node kind and embedding kind should be equal")
+	}
+}
+
+func Test_batchReducer_Add(t *testing.T) {
+	t.Parallel()
+
+	// Sum process function - used for simplicity
+	sumFn := func(ctx context.Context, data []int) (int, error) {
+		sum := 0
+		for _, d := range data {
+			sum += d
+		}
+		return sum, nil
+	}
+
+	type testCase struct {
+		// Test case name
+		name string
+		// Process batch size
+		batchSize int
+		// Input data
+		data []int
+		// Function to process batch
+		processFn func(ctx context.Context, data []int) (int, error)
+		// Expected result on Add
+		want []int
+		// Expected result on Finalize
+		finalizeResult int
+		// Expected error
+		wantErr assert.ErrorAssertionFunc
+	}
+
+	tests := []testCase{
+		{
+			name:           "empty",
+			batchSize:      100,
+			data:           []int{},
+			want:           []int{},
+			finalizeResult: 0,
+			processFn:      sumFn,
+			wantErr:        assert.NoError,
+		},
+		{
+			name:           "one element",
+			batchSize:      100,
+			data:           []int{1},
+			want:           []int{0},
+			finalizeResult: 1,
+			processFn:      sumFn,
+			wantErr:        assert.NoError,
+		},
+		{
+			name:           "many elements",
+			batchSize:      3,
+			data:           []int{1, 1, 1, 1},
+			want:           []int{0, 0, 3, 0},
+			finalizeResult: 1,
+			processFn:      sumFn,
+			wantErr:        assert.NoError,
+		},
+		{
+			name:      "propagate error",
+			batchSize: 2,
+			data:      []int{0},
+			want:      []int{0},
+			processFn: func(ctx context.Context, data []int) (int, error) {
+				return 0, errors.New("error")
+			},
+			wantErr: assert.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			br := ai.NewBatchReducer[int, int](tt.processFn, tt.batchSize)
+
+			for i, d := range tt.data {
+				got, err := br.Add(ctx, d)
+				require.NoError(t, err)
+				assert.Equalf(t, tt.want[i], got, "Add(%v)", tt.data)
+			}
+
+			got, err := br.Finalize(ctx)
+			if !tt.wantErr(t, err, fmt.Sprintf("Finalize(%v)", tt.data)) {
+				return
+			}
+			assert.Equalf(t, tt.finalizeResult, got, "Finalize(%v)", tt.data)
+		})
+	}
+}
diff --git a/lib/ai/knnretriever.go b/lib/ai/knnretriever.go
new file mode 100644
index 0000000000000..e427510994f3f
--- /dev/null
+++ b/lib/ai/knnretriever.go
@@ -0,0 +1,129 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package ai
+
+import (
+	"github.com/gravitational/trace"
+	"github.com/kyroy/kdtree"
+)
+
+// Document is a embedding enriched with similarity score
+type Document struct {
+	*Embedding
+	SimilarityScore float64
+}
+
+// Dimensions returns the number of dimensions of the embedding
+// Implements kdtree.Point interface
+func (e *Embedding) Dimensions() int {
+	return len(e.Vector)
+}
+
+// Dimension returns the value of the i-th dimension
+// Implements kdtree.Point interface
+func (e *Embedding) Dimension(i int) float64 {
+	return e.Vector[i]
+}
+
+// KNNRetriever is a retriever that uses KNN to find relevant documents.
+type KNNRetriever struct {
+	tree    *kdtree.KDTree
+	mapping map[string]*Embedding
+	// vectorsDimension is the dimension of the vectors.
+	// All vectors must have the same dimension.
+	vectorsDimension int
+}
+
+// NewKNNRetriever returns a new KNNRetriever. It expects that all points
+// have the same dimension and all vectors are normalized.
+func NewKNNRetriever(points []*Embedding) (*KNNRetriever, error) {
+	if len(points) == 0 {
+		return nil, trace.BadParameter("no points provided")
+	}
+	expectedDimension := points[0].Dimensions()
+	kpoints := make([]kdtree.Point, len(points))
+	mapping := make(map[string]*Embedding, len(points))
+	for i, point := range points {
+		// Make sure that all points have the same dimension
+		if point.Dimensions() != expectedDimension {
+			return nil, trace.BadParameter("all points must have the same dimension")
+		}
+		kpoints[i] = point
+		mapping[point.GetName()] = point
+	}
+
+	return &KNNRetriever{
+		tree:             kdtree.New(kpoints),
+		mapping:          mapping,
+		vectorsDimension: expectedDimension,
+	}, nil
+}
+
+// GetRelevant returns the k most relevant documents to the query
+func (r *KNNRetriever) GetRelevant(query *Embedding, k int) []*Document {
+	result := r.tree.KNN(query, k)
+	relevant := make([]*Document, len(result))
+	for i, item := range result {
+		embedding := item.(*Embedding)
+		// Ignore error. We've already checked that all points have the same dimension
+		similarity, _ := calculateSimilarity(query.Vector, embedding.Vector)
+
+		relevant[i] = &Document{
+			Embedding:       embedding,
+			SimilarityScore: similarity,
+		}
+	}
+	return relevant
+}
+
+// Insert inserts a new point into the retriever
+func (r *KNNRetriever) Insert(point *Embedding) error {
+	if point.Dimensions() != r.vectorsDimension {
+		return trace.BadParameter("point has wrong dimension")
+	}
+	r.tree.Insert(point)
+	r.mapping[point.GetName()] = point
+
+	return nil
+}
+
+// Remove removes an element from the retriever
+func (r *KNNRetriever) Remove(name string) error {
+	point, ok := r.mapping[name]
+	if !ok {
+		return trace.BadParameter("point %q not found", name)
+	}
+
+	delete(r.mapping, name)
+	r.tree.Remove(kdtree.Point(point))
+
+	return nil
+}
+
+// calculateSimilarity calculates the dot product/similarity between two normalized vectors.
+func calculateSimilarity(v1, v2 []float64) (float64, error) {
+	if len(v1) != len(v2) {
+		return 0, trace.BadParameter("vectors must be the same length")
+	}
+
+	var result float64
+	for i, val := range v1 {
+		result += val * v2[i]
+	}
+
+	return result, nil
+}
diff --git a/lib/ai/knnretriever_test.go b/lib/ai/knnretriever_test.go
new file mode 100644
index 0000000000000..20c0d52774b26
--- /dev/null
+++ b/lib/ai/knnretriever_test.go
@@ -0,0 +1,142 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package ai
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"math"
+	"math/rand"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestKNNRetriever_GetRelevant(t *testing.T) {
+	t.Parallel()
+
+	// Generate random vector. The seed is fixed, so the results are deterministic.
+	randGen := rand.New(rand.NewSource(42))
+
+	generateVector := func() Vector64 {
+		const testVectorDimension = 100
+		// generate random vector
+		// reduce the dimensionality to 100
+		vec := make(Vector64, testVectorDimension)
+		for i := 0; i < testVectorDimension; i++ {
+			vec[i] = randGen.Float64()
+		}
+		// normalize vector, so the simiarity between two vectors is the dot product
+		// between [0, 1]
+		return normalize(vec)
+	}
+
+	const testEmbeddingsSize = 100
+	points := make([]*Embedding, testEmbeddingsSize)
+	for i := 0; i < testEmbeddingsSize; i++ {
+		points[i] = NewEmbedding(types.KindNode, strconv.Itoa(i), generateVector(), sha256.Sum256([]byte{byte(i)}))
+	}
+
+	// Create a query.
+	query := NewEmbedding(types.KindNode, "1", generateVector(), sha256.Sum256([]byte("1")))
+
+	retriever, err := NewKNNRetriever(points)
+	require.NoError(t, err)
+
+	// Get the top 10 most similar documents.
+	docs := retriever.GetRelevant(query, 10)
+	require.Len(t, docs, 10)
+
+	expectedResults := []int{57, 92, 95, 49, 33, 56, 30, 99, 90, 47}
+	expectedSimilarities := []float64{0.80405, 0.79051, 0.78161, 0.78159,
+		0.77655, 0.77374, 0.77306, 0.76688, 0.76634, 0.76458}
+
+	for i, result := range docs {
+		require.Equal(t,
+			fmt.Sprintf("%s/%s", types.KindNode, strconv.Itoa(expectedResults[i])),
+			result.GetName(), "expected order is wrong")
+		require.InDelta(t, expectedSimilarities[i], result.SimilarityScore, 10e-6, "similarity score is wrong")
+	}
+}
+
+func TestKNNRetriever_Insert(t *testing.T) {
+	t.Parallel()
+
+	points := []*Embedding{
+		NewEmbedding(types.KindNode, "1", Vector64{1, 2, 3}, sha256.Sum256([]byte("1"))),
+		NewEmbedding(types.KindNode, "2", Vector64{4, 5, 6}, sha256.Sum256([]byte("2"))),
+	}
+
+	retriever, err := NewKNNRetriever(points)
+	require.NoError(t, err)
+
+	newEmbedding := NewEmbedding(types.KindNode, "3", Vector64{7, 8, 9}, sha256.Sum256([]byte("3")))
+	docs1 := retriever.GetRelevant(newEmbedding, 10)
+	require.Len(t, docs1, 2)
+
+	err = retriever.Insert(newEmbedding)
+	require.NoError(t, err)
+
+	docs2 := retriever.GetRelevant(newEmbedding, 10)
+	require.Len(t, docs2, 3)
+}
+
+func TestKNNRetriever_Remove(t *testing.T) {
+	t.Parallel()
+
+	points := []*Embedding{
+		NewEmbedding(types.KindNode, "1", Vector64{1, 2, 3}, sha256.Sum256([]byte("1"))),
+		NewEmbedding(types.KindNode, "2", Vector64{4, 5, 6}, sha256.Sum256([]byte("2"))),
+		NewEmbedding(types.KindNode, "3", Vector64{7, 8, 9}, sha256.Sum256([]byte("3"))),
+	}
+
+	retriever, err := NewKNNRetriever(points)
+	require.NoError(t, err)
+
+	query := NewEmbedding(types.KindNode, "3", Vector64{7, 8, 9}, sha256.Sum256([]byte("3")))
+	docs1 := retriever.GetRelevant(query, 10)
+
+	require.Len(t, docs1, 3)
+
+	err = retriever.Remove("node/2")
+	require.NoError(t, err)
+
+	docs2 := retriever.GetRelevant(query, 10)
+	require.Len(t, docs2, 2)
+}
+
+// Function to calculate L2 norm
+func L2norm(v []float64) float64 {
+	sum := 0.0
+	for _, value := range v {
+		sum += value * value
+	}
+	return math.Sqrt(sum)
+}
+
+// Function to normalize vector using L2 norm
+func normalize(v Vector64) Vector64 {
+	norm := L2norm(v)
+	result := make(Vector64, len(v))
+	for i, value := range v {
+		result[i] = value / norm
+	}
+	return result
+}
diff --git a/lib/ai/messages.go b/lib/ai/messages.go
deleted file mode 100644
index 8d5bd9c73df97..0000000000000
--- a/lib/ai/messages.go
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Copyright 2023 Gravitational, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package ai
-
-// Message represents a message within a live conversation.
-// Indexed by ID for frontend ordering and future partial message streaming.
-type Message struct {
-	Role    string `json:"role"`
-	Content string `json:"content"`
-	Idx     int    `json:"idx"`
-	// NumTokens is the number of completion tokens for the (non-streaming) message
-	NumTokens int `json:"-"`
-}
-
-// Label represents a label returned by OpenAI's completion API.
-type Label struct {
-	Key   string `json:"key"`
-	Value string `json:"value"`
-}
-
-// CompletionCommand represents a command returned by OpenAI's completion API.
-type CompletionCommand struct {
-	Command string   `json:"command,omitempty"`
-	Nodes   []string `json:"nodes,omitempty"`
-	Labels  []Label  `json:"labels,omitempty"`
-	// NumTokens is the number of completion tokens for the (non-streaming) message
-	NumTokens int `json:"-"`
-}
-
-// StreamingMessage represents a message that is streamed from the assistant and will later be stored as a normal message in the conversation store.
-type StreamingMessage struct {
-	// Role describes the OpenAI role of the message, i.e its sender.
-	Role string
-
-	// Idx is a semi-unique ID assigned when loading a conversation so that the UI can group partial messages together.
-	Idx int
-
-	// Chunks is a channel of message chunks that are streamed from the assistant.
-	Chunks <-chan string
-
-	// Error is a channel which may receive one error if the assistant encounters an error while streaming.
-	// Consumers should stop reading from all channels if they receive an error and abort.
-	Error <-chan error
-}
diff --git a/lib/ai/model/agent.go b/lib/ai/model/agent.go
new file mode 100644
index 0000000000000..a0cade5fda335
--- /dev/null
+++ b/lib/ai/model/agent.go
@@ -0,0 +1,400 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package model
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/sashabaranov/go-openai"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/gravitational/teleport/api/gen/proto/go/assist/v1"
+)
+
+const (
+	// The internal name used to create actions when the agent encounters an error, such as when parsing output.
+	actionException = "_Exception"
+
+	// The maximum amount of thought<-> observation iterations the agent is allowed to perform.
+	maxIterations = 15
+
+	// The maximum amount of time the agent is allowed to spend before yielding a final answer.
+	maxElapsedTime = 5 * time.Minute
+
+	// The special header the LLM has to respond with to indicate it's done.
+	finalResponseHeader = "<FINAL RESPONSE>"
+)
+
+// NewAgent creates a new agent. The Assist agent which defines the model responsible for the Assist feature.
+func NewAgent(assistClient assist.AssistEmbeddingServiceClient, username string) *Agent {
+	return &Agent{
+		tools: []Tool{
+			&commandExecutionTool{},
+			&embeddingRetrievalTool{
+				assistClient: assistClient,
+				currentUser:  username,
+			},
+		},
+	}
+}
+
+// Agent is a model storing static state which defines some properties of the chat model.
+type Agent struct {
+	tools []Tool
+}
+
+// AgentAction is an event type representing the decision to take a single action, typically a tool invocation.
+type AgentAction struct {
+	// The action to take, typically a tool name.
+	Action string `json:"action"`
+
+	// The input to the action, varies depending on the action.
+	Input string `json:"input"`
+
+	// The log is either a direct tool response or a thought prompt correlated to the input.
+	Log string `json:"log"`
+
+	// The reasoning is a string describing the reasoning behind the action.
+	Reasoning string `json:"reasoning"`
+}
+
+// agentFinish is an event type representing the decision to finish a thought
+// loop and return a final text answer to the user.
+type agentFinish struct {
+	// output must be Message, StreamingMessage or CompletionCommand
+	output any
+}
+
+type executionState struct {
+	llm               *openai.Client
+	chatHistory       []openai.ChatCompletionMessage
+	humanMessage      openai.ChatCompletionMessage
+	intermediateSteps []AgentAction
+	observations      []string
+	tokensUsed        *TokensUsed
+}
+
+// PlanAndExecute runs the agent with a given input until it arrives at a text answer it is satisfied
+// with or until it times out.
+func (a *Agent) PlanAndExecute(ctx context.Context, llm *openai.Client, chatHistory []openai.ChatCompletionMessage, humanMessage openai.ChatCompletionMessage, progressUpdates func(*AgentAction)) (any, error) {
+	log.Trace("entering agent think loop")
+	iterations := 0
+	start := time.Now()
+	tookTooLong := func() bool { return iterations > maxIterations || time.Since(start) > maxElapsedTime }
+	tokensUsed := newTokensUsed_Cl100kBase()
+	state := &executionState{
+		llm:               llm,
+		chatHistory:       chatHistory,
+		humanMessage:      humanMessage,
+		intermediateSteps: make([]AgentAction, 0),
+		observations:      make([]string, 0),
+		tokensUsed:        tokensUsed,
+	}
+
+	for {
+		log.Tracef("performing iteration %v of loop, %v seconds elapsed", iterations, int(time.Since(start).Seconds()))
+
+		// This is intentionally not context-based, as we want to finish the current step before exiting
+		// and the concern is not that we're stuck but that we're taking too long over multiple iterations.
+		if tookTooLong() {
+			return nil, trace.Errorf("timeout: agent took too long to finish")
+		}
+
+		output, err := a.takeNextStep(ctx, state, progressUpdates)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if output.finish != nil {
+			log.Tracef("agent finished with output: %#v", output.finish.output)
+			item, ok := output.finish.output.(interface{ SetUsed(data *TokensUsed) })
+			if !ok {
+				return nil, trace.Errorf("invalid output type %T", output.finish.output)
+			}
+
+			item.SetUsed(tokensUsed)
+
+			return item, nil
+		}
+
+		if output.action != nil {
+			state.intermediateSteps = append(state.intermediateSteps, *output.action)
+			state.observations = append(state.observations, output.observation)
+		}
+
+		iterations++
+	}
+}
+
+// stepOutput represents the inputs and outputs of a single thought step.
+type stepOutput struct {
+	// if the agent is done, finish is set.
+	finish *agentFinish
+
+	// if the agent is not done, action is set together with observation.
+	action      *AgentAction
+	observation string
+}
+
+func (a *Agent) takeNextStep(ctx context.Context, state *executionState, progressUpdates func(*AgentAction)) (stepOutput, error) {
+	log.Trace("agent entering takeNextStep")
+	defer log.Trace("agent exiting takeNextStep")
+
+	action, finish, err := a.plan(ctx, state)
+	if err, ok := trace.Unwrap(err).(*invalidOutputError); ok {
+		log.Tracef("agent encountered an invalid output error: %v, attempting to recover", err)
+		action := &AgentAction{
+			Action: actionException,
+			Input:  observationPrefix + "Invalid or incomplete response",
+			Log:    thoughtPrefix + err.Error(),
+		}
+
+		// The exception tool is currently a bit special, the observation is always equal to the input.
+		// We can expand on this in the future to make it handle errors better.
+		log.Tracef("agent decided on action %v and received observation %v", action.Action, action.Input)
+		return stepOutput{action: action, observation: action.Input}, nil
+	}
+	if err != nil {
+		log.Tracef("agent encountered an error: %v", err)
+		return stepOutput{}, trace.Wrap(err)
+	}
+
+	// If finish is set, the agent is done and did not call upon any tool.
+	if finish != nil {
+		log.Trace("agent picked finish, returning")
+		return stepOutput{finish: finish}, nil
+	}
+
+	// If action is set, the agent is not done and called upon a tool.
+	progressUpdates(action)
+
+	var tool Tool
+	for _, candidate := range a.tools {
+		if candidate.Name() == action.Action {
+			tool = candidate
+			break
+		}
+	}
+
+	if tool == nil {
+		log.Tracef("agent picked an unknown tool %v", action.Action)
+		action := &AgentAction{
+			Action: actionException,
+			Input:  observationPrefix + "Unknown tool",
+			Log:    fmt.Sprintf("%s No tool with name %s exists.", thoughtPrefix, action.Action),
+		}
+
+		return stepOutput{action: action, observation: action.Input}, nil
+	}
+
+	if tool, ok := tool.(*commandExecutionTool); ok {
+		input, err := tool.parseInput(action.Input)
+		if err != nil {
+			action := &AgentAction{
+				Action: actionException,
+				Input:  observationPrefix + "Invalid or incomplete response",
+				Log:    thoughtPrefix + err.Error(),
+			}
+
+			return stepOutput{action: action, observation: action.Input}, nil
+		}
+
+		completion := &CompletionCommand{
+			TokensUsed: newTokensUsed_Cl100kBase(),
+			Command:    input.Command,
+			Nodes:      input.Nodes,
+			Labels:     input.Labels,
+		}
+
+		log.Tracef("agent decided on command execution, let's translate to an agentFinish")
+		return stepOutput{finish: &agentFinish{output: completion}}, nil
+	}
+
+	runOut, err := tool.Run(ctx, action.Input)
+	if err != nil {
+		return stepOutput{}, trace.Wrap(err)
+	}
+	return stepOutput{action: action, observation: runOut}, nil
+}
+
+func (a *Agent) plan(ctx context.Context, state *executionState) (*AgentAction, *agentFinish, error) {
+	scratchpad := a.constructScratchpad(state.intermediateSteps, state.observations)
+	prompt := a.createPrompt(state.chatHistory, scratchpad, state.humanMessage)
+	stream, err := state.llm.CreateChatCompletionStream(
+		ctx,
+		openai.ChatCompletionRequest{
+			Model:    openai.GPT4,
+			Messages: prompt,
+			Stream:   true,
+		},
+	)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	deltas := make(chan string)
+	completion := strings.Builder{}
+	go func() {
+		defer close(deltas)
+
+		for {
+			response, err := stream.Recv()
+			if errors.Is(err, io.EOF) {
+				return
+			} else if err != nil {
+				log.Tracef("agent encountered an error while streaming: %v", err)
+				return
+			}
+
+			delta := response.Choices[0].Delta.Content
+			deltas <- delta
+			// TODO(jakule): Fix token counting. Uncommenting the line below causes a race condition.
+			//completion.WriteString(delta)
+		}
+	}()
+
+	action, finish, err := parsePlanningOutput(deltas)
+	state.tokensUsed.AddTokens(prompt, completion.String())
+	return action, finish, trace.Wrap(err)
+}
+
+func (a *Agent) createPrompt(chatHistory, agentScratchpad []openai.ChatCompletionMessage, humanMessage openai.ChatCompletionMessage) []openai.ChatCompletionMessage {
+	prompt := make([]openai.ChatCompletionMessage, 0)
+	prompt = append(prompt, chatHistory...)
+	toolList := strings.Builder{}
+	toolNames := make([]string, 0, len(a.tools))
+	for _, tool := range a.tools {
+		toolNames = append(toolNames, tool.Name())
+		toolList.WriteString("> ")
+		toolList.WriteString(tool.Name())
+		toolList.WriteString(": ")
+		toolList.WriteString(tool.Description())
+		toolList.WriteString("\n")
+	}
+
+	if len(a.tools) == 0 {
+		toolList.WriteString("No tools available.")
+	}
+
+	formatInstructions := conversationParserFormatInstructionsPrompt(toolNames)
+	newHumanMessage := conversationToolUsePrompt(toolList.String(), formatInstructions, humanMessage.Content)
+	prompt = append(prompt, openai.ChatCompletionMessage{
+		Role:    openai.ChatMessageRoleUser,
+		Content: newHumanMessage,
+	})
+
+	prompt = append(prompt, agentScratchpad...)
+	return prompt
+}
+
+func (a *Agent) constructScratchpad(intermediateSteps []AgentAction, observations []string) []openai.ChatCompletionMessage {
+	var thoughts []openai.ChatCompletionMessage
+	for i, action := range intermediateSteps {
+		thoughts = append(thoughts, openai.ChatCompletionMessage{
+			Role:    openai.ChatMessageRoleAssistant,
+			Content: action.Log,
+		}, openai.ChatCompletionMessage{
+			Role:    openai.ChatMessageRoleUser,
+			Content: conversationToolResponse(observations[i]),
+		})
+	}
+
+	return thoughts
+}
+
+// parseJSONFromModel parses a JSON object from the model output and attempts to sanitize contaminant text
+// to avoid triggering self-correction due to some natural language being bundled with the JSON.
+// The output type is generic, and thus the structure of the expected JSON varies depending on T.
+func parseJSONFromModel[T any](text string) (T, *invalidOutputError) {
+	cleaned := strings.TrimSpace(text)
+	if strings.Contains(cleaned, "```json") {
+		cleaned = strings.Split(cleaned, "```json")[1]
+	}
+	if strings.Contains(cleaned, "```") {
+		cleaned = strings.Split(cleaned, "```")[0]
+	}
+	cleaned = strings.TrimPrefix(cleaned, "```json")
+	cleaned = strings.TrimPrefix(cleaned, "```")
+	cleaned = strings.TrimSuffix(cleaned, "```")
+	cleaned = strings.TrimSpace(cleaned)
+	var output T
+	err := json.Unmarshal([]byte(cleaned), &output)
+	if err != nil {
+		return output, newInvalidOutputErrorWithParseError(err)
+	}
+
+	return output, nil
+}
+
+// PlanOutput describes the expected JSON output after asking it to plan its next action.
+type PlanOutput struct {
+	Action      string `json:"action"`
+	ActionInput any    `json:"action_input"`
+	Reasoning   string `json:"reasoning"`
+}
+
+// parsePlanningOutput parses the output of the model after asking it to plan its next action
+// and returns the appropriate event type or an error.
+func parsePlanningOutput(deltas <-chan string) (*AgentAction, *agentFinish, error) {
+	var text string
+	for delta := range deltas {
+		text += delta
+
+		if strings.HasPrefix(text, finalResponseHeader) {
+			parts := make(chan string)
+			go func() {
+				defer close(parts)
+
+				parts <- strings.TrimPrefix(text, finalResponseHeader)
+				for delta := range deltas {
+					parts <- delta
+				}
+			}()
+
+			return nil, &agentFinish{output: &StreamingMessage{Parts: parts, TokensUsed: newTokensUsed_Cl100kBase()}}, nil
+		}
+	}
+
+	log.Tracef("received planning output: \"%v\"", text)
+	if outputString, found := strings.CutPrefix(text, finalResponseHeader); found {
+		return nil, &agentFinish{output: &Message{Content: outputString, TokensUsed: newTokensUsed_Cl100kBase()}}, nil
+	}
+
+	response, err := parseJSONFromModel[PlanOutput](text)
+	if err != nil {
+		log.WithError(err).Trace("failed to parse planning output")
+		return nil, nil, trace.Wrap(err)
+	}
+
+	if v, ok := response.ActionInput.(string); ok {
+		return &AgentAction{Action: response.Action, Input: v}, nil, nil
+	} else {
+		input, err := json.Marshal(response.ActionInput)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+
+		return &AgentAction{Action: response.Action, Input: string(input), Reasoning: response.Reasoning}, nil, nil
+	}
+}
diff --git a/lib/ai/model/error.go b/lib/ai/model/error.go
new file mode 100644
index 0000000000000..c3a3c8fd8d697
--- /dev/null
+++ b/lib/ai/model/error.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package model
+
+import (
+	"fmt"
+)
+
+// invalidOutputError represents an error caused by the output of an LLM.
+// These may be used automatically by the agent loop to attempt to correct an output until it is valid.
+type invalidOutputError struct {
+	coarse string
+	detail string
+}
+
+// newInvalidOutputErrorWithParseError creates a new invalidOutputError assuming a JSON parse error.
+func newInvalidOutputErrorWithParseError(err error) *invalidOutputError {
+	return &invalidOutputError{
+		coarse: "json parse error",
+		detail: err.Error(),
+	}
+}
+
+// Error returns a string representation of the error. This is used to satisfy the error interface.
+func (o *invalidOutputError) Error() string {
+	return fmt.Sprintf("%v: %v", o.coarse, o.detail)
+}
diff --git a/lib/ai/model/messages.go b/lib/ai/model/messages.go
new file mode 100644
index 0000000000000..0c087740e238c
--- /dev/null
+++ b/lib/ai/model/messages.go
@@ -0,0 +1,114 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package model
+
+import (
+	"github.com/gravitational/trace"
+	"github.com/sashabaranov/go-openai"
+	"github.com/tiktoken-go/tokenizer"
+	"github.com/tiktoken-go/tokenizer/codec"
+)
+
+// Ref: https://github.com/openai/openai-cookbook/blob/594fc6c952425810e9ea5bd1a275c8ca5f32e8f9/examples/How_to_count_tokens_with_tiktoken.ipynb
+const (
+	// perMessage is the token "overhead" for each message
+	perMessage = 3
+
+	// perRequest is the number of tokens used up for each completion request
+	perRequest = 3
+
+	// perRole is the number of tokens used to encode a message's role
+	perRole = 1
+)
+
+// Message represents a new message within a live conversation.
+type Message struct {
+	*TokensUsed
+	Content string
+}
+
+// StreamingMessage represents a new message that is being streamed from the LLM.
+type StreamingMessage struct {
+	*TokensUsed
+	Parts <-chan string
+}
+
+// Label represents a label returned by OpenAI's completion API.
+type Label struct {
+	Key   string `json:"key"`
+	Value string `json:"value"`
+}
+
+// CompletionCommand represents a command returned by OpenAI's completion API.
+type CompletionCommand struct {
+	*TokensUsed
+	Command string   `json:"command,omitempty"`
+	Nodes   []string `json:"nodes,omitempty"`
+	Labels  []Label  `json:"labels,omitempty"`
+}
+
+// TokensUsed is used to track the number of tokens used during a single invocation of the agent.
+type TokensUsed struct {
+	tokenizer tokenizer.Codec
+
+	// Prompt is the number of prompt-class tokens used.
+	Prompt int
+
+	// Completion is the number of completion-class tokens used.
+	Completion int
+}
+
+// UsedTokens returns the number of tokens used during a single invocation of the agent.
+// This method creates a convenient way to get TokensUsed from embedded structs.
+func (t *TokensUsed) UsedTokens() *TokensUsed {
+	return t
+}
+
+// newTokensUsed_Cl100kBase creates a new TokensUsed instance with a Cl100kBase tokenizer.
+// This tokenizer is used by GPT-3 and GPT-4.
+func newTokensUsed_Cl100kBase() *TokensUsed {
+	return &TokensUsed{
+		tokenizer:  codec.NewCl100kBase(),
+		Prompt:     0,
+		Completion: 0,
+	}
+}
+
+// AddTokens updates TokensUsed with the tokens used for a single call to an LLM.
+func (t *TokensUsed) AddTokens(prompt []openai.ChatCompletionMessage, completion string) error {
+	for _, message := range prompt {
+		promptTokens, _, err := t.tokenizer.Encode(message.Content)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		t.Prompt = t.Prompt + perMessage + perRole + len(promptTokens)
+	}
+
+	completionTokens, _, err := t.tokenizer.Encode(completion)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	t.Completion = t.Completion + perRequest + len(completionTokens)
+	return err
+}
+
+// SetUsed sets the TokensUsed instance to the given data.
+func (t *TokensUsed) SetUsed(data *TokensUsed) {
+	*t = *data
+}
diff --git a/lib/ai/model/prompt.go b/lib/ai/model/prompt.go
new file mode 100644
index 0000000000000..fd940c6c72773
--- /dev/null
+++ b/lib/ai/model/prompt.go
@@ -0,0 +1,131 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package model
+
+import (
+	"fmt"
+	"strings"
+)
+
+var observationPrefix = "Observation: "
+var thoughtPrefix = "Thought: "
+
+const PromptSummarizeTitle = `You will be given a message. Create a short summary of that message.
+Respond only with summary, nothing else.`
+
+const PromptSummarizeCommand = `You will be given a chat history and a command output. Based on the history context, extract relevant information from the command output and write a short summary of the command output.
+Respond only with summary, nothing else.`
+
+const InitialAIResponse = `Hey, I'm Teleport - a powerful tool that can assist you in managing your Teleport cluster via OpenAI GPT-4.`
+
+func PromptCharacter(username string) string {
+	return fmt.Sprintf(`You are Teleport, a tool that users can use to connect to Linux servers and run relevant commands, as well as have a conversation.
+A Teleport cluster is a connectivity layer that allows access to a set of servers. Servers may also be referred to as nodes.
+Nodes sometimes have labels such as "production" and "staging" assigned to them. Labels are used to group nodes together.
+You will engage in professional conversation with the user and help accomplish tasks such as executing tasks
+within the cluster or answering relevant questions about Teleport, Linux or the cluster itself.
+
+You possess advanced capabilities to think and reason in multiple steps and use the available tools to accomplish the task at hand in a way a human would expect you to.
+
+You are not permitted to engage in conversation that is not related to Teleport, Linux or the cluster itself.
+If this user asks such an unrelated question, you must concisely respond that it is beyond your scope of knowledge.
+
+You are talking to %v.`, username)
+}
+
+func conversationParserFormatInstructionsPrompt(toolnames []string) string {
+	return fmt.Sprintf(`RESPONSE FORMAT INSTRUCTIONS
+----------------------------
+
+When responding to me, please output a response in one of two formats:
+
+**Option 1:**
+Use this if you want the human to use a tool.
+Markdown code snippet formatted in the following schema:
+
+%vjson
+{
+	"action": string \\ The action to take. Must be one of %v
+	"action_input": string \\ The input to the action
+	"reasoning": string \\ Your reasoning for taking this action
+}
+%v
+
+**Option #2:**
+Use this if you want to respond directly to the human or you want to ask the human a question to gather more information.
+You should avoid asking too many questions when you have other options available to you as it may be perceived as annoying.
+But asking is far better than guessing or making assumptions.
+Text with the hardcoded header %v followed by your response as below:
+
+%v
+YOUR RESPONSE HERE`, "```", toolnames, "```", finalResponseHeader, finalResponseHeader,
+	)
+}
+
+func conversationToolUsePrompt(tools string, formatInstructions string, userInput string) string {
+	return fmt.Sprintf(`TOOLS
+------
+Assistant can ask the user to use tools to look up information that may be helpful in answering the users original question. The tools the human can use are:
+
+%v
+
+%v
+
+USER'S INPUT
+--------------------
+Here is the user's input (remember to respond with a markdown code snippet of a json blob with a single action, and NOTHING else):
+
+%v`, tools, formatInstructions, userInput)
+}
+
+func conversationToolResponse(toolResponse string) string {
+	return fmt.Sprintf(`TOOL RESPONSE: 
+---------------------
+
+%v
+
+USER'S INPUT
+--------------------
+
+Okay, so what is the response to my last comment? If using information obtained from the tools you must mention it explicitly without mentioning the tool names - I have forgotten all TOOL RESPONSES! Remember to respond with a markdown code snippet of a json blob with a single action, and NOTHING else.`, toolResponse)
+}
+
+func ConversationCommandResult(result map[string][]byte) string {
+	var message strings.Builder
+	for node, output := range result {
+		message.WriteString(fmt.Sprintf(`Command ran on node "%s" and produced the following output:\n`, node))
+		message.WriteString(string(output))
+		message.WriteString("\n")
+	}
+	message.WriteString("Based on the chat history, extract relevant information out of the command output and write a summary.")
+	return message.String()
+}
+
+func MessageClassificationPrompt(classes map[string]string) string {
+	var classList strings.Builder
+	for name, description := range classes {
+		classList.WriteString(fmt.Sprintf("- `%s` (%s)\n", name, description))
+	}
+
+	return fmt.Sprintf(`Teleport is a tool that provides access to servers, kubernetes clusters, databases, and applications. All connected Teleport resources are called a cluster. Server resources might be called nodes.
+
+Classify the provided message between the following categories:
+
+%v
+
+Answer only with the category name. Nothing else.`, classList.String())
+}
diff --git a/lib/ai/model/tool.go b/lib/ai/model/tool.go
new file mode 100644
index 0000000000000..a917286eb31ab
--- /dev/null
+++ b/lib/ai/model/tool.go
@@ -0,0 +1,180 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package model
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/gravitational/teleport/api/gen/proto/go/assist/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// Tool is an interface that allows the agent to interact with the outside world.
+// It is used to implement things such as vector document retrieval and command execution.
+type Tool interface {
+	Name() string
+	Description() string
+	Run(ctx context.Context, input string) (string, error)
+}
+type commandExecutionTool struct{}
+
+type commandExecutionToolInput struct {
+	// Command is a unix command to execute.
+	Command string `json:"command"`
+
+	// Nodes is a list of hostnames to execute the command on.
+	Nodes []string `json:"nodes"`
+
+	// Labels is a list of labels specifying node groups to execute the command on.
+	Labels []Label `json:"labels"`
+}
+
+func (c *commandExecutionTool) Name() string {
+	return "Command Execution"
+}
+
+func (c *commandExecutionTool) Description() string {
+	return fmt.Sprintf(`Execute a command on a set of remote nodes based on a set of node names or/and a set of labels.
+The input must be a JSON object with the following schema:
+
+%vjson
+{
+	"command": string, \\ The command to execute
+	"nodes": []string, \\ Execute a command on all nodes that have the given node names
+	"labels": []{"key": string, "value": string} \\ Execute a command on all nodes that has at least one of the labels
+}
+%v
+`, "```", "```")
+}
+
+func (c *commandExecutionTool) Run(_ context.Context, _ string) (string, error) {
+	// This is stubbed because commandExecutionTool is handled specially.
+	// This is because execution of this tool breaks the loop and returns a command suggestion to the user.
+	// It is still handled as a tool because testing has shown that the LLM behaves better when it is treated as a tool.
+	//
+	// In addition, treating it as a Tool interface item simplifies the display and prompt assembly logic significantly.
+	return "", trace.NotImplemented("not implemented")
+}
+
+// parseInput is called in a special case if the planned tool is commandExecutionTool.
+// This is because commandExecutionTool is handled differently from most other tools and forcibly terminates the thought loop.
+func (*commandExecutionTool) parseInput(input string) (*commandExecutionToolInput, *invalidOutputError) {
+	output, err := parseJSONFromModel[commandExecutionToolInput](input)
+	if err != nil {
+		return nil, err
+	}
+
+	if output.Command == "" {
+		return nil, &invalidOutputError{
+			coarse: "command execution: missing command",
+			detail: "command must be non-empty",
+		}
+	}
+
+	if len(output.Nodes) == 0 && len(output.Labels) == 0 {
+		return nil, &invalidOutputError{
+			coarse: "command execution: missing nodes or labels",
+			detail: "at least one node or label must be specified",
+		}
+	}
+
+	return &output, nil
+}
+
+type embeddingRetrievalTool struct {
+	assistClient assist.AssistEmbeddingServiceClient
+	currentUser  string
+}
+
+type embeddingRetrievalToolInput struct {
+	Question string `json:"question"`
+}
+
+func (e *embeddingRetrievalTool) Run(ctx context.Context, input string) (string, error) {
+	inputCmd, outErr := e.parseInput(input)
+	if outErr == nil {
+		// If we failed to parse the input, we can still send the payload for embedding retrieval.
+		// In most cases, we will still get some sensible results.
+		// If we parsed the input successfully, we should use the parsed input instead.
+		input = inputCmd.Question
+	}
+	log.Tracef("embedding retrieval input: %v", input)
+
+	resp, err := e.assistClient.GetAssistantEmbeddings(ctx, &assist.GetAssistantEmbeddingsRequest{
+		Username: e.currentUser,
+		Kind:     types.KindNode, // currently only node embeddings are supported
+		Limit:    10,
+		Query:    input,
+	})
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	sb := strings.Builder{}
+	for _, embedding := range resp.Embeddings {
+		sb.WriteString(embedding.Content)
+		sb.WriteString("\n")
+	}
+
+	log.Tracef("embedding retrieval: %v", sb.String())
+
+	if sb.Len() == 0 {
+		// Either no nodes are connected, embedding process hasn't started yet, or
+		// the user doesn't have access to any resources.
+		return "Didn't find any nodes matching the query", nil
+	}
+
+	return sb.String(), nil
+}
+
+func (e *embeddingRetrievalTool) Name() string {
+	return "Nodes names and labels retrieval"
+}
+
+func (e *embeddingRetrievalTool) Description() string {
+	return fmt.Sprintf(`Ask about existing remote nodes that user has access to fetch node names or/and set of labels. 
+Always use this capability before returning generating any command. Do not assume that the user has access to any nodes. Returning a command without checking for access will result in an error.
+Always prefer to use labler rather than node names.
+The input must be a JSON object with the following schema:
+%vjson
+{
+	"question": string \\ Question about the available remote nodes
+}
+%v
+`, "```", "```")
+}
+
+func (*embeddingRetrievalTool) parseInput(input string) (*embeddingRetrievalToolInput, *invalidOutputError) {
+	output, err := parseJSONFromModel[embeddingRetrievalToolInput](input)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(output.Question) == 0 {
+		return nil, &invalidOutputError{
+			coarse: "embedding retrieval: missing question",
+			detail: "question must be non-empty",
+		}
+	}
+
+	return &output, nil
+}
diff --git a/lib/ai/prompt.go b/lib/ai/prompt.go
deleted file mode 100644
index df3b46dffd5d5..0000000000000
--- a/lib/ai/prompt.go
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright 2023 Gravitational, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package ai
-
-import "fmt"
-
-const promptSummarizeTitle = `You will be given a message. Create a short summary of that message.
-Respond only with summary, nothing else.`
-
-const initialAIResponse = `Hey, I'm Teleport - a powerful tool that can assist you in managing your Teleport cluster via OpenAI GPT-4.`
-
-const promptExtractInstruction = `If the input is a request to complete a task on a server, try to extract the following information:
-- A Linux shell command
-- One or more target servers
-- One or more target labels
-
-If there is a lack of details, provide most logical solution.
-Ensure the output is a valid shell command.
-There must be at least one target server or label, otherwise we do not have enough information to complete the task.
-Provide the output in the following format with no other text:
-
-{
-	"command": "<command to run>",
-	"nodes": ["<server1>", "<server2>"],
-	"labels": [
-		{
-			"key": "<label1>",
-			"value": "<value1>",
-		},
-		{
-			"key": "<label2>",
-			"value": "<value2>",
-		}
-	]
-}
-
-If the user is not asking to complete a task on a server directly but is asking a question related to Teleport or Linux - disregard this entire message and help them with their Teleport or Linux related request.`
-
-// promptCharacter is a prompt that sets the context for the conversation.
-// Username is the name of the user that the AI is talking to.
-func promptCharacter(username string) string {
-	return fmt.Sprintf(`You are Teleport, a tool that users can use to connect to Linux servers and run relevant commands, as well as have a conversation.
-A Teleport cluster is a connectivity layer that allows access to a set of servers. Servers may also be referred to as nodes.
-Nodes sometimes have labels such as "production" and "staging" assigned to them. Labels are used to group nodes together.
-You will engage in professional conversation with the user and help accomplish tasks such as executing tasks
-within the cluster or answering relevant questions about Teleport, Linux or the cluster itself.
-
-You are not permitted to engage in conversation that is not related to Teleport, Linux or the cluster itself.
-If this user asks such an unrelated question, you must concisely respond that it is beyond your scope of knowledge.
-
-You are talking to %v.`, username)
-}
diff --git a/lib/ai/simpleretriever.go b/lib/ai/simpleretriever.go
new file mode 100644
index 0000000000000..16745f82579fd
--- /dev/null
+++ b/lib/ai/simpleretriever.go
@@ -0,0 +1,121 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package ai
+
+import (
+	"sort"
+	"sync"
+)
+
+// SimpleRetriever is a simple implementation of embeddings retriever.
+// It stores all the embeddings in memory and retrieves the k nearest neighbors
+// by iterating over all the embeddings. Do not use for large datasets.
+type SimpleRetriever struct {
+	embeddings map[string]*Embedding
+	maxSize    int
+	mtx        sync.Mutex
+}
+
+func NewSimpleRetriever() *SimpleRetriever {
+	return &SimpleRetriever{
+		embeddings: make(map[string]*Embedding),
+		maxSize:    1_000, // keep the number low to avoid OOM
+	}
+}
+
+// Insert adds the embedding to the retriever. If the retriever is full, the
+// embedding is not added and false is returned.
+func (r *SimpleRetriever) Insert(id string, embedding *Embedding) bool {
+	r.mtx.Lock()
+	defer r.mtx.Unlock()
+	if len(r.embeddings) >= r.maxSize {
+		return false
+	}
+	r.embeddings[id] = embedding
+	return true
+}
+
+// Remove removes the embedding from the retriever by ID.
+func (r *SimpleRetriever) Remove(id string) {
+	r.mtx.Lock()
+	defer r.mtx.Unlock()
+	delete(r.embeddings, id)
+}
+
+// Swap replaces the embeddings in the retriever with the embeddings from the
+// provided retriever.
+// The mutex is acquired for the receiver, but not for the provided retriever.
+func (r *SimpleRetriever) Swap(s *SimpleRetriever) {
+	r.mtx.Lock()
+	defer r.mtx.Unlock()
+	r.embeddings = s.embeddings
+	r.maxSize = s.maxSize
+}
+
+// FilterFn is a function that filters out embeddings.
+// If the function returns false, the embedding is filtered out.
+type FilterFn func(id string, embedding *Embedding) bool
+
+// GetRelevant returns the k nearest neighbors to the query embedding.
+// If a filter is provided, only the embeddings that pass the filter are considered.
+func (r *SimpleRetriever) GetRelevant(query *Embedding, k int, filter FilterFn) []*Document {
+	// Replace with priority queue if k is large.
+	results := make([]*Document, 0, k)
+
+	r.mtx.Lock()
+	defer r.mtx.Unlock()
+
+	// Find the k nearest neighbors
+	for id, embedding := range r.embeddings {
+		// Skip if the document is filtered out
+		if filter != nil && !filter(id, embedding) {
+			continue
+		}
+
+		// Calculate the similarity score
+		similarity, _ := calculateSimilarity(query.Vector, embedding.Vector)
+		// If the results slice smaller than the k, add the element to the results
+		if len(results) < k {
+			results = append(results, &Document{
+				Embedding:       embedding,
+				SimilarityScore: similarity,
+			})
+
+			// Sort to preserve the invariant - the result slice is sorted by
+			// similarity score
+			sort.Slice(results, func(i, j int) bool {
+				return results[i].SimilarityScore > results[j].SimilarityScore
+			})
+		} else if similarity > results[len(results)-1].SimilarityScore {
+			// If the element is more relevant than the least similar element,
+			// add it to the result slice
+			results[len(results)-1] = &Document{
+				Embedding:       embedding,
+				SimilarityScore: similarity,
+			}
+
+			// Sort to preserve the invariant - the result slice is sorted by
+			// similarity score
+			sort.Slice(results, func(i, j int) bool {
+				return results[i].SimilarityScore > results[j].SimilarityScore
+			})
+		}
+	}
+
+	// Return the results sorted by similarity score.
+	return results
+}
diff --git a/lib/ai/simpleretriever_test.go b/lib/ai/simpleretriever_test.go
new file mode 100644
index 0000000000000..37030da39f40a
--- /dev/null
+++ b/lib/ai/simpleretriever_test.go
@@ -0,0 +1,80 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package ai
+
+import (
+	"fmt"
+	"math/rand"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestSimpleRetriever_GetRelevant(t *testing.T) {
+	t.Parallel()
+
+	// Generate random vector. The seed is fixed, so the results are deterministic.
+	randGen := rand.New(rand.NewSource(42))
+
+	generateVector := func() Vector64 {
+		const testVectorDimension = 100
+		// generate random vector
+		// reduce the dimensionality to 100
+		vec := make(Vector64, testVectorDimension)
+		for i := 0; i < testVectorDimension; i++ {
+			vec[i] = randGen.Float64()
+		}
+		// normalize vector, so the similarity between two vectors is the dot product
+		// between [0, 1]
+		return normalize(vec)
+	}
+
+	const testEmbeddingsSize = 100
+	points := make([]*Embedding, testEmbeddingsSize)
+	for i := 0; i < testEmbeddingsSize; i++ {
+		points[i] = NewEmbedding(types.KindNode, strconv.Itoa(i), generateVector(), [32]byte{})
+	}
+
+	// Create a query.
+	query := NewEmbedding(types.KindNode, "1", generateVector(), [32]byte{})
+
+	retriever := NewSimpleRetriever()
+
+	for _, point := range points {
+		retriever.Insert(point.GetName(), point)
+	}
+
+	// Get the top 10 most similar documents.
+	docs := retriever.GetRelevant(query, 10, func(id string, embedding *Embedding) bool {
+		return true
+	})
+	require.Len(t, docs, 10)
+
+	expectedResults := []int{57, 92, 95, 49, 33, 56, 30, 99, 90, 47}
+	expectedSimilarities := []float64{0.80405, 0.79051, 0.78161, 0.78159,
+		0.77655, 0.77374, 0.77306, 0.76688, 0.76634, 0.76458}
+
+	for i, result := range docs {
+		require.Equal(t,
+			fmt.Sprintf("%s/%s", types.KindNode, strconv.Itoa(expectedResults[i])),
+			result.GetName(), "expected order is wrong")
+		require.InDelta(t, expectedSimilarities[i], result.SimilarityScore, 10e-6, "similarity score is wrong")
+	}
+}
diff --git a/lib/ai/testutils/http.go b/lib/ai/testutils/http.go
new file mode 100644
index 0000000000000..1e8504ec54294
--- /dev/null
+++ b/lib/ai/testutils/http.go
@@ -0,0 +1,129 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package testutils
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/sashabaranov/go-openai"
+	"github.com/stretchr/testify/assert"
+)
+
+// GetTestHandlerFn returns a handler function that can be used to OpenAI API used by
+// the chat API. It takes a list of responses that will be returned in order.
+func GetTestHandlerFn(t *testing.T, responses []string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/chat/completions" {
+			http.Error(w, "Unexpected request", http.StatusBadRequest)
+			return
+		}
+
+		switch r.Header.Get("Accept") {
+		case "application/json; charset=utf-8", "application/json":
+			responses = messageResponse(w, r, t, responses)
+		case "text/event-stream":
+			responses = streamResponse(w, t, responses)
+		default:
+			http.Error(w, "Unexpected request", http.StatusBadRequest)
+		}
+	}
+}
+
+func streamResponse(w http.ResponseWriter, t *testing.T, responses []string) []string {
+	w.Header().Set("Content-Type", "text/event-stream")
+
+	if !assert.GreaterOrEqual(t, len(responses), 1, "Unexpected request") {
+		http.Error(w, "Unexpected request", http.StatusBadRequest)
+		return responses
+	}
+
+	resp := &openai.ChatCompletionStreamResponse{
+		ID:      strconv.Itoa(int(time.Now().Unix())),
+		Object:  "completion",
+		Created: time.Now().Unix(),
+		Model:   openai.GPT4,
+		Choices: []openai.ChatCompletionStreamChoice{
+			{
+				Index: 0,
+				Delta: openai.ChatCompletionStreamChoiceDelta{
+					Content: responses[0],
+					Role:    openai.ChatMessageRoleAssistant,
+				},
+				FinishReason: "",
+			},
+		},
+	}
+
+	respBytes, err := json.Marshal(resp)
+	assert.NoError(t, err, "Marshal error")
+
+	_, err = w.Write([]byte("data: "))
+	assert.NoError(t, err, "Write error")
+	_, err = w.Write(respBytes)
+	assert.NoError(t, err, "Write error")
+	_, err = w.Write([]byte("\n\nevent: done\ndata: [DONE]\n\n"))
+	assert.NoError(t, err, "Write error")
+
+	return responses[1:]
+}
+
+func messageResponse(w http.ResponseWriter, r *http.Request, t *testing.T, responses []string) []string {
+	w.Header().Set("Content-Type", "application/json")
+
+	req := &openai.ChatCompletionRequest{}
+	err := json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+	}
+
+	// Use assert as require doesn't work when called from a goroutine
+	if !assert.GreaterOrEqual(t, len(responses), 1, "Unexpected request") {
+		http.Error(w, "Unexpected request", http.StatusBadRequest)
+		return responses
+	}
+
+	dataBytes := responses[0]
+
+	resp := openai.ChatCompletionResponse{
+		ID:      strconv.Itoa(int(time.Now().Unix())),
+		Object:  "test-object",
+		Created: time.Now().Unix(),
+		Model:   req.Model,
+		Choices: []openai.ChatCompletionChoice{
+			{
+				Message: openai.ChatCompletionMessage{
+					Role:    openai.ChatMessageRoleAssistant,
+					Content: dataBytes,
+					Name:    "",
+				},
+			},
+		},
+		Usage: openai.Usage{},
+	}
+
+	respBytes, err := json.Marshal(resp)
+	assert.NoError(t, err, "Marshal error")
+
+	_, err = w.Write(respBytes)
+	assert.NoError(t, err, "Write error")
+
+	return responses[1:]
+}
diff --git a/lib/assist/assist.go b/lib/assist/assist.go
index 0fcbe9f50685c..adfb73b708211 100644
--- a/lib/assist/assist.go
+++ b/lib/assist/assist.go
@@ -21,7 +21,7 @@ package assist
 import (
 	"context"
 	"encoding/json"
-	"regexp"
+	"strings"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -32,10 +32,9 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/gravitational/teleport/api/gen/proto/go/assist/v1"
-	assistpb "github.com/gravitational/teleport/api/gen/proto/go/assist/v1"
 	pluginsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
 	"github.com/gravitational/teleport/lib/ai"
-	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/ai/model"
 )
 
 // MessageType is a type of the Assist message.
@@ -46,6 +45,11 @@ const (
 	MessageKindCommand MessageType = "COMMAND"
 	// MessageKindCommandResult is the type of Assist message that contains the command execution result.
 	MessageKindCommandResult MessageType = "COMMAND_RESULT"
+	// MessageKindCommandResultSummary is the type of message that is optionally
+	// emitted after a command and contains a summary of the command output.
+	// This message is both sent after the command execution to the web UI,
+	// and persisted in the conversation history.
+	MessageKindCommandResultSummary MessageType = "COMMAND_RESULT_SUMMARY"
 	// MessageKindUserMessage is the type of Assist message that contains the user message.
 	MessageKindUserMessage MessageType = "CHAT_MESSAGE_USER"
 	// MessageKindAssistantMessage is the type of Assist message that contains the assistant message.
@@ -58,8 +62,25 @@ const (
 	MessageKindSystemMessage MessageType = "CHAT_MESSAGE_SYSTEM"
 	// MessageKindError is the type of Assist message that is presented to user as information, but not stored persistently in the conversation. This can include backend error messages and the like.
 	MessageKindError MessageType = "CHAT_MESSAGE_ERROR"
+	// MessageKindProgressUpdate is the type of Assist message that contains a progress update.
+	// A progress update starts a new "stage" and ends a previous stage if there was one.
+	MessageKindProgressUpdate MessageType = "CHAT_MESSAGE_PROGRESS_UPDATE"
 )
 
+// PluginGetter is the minimal interface used by the chat to interact with the plugin service in the backend.
+type PluginGetter interface {
+	PluginsClient() pluginsv1.PluginServiceClient
+}
+
+// MessageService is the minimal interface used by the chat to interact with the Assist message service in the backend.
+type MessageService interface {
+	// GetAssistantMessages returns all messages with given conversation ID.
+	GetAssistantMessages(ctx context.Context, req *assist.GetAssistantMessagesRequest) (*assist.GetAssistantMessagesResponse, error)
+
+	// CreateAssistantMessage adds the message to the backend.
+	CreateAssistantMessage(ctx context.Context, msg *assist.CreateAssistantMessageRequest) error
+}
+
 // Assist is the Teleport Assist client.
 type Assist struct {
 	client *ai.Client
@@ -67,8 +88,8 @@ type Assist struct {
 	clock clockwork.Clock
 }
 
-// NewAssist creates a new Assist client.
-func NewAssist(ctx context.Context, proxyClient auth.ClientI,
+// NewClient creates a new Assist client.
+func NewClient(ctx context.Context, proxyClient PluginGetter,
 	proxySettings any, openaiCfg *openai.ClientConfig) (*Assist, error) {
 
 	client, err := getAssistantClient(ctx, proxyClient, proxySettings, openaiCfg)
@@ -86,26 +107,32 @@ func NewAssist(ctx context.Context, proxyClient auth.ClientI,
 type Chat struct {
 	assist *Assist
 	chat   *ai.Chat
-	// authClient is the auth server client.
-	authClient auth.ClientI
+	// assistService is the auth server client.
+	assistService MessageService
 	// ConversationID is the ID of the conversation.
 	ConversationID string
 	// Username is the username of the user who started the chat.
 	Username string
+	// potentiallyStaleHistory indicates messages might have been inserted into
+	// the chat history and the messages should be re-fetched before attempting
+	// the next completion.
+	potentiallyStaleHistory bool
 }
 
 // NewChat creates a new Assist chat.
-func (a *Assist) NewChat(ctx context.Context, authClient auth.ClientI,
-	conversationID string, username string,
+func (a *Assist) NewChat(ctx context.Context, assistService MessageService,
+	embeddingServiceClient assist.AssistEmbeddingServiceClient,
+	conversationID, username string,
 ) (*Chat, error) {
-	aichat := a.client.NewChat(username)
+	aichat := a.client.NewChat(embeddingServiceClient, username)
 
 	chat := &Chat{
-		assist:         a,
-		chat:           aichat,
-		authClient:     authClient,
-		ConversationID: conversationID,
-		Username:       username,
+		assist:                  a,
+		chat:                    aichat,
+		assistService:           assistService,
+		ConversationID:          conversationID,
+		Username:                username,
+		potentiallyStaleHistory: false,
 	}
 
 	if err := chat.loadMessages(ctx); err != nil {
@@ -120,10 +147,56 @@ func (a *Assist) GenerateSummary(ctx context.Context, message string) (string, e
 	return a.client.Summary(ctx, message)
 }
 
+// GenerateCommandSummary summarizes the output of a command executed on one or
+// many nodes. The conversation history is also sent into the prompt in order
+// to gather context and know what information is relevant in the command output.
+func (a *Assist) GenerateCommandSummary(ctx context.Context, messages []*assist.AssistantMessage, output map[string][]byte) (string, error) {
+	// Create system prompt
+	modelMessages := []openai.ChatCompletionMessage{
+		{Role: openai.ChatMessageRoleSystem, Content: model.PromptSummarizeCommand},
+	}
+
+	// Load context back into prompt
+	for _, message := range messages {
+		role := kindToRole(MessageType(message.Type))
+		if role != "" && role != openai.ChatMessageRoleSystem {
+			payload, err := formatMessagePayload(message)
+			if err != nil {
+				return "", trace.Wrap(err)
+			}
+			modelMessages = append(modelMessages, openai.ChatCompletionMessage{Role: role, Content: payload})
+		}
+	}
+	return a.client.CommandSummary(ctx, modelMessages, output)
+}
+
+// reloadMessages clears the chat history and reloads the messages from the database.
+func (c *Chat) reloadMessages(ctx context.Context) error {
+	c.chat.Clear()
+	return c.loadMessages(ctx)
+}
+
+// ClassifyMessage takes a user message, a list of categories, and uses the AI
+// mode as a zero shot classifier. It returns an error if the classification
+// result is not a valid class.
+func (a *Assist) ClassifyMessage(ctx context.Context, message string, classes map[string]string) (string, error) {
+	category, err := a.client.ClassifyMessage(ctx, message, classes)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	cleanedCategory := strings.ToLower(strings.Trim(category, ". "))
+	if _, ok := classes[cleanedCategory]; ok {
+		return cleanedCategory, nil
+	}
+
+	return "", trace.CompareFailed("classification failed, category '%s' is not a valid classes", cleanedCategory)
+}
+
 // loadMessages loads the messages from the database.
 func (c *Chat) loadMessages(ctx context.Context) error {
 	// existing conversation, retrieve old messages
-	messages, err := c.authClient.GetAssistantMessages(ctx, &assistpb.GetAssistantMessagesRequest{
+	messages, err := c.assistService.GetAssistantMessages(ctx, &assist.GetAssistantMessagesRequest{
 		ConversationId: c.ConversationID,
 		Username:       c.Username,
 	})
@@ -135,22 +208,28 @@ func (c *Chat) loadMessages(ctx context.Context) error {
 	for _, msg := range messages.GetMessages() {
 		role := kindToRole(MessageType(msg.Type))
 		if role != "" {
-			c.chat.Insert(role, msg.Payload)
+			payload, err := formatMessagePayload(msg)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			c.chat.Insert(role, payload)
 		}
 	}
 
+	// Mark the history as fresh.
+	c.potentiallyStaleHistory = false
+
 	return nil
 }
 
 // IsNewConversation returns true if the conversation has no messages yet.
 func (c *Chat) IsNewConversation() bool {
-	// The first message is always the system message generated by us.
-	return len(c.chat.GetMessages()) <= 1
+	return len(c.chat.GetMessages()) == 1
 }
 
 // getAssistantClient returns the OpenAI client created base on Teleport Plugin information
 // or the static token configured in YAML.
-func getAssistantClient(ctx context.Context, proxyClient auth.ClientI,
+func getAssistantClient(ctx context.Context, proxyClient PluginGetter,
 	proxySettings any, openaiCfg *openai.ClientConfig,
 ) (*ai.Client, error) {
 	apiKey, err := getOpenAITokenFromDefaultPlugin(ctx, proxyClient)
@@ -183,176 +262,111 @@ func getAssistantClient(ctx context.Context, proxyClient auth.ClientI,
 	return ai.NewClient(apiKey), nil
 }
 
-// InsertAssistantMessage inserts a message from the user into the conversation.
-// Message is saved in the DB.
-func (c *Chat) InsertAssistantMessage(ctx context.Context, msgType MessageType, msgPayload string,
-) error {
-	// write a user message to both an in-memory chain and persistent storage
-	c.chat.Insert(kindToRole(msgType), msgPayload)
-
-	if err := c.authClient.CreateAssistantMessage(ctx, &assistpb.CreateAssistantMessageRequest{
-		Message: &assistpb.AssistantMessage{
-			Type:        string(msgType), //string(MessageKindUserMessage),
-			Payload:     msgPayload,      // TODO(jakule): Sanitize the payload
-			CreatedTime: timestamppb.New(c.assist.clock.Now().UTC()),
-		},
-		ConversationId: c.ConversationID,
-		Username:       c.Username,
-	}); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
-}
-
-// TokensUsed is a number of tokens used in the last completion.
-type TokensUsed struct {
-	// Prompt is a number of tokens used in the prompt.
-	Prompt int
-	// Completion is a number of tokens used in the completion.
-	Completion int
-}
+// onMessageFunc is a function that is called when a message is received.
+type onMessageFunc func(kind MessageType, payload []byte, createdTime time.Time) error
 
 // ProcessComplete processes the completion request and returns the number of tokens used.
-func (c *Chat) ProcessComplete(ctx context.Context,
-	onMessage func(kind MessageType, payload []byte, createdTime time.Time) error,
-) (*TokensUsed, error) {
-	var numTokens int
+func (c *Chat) ProcessComplete(ctx context.Context, onMessage onMessageFunc, userInput string,
+) (*model.TokensUsed, error) {
+	var tokensUsed *model.TokensUsed
+	progressUpdates := func(update *model.AgentAction) {
+		payload, err := json.Marshal(update)
+		if err != nil {
+			log.WithError(err).Debugf("Failed to marshal progress update: %v", update)
+			return
+		}
 
-	promptTokens, err := c.chat.PromptTokens()
-	if err != nil {
-		log.Warnf("Failed to calculate prompt tokens: %v", err)
+		if err := onMessage(MessageKindProgressUpdate, payload, c.assist.clock.Now().UTC()); err != nil {
+			log.WithError(err).Debugf("Failed to send progress update: %v", update)
+			return
+		}
+	}
+
+	// If data might have been inserted into the chat history, we want to
+	// refresh and get the latest data before querying the model.
+	if c.potentiallyStaleHistory {
+		if err := c.reloadMessages(ctx); err != nil {
+			return nil, trace.Wrap(err)
+		}
 	}
 
 	// query the assistant and fetch an answer
-	message, err := c.chat.Complete(ctx)
+	message, err := c.chat.Complete(ctx, userInput, progressUpdates)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	switch message := message.(type) {
-	case *ai.StreamingMessage:
-		// collection of the entire message, used for writing to conversation log
-		content := ""
-
-		// stream all chunks to the client
-	outer:
-		for {
-			select {
-			case chunk, ok := <-message.Chunks:
-				if !ok {
-					break outer
-				}
-
-				if len(chunk) == 0 {
-					continue outer
-				}
-
-				numTokens++
-				content += chunk
-				payload := partialMessagePayload{
-					Content: chunk,
-					Idx:     message.Idx,
-				}
-
-				payloadJSON, err := json.Marshal(payload)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-				if err := onMessage(MessageKindAssistantPartialMessage, payloadJSON, c.assist.clock.Now().UTC()); err != nil {
-					return nil, trace.Wrap(err)
-				}
-
-			case err = <-message.Error:
-				return nil, trace.Wrap(err)
-			}
-		}
-
-		// tell the client that the message is complete
-		finalizePayload := partialFinalizePayload{
-			Idx: message.Idx,
-		}
+	// write the user message to persistent storage and the chat structure
+	c.chat.Insert(openai.ChatMessageRoleUser, userInput)
 
-		finalizePayloadJSON, err := json.Marshal(finalizePayload)
-		if err != nil {
+	// Do not write empty messages to the database.
+	if userInput != "" {
+		if err := c.assistService.CreateAssistantMessage(ctx, &assist.CreateAssistantMessageRequest{
+			Message: &assist.AssistantMessage{
+				Type:        string(MessageKindUserMessage),
+				Payload:     userInput, // TODO(jakule): Sanitize the payload
+				CreatedTime: timestamppb.New(c.assist.clock.Now().UTC()),
+			},
+			ConversationId: c.ConversationID,
+			Username:       c.Username,
+		}); err != nil {
 			return nil, trace.Wrap(err)
 		}
+	}
 
-		if err := onMessage(MessageKindAssistantPartialFinalize, finalizePayloadJSON, c.assist.clock.Now().UTC()); err != nil {
-			return nil, trace.Wrap(err)
-		}
+	switch message := message.(type) {
+	case *model.Message:
+		tokensUsed = message.TokensUsed
+		c.chat.Insert(openai.ChatMessageRoleAssistant, message.Content)
 
-		// write the entire message to both an in-memory chain and persistent storage
-		c.chat.Insert(message.Role, content)
+		// write an assistant message to persistent storage
 		protoMsg := &assist.CreateAssistantMessageRequest{
 			ConversationId: c.ConversationID,
 			Username:       c.Username,
 			Message: &assist.AssistantMessage{
 				Type:        string(MessageKindAssistantMessage),
-				Payload:     content,
+				Payload:     message.Content,
 				CreatedTime: timestamppb.New(c.assist.clock.Now().UTC()),
 			},
 		}
 
-		if err := c.authClient.CreateAssistantMessage(ctx, protoMsg); err != nil {
+		if err := c.assistService.CreateAssistantMessage(ctx, protoMsg); err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		// check if there's any embedded command in the response, if so, send a suggestion with it
-		if command := tryFindEmbeddedCommand(content); command != nil {
-			payload := commandPayload{
-				Command: command.Command,
-				Nodes:   command.Nodes,
-				Labels:  command.Labels,
-			}
-
-			payloadJson, err := json.Marshal(payload)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			msg := &assist.CreateAssistantMessageRequest{
-				ConversationId: c.ConversationID,
-				Username:       c.Username,
-				Message: &assist.AssistantMessage{
-					Type:        string(MessageKindCommand),
-					Payload:     string(payloadJson),
-					CreatedTime: timestamppb.New(c.assist.clock.Now().UTC()),
-				},
-			}
-
-			if err := c.authClient.CreateAssistantMessage(ctx, msg); err != nil {
-				return nil, trace.Wrap(err)
-			}
-
-			if err := onMessage(MessageKindCommand, payloadJson, c.assist.clock.Now().UTC()); err != nil {
+		if err := onMessage(MessageKindAssistantMessage, []byte(message.Content), c.assist.clock.Now().UTC()); err != nil {
+			return nil, trace.Wrap(err)
+		}
+	case *model.StreamingMessage:
+		tokensUsed = message.TokensUsed
+		var text strings.Builder
+		defer onMessage(MessageKindAssistantPartialFinalize, nil, c.assist.clock.Now().UTC())
+		for part := range message.Parts {
+			text.WriteString(part)
+
+			if err := onMessage(MessageKindAssistantPartialMessage, []byte(part), c.assist.clock.Now().UTC()); err != nil {
 				return nil, trace.Wrap(err)
 			}
 		}
-	case *ai.Message:
-		numTokens = message.NumTokens
-		// write an assistant message to both an in-memory chain and persistent storage
-		c.chat.Insert(message.Role, message.Content)
+
+		// write an assistant message to memory and persistent storage
+		textS := text.String()
+		c.chat.Insert(openai.ChatMessageRoleAssistant, textS)
 		protoMsg := &assist.CreateAssistantMessageRequest{
 			ConversationId: c.ConversationID,
 			Username:       c.Username,
 			Message: &assist.AssistantMessage{
 				Type:        string(MessageKindAssistantMessage),
-				Payload:     message.Content,
+				Payload:     textS,
 				CreatedTime: timestamppb.New(c.assist.clock.Now().UTC()),
 			},
 		}
 
-		if err := c.authClient.CreateAssistantMessage(ctx, protoMsg); err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		if err := onMessage(MessageKindAssistantMessage, []byte(message.Content), c.assist.clock.Now().UTC()); err != nil {
+		if err := c.assistService.CreateAssistantMessage(ctx, protoMsg); err != nil {
 			return nil, trace.Wrap(err)
 		}
-	case *ai.CompletionCommand:
-		numTokens = message.NumTokens
+	case *model.CompletionCommand:
+		tokensUsed = message.TokensUsed
 		payload := commandPayload{
 			Command: message.Command,
 			Nodes:   message.Nodes,
@@ -374,40 +388,26 @@ func (c *Chat) ProcessComplete(ctx context.Context,
 			},
 		}
 
-		if err := c.authClient.CreateAssistantMessage(ctx, msg); err != nil {
+		if err := c.assistService.CreateAssistantMessage(ctx, msg); err != nil {
 			return nil, trace.Wrap(err)
 		}
 
 		if err := onMessage(MessageKindCommand, payloadJson, c.assist.clock.Now().UTC()); nil != err {
 			return nil, trace.Wrap(err)
 		}
+		// As we emitted a command suggestion, the user might have run it. If
+		// the command ran, a summary could have been inserted in the backend.
+		// To take this command summary into account, we note the history might
+		// be stale.
+		c.potentiallyStaleHistory = true
 	default:
-		return nil, trace.Errorf("unknown message type")
+		return nil, trace.Errorf("unknown message type: %T", message)
 	}
 
-	return &TokensUsed{
-		Prompt:     promptTokens,
-		Completion: numTokens,
-	}, nil
+	return tokensUsed, nil
 }
 
-var jsonBlockPattern = regexp.MustCompile(`(?s){.+}`)
-
-// tryFindEmbeddedCommand tries to find an embedded command in the message.
-func tryFindEmbeddedCommand(message string) *ai.CompletionCommand {
-	candidates := jsonBlockPattern.FindAllString(message, -1)
-
-	for _, candidate := range candidates {
-		var c ai.CompletionCommand
-		if err := json.Unmarshal([]byte(candidate), &c); err == nil {
-			return &c
-		}
-	}
-
-	return nil
-}
-
-func getOpenAITokenFromDefaultPlugin(ctx context.Context, proxyClient auth.ClientI) (string, error) {
+func getOpenAITokenFromDefaultPlugin(ctx context.Context, proxyClient PluginGetter) (string, error) {
 	// Try retrieving credentials from the plugin resource first
 	openaiPlugin, err := proxyClient.PluginsClient().GetPlugin(ctx, &pluginsv1.GetPluginRequest{
 		Name:        "openai-default",
@@ -434,7 +434,27 @@ func kindToRole(kind MessageType) string {
 		return openai.ChatMessageRoleAssistant
 	case MessageKindSystemMessage:
 		return openai.ChatMessageRoleSystem
+	case MessageKindCommandResultSummary:
+		return openai.ChatMessageRoleUser
 	default:
 		return ""
 	}
 }
+
+// formatMessagePayload generates the OpemAI message payload corresponding to
+// an Assist message. Most Assist message payloads can be converted directly,
+// but some payloads are JSON-formatted and must be processed before being
+// passed to the model.
+func formatMessagePayload(message *assist.AssistantMessage) (string, error) {
+	switch MessageType(message.GetType()) {
+	case MessageKindCommandResultSummary:
+		var summary CommandExecSummary
+		err := json.Unmarshal([]byte(message.GetPayload()), &summary)
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
+		return summary.String(), nil
+	default:
+		return message.GetPayload(), nil
+	}
+}
diff --git a/lib/assist/assist_test.go b/lib/assist/assist_test.go
new file mode 100644
index 0000000000000..495383fb2ef38
--- /dev/null
+++ b/lib/assist/assist_test.go
@@ -0,0 +1,202 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package assist
+
+import (
+	"context"
+	"errors"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/sashabaranov/go-openai"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/gravitational/teleport/api/gen/proto/go/assist/v1"
+	pluginsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
+	"github.com/gravitational/teleport/api/types"
+	aitest "github.com/gravitational/teleport/lib/ai/testutils"
+	"github.com/gravitational/teleport/lib/auth"
+)
+
+func TestChatComplete(t *testing.T) {
+	t.Parallel()
+
+	// Given an OpenAI server that returns a response for a chat completion request.
+	responses := []string{
+		generateCommandResponse(),
+	}
+
+	server := httptest.NewServer(aitest.GetTestHandlerFn(t, responses))
+	t.Cleanup(server.Close)
+
+	cfg := openai.DefaultConfig("secret-test-token")
+	cfg.BaseURL = server.URL
+
+	// And a chat client.
+	ctx := context.Background()
+	client, err := NewClient(ctx, &mockPluginGetter{}, &apiKeyMock{}, &cfg)
+	require.NoError(t, err)
+
+	// And a test auth server.
+	authSrv, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
+		Dir:   t.TempDir(),
+		Clock: clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+
+	// And created conversation.
+	const testUser = "bob"
+	conversationResp, err := authSrv.AuthServer.CreateAssistantConversation(ctx, &assist.CreateAssistantConversationRequest{
+		Username:    testUser,
+		CreatedTime: timestamppb.Now(),
+	})
+	require.NoError(t, err)
+
+	// When a chat is created.
+	chat, err := client.NewChat(ctx, authSrv.AuthServer, nil, conversationResp.Id, testUser)
+	require.NoError(t, err)
+
+	t.Run("new conversation is new", func(t *testing.T) {
+		// Then the chat is new.
+		require.True(t, chat.IsNewConversation())
+	})
+
+	t.Run("the first message is the hey message", func(t *testing.T) {
+		// Use called to make sure that the callback is called.
+		called := false
+		// The first message is the welcome message.
+		_, err = chat.ProcessComplete(ctx, func(kind MessageType, payload []byte, createdTime time.Time) error {
+			require.Equal(t, MessageKindAssistantMessage, kind)
+			require.Contains(t, string(payload), "Hey, I'm Teleport")
+			called = true
+			return nil
+		}, "")
+		require.NoError(t, err)
+		require.True(t, called)
+	})
+
+	t.Run("command should be returned in the response", func(t *testing.T) {
+		called := false
+		// The second message is the command response.
+		_, err = chat.ProcessComplete(ctx, func(kind MessageType, payload []byte, createdTime time.Time) error {
+			if kind == MessageKindProgressUpdate {
+				return nil
+			}
+			require.Equal(t, MessageKindCommand, kind)
+			require.Equal(t, string(payload), `{"command":"df -h","nodes":["localhost"]}`)
+			called = true
+			return nil
+		}, "Show free disk space on localhost")
+		require.NoError(t, err)
+		require.True(t, called)
+	})
+
+	t.Run("check what messages are stored in the backend", func(t *testing.T) {
+		// backend should have 3 messages: welcome message, user message, command response.
+		messages, err := authSrv.AuthServer.GetAssistantMessages(ctx, &assist.GetAssistantMessagesRequest{
+			Username:       testUser,
+			ConversationId: conversationResp.Id,
+		})
+		require.NoError(t, err)
+		require.Len(t, messages.Messages, 3)
+
+		require.Equal(t, string(MessageKindAssistantMessage), messages.Messages[0].Type)
+		require.Equal(t, string(MessageKindUserMessage), messages.Messages[1].Type)
+		require.Equal(t, string(MessageKindCommand), messages.Messages[2].Type)
+	})
+}
+
+func TestClassifyMessage(t *testing.T) {
+	// Given an OpenAI server that returns a response for a chat completion request.
+	responses := []string{
+		"troubleshooting",
+		"Troubleshooting",
+		"Troubleshooting.",
+		"non-existent",
+	}
+
+	server := httptest.NewServer(aitest.GetTestHandlerFn(t, responses))
+	t.Cleanup(server.Close)
+
+	cfg := openai.DefaultConfig("secret-test-token")
+	cfg.BaseURL = server.URL
+
+	// And a chat client.
+	ctx := context.Background()
+	client, err := NewClient(ctx, &mockPluginGetter{}, &apiKeyMock{}, &cfg)
+	require.NoError(t, err)
+
+	t.Run("Valid class", func(t *testing.T) {
+		class, err := client.ClassifyMessage(ctx, "whatever", MessageClasses)
+		require.NoError(t, err)
+		require.Equal(t, class, "troubleshooting")
+	})
+
+	t.Run("Valid class starting with upper-case", func(t *testing.T) {
+		class, err := client.ClassifyMessage(ctx, "whatever", MessageClasses)
+		require.NoError(t, err)
+		require.Equal(t, class, "troubleshooting")
+	})
+
+	t.Run("Valid class starting with upper-case and ending with dot", func(t *testing.T) {
+		class, err := client.ClassifyMessage(ctx, "whatever", MessageClasses)
+		require.NoError(t, err)
+		require.Equal(t, class, "troubleshooting")
+	})
+
+	t.Run("Model hallucinates", func(t *testing.T) {
+		class, err := client.ClassifyMessage(ctx, "whatever", MessageClasses)
+		require.Error(t, err)
+		require.Empty(t, class)
+	})
+}
+
+type apiKeyMock struct{}
+
+// GetOpenAIAPIKey returns a mock API key.
+func (m *apiKeyMock) GetOpenAIAPIKey() string {
+	return "123"
+}
+
+type mockPluginGetter struct{}
+
+func (m *mockPluginGetter) PluginsClient() pluginsv1.PluginServiceClient {
+	return &mockPluginServiceClient{}
+}
+
+type mockPluginServiceClient struct {
+	pluginsv1.PluginServiceClient
+}
+
+// GetPlugin always returns an error, so the assist fallbacks to the default config.
+func (m *mockPluginServiceClient) GetPlugin(_ context.Context, _ *pluginsv1.GetPluginRequest, _ ...grpc.CallOption) (*types.PluginV1, error) {
+	return nil, errors.New("not implemented")
+}
+
+// generateCommandResponse generates a response for the command "df -h" on the node "localhost"
+func generateCommandResponse() string {
+	return "```" + `json
+	{
+	    "action": "Command Execution",
+	    "action_input": "{\"command\":\"df -h\",\"nodes\":[\"localhost\"],\"labels\":[]}"
+	}
+	` + "```"
+}
diff --git a/lib/assist/constants.go b/lib/assist/constants.go
new file mode 100644
index 0000000000000..230c68f6b37e7
--- /dev/null
+++ b/lib/assist/constants.go
@@ -0,0 +1,35 @@
+/*
+ Copyright 2023 Gravitational, Inc.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
+
+package assist
+
+// MessageClasses contains type of assist message we expect users to send.
+// When running on Cloud we attempt to classify user messages in one of those
+// categories. If this succeeds, we send an event into the analytics pipeline.
+//
+// Keys are the category names, those are the ones reported in the event and
+// generated by the model. Values are the category description. They are used to
+// build the model prompt and allow to provide more context to the model to
+// improve the classification.
+var MessageClasses = map[string]string{
+	"command execution": "the user want to execute a command on one or many servers",
+	"troubleshooting":   "the user wants to diagnose a problem or understand an error message",
+	"configuration":     "the user wants to generate configuration for a software which is not Teleport",
+	"manage resources":  "the user wants to list/add/remove/edit resources connected to the Teleport cluster",
+	"access request":    "the user requests access to one or many resources from the Teleport cluster",
+	"teleport setup":    "the user wants help with its Teleport cluster, like setting up a new feature or knowing if something is feasible",
+	"other":             "the user asks a question which is not IT nor Teleport-related",
+}
diff --git a/lib/assist/messages.go b/lib/assist/messages.go
index 2c12ebfc15e2d..f5197348ca295 100644
--- a/lib/assist/messages.go
+++ b/lib/assist/messages.go
@@ -19,22 +19,28 @@
 
 package assist
 
-import "github.com/gravitational/teleport/lib/ai"
+import (
+	"fmt"
+
+	"github.com/gravitational/teleport/lib/ai/model"
+)
 
 // commandPayload is a payload for a command message.
 type commandPayload struct {
-	Command string     `json:"command,omitempty"`
-	Nodes   []string   `json:"nodes,omitempty"`
-	Labels  []ai.Label `json:"labels,omitempty"`
+	Command string        `json:"command,omitempty"`
+	Nodes   []string      `json:"nodes,omitempty"`
+	Labels  []model.Label `json:"labels,omitempty"`
 }
 
-// partialMessagePayload is a payload for a partial message.
-type partialMessagePayload struct {
-	Content string `json:"content,omitempty"`
-	Idx     int    `json:"idx,omitempty"`
+// CommandExecSummary is a payload for the COMMAND_RESULT_SUMMARY message.
+type CommandExecSummary struct {
+	ExecutionID string `json:"execution_id"`
+	Summary     string `json:"summary"`
+	Command     string `json:"command"`
 }
 
-// partialFinalizePayload is a payload for a partial finalize message.
-type partialFinalizePayload struct {
-	Idx int `json:"idx,omitempty"`
+// String implements the Stringer interface and formats the message for AI
+// model consumption.
+func (s CommandExecSummary) String() string {
+	return fmt.Sprintf("Command: `%s` executed. The command output summary is: %s", s.Command, s.Summary)
 }
diff --git a/lib/auth/api.go b/lib/auth/api.go
index b502e7b3c753a..bc465c0e9693b 100644
--- a/lib/auth/api.go
+++ b/lib/auth/api.go
@@ -37,11 +37,11 @@ type Announcer interface {
 
 	// UpsertProxy registers proxy presence, permanently if ttl is 0 or
 	// for the specified duration with second resolution if it's >= 1 second
-	UpsertProxy(s types.Server) error
+	UpsertProxy(ctx context.Context, s types.Server) error
 
 	// UpsertAuthServer registers auth server presence, permanently if ttl is 0 or
 	// for the specified duration with second resolution if it's >= 1 second
-	UpsertAuthServer(s types.Server) error
+	UpsertAuthServer(ctx context.Context, s types.Server) error
 
 	// UpsertKubernetesServer registers a kubernetes server
 	UpsertKubernetesServer(context.Context, types.KubeServer) (*types.KeepAlive, error)
diff --git a/lib/auth/apiserver.go b/lib/auth/apiserver.go
index 9f1eef66f072d..ca4c317b084e2 100644
--- a/lib/auth/apiserver.go
+++ b/lib/auth/apiserver.go
@@ -250,11 +250,11 @@ func (s *APIServer) upsertServer(auth services.Presence, role types.SystemRole,
 		}
 		return handle, nil
 	case types.RoleAuth:
-		if err := auth.UpsertAuthServer(server); err != nil {
+		if err := auth.UpsertAuthServer(r.Context(), server); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	case types.RoleProxy:
-		if err := auth.UpsertProxy(server); err != nil {
+		if err := auth.UpsertProxy(r.Context(), server); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	default:
@@ -304,7 +304,7 @@ func (s *APIServer) deleteProxy(auth ClientI, w http.ResponseWriter, r *http.Req
 	if name == "" {
 		return nil, trace.BadParameter("missing proxy name")
 	}
-	err := auth.DeleteProxy(name)
+	err := auth.DeleteProxy(r.Context(), name)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/assist/assistv1/service.go b/lib/auth/assist/assistv1/service.go
index 4d718894297c4..a46dda271bbe1 100644
--- a/lib/auth/assist/assistv1/service.go
+++ b/lib/auth/assist/assistv1/service.go
@@ -22,23 +22,47 @@ import (
 	"context"
 
 	"github.com/gravitational/trace"
+	"github.com/sirupsen/logrus"
 	"google.golang.org/protobuf/types/known/emptypb"
 
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/gen/proto/go/assist/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/ai"
+	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/services"
 )
 
 // ServiceConfig holds configuration options for
 // the assist gRPC service.
 type ServiceConfig struct {
-	Backend services.Assistant
+	Backend        services.Assistant
+	Embeddings     *ai.SimpleRetriever
+	Embedder       ai.Embedder
+	Authorizer     authz.Authorizer
+	Logger         *logrus.Entry
+	ResourceGetter ResourceGetter
+}
+
+// ResourceGetter represents a subset of the auth.Cache interface.
+// Created to avoid circular dependencies.
+type ResourceGetter interface {
+	GetNode(ctx context.Context, namespace, name string) (types.Server, error)
 }
 
 // Service implements the teleport.assist.v1.AssistService RPC service.
 type Service struct {
 	assist.UnimplementedAssistServiceServer
-
-	backend services.Assistant
+	assist.UnimplementedAssistEmbeddingServiceServer
+
+	backend    services.Assistant
+	embeddings *ai.SimpleRetriever
+	// embedder is used to embed text into a vector.
+	// It can be nil if the OpenAI API key is not set.
+	embedder       ai.Embedder
+	authorizer     authz.Authorizer
+	log            *logrus.Entry
+	resourceGetter ResourceGetter
 }
 
 // NewService returns a new assist gRPC service.
@@ -46,10 +70,24 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 	switch {
 	case cfg.Backend == nil:
 		return nil, trace.BadParameter("backend is required")
+	case cfg.Embeddings == nil:
+		return nil, trace.BadParameter("embeddings is required")
+	case cfg.Authorizer == nil:
+		return nil, trace.BadParameter("authorizer is required")
+	case cfg.ResourceGetter == nil:
+		return nil, trace.BadParameter("resource getter is required")
+	case cfg.Logger == nil:
+		cfg.Logger = logrus.WithField(trace.Component, "assist.service")
 	}
+	// Embedder can be nil is the OpenAI API key is not set.
 
 	return &Service{
-		backend: cfg.Backend,
+		backend:        cfg.Backend,
+		embeddings:     cfg.Embeddings,
+		embedder:       cfg.Embedder,
+		authorizer:     cfg.Authorizer,
+		resourceGetter: cfg.ResourceGetter,
+		log:            cfg.Logger,
 	}, nil
 }
 
@@ -92,6 +130,67 @@ func (a *Service) CreateAssistantMessage(ctx context.Context, req *assist.Create
 }
 
 // IsAssistEnabled returns true if the assist is enabled or not on the auth level.
-func (a *Service) IsAssistEnabled(ctx context.Context, req *assist.IsAssistEnabledRequest) (*assist.IsAssistEnabledResponse, error) {
+func (a *Service) IsAssistEnabled(ctx context.Context, _ *assist.IsAssistEnabledRequest) (*assist.IsAssistEnabledResponse, error) {
+	if a.embedder == nil {
+		// If the embedder is not configured, the assist is not enabled as we cannot compute embeddings.
+		return &assist.IsAssistEnabledResponse{Enabled: false}, nil
+	}
+
+	// Check if assist can use the backend.
 	return a.backend.IsAssistEnabled(ctx)
 }
+
+func (a *Service) GetAssistantEmbeddings(ctx context.Context, msg *assist.GetAssistantEmbeddingsRequest) (*assist.GetAssistantEmbeddingsResponse, error) {
+	// TODO(jakule): The kind needs to be updated when we add more resources.
+	authCtx, err := authz.AuthorizeWithVerbs(ctx, a.log, a.authorizer, true, types.KindNode, types.VerbRead, types.VerbList)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if a.embedder == nil {
+		return nil, trace.BadParameter("assist is not configured in auth server")
+	}
+
+	// Call the openAI API to get the embeddings for the query.
+	embeddings, err := a.embedder.ComputeEmbeddings(ctx, []string{msg.Query})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if len(embeddings) == 0 {
+		return nil, trace.NotFound("OpenAI embeddings returned no results")
+	}
+
+	// Use default values for the id and content, as we only care about the embeddings.
+	queryEmbeddings := ai.NewEmbedding(msg.Kind, "", embeddings[0], [32]byte{})
+	documents := a.embeddings.GetRelevant(queryEmbeddings, int(msg.Limit), func(id string, embedding *ai.Embedding) bool {
+		// Run RBAC check on the embedded resource.
+		node, err := a.resourceGetter.GetNode(ctx, defaults.Namespace, embedding.GetEmbeddedID())
+		if err != nil {
+			a.log.Tracef("failed to get node %q: %v", embedding.GetName(), err)
+			return false
+		}
+		return authCtx.Checker.CheckAccess(node, services.AccessState{MFAVerified: true}) == nil
+	})
+
+	protoDocs := make([]*assist.EmbeddedDocument, 0, len(documents))
+	for _, doc := range documents {
+		node, err := a.resourceGetter.GetNode(ctx, defaults.Namespace, doc.GetEmbeddedID())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		content, err := ai.SerializeNode(node)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		protoDocs = append(protoDocs, &assist.EmbeddedDocument{
+			Id:              doc.GetEmbeddedID(),
+			Content:         string(content),
+			SimilarityScore: float32(doc.SimilarityScore),
+		})
+	}
+
+	return &assist.GetAssistantEmbeddingsResponse{
+		Embeddings: protoDocs,
+	}, nil
+}
diff --git a/lib/auth/auth.go b/lib/auth/auth.go
index b664906076773..3c6ae0e6d3e1d 100644
--- a/lib/auth/auth.go
+++ b/lib/auth/auth.go
@@ -58,6 +58,7 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/gen/proto/go/assist/v1"
+	userpreferencesv1 "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
@@ -65,6 +66,7 @@ import (
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
+	"github.com/gravitational/teleport/lib/ai"
 	"github.com/gravitational/teleport/lib/auth/keystore"
 	"github.com/gravitational/teleport/lib/auth/native"
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
@@ -230,6 +232,12 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 			return nil, trace.Wrap(err)
 		}
 	}
+	if cfg.Embeddings == nil {
+		cfg.Embeddings = local.NewEmbeddingsService(cfg.Backend)
+	}
+	if cfg.UserPreferences == nil {
+		cfg.UserPreferences = local.NewUserPreferencesService(cfg.Backend)
+	}
 
 	limiter, err := limiter.NewConnectionsLimiter(limiter.Config{
 		MaxConnections: defaults.LimiterMaxConcurrentSignatures,
@@ -279,10 +287,12 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		SessionTrackerService:   cfg.SessionTrackerService,
 		ConnectionsDiagnostic:   cfg.ConnectionsDiagnostic,
 		Integrations:            cfg.Integrations,
+		Embeddings:              cfg.Embeddings,
 		Okta:                    cfg.Okta,
 		StatusInternal:          cfg.Status,
 		UsageReporter:           cfg.UsageReporter,
 		Assistant:               cfg.Assist,
+		UserPreferences:         cfg.UserPreferences,
 	}
 
 	closeCtx, cancelFunc := context.WithCancel(context.TODO())
@@ -306,6 +316,8 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		fips:                cfg.FIPS,
 		loadAllCAs:          cfg.LoadAllCAs,
 		httpClientForAWSSTS: cfg.HTTPClientForAWSSTS,
+		embeddingsRetriever: cfg.EmbeddingRetriever,
+		embedder:            cfg.EmbeddingClient,
 	}
 	as.inventory = inventory.NewController(&as, services, inventory.WithAuthServerID(cfg.HostUUID))
 	for _, o := range opts {
@@ -394,6 +406,8 @@ type Services struct {
 	services.Integrations
 	services.Okta
 	services.Assistant
+	services.Embeddings
+	services.UserPreferences
 	usagereporter.UsageReporter
 	types.Events
 	events.AuditLogSessionStreamer
@@ -616,6 +630,12 @@ type Server struct {
 	// httpClientForAWSSTS overwrites the default HTTP client used for making
 	// STS requests.
 	httpClientForAWSSTS utils.HTTPDoClient
+
+	// embeddingRetriever is a retriever used to retrieve embeddings from the backend.
+	embeddingsRetriever *ai.SimpleRetriever
+
+	// embedder is an embedder client used to generate embeddings.
+	embedder ai.Embedder
 }
 
 // SetSAMLService registers svc as the SAMLService that provides the SAML
@@ -1499,7 +1519,11 @@ func (a *Server) GenerateOpenSSHCert(ctx context.Context, req *proto.OpenSSHCert
 		return nil, trace.BadParameter("public key is empty")
 	}
 	if req.TTL == 0 {
-		return nil, trace.BadParameter("TTL is not set")
+		cap, err := a.GetAuthPreference(ctx)
+		if err != nil {
+			return nil, trace.BadParameter("cert request does not specify a TTL and the cluster_auth_preference is not available: %v", err)
+		}
+		req.TTL = proto.Duration(cap.GetDefaultSessionTTL())
 	}
 	if req.TTL < 0 {
 		return nil, trace.BadParameter("TTL must be positive")
@@ -1512,7 +1536,11 @@ func (a *Server) GenerateOpenSSHCert(ctx context.Context, req *proto.OpenSSHCert
 	accessInfo := services.AccessInfoFromUser(req.User)
 	roles := make([]types.Role, len(req.Roles))
 	for i := range req.Roles {
-		roles[i] = services.ApplyTraits(req.Roles[i], req.User.GetTraits())
+		var err error
+		roles[i], err = services.ApplyTraits(req.Roles[i], req.User.GetTraits())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 	}
 	roleSet := services.NewRoleSet(roles...)
 
@@ -2058,6 +2086,10 @@ func generateCert(a *Server, req certRequest, caType types.CertAuthType) (*proto
 	var sessionTTL time.Duration
 	var allowedLogins []string
 
+	if req.ttl == 0 {
+		req.ttl = time.Duration(authPref.GetDefaultSessionTTL())
+	}
+
 	// If the role TTL is ignored, do not restrict session TTL and allowed logins.
 	// The only caller setting this parameter should be "tctl auth sign".
 	// Otherwise, set the session TTL to the smallest of all roles and
@@ -2071,10 +2103,10 @@ func generateCert(a *Server, req certRequest, caType types.CertAuthType) (*proto
 			return nil, trace.Wrap(err)
 		}
 	} else {
-		// Adjust session TTL to the smaller of two values: the session TTL
-		// requested in tsh or the session TTL for the role.
+		// Adjust session TTL to the smaller of two values: the session TTL requested
+		// in tsh (possibly using default_session_ttl) or the session TTL for the
+		// role.
 		sessionTTL = req.checker.AdjustSessionTTL(req.ttl)
-
 		// Return a list of logins that meet the session TTL limit. This means if
 		// the requested session TTL is larger than the max session TTL for a login,
 		// that login will not be included in the list of allowed logins.
@@ -3261,7 +3293,7 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ
 
 	// only observe latencies for non-throttled requests
 	start := a.clock.Now()
-	defer generateRequestsLatencies.Observe(time.Since(start).Seconds())
+	defer func() { generateRequestsLatencies.Observe(time.Since(start).Seconds()) }()
 
 	generateRequestsCount.Inc()
 	generateRequestsCurrent.Inc()
@@ -3723,6 +3755,10 @@ func (a *Server) NewWebSession(ctx context.Context, req types.NewWebSessionReque
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	if req.LoginIP == "" {
+		// TODO(antonam): consider turning this into error after all use cases are covered (before v14.0 testplan)
+		log.Debug("Creating new web session without login IP specified.")
+	}
 	clusterName, err := a.GetClusterName()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -3834,6 +3870,49 @@ func (a *Server) CreateAccessRequest(ctx context.Context, req types.AccessReques
 		return trace.Wrap(err)
 	}
 
+	// Look for user groups and associated applications to the request.
+	requestedResourceIDs := req.GetRequestedResourceIDs()
+	var additionalResources []types.ResourceID
+
+	var userGroups []types.ResourceID
+	existingApps := map[string]struct{}{}
+	for _, resource := range requestedResourceIDs {
+		switch resource.Kind {
+		case types.KindApp:
+			existingApps[resource.Name] = struct{}{}
+		case types.KindUserGroup:
+			userGroups = append(userGroups, resource)
+		}
+	}
+
+	for _, resource := range userGroups {
+		if resource.Kind != types.KindUserGroup {
+			continue
+		}
+
+		userGroup, err := a.GetUserGroup(ctx, resource.Name)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		for _, app := range userGroup.GetApplications() {
+			// Only add to the request if we haven't already added it.
+			if _, ok := existingApps[app]; !ok {
+				additionalResources = append(additionalResources, types.ResourceID{
+					ClusterName: resource.ClusterName,
+					Kind:        types.KindApp,
+					Name:        app,
+				})
+				existingApps[app] = struct{}{}
+			}
+		}
+	}
+
+	if len(additionalResources) > 0 {
+		requestedResourceIDs = append(requestedResourceIDs, additionalResources...)
+		req.SetRequestedResourceIDs(requestedResourceIDs)
+	}
+
 	if req.GetDryRun() {
 		// Made it this far with no errors, return before creating the request
 		// if this is a dry run.
@@ -5241,33 +5320,37 @@ func (a *Server) GetLicense(ctx context.Context) (string, error) {
 	return fmt.Sprintf("%s%s", a.license.CertPEM, a.license.KeyPEM), nil
 }
 
-// GetHeadlessAuthentication returns a headless authentication from the backend by name.
-// If it does not yet exist, a stub will be created to signal the login process to upsert
-// login details. This method will wait for the updated headless authentication and return it.
-func (a *Server) GetHeadlessAuthentication(ctx context.Context, name string) (*types.HeadlessAuthentication, error) {
-	// Try to create a stub if it doesn't already exist, then wait for full login details.
-	if _, err := a.Services.CreateHeadlessAuthenticationStub(ctx, name); err != nil && !trace.IsAlreadyExists(err) {
-		return nil, trace.Wrap(err)
-	}
-
-	sub, err := a.headlessAuthenticationWatcher.Subscribe(ctx, name)
+// GetHeadlessAuthenticationFromWatcher gets a headless authentication from the headless
+// authentication watcher.
+func (a *Server) GetHeadlessAuthenticationFromWatcher(ctx context.Context, username, name string) (*types.HeadlessAuthentication, error) {
+	sub, err := a.headlessAuthenticationWatcher.Subscribe(ctx, username, name)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	defer sub.Close()
 
-	waitCtx, cancel := context.WithTimeout(ctx, defaults.HTTPRequestTimeout)
-	defer cancel()
-
-	// wait for the headless authentication to be updated with valid login details
-	// by the login process. If the headless authentication is already updated,
-	// Wait will return it immediately.
-	headlessAuthn, err := a.headlessAuthenticationWatcher.WaitForUpdate(waitCtx, sub, func(ha *types.HeadlessAuthentication) (bool, error) {
+	// Wait for the login process to insert the headless authentication resource into the backend.
+	// If it already exists and passes the condition, WaitForUpdate will return it immediately.
+	headlessAuthn, err := sub.WaitForUpdate(ctx, func(ha *types.HeadlessAuthentication) (bool, error) {
 		return services.ValidateHeadlessAuthentication(ha) == nil, nil
 	})
 	return headlessAuthn, trace.Wrap(err)
 }
 
+// UpsertHeadlessAuthenticationStub creates a headless authentication stub for the user
+// that will expire after the standard callback timeout.
+func (a *Server) UpsertHeadlessAuthenticationStub(ctx context.Context, username string) error {
+	// Create the stub. If it already exists, update its expiration.
+	expires := a.clock.Now().Add(defaults.CallbackTimeout)
+	stub, err := types.NewHeadlessAuthentication(username, services.HeadlessAuthenticationUserStubID, expires)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	err = a.Services.UpsertHeadlessAuthentication(ctx, stub)
+	return trace.Wrap(err)
+}
+
 // GetAssistantMessages returns all messages with given conversation ID.
 func (a *Server) GetAssistantMessages(ctx context.Context, req *assist.GetAssistantMessagesRequest) (*assist.GetAssistantMessagesResponse, error) {
 	resp, err := a.Services.GetAssistantMessages(ctx, req)
@@ -5308,6 +5391,17 @@ func (a *Server) CompareAndSwapHeadlessAuthentication(ctx context.Context, old,
 	return headlessAuthn, trace.Wrap(err)
 }
 
+// GetUserPreferences returns the user preferences for a given user.
+func (a *Server) GetUserPreferences(ctx context.Context, request *userpreferencesv1.GetUserPreferencesRequest) (*userpreferencesv1.GetUserPreferencesResponse, error) {
+	resp, err := a.Services.GetUserPreferences(ctx, request)
+	return resp, trace.Wrap(err)
+}
+
+// UpsertUserPreferences creates or updates user preferences for a given username.
+func (a *Server) UpsertUserPreferences(ctx context.Context, request *userpreferencesv1.UpsertUserPreferencesRequest) error {
+	return trace.Wrap(a.Services.UpsertUserPreferences(ctx, request))
+}
+
 // getProxyPublicAddr returns the first valid, non-empty proxy public address it
 // finds, or empty otherwise.
 func (a *Server) getProxyPublicAddr() string {
diff --git a/lib/auth/auth_login_test.go b/lib/auth/auth_login_test.go
index 233d0f0145234..095bcc4012691 100644
--- a/lib/auth/auth_login_test.go
+++ b/lib/auth/auth_login_test.go
@@ -779,14 +779,6 @@ func TestServer_Authenticate_headless(t *testing.T) {
 				ha.State = types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED
 			},
 			expectErr: true,
-		}, {
-			name: "NOK user mismatch",
-			update: func(ha *types.HeadlessAuthentication, mfa *types.MFADevice) {
-				ha.State = types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED
-				ha.MfaDevice = mfa
-				ha.User = "other-user"
-			},
-			expectErr: true,
 		}, {
 			name: "NOK denied",
 			update: func(ha *types.HeadlessAuthentication, mfa *types.MFADevice) {
@@ -826,7 +818,7 @@ func TestServer_Authenticate_headless(t *testing.T) {
 			require.NoError(t, err)
 			require.NotEmpty(t, attempts, "Want at least one failed login attempt")
 
-			ctx, cancel := context.WithTimeout(ctx, 2*time.Second)
+			ctx, cancel := context.WithTimeout(ctx, 3*time.Second)
 			defer cancel()
 
 			// Start a goroutine to catch the headless authentication attempt and update with test case values.
@@ -834,7 +826,13 @@ func TestServer_Authenticate_headless(t *testing.T) {
 			go func() {
 				defer close(errC)
 
-				headlessAuthn, err := srv.Auth().GetHeadlessAuthentication(ctx, headlessID)
+				err := srv.Auth().UpsertHeadlessAuthenticationStub(ctx, username)
+				if err != nil {
+					errC <- err
+					return
+				}
+
+				headlessAuthn, err := srv.Auth().GetHeadlessAuthenticationFromWatcher(ctx, username, headlessID)
 				if err != nil {
 					errC <- err
 					return
diff --git a/lib/auth/auth_with_roles.go b/lib/auth/auth_with_roles.go
index 44a32bec4ede4..1aa857dfed528 100644
--- a/lib/auth/auth_with_roles.go
+++ b/lib/auth/auth_with_roles.go
@@ -23,6 +23,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/roundtrip"
 	"github.com/gravitational/trace"
 	"github.com/sirupsen/logrus"
@@ -31,6 +32,7 @@ import (
 	"golang.org/x/exp/slices"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api"
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/okta"
 	"github.com/gravitational/teleport/api/client/proto"
@@ -44,6 +46,7 @@ import (
 	pluginspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
 	samlidppb "github.com/gravitational/teleport/api/gen/proto/go/teleport/samlidp/v1"
 	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
+	userpreferencespb "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1"
 	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
@@ -316,6 +319,15 @@ func (a *ServerWithRoles) PluginsClient() pluginspb.PluginServiceClient {
 	)
 }
 
+// EmbeddingClient allows ServerWithRoles to implement ClientI.
+// It should not be called through ServerWithRoles,
+// as it returns a dummy client that will always respond with "not implemented".
+func (a *ServerWithRoles) EmbeddingClient() assist.AssistEmbeddingServiceClient {
+	return assist.NewAssistEmbeddingServiceClient(
+		utils.NewGRPCDummyClientConnection("EmbeddingClient() should not be called on ServerWithRoles"),
+	)
+}
+
 // SAMLIdPClient allows ServerWithRoles to implement ClientI.
 // It should not be called through ServerWithRoles,
 // as it returns a dummy client that will always respond with "not implemented".
@@ -1134,6 +1146,15 @@ func (a *ServerWithRoles) GetInstances(ctx context.Context, filter types.Instanc
 	return a.authServer.GetInstances(ctx, filter)
 }
 
+// GetNodeStream returns a stream of nodes.
+func (a *ServerWithRoles) GetNodeStream(ctx context.Context, namespace string) stream.Stream[types.Server] {
+	if err := a.action(namespace, types.KindNode, types.VerbList, types.VerbRead); err != nil {
+		return stream.Fail[types.Server](trace.Wrap(err))
+	}
+
+	return a.authServer.GetNodeStream(ctx, namespace)
+}
+
 func (a *ServerWithRoles) GetClusterAlerts(ctx context.Context, query types.GetClusterAlertsRequest) ([]types.ClusterAlert, error) {
 	// unauthenticated clients can never check for alerts. we don't normally explicitly
 	// check for this kind of thing, but since alerts use an unusual access-control
@@ -1431,6 +1452,19 @@ func (a *ServerWithRoles) NewWatcher(ctx context.Context, watch types.Watch) (ty
 					}
 				}
 			}
+		case types.KindHeadlessAuthentication:
+			var filter types.HeadlessAuthenticationFilter
+			if err := filter.FromMap(kind.Filter); err != nil {
+				if watch.AllowPartialSuccess {
+					continue
+				}
+				return nil, trace.Wrap(err)
+			}
+
+			// Only users can watch their own headless authentications.
+			if !hasLocalUserRole(a.context) || filter.Username != a.context.User.GetName() {
+				return nil, trace.AccessDenied("user %q cannot watch headless authentications of %q", a.context.User.GetName(), filter.Username)
+			}
 		default:
 			if err := a.action(apidefaults.Namespace, kind.Kind, types.VerbRead); err != nil {
 				if watch.AllowPartialSuccess {
@@ -1881,11 +1915,11 @@ func (a *ServerWithRoles) ListWindowsDesktopServices(ctx context.Context, req ty
 	return nil, trace.NotImplemented(notImplementedMessage)
 }
 
-func (a *ServerWithRoles) UpsertAuthServer(s types.Server) error {
+func (a *ServerWithRoles) UpsertAuthServer(ctx context.Context, s types.Server) error {
 	if err := a.action(apidefaults.Namespace, types.KindAuthServer, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
-	return a.authServer.UpsertAuthServer(s)
+	return a.authServer.UpsertAuthServer(ctx, s)
 }
 
 func (a *ServerWithRoles) GetAuthServers() ([]types.Server, error) {
@@ -1911,11 +1945,11 @@ func (a *ServerWithRoles) DeleteAuthServer(name string) error {
 	return a.authServer.DeleteAuthServer(name)
 }
 
-func (a *ServerWithRoles) UpsertProxy(s types.Server) error {
+func (a *ServerWithRoles) UpsertProxy(ctx context.Context, s types.Server) error {
 	if err := a.action(apidefaults.Namespace, types.KindProxy, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
-	return a.authServer.UpsertProxy(s)
+	return a.authServer.UpsertProxy(ctx, s)
 }
 
 func (a *ServerWithRoles) GetProxies() ([]types.Server, error) {
@@ -1934,11 +1968,11 @@ func (a *ServerWithRoles) DeleteAllProxies() error {
 }
 
 // DeleteProxy deletes proxy by name
-func (a *ServerWithRoles) DeleteProxy(name string) error {
+func (a *ServerWithRoles) DeleteProxy(ctx context.Context, name string) error {
 	if err := a.action(apidefaults.Namespace, types.KindProxy, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
-	return a.authServer.DeleteProxy(name)
+	return a.authServer.DeleteProxy(ctx, name)
 }
 
 func (a *ServerWithRoles) UpsertReverseTunnel(r types.ReverseTunnel) error {
@@ -3631,6 +3665,11 @@ func (a *ServerWithRoles) UpsertRole(ctx context.Context, role types.Role) error
 		return trace.Wrap(err)
 	}
 
+	if downgradeReason := role.GetMetadata().Labels[types.TeleportDowngradedLabel]; downgradeReason != "" {
+		return trace.BadParameter("refusing to upsert role because %s label is set with reason %q",
+			types.TeleportDowngradedLabel, downgradeReason)
+	}
+
 	// Some options are only available with enterprise subscription
 	if err := checkRoleFeatureSupport(role); err != nil {
 		return trace.Wrap(err)
@@ -3651,6 +3690,18 @@ func (a *ServerWithRoles) UpsertRole(ctx context.Context, role types.Role) error
 		}
 	}
 
+	// Note: passing a.authServer.GetInventoryStatus here intentionally bypasses
+	// the authz checks in a.GetInventoryStatus, for these reasons:
+	// - We don't actually return the inventory status result, we're only using
+	//   it internally to check for a misconfiguration and return a generic error.
+	// - We don't want to require users to have new permissions to call UpsertRole.
+	// - GetInventoryStatus currently only supports builtin roles.
+	// - This user already has UpsertRole permissions and could give themselves
+	//   arbitrary permissions if they wanted to.
+	if err := checkInventorySupportsRole(ctx, role, api.Version, a.authServer.GetInventoryStatus); err != nil {
+		return trace.Wrap(err)
+	}
+
 	return a.authServer.UpsertRole(ctx, role)
 }
 
@@ -3687,6 +3738,91 @@ func checkRoleFeatureSupport(role types.Role) error {
 	}
 }
 
+type inventoryGetter func(context.Context, proto.InventoryStatusRequest) proto.InventoryStatusSummary
+
+// checkInventorySupportsRole returns an error if any connected servers found in
+// the inventory do not support some features enabled in [role]. This is only a
+// best-effort check meant to prevent common user errors, since some unsupported
+// servers may not be connected to this auth, or they may connect later.
+func checkInventorySupportsRole(ctx context.Context, role types.Role, authVersion string, getInventory inventoryGetter) error {
+	minRequiredVersion, msg, err := minRequiredVersionForRole(role)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if safeToSkipInventoryCheck(*semver.New(authVersion), minRequiredVersion) {
+		return nil
+	}
+
+	inventoryStatus := getInventory(ctx, proto.InventoryStatusRequest{Connected: true})
+	for _, hello := range inventoryStatus.Connected {
+		version, err := semver.NewVersion(hello.Version)
+		if err != nil {
+			log.Warnf("Connected server %q has unparseable version %q", hello.ServerID, hello.Version)
+			continue
+		}
+		if version.LessThan(minRequiredVersion) {
+			return trace.BadParameter(msg)
+		}
+	}
+	return nil
+}
+
+func minRequiredVersionForRole(role types.Role) (semver.Version, string, error) {
+	// DELETE IN 15.0.0
+	// The label expression checks can be deleted in 15.0.0 since all servers
+	// that don't support label expressions are on 13.x or older. If no other
+	// feature checks have been added at that time, checkInventorySupportsRole
+	// can be deleted entirely.
+	for _, kind := range types.LabelMatcherKinds {
+		for _, rct := range []types.RoleConditionType{types.Allow, types.Deny} {
+			labelMatchers, err := role.GetLabelMatchers(rct, kind)
+			if err != nil {
+				return semver.Version{}, "", trace.Wrap(err)
+			}
+			if len(labelMatchers.Expression) != 0 {
+				return minSupportedLabelExpressionVersion, fmt.Sprintf(
+					"one or more connected servers is running a Teleport version "+
+						"older than %s which does not support the label expressions used "+
+						"in this role.", minSupportedLabelExpressionVersion), nil
+			}
+		}
+	}
+	// Return the zero version to indicate all server versions are supported.
+	return semver.Version{}, "", nil
+}
+
+// safeToSkipInventoryCheck returns true if all possible versions *less than*
+// [minRequiredVersion] are more than one major version behind [authVersion].
+//
+// In this case, any servers older than [minRequiredVersion] are already
+// unsupported and shouldn't be connected, so it's safe to skip the inventory
+// check as an optimization.
+//
+// This also covers the case where minRequiredVersionForRole returned
+// the zero version.
+//
+// Examples:
+// - (15.x.x, 13.1.1) -> true (anything older than 13.1.1 is >1 major behind v15)
+// - (14.x.x, 13.1.1) -> false (13.0.9 is within one major of v14)
+// - (14.x.x, 13.0.0) -> true (anything older than 13.0.0 is >1 major behind v14)
+func safeToSkipInventoryCheck(authVersion, minRequiredVersion semver.Version) bool {
+	return authVersion.Major > roundToNextMajor(minRequiredVersion)
+}
+
+// roundToNextMajor returns the next major version that is *not less than* [v].
+//
+// Examples:
+// - 13.1.1 -> 14.0.0
+// - 13.0.0 -> 13.0.0
+// - 13.0.0-alpha -> 13.0.0
+func roundToNextMajor(v semver.Version) int64 {
+	if (semver.Version{Major: v.Major}).LessThan(v) {
+		return v.Major + 1
+	}
+	return v.Major
+}
+
 // GetRole returns role by name
 func (a *ServerWithRoles) GetRole(ctx context.Context, name string) (types.Role, error) {
 	// Current-user exception: we always allow users to read roles
@@ -6070,50 +6206,63 @@ func (a *ServerWithRoles) DeleteAllUserGroups(ctx context.Context) error {
 	return a.authServer.DeleteAllUserGroups(ctx)
 }
 
-// GetHeadlessAuthentication retrieves a headless authentication by id.
-func (a *ServerWithRoles) GetHeadlessAuthentication(ctx context.Context, id string) (*types.HeadlessAuthentication, error) {
-	// GetHeadlessAuthentication will wait for the headless details
-	// if they don't yet exist in the backend.
-	ctx, cancel := context.WithTimeout(ctx, defaults.HTTPRequestTimeout)
-	defer cancel()
+// GetHeadlessAuthentication gets a headless authentication from the backend.
+func (a *ServerWithRoles) GetHeadlessAuthentication(ctx context.Context, name string) (*types.HeadlessAuthentication, error) {
+	if !hasLocalUserRole(a.context) {
+		return nil, trace.AccessDenied("non-local user roles cannot get headless authentication resources")
+	}
+	username := a.context.User.GetName()
 
-	headlessAuthn, err := a.authServer.GetHeadlessAuthentication(ctx, id)
+	headlessAuthn, err := a.authServer.GetHeadlessAuthentication(ctx, username, name)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	return headlessAuthn, nil
+}
 
-	// Only users can get their own headless authentication requests.
-	if !hasLocalUserRole(a.context) || headlessAuthn.User != a.context.User.GetName() {
-		// This method would usually time out above if the headless authentication
-		// does not exist, so we mimick this behavior here for users without access.
-		<-ctx.Done()
-		return nil, trace.Wrap(ctx.Err())
+// GetHeadlessAuthenticationFromWatcher gets a headless authentication from the headless
+// authentication watcher.
+func (a *ServerWithRoles) GetHeadlessAuthenticationFromWatcher(ctx context.Context, name string) (*types.HeadlessAuthentication, error) {
+	if !hasLocalUserRole(a.context) {
+		return nil, trace.AccessDenied("non-local user roles cannot get headless authentication resources")
+	}
+	username := a.context.User.GetName()
+
+	headlessAuthn, err := a.authServer.GetHeadlessAuthenticationFromWatcher(ctx, username, name)
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
 
 	return headlessAuthn, nil
 }
 
+// UpsertHeadlessAuthenticationStub creates a headless authentication stub for the user
+// that will expire after the standard callback timeout. Headless login processes will
+// look for this stub before inserting the headless authentication resource into the
+// backend as a form of indirect authorization.
+func (a *ServerWithRoles) UpsertHeadlessAuthenticationStub(ctx context.Context) error {
+	if !hasLocalUserRole(a.context) {
+		return trace.AccessDenied("non-local user roles cannot create headless authentication stubs")
+	}
+	username := a.context.User.GetName()
+
+	err := a.authServer.UpsertHeadlessAuthenticationStub(ctx, username)
+	return trace.Wrap(err)
+}
+
 // UpdateHeadlessAuthenticationState updates a headless authentication state.
-func (a *ServerWithRoles) UpdateHeadlessAuthenticationState(ctx context.Context, id string, state types.HeadlessAuthenticationState, mfaResp *proto.MFAAuthenticateResponse) error {
-	// GetHeadlessAuthentication will wait for the headless details
-	// if they don't yet exist in the backend.
-	ctx, cancel := context.WithTimeout(ctx, defaults.HTTPRequestTimeout)
-	defer cancel()
+func (a *ServerWithRoles) UpdateHeadlessAuthenticationState(ctx context.Context, name string, state types.HeadlessAuthenticationState, mfaResp *proto.MFAAuthenticateResponse) error {
+	if !hasLocalUserRole(a.context) {
+		return trace.AccessDenied("non-local user roles cannot approve or deny headless authentication resources")
+	}
+	username := a.context.User.GetName()
 
-	headlessAuthn, err := a.authServer.GetHeadlessAuthentication(ctx, id)
+	headlessAuthn, err := a.authServer.GetHeadlessAuthentication(ctx, username, name)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	// Only users can update their own headless authentication requests.
-	if !hasLocalUserRole(a.context) || headlessAuthn.User != a.context.User.GetName() {
-		// This method would usually time out above if the headless authentication
-		// does not exist, so we mimick this behavior here for users without access.
-		<-ctx.Done()
-		return trace.Wrap(ctx.Err())
-	}
-
-	if headlessAuthn.State != types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING {
+	if !headlessAuthn.State.IsPending() {
 		return trace.AccessDenied("cannot update a headless authentication state from a non-pending state")
 	}
 
@@ -6149,6 +6298,58 @@ func (a *ServerWithRoles) UpdateHeadlessAuthenticationState(ctx context.Context,
 	return trace.Wrap(err)
 }
 
+// MaintainHeadlessAuthenticationStub maintains a headless authentication stub for the user.
+// Headless login processes will look for this stub before inserting the headless authentication
+// resource into the backend as a form of indirect authorization.
+func (a *ServerWithRoles) MaintainHeadlessAuthenticationStub(ctx context.Context) error {
+	if !hasLocalUserRole(a.context) {
+		return trace.AccessDenied("non-local user roles cannot create headless authentication stubs")
+	}
+	username := a.context.User.GetName()
+
+	// Create a stub and re-create it each time it expires.
+	// Authorization is handled by UpsertHeadlessAuthenticationStub.
+	if err := a.authServer.UpsertHeadlessAuthenticationStub(ctx, username); err != nil {
+		return trace.Wrap(err)
+	}
+
+	ticker := time.NewTicker(defaults.CallbackTimeout)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if err := a.authServer.UpsertHeadlessAuthenticationStub(ctx, username); err != nil {
+				return trace.Wrap(err)
+			}
+		case <-ctx.Done():
+			return nil
+		}
+	}
+}
+
+// WatchPendingHeadlessAuthentications creates a watcher for pending headless authentication for the current user.
+func (a *ServerWithRoles) WatchPendingHeadlessAuthentications(ctx context.Context) (types.Watcher, error) {
+	if !hasLocalUserRole(a.context) {
+		return nil, trace.AccessDenied("non-local user roles cannot watch headless authentications")
+	}
+	username := a.context.User.GetName()
+
+	// Authorization is handled by NewWatcher.
+	filter := types.HeadlessAuthenticationFilter{
+		Username: username,
+		State:    types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING,
+	}
+
+	return a.NewWatcher(ctx, types.Watch{
+		Name: username,
+		Kinds: []types.WatchKind{{
+			Kind:   types.KindHeadlessAuthentication,
+			Filter: filter.IntoMap(),
+		}},
+	})
+}
+
 // CreateAssistantConversation creates a new conversation entry in the backend.
 func (a *ServerWithRoles) CreateAssistantConversation(ctx context.Context, req *assist.CreateAssistantConversationRequest) (*assist.CreateAssistantConversationResponse, error) {
 	if err := a.action(apidefaults.Namespace, types.KindAssistant, types.VerbCreate); err != nil {
@@ -6212,6 +6413,29 @@ func (a *ServerWithRoles) UpdateAssistantConversationInfo(ctx context.Context, m
 	return a.authServer.UpdateAssistantConversationInfo(ctx, msg)
 }
 
+// GetUserPreferences returns the user preferences for a given user.
+func (a *ServerWithRoles) GetUserPreferences(ctx context.Context, req *userpreferencespb.GetUserPreferencesRequest) (*userpreferencespb.GetUserPreferencesResponse, error) {
+	if err := a.currentUserAction(req.Username); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	preferences, err := a.authServer.GetUserPreferences(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return preferences, nil
+}
+
+// UpsertUserPreferences creates or updates user preferences for a given username.
+func (a *ServerWithRoles) UpsertUserPreferences(ctx context.Context, req *userpreferencespb.UpsertUserPreferencesRequest) error {
+	if err := a.currentUserAction(req.Username); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(a.authServer.UpsertUserPreferences(ctx, req))
+}
+
 // CloneHTTPClient creates a new HTTP client with the same configuration.
 func (a *ServerWithRoles) CloneHTTPClient(params ...roundtrip.ClientParam) (*HTTPClient, error) {
 	return nil, trace.NotImplemented("not implemented")
diff --git a/lib/auth/auth_with_roles_test.go b/lib/auth/auth_with_roles_test.go
index 87ccfa93268a3..012c9b2b0a132 100644
--- a/lib/auth/auth_with_roles_test.go
+++ b/lib/auth/auth_with_roles_test.go
@@ -25,6 +25,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/google/uuid"
@@ -35,6 +36,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/defaults"
@@ -205,6 +207,10 @@ func TestLocalUserCanReissueCerts(t *testing.T) {
 			ctx := context.Background()
 			user, role, err := CreateUserAndRole(srv.Auth(), test.desc, []string{"role"}, nil)
 			require.NoError(t, err)
+			authPref, err := srv.Auth().GetAuthPreference(ctx)
+			require.NoError(t, err)
+			authPref.SetDefaultSessionTTL(types.Duration(test.expiresIn))
+			srv.Auth().SetAuthPreference(ctx, authPref)
 
 			var id TestIdentity
 			if test.renewable {
@@ -1183,16 +1189,26 @@ func TestSessionRecordingConfigRBAC(t *testing.T) {
 	})
 }
 
-// time go test ./lib/auth -bench=. -run=^$ -v
+// go test ./lib/auth -bench=. -run=^$ -v -benchtime 1x
 // goos: darwin
 // goarch: amd64
 // pkg: github.com/gravitational/teleport/lib/auth
 // cpu: Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
 // BenchmarkListNodes
-// BenchmarkListNodes-16    	       1	1000469673 ns/op	518721960 B/op	 8344858 allocs/op
+// BenchmarkListNodes/simple_labels
+// BenchmarkListNodes/simple_labels-16                    1        1079886286 ns/op        525128104 B/op   8831939 allocs/op
+// BenchmarkListNodes/simple_expression
+// BenchmarkListNodes/simple_expression-16                1         770118479 ns/op        432667432 B/op   6514790 allocs/op
+// BenchmarkListNodes/labels
+// BenchmarkListNodes/labels-16                           1        1931843502 ns/op        741444360 B/op  15159333 allocs/op
+// BenchmarkListNodes/expression
+// BenchmarkListNodes/expression-16                       1        1040855282 ns/op        509643128 B/op   8120970 allocs/op
+// BenchmarkListNodes/complex_labels
+// BenchmarkListNodes/complex_labels-16                   1        2274376396 ns/op        792948904 B/op  17084107 allocs/op
+// BenchmarkListNodes/complex_expression
+// BenchmarkListNodes/complex_expression-16               1        1518800599 ns/op        738532920 B/op  12483748 allocs/op
 // PASS
-// ok  	github.com/gravitational/teleport/lib/auth	3.695s
-// go test ./lib/auth -bench=. -run=^$ -v  19.02s user 3.87s system 244% cpu 9.376 total
+// ok      github.com/gravitational/teleport/lib/auth      11.679s
 func BenchmarkListNodes(b *testing.B) {
 	const nodeCount = 50_000
 	const roleCount = 32
@@ -1206,47 +1222,149 @@ func BenchmarkListNodes(b *testing.B) {
 	ctx := context.Background()
 	srv := newTestTLSServer(b)
 
-	var values []string
+	var ids []string
 	for i := 0; i < roleCount; i++ {
-		values = append(values, uuid.New().String())
+		ids = append(ids, uuid.New().String())
 	}
 
-	values[0] = "hidden"
+	ids[0] = "hidden"
 
 	var hiddenNodes int
 	// Create test nodes.
 	for i := 0; i < nodeCount; i++ {
 		name := uuid.New().String()
-		val := values[i%len(values)]
-		if val == "hidden" {
+		id := ids[i%len(ids)]
+		if id == "hidden" {
 			hiddenNodes++
 		}
 		node, err := types.NewServerWithLabels(
 			name,
 			types.KindNode,
 			types.ServerSpecV2{},
-			map[string]string{"key": val},
+			map[string]string{
+				"key":   id,
+				"group": "users",
+			},
 		)
 		require.NoError(b, err)
 
 		_, err = srv.Auth().UpsertNode(ctx, node)
 		require.NoError(b, err)
 	}
-
 	testNodes, err := srv.Auth().GetNodes(ctx, defaults.Namespace)
 	require.NoError(b, err)
 	require.Len(b, testNodes, nodeCount)
 
+	for _, tc := range []struct {
+		desc     string
+		editRole func(types.Role, string)
+	}{
+		{
+			desc: "simple labels",
+			editRole: func(r types.Role, id string) {
+				if id == "hidden" {
+					r.SetNodeLabels(types.Deny, types.Labels{"key": {id}})
+				} else {
+					r.SetNodeLabels(types.Allow, types.Labels{"key": {id}})
+				}
+			},
+		},
+		{
+			desc: "simple expression",
+			editRole: func(r types.Role, id string) {
+				if id == "hidden" {
+					err = r.SetLabelMatchers(types.Deny, types.KindNode, types.LabelMatchers{
+						Expression: `labels.key == "hidden"`,
+					})
+					require.NoError(b, err)
+				} else {
+					err := r.SetLabelMatchers(types.Allow, types.KindNode, types.LabelMatchers{
+						Expression: fmt.Sprintf(`labels.key == %q`, id),
+					})
+					require.NoError(b, err)
+				}
+			},
+		},
+		{
+			desc: "labels",
+			editRole: func(r types.Role, id string) {
+				r.SetNodeLabels(types.Allow, types.Labels{
+					"key":   {id},
+					"group": {"{{external.group}}"},
+				})
+				r.SetNodeLabels(types.Deny, types.Labels{"key": {"hidden"}})
+			},
+		},
+		{
+			desc: "expression",
+			editRole: func(r types.Role, id string) {
+				err := r.SetLabelMatchers(types.Allow, types.KindNode, types.LabelMatchers{
+					Expression: fmt.Sprintf(`labels.key == %q && contains(user.spec.traits["group"], labels["group"])`,
+						id),
+				})
+				require.NoError(b, err)
+				err = r.SetLabelMatchers(types.Deny, types.KindNode, types.LabelMatchers{
+					Expression: `labels.key == "hidden"`,
+				})
+				require.NoError(b, err)
+			},
+		},
+		{
+			desc: "complex labels",
+			editRole: func(r types.Role, id string) {
+				r.SetNodeLabels(types.Allow, types.Labels{
+					"key": {"other", id, "another"},
+					"group": {
+						`{{regexp.replace(external.group, "^(.*)$", "$1")}}`,
+						"{{email.local(external.email)}}",
+					},
+				})
+				r.SetNodeLabels(types.Deny, types.Labels{"key": {"hidden"}})
+			},
+		},
+		{
+			desc: "complex expression",
+			editRole: func(r types.Role, id string) {
+				expr := fmt.Sprintf(
+					`(labels.key == "other" || labels.key == %q || labels.key == "another") &&
+					 (contains(email.local(user.spec.traits["email"]), labels["group"]) ||
+						 contains(regexp.replace(user.spec.traits["group"], "^(.*)$", "$1"), labels["group"]))`,
+					id)
+				err := r.SetLabelMatchers(types.Allow, types.KindNode, types.LabelMatchers{
+					Expression: expr,
+				})
+				require.NoError(b, err)
+				err = r.SetLabelMatchers(types.Deny, types.KindNode, types.LabelMatchers{
+					Expression: `labels.key == "hidden"`,
+				})
+				require.NoError(b, err)
+			},
+		},
+	} {
+		b.Run(tc.desc, func(b *testing.B) {
+			benchmarkListNodes(
+				b, ctx,
+				nodeCount, roleCount, hiddenNodes,
+				srv,
+				ids,
+				tc.editRole,
+			)
+		})
+	}
+}
+
+func benchmarkListNodes(
+	b *testing.B, ctx context.Context,
+	nodeCount, roleCount, hiddenNodes int,
+	srv *TestTLSServer,
+	ids []string,
+	editRole func(r types.Role, id string),
+) {
 	var roles []types.Role
-	for _, val := range values {
-		role, err := types.NewRole(fmt.Sprintf("role-%s", val), types.RoleSpecV6{})
+	for _, id := range ids {
+		role, err := types.NewRole(fmt.Sprintf("role-%s", id), types.RoleSpecV6{})
 		require.NoError(b, err)
-
-		if val == "hidden" {
-			role.SetNodeLabels(types.Deny, types.Labels{"key": {val}})
-		} else {
-			role.SetNodeLabels(types.Allow, types.Labels{"key": {val}})
-		}
+		editRole(role, id)
 		roles = append(roles, role)
 	}
 
@@ -1255,6 +1373,12 @@ func BenchmarkListNodes(b *testing.B) {
 
 	user, err := CreateUser(srv.Auth(), username, roles...)
 	require.NoError(b, err)
+	user.SetTraits(map[string][]string{
+		"group": {"users"},
+		"email": {"test@example.com"},
+	})
+	err = srv.Auth().UpsertUser(user)
+	require.NoError(b, err)
 	identity := TestUser(user.GetName())
 	clt, err := srv.NewClient(identity)
 	require.NoError(b, err)
@@ -3199,7 +3323,7 @@ func createUserGroup(t *testing.T, s *ServerWithRoles, name string, labels map[s
 	userGroup, err := types.NewUserGroup(types.Metadata{
 		Name:   name,
 		Labels: labels,
-	})
+	}, types.UserGroupSpecV1{})
 	require.NoError(t, err)
 	err = s.CreateUserGroup(context.Background(), userGroup)
 	require.NoError(t, err)
@@ -4545,6 +4669,11 @@ func TestGetHeadlessAuthentication(t *testing.T) {
 		require.ErrorContains(t, err, context.DeadlineExceeded.Error(), "expected context deadline error but got: %v", err)
 	}
 
+	assertAccessDenied := func(t require.TestingT, err error, i ...interface{}) {
+		require.Error(t, err)
+		require.True(t, trace.IsAccessDenied(err), "expected access denied error but got: %v", err)
+	}
+
 	for _, tc := range []struct {
 		name                  string
 		headlessID            string
@@ -4568,20 +4697,17 @@ func TestGetHeadlessAuthentication(t *testing.T) {
 		}, {
 			name:        "NOK admin",
 			identity:    TestAdmin(),
-			assertError: assertTimeout,
+			assertError: assertAccessDenied,
 		},
 	} {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
-			tc := tc
 			t.Parallel()
 
 			// create headless authn
 			headlessAuthn := newTestHeadlessAuthn(t, username, srv.Auth().clock)
-			stub, err := srv.Auth().CreateHeadlessAuthenticationStub(ctx, headlessAuthn.GetName())
-			require.NoError(t, err)
-			_, err = srv.Auth().CompareAndSwapHeadlessAuthentication(ctx, stub, headlessAuthn)
+			err := srv.Auth().UpsertHeadlessAuthentication(ctx, headlessAuthn)
 			require.NoError(t, err)
-
 			client, err := srv.NewClient(tc.identity)
 			require.NoError(t, err)
 
@@ -4612,9 +4738,14 @@ func TestUpdateHeadlessAuthenticationState(t *testing.T) {
 	_, _, err := CreateUserAndRole(srv.Auth(), otherUsername, nil, nil)
 	require.NoError(t, err)
 
-	assertTimeout := func(t require.TestingT, err error, i ...interface{}) {
+	assertNotFound := func(t require.TestingT, err error, i ...interface{}) {
 		require.Error(t, err)
-		require.ErrorContains(t, err, context.DeadlineExceeded.Error(), "expected context deadline error but got: %v", err)
+		require.True(t, trace.IsNotFound(err), "expected not found error but got: %v", err)
+	}
+
+	assertAccessDenied := func(t require.TestingT, err error, i ...interface{}) {
+		require.Error(t, err)
+		require.True(t, trace.IsAccessDenied(err), "expected access denied error but got: %v", err)
 	}
 
 	for _, tc := range []struct {
@@ -4637,49 +4768,45 @@ func TestUpdateHeadlessAuthenticationState(t *testing.T) {
 			withMFA:     true,
 			assertError: require.NoError,
 		}, {
-			name:    "NOK same user approved without mfa",
-			state:   types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED,
-			withMFA: false,
-			assertError: func(t require.TestingT, err error, i ...interface{}) {
-				require.Error(t, err)
-				require.True(t, trace.IsAccessDenied(err), "expected access denied error but got: %v", err)
-			},
+			name:        "NOK same user approved without mfa",
+			state:       types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED,
+			withMFA:     false,
+			assertError: assertAccessDenied,
 		}, {
 			name:        "NOK not found",
 			headlessID:  uuid.NewString(),
 			state:       types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_DENIED,
-			assertError: assertTimeout,
+			assertError: assertNotFound,
 		}, {
-			name:        "NOK different user denied",
+			name:        "NOK different user not found",
 			state:       types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_DENIED,
 			identity:    TestUser(otherUsername),
-			assertError: assertTimeout,
+			assertError: assertNotFound,
 		}, {
 			name:        "NOK different user approved",
 			state:       types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED,
 			identity:    TestUser(otherUsername),
-			assertError: assertTimeout,
+			assertError: assertNotFound,
 		}, {
 			name:        "NOK admin denied",
 			state:       types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_DENIED,
 			identity:    TestAdmin(),
-			assertError: assertTimeout,
+			assertError: assertAccessDenied,
 		}, {
 			name:        "NOK admin approved",
 			state:       types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED,
 			identity:    TestAdmin(),
-			assertError: assertTimeout,
+			assertError: assertAccessDenied,
 		},
 	} {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
-			tc := tc
 			t.Parallel()
 
 			// create headless authn
 			headlessAuthn := newTestHeadlessAuthn(t, mfa.User, srv.Auth().clock)
-			stub, err := srv.Auth().CreateHeadlessAuthenticationStub(ctx, headlessAuthn.GetName())
-			require.NoError(t, err)
-			_, err = srv.Auth().CompareAndSwapHeadlessAuthentication(ctx, stub, headlessAuthn)
+			headlessAuthn.State = types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING
+			err := srv.Auth().UpsertHeadlessAuthentication(ctx, headlessAuthn)
 			require.NoError(t, err)
 
 			// default to mfa user
@@ -5245,3 +5372,337 @@ func createSessionTestUsers(t *testing.T, authServer *Server) (string, string, s
 	require.NoError(t, err)
 	return "alice", "bob", "admin"
 }
+
+func TestCheckInventorySupportsRole(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	emptyRole, err := types.NewRole("empty", types.RoleSpecV6{})
+	require.NoError(t, err)
+
+	roleWithLabelExpressions, err := types.NewRole("expressions", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			NodeLabelsExpression: `contains(user.spec.traits["allow-env"], labels["env"])`,
+		},
+	})
+	require.NoError(t, err)
+
+	for _, tc := range []struct {
+		desc                   string
+		role                   types.Role
+		authVersion            string
+		inventoryVersions      []string
+		assertErr              require.ErrorAssertionFunc
+		expectNoInventoryCheck bool
+	}{
+		{
+			desc:                   "basic",
+			role:                   emptyRole,
+			authVersion:            api.Version,
+			inventoryVersions:      []string{"12.1.2", "13.0.0", api.Version},
+			assertErr:              require.NoError,
+			expectNoInventoryCheck: true,
+		},
+		{
+			desc:              "label expressions supported",
+			role:              roleWithLabelExpressions,
+			authVersion:       "14.0.0-dev",
+			inventoryVersions: []string{minSupportedLabelExpressionVersion.String(), "13.2.3"},
+			assertErr:         require.NoError,
+		},
+		{
+			desc:              "unparseable server version doesn't break UpsertRole",
+			role:              roleWithLabelExpressions,
+			authVersion:       "14.0.0-dev",
+			inventoryVersions: []string{"Not a version"},
+			assertErr:         require.NoError,
+		},
+		{
+			desc:              "block upsert with unsupported nodes in v13",
+			role:              roleWithLabelExpressions,
+			authVersion:       "13.2.3",
+			inventoryVersions: []string{minSupportedLabelExpressionVersion.String(), "13.0.0-unsupported", "13.2.3"},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.Error(t, err)
+				require.True(t, trace.IsBadParameter(err), "expected bad parameter error, got %v", err)
+				require.ErrorContains(t, err, "does not support the label expressions used in this role")
+			},
+		},
+		{
+			desc:              "block upsert with unsupported nodes in v14",
+			role:              roleWithLabelExpressions,
+			authVersion:       "14.1.2",
+			inventoryVersions: []string{minSupportedLabelExpressionVersion.String(), "13.0.0-unsupported", "13.2.3"},
+			assertErr: func(t require.TestingT, err error, args ...any) {
+				require.Error(t, err)
+				require.True(t, trace.IsBadParameter(err), "expected bad parameter error, got %v", err)
+				require.ErrorContains(t, err, "does not support the label expressions used in this role")
+			},
+		},
+		{
+			desc:                   "skip inventory check in 15",
+			role:                   roleWithLabelExpressions,
+			authVersion:            "15.0.0-dev",
+			inventoryVersions:      []string{"14.0.0", "15.0.0"},
+			assertErr:              require.NoError,
+			expectNoInventoryCheck: true,
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			getInventory := func(context.Context, proto.InventoryStatusRequest) proto.InventoryStatusSummary {
+				if tc.expectNoInventoryCheck {
+					require.Fail(t, "getInventory called when the inventory check should have been skipped")
+				}
+
+				hellos := make([]proto.UpstreamInventoryHello, 0, len(tc.inventoryVersions))
+				for _, v := range tc.inventoryVersions {
+					hellos = append(hellos, proto.UpstreamInventoryHello{
+						Version: v,
+					})
+				}
+				return proto.InventoryStatusSummary{
+					Connected: hellos,
+				}
+			}
+
+			err := checkInventorySupportsRole(ctx, tc.role, tc.authVersion, getInventory)
+			tc.assertErr(t, err)
+		})
+	}
+}
+
+func TestSafeToSkipInventoryCheck(t *testing.T) {
+	for _, tc := range []struct {
+		desc               string
+		authVersion        string
+		minRequiredVersion string
+		safeToSkip         bool
+	}{
+		{
+			desc:               "auth two majors ahead of required minor release",
+			authVersion:        "15.0.0",
+			minRequiredVersion: "13.1.0",
+			safeToSkip:         true,
+		},
+		{
+			desc:               "auth within one major of required minor release",
+			authVersion:        "14.0.0",
+			minRequiredVersion: "13.1.0",
+			safeToSkip:         false,
+		},
+		{
+			desc:               "auth one major greater than required major release",
+			authVersion:        "14.0.0",
+			minRequiredVersion: "13.0.0",
+			safeToSkip:         true, // anything older than 13.0.0 is >1 major behind 14.0.0
+		},
+		{
+			desc:               "auth within one major of required major release",
+			authVersion:        "13.3.12",
+			minRequiredVersion: "13.0.0",
+			safeToSkip:         false,
+		},
+		{
+			desc:               "matching releases",
+			authVersion:        "13.2.0",
+			minRequiredVersion: "13.2.0",
+			safeToSkip:         false,
+		},
+		{
+			desc:               "skip for zero version",
+			authVersion:        "13.2.0",
+			minRequiredVersion: "0.0.0",
+			safeToSkip:         true,
+		},
+	} {
+		require.Equal(t, tc.safeToSkip,
+			safeToSkipInventoryCheck(*semver.New(tc.authVersion), *semver.New(tc.minRequiredVersion)))
+	}
+}
+
+func TestCreateAccessRequest(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	srv := newTestTLSServer(t)
+	clock := srv.Clock()
+	alice, bob, admin := createSessionTestUsers(t, srv.Auth())
+
+	searchRole, err := types.NewRole("requestRole", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			Request: &types.AccessRequestConditions{
+				Roles:         []string{"requestRole"},
+				SearchAsRoles: []string{"requestRole"},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	requestRole, err := types.NewRole("requestRole", types.RoleSpecV6{})
+	require.NoError(t, err)
+
+	srv.Auth().CreateRole(ctx, searchRole)
+	srv.Auth().CreateRole(ctx, requestRole)
+
+	user, err := srv.Auth().GetUser(alice, true)
+	require.NoError(t, err)
+
+	user.AddRole(searchRole.GetName())
+	require.NoError(t, srv.Auth().UpsertUser(user))
+
+	userGroup1, err := types.NewUserGroup(types.Metadata{
+		Name: "user-group1",
+	}, types.UserGroupSpecV1{
+		Applications: []string{"app1", "app2", "app3"},
+	})
+	require.NoError(t, err)
+	require.NoError(t, srv.Auth().CreateUserGroup(ctx, userGroup1))
+
+	userGroup2, err := types.NewUserGroup(types.Metadata{
+		Name: "user-group2",
+	}, types.UserGroupSpecV1{})
+	require.NoError(t, err)
+	require.NoError(t, srv.Auth().CreateUserGroup(ctx, userGroup2))
+
+	userGroup3, err := types.NewUserGroup(types.Metadata{
+		Name: "user-group3",
+	}, types.UserGroupSpecV1{
+		Applications: []string{"app1", "app4", "app5"},
+	})
+	require.NoError(t, err)
+	require.NoError(t, srv.Auth().CreateUserGroup(ctx, userGroup3))
+
+	tests := []struct {
+		name             string
+		user             string
+		accessRequest    types.AccessRequest
+		errAssertionFunc require.ErrorAssertionFunc
+		expected         types.AccessRequest
+	}{
+		{
+			name: "user creates own pending access request",
+			user: alice,
+			accessRequest: mustAccessRequest(t, alice, types.RequestState_PENDING, clock.Now(), clock.Now().Add(time.Hour),
+				[]string{requestRole.GetName()}, []types.ResourceID{
+					mustResourceID(srv.ClusterName(), types.KindRole, requestRole.GetName()),
+				}),
+			errAssertionFunc: require.NoError,
+			expected: mustAccessRequest(t, alice, types.RequestState_PENDING, clock.Now(), clock.Now().Add(time.Hour),
+				[]string{requestRole.GetName()}, []types.ResourceID{
+					mustResourceID(srv.ClusterName(), types.KindRole, requestRole.GetName()),
+				}),
+		},
+		{
+			name: "admin creates a request for alice",
+			user: admin,
+			accessRequest: mustAccessRequest(t, alice, types.RequestState_PENDING, clock.Now(), clock.Now().Add(time.Hour),
+				[]string{requestRole.GetName()}, []types.ResourceID{
+					mustResourceID(srv.ClusterName(), types.KindRole, requestRole.GetName()),
+				}),
+			errAssertionFunc: require.NoError,
+			expected: mustAccessRequest(t, alice, types.RequestState_PENDING, clock.Now(), clock.Now().Add(time.Hour),
+				[]string{requestRole.GetName()}, []types.ResourceID{
+					mustResourceID(srv.ClusterName(), types.KindRole, requestRole.GetName()),
+				}),
+		},
+		{
+			name: "bob fails to create a request for alice",
+			user: bob,
+			accessRequest: mustAccessRequest(t, alice, types.RequestState_PENDING, clock.Now(), clock.Now().Add(time.Hour),
+				[]string{requestRole.GetName()}, []types.ResourceID{
+					mustResourceID(srv.ClusterName(), types.KindRole, requestRole.GetName()),
+				}),
+			errAssertionFunc: require.Error,
+		},
+		{
+			name: "user creates own pending access request with user group needing app expansion",
+			user: alice,
+			accessRequest: mustAccessRequest(t, alice, types.RequestState_PENDING, clock.Now(), clock.Now().Add(time.Hour),
+				[]string{requestRole.GetName()}, []types.ResourceID{
+					mustResourceID(srv.ClusterName(), types.KindRole, requestRole.GetName()),
+					mustResourceID(srv.ClusterName(), types.KindUserGroup, userGroup1.GetName()),
+					mustResourceID(srv.ClusterName(), types.KindApp, "app1"),
+					mustResourceID(srv.ClusterName(), types.KindUserGroup, userGroup2.GetName()),
+					mustResourceID(srv.ClusterName(), types.KindUserGroup, userGroup3.GetName()),
+				}),
+			errAssertionFunc: require.NoError,
+			expected: mustAccessRequest(t, alice, types.RequestState_PENDING, clock.Now(), clock.Now().Add(time.Hour),
+				[]string{requestRole.GetName()}, []types.ResourceID{
+					mustResourceID(srv.ClusterName(), types.KindRole, requestRole.GetName()),
+					mustResourceID(srv.ClusterName(), types.KindUserGroup, userGroup1.GetName()),
+					mustResourceID(srv.ClusterName(), types.KindApp, "app1"),
+					mustResourceID(srv.ClusterName(), types.KindUserGroup, userGroup2.GetName()),
+					mustResourceID(srv.ClusterName(), types.KindUserGroup, userGroup3.GetName()),
+					mustResourceID(srv.ClusterName(), types.KindApp, "app2"),
+					mustResourceID(srv.ClusterName(), types.KindApp, "app3"),
+					mustResourceID(srv.ClusterName(), types.KindApp, "app4"),
+					mustResourceID(srv.ClusterName(), types.KindApp, "app5"),
+				}),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			// Make sure there are no access requests before we do anything. We'll clear out
+			// each time to save on the complexity of setting up the auth server and dependent
+			// users and roles.
+			ctx := context.Background()
+			require.NoError(t, srv.Auth().DeleteAllAccessRequests(ctx))
+
+			client, err := srv.NewClient(TestUser(test.user))
+			require.NoError(t, err)
+
+			test.errAssertionFunc(t, client.CreateAccessRequest(ctx, test.accessRequest))
+
+			accessRequests, err := srv.Auth().GetAccessRequests(ctx, types.AccessRequestFilter{
+				ID: test.accessRequest.GetName(),
+			})
+			require.NoError(t, err)
+
+			if test.expected == nil {
+				require.Empty(t, accessRequests)
+				return
+			}
+
+			require.Len(t, accessRequests, 1)
+
+			// We have to ignore the name here, as it's auto-generated by the underlying access request
+			// logic.
+			require.Empty(t, cmp.Diff(test.expected, accessRequests[0],
+				cmpopts.IgnoreFields(types.Metadata{}, "Name", "ID"),
+				cmpopts.IgnoreFields(types.AccessRequestSpecV3{}),
+			))
+		})
+	}
+}
+
+func mustAccessRequest(t *testing.T, user string, state types.RequestState, created, expires time.Time, roles []string, resourceIDs []types.ResourceID) types.AccessRequest {
+	t.Helper()
+
+	accessRequest, err := types.NewAccessRequest(uuid.NewString(), user, roles...)
+	require.NoError(t, err)
+
+	accessRequest.SetRequestedResourceIDs(resourceIDs)
+	accessRequest.SetState(state)
+	accessRequest.SetCreationTime(created)
+	accessRequest.SetExpiry(expires)
+	accessRequest.SetAccessExpiry(expires)
+	accessRequest.SetThresholds([]types.AccessReviewThreshold{{Name: "default", Approve: 1, Deny: 1}})
+	accessRequest.SetRoleThresholdMapping(map[string]types.ThresholdIndexSets{
+		"requestRole": {
+			Sets: []types.ThresholdIndexSet{
+				{Indexes: []uint32{0}},
+			},
+		},
+	})
+
+	return accessRequest
+}
+
+func mustResourceID(clusterName, kind, name string) types.ResourceID {
+	return types.ResourceID{
+		ClusterName: clusterName,
+		Kind:        kind,
+		Name:        name,
+	}
+}
diff --git a/lib/auth/bot.go b/lib/auth/bot.go
index e2694faca1bef..e56059db4b063 100644
--- a/lib/auth/bot.go
+++ b/lib/auth/bot.go
@@ -35,6 +35,7 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/services"
+	usagereporter "github.com/gravitational/teleport/lib/usagereporter/teleport"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -170,6 +171,16 @@ func (s *Server) createBot(ctx context.Context, req *proto.CreateBotRequest) (*p
 		tokenTTL = time.Until(exp)
 	}
 
+	// Emit usage analytics event for bot creation.
+	s.AnonymizeAndSubmit(&usagereporter.BotCreateEvent{
+		UserName:    authz.ClientUsername(ctx),
+		BotUserName: resourceName,
+		RoleName:    resourceName,
+		BotName:     req.Name,
+		RoleCount:   int64(len(req.Roles)),
+		JoinMethod:  string(provisionToken.GetJoinMethod()),
+	})
+
 	return &proto.CreateBotResponse{
 		TokenID:    provisionToken.GetName(),
 		UserName:   resourceName,
diff --git a/lib/auth/clt.go b/lib/auth/clt.go
index 8eba35b95dfbc..840d8b91e283b 100644
--- a/lib/auth/clt.go
+++ b/lib/auth/clt.go
@@ -28,10 +28,12 @@ import (
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	assistpb "github.com/gravitational/teleport/api/gen/proto/go/assist/v1"
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
 	loginrulepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/loginrule/v1"
 	pluginspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
 	samlidppb "github.com/gravitational/teleport/api/gen/proto/go/teleport/samlidp/v1"
+	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/events"
@@ -282,6 +284,11 @@ func (c *Client) CompareAndSwapUser(ctx context.Context, new, expected types.Use
 	return trace.NotImplemented(notImplementedMessage)
 }
 
+// GetNodeStream not implemented: can only be called locally
+func (c *Client) GetNodeStream(_ context.Context, _ string) stream.Stream[types.Server] {
+	return stream.Fail[types.Server](trace.NotImplemented(notImplementedMessage))
+}
+
 // StreamSessionEvents streams all events from a given session recording. An error is returned on the first
 // channel if one is encountered. Otherwise the event channel is closed when the stream ends.
 // The event channel is not closed on error to prevent race conditions in downstream select statements.
@@ -653,6 +660,8 @@ type IdentityService interface {
 	UpdateHeadlessAuthenticationState(ctx context.Context, id string, state types.HeadlessAuthenticationState, mfaResponse *proto.MFAAuthenticateResponse) error
 	// GetHeadlessAuthentication retrieves a headless authentication by id.
 	GetHeadlessAuthentication(ctx context.Context, id string) (*types.HeadlessAuthentication, error)
+	// WatchPendingHeadlessAuthentications creates a watcher for pending headless authentication for the current user.
+	WatchPendingHeadlessAuthentications(ctx context.Context) (types.Watcher, error)
 }
 
 // ProvisioningService is a service in control
@@ -703,6 +712,7 @@ type ClientI interface {
 	services.SAMLIdPServiceProviders
 	services.UserGroups
 	services.Assistant
+	services.UserPreferences
 	WebService
 	services.Status
 	services.ClusterConfiguration
@@ -727,6 +737,9 @@ type ClientI interface {
 	// "not implemented" errors (as per the default gRPC behavior).
 	LoginRuleClient() loginrulepb.LoginRuleServiceClient
 
+	// EmbeddingClient returns a client to the Embedding gRPC service.
+	EmbeddingClient() assistpb.AssistEmbeddingServiceClient
+
 	// NewKeepAliver returns a new instance of keep aliver
 	NewKeepAliver(ctx context.Context) (types.KeepAliver, error)
 
diff --git a/lib/auth/github.go b/lib/auth/github.go
index d75ccacd79b4a..924bbbd3cfbbf 100644
--- a/lib/auth/github.go
+++ b/lib/auth/github.go
@@ -371,6 +371,7 @@ func validateGithubAuthCallbackHelper(ctx context.Context, m githubManager, diag
 
 	auth, err := m.validateGithubAuthCallback(ctx, diagCtx, q)
 	diagCtx.Info.Error = trace.UserMessage(err)
+	event.AppliedLoginRules = diagCtx.Info.AppliedLoginRules
 
 	diagCtx.WriteToBackend(ctx)
 
@@ -597,7 +598,7 @@ func (a *Server) validateGithubAuthCallback(ctx context.Context, diagCtx *SSODia
 
 	// Calculate (figure out name, roles, traits, session TTL) of user and
 	// create the user in the backend.
-	params, err := a.calculateGithubUser(ctx, connector, claims, req)
+	params, err := a.calculateGithubUser(ctx, diagCtx, connector, claims, req)
 	if err != nil {
 		return nil, trace.Wrap(err, "Failed to calculate user attributes.")
 	}
@@ -645,6 +646,7 @@ func (a *Server) validateGithubAuthCallback(ctx context.Context, diagCtx *SSODia
 			Traits:     user.GetTraits(),
 			SessionTTL: params.SessionTTL,
 			LoginTime:  a.clock.Now().UTC(),
+			LoginIP:    req.ClientLoginIP,
 		})
 		if err != nil {
 			return nil, trace.Wrap(err, "Failed to create web session.")
@@ -723,7 +725,7 @@ type CreateUserParams struct {
 	SessionTTL time.Duration
 }
 
-func (a *Server) calculateGithubUser(ctx context.Context, connector types.GithubConnector, claims *types.GithubClaims, request *types.GithubAuthRequest) (*CreateUserParams, error) {
+func (a *Server) calculateGithubUser(ctx context.Context, diagCtx *SSODiagContext, connector types.GithubConnector, claims *types.GithubClaims, request *types.GithubAuthRequest) (*CreateUserParams, error) {
 	p := CreateUserParams{
 		ConnectorName: connector.GetName(),
 		Username:      claims.Username,
@@ -749,6 +751,7 @@ func (a *Server) calculateGithubUser(ctx context.Context, connector types.Github
 		return nil, trace.Wrap(err)
 	}
 	p.Traits = evaluationOutput.Traits
+	diagCtx.Info.AppliedLoginRules = evaluationOutput.AppliedRules
 
 	// Kube groups and users are ultimately only set in the traits, not any
 	// other property of the User. In case the login rules changed the relevant
diff --git a/lib/auth/github_test.go b/lib/auth/github_test.go
index b936e28a530ec..a6e0266c519e9 100644
--- a/lib/auth/github_test.go
+++ b/lib/auth/github_test.go
@@ -35,6 +35,7 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/auth/keystore"
 	authority "github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/backend"
@@ -212,11 +213,13 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 	diagCtx := ssoDiagContextFixture(false /* testFlow */)
 	m.mockValidateGithubAuthCallback = func(ctx context.Context, diagCtx *SSODiagContext, q url.Values) (*GithubAuthResponse, error) {
 		diagCtx.Info.GithubClaims = claims
+		diagCtx.Info.AppliedLoginRules = []string{"login-rule"}
 		return auth, nil
 	}
 	_, _ = validateGithubAuthCallbackHelper(context.Background(), m, diagCtx, nil, tt.a.emitter)
 	require.Equal(t, tt.mockEmitter.LastEvent().GetType(), events.UserLoginEvent)
 	require.Equal(t, tt.mockEmitter.LastEvent().GetCode(), events.UserSSOLoginCode)
+	require.Equal(t, tt.mockEmitter.LastEvent().(*apievents.UserLogin).AppliedLoginRules, []string{"login-rule"})
 	require.Equal(t, ssoDiagInfoCalls, 0)
 	tt.mockEmitter.Reset()
 
@@ -279,7 +282,9 @@ func TestCalculateGithubUserNoTeams(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	_, err = a.calculateGithubUser(ctx, connector, &types.GithubClaims{
+	diagCtx := &SSODiagContext{}
+
+	_, err = a.calculateGithubUser(ctx, diagCtx, connector, &types.GithubClaims{
 		Username: "octocat",
 		OrganizationToTeams: map[string][]string{
 			"org1": {"team1", "team2"},
@@ -324,6 +329,7 @@ func TestCalculateGithubUserWithLoginRules(t *testing.T) {
 	}
 	mockEvaluator := &mockLoginRuleEvaluator{
 		outputTraits: evaluatedTraits,
+		ruleNames:    []string{"mock"},
 	}
 	a.SetLoginRuleEvaluator(mockEvaluator)
 
@@ -339,7 +345,9 @@ func TestCalculateGithubUserWithLoginRules(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	userParams, err := a.calculateGithubUser(ctx, connector, &types.GithubClaims{
+	diagCtx := &SSODiagContext{}
+
+	userParams, err := a.calculateGithubUser(ctx, diagCtx, connector, &types.GithubClaims{
 		Username: "octocat",
 		OrganizationToTeams: map[string][]string{
 			"org1": {"team1"},
@@ -358,6 +366,7 @@ func TestCalculateGithubUserWithLoginRules(t *testing.T) {
 		SessionTTL:    defaults.MaxCertDuration,
 	}, userParams, "user params does not match expected")
 	require.Equal(t, 1, mockEvaluator.evaluatedCount, "login rules were not evaluated exactly once")
+	require.Equal(t, mockEvaluator.ruleNames, diagCtx.Info.AppliedLoginRules)
 }
 
 type mockRoleCache struct {
@@ -372,13 +381,14 @@ func (m *mockRoleCache) GetRole(_ context.Context, name string) (types.Role, err
 type mockLoginRuleEvaluator struct {
 	outputTraits   map[string][]string
 	evaluatedCount int
+	ruleNames      []string
 }
 
 func (m *mockLoginRuleEvaluator) Evaluate(context.Context, *loginrule.EvaluationInput) (*loginrule.EvaluationOutput, error) {
 	m.evaluatedCount++
 	return &loginrule.EvaluationOutput{
 		Traits:       m.outputTraits,
-		AppliedRules: []string{"mock"},
+		AppliedRules: m.ruleNames,
 	}, nil
 }
 
diff --git a/lib/auth/grpcserver.go b/lib/auth/grpcserver.go
index d89906ab418a5..c116839e24fdc 100644
--- a/lib/auth/grpcserver.go
+++ b/lib/auth/grpcserver.go
@@ -25,6 +25,7 @@ import (
 	"net"
 	"time"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/gravitational/trace/trail"
@@ -49,6 +50,8 @@ import (
 	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	oktapb "github.com/gravitational/teleport/api/gen/proto/go/teleport/okta/v1"
 	trustpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/trust/v1"
+	userpreferencespb "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1"
+	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/installers"
@@ -57,6 +60,7 @@ import (
 	integrationService "github.com/gravitational/teleport/lib/auth/integration/integrationv1"
 	"github.com/gravitational/teleport/lib/auth/okta"
 	"github.com/gravitational/teleport/lib/auth/trust/trustv1"
+	"github.com/gravitational/teleport/lib/auth/userpreferences/userpreferencesv1"
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/backend"
@@ -379,6 +383,13 @@ func (g *GRPCServer) WatchEvents(watch *proto.Watch, stream proto.AuthService_Wa
 		case <-watcher.Done():
 			return watcher.Error()
 		case event := <-watcher.Events():
+			if role, ok := event.Resource.(*types.RoleV6); ok {
+				downgraded, err := maybeDowngradeRole(stream.Context(), role)
+				if err != nil {
+					return trace.Wrap(err)
+				}
+				event.Resource = downgraded
+			}
 			out, err := client.EventToGRPC(event)
 			if err != nil {
 				return trace.Wrap(err)
@@ -1917,22 +1928,206 @@ func (g *GRPCServer) DeleteAllKubernetesServers(ctx context.Context, req *proto.
 	return &emptypb.Empty{}, nil
 }
 
+// maybeDowngradeRole tests the client version passed through the GRPC metadata,
+// and if the client version is unknown or less than the minimum supported
+// version for some features of the role returns a shallow copy of the given
+// role downgraded for compatibility with the older version.
+func maybeDowngradeRole(ctx context.Context, role *types.RoleV6) (*types.RoleV6, error) {
+	clientVersionString, ok := metadata.ClientVersionFromContext(ctx)
+	if !ok {
+		// This client is not reporting its version via gRPC metadata. Teleport
+		// clients have been reporting their version for long enough that older
+		// clients won't even support v6 roles at all, so this is likely a
+		// third-party client, and we shouldn't assume that downgrading the role
+		// will do more good than harm.
+		return role, nil
+	}
+
+	clientVersion, err := semver.NewVersion(clientVersionString)
+	if err != nil {
+		return nil, trace.BadParameter("unrecognized client version: %s is not a valid semver", clientVersionString)
+	}
+
+	role, err = maybeDowngradeRoleToV6(ctx, role, clientVersion)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	role, err = maybeDowngradeRoleLabelExpressions(ctx, role, clientVersion)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return role, nil
+}
+
+var minSupportedLabelExpressionVersion = semver.Version{Major: 13, Minor: 1, Patch: 1}
+
+func maybeDowngradeRoleLabelExpressions(ctx context.Context, role *types.RoleV6, clientVersion *semver.Version) (*types.RoleV6, error) {
+	if !clientVersion.LessThan(minSupportedLabelExpressionVersion) {
+		return role, nil
+	}
+	hasLabelExpression := false
+	for _, kind := range types.LabelMatcherKinds {
+		allowLabelMatchers, err := role.GetLabelMatchers(types.Allow, kind)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		denyLabelMatchers, err := role.GetLabelMatchers(types.Deny, kind)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if len(allowLabelMatchers.Expression) == 0 && len(denyLabelMatchers.Expression) == 0 {
+			continue
+		}
+		hasLabelExpression = true
+		denyLabelMatchers.Labels = types.Labels{types.Wildcard: {types.Wildcard}}
+		role.SetLabelMatchers(types.Deny, kind, denyLabelMatchers)
+	}
+	if hasLabelExpression {
+		reason := fmt.Sprintf(
+			"client version %q does not support label expressions, wildcard deny labels have been added for all resource kinds with configured label expressions",
+			clientVersion)
+		if role.Metadata.Labels == nil {
+			role.Metadata.Labels = make(map[string]string, 1)
+		}
+		role.Metadata.Labels[types.TeleportDowngradedLabel] = reason
+		log.Debugf(`Downgrading role %q before returning it to the client: %s`,
+			role.GetName(), reason)
+	}
+	return role, nil
+}
+
+var minSupportedRoleV7Version = semver.New(utils.VersionBeforeAlpha("14.0.0"))
+
+// maybeDowngradeRoleToV6 tests the client version passed through the GRPC metadata, and
+// if the client version is less than the minimum supported version
+// for V7 roles returns a shallow copy of the given role downgraded to V6, If
+// the passed in role is already V6, it is returned unmodified.
+func maybeDowngradeRoleToV6(ctx context.Context, role *types.RoleV6, clientVersion *semver.Version) (*types.RoleV6, error) {
+	if !clientVersion.LessThan(*minSupportedRoleV7Version) || role.Version != types.V7 {
+		return role, nil
+	}
+
+	log.Debugf(`Client version "%s" is less than 14.0.0, converting role to v6`, clientVersion.String())
+
+	switch downgraded, isRestricted, err := downgradeRoleToV6(role); {
+	case err != nil:
+		return nil, trace.Wrap(err)
+	case isRestricted:
+		reason := fmt.Sprintf(`Client version %q does not support Role v7. `+
+			`Role %q will be downgraded by adding more stringent restriction rules for Kubernetes clusters which will affect its behavior before returning to the client. `+
+			`In order to guarantee the correct behavior, all clients must be updated to version %q or higher.`,
+			clientVersion, downgraded.GetName(), minSupportedRoleV7Version)
+		if downgraded.Metadata.Labels == nil {
+			downgraded.Metadata.Labels = make(map[string]string, 1)
+		}
+		downgraded.Metadata.Labels[types.TeleportDowngradedLabel] = reason
+		log.Debugf(`Downgrading role %q before returning it to the client: %s`,
+			role.GetName(), reason)
+		return downgraded, nil
+	default:
+		return downgraded, nil
+	}
+}
+
+// downgradeRoleToV6 converts a V7 role to V6 so that it will be compatible with
+// older instances. Makes a shallow copy if the conversion is necessary. The
+// passed in role will not be mutated.
+// DELETE IN 15.0.0
+func downgradeRoleToV6(r *types.RoleV6) (*types.RoleV6, bool, error) {
+	switch r.Version {
+	case types.V3, types.V4, types.V5, types.V6:
+		return r, false, nil
+	case types.V7:
+		var (
+			downgraded types.RoleV6
+			restricted bool
+		)
+		downgraded = *r
+		downgraded.Version = types.V6
+
+		if len(downgraded.GetKubeResources(types.Deny)) > 0 {
+			// V6 roles don't know about kubernetes resources besides "pod",
+			// so if the role denies any other resources, we need to deny all
+			// access to kubernetes.
+			// This is more restrictive than the original V7 role and it's the best
+			// we can do without leaking access to kubernetes resources that V6
+			// doesn't know about.
+			hasOtherResources := false
+			for _, resource := range downgraded.GetKubeResources(types.Deny) {
+				if resource.Kind != types.KindKubePod {
+					hasOtherResources = true
+					break
+				}
+			}
+			if hasOtherResources {
+				// If the role has deny rules for resources other than "pod", we
+				// need to deny all access to kubernetes because the Kubernetes
+				// service requesting this role isn't able to exclude those resources
+				// from the responses and the client will receive them.
+				downgraded.SetLabelMatchers(
+					types.Deny,
+					types.KindKubernetesCluster,
+					types.LabelMatchers{
+						Labels: types.Labels{
+							types.Wildcard: []string{types.Wildcard},
+						},
+					},
+				)
+				// Clear out the deny list so that the V6 role doesn't include unknown
+				// resources in the deny list.
+				downgraded.SetKubeResources(types.Deny, nil)
+				restricted = true
+			}
+		}
+
+		if len(downgraded.GetKubeResources(types.Allow)) > 0 {
+			// V6 roles don't know about kubernetes resources besides "pod",
+			// so if the role allows any resources, we need remove the role
+			// from being used for kubernetes access.
+			// If the role specifies any kubernetes resources, the V6 role will
+			// be unable to be used for kubernetes access because the labels
+			// will be empty and won't match anything.
+			downgraded.SetLabelMatchers(
+				types.Allow,
+				types.KindKubernetesCluster,
+				types.LabelMatchers{
+					Labels: types.Labels{},
+				},
+			)
+			// Clear out the allow list so that the V6 role doesn't include unknown
+			// resources in the allow list.
+			downgraded.SetKubeResources(types.Allow, nil)
+			restricted = true
+		}
+
+		return &downgraded, restricted, nil
+	default:
+		return nil, false, trace.BadParameter("unrecognized role version %T", r.Version)
+	}
+}
+
 // GetRole retrieves a role by name.
 func (g *GRPCServer) GetRole(ctx context.Context, req *proto.GetRoleRequest) (*types.RoleV6, error) {
 	auth, err := g.authenticate(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	role, err := auth.ServerWithRoles.GetRole(ctx, req.Name)
+	roleI, err := auth.ServerWithRoles.GetRole(ctx, req.Name)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	roleV6, ok := role.(*types.RoleV6)
+	role, ok := roleI.(*types.RoleV6)
 	if !ok {
 		return nil, trace.Errorf("encountered unexpected role type: %T", role)
 	}
 
-	return roleV6, nil
+	downgraded, err := maybeDowngradeRole(ctx, role)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return downgraded, nil
 }
 
 // GetRoles retrieves all roles.
@@ -1941,20 +2136,24 @@ func (g *GRPCServer) GetRoles(ctx context.Context, _ *emptypb.Empty) (*proto.Get
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	roles, err := auth.ServerWithRoles.GetRoles(ctx)
+	rolesI, err := auth.ServerWithRoles.GetRoles(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	var rolesV6 []*types.RoleV6
-	for _, r := range roles {
+	var roles []*types.RoleV6
+	for _, r := range rolesI {
 		role, ok := r.(*types.RoleV6)
 		if !ok {
 			return nil, trace.BadParameter("unexpected type %T", r)
 		}
-		rolesV6 = append(rolesV6, role)
+		downgraded, err := maybeDowngradeRole(ctx, role)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		roles = append(roles, downgraded)
 	}
 	return &proto.GetRolesResponse{
-		Roles: rolesV6,
+		Roles: roles,
 	}, nil
 }
 
@@ -3758,6 +3957,9 @@ func (g *GRPCServer) CreateDatabase(ctx context.Context, database *types.Databas
 	if database.Origin() == "" {
 		database.SetOrigin(types.OriginDynamic)
 	}
+	if err := services.ValidateDatabase(database); err != nil {
+		return nil, trace.Wrap(err)
+	}
 	if err := auth.CreateDatabase(ctx, database); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3773,6 +3975,9 @@ func (g *GRPCServer) UpdateDatabase(ctx context.Context, database *types.Databas
 	if database.Origin() == "" {
 		database.SetOrigin(types.OriginDynamic)
 	}
+	if err := services.ValidateDatabase(database); err != nil {
+		return nil, trace.Wrap(err)
+	}
 	if err := auth.UpdateDatabase(ctx, database); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -4974,17 +5179,81 @@ func (g *GRPCServer) UpdateHeadlessAuthenticationState(ctx context.Context, req
 	return &emptypb.Empty{}, trace.Wrap(err)
 }
 
-// GetHeadlessAuthentication retrieves a headless authentication by id.
+// GetHeadlessAuthentication retrieves a headless authentication.
 func (g *GRPCServer) GetHeadlessAuthentication(ctx context.Context, req *proto.GetHeadlessAuthenticationRequest) (*types.HeadlessAuthentication, error) {
 	auth, err := g.authenticate(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	authReq, err := auth.GetHeadlessAuthentication(ctx, req.Id)
+	// First, try to retrieve the headless authentication directly if it already exists.
+	if ha, err := auth.GetHeadlessAuthentication(ctx, req.Id); err == nil {
+		return ha, nil
+	} else if !trace.IsNotFound(err) {
+		return nil, trace.Wrap(err)
+	}
+
+	// If the headless authentication doesn't exist yet, the headless login process may be waiting
+	// for the user to create a stub to authorize the insert.
+	if err := auth.UpsertHeadlessAuthenticationStub(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Force a short request timeout to prevent GetHeadlessAuthenticationFromWatcher
+	// from waiting indefinitely for a nonexistent headless authentication. This is
+	// useful for cases when the headless link/command is copied incorrectly or is
+	// run with the wrong user.
+	timeout := 5 * time.Second
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	// Wait for the login process to insert the actual headless authentication details.
+	authReq, err := auth.GetHeadlessAuthenticationFromWatcher(ctx, req.Id)
 	return authReq, trace.Wrap(err)
 }
 
+// WatchPendingHeadlessAuthentications watches the backend for pending headless authentication requests for the user.
+func (g *GRPCServer) WatchPendingHeadlessAuthentications(_ *emptypb.Empty, stream proto.AuthService_WatchPendingHeadlessAuthenticationsServer) error {
+	auth, err := g.authenticate(stream.Context())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	watcher, err := auth.WatchPendingHeadlessAuthentications(stream.Context())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer watcher.Close()
+
+	stubErr := make(chan error)
+	go func() {
+		stubErr <- auth.MaintainHeadlessAuthenticationStub(stream.Context())
+	}()
+
+	for {
+		select {
+		case err := <-stubErr:
+			return trace.Wrap(err)
+		case <-stream.Context().Done():
+			return nil
+		case <-watcher.Done():
+			return watcher.Error()
+		case event := <-watcher.Events():
+			out, err := client.EventToGRPC(event)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			watcherEventsEmitted.WithLabelValues(resourceLabel(event)).Observe(float64(out.Size()))
+			watcherEventSizes.Observe(float64(out.Size()))
+
+			if err := stream.Send(out); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+	}
+}
+
 // ExportUpgradeWindows is used to load derived upgrade window values for agents that
 // need to export schedules to external upgraders.
 func (g *GRPCServer) ExportUpgradeWindows(ctx context.Context, req *proto.ExportUpgradeWindowsRequest) (*proto.ExportUpgradeWindowsResponse, error) {
@@ -5140,12 +5409,17 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 
 	// Initialize and register the assist service.
 	assistSrv, err := assistv1.NewService(&assistv1.ServiceConfig{
-		Backend: cfg.AuthServer.Services,
+		Backend:        cfg.AuthServer.Services,
+		Embeddings:     cfg.AuthServer.embeddingsRetriever,
+		Embedder:       cfg.AuthServer.embedder,
+		Authorizer:     cfg.Authorizer,
+		ResourceGetter: cfg.AuthServer,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	assist.RegisterAssistServiceServer(server, assistSrv)
+	assist.RegisterAssistEmbeddingServiceServer(server, assistSrv)
 
 	// create server with no-op role to pass to JoinService server
 	serverWithNopRole, err := serverWithNopRole(cfg)
@@ -5176,6 +5450,15 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 	}
 	integrationpb.RegisterIntegrationServiceServer(server, integrationServiceServer)
 
+	// Initialize and register the user preferences service.
+	userPreferencesSrv, err := userpreferencesv1.NewService(&userpreferencesv1.ServiceConfig{
+		Backend: cfg.AuthServer.Services,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	userpreferencespb.RegisterUserPreferencesServiceServer(server, userPreferencesSrv)
+
 	return authServer, nil
 }
 
diff --git a/lib/auth/grpcserver_test.go b/lib/auth/grpcserver_test.go
index df0066318594d..364163e2283be 100644
--- a/lib/auth/grpcserver_test.go
+++ b/lib/auth/grpcserver_test.go
@@ -50,10 +50,12 @@ import (
 	"google.golang.org/protobuf/types/known/emptypb"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/internalutils/stream"
+	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/observability/tracing"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/installers"
@@ -4176,3 +4178,234 @@ func TestGRPCServer_GetInstallers(t *testing.T) {
 		})
 	}
 }
+
+func TestRoleVersions(t *testing.T) {
+	t.Parallel()
+	srv := newTestTLSServer(t)
+
+	wildcardLabels := types.Labels{types.Wildcard: {types.Wildcard}}
+
+	newRole := func(version string, spec types.RoleSpecV6) types.Role {
+		role, err := types.NewRoleWithVersion("test_rule", version, spec)
+		require.NoError(t, err)
+		return role
+	}
+
+	role := newRole(types.V7, types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			NodeLabels:               wildcardLabels,
+			AppLabels:                wildcardLabels,
+			AppLabelsExpression:      `labels["env"] == "staging"`,
+			DatabaseLabelsExpression: `labels["env"] == "staging"`,
+			Rules: []types.Rule{
+				types.NewRule(types.KindRole, services.RW()),
+			},
+			KubernetesLabels: wildcardLabels,
+			KubernetesResources: []types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					Namespace: types.Wildcard,
+					Name:      types.Wildcard,
+				},
+			},
+		},
+		Deny: types.RoleConditions{
+			KubernetesLabels:               types.Labels{"env": {"prod"}},
+			ClusterLabels:                  types.Labels{"env": {"prod"}},
+			ClusterLabelsExpression:        `labels["env"] == "prod"`,
+			WindowsDesktopLabelsExpression: `labels["env"] == "prod"`,
+			KubernetesResources: []types.KubernetesResource{
+				{
+					Kind:      types.Wildcard,
+					Namespace: types.Wildcard,
+					Name:      types.Wildcard,
+				},
+			},
+		},
+	})
+
+	user, err := CreateUser(srv.Auth(), "user", role)
+	require.NoError(t, err)
+
+	client, err := srv.NewClient(TestUser(user.GetName()))
+	require.NoError(t, err)
+
+	for _, tc := range []struct {
+		desc             string
+		clientVersions   []string
+		expectError      bool
+		expectedRole     types.Role
+		expectDowngraded bool
+	}{
+		{
+			desc: "up to date",
+			clientVersions: []string{
+				"14.0.0-alpha.1", "15.1.2", api.Version, "",
+			},
+			expectedRole: role,
+		},
+		{
+			desc: "downgrade role to v6 but supports label expressions",
+			clientVersions: []string{
+				minSupportedLabelExpressionVersion.String(), "13.3.0",
+			},
+			expectedRole: newRole(types.V6, types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					NodeLabels:               wildcardLabels,
+					AppLabels:                wildcardLabels,
+					AppLabelsExpression:      `labels["env"] == "staging"`,
+					DatabaseLabelsExpression: `labels["env"] == "staging"`,
+					Rules: []types.Rule{
+						types.NewRule(types.KindRole, services.RW()),
+					},
+				},
+				Deny: types.RoleConditions{
+					KubernetesLabels:               wildcardLabels,
+					ClusterLabels:                  types.Labels{"env": {"prod"}},
+					ClusterLabelsExpression:        `labels["env"] == "prod"`,
+					WindowsDesktopLabelsExpression: `labels["env"] == "prod"`,
+				},
+			}),
+			expectDowngraded: true,
+		},
+		{
+			desc:           "bad client versions",
+			clientVersions: []string{"Not a version", "13", "13.1"},
+			expectError:    true,
+		},
+		{
+			desc:           "label expressions downgraded",
+			clientVersions: []string{"13.0.11", "12.4.3", "6.0.0"},
+			expectedRole: newRole(types.V6,
+				types.RoleSpecV6{
+					Allow: types.RoleConditions{
+						// None of the allow labels change
+						NodeLabels:               wildcardLabels,
+						AppLabels:                wildcardLabels,
+						AppLabelsExpression:      `labels["env"] == "staging"`,
+						DatabaseLabelsExpression: `labels["env"] == "staging"`,
+						Rules: []types.Rule{
+							types.NewRule(types.KindRole, services.RW()),
+						},
+					},
+					Deny: types.RoleConditions{
+						// These fields don't change
+						KubernetesLabels:               wildcardLabels,
+						ClusterLabelsExpression:        `labels["env"] == "prod"`,
+						WindowsDesktopLabelsExpression: `labels["env"] == "prod"`,
+						// These all get set to wildcard deny because there is
+						// either an allow or deny label expression for them.
+						AppLabels:            wildcardLabels,
+						DatabaseLabels:       wildcardLabels,
+						ClusterLabels:        wildcardLabels,
+						WindowsDesktopLabels: wildcardLabels,
+					},
+				}),
+			expectDowngraded: true,
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			for _, clientVersion := range tc.clientVersions {
+				t.Run(clientVersion, func(t *testing.T) {
+					// setup client metadata
+					ctx := context.Background()
+					if clientVersion == "" {
+						ctx = context.WithValue(ctx, metadata.DisableInterceptors{}, struct{}{})
+					} else {
+						ctx = metadata.AddMetadataToContext(ctx, map[string]string{
+							metadata.VersionKey: clientVersion,
+						})
+					}
+
+					checkRole := func(gotRole types.Role) {
+						t.Helper()
+						if tc.expectError {
+							return
+						}
+						require.Empty(t, cmp.Diff(tc.expectedRole, gotRole,
+							cmpopts.IgnoreFields(types.RoleV6{}, "Metadata.ID", "Metadata.Labels")))
+						// The downgraded label value won't match exactly because it
+						// includes the client version, so just check it's not empty
+						// and ignore it in the role diff.
+						if tc.expectDowngraded {
+							require.NotEmpty(t, gotRole.GetMetadata().Labels[types.TeleportDowngradedLabel])
+						}
+					}
+					checkErr := func(err error) {
+						t.Helper()
+						if tc.expectError {
+							require.Error(t, err)
+						} else {
+							require.NoError(t, err)
+						}
+					}
+
+					// Test GetRole
+					gotRole, err := client.GetRole(ctx, role.GetName())
+					checkErr(err)
+					checkRole(gotRole)
+
+					// Test GetRoles
+					gotRoles, err := client.GetRoles(ctx)
+					checkErr(err)
+					if !tc.expectError {
+						foundTestRole := false
+						for _, gotRole := range gotRoles {
+							if gotRole.GetName() != role.GetName() {
+								continue
+							}
+							checkRole(gotRole)
+							foundTestRole = true
+							break
+						}
+						require.True(t, foundTestRole, "GetRoles result does not include expected role")
+					}
+
+					ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+					defer cancel()
+
+					// Test WatchEvents
+					watcher, err := client.NewWatcher(ctx, types.Watch{Name: "roles", Kinds: []types.WatchKind{{Kind: types.KindRole}}})
+					require.NoError(t, err)
+					defer watcher.Close()
+
+					// Swallow the init event
+					e := <-watcher.Events()
+					require.Equal(t, types.OpInit, e.Type)
+
+					// Re-upsert the role so that the watcher sees it, do this
+					// on the auth server directly to avoid the
+					// TeleportDowngradedLabel check in ServerWithRoles
+					require.NoError(t, srv.Auth().UpsertRole(ctx, role))
+
+					gotRole, err = func() (types.Role, error) {
+						for {
+							select {
+							case <-watcher.Done():
+								return nil, watcher.Error()
+							case e := <-watcher.Events():
+								if gotRole, ok := e.Resource.(types.Role); ok && gotRole.GetName() == role.GetName() {
+									return gotRole, nil
+								}
+							}
+						}
+					}()
+					checkErr(err)
+					checkRole(gotRole)
+
+					if !tc.expectError {
+						// Try to re-upsert the role we got. If it was
+						// downgraded, it should be rejected due to the
+						// TeleportDowngradedLabel
+						err = client.UpsertRole(ctx, gotRole)
+						if tc.expectDowngraded {
+							require.Error(t, err)
+						} else {
+							require.NoError(t, err)
+						}
+					}
+				})
+			}
+		})
+	}
+}
diff --git a/lib/auth/helpers.go b/lib/auth/helpers.go
index eb326bab63b8e..f71c1fdd56c3c 100644
--- a/lib/auth/helpers.go
+++ b/lib/auth/helpers.go
@@ -35,6 +35,7 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/ai"
 	"github.com/gravitational/teleport/lib/auth/keystore"
 	"github.com/gravitational/teleport/lib/auth/native"
 	authority "github.com/gravitational/teleport/lib/auth/testauthority"
@@ -76,6 +77,8 @@ type TestAuthServerConfig struct {
 	TraceClient otlptrace.Client
 	// AuthPreferenceSpec is custom initial AuthPreference spec for the test.
 	AuthPreferenceSpec *types.AuthPreferenceSpecV2
+	// Embedder is required to enable the assist in the auth server.
+	Embedder ai.Embedder
 }
 
 // CheckAndSetDefaults checks and sets defaults
@@ -98,6 +101,9 @@ func (cfg *TestAuthServerConfig) CheckAndSetDefaults() error {
 			SecondFactor: constants.SecondFactorOff,
 		}
 	}
+	if cfg.Embedder == nil {
+		cfg.Embedder = &noopEmbedder{}
+	}
 	return nil
 }
 
@@ -187,6 +193,14 @@ func WithClock(clock clockwork.Clock) ServerOption {
 	}
 }
 
+// WithEmbedder is a functional server option that sets the server's embedder.
+func WithEmbedder(embedder ai.Embedder) ServerOption {
+	return func(s *Server) error {
+		s.embedder = embedder
+		return nil
+	}
+}
+
 // TestAuthServer is auth server using local filesystem backend
 // and test certificate authority key generation that speeds up
 // keygen by using the same private key
@@ -268,7 +282,11 @@ func NewTestAuthServer(cfg TestAuthServerConfig) (*TestAuthServer, error) {
 				RSAKeyPairSource: authority.New().GenerateKeyPair,
 			},
 		},
-	}, WithClock(cfg.Clock))
+		EmbeddingRetriever: ai.NewSimpleRetriever(),
+	},
+		WithClock(cfg.Clock),
+		WithEmbedder(cfg.Embedder),
+	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1163,3 +1181,10 @@ func CreateUserAndRoleWithoutRoles(clt clt, username string, allowedLogins []str
 
 	return user, role, nil
 }
+
+// noopEmbedder is a no op implementation of the Embedder interface.
+type noopEmbedder struct{}
+
+func (n noopEmbedder) ComputeEmbeddings(_ context.Context, _ []string) ([]ai.Vector64, error) {
+	return []ai.Vector64{}, nil
+}
diff --git a/lib/auth/http_client.go b/lib/auth/http_client.go
index 5fca47b82dfa0..2ac9301762635 100644
--- a/lib/auth/http_client.go
+++ b/lib/auth/http_client.go
@@ -632,7 +632,7 @@ func (c *HTTPClient) CreateRemoteCluster(rc types.RemoteCluster) error {
 
 // UpsertAuthServer is used by auth servers to report their presence
 // to other auth servers in form of hearbeat expiring after ttl period.
-func (c *HTTPClient) UpsertAuthServer(s types.Server) error {
+func (c *HTTPClient) UpsertAuthServer(ctx context.Context, s types.Server) error {
 	data, err := services.MarshalServer(s)
 	if err != nil {
 		return trace.Wrap(err)
@@ -640,7 +640,7 @@ func (c *HTTPClient) UpsertAuthServer(s types.Server) error {
 	args := &upsertServerRawReq{
 		Server: data,
 	}
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("authservers"), args)
+	_, err = c.PostJSON(ctx, c.Endpoint("authservers"), args)
 	return trace.Wrap(err)
 }
 
@@ -667,7 +667,7 @@ func (c *HTTPClient) GetAuthServers() ([]types.Server, error) {
 
 // UpsertProxy is used by proxies to report their presence
 // to other auth servers in form of heartbeat expiring after ttl period.
-func (c *HTTPClient) UpsertProxy(s types.Server) error {
+func (c *HTTPClient) UpsertProxy(ctx context.Context, s types.Server) error {
 	data, err := services.MarshalServer(s)
 	if err != nil {
 		return trace.Wrap(err)
@@ -675,7 +675,7 @@ func (c *HTTPClient) UpsertProxy(s types.Server) error {
 	args := &upsertServerRawReq{
 		Server: data,
 	}
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("proxies"), args)
+	_, err = c.PostJSON(ctx, c.Endpoint("proxies"), args)
 	return trace.Wrap(err)
 }
 
@@ -710,11 +710,11 @@ func (c *HTTPClient) DeleteAllProxies() error {
 }
 
 // DeleteProxy deletes proxy by name
-func (c *HTTPClient) DeleteProxy(name string) error {
+func (c *HTTPClient) DeleteProxy(ctx context.Context, name string) error {
 	if name == "" {
 		return trace.BadParameter("missing parameter name")
 	}
-	_, err := c.Delete(context.TODO(), c.Endpoint("proxies", name))
+	_, err := c.Delete(ctx, c.Endpoint("proxies", name))
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/auth/init.go b/lib/auth/init.go
index b0da48dc4c401..cd501be75d07b 100644
--- a/lib/auth/init.go
+++ b/lib/auth/init.go
@@ -39,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/api/utils/keys"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib"
+	"github.com/gravitational/teleport/lib/ai"
 	"github.com/gravitational/teleport/lib/auth/keystore"
 	"github.com/gravitational/teleport/lib/auth/native"
 	"github.com/gravitational/teleport/lib/backend"
@@ -146,6 +147,9 @@ type InitConfig struct {
 	// Assist is a service that implements the Teleport Assist functionality.
 	Assist services.Assistant
 
+	// UserPreferences is a service that manages user preferences.
+	UserPreferences services.UserPreferences
+
 	// Roles is a set of roles to create
 	Roles []types.Role
 
@@ -195,6 +199,9 @@ type InitConfig struct {
 	// Integrations is a service that manages Integrations.
 	Integrations services.Integrations
 
+	// Embeddings is a service that manages Embeddings
+	Embeddings services.Embeddings
+
 	// SessionTrackerService is a service that manages trackers for all active sessions.
 	SessionTrackerService services.SessionTrackerService
 
@@ -229,6 +236,12 @@ type InitConfig struct {
 	// HTTPClientForAWSSTS overwrites the default HTTP client used for making
 	// STS requests. Used in test.
 	HTTPClientForAWSSTS utils.HTTPDoClient
+
+	// EmbeddingRetriever is a retriever for embeddings.
+	EmbeddingRetriever *ai.SimpleRetriever
+
+	// EmbeddingClient is a client that allows generating embeddings.
+	EmbeddingClient ai.Embedder
 }
 
 // Init instantiates and configures an instance of AuthServer
@@ -480,7 +493,12 @@ func Init(cfg InitConfig, opts ...ServerOption) (*Server, error) {
 	}
 
 	// Create presets - convenience and example resources.
-	err = createPresets(ctx, asrv)
+	err = createPresetRoles(ctx, asrv)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	err = createPresetUsers(ctx, asrv)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -611,15 +629,31 @@ type PresetRoleManager interface {
 	UpsertRole(ctx context.Context, role types.Role) error
 }
 
-// createPresets creates preset resources (eg, roles).
-func createPresets(ctx context.Context, rm PresetRoleManager) error {
+// createPresetRoles creates preset role resources
+func createPresetRoles(ctx context.Context, rm PresetRoleManager) error {
 	roles := []types.Role{
 		services.NewPresetGroupAccessRole(),
 		services.NewPresetEditorRole(),
 		services.NewPresetAccessRole(),
 		services.NewPresetAuditorRole(),
+		services.NewPresetReviewerRole(),
+		services.NewPresetRequesterRole(),
+		services.NewSystemAutomaticAccessApproverRole(),
 	}
 	for _, role := range roles {
+		// If the role is nil, skip because it doesn't apply to this Teleport installation.
+		if role == nil {
+			continue
+		}
+
+		if types.IsSystemResource(role) {
+			// System resources *always* get reset on every auth startup
+			if err := rm.UpsertRole(ctx, role); err != nil {
+				return trace.Wrap(err, "failed upserting system role %s", role.GetName())
+			}
+			continue
+		}
+
 		err := rm.CreateRole(ctx, role)
 		if err != nil {
 			if !trace.IsAlreadyExists(err) {
@@ -648,6 +682,55 @@ func createPresets(ctx context.Context, rm PresetRoleManager) error {
 	return nil
 }
 
+// PresetUsers contains the required User Management methods to
+// create a preset User. Method names represent the appropriate
+// subset
+type PresetUsers interface {
+	// CreateUser creates a new user record based on the supplied `user` instance.
+	CreateUser(ctx context.Context, user types.User) error
+	// GetUser fetches a user from the repository by name, optionally fetching
+	// any associated secrets
+	GetUser(username string, withSecrets bool) (types.User, error)
+	// Upsert user creates or updates a user record as needed
+	UpsertUser(user types.User) error
+}
+
+// createPresetUsers creates all of the required user presets. No attempt is
+// made to migrate any existing users to the lastest preset.
+func createPresetUsers(ctx context.Context, um PresetUsers) error {
+	users := []types.User{
+		services.NewSystemAutomaticAccessBotUser(),
+	}
+	for _, user := range users {
+		// Some users are only valid for enterprise Teleport, and so will be
+		// nil for an OSS build and can be skipped
+		if user == nil {
+			continue
+		}
+
+		if types.IsSystemResource(user) {
+			// System resources *always* get reset on every auth startup
+			if err := um.UpsertUser(user); err != nil {
+				return trace.Wrap(err, "failed upserting system user %s", user.GetName())
+			}
+			continue
+		}
+
+		err := um.CreateUser(ctx, user)
+		if err == nil {
+			// Success! The rest of the loop body is immaterial. Move on to
+			// the next user.
+			continue
+		}
+
+		if !trace.IsAlreadyExists(err) {
+			return trace.Wrap(err, "failed creating preset user %s", user.GetName())
+		}
+	}
+
+	return nil
+}
+
 // isFirstStart returns 'true' if the auth server is starting for the 1st time
 // on this server.
 func isFirstStart(ctx context.Context, authServer *Server, cfg InitConfig) (bool, error) {
diff --git a/lib/auth/init_test.go b/lib/auth/init_test.go
index b129d04e27d3f..3ea8e54de008c 100644
--- a/lib/auth/init_test.go
+++ b/lib/auth/init_test.go
@@ -30,6 +30,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/exp/slices"
@@ -43,6 +44,7 @@ import (
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/lite"
+	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/suite"
 	"github.com/gravitational/teleport/lib/sshutils"
@@ -443,13 +445,22 @@ func TestClusterName(t *testing.T) {
 	require.Equal(t, conf.ClusterName.GetClusterName(), cn.GetClusterName())
 }
 
+func keysIn[K comparable, V any](m map[K]V) []K {
+	result := make([]K, 0, len(m))
+	for k := range m {
+		result = append(result, k)
+	}
+	return result
+}
+
 // TestPresets tests behavior of presets
 func TestPresets(t *testing.T) {
 	ctx := context.Background()
-	roles := []types.Role{
-		services.NewPresetEditorRole(),
-		services.NewPresetAccessRole(),
-		services.NewPresetAuditorRole(),
+
+	presetRoleNames := []string{
+		teleport.PresetEditorRoleName,
+		teleport.PresetAccessRoleName,
+		teleport.PresetAuditorRoleName,
 	}
 
 	t.Run("EmptyCluster", func(t *testing.T) {
@@ -457,16 +468,16 @@ func TestPresets(t *testing.T) {
 		clock := clockwork.NewFakeClock()
 		as.SetClock(clock)
 
-		err := createPresets(ctx, as)
+		err := createPresetRoles(ctx, as)
 		require.NoError(t, err)
 
 		// Second call should not fail
-		err = createPresets(ctx, as)
+		err = createPresetRoles(ctx, as)
 		require.NoError(t, err)
 
 		// Presets were created
-		for _, role := range roles {
-			_, err := as.GetRole(ctx, role.GetName())
+		for _, role := range presetRoleNames {
+			_, err := as.GetRole(ctx, role)
 			require.NoError(t, err)
 		}
 	})
@@ -482,12 +493,12 @@ func TestPresets(t *testing.T) {
 		err := as.CreateRole(ctx, access)
 		require.NoError(t, err)
 
-		err = createPresets(ctx, as)
+		err = createPresetRoles(ctx, as)
 		require.NoError(t, err)
 
 		// Presets were created
-		for _, role := range roles {
-			_, err := as.GetRole(ctx, role.GetName())
+		for _, role := range presetRoleNames {
+			_, err := as.GetRole(ctx, role)
 			require.NoError(t, err)
 		}
 
@@ -525,7 +536,7 @@ func TestPresets(t *testing.T) {
 		err = as.CreateRole(ctx, accessRole)
 		require.NoError(t, err)
 
-		err = createPresets(ctx, as)
+		err = createPresetRoles(ctx, as)
 		require.NoError(t, err)
 
 		outEditor, err := as.GetRole(ctx, editorRole.GetName())
@@ -589,7 +600,7 @@ func TestPresets(t *testing.T) {
 		require.NoError(t, err)
 
 		// Apply defaults.
-		err = createPresets(ctx, as)
+		err = createPresetRoles(ctx, as)
 		require.NoError(t, err)
 
 		outEditor, err := as.GetRole(ctx, editorRole.GetName())
@@ -613,33 +624,91 @@ func TestPresets(t *testing.T) {
 		require.Equal(t, types.Labels{types.Wildcard: []string{types.Wildcard}}, deniedDatabaseServiceLabels, "keeps the deny label for DatabaseService")
 	})
 
-	t.Run("Does not upsert roles if nothing changes", func(t *testing.T) {
-		presetRoleCount := 4
-
-		roleManager := &mockRoleManager{
-			roles: make(map[string]types.Role, presetRoleCount),
-		}
-
-		err := createPresets(ctx, roleManager)
+	upsertRoleTest := func(t *testing.T, expectedPresetRoles []string, expectedSystemRoles []string) {
+		// test state
+		ctx := context.Background()
+		createdSystemRoles := make(map[string]types.Role)
+		createdPresets := make(map[string]types.Role)
+
+		//
+		// Test #1 - popuulating an empty cluster
+		//
+		roleManager := newMockRoleManager(t)
+
+		// EXPECT that non-system resources will be created once
+		// and once only.
+		roleManager.
+			On("CreateRole", ctx, mock.Anything).
+			Run(func(args mock.Arguments) {
+				r := args[1].(types.Role)
+				require.Contains(t, expectedPresetRoles, r.GetName())
+				require.NotContains(t, createdPresets, r.GetName())
+				require.False(t, types.IsSystemResource(r))
+				createdPresets[r.GetName()] = r
+			}).
+			Return(nil)
+
+		// EXPECT that any (and ONLY) system resources will be upserted
+		roleManager.
+			On("UpsertRole", ctx, mock.Anything).
+			Run(func(args mock.Arguments) {
+				r := args[1].(types.Role)
+				require.True(t, types.IsSystemResource(r))
+				require.Contains(t, expectedSystemRoles, r.GetName())
+				require.NotContains(t, keysIn(createdSystemRoles), r.GetName())
+				createdSystemRoles[r.GetName()] = r
+			}).
+			Maybe().
+			Return(nil)
+
+		err := createPresetRoles(ctx, roleManager)
 		require.NoError(t, err)
+		require.ElementsMatch(t, keysIn(createdPresets), expectedPresetRoles)
+		require.ElementsMatch(t, keysIn(createdSystemRoles), expectedSystemRoles)
+		roleManager.AssertExpectations(t)
+
+		//
+		// Test #2 - populating an already-populated cluster
+		//
+		roleManager = newMockRoleManager(t)
+
+		// EXPECT that createPresets will try to create all expected
+		// non-system roles
+		roleManager.
+			On("CreateRole", ctx, mock.Anything).
+			Run(func(args mock.Arguments) {
+				require.Contains(t, createdPresets, args[1].(types.Role).GetName())
+			}).
+			Return(trace.AlreadyExists("dupe"))
+
+		// EXPECT that any (and ONLY) expected system roles will be
+		// automatically upserted
+		roleManager.
+			On("UpsertRole", ctx, mock.Anything).
+			Run(requireSystemResource(t, 1)).
+			Maybe().
+			Return(nil)
+
+		// EXPECT that all of the roles created in the previous step (and ONLY the
+		// roles created in the previous step will be queried.
+		for name, role := range createdPresets {
+			roleManager.
+				On("GetRole", mock.Anything, name).
+				Return(role, nil)
+		}
 
-		require.Equal(t, 0, roleManager.upsertRoleCallsCount, "unexpected call to UpsertRole")
-		require.Equal(t, 0, roleManager.getRoleCallsCount, "unexpected call to GetRole")
-		require.Equal(t, presetRoleCount, roleManager.createRoleCallsCount, "unexpected number of calls to CreateRole, got %d calls", roleManager.createRoleCallsCount)
-
-		// Running a second time should return Already Exists, so it fetches the role.
-		// The role was not changed, so it can't call the UpsertRole method.
-		roleManager.ResetCallCounters()
-
-		err = createPresets(ctx, roleManager)
+		err = createPresetRoles(ctx, roleManager)
 		require.NoError(t, err)
+		roleManager.AssertExpectations(t)
 
-		require.Equal(t, 0, roleManager.upsertRoleCallsCount, "unexpected call to UpsertRole")
-		require.Equal(t, presetRoleCount, roleManager.getRoleCallsCount, "unexpected number of calls to CreateRole, got %d calls", roleManager.getRoleCallsCount)
-		require.Equal(t, presetRoleCount, roleManager.createRoleCallsCount, "unexpected number of calls to CreateRole, got %d calls", roleManager.createRoleCallsCount)
+		//
+		// Test #3 - populating an already-populated cluster with updated presets
+		//
+		roleManager = newMockRoleManager(t)
 
-		// Removing a specific resource which is part of the Default Allow Rules should trigger an UpsertRole call
-		editorRole := roleManager.roles[teleport.PresetEditorRoleName]
+		// Removing a specific resource which is part of the Default Allow Rules
+		// should trigger an UpsertRole call
+		editorRole := createdPresets[teleport.PresetEditorRoleName]
 		allowRulesWithoutConnectionDiag := []types.Rule{}
 
 		for _, r := range editorRole.GetRules(types.Allow) {
@@ -649,63 +718,229 @@ func TestPresets(t *testing.T) {
 			allowRulesWithoutConnectionDiag = append(allowRulesWithoutConnectionDiag, r)
 		}
 		editorRole.SetRules(types.Allow, allowRulesWithoutConnectionDiag)
-		err = roleManager.UpsertRole(ctx, editorRole)
-		require.NoError(t, err)
 
-		roleManager.ResetCallCounters()
-		err = createPresets(ctx, roleManager)
+		// EXPECT that createPresets will try to create all expected
+		// non-system roles
+		remainingPresets := toSet(expectedPresetRoles)
+		roleManager.
+			On("CreateRole", ctx, mock.Anything).
+			Run(func(args mock.Arguments) {
+				r := args[1].(types.Role)
+				require.Contains(t, createdPresets, r.GetName())
+				delete(remainingPresets, r.GetName())
+			}).
+			Return(trace.AlreadyExists("dupe"))
+
+		// EXPECT that all of the roles created in the first step (and ONLY the
+		// roles created in the first step will be queried.
+		for name, role := range createdPresets {
+			roleManager.
+				On("GetRole", mock.Anything, name).
+				Return(role, nil)
+		}
+
+		// EXPECT that any system roles will be automatically upserted
+		// AND our modified editor resource will be updated using an upsert
+		roleManager.
+			On("UpsertRole", ctx, mock.Anything).
+			Return(func(_ context.Context, r types.Role) error {
+				if types.IsSystemResource(r) {
+					require.Contains(t, expectedSystemRoles, r.GetName())
+					return nil
+				}
+				require.Equal(t, teleport.PresetEditorRoleName, r.GetName())
+				return nil
+			})
+
+		err = createPresetRoles(ctx, roleManager)
 		require.NoError(t, err)
+		require.Empty(t, remainingPresets)
+		roleManager.AssertExpectations(t)
+	}
 
-		require.Equal(t, 1, roleManager.upsertRoleCallsCount, "unexpected call to UpsertRole")
-		require.Equal(t, presetRoleCount, roleManager.getRoleCallsCount, "unexpected number of calls to CreateRole, got %d calls", roleManager.getRoleCallsCount)
-		require.Equal(t, presetRoleCount, roleManager.createRoleCallsCount, "unexpected number of calls to CreateRole, got %d calls", roleManager.createRoleCallsCount)
+	t.Run("Does not upsert roles if nothing changes", func(t *testing.T) {
+		upsertRoleTest(t, presetRoleNames, nil)
+	})
+
+	t.Run("Enterprise", func(t *testing.T) {
+		modules.SetTestModules(t, &modules.TestModules{
+			TestBuildType: modules.BuildEnterprise,
+		})
+
+		enterprisePresetRoleNames := append([]string{
+			teleport.PresetGroupAccessRoleName,
+			teleport.PresetRequesterRoleName,
+			teleport.PresetReviewerRoleName,
+		}, presetRoleNames...)
+
+		enterpriseSystemRoleNames := []string{
+			teleport.SystemAutomaticAccessApprovalRoleName,
+		}
+
+		enterpriseUsers := []types.User{
+			services.NewSystemAutomaticAccessBotUser(),
+		}
+
+		t.Run("EmptyCluster", func(t *testing.T) {
+			as := newTestAuthServer(ctx, t)
+			clock := clockwork.NewFakeClock()
+			as.SetClock(clock)
+
+			// Run multiple times to simulate starting auth on an
+			// existing cluster and asserting that everything still
+			// returns success
+			for i := 0; i < 2; i++ {
+				err := createPresetRoles(ctx, as)
+				require.NoError(t, err)
+
+				err = createPresetUsers(ctx, as)
+				require.NoError(t, err)
+			}
+
+			// Preset Roles were created
+			for _, role := range append(enterprisePresetRoleNames, enterpriseSystemRoleNames...) {
+				_, err := as.GetRole(ctx, role)
+				require.NoError(t, err)
+			}
+
+			// Preset Users were created
+			for _, user := range enterpriseUsers {
+				_, err := as.GetUser(user.GetName(), false)
+				require.NoError(t, err)
+			}
+		})
+
+		t.Run("Does not upsert roles if nothing changes", func(t *testing.T) {
+			upsertRoleTest(t, enterprisePresetRoleNames, enterpriseSystemRoleNames)
+		})
+
+		t.Run("System users are always upserted", func(t *testing.T) {
+			ctx := context.Background()
+			sysUser := services.NewSystemAutomaticAccessBotUser().(*types.UserV2)
+
+			// GIVEN a user database...
+			auth := newMockUserManager(t)
+
+			// Set the expectation that all user creations will succeed EXCEPT
+			// for our known system user
+			auth.On("CreateUser", ctx, mock.Anything).
+				Run(requireSystemResource(t, 1)).
+				Maybe().
+				Return(nil)
+
+			// All attempts to upsert should succeed, and record the being upserted
+			upsertedUsers := []string{}
+			auth.On("UpsertUser", mock.Anything).
+				Run(func(args mock.Arguments) {
+					u := args.Get(0).(types.User)
+					upsertedUsers = append(upsertedUsers, u.GetName())
+				}).
+				Return(nil)
+
+			// WHEN I attempt to create the preset users...
+			err := createPresetUsers(ctx, auth)
+
+			// EXPECT that the process succeeds and the system user was upserted
+			require.NoError(t, err)
+			auth.AssertExpectations(t)
+			require.Contains(t, upsertedUsers, sysUser.Metadata.Name)
+		})
 	})
 }
 
-type mockRoleManager struct {
-	roles                map[string]types.Role
-	getRoleCallsCount    int
-	createRoleCallsCount int
-	upsertRoleCallsCount int
+type mockUserManager struct {
+	mock.Mock
 }
 
-// ResetCallCounters resets the method call counters.
-func (m *mockRoleManager) ResetCallCounters() {
-	m.getRoleCallsCount = 0
-	m.createRoleCallsCount = 0
-	m.upsertRoleCallsCount = 0
+func newMockUserManager(t *testing.T) *mockUserManager {
+	m := &mockUserManager{}
+	m.Test(t)
+	return m
 }
 
-// GetRole returns role by name.
-func (m *mockRoleManager) GetRole(ctx context.Context, name string) (types.Role, error) {
-	m.getRoleCallsCount = m.getRoleCallsCount + 1
+func (m *mockUserManager) CreateUser(ctx context.Context, user types.User) error {
+	type delegateFn = func(types.User) error
+	args := m.Called(ctx, user)
+	if delegate, ok := args.Get(0).(delegateFn); ok {
+		return delegate(user)
+	}
+	return args.Error(0)
+}
+
+func (m *mockUserManager) GetUser(username string, withSecrets bool) (types.User, error) {
+	type delegateFn = func(username string, withSecrets bool) (types.User, error)
+	args := m.Called(username, withSecrets)
+	if delegate, ok := args.Get(0).(delegateFn); ok {
+		return delegate(username, withSecrets)
+	}
+	return args.Get(0).(types.User), args.Error(1)
+}
 
-	role, ok := m.roles[name]
-	if !ok {
-		return nil, trace.NotFound("role not found")
+func (m *mockUserManager) UpsertUser(user types.User) error {
+	type delegateFn = func(types.User) error
+	args := m.Called(user)
+	if delegate, ok := args.Get(0).(delegateFn); ok {
+		return delegate(user)
 	}
-	return role, nil
+	return args.Error(0)
+}
+
+var _ PresetUsers = &mockUserManager{}
+
+type mockRoleManager struct {
+	mock.Mock
+}
+
+var _ PresetRoleManager = &mockRoleManager{}
+
+func newMockRoleManager(t *testing.T) *mockRoleManager {
+	m := &mockRoleManager{}
+	m.Test(t)
+	return m
 }
 
 // CreateRole creates a role.
 func (m *mockRoleManager) CreateRole(ctx context.Context, role types.Role) error {
-	m.createRoleCallsCount = m.createRoleCallsCount + 1
-
-	_, ok := m.roles[role.GetName()]
-	if ok {
-		return trace.AlreadyExists("role not found")
+	type delegateFn = func(context.Context, types.Role) error
+	args := m.Called(ctx, role)
+	if delegate, ok := args[0].(delegateFn); ok {
+		return delegate(ctx, role)
 	}
+	return args.Error(0)
+}
 
-	m.roles[role.GetName()] = role
-	return nil
+func (m *mockRoleManager) GetRole(ctx context.Context, name string) (types.Role, error) {
+	type delegateFn = func(context.Context, string) (types.Role, error)
+	args := m.Called(ctx, name)
+	if delegate, ok := args[0].(delegateFn); ok {
+		return delegate(ctx, name)
+	}
+	return args[0].(types.Role), args.Error(1)
 }
 
-// UpsertRole creates or updates a role and emits a related audit event.
 func (m *mockRoleManager) UpsertRole(ctx context.Context, role types.Role) error {
-	m.upsertRoleCallsCount = m.upsertRoleCallsCount + 1
-	m.roles[role.GetName()] = role
+	type delegateFn = func(context.Context, types.Role) error
+	args := m.Called(ctx, role)
+	if delegate, ok := args[0].(delegateFn); ok {
+		return delegate(ctx, role)
+	}
+	return args.Error(0)
+}
 
-	return nil
+func requireSystemResource(t *testing.T, argno int) func(mock.Arguments) {
+	return func(args mock.Arguments) {
+		argOfInterest := args[argno]
+		require.Implements(t, (*types.Resource)(nil), argOfInterest)
+		require.True(t, types.IsSystemResource(argOfInterest.(types.Resource)))
+	}
+}
+
+func toSet(items []string) map[string]struct{} {
+	result := make(map[string]struct{})
+	for _, v := range items {
+		result[v] = struct{}{}
+	}
+	return result
 }
 
 func setupConfig(t *testing.T) InitConfig {
diff --git a/lib/auth/join_ec2_test.go b/lib/auth/join_ec2_test.go
index a50d221366dbc..72c9b5b0ca782 100644
--- a/lib/auth/join_ec2_test.go
+++ b/lib/auth/join_ec2_test.go
@@ -643,7 +643,7 @@ func TestHostUniqueCheck(t *testing.T) {
 						Namespace: defaults.Namespace,
 					},
 				}
-				err := a.UpsertProxy(proxy)
+				err := a.UpsertProxy(context.Background(), proxy)
 				require.NoError(t, err)
 			},
 		},
diff --git a/lib/auth/methods.go b/lib/auth/methods.go
index 304cf7816db6d..413113dc32a58 100644
--- a/lib/auth/methods.go
+++ b/lib/auth/methods.go
@@ -352,7 +352,7 @@ func (s *Server) authenticateHeadless(ctx context.Context, req AuthenticateUserR
 	// Delete the headless authentication upon failure.
 	defer func() {
 		if err != nil {
-			if err := s.DeleteHeadlessAuthentication(s.CloseContext(), req.HeadlessAuthenticationID); err != nil && !trace.IsNotFound(err) {
+			if err := s.DeleteHeadlessAuthentication(s.CloseContext(), req.Username, req.HeadlessAuthenticationID); err != nil && !trace.IsNotFound(err) {
 				log.Debugf("Failed to delete headless authentication: %v", err)
 			}
 		}
@@ -365,45 +365,73 @@ func (s *Server) authenticateHeadless(ctx context.Context, req AuthenticateUserR
 
 	// Headless Authentication should expire when the callback expires.
 	expires := s.clock.Now().Add(defaults.CallbackTimeout)
-	headlessAuthn, err := types.NewHeadlessAuthenticationStub(req.HeadlessAuthenticationID, expires)
+
+	// Create the headless authentication and validate request details.
+	ha, err := types.NewHeadlessAuthentication(req.Username, req.HeadlessAuthenticationID, expires)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	headlessAuthn.User = req.Username
-	headlessAuthn.PublicKey = req.PublicKey
-	headlessAuthn.ClientIpAddress = req.ClientMetadata.RemoteAddr
-	if err := services.ValidateHeadlessAuthentication(headlessAuthn); err != nil {
+	ha.State = types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING
+	ha.PublicKey = req.PublicKey
+	ha.ClientIpAddress = req.ClientMetadata.RemoteAddr
+	if err := services.ValidateHeadlessAuthentication(ha); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Headless authentication requests are made without any prior authentication. To avoid DDos
+	// attacks on the Auth server's backend, we don't create the headless authentication in the
+	// backend until an authenticated client creates a headless authentication stub. This serves
+	// as indirect authorization to insert the full headless authentication details into the backend.
+	if _, err := s.waitForHeadlessStub(ctx, ha); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := s.UpsertHeadlessAuthentication(ctx, ha); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	sub, err := s.headlessAuthenticationWatcher.Subscribe(ctx, req.HeadlessAuthenticationID)
+	// Wait for the request to be approved/denied.
+	approvedHeadlessAuthn, err := s.waitForHeadlessApproval(ctx, req.Username, req.HeadlessAuthenticationID)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Verify that the headless authentication has not been tampered with.
+	if approvedHeadlessAuthn.User != req.Username {
+		return nil, trace.AccessDenied("headless authentication user mismatch")
+	}
+	if !bytes.Equal(req.PublicKey, ha.PublicKey) {
+		return nil, trace.AccessDenied("headless authentication public key mismatch")
+	}
+
+	return approvedHeadlessAuthn.MfaDevice, nil
+}
+
+func (s *Server) waitForHeadlessStub(ctx context.Context, ha *types.HeadlessAuthentication) (*types.HeadlessAuthentication, error) {
+	sub, err := s.headlessAuthenticationWatcher.Subscribe(ctx, ha.User, services.HeadlessAuthenticationUserStubID)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	defer sub.Close()
 
-	// Wait for a headless authenticated stub to be inserted by an authenticated
-	// call to GetHeadlessAuthentication. We do this to avoid immediately inserting
-	// backend items from an unauthenticated endpoint.
-	headlessAuthnStub, err := s.headlessAuthenticationWatcher.WaitForUpdate(ctx, sub, func(ha *types.HeadlessAuthentication) (bool, error) {
-		// Only headless authentication stub can be inserted without the standard validation.
-		if services.ValidateHeadlessAuthentication(ha) == nil {
-			return false, trace.AlreadyExists("headless auth request already exists")
-		}
+	stub, err := sub.WaitForUpdate(ctx, func(ha *types.HeadlessAuthentication) (bool, error) {
 		return true, nil
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	return stub, nil
+}
 
-	// Update headless authentication with login details.
-	if _, err := s.CompareAndSwapHeadlessAuthentication(ctx, headlessAuthnStub, headlessAuthn); err != nil {
+func (s *Server) waitForHeadlessApproval(ctx context.Context, username, reqID string) (*types.HeadlessAuthentication, error) {
+	sub, err := s.headlessAuthenticationWatcher.Subscribe(ctx, username, reqID)
+	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	defer sub.Close()
 
-	// Wait for the request to be approved/denied.
-	headlessAuthn, err = s.headlessAuthenticationWatcher.WaitForUpdate(ctx, sub, func(ha *types.HeadlessAuthentication) (bool, error) {
+	headlessAuthn, err := sub.WaitForUpdate(ctx, func(ha *types.HeadlessAuthentication) (bool, error) {
 		switch ha.State {
 		case types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED:
 			if ha.MfaDevice == nil {
@@ -419,12 +447,7 @@ func (s *Server) authenticateHeadless(ctx context.Context, req AuthenticateUserR
 		return nil, trace.Wrap(err)
 	}
 
-	// Verify that the headless authentication has not been tampered with.
-	if headlessAuthn.User != req.Username {
-		return nil, trace.AccessDenied("user mismatch")
-	}
-
-	return headlessAuthn.MfaDevice, nil
+	return headlessAuthn, nil
 }
 
 // AuthenticateWebUser authenticates web user, creates and returns a web session
@@ -636,7 +659,7 @@ func (s *Server) AuthenticateSSHUser(ctx context.Context, req AuthenticateSSHReq
 
 	// For headless authentication, a short-lived mfa-verified cert should be generated.
 	if req.HeadlessAuthenticationID != "" {
-		ha, err := s.GetHeadlessAuthentication(ctx, req.HeadlessAuthenticationID)
+		ha, err := s.GetHeadlessAuthentication(ctx, req.Username, req.HeadlessAuthenticationID)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/auth/register.go b/lib/auth/register.go
index 61f31f4715710..17673158d1a41 100644
--- a/lib/auth/register.go
+++ b/lib/auth/register.go
@@ -433,7 +433,7 @@ func proxyJoinServiceConn(params RegisterParams, insecure bool) (*grpc.ClientCon
 	// skip verify as the Proxy server will present its host cert which is not
 	// fully verifiable at this point since the client does not have the host
 	// CAs yet before completing registration.
-	alpnConnUpgrade := client.IsALPNConnUpgradeRequired(getHostAddresses(params)[0], insecure)
+	alpnConnUpgrade := client.IsALPNConnUpgradeRequired(context.TODO(), getHostAddresses(params)[0], insecure)
 	if alpnConnUpgrade && !insecure {
 		tlsConfig.InsecureSkipVerify = true
 		tlsConfig.VerifyConnection = verifyALPNUpgradedConn(params.Clock)
diff --git a/lib/auth/session_access.go b/lib/auth/session_access.go
index bd7e6e0cd9868..4c769ad5c756c 100644
--- a/lib/auth/session_access.go
+++ b/lib/auth/session_access.go
@@ -24,6 +24,7 @@ import (
 	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/trace"
 	"github.com/vulcand/predicate"
+	"golang.org/x/exp/slices"
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/services"
@@ -187,7 +188,7 @@ func (e *SessionAccessEvaluator) matchesKind(allow []string) bool {
 func RoleSupportsModeratedSessions(roles []types.Role) bool {
 	for _, role := range roles {
 		switch role.GetVersion() {
-		case types.V5, types.V6:
+		case types.V5, types.V6, types.V7:
 			return true
 		}
 	}
@@ -216,7 +217,7 @@ func (e *SessionAccessEvaluator) CanJoin(user SessionAccessContext) []types.Sess
 		if e.matchesJoin(allowPolicy) {
 			for _, modeString := range allowPolicy.Modes {
 				mode := types.SessionParticipantMode(modeString)
-				if !SliceContainsMode(modes, mode) {
+				if !slices.Contains(modes, mode) {
 					modes = append(modes, mode)
 				}
 			}
@@ -226,15 +227,6 @@ func (e *SessionAccessEvaluator) CanJoin(user SessionAccessContext) []types.Sess
 	return modes
 }
 
-func SliceContainsMode(s []types.SessionParticipantMode, e types.SessionParticipantMode) bool {
-	for _, a := range s {
-		if a == e {
-			return true
-		}
-	}
-	return false
-}
-
 // PolicyOptions is a set of settings for the session determined by the matched required policy.
 type PolicyOptions struct {
 	OnLeaveAction types.OnSessionLeaveAction
@@ -310,7 +302,7 @@ policySetLoop:
 
 			// Check every participant against the policy.
 			for _, participant := range participants {
-				if !SliceContainsMode(requireModes, participant.Mode) {
+				if !slices.Contains(requireModes, participant.Mode) {
 					continue
 				}
 
diff --git a/lib/auth/state.go b/lib/auth/state.go
index a21d8d011fe2a..2c435cccaef95 100644
--- a/lib/auth/state.go
+++ b/lib/auth/state.go
@@ -85,8 +85,8 @@ const (
 )
 
 // GetState reads rotation state from disk.
-func (p *ProcessStorage) GetState(role types.SystemRole) (*StateV2, error) {
-	item, err := p.stateStorage.Get(context.TODO(), backend.Key(statesPrefix, strings.ToLower(role.String()), stateName))
+func (p *ProcessStorage) GetState(ctx context.Context, role types.SystemRole) (*StateV2, error) {
+	item, err := p.stateStorage.Get(ctx, backend.Key(statesPrefix, strings.ToLower(role.String()), stateName))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/tls_test.go b/lib/auth/tls_test.go
index 7e2a592877bc8..ccaa8f77f5f83 100644
--- a/lib/auth/tls_test.go
+++ b/lib/auth/tls_test.go
@@ -2160,6 +2160,10 @@ func TestGenerateCerts(t *testing.T) {
 	t.Run("ImpersonateAllow", func(t *testing.T) {
 		// Super impersonator impersonate anyone and login as root
 		maxSessionTTL := 300 * time.Hour
+		authPref, err := srv.Auth().GetAuthPreference(ctx)
+		require.NoError(t, err)
+		authPref.SetDefaultSessionTTL(types.Duration(maxSessionTTL))
+		srv.Auth().SetAuthPreference(ctx, authPref)
 		superImpersonatorRole, err := types.NewRole("superimpersonator", types.RoleSpecV6{
 			Options: types.RoleOptions{
 				MaxSessionTTL: types.Duration(maxSessionTTL),
diff --git a/lib/auth/touchid/api.go b/lib/auth/touchid/api.go
index 77a54996ac926..5745593b6c370 100644
--- a/lib/auth/touchid/api.go
+++ b/lib/auth/touchid/api.go
@@ -108,6 +108,16 @@ type DiagResult struct {
 	// IsAvailable is true if Touch ID is considered functional.
 	// It means enough of the preceding tests to enable the feature.
 	IsAvailable bool
+
+	// isClamshellFailure is set when it's likely that clamshell mode is the sole
+	// culprit of Touch ID unavailability.
+	isClamshellFailure bool
+}
+
+// IsClamshellFailure returns true if the lack of touch ID availability could be
+// due to clamshell mode.
+func (d *DiagResult) IsClamshellFailure() bool {
+	return d.isClamshellFailure
 }
 
 // CredentialInfo holds information about a Secure Enclave credential.
diff --git a/lib/auth/touchid/api_darwin.go b/lib/auth/touchid/api_darwin.go
index ac024ee76becd..8dd2f5578f41b 100644
--- a/lib/auth/touchid/api_darwin.go
+++ b/lib/auth/touchid/api_darwin.go
@@ -56,6 +56,11 @@ const (
 	promptReason = "authenticate user"
 )
 
+const (
+	kLAErrorDomain       = "com.apple.LocalAuthentication"
+	kLAErrorSystemCancel = -4
+)
+
 type parsedLabel struct {
 	rpID, user string
 }
@@ -88,11 +93,33 @@ type touchIDImpl struct{}
 func (touchIDImpl) Diag() (*DiagResult, error) {
 	var resC C.DiagResult
 	C.RunDiag(&resC)
+	defer func() {
+		C.free(unsafe.Pointer(resC.la_error_domain))
+		C.free(unsafe.Pointer(resC.la_error_description))
+	}()
 
 	signed := (bool)(resC.has_signature)
 	entitled := (bool)(resC.has_entitlements)
 	passedLA := (bool)(resC.passed_la_policy_test)
 	passedEnclave := (bool)(resC.passed_secure_enclave_test)
+	laErrorCode := int64(resC.la_error_code)
+	laErrorDomain := C.GoString(resC.la_error_domain)
+	laErrorDescription := C.GoString(resC.la_error_description)
+	if !passedLA && laErrorDescription != "" {
+		log.Debugf("Touch ID: LAError description: %v", laErrorDescription)
+	}
+
+	isAvailable := signed && entitled && passedLA && passedEnclave
+	isClamshellFailure := !isAvailable &&
+		// LAContext test failed.
+		!passedLA &&
+		// Everything else worked.
+		signed &&
+		entitled &&
+		passedEnclave &&
+		// We got an LAErrorSystemCancel error.
+		laErrorDomain == kLAErrorDomain &&
+		laErrorCode == kLAErrorSystemCancel
 
 	return &DiagResult{
 		HasCompileSupport:       true,
@@ -100,7 +127,8 @@ func (touchIDImpl) Diag() (*DiagResult, error) {
 		HasEntitlements:         entitled,
 		PassedLAPolicyTest:      passedLA,
 		PassedSecureEnclaveTest: passedEnclave,
-		IsAvailable:             signed && entitled && passedLA && passedEnclave,
+		IsAvailable:             isAvailable,
+		isClamshellFailure:      isClamshellFailure,
 	}, nil
 }
 
diff --git a/lib/auth/touchid/diag.h b/lib/auth/touchid/diag.h
index ff674b7eeca78..a8d3169d1a6be 100644
--- a/lib/auth/touchid/diag.h
+++ b/lib/auth/touchid/diag.h
@@ -16,12 +16,16 @@
 #define DIAG_H_
 
 #include <stdbool.h>
+#include <stdint.h>
 
 typedef struct DiagResult {
   bool has_signature;
   bool has_entitlements;
   bool passed_la_policy_test;
   bool passed_secure_enclave_test;
+  int64_t la_error_code;
+  const char *la_error_domain;
+  const char *la_error_description;
 } DiagResult;
 
 // RunDiag runs self-diagnostics to verify if Touch ID is supported.
diff --git a/lib/auth/touchid/diag.m b/lib/auth/touchid/diag.m
index bb75a448c7e22..06e2389bee756 100644
--- a/lib/auth/touchid/diag.m
+++ b/lib/auth/touchid/diag.m
@@ -66,9 +66,15 @@ void RunDiag(DiagResult *diagOut) {
   // This fails if Touch ID is not available or cannot be used for various
   // reasons (no password set, device locked, lid is closed, etc).
   LAContext *ctx = [[LAContext alloc] init];
+  NSError *laError = NULL;
   diagOut->passed_la_policy_test =
       [ctx canEvaluatePolicy:LAPolicyDeviceOwnerAuthenticationWithBiometrics
-                       error:NULL];
+                       error:&laError];
+  if (laError) {
+    diagOut->la_error_code = [laError code];
+    diagOut->la_error_domain = CopyNSString([laError domain]);
+    diagOut->la_error_description = CopyNSString([laError description]);
+  }
 
   // Attempt to write a non-permanent key to the enclave.
   NSDictionary *attributes = @{
diff --git a/lib/auth/user.go b/lib/auth/user.go
index 7946072da3b67..d59be83a5391e 100644
--- a/lib/auth/user.go
+++ b/lib/auth/user.go
@@ -33,6 +33,7 @@ import (
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/services"
+	usagereporter "github.com/gravitational/teleport/lib/usagereporter/teleport"
 )
 
 // CreateUser inserts a new user entry in a backend.
@@ -74,11 +75,21 @@ func (s *Server) CreateUser(ctx context.Context, user types.User) error {
 		log.WithError(err).Warn("Failed to emit user create event.")
 	}
 
+	usagereporter.EmitEditorChangeEvent(user.GetName(), nil, user.GetRoles(), s.AnonymizeAndSubmit)
+
 	return nil
 }
 
 // UpdateUser updates an existing user in a backend.
 func (s *Server) UpdateUser(ctx context.Context, user types.User) error {
+	prevUser, err := s.GetUser(user.GetName(), false)
+	var omitEditorEvent bool
+	if err != nil {
+		// don't return error here since this call is for event emitting purposes only
+		log.WithError(err).Warn("Failed getting user during update")
+		omitEditorEvent = true
+	}
+
 	if err := s.Services.UpdateUser(ctx, user); err != nil {
 		return trace.Wrap(err)
 	}
@@ -106,12 +117,28 @@ func (s *Server) UpdateUser(ctx context.Context, user types.User) error {
 		log.WithError(err).Warn("Failed to emit user update event.")
 	}
 
+	if !omitEditorEvent {
+		usagereporter.EmitEditorChangeEvent(user.GetName(), prevUser.GetRoles(), user.GetRoles(), s.AnonymizeAndSubmit)
+	}
+
 	return nil
 }
 
 // UpsertUser updates a user.
 func (s *Server) UpsertUser(user types.User) error {
-	err := s.Services.UpsertUser(user)
+	prevUser, err := s.GetUser(user.GetName(), false)
+	var omitEditorEvent bool
+	if err != nil {
+		if trace.IsNotFound(err) {
+			prevUser = nil
+		} else {
+			// don't return error here since upsert may still succeed, just omit the event
+			log.WithError(err).Warn("Failed getting user during upsert")
+			omitEditorEvent = true
+		}
+	}
+
+	err = s.Services.UpsertUser(user)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -141,6 +168,14 @@ func (s *Server) UpsertUser(user types.User) error {
 		log.WithError(err).Warn("Failed to emit user upsert event.")
 	}
 
+	var prevRoles []string
+	if prevUser != nil {
+		prevRoles = prevUser.GetRoles()
+	}
+	if !omitEditorEvent {
+		usagereporter.EmitEditorChangeEvent(user.GetName(), prevRoles, user.GetRoles(), s.AnonymizeAndSubmit)
+	}
+
 	return nil
 }
 
@@ -175,11 +210,22 @@ func (s *Server) CompareAndSwapUser(ctx context.Context, new, existing types.Use
 		log.WithError(err).Warn("Failed to emit user update event.")
 	}
 
+	usagereporter.EmitEditorChangeEvent(new.GetName(), existing.GetRoles(), new.GetRoles(), s.AnonymizeAndSubmit)
+
 	return nil
 }
 
 // DeleteUser deletes an existng user in a backend by username.
 func (s *Server) DeleteUser(ctx context.Context, user string) error {
+	prevUser, err := s.GetUser(user, false)
+	var omitEditorEvent bool
+	if err != nil && !trace.IsNotFound(err) {
+		// don't return error here, delete may still succeed
+		log.WithError(err).Warn("Failed getting user during delete operation")
+		prevUser = nil
+		omitEditorEvent = true
+	}
+
 	role, err := s.Services.GetRole(ctx, services.RoleNameForUser(user))
 	if err != nil {
 		if !trace.IsNotFound(err) {
@@ -212,5 +258,9 @@ func (s *Server) DeleteUser(ctx context.Context, user string) error {
 		log.WithError(err).Warn("Failed to emit user delete event.")
 	}
 
+	if !omitEditorEvent {
+		usagereporter.EmitEditorChangeEvent(user, prevUser.GetRoles(), nil, s.AnonymizeAndSubmit)
+	}
+
 	return nil
 }
diff --git a/lib/auth/userpreferences/userpreferencesv1/service.go b/lib/auth/userpreferences/userpreferencesv1/service.go
new file mode 100644
index 0000000000000..933c3f9fe8d54
--- /dev/null
+++ b/lib/auth/userpreferences/userpreferencesv1/service.go
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package userpreferencesv1
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	userpreferences "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+// ServiceConfig holds configuration options for the user preferences service.
+type ServiceConfig struct {
+	Backend services.UserPreferences
+}
+
+// Service implements the teleport.userpreferences.v1.UserPreferencesService RPC service.
+type Service struct {
+	userpreferences.UnimplementedUserPreferencesServiceServer
+
+	backend services.UserPreferences
+}
+
+// NewService returns a new user preferences gRPC service.
+func NewService(cfg *ServiceConfig) (*Service, error) {
+	switch {
+	case cfg.Backend == nil:
+		return nil, trace.BadParameter("backend is required")
+	}
+
+	return &Service{
+		backend: cfg.Backend,
+	}, nil
+}
+
+// GetUserPreferences returns the user preferences for a given user.
+func (a *Service) GetUserPreferences(ctx context.Context, req *userpreferences.GetUserPreferencesRequest) (*userpreferences.GetUserPreferencesResponse, error) {
+	return a.backend.GetUserPreferences(ctx, req)
+}
+
+// UpsertUserPreferences creates or updates user preferences for a given username.
+func (a *Service) UpsertUserPreferences(ctx context.Context, req *userpreferences.UpsertUserPreferencesRequest) (*emptypb.Empty, error) {
+	return &emptypb.Empty{}, trace.Wrap(a.backend.UpsertUserPreferences(ctx, req))
+}
diff --git a/lib/auth/webauthncli/api.go b/lib/auth/webauthncli/api.go
index 08feab8305303..0a895ce5e88a6 100644
--- a/lib/auth/webauthncli/api.go
+++ b/lib/auth/webauthncli/api.go
@@ -21,8 +21,10 @@ import (
 
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
+	oteltrace "go.opentelemetry.io/otel/trace"
 
 	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/observability/tracing"
 	"github.com/gravitational/teleport/lib/auth/touchid"
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 	"github.com/gravitational/teleport/lib/auth/webauthnwin"
@@ -119,6 +121,13 @@ func Login(
 	ctx context.Context,
 	origin string, assertion *wanlib.CredentialAssertion, prompt LoginPrompt, opts *LoginOpts,
 ) (*proto.MFAAuthenticateResponse, string, error) {
+	ctx, span := tracing.NewTracer("mfa").Start(
+		ctx,
+		"webauthncli/Login",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
 	// origin vs RPID sanity check.
 	// Doesn't necessarily means a failure, but it's likely to be one.
 	switch {
diff --git a/lib/authz/permissions.go b/lib/authz/permissions.go
index 5baba26027ef4..ce9b58b12598f 100644
--- a/lib/authz/permissions.go
+++ b/lib/authz/permissions.go
@@ -625,7 +625,7 @@ func roleSpecForProxy(clusterName string) types.RoleSpecV6 {
 	}
 }
 
-// RoleSetForBuiltinRole returns RoleSet for embedded builtin role
+// RoleSetForBuiltinRoles returns RoleSet for embedded builtin role
 func RoleSetForBuiltinRoles(clusterName string, recConfig types.SessionRecordingConfig, roles ...types.SystemRole) (services.RoleSet, error) {
 	var definitions []types.Role
 	for _, role := range roles {
diff --git a/lib/authz/permissions_test.go b/lib/authz/permissions_test.go
index e3eae0c1d5514..3d8af3237eed7 100644
--- a/lib/authz/permissions_test.go
+++ b/lib/authz/permissions_test.go
@@ -236,15 +236,18 @@ func upsertLockWithPutEvent(ctx context.Context, t *testing.T, client *testClien
 	defer lockWatch.Close()
 
 	require.NoError(t, client.UpsertLock(ctx, lock))
-	select {
-	case event := <-lockWatch.Events():
-		require.Equal(t, types.OpPut, event.Type)
-		require.Empty(t, resourceDiff(lock, event.Resource))
-	case <-lockWatch.Done():
-		t.Fatalf("Watcher exited with error: %v.", lockWatch.Error())
-	case <-time.After(2 * time.Second):
-		t.Fatal("Timeout waiting for lock put.")
-	}
+
+	// Retry a few times to wait for the resource event we expect as the
+	// resource watcher can potentially return events for previously
+	// created resources as well.
+	require.Eventually(t, func() bool {
+		select {
+		case event := <-lockWatch.Events():
+			return types.OpPut == event.Type && resourceDiff(lock, event.Resource) == ""
+		case <-lockWatch.Done():
+			return false
+		}
+	}, 2*time.Second, 100*time.Millisecond)
 }
 
 func TestGetClientUserIsSSO(t *testing.T) {
diff --git a/lib/automaticupgrades/version.go b/lib/automaticupgrades/version.go
new file mode 100644
index 0000000000000..607d32ef9bbd9
--- /dev/null
+++ b/lib/automaticupgrades/version.go
@@ -0,0 +1,75 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package automaticupgrades
+
+import (
+	"context"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+const (
+	// stableCloudVersionBaseURL is the base URL for the server that returns the current stable/cloud version.
+	stableCloudVersionBaseURL = "https://updates.releases.teleport.dev"
+
+	// stableCloudVersionPath is the URL path that returns the current stable/cloud version.
+	stableCloudVersionPath = "/v1/stable/cloud/version"
+)
+
+// Version returns the version that should be used for installing Teleport Services
+// This is used when installing agents using scripts.
+// Even when Teleport Auth/Proxy is using vX, the agents must always respect this version.
+func Version(ctx context.Context, baseURL string) (string, error) {
+	if baseURL == "" {
+		baseURL = stableCloudVersionBaseURL
+	}
+
+	fullURL, err := url.JoinPath(baseURL, stableCloudVersionPath)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	defer resp.Body.Close()
+
+	body, err := utils.ReadAtMost(resp.Body, teleport.MaxHTTPResponseSize)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return "", trace.BadParameter("invalid status code %d, body: %s", resp.StatusCode, string(body))
+	}
+
+	versionString := strings.TrimSpace(string(body))
+
+	return versionString, trace.Wrap(err)
+}
diff --git a/lib/automaticupgrades/version_test.go b/lib/automaticupgrades/version_test.go
new file mode 100644
index 0000000000000..7433e6af84ae5
--- /dev/null
+++ b/lib/automaticupgrades/version_test.go
@@ -0,0 +1,86 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package automaticupgrades
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestVersion(t *testing.T) {
+	ctx := context.Background()
+
+	isBadParameterErr := func(tt require.TestingT, err error, i ...interface{}) {
+		require.True(tt, trace.IsBadParameter(err), "expected bad parameter, got %v", err)
+	}
+
+	for _, tt := range []struct {
+		name               string
+		mockStatusCode     int
+		mockResponseString string
+		errCheck           require.ErrorAssertionFunc
+		expectedVersion    string
+	}{
+		{
+			name:               "real response",
+			mockStatusCode:     http.StatusOK,
+			mockResponseString: "v13.1.1\n",
+			errCheck:           require.NoError,
+			expectedVersion:    "v13.1.1",
+		},
+		{
+			name:           "invalid status code (500)",
+			mockStatusCode: http.StatusInternalServerError,
+			errCheck:       isBadParameterErr,
+		},
+		{
+			name:           "invalid status code (403)",
+			mockStatusCode: http.StatusForbidden,
+			errCheck:       isBadParameterErr,
+		},
+		{
+			name:               "valid but has spaces",
+			mockStatusCode:     http.StatusOK,
+			mockResponseString: " v13.1.1 \n \r\n",
+			errCheck:           require.NoError,
+			expectedVersion:    "v13.1.1",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			httpTestServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				assert.Equal(t, r.URL.Path, "/v1/stable/cloud/version")
+				w.WriteHeader(tt.mockStatusCode)
+				w.Write([]byte(tt.mockResponseString))
+			}))
+			defer httpTestServer.Close()
+
+			v, err := Version(ctx, httpTestServer.URL)
+			tt.errCheck(t, err)
+			if err != nil {
+				return
+			}
+
+			require.Equal(t, v, tt.expectedVersion)
+		})
+	}
+}
diff --git a/lib/backend/dynamo/dynamodbbk.go b/lib/backend/dynamo/dynamodbbk.go
index 2b21371e0e5bc..506994b5901c2 100644
--- a/lib/backend/dynamo/dynamodbbk.go
+++ b/lib/backend/dynamo/dynamodbbk.go
@@ -852,6 +852,22 @@ func (b *Backend) deleteKey(ctx context.Context, key []byte) error {
 	return nil
 }
 
+func (b *Backend) deleteKeyIfExpired(ctx context.Context, key []byte) error {
+	_, err := b.svc.DeleteItemWithContext(ctx, &dynamodb.DeleteItemInput{
+		TableName: aws.String(b.TableName),
+		Key:       keyToAttributeValueMap(key),
+
+		// succeed if the item no longer exists
+		ConditionExpression: aws.String(
+			"attribute_not_exists(FullPath) OR (attribute_exists(Expires) AND Expires <= :timestamp)",
+		),
+		ExpressionAttributeValues: map[string]*dynamodb.AttributeValue{
+			":timestamp": timeToAttributeValue(b.clock.Now()),
+		},
+	})
+	return trace.Wrap(err)
+}
+
 func (b *Backend) getKey(ctx context.Context, key []byte) (*record, error) {
 	av, err := dynamodbattribute.MarshalMap(keyLookup{
 		HashKey:  hashKey,
@@ -880,7 +896,7 @@ func (b *Backend) getKey(ctx context.Context, key []byte) (*record, error) {
 	}
 	// Check if key expired, if expired delete it
 	if r.isExpired(b.clock.Now()) {
-		if err := b.deleteKey(ctx, key); err != nil {
+		if err := b.deleteKeyIfExpired(ctx, key); err != nil {
 			b.Warnf("Failed deleting expired key %q: %v", key, err)
 		}
 		return nil, trace.NotFound("%q is not found", key)
@@ -930,3 +946,20 @@ func (r records) Swap(i, j int) {
 func (r records) Less(i, j int) bool {
 	return r[i].FullPath < r[j].FullPath
 }
+
+func fullPathToAttributeValueMap(fullPath string) map[string]*dynamodb.AttributeValue {
+	return map[string]*dynamodb.AttributeValue{
+		hashKeyKey:  {S: aws.String(hashKey)},
+		fullPathKey: {S: aws.String(fullPath)},
+	}
+}
+
+func keyToAttributeValueMap(key []byte) map[string]*dynamodb.AttributeValue {
+	return fullPathToAttributeValueMap(prependPrefix(key))
+}
+
+func timeToAttributeValue(t time.Time) *dynamodb.AttributeValue {
+	return &dynamodb.AttributeValue{
+		N: aws.String(strconv.FormatInt(t.Unix(), 10)),
+	}
+}
diff --git a/lib/backend/report.go b/lib/backend/report.go
index 4e12caa242c7d..c792d90c9570b 100644
--- a/lib/backend/report.go
+++ b/lib/backend/report.go
@@ -124,7 +124,7 @@ func (s *Reporter) GetRange(ctx context.Context, startKey []byte, endKey []byte,
 
 	start := s.Clock().Now()
 	res, err := s.Backend.GetRange(ctx, startKey, endKey, limit)
-	batchReadLatencies.WithLabelValues(s.Component).Observe(time.Since(start).Seconds())
+	batchReadLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
 	batchReadRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
 		batchReadRequestsFailed.WithLabelValues(s.Component).Inc()
@@ -146,7 +146,7 @@ func (s *Reporter) Create(ctx context.Context, i Item) (*Lease, error) {
 
 	start := s.Clock().Now()
 	lease, err := s.Backend.Create(ctx, i)
-	writeLatencies.WithLabelValues(s.Component).Observe(time.Since(start).Seconds())
+	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
 	writeRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
 		writeRequestsFailed.WithLabelValues(s.Component).Inc()
@@ -169,7 +169,7 @@ func (s *Reporter) Put(ctx context.Context, i Item) (*Lease, error) {
 
 	start := s.Clock().Now()
 	lease, err := s.Backend.Put(ctx, i)
-	writeLatencies.WithLabelValues(s.Component).Observe(time.Since(start).Seconds())
+	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
 	writeRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
 		writeRequestsFailed.WithLabelValues(s.Component).Inc()
@@ -191,7 +191,7 @@ func (s *Reporter) Update(ctx context.Context, i Item) (*Lease, error) {
 
 	start := s.Clock().Now()
 	lease, err := s.Backend.Update(ctx, i)
-	writeLatencies.WithLabelValues(s.Component).Observe(time.Since(start).Seconds())
+	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
 	writeRequests.WithLabelValues(s.Component).Inc()
 	if err != nil {
 		writeRequestsFailed.WithLabelValues(s.Component).Inc()
@@ -212,9 +212,9 @@ func (s *Reporter) Get(ctx context.Context, key []byte) (*Item, error) {
 	defer span.End()
 
 	start := s.Clock().Now()
-	readLatencies.WithLabelValues(s.Component).Observe(time.Since(start).Seconds())
-	readRequests.WithLabelValues(s.Component).Inc()
 	item, err := s.Backend.Get(ctx, key)
+	readLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
+	readRequests.WithLabelValues(s.Component).Inc()
 	if err != nil && !trace.IsNotFound(err) {
 		readRequestsFailed.WithLabelValues(s.Component).Inc()
 	}
@@ -236,7 +236,7 @@ func (s *Reporter) CompareAndSwap(ctx context.Context, expected Item, replaceWit
 
 	start := s.Clock().Now()
 	lease, err := s.Backend.CompareAndSwap(ctx, expected, replaceWith)
-	writeLatencies.WithLabelValues(s.Component).Observe(time.Since(start).Seconds())
+	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
 	writeRequests.WithLabelValues(s.Component).Inc()
 	if err != nil && !trace.IsNotFound(err) && !trace.IsCompareFailed(err) {
 		writeRequestsFailed.WithLabelValues(s.Component).Inc()
@@ -258,7 +258,7 @@ func (s *Reporter) Delete(ctx context.Context, key []byte) error {
 
 	start := s.Clock().Now()
 	err := s.Backend.Delete(ctx, key)
-	writeLatencies.WithLabelValues(s.Component).Observe(time.Since(start).Seconds())
+	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
 	writeRequests.WithLabelValues(s.Component).Inc()
 	if err != nil && !trace.IsNotFound(err) {
 		writeRequestsFailed.WithLabelValues(s.Component).Inc()
@@ -281,7 +281,7 @@ func (s *Reporter) DeleteRange(ctx context.Context, startKey []byte, endKey []by
 
 	start := s.Clock().Now()
 	err := s.Backend.DeleteRange(ctx, startKey, endKey)
-	batchWriteLatencies.WithLabelValues(s.Component).Observe(time.Since(start).Seconds())
+	batchWriteLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
 	batchWriteRequests.WithLabelValues(s.Component).Inc()
 	if err != nil && !trace.IsNotFound(err) {
 		batchWriteRequestsFailed.WithLabelValues(s.Component).Inc()
@@ -307,7 +307,7 @@ func (s *Reporter) KeepAlive(ctx context.Context, lease Lease, expires time.Time
 
 	start := s.Clock().Now()
 	err := s.Backend.KeepAlive(ctx, lease, expires)
-	writeLatencies.WithLabelValues(s.Component).Observe(time.Since(start).Seconds())
+	writeLatencies.WithLabelValues(s.Component).Observe(s.Clock().Since(start).Seconds())
 	writeRequests.WithLabelValues(s.Component).Inc()
 	if err != nil && !trace.IsNotFound(err) {
 		writeRequestsFailed.WithLabelValues(s.Component).Inc()
@@ -442,7 +442,7 @@ var (
 	requests = prometheus.NewCounterVec(
 		prometheus.CounterOpts{
 			Name: teleport.MetricBackendRequests,
-			Help: "Number of write requests to the backend",
+			Help: "Number of requests to the backend (reads, writes, and keepalives)",
 		},
 		[]string{teleport.ComponentLabel, teleport.TagReq, teleport.TagRange},
 	)
diff --git a/lib/benchmark/web.go b/lib/benchmark/web.go
new file mode 100644
index 0000000000000..0896269996d6b
--- /dev/null
+++ b/lib/benchmark/web.go
@@ -0,0 +1,236 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package benchmark
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"github.com/gravitational/roundtrip"
+	"github.com/gravitational/trace"
+
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/web"
+)
+
+// WebSSHBenchmark is a benchmark suite that connects to the configured
+// target hosts via the web api and executes the provided command.
+type WebSSHBenchmark struct {
+	// Command to execute on the host.
+	Command []string
+	// Random whether to connect to a random host or not
+	Random bool
+	// Duration of the test used to determine if renewing web sessions
+	// is necessary.
+	Duration time.Duration
+}
+
+// BenchBuilder returns a WorkloadFunc for the given benchmark suite.
+func (s WebSSHBenchmark) BenchBuilder(ctx context.Context, tc *client.TeleportClient) (WorkloadFunc, error) {
+	clt, sess, err := tc.LoginWeb(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	webSess := &webSession{
+		webSession: sess,
+		clt:        clt,
+	}
+
+	// The web session will expire before the duration of the test
+	// so launch the renewal loop.
+	if !time.Now().Add(s.Duration).Before(webSess.expires()) {
+		go webSess.renew(ctx)
+	}
+
+	// Add "exit" to ensure that the session terminates after running the command.
+	command := strings.Join(append(s.Command, "\r\nexit\r\n"), " ")
+
+	if s.Random {
+		if tc.Host != "all" {
+			return nil, trace.BadParameter("random ssh bench commands must use the format <user>@all <command>")
+		}
+
+		servers, err := getServers(ctx, tc)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return func(ctx context.Context) error {
+			return trace.Wrap(s.runCommand(ctx, tc, webSess, chooseRandomHost(servers), command))
+		}, nil
+	}
+
+	return func(ctx context.Context) error {
+		return trace.Wrap(s.runCommand(ctx, tc, webSess, tc.Host, command))
+	}, nil
+}
+
+type webSession struct {
+	mu         sync.Mutex
+	webSession types.WebSession
+	clt        *client.WebClient
+}
+
+func (s *webSession) renew(ctx context.Context) {
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(time.Until(s.expires().Add(-3 * time.Minute))):
+			resp, err := s.clt.PostJSON(ctx, s.clt.Endpoint("webapi", "sessions", "renew"), nil)
+			if err != nil {
+				continue
+			}
+
+			session, err := client.GetSessionFromResponse(resp)
+			if err != nil {
+				continue
+			}
+
+			s.mu.Lock()
+			s.webSession = session
+			s.mu.Unlock()
+		}
+	}
+}
+
+// runCommand starts a non-interactive SSH session and executes the provided
+// command before terminating the session.
+func (s WebSSHBenchmark) runCommand(ctx context.Context, tc *client.TeleportClient, webSess *webSession, host, command string) error {
+	stream, err := connectToHost(ctx, tc, webSess, host)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	defer stream.Close()
+
+	if _, err := io.WriteString(stream, command); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if _, err := io.Copy(tc.Stdout, stream); err != nil && !errors.Is(err, io.EOF) {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// connectToHost opens an SSH session to the target host via the Proxy web api.
+func connectToHost(ctx context.Context, tc *client.TeleportClient, webSession *webSession, host string) (io.ReadWriteCloser, error) {
+	req := web.TerminalRequest{
+		Server: host,
+		Login:  tc.HostLogin,
+		Term: session.TerminalParams{
+			W: 100,
+			H: 100,
+		},
+	}
+
+	data, err := json.Marshal(req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	u := url.URL{
+		Host:   tc.WebProxyAddr,
+		Scheme: client.WSS,
+		Path:   fmt.Sprintf("/v1/webapi/sites/%v/connect", tc.SiteName),
+		RawQuery: url.Values{
+			"params":                        []string{string(data)},
+			roundtrip.AccessTokenQueryParam: []string{webSession.getToken()},
+		}.Encode(),
+	}
+
+	dialer := websocket.Dialer{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: tc.InsecureSkipVerify},
+		Jar:             webSession.getCookieJar(),
+	}
+
+	ws, resp, err := dialer.DialContext(ctx, u.String(), http.Header{
+		"Origin": []string{"http://localhost"},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer resp.Body.Close()
+
+	ty, _, err := ws.ReadMessage()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if ty != websocket.BinaryMessage {
+		return nil, trace.BadParameter("unexpected websocket message received %d", ty)
+	}
+
+	stream := web.NewTerminalStream(ctx, ws, utils.NewLogger())
+	return stream, trace.Wrap(err)
+}
+
+// getServers returns all [types.Server] that the authenticated user has
+// access to.
+func getServers(ctx context.Context, tc *client.TeleportClient) ([]types.Server, error) {
+	clt, err := tc.ConnectToCluster(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer clt.Close()
+
+	resources, err := apiclient.GetAllResources[types.Server](ctx, clt.AuthClient, tc.ResourceFilter(types.KindNode))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if len(resources) == 0 {
+		return nil, trace.BadParameter("no target hosts available")
+	}
+
+	return resources, nil
+}
+
+func (s *webSession) expires() time.Time {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return s.webSession.GetBearerTokenExpiryTime()
+}
+
+func (s *webSession) getCookieJar() http.CookieJar {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return s.clt.HTTPClient().Jar
+}
+
+func (s *webSession) getToken() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return s.webSession.GetBearerToken()
+}
diff --git a/lib/cache/cache.go b/lib/cache/cache.go
index db55053b46e16..8cfed890fbe8f 100644
--- a/lib/cache/cache.go
+++ b/lib/cache/cache.go
@@ -113,6 +113,7 @@ func ForAuth(cfg Config) Config {
 		{Kind: types.KindOktaImportRule},
 		{Kind: types.KindOktaAssignment},
 		{Kind: types.KindIntegration},
+		{Kind: types.KindHeadlessAuthentication},
 	}
 	cfg.QueueSize = defaults.AuthQueueSize
 	// We don't want to enable partial health for auth cache because auth uses an event stream
@@ -467,6 +468,7 @@ type Cache struct {
 	userGroupsCache              services.UserGroups
 	oktaCache                    services.Okta
 	integrationsCache            services.Integrations
+	headlessAuthenticationsCache services.HeadlessAuthenticationService
 	eventsFanout                 *services.FanoutSet
 
 	// closed indicates that the cache has been closed
@@ -817,6 +819,7 @@ func New(config Config) (*Cache, error) {
 		userGroupsCache:              userGroupsCache,
 		oktaCache:                    oktaCache,
 		integrationsCache:            integrationsCache,
+		headlessAuthenticationsCache: local.NewIdentityService(config.Backend),
 		eventsFanout:                 services.NewFanoutSet(),
 		Logger: log.WithFields(log.Fields{
 			trace.Component: config.Component,
diff --git a/lib/cache/cache_test.go b/lib/cache/cache_test.go
index cf52d8eccc163..c384f49b8ac37 100644
--- a/lib/cache/cache_test.go
+++ b/lib/cache/cache_test.go
@@ -1530,14 +1530,14 @@ func TestProxies(t *testing.T) {
 		newResource: func(name string) (types.Server, error) {
 			return suite.NewServer(types.KindProxy, name, "127.0.0.1:2022", apidefaults.Namespace), nil
 		},
-		create: modifyNoContext(p.presenceS.UpsertProxy),
+		create: p.presenceS.UpsertProxy,
 		list: func(_ context.Context) ([]types.Server, error) {
 			return p.presenceS.GetProxies()
 		},
 		cacheList: func(_ context.Context) ([]types.Server, error) {
 			return p.cache.GetProxies()
 		},
-		update: modifyNoContext(p.presenceS.UpsertProxy),
+		update: p.presenceS.UpsertProxy,
 		deleteAll: func(_ context.Context) error {
 			return p.presenceS.DeleteAllProxies()
 		},
@@ -1555,14 +1555,14 @@ func TestAuthServers(t *testing.T) {
 		newResource: func(name string) (types.Server, error) {
 			return suite.NewServer(types.KindAuthServer, name, "127.0.0.1:2022", apidefaults.Namespace), nil
 		},
-		create: modifyNoContext(p.presenceS.UpsertAuthServer),
+		create: p.presenceS.UpsertAuthServer,
 		list: func(_ context.Context) ([]types.Server, error) {
 			return p.presenceS.GetAuthServers()
 		},
 		cacheList: func(_ context.Context) ([]types.Server, error) {
 			return p.cache.GetAuthServers()
 		},
-		update: modifyNoContext(p.presenceS.UpsertAuthServer),
+		update: p.presenceS.UpsertAuthServer,
 		deleteAll: func(_ context.Context) error {
 			return p.presenceS.DeleteAllAuthServers()
 		},
@@ -1848,7 +1848,7 @@ func TestUserGroups(t *testing.T) {
 			return types.NewUserGroup(
 				types.Metadata{
 					Name: name,
-				},
+				}, types.UserGroupSpecV1{},
 			)
 		},
 		create: p.userGroups.CreateUserGroup,
@@ -2514,6 +2514,7 @@ func TestCacheWatchKindExistsInEvents(t *testing.T) {
 		types.KindOktaImportRule:          &types.OktaImportRuleV1{},
 		types.KindOktaAssignment:          &types.OktaAssignmentV1{},
 		types.KindIntegration:             &types.IntegrationV1{},
+		types.KindHeadlessAuthentication:  &types.HeadlessAuthentication{},
 	}
 
 	for name, cfg := range cases {
@@ -2616,6 +2617,106 @@ func TestPartialHealth(t *testing.T) {
 	}
 }
 
+// TestInvalidDatbases given a database that returns an error on validation, the
+// cache should not be impacted, and the database must be on it. This scenario
+// is most common on Teleport upgrades/downgrades where the database validation
+// can have new rules, causing the existing database to fail on validation.
+func TestInvalidDatabases(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	generateInvalidDB := func(t *testing.T, resourceID int64, name string) types.Database {
+		db := &types.DatabaseV3{Metadata: types.Metadata{
+			ID:   resourceID,
+			Name: name,
+		}, Spec: types.DatabaseSpecV3{
+			Protocol: "invalid-protocol",
+			URI:      "non-empty-uri",
+		}}
+		// Just ensures the database we're using on this test will trigger a
+		// validation failure.
+		require.Error(t, services.ValidateDatabase(db))
+		return db
+	}
+
+	for name, tc := range map[string]struct {
+		storeFunc func(*testing.T, *backend.Wrapper, *Cache)
+	}{
+		"CreateDatabase": {
+			storeFunc: func(t *testing.T, b *backend.Wrapper, _ *Cache) {
+				db := generateInvalidDB(t, 0, "invalid-db")
+				value, err := services.MarshalDatabase(db)
+				require.NoError(t, err)
+				_, err = b.Create(ctx, backend.Item{
+					Key:     backend.Key("db", db.GetName()),
+					Value:   value,
+					Expires: db.Expiry(),
+					ID:      db.GetResourceID(),
+				})
+				require.NoError(t, err)
+			},
+		},
+		"UpdateDatabase": {
+			storeFunc: func(t *testing.T, b *backend.Wrapper, c *Cache) {
+				dbName := "updated-db"
+				validDB, err := types.NewDatabaseV3(types.Metadata{
+					Name: dbName,
+				}, types.DatabaseSpecV3{
+					Protocol: defaults.ProtocolPostgres,
+					URI:      "postgres://localhost",
+				})
+				require.NoError(t, err)
+				require.NoError(t, services.ValidateDatabase(validDB))
+
+				marshalledDB, err := services.MarshalDatabase(validDB)
+				require.NoError(t, err)
+				_, err = b.Create(ctx, backend.Item{
+					Key:     backend.Key("db", validDB.GetName()),
+					Value:   marshalledDB,
+					Expires: validDB.Expiry(),
+					ID:      validDB.GetResourceID(),
+				})
+				require.NoError(t, err)
+
+				// Wait until the database appear on cache.
+				require.Eventually(t, func() bool {
+					if dbs, err := c.GetDatabases(ctx); err == nil {
+						return len(dbs) == 1
+					}
+
+					return false
+				}, time.Second, 100*time.Millisecond, "expected database to be on cache, but nothing found")
+
+				cacheDB, err := c.GetDatabase(ctx, dbName)
+				require.NoError(t, err)
+
+				invalidDB := generateInvalidDB(t, cacheDB.GetResourceID(), cacheDB.GetName())
+				value, err := services.MarshalDatabase(invalidDB)
+				require.NoError(t, err)
+				_, err = b.Update(ctx, backend.Item{
+					Key:     backend.Key("db", cacheDB.GetName()),
+					Value:   value,
+					Expires: invalidDB.Expiry(),
+					ID:      cacheDB.GetResourceID(),
+				})
+				require.NoError(t, err)
+			},
+		},
+	} {
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			p := newTestPack(t, ForAuth)
+			t.Cleanup(p.Close)
+
+			tc.storeFunc(t, p.backend, p.cache)
+
+			// Events processing should not restart due to an invalid database error.
+			unexpectedEvent(t, p.eventsC, Reloading)
+		})
+	}
+}
+
 func withKeepalive[T any](fn func(context.Context, T) (*types.KeepAlive, error)) func(context.Context, T) error {
 	return func(ctx context.Context, resource T) error {
 		_, err := fn(ctx, resource)
diff --git a/lib/cache/collections.go b/lib/cache/collections.go
index 2af5e010676c3..57808a5558bd7 100644
--- a/lib/cache/collections.go
+++ b/lib/cache/collections.go
@@ -72,6 +72,9 @@ type executor[T types.Resource, R any] interface {
 	getReader(c *Cache, cacheOK bool) R
 }
 
+// noReader is returned by getReader for resources which aren't directly used by the cache, and therefore have no associated reader.
+type noReader struct{}
+
 // genericCollection is a generic collection implementation for resource type T with collection-specific logic
 // encapsulated in executor type E. Type R provides getter methods related to the collection, e.g. GetNodes(),
 // GetRoles().
@@ -395,8 +398,7 @@ func setupCollections(c *Cache, watches []types.WatchKind) (*cacheCollections, e
 			if c.DynamicAccess == nil {
 				return nil, trace.BadParameter("missing parameter DynamicAccess")
 			}
-			// access request resources aren't directly used by Cache so there's no associated reader type
-			collections.byKind[resourceKind] = &genericCollection[types.AccessRequest, any, accessRequestExecutor]{cache: c, watch: watch}
+			collections.byKind[resourceKind] = &genericCollection[types.AccessRequest, noReader, accessRequestExecutor]{cache: c, watch: watch}
 		case types.KindAppServer:
 			if c.Presence == nil {
 				return nil, trace.BadParameter("missing parameter Presence")
@@ -479,8 +481,7 @@ func setupCollections(c *Cache, watches []types.WatchKind) (*cacheCollections, e
 			if c.Presence == nil {
 				return nil, trace.BadParameter("missing parameter Presence")
 			}
-			// database service resources aren't directly used by Cache so there's no associated reader type
-			collections.byKind[resourceKind] = &genericCollection[types.DatabaseService, any, databaseServiceExecutor]{cache: c, watch: watch}
+			collections.byKind[resourceKind] = &genericCollection[types.DatabaseService, noReader, databaseServiceExecutor]{cache: c, watch: watch}
 		case types.KindApp:
 			if c.Apps == nil {
 				return nil, trace.BadParameter("missing parameter Apps")
@@ -589,6 +590,8 @@ func setupCollections(c *Cache, watches []types.WatchKind) (*cacheCollections, e
 				watch: watch,
 			}
 			collections.byKind[resourceKind] = collections.integrations
+		case types.KindHeadlessAuthentication:
+			collections.byKind[resourceKind] = &genericCollection[*types.HeadlessAuthentication, noReader, headlessAuthenticationServiceExecutor]{cache: c, watch: watch}
 		default:
 			return nil, trace.BadParameter("resource %q is not supported", watch.Kind)
 		}
@@ -658,12 +661,11 @@ func (accessRequestExecutor) delete(ctx context.Context, cache *Cache, resource
 
 func (accessRequestExecutor) isSingleton() bool { return false }
 
-func (accessRequestExecutor) getReader(_ *Cache, _ bool) any {
-	// access request resources aren't directly used by Cache so there's no associated reader type
-	return nil
+func (accessRequestExecutor) getReader(_ *Cache, _ bool) noReader {
+	return noReader{}
 }
 
-var _ executor[types.AccessRequest, any] = accessRequestExecutor{}
+var _ executor[types.AccessRequest, noReader] = accessRequestExecutor{}
 
 type tunnelConnectionExecutor struct{}
 
@@ -780,7 +782,7 @@ func (proxyExecutor) getAll(ctx context.Context, cache *Cache, loadSecrets bool)
 }
 
 func (proxyExecutor) upsert(ctx context.Context, cache *Cache, resource types.Server) error {
-	return cache.presenceCache.UpsertProxy(resource)
+	return cache.presenceCache.UpsertProxy(ctx, resource)
 }
 
 func (proxyExecutor) deleteAll(ctx context.Context, cache *Cache) error {
@@ -788,7 +790,7 @@ func (proxyExecutor) deleteAll(ctx context.Context, cache *Cache) error {
 }
 
 func (proxyExecutor) delete(ctx context.Context, cache *Cache, resource types.Resource) error {
-	return cache.presenceCache.DeleteProxy(resource.GetName())
+	return cache.presenceCache.DeleteProxy(ctx, resource.GetName())
 }
 
 func (proxyExecutor) isSingleton() bool { return false }
@@ -809,7 +811,7 @@ func (authServerExecutor) getAll(ctx context.Context, cache *Cache, loadSecrets
 }
 
 func (authServerExecutor) upsert(ctx context.Context, cache *Cache, resource types.Server) error {
-	return cache.presenceCache.UpsertAuthServer(resource)
+	return cache.presenceCache.UpsertAuthServer(ctx, resource)
 }
 
 func (authServerExecutor) deleteAll(ctx context.Context, cache *Cache) error {
@@ -1231,12 +1233,11 @@ func (databaseServiceExecutor) delete(ctx context.Context, cache *Cache, resourc
 
 func (databaseServiceExecutor) isSingleton() bool { return false }
 
-func (databaseServiceExecutor) getReader(_ *Cache, _ bool) any {
-	// database service resources aren't directly used by Cache so there's no associated reader
-	return nil
+func (databaseServiceExecutor) getReader(_ *Cache, _ bool) noReader {
+	return noReader{}
 }
 
-var _ executor[types.DatabaseService, any] = databaseServiceExecutor{}
+var _ executor[types.DatabaseService, noReader] = databaseServiceExecutor{}
 
 type databaseExecutor struct{}
 
@@ -2299,3 +2300,33 @@ func (integrationsExecutor) getReader(cache *Cache, cacheOK bool) services.Integ
 }
 
 var _ executor[types.Integration, services.IntegrationsGetter] = integrationsExecutor{}
+
+type headlessAuthenticationServiceExecutor struct{}
+
+func (headlessAuthenticationServiceExecutor) getAll(ctx context.Context, cache *Cache, loadSecrets bool) ([]*types.HeadlessAuthentication, error) {
+	return cache.headlessAuthenticationsCache.GetHeadlessAuthentications(ctx)
+}
+
+func (headlessAuthenticationServiceExecutor) upsert(ctx context.Context, cache *Cache, resource *types.HeadlessAuthentication) error {
+	return cache.headlessAuthenticationsCache.UpsertHeadlessAuthentication(ctx, resource)
+}
+
+func (headlessAuthenticationServiceExecutor) deleteAll(ctx context.Context, cache *Cache) error {
+	return cache.headlessAuthenticationsCache.DeleteAllHeadlessAuthentications(ctx)
+}
+
+func (headlessAuthenticationServiceExecutor) delete(ctx context.Context, cache *Cache, resource types.Resource) error {
+	ha, ok := resource.(*types.HeadlessAuthentication)
+	if !ok {
+		return trace.BadParameter("unexpected type %T", resource)
+	}
+	return cache.headlessAuthenticationsCache.DeleteHeadlessAuthentication(ctx, ha.User, resource.GetName())
+}
+
+func (headlessAuthenticationServiceExecutor) isSingleton() bool { return false }
+
+func (headlessAuthenticationServiceExecutor) getReader(_ *Cache, _ bool) noReader {
+	return noReader{}
+}
+
+var _ executor[*types.HeadlessAuthentication, noReader] = headlessAuthenticationServiceExecutor{}
diff --git a/lib/client/api.go b/lib/client/api.go
index 4f4efe253d71f..bc96f9b303517 100644
--- a/lib/client/api.go
+++ b/lib/client/api.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
-	"encoding/json"
 	"encoding/pem"
 	"errors"
 	"fmt"
@@ -430,6 +429,21 @@ type Config struct {
 
 	// PROXYSigner is used to sign PROXY headers for securely propagating client IP address
 	PROXYSigner multiplexer.PROXYHeaderSigner
+
+	// DTAuthnRunCeremony allows tests to override the default device
+	// authentication function.
+	// Defaults to [dtauthn.NewCeremony().Run].
+	DTAuthnRunCeremony DTAuthnRunCeremonyFunc
+
+	// dtAttemptLoginIgnorePing and dtAutoEnrollIgnorePing allow Device Trust
+	// tests to ignore Ping responses.
+	// Useful to force flows that only typically happen on Teleport Enterprise.
+	dtAttemptLoginIgnorePing, dtAutoEnrollIgnorePing bool
+
+	// dtAutoEnroll allows tests to override the default device auto-enroll
+	// function.
+	// Defaults to [dtenroll.AutoEnroll].
+	dtAutoEnroll dtAutoEnrollFunc
 }
 
 // CachePolicy defines cache policy for local clients
@@ -565,12 +579,18 @@ func RetryWithRelogin(ctx context.Context, tc *TeleportClient, fn func() error)
 		}
 		return trace.Wrap(err)
 	}
-	if err := tc.ActivateKey(ctx, key); err != nil {
+
+	proxyClient, rootAuthClient, err := tc.ConnectToRootCluster(ctx, key)
+	if err != nil {
 		return trace.Wrap(err)
 	}
+	defer func() {
+		rootAuthClient.Close()
+		proxyClient.Close()
+	}()
 
 	// Attempt device login. This activates a fresh key if successful.
-	if err := tc.AttemptDeviceLogin(ctx, key); err != nil {
+	if err := tc.AttemptDeviceLogin(ctx, key, rootAuthClient); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -586,7 +606,8 @@ func RetryWithRelogin(ctx context.Context, tc *TeleportClient, fn func() error)
 func IsErrorResolvableWithRelogin(err error) bool {
 	// Assume that failed handshake is a result of expired credentials.
 	return utils.IsHandshakeFailedError(err) || utils.IsCertExpiredError(err) ||
-		trace.IsBadParameter(err) || trace.IsTrustError(err) || keys.IsPrivateKeyPolicyError(err) || trace.IsNotFound(err)
+		trace.IsBadParameter(err) || trace.IsTrustError(err) ||
+		keys.IsPrivateKeyPolicyError(err) || IsNoCredentialsError(err)
 }
 
 // GetProfile gets the profile for the specified proxy address, or
@@ -660,7 +681,15 @@ func (c *Config) SaveProfile(makeCurrent bool) error {
 		return nil
 	}
 
-	p := &profile.Profile{
+	if err := c.ClientStore.SaveProfile(c.Profile(), makeCurrent); err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
+}
+
+// Profile converts Config to *profile.Profile.
+func (c *Config) Profile() *profile.Profile {
+	return &profile.Profile{
 		Username:                      c.Username,
 		WebProxyAddr:                  c.WebProxyAddr,
 		SSHProxyAddr:                  c.SSHProxyAddr,
@@ -676,11 +705,6 @@ func (c *Config) SaveProfile(makeCurrent bool) error {
 		LoadAllCAs:                    c.LoadAllCAs,
 		PrivateKeyPolicy:              c.PrivateKeyPolicy,
 	}
-
-	if err := c.ClientStore.SaveProfile(p, makeCurrent); err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
 }
 
 // ParsedProxyHost holds the hostname and Web & SSH proxy addresses
@@ -942,8 +966,8 @@ func (c *Config) ResourceFilter(kind string) *proto.ListResourcesRequest {
 	}
 }
 
-// dtAuthnRunCeremonyFunc matches the signature of [dtauthn.RunCeremony].
-type dtAuthnRunCeremonyFunc func(context.Context, devicepb.DeviceTrustServiceClient, *devicepb.UserCertificates) (*devicepb.UserCertificates, error)
+// DTAuthnRunCeremonyFunc matches the signature of [dtauthn.RunCeremony].
+type DTAuthnRunCeremonyFunc func(context.Context, devicepb.DeviceTrustServiceClient, *devicepb.UserCertificates) (*devicepb.UserCertificates, error)
 
 // dtAutoEnrollFunc matches the signature of [dtenroll.AutoEnroll].
 type dtAutoEnrollFunc func(context.Context, devicepb.DeviceTrustServiceClient) (*devicepb.Device, error)
@@ -966,21 +990,6 @@ type TeleportClient struct {
 	// Note: there's no mutex guarding this or localAgent, making
 	// TeleportClient NOT safe for concurrent use.
 	lastPing *webclient.PingResponse
-
-	// dtAttemptLoginIgnorePing and dtAutoEnrollIgnorePing allow Device Trust
-	// tests to ignore Ping responses.
-	// Useful to force flows that only typically happen on Teleport Enterprise.
-	dtAttemptLoginIgnorePing, dtAutoEnrollIgnorePing bool
-
-	// dtAuthnRunCeremony allows tests to override the default device
-	// authentication function.
-	// Defaults to [dtauthn.NewCeremony().Run].
-	dtAuthnRunCeremony dtAuthnRunCeremonyFunc
-
-	// dtAutoEnroll allows tests to override the default device auto-enroll
-	// function.
-	// Defaults to [dtenroll.AutoEnroll].
-	dtAutoEnroll dtAutoEnrollFunc
 }
 
 // ShellCreatedCallback can be supplied for every teleport client. It will
@@ -1013,9 +1022,7 @@ func NewClient(c *Config) (tc *TeleportClient, err error) {
 		}
 		log.Infof("no host login given. defaulting to %s", c.HostLogin)
 	}
-	if c.KeyTTL == 0 {
-		c.KeyTTL = apidefaults.CertDuration
-	}
+
 	c.Namespace = types.ProcessNamespace(c.Namespace)
 
 	if c.Tracer == nil {
@@ -1779,7 +1786,7 @@ func (tc *TeleportClient) runShellOrCommandOnSingleNode(ctx context.Context, clt
 		// Reuse the existing nodeClient we connected above.
 		return nodeClient.RunCommand(ctx, command)
 	}
-	return tc.runShell(ctx, nodeClient, types.SessionPeerMode, nil, nil)
+	return trace.Wrap(nodeClient.RunInteractiveShell(ctx, types.SessionPeerMode, nil, nil))
 }
 
 func (tc *TeleportClient) runShellOrCommandOnMultipleNodes(ctx context.Context, clt *ClusterClient, nodeAddrs []string, command []string) error {
@@ -1902,7 +1909,12 @@ func (tc *TeleportClient) Join(ctx context.Context, mode types.SessionParticipan
 	if mode == types.SessionModeratorMode {
 		beforeStart = func(out io.Writer) {
 			nc.OnMFA = func() {
-				runPresenceTask(presenceCtx, out, clt.AuthClient, tc, session.GetSessionID())
+				RunPresenceTask(presenceCtx, out, clt.AuthClient, session.GetSessionID(), func(ctx context.Context, proxyAddr string, c *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
+					resp, err := tc.PromptMFAChallenge(ctx, proxyAddr, c, func(opts *PromptMFAChallengeOpts) {
+						opts.Quiet = true
+					})
+					return resp, trace.Wrap(err)
+				})
 			}
 		}
 	}
@@ -1910,7 +1922,7 @@ func (tc *TeleportClient) Join(ctx context.Context, mode types.SessionParticipan
 	fmt.Printf("Joining session with participant mode: %v. \n\n", mode)
 
 	// running shell with a given session means "join" it:
-	err = tc.runShell(ctx, nc, mode, session, beforeStart)
+	err = nc.RunInteractiveShell(ctx, mode, session, beforeStart)
 	return trace.Wrap(err)
 }
 
@@ -2665,7 +2677,7 @@ func (tc *TeleportClient) runCommandOnNodes(ctx context.Context, clt *ClusterCli
 
 func (tc *TeleportClient) newSessionEnv() map[string]string {
 	env := map[string]string{
-		teleport.SSHSessionWebproxyAddr: tc.WebProxyAddr,
+		teleport.SSHSessionWebProxyAddr: tc.WebProxyAddr,
 	}
 	if tc.SessionID != "" {
 		env[sshutils.SessionEnvVar] = tc.SessionID
@@ -2677,49 +2689,6 @@ func (tc *TeleportClient) newSessionEnv() map[string]string {
 	return env
 }
 
-// runShell starts an interactive SSH session/shell.
-// sessionID : when empty, creates a new shell. otherwise it tries to join the existing session.
-func (tc *TeleportClient) runShell(ctx context.Context, nodeClient *NodeClient, mode types.SessionParticipantMode, sessToJoin types.SessionTracker, beforeStart func(io.Writer)) error {
-	ctx, span := tc.Tracer.Start(
-		ctx,
-		"teleportClient/runShell",
-		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
-	)
-	defer span.End()
-
-	env := tc.newSessionEnv()
-	env[teleport.EnvSSHJoinMode] = string(mode)
-	env[teleport.EnvSSHSessionReason] = tc.Config.Reason
-	env[teleport.EnvSSHSessionDisplayParticipantRequirements] = strconv.FormatBool(tc.Config.DisplayParticipantRequirements)
-
-	encoded, err := json.Marshal(&tc.Config.Invited)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	env[teleport.EnvSSHSessionInvited] = string(encoded)
-
-	nodeSession, err := newSession(ctx, nodeClient, sessToJoin, env, tc.Stdin, tc.Stdout, tc.Stderr, tc.EnableEscapeSequences)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	if err = nodeSession.runShell(ctx, mode, beforeStart, tc.OnShellCreated); err != nil {
-		switch e := trace.Unwrap(err).(type) {
-		case *ssh.ExitError:
-			tc.ExitStatus = e.ExitStatus()
-		case *ssh.ExitMissingError:
-			tc.ExitStatus = 1
-		}
-
-		return trace.Wrap(err)
-	}
-	if nodeSession.ExitMsg == "" {
-		fmt.Fprintln(tc.Stderr, "the connection was closed on the remote side on ", time.Now().Format(time.RFC822))
-	} else {
-		fmt.Fprintln(tc.Stderr, nodeSession.ExitMsg)
-	}
-	return nil
-}
-
 // getProxyLogin determines which SSH principal to use when connecting to proxy.
 func (tc *TeleportClient) getProxySSHPrincipal() string {
 	if tc.ProxySSHPrincipal != "" {
@@ -3179,15 +3148,11 @@ func (g *proxyClusterGuesser) authMethod(ctx context.Context) ssh.AuthMethod {
 // profile.
 func (tc *TeleportClient) WithoutJumpHosts(fn func(tcNoJump *TeleportClient) error) error {
 	tcNoJump := &TeleportClient{
-		Config:                   tc.Config,
-		localAgent:               tc.localAgent,
-		OnShellCreated:           tc.OnShellCreated,
-		eventsCh:                 make(chan events.EventFields, 1024),
-		lastPing:                 tc.lastPing,
-		dtAttemptLoginIgnorePing: tc.dtAttemptLoginIgnorePing,
-		dtAutoEnrollIgnorePing:   tc.dtAutoEnrollIgnorePing,
-		dtAuthnRunCeremony:       tc.dtAuthnRunCeremony,
-		dtAutoEnroll:             tc.dtAutoEnroll,
+		Config:         tc.Config,
+		localAgent:     tc.localAgent,
+		OnShellCreated: tc.OnShellCreated,
+		eventsCh:       make(chan events.EventFields, 1024),
+		lastPing:       tc.lastPing,
 	}
 	tcNoJump.JumpHosts = nil
 
@@ -3284,8 +3249,9 @@ func (tc *TeleportClient) GetWebConfig(ctx context.Context) (*webclient.WebConfi
 
 // Login logs the user into a Teleport cluster by talking to a Teleport proxy.
 //
-// The returned Key should typically be passed to ActivateKey in order to
-// update local agent state.
+// The returned Key should typically be passed to ConnectToRootCluster in order to
+//
+//	update the local agent state and create an initial connection to the cluster.
 //
 // If the initial login fails due to a private key policy not being met, Login
 // will automatically retry login with a private key that meets the required policy.
@@ -3306,7 +3272,15 @@ func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
 	}
 
 	// Perform the ALPN test once at login.
-	tc.TLSRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(tc.WebProxyAddr, tc.InsecureSkipVerify)
+	tc.TLSRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, tc.WebProxyAddr, tc.InsecureSkipVerify)
+
+	if tc.KeyTTL == 0 {
+		tc.KeyTTL = time.Duration(pr.Auth.DefaultSessionTTL)
+	}
+	// todo(lxea): DELETE IN v15(?) where the auth is guaranteed to send us a valid MaxSessionTTL or the auth is guaranteed to interpret 0 duration as the auth's default?
+	if tc.KeyTTL == 0 {
+		tc.KeyTTL = apidefaults.CertDuration
+	}
 
 	// Get the SSHLoginFunc that matches client and cluster settings.
 	sshLoginFunc, err := tc.getSSHLoginFunc(pr)
@@ -3330,19 +3304,54 @@ func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
 	return key, nil
 }
 
+// LoginWeb logs the user in via the Teleport web api the same way that the web UI does.
+func (tc *TeleportClient) LoginWeb(ctx context.Context) (*WebClient, types.WebSession, error) {
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/LoginWeb",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
+	// Ping the endpoint to see if it's up and find the type of authentication
+	// supported, also show the message of the day if available.
+	pr, err := tc.Ping(ctx)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	// Perform the ALPN test once at login.
+	tc.TLSRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, tc.WebProxyAddr, tc.InsecureSkipVerify)
+
+	// Get the SSHLoginFunc that matches client and cluster settings.
+	webLoginFunc, err := tc.getWebLoginFunc(pr)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	clt, session, err := tc.webLogin(ctx, webLoginFunc)
+	return clt, session, trace.Wrap(err)
+}
+
 // AttemptDeviceLogin attempts device authentication for the current device.
 // It expects to receive the latest activated key, as acquired via
 // [TeleportClient.Login], and augments the certificates within the key with
 // device extensions.
 //
-// If successful, the new device certificates are automatically activated (using
-// [TeleportClient.ActivateKey].)
+// If successful, the new device certificates are automatically activated.
 //
 // A nil response from this method doesn't mean that device authentication was
 // successful, as skipping the ceremony is valid for various reasons (Teleport
 // cluster doesn't support device authn, device wasn't enrolled, etc).
 // Use [TeleportClient.DeviceLogin] if you want more control over process.
-func (tc *TeleportClient) AttemptDeviceLogin(ctx context.Context, key *Key) error {
+func (tc *TeleportClient) AttemptDeviceLogin(ctx context.Context, key *Key, rootAuthClient auth.ClientI) error {
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/AttemptDeviceLogin",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
 	pingResp, err := tc.Ping(ctx)
 	if err != nil {
 		return trace.Wrap(err)
@@ -3353,11 +3362,14 @@ func (tc *TeleportClient) AttemptDeviceLogin(ctx context.Context, key *Key) erro
 		return nil
 	}
 
-	newCerts, err := tc.DeviceLogin(ctx, &devicepb.UserCertificates{
-		// Augment the SSH certificate.
-		// The TLS certificate is already part of the connection.
-		SshAuthorizedKey: key.Cert,
-	})
+	newCerts, err := tc.DeviceLogin(
+		ctx,
+		rootAuthClient,
+		&devicepb.UserCertificates{
+			// Augment the SSH certificate.
+			// The TLS certificate is already part of the connection.
+			SshAuthorizedKey: key.Cert,
+		})
 	switch {
 	case errors.Is(err, devicetrust.ErrDeviceKeyNotFound):
 		log.Debug("Device Trust: Skipping device authentication, device key not found")
@@ -3380,7 +3392,16 @@ func (tc *TeleportClient) AttemptDeviceLogin(ctx context.Context, key *Key) erro
 		Type:  "CERTIFICATE",
 		Bytes: newCerts.X509Der,
 	})
-	return trace.Wrap(tc.ActivateKey(ctx, &cp))
+
+	// Get the list of host certificates that this cluster knows about.
+	hostCerts, err := rootAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	trustedCerts := auth.AuthoritiesToTrustedCerts(hostCerts)
+
+	// Update the CA pool and known hosts for all CAs the cluster knows about.
+	return trace.Wrap(tc.localAgent.SaveTrustedCerts(trustedCerts))
 }
 
 // DeviceLogin attempts to authenticate the current device with Teleport.
@@ -3396,27 +3417,22 @@ func (tc *TeleportClient) AttemptDeviceLogin(ctx context.Context, key *Key) erro
 // `tsh login`).
 //
 // Device Trust is a Teleport Enterprise feature.
-func (tc *TeleportClient) DeviceLogin(ctx context.Context, certs *devicepb.UserCertificates) (*devicepb.UserCertificates, error) {
-	proxyClient, err := tc.ConnectToProxy(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	defer proxyClient.Close()
-
-	authClient, err := proxyClient.ConnectToRootCluster(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	defer authClient.Close()
+func (tc *TeleportClient) DeviceLogin(ctx context.Context, rootAuthClient auth.ClientI, certs *devicepb.UserCertificates) (*devicepb.UserCertificates, error) {
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/DeviceLogin",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
 
 	// Allow tests to override the default authn function.
-	runCeremony := tc.dtAuthnRunCeremony
+	runCeremony := tc.DTAuthnRunCeremony
 	if runCeremony == nil {
 		runCeremony = dtauthn.NewCeremony().Run
 	}
 
 	// Login without a previous auto-enroll attempt.
-	devicesClient := authClient.DevicesClient()
+	devicesClient := rootAuthClient.DevicesClient()
 	newCerts, loginErr := runCeremony(ctx, devicesClient, certs)
 	// Success or auto-enroll impossible.
 	if loginErr == nil || errors.Is(loginErr, devicetrust.ErrPlatformNotSupported) || trace.IsNotImplemented(loginErr) {
@@ -3506,6 +3522,139 @@ func (tc *TeleportClient) getSSHLoginFunc(pr *webclient.PingResponse) (SSHLoginF
 	}
 }
 
+// getWebLoginFunc returns an WebLoginFunc that matches client and cluster settings.
+func (tc *TeleportClient) getWebLoginFunc(pr *webclient.PingResponse) (WebLoginFunc, error) {
+	switch pr.Auth.Type {
+	case constants.Local:
+		switch pr.Auth.Local.Name {
+		case constants.PasswordlessConnector:
+			// Sanity check settings.
+			if !pr.Auth.AllowPasswordless {
+				return nil, trace.BadParameter("passwordless disallowed by cluster settings")
+			}
+			return tc.pwdlessLoginWeb, nil
+		case constants.HeadlessConnector:
+			return nil, trace.BadParameter("headless logins not allowed for web sessions")
+		case constants.LocalConnector, "":
+			// if passwordless is enabled and there are passwordless credentials
+			// registered, we can try to go with passwordless login even though
+			// auth=local was selected.
+			if tc.canDefaultToPasswordless(pr) {
+				log.Debug("Trying passwordless login because credentials were found")
+				return tc.pwdlessLoginWeb, nil
+			}
+
+			return func(ctx context.Context, priv *keys.PrivateKey) (*WebClient, types.WebSession, error) {
+				return tc.localLoginWeb(ctx, priv, pr.Auth.SecondFactor)
+			}, nil
+		default:
+			return nil, trace.BadParameter("unsupported authentication connector type: %q", pr.Auth.Local.Name)
+		}
+	case constants.OIDC:
+		return nil, trace.NotImplemented("SSO login not supported")
+	case constants.SAML:
+		return nil, trace.NotImplemented("SSO login not supported")
+	case constants.Github:
+		return nil, trace.NotImplemented("SSO login not supported")
+	default:
+		return nil, trace.BadParameter("unsupported authentication type: %q", pr.Auth.Type)
+	}
+}
+
+// pwdlessLoginWeb performs a passwordless ceremony and then makes a request to authenticate via the web api.
+func (tc *TeleportClient) pwdlessLoginWeb(ctx context.Context, priv *keys.PrivateKey) (*WebClient, types.WebSession, error) {
+	// Only pass on the user if explicitly set, otherwise let the credential
+	// picker kick in.
+	user := ""
+	if tc.ExplicitUsername {
+		user = tc.Username
+	}
+
+	sshLogin, err := tc.newSSHLogin(priv)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	clt, session, err := SSHAgentPasswordlessLoginWeb(ctx, SSHLoginPasswordless{
+		SSHLogin:                sshLogin,
+		User:                    user,
+		AuthenticatorAttachment: tc.AuthenticatorAttachment,
+		StderrOverride:          tc.Stderr,
+	})
+	return clt, session, trace.Wrap(err)
+}
+
+// localLoginWeb performs the mfa ceremony and then makes a request to authenticate via the web api.
+func (tc *TeleportClient) localLoginWeb(ctx context.Context, priv *keys.PrivateKey, secondFactor constants.SecondFactorType) (*WebClient, types.WebSession, error) {
+	// TODO(awly): mfa: ideally, clients should always go through mfaLocalLogin
+	// (with a nop MFA challenge if no 2nd factor is required). That way we can
+	// deprecate the direct login endpoint.
+	switch secondFactor {
+	case constants.SecondFactorOff, constants.SecondFactorOTP:
+		clt, session, err := tc.directLoginWeb(ctx, secondFactor, priv)
+		return clt, session, trace.Wrap(err)
+	case constants.SecondFactorU2F, constants.SecondFactorWebauthn, constants.SecondFactorOn, constants.SecondFactorOptional:
+		clt, session, err := tc.mfaLocalLoginWeb(ctx, priv)
+		return clt, session, trace.Wrap(err)
+	default:
+		return nil, nil, trace.BadParameter("unsupported second factor type: %q", secondFactor)
+	}
+}
+
+// directLoginWeb asks for a password + OTP token then makes a request to authenticate via the web api.
+func (tc *TeleportClient) directLoginWeb(ctx context.Context, secondFactorType constants.SecondFactorType, priv *keys.PrivateKey) (*WebClient, types.WebSession, error) {
+	password, err := tc.AskPassword(ctx)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	// Only ask for a second factor if it's enabled.
+	var otpToken string
+	if secondFactorType == constants.SecondFactorOTP {
+		otpToken, err = tc.AskOTP(ctx)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+	}
+
+	sshLogin, err := tc.newSSHLogin(priv)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	// authenticate via the web api
+	clt, session, err := SSHAgentLoginWeb(ctx, SSHLoginDirect{
+		SSHLogin: sshLogin,
+		User:     tc.Username,
+		Password: password,
+		OTPToken: otpToken,
+	})
+	return clt, session, trace.Wrap(err)
+}
+
+// mfaLocalLoginWeb asks for a password and performs the challenge-response authentication with the web api
+func (tc *TeleportClient) mfaLocalLoginWeb(ctx context.Context, priv *keys.PrivateKey) (*WebClient, types.WebSession, error) {
+	password, err := tc.AskPassword(ctx)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	sshLogin, err := tc.newSSHLogin(priv)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	clt, session, err := SSHAgentMFAWebSessionLogin(ctx, SSHLoginMFA{
+		SSHLogin:                sshLogin,
+		User:                    tc.Username,
+		Password:                password,
+		AuthenticatorAttachment: tc.AuthenticatorAttachment,
+		PreferOTP:               tc.PreferOTP,
+		AllowStdinHijack:        tc.AllowStdinHijack,
+	})
+	return clt, session, trace.Wrap(err)
+}
+
 // hasTouchIDCredentials provides indirection for tests.
 var hasTouchIDCredentials = touchid.HasCredentials
 
@@ -3540,6 +3689,13 @@ type SSHLoginFunc func(context.Context, *keys.PrivateKey) (*auth.SSHLoginRespons
 // SSHLogin uses the given login function to login the client. This function handles
 // private key logic and parsing the resulting auth response.
 func (tc *TeleportClient) SSHLogin(ctx context.Context, sshLoginFunc SSHLoginFunc) (*Key, error) {
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/SSHLogin",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
 	priv, err := tc.GetNewLoginKey(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -3599,8 +3755,47 @@ func (tc *TeleportClient) SSHLogin(ctx context.Context, sshLoginFunc SSHLoginFun
 	return key, nil
 }
 
+// WebLoginFunc is a function which carries out authn with the web server and returns a web session and cookies.
+type WebLoginFunc func(context.Context, *keys.PrivateKey) (*WebClient, types.WebSession, error)
+
+// webLogin uses the given login function to log the client in via the web api.
+func (tc *TeleportClient) webLogin(ctx context.Context, webLoginFunc WebLoginFunc) (*WebClient, types.WebSession, error) {
+	priv, err := tc.GetNewLoginKey(ctx)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	clt, session, err := webLoginFunc(ctx, priv)
+	if err != nil {
+		// check if the error is a private key policy error, and relogin if it is.
+		if privateKeyPolicy, parseErr := keys.ParsePrivateKeyPolicyError(err); parseErr == nil {
+			// The current private key was rejected due to an unmet key policy requirement.
+			fmt.Fprintf(tc.Stderr, "Unmet private key policy %q.\n", privateKeyPolicy)
+
+			// Set the private key policy to the expected value and re-login.
+			tc.PrivateKeyPolicy = privateKeyPolicy
+			priv, err = tc.GetNewLoginKey(ctx)
+			if err != nil {
+				return nil, nil, trace.Wrap(err)
+			}
+
+			fmt.Fprintf(tc.Stderr, "Re-initiating login with YubiKey generated private key.\n")
+			clt, session, err = webLoginFunc(ctx, priv)
+		}
+	}
+
+	return clt, session, trace.Wrap(err)
+}
+
 // GetNewLoginKey gets a new private key for login.
 func (tc *TeleportClient) GetNewLoginKey(ctx context.Context) (priv *keys.PrivateKey, err error) {
+	_, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/GetNewLoginKey",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
 	switch tc.PrivateKeyPolicy {
 	case keys.PrivateKeyPolicyHardwareKey:
 		log.Debugf("Attempting to login with YubiKey private key.")
@@ -3641,6 +3836,13 @@ func (tc *TeleportClient) newSSHLogin(priv *keys.PrivateKey) (SSHLogin, error) {
 }
 
 func (tc *TeleportClient) pwdlessLogin(ctx context.Context, priv *keys.PrivateKey) (*auth.SSHLoginResponse, error) {
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/pwdlessLogin",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
 	// Only pass on the user if explicitly set, otherwise let the credential
 	// picker kick in.
 	user := ""
@@ -3692,6 +3894,13 @@ func (tc *TeleportClient) localLogin(ctx context.Context, priv *keys.PrivateKey,
 
 // directLogin asks for a password + OTP token, makes a request to CA via proxy
 func (tc *TeleportClient) directLogin(ctx context.Context, secondFactorType constants.SecondFactorType, priv *keys.PrivateKey) (*auth.SSHLoginResponse, error) {
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/directLogin",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
 	password, err := tc.AskPassword(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -3724,6 +3933,13 @@ func (tc *TeleportClient) directLogin(ctx context.Context, secondFactorType cons
 
 // mfaLocalLogin asks for a password and performs the challenge-response authentication
 func (tc *TeleportClient) mfaLocalLogin(ctx context.Context, priv *keys.PrivateKey) (*auth.SSHLoginResponse, error) {
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/mfaLocalLogin",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
 	password, err := tc.AskPassword(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -3807,12 +4023,43 @@ func (tc *TeleportClient) ssoLogin(ctx context.Context, priv *keys.PrivateKey, c
 	return response, trace.Wrap(err)
 }
 
-// ActivateKey saves the target session cert into the local
-// keystore (and into the ssh-agent) for future use.
-func (tc *TeleportClient) ActivateKey(ctx context.Context, key *Key) error {
+// ConnectToRootCluster activates the provided key and connects to the
+// root cluster with its credentials.
+func (tc *TeleportClient) ConnectToRootCluster(ctx context.Context, key *Key) (*ProxyClient, auth.ClientI, error) {
 	ctx, span := tc.Tracer.Start(
 		ctx,
-		"teleportClient/ActivateKey",
+		"teleportClient/ConnectToRootCluster",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
+	if err := tc.activateKey(ctx, key); err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	proxyClient, err := tc.ConnectToProxy(ctx)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	rootAuthClient, err := proxyClient.ConnectToRootCluster(ctx)
+	if err != nil {
+		return nil, nil, trace.NewAggregate(err, proxyClient.Close())
+	}
+
+	if err := tc.UpdateTrustedCA(ctx, rootAuthClient); err != nil {
+		return nil, nil, trace.NewAggregate(err, rootAuthClient.Close(), proxyClient.Close())
+	}
+
+	return proxyClient, rootAuthClient, nil
+}
+
+// activateKey saves the target session cert into the local
+// keystore (and into the ssh-agent) for future use.
+func (tc *TeleportClient) activateKey(ctx context.Context, key *Key) error {
+	_, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/activateKey",
 		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
 	)
 	defer span.End()
@@ -3827,23 +4074,6 @@ func (tc *TeleportClient) ActivateKey(ctx context.Context, key *Key) error {
 		return trace.Wrap(err)
 	}
 
-	// Connect to the Auth Server of the root cluster and fetch the known hosts.
-	rootClusterName := key.TrustedCerts[0].ClusterName
-	if err := tc.UpdateTrustedCA(ctx, rootClusterName); err != nil {
-		if len(tc.JumpHosts) == 0 {
-			return trace.Wrap(err)
-		}
-		errViaJumphost := err
-		// If JumpHosts was pointing at the leaf cluster (e.g. during 'tsh ssh
-		// -J leaf.example.com'), this could've caused the above error. Try to
-		// fetch CAs without JumpHosts to force it to use the root cluster.
-		if err := tc.WithoutJumpHosts(func(tc *TeleportClient) error {
-			return tc.UpdateTrustedCA(ctx, rootClusterName)
-		}); err != nil {
-			return trace.NewAggregate(errViaJumphost, err)
-		}
-	}
-
 	return nil
 }
 
@@ -3979,20 +4209,19 @@ func (tc *TeleportClient) GetTrustedCA(ctx context.Context, clusterName string)
 
 // UpdateTrustedCA connects to the Auth Server and fetches all host certificates
 // and updates ~/.tsh/keys/proxy/certs.pem and ~/.tsh/known_hosts.
-func (tc *TeleportClient) UpdateTrustedCA(ctx context.Context, clusterName string) error {
+func (tc *TeleportClient) UpdateTrustedCA(ctx context.Context, getter services.AuthorityGetter) error {
 	ctx, span := tc.Tracer.Start(
 		ctx,
 		"teleportClient/UpdateTrustedCA",
 		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
-		oteltrace.WithAttributes(attribute.String("cluster", clusterName)),
 	)
 	defer span.End()
 
 	if tc.localAgent == nil {
-		return trace.BadParameter("TeleportClient.UpdateTrustedCA called on a client without localAgent")
+		return trace.BadParameter("UpdateTrustedCA called on a client without localAgent")
 	}
 	// Get the list of host certificates that this cluster knows about.
-	hostCerts, err := tc.GetTrustedCA(ctx, clusterName)
+	hostCerts, err := getter.GetCertAuthorities(ctx, types.HostCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -4296,6 +4525,13 @@ func Username() (string, error) {
 
 // AskOTP prompts the user to enter the OTP token.
 func (tc *TeleportClient) AskOTP(ctx context.Context) (token string, err error) {
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/AskOTP",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
 	stdin := prompt.Stdin()
 	if !stdin.IsTerminal() {
 		return "", trace.Wrap(prompt.ErrNotTerminal, "cannot perform OTP login without a terminal")
@@ -4305,6 +4541,13 @@ func (tc *TeleportClient) AskOTP(ctx context.Context) (token string, err error)
 
 // AskPassword prompts the user to enter the password
 func (tc *TeleportClient) AskPassword(ctx context.Context) (pwd string, err error) {
+	ctx, span := tc.Tracer.Start(
+		ctx,
+		"teleportClient/AskPassword",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
 	stdin := prompt.Stdin()
 	if !stdin.IsTerminal() {
 		return "", trace.Wrap(prompt.ErrNotTerminal, "cannot perform password login without a terminal")
@@ -4755,13 +4998,13 @@ func (tc *TeleportClient) NewKubernetesServiceClient(ctx context.Context, cluste
 // IsALPNConnUpgradeRequiredForWebProxy returns true if connection upgrade is
 // required for provided addr. The provided address must be a web proxy
 // address.
-func (tc *TeleportClient) IsALPNConnUpgradeRequiredForWebProxy(proxyAddr string) bool {
+func (tc *TeleportClient) IsALPNConnUpgradeRequiredForWebProxy(ctx context.Context, proxyAddr string) bool {
 	// Use cached value.
 	if proxyAddr == tc.WebProxyAddr {
 		return tc.TLSRoutingConnUpgradeRequired
 	}
 	// Do a test for other proxy addresses.
-	return client.IsALPNConnUpgradeRequired(proxyAddr, tc.InsecureSkipVerify)
+	return client.IsALPNConnUpgradeRequired(ctx, proxyAddr, tc.InsecureSkipVerify)
 }
 
 // RootClusterCACertPool returns a *x509.CertPool with the root cluster CA.
@@ -4788,7 +5031,7 @@ func (tc *TeleportClient) RootClusterCACertPool(ctx context.Context) (*x509.Cert
 }
 
 // HeadlessApprove handles approval of a headless authentication request.
-func (tc *TeleportClient) HeadlessApprove(ctx context.Context, headlessAuthenticationID string) error {
+func (tc *TeleportClient) HeadlessApprove(ctx context.Context, headlessAuthenticationID string, confirm bool) error {
 	ctx, span := tc.Tracer.Start(
 		ctx,
 		"teleportClient/HeadlessApprove",
@@ -4822,19 +5065,22 @@ func (tc *TeleportClient) HeadlessApprove(ctx context.Context, headlessAuthentic
 		return trace.Wrap(err)
 	}
 
-	if headlessAuthn.State != types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING {
+	if !headlessAuthn.State.IsPending() {
 		return trace.Errorf("cannot approve a headless authentication from a non-pending state: %v", headlessAuthn.State.Stringify())
 	}
 
-	confirmationPrompt := fmt.Sprintf("Headless login attempt from IP address %q requires approval.\nContact your administrator if you didn't initiate this login attempt.\nApprove?", headlessAuthn.ClientIpAddress)
-	ok, err := prompt.Confirmation(ctx, tc.Stdout, prompt.Stdin(), confirmationPrompt)
-	if err != nil {
-		return trace.Wrap(err)
-	}
+	fmt.Fprintf(tc.Stdout, "Headless login attempt from IP address %q requires approval.\nContact your administrator if you didn't initiate this login attempt.\n", headlessAuthn.ClientIpAddress)
 
-	if !ok {
-		err = rootClient.UpdateHeadlessAuthenticationState(ctx, headlessAuthenticationID, types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_DENIED, nil)
-		return trace.Wrap(err)
+	if confirm {
+		ok, err := prompt.Confirmation(ctx, tc.Stdout, prompt.Stdin(), "Approve?")
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if !ok {
+			err = rootClient.UpdateHeadlessAuthenticationState(ctx, headlessAuthenticationID, types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_DENIED, nil)
+			return trace.Wrap(err)
+		}
 	}
 
 	chall, err := rootClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
diff --git a/lib/client/api_login_test.go b/lib/client/api_login_test.go
index 326ee11bdb5ea..bfd2c4b005c72 100644
--- a/lib/client/api_login_test.go
+++ b/lib/client/api_login_test.go
@@ -443,9 +443,13 @@ func TestTeleportClient_DeviceLogin(t *testing.T) {
 	// Login the current user and fetch a valid pair of certificates.
 	key, err := teleportClient.Login(ctx)
 	require.NoError(t, err, "Login failed")
-	require.NoError(t,
-		teleportClient.ActivateKey(ctx, key),
-		"ActivateKey failed")
+
+	proxyClient, rootAuthClient, err := teleportClient.ConnectToRootCluster(ctx, key)
+	require.NoError(t, err, "Connecting to the root cluster failed")
+	t.Cleanup(func() {
+		require.NoError(t, rootAuthClient.Close())
+		require.NoError(t, proxyClient.Close())
+	})
 
 	// Prepare "device aware" certificates from key.
 	// In a real scenario these would be augmented certs.
@@ -487,16 +491,18 @@ func TestTeleportClient_DeviceLogin(t *testing.T) {
 		require.NoError(t, authenticatedAction(), "Authenticated action failed *before* AttemptDeviceLogin")
 
 		// Test! Exercise DeviceLogin.
-		got, err := teleportClient.DeviceLogin(ctx, &devicepb.UserCertificates{
-			SshAuthorizedKey: key.Cert,
-		})
+		got, err := teleportClient.DeviceLogin(ctx,
+			rootAuthClient,
+			&devicepb.UserCertificates{
+				SshAuthorizedKey: key.Cert,
+			})
 		require.NoError(t, err, "DeviceLogin failed")
 		require.Equal(t, validCerts, got, "DeviceLogin mismatch")
 		assert.Equal(t, 1, runCeremonyCalls, `DeviceLogin didn't call dtAuthnRunCeremony()`)
 
 		// Test! Exercise AttemptDeviceLogin.
 		require.NoError(t,
-			teleportClient.AttemptDeviceLogin(ctx, key),
+			teleportClient.AttemptDeviceLogin(ctx, key, rootAuthClient),
 			"AttemptDeviceLogin failed")
 		assert.Equal(t, 2, runCeremonyCalls, `AttemptDeviceLogin didn't call dtAuthnRunCeremony()`)
 
@@ -521,7 +527,7 @@ func TestTeleportClient_DeviceLogin(t *testing.T) {
 		// Test!
 		// AttemptDeviceLogin should obey Ping and not attempt the ceremony.
 		require.NoError(t,
-			teleportClient.AttemptDeviceLogin(ctx, key),
+			teleportClient.AttemptDeviceLogin(ctx, key, rootAuthClient),
 			"AttemptDeviceLogin failed")
 		assert.False(t, runCeremonyCalled, "AttemptDeviceLogin called DeviceLogin/dtAuthnRunCeremony, despite the Ping response")
 	})
@@ -550,10 +556,21 @@ func TestTeleportClient_DeviceLogin(t *testing.T) {
 			}, nil
 		})
 
+		proxyClient, err := teleportClient.ConnectToProxy(ctx)
+		require.NoError(t, err)
+		defer proxyClient.Close()
+
+		rootAuthClient, err := proxyClient.ConnectToRootCluster(ctx)
+		require.NoError(t, err)
+		defer rootAuthClient.Close()
+
 		// Test!
-		got, err := teleportClient.DeviceLogin(ctx, &devicepb.UserCertificates{
-			SshAuthorizedKey: key.Cert,
-		})
+		got, err := teleportClient.DeviceLogin(
+			ctx,
+			rootAuthClient,
+			&devicepb.UserCertificates{
+				SshAuthorizedKey: key.Cert,
+			})
 		require.NoError(t, err, "DeviceLogin failed")
 		assert.Equal(t, got, validCerts, "DeviceLogin mismatch")
 		assert.Equal(t, 2, runCeremonyCalls, "RunCeremony called an unexpected number of times")
diff --git a/lib/client/client.go b/lib/client/client.go
index c79560c4c461e..1821aaac99e4b 100644
--- a/lib/client/client.go
+++ b/lib/client/client.go
@@ -92,6 +92,11 @@ type NodeClient struct {
 
 	mu      sync.Mutex
 	closers []io.Closer
+
+	// ProxyPublicAddr is the web proxy public addr, as opposed to the local proxy
+	// addr set in TC.WebProxyAddr. This is needed to report the correct address
+	// to SSH_TELEPORT_WEBPROXY_ADDR used by some features like "teleport status".
+	ProxyPublicAddr string
 }
 
 // AddCloser adds an [io.Closer] that will be closed when the
@@ -1138,7 +1143,7 @@ func (proxy *ProxyClient) ConnectToAuthServiceThroughALPNSNIProxy(ctx context.Co
 		},
 		ALPNSNIAuthDialClusterName: clusterName,
 		CircuitBreakerConfig:       breaker.NoopBreakerConfig(),
-		ALPNConnUpgradeRequired:    proxy.teleportClient.IsALPNConnUpgradeRequiredForWebProxy(proxyAddr),
+		ALPNConnUpgradeRequired:    proxy.teleportClient.IsALPNConnUpgradeRequiredForWebProxy(ctx, proxyAddr),
 		PROXYHeaderGetter:          CreatePROXYHeaderGetter(ctx, proxy.teleportClient.PROXYSigner),
 		InsecureAddressDiscovery:   proxy.teleportClient.InsecureSkipVerify,
 	})
@@ -1574,11 +1579,12 @@ func NewNodeClient(ctx context.Context, sshConfig *ssh.ClientConfig, conn net.Co
 	close(emptyCh)
 
 	nc := &NodeClient{
-		Client:      tracessh.NewClient(sshconn, chans, emptyCh),
-		Namespace:   apidefaults.Namespace,
-		TC:          tc,
-		Tracer:      tc.Tracer,
-		FIPSEnabled: fipsEnabled,
+		Client:          tracessh.NewClient(sshconn, chans, emptyCh),
+		Namespace:       apidefaults.Namespace,
+		TC:              tc,
+		Tracer:          tc.Tracer,
+		FIPSEnabled:     fipsEnabled,
+		ProxyPublicAddr: tc.WebProxyAddr,
 	}
 
 	// Start a goroutine that will run for the duration of the client to process
@@ -1592,7 +1598,7 @@ func NewNodeClient(ctx context.Context, sshConfig *ssh.ClientConfig, conn net.Co
 // RunInteractiveShell creates an interactive shell on the node and copies stdin/stdout/stderr
 // to and from the node and local shell. This will block until the interactive shell on the node
 // is terminated.
-func (c *NodeClient) RunInteractiveShell(ctx context.Context, mode types.SessionParticipantMode, sessToJoin types.SessionTracker) error {
+func (c *NodeClient) RunInteractiveShell(ctx context.Context, mode types.SessionParticipantMode, sessToJoin types.SessionTracker, beforeStart func(io.Writer)) error {
 	ctx, span := c.Tracer.Start(
 		ctx,
 		"nodeClient/RunInteractiveShell",
@@ -1608,15 +1614,20 @@ func (c *NodeClient) RunInteractiveShell(ctx context.Context, mode types.Session
 	if err != nil {
 		return trace.Wrap(err)
 	}
-
 	env[teleport.EnvSSHSessionInvited] = string(encoded)
 
+	// Overwrite "SSH_SESSION_WEBPROXY_ADDR" with the public addr reported by the proxy. Otherwise,
+	// this would be set to the localhost addr (tc.WebProxyAddr) used for Web UI client connections.
+	if c.ProxyPublicAddr != "" && c.TC.WebProxyAddr != c.ProxyPublicAddr {
+		env[teleport.SSHSessionWebProxyAddr] = c.ProxyPublicAddr
+	}
+
 	nodeSession, err := newSession(ctx, c, sessToJoin, env, c.TC.Stdin, c.TC.Stdout, c.TC.Stderr, c.TC.EnableEscapeSequences)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	if err = nodeSession.runShell(ctx, mode, nil, c.TC.OnShellCreated); err != nil {
+	if err = nodeSession.runShell(ctx, mode, beforeStart, c.TC.OnShellCreated); err != nil {
 		switch e := trace.Unwrap(err).(type) {
 		case *ssh.ExitError:
 			c.TC.ExitStatus = e.ExitStatus()
@@ -1695,7 +1706,7 @@ func (c *NodeClient) handleGlobalRequests(ctx context.Context, requestCh <-chan
 					continue
 				}
 
-				c.OnMFA()
+				go c.OnMFA()
 			case teleport.SessionEvent:
 				// Parse event and create events.EventFields that can be consumed directly
 				// by caller.
diff --git a/lib/client/client_store.go b/lib/client/client_store.go
index 6ffce20fc565a..c2cd18b9240b2 100644
--- a/lib/client/client_store.go
+++ b/lib/client/client_store.go
@@ -14,6 +14,7 @@ limitations under the License.
 package client
 
 import (
+	"errors"
 	"net/url"
 	"os"
 	"time"
@@ -76,11 +77,25 @@ func (s *Store) AddKey(key *Key) error {
 	return nil
 }
 
+// ErrNoCredentials is returned by the client store when a specific key is not found.
+// This error can be used to determine whether a client should retrieve new credentials,
+// like how it is used with lib/client.RetryWithRelogin.
+var ErrNoCredentials = trace.NotFound("no credentials")
+
+// IsNoCredentialsError returns whether the given error is an ErrNoCredentials error.
+func IsNoCredentialsError(err error) bool {
+	return errors.Is(err, ErrNoCredentials)
+}
+
 // GetKey gets the requested key with trusted the requested certificates. The key's
-// trusted certs will be retrieved from the trusted certs store.
+// trusted certs will be retrieved from the trusted certs store. If the key is not
+// found or is missing data (certificates, etc.), then an ErrNoCredentials error
+// is returned.
 func (s *Store) GetKey(idx KeyIndex, opts ...CertOption) (*Key, error) {
 	key, err := s.KeyStore.GetKey(idx, opts...)
-	if err != nil {
+	if trace.IsNotFound(err) {
+		return nil, trace.Wrap(ErrNoCredentials, err.Error())
+	} else if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
diff --git a/lib/client/conntest/database/mysql.go b/lib/client/conntest/database/mysql.go
index d813fe4692c4f..5c77a6317b135 100644
--- a/lib/client/conntest/database/mysql.go
+++ b/lib/client/conntest/database/mysql.go
@@ -29,12 +29,27 @@ import (
 	"github.com/sirupsen/logrus"
 
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/srv/db/common"
 )
 
 // MySQLPinger implements the DatabasePinger interface for the MySQL protocol.
 type MySQLPinger struct{}
 
+// convertError converts the error from MySQL client since it can be wrapped in an [errors.Causer].
+// The MySQL engine in the agent already does this, but we need it here because
+// the error is from the MySQL client.
+func convertError(err error) error {
+	// causer defines an interface for errors wrapped by the [errors] package.
+	type causer interface {
+		Cause() error
+	}
+
+	if causer, ok := err.(causer); ok {
+		return trace.Wrap(causer.Cause())
+	}
+
+	return trace.Wrap(err)
+}
+
 // Ping connects to the database and issues a basic select statement to validate the connection.
 func (p *MySQLPinger) Ping(ctx context.Context, params PingParams) error {
 	if err := params.CheckAndSetDefaults(defaults.ProtocolMySQL); err != nil {
@@ -50,10 +65,7 @@ func (p *MySQLPinger) Ping(ctx context.Context, params PingParams) error {
 		nd.DialContext,
 	)
 	if err != nil {
-		// convert the error from MySQL client since it can be wrapped in a "Causer".
-		// The MySQL engine in the agent already does this, but we need it here because
-		// the error is from the MySQL client.
-		return trace.Wrap(common.ConvertError(err))
+		return convertError(err)
 	}
 
 	defer func() {
@@ -63,7 +75,7 @@ func (p *MySQLPinger) Ping(ctx context.Context, params PingParams) error {
 	}()
 
 	if err := conn.Ping(); err != nil {
-		return trace.Wrap(common.ConvertError(err))
+		return convertError(err)
 	}
 
 	return nil
diff --git a/lib/client/db/dbcmd/dbcmd.go b/lib/client/db/dbcmd/dbcmd.go
index da7d46b339960..fb2563704e0de 100644
--- a/lib/client/db/dbcmd/dbcmd.go
+++ b/lib/client/db/dbcmd/dbcmd.go
@@ -375,40 +375,39 @@ func (c *CLICommandBuilder) getMySQLCommand() (*exec.Cmd, error) {
 	return c.getMySQLOracleCommand()
 }
 
+func (c *CLICommandBuilder) isBinAvailable(file string) bool {
+	_, err := c.options.exe.LookPath(file)
+	return err == nil
+}
+
 // isMariaDBBinAvailable returns true if "mariadb" binary is found in the system PATH.
 func (c *CLICommandBuilder) isMariaDBBinAvailable() bool {
-	_, err := c.options.exe.LookPath(mariadbBin)
-	return err == nil
+	return c.isBinAvailable(mariadbBin)
 }
 
 // isMySQLBinAvailable returns true if "mysql" binary is found in the system PATH.
 func (c *CLICommandBuilder) isMySQLBinAvailable() bool {
-	_, err := c.options.exe.LookPath(mysqlBin)
-	return err == nil
+	return c.isBinAvailable(mysqlBin)
 }
 
 // isMongoshBinAvailable returns true if "mongosh" binary is found in the system PATH.
 func (c *CLICommandBuilder) isMongoshBinAvailable() bool {
-	_, err := c.options.exe.LookPath(mongoshBin)
-	return err == nil
+	return c.isBinAvailable(mongoshBin)
 }
 
 // isElasticsearchSQLBinAvailable returns true if "elasticsearch-sql-cli" binary is found in the system PATH.
 func (c *CLICommandBuilder) isElasticsearchSQLBinAvailable() bool {
-	_, err := c.options.exe.LookPath(elasticsearchSQLBin)
-	return err == nil
+	return c.isBinAvailable(elasticsearchSQLBin)
 }
 
 // isOpenSearchCLIBinAvailable returns true if "opensearch-cli" binary is found in the system PATH.
 func (c *CLICommandBuilder) isOpenSearchCLIBinAvailable() bool {
-	_, err := c.options.exe.LookPath(openSearchCLIBin)
-	return err == nil
+	return c.isBinAvailable(openSearchCLIBin)
 }
 
 // isOpenSearchCLIBinAvailable returns true if "opensearchsql" binary is found in the system PATH.
 func (c *CLICommandBuilder) isOpenSearchSQLBinAvailable() bool {
-	_, err := c.options.exe.LookPath(openSearchSQLBin)
-	return err == nil
+	return c.isBinAvailable(openSearchSQLBin)
 }
 
 // isMySQLBinMariaDBFlavor checks if mysql binary comes from Oracle or MariaDB.
@@ -430,9 +429,16 @@ func (c *CLICommandBuilder) isMySQLBinMariaDBFlavor() (bool, error) {
 	return strings.Contains(strings.ToLower(string(mysqlVer)), "mariadb"), nil
 }
 
+func (c *CLICommandBuilder) shouldUseMongoshBin() bool {
+	// Use "mongosh" if available.
+	// If not, use legacy "mongo" if available.
+	// If both are not available, pick "mongosh" in print out.
+	return c.isMongoshBinAvailable() || !c.isBinAvailable(mongoBin)
+}
+
 func (c *CLICommandBuilder) getMongoCommand() *exec.Cmd {
 	// look for `mongosh`
-	hasMongosh := c.isMongoshBinAvailable()
+	useMongosh := c.shouldUseMongoshBin()
 
 	var args []string
 
@@ -447,7 +453,7 @@ func (c *CLICommandBuilder) getMongoCommand() *exec.Cmd {
 
 		var flags tlsFlags
 
-		if hasMongosh {
+		if useMongosh {
 			flags = tlsFlags{tls: "--tls", tlsCertKeyFile: "--tlsCertificateKeyFile", tlsCAFile: "--tlsCAFile"}
 		} else {
 			flags = tlsFlags{tls: "--ssl", tlsCertKeyFile: "--sslPEMKeyFile", tlsCAFile: "--sslCAFile"}
@@ -466,7 +472,7 @@ func (c *CLICommandBuilder) getMongoCommand() *exec.Cmd {
 			// mongosh does not load system CAs by default which will cause issues if
 			// the proxy presents a certificate signed by a non-recognized authority
 			// which your system trusts (e.g. mkcert).
-			if hasMongosh {
+			if useMongosh {
 				args = append(args, "--tlsUseSystemCA")
 			}
 		}
@@ -477,7 +483,7 @@ func (c *CLICommandBuilder) getMongoCommand() *exec.Cmd {
 	args = append(args, c.getMongoAddress())
 
 	// use `mongosh` if available
-	if hasMongosh {
+	if useMongosh {
 		return exec.Command(mongoshBin, args...)
 	}
 
diff --git a/lib/client/db/dbcmd/dbcmd_test.go b/lib/client/db/dbcmd/dbcmd_test.go
index ab872a7e63108..4c6eef1014ca6 100644
--- a/lib/client/db/dbcmd/dbcmd_test.go
+++ b/lib/client/db/dbcmd/dbcmd_test.go
@@ -317,7 +317,9 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			dbProtocol:   defaults.ProtocolMongoDB,
 			databaseName: "mydb",
 			execer: &fakeExec{
-				execOutput: map[string][]byte{},
+				execOutput: map[string][]byte{
+					"mongo": []byte("legacy"),
+				},
 			},
 			cmd: []string{"mongo",
 				"--ssl",
@@ -327,12 +329,14 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name:         "mongodb no TLS",
+			name:         "mongodb no TLS (legacy)",
 			dbProtocol:   defaults.ProtocolMongoDB,
 			databaseName: "mydb",
 			opts:         []ConnectCommandFunc{WithNoTLS()},
 			execer: &fakeExec{
-				execOutput: map[string][]byte{},
+				execOutput: map[string][]byte{
+					"mongo": []byte("legacy"),
+				},
 			},
 			cmd: []string{"mongo",
 				"mongodb://localhost:12345/mydb?serverSelectionTimeoutMS=5000",
@@ -387,6 +391,18 @@ func TestCLICommandBuilderGetConnectCommand(t *testing.T) {
 				"mongodb://localhost:12345/mydb?serverSelectionTimeoutMS=5000",
 			},
 		},
+		{
+			name:         "mongosh preferred",
+			dbProtocol:   defaults.ProtocolMongoDB,
+			databaseName: "mydb",
+			opts:         []ConnectCommandFunc{WithNoTLS()},
+			execer: &fakeExec{
+				execOutput: map[string][]byte{}, // Cannot find either bin.
+			},
+			cmd: []string{"mongosh",
+				"mongodb://localhost:12345/mydb?serverSelectionTimeoutMS=5000",
+			},
+		},
 		{
 			name:         "sqlserver",
 			dbProtocol:   defaults.ProtocolSQLServer,
diff --git a/lib/client/export_test.go b/lib/client/export_test.go
index 1638f7bd361ce..07bd1ab5131f1 100644
--- a/lib/client/export_test.go
+++ b/lib/client/export_test.go
@@ -24,8 +24,8 @@ func (tc *TeleportClient) SetDTAutoEnrollIgnorePing(val bool) {
 	tc.dtAutoEnrollIgnorePing = val
 }
 
-func (tc *TeleportClient) SetDTAuthnRunCeremony(fn dtAuthnRunCeremonyFunc) {
-	tc.dtAuthnRunCeremony = fn
+func (tc *TeleportClient) SetDTAuthnRunCeremony(fn DTAuthnRunCeremonyFunc) {
+	tc.DTAuthnRunCeremony = fn
 }
 
 func (tc *TeleportClient) SetDTAutoEnroll(fn dtAutoEnrollFunc) {
diff --git a/lib/client/kubesession.go b/lib/client/kubesession.go
index f31d99add0249..b2ab3e0a36703 100644
--- a/lib/client/kubesession.go
+++ b/lib/client/kubesession.go
@@ -23,13 +23,13 @@ import (
 	"fmt"
 	"io"
 	"sync"
-	"time"
 
 	"github.com/gorilla/websocket"
 	"github.com/gravitational/trace"
 	"k8s.io/client-go/tools/remotecommand"
 
 	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/client/terminal"
@@ -37,8 +37,6 @@ import (
 	"github.com/gravitational/teleport/lib/utils"
 )
 
-const mfaChallengeInterval = time.Second * 30
-
 // KubeSession a joined kubernetes session from the client side.
 type KubeSession struct {
 	stream *streamproto.SessionStream
@@ -197,7 +195,12 @@ func (s *KubeSession) handleMFA(ctx context.Context, tc *TeleportClient, mode ty
 			return trace.Wrap(err)
 		}
 
-		go runPresenceTask(ctx, stdout, auth, tc, s.meta.GetSessionID())
+		go RunPresenceTask(ctx, stdout, auth, s.meta.GetSessionID(), func(ctx context.Context, proxyAddr string, c *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
+			resp, err := tc.PromptMFAChallenge(ctx, proxyAddr, c, func(opts *PromptMFAChallengeOpts) {
+				opts.Quiet = true
+			})
+			return resp, trace.Wrap(err)
+		})
 	}
 
 	return nil
diff --git a/lib/client/mfa.go b/lib/client/mfa.go
index f91dd5f65e3f0..3710f6f79c261 100644
--- a/lib/client/mfa.go
+++ b/lib/client/mfa.go
@@ -29,6 +29,7 @@ import (
 	oteltrace "go.opentelemetry.io/otel/trace"
 
 	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/observability/tracing"
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
 	"github.com/gravitational/teleport/lib/utils/prompt"
@@ -117,6 +118,13 @@ func (tc *TeleportClient) PromptMFAChallenge(ctx context.Context, proxyAddr stri
 // PromptMFAChallenge prompts the user to complete MFA authentication
 // challenges.
 func PromptMFAChallenge(ctx context.Context, c *proto.MFAAuthenticateChallenge, proxyAddr string, opts *PromptMFAChallengeOpts) (*proto.MFAAuthenticateResponse, error) {
+	ctx, span := tracing.NewTracer("mfa").Start(
+		ctx,
+		"PromptMFAChallenge",
+		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
+	)
+	defer span.End()
+
 	// Is there a challenge present?
 	if c.TOTP == nil && c.WebauthnChallenge == nil {
 		return &proto.MFAAuthenticateResponse{}, nil
diff --git a/lib/client/presence.go b/lib/client/presence.go
index 41705c084afec..df6fdfcfb8ac6 100644
--- a/lib/client/presence.go
+++ b/lib/client/presence.go
@@ -23,18 +23,51 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
 
 	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/lib/auth"
 )
 
-func runPresenceTask(ctx context.Context, term io.Writer, auth auth.ClientI, tc *TeleportClient, sessionID string) error {
+// PresenceMaintainer allows maintaining presence with the Auth service.
+type PresenceMaintainer interface {
+	MaintainSessionPresence(ctx context.Context) (proto.AuthService_MaintainSessionPresenceClient, error)
+}
+
+const mfaChallengeInterval = time.Second * 30
+
+// presenceOptions allows passing optional overrides
+// to RunPresenceTask. Mainly used by tests.
+type presenceOptions struct {
+	Clock clockwork.Clock
+}
+
+// PresenceOption a functional option for RunPresenceTask.
+type PresenceOption func(p *presenceOptions)
+
+// WithPresenceClock sets the clock to be used by RunPresenceTask.
+func WithPresenceClock(clock clockwork.Clock) PresenceOption {
+	return func(p *presenceOptions) {
+		p.Clock = clock
+	}
+}
+
+// RunPresenceTask periodically performs and MFA ceremony to detect that a user is
+// still present and attentive.
+func RunPresenceTask(ctx context.Context, term io.Writer, maintainer PresenceMaintainer, sessionID string, promptMFAChallenge PromptMFAChallengeHandler, opts ...PresenceOption) error {
 	fmt.Fprintf(term, "\r\nTeleport > MFA presence enabled\r\n")
 
-	ticker := time.NewTicker(mfaChallengeInterval)
+	o := &presenceOptions{
+		Clock: clockwork.NewRealClock(),
+	}
+
+	for _, opt := range opts {
+		opt(o)
+	}
+
+	ticker := o.Clock.NewTicker(mfaChallengeInterval)
 	defer ticker.Stop()
 
-	stream, err := auth.MaintainSessionPresence(ctx)
+	stream, err := maintainer.MaintainSessionPresence(ctx)
 	if err != nil {
 		fmt.Fprintf(term, "\r\nstream error: %v\r\n", err)
 		return trace.Wrap(err)
@@ -42,7 +75,7 @@ func runPresenceTask(ctx context.Context, term io.Writer, auth auth.ClientI, tc
 
 	for {
 		select {
-		case <-ticker.C:
+		case <-ticker.Chan():
 			req := &proto.PresenceMFAChallengeSend{
 				Request: &proto.PresenceMFAChallengeSend_ChallengeRequest{
 					ChallengeRequest: &proto.PresenceMFAChallengeRequest{SessionID: sessionID},
@@ -59,11 +92,20 @@ func runPresenceTask(ctx context.Context, term io.Writer, auth auth.ClientI, tc
 				return trace.Wrap(err)
 			}
 
-			solution, err := solveMFA(ctx, term, tc, challenge)
+			fmt.Fprint(term, "\r\nTeleport > Please tap your MFA key\r\n")
+
+			// This is here to enforce the usage of a MFA device.
+			// We don't support TOTP for live presence.
+			challenge.TOTP = nil
+
+			solution, err := promptMFAChallenge(ctx, "" /* proxyAddr */, challenge)
 			if err != nil {
+				fmt.Fprintf(term, "\r\nTeleport > Failed to confirm presence: %v\r\n", err)
 				return trace.Wrap(err)
 			}
 
+			fmt.Fprint(term, "\r\nTeleport > Received MFA presence confirmation\r\n")
+
 			req = &proto.PresenceMFAChallengeSend{
 				Request: &proto.PresenceMFAChallengeSend_ChallengeResponse{
 					ChallengeResponse: solution,
@@ -79,22 +121,3 @@ func runPresenceTask(ctx context.Context, term io.Writer, auth auth.ClientI, tc
 		}
 	}
 }
-
-func solveMFA(ctx context.Context, term io.Writer, tc *TeleportClient, challenge *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
-	fmt.Fprint(term, "\r\nTeleport > Please tap your MFA key\r\n")
-
-	// This is here to enforce the usage of a MFA device.
-	// We don't support TOTP for live presence.
-	challenge.TOTP = nil
-
-	response, err := tc.PromptMFAChallenge(ctx, "" /* proxyAddr */, challenge, func(opts *PromptMFAChallengeOpts) {
-		opts.Quiet = true
-	})
-	if err != nil {
-		fmt.Fprintf(term, "\r\nTeleport > Failed to confirm presence: %v\r\n", err)
-		return nil, trace.Wrap(err)
-	}
-
-	fmt.Fprint(term, "\r\nTeleport > Received MFA presence confirmation\r\n")
-	return response, nil
-}
diff --git a/lib/client/profile.go b/lib/client/profile.go
index 2d4a0831d1770..ea8460137a153 100644
--- a/lib/client/profile.go
+++ b/lib/client/profile.go
@@ -559,3 +559,12 @@ func ProfileNameFromProxyAddress(store ProfileStore, proxyAddr string) (string,
 	profileName, err := utils.Host(proxyAddr)
 	return profileName, trace.Wrap(err)
 }
+
+// AccessInfo returns the complete services.AccessInfo for this profile.
+func (p *ProfileStatus) AccessInfo() *services.AccessInfo {
+	return &services.AccessInfo{
+		Roles:              p.Roles,
+		Traits:             p.Traits,
+		AllowedResourceIDs: p.AllowedResourceIDs,
+	}
+}
diff --git a/lib/client/session.go b/lib/client/session.go
index cbb2341c0720b..69173486a7bf2 100644
--- a/lib/client/session.go
+++ b/lib/client/session.go
@@ -493,17 +493,41 @@ func (ns *NodeSession) updateTerminalSize(ctx context.Context, s *tracessh.Sessi
 	}
 }
 
+// sessionWriter wraps the [tracessh.Session]
+// stdout to prevent any panics that may occur
+// by trying to use it before it has been initialized.
+// In those cases output is written to the stdout that
+// is configured for tsh so that output is not lost entirely.
+type sessionWriter struct {
+	tshOut  io.Writer
+	session *tracessh.Session
+}
+
+func (s *sessionWriter) Write(p []byte) (int, error) {
+	if s.session.Stdout != nil {
+		return s.session.Stdout.Write(p)
+	}
+
+	return s.tshOut.Write(p)
+}
+
 // runShell executes user's shell on the remote node under an interactive session
 func (ns *NodeSession) runShell(ctx context.Context, mode types.SessionParticipantMode, beforeStart func(io.Writer), callback ShellCreatedCallback) error {
 	return ns.interactiveSession(ctx, mode, func(s *tracessh.Session, shell io.ReadWriteCloser) error {
+		w := &sessionWriter{
+			tshOut:  ns.nodeClient.TC.Stdout,
+			session: s,
+		}
+
 		if beforeStart != nil {
-			beforeStart(s.Stdout)
+			beforeStart(w)
 		}
 
 		// start the shell on the server:
 		if err := s.Shell(ctx); err != nil {
 			return trace.Wrap(err)
 		}
+
 		// call the client-supplied callback
 		if callback != nil {
 			exit, err := callback(s, ns.nodeClient.Client, shell)
diff --git a/lib/client/weblogin.go b/lib/client/weblogin.go
index 6ca06870ef304..74831580bdb7b 100644
--- a/lib/client/weblogin.go
+++ b/lib/client/weblogin.go
@@ -19,11 +19,15 @@ package client
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
 	"crypto/x509"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net"
+	"net/http"
+	"net/http/cookiejar"
 	"net/url"
 	"os"
 	"os/exec"
@@ -45,6 +49,9 @@ import (
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/httplib"
+	"github.com/gravitational/teleport/lib/httplib/csrf"
+	websession "github.com/gravitational/teleport/lib/web/session"
 )
 
 const (
@@ -301,7 +308,7 @@ type SSHLoginHeadless struct {
 }
 
 // initClient creates a new client to the HTTPS web proxy.
-func initClient(proxyAddr string, insecure bool, pool *x509.CertPool, extraHeaders map[string]string) (*WebClient, *url.URL, error) {
+func initClient(proxyAddr string, insecure bool, pool *x509.CertPool, extraHeaders map[string]string, opts ...roundtrip.ClientParam) (*WebClient, *url.URL, error) {
 	log := logrus.WithFields(logrus.Fields{
 		trace.Component: teleport.ComponentClient,
 	})
@@ -326,8 +333,16 @@ func initClient(proxyAddr string, insecure bool, pool *x509.CertPool, extraHeade
 		fmt.Fprintf(os.Stderr, "WARNING: You are using insecure connection to Teleport proxy %v\n", proxyAddr)
 	}
 
-	opt := roundtrip.HTTPClient(newClient(insecure, pool, extraHeaders))
-	clt, err := NewWebClient(proxyAddr, opt)
+	jar, err := cookiejar.New(nil)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	opts = append(opts,
+		roundtrip.HTTPClient(newClient(insecure, pool, extraHeaders)),
+		roundtrip.CookieJar(jar),
+	)
+	clt, err := NewWebClient(proxyAddr, opts...)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -658,3 +673,248 @@ func GetWebConfig(ctx context.Context, proxyAddr string, insecure bool) (*webcli
 
 	return &cfg, nil
 }
+
+// CreateWebSessionReq is a request for the web api to
+// initiate a new web session.
+type CreateWebSessionReq struct {
+	// User is the Teleport username.
+	User string `json:"user"`
+	// Pass is the password.
+	Pass string `json:"pass"`
+	// SecondFactorToken is the OTP.
+	SecondFactorToken string `json:"second_factor_token"`
+}
+
+// CreateWebSessionResponse is a response from the web api
+// to a [CreateWebSessionReq] request.
+type CreateWebSessionResponse struct {
+	// TokenType is token type (bearer)
+	TokenType string `json:"type"`
+	// Token value
+	Token string `json:"token"`
+	// TokenExpiresIn sets seconds before this token is not valid
+	TokenExpiresIn int `json:"expires_in"`
+	// SessionExpires is when this session expires.
+	SessionExpires time.Time `json:"sessionExpires,omitempty"`
+	// SessionInactiveTimeoutMS specifies how long in milliseconds
+	// a user WebUI session can be left idle before being logged out
+	// by the server. A zero value means there is no idle timeout set.
+	SessionInactiveTimeoutMS int `json:"sessionInactiveTimeout"`
+}
+
+// SSHAgentLoginWeb is used by tsh to fetch local user credentials via the web api.
+func SSHAgentLoginWeb(ctx context.Context, login SSHLoginDirect) (*WebClient, types.WebSession, error) {
+	clt, _, err := initClient(login.ProxyAddr, login.Insecure, login.Pool, login.ExtraHeaders)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	token := make([]byte, 32)
+	if _, err := rand.Read(token); err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	csrfToken := hex.EncodeToString(token)
+	resp, err := httplib.ConvertResponse(clt.RoundTrip(func() (*http.Response, error) {
+		var buf bytes.Buffer
+		if err := json.NewEncoder(&buf).Encode(&CreateWebSessionReq{
+			User:              login.User,
+			Pass:              login.Password,
+			SecondFactorToken: login.OTPToken,
+		}); err != nil {
+			return nil, err
+		}
+
+		req, err := http.NewRequestWithContext(ctx, "POST", clt.Endpoint("webapi", "sessions", "web"), &buf)
+		if err != nil {
+			return nil, err
+		}
+
+		cookie := &http.Cookie{
+			Name:  csrf.CookieName,
+			Value: csrfToken,
+		}
+
+		req.AddCookie(cookie)
+
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set(csrf.HeaderName, csrfToken)
+		return clt.HTTPClient().Do(req)
+	}))
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	session, err := GetSessionFromResponse(resp)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	return clt, session, nil
+}
+
+// SSHAgentMFAWebSessionLogin requests a MFA challenge via the proxy web api.
+// If the credentials are valid, the proxy will return a challenge. We then
+// prompt the user to provide 2nd factor and pass the response to the proxy.
+func SSHAgentMFAWebSessionLogin(ctx context.Context, login SSHLoginMFA) (*WebClient, types.WebSession, error) {
+	clt, _, err := initClient(login.ProxyAddr, login.Insecure, login.Pool, login.ExtraHeaders)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	beginReq := MFAChallengeRequest{
+		User: login.User,
+		Pass: login.Password,
+	}
+	challengeJSON, err := clt.PostJSON(ctx, clt.Endpoint("webapi", "mfa", "login", "begin"), beginReq)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	challenge := &MFAAuthenticateChallenge{}
+	if err := json.Unmarshal(challengeJSON.Bytes(), challenge); err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	// Convert to auth gRPC proto challenge.
+	challengePB := &proto.MFAAuthenticateChallenge{}
+	if challenge.TOTPChallenge {
+		challengePB.TOTP = &proto.TOTPChallenge{}
+	}
+	if challenge.WebauthnChallenge != nil {
+		challengePB.WebauthnChallenge = wanlib.CredentialAssertionToProto(challenge.WebauthnChallenge)
+	}
+
+	respPB, err := PromptMFAChallenge(ctx, challengePB, login.ProxyAddr, &PromptMFAChallengeOpts{
+		AllowStdinHijack:        login.AllowStdinHijack,
+		AuthenticatorAttachment: login.AuthenticatorAttachment,
+		PreferOTP:               login.PreferOTP,
+	})
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	challengeResp := AuthenticateWebUserRequest{
+		User: login.User,
+	}
+	// Convert back from auth gRPC proto response.
+	switch r := respPB.Response.(type) {
+	case *proto.MFAAuthenticateResponse_Webauthn:
+		challengeResp.WebauthnAssertionResponse = wanlib.CredentialAssertionResponseFromProto(r.Webauthn)
+	default:
+		// No challenge was sent, so we send back just username/password.
+	}
+
+	loginRespJSON, err := clt.PostJSON(ctx, clt.Endpoint("webapi", "mfa", "login", "finishsession"), challengeResp)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	session, err := GetSessionFromResponse(loginRespJSON)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	return clt, session, nil
+}
+
+// SSHAgentPasswordlessLoginWeb requests a passwordless MFA challenge via the proxy
+// web api.
+func SSHAgentPasswordlessLoginWeb(ctx context.Context, login SSHLoginPasswordless) (*WebClient, types.WebSession, error) {
+	webClient, webURL, err := initClient(login.ProxyAddr, login.Insecure, login.Pool, login.ExtraHeaders)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	challengeJSON, err := webClient.PostJSON(
+		ctx, webClient.Endpoint("webapi", "mfa", "login", "begin"),
+		&MFAChallengeRequest{
+			Passwordless: true,
+		})
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	challenge := &MFAAuthenticateChallenge{}
+	if err := json.Unmarshal(challengeJSON.Bytes(), challenge); err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	// Sanity check WebAuthn challenge.
+	switch {
+	case challenge.WebauthnChallenge == nil:
+		return nil, nil, trace.BadParameter("passwordless: webauthn challenge missing")
+	case challenge.WebauthnChallenge.Response.UserVerification == protocol.VerificationDiscouraged:
+		return nil, nil, trace.BadParameter("passwordless: user verification requirement too lax (%v)", challenge.WebauthnChallenge.Response.UserVerification)
+	}
+
+	stderr := login.StderrOverride
+	if stderr == nil {
+		stderr = os.Stderr
+	}
+
+	prompt := login.CustomPrompt
+	if prompt == nil {
+		prompt = wancli.NewDefaultPrompt(ctx, stderr)
+	}
+
+	mfaResp, _, err := promptWebauthn(ctx, webURL.String(), challenge.WebauthnChallenge, prompt, &wancli.LoginOpts{
+		User:                    login.User,
+		AuthenticatorAttachment: login.AuthenticatorAttachment,
+	})
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	loginRespJSON, err := webClient.PostJSON(
+		ctx, webClient.Endpoint("webapi", "mfa", "login", "finishsession"),
+		&AuthenticateWebUserRequest{
+			User:                      login.User,
+			WebauthnAssertionResponse: wanlib.CredentialAssertionResponseFromProto(mfaResp.GetWebauthn()),
+		})
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	webSession, err := GetSessionFromResponse(loginRespJSON)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	return webClient, webSession, nil
+}
+
+// GetSessionFromResponse creates a [types.WebSession] if a cookie
+// named [websession.CookieName] is present in the provided [roundtrip.Response].
+func GetSessionFromResponse(resp *roundtrip.Response) (types.WebSession, error) {
+	var sess CreateWebSessionResponse
+	if err := json.Unmarshal(resp.Bytes(), &sess); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	cookies := resp.Cookies()
+
+	var sessionCookie *http.Cookie
+	for _, cookie := range cookies {
+		if cookie.Name == websession.CookieName {
+			sessionCookie = cookie
+			break
+		}
+	}
+
+	if sessionCookie == nil {
+		return nil, trace.BadParameter("no session cookie present")
+	}
+
+	cookie, err := websession.DecodeCookie(sessionCookie.Value)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	session, err := types.NewWebSession(cookie.SID, types.KindWebSession, types.WebSessionSpecV2{
+		User:               cookie.User,
+		BearerToken:        sess.Token,
+		BearerTokenExpires: time.Now().Add(time.Duration(sess.TokenExpiresIn) * time.Second),
+		Expires:            sess.SessionExpires,
+		LoginTime:          time.Now(),
+		IdleTimeout:        types.Duration(time.Duration(sess.SessionInactiveTimeoutMS) * time.Millisecond),
+	})
+	return session, trace.Wrap(err)
+}
diff --git a/lib/cloud/aws/errors.go b/lib/cloud/aws/errors.go
index 57923ad1bc3f0..1d5afbfe8e909 100644
--- a/lib/cloud/aws/errors.go
+++ b/lib/cloud/aws/errors.go
@@ -20,6 +20,8 @@ import (
 	"errors"
 	"net/http"
 
+	awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
+	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/gravitational/trace"
@@ -34,7 +36,11 @@ func ConvertRequestFailureError(err error) error {
 		return err
 	}
 
-	switch requestErr.StatusCode() {
+	return convertRequestFailureErrorFromStatusCode(requestErr.StatusCode(), requestErr)
+}
+
+func convertRequestFailureErrorFromStatusCode(statusCode int, requestErr error) error {
+	switch statusCode {
 	case http.StatusForbidden:
 		return trace.AccessDenied(requestErr.Error())
 	case http.StatusConflict:
@@ -43,7 +49,7 @@ func ConvertRequestFailureError(err error) error {
 		return trace.NotFound(requestErr.Error())
 	}
 
-	return err // Return unmodified.
+	return requestErr // Return unmodified.
 }
 
 // ConvertIAMError converts common errors from IAM clients to trace errors.
@@ -79,3 +85,32 @@ func parseMetadataClientError(err error) error {
 	}
 	return trace.Wrap(err)
 }
+
+// ConvertIAMv2Error converts common errors from IAM clients to trace errors.
+func ConvertIAMv2Error(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	var entityExistsError *iamTypes.EntityAlreadyExistsException
+	if errors.As(err, &entityExistsError) {
+		return trace.AlreadyExists(*entityExistsError.Message)
+	}
+
+	var entityNotFound *iamTypes.NoSuchEntityException
+	if errors.As(err, &entityNotFound) {
+		return trace.NotFound(*entityNotFound.Message)
+	}
+
+	var malformedPolicyDocument *iamTypes.MalformedPolicyDocumentException
+	if errors.As(err, &malformedPolicyDocument) {
+		return trace.BadParameter(*malformedPolicyDocument.Message)
+	}
+
+	var re *awshttp.ResponseError
+	if errors.As(err, &re) {
+		return convertRequestFailureErrorFromStatusCode(re.HTTPStatusCode(), re.Err)
+	}
+
+	return err
+}
diff --git a/lib/cloud/aws/errors_test.go b/lib/cloud/aws/errors_test.go
new file mode 100644
index 0000000000000..a2631857ad898
--- /dev/null
+++ b/lib/cloud/aws/errors_test.go
@@ -0,0 +1,116 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package aws
+
+import (
+	"net/http"
+	"testing"
+
+	awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
+	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
+	"github.com/aws/aws-sdk-go/aws"
+	smithyhttp "github.com/aws/smithy-go/transport/http"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConvertIAMv2Error(t *testing.T) {
+	for _, tt := range []struct {
+		name     string
+		inErr    error
+		errCheck require.ErrorAssertionFunc
+	}{
+		{
+			name:     "no error",
+			inErr:    nil,
+			errCheck: require.NoError,
+		},
+		{
+			name: "resource already exists",
+			inErr: &iamTypes.EntityAlreadyExistsException{
+				Message: aws.String("resource exists"),
+			},
+			errCheck: func(tt require.TestingT, err error, i ...interface{}) {
+				require.True(tt, trace.IsAlreadyExists(err), "expected trace.AlreadyExists error, got %v", err)
+			},
+		},
+		{
+			name: "resource already exists",
+			inErr: &iamTypes.NoSuchEntityException{
+				Message: aws.String("resource not found"),
+			},
+			errCheck: func(tt require.TestingT, err error, i ...interface{}) {
+				require.True(tt, trace.IsNotFound(err), "expected trace.NotFound error, got %v", err)
+			},
+		},
+		{
+			name: "invalid policy document",
+			inErr: &iamTypes.MalformedPolicyDocumentException{
+				Message: aws.String("malformed document"),
+			},
+			errCheck: func(tt require.TestingT, err error, i ...interface{}) {
+				require.True(tt, trace.IsBadParameter(err), "expected trace.BadParameter error, got %v", err)
+			},
+		},
+		{
+			name: "unauthorized",
+			inErr: &awshttp.ResponseError{
+				ResponseError: &smithyhttp.ResponseError{
+					Response: &smithyhttp.Response{Response: &http.Response{
+						StatusCode: http.StatusForbidden,
+					}},
+					Err: trace.Errorf(""),
+				},
+			},
+			errCheck: func(tt require.TestingT, err error, i ...interface{}) {
+				require.True(tt, trace.IsAccessDenied(err), "expected trace.AccessDenied error, got %v", err)
+			},
+		},
+		{
+			name: "not found",
+			inErr: &awshttp.ResponseError{
+				ResponseError: &smithyhttp.ResponseError{
+					Response: &smithyhttp.Response{Response: &http.Response{
+						StatusCode: http.StatusNotFound,
+					}},
+					Err: trace.Errorf(""),
+				},
+			},
+			errCheck: func(tt require.TestingT, err error, i ...interface{}) {
+				require.True(tt, trace.IsNotFound(err), "expected trace.NotFound error, got %v", err)
+			},
+		},
+		{
+			name: "resource already exists",
+			inErr: &awshttp.ResponseError{
+				ResponseError: &smithyhttp.ResponseError{
+					Response: &smithyhttp.Response{Response: &http.Response{
+						StatusCode: http.StatusConflict,
+					}},
+					Err: trace.Errorf(""),
+				},
+			},
+			errCheck: func(tt require.TestingT, err error, i ...interface{}) {
+				require.True(tt, trace.IsAlreadyExists(err), "expected trace.AlreadyExists error, got %v", err)
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.errCheck(t, ConvertIAMv2Error(tt.inErr))
+		})
+	}
+}
diff --git a/lib/cloud/aws/policy.go b/lib/cloud/aws/policy.go
index fc67d71f41905..882ac583bb609 100644
--- a/lib/cloud/aws/policy.go
+++ b/lib/cloud/aws/policy.go
@@ -19,7 +19,6 @@ package aws
 import (
 	"context"
 	"encoding/json"
-	"fmt"
 	"net/url"
 	"sort"
 
@@ -29,6 +28,8 @@ import (
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/slices"
+
+	awsutils "github.com/gravitational/teleport/lib/utils/aws"
 )
 
 // Policy represents an AWS IAM policy.
@@ -72,7 +73,9 @@ type Statement struct {
 	// Actions is a list of actions.
 	Actions SliceOrString `json:"Action"`
 	// Resources is a list of resources.
-	Resources SliceOrString `json:"Resource"`
+	Resources SliceOrString `json:"Resource,omitempty"`
+	// Principals is a list of principals.
+	Principals map[string]SliceOrString `json:"Principal,omitempty"`
 }
 
 // ensureResource ensures that the statement contains the specified resource.
@@ -318,7 +321,7 @@ func NewPolicies(partitionID string, accountID string, iamClient iamiface.IAMAPI
 // * `iam:DeletePolicyVersion`: wildcard ("*") or policy that will be created;
 // * `iam:CreatePolicyVersion`: wildcard ("*") or policy that will be created;
 func (p *policies) Upsert(ctx context.Context, policy *Policy) (string, error) {
-	policyARN := fmt.Sprintf("arn:%s:iam::%s:policy/%s", p.partitionID, p.accountID, policy.Name)
+	policyARN := awsutils.PolicyARN(p.partitionID, p.accountID, policy.Name)
 	encodedPolicyDocument, err := json.Marshal(policy.Document)
 	if err != nil {
 		return "", trace.Wrap(err)
diff --git a/lib/cloud/aws/policy_statements.go b/lib/cloud/aws/policy_statements.go
new file mode 100644
index 0000000000000..1b1602fcc3fc2
--- /dev/null
+++ b/lib/cloud/aws/policy_statements.go
@@ -0,0 +1,100 @@
+/*
+Copyright 2021 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package aws
+
+var (
+	allResources = []string{"*"}
+)
+
+// StatementForIAMEditRolePolicy returns a IAM Policy Statement which allows editting Role Policy
+// of the resources.
+func StatementForIAMEditRolePolicy(resources ...string) *Statement {
+	return &Statement{
+		Effect:    EffectAllow,
+		Actions:   []string{"iam:GetRolePolicy", "iam:PutRolePolicy", "iam:DeleteRolePolicy"},
+		Resources: resources,
+	}
+}
+
+// StatementForIAMEditUserPolicy returns a IAM Policy Statement which allows editting User Policy
+// of the resources.
+func StatementForIAMEditUserPolicy(resources ...string) *Statement {
+	return &Statement{
+		Effect:    EffectAllow,
+		Actions:   []string{"iam:GetUserPolicy", "iam:PutUserPolicy", "iam:DeleteUserPolicy"},
+		Resources: resources,
+	}
+}
+
+// StatementForECSManageService returns the statement that allows managing the ECS Service deployed
+// by DeployService (AWS OIDC Integration).
+func StatementForECSManageService() *Statement {
+	return &Statement{
+		Effect: EffectAllow,
+		Actions: []string{
+			"ecs:DescribeClusters", "ecs:CreateCluster", "ecs:PutClusterCapacityProviders",
+			"ecs:DescribeServices", "ecs:CreateService", "ecs:UpdateService",
+			"ecs:RegisterTaskDefinition",
+		},
+		Resources: allResources,
+	}
+}
+
+// StatementForWritingLogs returns the statement that allows the writing logs to CloudWatch.
+// This is used by the DeployService (ECS Service) to write teleport logs.
+// https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html
+func StatementForWritingLogs() *Statement {
+	return &Statement{
+		Effect:    EffectAllow,
+		Actions:   []string{"logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup"},
+		Resources: allResources,
+	}
+}
+
+// StatementForIAMPassRole returns a statement that allows to iam:PassRole the target role.
+// Usage example: when setting up the TaskRole for the ECS Task.
+// https://docs.aws.amazon.com/AmazonECS/latest/userguide/task-iam-roles.html#specify-task-iam-roles
+func StatementForIAMPassRole(targetRole string) *Statement {
+	return &Statement{
+		Effect:  EffectAllow,
+		Actions: SliceOrString{"iam:PassRole"},
+		Resources: SliceOrString{
+			targetRole,
+		},
+	}
+}
+
+// StatementForECSTaskRoleTrustRelationships returns the Trust Relationship to allow the ECS Tasks service to.
+// It allows the usage of this Role by the ECS Tasks service.
+func StatementForECSTaskRoleTrustRelationships() *Statement {
+	return &Statement{
+		Effect:  EffectAllow,
+		Actions: SliceOrString{"sts:AssumeRole"},
+		Principals: map[string]SliceOrString{
+			"Service": {"ecs-tasks.amazonaws.com"},
+		},
+	}
+}
+
+// StatementForRDSDBConnect returns a statement that allows the `rds-db:connect` for all RDS DBs.
+func StatementForRDSDBConnect() *Statement {
+	return &Statement{
+		Effect:    EffectAllow,
+		Actions:   SliceOrString{"rds-db:connect"},
+		Resources: allResources,
+	}
+}
diff --git a/lib/cloud/aws/policy_test.go b/lib/cloud/aws/policy_test.go
index 626453da6074e..0610e54ef9c9a 100644
--- a/lib/cloud/aws/policy_test.go
+++ b/lib/cloud/aws/policy_test.go
@@ -87,25 +87,108 @@ func TestSliceOrString(t *testing.T) {
 }
 
 func TestParsePolicyDocument(t *testing.T) {
-	policyDoc, err := ParsePolicyDocument(`{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": "rds-db:connect",
-	  "Resource": ["arn:aws:rds-db:us-west-1:12345:dbuser:id/*"]
-    }
-  ]
-}`)
-	require.NoError(t, err)
-	require.Equal(t, PolicyDocument{
-		Version: PolicyVersion,
-		Statements: []*Statement{{
-			Effect:    EffectAllow,
-			Actions:   SliceOrString{"rds-db:connect"},
-			Resources: SliceOrString{"arn:aws:rds-db:us-west-1:12345:dbuser:id/*"},
-		}},
-	}, *policyDoc)
+	t.Run("parse without principals", func(t *testing.T) {
+		policyDoc, err := ParsePolicyDocument(`{
+			"Version": "2012-10-17",
+			"Statement": [
+			  {
+				"Effect": "Allow",
+				"Action": "rds-db:connect",
+				"Resource": ["arn:aws:rds-db:us-west-1:12345:dbuser:id/*"]
+			  }
+			]
+		  }`)
+		require.NoError(t, err)
+		require.Equal(t, PolicyDocument{
+			Version: PolicyVersion,
+			Statements: []*Statement{{
+				Effect:    EffectAllow,
+				Actions:   SliceOrString{"rds-db:connect"},
+				Resources: SliceOrString{"arn:aws:rds-db:us-west-1:12345:dbuser:id/*"},
+			}},
+		}, *policyDoc)
+	})
+	t.Run("parse without resource", func(t *testing.T) {
+		policyDoc, err := ParsePolicyDocument(`{
+			"Version": "2012-10-17",
+			"Statement": [
+			  {
+				"Effect": "Allow",
+				"Action": "rds-db:connect",
+				"Principal": {
+					"Service": "ecs-tasks.amazonaws.com"
+				}
+			  }
+			]
+		  }`)
+		require.NoError(t, err)
+		require.Equal(t, PolicyDocument{
+			Version: PolicyVersion,
+			Statements: []*Statement{{
+				Effect:  EffectAllow,
+				Actions: SliceOrString{"rds-db:connect"},
+				Principals: map[string]SliceOrString{
+					"Service": {"ecs-tasks.amazonaws.com"},
+				},
+			}},
+		}, *policyDoc)
+	})
+}
+
+func TestMarshalPolicyDocument(t *testing.T) {
+	t.Run("marshal without principal", func(t *testing.T) {
+		doc := PolicyDocument{
+			Version: PolicyVersion,
+			Statements: []*Statement{{
+				Effect:    EffectAllow,
+				Actions:   SliceOrString{"rds-db:connect"},
+				Resources: SliceOrString{"arn:aws:rds-db:us-west-1:12345:dbuser:id/*"},
+			}},
+		}
+
+		docString, err := doc.Marshal()
+		require.NoError(t, err)
+
+		require.Equal(t, `{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": "rds-db:connect",
+            "Resource": "arn:aws:rds-db:us-west-1:12345:dbuser:id/*"
+        }
+    ]
+}`, docString)
+	})
+
+	t.Run("marshal without resources", func(t *testing.T) {
+		doc := PolicyDocument{
+			Version: PolicyVersion,
+			Statements: []*Statement{{
+				Effect:  EffectAllow,
+				Actions: SliceOrString{"rds-db:connect"},
+				Principals: map[string]SliceOrString{
+					"Service": {"ecs-tasks.amazonaws.com"},
+				},
+			}},
+		}
+
+		docString, err := doc.Marshal()
+		require.NoError(t, err)
+
+		require.Equal(t, `{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": "rds-db:connect",
+            "Principal": {
+                "Service": "ecs-tasks.amazonaws.com"
+            }
+        }
+    ]
+}`, docString)
+	})
 }
 
 // TestIAMPolicy verifies AWS IAM policy manipulations.
diff --git a/lib/cloud/aws/tags_helpers.go b/lib/cloud/aws/tags_helpers.go
index 9408fb1282a91..2bcec419c9e55 100644
--- a/lib/cloud/aws/tags_helpers.go
+++ b/lib/cloud/aws/tags_helpers.go
@@ -21,6 +21,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/aws/aws-sdk-go/service/memorydb"
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	"github.com/aws/aws-sdk-go/service/redshiftserverless"
@@ -34,8 +35,14 @@ import (
 // ResourceTag is a generic interface that represents an AWS resource tag.
 type ResourceTag interface {
 	// TODO Go generic does not allow access common fields yet. List all types
-	// here and use a type switch for now.
-	rdsTypesV2.Tag | *rds.Tag | *redshift.Tag | *elasticache.Tag | *memorydb.Tag | *redshiftserverless.Tag
+	//  here and use a type switch for now.
+	rdsTypesV2.Tag |
+		*rds.Tag |
+		*redshift.Tag |
+		*elasticache.Tag |
+		*memorydb.Tag |
+		*redshiftserverless.Tag |
+		*opensearchservice.Tag
 }
 
 // TagsToLabels converts a list of AWS resource tags to a label map.
@@ -71,6 +78,8 @@ func resourceTagToKeyValue[Tag ResourceTag](tag Tag) (string, string) {
 		return aws.StringValue(v.Key), aws.StringValue(v.Value)
 	case rdsTypesV2.Tag:
 		return aws.StringValue(v.Key), aws.StringValue(v.Value)
+	case *opensearchservice.Tag:
+		return aws.StringValue(v.Key), aws.StringValue(v.Value)
 	default:
 		return "", ""
 	}
diff --git a/lib/cloud/aws/tags_helpers_test.go b/lib/cloud/aws/tags_helpers_test.go
index 5ca063c561a15..873f9ae1657c0 100644
--- a/lib/cloud/aws/tags_helpers_test.go
+++ b/lib/cloud/aws/tags_helpers_test.go
@@ -44,7 +44,6 @@ func TestTagsToLabels(t *testing.T) {
 				Value: aws.String("test"),
 			},
 		}
-		t.Log(inputTags)
 
 		expectLabels := map[string]string{
 			"Name":                        "test",
@@ -71,7 +70,6 @@ func TestTagsToLabels(t *testing.T) {
 				Value: aws.String("test"),
 			},
 		}
-		t.Log(inputTags)
 
 		expectLabels := map[string]string{
 			"Name":                        "test",
diff --git a/lib/cloud/clients.go b/lib/cloud/clients.go
index f099d075c38c7..df8eca26f05f1 100644
--- a/lib/cloud/clients.go
+++ b/lib/cloud/clients.go
@@ -45,6 +45,8 @@ import (
 	"github.com/aws/aws-sdk-go/service/iam/iamiface"
 	"github.com/aws/aws-sdk-go/service/memorydb"
 	"github.com/aws/aws-sdk-go/service/memorydb/memorydbiface"
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
+	"github.com/aws/aws-sdk-go/service/opensearchservice/opensearchserviceiface"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/aws/aws-sdk-go/service/rds/rdsiface"
 	"github.com/aws/aws-sdk-go/service/redshift"
@@ -109,6 +111,8 @@ type AWSClients interface {
 	GetAWSElastiCacheClient(ctx context.Context, region string, opts ...AWSAssumeRoleOptionFn) (elasticacheiface.ElastiCacheAPI, error)
 	// GetAWSMemoryDBClient returns AWS MemoryDB client for the specified region.
 	GetAWSMemoryDBClient(ctx context.Context, region string, opts ...AWSAssumeRoleOptionFn) (memorydbiface.MemoryDBAPI, error)
+	// GetAWSOpenSearchClient returns AWS OpenSearch client for the specified region.
+	GetAWSOpenSearchClient(ctx context.Context, region string, opts ...AWSAssumeRoleOptionFn) (opensearchserviceiface.OpenSearchServiceAPI, error)
 	// GetAWSSecretsManagerClient returns AWS Secrets Manager client for the specified region.
 	GetAWSSecretsManagerClient(ctx context.Context, region string, opts ...AWSAssumeRoleOptionFn) (secretsmanageriface.SecretsManagerAPI, error)
 	// GetAWSIAMClient returns AWS IAM client for the specified region.
@@ -333,6 +337,15 @@ func (c *cloudClients) GetAWSElastiCacheClient(ctx context.Context, region strin
 	return elasticache.New(session), nil
 }
 
+// GetAWSOpenSearchClient returns AWS OpenSearch client for the specified region.
+func (c *cloudClients) GetAWSOpenSearchClient(ctx context.Context, region string, opts ...AWSAssumeRoleOptionFn) (opensearchserviceiface.OpenSearchServiceAPI, error) {
+	session, err := c.GetAWSSession(ctx, region, opts...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return opensearchservice.New(session), nil
+}
+
 // GetAWSMemoryDBClient returns AWS MemoryDB client for the specified region.
 func (c *cloudClients) GetAWSMemoryDBClient(ctx context.Context, region string, opts ...AWSAssumeRoleOptionFn) (memorydbiface.MemoryDBAPI, error) {
 	session, err := c.GetAWSSession(ctx, region, opts...)
@@ -759,6 +772,7 @@ type TestCloudClients struct {
 	Redshift                redshiftiface.RedshiftAPI
 	RedshiftServerless      redshiftserverlessiface.RedshiftServerlessAPI
 	ElastiCache             elasticacheiface.ElastiCacheAPI
+	OpenSearch              opensearchserviceiface.OpenSearchServiceAPI
 	MemoryDB                memorydbiface.MemoryDBAPI
 	SecretsManager          secretsmanageriface.SecretsManagerAPI
 	IAM                     iamiface.IAMAPI
@@ -856,6 +870,15 @@ func (c *TestCloudClients) GetAWSElastiCacheClient(ctx context.Context, region s
 	return c.ElastiCache, nil
 }
 
+// GetAWSOpenSearchClient returns AWS OpenSearch client for the specified region.
+func (c *TestCloudClients) GetAWSOpenSearchClient(ctx context.Context, region string, opts ...AWSAssumeRoleOptionFn) (opensearchserviceiface.OpenSearchServiceAPI, error) {
+	_, err := c.GetAWSSession(ctx, region, opts...)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return c.OpenSearch, nil
+}
+
 // GetAWSMemoryDBClient returns AWS MemoryDB client for the specified region.
 func (c *TestCloudClients) GetAWSMemoryDBClient(ctx context.Context, region string, opts ...AWSAssumeRoleOptionFn) (memorydbiface.MemoryDBAPI, error) {
 	_, err := c.GetAWSSession(ctx, region, opts...)
diff --git a/lib/cloud/mocks/aws.go b/lib/cloud/mocks/aws.go
index a148051304af0..1fb0d979743de 100644
--- a/lib/cloud/mocks/aws.go
+++ b/lib/cloud/mocks/aws.go
@@ -33,6 +33,8 @@ import (
 	"github.com/aws/aws-sdk-go/service/iam/iamiface"
 	"github.com/aws/aws-sdk-go/service/memorydb"
 	"github.com/aws/aws-sdk-go/service/memorydb/memorydbiface"
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
+	"github.com/aws/aws-sdk-go/service/opensearchservice/opensearchserviceiface"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/aws/aws-sdk-go/service/rds/rdsiface"
 	"github.com/aws/aws-sdk-go/service/redshift"
@@ -683,6 +685,38 @@ func (m *ElastiCacheMock) ModifyUserWithContext(_ aws.Context, input *elasticach
 	return nil, trace.NotFound("user %s not found", aws.StringValue(input.UserId))
 }
 
+type OpenSearchMock struct {
+	opensearchserviceiface.OpenSearchServiceAPI
+
+	Domains   []*opensearchservice.DomainStatus
+	TagsByARN map[string][]*opensearchservice.Tag
+}
+
+func (o *OpenSearchMock) ListDomainNamesWithContext(aws.Context, *opensearchservice.ListDomainNamesInput, ...request.Option) (*opensearchservice.ListDomainNamesOutput, error) {
+	out := &opensearchservice.ListDomainNamesOutput{}
+	for _, domain := range o.Domains {
+		out.DomainNames = append(out.DomainNames, &opensearchservice.DomainInfo{
+			DomainName: domain.DomainName,
+			EngineType: aws.String("OpenSearch"),
+		})
+	}
+
+	return out, nil
+}
+
+func (o *OpenSearchMock) DescribeDomainsWithContext(aws.Context, *opensearchservice.DescribeDomainsInput, ...request.Option) (*opensearchservice.DescribeDomainsOutput, error) {
+	out := &opensearchservice.DescribeDomainsOutput{DomainStatusList: o.Domains}
+	return out, nil
+}
+
+func (o *OpenSearchMock) ListTagsWithContext(_ aws.Context, request *opensearchservice.ListTagsInput, _ ...request.Option) (*opensearchservice.ListTagsOutput, error) {
+	tags, found := o.TagsByARN[aws.StringValue(request.ARN)]
+	if !found {
+		return nil, trace.NotFound("tags not found")
+	}
+	return &opensearchservice.ListTagsOutput{TagList: tags}, nil
+}
+
 // MemoryDBMock mocks AWS MemoryDB API.
 type MemoryDBMock struct {
 	memorydbiface.MemoryDBAPI
diff --git a/lib/config/configuration.go b/lib/config/configuration.go
index 59c5be98ae357..7dbb2c035e83d 100644
--- a/lib/config/configuration.go
+++ b/lib/config/configuration.go
@@ -193,6 +193,25 @@ type CommandLineFlags struct {
 	AdditionalPrincipals string
 	// Directory to store
 	DataDir string
+
+	// IntegrationConfDeployServiceIAMArguments contains the arguments of
+	// `teleport integration configure deployservice-iam` command
+	IntegrationConfDeployServiceIAMArguments IntegrationConfDeployServiceIAM
+}
+
+// IntegrationConfDeployServiceIAM contains the arguments of
+// `teleport integration configure deployservice-iam` command
+type IntegrationConfDeployServiceIAM struct {
+	// Cluster is the teleport cluster name.
+	Cluster string
+	// Name is the integration name.
+	Name string
+	// Region is the AWS Region used to set up the client.
+	Region string
+	// Role is the AWS Role associated with the Integration
+	Role string
+	// TaskRole is the AWS Role to be used by the deployed service.
+	TaskRole string
 }
 
 // ReadConfigFile reads /etc/teleport.yaml (or whatever is passed via --config flag)
@@ -697,6 +716,16 @@ func applyAuthConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		cfg.Auth.Preference.SetDisconnectExpiredCert(fc.Auth.DisconnectExpiredCert.Value)
 	}
 
+	if fc.Auth.Assist != nil && fc.Auth.Assist.OpenAI != nil {
+		keyPath := fc.Auth.Assist.OpenAI.APITokenPath
+		key, err := os.ReadFile(keyPath)
+		if err != nil {
+			return trace.Errorf("failed to read OpenAI API key file: %w", err)
+		} else {
+			cfg.Auth.AssistAPIKey = strings.TrimSpace(string(key))
+		}
+	}
+
 	// Set cluster audit configuration from file configuration.
 	auditConfigSpec, err := services.ClusterAuditConfigSpecFromObject(fc.Storage.Params)
 	if err != nil {
@@ -1090,7 +1119,7 @@ func applyProxyConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		return trace.Wrap(err)
 	}
 	cfg.Proxy.ACME = *acme
-
+	cfg.Proxy.TrustXForwardedFor = fc.Proxy.TrustXForwardedFor.Value()
 	return nil
 }
 
@@ -1225,7 +1254,7 @@ func applySSHConfig(fc *FileConfig, cfg *servicecfg.Config) (err error) {
 // getInstallerProxyAddr determines the address of the proxy for discovered
 // nodes to connect to.
 func getInstallerProxyAddr(matcher AzureMatcher, fc *FileConfig) string {
-	if matcher.InstallParams.PublicProxyAddr != "" {
+	if matcher.InstallParams != nil && matcher.InstallParams.PublicProxyAddr != "" {
 		return matcher.InstallParams.PublicProxyAddr
 	}
 	if fc.ProxyServer != "" {
@@ -1247,21 +1276,21 @@ func applyDiscoveryConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		}
 
 		cfg.Discovery.AWSMatchers = append(cfg.Discovery.AWSMatchers,
-			services.AWSMatcher{
+			types.AWSMatcher{
 				Types:   matcher.Types,
 				Regions: matcher.Regions,
-				AssumeRole: services.AssumeRole{
+				AssumeRole: &types.AssumeRole{
 					RoleARN:    matcher.AssumeRoleARN,
 					ExternalID: matcher.ExternalID,
 				},
 				Tags:   matcher.Tags,
-				Params: installParams,
-				SSM:    &services.AWSSSM{DocumentName: matcher.SSM.DocumentName},
+				Params: &installParams,
+				SSM:    &types.AWSSSM{DocumentName: matcher.SSM.DocumentName},
 			})
 	}
 
 	for _, matcher := range fc.Discovery.AzureMatchers {
-		m := services.AzureMatcher{
+		m := types.AzureMatcher{
 			Subscriptions:  matcher.Subscriptions,
 			ResourceGroups: matcher.ResourceGroups,
 			Types:          matcher.Types,
@@ -1270,7 +1299,7 @@ func applyDiscoveryConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		}
 
 		if matcher.InstallParams != nil {
-			m.Params = services.InstallerParams{
+			m.Params = &types.InstallerParams{
 				JoinMethod:      matcher.InstallParams.JoinParams.Method,
 				JoinToken:       matcher.InstallParams.JoinParams.TokenName,
 				ScriptName:      matcher.InstallParams.ScriptName,
@@ -1283,7 +1312,7 @@ func applyDiscoveryConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	for _, matcher := range fc.Discovery.GCPMatchers {
 		cfg.Discovery.GCPMatchers = append(
 			cfg.Discovery.GCPMatchers,
-			services.GCPMatcher{
+			types.GCPMatcher{
 				Types:      matcher.Types,
 				Locations:  matcher.Locations,
 				Tags:       matcher.Tags,
@@ -1316,6 +1345,10 @@ func applyKubeConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		cfg.Kube.ResourceMatchers = append(cfg.Kube.ResourceMatchers,
 			services.ResourceMatcher{
 				Labels: matcher.Labels,
+				AWS: services.ResourceMatcherAWS{
+					AssumeRoleARN: matcher.AWS.AssumeRoleARN,
+					ExternalID:    matcher.AWS.ExternalID,
+				},
 			})
 	}
 
@@ -1352,15 +1385,19 @@ func applyDatabasesConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 		cfg.Databases.ResourceMatchers = append(cfg.Databases.ResourceMatchers,
 			services.ResourceMatcher{
 				Labels: matcher.Labels,
+				AWS: services.ResourceMatcherAWS{
+					AssumeRoleARN: matcher.AWS.AssumeRoleARN,
+					ExternalID:    matcher.AWS.ExternalID,
+				},
 			})
 	}
 	for _, matcher := range fc.Databases.AWSMatchers {
 		cfg.Databases.AWSMatchers = append(cfg.Databases.AWSMatchers,
-			services.AWSMatcher{
+			types.AWSMatcher{
 				Types:   matcher.Types,
 				Regions: matcher.Regions,
 				Tags:    matcher.Tags,
-				AssumeRole: services.AssumeRole{
+				AssumeRole: &types.AssumeRole{
 					RoleARN:    matcher.AssumeRoleARN,
 					ExternalID: matcher.ExternalID,
 				},
@@ -1368,7 +1405,7 @@ func applyDatabasesConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 	}
 	for _, matcher := range fc.Databases.AzureMatchers {
 		cfg.Databases.AzureMatchers = append(cfg.Databases.AzureMatchers,
-			services.AzureMatcher{
+			types.AzureMatcher{
 				Subscriptions:  matcher.Subscriptions,
 				ResourceGroups: matcher.ResourceGroups,
 				Types:          matcher.Types,
@@ -1512,6 +1549,9 @@ func applyAppsConfig(fc *FileConfig, cfg *servicecfg.Config) error {
 
 	// Configure resource watcher selectors if present.
 	for _, matcher := range fc.Apps.ResourceMatchers {
+		if matcher.AWS.AssumeRoleARN != "" {
+			return trace.NotImplemented("assume_role_arn is not supported for app resource matchers")
+		}
 		cfg.Apps.ResourceMatchers = append(cfg.Apps.ResourceMatchers,
 			services.ResourceMatcher{
 				Labels: matcher.Labels,
diff --git a/lib/config/configuration_test.go b/lib/config/configuration_test.go
index 16da9ae08dcce..cfa8f3940c419 100644
--- a/lib/config/configuration_test.go
+++ b/lib/config/configuration_test.go
@@ -219,8 +219,8 @@ func TestSampleConfig(t *testing.T) {
 	}
 }
 
-// TestBooleanParsing tests that boolean options
-// are parsed properly
+// TestBooleanParsing tests that types.Bool and *types.BoolOption are parsed
+// properly
 func TestBooleanParsing(t *testing.T) {
 	testCases := []struct {
 		s string
@@ -240,11 +240,15 @@ func TestBooleanParsing(t *testing.T) {
 		conf, err := ReadFromString(base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf(`
 teleport:
   advertise_ip: 10.10.10.1
+proxy_service:
+  enabled: yes
+  trust_x_forwarded_for: %v
 auth_service:
   enabled: yes
   disconnect_expired_cert: %v
-`, tc.s))))
+`, tc.s, tc.s))))
 		require.NoError(t, err, msg)
+		require.Equal(t, tc.b, conf.Proxy.TrustXForwardedFor.Value(), msg)
 		require.Equal(t, tc.b, conf.Auth.DisconnectExpiredCert.Value, msg)
 	}
 }
@@ -462,7 +466,16 @@ func TestConfigReading(t *testing.T) {
 			ResourceMatchers: []ResourceMatcher{
 				{
 					Labels: map[string]apiutils.Strings{
-						"*": {"*"},
+						"a": {"b"},
+					},
+				},
+				{
+					Labels: map[string]apiutils.Strings{
+						"c": {"d"},
+					},
+					AWS: ResourceMatcherAWS{
+						AssumeRoleARN: "arn:aws:iam::123456789012:role/DBAccess",
+						ExternalID:    "externalID123",
 					},
 				},
 			},
@@ -802,6 +815,7 @@ SREzU8onbBsjMg9QDiSf5oJLKvd/Ren+zGY7
 			LockingMode:           constants.LockingModeBestEffort,
 			AllowPasswordless:     types.NewBoolOption(true),
 			AllowHeadless:         types.NewBoolOption(true),
+			DefaultSessionTTL:     types.Duration(apidefaults.CertDuration),
 			IDP: &types.IdPOptions{
 				SAML: &types.IdPSAMLOptions{
 					Enabled: types.NewBoolOption(true),
@@ -817,8 +831,21 @@ SREzU8onbBsjMg9QDiSf5oJLKvd/Ren+zGY7
 	require.ElementsMatch(t, []string{"ca-pin-from-string", "ca-pin-from-file1", "ca-pin-from-file2"}, cfg.CAPins)
 
 	require.True(t, cfg.Databases.Enabled)
+	require.Empty(t, cmp.Diff(cfg.Databases.ResourceMatchers,
+		[]services.ResourceMatcher{
+			{
+				Labels: map[string]apiutils.Strings{
+					"*": {"*"},
+				},
+				AWS: services.ResourceMatcherAWS{
+					AssumeRoleARN: "arn:aws:iam::123456789012:role/DBAccess",
+					ExternalID:    "externalID123",
+				},
+			},
+		},
+	))
 	require.Empty(t, cmp.Diff(cfg.Databases.AzureMatchers,
-		[]services.AzureMatcher{
+		[]types.AzureMatcher{
 			{
 				Subscriptions:  []string{"sub1", "sub2"},
 				ResourceGroups: []string{"group1", "group2"},
@@ -839,11 +866,11 @@ SREzU8onbBsjMg9QDiSf5oJLKvd/Ren+zGY7
 			},
 		}))
 	require.Empty(t, cmp.Diff(cfg.Databases.AWSMatchers,
-		[]services.AWSMatcher{
+		[]types.AWSMatcher{
 			{
 				Types:   []string{"rds"},
 				Regions: []string{"us-west-1"},
-				AssumeRole: services.AssumeRole{
+				AssumeRole: &types.AssumeRole{
 					RoleARN:    "arn:aws:iam::123456789012:role/DBDiscoverer",
 					ExternalID: "externalID123",
 				},
@@ -872,7 +899,7 @@ SREzU8onbBsjMg9QDiSf5oJLKvd/Ren+zGY7
 	require.Equal(t, cfg.Discovery.AWSMatchers[0].Types, []string{"ec2"})
 	require.Equal(t, cfg.Discovery.AWSMatchers[0].AssumeRole.RoleARN, "arn:aws:iam::123456789012:role/DBDiscoverer")
 	require.Equal(t, cfg.Discovery.AWSMatchers[0].AssumeRole.ExternalID, "externalID123")
-	require.Equal(t, cfg.Discovery.AWSMatchers[0].Params, services.InstallerParams{
+	require.Equal(t, cfg.Discovery.AWSMatchers[0].Params, &types.InstallerParams{
 		InstallTeleport: true,
 		JoinMethod:      "iam",
 		JoinToken:       defaults.IAMInviteTokenName,
@@ -1553,7 +1580,14 @@ func makeConfigFixture() string {
 	}
 	conf.Databases.ResourceMatchers = []ResourceMatcher{
 		{
-			Labels: map[string]apiutils.Strings{"*": {"*"}},
+			Labels: map[string]apiutils.Strings{"a": {"b"}},
+		},
+		{
+			Labels: map[string]apiutils.Strings{"c": {"d"}},
+			AWS: ResourceMatcherAWS{
+				AssumeRoleARN: "arn:aws:iam::123456789012:role/DBAccess",
+				ExternalID:    "externalID123",
+			},
 		},
 	}
 	conf.Databases.AWSMatchers = []AWSMatcher{
@@ -2304,6 +2338,24 @@ app_service:
 			inComment: "config is missing internal address",
 			outError:  true,
 		},
+		{
+			inConfigString: `
+app_service:
+  enabled: true
+  apps:
+    -
+      name: foo
+      public_addr: "foo.example.com"
+      uri: "http://127.0.0.1:8080"
+  resources:
+  - labels:
+      '*': '*'
+    aws:
+      assume_role_arn: "arn:aws:iam::123456789012:role/AppAccess"
+`,
+			inComment: "assume_role_arn is not supported",
+			outError:  true,
+		},
 	}
 
 	for _, tt := range tests {
@@ -2450,7 +2502,7 @@ func TestAppsCLF(t *testing.T) {
 			outApps:   nil,
 			requireError: func(t require.TestingT, err error, i ...interface{}) {
 				require.True(t, trace.IsBadParameter(err))
-				require.ErrorContains(t, err, "application name \"-foo\" must be a valid DNS subdomain: https://goteleport.com/teleport/docs/application-access/#application-name")
+				require.ErrorContains(t, err, "application name \"-foo\" must be a valid DNS subdomain: https://goteleport.com/docs/application-access/guides/connecting-apps/#application-name")
 			},
 		},
 		{
@@ -3391,7 +3443,7 @@ func TestApplyConfig_JamfService(t *testing.T) {
 	const password = "supersecret!!1!"
 	passwordFile := filepath.Join(tempDir, "test_jamf_password.txt")
 	require.NoError(t,
-		os.WriteFile(passwordFile, []byte(password+"\n"), 0400),
+		os.WriteFile(passwordFile, []byte(password+"\n"), 0o400),
 		"WriteFile(%q) failed", passwordFile)
 
 	minimalYAML := fmt.Sprintf(`
@@ -3705,11 +3757,11 @@ func TestApplyDiscoveryConfig(t *testing.T) {
 			},
 			expectedDiscovery: servicecfg.DiscoveryConfig{
 				Enabled: true,
-				AzureMatchers: []services.AzureMatcher{
+				AzureMatchers: []types.AzureMatcher{
 					{
 						Subscriptions: []string{"abcd"},
 						Types:         []string{"aks", "vm"},
-						Params: services.InstallerParams{
+						Params: &types.InstallerParams{
 							JoinMethod:      "azure",
 							JoinToken:       "azure-token",
 							ScriptName:      "default-installer",
@@ -3731,7 +3783,7 @@ func TestApplyDiscoveryConfig(t *testing.T) {
 			},
 			expectedDiscovery: servicecfg.DiscoveryConfig{
 				Enabled: true,
-				AzureMatchers: []services.AzureMatcher{
+				AzureMatchers: []types.AzureMatcher{
 					{
 						Subscriptions: []string{"abcd"},
 						Types:         []string{"aks"},
@@ -3941,3 +3993,127 @@ proxy_service:
 		})
 	}
 }
+
+func TestApplyKubeConfig(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name              string
+		inputFileConfig   Kube
+		wantServiceConfig servicecfg.KubeConfig
+		wantError         bool
+	}{
+		{
+			name: "invalid listener address",
+			inputFileConfig: Kube{
+				Service: Service{
+					ListenAddress: "0.0.0.0:a",
+				},
+				KubeconfigFile: "path-to-kubeconfig",
+			},
+			wantError: true,
+		},
+		{
+			name: "assume_role_arn is not supported",
+			inputFileConfig: Kube{
+				Service: Service{
+					ListenAddress: "0.0.0.0:8888",
+				},
+				KubeconfigFile: "path-to-kubeconfig",
+				ResourceMatchers: []ResourceMatcher{
+					{
+						Labels: map[string]apiutils.Strings{"a": {"b"}},
+						AWS: ResourceMatcherAWS{
+							AssumeRoleARN: "arn:aws:iam::123456789012:role/KubeAccess",
+							ExternalID:    "externalID123",
+						},
+					},
+				},
+			},
+			wantError: false,
+			wantServiceConfig: servicecfg.KubeConfig{
+				ListenAddr:     utils.MustParseAddr("0.0.0.0:8888"),
+				KubeconfigPath: "path-to-kubeconfig",
+				ResourceMatchers: []services.ResourceMatcher{
+					{
+						Labels: map[string]apiutils.Strings{"a": {"b"}},
+						AWS: services.ResourceMatcherAWS{
+							AssumeRoleARN: "arn:aws:iam::123456789012:role/KubeAccess",
+							ExternalID:    "externalID123",
+						},
+					},
+				},
+				Limiter: limiter.Config{
+					MaxConnections:   defaults.LimiterMaxConnections,
+					MaxNumberOfUsers: 250,
+				},
+			},
+		},
+		{
+			name: "valid",
+			inputFileConfig: Kube{
+				Service: Service{
+					ListenAddress: "0.0.0.0:8888",
+				},
+				PublicAddr:      apiutils.Strings{"example.com", "example.with.port.com:4444"},
+				KubeconfigFile:  "path-to-kubeconfig",
+				KubeClusterName: "kube-name",
+				ResourceMatchers: []ResourceMatcher{{
+					Labels: map[string]apiutils.Strings{"a": {"b"}},
+				}},
+				StaticLabels: map[string]string{
+					"env":     "dev",
+					"product": "test",
+				},
+				DynamicLabels: []CommandLabel{{
+					Name:    "hostname",
+					Command: []string{"hostname"},
+					Period:  time.Hour,
+				}},
+			},
+			wantServiceConfig: servicecfg.KubeConfig{
+				ListenAddr:      utils.MustParseAddr("0.0.0.0:8888"),
+				PublicAddrs:     []utils.NetAddr{*utils.MustParseAddr("example.com:3026"), *utils.MustParseAddr("example.with.port.com:4444")},
+				KubeconfigPath:  "path-to-kubeconfig",
+				KubeClusterName: "kube-name",
+				ResourceMatchers: []services.ResourceMatcher{
+					{
+						Labels: map[string]apiutils.Strings{"a": {"b"}},
+					},
+				},
+				StaticLabels: map[string]string{
+					"env":     "dev",
+					"product": "test",
+				},
+				DynamicLabels: services.CommandLabels{
+					"hostname": &types.CommandLabelV2{
+						Period:  types.Duration(time.Hour),
+						Command: []string{"hostname"},
+					},
+				},
+				Limiter: limiter.Config{
+					MaxConnections:   defaults.LimiterMaxConnections,
+					MaxNumberOfUsers: 250,
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			fc, err := ReadConfig(bytes.NewBufferString(NoServicesConfigString))
+			require.NoError(t, err)
+			fc.Kube = test.inputFileConfig
+			fc.Kube.EnabledFlag = "yes"
+
+			cfg := servicecfg.MakeDefaultConfig()
+			err = applyKubeConfig(fc, cfg)
+			if test.wantError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, test.wantServiceConfig, cfg.Kube)
+			}
+		})
+	}
+}
diff --git a/lib/config/database.go b/lib/config/database.go
index ff82d0b7e87a0..4bc8ba2a5daf4 100644
--- a/lib/config/database.go
+++ b/lib/config/database.go
@@ -75,7 +75,7 @@ db_service:
   {{- end }}
 
   # Matchers for registering AWS-hosted databases.
-  {{- if or .RDSDiscoveryRegions .RDSProxyDiscoveryRegions .RedshiftDiscoveryRegions .RedshiftServerlessDiscoveryRegions .ElastiCacheDiscoveryRegions .MemoryDBDiscoveryRegions}}
+  {{- if or .RDSDiscoveryRegions .RDSProxyDiscoveryRegions .RedshiftDiscoveryRegions .RedshiftServerlessDiscoveryRegions .ElastiCacheDiscoveryRegions .MemoryDBDiscoveryRegions .OpenSearchDiscoveryRegions}}
   aws:
   {{- else }}
   # For more information about AWS auto-discovery:
@@ -84,6 +84,7 @@ db_service:
   # Redshift: https://goteleport.com/docs/database-access/guides/postgres-redshift/
   # Redshift Serverless: https://goteleport.com/docs/database-access/guides/postgres-redshift-serverless/
   # ElastiCache/MemoryDB: https://goteleport.com/docs/database-access/guides/redis-aws/
+  # OpenSearch: https://goteleport.com/docs/database-access/guides/aws-opensearch/
   #
   # aws:
   #   # Database types. Valid options are:
@@ -93,7 +94,8 @@ db_service:
   #   # 'redshift-serverless' - discovers and registers AWS Redshift Serverless databases.
   #   # 'elasticache' - discovers and registers AWS ElastiCache Redis databases.
   #   # 'memorydb' - discovers and registers AWS MemoryDB Redis databases.
-  # - types: ["rds", "rdsproxy","redshift", "redshift-serverless", "elasticache", "memorydb"]
+  #   # 'opensearch' - discovers and registers AWS OpenSearch domains.
+  # - types: ["rds", "rdsproxy", "redshift", "redshift-serverless", "elasticache", "memorydb", "opensearch"]
   #   # AWS regions to register databases from.
   #   regions: ["us-west-1", "us-east-2"]
   #   # AWS resource tags to match when registering databases.
@@ -190,6 +192,21 @@ db_service:
       "{{ $name }}": "{{ $value }}"
     {{- end }}
   {{- end }}
+  {{- if .OpenSearchDiscoveryRegions }}
+  # OpenSearch databases auto-discovery.
+  # For more information about OpenSearch auto-discovery: https://goteleport.com/docs/database-access/guides/aws-opensearch/
+  - types: ["opensearch"]
+    # AWS regions to register databases from.
+    regions:
+    {{- range .OpenSearchDiscoveryRegions }}
+    - "{{ . }}"
+    {{- end }}
+    # AWS resource tags to match when registering databases.
+    tags:
+    {{- range $name, $value := .AWSTags }}
+      "{{ $name }}": "{{ $value }}"
+    {{- end }}
+  {{- end }}
 
   # Matchers for registering Azure-hosted databases.
   {{- if or .AzureMySQLDiscoveryRegions .AzurePostgresDiscoveryRegions .AzureRedisDiscoveryRegions .AzureSQLServerDiscoveryRegions }}
@@ -488,6 +505,17 @@ db_service:
   #     memorydb:
   #       # MemoryDB cluster name.
   #       cluster_name: my-memorydb
+  # # OpenSearch database static configuration.
+  # - name: opensearch
+  #   description: AWS OpenSearch domain configuration example.
+  #   protocol: opensearch
+  #   # Database connection endpoint. Must be reachable from Database service.
+  #   uri: search-my-domain-xxxxxx.us-east-1.es.amazonaws.com:443
+  #   # AWS specific configuration.
+  #   aws:
+  #     # Region the database is deployed in.
+  #     region: us-east-1
+  #     account_id: "123456789000"
   # # Self-hosted static configuration.
   # - name: self-hosted
   #   description: Self-hosted database configuration.
@@ -573,6 +601,9 @@ type DatabaseSampleFlags struct {
 	// MemoryDBDiscoveryRegions is a list of regions the MemoryDB
 	// auto-discovery is configured.
 	MemoryDBDiscoveryRegions []string
+	// OpenSearchDiscoveryRegions is a list of regions the OpenSearch
+	// auto-discovery is configured.
+	OpenSearchDiscoveryRegions []string
 	// AWSTags is the list of the AWS resource tags used for AWS discoveries.
 	AWSTags map[string]string
 	// AWSRawTags is the "raw" list of AWS resource tags used for AWS discoveries.
diff --git a/lib/config/database_test.go b/lib/config/database_test.go
index 08f86a40df6a7..bd8f7caa5f7d9 100644
--- a/lib/config/database_test.go
+++ b/lib/config/database_test.go
@@ -123,6 +123,18 @@ func TestMakeDatabaseConfig(t *testing.T) {
 		require.ElementsMatch(t, flags.MemoryDBDiscoveryRegions, databases.AWSMatchers[0].Regions)
 	})
 
+	t.Run("OpenSearchAutoDiscovery", func(t *testing.T) {
+		t.Parallel()
+		flags := DatabaseSampleFlags{
+			OpenSearchDiscoveryRegions: []string{"us-west-1", "us-west-2"},
+		}
+
+		databases := generateAndParseConfig(t, flags)
+		require.Len(t, databases.AWSMatchers, 1)
+		require.ElementsMatch(t, []string{"opensearch"}, databases.AWSMatchers[0].Types)
+		require.ElementsMatch(t, flags.OpenSearchDiscoveryRegions, databases.AWSMatchers[0].Regions)
+	})
+
 	t.Run("AWS discovery tags", func(t *testing.T) {
 		t.Parallel()
 		flags := DatabaseSampleFlags{
@@ -352,7 +364,7 @@ func TestMakeDatabaseConfig(t *testing.T) {
 				flags: DatabaseSampleFlags{
 					StaticDatabaseName:     "",
 					StaticDatabaseProtocol: "postgres",
-					StaticDatabaseURI:      "postgres://localhost:5432",
+					StaticDatabaseURI:      "localhost:5432",
 				},
 				requireFn: require.Error,
 			},
@@ -360,7 +372,7 @@ func TestMakeDatabaseConfig(t *testing.T) {
 				flags: DatabaseSampleFlags{
 					StaticDatabaseName:     "sample",
 					StaticDatabaseProtocol: "",
-					StaticDatabaseURI:      "postgres://localhost:5432",
+					StaticDatabaseURI:      "localhost:5432",
 				},
 				requireFn: require.Error,
 			},
@@ -372,11 +384,19 @@ func TestMakeDatabaseConfig(t *testing.T) {
 				},
 				requireFn: require.Error,
 			},
+			"BadURI": {
+				flags: DatabaseSampleFlags{
+					StaticDatabaseName:     "sample",
+					StaticDatabaseProtocol: "postgres",
+					StaticDatabaseURI:      "postgres://localhost:5432",
+				},
+				requireFn: require.Error,
+			},
 			"InvalidLabels": {
 				flags: DatabaseSampleFlags{
 					StaticDatabaseName:      "sample",
 					StaticDatabaseProtocol:  "postgres",
-					StaticDatabaseURI:       "postgres://localhost:5432",
+					StaticDatabaseURI:       "localhost:5432",
 					StaticDatabaseRawLabels: "abc",
 				},
 				requireFn: require.Error,
diff --git a/lib/config/fileconf.go b/lib/config/fileconf.go
index 039fc01b6c472..0b90be8bf8dc0 100644
--- a/lib/config/fileconf.go
+++ b/lib/config/fileconf.go
@@ -536,7 +536,7 @@ func checkAndSetDefaultsForAWSMatchers(matcherInput []AWSMatcher) error {
 			matcher.Tags = map[string]apiutils.Strings{types.Wildcard: {types.Wildcard}}
 		}
 
-		var installParams services.InstallerParams
+		var installParams types.InstallerParams
 		var err error
 
 		if matcher.InstallParams == nil {
@@ -1013,6 +1013,9 @@ type Auth struct {
 	// HostedPlugins configures the hosted plugins runtime.
 	// This is currently Cloud-specific.
 	HostedPlugins HostedPlugins `yaml:"hosted_plugins,omitempty"`
+
+	// Assist is a set of options related to the Teleport Assist feature.
+	Assist *AssistOptions `yaml:"assist,omitempty"`
 }
 
 // PluginService represents the configuration for the plugin service.
@@ -1201,6 +1204,9 @@ type AuthenticationConfig struct {
 	// DeviceTrust holds settings related to trusted device verification.
 	// Requires Teleport Enterprise.
 	DeviceTrust *DeviceTrust `yaml:"device_trust,omitempty"`
+
+	// DefaultSessionTTL is the default cluster max session ttl
+	DefaultSessionTTL types.Duration `yaml:"default_session_ttl"`
 }
 
 // Parse returns valid types.AuthPreference instance.
@@ -1243,6 +1249,7 @@ func (a *AuthenticationConfig) Parse() (types.AuthPreference, error) {
 		AllowPasswordless: a.Passwordless,
 		AllowHeadless:     a.Headless,
 		DeviceTrust:       dt,
+		DefaultSessionTTL: a.DefaultSessionTTL,
 	})
 }
 
@@ -1706,6 +1713,18 @@ type Databases struct {
 type ResourceMatcher struct {
 	// Labels match resource labels.
 	Labels map[string]apiutils.Strings `yaml:"labels,omitempty"`
+	// AWS contains AWS specific settings.
+	AWS ResourceMatcherAWS `yaml:"aws,omitempty"`
+}
+
+// ResourceMatcherAWS contains AWS specific settings for resource matcher.
+type ResourceMatcherAWS struct {
+	// AssumeRoleARN is the AWS role to assume to before accessing the
+	// database.
+	AssumeRoleARN string `yaml:"assume_role_arn,omitempty"`
+	// ExternalID is an optional AWS external ID used to enable assuming an AWS
+	// role across accounts.
+	ExternalID string `yaml:"external_id,omitempty"`
 }
 
 // AWSMatcher matches AWS EC2 instances and AWS Databases
@@ -1747,8 +1766,8 @@ type InstallParams struct {
 	PublicProxyAddr string `yaml:"public_proxy_addr,omitempty"`
 }
 
-func (ip *InstallParams) Parse() (services.InstallerParams, error) {
-	install := services.InstallerParams{
+func (ip *InstallParams) Parse() (types.InstallerParams, error) {
+	install := types.InstallerParams{
 		JoinMethod:      ip.JoinParams.Method,
 		JoinToken:       ip.JoinParams.TokenName,
 		ScriptName:      ip.ScriptName,
@@ -1763,7 +1782,7 @@ func (ip *InstallParams) Parse() (services.InstallerParams, error) {
 	var err error
 	install.InstallTeleport, err = apiutils.ParseBool(ip.InstallTeleport)
 	if err != nil {
-		return services.InstallerParams{}, trace.Wrap(err)
+		return types.InstallerParams{}, trace.Wrap(err)
 	}
 
 	return install, nil
@@ -2102,6 +2121,11 @@ type Proxy struct {
 
 	// Assist is a set of options related to the Teleport Assist feature.
 	Assist *AssistOptions `yaml:"assist,omitempty"`
+
+	// TrustXForwardedFor enables the service to take client source IPs from
+	// the "X-Forwarded-For" headers for web APIs received from layer 7 load
+	// balancers or reverse proxies.
+	TrustXForwardedFor types.Bool `yaml:"trust_x_forwarded_for,omitempty"`
 }
 
 // UIConfig provides config options for the web UI served by the proxy service.
@@ -2425,7 +2449,7 @@ type JamfService struct {
 	// ExitOnSync tells the service to exit immediately after the first sync.
 	ExitOnSync bool `yaml:"exit_on_sync,omitempty"`
 	// APIEndpoint is the Jamf Pro API endpoint.
-	// Example: "https://yourtenant.jamfcloud.com".
+	// Example: "https://yourtenant.jamfcloud.com/api".
 	APIEndpoint string `yaml:"api_endpoint,omitempty"`
 	// Username is the Jamf Pro API username.
 	Username string `yaml:"username,omitempty"`
diff --git a/lib/config/openssh/openssh.go b/lib/config/openssh/openssh.go
index d9d11a1b8a882..331ea086742be 100644
--- a/lib/config/openssh/openssh.go
+++ b/lib/config/openssh/openssh.go
@@ -49,9 +49,9 @@ Host *.{{ $clusterName }} {{ $dot.ProxyHost }}
 Host *.{{ $clusterName }} !{{ $dot.ProxyHost }}
     Port 3022
     {{- if eq $dot.AppName "tsh" }}
-    ProxyCommand "{{ $dot.ExecutablePath }}" proxy ssh --cluster={{ $clusterName }} --proxy={{ $dot.ProxyHost }} %r@%h:%p
+    ProxyCommand "{{ $dot.ExecutablePath }}" proxy ssh --cluster={{ $clusterName }} --proxy={{ $dot.ProxyHost }}:{{ $dot.ProxyPort }} %r@%h:%p
 {{- end }}{{- if eq $dot.AppName "tbot" }}
-    ProxyCommand "{{ $dot.ExecutablePath }}" proxy --destination-dir={{ $dot.DestinationDir }} --proxy={{ $dot.ProxyHost }} ssh --cluster={{ $clusterName }}  %r@%h:%p
+    ProxyCommand "{{ $dot.ExecutablePath }}" proxy --destination-dir={{ $dot.DestinationDir }} --proxy={{ $dot.ProxyHost }}:{{ $dot.ProxyPort }} ssh --cluster={{ $clusterName }}  %r@%h:%p
 {{- end }}
 {{- end }}
 
@@ -66,6 +66,7 @@ type SSHConfigParameters struct {
 	IdentityFilePath    string
 	CertificateFilePath string
 	ProxyHost           string
+	ProxyPort           string
 	ExecutablePath      string
 	DestinationDir      string
 }
diff --git a/lib/config/openssh/openssh_test.go b/lib/config/openssh/openssh_test.go
index fc611dbe2a1d2..7d34fb04da2fc 100644
--- a/lib/config/openssh/openssh_test.go
+++ b/lib/config/openssh/openssh_test.go
@@ -89,6 +89,7 @@ func TestSSHConfig_GetSSHConfig(t *testing.T) {
 				IdentityFilePath:    "/home/alice/.tsh/keys/example.com/bob",
 				CertificateFilePath: "/home/alice/.tsh/keys/example.com/bob-ssh/example.com-cert.pub",
 				ProxyHost:           "proxy.example.com",
+				ProxyPort:           "443",
 				ExecutablePath:      "/tmp/tsh",
 			},
 		},
@@ -102,6 +103,7 @@ func TestSSHConfig_GetSSHConfig(t *testing.T) {
 				IdentityFilePath:    "/home/alice/.tsh/keys/example.com/bob",
 				CertificateFilePath: "/home/alice/.tsh/keys/example.com/bob-ssh/example.com-cert.pub",
 				ProxyHost:           "proxy.example.com",
+				ProxyPort:           "443",
 				ExecutablePath:      "/tmp/tsh",
 			},
 		},
@@ -115,6 +117,7 @@ func TestSSHConfig_GetSSHConfig(t *testing.T) {
 				IdentityFilePath:    "/home/alice/.tsh/keys/example.com/bob",
 				CertificateFilePath: "/home/alice/.tsh/keys/example.com/bob-ssh/example.com-cert.pub",
 				ProxyHost:           "proxy.example.com",
+				ProxyPort:           "443",
 				ExecutablePath:      "/tmp/tsh",
 			},
 		},
diff --git a/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/legacy_OpenSSH_-_single_cluster.golden b/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/legacy_OpenSSH_-_single_cluster.golden
index 4797ecd1a0e81..15da15c68c9b7 100644
--- a/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/legacy_OpenSSH_-_single_cluster.golden
+++ b/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/legacy_OpenSSH_-_single_cluster.golden
@@ -10,6 +10,6 @@ Host *.example.com proxy.example.com
 # Flags for all example.com hosts except the proxy
 Host *.example.com !proxy.example.com
     Port 3022
-    ProxyCommand "/tmp/tsh" proxy ssh --cluster=example.com --proxy=proxy.example.com %r@%h:%p
+    ProxyCommand "/tmp/tsh" proxy ssh --cluster=example.com --proxy=proxy.example.com:443 %r@%h:%p
 
 # End generated Teleport configuration
diff --git a/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/modern_OpenSSH_-_multiple_clusters.golden b/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/modern_OpenSSH_-_multiple_clusters.golden
index ceaca490e07b7..9875d49528a65 100644
--- a/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/modern_OpenSSH_-_multiple_clusters.golden
+++ b/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/modern_OpenSSH_-_multiple_clusters.golden
@@ -10,7 +10,7 @@ Host *.root proxy.example.com
 # Flags for all root hosts except the proxy
 Host *.root !proxy.example.com
     Port 3022
-    ProxyCommand "/tmp/tsh" proxy ssh --cluster=root --proxy=proxy.example.com %r@%h:%p
+    ProxyCommand "/tmp/tsh" proxy ssh --cluster=root --proxy=proxy.example.com:443 %r@%h:%p
 # Common flags for all leaf hosts
 Host *.leaf proxy.example.com
     UserKnownHostsFile "/home/alice/.tsh/known_hosts"
@@ -21,6 +21,6 @@ Host *.leaf proxy.example.com
 # Flags for all leaf hosts except the proxy
 Host *.leaf !proxy.example.com
     Port 3022
-    ProxyCommand "/tmp/tsh" proxy ssh --cluster=leaf --proxy=proxy.example.com %r@%h:%p
+    ProxyCommand "/tmp/tsh" proxy ssh --cluster=leaf --proxy=proxy.example.com:443 %r@%h:%p
 
 # End generated Teleport configuration
diff --git a/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/modern_OpenSSH_-_single_cluster.golden b/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/modern_OpenSSH_-_single_cluster.golden
index de95d49fc5d30..f2cab475b57c2 100644
--- a/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/modern_OpenSSH_-_single_cluster.golden
+++ b/lib/config/openssh/testdata/TestSSHConfig_GetSSHConfig/modern_OpenSSH_-_single_cluster.golden
@@ -10,6 +10,6 @@ Host *.example.com proxy.example.com
 # Flags for all example.com hosts except the proxy
 Host *.example.com !proxy.example.com
     Port 3022
-    ProxyCommand "/tmp/tsh" proxy ssh --cluster=example.com --proxy=proxy.example.com %r@%h:%p
+    ProxyCommand "/tmp/tsh" proxy ssh --cluster=example.com --proxy=proxy.example.com:443 %r@%h:%p
 
 # End generated Teleport configuration
diff --git a/lib/config/testdata_test.go b/lib/config/testdata_test.go
index 604711a7c29bb..ef3dc1c5db426 100644
--- a/lib/config/testdata_test.go
+++ b/lib/config/testdata_test.go
@@ -170,6 +170,9 @@ db_service:
   resources:
     - labels:
         "*": "*"
+      aws:
+        assume_role_arn: "arn:aws:iam::123456789012:role/DBAccess"
+        external_id: "externalID123"
   azure:
     - subscriptions: ["sub1", "sub2"]
       resource_groups: ["group1", "group2"]
diff --git a/lib/configurators/aws/aws.go b/lib/configurators/aws/aws.go
index 8f5703cdedc74..9715a7ffa491d 100644
--- a/lib/configurators/aws/aws.go
+++ b/lib/configurators/aws/aws.go
@@ -35,6 +35,7 @@ import (
 	"github.com/gravitational/trace"
 	"golang.org/x/exp/slices"
 
+	"github.com/gravitational/teleport/api/types"
 	apiawsutils "github.com/gravitational/teleport/api/utils/aws"
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
 	"github.com/gravitational/teleport/lib/configurators"
@@ -108,10 +109,6 @@ func (a databaseActions) buildStatement(boundary bool) *awslib.Statement {
 var (
 	// defaultPolicyTags default list of tags present at the managed policies.
 	defaultPolicyTags = map[string]string{policyTeleportTagKey: policyTeleportTagValue}
-	// userBaseActions list of actions used when target is an user.
-	userBaseActions = []string{"iam:GetUserPolicy", "iam:PutUserPolicy", "iam:DeleteUserPolicy"}
-	// roleBaseActions list of actions used when target is a role.
-	roleBaseActions = []string{"iam:GetRolePolicy", "iam:PutRolePolicy", "iam:DeleteRolePolicy"}
 	// secretsManagerActions is a list of actions used for SecretsManager.
 	secretsManagerActions = []string{
 		"secretsmanager:DescribeSecret",
@@ -697,7 +694,7 @@ func buildSSMDocumentCreators(ssm ssmiface.SSMAPI, targetCfg targetConfig, proxy
 	return creators
 }
 
-func isEC2AutoDiscoveryEnabled(flags configurators.BootstrapFlags, matchers []services.AWSMatcher) bool {
+func isEC2AutoDiscoveryEnabled(flags configurators.BootstrapFlags, matchers []types.AWSMatcher) bool {
 	if flags.ForceEC2Permissions {
 		return true
 	}
@@ -794,8 +791,8 @@ func hasDynamoDBDatabases(flags configurators.BootstrapFlags, targetCfg targetCo
 
 // isAutoDiscoveryEnabledForMatcher returns true if provided AWS matcher type
 // is found.
-func isAutoDiscoveryEnabledForMatcher(matcherType string, matchers []services.AWSMatcher) bool {
-	return findAWSMatcherIs(matchers, func(matcher *services.AWSMatcher) bool {
+func isAutoDiscoveryEnabledForMatcher(matcherType string, matchers []types.AWSMatcher) bool {
+	return findAWSMatcherIs(matchers, func(matcher *types.AWSMatcher) bool {
 		for _, databaseType := range matcher.Types {
 			if databaseType == matcherType {
 				return true
@@ -826,7 +823,7 @@ func findDatabaseIs(databases []*servicecfg.Database, is func(*servicecfg.Databa
 
 // findAWSMatcherIs returns true if the provided check returns true for any
 // AWS matcher.
-func findAWSMatcherIs(matchers []services.AWSMatcher, is func(*services.AWSMatcher) bool) bool {
+func findAWSMatcherIs(matchers []types.AWSMatcher, is func(*types.AWSMatcher) bool) bool {
 	for i := range matchers {
 		if is(&matchers[i]) {
 			return true
@@ -837,7 +834,7 @@ func findAWSMatcherIs(matchers []services.AWSMatcher, is func(*services.AWSMatch
 
 // supportsAWSAssumeRole returns true if the given matcher supports assuming
 // AWS roles. Currently limited to just the AWS database matchers.
-func supportsAWSAssumeRole(matcher services.AWSMatcher) bool {
+func supportsAWSAssumeRole(matcher types.AWSMatcher) bool {
 	for _, matcherType := range matcher.Types {
 		if slices.Contains(services.SupportedAWSDatabaseMatchers, matcherType) {
 			return true
@@ -867,21 +864,20 @@ func isRDSProxyEndpoint(uri string) bool {
 // buildIAMEditStatements returns IAM statements necessary for the Teleport
 // agent to edit user/role permissions.
 func buildIAMEditStatements(target awslib.Identity) ([]*awslib.Statement, error) {
-	statement := &awslib.Statement{
-		Effect:    awslib.EffectAllow,
-		Resources: []string{target.String()},
-	}
-
 	switch target.(type) {
 	case awslib.User, *awslib.User:
-		statement.Actions = userBaseActions
+		return []*awslib.Statement{
+			awslib.StatementForIAMEditUserPolicy(target.String()),
+		}, nil
+
 	case awslib.Role, *awslib.Role:
-		statement.Actions = roleBaseActions
+		return []*awslib.Statement{
+			awslib.StatementForIAMEditRolePolicy(target.String()),
+		}, nil
+
 	default:
 		return nil, trace.BadParameter("policies target must be an user or role, received %T", target)
 	}
-
-	return []*awslib.Statement{statement}, nil
 }
 
 // buildEC2AutoDiscoveryStatements returns IAM statements necessary for
@@ -1035,7 +1031,7 @@ type targetConfig struct {
 	// identity is the target identity.
 	identity awslib.Identity
 	// awsMatchers are the AWS matchers associated with the target identity.
-	awsMatchers []services.AWSMatcher
+	awsMatchers []types.AWSMatcher
 	// databases are the databases associated with the target identity.
 	databases []*servicecfg.Database
 	// assumesAWSRoles are the AWS IAM roles that the target identity needs to
@@ -1052,18 +1048,19 @@ func getTargetConfig(flags configurators.BootstrapFlags, cfg *servicecfg.Config,
 	}
 	awsMatchers := awsMatchersFromConfig(flags, cfg)
 	databases := databasesFromConfig(flags, cfg)
-	targetIsAssumeRole := isTargetAWSAssumeRole(flags, awsMatchers, databases, target)
+	resourceMatchers := resourceMatchersFromConfig(flags, cfg)
+	targetIsAssumeRole := isTargetAWSAssumeRole(flags, awsMatchers, databases, resourceMatchers, target)
 	return targetConfig{
 		identity:        target,
 		awsMatchers:     matchersForTarget(awsMatchers, target, targetIsAssumeRole),
 		databases:       databasesForTarget(databases, target, targetIsAssumeRole),
-		assumesAWSRoles: rolesForTarget(forcedRoles, awsMatchers, databases, targetIsAssumeRole),
+		assumesAWSRoles: rolesForTarget(forcedRoles, awsMatchers, databases, resourceMatchers, targetIsAssumeRole),
 	}, nil
 }
 
 // awsMatchersFromConfig is a helper function that extracts database AWS matchers
 // from the service configuration based on cli flags.
-func awsMatchersFromConfig(flags configurators.BootstrapFlags, cfg *servicecfg.Config) []services.AWSMatcher {
+func awsMatchersFromConfig(flags configurators.BootstrapFlags, cfg *servicecfg.Config) []types.AWSMatcher {
 	if flags.DiscoveryService {
 		return cfg.Discovery.AWSMatchers
 	}
@@ -1083,9 +1080,16 @@ func databasesFromConfig(flags configurators.BootstrapFlags, cfg *servicecfg.Con
 	return databases
 }
 
+func resourceMatchersFromConfig(flags configurators.BootstrapFlags, cfg *servicecfg.Config) []services.ResourceMatcher {
+	if flags.DiscoveryService {
+		return nil
+	}
+	return cfg.Databases.ResourceMatchers
+}
+
 // isTargetAWSAssumeRole determines if the target identity exists in config or cli
 // flags as an AWS IAM role arn that will be assumed by the database agent.
-func isTargetAWSAssumeRole(flags configurators.BootstrapFlags, matchers []services.AWSMatcher, databases []*servicecfg.Database, target awslib.Identity) bool {
+func isTargetAWSAssumeRole(flags configurators.BootstrapFlags, matchers []types.AWSMatcher, databases []*servicecfg.Database, resourceMatchers []services.ResourceMatcher, target awslib.Identity) bool {
 	switch target.(type) {
 	case awslib.Role, *awslib.Role:
 	default:
@@ -1094,14 +1098,19 @@ func isTargetAWSAssumeRole(flags configurators.BootstrapFlags, matchers []servic
 
 	targetARN := target.String()
 	return isTargetAWSAssumeRoleForMatchers(matchers, targetARN) ||
-		isTargetAWSAssumeRoleForDatabases(databases, targetARN)
+		isTargetAWSAssumeRoleForDatabases(databases, targetARN) ||
+		isTargetAWSAssumeRoleForResourceMatchers(resourceMatchers, targetARN)
 }
 
 // isTargetAWSAssumeRoleForMatchers checks if the target identity is the same as
 // an AWS matcher's assume_role_arn.
-func isTargetAWSAssumeRoleForMatchers(matchers []services.AWSMatcher, target string) bool {
-	return findAWSMatcherIs(matchers, func(m *services.AWSMatcher) bool {
-		return m.AssumeRole.RoleARN == target
+func isTargetAWSAssumeRoleForMatchers(matchers []types.AWSMatcher, target string) bool {
+	return findAWSMatcherIs(matchers, func(m *types.AWSMatcher) bool {
+		assumeRoleARN := ""
+		if m.AssumeRole != nil {
+			assumeRoleARN = m.AssumeRole.RoleARN
+		}
+		return assumeRoleARN == target
 	})
 }
 
@@ -1113,6 +1122,15 @@ func isTargetAWSAssumeRoleForDatabases(databases []*servicecfg.Database, targetA
 	})
 }
 
+func isTargetAWSAssumeRoleForResourceMatchers(resourceMatchers []services.ResourceMatcher, targetARN string) bool {
+	for _, resourceMatcher := range resourceMatchers {
+		if resourceMatcher.AWS.AssumeRoleARN == targetARN {
+			return true
+		}
+	}
+	return false
+}
+
 // predicate is a generic predicate function type.
 type predicate[Elem any] func(t Elem) bool
 
@@ -1129,15 +1147,23 @@ func filter[Elem any](elems []Elem, keepFn predicate[Elem]) []Elem {
 }
 
 // matchersForTarget returns all AWS matchers that are associated with the target identity.
-func matchersForTarget(matchers []services.AWSMatcher, target awslib.Identity, targetIsAssumeRole bool) []services.AWSMatcher {
+func matchersForTarget(matchers []types.AWSMatcher, target awslib.Identity, targetIsAssumeRole bool) []types.AWSMatcher {
 	if targetIsAssumeRole {
 		targetARN := target.String()
-		return filter(matchers, func(matcher services.AWSMatcher) bool {
-			return matcher.AssumeRole.RoleARN == targetARN
+		return filter(matchers, func(matcher types.AWSMatcher) bool {
+			assumeRoleARN := ""
+			if matcher.AssumeRole != nil {
+				assumeRoleARN = matcher.AssumeRole.RoleARN
+			}
+			return assumeRoleARN == targetARN
 		})
 	}
-	return filter(matchers, func(matcher services.AWSMatcher) bool {
-		return matcher.AssumeRole.RoleARN == ""
+	return filter(matchers, func(matcher types.AWSMatcher) bool {
+		assumeRoleARN := ""
+		if matcher.AssumeRole != nil {
+			assumeRoleARN = matcher.AssumeRole.RoleARN
+		}
+		return assumeRoleARN == ""
 	})
 }
 
@@ -1187,7 +1213,7 @@ func isStubAccountIDError(target awslib.Identity, err error) bool {
 
 // rolesForTarget returns all AWS roles from cli flags, AWS matchers, and
 // databases that the target identity will need to be able to assume.
-func rolesForTarget(forcedRoles []string, matchers []services.AWSMatcher, databases []*servicecfg.Database, targetIsAssumeRole bool) []string {
+func rolesForTarget(forcedRoles []string, matchers []types.AWSMatcher, databases []*servicecfg.Database, resourceMatchers []services.ResourceMatcher, targetIsAssumeRole bool) []string {
 	roleSet := make(map[string]struct{})
 	for _, roleARN := range forcedRoles {
 		roleSet[roleARN] = struct{}{}
@@ -1198,10 +1224,15 @@ func rolesForTarget(forcedRoles []string, matchers []services.AWSMatcher, databa
 		return utils.StringsSliceFromSet(roleSet)
 	}
 	for _, matcher := range matchers {
-		if matcher.AssumeRole.RoleARN == "" || !supportsAWSAssumeRole(matcher) {
+		assumeRoleARN := ""
+		if matcher.AssumeRole != nil {
+			assumeRoleARN = matcher.AssumeRole.RoleARN
+		}
+
+		if assumeRoleARN == "" || !supportsAWSAssumeRole(matcher) {
 			continue
 		}
-		roleSet[matcher.AssumeRole.RoleARN] = struct{}{}
+		roleSet[assumeRoleARN] = struct{}{}
 	}
 	for _, db := range databases {
 		if db.AWS.AssumeRoleARN == "" {
@@ -1209,5 +1240,11 @@ func rolesForTarget(forcedRoles []string, matchers []services.AWSMatcher, databa
 		}
 		roleSet[db.AWS.AssumeRoleARN] = struct{}{}
 	}
+	for _, resourceMatcher := range resourceMatchers {
+		if resourceMatcher.AWS.AssumeRoleARN == "" {
+			continue
+		}
+		roleSet[resourceMatcher.AWS.AssumeRoleARN] = struct{}{}
+	}
 	return utils.StringsSliceFromSet(roleSet)
 }
diff --git a/lib/configurators/aws/aws_test.go b/lib/configurators/aws/aws_test.go
index b16919418fb93..ae1da2e17fb5d 100644
--- a/lib/configurators/aws/aws_test.go
+++ b/lib/configurators/aws/aws_test.go
@@ -1483,6 +1483,7 @@ func TestExtractTargetConfig(t *testing.T) {
 	role4 := "arn:aws:iam::123456789012:role/role-4"
 	role5 := "arn:aws:iam::123456789012:role/role-5"
 	role6 := "arn:aws:iam::123456789012:role/role-6"
+	role7 := "arn:aws:iam::123456789012:role/role-7"
 	roleTarget, err := awslib.IdentityFromArn("arn:aws:iam::123456789012:role/target-role")
 	require.NoError(t, err)
 
@@ -1498,8 +1499,8 @@ func TestExtractTargetConfig(t *testing.T) {
 			cfg: &servicecfg.Config{
 				// check discovery resources are not included
 				Discovery: servicecfg.DiscoveryConfig{
-					AWSMatchers: []services.AWSMatcher{
-						{Types: []string{services.AWSMatcherRDSProxy}, AssumeRole: services.AssumeRole{RoleARN: roleTarget.String()}},
+					AWSMatchers: []types.AWSMatcher{
+						{Types: []string{services.AWSMatcherRDSProxy}, AssumeRole: &types.AssumeRole{RoleARN: roleTarget.String()}},
 					},
 				},
 				Databases: servicecfg.DatabasesConfig{
@@ -1509,12 +1510,12 @@ func TestExtractTargetConfig(t *testing.T) {
 						{Name: "db3"},
 						{Name: "db4", AWS: servicecfg.DatabaseAWS{AssumeRoleARN: roleTarget.String()}},
 					},
-					AWSMatchers: []services.AWSMatcher{
-						{Types: []string{services.AWSMatcherRDS, services.AWSMatcherEC2}, AssumeRole: services.AssumeRole{RoleARN: role4}},
-						{Types: []string{services.AWSMatcherRDS, services.AWSMatcherEC2}, AssumeRole: services.AssumeRole{RoleARN: role5, ExternalID: "foo"}},
-						{Types: []string{services.AWSMatcherEC2}, AssumeRole: services.AssumeRole{RoleARN: role6}},
+					AWSMatchers: []types.AWSMatcher{
+						{Types: []string{services.AWSMatcherRDS, services.AWSMatcherEC2}, AssumeRole: &types.AssumeRole{RoleARN: role4}},
+						{Types: []string{services.AWSMatcherRDS, services.AWSMatcherEC2}, AssumeRole: &types.AssumeRole{RoleARN: role5, ExternalID: "foo"}},
+						{Types: []string{services.AWSMatcherEC2}, AssumeRole: &types.AssumeRole{RoleARN: role6}},
 						{Types: []string{services.AWSMatcherElastiCache}},
-						{Types: []string{services.AWSMatcherRedshift}, AssumeRole: services.AssumeRole{RoleARN: roleTarget.String()}},
+						{Types: []string{services.AWSMatcherRedshift}, AssumeRole: &types.AssumeRole{RoleARN: roleTarget.String()}},
 					},
 				},
 			},
@@ -1522,8 +1523,8 @@ func TestExtractTargetConfig(t *testing.T) {
 				identity:        roleTarget,
 				assumesAWSRoles: []string{role1},
 				databases:       []*servicecfg.Database{{Name: "db4", AWS: servicecfg.DatabaseAWS{AssumeRoleARN: roleTarget.String()}}},
-				awsMatchers: []services.AWSMatcher{
-					{Types: []string{services.AWSMatcherRedshift}, AssumeRole: services.AssumeRole{RoleARN: roleTarget.String()}},
+				awsMatchers: []types.AWSMatcher{
+					{Types: []string{services.AWSMatcherRedshift}, AssumeRole: &types.AssumeRole{RoleARN: roleTarget.String()}},
 				},
 			},
 		},
@@ -1532,8 +1533,8 @@ func TestExtractTargetConfig(t *testing.T) {
 			flags:  configurators.BootstrapFlags{ForceAssumesRoles: role1, DiscoveryService: true},
 			cfg: &servicecfg.Config{
 				Discovery: servicecfg.DiscoveryConfig{
-					AWSMatchers: []services.AWSMatcher{
-						{Types: []string{services.AWSMatcherRDSProxy}, AssumeRole: services.AssumeRole{RoleARN: roleTarget.String()}},
+					AWSMatchers: []types.AWSMatcher{
+						{Types: []string{services.AWSMatcherRDSProxy}, AssumeRole: &types.AssumeRole{RoleARN: roleTarget.String()}},
 					},
 				},
 				// check that database service resources are not included.
@@ -1541,16 +1542,16 @@ func TestExtractTargetConfig(t *testing.T) {
 					Databases: []servicecfg.Database{
 						{Name: "db1", AWS: servicecfg.DatabaseAWS{AssumeRoleARN: roleTarget.String()}},
 					},
-					AWSMatchers: []services.AWSMatcher{
-						{Types: []string{services.AWSMatcherRedshift}, AssumeRole: services.AssumeRole{RoleARN: roleTarget.String()}},
+					AWSMatchers: []types.AWSMatcher{
+						{Types: []string{services.AWSMatcherRedshift}, AssumeRole: &types.AssumeRole{RoleARN: roleTarget.String()}},
 					},
 				},
 			},
 			want: targetConfig{
 				identity:        roleTarget,
 				assumesAWSRoles: []string{role1},
-				awsMatchers: []services.AWSMatcher{
-					{Types: []string{services.AWSMatcherRDSProxy}, AssumeRole: services.AssumeRole{RoleARN: roleTarget.String()}},
+				awsMatchers: []types.AWSMatcher{
+					{Types: []string{services.AWSMatcherRDSProxy}, AssumeRole: &types.AssumeRole{RoleARN: roleTarget.String()}},
 				},
 			},
 		},
@@ -1560,7 +1561,7 @@ func TestExtractTargetConfig(t *testing.T) {
 			cfg: &servicecfg.Config{
 				// check that discovery service resources are not included.
 				Discovery: servicecfg.DiscoveryConfig{
-					AWSMatchers: []services.AWSMatcher{
+					AWSMatchers: []types.AWSMatcher{
 						{Types: []string{services.AWSMatcherEC2}},
 					},
 				},
@@ -1570,22 +1571,26 @@ func TestExtractTargetConfig(t *testing.T) {
 						{Name: "db2", AWS: servicecfg.DatabaseAWS{AssumeRoleARN: role3, ExternalID: "foo"}},
 						{Name: "db3"},
 					},
-					AWSMatchers: []services.AWSMatcher{
+					AWSMatchers: []types.AWSMatcher{
 						// rds/ec2 matcher's assume role should be added because rds assume role is supported.
-						{Types: []string{services.AWSMatcherRDS, services.AWSMatcherEC2}, AssumeRole: services.AssumeRole{RoleARN: role4}},
+						{Types: []string{services.AWSMatcherRDS, services.AWSMatcherEC2}, AssumeRole: &types.AssumeRole{RoleARN: role4}},
 						// ec2-only matcher's assume role should not be added because it's not supported.
-						{Types: []string{services.AWSMatcherEC2}, AssumeRole: services.AssumeRole{RoleARN: role5}},
-						{Types: []string{services.AWSMatcherRDS, services.AWSMatcherEC2}, AssumeRole: services.AssumeRole{RoleARN: role6, ExternalID: "foo"}},
+						{Types: []string{services.AWSMatcherEC2}, AssumeRole: &types.AssumeRole{RoleARN: role5}},
+						{Types: []string{services.AWSMatcherRDS, services.AWSMatcherEC2}, AssumeRole: &types.AssumeRole{RoleARN: role6, ExternalID: "foo"}},
 						// matcher without assume role should be added to matchers
 						{Types: []string{services.AWSMatcherElastiCache}},
 					},
+					ResourceMatchers: []services.ResourceMatcher{
+						// dynamic resources' assume role should be added.
+						{Labels: types.Labels{"env": []string{"dev"}}, AWS: services.ResourceMatcherAWS{AssumeRoleARN: role7}},
+					},
 				},
 			},
 			want: targetConfig{
 				identity:        roleTarget,
-				assumesAWSRoles: []string{role1, role2, role3, role4, role6},
+				assumesAWSRoles: []string{role1, role2, role3, role4, role6, role7},
 				databases:       []*servicecfg.Database{{Name: "db3"}},
-				awsMatchers: []services.AWSMatcher{
+				awsMatchers: []types.AWSMatcher{
 					{Types: []string{services.AWSMatcherElastiCache}},
 				},
 			},
@@ -1595,9 +1600,9 @@ func TestExtractTargetConfig(t *testing.T) {
 			flags:  configurators.BootstrapFlags{ForceAssumesRoles: role1, DiscoveryService: true},
 			cfg: &servicecfg.Config{
 				Discovery: servicecfg.DiscoveryConfig{
-					AWSMatchers: []services.AWSMatcher{
-						{Types: []string{services.AWSMatcherRDSProxy}, AssumeRole: services.AssumeRole{RoleARN: role2}},
-						{Types: []string{services.AWSMatcherRDSProxy}, AssumeRole: services.AssumeRole{RoleARN: role3, ExternalID: "foo"}},
+					AWSMatchers: []types.AWSMatcher{
+						{Types: []string{services.AWSMatcherRDSProxy}, AssumeRole: &types.AssumeRole{RoleARN: role2}},
+						{Types: []string{services.AWSMatcherRDSProxy}, AssumeRole: &types.AssumeRole{RoleARN: role3, ExternalID: "foo"}},
 						{Types: []string{services.AWSMatcherEC2}},
 					},
 				},
@@ -1606,15 +1611,15 @@ func TestExtractTargetConfig(t *testing.T) {
 					Databases: []servicecfg.Database{
 						{Name: "db3"},
 					},
-					AWSMatchers: []services.AWSMatcher{
-						{Types: []string{services.AWSMatcherElastiCache}, AssumeRole: services.AssumeRole{RoleARN: role4}},
+					AWSMatchers: []types.AWSMatcher{
+						{Types: []string{services.AWSMatcherElastiCache}, AssumeRole: &types.AssumeRole{RoleARN: role4}},
 					},
 				},
 			},
 			want: targetConfig{
 				identity:        roleTarget,
 				assumesAWSRoles: []string{role1, role2, role3},
-				awsMatchers: []services.AWSMatcher{
+				awsMatchers: []types.AWSMatcher{
 					{Types: []string{services.AWSMatcherEC2}},
 				},
 			},
@@ -1649,16 +1654,17 @@ func TestIsTargetAssumeRole(t *testing.T) {
 	tests := map[string]struct {
 		target    awslib.Identity
 		flags     configurators.BootstrapFlags
-		matchers  []services.AWSMatcher
+		matchers  []types.AWSMatcher
 		databases []*servicecfg.Database
+		resources []services.ResourceMatcher
 		want      bool
 	}{
 		"target in matchers": {
 			target: roleTarget,
-			matchers: []services.AWSMatcher{{
+			matchers: []types.AWSMatcher{{
 				Types:      []string{services.AWSMatcherRDS},
 				Regions:    []string{"us-west-1"},
-				AssumeRole: services.AssumeRole{RoleARN: roleTarget.String()},
+				AssumeRole: &types.AssumeRole{RoleARN: roleTarget.String()},
 			}},
 			want: true,
 		},
@@ -1671,6 +1677,26 @@ func TestIsTargetAssumeRole(t *testing.T) {
 			}},
 			want: true,
 		},
+		"target in resources": {
+			target: roleTarget,
+			resources: []services.ResourceMatcher{
+				{
+					Labels: types.Labels{
+						"env": []string{"prod"},
+					},
+				},
+				{
+					Labels: types.Labels{
+						"env": []string{"dev"},
+					},
+					AWS: services.ResourceMatcherAWS{
+						AssumeRoleARN: roleTarget.String(),
+						ExternalID:    "external-id",
+					},
+				},
+			},
+			want: true,
+		},
 		"target is not a role": {
 			target: userTarget,
 			want:   false,
@@ -1678,10 +1704,10 @@ func TestIsTargetAssumeRole(t *testing.T) {
 		"target not in anything": {
 			target: roleTarget,
 			flags:  configurators.BootstrapFlags{ForceAssumesRoles: role1},
-			matchers: []services.AWSMatcher{{
+			matchers: []types.AWSMatcher{{
 				Types:      []string{services.AWSMatcherRDS},
 				Regions:    []string{"us-west-1"},
-				AssumeRole: services.AssumeRole{RoleARN: role1},
+				AssumeRole: &types.AssumeRole{RoleARN: role1},
 			}},
 			databases: []*servicecfg.Database{{
 				AWS: servicecfg.DatabaseAWS{
@@ -1693,7 +1719,7 @@ func TestIsTargetAssumeRole(t *testing.T) {
 	}
 	for name, tt := range tests {
 		t.Run(name, func(t *testing.T) {
-			got := isTargetAWSAssumeRole(tt.flags, tt.matchers, tt.databases, tt.target)
+			got := isTargetAWSAssumeRole(tt.flags, tt.matchers, tt.databases, tt.resources, tt.target)
 			require.Equal(t, tt.want, got)
 		})
 	}
diff --git a/lib/devicetrust/authn/authn_test.go b/lib/devicetrust/authn/authn_test.go
index a17fb2e6a38ee..0013cf462bbc4 100644
--- a/lib/devicetrust/authn/authn_test.go
+++ b/lib/devicetrust/authn/authn_test.go
@@ -129,7 +129,7 @@ func enrollDevice(ctx context.Context, devices devicepb.DeviceTrustServiceClient
 			return err
 		}
 	case devicepb.OSType_OS_TYPE_WINDOWS:
-		solution, err := dev.SolveTPMEnrollChallenge(resp.GetTpmChallenge())
+		solution, err := dev.SolveTPMEnrollChallenge(resp.GetTpmChallenge(), false /* debug */)
 		if err != nil {
 			return err
 		}
diff --git a/lib/devicetrust/enroll/auto_enroll.go b/lib/devicetrust/enroll/auto_enroll.go
index c5faa41f388a1..7eaf469ac4452 100644
--- a/lib/devicetrust/enroll/auto_enroll.go
+++ b/lib/devicetrust/enroll/auto_enroll.go
@@ -61,6 +61,6 @@ func (c *AutoEnrollCeremony) Run(ctx context.Context, devicesClient devicepb.Dev
 		return nil, trace.Wrap(err, "creating auto-token")
 	}
 
-	dev, err := c.Ceremony.Run(ctx, devicesClient, token.Token)
+	dev, err := c.Ceremony.Run(ctx, devicesClient, false, token.Token)
 	return dev, trace.Wrap(err)
 }
diff --git a/lib/devicetrust/enroll/enroll.go b/lib/devicetrust/enroll/enroll.go
index 8f8735ccbb22e..75ae948c77df0 100644
--- a/lib/devicetrust/enroll/enroll.go
+++ b/lib/devicetrust/enroll/enroll.go
@@ -33,7 +33,7 @@ type Ceremony struct {
 	GetDeviceOSType         func() devicepb.OSType
 	EnrollDeviceInit        func() (*devicepb.EnrollDeviceInit, error)
 	SignChallenge           func(chal []byte) (sig []byte, err error)
-	SolveTPMEnrollChallenge func(challenge *devicepb.TPMEnrollChallenge) (*devicepb.TPMEnrollChallengeResponse, error)
+	SolveTPMEnrollChallenge func(challenge *devicepb.TPMEnrollChallenge, debug bool) (*devicepb.TPMEnrollChallengeResponse, error)
 }
 
 // NewCeremony creates a new ceremony that delegates per-device behavior
@@ -51,12 +51,12 @@ func NewCeremony() *Ceremony {
 
 // RunCeremony performs the client-side device enrollment ceremony.
 // Equivalent to `NewCeremony().Run()`.
-func RunCeremony(ctx context.Context, devicesClient devicepb.DeviceTrustServiceClient, enrollToken string) (*devicepb.Device, error) {
-	return NewCeremony().Run(ctx, devicesClient, enrollToken)
+func RunCeremony(ctx context.Context, devicesClient devicepb.DeviceTrustServiceClient, debug bool, enrollToken string) (*devicepb.Device, error) {
+	return NewCeremony().Run(ctx, devicesClient, debug, enrollToken)
 }
 
 // Run performs the client-side device enrollment ceremony.
-func (c *Ceremony) Run(ctx context.Context, devicesClient devicepb.DeviceTrustServiceClient, enrollToken string) (*devicepb.Device, error) {
+func (c *Ceremony) Run(ctx context.Context, devicesClient devicepb.DeviceTrustServiceClient, debug bool, enrollToken string) (*devicepb.Device, error) {
 	// Start by checking the OSType, this lets us exit early with a nicer message
 	// for unsupported OSes.
 	osType := c.GetDeviceOSType()
@@ -100,7 +100,7 @@ func (c *Ceremony) Run(ctx context.Context, devicesClient devicepb.DeviceTrustSe
 		err = c.enrollDeviceMacOS(stream, resp)
 		// err handled below
 	case devicepb.OSType_OS_TYPE_WINDOWS:
-		err = c.enrollDeviceTPM(stream, resp)
+		err = c.enrollDeviceTPM(ctx, stream, resp, debug)
 		// err handled below
 	default:
 		// This should be caught by the OSType guard at start of function.
@@ -142,7 +142,7 @@ func (c *Ceremony) enrollDeviceMacOS(stream devicepb.DeviceTrustService_EnrollDe
 	return trace.Wrap(err)
 }
 
-func (c *Ceremony) enrollDeviceTPM(stream devicepb.DeviceTrustService_EnrollDeviceClient, resp *devicepb.EnrollDeviceResponse) error {
+func (c *Ceremony) enrollDeviceTPM(ctx context.Context, stream devicepb.DeviceTrustService_EnrollDeviceClient, resp *devicepb.EnrollDeviceResponse, debug bool) error {
 	challenge := resp.GetTpmChallenge()
 	switch {
 	case challenge == nil:
@@ -153,7 +153,7 @@ func (c *Ceremony) enrollDeviceTPM(stream devicepb.DeviceTrustService_EnrollDevi
 		return trace.BadParameter("missing attestation_nonce in challenge from server")
 	}
 
-	challengeResponse, err := c.SolveTPMEnrollChallenge(challenge)
+	challengeResponse, err := c.SolveTPMEnrollChallenge(challenge, debug)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/devicetrust/enroll/enroll_test.go b/lib/devicetrust/enroll/enroll_test.go
index bb4cf4b0d5f8a..001f80afd8dee 100644
--- a/lib/devicetrust/enroll/enroll_test.go
+++ b/lib/devicetrust/enroll/enroll_test.go
@@ -90,7 +90,7 @@ func TestCeremony_Run(t *testing.T) {
 				SolveTPMEnrollChallenge: test.dev.SolveTPMEnrollChallenge,
 			}
 
-			got, err := c.Run(ctx, devices, "faketoken")
+			got, err := c.Run(ctx, devices, false, "faketoken")
 			test.assertErr(t, err)
 			test.assertGotDevice(t, got)
 		})
diff --git a/lib/devicetrust/native/api.go b/lib/devicetrust/native/api.go
index b9593ba1355f8..6872b2b91887f 100644
--- a/lib/devicetrust/native/api.go
+++ b/lib/devicetrust/native/api.go
@@ -45,8 +45,8 @@ func GetDeviceCredential() (*devicepb.DeviceCredential, error) {
 }
 
 // SolveTPMEnrollChallenge completes a TPM enrollment challenge.
-func SolveTPMEnrollChallenge(challenge *devicepb.TPMEnrollChallenge) (*devicepb.TPMEnrollChallengeResponse, error) {
-	return solveTPMEnrollChallenge(challenge)
+func SolveTPMEnrollChallenge(challenge *devicepb.TPMEnrollChallenge, debug bool) (*devicepb.TPMEnrollChallengeResponse, error) {
+	return solveTPMEnrollChallenge(challenge, debug)
 }
 
 // SolveTPMAuthnDeviceChallenge completes a TPM device authetication challenge.
@@ -54,6 +54,15 @@ func SolveTPMAuthnDeviceChallenge(challenge *devicepb.TPMAuthenticateDeviceChall
 	return solveTPMAuthnDeviceChallenge(challenge)
 }
 
+// HandleTPMActivateCredential completes the credential activation part of an
+// enrollment challenge. This is usually called in an elevated process that's
+// created by SolveTPMEnrollChallenge.
+//
+//nolint:staticcheck // HandleTPMActivateCredential works depending on the platform.
+func HandleTPMActivateCredential(encryptedCredential, encryptedCredentialSecret string) error {
+	return handleTPMActivateCredential(encryptedCredential, encryptedCredentialSecret)
+}
+
 // GetDeviceOSType returns the devicepb.OSType for the current OS
 func GetDeviceOSType() devicepb.OSType {
 	switch runtime.GOOS {
diff --git a/lib/devicetrust/native/device_darwin.go b/lib/devicetrust/native/device_darwin.go
index ca06a83fe604e..fb9dc96a571f1 100644
--- a/lib/devicetrust/native/device_darwin.go
+++ b/lib/devicetrust/native/device_darwin.go
@@ -240,10 +240,14 @@ func statusErrorFromC(res C.int32_t) error {
 	return &statusError{status: int32(res)}
 }
 
-func solveTPMEnrollChallenge(challenge *devicepb.TPMEnrollChallenge) (*devicepb.TPMEnrollChallengeResponse, error) {
+func solveTPMEnrollChallenge(_ *devicepb.TPMEnrollChallenge, _ bool) (*devicepb.TPMEnrollChallengeResponse, error) {
 	return nil, trace.BadParameter("called solveTPMEnrollChallenge on darwin")
 }
 
 func solveTPMAuthnDeviceChallenge(_ *devicepb.TPMAuthenticateDeviceChallenge) (*devicepb.TPMAuthenticateDeviceChallengeResponse, error) {
 	return nil, trace.BadParameter("called solveTPMAuthnDeviceChallenge on darwin")
 }
+
+func handleTPMActivateCredential(_, _ string) error {
+	return trace.BadParameter("called handleTPMActivateCredential on darwin")
+}
diff --git a/lib/devicetrust/native/device_windows.go b/lib/devicetrust/native/device_windows.go
index fdf990b699abf..519e0978d6ee1 100644
--- a/lib/devicetrust/native/device_windows.go
+++ b/lib/devicetrust/native/device_windows.go
@@ -20,51 +20,63 @@ import (
 	"crypto/sha256"
 	"crypto/x509"
 	"encoding/base64"
+	"fmt"
 	"math/big"
 	"os"
 	"os/exec"
 	"os/user"
 	"path/filepath"
+	"time"
 
 	"github.com/google/go-attestation/attest"
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
 	"github.com/gravitational/teleport/lib/devicetrust"
+	"github.com/gravitational/teleport/lib/windowsexec"
 )
 
 const (
-	deviceStateFolderName  = ".teleport-device"
-	attestationKeyFileName = "attestation.key"
+	deviceStateFolderName        = ".teleport-device"
+	attestationKeyFileName       = "attestation.key"
+	credentialActivationFileName = "credential-activation"
 )
 
+type deviceState struct {
+	attestationKeyPath       string
+	credentialActivationPath string
+}
+
 // setupDeviceStateDir ensures that device state directory exists.
-// It returns the absolute path to where the attestation key can be found:
-// $CONFIG_DIR/teleport-device/attestation.key
-func setupDeviceStateDir(getBaseDir func() (string, error)) (akPath string, err error) {
+// It returns a struct containing the path of each part of the device state,
+// or nil and an error if it was not possible to set up the directory.
+func setupDeviceStateDir(getBaseDir func() (string, error)) (*deviceState, error) {
 	base, err := getBaseDir()
 	if err != nil {
-		return "", trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
 	deviceStateDirPath := filepath.Join(base, deviceStateFolderName)
-	keyPath := filepath.Join(deviceStateDirPath, attestationKeyFileName)
-
-	if _, err := os.Stat(deviceStateDirPath); err != nil {
-		if os.IsNotExist(err) {
-			// If it doesn't exist, we can create it and return as we know
-			// the perms are correct as we created it.
-			if err := os.Mkdir(deviceStateDirPath, 700); err != nil {
-				return "", trace.Wrap(err)
-			}
-			return keyPath, nil
+	ds := &deviceState{
+		attestationKeyPath:       filepath.Join(deviceStateDirPath, attestationKeyFileName),
+		credentialActivationPath: filepath.Join(deviceStateDirPath, credentialActivationFileName),
+	}
+
+	switch _, err := os.Stat(deviceStateDirPath); {
+	case os.IsNotExist(err):
+		// If it doesn't exist, we can create it and return as we know
+		// the perms are correct as we created it.
+		if err := os.Mkdir(deviceStateDirPath, 700); err != nil {
+			return nil, trace.Wrap(err)
 		}
-		return "", trace.Wrap(err)
+	case err != nil:
+		return nil, trace.Wrap(err)
 	}
 
-	return keyPath, nil
+	return ds, nil
 }
 
 // getMarshaledEK returns the EK public key in PKIX, ASN.1 DER format.
@@ -137,7 +149,7 @@ func createAndSaveAK(
 }
 
 func enrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {
-	akPath, err := setupDeviceStateDir(os.UserConfigDir)
+	stateDir, err := setupDeviceStateDir(os.UserConfigDir)
 	if err != nil {
 		return nil, trace.Wrap(err, "setting up device state directory")
 	}
@@ -156,13 +168,13 @@ func enrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {
 
 	// Try to load an existing AK in the case of re-enrollment, but, if the
 	// AK does not exist, create one and persist it.
-	ak, err := loadAK(tpm, akPath)
+	ak, err := loadAK(tpm, stateDir.attestationKeyPath)
 	if err != nil {
 		if !trace.IsNotFound(err) {
 			return nil, trace.Wrap(err, "loading ak")
 		}
 		log.Debug("TPM: No existing AK was found on disk, an AK will be created.")
-		ak, err = createAndSaveAK(tpm, akPath)
+		ak, err = createAndSaveAK(tpm, stateDir.attestationKeyPath)
 		if err != nil {
 			return nil, trace.Wrap(err, "creating ak")
 		}
@@ -414,7 +426,7 @@ func collectDeviceData() (*devicepb.DeviceCollectedData, error) {
 // getDeviceCredential will only return the credential ID on windows. The
 // other information is determined server-side.
 func getDeviceCredential() (*devicepb.DeviceCredential, error) {
-	akPath, err := setupDeviceStateDir(os.UserConfigDir)
+	stateDir, err := setupDeviceStateDir(os.UserConfigDir)
 	if err != nil {
 		return nil, trace.Wrap(err, "setting up device state directory")
 	}
@@ -431,7 +443,7 @@ func getDeviceCredential() (*devicepb.DeviceCredential, error) {
 	}()
 
 	// Attempt to load the AK from well-known location.
-	ak, err := loadAK(tpm, akPath)
+	ak, err := loadAK(tpm, stateDir.attestationKeyPath)
 	if err != nil {
 		return nil, trace.Wrap(err, "loading ak")
 	}
@@ -449,8 +461,9 @@ func getDeviceCredential() (*devicepb.DeviceCredential, error) {
 
 func solveTPMEnrollChallenge(
 	challenge *devicepb.TPMEnrollChallenge,
+	debug bool,
 ) (*devicepb.TPMEnrollChallengeResponse, error) {
-	akPath, err := setupDeviceStateDir(os.UserConfigDir)
+	stateDir, err := setupDeviceStateDir(os.UserConfigDir)
 	if err != nil {
 		return nil, trace.Wrap(err, "setting up device state directory")
 	}
@@ -468,7 +481,7 @@ func solveTPMEnrollChallenge(
 	}()
 
 	// Attempt to load the AK from well-known location.
-	ak, err := loadAK(tpm, akPath)
+	ak, err := loadAK(tpm, stateDir.attestationKeyPath)
 	if err != nil {
 		return nil, trace.Wrap(err, "loading ak")
 	}
@@ -488,12 +501,36 @@ func solveTPMEnrollChallenge(
 	// First perform the credential activation challenge provided by the
 	// auth server.
 	log.Debug("TPM: Activating credential.")
-	activationSolution, err := ak.ActivateCredential(
-		tpm,
-		devicetrust.EncryptedCredentialFromProto(challenge.EncryptedCredential),
+	encryptedCredential := devicetrust.EncryptedCredentialFromProto(
+		challenge.EncryptedCredential,
 	)
-	if err != nil {
-		return nil, trace.Wrap(err, "activating credential with challenge")
+	if encryptedCredential == nil {
+		return nil, trace.BadParameter("missing encrypted credential in challenge from server")
+	}
+
+	var activationSolution []byte
+	if windows.GetCurrentProcessToken().IsElevated() {
+		log.Debug("TPM: Detected current process is elevated. Will run credential activation in current process.")
+		// If we are running with elevated privileges, we can just complete the
+		// credential activation here.
+		activationSolution, err = ak.ActivateCredential(
+			tpm,
+			*encryptedCredential,
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "activating credential with challenge")
+		}
+	} else {
+		fmt.Fprintln(os.Stderr, "Detected that tsh is not running with elevated privileges. Triggering a UAC prompt to complete the enrollment in an elevated process.")
+		activationSolution, err = activateCredentialInElevatedChild(
+			*encryptedCredential,
+			stateDir.credentialActivationPath,
+			debug,
+		)
+		if err != nil {
+			return nil, trace.Wrap(err, "activating credential with challenge using elevated child")
+		}
+		fmt.Fprintln(os.Stderr, "Successfully completed credential activation in elevated process.")
 	}
 
 	log.Debug("TPM: Enrollment challenge completed.")
@@ -505,10 +542,131 @@ func solveTPMEnrollChallenge(
 	}, nil
 }
 
+// activateCredentialInElevated child uses `runas` to trigger a child process
+// with elevated privileges. This is necessary because the process must have
+// elevated privileges in order to invoke the TPM 2.0 ActivateCredential
+// command.
+func activateCredentialInElevatedChild(
+	encryptedCredential attest.EncryptedCredential,
+	credActivationPath string,
+	debug bool,
+) ([]byte, error) {
+	exe, err := os.Executable()
+	if err != nil {
+		return nil, trace.Wrap(err, "determining current executable path")
+	}
+	cwd, err := os.Getwd()
+	if err != nil {
+		return nil, trace.Wrap(err, "determining current working directory")
+	}
+
+	// Clear up the results of any previous credential activation
+	if err := os.Remove(credActivationPath); err != nil {
+		err := trace.ConvertSystemError(err)
+		if !trace.IsNotFound(err) {
+			return nil, trace.Wrap(err, "clearing previous credential activation results")
+		}
+	}
+
+	// Assemble the parameter list. We encoded any binary data in base64.
+	// These parameters cause `tsh` to invoke HandleTPMActivateCredential.
+	params := []string{
+		"device",
+		"tpm-activate-credential",
+		"--encrypted-credential",
+		base64.StdEncoding.EncodeToString(encryptedCredential.Credential),
+		"--encrypted-credential-secret",
+		base64.StdEncoding.EncodeToString(encryptedCredential.Secret),
+	}
+	if debug {
+		params = append(params, "--debug")
+	}
+
+	log.Debug("Starting elevated process.")
+	// https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-shellexecutew
+	err = windowsexec.RunAsAndWait(
+		exe,
+		cwd,
+		time.Second*10,
+		params,
+	)
+	if err != nil {
+		return nil, trace.Wrap(err, "invoking ShellExecute")
+	}
+
+	// Ensure we clean up the results of the execution once we are done with
+	// it.
+	defer func() {
+		if err := os.Remove(credActivationPath); err != nil {
+			log.WithError(err).Debug("Failed to clean up credential activation result")
+		}
+	}()
+
+	solutionBytes, err := os.ReadFile(credActivationPath)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return solutionBytes, nil
+}
+
+func handleTPMActivateCredential(encryptedCredential, encryptedCredentialSecret string) error {
+	log.Debug("Performing credential activation.")
+	// The two input parameters are base64 encoded, so decode them.
+	credentialBytes, err := base64.StdEncoding.DecodeString(encryptedCredential)
+	if err != nil {
+		return trace.Wrap(err, "decoding encrypted credential")
+	}
+	secretBytes, err := base64.StdEncoding.DecodeString(encryptedCredentialSecret)
+	if err != nil {
+		return trace.Wrap(err, "decoding encrypted credential secret")
+	}
+
+	stateDir, err := setupDeviceStateDir(os.UserConfigDir)
+	if err != nil {
+		return trace.Wrap(err, "setting up device state directory")
+	}
+
+	tpm, err := attest.OpenTPM(&attest.OpenConfig{
+		TPMVersion: attest.TPMVersion20,
+	})
+	if err != nil {
+		return trace.Wrap(err, "opening tpm")
+	}
+	defer func() {
+		if err := tpm.Close(); err != nil {
+			log.WithError(err).Debug("TPM: Failed to close TPM.")
+		}
+	}()
+
+	// Attempt to load the AK from well-known location.
+	ak, err := loadAK(tpm, stateDir.attestationKeyPath)
+	if err != nil {
+		return trace.Wrap(err, "loading ak")
+	}
+	defer ak.Close(tpm)
+
+	solution, err := ak.ActivateCredential(
+		tpm,
+		attest.EncryptedCredential{
+			Credential: credentialBytes,
+			Secret:     secretBytes,
+		},
+	)
+	if err != nil {
+		return trace.Wrap(err, "activating credential with challenge")
+	}
+
+	log.Debug("Completed credential activation. Returning result to original process.")
+	return trace.Wrap(
+		os.WriteFile(stateDir.credentialActivationPath, solution, 0600),
+	)
+}
+
 func solveTPMAuthnDeviceChallenge(
 	challenge *devicepb.TPMAuthenticateDeviceChallenge,
 ) (*devicepb.TPMAuthenticateDeviceChallengeResponse, error) {
-	akPath, err := setupDeviceStateDir(os.UserConfigDir)
+	stateDir, err := setupDeviceStateDir(os.UserConfigDir)
 	if err != nil {
 		return nil, trace.Wrap(err, "setting up device state directory")
 	}
@@ -526,7 +684,7 @@ func solveTPMAuthnDeviceChallenge(
 	}()
 
 	// Attempt to load the AK from well-known location.
-	ak, err := loadAK(tpm, akPath)
+	ak, err := loadAK(tpm, stateDir.attestationKeyPath)
 	if err != nil {
 		return nil, trace.Wrap(err, "loading ak")
 	}
diff --git a/lib/devicetrust/native/others.go b/lib/devicetrust/native/others.go
index 1150380870a1f..e562904fceff4 100644
--- a/lib/devicetrust/native/others.go
+++ b/lib/devicetrust/native/others.go
@@ -39,6 +39,7 @@ func getDeviceCredential() (*devicepb.DeviceCredential, error) {
 
 func solveTPMEnrollChallenge(
 	_ *devicepb.TPMEnrollChallenge,
+	_ bool,
 ) (*devicepb.TPMEnrollChallengeResponse, error) {
 	return nil, devicetrust.ErrPlatformNotSupported
 }
@@ -48,3 +49,7 @@ func solveTPMAuthnDeviceChallenge(
 ) (*devicepb.TPMAuthenticateDeviceChallengeResponse, error) {
 	return nil, devicetrust.ErrPlatformNotSupported
 }
+
+func handleTPMActivateCredential(_, _ string) error {
+	return devicetrust.ErrPlatformNotSupported
+}
diff --git a/lib/devicetrust/testenv/fake_linux_device.go b/lib/devicetrust/testenv/fake_linux_device.go
index 41b68e642e4f9..d6f5551d10f7f 100644
--- a/lib/devicetrust/testenv/fake_linux_device.go
+++ b/lib/devicetrust/testenv/fake_linux_device.go
@@ -44,7 +44,7 @@ func (d *FakeLinuxDevice) SignChallenge(_ []byte) (sig []byte, err error) {
 	return nil, trace.NotImplemented("linux device fake unimplemented")
 }
 
-func (d *FakeLinuxDevice) SolveTPMEnrollChallenge(_ *devicepb.TPMEnrollChallenge) (*devicepb.TPMEnrollChallengeResponse, error) {
+func (d *FakeLinuxDevice) SolveTPMEnrollChallenge(_ *devicepb.TPMEnrollChallenge, _ bool) (*devicepb.TPMEnrollChallengeResponse, error) {
 	return nil, trace.NotImplemented("linux device fake unimplemented")
 }
 
diff --git a/lib/devicetrust/testenv/fake_macos_device.go b/lib/devicetrust/testenv/fake_macos_device.go
index 08a1e17ea6383..a55cdcf62fa9e 100644
--- a/lib/devicetrust/testenv/fake_macos_device.go
+++ b/lib/devicetrust/testenv/fake_macos_device.go
@@ -95,6 +95,7 @@ func (f *FakeMacOSDevice) SignChallenge(chal []byte) (sig []byte, err error) {
 
 func (d *FakeMacOSDevice) SolveTPMEnrollChallenge(
 	_ *devicepb.TPMEnrollChallenge,
+	_ bool,
 ) (*devicepb.TPMEnrollChallengeResponse, error) {
 	return nil, trace.NotImplemented("mac device does not implement SolveTPMEnrollChallenge")
 }
diff --git a/lib/devicetrust/testenv/fake_windows_device.go b/lib/devicetrust/testenv/fake_windows_device.go
index 25f267809d7ab..673dae8e915b0 100644
--- a/lib/devicetrust/testenv/fake_windows_device.go
+++ b/lib/devicetrust/testenv/fake_windows_device.go
@@ -73,6 +73,7 @@ func (f *FakeWindowsDevice) EnrollDeviceInit() (*devicepb.EnrollDeviceInit, erro
 
 func (f *FakeWindowsDevice) SolveTPMEnrollChallenge(
 	challenge *devicepb.TPMEnrollChallenge,
+	_ bool,
 ) (*devicepb.TPMEnrollChallengeResponse, error) {
 	// This extremely roughly mimics the actual TPM by using the values
 	// provided in the encrypted credential to produce an activation challenge
diff --git a/lib/devicetrust/testenv/testenv.go b/lib/devicetrust/testenv/testenv.go
index 6b0c6c8341343..bdc77c0805674 100644
--- a/lib/devicetrust/testenv/testenv.go
+++ b/lib/devicetrust/testenv/testenv.go
@@ -122,7 +122,7 @@ type FakeDevice interface {
 	EnrollDeviceInit() (*devicepb.EnrollDeviceInit, error)
 	GetDeviceOSType() devicepb.OSType
 	SignChallenge(chal []byte) (sig []byte, err error)
-	SolveTPMEnrollChallenge(challenge *devicepb.TPMEnrollChallenge) (*devicepb.TPMEnrollChallengeResponse, error)
+	SolveTPMEnrollChallenge(challenge *devicepb.TPMEnrollChallenge, debug bool) (*devicepb.TPMEnrollChallengeResponse, error)
 	SolveTPMAuthnDeviceChallenge(challenge *devicepb.TPMAuthenticateDeviceChallenge) (*devicepb.TPMAuthenticateDeviceChallengeResponse, error)
 	GetDeviceCredential() *devicepb.DeviceCredential
 }
diff --git a/lib/devicetrust/tpm_attest_proto.go b/lib/devicetrust/tpm_attest_proto.go
index a1a68568832c2..e923397ca302f 100644
--- a/lib/devicetrust/tpm_attest_proto.go
+++ b/lib/devicetrust/tpm_attest_proto.go
@@ -61,11 +61,11 @@ func EncryptedCredentialToProto(in *attest.EncryptedCredential) *devicepb.TPMEnc
 
 // EncryptedCredentialFromProto extracts an attest.EncryptedCredential from
 // its protobuf representation.
-func EncryptedCredentialFromProto(in *devicepb.TPMEncryptedCredential) attest.EncryptedCredential {
+func EncryptedCredentialFromProto(in *devicepb.TPMEncryptedCredential) *attest.EncryptedCredential {
 	if in == nil {
-		return attest.EncryptedCredential{}
+		return nil
 	}
-	return attest.EncryptedCredential{
+	return &attest.EncryptedCredential{
 		Credential: in.CredentialBlob,
 		Secret:     in.Secret,
 	}
@@ -86,11 +86,11 @@ func PlatformParametersToProto(in *attest.PlatformParameters) *devicepb.TPMPlatf
 
 // PlatformParametersFromProto extracts an attest.PlatformParameters from
 // its protobuf representation.
-func PlatformParametersFromProto(in *devicepb.TPMPlatformParameters) attest.PlatformParameters {
+func PlatformParametersFromProto(in *devicepb.TPMPlatformParameters) *attest.PlatformParameters {
 	if in == nil {
-		return attest.PlatformParameters{}
+		return nil
 	}
-	return attest.PlatformParameters{
+	return &attest.PlatformParameters{
 		TPMVersion: attest.TPMVersion20,
 		Quotes:     quotesFromProto(in.Quotes),
 		PCRs:       pcrsFromProto(in.Pcrs),
@@ -98,6 +98,28 @@ func PlatformParametersFromProto(in *devicepb.TPMPlatformParameters) attest.Plat
 	}
 }
 
+// PlatformAttestationToProto converts an *attest.PlatformParameters and nonce
+// to a PlatformAttestation proto message.
+func PlatformAttestationToProto(in *attest.PlatformParameters, nonce []byte) *devicepb.TPMPlatformAttestation {
+	if in == nil {
+		return nil
+	}
+	platParams := PlatformParametersToProto(in)
+	return &devicepb.TPMPlatformAttestation{
+		PlatformParameters: platParams,
+		Nonce:              nonce,
+	}
+}
+
+// PlatformAttestationFromProto extracts a attest.PlatformParameters and nonce
+// from a PlatformAttestation proto message.
+func PlatformAttestationFromProto(in *devicepb.TPMPlatformAttestation) (platParams *attest.PlatformParameters, nonce []byte) {
+	if in == nil {
+		return nil, nil
+	}
+	return PlatformParametersFromProto(in.PlatformParameters), in.Nonce
+}
+
 func quotesToProto(in []attest.Quote) []*devicepb.TPMQuote {
 	out := make([]*devicepb.TPMQuote, len(in))
 	for i, q := range in {
diff --git a/lib/devicetrust/tpm_attest_proto_test.go b/lib/devicetrust/tpm_attest_proto_test.go
index d74a2f1c46635..636ccb8049dd5 100644
--- a/lib/devicetrust/tpm_attest_proto_test.go
+++ b/lib/devicetrust/tpm_attest_proto_test.go
@@ -39,18 +39,18 @@ func TestAttestationParametersProto(t *testing.T) {
 }
 
 func TestEncryptedCredentialProto(t *testing.T) {
-	want := attest.EncryptedCredential{
+	want := &attest.EncryptedCredential{
 		Credential: []byte("encrypted_credential"),
 		Secret:     []byte("secret"),
 	}
-	pb := devicetrust.EncryptedCredentialToProto(&want)
+	pb := devicetrust.EncryptedCredentialToProto(want)
 	clonedPb := utils.CloneProtoMsg(pb)
 	got := devicetrust.EncryptedCredentialFromProto(clonedPb)
 	require.Equal(t, want, got)
 }
 
 func TestPlatformParametersProto(t *testing.T) {
-	want := attest.PlatformParameters{
+	want := &attest.PlatformParameters{
 		TPMVersion: attest.TPMVersion20,
 		EventLog:   []byte("event_log"),
 		Public:     []byte("public"),
@@ -79,7 +79,7 @@ func TestPlatformParametersProto(t *testing.T) {
 			},
 		},
 	}
-	pb := devicetrust.PlatformParametersToProto(&want)
+	pb := devicetrust.PlatformParametersToProto(want)
 	clonedPb := utils.CloneProtoMsg(pb)
 	got := devicetrust.PlatformParametersFromProto(clonedPb)
 	// We expect `Public` to be nil because we don't transmit this field over
@@ -88,3 +88,40 @@ func TestPlatformParametersProto(t *testing.T) {
 	want.Public = nil
 	require.Equal(t, want, got)
 }
+
+func TestPlatformAttestationProto(t *testing.T) {
+	want := &attest.PlatformParameters{
+		TPMVersion: attest.TPMVersion20,
+		EventLog:   []byte("event_log"),
+		Quotes: []attest.Quote{
+			{
+				Version:   attest.TPMVersion20,
+				Quote:     []byte("quote_0"),
+				Signature: []byte("signature_0"),
+			},
+			{
+				Version:   attest.TPMVersion20,
+				Quote:     []byte("quote_1"),
+				Signature: []byte("signature_1"),
+			},
+		},
+		PCRs: []attest.PCR{
+			{
+				Index:     0,
+				Digest:    []byte("digest_sha256_0"),
+				DigestAlg: crypto.SHA256,
+			},
+			{
+				Index:     1,
+				Digest:    []byte("digest_sha1_0"),
+				DigestAlg: crypto.SHA1,
+			},
+		},
+	}
+	wantNonce := []byte("foo-bar-bizz-boo")
+	pb := devicetrust.PlatformAttestationToProto(want, wantNonce)
+	clonedPb := utils.CloneProtoMsg(pb)
+	got, gotNonce := devicetrust.PlatformAttestationFromProto(clonedPb)
+	require.Equal(t, want, got)
+	require.Equal(t, wantNonce, gotNonce)
+}
diff --git a/lib/events/athena/athena.go b/lib/events/athena/athena.go
index dba7afde50744..611e1459e7276 100644
--- a/lib/events/athena/athena.go
+++ b/lib/events/athena/athena.go
@@ -405,7 +405,7 @@ func New(ctx context.Context, cfg Config) (*Log, error) {
 	}
 
 	l := &Log{
-		publisher:      newPublisher(cfg),
+		publisher:      newPublisherFromAthenaConfig(cfg),
 		querier:        querier,
 		consumerCloser: consumer,
 	}
diff --git a/lib/events/athena/athena_test.go b/lib/events/athena/athena_test.go
index da0ddb3d49c05..e761a949e5921 100644
--- a/lib/events/athena/athena_test.go
+++ b/lib/events/athena/athena_test.go
@@ -293,8 +293,10 @@ func TestPublisherConsumer(t *testing.T) {
 	fS3 := newFakeS3manager()
 	fq := newFakeQueue()
 	p := &publisher{
-		snsPublisher: fq,
-		uploader:     fS3,
+		PublisherConfig: PublisherConfig{
+			SNSPublisher: fq,
+			Uploader:     fS3,
+		},
 	}
 
 	smallEvent := &apievents.AppCreate{
diff --git a/lib/events/athena/consumer.go b/lib/events/athena/consumer.go
index ec09965d0005c..fa7559adc3089 100644
--- a/lib/events/athena/consumer.go
+++ b/lib/events/athena/consumer.go
@@ -20,6 +20,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"strconv"
 	"sync"
 	"time"
 
@@ -32,11 +33,8 @@ import (
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/prometheus/client_golang/prometheus"
+	"github.com/segmentio/parquet-go"
 	log "github.com/sirupsen/logrus"
-	"github.com/xitongsys/parquet-go-source/s3v2"
-	"github.com/xitongsys/parquet-go/parquet"
-	"github.com/xitongsys/parquet-go/source"
-	"github.com/xitongsys/parquet-go/writer"
 	"golang.org/x/exp/slices"
 
 	"github.com/gravitational/teleport"
@@ -72,7 +70,7 @@ type consumer struct {
 
 	// perDateFileParquetWriter returns file writer per date.
 	// Added in config to allow testing.
-	perDateFileParquetWriter func(ctx context.Context, date string) (source.ParquetFile, error)
+	perDateFileParquetWriter func(ctx context.Context, date string) (io.WriteCloser, error)
 
 	collectConfig sqsCollectConfig
 
@@ -134,9 +132,9 @@ func newConsumer(cfg Config, cancelFn context.CancelFunc, metricConsumerBatchPro
 		collectConfig:       collectCfg,
 		sqsDeleter:          sqsClient,
 		queueURL:            cfg.QueueURL,
-		perDateFileParquetWriter: func(ctx context.Context, date string) (source.ParquetFile, error) {
+		perDateFileParquetWriter: func(ctx context.Context, date string) (io.WriteCloser, error) {
 			key := fmt.Sprintf("%s/%s/%s.parquet", cfg.locationS3Prefix, date, uuid.NewString())
-			fw, err := s3v2.NewS3FileWriterWithClient(ctx, s3client, cfg.locationS3Bucket, key, nil /* uploader options */, func(poi *s3.PutObjectInput) {
+			fw, err := awsutils.NewS3V2FileWriter(ctx, s3client, cfg.locationS3Bucket, key, nil /* uploader options */, func(poi *s3.PutObjectInput) {
 				// ChecksumAlgorithm is required for putting objects when object lock is enabled.
 				poi.ChecksumAlgorithm = s3Types.ChecksumAlgorithmSha256
 			})
@@ -476,6 +474,9 @@ func (s *sqsMessagesCollector) fromSQS(ctx context.Context) {
 		consumerBatchCount.Add(float64(fullBatchMetadata.Count))
 		consumerBatchSize.Observe(float64(fullBatchMetadata.Size))
 		consumerAgeOfOldestProcessedMessage.Set(time.Since(fullBatchMetadata.OldestTimestamp).Seconds())
+	} else {
+		// When no messages were processed, clear gauge metric.
+		consumerAgeOfOldestProcessedMessage.Set(0)
 	}
 }
 
@@ -500,15 +501,19 @@ func (c *collectedEventsMetadata) Merge(in collectedEventsMetadata) {
 }
 
 // MergeWithEvent combines collectedEventsMetadata with metadata of single event.
-func (c *collectedEventsMetadata) MergeWithEvent(in apievents.AuditEvent) {
+func (c *collectedEventsMetadata) MergeWithEvent(in apievents.AuditEvent, publishedToQueueTimestamp time.Time) {
 	c.Merge(collectedEventsMetadata{
 		// 1 because we are merging single event
 		Count:           1,
 		Size:            in.Size(),
-		OldestTimestamp: in.GetTime(),
+		OldestTimestamp: publishedToQueueTimestamp,
 	})
 }
 
+// SDK defines invalid type for attribute names, let's just use const here.
+// https://github.com/aws/aws-sdk-go-v2/issues/2124
+const sentTimestampAttribute = "SentTimestamp"
+
 func (s *sqsMessagesCollector) receiveMessagesAndSendOnChan(ctx context.Context, eventsC chan<- eventAndAckID, errorsC chan<- error) collectedEventsMetadata {
 	sqsOut, err := s.cfg.sqsReceiver.ReceiveMessage(ctx, &sqs.ReceiveMessageInput{
 		QueueUrl:              aws.String(s.cfg.queueURL),
@@ -516,6 +521,7 @@ func (s *sqsMessagesCollector) receiveMessagesAndSendOnChan(ctx context.Context,
 		WaitTimeSeconds:       s.cfg.waitOnReceiveTimeout,
 		VisibilityTimeout:     s.cfg.visibilityTimeout,
 		MessageAttributeNames: []string{payloadTypeAttr},
+		AttributeNames:        []sqsTypes.QueueAttributeName{sentTimestampAttribute},
 	})
 	if err != nil {
 		// We don't need handle canceled errors anyhow.
@@ -547,11 +553,30 @@ func (s *sqsMessagesCollector) receiveMessagesAndSendOnChan(ctx context.Context,
 			event:         event,
 			receiptHandle: aws.ToString(msg.ReceiptHandle),
 		}
-		singleReceiveMetadata.MergeWithEvent(event)
+		messageSentTimestamp, err := getMessageSentTimestamp(msg)
+		if err != nil {
+			s.cfg.logger.Debugf("Failed to get sentTimestamp: %v", err)
+		}
+		singleReceiveMetadata.MergeWithEvent(event, messageSentTimestamp)
 	}
 	return singleReceiveMetadata
 }
 
+func getMessageSentTimestamp(msg sqsTypes.Message) (time.Time, error) {
+	if msg.Attributes == nil {
+		return time.Time{}, nil
+	}
+	attribute := msg.Attributes[sentTimestampAttribute]
+	if attribute == "" {
+		return time.Time{}, nil
+	}
+	milis, err := strconv.Atoi(attribute)
+	if err != nil {
+		return time.Time{}, trace.Wrap(err)
+	}
+	return time.UnixMilli(int64(milis)).UTC(), nil
+}
+
 // auditEventFromSQSorS3 returns events either directly from SQS message payload
 // or from s3, if event was very large.
 func (s *sqsMessagesCollector) auditEventFromSQSorS3(ctx context.Context, msg sqsTypes.Message) (apievents.AuditEvent, error) {
@@ -679,7 +704,7 @@ func (s *sqsMessagesCollector) downloadEventFromS3(ctx context.Context, payload
 // to s3 bucket. It returns receiptHandles of elements to delete from queue.
 // If error is returned, it means that messages won't be deleted from SQS,
 // and events will be retried or go to dead-letter queue.
-func (c *consumer) writeToS3(ctx context.Context, eventsCh <-chan eventAndAckID, newPerDateFileWriterFn func(ctx context.Context, date string) (source.ParquetFile, error)) ([]string, error) {
+func (c *consumer) writeToS3(ctx context.Context, eventsCh <-chan eventAndAckID, newPerDateFileWriterFn func(ctx context.Context, date string) (io.WriteCloser, error)) ([]string, error) {
 	toDelete := make([]string, 0, c.batchMaxItems)
 	// TODO(tobiaszheller): later write in goroutine, so far it's not bottleneck.
 	perDateWriter := map[string]*parquetWriter{}
@@ -697,7 +722,7 @@ eventLoop:
 				c.logger.WithError(err).Error("Could not convert event to parquet format")
 				continue
 			}
-			date := pqtEvent.GetDate()
+			date := pqtEvent.EventTime.Format(time.DateOnly)
 			pw := perDateWriter[date]
 			if pw == nil {
 				fw, err := newPerDateFileWriterFn(ctx, date)
@@ -743,23 +768,14 @@ eventLoop:
 			// If we are not able to close parquet file, it make sense to retrun
 			// error and retry whole batch again from SQS.
 
-			// TODO(tobiaszheller): verify if broken files are removed from s3.
 			return nil, trace.Wrap(err)
 		}
 	}
 	return toDelete, nil
 }
 
-func newParquetWriter(ctx context.Context, fw source.ParquetFile) (*parquetWriter, error) {
-	// numberOfWorkersMarshalingParquet defines number how many goroutines
-	// will do marshaling of objects. I have followed example from xitongsys/parquet-go, where they use 4.
-	const numberOfWorkersMarshalingParquet = 4
-	pw, err := writer.NewParquetWriter(fw, new(eventParquet), numberOfWorkersMarshalingParquet)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	pw.CompressionType = parquet.CompressionCodec_SNAPPY
-
+func newParquetWriter(ctx context.Context, fw io.WriteCloser) (*parquetWriter, error) {
+	pw := parquet.NewGenericWriter[eventParquet](fw, parquet.Compression(&parquet.Snappy))
 	return &parquetWriter{
 		closer: fw,
 		writer: pw,
@@ -768,15 +784,16 @@ func newParquetWriter(ctx context.Context, fw source.ParquetFile) (*parquetWrite
 
 type parquetWriter struct {
 	closer io.Closer
-	writer *writer.ParquetWriter
+	writer *parquet.GenericWriter[eventParquet]
 }
 
 func (pw *parquetWriter) Write(ctx context.Context, in eventParquet) error {
-	return trace.Wrap(pw.writer.Write(in))
+	_, err := pw.writer.Write([]eventParquet{in})
+	return trace.Wrap(err)
 }
 
 func (pw *parquetWriter) Close() error {
-	if err := pw.writer.WriteStop(); err != nil {
+	if err := pw.writer.Close(); err != nil {
 		return trace.NewAggregate(err, pw.closer.Close())
 	}
 	return trace.Wrap(pw.closer.Close())
diff --git a/lib/events/athena/consumer_test.go b/lib/events/athena/consumer_test.go
index 514e04d718393..9025c0a30bd11 100644
--- a/lib/events/athena/consumer_test.go
+++ b/lib/events/athena/consumer_test.go
@@ -21,6 +21,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"io"
 	"math/big"
 	"os"
 	"path/filepath"
@@ -33,14 +34,12 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/sqs"
 	sqsTypes "github.com/aws/aws-sdk-go-v2/service/sqs/types"
 	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/prometheus/client_golang/prometheus"
+	"github.com/segmentio/parquet-go"
 	"github.com/stretchr/testify/require"
-	"github.com/xitongsys/parquet-go-source/local"
-	"github.com/xitongsys/parquet-go/source"
 
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/backend/memory"
@@ -338,8 +337,9 @@ func TestSQSMessagesCollectorErrorsOnReceive(t *testing.T) {
 
 	gotNoOfCalls := mockReceiver.getNoOfCalls()
 	// We can't be sure that there will be equaly noOfCalls as expected,
-	// because they are process in async way, that's why margin in EquateApprox is used.
-	require.Empty(t, cmp.Diff(float32(gotNoOfCalls), float32(expectedNoOfCalls), cmpopts.EquateApprox(0, 4)))
+	// because they are process in async way, but anything within range x>= 0 && x< 1.5*expected is valid.
+	require.LessOrEqual(t, float64(gotNoOfCalls), 1.5*float64(expectedNoOfCalls), "receiveMessage got too many calls")
+	require.Greater(t, gotNoOfCalls, 0, "receiveMessage was not called at all")
 }
 
 type mockReceiver struct {
@@ -600,12 +600,12 @@ func TestConsumerWriteToS3(t *testing.T) {
 	defer cancel()
 
 	tmp := t.TempDir()
-	localWriter := func(ctx context.Context, date string) (source.ParquetFile, error) {
+	localWriter := func(ctx context.Context, date string) (io.WriteCloser, error) {
 		err := os.MkdirAll(filepath.Join(tmp, date), 0o777)
 		if err != nil {
 			return nil, err
 		}
-		localW, err := local.NewLocalFileWriter(filepath.Join(tmp, date, "test.parquet"))
+		localW, err := os.Create(filepath.Join(tmp, date, "test.parquet"))
 		return localW, err
 	}
 
@@ -617,11 +617,15 @@ func TestConsumerWriteToS3(t *testing.T) {
 		return &apievents.AppCreate{Metadata: apievents.Metadata{Type: events.AppCreateEvent, Time: t}, AppMetadata: apievents.AppMetadata{AppName: name}}
 	}
 
+	eventR1 := makeAppCreateEventWithTime(april1st2023Afternoon, "app-1")
+	eventR2 := makeAppCreateEventWithTime(april1st2023Afternoon.Add(10*time.Second), "app-2")
+	// r3 date is next date, so it should be written as separate file.
+	eventR3 := makeAppCreateEventWithTime(april1st2023Afternoon.Add(18*time.Hour), "app3")
+
 	events := []eventAndAckID{
-		{receiptHandle: "r1", event: makeAppCreateEventWithTime(april1st2023Afternoon, "app-1")},
-		{receiptHandle: "r2", event: makeAppCreateEventWithTime(april1st2023Afternoon.Add(10*time.Second), "app-2")},
-		// r3 date is next date, so it should be written as separate file.
-		{receiptHandle: "r3", event: makeAppCreateEventWithTime(april1st2023Afternoon.Add(18*time.Hour), "app3")},
+		{receiptHandle: "r1", event: eventR1},
+		{receiptHandle: "r2", event: eventR2},
+		{receiptHandle: "r3", event: eventR3},
 	}
 
 	eventsC := make(chan eventAndAckID, 100)
@@ -638,28 +642,54 @@ func TestConsumerWriteToS3(t *testing.T) {
 	// Make sure that all events are marked to delete.
 	require.Equal(t, []string{"r1", "r2", "r3"}, gotHandlesToDelete)
 
-	// vefiry that both files for 2023-04-01 and 2023-04-02 were written and
-	// if they are equal to test data.
+	// verify that both files for 2023-04-01 and 2023-04-02 were written and
+	// if they contain audit events.
 	type wantGot struct {
-		wantFilepath string
-		gotFile      string
+		name       string
+		wantEvents []apievents.AuditEvent
+		gotFile    string
 	}
 	toCheck := []wantGot{
-		{wantFilepath: filepath.Join("testdata/events_2023-04-01.parquet"), gotFile: filepath.Join(tmp, "2023-04-01", "test.parquet")},
-		{wantFilepath: filepath.Join("testdata/events_2023-04-02.parquet"), gotFile: filepath.Join(tmp, "2023-04-02", "test.parquet")},
+		{
+			name:       "2023-04-01 should contain 2 events",
+			wantEvents: []apievents.AuditEvent{eventR1, eventR2},
+			gotFile:    filepath.Join(tmp, "2023-04-01", "test.parquet"),
+		},
+		{
+			name:       "2023-04-02 should contain 1 events",
+			wantEvents: []apievents.AuditEvent{eventR3},
+			gotFile:    filepath.Join(tmp, "2023-04-02", "test.parquet"),
+		},
 	}
 
 	for _, v := range toCheck {
-		t.Run("Checking "+filepath.Base(v.wantFilepath), func(t *testing.T) {
-			got, err := os.ReadFile(v.gotFile)
+		t.Run("Checking "+v.name, func(t *testing.T) {
+			rows, err := parquet.ReadFile[eventParquet](v.gotFile)
 			require.NoError(t, err)
-			want, err := os.ReadFile(v.wantFilepath)
+			gotEvents, err := parquetRowsToAuditEvents(rows)
 			require.NoError(t, err)
-			require.Empty(t, cmp.Diff(got, want))
+
+			require.Empty(t, cmp.Diff(gotEvents, v.wantEvents))
 		})
 	}
 }
 
+func parquetRowsToAuditEvents(in []eventParquet) ([]apievents.AuditEvent, error) {
+	out := make([]apievents.AuditEvent, 0, len(in))
+	for _, p := range in {
+		var fields events.EventFields
+		if err := utils.FastUnmarshal([]byte(p.EventData), &fields); err != nil {
+			return nil, trace.Wrap(err, "failed to unmarshal event, %s", p.EventData)
+		}
+		event, err := events.FromEventFields(fields)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		out = append(out, event)
+	}
+	return out, nil
+}
+
 func TestDeleteMessagesFromQueue(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
@@ -846,3 +876,44 @@ func TestCollectedEventsMetadataMerge(t *testing.T) {
 		})
 	}
 }
+
+func Test_getMessageSentTimestamp(t *testing.T) {
+	tests := []struct {
+		name    string
+		msg     sqsTypes.Message
+		want    time.Time
+		wantErr string
+	}{
+		{
+			name: "valid value sentTimestamp",
+			msg:  sqsTypes.Message{Attributes: map[string]string{"SentTimestamp": "1687183084420"}},
+			want: time.Date(2023, time.June, 19, 13, 58, 4, 420000000, time.UTC),
+		},
+		{
+			name: "empty map",
+			msg:  sqsTypes.Message{},
+			want: time.Time{},
+		},
+		{
+			name: "missing attribute",
+			msg:  sqsTypes.Message{Attributes: map[string]string{"abc": "def"}},
+			want: time.Time{},
+		},
+		{
+			name:    "wrong format of sentTimestamp",
+			msg:     sqsTypes.Message{Attributes: map[string]string{"SentTimestamp": "def"}},
+			wantErr: "invalid syntax",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := getMessageSentTimestamp(tt.msg)
+			if tt.wantErr == "" {
+				require.NoError(t, err, "getMessageSentTimestamp return unexpected err")
+				require.Equal(t, tt.want, got)
+			} else {
+				require.ErrorContains(t, err, tt.wantErr)
+			}
+		})
+	}
+}
diff --git a/lib/events/athena/integration_test.go b/lib/events/athena/integration_test.go
index 0bdc9b76a2bbe..0ab8618ca80f9 100644
--- a/lib/events/athena/integration_test.go
+++ b/lib/events/athena/integration_test.go
@@ -50,6 +50,7 @@ import (
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/test"
+	"github.com/gravitational/teleport/lib/observability/tracing"
 )
 
 type athenaContext struct {
@@ -431,6 +432,7 @@ func (ac *athenaContext) setupInfraWithCleanup(t *testing.T, ctx context.Context
 		querierConfig: querierConfig{
 			getQueryResultsInterval: 100 * time.Millisecond,
 			clock:                   ac.clock,
+			tracer:                  tracing.NoopTracer(teleport.ComponentAthena),
 		},
 	}
 	err = q.waitForSuccess(ctx, aws.ToString(startQueryExecResp.QueryExecutionId))
diff --git a/lib/events/athena/publisher.go b/lib/events/athena/publisher.go
index 2906dd4351d9c..98e0da6e18e14 100644
--- a/lib/events/athena/publisher.go
+++ b/lib/events/athena/publisher.go
@@ -48,11 +48,7 @@ const (
 // It publishes proto events directly to SNS topic, or use S3 bucket
 // if payload is too large for SNS.
 type publisher struct {
-	topicARN      string
-	snsPublisher  snsPublisher
-	uploader      s3uploader
-	payloadBucket string
-	payloadPrefix string
+	PublisherConfig
 }
 
 type snsPublisher interface {
@@ -63,23 +59,38 @@ type s3uploader interface {
 	Upload(ctx context.Context, input *s3.PutObjectInput, opts ...func(*manager.Uploader)) (*manager.UploadOutput, error)
 }
 
-// newPublisher returns new instance of publisher.
-func newPublisher(cfg Config) *publisher {
+type PublisherConfig struct {
+	TopicARN      string
+	SNSPublisher  snsPublisher
+	Uploader      s3uploader
+	PayloadBucket string
+	PayloadPrefix string
+}
+
+// NewPublisher returns new instance of publisher.
+func NewPublisher(cfg PublisherConfig) *publisher {
+	return &publisher{
+		PublisherConfig: cfg,
+	}
+}
+
+// newPublisherFromAthenaConfig returns new instance of publisher from athena
+// config.
+func newPublisherFromAthenaConfig(cfg Config) *publisher {
 	r := retry.NewStandard(func(so *retry.StandardOptions) {
 		so.MaxAttempts = 20
 		so.MaxBackoff = 1 * time.Minute
 	})
-
-	// TODO(tobiaszheller): consider reworking lib/observability to work also on s3 sdk-v2.
-	return &publisher{
-		topicARN: cfg.TopicARN,
-		snsPublisher: sns.NewFromConfig(*cfg.AWSConfig, func(o *sns.Options) {
+	return NewPublisher(PublisherConfig{
+		TopicARN: cfg.TopicARN,
+		SNSPublisher: sns.NewFromConfig(*cfg.AWSConfig, func(o *sns.Options) {
 			o.Retryer = r
 		}),
-		uploader:      manager.NewUploader(s3.NewFromConfig(*cfg.AWSConfig)),
-		payloadBucket: cfg.largeEventsBucket,
-		payloadPrefix: cfg.largeEventsPrefix,
-	}
+		// TODO(tobiaszheller): consider reworking lib/observability to work also on s3 sdk-v2.
+		Uploader:      manager.NewUploader(s3.NewFromConfig(*cfg.AWSConfig)),
+		PayloadBucket: cfg.largeEventsBucket,
+		PayloadPrefix: cfg.largeEventsPrefix,
+	})
 }
 
 // EmitAuditEvent emits audit event to SNS topic. Topic should be connected with
@@ -117,9 +128,9 @@ func (p *publisher) EmitAuditEvent(ctx context.Context, in apievents.AuditEvent)
 }
 
 func (p *publisher) emitViaS3(ctx context.Context, uid string, marshaledEvent []byte) error {
-	path := filepath.Join(p.payloadPrefix, uid)
-	out, err := p.uploader.Upload(ctx, &s3.PutObjectInput{
-		Bucket: aws.String(p.payloadBucket),
+	path := filepath.Join(p.PayloadPrefix, uid)
+	out, err := p.Uploader.Upload(ctx, &s3.PutObjectInput{
+		Bucket: aws.String(p.PayloadBucket),
 		Key:    aws.String(path),
 		Body:   bytes.NewBuffer(marshaledEvent),
 	})
@@ -140,8 +151,8 @@ func (p *publisher) emitViaS3(ctx context.Context, uid string, marshaledEvent []
 		return trace.Wrap(err)
 	}
 
-	_, err = p.snsPublisher.Publish(ctx, &sns.PublishInput{
-		TopicArn: aws.String(p.topicARN),
+	_, err = p.SNSPublisher.Publish(ctx, &sns.PublishInput{
+		TopicArn: aws.String(p.TopicARN),
 		Message:  aws.String(base64.StdEncoding.EncodeToString(buf)),
 		MessageAttributes: map[string]snsTypes.MessageAttributeValue{
 			payloadTypeAttr: {DataType: aws.String("String"), StringValue: aws.String(payloadTypeS3Based)},
@@ -151,8 +162,8 @@ func (p *publisher) emitViaS3(ctx context.Context, uid string, marshaledEvent []
 }
 
 func (p *publisher) emitViaSNS(ctx context.Context, uid string, b64Encoded string) error {
-	_, err := p.snsPublisher.Publish(ctx, &sns.PublishInput{
-		TopicArn: aws.String(p.topicARN),
+	_, err := p.SNSPublisher.Publish(ctx, &sns.PublishInput{
+		TopicArn: aws.String(p.TopicARN),
 		Message:  aws.String(b64Encoded),
 		MessageAttributes: map[string]snsTypes.MessageAttributeValue{
 			payloadTypeAttr: {DataType: aws.String("String"), StringValue: aws.String(payloadTypeRawProtoEvent)},
diff --git a/lib/events/athena/publisher_test.go b/lib/events/athena/publisher_test.go
index 122b36fd09d63..eb7529cd595e3 100644
--- a/lib/events/athena/publisher_test.go
+++ b/lib/events/athena/publisher_test.go
@@ -88,8 +88,10 @@ func Test_EmitAuditEvent(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			fq := newFakeQueue()
 			p := &publisher{
-				snsPublisher: fq,
-				uploader:     tt.uploader,
+				PublisherConfig: PublisherConfig{
+					SNSPublisher: fq,
+					Uploader:     tt.uploader,
+				},
 			}
 			err := p.EmitAuditEvent(context.Background(), tt.in)
 			require.NoError(t, err)
diff --git a/lib/events/athena/testdata/events_2023-04-01.parquet b/lib/events/athena/testdata/events_2023-04-01.parquet
deleted file mode 100644
index 2a9f304ff2322..0000000000000
Binary files a/lib/events/athena/testdata/events_2023-04-01.parquet and /dev/null differ
diff --git a/lib/events/athena/testdata/events_2023-04-02.parquet b/lib/events/athena/testdata/events_2023-04-02.parquet
deleted file mode 100644
index 96fd361151e2a..0000000000000
Binary files a/lib/events/athena/testdata/events_2023-04-02.parquet and /dev/null differ
diff --git a/lib/events/athena/types.go b/lib/events/athena/types.go
index 2bfc4a3b448d6..4620af116f908 100644
--- a/lib/events/athena/types.go
+++ b/lib/events/athena/types.go
@@ -25,17 +25,12 @@ import (
 )
 
 type eventParquet struct {
-	EventType string `parquet:"name=event_type, type=BYTE_ARRAY, convertedtype=UTF8"`
-	// TODO(tobiaszheller): what precision of timestamp we want. AWS supports micros, maybe we can use it instead of mili?
-	EventTime int64  `parquet:"name=event_time, type=INT64, convertedtype=TIMESTAMP_MILLIS"`
-	UID       string `parquet:"name=uid, type=BYTE_ARRAY, convertedtype=UTF8"`
-	SessionID string `parquet:"name=session_id, type=BYTE_ARRAY, convertedtype=UTF8"`
-	User      string `parquet:"name=user, type=BYTE_ARRAY, convertedtype=UTF8"`
-	EventData string `parquet:"name=event_data, type=BYTE_ARRAY, convertedtype=UTF8"`
-}
-
-func (e eventParquet) GetDate() string {
-	return time.UnixMilli(e.EventTime).Format(time.DateOnly)
+	EventType string    `parquet:"event_type"`
+	EventTime time.Time `parquet:"event_time,timestamp(millisecond)"`
+	UID       string    `parquet:"uid"`
+	SessionID string    `parquet:"session_id"`
+	User      string    `parquet:"user"`
+	EventData string    `parquet:"event_data"`
 }
 
 func auditEventToParquet(event apievents.AuditEvent) (*eventParquet, error) {
@@ -46,7 +41,7 @@ func auditEventToParquet(event apievents.AuditEvent) (*eventParquet, error) {
 
 	return &eventParquet{
 		EventType: event.GetType(),
-		EventTime: event.GetTime().UnixMilli(),
+		EventTime: event.GetTime().UTC(),
 		UID:       event.GetID(),
 		SessionID: events.GetSessionID(event),
 		User:      events.GetTeleportUser(event),
diff --git a/lib/events/complete.go b/lib/events/complete.go
index 4ce66ece79ed3..514aaac688251 100644
--- a/lib/events/complete.go
+++ b/lib/events/complete.go
@@ -68,7 +68,7 @@ func (cfg *UploadCompleterConfig) CheckAndSetDefaults() error {
 		return trace.BadParameter("missing parameter ClusterName")
 	}
 	if cfg.Component == "" {
-		cfg.Component = teleport.ComponentAuth
+		cfg.Component = teleport.ComponentProcess
 	}
 	if cfg.CheckPeriod == 0 {
 		cfg.CheckPeriod = AbandonedUploadPollingRate
@@ -140,6 +140,7 @@ func (u *UploadCompleter) Serve(ctx context.Context) error {
 		Jitter:        retryutils.NewSeventhJitter(),
 	})
 	defer periodic.Stop()
+	u.log.Infof("upload completer will run every %v", u.cfg.CheckPeriod.String())
 
 	for {
 		select {
diff --git a/lib/events/s3sessions/s3stream.go b/lib/events/s3sessions/s3stream.go
index 87e74a05d01d2..e9e6feafaafce 100644
--- a/lib/events/s3sessions/s3stream.go
+++ b/lib/events/s3sessions/s3stream.go
@@ -67,7 +67,9 @@ func (h *Handler) CreateUpload(ctx context.Context, sessionID session.ID) (*even
 // UploadPart uploads part
 func (h *Handler) UploadPart(ctx context.Context, upload events.StreamUpload, partNumber int64, partBody io.ReadSeeker) (*events.StreamPart, error) {
 	start := time.Now()
-	defer func() { h.Infof("UploadPart(%v) part(%v) uploaded in %v.", upload.ID, partNumber, time.Since(start)) }()
+	defer func() {
+		h.Infof("UploadPart(upload %v) part(%v) session(%v) uploaded in %v.", upload.ID, partNumber, upload.SessionID, time.Since(start))
+	}()
 
 	// This upload exceeded maximum number of supported parts, error now.
 	if partNumber > s3manager.MaxUploadParts {
diff --git a/lib/events/search_limiter_test.go b/lib/events/search_limiter_test.go
index 4fe1e9a3df11c..e742a74649ae6 100644
--- a/lib/events/search_limiter_test.go
+++ b/lib/events/search_limiter_test.go
@@ -105,7 +105,7 @@ func TestSearchEventsLimiter(t *testing.T) {
 				Order: types.EventOrderAscending,
 			})
 			return err == nil
-		}, 40*time.Millisecond, 5*time.Millisecond)
+		}, 1*time.Second, 5*time.Millisecond)
 	})
 }
 
diff --git a/lib/fuzz/README.md b/lib/fuzz/README.md
deleted file mode 100644
index 903a24b7491af..0000000000000
--- a/lib/fuzz/README.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Fuzzers
-
-The fuzz package holds fuzzers for the Teleport library.
-
-All fuzzers are stored in fuzz.go and are implemented using [go-fuzz](https://github.com/dvyukov/go-fuzz)
-
-These fuzzers run continuously through oss-fuzz.
diff --git a/lib/httplib/httpheaders.go b/lib/httplib/httpheaders.go
index d335e23f20488..57c3df1e32a0e 100644
--- a/lib/httplib/httpheaders.go
+++ b/lib/httplib/httpheaders.go
@@ -21,10 +21,67 @@ package httplib
 import (
 	"fmt"
 	"net/http"
+	"sort"
 	"strings"
 	"time"
+
+	"golang.org/x/exp/maps"
+
+	"github.com/gravitational/teleport/api/client/proto"
 )
 
+var defaultContentSecurityPolicy = map[string]string{
+	"default-src": "'self'",
+	// specify CSP directives not covered by `default-src`
+	"base-uri":        "'self'",
+	"form-action":     "'self'",
+	"frame-ancestors": "'none'",
+	// additional default restrictions
+	"object-src": "'none'",
+	"img-src":    "'self' data: blob:",
+	"style-src":  "'self' 'unsafe-inline'",
+}
+
+var defaultFontSrc = map[string]string{"font-src": "'self' data:"}
+
+var stripeSecurityPolicy = map[string]string{
+	// auto-pay plans in Cloud use stripe.com to manage billing information
+	"script-src": "'self' https://js.stripe.com",
+	"frame-src":  "https://js.stripe.com",
+}
+
+// combineCSPMaps combines multiple CSP maps into a single map.
+// When multiple of the input cspMaps have the same key, the
+// latter map's value takes precedence.
+func combineCSPMaps(cspMaps ...map[string]string) map[string]string {
+	combined := make(map[string]string)
+	for _, cspMap := range cspMaps {
+		maps.Copy(combined, cspMap)
+	}
+	return combined
+}
+
+// getContentSecurityPolicyString combines multiple CSP maps into a single
+// CSP string, alphabetically sorted by the directive key.
+// When multiple of the input cspMaps have the same key, the
+// latter map's value takes precedence.
+func getContentSecurityPolicyString(cspMaps ...map[string]string) string {
+	combined := combineCSPMaps(cspMaps...)
+
+	keys := make([]string, 0, len(combined))
+	for k := range combined {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+
+	var cspStringBuilder strings.Builder
+	for _, k := range keys {
+		fmt.Fprintf(&cspStringBuilder, "%s %s; ", k, combined[k])
+	}
+
+	return strings.TrimSpace(cspStringBuilder.String())
+}
+
 // SetNoCacheHeaders tells proxies and browsers do not cache the content
 func SetNoCacheHeaders(h http.Header) {
 	h.Set("Cache-Control", "no-cache, no-store, must-revalidate")
@@ -62,52 +119,43 @@ func SetDefaultSecurityHeaders(h http.Header) {
 }
 
 // SetIndexContentSecurityPolicy sets the Content-Security-Policy header for main index.html page
-func SetIndexContentSecurityPolicy(h http.Header) {
-	var cspValue = strings.Join([]string{
-		GetDefaultContentSecurityPolicy(),
-		// 'unsafe-inline' is required by CSS-in-JS to work
-		"style-src 'self' 'unsafe-inline'",
-		"img-src 'self' data: blob:",
-		"font-src 'self' data:",
-		"connect-src 'self' wss:",
-	}, ";")
-
-	h.Set("Content-Security-Policy", cspValue)
+func SetIndexContentSecurityPolicy(h http.Header, cfg proto.Features) {
+	cspMaps := []map[string]string{
+		defaultContentSecurityPolicy,
+		defaultFontSrc,
+		{"connect-src": "'self' wss:"},
+	}
+
+	if cfg.GetCloud() && cfg.GetIsUsageBased() {
+		cspMaps = append(cspMaps, stripeSecurityPolicy)
+	}
+
+	cspString := getContentSecurityPolicyString(cspMaps...)
+	h.Set("Content-Security-Policy", cspString)
 }
 
 // SetAppLaunchContentSecurityPolicy sets the Content-Security-Policy header for /web/launch
 func SetAppLaunchContentSecurityPolicy(h http.Header, applicationURL string) {
-	var cspValue = strings.Join([]string{
-		GetDefaultContentSecurityPolicy(),
-		// 'unsafe-inline' is required by CSS-in-JS to work
-		"style-src 'self' 'unsafe-inline'",
-		"img-src 'self' data: blob:",
-		"font-src 'self' data:",
-		fmt.Sprintf("connect-src 'self' %s", applicationURL),
-	}, ";")
-
-	h.Set("Content-Security-Policy", cspValue)
+	cspString := getContentSecurityPolicyString(
+		defaultContentSecurityPolicy,
+		defaultFontSrc,
+		map[string]string{
+			"connect-src": "'self' " + applicationURL,
+		},
+	)
+
+	h.Set("Content-Security-Policy", cspString)
 }
 
-// GetDefaultContentSecurityPolicy provides a starting Content Security Policy with safe defaults.
-func GetDefaultContentSecurityPolicy() string {
-	return strings.Join([]string{
-		"default-src 'self'",
-		// specify CSP directives not covered by `default-src`
-		"base-uri 'self'",
-		"form-action 'self'",
-		"frame-ancestors 'none'",
-		// additional default restrictions
-		"object-src 'none'",
-		// auto-pay plans in Cloud use stripe.com to manage billing information
-		"script-src 'self' https://js.stripe.com",
-		"frame-src https://js.stripe.com",
-	}, ";")
-}
+func SetRedirectPageContentSecurityPolicy(h http.Header, scriptSrc string) {
+	cspString := getContentSecurityPolicyString(
+		defaultContentSecurityPolicy,
+		map[string]string{
+			"script-src": "'" + scriptSrc + "'",
+		},
+	)
 
-// SetDefaultContentSecurityPolicy provides a starting Content Security Policy with safe defaults.
-func SetDefaultContentSecurityPolicy(h http.Header) {
-	h.Set("Content-Security-Policy", GetDefaultContentSecurityPolicy())
+	h.Set("Content-Security-Policy", cspString)
 }
 
 // SetWebConfigHeaders sets headers for webConfig.js
diff --git a/lib/httplib/httplib.go b/lib/httplib/httplib.go
index 92a82e5f9c5df..0e7447af7a2c6 100644
--- a/lib/httplib/httplib.go
+++ b/lib/httplib/httplib.go
@@ -97,6 +97,14 @@ func MakeTracingHandler(h http.Handler, component string) http.Handler {
 	return otelhttp.NewHandler(http.HandlerFunc(handler), component, otelhttp.WithSpanNameFormatter(tracehttp.HandlerFormatter))
 }
 
+// MakeTracingMiddleware returns an HTTP middleware that makes tracing
+// handlers.
+func MakeTracingMiddleware(component string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return MakeTracingHandler(next, component)
+	}
+}
+
 // MakeHandlerWithErrorWriter returns a httprouter.Handle from the HandlerFunc,
 // and sends all errors to ErrorWriter.
 func MakeHandlerWithErrorWriter(fn HandlerFunc, errWriter ErrorWriter) httprouter.Handle {
diff --git a/lib/httplib/httplib_test.go b/lib/httplib/httplib_test.go
index 2bd0340b59a77..6f13f27dc5e29 100644
--- a/lib/httplib/httplib_test.go
+++ b/lib/httplib/httplib_test.go
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -31,6 +32,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/observability/tracing"
 )
 
@@ -263,3 +265,104 @@ func TestMakeTracingHandler(t *testing.T) {
 	}
 
 }
+
+func TestSetIndexContentSecurityPolicy(t *testing.T) {
+	t.Parallel()
+
+	expectedCspVals := map[string]string{
+		"default-src":     "'self'",
+		"base-uri":        "'self'",
+		"form-action":     "'self'",
+		"frame-ancestors": "'none'",
+		"object-src":      "'none'",
+		"style-src":       "'self' 'unsafe-inline'",
+		"img-src":         "'self' data: blob:",
+		"font-src":        "'self' data:",
+		"connect-src":     "'self' wss:",
+	}
+
+	h := make(http.Header)
+	SetIndexContentSecurityPolicy(h, proto.Features{})
+	actualCsp := h.Get("Content-Security-Policy")
+	for k, v := range expectedCspVals {
+		expectedCspSubString := fmt.Sprintf("%s %s;", k, v)
+		require.Contains(t, actualCsp, expectedCspSubString)
+	}
+}
+
+func TestSetIndexContentSecurityPolicyForCloudUsageBased(t *testing.T) {
+	t.Parallel()
+
+	expectedCspVals := map[string]string{
+		"default-src":     "'self'",
+		"base-uri":        "'self'",
+		"form-action":     "'self'",
+		"frame-ancestors": "'none'",
+		"object-src":      "'none'",
+		"script-src":      "'self' https://js.stripe.com",
+		"frame-src":       "https://js.stripe.com",
+		"style-src":       "'self' 'unsafe-inline'",
+		"img-src":         "'self' data: blob:",
+		"font-src":        "'self' data:",
+		"connect-src":     "'self' wss:",
+	}
+
+	h := make(http.Header)
+	SetIndexContentSecurityPolicy(h, proto.Features{Cloud: true, IsUsageBased: true})
+	actualCsp := h.Get("Content-Security-Policy")
+	for k, v := range expectedCspVals {
+		expectedCspSubString := fmt.Sprintf("%s %s;", k, v)
+		require.Contains(t, actualCsp, expectedCspSubString)
+	}
+}
+
+func TestSetAppLaunchContentSecurityPolicy(t *testing.T) {
+	t.Parallel()
+
+	applicationURL := "https://example.com"
+
+	expectedCspVals := map[string]string{
+		"default-src":     "'self'",
+		"base-uri":        "'self'",
+		"form-action":     "'self'",
+		"frame-ancestors": "'none'",
+		"object-src":      "'none'",
+		"style-src":       "'self' 'unsafe-inline'",
+		"img-src":         "'self' data: blob:",
+		"font-src":        "'self' data:",
+		"connect-src":     fmt.Sprintf("'self' %s", applicationURL),
+	}
+
+	h := make(http.Header)
+	SetAppLaunchContentSecurityPolicy(h, applicationURL)
+	actualCsp := h.Get("Content-Security-Policy")
+	for k, v := range expectedCspVals {
+		expectedCspSubString := fmt.Sprintf("%s %s;", k, v)
+		require.Contains(t, actualCsp, expectedCspSubString)
+	}
+}
+
+func TestSetRedirectPageContentSecurityPolicy(t *testing.T) {
+	t.Parallel()
+
+	scriptSrc := "nonce-123456789abcdefg"
+
+	expectedCspVals := map[string]string{
+		"default-src":     "'self'",
+		"base-uri":        "'self'",
+		"form-action":     "'self'",
+		"frame-ancestors": "'none'",
+		"object-src":      "'none'",
+		"style-src":       "'self' 'unsafe-inline'",
+		"img-src":         "'self' data: blob:",
+		"script-src":      fmt.Sprintf("'%s'", scriptSrc),
+	}
+
+	h := make(http.Header)
+	SetRedirectPageContentSecurityPolicy(h, scriptSrc)
+	actualCsp := h.Get("Content-Security-Policy")
+	for k, v := range expectedCspVals {
+		expectedCspSubString := fmt.Sprintf("%s %s;", k, v)
+		require.Contains(t, actualCsp, expectedCspSubString)
+	}
+}
diff --git a/lib/httplib/reverseproxy/handler.go b/lib/httplib/reverseproxy/handler.go
new file mode 100644
index 0000000000000..d14c4fd853b9c
--- /dev/null
+++ b/lib/httplib/reverseproxy/handler.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package reverseproxy
+
+import (
+	"io"
+	"net"
+	"net/http"
+)
+
+// ErrorHandler is an interface for handling errors.
+type ErrorHandler interface {
+	ServeHTTP(w http.ResponseWriter, req *http.Request, err error)
+}
+
+// DefaultHandler is the default error handler.
+var DefaultHandler ErrorHandler = &defaultHandler{}
+
+// defaultHandler is the default error handler.
+type defaultHandler struct{}
+
+// ServeHTTP writes the error message to the response.
+func (e *defaultHandler) ServeHTTP(w http.ResponseWriter, req *http.Request, err error) {
+	statusCode := http.StatusInternalServerError
+	switch {
+	case err == io.EOF:
+		statusCode = http.StatusBadGateway
+	default:
+		switch e, ok := err.(net.Error); {
+		case ok && e.Timeout():
+			statusCode = http.StatusGatewayTimeout
+		case ok:
+			statusCode = http.StatusBadGateway
+		}
+	}
+	w.WriteHeader(statusCode)
+	w.Write([]byte(http.StatusText(statusCode)))
+}
+
+// ErrorHandlerFunc is an adapter to allow the use of ordinary functions as
+// error handlers. If f is a function with the appropriate signature,
+// ErrorHandlerFunc(f) is a ErrorHandler that calls f.
+type ErrorHandlerFunc func(http.ResponseWriter, *http.Request, error)
+
+// ServeHTTP calls f(w, r).
+func (f ErrorHandlerFunc) ServeHTTP(w http.ResponseWriter, r *http.Request, err error) {
+	f(w, r, err)
+}
diff --git a/lib/httplib/reverseproxy/reverse_proxy.go b/lib/httplib/reverseproxy/reverse_proxy.go
new file mode 100644
index 0000000000000..e1c39ab884e4a
--- /dev/null
+++ b/lib/httplib/reverseproxy/reverse_proxy.go
@@ -0,0 +1,241 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package reverseproxy
+
+import (
+	"io"
+	"log"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/sirupsen/logrus"
+
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// X-* Header names.
+const (
+	XForwardedProto  = "X-Forwarded-Proto"
+	XForwardedFor    = "X-Forwarded-For"
+	XForwardedHost   = "X-Forwarded-Host"
+	XForwardedPort   = "X-Forwarded-Port"
+	XForwardedServer = "X-Forwarded-Server"
+	XRealIP          = "X-Real-Ip"
+)
+
+// XHeaders X-* headers.
+var XHeaders = []string{
+	XForwardedProto,
+	XForwardedFor,
+	XForwardedHost,
+	XForwardedPort,
+	XForwardedServer,
+	XRealIP,
+}
+
+const (
+	// ContentLength is the Content-Length header.
+	ContentLength = "Content-Length"
+)
+
+// Forwarder is a reverse proxy that forwards http requests to another server.
+type Forwarder struct {
+	passHostHeader bool
+	headerRewriter Rewriter
+	*httputil.ReverseProxy
+	log       utils.FieldLoggerWithWriter
+	transport http.RoundTripper
+}
+
+// New returns a new reverse proxy that forwards to the given url.
+// If passHostHeader is true, the Host header will be copied from the
+// request to the forwarded request. Otherwise, the Host header will be
+// set to the host portion of the url.
+func New(opts ...Option) (*Forwarder, error) {
+	fwd := &Forwarder{
+		headerRewriter: NewHeaderRewriter(),
+		ReverseProxy: &httputil.ReverseProxy{
+			ErrorHandler: DefaultHandler.ServeHTTP,
+		},
+		log: utils.NewLogger(),
+	}
+	// Apply options.
+	for _, opt := range opts {
+		opt(fwd)
+	}
+
+	// Director is called by the ReverseProxy to modify the request.
+	fwd.Director = func(request *http.Request) {
+		modifyRequest(request)
+		if fwd.headerRewriter != nil {
+			fwd.headerRewriter.Rewrite(request)
+		}
+		if !fwd.passHostHeader {
+			request.Host = request.URL.Host
+		}
+	}
+
+	if fwd.transport == nil {
+		tr, err := defaults.Transport()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		fwd.transport = tr
+	}
+	// Set the transport for the reverse proxy to use a round tripper
+	// that logs the request and response.
+	fwd.ReverseProxy.Transport = &roundTripperWithLogger{transport: fwd.transport, log: fwd.log}
+
+	return fwd, nil
+}
+
+// Option is a functional option for the forwarder.
+type Option func(*Forwarder)
+
+// WithFlushInterval sets the flush interval for the forwarder.
+func WithFlushInterval(interval time.Duration) Option {
+	return func(rp *Forwarder) {
+		rp.FlushInterval = interval
+	}
+}
+
+// WithLogger sets the logger for the forwarder. It uses the logger.Writer()
+// method to get the io.Writer to use for the stdlib logger.
+func WithLogger(logger utils.FieldLoggerWithWriter) Option {
+	return func(rp *Forwarder) {
+		rp.log = logger
+		// TODO: this is a hack to get the stdlib logger to work with the
+		// logrus logger.
+		if rp.ReverseProxy.ErrorLog == nil {
+			rp.ReverseProxy.ErrorLog = log.New(logger.WriterLevel(logrus.DebugLevel), "", log.LstdFlags)
+		}
+	}
+}
+
+// WithLogWriter sets the writer for the stdlib logger to use a different
+// io.Writer than the default one created when using WithLogger.
+func WithLogWriter(w *io.PipeWriter) Option {
+	return func(rp *Forwarder) {
+		rp.ReverseProxy.ErrorLog = log.New(w, "", log.LstdFlags)
+	}
+}
+
+// WithRoundTripper sets the round tripper for the forwarder.
+func WithRoundTripper(transport http.RoundTripper) Option {
+	return func(rp *Forwarder) {
+		rp.transport = transport
+	}
+}
+
+// WithErrorHandler sets the error handler for the forwarder.
+func WithErrorHandler(e ErrorHandlerFunc) Option {
+	return func(rp *Forwarder) {
+		rp.ErrorHandler = e
+	}
+}
+
+// WithRewriter sets the header rewriter for the forwarder.
+func WithRewriter(h Rewriter) Option {
+	return func(rp *Forwarder) {
+		rp.headerRewriter = h
+	}
+}
+
+// WithPassHostHeader sets whether the Host header should be passed to the
+// forwarded request.
+func WithPassHostHeader() Option {
+	return func(rp *Forwarder) {
+		rp.passHostHeader = true
+	}
+}
+
+// Modify the request to handle the target URL.
+func modifyRequest(outReq *http.Request) {
+	u := getURLFromRequest(outReq)
+
+	outReq.URL.Path = u.Path
+	outReq.URL.RawPath = u.RawPath
+	outReq.URL.RawQuery = u.RawQuery
+	outReq.RequestURI = "" // Outgoing request should not have RequestURI
+
+	outReq.Proto = "HTTP/1.1"
+	outReq.ProtoMajor = 1
+	outReq.ProtoMinor = 1
+}
+
+// getURLFromRequest returns the URL from the request object. If the request
+// RequestURI is non-empty and parsable, it will be used. Otherwise, the URL
+// will be used.
+func getURLFromRequest(req *http.Request) *url.URL {
+	// If the Request was created by Go via a real HTTP request,
+	// RequestURI will contain the original query string.
+	// If the Request was created in code,
+	// RequestURI will be empty, and we will use the URL object instead
+	u := req.URL
+	if req.RequestURI != "" {
+		parsedURL, err := url.ParseRequestURI(req.RequestURI)
+		if err == nil {
+			return parsedURL
+		}
+	}
+	return u
+}
+
+type roundTripperWithLogger struct {
+	log       logrus.FieldLogger
+	transport http.RoundTripper
+}
+
+// CloseIdleConnections ensures idle connections of the wrapped
+// [http.RoundTripper] are closed.
+func (r *roundTripperWithLogger) CloseIdleConnections() {
+	type closeIdler interface {
+		CloseIdleConnections()
+	}
+	if tr, ok := r.transport.(closeIdler); ok {
+		tr.CloseIdleConnections()
+	}
+}
+
+// RoundTrip forwards the request on to the provided http.RoundTripper and logs
+// the request and response.
+func (r *roundTripperWithLogger) RoundTrip(req *http.Request) (*http.Response, error) {
+	start := time.Now()
+	rsp, err := r.transport.RoundTrip(req)
+	if err != nil {
+		r.log.Errorf("Error forwarding to %v, err: %v", req.URL, err)
+		return rsp, err
+	}
+
+	if req.TLS != nil {
+		r.log.Infof("Round trip: %v %v, code: %v, duration: %v tls:version: %x, tls:resume:%t, tls:csuite:%x, tls:server:%v",
+			req.Method, req.URL, rsp.StatusCode, time.Now().UTC().Sub(start),
+			req.TLS.Version,
+			req.TLS.DidResume,
+			req.TLS.CipherSuite,
+			req.TLS.ServerName)
+	} else {
+		r.log.Infof("Round trip: %v %v, code: %v, duration: %v",
+			req.Method, req.URL, rsp.StatusCode, time.Now().UTC().Sub(start))
+	}
+
+	return rsp, nil
+}
diff --git a/lib/httplib/reverseproxy/rewriter.go b/lib/httplib/reverseproxy/rewriter.go
new file mode 100644
index 0000000000000..807ce421b779b
--- /dev/null
+++ b/lib/httplib/reverseproxy/rewriter.go
@@ -0,0 +1,125 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package reverseproxy
+
+import (
+	"net"
+	"net/http"
+	"os"
+	"strings"
+)
+
+// Rewriter is an interface for rewriting http requests.
+type Rewriter interface {
+	Rewrite(*http.Request)
+}
+
+// NewHeaderRewriter creates a new HeaderRewriter.
+func NewHeaderRewriter() *HeaderRewriter {
+	h, err := os.Hostname()
+	if err != nil {
+		h = "localhost"
+	}
+	return &HeaderRewriter{TrustForwardHeader: true, Hostname: h}
+}
+
+// HeaderRewriter re-sets the X-Forwarded-* headers and sets X-Real-IP header.
+type HeaderRewriter struct {
+	TrustForwardHeader bool
+	Hostname           string
+}
+
+// Rewrite request headers.
+func (rw *HeaderRewriter) Rewrite(req *http.Request) {
+	if !rw.TrustForwardHeader {
+		for _, h := range XHeaders {
+			req.Header.Del(h)
+		}
+	}
+
+	// Set X-Real-IP header if it is not set to the IP address of the client making the request.
+	maybeSetXRealIP(req)
+
+	// Set X-Forwarded-Proto header if it is not set to the scheme of the request.
+	maybeSetForwardedProto(req)
+
+	if xfPort := req.Header.Get(XForwardedPort); xfPort == "" {
+		req.Header.Set(XForwardedPort, forwardedPort(req))
+	}
+
+	if xfHost := req.Header.Get(XForwardedHost); xfHost == "" && req.Host != "" {
+		req.Header.Set(XForwardedHost, req.Host)
+	}
+
+	if rw.Hostname != "" {
+		req.Header.Set(XForwardedServer, rw.Hostname)
+	}
+}
+
+// forwardedPort returns the port part of the Host header if present, otherwise,
+// returns "80" if the scheme is http or "443" if the scheme is https or wss.
+func forwardedPort(req *http.Request) string {
+	if req == nil {
+		return ""
+	}
+
+	if _, port, err := net.SplitHostPort(req.Host); err == nil && port != "" {
+		return port
+	}
+
+	if req.Header.Get(XForwardedProto) == "https" || req.Header.Get(XForwardedProto) == "wss" {
+		return "443"
+	}
+
+	if req.TLS != nil {
+		return "443"
+	}
+
+	return "80"
+}
+
+// maybeSetXRealIP sets X-Real-IP header if it is not set to the IP address of
+// the client making the request.
+func maybeSetXRealIP(req *http.Request) {
+	if req.Header.Get(XRealIP) != "" {
+		return
+	}
+	if clientIP, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
+		clientIP = ipv6fix(clientIP)
+		req.Header.Set(XRealIP, clientIP)
+	}
+}
+
+// maybeSetForwardedProto sets X-Forwarded-Proto header if it is not set to the
+// scheme of the request.
+func maybeSetForwardedProto(req *http.Request) {
+	if req.Header.Get(XForwardedProto) != "" {
+		return
+	}
+
+	if req.TLS != nil {
+		req.Header.Set(XForwardedProto, "https")
+	} else {
+		req.Header.Set(XForwardedProto, "http")
+	}
+}
+
+// clean up IP in case if it is ipv6 address and it has {zone} information in
+// it, like "[fe80::d806:a55d:eb1b:49cc%vEthernet (vmxnet3 Ethernet Adapter - Virtual Switch)]:64692".
+func ipv6fix(clientIP string) string {
+	return strings.Split(clientIP, "%")[0]
+}
diff --git a/lib/httplib/reverseproxy/rewriter_test.go b/lib/httplib/reverseproxy/rewriter_test.go
new file mode 100644
index 0000000000000..31913c52755f9
--- /dev/null
+++ b/lib/httplib/reverseproxy/rewriter_test.go
@@ -0,0 +1,158 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package reverseproxy
+
+import (
+	"crypto/tls"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestIPv6Fix(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		clientIP string
+		expected string
+	}{
+		{
+			desc:     "empty",
+			clientIP: "",
+			expected: "",
+		},
+		{
+			desc:     "ipv4 localhost",
+			clientIP: "127.0.0.1",
+			expected: "127.0.0.1",
+		},
+		{
+			desc:     "ipv4",
+			clientIP: "10.13.14.15",
+			expected: "10.13.14.15",
+		},
+		{
+			desc:     "ipv6 zone",
+			clientIP: `fe80::d806:a55d:eb1b:49cc%vEthernet (vmxnet3 Ethernet Adapter - Virtual Switch)`,
+			expected: "fe80::d806:a55d:eb1b:49cc",
+		},
+		{
+			desc:     "ipv6 medium",
+			clientIP: `fe80::1`,
+			expected: "fe80::1",
+		},
+		{
+			desc:     "ipv6 small",
+			clientIP: `2000::`,
+			expected: "2000::",
+		},
+		{
+			desc:     "ipv6",
+			clientIP: `2001:3452:4952:2837::`,
+			expected: "2001:3452:4952:2837::",
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			actual := ipv6fix(test.clientIP)
+			require.Equal(t, test.expected, actual)
+		})
+	}
+}
+
+func TestRewriter(t *testing.T) {
+	const hostname = "teleport-dev"
+	testCases := []struct {
+		desc       string
+		reqHeaders http.Header
+		tlsReq     bool
+		hostReq    string
+		remoteAddr string
+		expected   http.Header
+	}{
+		{
+			desc:       "set x-real-ip",
+			reqHeaders: http.Header{},
+			tlsReq:     true,
+			hostReq:    "teleport.dev:3543",
+			remoteAddr: "1.2.3.4:1234",
+			expected: http.Header{
+				XForwardedHost:   []string{"teleport.dev:3543"},
+				XForwardedPort:   []string{"3543"},
+				XForwardedProto:  []string{"https"},
+				XForwardedServer: []string{hostname},
+				XRealIP:          []string{"1.2.3.4"},
+			},
+		},
+		{
+			desc: "trust x-real-ip",
+			reqHeaders: http.Header{
+				XRealIP: []string{"5.6.7.8"},
+			},
+			tlsReq:     false,
+			hostReq:    "teleport.dev:3543",
+			remoteAddr: "1.2.3.4:1234",
+			expected: http.Header{
+				XForwardedHost:   []string{"teleport.dev:3543"},
+				XForwardedPort:   []string{"3543"},
+				XForwardedProto:  []string{"http"},
+				XForwardedServer: []string{hostname},
+				XRealIP:          []string{"5.6.7.8"},
+			},
+		},
+		{
+			desc: "trust x-real-ip and guess port from schema",
+			reqHeaders: http.Header{
+				XRealIP: []string{"5.6.7.8"},
+			},
+			tlsReq:     false,
+			hostReq:    "teleport.dev",
+			remoteAddr: "1.2.3.4:1234",
+			expected: http.Header{
+				XForwardedHost:   []string{"teleport.dev"},
+				XForwardedPort:   []string{"80"},
+				XForwardedProto:  []string{"http"},
+				XForwardedServer: []string{hostname},
+				XRealIP:          []string{"5.6.7.8"},
+			},
+		},
+	}
+	rewriter := NewHeaderRewriter()
+	// set hostname to make sure it's the same in all tests.
+	rewriter.Hostname = hostname
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			req := &http.Request{
+				Host:       test.hostReq,
+				Header:     test.reqHeaders,
+				RemoteAddr: test.remoteAddr,
+			}
+			if test.tlsReq {
+				req.TLS = &tls.ConnectionState{}
+			}
+			rewriter.Rewrite(req)
+			require.Equal(t, test.expected, req.Header)
+		})
+	}
+}
diff --git a/lib/integrations/awsoidc/clients.go b/lib/integrations/awsoidc/clients.go
index ebf5bc17b9cb0..eb4535ef84c57 100644
--- a/lib/integrations/awsoidc/clients.go
+++ b/lib/integrations/awsoidc/clients.go
@@ -22,6 +22,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
+	"github.com/aws/aws-sdk-go-v2/service/ecs"
 	"github.com/aws/aws-sdk-go-v2/service/rds"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/gravitational/trace"
@@ -29,6 +30,9 @@ import (
 
 // AWSClientRequest contains the required fields to set up an AWS service client.
 type AWSClientRequest struct {
+	// IntegrationName is the integration name that is going to issue an API Call.
+	IntegrationName string
+
 	// Token is the token used to issue the API Call.
 	Token string
 
@@ -37,10 +41,17 @@ type AWSClientRequest struct {
 
 	// Region where the API call should be made.
 	Region string
+
+	// httpClient used in tests.
+	httpClient aws.HTTPClient
 }
 
 // CheckAndSetDefaults checks if the required fields are present.
 func (req *AWSClientRequest) CheckAndSetDefaults() error {
+	if req.IntegrationName == "" {
+		return trace.BadParameter("integration name is required")
+	}
+
 	if req.Token == "" {
 		return trace.BadParameter("token is required")
 	}
@@ -58,11 +69,19 @@ func (req *AWSClientRequest) CheckAndSetDefaults() error {
 
 // newAWSConfig creates a new [aws.Config] using the [AWSClientRequest] fields.
 func newAWSConfig(ctx context.Context, req *AWSClientRequest) (*aws.Config, error) {
+	if err := req.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(req.Region))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
+	if req.httpClient != nil {
+		cfg.HTTPClient = req.httpClient
+	}
+
 	cfg.Credentials = stscreds.NewWebIdentityRoleProvider(
 		sts.NewFromConfig(cfg),
 		req.RoleARN,
@@ -82,6 +101,16 @@ func newRDSClient(ctx context.Context, req *AWSClientRequest) (*rds.Client, erro
 	return rds.NewFromConfig(*cfg), nil
 }
 
+// newECSClient creates an [ecs.Client] using the provided Token, RoleARN and Region.
+func newECSClient(ctx context.Context, req *AWSClientRequest) (*ecs.Client, error) {
+	cfg, err := newAWSConfig(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return ecs.NewFromConfig(*cfg), nil
+}
+
 // IdentityToken is an implementation of [stscreds.IdentityTokenRetriever] for returning a static token.
 type IdentityToken string
 
diff --git a/lib/integrations/awsoidc/deployservice.go b/lib/integrations/awsoidc/deployservice.go
new file mode 100644
index 0000000000000..a01b23cb12914
--- /dev/null
+++ b/lib/integrations/awsoidc/deployservice.go
@@ -0,0 +1,590 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package awsoidc
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/service/ecs"
+	ecsTypes "github.com/aws/aws-sdk-go-v2/service/ecs/types"
+	"github.com/gravitational/trace"
+	"golang.org/x/exp/slices"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+)
+
+var (
+	// launchTypeFargateString is the FARGATE LaunchType converted into a string.
+	launchTypeFargateString = string(ecsTypes.LaunchTypeFargate)
+	// requiredCapacityProviders contains the FARGATE type which is required to deploy a Teleport Service.
+	requiredCapacityProviders = []string{launchTypeFargateString}
+
+	// Ensure Cpu and Memory use one of the allowed combinations:
+	// https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html
+	taskCPU = "2048"
+	taskMem = "4096"
+
+	// taskAgentContainerName is the name of the container to run within the Task.
+	// Each task supports multiple containers, but, currently, there's only one being used.
+	taskAgentContainerName = "teleport-service"
+
+	// oneAgent is used to define the desired agent count when creating a service.
+	oneAgent = int32(1)
+
+	// defaultTeleportIAMTokenName is the default Teleport IAM Token to use when it's not specified.
+	defaultTeleportIAMTokenName = "discover-aws-oidc-iam-token"
+)
+
+const (
+	// teleportContainerImageFmt is the Teleport Container Image to be used
+	teleportContainerImageFmt = "public.ecr.aws/gravitational/teleport-distroless:%s"
+
+	// clusterStatusActive is the string representing an ACTIVE ECS Cluster.
+	clusterStatusActive = "ACTIVE"
+	// clusterStatusInactive is the string representing an INACTIVE ECS Cluster.
+	clusterStatusInactive = "INACTIVE"
+	// clusterStatusProvisioning is the string representing an PROVISIONING ECS Cluster.
+	clusterStatusProvisioning = "PROVISIONING"
+	// clusterStatusProvisioningWaitTime defines for how long should the client wait for the Cluster to become available.
+	clusterStatusProvisioningWaitTime = 30 * time.Second
+	// clusterStatusProvisioningWaitTimeTick defines the interval between checks on Cluster status while it is Provisioning.
+	clusterStatusProvisioningWaitTimeTick = 1 * time.Second
+
+	// serviceStatusActive is the string representing an ACTIVE ECS Service.
+	serviceStatusActive = "ACTIVE"
+	// serviceStatusDraining is the string representing an DRAINING ECS Service.
+	serviceStatusDraining = "DRAINING"
+)
+
+var (
+	// DatabaseServiceDeploymentMode is a deployment configuration for Deploying a Database Service.
+	// This mode starts a Database with the specificied Resource Matchers.
+	DatabaseServiceDeploymentMode = "database-service"
+
+	// DeploymentModes has all the available deployment modes.
+	DeploymentModes = []string{
+		DatabaseServiceDeploymentMode,
+	}
+)
+
+// DeployServiceRequest contains the required fields to deploy a Teleport Service.
+type DeployServiceRequest struct {
+	// Region is the AWS Region
+	Region string
+
+	// SubnetIDs are the subnets associated with the service.
+	SubnetIDs []string
+
+	// ClusterName is the ECS Cluster to be used.
+	// It will be created if it doesn't exist.
+	// It will be updated if it doesn't include the FARGATE capacity provider using PutClusterCapacityProviders.
+	ClusterName *string
+
+	// ServiceName is the ECS Service to be used.
+	// It will be created if it doesn't exist.
+	// It will be updated if it doesn't match the required properties.
+	ServiceName *string
+
+	// TaskName is the ECS Task Definition's Family Name.
+	TaskName *string
+
+	// TaskRoleARN is the AWS Role's ARN used within the Task execution.
+	// Ensure the AWS Client has `iam:PassRole` for this Role's ARN.
+	TaskRoleARN string
+
+	// TeleportClusterName is the Teleport Cluster Name, used to create default names for Cluster, Service and Task.
+	TeleportClusterName string
+
+	// TeleportIAMTokenNameis the Teleport IAM Token to use in the deployed Service.
+	// Optional.
+	// Defaults to discover-aws-oidc-iam-token
+	TeleportIAMTokenName *string
+
+	// ProxyServerHostPort is the Teleport Proxy's Public.
+	ProxyServerHostPort string
+
+	// IntegrationName is the integration name.
+	// Used for resource tagging when creating resources in AWS.
+	IntegrationName string
+
+	// ResourceCreationTags is used to add tags when creating resources in AWS.
+	ResourceCreationTags awsTags
+
+	// DeploymentMode is the identifier of a deployment mode - which Teleport Services to enable and their configuration.
+	DeploymentMode string
+
+	// DatabaseResourceMatcherLabels contains the set of labels to be used by the DatabaseService.
+	// This is used when the deployment mode creates a Database Service.
+	DatabaseResourceMatcherLabels types.Labels
+}
+
+// normalizeECSResourceName converts a name into a valid ECS Resource Name.
+// TeleportCluster name must match the following:
+// > regexp.MustCompile(`^[0-9A-Za-z_\-@:./+]+$`)
+//
+// ECS Resources name must match the following:
+// > Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.
+// > regexp.MustCompile(`^[0-9A-Za-z_\-]+$`)
+// The following resources should be normalized
+// - ECS Cluster Name (r.ClusterName)
+// - ECS Service Name (r.ServiceName)
+// - ECS TaskDefinition Family (r.TaskName)
+func normalizeECSResourceName(name string) string {
+	replacer := strings.NewReplacer(
+		"@", "_",
+		":", "_",
+		".", "_",
+		"/", "_",
+		"+", "_",
+	)
+
+	return replacer.Replace(name)
+}
+
+// CheckAndSetDefaults checks if the required fields are present.
+func (r *DeployServiceRequest) CheckAndSetDefaults() error {
+	if r.TeleportClusterName == "" {
+		return trace.BadParameter("teleport cluster name is required")
+	}
+	baseResourceName := normalizeECSResourceName(r.TeleportClusterName)
+
+	if r.TeleportIAMTokenName == nil || *r.TeleportIAMTokenName == "" {
+		r.TeleportIAMTokenName = &defaultTeleportIAMTokenName
+	}
+
+	if r.DeploymentMode == "" {
+		return trace.BadParameter("deployment mode is required, please use one of the following: %v", DeploymentModes)
+	}
+
+	if !slices.Contains(DeploymentModes, r.DeploymentMode) {
+		return trace.BadParameter("invalid deployment mode, please use one of the following: %v", DeploymentModes)
+	}
+
+	if r.Region == "" {
+		return trace.BadParameter("region is required")
+	}
+
+	if len(r.SubnetIDs) == 0 {
+		return trace.BadParameter("at least one subnet id is required")
+	}
+
+	if r.TaskRoleARN == "" {
+		return trace.BadParameter("task role arn is required")
+	}
+
+	if r.ClusterName == nil || *r.ClusterName == "" {
+		clusterName := fmt.Sprintf("%s-teleport", baseResourceName)
+		r.ClusterName = &clusterName
+	}
+
+	if r.ServiceName == nil || *r.ServiceName == "" {
+		serviceName := fmt.Sprintf("%s-teleport-%s", baseResourceName, r.DeploymentMode)
+		r.ServiceName = &serviceName
+	}
+
+	if r.TaskName == nil || *r.TaskName == "" {
+		taskName := fmt.Sprintf("%s-teleport-%s", baseResourceName, r.DeploymentMode)
+		r.TaskName = &taskName
+	}
+
+	if r.ProxyServerHostPort == "" {
+		return trace.BadParameter("proxy address is required")
+	}
+
+	if r.IntegrationName == "" {
+		return trace.BadParameter("integration name is required")
+	}
+
+	if r.ResourceCreationTags == nil {
+		r.ResourceCreationTags = DefaultResourceCreationTags(r.TeleportClusterName, r.IntegrationName)
+	}
+
+	if len(r.DatabaseResourceMatcherLabels) == 0 {
+		return trace.BadParameter("at least one agent matcher label is required")
+	}
+
+	return nil
+}
+
+// DeployServiceResponse contains the ARNs of the Amazon resources used to deploy the Teleport Service.
+type DeployServiceResponse struct {
+	// ClusterARN is the Amazon ECS Cluster ARN where the task was started.
+	ClusterARN string
+
+	// ServiceARN is the Amazon ECS Cluster Service ARN created to run the task.
+	ServiceARN string
+
+	// TaskDefinitionARN is the Amazon ECS Task Definition ARN created to run the  Teleport Service.
+	TaskDefinitionARN string
+
+	// ServiceDashboardURL is a link to the service's Dashboard URL in Amazon Console.
+	ServiceDashboardURL string
+}
+
+// DeployServiceClient describes the required methods to Deploy a  Teleport Service.
+type DeployServiceClient interface {
+	// DescribeClusters lists ECS Clusters.
+	// https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ecs@v1.27.1#Client.DescribeClusters
+	DescribeClusters(ctx context.Context, params *ecs.DescribeClustersInput, optFns ...func(*ecs.Options)) (*ecs.DescribeClustersOutput, error)
+
+	// CreateCluster creates a new cluster.
+	// https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ecs@v1.27.1#Client.CreateCluster
+	CreateCluster(ctx context.Context, params *ecs.CreateClusterInput, optFns ...func(*ecs.Options)) (*ecs.CreateClusterOutput, error)
+
+	// PutClusterCapacityProviders sets the Capacity Providers available for services in a given cluster.
+	// https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ecs@v1.27.1#Client.PutClusterCapacityProviders
+	PutClusterCapacityProviders(ctx context.Context, params *ecs.PutClusterCapacityProvidersInput, optFns ...func(*ecs.Options)) (*ecs.PutClusterCapacityProvidersOutput, error)
+
+	// DescribeServices lists the matching Services of a given Cluster.
+	// https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ecs@v1.27.1#Client.DescribeServices
+	DescribeServices(ctx context.Context, params *ecs.DescribeServicesInput, optFns ...func(*ecs.Options)) (*ecs.DescribeServicesOutput, error)
+
+	// UpdateService updates the service.
+	// https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ecs@v1.27.1#Client.UpdateService
+	UpdateService(ctx context.Context, params *ecs.UpdateServiceInput, optFns ...func(*ecs.Options)) (*ecs.UpdateServiceOutput, error)
+
+	// CreateService starts a task within a cluster.
+	// https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ecs@v1.27.1#Client.CreateService
+	CreateService(ctx context.Context, params *ecs.CreateServiceInput, optFns ...func(*ecs.Options)) (*ecs.CreateServiceOutput, error)
+
+	// RegisterTaskDefinition registers a new task definition from the supplied family and containerDefinitions.
+	// https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ecs@v1.27.1#Client.RegisterTaskDefinition
+	RegisterTaskDefinition(ctx context.Context, params *ecs.RegisterTaskDefinitionInput, optFns ...func(*ecs.Options)) (*ecs.RegisterTaskDefinitionOutput, error)
+}
+
+// NewDeployServiceClient creates a new DeployServiceClient using a AWSClientRequest.
+func NewDeployServiceClient(ctx context.Context, clientReq *AWSClientRequest) (DeployServiceClient, error) {
+	return newECSClient(ctx, clientReq)
+}
+
+// DeployService calls Amazon ECS APIs to deploy a Teleport Service.
+//
+// # Pre-requirement: Set up discover-aws-oidc-iam-token for auto join
+//
+// The Teleport Service connects via `discover-aws-oidc-iam-token`, so ensure your cluster has the following token:
+//
+//	kind: token
+//	metadata:
+//	  name: discover-aws-oidc-iam-token
+//	spec:
+//	  allow:
+//	  - aws_account: "<account_id>"
+//	  join_method: iam
+//	  roles:
+//	  - Db
+//	version: v2
+//
+// You can also use the role received as parameter (req.TaskRoleARN) to have an even stricter matching.
+// Eg of the identity ARN: "arn:aws:sts::0123456789012:assumed-role/<req.TaskRoleARN>/<abcd>"
+//
+// # Pre-requirement: TaskRole and Integration Role
+// The required IAM Roles and Policies are described in [awsoidc.ConfigureDeployServiceIAM].
+
+// # Resource tagging
+//
+// Created resources have the following set of tags:
+// - teleport.dev/cluster: <clusterName>
+// - teleport.dev/origin: aws-oidc-integration
+// - teleport.dev/integration: <integrationName>
+//
+// If resources already exist, only resources with those tags will be updated.
+func DeployService(ctx context.Context, clt DeployServiceClient, req DeployServiceRequest) (*DeployServiceResponse, error) {
+	if err := req.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	teleportConfigString, err := generateTeleportConfigString(req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	taskDefinition, err := upsertTask(ctx, clt, req, teleportConfigString)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	taskDefinitionARN := *taskDefinition.TaskDefinitionArn
+
+	cluster, err := upsertCluster(ctx, clt, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	service, err := upsertService(ctx, clt, req, taskDefinitionARN)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	serviceDashboardURL := fmt.Sprintf("https://%s.console.aws.amazon.com/ecs/v2/clusters/%s/services/%s", req.Region, *req.ClusterName, *req.ServiceName)
+
+	return &DeployServiceResponse{
+		ClusterARN:          *cluster.ClusterArn,
+		ServiceARN:          *service.ServiceArn,
+		TaskDefinitionARN:   taskDefinitionARN,
+		ServiceDashboardURL: serviceDashboardURL,
+	}, nil
+}
+
+// upsertTask ensures a TaskDefinition with TaskName exists
+func upsertTask(ctx context.Context, clt DeployServiceClient, req DeployServiceRequest, configB64 string) (*ecsTypes.TaskDefinition, error) {
+	taskAgentContainerImage := fmt.Sprintf(teleportContainerImageFmt, teleport.Version)
+
+	taskDefOut, err := clt.RegisterTaskDefinition(ctx, &ecs.RegisterTaskDefinitionInput{
+		Family: req.TaskName,
+		RequiresCompatibilities: []ecsTypes.Compatibility{
+			ecsTypes.CompatibilityFargate,
+		},
+		Cpu:    &taskCPU,
+		Memory: &taskMem,
+
+		NetworkMode:      ecsTypes.NetworkModeAwsvpc,
+		TaskRoleArn:      &req.TaskRoleARN,
+		ExecutionRoleArn: &req.TaskRoleARN,
+		ContainerDefinitions: []ecsTypes.ContainerDefinition{{
+			Command: []string{
+				"start",
+				"--config-string",
+				configB64,
+			},
+			EntryPoint: []string{"teleport"},
+			Image:      &taskAgentContainerImage,
+			Name:       &taskAgentContainerName,
+			LogConfiguration: &ecsTypes.LogConfiguration{
+				LogDriver: ecsTypes.LogDriverAwslogs,
+				Options: map[string]string{
+					"awslogs-group":         "ecs-" + *req.ClusterName,
+					"awslogs-region":        req.Region,
+					"awslogs-create-group":  "true",
+					"awslogs-stream-prefix": *req.ServiceName + "/" + *req.TaskName,
+				},
+			},
+		}},
+		Tags: req.ResourceCreationTags.ToECSTags(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return taskDefOut.TaskDefinition, nil
+}
+
+// upsertCluster creates the cluster if it doesn't exist.
+// It will update the cluster if it doesn't have the required capacity provider (FARGATE)
+// It will re-create if its status is INACTIVE.
+// If the cluster status is not ACTIVE, an error is returned.
+// The cluster is returned.
+func upsertCluster(ctx context.Context, clt DeployServiceClient, req DeployServiceRequest) (*ecsTypes.Cluster, error) {
+	describeClustersResponse, err := clt.DescribeClusters(ctx, &ecs.DescribeClustersInput{
+		Clusters: []string{*req.ClusterName},
+		Include: []ecsTypes.ClusterField{
+			ecsTypes.ClusterFieldTags,
+		},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if clusterMustBeCreated(describeClustersResponse.Clusters) {
+		createClusterResp, err := clt.CreateCluster(ctx, &ecs.CreateClusterInput{
+			ClusterName:       req.ClusterName,
+			CapacityProviders: requiredCapacityProviders,
+			Tags:              req.ResourceCreationTags.ToECSTags(),
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if err := waitForActiveCluster(ctx, clt, req, createClusterResp.Cluster); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return createClusterResp.Cluster, nil
+	}
+
+	// There's a cluster and it is not INACTIVE.
+	cluster := &describeClustersResponse.Clusters[0]
+
+	ownershipTags := req.ResourceCreationTags
+	if !ownershipTags.MatchesECSTags(cluster.Tags) {
+		return nil, trace.Errorf("ECS Cluster %q already exists but is not managed by Teleport. "+
+			"Add the following tags to allow Teleport to manage this cluster: %s", *req.ClusterName, req.ResourceCreationTags)
+	}
+
+	if slices.Contains(cluster.CapacityProviders, launchTypeFargateString) {
+		return cluster, nil
+	}
+
+	// Ensure the required capacity provider (Fargate) is available.
+	putClusterCPResp, err := clt.PutClusterCapacityProviders(ctx, &ecs.PutClusterCapacityProvidersInput{
+		Cluster:           req.ClusterName,
+		CapacityProviders: requiredCapacityProviders,
+		DefaultCapacityProviderStrategy: []ecsTypes.CapacityProviderStrategyItem{{
+			CapacityProvider: &launchTypeFargateString,
+		}},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := waitForActiveCluster(ctx, clt, req, cluster); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return putClusterCPResp.Cluster, nil
+}
+
+// clusterMustBeCreated returns true if there's no cluster or the existing one has an Inactive (deleted) status.
+func clusterMustBeCreated(clusters []ecsTypes.Cluster) bool {
+	if len(clusters) == 0 {
+		return true
+	}
+
+	cluster := clusters[0]
+
+	return *cluster.Status == clusterStatusInactive
+}
+
+// waitForActiveCluster waits until the Cluster is Active.
+// If the Cluster is Provisioning, then it waits at most clusterStatusProvisioningWaitTime (30 seconds) for it to become ready.
+func waitForActiveCluster(ctx context.Context, clt DeployServiceClient, req DeployServiceRequest, cluster *ecsTypes.Cluster) error {
+	if cluster.Status != nil && *cluster.Status == clusterStatusActive {
+		return nil
+	}
+
+	retry, err := retryutils.NewConstant(clusterStatusProvisioningWaitTimeTick)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	retryCtx, cancel := context.WithTimeout(ctx, clusterStatusProvisioningWaitTime)
+	defer cancel()
+
+	err = retry.For(retryCtx, func() error {
+		describeClustersResponse, err := clt.DescribeClusters(ctx, &ecs.DescribeClustersInput{
+			Clusters: []string{*req.ClusterName},
+		})
+		if err != nil {
+			return retryutils.PermanentRetryError(trace.Wrap(err))
+		}
+
+		if len(describeClustersResponse.Clusters) == 0 {
+			return retryutils.PermanentRetryError(trace.NotFound("cluster %q does not exist", *cluster.ClusterName))
+		}
+
+		cluster := describeClustersResponse.Clusters[0]
+		if cluster.Status == nil {
+			return retryutils.PermanentRetryError(trace.Errorf("cluster %q has an unknown (nil) status", *cluster.ClusterName))
+		}
+
+		if *cluster.Status == clusterStatusActive {
+			return nil
+		}
+
+		if *cluster.Status == clusterStatusProvisioning {
+			return trace.Errorf("cluster %q is provisioning...", *cluster.ClusterName)
+		}
+
+		return retryutils.PermanentRetryError(trace.Errorf("unexpected status %s for ECS Cluster %q", *cluster.ClusterName, *cluster.Status))
+	})
+
+	return trace.Wrap(err)
+}
+
+// upsertService creates or updates the service.
+// If the service exists but its LaunchType is not Fargate, then it gets re-created.
+func upsertService(ctx context.Context, clt DeployServiceClient, req DeployServiceRequest, taskARN string) (*ecsTypes.Service, error) {
+	describeServiceOut, err := clt.DescribeServices(ctx, &ecs.DescribeServicesInput{
+		Services: []string{*req.ServiceName},
+		Cluster:  req.ClusterName,
+		Include: []ecsTypes.ServiceField{
+			ecsTypes.ServiceFieldTags,
+		},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Service already exists.
+	if len(describeServiceOut.Services) > 0 {
+		service := &describeServiceOut.Services[0]
+
+		if service.Status == nil {
+			return nil, trace.Errorf("unknown status for ECS Service %q", *req.ServiceName)
+		}
+
+		if *service.Status == serviceStatusDraining {
+			return nil, trace.Errorf("ECS Service is draining, please retry in a couple of minutes")
+		}
+
+		if *service.Status == serviceStatusActive {
+			ownershipTags := req.ResourceCreationTags
+			if !ownershipTags.MatchesECSTags(service.Tags) {
+				return nil, trace.Errorf("ECS Service %q already exists but is not managed by Teleport. "+
+					"Add the following tags to allow Teleport to manage this service: %s", *req.ServiceName, req.ResourceCreationTags)
+			}
+
+			// If the LaunchType is the required one, than we can update the current Service.
+			// Otherwise we have to delete it.
+			if service.LaunchType != ecsTypes.LaunchTypeFargate {
+				return nil, trace.Errorf("ECS Service %q already exists but has an invalid LaunchType %q. Delete the Service and try again.", *req.ServiceName, service.LaunchType)
+			}
+
+			updateServiceResp, err := clt.UpdateService(ctx, &ecs.UpdateServiceInput{
+				Service:        req.ServiceName,
+				DesiredCount:   &oneAgent,
+				TaskDefinition: &taskARN,
+				Cluster:        req.ClusterName,
+				NetworkConfiguration: &ecsTypes.NetworkConfiguration{
+					AwsvpcConfiguration: &ecsTypes.AwsVpcConfiguration{
+						AssignPublicIp: ecsTypes.AssignPublicIpEnabled, // no internet connection otherwise
+						Subnets:        req.SubnetIDs,
+					},
+				},
+				ForceNewDeployment: true,
+				PropagateTags:      ecsTypes.PropagateTagsService,
+			})
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			return updateServiceResp.Service, nil
+		}
+	}
+
+	createServiceOut, err := clt.CreateService(ctx, &ecs.CreateServiceInput{
+		ServiceName:    req.ServiceName,
+		DesiredCount:   &oneAgent,
+		LaunchType:     ecsTypes.LaunchTypeFargate,
+		TaskDefinition: &taskARN,
+		Cluster:        req.ClusterName,
+		NetworkConfiguration: &ecsTypes.NetworkConfiguration{
+			AwsvpcConfiguration: &ecsTypes.AwsVpcConfiguration{
+				AssignPublicIp: ecsTypes.AssignPublicIpEnabled, // no internet connection otherwise
+				Subnets:        req.SubnetIDs,
+			},
+		},
+		Tags:          req.ResourceCreationTags.ToECSTags(),
+		PropagateTags: ecsTypes.PropagateTagsService,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return createServiceOut.Service, nil
+}
diff --git a/lib/integrations/awsoidc/deployservice_config.go b/lib/integrations/awsoidc/deployservice_config.go
new file mode 100644
index 0000000000000..ac6db9255b10c
--- /dev/null
+++ b/lib/integrations/awsoidc/deployservice_config.go
@@ -0,0 +1,87 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package awsoidc
+
+import (
+	"encoding/base64"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v2"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/config"
+	"github.com/gravitational/teleport/lib/defaults"
+)
+
+// generateTeleportConfigString creates a teleport.yaml configuration that the agent
+// deployed in a ECS Cluster (using Fargate) will use.
+//
+// Returns config as base64-encoded string suitable for passing to teleport process
+// via --config-string flag.
+func generateTeleportConfigString(req DeployServiceRequest) (string, error) {
+	teleportConfig, err := config.MakeSampleFileConfig(config.SampleFlags{
+		Version:      defaults.TeleportConfigVersionV3,
+		ProxyAddress: req.ProxyServerHostPort,
+	})
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	// Disable default services
+	teleportConfig.Auth.EnabledFlag = "no"
+	teleportConfig.Proxy.EnabledFlag = "no"
+	teleportConfig.SSH.EnabledFlag = "no"
+
+	// Ensure the NodeName is not set to the current host (Teleport Proxy).
+	// Setting it to an empty string, ensures the NodeName is picked up from the host's hostname.
+	teleportConfig.NodeName = ""
+
+	// Use IAM Token join method to enroll into the Cluster.
+	// req.TeleportIAMTokenName must have the following TokenRule:
+	/*
+		types.TokenRule{
+			AWSAccount: "<account-id>",
+			AWSARN:     "arn:aws:sts::<account-id>:assumed-role/<taskRoleARN>/*",
+		}
+	*/
+	teleportConfig.JoinParams = config.JoinParams{
+		TokenName: *req.TeleportIAMTokenName,
+		Method:    types.JoinMethodIAM,
+	}
+
+	switch req.DeploymentMode {
+	case DatabaseServiceDeploymentMode:
+		teleportConfig.Databases.Service.EnabledFlag = "yes"
+		teleportConfig.Databases.ResourceMatchers = []config.ResourceMatcher{{
+			Labels: req.DatabaseResourceMatcherLabels,
+		}}
+
+	default:
+		return "", trace.BadParameter("invalid deployment mode %q, supported modes: %v", req.DeploymentMode, DeploymentModes)
+	}
+
+	teleportConfigYAMLBytes, err := yaml.Marshal(teleportConfig)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	// This Config is meant to be passed as argument to `teleport start`
+	// Eg, `teleport start --config-string <X>`
+	teleportConfigString := base64.StdEncoding.EncodeToString(teleportConfigYAMLBytes)
+
+	return teleportConfigString, nil
+}
diff --git a/lib/integrations/awsoidc/deployservice_iam_config.go b/lib/integrations/awsoidc/deployservice_iam_config.go
new file mode 100644
index 0000000000000..2c994c746928e
--- /dev/null
+++ b/lib/integrations/awsoidc/deployservice_iam_config.go
@@ -0,0 +1,334 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package awsoidc
+
+import (
+	"context"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/gravitational/trace"
+
+	awsapiutils "github.com/gravitational/teleport/api/utils/aws"
+	awslib "github.com/gravitational/teleport/lib/cloud/aws"
+	awslibutils "github.com/gravitational/teleport/lib/utils/aws"
+)
+
+const (
+	boundarySuffix = "Boundary"
+)
+
+var taskRoleDescription = "Used by Teleport Database Service deployed in Amazon ECS."
+
+// DeployServiceIAMConfigureRequest is a request to configure the DeployService action required Roles.
+type DeployServiceIAMConfigureRequest struct {
+	// Cluster is the Teleport Cluster.
+	// Used for tagging the created Roles/Policies.
+	Cluster string
+
+	// IntegrationName is the Integration Name.
+	// Used for tagging the created Roles/Policies.
+	IntegrationName string
+
+	// Region is the AWS Region.
+	// Used to set up the AWS SDK Client.
+	Region string
+
+	// IntegrationRole is the Integration's AWS Role used to set up Teleport as an OIDC IdP.
+	IntegrationRole string
+
+	// IntegrationRoleDeployServicePolicy is the Policy Name that is created to allow the DeployService to call AWS APIs (ecs, logs).
+	// Defaults to DeployService.
+	IntegrationRoleDeployServicePolicy string
+
+	// TaskRole is the AWS Role used by the deployed service.
+	TaskRole string
+
+	// TaskRoleBoundaryPolicyName is the name to be used to create a Policy to be used as boundary for the TaskRole.
+	// Defaults to <TaskRole>Boundary
+	TaskRoleBoundaryPolicyName string
+
+	// AccountID is the AWS Account ID.
+	// Optional. sts.GetCallerIdentity is used if not provided.
+	AccountID string
+
+	// ResourceCreationTags is used to add tags when creating resources in AWS.
+	// Defaults to:
+	// - teleport.dev/cluster: <cluster>
+	// - teleport.dev/origin: aws-oidc-integration
+	// - teleport.dev/integration: <integrationName>
+	ResourceCreationTags awsTags
+
+	// partitionID is the AWS Partition ID.
+	// Eg, aws, aws-cn, aws-us-gov
+	// https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html
+	partitionID string
+}
+
+// CheckAndSetDefaults ensures the required fields are present.
+func (r *DeployServiceIAMConfigureRequest) CheckAndSetDefaults() error {
+	if r.Cluster == "" {
+		return trace.BadParameter("cluster is required")
+	}
+
+	if r.IntegrationName == "" {
+		return trace.BadParameter("integration name is required")
+	}
+
+	if r.Region == "" {
+		return trace.BadParameter("region is required")
+	}
+
+	if r.IntegrationRole == "" {
+		return trace.BadParameter("integration role is required")
+	}
+
+	if r.IntegrationRoleDeployServicePolicy == "" {
+		r.IntegrationRoleDeployServicePolicy = "DeployService"
+	}
+
+	if r.TaskRole == "" {
+		return trace.BadParameter("task role is required")
+	}
+
+	if r.TaskRoleBoundaryPolicyName == "" {
+		r.TaskRoleBoundaryPolicyName = r.TaskRole + boundarySuffix
+	}
+
+	if len(r.ResourceCreationTags) == 0 {
+		r.ResourceCreationTags = DefaultResourceCreationTags(r.Cluster, r.IntegrationName)
+	}
+
+	r.partitionID = awsapiutils.GetPartitionFromRegion(r.Region)
+
+	return nil
+}
+
+// DeployServiceIAMConfigureClient describes the required methods to create the IAM Roles/Policies required for the DeployService action.
+type DeployServiceIAMConfigureClient interface {
+	// GetCallerIdentity returns information about the caller identity.
+	GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error)
+
+	// CreatePolicy creates a new IAM Policy.
+	CreatePolicy(ctx context.Context, params *iam.CreatePolicyInput, optFns ...func(*iam.Options)) (*iam.CreatePolicyOutput, error)
+
+	// CreateRole creates a new IAM Role.
+	CreateRole(ctx context.Context, params *iam.CreateRoleInput, optFns ...func(*iam.Options)) (*iam.CreateRoleOutput, error)
+
+	// PutRolePolicy creates or replaces a Policy by its name in a IAM Role.
+	PutRolePolicy(ctx context.Context, params *iam.PutRolePolicyInput, optFns ...func(*iam.Options)) (*iam.PutRolePolicyOutput, error)
+}
+
+type defaultDeployServiceIAMConfigureClient struct {
+	*iam.Client
+	stsClient *sts.Client
+}
+
+// NewDeployServiceIAMConfigureClient creates a new DeployServiceIAMConfigureClient.
+func NewDeployServiceIAMConfigureClient(ctx context.Context, region string) (DeployServiceIAMConfigureClient, error) {
+	if region == "" {
+		return nil, trace.BadParameter("region is required")
+	}
+
+	cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(region))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &defaultDeployServiceIAMConfigureClient{
+		Client:    iam.NewFromConfig(cfg),
+		stsClient: sts.NewFromConfig(cfg),
+	}, nil
+}
+
+// GetCallerIdentity returns details about the IAM user or role whose credentials are used to call the operation.
+func (d defaultDeployServiceIAMConfigureClient) GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error) {
+	return d.stsClient.GetCallerIdentity(ctx, params, optFns...)
+}
+
+// ConfigureDeployServiceIAM set ups the roles required for calling the DeployService action.
+// It creates the following:
+//
+// A) Role to be used by the deployed service, also known as _TaskRole_.
+// The Role is able to manage policies and create logs.
+// To ensure there's no priv escalation, we also set up a boundary policy.
+// The boundary policy only allows the above permissions and the `rds-db:connect`.
+//
+// B) Create a Policy in the Integration Role - the role used when setting up the integration.
+// This policy allows for the required API Calls to set up the Amazon ECS TaskDefinition, Cluster and Service.
+// It also allows to 'iam:PassRole' only for the _TaskRole_.
+//
+// The following actions must be allowed by the IAM Role assigned in the Client.
+// - iam:CreatePolicy
+// - iam:CreateRole
+// - iam:PutRolePolicy
+// - iam:TagPolicy
+// - iam:TagRole
+func ConfigureDeployServiceIAM(ctx context.Context, clt DeployServiceIAMConfigureClient, req DeployServiceIAMConfigureRequest) error {
+	if err := req.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if req.AccountID == "" {
+		callerIdentity, err := clt.GetCallerIdentity(ctx, nil)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		req.AccountID = aws.ToString(callerIdentity.Account)
+	}
+
+	if err := createBoundaryPolicyForTaskRole(ctx, clt, req); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := createTaskRole(ctx, clt, req); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := addPolicyToTaskRole(ctx, clt, req); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := addPolicyToIntegrationRole(ctx, clt, req); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// createBoundaryPolicyForTaskRole creates a Policy to be used as TaskRole's Role Boundary.
+// It allows for the TaskRole to:
+// - connect to any RDS DB
+// - Get, Put and Delete Role Policies to manage the Policy Statements when adding other rds-db:connect entries
+// - write application logs to CloudWatch
+func createBoundaryPolicyForTaskRole(ctx context.Context, clt DeployServiceIAMConfigureClient, req DeployServiceIAMConfigureRequest) error {
+	taskRoleARN := awslibutils.RoleARN(req.partitionID, req.AccountID, req.TaskRole)
+
+	taskRoleBoundaryPolicyDocument, err := awslib.NewPolicyDocument(
+		awslib.StatementForRDSDBConnect(),
+		awslib.StatementForIAMEditRolePolicy(taskRoleARN),
+		awslib.StatementForWritingLogs(),
+	).Marshal()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	_, err = clt.CreatePolicy(ctx, &iam.CreatePolicyInput{
+		PolicyName:     &req.TaskRoleBoundaryPolicyName,
+		PolicyDocument: &taskRoleBoundaryPolicyDocument,
+		Tags:           req.ResourceCreationTags.ToIAMTags(),
+	})
+	if err != nil {
+		convertedErr := awslib.ConvertIAMv2Error(err)
+		if trace.IsAlreadyExists(convertedErr) {
+			return trace.AlreadyExists("Policy %q already exists, please remove it and try again.", req.TaskRoleBoundaryPolicyName)
+		}
+		return trace.Wrap(convertedErr)
+	}
+
+	log.Printf("TaskRole: Boundary Policy %q created.\n", req.TaskRoleBoundaryPolicyName)
+	return nil
+}
+
+// createTaskRole creates the TaskRole and sets up the Role Boundary and its Trust Relationship.
+func createTaskRole(ctx context.Context, clt DeployServiceIAMConfigureClient, req DeployServiceIAMConfigureRequest) error {
+	taskRoleAssumeRoleDocument, err := awslib.NewPolicyDocument(
+		awslib.StatementForECSTaskRoleTrustRelationships(),
+	).Marshal()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	policyARNForRoleBoundary := awslibutils.PolicyARN(req.partitionID, req.AccountID, req.TaskRoleBoundaryPolicyName)
+
+	_, err = clt.CreateRole(ctx, &iam.CreateRoleInput{
+		RoleName:                 &req.TaskRole,
+		Description:              &taskRoleDescription,
+		AssumeRolePolicyDocument: &taskRoleAssumeRoleDocument,
+		PermissionsBoundary:      &policyARNForRoleBoundary,
+		Tags:                     req.ResourceCreationTags.ToIAMTags(),
+	})
+	if err != nil {
+		convertedErr := awslib.ConvertIAMv2Error(err)
+		if trace.IsAlreadyExists(convertedErr) {
+			return trace.AlreadyExists("Role %q already exists, please remove it and try again.", req.TaskRole)
+		}
+		return trace.Wrap(convertedErr)
+	}
+
+	log.Printf("TaskRole: Role %q created with Boundary %q.\n", req.TaskRole, policyARNForRoleBoundary)
+	return nil
+}
+
+// addPolicyToTaskRole updates the TaskRole to allow the service to:
+// - manage Policies of the TaskRole
+// - write logs to CloudWatch
+func addPolicyToTaskRole(ctx context.Context, clt DeployServiceIAMConfigureClient, req DeployServiceIAMConfigureRequest) error {
+	taskRoleARN := awslibutils.RoleARN(req.partitionID, req.AccountID, req.TaskRole)
+
+	taskRolePolicyDocument, err := awslib.NewPolicyDocument(
+		awslib.StatementForIAMEditRolePolicy(taskRoleARN),
+		awslib.StatementForWritingLogs(),
+	).Marshal()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	_, err = clt.PutRolePolicy(ctx, &iam.PutRolePolicyInput{
+		PolicyName:     &req.TaskRole,
+		RoleName:       &req.TaskRole,
+		PolicyDocument: &taskRolePolicyDocument,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	log.Printf("TaskRole: IAM Policy %q added to Role %q.\n", req.TaskRole, req.TaskRole)
+	return nil
+}
+
+// addPolicyToIntegrationRole creates or updates the DeployService Policy in IntegrationRole.
+// It allows the Proxy to call ECS APIs and to pass the TaskRole when deploying a service.
+func addPolicyToIntegrationRole(ctx context.Context, clt DeployServiceIAMConfigureClient, req DeployServiceIAMConfigureRequest) error {
+	taskRoleARN := awslibutils.RoleARN(req.partitionID, req.AccountID, req.TaskRole)
+
+	taskRolePolicyDocument, err := awslib.NewPolicyDocument(
+		awslib.StatementForIAMPassRole(taskRoleARN),
+		awslib.StatementForECSManageService(),
+	).Marshal()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	_, err = clt.PutRolePolicy(ctx, &iam.PutRolePolicyInput{
+		PolicyName:     &req.IntegrationRoleDeployServicePolicy,
+		RoleName:       &req.IntegrationRole,
+		PolicyDocument: &taskRolePolicyDocument,
+	})
+	if err != nil {
+		if trace.IsNotFound(awslib.ConvertIAMv2Error(err)) {
+			return trace.NotFound("Role %q not found.", req.IntegrationRole)
+		}
+		return trace.Wrap(err)
+	}
+
+	log.Printf("IntegrationRole: IAM Policy %q added to Role %q\n", req.IntegrationRoleDeployServicePolicy, req.IntegrationRole)
+	return nil
+}
diff --git a/lib/integrations/awsoidc/deployservice_iam_config_test.go b/lib/integrations/awsoidc/deployservice_iam_config_test.go
new file mode 100644
index 0000000000000..464fe164953cd
--- /dev/null
+++ b/lib/integrations/awsoidc/deployservice_iam_config_test.go
@@ -0,0 +1,245 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package awsoidc
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/exp/slices"
+)
+
+var badParameterCheck = func(t require.TestingT, err error, msgAndArgs ...interface{}) {
+	require.True(t, trace.IsBadParameter(err), `expected "bad parameter", but got %v`, err)
+}
+
+var alreadyExistsCheck = func(t require.TestingT, err error, msgAndArgs ...interface{}) {
+	require.True(t, trace.IsAlreadyExists(err), `expected "already exists", but got %v`, err)
+}
+
+var notFounCheck = func(t require.TestingT, err error, msgAndArgs ...interface{}) {
+	require.True(t, trace.IsNotFound(err), `expected "not found", but got %v`, err)
+}
+
+var baseReq = func() DeployServiceIAMConfigureRequest {
+	return DeployServiceIAMConfigureRequest{
+		Cluster:         "mycluster",
+		IntegrationName: "myintegration",
+		Region:          "us-east-1",
+		IntegrationRole: "integrationrole",
+		TaskRole:        "taskrole",
+	}
+}
+
+func TestDeployServiceIAMConfigReqDefaults(t *testing.T) {
+	for _, tt := range []struct {
+		name     string
+		req      func() DeployServiceIAMConfigureRequest
+		errCheck require.ErrorAssertionFunc
+		expected DeployServiceIAMConfigureRequest
+	}{
+		{
+			name:     "set defaults",
+			req:      baseReq,
+			errCheck: require.NoError,
+			expected: DeployServiceIAMConfigureRequest{
+				Cluster:                            "mycluster",
+				IntegrationName:                    "myintegration",
+				Region:                             "us-east-1",
+				IntegrationRole:                    "integrationrole",
+				TaskRole:                           "taskrole",
+				partitionID:                        "aws",
+				IntegrationRoleDeployServicePolicy: "DeployService",
+				TaskRoleBoundaryPolicyName:         "taskroleBoundary",
+				ResourceCreationTags: awsTags{
+					"teleport.dev/cluster":     "mycluster",
+					"teleport.dev/integration": "myintegration",
+					"teleport.dev/origin":      "integration_awsoidc",
+				},
+			},
+		},
+		{
+			name: "missing cluster",
+			req: func() DeployServiceIAMConfigureRequest {
+				req := baseReq()
+				req.Cluster = ""
+				return req
+			},
+			errCheck: badParameterCheck,
+		},
+		{
+			name: "missing integration name",
+			req: func() DeployServiceIAMConfigureRequest {
+				req := baseReq()
+				req.IntegrationName = ""
+				return req
+			},
+			errCheck: badParameterCheck,
+		},
+		{
+			name: "missing region",
+			req: func() DeployServiceIAMConfigureRequest {
+				req := baseReq()
+				req.Region = ""
+				return req
+			},
+			errCheck: badParameterCheck,
+		},
+		{
+			name: "missing integration role",
+			req: func() DeployServiceIAMConfigureRequest {
+				req := baseReq()
+				req.IntegrationRole = ""
+				return req
+			},
+			errCheck: badParameterCheck,
+		},
+		{
+			name: "missing task role",
+			req: func() DeployServiceIAMConfigureRequest {
+				req := baseReq()
+				req.TaskRole = ""
+				return req
+			},
+			errCheck: badParameterCheck,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			req := tt.req()
+			err := req.CheckAndSetDefaults()
+			tt.errCheck(t, err)
+			if err != nil {
+				return
+			}
+
+			require.Equal(t, tt.expected, req)
+		})
+	}
+}
+
+func TestDeployServiceIAMConfig(t *testing.T) {
+	ctx := context.Background()
+
+	for _, tt := range []struct {
+		name                 string
+		mockAccountID        string
+		mockExistingPolicies []string
+		mockExistingRoles    []string
+		req                  func() DeployServiceIAMConfigureRequest
+		errCheck             require.ErrorAssertionFunc
+	}{
+		{
+			name:                 "valid",
+			mockAccountID:        "123456789012",
+			mockExistingPolicies: []string{},
+			mockExistingRoles:    []string{"integrationrole"},
+			req:                  baseReq,
+			errCheck:             require.NoError,
+		},
+		{
+			name:                 "boundary policy already exists",
+			mockAccountID:        "123456789012",
+			mockExistingPolicies: []string{"taskroleBoundary"},
+			mockExistingRoles:    []string{"integrationrole"},
+			req:                  baseReq,
+			errCheck:             alreadyExistsCheck,
+		},
+		{
+			name:                 "task role already exists",
+			mockAccountID:        "123456789012",
+			mockExistingPolicies: []string{},
+			mockExistingRoles:    []string{"integrationrole", "taskrole"},
+			req:                  baseReq,
+			errCheck:             alreadyExistsCheck,
+		},
+		{
+			name:                 "integration role does not exist",
+			mockAccountID:        "123456789012",
+			mockExistingPolicies: []string{},
+			mockExistingRoles:    []string{},
+			req:                  baseReq,
+			errCheck:             notFounCheck,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			clt := mockDeployServiceIAMConfigClient{
+				accountID:        tt.mockAccountID,
+				existingPolicies: tt.mockExistingPolicies,
+				existingRoles:    tt.mockExistingRoles,
+			}
+
+			err := ConfigureDeployServiceIAM(ctx, &clt, tt.req())
+			tt.errCheck(t, err)
+		})
+	}
+}
+
+type mockDeployServiceIAMConfigClient struct {
+	accountID        string
+	existingPolicies []string
+	existingRoles    []string
+}
+
+// GetCallerIdentity returns information about the caller identity.
+func (m *mockDeployServiceIAMConfigClient) GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error) {
+	return &sts.GetCallerIdentityOutput{
+		Account: &m.accountID,
+	}, nil
+}
+
+// CreatePolicy creates a new IAM Policy.
+func (m *mockDeployServiceIAMConfigClient) CreatePolicy(ctx context.Context, params *iam.CreatePolicyInput, optFns ...func(*iam.Options)) (*iam.CreatePolicyOutput, error) {
+	alreadyExistsMessage := fmt.Sprintf("Policy %q already exists.", *params.PolicyName)
+	if slices.Contains(m.existingPolicies, *params.PolicyName) {
+		return nil, &iamTypes.EntityAlreadyExistsException{
+			Message: &alreadyExistsMessage,
+		}
+	}
+
+	m.existingPolicies = append(m.existingPolicies, *params.PolicyName)
+	return nil, nil
+}
+
+// CreateRole creates a new IAM Role.
+func (m *mockDeployServiceIAMConfigClient) CreateRole(ctx context.Context, params *iam.CreateRoleInput, optFns ...func(*iam.Options)) (*iam.CreateRoleOutput, error) {
+	alreadyExistsMessage := fmt.Sprintf("Role %q already exists.", *params.RoleName)
+	if slices.Contains(m.existingRoles, *params.RoleName) {
+		return nil, &iamTypes.EntityAlreadyExistsException{
+			Message: &alreadyExistsMessage,
+		}
+	}
+	m.existingRoles = append(m.existingRoles, *params.RoleName)
+
+	return nil, nil
+}
+
+// PutRolePolicy creates or replaces a Policy by its name in a IAM Role.
+func (m *mockDeployServiceIAMConfigClient) PutRolePolicy(ctx context.Context, params *iam.PutRolePolicyInput, optFns ...func(*iam.Options)) (*iam.PutRolePolicyOutput, error) {
+	noSuchEntityMessage := fmt.Sprintf("Role %q does not exist.", *params.RoleName)
+	if !slices.Contains(m.existingRoles, *params.RoleName) {
+		return nil, &iamTypes.NoSuchEntityException{
+			Message: &noSuchEntityMessage,
+		}
+	}
+	return nil, nil
+}
diff --git a/lib/integrations/awsoidc/deployservice_test.go b/lib/integrations/awsoidc/deployservice_test.go
new file mode 100644
index 0000000000000..647090d34e158
--- /dev/null
+++ b/lib/integrations/awsoidc/deployservice_test.go
@@ -0,0 +1,209 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package awsoidc
+
+import (
+	"regexp"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestDeployServiceRequest(t *testing.T) {
+	isBadParamErrFn := func(tt require.TestingT, err error, i ...any) {
+		require.True(tt, trace.IsBadParameter(err), "expected bad parameter, got %v", err)
+	}
+
+	baseReqFn := func() DeployServiceRequest {
+		return DeployServiceRequest{
+			TeleportClusterName:           "mycluster",
+			Region:                        "r",
+			SubnetIDs:                     []string{"1"},
+			TaskRoleARN:                   "arn",
+			ProxyServerHostPort:           "proxy.example.com:3080",
+			IntegrationName:               "teleportdev",
+			DeploymentMode:                DatabaseServiceDeploymentMode,
+			DatabaseResourceMatcherLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
+		}
+	}
+
+	for _, tt := range []struct {
+		name            string
+		req             func() DeployServiceRequest
+		errCheck        require.ErrorAssertionFunc
+		reqWithDefaults DeployServiceRequest
+	}{
+		{
+			name: "no fields",
+			req: func() DeployServiceRequest {
+				return DeployServiceRequest{}
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing teleport cluster name",
+			req: func() DeployServiceRequest {
+				r := baseReqFn()
+				r.TeleportClusterName = ""
+				return r
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing region",
+			req: func() DeployServiceRequest {
+				r := baseReqFn()
+				r.Region = ""
+				return r
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "empty list of subnets",
+			req: func() DeployServiceRequest {
+				r := baseReqFn()
+				r.SubnetIDs = []string{}
+				return r
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing task role arn",
+			req: func() DeployServiceRequest {
+				r := baseReqFn()
+				r.TaskRoleARN = ""
+				return r
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing integration name",
+			req: func() DeployServiceRequest {
+				r := baseReqFn()
+				r.IntegrationName = ""
+				return r
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "invalid deployment mode",
+			req: func() DeployServiceRequest {
+				r := baseReqFn()
+				r.DeploymentMode = "invalid"
+				return r
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "no deployment mode",
+			req: func() DeployServiceRequest {
+				r := baseReqFn()
+				r.DeploymentMode = ""
+				return r
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "no label matchers",
+			req: func() DeployServiceRequest {
+				r := baseReqFn()
+				r.DatabaseResourceMatcherLabels = types.Labels{}
+				return r
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name:     "fill defaults",
+			req:      baseReqFn,
+			errCheck: require.NoError,
+			reqWithDefaults: DeployServiceRequest{
+				TeleportClusterName:  "mycluster",
+				Region:               "r",
+				SubnetIDs:            []string{"1"},
+				TaskRoleARN:          "arn",
+				ClusterName:          stringPointer("mycluster-teleport"),
+				ServiceName:          stringPointer("mycluster-teleport-database-service"),
+				TaskName:             stringPointer("mycluster-teleport-database-service"),
+				TeleportIAMTokenName: stringPointer("discover-aws-oidc-iam-token"),
+				IntegrationName:      "teleportdev",
+				ProxyServerHostPort:  "proxy.example.com:3080",
+				ResourceCreationTags: awsTags{
+					"teleport.dev/origin":      "integration_awsoidc",
+					"teleport.dev/cluster":     "mycluster",
+					"teleport.dev/integration": "teleportdev",
+				},
+				DeploymentMode:                DatabaseServiceDeploymentMode,
+				DatabaseResourceMatcherLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			r := tt.req()
+			err := r.CheckAndSetDefaults()
+			tt.errCheck(t, err)
+
+			if err != nil {
+				return
+			}
+
+			require.Empty(t, cmp.Diff(tt.reqWithDefaults, r))
+		})
+	}
+}
+
+func TestNormalizeECSResourceName(t *testing.T) {
+	validClusterName := regexp.MustCompile(`^[0-9A-Za-z_\-@:./+]+$`)
+	validECSName := regexp.MustCompile(`^[0-9A-Za-z_\-]+$`)
+	for _, tt := range []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "valid",
+			input:    "mycluster",
+			expected: "mycluster",
+		},
+		{
+			name:     "with dots",
+			input:    "mycluster.example",
+			expected: "mycluster_example",
+		},
+		{
+			name:     "cloud format",
+			input:    "tenant.teleport.sh",
+			expected: "tenant_teleport_sh",
+		},
+		{
+			name:     "other special chars",
+			input:    "cluster@with:another.host/with+numbers_123",
+			expected: "cluster_with_another_host_with_numbers_123",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			// ensure test case is valid
+			require.True(t, validClusterName.Match([]byte(tt.input)))
+			require.True(t, validECSName.Match([]byte(tt.expected)))
+
+			require.Equal(t, normalizeECSResourceName(tt.input), tt.expected)
+		})
+	}
+}
diff --git a/lib/integrations/awsoidc/deployservice_vcr_test.go b/lib/integrations/awsoidc/deployservice_vcr_test.go
new file mode 100644
index 0000000000000..60621290c6e0f
--- /dev/null
+++ b/lib/integrations/awsoidc/deployservice_vcr_test.go
@@ -0,0 +1,229 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package awsoidc
+
+import (
+	"context"
+	"net/http"
+	"regexp"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/dnaeon/go-vcr.v3/cassette"
+	"gopkg.in/dnaeon/go-vcr.v3/recorder"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestDeployDBService(t *testing.T) {
+	ctx := context.Background()
+
+	// To record new fixtures ensure the following:
+	// - change recordingMode to recorder.ModeRecordOnce
+	recordingMode := recorder.ModeReplayOnly
+	// - get a token by
+	//   - add `fmt.Println(clientReq.Token)` in `NewDeployServiceClient`
+	//   - hosting teleport in a public endpoint and configure the AWS OIDC Integration
+	//   - issue a DeployService call and look for the token in the logs
+	awsOIDCToken := "x.y.z"
+
+	awsRegion := "us-east-1"
+	awsOIDCRoleARN := "arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider"
+	integrationName := "teleportdev"
+
+	removeKeysRegex, err := regexp.Compile(`(?s)(<AccessKeyId>).*(</AccessKeyId>).*(<SecretAccessKey>).*(</SecretAccessKey>).*(<SessionToken>).*(</SessionToken>)`)
+	require.NoError(t, err)
+	removeSensitiveHeadersHook := func(i *cassette.Interaction) error {
+		i.Request.Headers.Del("Authorization")
+		i.Request.Headers.Del("X-Amz-Security-Token")
+		i.Request.Form.Del("WebIdentityToken")
+
+		// Requests to STS contain tokens in both HTTP request and response.
+		if i.Request.URL == "https://sts.us-east-1.amazonaws.com/" {
+			i.Request.Body = ""
+			i.Response.Body = removeKeysRegex.ReplaceAllString(i.Response.Body, "${1}x${2}${3}x${4}${5}x${6}")
+		}
+
+		return nil
+	}
+
+	awsClientReqFunc := func(httpClient *http.Client) *AWSClientRequest {
+		return &AWSClientRequest{
+			// To record new fixtures you will need a valid token.
+			// You can get one by getting the generated token in a real cluster.
+			Token:           awsOIDCToken,
+			RoleARN:         awsOIDCRoleARN,
+			Region:          awsRegion,
+			IntegrationName: integrationName,
+			httpClient:      httpClient,
+		}
+	}
+
+	deployServiceReqFunc := func(clusterName string) DeployServiceRequest {
+		return DeployServiceRequest{
+			Region: awsRegion,
+			SubnetIDs: []string{
+				"subnet-0b7ab67161173748b",
+				"subnet-0dda93c8621eb2e99",
+				"subnet-034f17b3f7344e375",
+				"subnet-04a07d4721a3c96e0",
+				"subnet-0ef025345dd791986",
+				"subnet-099632749366c2c56",
+			},
+			TaskRoleARN:         "MarcoEC2Role",
+			TeleportClusterName: clusterName,
+			IntegrationName:     "teleportdev",
+			DeploymentMode:      DatabaseServiceDeploymentMode,
+			ProxyServerHostPort: "marcodinis.teleportdemo.net:443",
+			DatabaseResourceMatcherLabels: types.Labels{
+				types.Wildcard: []string{types.Wildcard},
+			},
+		}
+	}
+
+	mustRecordUsing := func(t *testing.T, name string) *recorder.Recorder {
+		r, err := recorder.NewWithOptions(&recorder.Options{
+			CassetteName:       name,
+			SkipRequestLatency: true,
+			Mode:               recordingMode,
+		})
+		require.NoError(t, err)
+		r.AddHook(removeSensitiveHeadersHook, recorder.BeforeSaveHook)
+		return r
+	}
+
+	t.Run("nothing exists in aws account", func(t *testing.T) {
+		r := mustRecordUsing(t, "fixtures/emptyaccount")
+		defer r.Stop()
+
+		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
+		ecsClient, err := newECSClient(ctx, awsClientRecorder)
+		require.NoError(t, err)
+
+		resp, err := DeployService(ctx, ecsClient, deployServiceReqFunc("cluster1002"))
+		require.NoError(t, err)
+
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport", resp.ClusterARN)
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service", resp.ServiceARN)
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:1", resp.TaskDefinitionARN)
+		require.Equal(t, "https://us-east-1.console.aws.amazon.com/ecs/v2/clusters/cluster1002-teleport/services/cluster1002-teleport-database-service", resp.ServiceDashboardURL)
+	})
+
+	t.Run("recreate everything", func(t *testing.T) {
+		r := mustRecordUsing(t, "fixtures/replace")
+		defer r.Stop()
+
+		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
+		ecsClient, err := newECSClient(ctx, awsClientRecorder)
+		require.NoError(t, err)
+
+		resp, err := DeployService(ctx, ecsClient, deployServiceReqFunc("cluster1002"))
+		require.NoError(t, err)
+
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport", resp.ClusterARN)
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service", resp.ServiceARN)
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:2", resp.TaskDefinitionARN)
+		require.Equal(t, "https://us-east-1.console.aws.amazon.com/ecs/v2/clusters/cluster1002-teleport/services/cluster1002-teleport-database-service", resp.ServiceDashboardURL)
+	})
+
+	t.Run("service is being deleted", func(t *testing.T) {
+		r := mustRecordUsing(t, "fixtures/servicedeleted")
+		defer r.Stop()
+
+		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
+		ecsClient, err := newECSClient(ctx, awsClientRecorder)
+		require.NoError(t, err)
+
+		_, err = DeployService(ctx, ecsClient, deployServiceReqFunc("cluster1002"))
+		require.ErrorContains(t, err, "ECS Service is draining, please retry in a couple of minutes")
+	})
+
+	t.Run("cluster is being deleted", func(t *testing.T) {
+		r := mustRecordUsing(t, "fixtures/clusterdeleted")
+		defer r.Stop()
+
+		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
+		ecsClient, err := newECSClient(ctx, awsClientRecorder)
+		require.NoError(t, err)
+
+		resp, err := DeployService(ctx, ecsClient, deployServiceReqFunc("cluster1002"))
+		require.NoError(t, err)
+
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport", resp.ClusterARN)
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service", resp.ServiceARN)
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:5", resp.TaskDefinitionARN)
+		require.Equal(t, "https://us-east-1.console.aws.amazon.com/ecs/v2/clusters/cluster1002-teleport/services/cluster1002-teleport-database-service", resp.ServiceDashboardURL)
+	})
+
+	t.Run("cluster does not have the required capacity provider", func(t *testing.T) {
+		r := mustRecordUsing(t, "fixtures/clustercapacityprovider")
+		defer r.Stop()
+
+		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
+		ecsClient, err := newECSClient(ctx, awsClientRecorder)
+		require.NoError(t, err)
+
+		resp, err := DeployService(ctx, ecsClient, deployServiceReqFunc("cluster1002"))
+		require.NoError(t, err)
+
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport", resp.ClusterARN)
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service", resp.ServiceARN)
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:9", resp.TaskDefinitionARN)
+		require.Equal(t, "https://us-east-1.console.aws.amazon.com/ecs/v2/clusters/cluster1002-teleport/services/cluster1002-teleport-database-service", resp.ServiceDashboardURL)
+	})
+
+	t.Run("cluster does not have the ownership tags", func(t *testing.T) {
+		r := mustRecordUsing(t, "fixtures/cluster_without_ownership_tags")
+		defer r.Stop()
+
+		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
+		ecsClient, err := newECSClient(ctx, awsClientRecorder)
+		require.NoError(t, err)
+
+		_, err = DeployService(ctx, ecsClient, deployServiceReqFunc("cluster1002"))
+		require.ErrorContains(t, err, `ECS Cluster "cluster1002-teleport" already exists but is not managed by Teleport. Add the following tags to allow Teleport to manage this cluster:`)
+	})
+
+	t.Run("service does not have the ownership tags", func(t *testing.T) {
+		r := mustRecordUsing(t, "fixtures/service_without_ownership_tags")
+		defer r.Stop()
+
+		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
+		ecsClient, err := newECSClient(ctx, awsClientRecorder)
+		require.NoError(t, err)
+
+		_, err = DeployService(ctx, ecsClient, deployServiceReqFunc("cluster1002"))
+		require.ErrorContains(t, err, `ECS Service "cluster1002-teleport-database-service" already exists but is not managed by Teleport. Add the following tags to allow Teleport to manage this service:`)
+	})
+
+	t.Run("cluster name with dots", func(t *testing.T) {
+		r := mustRecordUsing(t, "fixtures/cluster_name_with_dots")
+		defer r.Stop()
+
+		awsClientRecorder := awsClientReqFunc(r.GetDefaultClient())
+		ecsClient, err := newECSClient(ctx, awsClientRecorder)
+		require.NoError(t, err)
+
+		resp, err := DeployService(ctx, ecsClient, deployServiceReqFunc("tenant-a.teleport.sh"))
+		require.NoError(t, err)
+
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:cluster/tenant-a_teleport_sh-teleport", resp.ClusterARN)
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:service/tenant-a_teleport_sh-teleport/tenant-a_teleport_sh-teleport-database-service", resp.ServiceARN)
+		require.Equal(t, "arn:aws:ecs:us-east-1:278576220453:task-definition/tenant-a_teleport_sh-teleport-database-service:1", resp.TaskDefinitionARN)
+		require.Equal(t, "https://us-east-1.console.aws.amazon.com/ecs/v2/clusters/tenant-a_teleport_sh-teleport/services/tenant-a_teleport_sh-teleport-database-service", resp.ServiceDashboardURL)
+	})
+}
diff --git a/lib/integrations/awsoidc/fixtures/cluster_name_with_dots.yaml b/lib/integrations/awsoidc/fixtures/cluster_name_with_dots.yaml
new file mode 100644
index 0000000000000..c9396cf3b3e8d
--- /dev/null
+++ b/lib/integrations/awsoidc/fixtures/cluster_name_with_dots.yaml
@@ -0,0 +1,603 @@
+---
+version: 2
+interactions:
+    - id: 0
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911152857792573"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 427dc06d-e6fa-443e-96a1-e5057fa55a95
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911152857792573</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911152857792573</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:25:53Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>9a19bee7-07bb-4568-a462-637855a6c088</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:25:53 GMT
+            X-Amzn-Requestid:
+                - 9a19bee7-07bb-4568-a462-637855a6c088
+        status: 200 OK
+        code: 200
+        duration: 1.105605065s
+    - id: 1
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 1748
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"entryPoint":["teleport"],"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-tenant-a_teleport_sh-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"tenant-a_teleport_sh-teleport-database-service/tenant-a_teleport_sh-teleport-database-service"}},"name":"teleport-service"}],"cpu":"2048","executionRoleArn":"MarcoEC2Role","family":"tenant-a_teleport_sh-teleport-database-service","memory":"4096","networkMode":"awsvpc","requiresCompatibilities":["FARGATE"],"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"tenant-a.teleport.sh"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskRoleArn":"MarcoEC2Role"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 1ffcf95b-3231-4232-906d-bc8f7d53345c
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102553Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2698
+        uncompressed: false
+        body: '{"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"tenant-a.teleport.sh"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":{"compatibilities":["EC2","FARGATE"],"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"cpu":0,"entryPoint":["teleport"],"environment":[],"essential":true,"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-tenant-a_teleport_sh-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"tenant-a_teleport_sh-teleport-database-service/tenant-a_teleport_sh-teleport-database-service"}},"mountPoints":[],"name":"teleport-service","portMappings":[],"volumesFrom":[]}],"cpu":"2048","executionRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","family":"tenant-a_teleport_sh-teleport-database-service","memory":"4096","networkMode":"awsvpc","placementConstraints":[],"registeredAt":1.686911154608E9,"registeredBy":"arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911152857792573","requiresAttributes":[{"name":"com.amazonaws.ecs.capability.logging-driver.awslogs"},{"name":"ecs.capability.execution-role-awslogs"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.19"},{"name":"com.amazonaws.ecs.capability.task-iam-role"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.18"},{"name":"ecs.capability.task-eni"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.29"}],"requiresCompatibilities":["FARGATE"],"revision":1,"status":"ACTIVE","taskDefinitionArn":"arn:aws:ecs:us-east-1:278576220453:task-definition/tenant-a_teleport_sh-teleport-database-service:1","taskRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","volumes":[]}}'
+        headers:
+            Content-Length:
+                - "2698"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:25:54 GMT
+            X-Amzn-Requestid:
+                - ea196952-82b3-4ed1-b483-960e117e8902
+        status: 200 OK
+        code: 200
+        duration: 762.93508ms
+    - id: 2
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911154728313073"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 243d866f-a30a-4b8b-b56c-bea727c51977
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911154728313073</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911154728313073</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:25:54Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>35f3af71-b03d-4cc4-9261-1b11e2e17124</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:25:54 GMT
+            X-Amzn-Requestid:
+                - 35f3af71-b03d-4cc4-9261-1b11e2e17124
+        status: 200 OK
+        code: 200
+        duration: 148.425139ms
+    - id: 3
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 65
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"clusters":["tenant-a_teleport_sh-teleport"],"include":["TAGS"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - b71a9033-4118-44dd-93f4-5326935506d3
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102554Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeClusters
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 130
+        uncompressed: false
+        body: '{"clusters":[],"failures":[{"arn":"arn:aws:ecs:us-east-1:278576220453:cluster/tenant-a_teleport_sh-teleport","reason":"MISSING"}]}'
+        headers:
+            Content-Length:
+                - "130"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:25:54 GMT
+            X-Amzn-Requestid:
+                - 501fc81f-448c-4819-8354-44e7ef4696af
+        status: 200 OK
+        code: 200
+        duration: 150.975685ms
+    - id: 4
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911155029147918"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - d4c31ef9-630c-4b79-b06a-759e2929fccc
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911155029147918</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911155029147918</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:25:55Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>90c84a87-1b2c-4120-8e71-1504b632764a</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:25:54 GMT
+            X-Amzn-Requestid:
+                - 90c84a87-1b2c-4120-8e71-1504b632764a
+        status: 200 OK
+        code: 200
+        duration: 172.678556ms
+    - id: 5
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 267
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"capacityProviders":["FARGATE"],"clusterName":"tenant-a_teleport_sh-teleport","tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"tenant-a.teleport.sh"},{"key":"teleport.dev/integration","value":"teleportdev"}]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 2ec1d1d5-0604-40e4-8f32-5173061ffa6b
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102555Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.CreateCluster
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 622
+        uncompressed: false
+        body: '{"cluster":{"activeServicesCount":0,"capacityProviders":["FARGATE"],"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/tenant-a_teleport_sh-teleport","clusterName":"tenant-a_teleport_sh-teleport","defaultCapacityProviderStrategy":[],"pendingTasksCount":0,"registeredContainerInstancesCount":0,"runningTasksCount":0,"settings":[{"name":"containerInsights","value":"disabled"}],"statistics":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"tenant-a.teleport.sh"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}]},"clusterCount":0}'
+        headers:
+            Content-Length:
+                - "622"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:25:55 GMT
+            X-Amzn-Requestid:
+                - 6a2257bb-a00a-4325-be52-ed7831abc9eb
+        status: 200 OK
+        code: 200
+        duration: 328.933829ms
+    - id: 6
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911155532239167"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 09290c6f-51e4-42de-bae8-4d25866a70b9
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911155532239167</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911155532239167</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:25:55Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>342c77b3-3e63-4657-8f4d-63234ff54856</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:25:55 GMT
+            X-Amzn-Requestid:
+                - 342c77b3-3e63-4657-8f4d-63234ff54856
+        status: 200 OK
+        code: 200
+        duration: 143.520728ms
+    - id: 7
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 124
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"tenant-a_teleport_sh-teleport","include":["TAGS"],"services":["tenant-a_teleport_sh-teleport-database-service"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 8afbe769-56f9-4b44-95a9-1a65f8d2d8cb
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102555Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeServices
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 147
+        uncompressed: false
+        body: '{"failures":[{"arn":"arn:aws:ecs:us-east-1:278576220453:service/tenant-a_teleport_sh-teleport-database-service","reason":"MISSING"}],"services":[]}'
+        headers:
+            Content-Length:
+                - "147"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:25:55 GMT
+            X-Amzn-Requestid:
+                - c328ded6-fc05-481d-abe2-ebee10c82c5e
+        status: 200 OK
+        code: 200
+        duration: 159.242457ms
+    - id: 8
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911155844582408"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 0f355697-1fb6-445c-8636-cd74d1a60f34
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911155844582408</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911155844582408</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:25:55Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>88e7a7e0-6bae-44da-a04a-b31cfa508893</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:25:55 GMT
+            X-Amzn-Requestid:
+                - 88e7a7e0-6bae-44da-a04a-b31cfa508893
+        status: 200 OK
+        code: 200
+        duration: 137.757837ms
+    - id: 9
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 729
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"tenant-a_teleport_sh-teleport","desiredCount":1,"launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"propagateTags":"SERVICE","serviceName":"tenant-a_teleport_sh-teleport-database-service","tags":[{"key":"teleport.dev/cluster","value":"tenant-a.teleport.sh"},{"key":"teleport.dev/integration","value":"teleportdev"},{"key":"teleport.dev/origin","value":"integration_awsoidc"}],"taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/tenant-a_teleport_sh-teleport-database-service:1"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 0e20e46f-e75f-4c4b-9a95-0aceeea44a26
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102555Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.CreateService
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2441
+        uncompressed: false
+        body: '{"service":{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/tenant-a_teleport_sh-teleport","createdAt":1.686911156487E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.686911156487E9,"desiredCount":1,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/9715965138496391411","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"IN_PROGRESS","rolloutStateReason":"ECS deployment ecs-svc/9715965138496391411 in progress.","runningCount":0,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/tenant-a_teleport_sh-teleport-database-service:1","updatedAt":1.686911156487E9}],"desiredCount":1,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runningCount":0,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/tenant-a_teleport_sh-teleport/tenant-a_teleport_sh-teleport-database-service","serviceName":"tenant-a_teleport_sh-teleport-database-service","serviceRegistries":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"tenant-a.teleport.sh"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/tenant-a_teleport_sh-teleport-database-service:1","version":0}}'
+        headers:
+            Content-Length:
+                - "2441"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:25:56 GMT
+            X-Amzn-Requestid:
+                - fc76c853-e3d9-47e6-95d1-ecc4c7559295
+        status: 200 OK
+        code: 200
+        duration: 615.89935ms
diff --git a/lib/integrations/awsoidc/fixtures/cluster_without_ownership_tags.yaml b/lib/integrations/awsoidc/fixtures/cluster_without_ownership_tags.yaml
new file mode 100644
index 0000000000000..c1766140ae739
--- /dev/null
+++ b/lib/integrations/awsoidc/fixtures/cluster_without_ownership_tags.yaml
@@ -0,0 +1,243 @@
+---
+version: 2
+interactions:
+    - id: 0
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911061865572432"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 1692ecc6-8382-4ef0-80e8-6e55b3c64f52
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911061865572432</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911061865572432</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:24:22Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>e8f7bf82-d225-4731-99ed-021ff32030ce</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:24:22 GMT
+            X-Amzn-Requestid:
+                - e8f7bf82-d225-4731-99ed-021ff32030ce
+        status: 200 OK
+        code: 200
+        duration: 1.104729648s
+    - id: 1
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 1703
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"entryPoint":["teleport"],"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service","awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1"}},"name":"teleport-service"}],"cpu":"2048","executionRoleArn":"MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","requiresCompatibilities":["FARGATE"],"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskRoleArn":"MarcoEC2Role"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - a7311aca-3ae9-46e4-9ab2-b5ed6b3f6b40
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102422Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2644
+        uncompressed: false
+        body: '{"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":{"compatibilities":["EC2","FARGATE"],"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"cpu":0,"entryPoint":["teleport"],"environment":[],"essential":true,"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"mountPoints":[],"name":"teleport-service","portMappings":[],"volumesFrom":[]}],"cpu":"2048","executionRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","placementConstraints":[],"registeredAt":1.686911063628E9,"registeredBy":"arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911061865572432","requiresAttributes":[{"name":"com.amazonaws.ecs.capability.logging-driver.awslogs"},{"name":"ecs.capability.execution-role-awslogs"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.19"},{"name":"com.amazonaws.ecs.capability.task-iam-role"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.18"},{"name":"ecs.capability.task-eni"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.29"}],"requiresCompatibilities":["FARGATE"],"revision":6,"status":"ACTIVE","taskDefinitionArn":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:6","taskRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","volumes":[]}}'
+        headers:
+            Content-Length:
+                - "2644"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:24:23 GMT
+            X-Amzn-Requestid:
+                - da156dde-91a9-47c0-92a4-c52d2d3bb7c1
+        status: 200 OK
+        code: 200
+        duration: 770.550376ms
+    - id: 2
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911063742378737"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 1f3967d5-3388-49f2-b0a6-44d8f4de4865
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911063742378737</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911063742378737</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:24:23Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>d8e65c45-a90f-43f5-8edc-dd044966dbe6</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:24:23 GMT
+            X-Amzn-Requestid:
+                - d8e65c45-a90f-43f5-8edc-dd044966dbe6
+        status: 200 OK
+        code: 200
+        duration: 139.753879ms
+    - id: 3
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 56
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"clusters":["cluster1002-teleport"],"include":["TAGS"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 840f3656-bb9e-4b7c-a362-9733d0969a2a
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102423Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeClusters
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 548
+        uncompressed: false
+        body: '{"clusters":[{"activeServicesCount":1,"capacityProviders":["FARGATE"],"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","clusterName":"cluster1002-teleport","defaultCapacityProviderStrategy":[],"pendingTasksCount":0,"registeredContainerInstancesCount":0,"runningTasksCount":1,"settings":[],"statistics":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1001"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}]}],"failures":[]}'
+        headers:
+            Content-Length:
+                - "548"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:24:23 GMT
+            X-Amzn-Requestid:
+                - 499a9b02-a9a8-4d5d-9c91-1bfa4ae13550
+        status: 200 OK
+        code: 200
+        duration: 179.053835ms
diff --git a/lib/integrations/awsoidc/fixtures/clustercapacityprovider.yaml b/lib/integrations/awsoidc/fixtures/clustercapacityprovider.yaml
new file mode 100644
index 0000000000000..5df30d53daabe
--- /dev/null
+++ b/lib/integrations/awsoidc/fixtures/clustercapacityprovider.yaml
@@ -0,0 +1,723 @@
+---
+version: 2
+interactions:
+    - id: 0
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911414502217606"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 87bc027f-2bbf-45bd-a05c-b805f4a9cf74
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911414502217606</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911414502217606</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:30:15Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>719676fc-9e50-40a5-b6a5-c4f30ebee796</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:30:14 GMT
+            X-Amzn-Requestid:
+                - 719676fc-9e50-40a5-b6a5-c4f30ebee796
+        status: 200 OK
+        code: 200
+        duration: 1.079726618s
+    - id: 1
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 1703
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"entryPoint":["teleport"],"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"name":"teleport-service"}],"cpu":"2048","executionRoleArn":"MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","requiresCompatibilities":["FARGATE"],"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskRoleArn":"MarcoEC2Role"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 6b149feb-be2f-490f-a75f-590a8f0d0c6f
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T103015Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2644
+        uncompressed: false
+        body: '{"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":{"compatibilities":["EC2","FARGATE"],"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"cpu":0,"entryPoint":["teleport"],"environment":[],"essential":true,"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"mountPoints":[],"name":"teleport-service","portMappings":[],"volumesFrom":[]}],"cpu":"2048","executionRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","placementConstraints":[],"registeredAt":1.686911416291E9,"registeredBy":"arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911414502217606","requiresAttributes":[{"name":"com.amazonaws.ecs.capability.logging-driver.awslogs"},{"name":"ecs.capability.execution-role-awslogs"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.19"},{"name":"com.amazonaws.ecs.capability.task-iam-role"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.18"},{"name":"ecs.capability.task-eni"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.29"}],"requiresCompatibilities":["FARGATE"],"revision":9,"status":"ACTIVE","taskDefinitionArn":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:9","taskRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","volumes":[]}}'
+        headers:
+            Content-Length:
+                - "2644"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:30:15 GMT
+            X-Amzn-Requestid:
+                - 671db742-6d70-4cb9-8d72-b3f9db7b3706
+        status: 200 OK
+        code: 200
+        duration: 818.133531ms
+    - id: 2
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911416409823902"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 06928b35-3de4-4418-8a5c-7274e78ba978
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911416409823902</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911416409823902</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:30:16Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>209d5437-1dd2-4d38-a6a9-893753ce5724</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:30:15 GMT
+            X-Amzn-Requestid:
+                - 209d5437-1dd2-4d38-a6a9-893753ce5724
+        status: 200 OK
+        code: 200
+        duration: 138.301264ms
+    - id: 3
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 56
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"clusters":["cluster1002-teleport"],"include":["TAGS"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 55a054a3-f1dc-4768-ba3d-82968b9ee446
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T103016Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeClusters
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 608
+        uncompressed: false
+        body: '{"clusters":[{"activeServicesCount":0,"capacityProviders":["FARGATE_SPOT"],"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","clusterName":"cluster1002-teleport","defaultCapacityProviderStrategy":[{"base":1,"capacityProvider":"FARGATE_SPOT","weight":1}],"pendingTasksCount":0,"registeredContainerInstancesCount":0,"runningTasksCount":0,"settings":[],"statistics":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}]}],"failures":[]}'
+        headers:
+            Content-Length:
+                - "608"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:30:16 GMT
+            X-Amzn-Requestid:
+                - 6763fb29-6676-4851-84b9-a2566c710be0
+        status: 200 OK
+        code: 200
+        duration: 183.176383ms
+    - id: 4
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911416738501632"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 107e2a41-d6ac-4945-a195-9b637d80a17e
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911416738501632</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911416738501632</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:30:16Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>36b0a3f1-2b81-412b-af42-0d20dc4d4e1c</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:30:16 GMT
+            X-Amzn-Requestid:
+                - 36b0a3f1-2b81-412b-af42-0d20dc4d4e1c
+        status: 200 OK
+        code: 200
+        duration: 144.419467ms
+    - id: 5
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 133
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"capacityProviders":["FARGATE"],"cluster":"cluster1002-teleport","defaultCapacityProviderStrategy":[{"capacityProvider":"FARGATE"}]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 6b2b7903-63e1-422d-8430-2f6f42d999e8
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T103016Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.PutClusterCapacityProviders
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 517
+        uncompressed: false
+        body: '{"cluster":{"activeServicesCount":0,"attachments":[],"attachmentsStatus":"UPDATE_IN_PROGRESS","capacityProviders":["FARGATE"],"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","clusterName":"cluster1002-teleport","defaultCapacityProviderStrategy":[{"base":0,"capacityProvider":"FARGATE","weight":0}],"pendingTasksCount":0,"registeredContainerInstancesCount":0,"runningTasksCount":0,"settings":[{"name":"containerInsights","value":"disabled"}],"statistics":[],"status":"ACTIVE","tags":[]}}'
+        headers:
+            Content-Length:
+                - "517"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:30:16 GMT
+            X-Amzn-Requestid:
+                - c69873c0-548b-401e-907c-a638c731b1b1
+        status: 200 OK
+        code: 200
+        duration: 307.395526ms
+    - id: 6
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911417191628929"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - e005a035-be68-4260-8ae0-9f14158821c5
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911417191628929</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911417191628929</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:30:17Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>1952e7ff-4d99-4575-8c8a-38b024e46ffa</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:30:16 GMT
+            X-Amzn-Requestid:
+                - 1952e7ff-4d99-4575-8c8a-38b024e46ffa
+        status: 200 OK
+        code: 200
+        duration: 150.372238ms
+    - id: 7
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 106
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","include":["TAGS"],"services":["cluster1002-teleport-database-service"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 98d283b2-512c-4535-996b-4e731c7c20b3
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T103017Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeServices
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2237
+        uncompressed: false
+        body: '{"failures":[],"services":[{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","createdAt":1.686911018875E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.686911018875E9,"desiredCount":0,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/4405686048337041128","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"COMPLETED","rolloutStateReason":"ECS deployment ecs-svc/4405686048337041128 completed.","runningCount":0,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:5","updatedAt":1.686911276471E9}],"desiredCount":0,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runStatus":"Inactive","runningCount":0,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service","serviceName":"cluster1002-teleport-database-service","serviceRegistries":[],"status":"INACTIVE","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:5","version":0}]}'
+        headers:
+            Content-Length:
+                - "2237"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:30:16 GMT
+            X-Amzn-Requestid:
+                - e2653498-4325-4bbb-9ac4-cc27e4a43f3c
+        status: 200 OK
+        code: 200
+        duration: 182.426226ms
+    - id: 8
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911417525904237"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 172620b7-271e-4b0a-bd22-d800e8b45d8b
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911417525904237</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911417525904237</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:30:17Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>2dfee334-96ba-4b28-b1ab-f03d7319e4c3</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:30:17 GMT
+            X-Amzn-Requestid:
+                - 2dfee334-96ba-4b28-b1ab-f03d7319e4c3
+        status: 200 OK
+        code: 200
+        duration: 151.698158ms
+    - id: 9
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 97
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","force":true,"service":"cluster1002-teleport-database-service"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - be391402-50ed-47f4-8c60-01bd985e1567
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T103017Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DeleteService
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2220
+        uncompressed: false
+        body: '{"service":{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","createdAt":1.686911018875E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.686911018875E9,"desiredCount":0,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/4405686048337041128","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"COMPLETED","rolloutStateReason":"ECS deployment ecs-svc/4405686048337041128 completed.","runningCount":0,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:5","updatedAt":1.686911276471E9}],"desiredCount":0,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runStatus":"Inactive","runningCount":0,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service","serviceName":"cluster1002-teleport-database-service","serviceRegistries":[],"status":"INACTIVE","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:5","version":0}}'
+        headers:
+            Content-Length:
+                - "2220"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:30:17 GMT
+            X-Amzn-Requestid:
+                - b7dbd92d-43be-4a99-ba31-92fc9bf1a369
+        status: 200 OK
+        code: 200
+        duration: 199.660618ms
+    - id: 10
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911417878844563"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 698f1046-ff5f-4fa6-b4e4-22cb884fd75e
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911417878844563</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911417878844563</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:30:17Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>a229c289-fa55-41b2-a834-03612aa9a715</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:30:17 GMT
+            X-Amzn-Requestid:
+                - a229c289-fa55-41b2-a834-03612aa9a715
+        status: 200 OK
+        code: 200
+        duration: 145.1559ms
+    - id: 11
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 693
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","desiredCount":1,"launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"propagateTags":"SERVICE","serviceName":"cluster1002-teleport-database-service","tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:9"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - cdf86819-8fce-4448-9935-03a92a55552f
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T103018Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.CreateService
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2397
+        uncompressed: false
+        body: '{"service":{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","createdAt":1.68691141864E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.68691141864E9,"desiredCount":1,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/4110934217736066391","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"IN_PROGRESS","rolloutStateReason":"ECS deployment ecs-svc/4110934217736066391 in progress.","runningCount":0,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:9","updatedAt":1.68691141864E9}],"desiredCount":1,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runStatus":"Unknown","runningCount":0,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service","serviceName":"cluster1002-teleport-database-service","serviceRegistries":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:9","version":0}}'
+        headers:
+            Content-Length:
+                - "2397"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:30:18 GMT
+            X-Amzn-Requestid:
+                - 74f7a2f4-336a-4b00-8cce-95f7a7316233
+        status: 200 OK
+        code: 200
+        duration: 720.112397ms
diff --git a/lib/integrations/awsoidc/fixtures/clusterdeleted.yaml b/lib/integrations/awsoidc/fixtures/clusterdeleted.yaml
new file mode 100644
index 0000000000000..aabe355a491f4
--- /dev/null
+++ b/lib/integrations/awsoidc/fixtures/clusterdeleted.yaml
@@ -0,0 +1,603 @@
+---
+version: 2
+interactions:
+    - id: 0
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911015303171093"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 3a2ac659-e984-4e9a-ba39-0a3d7beed5ef
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911015303171093</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911015303171093</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:23:36Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>2a9da673-0f47-4bb6-91dd-366671d81336</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:23:36 GMT
+            X-Amzn-Requestid:
+                - 2a9da673-0f47-4bb6-91dd-366671d81336
+        status: 200 OK
+        code: 200
+        duration: 1.084193694s
+    - id: 1
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 1703
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"entryPoint":["teleport"],"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"name":"teleport-service"}],"cpu":"2048","executionRoleArn":"MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","requiresCompatibilities":["FARGATE"],"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskRoleArn":"MarcoEC2Role"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 814af374-ec43-4838-90c8-8aef9ecc2b16
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102336Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2644
+        uncompressed: false
+        body: '{"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":{"compatibilities":["EC2","FARGATE"],"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"cpu":0,"entryPoint":["teleport"],"environment":[],"essential":true,"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"mountPoints":[],"name":"teleport-service","portMappings":[],"volumesFrom":[]}],"cpu":"2048","executionRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","placementConstraints":[],"registeredAt":1.686911017061E9,"registeredBy":"arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911015303171093","requiresAttributes":[{"name":"com.amazonaws.ecs.capability.logging-driver.awslogs"},{"name":"ecs.capability.execution-role-awslogs"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.19"},{"name":"com.amazonaws.ecs.capability.task-iam-role"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.18"},{"name":"ecs.capability.task-eni"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.29"}],"requiresCompatibilities":["FARGATE"],"revision":5,"status":"ACTIVE","taskDefinitionArn":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:5","taskRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","volumes":[]}}'
+        headers:
+            Content-Length:
+                - "2644"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:23:36 GMT
+            X-Amzn-Requestid:
+                - 9a0f78d0-2968-4a3c-8271-92417a9eb9f5
+        status: 200 OK
+        code: 200
+        duration: 781.994571ms
+    - id: 2
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911017171905120"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 0f1e8c92-5197-4d31-a8c5-12eb8aa88b00
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911017171905120</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911017171905120</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:23:37Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>e2bb9ffc-682e-4079-915a-4d7a4808fa1f</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:23:37 GMT
+            X-Amzn-Requestid:
+                - e2bb9ffc-682e-4079-915a-4d7a4808fa1f
+        status: 200 OK
+        code: 200
+        duration: 142.424782ms
+    - id: 3
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 56
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"clusters":["cluster1002-teleport"],"include":["TAGS"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - e9d95420-aaa6-4cc1-bf6a-2107c0cee3f5
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102337Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeClusters
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 548
+        uncompressed: false
+        body: '{"clusters":[{"activeServicesCount":0,"capacityProviders":["FARGATE"],"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","clusterName":"cluster1002-teleport","defaultCapacityProviderStrategy":[],"pendingTasksCount":0,"registeredContainerInstancesCount":0,"runningTasksCount":0,"settings":[],"statistics":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}]}],"failures":[]}'
+        headers:
+            Content-Length:
+                - "548"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:23:37 GMT
+            X-Amzn-Requestid:
+                - 767e4aea-5243-44d8-94fb-9d0172ec7fb6
+        status: 200 OK
+        code: 200
+        duration: 180.19523ms
+    - id: 4
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911017497654970"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 994b16a8-1358-4c53-8462-70250fcdcbd4
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911017497654970</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911017497654970</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:23:37Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>6fa7c57c-a095-4ce7-95da-4f3eb2ad3034</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:23:37 GMT
+            X-Amzn-Requestid:
+                - 6fa7c57c-a095-4ce7-95da-4f3eb2ad3034
+        status: 200 OK
+        code: 200
+        duration: 137.223613ms
+    - id: 5
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 106
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","include":["TAGS"],"services":["cluster1002-teleport-database-service"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 8fa7c018-8224-4b3a-b92c-1dfc8460dd95
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102337Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeServices
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2240
+        uncompressed: false
+        body: '{"failures":[],"services":[{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","createdAt":1.686910651901E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.68691073965E9,"desiredCount":0,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/9596191636721638307","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"IN_PROGRESS","rolloutStateReason":"ECS deployment ecs-svc/9596191636721638307 in progress.","runningCount":0,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:2","updatedAt":1.686910887907E9}],"desiredCount":0,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runStatus":"Inactive","runningCount":0,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service","serviceName":"cluster1002-teleport-database-service","serviceRegistries":[],"status":"INACTIVE","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:2","version":0}]}'
+        headers:
+            Content-Length:
+                - "2240"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:23:37 GMT
+            X-Amzn-Requestid:
+                - 4e23cdbb-a1a3-454e-bd12-834067db7d59
+        status: 200 OK
+        code: 200
+        duration: 186.472276ms
+    - id: 6
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911017829781203"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 268f875b-2dba-4d85-b110-2bbb6c092561
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911017829781203</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911017829781203</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:23:37Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>5385652c-3790-4323-86d6-166b3a67dc00</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:23:37 GMT
+            X-Amzn-Requestid:
+                - 5385652c-3790-4323-86d6-166b3a67dc00
+        status: 200 OK
+        code: 200
+        duration: 152.749148ms
+    - id: 7
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 97
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","force":true,"service":"cluster1002-teleport-database-service"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - ada8dfc0-0c04-4956-aadf-239083d1e382
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102337Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DeleteService
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2223
+        uncompressed: false
+        body: '{"service":{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","createdAt":1.686910651901E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.68691073965E9,"desiredCount":0,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/9596191636721638307","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"IN_PROGRESS","rolloutStateReason":"ECS deployment ecs-svc/9596191636721638307 in progress.","runningCount":0,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:2","updatedAt":1.686910887907E9}],"desiredCount":0,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runStatus":"Inactive","runningCount":0,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service","serviceName":"cluster1002-teleport-database-service","serviceRegistries":[],"status":"INACTIVE","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:2","version":0}}'
+        headers:
+            Content-Length:
+                - "2223"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:23:37 GMT
+            X-Amzn-Requestid:
+                - ac078326-e71c-4a34-bb2b-481cda74db95
+        status: 200 OK
+        code: 200
+        duration: 180.63118ms
+    - id: 8
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911018164695155"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 03a8664f-0cea-4f0d-9866-babd00b0b5e8
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911018164695155</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911018164695155</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:23:38Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>6fb7e9cb-0930-46dd-88fc-cc5174e844a2</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:23:38 GMT
+            X-Amzn-Requestid:
+                - 6fb7e9cb-0930-46dd-88fc-cc5174e844a2
+        status: 200 OK
+        code: 200
+        duration: 148.511174ms
+    - id: 9
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 693
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","desiredCount":1,"launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"propagateTags":"SERVICE","serviceName":"cluster1002-teleport-database-service","tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:5"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - aefd3195-8a6f-47e9-b127-93d700acf557
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102338Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.CreateService
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2400
+        uncompressed: false
+        body: '{"service":{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","createdAt":1.686911018875E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.686911018875E9,"desiredCount":1,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/4405686048337041128","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"IN_PROGRESS","rolloutStateReason":"ECS deployment ecs-svc/4405686048337041128 in progress.","runningCount":0,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:5","updatedAt":1.686911018875E9}],"desiredCount":1,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runStatus":"Unknown","runningCount":0,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service","serviceName":"cluster1002-teleport-database-service","serviceRegistries":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:5","version":0}}'
+        headers:
+            Content-Length:
+                - "2400"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:23:38 GMT
+            X-Amzn-Requestid:
+                - f1613a7d-bcf3-4f0c-b5e7-ef347d9c4cb4
+        status: 200 OK
+        code: 200
+        duration: 685.396222ms
diff --git a/lib/integrations/awsoidc/fixtures/emptyaccount.yaml b/lib/integrations/awsoidc/fixtures/emptyaccount.yaml
new file mode 100644
index 0000000000000..8e7396ce7356c
--- /dev/null
+++ b/lib/integrations/awsoidc/fixtures/emptyaccount.yaml
@@ -0,0 +1,603 @@
+---
+version: 2
+interactions:
+    - id: 0
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910648103790394"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 0ec16bbb-d12d-4f16-8b52-420c4f3814cb
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910648103790394</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910648103790394</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:17:29Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>714cf5a1-1b33-48ce-a6cb-c6631cd89901</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:17:28 GMT
+            X-Amzn-Requestid:
+                - 714cf5a1-1b33-48ce-a6cb-c6631cd89901
+        status: 200 OK
+        code: 200
+        duration: 1.149154693s
+    - id: 1
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 1703
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"entryPoint":["teleport"],"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service","awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport"}},"name":"teleport-service"}],"cpu":"2048","executionRoleArn":"MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","requiresCompatibilities":["FARGATE"],"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskRoleArn":"MarcoEC2Role"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 5ca473cc-b779-421a-b136-701caf4ce932
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T101729Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2644
+        uncompressed: false
+        body: '{"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":{"compatibilities":["EC2","FARGATE"],"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"cpu":0,"entryPoint":["teleport"],"environment":[],"essential":true,"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"mountPoints":[],"name":"teleport-service","portMappings":[],"volumesFrom":[]}],"cpu":"2048","executionRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","placementConstraints":[],"registeredAt":1.686910649892E9,"registeredBy":"arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910648103790394","requiresAttributes":[{"name":"com.amazonaws.ecs.capability.logging-driver.awslogs"},{"name":"ecs.capability.execution-role-awslogs"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.19"},{"name":"com.amazonaws.ecs.capability.task-iam-role"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.18"},{"name":"ecs.capability.task-eni"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.29"}],"requiresCompatibilities":["FARGATE"],"revision":1,"status":"ACTIVE","taskDefinitionArn":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:1","taskRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","volumes":[]}}'
+        headers:
+            Content-Length:
+                - "2644"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:17:29 GMT
+            X-Amzn-Requestid:
+                - c569b627-652f-43db-a7bb-edaf884d070c
+        status: 200 OK
+        code: 200
+        duration: 756.013031ms
+    - id: 2
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910650010453356"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - d8fdb754-fffb-4460-8af9-362363f065e5
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910650010453356</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910650010453356</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:17:30Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>39802281-a543-4888-983e-e3d2b63fdde4</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:17:29 GMT
+            X-Amzn-Requestid:
+                - 39802281-a543-4888-983e-e3d2b63fdde4
+        status: 200 OK
+        code: 200
+        duration: 158.400558ms
+    - id: 3
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 56
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"clusters":["cluster1002-teleport"],"include":["TAGS"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - cefebee1-8507-4d72-b54a-3a76da1d257c
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T101730Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeClusters
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 121
+        uncompressed: false
+        body: '{"clusters":[],"failures":[{"arn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","reason":"MISSING"}]}'
+        headers:
+            Content-Length:
+                - "121"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:17:30 GMT
+            X-Amzn-Requestid:
+                - 5c5124a4-7455-45da-849b-31a7f079c278
+        status: 200 OK
+        code: 200
+        duration: 217.33819ms
+    - id: 4
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910650387214490"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 0002d160-a1c8-49ce-ab5a-0b4628c065f3
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910650387214490</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910650387214490</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:17:30Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>f7c67b09-a2de-4efc-9490-154e258f47f1</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:17:29 GMT
+            X-Amzn-Requestid:
+                - f7c67b09-a2de-4efc-9490-154e258f47f1
+        status: 200 OK
+        code: 200
+        duration: 139.254623ms
+    - id: 5
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 249
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"capacityProviders":["FARGATE"],"clusterName":"cluster1002-teleport","tags":[{"key":"teleport.dev/integration","value":"teleportdev"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"}]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 3a803920-8890-43a0-90bb-e33ddfe3b03b
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T101730Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.CreateCluster
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 595
+        uncompressed: false
+        body: '{"cluster":{"activeServicesCount":0,"capacityProviders":["FARGATE"],"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","clusterName":"cluster1002-teleport","defaultCapacityProviderStrategy":[],"pendingTasksCount":0,"registeredContainerInstancesCount":0,"runningTasksCount":0,"settings":[{"name":"containerInsights","value":"disabled"}],"statistics":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}]},"clusterCount":0}'
+        headers:
+            Content-Length:
+                - "595"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:17:30 GMT
+            X-Amzn-Requestid:
+                - 79becd92-6fe3-449c-b4de-ea621a6e8a69
+        status: 200 OK
+        code: 200
+        duration: 342.249596ms
+    - id: 6
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910650870254453"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 38a0227b-c0d4-4d45-bd87-95205fc17172
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910650870254453</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910650870254453</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:17:30Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>e43463ca-2484-4bd7-9bac-3c6107e48415</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:17:30 GMT
+            X-Amzn-Requestid:
+                - e43463ca-2484-4bd7-9bac-3c6107e48415
+        status: 200 OK
+        code: 200
+        duration: 141.740345ms
+    - id: 7
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 106
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","include":["TAGS"],"services":["cluster1002-teleport-database-service"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - ea60f52e-5aa1-499e-a6a0-edc025538fdc
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T101731Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeServices
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 138
+        uncompressed: false
+        body: '{"failures":[{"arn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport-database-service","reason":"MISSING"}],"services":[]}'
+        headers:
+            Content-Length:
+                - "138"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:17:31 GMT
+            X-Amzn-Requestid:
+                - 07d1c761-0564-41fe-b652-90cee79a7f8c
+        status: 200 OK
+        code: 200
+        duration: 170.572086ms
+    - id: 8
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910651184282997"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - e0d21fed-06e3-46e2-a90d-83144dee0af4
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910651184282997</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910651184282997</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:17:31Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>a785d6e1-cd93-4fc8-b4f8-8d89620c477d</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:17:30 GMT
+            X-Amzn-Requestid:
+                - a785d6e1-cd93-4fc8-b4f8-8d89620c477d
+        status: 200 OK
+        code: 200
+        duration: 148.727427ms
+    - id: 9
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 693
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","desiredCount":1,"launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"propagateTags":"SERVICE","serviceName":"cluster1002-teleport-database-service","tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:1"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 8016bfc2-0358-44fb-88b9-6d05a0bf1ad5
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T101731Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.CreateService
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2378
+        uncompressed: false
+        body: '{"service":{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","createdAt":1.686910651901E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.686910651901E9,"desiredCount":1,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/1232828310745079648","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"IN_PROGRESS","rolloutStateReason":"ECS deployment ecs-svc/1232828310745079648 in progress.","runningCount":0,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:1","updatedAt":1.686910651901E9}],"desiredCount":1,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runningCount":0,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service","serviceName":"cluster1002-teleport-database-service","serviceRegistries":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:1","version":0}}'
+        headers:
+            Content-Length:
+                - "2378"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:17:31 GMT
+            X-Amzn-Requestid:
+                - ba794ef5-7f97-478e-835e-a7b0264337df
+        status: 200 OK
+        code: 200
+        duration: 666.538747ms
diff --git a/lib/integrations/awsoidc/fixtures/replace.yaml b/lib/integrations/awsoidc/fixtures/replace.yaml
new file mode 100644
index 0000000000000..b7d64880999fa
--- /dev/null
+++ b/lib/integrations/awsoidc/fixtures/replace.yaml
@@ -0,0 +1,483 @@
+---
+version: 2
+interactions:
+    - id: 0
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910736627520216"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 85391854-7893-4e70-b931-5f5aab724452
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910736627520216</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910736627520216</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:18:57Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>5e613fa6-80ce-493b-a96d-50f8b0f00aff</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:18:57 GMT
+            X-Amzn-Requestid:
+                - 5e613fa6-80ce-493b-a96d-50f8b0f00aff
+        status: 200 OK
+        code: 200
+        duration: 1.0508353s
+    - id: 1
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 1703
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"entryPoint":["teleport"],"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"name":"teleport-service"}],"cpu":"2048","executionRoleArn":"MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","requiresCompatibilities":["FARGATE"],"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskRoleArn":"MarcoEC2Role"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 6e9fb77a-d68c-4169-b988-108aea590d7b
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T101857Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2644
+        uncompressed: false
+        body: '{"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":{"compatibilities":["EC2","FARGATE"],"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"cpu":0,"entryPoint":["teleport"],"environment":[],"essential":true,"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"mountPoints":[],"name":"teleport-service","portMappings":[],"volumesFrom":[]}],"cpu":"2048","executionRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","placementConstraints":[],"registeredAt":1.686910738291E9,"registeredBy":"arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910736627520216","requiresAttributes":[{"name":"com.amazonaws.ecs.capability.logging-driver.awslogs"},{"name":"ecs.capability.execution-role-awslogs"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.19"},{"name":"com.amazonaws.ecs.capability.task-iam-role"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.18"},{"name":"ecs.capability.task-eni"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.29"}],"requiresCompatibilities":["FARGATE"],"revision":2,"status":"ACTIVE","taskDefinitionArn":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:2","taskRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","volumes":[]}}'
+        headers:
+            Content-Length:
+                - "2644"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:18:57 GMT
+            X-Amzn-Requestid:
+                - 292c364b-712e-4927-b7ea-ed35b43617aa
+        status: 200 OK
+        code: 200
+        duration: 724.527903ms
+    - id: 2
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910738404698814"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 6aa8e137-de7f-47af-b233-b86a989f1143
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910738404698814</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910738404698814</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:18:58Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>f3897610-ff1e-416a-812b-5fdba24e12a4</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:18:58 GMT
+            X-Amzn-Requestid:
+                - f3897610-ff1e-416a-812b-5fdba24e12a4
+        status: 200 OK
+        code: 200
+        duration: 145.492676ms
+    - id: 3
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 56
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"clusters":["cluster1002-teleport"],"include":["TAGS"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 04603a04-39a0-46f0-ab1f-4081f81af429
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T101858Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeClusters
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 548
+        uncompressed: false
+        body: '{"clusters":[{"activeServicesCount":1,"capacityProviders":["FARGATE"],"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","clusterName":"cluster1002-teleport","defaultCapacityProviderStrategy":[],"pendingTasksCount":0,"registeredContainerInstancesCount":0,"runningTasksCount":1,"settings":[],"statistics":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}]}],"failures":[]}'
+        headers:
+            Content-Length:
+                - "548"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:18:58 GMT
+            X-Amzn-Requestid:
+                - 9d17c5e6-4f93-4825-b645-e518b0f1f167
+        status: 200 OK
+        code: 200
+        duration: 184.047841ms
+    - id: 4
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910738735562164"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 01fdf3e9-f551-46fd-aed9-c2202e22de14
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910738735562164</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910738735562164</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:18:58Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>4ab8bc85-db6f-432a-bc11-50777f2264fd</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:18:58 GMT
+            X-Amzn-Requestid:
+                - 4ab8bc85-db6f-432a-bc11-50777f2264fd
+        status: 200 OK
+        code: 200
+        duration: 144.014392ms
+    - id: 5
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 106
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","include":["TAGS"],"services":["cluster1002-teleport-database-service"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 87c60cd6-1af0-4570-a37b-50804832a361
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T101858Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeServices
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2974
+        uncompressed: false
+        body: '{"failures":[],"services":[{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","createdAt":1.686910651901E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.686910651901E9,"desiredCount":1,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/1232828310745079648","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"COMPLETED","rolloutStateReason":"ECS deployment ecs-svc/1232828310745079648 completed.","runningCount":1,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:1","updatedAt":1.686910686813E9}],"desiredCount":1,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[{"createdAt":1.686910686818E9,"id":"ca5ece75-e4ea-41c8-8ad8-edf095100e2d","message":"(service cluster1002-teleport-database-service) has reached a steady state."},{"createdAt":1.686910686817E9,"id":"222346ec-1b7e-4c81-aabf-f295aa801242","message":"(service cluster1002-teleport-database-service) (deployment ecs-svc/1232828310745079648) deployment completed."},{"createdAt":1.686910657518E9,"id":"ae6c53a7-c6c5-40c2-96ff-f92614b68a47","message":"(service cluster1002-teleport-database-service) has started 1 tasks: (task 44749166194b4226b1b18d60a46451fc)."}],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runStatus":"SteadyState","runningCount":1,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service","serviceName":"cluster1002-teleport-database-service","serviceRegistries":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:1","version":0}]}'
+        headers:
+            Content-Length:
+                - "2974"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:18:58 GMT
+            X-Amzn-Requestid:
+                - a2a270ac-344b-41b8-ac00-9cb36a57e24c
+        status: 200 OK
+        code: 200
+        duration: 187.743994ms
+    - id: 6
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910739068896807"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 85cbfbdc-a456-4c32-811b-d3420c88c15f
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910739068896807</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910739068896807</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:18:59Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>3754099e-707d-4c7f-89db-5931c547396c</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:18:58 GMT
+            X-Amzn-Requestid:
+                - 3754099e-707d-4c7f-89db-5931c547396c
+        status: 200 OK
+        code: 200
+        duration: 132.256221ms
+    - id: 7
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 513
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","desiredCount":1,"forceNewDeployment":true,"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"propagateTags":"SERVICE","service":"cluster1002-teleport-database-service","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:2"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 39683ebe-91cb-414f-ae9a-939e6a8be39d
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T101859Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.UpdateService
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 3566
+        uncompressed: false
+        body: '{"service":{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","createdAt":1.686910651901E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.68691073965E9,"desiredCount":0,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/9596191636721638307","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"IN_PROGRESS","rolloutStateReason":"ECS deployment ecs-svc/9596191636721638307 in progress.","runningCount":0,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:2","updatedAt":1.68691073965E9},{"createdAt":1.686910651901E9,"desiredCount":1,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/1232828310745079648","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"COMPLETED","rolloutStateReason":"ECS deployment ecs-svc/1232828310745079648 completed.","runningCount":1,"status":"ACTIVE","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:1","updatedAt":1.686910686813E9}],"desiredCount":1,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[{"createdAt":1.686910686818E9,"id":"ca5ece75-e4ea-41c8-8ad8-edf095100e2d","message":"(service cluster1002-teleport-database-service) has reached a steady state."},{"createdAt":1.686910686817E9,"id":"222346ec-1b7e-4c81-aabf-f295aa801242","message":"(service cluster1002-teleport-database-service) (deployment ecs-svc/1232828310745079648) deployment completed."},{"createdAt":1.686910657518E9,"id":"ae6c53a7-c6c5-40c2-96ff-f92614b68a47","message":"(service cluster1002-teleport-database-service) has started 1 tasks: (task 44749166194b4226b1b18d60a46451fc)."}],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runStatus":"SteadyState","runningCount":1,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service","serviceName":"cluster1002-teleport-database-service","serviceRegistries":[],"status":"ACTIVE","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:2","version":0}}'
+        headers:
+            Content-Length:
+                - "3566"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:18:59 GMT
+            X-Amzn-Requestid:
+                - de1ff65d-2b3d-4277-8f77-0905880e3936
+        status: 200 OK
+        code: 200
+        duration: 529.992623ms
diff --git a/lib/integrations/awsoidc/fixtures/service_without_ownership_tags.yaml b/lib/integrations/awsoidc/fixtures/service_without_ownership_tags.yaml
new file mode 100644
index 0000000000000..692d897641140
--- /dev/null
+++ b/lib/integrations/awsoidc/fixtures/service_without_ownership_tags.yaml
@@ -0,0 +1,363 @@
+---
+version: 2
+interactions:
+    - id: 0
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911098435542029"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - bcfb65e6-3d88-4331-aeb2-f839d9e6060c
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911098435542029</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911098435542029</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:24:59Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>bd57d79a-87b5-4b43-bf47-425cb90789cf</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:24:59 GMT
+            X-Amzn-Requestid:
+                - bd57d79a-87b5-4b43-bf47-425cb90789cf
+        status: 200 OK
+        code: 200
+        duration: 1.154254825s
+    - id: 1
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 1703
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"entryPoint":["teleport"],"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"name":"teleport-service"}],"cpu":"2048","executionRoleArn":"MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","requiresCompatibilities":["FARGATE"],"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskRoleArn":"MarcoEC2Role"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - fa23fa36-c918-470f-8066-f4274fa6fe40
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102459Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2644
+        uncompressed: false
+        body: '{"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":{"compatibilities":["EC2","FARGATE"],"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"cpu":0,"entryPoint":["teleport"],"environment":[],"essential":true,"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"mountPoints":[],"name":"teleport-service","portMappings":[],"volumesFrom":[]}],"cpu":"2048","executionRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","placementConstraints":[],"registeredAt":1.686911100252E9,"registeredBy":"arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911098435542029","requiresAttributes":[{"name":"com.amazonaws.ecs.capability.logging-driver.awslogs"},{"name":"ecs.capability.execution-role-awslogs"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.19"},{"name":"com.amazonaws.ecs.capability.task-iam-role"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.18"},{"name":"ecs.capability.task-eni"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.29"}],"requiresCompatibilities":["FARGATE"],"revision":7,"status":"ACTIVE","taskDefinitionArn":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:7","taskRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","volumes":[]}}'
+        headers:
+            Content-Length:
+                - "2644"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:24:59 GMT
+            X-Amzn-Requestid:
+                - 14c3b5b8-2549-4207-9e38-a8f318d20927
+        status: 200 OK
+        code: 200
+        duration: 787.700865ms
+    - id: 2
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911100379112147"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 11017248-7baa-44f4-9c7c-9b82028c2711
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911100379112147</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911100379112147</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:25:00Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>43eb61dd-ac40-4bca-90ac-1d7d12a5661f</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:25:00 GMT
+            X-Amzn-Requestid:
+                - 43eb61dd-ac40-4bca-90ac-1d7d12a5661f
+        status: 200 OK
+        code: 200
+        duration: 139.637922ms
+    - id: 3
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 56
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"clusters":["cluster1002-teleport"],"include":["TAGS"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 5db33d58-7bb7-42c9-a873-8a9ccee46d07
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102500Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeClusters
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 548
+        uncompressed: false
+        body: '{"clusters":[{"activeServicesCount":1,"capacityProviders":["FARGATE"],"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","clusterName":"cluster1002-teleport","defaultCapacityProviderStrategy":[],"pendingTasksCount":0,"registeredContainerInstancesCount":0,"runningTasksCount":1,"settings":[],"statistics":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}]}],"failures":[]}'
+        headers:
+            Content-Length:
+                - "548"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:25:00 GMT
+            X-Amzn-Requestid:
+                - 1ee3cccd-cd5d-4757-aa95-49a96128ca31
+        status: 200 OK
+        code: 200
+        duration: 185.564423ms
+    - id: 4
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686911100705802122"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - a62f20e5-fc64-407c-bcd5-5e6d276fce62
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686911100705802122</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686911100705802122</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:25:00Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>34b3678b-c3e9-4ff6-b176-c62e4f92b279</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:25:00 GMT
+            X-Amzn-Requestid:
+                - 34b3678b-c3e9-4ff6-b176-c62e4f92b279
+        status: 200 OK
+        code: 200
+        duration: 145.865702ms
+    - id: 5
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 106
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","include":["TAGS"],"services":["cluster1002-teleport-database-service"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 4e9f605c-98fb-43a8-b8dd-6a12f9543159
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102500Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeServices
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2974
+        uncompressed: false
+        body: '{"failures":[],"services":[{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","createdAt":1.686911018875E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.686911018875E9,"desiredCount":1,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/4405686048337041128","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"COMPLETED","rolloutStateReason":"ECS deployment ecs-svc/4405686048337041128 completed.","runningCount":1,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:5","updatedAt":1.686911052717E9}],"desiredCount":1,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[{"createdAt":1.686911052725E9,"id":"e812395f-3a97-47e3-ac7c-264fd5991bee","message":"(service cluster1002-teleport-database-service) has reached a steady state."},{"createdAt":1.686911052724E9,"id":"3f552842-5a91-4f0a-b5e0-8a8038b46e58","message":"(service cluster1002-teleport-database-service) (deployment ecs-svc/4405686048337041128) deployment completed."},{"createdAt":1.686911023075E9,"id":"0dd1be6f-87d0-4ddc-8e44-0c0fdab088d2","message":"(service cluster1002-teleport-database-service) has started 1 tasks: (task 1ad87fcbc1a54cfbbcc1bb16da64b4a7)."}],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runStatus":"SteadyState","runningCount":1,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service","serviceName":"cluster1002-teleport-database-service","serviceRegistries":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1001"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:5","version":0}]}'
+        headers:
+            Content-Length:
+                - "2974"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:25:00 GMT
+            X-Amzn-Requestid:
+                - 55b93c4d-7e66-4b0f-8702-b61c25e6c806
+        status: 200 OK
+        code: 200
+        duration: 184.333605ms
diff --git a/lib/integrations/awsoidc/fixtures/servicedeleted.yaml b/lib/integrations/awsoidc/fixtures/servicedeleted.yaml
new file mode 100644
index 0000000000000..8ee28ef216940
--- /dev/null
+++ b/lib/integrations/awsoidc/fixtures/servicedeleted.yaml
@@ -0,0 +1,363 @@
+---
+version: 2
+interactions:
+    - id: 0
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910874064151403"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 83145c79-f826-4f77-bd75-5e82d28c2340
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910874064151403</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910874064151403</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:21:15Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>582b7133-0c2c-4d76-beeb-f27d0cb3310d</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:21:14 GMT
+            X-Amzn-Requestid:
+                - 582b7133-0c2c-4d76-beeb-f27d0cb3310d
+        status: 200 OK
+        code: 200
+        duration: 1.087512264s
+    - id: 1
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 1703
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"entryPoint":["teleport"],"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"name":"teleport-service"}],"cpu":"2048","executionRoleArn":"MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","requiresCompatibilities":["FARGATE"],"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskRoleArn":"MarcoEC2Role"}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 11e9b430-ce55-4001-9103-e35e341609b3
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102115Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 2644
+        uncompressed: false
+        body: '{"tags":[{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/integration","value":"teleportdev"}],"taskDefinition":{"compatibilities":["EC2","FARGATE"],"containerDefinitions":[{"command":["start","--config-string","dmVyc2lvbjogdjMKdGVsZXBvcnQ6CiAgZGF0YV9kaXI6IC92YXIvbGliL3RlbGVwb3J0CiAgam9pbl9wYXJhbXM6CiAgICB0b2tlbl9uYW1lOiBkaXNjb3Zlci1hd3Mtb2lkYy1pYW0tdG9rZW4KICAgIG1ldGhvZDogaWFtCiAgcHJveHlfc2VydmVyOiBtYXJjb2RpbmlzLnRlbGVwb3J0ZGVtby5uZXQ6NDQzCiAgbG9nOgogICAgb3V0cHV0OiBzdGRlcnIKICAgIHNldmVyaXR5OiBJTkZPCiAgICBmb3JtYXQ6CiAgICAgIG91dHB1dDogdGV4dAogIGNhX3BpbjogIiIKICBkaWFnX2FkZHI6ICIiCmF1dGhfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgbGlzdGVuX2FkZHI6IDAuMC4wLjA6MzAyNQogIHByb3h5X2xpc3RlbmVyX21vZGU6IG11bHRpcGxleApzc2hfc2VydmljZToKICBlbmFibGVkOiAibm8iCiAgY29tbWFuZHM6CiAgLSBuYW1lOiBob3N0bmFtZQogICAgY29tbWFuZDogW2hvc3RuYW1lXQogICAgcGVyaW9kOiAxbTBzCnByb3h5X3NlcnZpY2U6CiAgZW5hYmxlZDogIm5vIgogIGh0dHBzX2tleXBhaXJzOiBbXQogIGh0dHBzX2tleXBhaXJzX3JlbG9hZF9pbnRlcnZhbDogMHMKICBhY21lOiB7fQpkYl9zZXJ2aWNlOgogIGVuYWJsZWQ6ICJ5ZXMiCiAgZGF0YWJhc2VzOiBbXQogIHJlc291cmNlczoKICAtIGxhYmVsczoKICAgICAgJyonOiAnKicK"],"cpu":0,"entryPoint":["teleport"],"environment":[],"essential":true,"image":"public.ecr.aws/gravitational/teleport-distroless:13.1.1","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-create-group":"true","awslogs-group":"ecs-cluster1002-teleport","awslogs-region":"us-east-1","awslogs-stream-prefix":"cluster1002-teleport-database-service/cluster1002-teleport-database-service"}},"mountPoints":[],"name":"teleport-service","portMappings":[],"volumesFrom":[]}],"cpu":"2048","executionRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","family":"cluster1002-teleport-database-service","memory":"4096","networkMode":"awsvpc","placementConstraints":[],"registeredAt":1.686910875785E9,"registeredBy":"arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910874064151403","requiresAttributes":[{"name":"com.amazonaws.ecs.capability.logging-driver.awslogs"},{"name":"ecs.capability.execution-role-awslogs"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.19"},{"name":"com.amazonaws.ecs.capability.task-iam-role"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.18"},{"name":"ecs.capability.task-eni"},{"name":"com.amazonaws.ecs.capability.docker-remote-api.1.29"}],"requiresCompatibilities":["FARGATE"],"revision":3,"status":"ACTIVE","taskDefinitionArn":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:3","taskRoleArn":"arn:aws:iam::278576220453:role/MarcoEC2Role","volumes":[]}}'
+        headers:
+            Content-Length:
+                - "2644"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:21:15 GMT
+            X-Amzn-Requestid:
+                - a8fce2bc-9fb0-4968-afe3-83411bac673b
+        status: 200 OK
+        code: 200
+        duration: 746.311319ms
+    - id: 2
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910875900082744"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 13d25227-2b61-4b24-986d-9ccc092c1ec5
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910875900082744</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910875900082744</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:21:15Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>40a4fc63-7873-4ac3-a6a6-4da2a6eb96c8</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:21:15 GMT
+            X-Amzn-Requestid:
+                - 40a4fc63-7873-4ac3-a6a6-4da2a6eb96c8
+        status: 200 OK
+        code: 200
+        duration: 140.115809ms
+    - id: 3
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 56
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"clusters":["cluster1002-teleport"],"include":["TAGS"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 5abd650e-1765-4815-b705-1374a343d43a
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102116Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeClusters
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 548
+        uncompressed: false
+        body: '{"clusters":[{"activeServicesCount":0,"capacityProviders":["FARGATE"],"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","clusterName":"cluster1002-teleport","defaultCapacityProviderStrategy":[],"pendingTasksCount":0,"registeredContainerInstancesCount":0,"runningTasksCount":2,"settings":[],"statistics":[],"status":"ACTIVE","tags":[{"key":"teleport.dev/cluster","value":"cluster1002"},{"key":"teleport.dev/origin","value":"integration_awsoidc"},{"key":"teleport.dev/integration","value":"teleportdev"}]}],"failures":[]}'
+        headers:
+            Content-Length:
+                - "548"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:21:15 GMT
+            X-Amzn-Requestid:
+                - ded4bb2f-b1b1-451f-96ba-5a5c80e3e58a
+        status: 200 OK
+        code: 200
+        duration: 166.952212ms
+    - id: 4
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 841
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            Action:
+                - AssumeRoleWithWebIdentity
+            RoleArn:
+                - arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider
+            RoleSessionName:
+                - "1686910876208800294"
+            Version:
+                - "2011-06-15"
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - a6760ac2-93ad-4bdd-9020-c91e421a32e7
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-www-form-urlencoded
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/sts/1.19.0
+        url: https://sts.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 1930
+        uncompressed: false
+        body: |
+            <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
+              <AssumeRoleWithWebIdentityResult>
+                <Audience>discover.teleport</Audience>
+                <AssumedRoleUser>
+                  <AssumedRoleId>AROAUBXDPZES62GD44VBR:1686910876208800294</AssumedRoleId>
+                  <Arn>arn:aws:sts::278576220453:assumed-role/MarcoTestRoleOIDCProvider/1686910876208800294</Arn>
+                </AssumedRoleUser>
+                <Provider>arn:aws:iam::278576220453:oidc-provider/marcodinis.teleportdemo.net</Provider>
+                <Credentials>
+                  <AccessKeyId>x</AccessKeyId><SecretAccessKey>x</SecretAccessKey><SessionToken>x</SessionToken>
+                  <Expiration>2023-06-16T11:21:16Z</Expiration>
+                </Credentials>
+                <SubjectFromWebIdentityToken>system:proxy</SubjectFromWebIdentityToken>
+              </AssumeRoleWithWebIdentityResult>
+              <ResponseMetadata>
+                <RequestId>dd2d0a03-7ddc-4be7-bd2f-ffbbf41160b1</RequestId>
+              </ResponseMetadata>
+            </AssumeRoleWithWebIdentityResponse>
+        headers:
+            Content-Length:
+                - "1930"
+            Content-Type:
+                - text/xml
+            Date:
+                - Fri, 16 Jun 2023 10:21:15 GMT
+            X-Amzn-Requestid:
+                - dd2d0a03-7ddc-4be7-bd2f-ffbbf41160b1
+        status: 200 OK
+        code: 200
+        duration: 143.453061ms
+    - id: 5
+      request:
+        proto: ""
+        proto_major: 0
+        proto_minor: 0
+        content_length: 106
+        transfer_encoding: []
+        trailer: {}
+        host: ""
+        remote_addr: ""
+        request_uri: ""
+        body: '{"cluster":"cluster1002-teleport","include":["TAGS"],"services":["cluster1002-teleport-database-service"]}'
+        form: {}
+        headers:
+            Amz-Sdk-Invocation-Id:
+                - 5f0fc7fe-8e43-4e03-8d94-5a3166c24d40
+            Amz-Sdk-Request:
+                - attempt=1; max=3
+            Content-Type:
+                - application/x-amz-json-1.1
+            User-Agent:
+                - aws-sdk-go-v2/1.18.0 os/linux lang/go/1.20.4 md/GOOS/linux md/GOARCH/amd64 api/ecs/1.27.1
+            X-Amz-Date:
+                - 20230616T102116Z
+            X-Amz-Target:
+                - AmazonEC2ContainerServiceV20141113.DescribeServices
+        url: https://ecs.us-east-1.amazonaws.com/
+        method: POST
+      response:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        transfer_encoding: []
+        trailer: {}
+        content_length: 3777
+        uncompressed: false
+        body: '{"failures":[],"services":[{"clusterArn":"arn:aws:ecs:us-east-1:278576220453:cluster/cluster1002-teleport","createdAt":1.686910651901E9,"createdBy":"arn:aws:iam::278576220453:role/MarcoTestRoleOIDCProvider","deploymentConfiguration":{"deploymentCircuitBreaker":{"enable":false,"rollback":false},"maximumPercent":200,"minimumHealthyPercent":100},"deploymentController":{"type":"ECS"},"deployments":[{"createdAt":1.68691073965E9,"desiredCount":0,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/9596191636721638307","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"IN_PROGRESS","rolloutStateReason":"ECS deployment ecs-svc/9596191636721638307 in progress.","runningCount":1,"status":"PRIMARY","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:2","updatedAt":1.686910871683E9},{"createdAt":1.686910651901E9,"desiredCount":0,"failedLaunchTaskCount":0,"failedTasks":0,"id":"ecs-svc/1232828310745079648","launchType":"FARGATE","networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"platformFamily":"Linux","platformVersion":"1.4.0","replacedTaskCount":0,"rolloutState":"COMPLETED","rolloutStateReason":"ECS deployment ecs-svc/1232828310745079648 completed.","runningCount":1,"status":"ACTIVE","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:1","updatedAt":1.686910819021E9}],"desiredCount":0,"enableECSManagedTags":false,"enableExecuteCommand":false,"events":[{"createdAt":1.686910770752E9,"id":"f58b5999-d12c-41b7-8923-c833c9c611ac","message":"(service cluster1002-teleport-database-service) has started 1 tasks: (task c5e1045426c2453cbed8c1d261d99923)."},{"createdAt":1.686910686818E9,"id":"ca5ece75-e4ea-41c8-8ad8-edf095100e2d","message":"(service cluster1002-teleport-database-service) has reached a steady state."},{"createdAt":1.686910686817E9,"id":"222346ec-1b7e-4c81-aabf-f295aa801242","message":"(service cluster1002-teleport-database-service) (deployment ecs-svc/1232828310745079648) deployment completed."},{"createdAt":1.686910657518E9,"id":"ae6c53a7-c6c5-40c2-96ff-f92614b68a47","message":"(service cluster1002-teleport-database-service) has started 1 tasks: (task 44749166194b4226b1b18d60a46451fc)."}],"launchType":"FARGATE","loadBalancers":[],"networkConfiguration":{"awsvpcConfiguration":{"assignPublicIp":"ENABLED","securityGroups":[],"subnets":["subnet-0b7ab67161173748b","subnet-0dda93c8621eb2e99","subnet-034f17b3f7344e375","subnet-04a07d4721a3c96e0","subnet-0ef025345dd791986","subnet-099632749366c2c56"]}},"pendingCount":0,"placementConstraints":[],"placementStrategy":[],"platformFamily":"Linux","platformVersion":"LATEST","propagateTags":"SERVICE","roleArn":"arn:aws:iam::278576220453:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS","runStatus":"Unset","runningCount":2,"schedulingStrategy":"REPLICA","serviceArn":"arn:aws:ecs:us-east-1:278576220453:service/cluster1002-teleport/cluster1002-teleport-database-service","serviceName":"cluster1002-teleport-database-service","serviceRegistries":[],"status":"DRAINING","taskDefinition":"arn:aws:ecs:us-east-1:278576220453:task-definition/cluster1002-teleport-database-service:2","version":0}]}'
+        headers:
+            Content-Length:
+                - "3777"
+            Content-Type:
+                - application/x-amz-json-1.1
+            Date:
+                - Fri, 16 Jun 2023 10:21:15 GMT
+            X-Amzn-Requestid:
+                - 0018bde1-cab5-40b7-9ad4-0172ad01be8a
+        status: 200 OK
+        code: 200
+        duration: 176.604987ms
diff --git a/lib/integrations/awsoidc/tags.go b/lib/integrations/awsoidc/tags.go
new file mode 100644
index 0000000000000..7b6f3a7d60fc6
--- /dev/null
+++ b/lib/integrations/awsoidc/tags.go
@@ -0,0 +1,95 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package awsoidc
+
+import (
+	"fmt"
+	"strings"
+
+	ecsTypes "github.com/aws/aws-sdk-go-v2/service/ecs/types"
+	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+type awsTags map[string]string
+
+// String converts awsTags into a ',' separated list of k:v
+func (d awsTags) String() string {
+	tagsString := make([]string, 0, len(d))
+	for k, v := range d {
+		tagsString = append(tagsString, fmt.Sprintf("%s:%s", k, v))
+	}
+
+	return strings.Join(tagsString, ", ")
+}
+
+// DefaultResourceCreationTags returns the default tags that should be applied when creating new AWS resources.
+// The following tags are returned:
+// - teleport.dev/cluster: <clusterName>
+// - teleport.dev/origin: aws-oidc-integration
+// - teleport.dev/integration: <integrationName>
+func DefaultResourceCreationTags(clusterName, integrationName string) awsTags {
+	return awsTags{
+		types.ClusterLabel:     clusterName,
+		types.OriginLabel:      types.OriginIntegrationAWSOIDC,
+		types.IntegrationLabel: integrationName,
+	}
+}
+
+// ToECSTags returns the default tags using the expected type for ECS resources: [ecsTypes.Tag]
+func (d awsTags) ToECSTags() []ecsTypes.Tag {
+	ecsTags := make([]ecsTypes.Tag, 0, len(d))
+	for k, v := range d {
+		k, v := k, v
+		ecsTags = append(ecsTags, ecsTypes.Tag{
+			Key:   &k,
+			Value: &v,
+		})
+	}
+	return ecsTags
+}
+
+// MatchesECSTags checks if the awsTags are present and have the same value in resourceTags.
+func (d awsTags) MatchesECSTags(resourceTags []ecsTypes.Tag) bool {
+	resourceTagsMap := make(map[string]string, len(resourceTags))
+	for _, tag := range resourceTags {
+		resourceTagsMap[*tag.Key] = *tag.Value
+	}
+
+	for awsTagKey, awsTagValue := range d {
+		resourceTagValue, found := resourceTagsMap[awsTagKey]
+		if !found || resourceTagValue != awsTagValue {
+			return false
+		}
+	}
+
+	return true
+}
+
+// ToIAMTags returns the default tags using the expected type for IAM resources: [iamTypes.Tag]
+func (d awsTags) ToIAMTags() []iamTypes.Tag {
+	iamTags := make([]iamTypes.Tag, 0, len(d))
+	for k, v := range d {
+		k, v := k, v
+		iamTags = append(iamTags, iamTypes.Tag{
+			Key:   &k,
+			Value: &v,
+		})
+	}
+	return iamTags
+}
diff --git a/lib/integrations/awsoidc/tags_test.go b/lib/integrations/awsoidc/tags_test.go
new file mode 100644
index 0000000000000..bfa70dbf09c5e
--- /dev/null
+++ b/lib/integrations/awsoidc/tags_test.go
@@ -0,0 +1,92 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package awsoidc
+
+import (
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	ecsTypes "github.com/aws/aws-sdk-go-v2/service/ecs/types"
+	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDefaultTags(t *testing.T) {
+	clusterName := "mycluster"
+	integrationName := "myawsaccount"
+	d := DefaultResourceCreationTags(clusterName, integrationName)
+
+	expectedTags := awsTags{
+		"teleport.dev/cluster":     "mycluster",
+		"teleport.dev/integration": "myawsaccount",
+		"teleport.dev/origin":      "integration_awsoidc",
+	}
+	require.Equal(t, expectedTags, d)
+
+	t.Run("iam tags", func(t *testing.T) {
+		expectedIAMTags := []iamTypes.Tag{
+			{Key: aws.String("teleport.dev/cluster"), Value: aws.String("mycluster")},
+			{Key: aws.String("teleport.dev/integration"), Value: aws.String("myawsaccount")},
+			{Key: aws.String("teleport.dev/origin"), Value: aws.String("integration_awsoidc")},
+		}
+		require.ElementsMatch(t, expectedIAMTags, d.ToIAMTags())
+	})
+
+	t.Run("ecs tags", func(t *testing.T) {
+		expectedECSTags := []ecsTypes.Tag{
+			{Key: aws.String("teleport.dev/cluster"), Value: aws.String("mycluster")},
+			{Key: aws.String("teleport.dev/integration"), Value: aws.String("myawsaccount")},
+			{Key: aws.String("teleport.dev/origin"), Value: aws.String("integration_awsoidc")},
+		}
+		require.ElementsMatch(t, expectedECSTags, d.ToECSTags())
+	})
+
+	t.Run("resource is teleport managed", func(t *testing.T) {
+		t.Run("all tags match", func(t *testing.T) {
+			awsResourceTags := []ecsTypes.Tag{
+				{Key: aws.String("teleport.dev/cluster"), Value: aws.String("mycluster")},
+				{Key: aws.String("teleport.dev/integration"), Value: aws.String("myawsaccount")},
+				{Key: aws.String("teleport.dev/origin"), Value: aws.String("integration_awsoidc")},
+			}
+			require.True(t, d.MatchesECSTags(awsResourceTags), "resource was wrongly detected as not Teleport managed")
+		})
+		t.Run("extra tags in aws resource", func(t *testing.T) {
+			awsResourceTags := []ecsTypes.Tag{
+				{Key: aws.String("teleport.dev/cluster"), Value: aws.String("mycluster")},
+				{Key: aws.String("teleport.dev/integration"), Value: aws.String("myawsaccount")},
+				{Key: aws.String("teleport.dev/origin"), Value: aws.String("integration_awsoidc")},
+				{Key: aws.String("unrelated"), Value: aws.String("true")},
+			}
+			require.True(t, d.MatchesECSTags(awsResourceTags), "resource was wrongly detected as not Teleport managed")
+		})
+		t.Run("missing one of the labels should return false", func(t *testing.T) {
+			awsResourceTags := []ecsTypes.Tag{
+				{Key: aws.String("teleport.dev/cluster"), Value: aws.String("mycluster")},
+				{Key: aws.String("teleport.dev/integration"), Value: aws.String("myawsaccount")},
+			}
+			require.False(t, d.MatchesECSTags(awsResourceTags), "resource was wrongly detected as Teleport managed")
+		})
+		t.Run("one of the labels has a different value, should return false", func(t *testing.T) {
+			awsResourceTags := []ecsTypes.Tag{
+				{Key: aws.String("teleport.dev/cluster"), Value: aws.String("another-cluster")},
+				{Key: aws.String("teleport.dev/integration"), Value: aws.String("myawsaccount")},
+				{Key: aws.String("teleport.dev/origin"), Value: aws.String("integration_awsoidc")},
+			}
+			require.False(t, d.MatchesECSTags(awsResourceTags), "resource was wrongly detected as Teleport managed")
+		})
+	})
+}
diff --git a/lib/kube/proxy/auth_test.go b/lib/kube/proxy/auth_test.go
index d0836a2dd67bf..73fadeb06f241 100644
--- a/lib/kube/proxy/auth_test.go
+++ b/lib/kube/proxy/auth_test.go
@@ -65,7 +65,6 @@ func TestCheckImpersonationPermissions(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		t.Log(tt.desc)
 		mock := &mockSARClient{
 			err:              tt.sarErr,
 			allowedVerbs:     tt.allowedVerbs,
diff --git a/lib/kube/proxy/cluster_details.go b/lib/kube/proxy/cluster_details.go
index 988ec5969c514..dda7ff3b4e918 100644
--- a/lib/kube/proxy/cluster_details.go
+++ b/lib/kube/proxy/cluster_details.go
@@ -35,6 +35,7 @@ import (
 	"github.com/gravitational/teleport/lib/cloud/gcp"
 	"github.com/gravitational/teleport/lib/labels"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 // kubeDetails contain the cluster-related details including authentication.
@@ -46,21 +47,36 @@ type kubeDetails struct {
 	kubeCluster types.KubeCluster
 }
 
+// clusterDetailsConfig contains the configuration for creating a proxied cluster.
+type clusterDetailsConfig struct {
+	// cloudClients is the cloud clients to use for dynamic clusters.
+	cloudClients cloud.Clients
+	// cluster is the cluster to create a proxied cluster for.
+	cluster types.KubeCluster
+	// log is the logger to use.
+	log *logrus.Entry
+	// checker is the permissions checker to use.
+	checker servicecfg.ImpersonationPermissionsChecker
+	// resourceMatchers is the list of resource matchers to match the cluster against
+	// to determine if we should assume the role or not for AWS.
+	resourceMatchers []services.ResourceMatcher
+}
+
 // newClusterDetails creates a proxied kubeDetails structure given a dynamic cluster.
-func newClusterDetails(ctx context.Context, cloudClients cloud.Clients, cluster types.KubeCluster, log *logrus.Entry, checker servicecfg.ImpersonationPermissionsChecker) (*kubeDetails, error) {
+func newClusterDetails(ctx context.Context, cfg clusterDetailsConfig) (*kubeDetails, error) {
 	var dynLabels *labels.Dynamic
 
-	creds, err := getKubeClusterCredentials(ctx, cloudClients, cluster, log, checker)
+	creds, err := getKubeClusterCredentials(ctx, cfg)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if len(cluster.GetDynamicLabels()) > 0 {
+	if len(cfg.cluster.GetDynamicLabels()) > 0 {
 		dynLabels, err = labels.NewDynamic(
 			ctx,
 			&labels.DynamicConfig{
-				Labels: cluster.GetDynamicLabels(),
-				Log:    log,
+				Labels: cfg.cluster.GetDynamicLabels(),
+				Log:    cfg.log,
 			})
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -72,7 +88,7 @@ func newClusterDetails(ctx context.Context, cloudClients cloud.Clients, cluster
 	return &kubeDetails{
 		kubeCreds:     creds,
 		dynamicLabels: dynLabels,
-		kubeCluster:   cluster,
+		kubeCluster:   cfg.cluster,
 	}, nil
 }
 
@@ -85,18 +101,19 @@ func (k *kubeDetails) Close() {
 }
 
 // getKubeClusterCredentials generates kube credentials for dynamic clusters.
-func getKubeClusterCredentials(ctx context.Context, cloudClients cloud.Clients, cluster types.KubeCluster, log *logrus.Entry, checker servicecfg.ImpersonationPermissionsChecker) (kubeCreds, error) {
+func getKubeClusterCredentials(ctx context.Context, cfg clusterDetailsConfig) (kubeCreds, error) {
+	dynCredsCfg := dynamicCredsConfig{kubeCluster: cfg.cluster, log: cfg.log, checker: cfg.checker, resourceMatchers: cfg.resourceMatchers}
 	switch {
-	case cluster.IsKubeconfig():
-		return getStaticCredentialsFromKubeconfig(ctx, cluster, log, checker)
-	case cluster.IsAzure():
-		return getAzureCredentials(ctx, cloudClients, dynamicCredsConfig{kubeCluster: cluster, log: log, checker: checker})
-	case cluster.IsAWS():
-		return getAWSCredentials(ctx, cloudClients, dynamicCredsConfig{kubeCluster: cluster, log: log, checker: checker})
-	case cluster.IsGCP():
-		return getGCPCredentials(ctx, cloudClients, dynamicCredsConfig{kubeCluster: cluster, log: log, checker: checker})
+	case cfg.cluster.IsKubeconfig():
+		return getStaticCredentialsFromKubeconfig(ctx, cfg.cluster, cfg.log, cfg.checker)
+	case cfg.cluster.IsAzure():
+		return getAzureCredentials(ctx, cfg.cloudClients, dynCredsCfg)
+	case cfg.cluster.IsAWS():
+		return getAWSCredentials(ctx, cfg.cloudClients, dynCredsCfg)
+	case cfg.cluster.IsGCP():
+		return getGCPCredentials(ctx, cfg.cloudClients, dynCredsCfg)
 	default:
-		return nil, trace.BadParameter("authentication method provided for cluster %q not supported", cluster.GetName())
+		return nil, trace.BadParameter("authentication method provided for cluster %q not supported", cfg.cluster.GetName())
 	}
 }
 
@@ -132,17 +149,39 @@ func azureRestConfigClient(cloudClients cloud.Clients) dynamicCredsClient {
 // getAWSCredentials creates a dynamicKubeCreds that generates and updates the access credentials to a EKS kubernetes cluster.
 func getAWSCredentials(ctx context.Context, cloudClients cloud.Clients, cfg dynamicCredsConfig) (*dynamicKubeCreds, error) {
 	// create a client that returns the credentials for kubeCluster
-	cfg.client = getAWSClientRestConfig(cloudClients, cfg.clock)
+	cfg.client = getAWSClientRestConfig(cloudClients, cfg.clock, cfg.resourceMatchers)
 	creds, err := newDynamicKubeCreds(ctx, cfg)
 	return creds, trace.Wrap(err)
 }
 
+// getAWSResourceMatcherToCluster returns the AWS assume role ARN and external ID for the cluster that matches the kubeCluster.
+// If no match is found, nil is returned, which means that we should not attempt to assume a role.
+func getAWSResourceMatcherToCluster(kubeCluster types.KubeCluster, resourceMatchers []services.ResourceMatcher) *services.ResourceMatcherAWS {
+	if !kubeCluster.IsAWS() {
+		return nil
+	}
+	for _, matcher := range resourceMatchers {
+		if len(matcher.Labels) == 0 || matcher.AWS.AssumeRoleARN == "" {
+			continue
+		}
+		if match, _, _ := services.MatchLabels(matcher.Labels, kubeCluster.GetAllLabels()); !match {
+			continue
+		}
+
+		return &(matcher.AWS)
+	}
+	return nil
+}
+
 // getAWSClientRestConfig creates a dynamicCredsClient that generates returns credentials to EKS clusters.
-func getAWSClientRestConfig(cloudClients cloud.Clients, clock clockwork.Clock) dynamicCredsClient {
+func getAWSClientRestConfig(cloudClients cloud.Clients, clock clockwork.Clock, resourceMatchers []services.ResourceMatcher) dynamicCredsClient {
 	return func(ctx context.Context, cluster types.KubeCluster) (*rest.Config, time.Time, error) {
-		// TODO(gavin): support assume_role_arn for AWS EKS.
 		region := cluster.GetAWSConfig().Region
-		regionalClient, err := cloudClients.GetAWSEKSClient(ctx, region)
+		var opts []cloud.AWSAssumeRoleOptionFn
+		if awsAssume := getAWSResourceMatcherToCluster(cluster, resourceMatchers); awsAssume != nil {
+			opts = append(opts, cloud.WithAssumeRole(awsAssume.AssumeRoleARN, awsAssume.ExternalID))
+		}
+		regionalClient, err := cloudClients.GetAWSEKSClient(ctx, region, opts...)
 		if err != nil {
 			return nil, time.Time{}, trace.Wrap(err)
 		}
@@ -164,7 +203,7 @@ func getAWSClientRestConfig(cloudClients cloud.Clients, clock clockwork.Clock) d
 			return nil, time.Time{}, trace.BadParameter("invalid api endpoint for cluster %q", cluster.GetAWSConfig().Name)
 		}
 
-		stsClient, err := cloudClients.GetAWSSTSClient(ctx, region)
+		stsClient, err := cloudClients.GetAWSSTSClient(ctx, region, opts...)
 		if err != nil {
 			return nil, time.Time{}, trace.Wrap(err)
 		}
diff --git a/lib/kube/proxy/forwarder.go b/lib/kube/proxy/forwarder.go
index df442ba73196a..fbd31366c7b3b 100644
--- a/lib/kube/proxy/forwarder.go
+++ b/lib/kube/proxy/forwarder.go
@@ -29,8 +29,8 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"path"
 	"path/filepath"
-	"regexp"
 	"strconv"
 	"strings"
 	"sync"
@@ -38,8 +38,6 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/gorilla/websocket"
-	"github.com/gravitational/oxy/forward"
-	fwdutils "github.com/gravitational/oxy/utils"
 	"github.com/gravitational/trace"
 	"github.com/gravitational/ttlmap"
 	"github.com/jonboulle/clockwork"
@@ -50,7 +48,12 @@ import (
 	oteltrace "go.opentelemetry.io/otel/trace"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/exp/slices"
+	appsv1 "k8s.io/api/apps/v1"
+	batchv1 "k8s.io/api/batch/v1"
+	certificatesv1 "k8s.io/api/certificates/v1"
 	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	authv1 "k8s.io/api/rbac/v1"
 	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -78,11 +81,11 @@ import (
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/filesessions"
 	"github.com/gravitational/teleport/lib/httplib"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 	"github.com/gravitational/teleport/lib/kube/proxy/responsewriters"
 	"github.com/gravitational/teleport/lib/kube/proxy/streamproto"
 	kubeutils "github.com/gravitational/teleport/lib/kube/utils"
 	"github.com/gravitational/teleport/lib/multiplexer"
-	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
@@ -111,7 +114,7 @@ const (
 // ForwarderConfig specifies configuration for proxy forwarder
 type ForwarderConfig struct {
 	// ReverseTunnelSrv is the teleport reverse tunnel server
-	ReverseTunnelSrv reversetunnel.Server
+	ReverseTunnelSrv reversetunnelclient.Server
 	// ClusterName is a local cluster name
 	ClusterName string
 	// Keygen points to a key generator implementation
@@ -161,7 +164,7 @@ type ForwarderConfig struct {
 	// PROXYSigner is used to sign PROXY headers for securely propagating client IP address
 	PROXYSigner multiplexer.PROXYHeaderSigner
 	// log is the logger function
-	log logrus.FieldLogger
+	log utils.FieldLoggerWithWriter
 	// TracerProvider is used to create tracers capable
 	// of starting spans.
 	TracerProvider oteltrace.TracerProvider
@@ -320,16 +323,32 @@ func NewForwarder(cfg ForwarderConfig) (*Forwarder, error) {
 	router.POST("/api/:ver/namespaces/:podNamespace/pods/:podName/portforward", fwd.withAuth(fwd.portForward))
 	router.GET("/api/:ver/namespaces/:podNamespace/pods/:podName/portforward", fwd.withAuth(fwd.portForward))
 
-	router.GET("/api/:ver/pods", fwd.withAuth(fwd.listPods))
-	router.GET("/api/:ver/namespaces/:podNamespace/pods", fwd.withAuth(fwd.listPods))
 	router.POST("/apis/authorization.k8s.io/:ver/selfsubjectaccessreviews", fwd.withAuth(fwd.selfSubjectAccessReviews))
-	router.DELETE("/api/:ver/namespaces/:podNamespace/pods", fwd.withAuth(fwd.deletePodsCollection))
-	router.POST("/api/:ver/namespaces/:podNamespace/pods", fwd.withAuth(
-		func(ctx *authContext, w http.ResponseWriter, r *http.Request, _ httprouter.Params) (any, error) {
-			// Forward pod creation to default handler.
-			return fwd.catchAll(ctx, w, r)
-		},
-	))
+
+	for k, v := range allowedResources {
+		prefix := "/api"
+		if k.apiGroup != "core" {
+			prefix = path.Join("/apis", k.apiGroup)
+		}
+		prefix = path.Join(prefix, ":ver")
+
+		switch namespace := ""; {
+		case !slices.Contains(types.KubernetesClusterWideResourceKinds, v):
+			router.GET(path.Join(prefix, k.resourceKind), fwd.withAuth(fwd.listResources))
+			namespace = "namespaces/:podNamespace"
+			fallthrough
+		default:
+			endpoint := path.Join(prefix, namespace, k.resourceKind)
+			router.GET(endpoint, fwd.withAuth(fwd.listResources))
+			router.DELETE(endpoint, fwd.withAuth(fwd.deleteResourcesCollection))
+			router.POST(endpoint, fwd.withAuth(
+				func(ctx *authContext, w http.ResponseWriter, r *http.Request, _ httprouter.Params) (any, error) {
+					// Forward pod creation to default handler.
+					return fwd.catchAll(ctx, w, r)
+				},
+			))
+		}
+	}
 
 	router.GET("/api/:ver/teleport/join/:session", fwd.withAuthPassthrough(fwd.join))
 
@@ -358,7 +377,7 @@ func NewForwarder(cfg ForwarderConfig) (*Forwarder, error) {
 // however some requests like exec sessions it intercepts and records.
 type Forwarder struct {
 	mu     sync.Mutex
-	log    logrus.FieldLogger
+	log    utils.FieldLoggerWithWriter
 	router http.Handler
 	cfg    ForwarderConfig
 	// clientCredentials is an expiring cache of ephemeral client credentials.
@@ -446,6 +465,8 @@ type authContext struct {
 	// kubeServers are the registered agents for the kubernetes cluster the request
 	// is targeted to.
 	kubeServers []types.KubeServer
+	// apiResource holds the information about the requested API resource.
+	apiResource apiResource
 }
 
 func (c authContext) String() string {
@@ -458,11 +479,21 @@ func (c *authContext) key() string {
 	return fmt.Sprintf("%v:%v:%v:%v:%v:%v:%v", c.teleportCluster.name, c.User.GetName(), c.kubeUsers, c.kubeGroups, c.kubeClusterName, c.certExpires.Unix(), c.Identity.GetIdentity().ActiveRequests)
 }
 
-func (c *authContext) eventClusterMeta() apievents.KubernetesClusterMetadata {
+func (c *authContext) eventClusterMeta(req *http.Request) apievents.KubernetesClusterMetadata {
+	var kubeUsers, kubeGroups []string
+
+	if impersonateUser, impersonateGroups, err := computeImpersonatedPrincipals(c.kubeUsers, c.kubeGroups, req.Header); err == nil {
+		kubeUsers = []string{impersonateUser}
+		kubeGroups = impersonateGroups
+	} else {
+		kubeUsers = utils.StringsSliceFromSet(c.kubeUsers)
+		kubeGroups = utils.StringsSliceFromSet(c.kubeGroups)
+	}
+
 	return apievents.KubernetesClusterMetadata{
 		KubernetesCluster: c.kubeClusterName,
-		KubernetesUsers:   utils.StringsSliceFromSet(c.kubeUsers),
-		KubernetesGroups:  utils.StringsSliceFromSet(c.kubeGroups),
+		KubernetesUsers:   kubeUsers,
+		KubernetesGroups:  kubeGroups,
 		KubernetesLabels:  c.kubeClusterLabels,
 	}
 }
@@ -542,8 +573,8 @@ func (f *Forwarder) authenticate(req *http.Request) (*authContext, error) {
 
 	// kubeResource is the Kubernetes Resource the request is targeted at.
 	// Currently only supports Pods and it includes the pod name and namespace.
-	kubeResource := getPodResourceFromRequest(req.RequestURI)
-	authContext, err := f.setupContext(ctx, *userContext, req, isRemoteUser, kubeResource)
+	kubeResource, apiResource := getResourceFromRequest(req.URL.Path)
+	authContext, err := f.setupContext(ctx, *userContext, req, isRemoteUser, apiResource, kubeResource)
 	if err != nil {
 		f.log.WithError(err).Warn("Unable to setup context.")
 		if trace.IsAccessDenied(err) {
@@ -734,7 +765,14 @@ func (f *Forwarder) formatStatusResponseError(rw http.ResponseWriter, respErr er
 	}
 }
 
-func (f *Forwarder) setupContext(ctx context.Context, authCtx authz.Context, req *http.Request, isRemoteUser bool, kubeResource *types.KubernetesResource) (*authContext, error) {
+func (f *Forwarder) setupContext(
+	ctx context.Context,
+	authCtx authz.Context,
+	req *http.Request,
+	isRemoteUser bool,
+	apiResource apiResource,
+	kubeResource *types.KubernetesResource,
+) (*authContext, error) {
 	ctx, span := f.cfg.tracer.Start(
 		ctx,
 		"kube.Forwarder/setupContext",
@@ -826,6 +864,7 @@ func (f *Forwarder) setupContext(ctx context.Context, authCtx authz.Context, req
 		},
 		httpMethod:  req.Method,
 		kubeServers: kubeServers,
+		apiResource: apiResource,
 	}, nil
 }
 
@@ -846,7 +885,7 @@ func (f *Forwarder) emitAuditEvent(ctx *authContext, req *http.Request, sess *cl
 	if sess.noAuditEvents {
 		return
 	}
-	r := parseResourcePath(req.URL.Path)
+	r := ctx.apiResource
 	if r.skipEvent {
 		return
 	}
@@ -869,7 +908,7 @@ func (f *Forwarder) emitAuditEvent(ctx *authContext, req *http.Request, sess *cl
 		RequestPath:               req.URL.Path,
 		Verb:                      req.Method,
 		ResponseCode:              int32(status),
-		KubernetesClusterMetadata: ctx.eventClusterMeta(),
+		KubernetesClusterMetadata: ctx.eventClusterMeta(req),
 	}
 
 	r.populateEvent(event)
@@ -910,7 +949,7 @@ type kubeAccessDetails struct {
 // getKubeAccessDetails returns the allowed kube groups/users names and the cluster labels for a local kube cluster.
 func (f *Forwarder) getKubeAccessDetails(
 	kubeServers []types.KubeServer,
-	roles services.AccessChecker,
+	accessChecker services.AccessChecker,
 	kubeClusterName string,
 	sessionTTL time.Duration,
 	kubeResource *types.KubernetesResource,
@@ -929,7 +968,7 @@ func (f *Forwarder) getKubeAccessDetails(
 		// Creates a matcher that matches the cluster labels against `kubernetes_labels`
 		// defined for each user's role.
 		matchers = append(matchers,
-			services.NewKubernetesClusterLabelMatcher(labels),
+			services.NewKubernetesClusterLabelMatcher(labels, accessChecker.Traits()),
 		)
 
 		// If the kubeResource is available, append an extra matcher that validates
@@ -948,13 +987,13 @@ func (f *Forwarder) getKubeAccessDetails(
 				services.NewKubernetesResourceMatcher(*kubeResource),
 			)
 		}
-		// roles.CheckKubeGroupsAndUsers returns the accumulated kubernetes_groups
+		// accessChecker.CheckKubeGroupsAndUsers returns the accumulated kubernetes_groups
 		// and kubernetes_users that satisfy te provided matchers.
 		// When a KubernetesResourceMatcher, it will gather the Kubernetes principals
 		// whose role satisfy the the desired Kubernetes Resource.
 		// The users/groups will be forwarded to Kubernetes Cluster as Impersonation
 		// headers.
-		groups, users, err := roles.CheckKubeGroupsAndUsers(sessionTTL, false /* overrideTTL */, matchers...)
+		groups, users, err := accessChecker.CheckKubeGroupsAndUsers(sessionTTL, false /* overrideTTL */, matchers...)
 		if err != nil {
 			return kubeAccessDetails{}, trace.Wrap(err)
 		}
@@ -973,24 +1012,6 @@ func (f *Forwarder) getKubeAccessDetails(
 	}, nil
 }
 
-// podNameRegex is the Pods endpoint API url.
-var podNameRegex = regexp.MustCompile(`/api/v1/namespaces/([^/]+)/pods/([^/]+)`)
-
-// getPodResourceFromRequest returns a KubernetesResource if the user tried to access
-// a specific Pod endpoint. Otherwise, returns nil.
-// TODO(tigrato): extend it to support other resources.
-func getPodResourceFromRequest(requestURI string) *types.KubernetesResource {
-	matches := podNameRegex.FindStringSubmatch(requestURI)
-	if matches == nil {
-		return nil
-	}
-	return &types.KubernetesResource{
-		Kind:      types.KindKubePod,
-		Namespace: matches[1],
-		Name:      matches[2],
-	}
-}
-
 func (f *Forwarder) authorize(ctx context.Context, actx *authContext) error {
 	ctx, span := f.cfg.tracer.Start(
 		ctx,
@@ -1099,7 +1120,7 @@ func (f *Forwarder) authorize(ctx context.Context, actx *authContext) error {
 			// did not request access to any Kubernetes resource type, the allowed
 			// list will be empty.
 			allowed, denied := actx.Checker.GetKubeResources(ks)
-			if err := matchKubernetesResource(*actx.kubeResource, allowed, denied); err != nil {
+			if result, err := matchKubernetesResource(*actx.kubeResource, allowed, denied); err != nil || !result {
 				return trace.AccessDenied(notFoundMessage)
 			}
 		}
@@ -1116,24 +1137,22 @@ func (f *Forwarder) authorize(ctx context.Context, actx *authContext) error {
 
 // matchKubernetesResource checks if the Kubernetes Resource does not match any
 // entry from the deny list and matches at least one entry from the allowed list.
-func matchKubernetesResource(resource types.KubernetesResource, allowed, denied []types.KubernetesResource) error {
+func matchKubernetesResource(resource types.KubernetesResource, allowed, denied []types.KubernetesResource) (bool, error) {
 	// utils.KubeResourceMatchesRegex checks if the resource.Kind is strictly equal
 	// to each entry and validates if the Name and Namespace fields matches the
 	// regex allowed by each entry.
 	result, err := utils.KubeResourceMatchesRegex(resource, denied)
 	if err != nil {
-		return trace.Wrap(err)
+		return false, trace.Wrap(err)
 	} else if result {
-		return trace.AccessDenied("access to %s %q denied", resource.Kind, resource.ClusterResource())
+		return false, nil
 	}
 
 	result, err = utils.KubeResourceMatchesRegex(resource, allowed)
 	if err != nil {
-		return trace.Wrap(err)
-	} else if !result {
-		return trace.AccessDenied("access to %s %q denied", resource.Kind, resource.ClusterResource())
+		return false, trace.Wrap(err)
 	}
-	return nil
+	return result, nil
 }
 
 // newStreamer returns sync or async streamer based on the configuration
@@ -1488,7 +1507,7 @@ func (f *Forwarder) execNonInteractive(ctx *authContext, w http.ResponseWriter,
 		SessionMetadata:           sessionMetadata,
 		UserMetadata:              ctx.eventUserMeta(),
 		ConnectionMetadata:        connectionMetdata,
-		KubernetesClusterMetadata: ctx.eventClusterMeta(),
+		KubernetesClusterMetadata: ctx.eventClusterMeta(req),
 		KubernetesPodMetadata:     eventPodMeta,
 
 		InitialCommand:   request.cmd,
@@ -1511,7 +1530,7 @@ func (f *Forwarder) execNonInteractive(ctx *authContext, w http.ResponseWriter,
 		CommandMetadata: apievents.CommandMetadata{
 			Command: strings.Join(request.cmd, " "),
 		},
-		KubernetesClusterMetadata: ctx.eventClusterMeta(),
+		KubernetesClusterMetadata: ctx.eventClusterMeta(req),
 		KubernetesPodMetadata:     eventPodMeta,
 	}
 
@@ -1533,7 +1552,7 @@ func (f *Forwarder) execNonInteractive(ctx *authContext, w http.ResponseWriter,
 			Interactive:               false,
 			StartTime:                 sessionStart,
 			EndTime:                   f.cfg.Clock.Now().UTC(),
-			KubernetesClusterMetadata: ctx.eventClusterMeta(),
+			KubernetesClusterMetadata: ctx.eventClusterMeta(req),
 			KubernetesPodMetadata:     eventPodMeta,
 			InitialCommand:            request.cmd,
 			SessionRecording:          ctx.recordingConfig.GetMode(),
@@ -1882,7 +1901,7 @@ func setupImpersonationHeaders(log logrus.FieldLogger, ctx authContext, headers
 		return nil
 	}
 
-	impersonateUser, impersonateGroups, err := computeImpersonatedPrincipals(log, ctx.kubeUsers, ctx.kubeGroups, headers)
+	impersonateUser, impersonateGroups, err := computeImpersonatedPrincipals(ctx.kubeUsers, ctx.kubeGroups, headers)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1918,7 +1937,7 @@ func copyImpersonationHeaders(dst, src http.Header) {
 // received in the `Impersonate-User` and `Impersonate-Groups` headers and the
 // allowed values. If the user didn't specify any user and groups to impersonate,
 // Teleport will use every group the user is allowed to impersonate.
-func computeImpersonatedPrincipals(log logrus.FieldLogger, kubeUsers, kubeGroups map[string]struct{}, headers http.Header) (string, []string, error) {
+func computeImpersonatedPrincipals(kubeUsers, kubeGroups map[string]struct{}, headers http.Header) (string, []string, error) {
 	var impersonateUser string
 	var impersonateGroups []string
 	for header, values := range headers {
@@ -2120,7 +2139,7 @@ type clusterSession struct {
 	// It is non-nil if the kubernetes cluster is served by this teleport service,
 	// nil otherwise.
 	kubeAPICreds kubeCreds
-	forwarder    *forward.Forwarder
+	forwarder    *reverseproxy.Forwarder
 	// noAuditEvents is true if this teleport service should leave audit event
 	// logging to another service.
 	noAuditEvents bool
@@ -2288,24 +2307,20 @@ func (f *Forwarder) newClusterSessionDirect(ctx context.Context, authCtx authCon
 // - for HTTP2 in all other cases.
 // The reason being is that streaming requests are going to be upgraded to SPDY, which is only
 // supported coming from an HTTP1 request.
-func (f *Forwarder) makeSessionForwarder(sess *clusterSession) (*forward.Forwarder, error) {
+func (f *Forwarder) makeSessionForwarder(sess *clusterSession) (*reverseproxy.Forwarder, error) {
 	transport, err := f.transportForRequest(sess)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	forwarder, err := forward.New(
-		forward.FlushInterval(100*time.Millisecond),
-		forward.RoundTripper(transport),
-		forward.WebsocketDial(sess.Dial),
-		forward.Logger(f.log),
-		forward.ErrorHandler(fwdutils.ErrorHandlerFunc(f.formatForwardResponseError)),
+	forwarder, err := reverseproxy.New(
+		reverseproxy.WithFlushInterval(100*time.Millisecond),
+		reverseproxy.WithRoundTripper(transport),
+		reverseproxy.WithLogger(f.log),
+		reverseproxy.WithErrorHandler(f.formatForwardResponseError),
 	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
 
-	return forwarder, nil
+	return forwarder, trace.Wrap(err)
 }
 
 // getOrCreateRequestContext creates a new certificate request for a given context,
@@ -2509,9 +2524,9 @@ func (f *Forwarder) isLocalKubeCluster(sess *clusterSession) bool {
 	}
 }
 
-// listPods forwards the pod list request to the target server, captures
+// listResources forwards the pod list request to the target server, captures
 // all output and filters accordingly to user roles resource access rules.
-func (f *Forwarder) listPods(authCtx *authContext, w http.ResponseWriter, req *http.Request, p httprouter.Params) (resp any, err error) {
+func (f *Forwarder) listResources(authCtx *authContext, w http.ResponseWriter, req *http.Request, p httprouter.Params) (resp any, err error) {
 	ctx, span := f.cfg.tracer.Start(
 		req.Context(),
 		"kube.Forwarder/listPods",
@@ -2560,12 +2575,12 @@ func (f *Forwarder) listPods(authCtx *authContext, w http.ResponseWriter, req *h
 		isWatch := req.URL.Query().Get("watch") == "true"
 		if !isWatch {
 			// List pods and return immediately.
-			status, err = f.listPodsList(req, w, sess, allowedResources, deniedResources)
+			status, err = f.listResourcesList(req, w, sess, allowedResources, deniedResources)
 		} else {
 			// Creates a watch stream to the upstream target and applies filtering
 			// for each new frame that is received to exclude pods the user doesn't
 			// have access to.
-			status, err = f.listPodsWatcher(req, w, sess, allowedResources, deniedResources)
+			status, err = f.listResourcesWatcher(req, w, sess, allowedResources, deniedResources)
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -2576,21 +2591,25 @@ func (f *Forwarder) listPods(authCtx *authContext, w http.ResponseWriter, req *h
 	return nil, nil
 }
 
-// listPodsList forwards the request into the target cluster and accumulates the
+// listResourcesList forwards the request into the target cluster and accumulates the
 // response into the memory. Once the request finishes, the memory buffer
 // data is parsed and pods the user does not have access to are excluded from
 // the response. Finally, the filtered response is serialized and sent back to
 // the user with the appropriate headers.
-func (f *Forwarder) listPodsList(req *http.Request, w http.ResponseWriter, sess *clusterSession, allowedResources, deniedResources []types.KubernetesResource) (int, error) {
+func (f *Forwarder) listResourcesList(req *http.Request, w http.ResponseWriter, sess *clusterSession, allowedResources, deniedResources []types.KubernetesResource) (int, error) {
 	// Creates a memory response writer that collects the response status, headers
 	// and payload into memory.
 	memBuffer := responsewriters.NewMemoryResponseWriter()
 	// Forward the request to the target cluster.
 	sess.forwarder.ServeHTTP(memBuffer, req)
+	resourceKind, ok := getTeleportResourceKindFromAPIResource(sess.apiResource)
+	if !ok {
+		return http.StatusBadRequest, trace.BadParameter("unknown resource kind %q", sess.apiResource.resourceKind)
+	}
 	// filterBuffer filters the response to exclude pods the user doesn't have access to.
 	// The filtered payload will be written into memBuffer again.
 	if err := filterBuffer(
-		newPodFilterer(allowedResources, deniedResources, f.log),
+		newResourceFilterer(resourceKind, allowedResources, deniedResources, f.log),
 		memBuffer,
 	); err != nil {
 		return memBuffer.Status(), trace.Wrap(err)
@@ -2602,7 +2621,7 @@ func (f *Forwarder) listPodsList(req *http.Request, w http.ResponseWriter, sess
 	return memBuffer.Status(), trace.Wrap(err)
 }
 
-// listPodsWatcher handles a long lived connection to the upstream server where
+// listResourcesWatcher handles a long lived connection to the upstream server where
 // the Kubernetes API returns frames with events.
 // This handler creates a WatcherResponseWriter that spins a new goroutine once
 // the API server writes the status code and headers.
@@ -2612,9 +2631,22 @@ func (f *Forwarder) listPodsList(req *http.Request, w http.ResponseWriter, sess
 // forwarded to the user's response writer.
 // If it does not match, the watcher ignores the event and continues waiting
 // for the next event.
-func (f *Forwarder) listPodsWatcher(req *http.Request, w http.ResponseWriter, sess *clusterSession, allowedResources, deniedResources []types.KubernetesResource) (int, error) {
+func (f *Forwarder) listResourcesWatcher(req *http.Request, w http.ResponseWriter, sess *clusterSession, allowedResources, deniedResources []types.KubernetesResource) (int, error) {
 	negotiator := newClientNegotiator()
-	rw, err := responsewriters.NewWatcherResponseWriter(w, negotiator, newPodFilterer(allowedResources, deniedResources, f.log))
+	resourceKind, ok := getTeleportResourceKindFromAPIResource(sess.apiResource)
+	if !ok {
+		return http.StatusBadRequest, trace.BadParameter("unknown resource kind %q", sess.apiResource.resourceKind)
+	}
+	rw, err := responsewriters.NewWatcherResponseWriter(
+		w,
+		negotiator,
+		newResourceFilterer(
+			resourceKind,
+			allowedResources,
+			deniedResources,
+			f.log,
+		),
+	)
 	if err != nil {
 		return http.StatusInternalServerError, trace.Wrap(err)
 	}
@@ -2626,9 +2658,9 @@ func (f *Forwarder) listPodsWatcher(req *http.Request, w http.ResponseWriter, se
 	return rw.Status(), trace.Wrap(err)
 }
 
-// deletePodsCollection calls listPods method to list the Pods the user
+// deleteResourcesCollection calls listPods method to list the Pods the user
 // has access to and calls their delete method using the allowed kube principals.
-func (f *Forwarder) deletePodsCollection(authCtx *authContext, w http.ResponseWriter, req *http.Request, p httprouter.Params) (resp any, err error) {
+func (f *Forwarder) deleteResourcesCollection(authCtx *authContext, w http.ResponseWriter, req *http.Request, p httprouter.Params) (resp any, err error) {
 	ctx, span := f.cfg.tracer.Start(
 		req.Context(),
 		"kube.Forwarder/deletePodsCollection",
@@ -2677,7 +2709,7 @@ func (f *Forwarder) deletePodsCollection(authCtx *authContext, w http.ResponseWr
 		// reset body and method since list does not need the body response.
 		listReq.Body = nil
 		listReq.Method = http.MethodGet
-		_, err = f.listPods(authCtx, memoryRW, listReq, p)
+		_, err = f.listResources(authCtx, memoryRW, listReq, p)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -2733,66 +2765,276 @@ func (f *Forwarder) handleDeleteCollectionReq(req *http.Request, authCtx *authCo
 	if err != nil {
 		return internalErrStatus, trace.Wrap(err)
 	}
+	params := deleteResourcesCommonParams{
+		ctx:         ctx,
+		log:         f.log,
+		authCtx:     authCtx,
+		header:      req.Header,
+		kubeDetails: details,
+	}
+
+	// At this point, items already include the list of pods the filtered pods the
+	// user has access to.
+	// For each Pod, we compute the kubernetes_groups and kubernetes_labels
+	// that are applicable and we will forward them as the delete request.
+	// If request is a dry-run.
+	// TODO (tigrato):
+	//  - parallelize loop
+	//  -  check if the request should stop at the first fail.
+
 	switch o := obj.(type) {
 	case *metav1.Status:
 		// Do nothing.
 	case *corev1.PodList:
-		// At this point, items already include the list of pods the filtered pods the
-		// user has access to.
-		// For each Pod, we compute the kubernetes_groups and kubernetes_labels
-		// that are applicable and we will forward them as the delete request.
-		// If request is a dry-run.
-		// TODO (tigrato):
-		//  - parallelize loop
-		//  -  check if the request should stop at the first fail.
-		items := make([]corev1.Pod, 0, len(o.Items))
-		for _, item := range o.Items {
-			// Compute users and groups from available roles that match the
-			// cluster labels and kubernetes resources.
-			allowedKubeGroups, allowedKubeUsers, err := authCtx.Checker.CheckKubeGroupsAndUsers(
-				authCtx.sessionTTL,
-				false,
-				services.NewKubernetesClusterLabelMatcher(authCtx.kubeClusterLabels),
-				services.NewKubernetesResourceMatcher(
-					types.KubernetesResource{
-						Kind:      types.KindKubePod,
-						Name:      item.Name,
-						Namespace: item.Namespace,
-					},
-				),
-			)
-			// no match was found, we ignore the request.
-			if err != nil {
-				continue
-			}
-			allowedKubeUsers, allowedKubeGroups = fillDefaultKubePrincipalDetails(allowedKubeUsers, allowedKubeGroups, authCtx.User.GetName())
-
-			impersonatedUsers, impersonatedGroups, err := computeImpersonatedPrincipals(
-				f.log, utils.StringsSet(allowedKubeUsers), utils.StringsSet(allowedKubeGroups),
-				req.Header,
-			)
-			if err != nil {
-				continue
-			}
-
-			// create a new kubernetes.Client using the impersonated users and groups
-			// that matched the current pod.
-			client, err := newImpersonatedKubeClient(details.kubeCreds, impersonatedUsers, impersonatedGroups)
-			if err != nil {
-				return internalErrStatus, trace.Wrap(err)
-			}
-			// delete each pod individually.
-			err = client.CoreV1().Pods(item.Namespace).Delete(ctx, item.Name, deleteOptions)
-			if err != nil {
-				// TODO(tigrato): check what should we do when delete returns an error.
-				// Should we check if it's permission error?
-				// Check if the Pod has already been deleted by a concurrent request
-				continue
-			}
-			items = append(items, item)
+		items, err := deleteResources(
+			params,
+			types.KindKubePod,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.CoreV1().Pods(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
 		}
-		// reset items.
-		o.Items = items
+		o.Items = pointerArrayToArray(items)
+	case *corev1.SecretList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeSecret,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.CoreV1().Secrets(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *corev1.ConfigMapList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeConfigmap,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.CoreV1().ConfigMaps(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *corev1.NamespaceList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeNamespace,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, _ string) error {
+				return trace.Wrap(client.CoreV1().Namespaces().Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *corev1.ServiceAccountList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeServiceAccount,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.CoreV1().ServiceAccounts(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *corev1.PersistentVolumeList:
+		items, err := deleteResources(
+			params,
+			types.KindKubePersistentVolume,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, _ string) error {
+				return trace.Wrap(client.CoreV1().PersistentVolumes().Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+
+	case *corev1.PersistentVolumeClaimList:
+		items, err := deleteResources(
+			params,
+			types.KindKubePersistentVolumeClaim,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.CoreV1().PersistentVolumeClaims(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *appsv1.DeploymentList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeDeployment,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.AppsV1().Deployments(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *appsv1.ReplicaSetList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeReplicaSet,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.AppsV1().ReplicaSets(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+
+	case *appsv1.StatefulSetList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeStatefulset,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.AppsV1().StatefulSets(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *appsv1.DaemonSetList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeDaemonSet,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.AppsV1().DaemonSets(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+
+	case *authv1.ClusterRoleList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeClusterRole,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, _ string) error {
+				return trace.Wrap(client.RbacV1().ClusterRoles().Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *authv1.RoleList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeRole,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.RbacV1().Roles(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *authv1.ClusterRoleBindingList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeClusterRoleBinding,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, _ string) error {
+				return trace.Wrap(client.RbacV1().ClusterRoleBindings().Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *authv1.RoleBindingList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeRoleBinding,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.RbacV1().RoleBindings(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *batchv1.CronJobList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeCronjob,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.BatchV1().CronJobs(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *batchv1.JobList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeJob,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.BatchV1().Jobs(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *certificatesv1.CertificateSigningRequestList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeCertificateSigningRequest,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, _ string) error {
+				return trace.Wrap(client.CertificatesV1().CertificateSigningRequests().Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
+	case *networkingv1.IngressList:
+		items, err := deleteResources(
+			params,
+			types.KindKubeIngress,
+			arrayToPointerArray(o.Items),
+			func(ctx context.Context, client kubernetes.Interface, name, namespace string) error {
+				return trace.Wrap(client.NetworkingV1().Ingresses(namespace).Delete(ctx, name, deleteOptions))
+			},
+		)
+		if err != nil {
+			return internalErrStatus, trace.Wrap(err)
+		}
+		o.Items = pointerArrayToArray(items)
 	default:
 		return internalErrStatus, trace.BadParameter("expected *corev1.PodList, got: %T", obj)
 	}
@@ -2841,14 +3083,30 @@ func parseDeleteCollectionBody(r io.Reader, decoder runtime.Decoder) (metav1.Del
 // Logic from:
 // https://github.com/kubernetes/kubernetes/blob/ea0764452222146c47ec826977f49d7001b0ea8c/staging/src/k8s.io/apiserver/pkg/endpoints/handlers/responsewriters/errors.go#L51
 func kubeResourceDeniedAccessMsg(user, method string, kubeResource *types.KubernetesResource) string {
-	resource := pluralize(kubeResource.Kind)
-	// pod api group is ""
-	// Check this code when we introduce new resources.
-	apiGroup := ""
+	resource, apiGroup := getKubeResourceAndAPIGroupFromType(kubeResource.Kind)
+	// <resource> "<name>" is forbidden: User "<user>" cannot create resource "<resource>" in API group "<api_group>"
+	if kubeResource.Namespace == "" {
+		return fmt.Sprintf(
+			"%s %q is forbidden: User %q cannot %s resource %q in API group %q\n"+
+				"Ask your Teleport admin to ensure that your Teleport role includes access to the %s in %q field.\n"+
+				"Check by running: kubectl auth can-i %s %s/%s",
+			resource,
+			kubeResource.Name,
+			user,
+			getRequestVerb(method),
+			resource,
+			apiGroup,
+			kubeResource.Kind,
+			kubernetesResourcesKey,
+			getRequestVerb(method),
+			resource,
+			kubeResource.Name,
+		)
+	}
 	// <resource> "<pod_name>" is forbidden: User "<user>" cannot create resource "<resource>" in API group "" in the namespace "<namespace>"
 	return fmt.Sprintf(
 		"%s %q is forbidden: User %q cannot %s resource %q in API group %q in the namespace %q\n"+
-			"Ask your Teleport admin to ensure that your Teleport role includes access to the pod in %q field.\n"+
+			"Ask your Teleport admin to ensure that your Teleport role includes access to the %s in %q field.\n"+
 			"Check by running: kubectl auth can-i %s %s/%s --namespace %s ",
 		resource,
 		kubeResource.Name,
@@ -2857,6 +3115,7 @@ func kubeResourceDeniedAccessMsg(user, method string, kubeResource *types.Kubern
 		resource,
 		apiGroup,
 		kubeResource.Namespace,
+		kubeResource.Kind,
 		kubernetesResourcesKey,
 		getRequestVerb(method),
 		resource,
@@ -2865,11 +3124,6 @@ func kubeResourceDeniedAccessMsg(user, method string, kubeResource *types.Kubern
 	)
 }
 
-// pluralize adds an s at the end of the input string.
-func pluralize(s string) string {
-	return s + "s"
-}
-
 // getRequestVerb converts the request method into a Kubernetes Verb.
 func getRequestVerb(method string) string {
 	apiVerb := ""
@@ -2939,3 +3193,65 @@ func decompressInplace(memoryRW *responsewriters.MemoryResponseWriter) error {
 		return nil
 	}
 }
+
+type deleteResourcesCommonParams struct {
+	ctx         context.Context
+	log         logrus.FieldLogger
+	authCtx     *authContext
+	header      http.Header
+	kubeDetails *kubeDetails
+}
+
+func deleteResources[T kubeObjectInterface](
+	params deleteResourcesCommonParams,
+	kind string,
+	items []T,
+	deleteOP func(ctx context.Context, client kubernetes.Interface, name, namespace string) error,
+) ([]T, error) {
+	deletedItems := make([]T, 0, len(items))
+	for _, item := range items {
+		// Compute users and groups from available roles that match the
+		// cluster labels and kubernetes resources.
+		allowedKubeGroups, allowedKubeUsers, err := params.authCtx.Checker.CheckKubeGroupsAndUsers(
+			params.authCtx.sessionTTL,
+			false,
+			services.NewKubernetesClusterLabelMatcher(
+				params.authCtx.kubeClusterLabels,
+				params.authCtx.Checker.Traits(),
+			),
+			services.NewKubernetesResourceMatcher(
+				getKubeResource(kind, item),
+			),
+		)
+		// no match was found, we ignore the request.
+		if err != nil {
+			continue
+		}
+		allowedKubeUsers, allowedKubeGroups = fillDefaultKubePrincipalDetails(allowedKubeUsers, allowedKubeGroups, params.authCtx.User.GetName())
+
+		impersonatedUsers, impersonatedGroups, err := computeImpersonatedPrincipals(
+			utils.StringsSet(allowedKubeUsers), utils.StringsSet(allowedKubeGroups),
+			params.header,
+		)
+		if err != nil {
+			continue
+		}
+
+		// create a new kubernetes.Client using the impersonated users and groups
+		// that matched the current pod.
+		client, err := newImpersonatedKubeClient(params.kubeDetails.kubeCreds, impersonatedUsers, impersonatedGroups)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		// delete each pod individually.
+		err = deleteOP(params.ctx, client, item.GetName(), item.GetNamespace())
+		if err != nil {
+			// TODO(tigrato): check what should we do when delete returns an error.
+			// Should we check if it's permission error?
+			// Check if the Pod has already been deleted by a concurrent request
+			continue
+		}
+		deletedItems = append(deletedItems, item)
+	}
+	return deletedItems, nil
+}
diff --git a/lib/kube/proxy/forwarder_test.go b/lib/kube/proxy/forwarder_test.go
index 18643f9c0c12d..92a0a1b3a0890 100644
--- a/lib/kube/proxy/forwarder_test.go
+++ b/lib/kube/proxy/forwarder_test.go
@@ -49,6 +49,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
+	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/authz"
@@ -56,7 +57,6 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/fixtures"
 	testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
-	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
@@ -161,7 +161,7 @@ func TestAuthenticate(t *testing.T) {
 	require.NoError(t, err)
 
 	tun := mockRevTunnel{
-		sites: map[string]reversetunnel.RemoteSite{
+		sites: map[string]reversetunnelclient.RemoteSite{
 			"remote": mockRemoteSite{name: "remote"},
 			"local":  mockRemoteSite{name: "local"},
 		},
@@ -201,7 +201,7 @@ func TestAuthenticate(t *testing.T) {
 		routeToCluster    string
 		kubernetesCluster string
 		haveKubeCreds     bool
-		tunnel            reversetunnel.Server
+		tunnel            reversetunnelclient.Server
 		kubeServers       []types.KubeServer
 		activeRequests    []string
 
@@ -755,6 +755,7 @@ func TestAuthenticate(t *testing.T) {
 			req := &http.Request{
 				Host:       "example.com",
 				RemoteAddr: remoteAddr,
+				URL:        &url.URL{},
 				TLS: &tls.ConnectionState{
 					PeerCertificates: []*x509.Certificate{
 						{
@@ -785,8 +786,8 @@ func TestAuthenticate(t *testing.T) {
 			require.NoError(t, err)
 
 			require.Empty(t, cmp.Diff(gotCtx, tt.wantCtx,
-				cmp.AllowUnexported(authContext{}, teleportClusterClient{}),
-				cmpopts.IgnoreFields(authContext{}, "clientIdleTimeout", "sessionTTL", "Context", "recordingConfig", "disconnectExpiredCert", "kubeCluster"),
+				cmp.AllowUnexported(authContext{}, teleportClusterClient{}, apiResource{}),
+				cmpopts.IgnoreFields(authContext{}, "clientIdleTimeout", "sessionTTL", "Context", "recordingConfig", "disconnectExpiredCert", "kubeCluster", "apiResource"),
 			))
 
 			// validate authCtx.key() to make sure it includes certExpires timestamp.
@@ -934,8 +935,6 @@ func TestSetupImpersonationHeaders(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		t.Log(tt.desc)
-
 		err := setupImpersonationHeaders(
 			logrus.NewEntry(logrus.New()),
 			authContext{
@@ -945,7 +944,6 @@ func TestSetupImpersonationHeaders(t *testing.T) {
 			},
 			tt.inHeaders,
 		)
-		t.Log("got error:", err)
 		tt.errAssertion(t, err)
 
 		if err == nil {
@@ -1185,11 +1183,11 @@ func (c *mockCSRClient) ProcessKubeCSR(csr auth.KubeCSR) (*auth.KubeCSRResponse,
 	}, nil
 }
 
-// mockRemoteSite is a reversetunnel.RemoteSite implementation with hardcoded
+// mockRemoteSite is a reversetunnelclient.RemoteSite implementation with hardcoded
 // name, because there's no easy way to construct a real
-// reversetunnel.RemoteSite.
+// reversetunnelclient.RemoteSite.
 type mockRemoteSite struct {
-	reversetunnel.RemoteSite
+	reversetunnelclient.RemoteSite
 	name string
 }
 
@@ -1234,12 +1232,12 @@ func (ap mockAccessPoint) GetCertAuthority(ctx context.Context, id types.CertAut
 }
 
 type mockRevTunnel struct {
-	reversetunnel.Server
+	reversetunnelclient.Server
 
-	sites map[string]reversetunnel.RemoteSite
+	sites map[string]reversetunnelclient.RemoteSite
 }
 
-func (t mockRevTunnel) GetSite(name string) (reversetunnel.RemoteSite, error) {
+func (t mockRevTunnel) GetSite(name string) (reversetunnelclient.RemoteSite, error) {
 	s, ok := t.sites[name]
 	if !ok {
 		return nil, trace.NotFound("remote site %q not found", name)
@@ -1247,8 +1245,8 @@ func (t mockRevTunnel) GetSite(name string) (reversetunnel.RemoteSite, error) {
 	return s, nil
 }
 
-func (t mockRevTunnel) GetSites() ([]reversetunnel.RemoteSite, error) {
-	var sites []reversetunnel.RemoteSite
+func (t mockRevTunnel) GetSites() ([]reversetunnelclient.RemoteSite, error) {
+	var sites []reversetunnelclient.RemoteSite
 	for _, s := range t.sites {
 		sites = append(sites, s)
 	}
@@ -1606,49 +1604,6 @@ func TestForwarder_clientCreds_cache(t *testing.T) {
 	}
 }
 
-func Test_getPodResourceFromRequest(t *testing.T) {
-	tests := []struct {
-		name       string
-		requestURI string
-		want       *types.KubernetesResource
-	}{
-		{
-			name:       "pod access endpoint",
-			requestURI: "/api/v1/namespaces/default/pods/podName",
-			want: &types.KubernetesResource{
-				Kind:      types.KindKubePod,
-				Namespace: "default",
-				Name:      "podName",
-			},
-		},
-		{
-			name:       "pod exec endpoint",
-			requestURI: "/api/v1/namespaces/default/pods/podName/exec",
-			want: &types.KubernetesResource{
-				Kind:      types.KindKubePod,
-				Namespace: "default",
-				Name:      "podName",
-			},
-		},
-		{
-			name:       "pod list endpoint",
-			requestURI: "/api/v1/namespaces/default/pods/",
-			want:       nil,
-		},
-		{
-			name:       "secrets get endpoint",
-			requestURI: "/api/v1/namespaces/default/secrets/secretName",
-			want:       nil,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := getPodResourceFromRequest(tt.requestURI)
-			require.Equal(t, tt.want, got)
-		})
-	}
-}
-
 func Test_copyImpersonationHeaders(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -1758,3 +1713,91 @@ func TestKubernetesLicenseEnforcement(t *testing.T) {
 		})
 	}
 }
+
+func Test_authContext_eventClusterMeta(t *testing.T) {
+	t.Parallel()
+	kubeClusterLabels := map[string]string{
+		"label": "value",
+	}
+	type args struct {
+		req *http.Request
+		ctx *authContext
+	}
+	tests := []struct {
+		name string
+		args args
+		want apievents.KubernetesClusterMetadata
+	}{
+		{
+			name: "no headers in request",
+			args: args{
+				req: &http.Request{
+					Header: http.Header{},
+				},
+				ctx: &authContext{
+					kubeClusterName:   "clusterName",
+					kubeClusterLabels: kubeClusterLabels,
+					kubeGroups:        map[string]struct{}{"kube-group-a": {}, "kube-group-b": {}},
+					kubeUsers:         map[string]struct{}{"kube-user-a": {}},
+				},
+			},
+			want: apievents.KubernetesClusterMetadata{
+				KubernetesCluster: "clusterName",
+				KubernetesLabels:  kubeClusterLabels,
+				KubernetesGroups:  []string{"kube-group-a", "kube-group-b"},
+				KubernetesUsers:   []string{"kube-user-a"},
+			},
+		},
+		{
+			name: "with filter headers in request",
+			args: args{
+				req: &http.Request{
+					Header: http.Header{
+						ImpersonateUserHeader:  []string{"kube-user-a"},
+						ImpersonateGroupHeader: []string{"kube-group-b", "kube-group-c"},
+					},
+				},
+				ctx: &authContext{
+					kubeClusterName:   "clusterName",
+					kubeClusterLabels: kubeClusterLabels,
+					kubeGroups:        map[string]struct{}{"kube-group-a": {}, "kube-group-b": {}, "kube-group-c": {}},
+					kubeUsers:         map[string]struct{}{"kube-user-a": {}, "kube-user-b": {}},
+				},
+			},
+			want: apievents.KubernetesClusterMetadata{
+				KubernetesCluster: "clusterName",
+				KubernetesLabels:  kubeClusterLabels,
+				KubernetesGroups:  []string{"kube-group-b", "kube-group-c"},
+				KubernetesUsers:   []string{"kube-user-a"},
+			},
+		},
+		{
+			name: "without filter headers in request and multi groups",
+			args: args{
+				req: &http.Request{
+					Header: http.Header{},
+				},
+				ctx: &authContext{
+					kubeClusterName:   "clusterName",
+					kubeClusterLabels: kubeClusterLabels,
+					kubeGroups:        map[string]struct{}{"kube-group-a": {}, "kube-group-b": {}, "kube-group-c": {}},
+					kubeUsers:         map[string]struct{}{"kube-user-a": {}, "kube-user-b": {}},
+				},
+			},
+			want: apievents.KubernetesClusterMetadata{
+				KubernetesCluster: "clusterName",
+				KubernetesLabels:  kubeClusterLabels,
+				KubernetesGroups:  []string{"kube-group-a", "kube-group-b", "kube-group-c"},
+				KubernetesUsers:   []string{"kube-user-a", "kube-user-b"},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.args.ctx.eventClusterMeta(tt.args.req)
+			sort.Strings(got.KubernetesGroups)
+			sort.Strings(got.KubernetesGroups)
+			require.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/lib/kube/proxy/fuzz_test.go b/lib/kube/proxy/fuzz_test.go
index 759f31dbc6e29..1feada2e73737 100644
--- a/lib/kube/proxy/fuzz_test.go
+++ b/lib/kube/proxy/fuzz_test.go
@@ -23,8 +23,19 @@ import (
 )
 
 func FuzzParseResourcePath(f *testing.F) {
-	f.Fuzz(func(t *testing.T, path string) {
+	f.Add("")
+	f.Add("/api/v1/")
+	f.Add("/apis/group/version")
+	f.Add("/watch/abc/def/hij")
+	f.Add("/apis/apps/v1")
+	f.Add("/api/v1/pods")
+	f.Add("/api/v1/clusterroles/name")
+	f.Add("/api/v1/namespaces/namespace/pods")
+	f.Add("/apis/apiregistration.k8s.io/v1/apiservices/name/status")
+	f.Add("/api/v1/namespaces/{namespace}/pods/name/exec")
+	f.Add("/api/v1/nodes/name/proxy/path")
 
+	f.Fuzz(func(t *testing.T, path string) {
 		require.NotPanics(t, func() {
 			parseResourcePath(path)
 		})
diff --git a/lib/kube/proxy/kube_creds.go b/lib/kube/proxy/kube_creds.go
index 00503305c7c34..6fa42943b2391 100644
--- a/lib/kube/proxy/kube_creds.go
+++ b/lib/kube/proxy/kube_creds.go
@@ -32,6 +32,7 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 type kubeCreds interface {
@@ -171,6 +172,7 @@ type dynamicCredsConfig struct {
 	checker              servicecfg.ImpersonationPermissionsChecker
 	clock                clockwork.Clock
 	initialRenewInterval time.Duration
+	resourceMatchers     []services.ResourceMatcher
 }
 
 func (d *dynamicCredsConfig) checkAndSetDefaults() error {
diff --git a/lib/kube/proxy/kube_creds_test.go b/lib/kube/proxy/kube_creds_test.go
index 90fc0c014ef6d..5bda7e4713f2a 100644
--- a/lib/kube/proxy/kube_creds_test.go
+++ b/lib/kube/proxy/kube_creds_test.go
@@ -34,11 +34,13 @@ import (
 	"k8s.io/client-go/rest"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/azure"
 	"github.com/gravitational/teleport/lib/cloud/gcp"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/services"
 )
 
 // Test_DynamicKubeCreds tests the dynamic kube credrentials generator for
@@ -102,13 +104,14 @@ func Test_DynamicKubeCreds(t *testing.T) {
 		Host:   "sts.amazonaws.com",
 		Path:   "/?Action=GetCallerIdentity&Version=2011-06-15",
 	}
+	sts := &mocks.STSMock{
+		// u is used to presign the request
+		// here we just verify the pre-signed request includes this url.
+		URL: u,
+	}
 	// mock clients
 	cloudclients := &cloud.TestCloudClients{
-		STS: &mocks.STSMock{
-			// u is used to presign the request
-			// here we just verify the pre-signed request includes this url.
-			URL: u,
-		},
+		STS: sts,
 		EKS: &mocks.EKSMock{
 			Notify: notify,
 			Clusters: []*eks.Cluster{
@@ -164,22 +167,85 @@ func Test_DynamicKubeCreds(t *testing.T) {
 			},
 		},
 	}
-
+	validateEKSToken := func(token string) error {
+		if token == "" {
+			return trace.BadParameter("missing bearer token")
+		}
+		tokens := strings.Split(token, ".")
+		if len(tokens) != 2 {
+			return trace.BadParameter("invalid bearer token")
+		}
+		if tokens[0] != "k8s-aws-v1" {
+			return trace.BadParameter("token must start with k8s-aws-v1")
+		}
+		dec, err := base64.RawStdEncoding.DecodeString(tokens[1])
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if string(dec) != u.String() {
+			return trace.BadParameter("invalid token payload")
+		}
+		return nil
+	}
 	type args struct {
 		cluster             types.KubeCluster
 		client              dynamicCredsClient
 		validateBearerToken func(string) error
 	}
 	tests := []struct {
-		name     string
-		args     args
-		wantAddr string
+		name            string
+		args            args
+		wantAddr        string
+		wantAssumedRole []string
+		wantExternalIds []string
 	}{
 		{
-			name: "aws eks cluster",
+			name: "aws eks cluster without assume role",
+			args: args{
+				cluster:             awsKube,
+				client:              getAWSClientRestConfig(cloudclients, fakeClock, nil),
+				validateBearerToken: validateEKSToken,
+			},
+			wantAddr: "api.eks.us-west-2.amazonaws.com:443",
+		},
+		{
+			name: "aws eks cluster with unmatched assume role",
 			args: args{
 				cluster: awsKube,
-				client:  getAWSClientRestConfig(cloudclients, fakeClock),
+				client: getAWSClientRestConfig(cloudclients, fakeClock, []services.ResourceMatcher{
+					{
+						Labels: types.Labels{
+							"rand": []string{"value"},
+						},
+						AWS: services.ResourceMatcherAWS{
+							AssumeRoleARN: "arn:aws:iam::123456789012:role/eks-role",
+							ExternalID:    "1234567890",
+						},
+					},
+				}),
+				validateBearerToken: validateEKSToken,
+			},
+			wantAddr: "api.eks.us-west-2.amazonaws.com:443",
+		},
+		{
+			name: "aws eks cluster with assume role",
+			args: args{
+				cluster: awsKube,
+				client: getAWSClientRestConfig(
+					cloudclients,
+					fakeClock,
+					[]services.ResourceMatcher{
+						{
+							Labels: types.Labels{
+								types.Wildcard: []string{types.Wildcard},
+							},
+							AWS: services.ResourceMatcherAWS{
+								AssumeRoleARN: "arn:aws:iam::123456789012:role/eks-role",
+								ExternalID:    "1234567890",
+							},
+						},
+					},
+				),
 				validateBearerToken: func(token string) error {
 					if token == "" {
 						return trace.BadParameter("missing bearer token")
@@ -201,7 +267,9 @@ func Test_DynamicKubeCreds(t *testing.T) {
 					return nil
 				},
 			},
-			wantAddr: "api.eks.us-west-2.amazonaws.com:443",
+			wantAddr:        "api.eks.us-west-2.amazonaws.com:443",
+			wantAssumedRole: []string{"arn:aws:iam::123456789012:role/eks-role"},
+			wantExternalIds: []string{"1234567890"},
 		},
 		{
 			name: "gcp gke cluster",
@@ -261,6 +329,10 @@ func Test_DynamicKubeCreds(t *testing.T) {
 				}
 			}
 			require.NoError(t, got.close())
+
+			require.Equal(t, tt.wantAssumedRole, utils.Deduplicate(sts.GetAssumedRoleARNs()))
+			require.Equal(t, tt.wantExternalIds, utils.Deduplicate(sts.GetAssumedRoleExternalIDs()))
+			sts.ResetAssumeRoleHistory()
 		})
 	}
 }
diff --git a/lib/kube/proxy/pod_filters.go b/lib/kube/proxy/pod_filters.go
deleted file mode 100644
index 658d869bba3aa..0000000000000
--- a/lib/kube/proxy/pod_filters.go
+++ /dev/null
@@ -1,355 +0,0 @@
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package proxy
-
-import (
-	"bytes"
-	"io"
-	"mime"
-	"net/http"
-
-	"github.com/gravitational/trace"
-	"github.com/sirupsen/logrus"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/kube/proxy/responsewriters"
-)
-
-// newPodFilterer creates a wrapper function that once executed creates
-// a runtime filter for Pods.
-// The filter exclusion criteria is:
-// - deniedPods: excluded if (namespace,name) matches an entry even if it matches
-// the allowedPod's list.
-// - allowedPods: excluded if (namespace,name) not match a single entry.
-func newPodFilterer(allowedPods, deniedPods []types.KubernetesResource, log logrus.FieldLogger) responsewriters.FilterWrapper {
-	// If the list of allowed pods contains a wildcard and no deniedPods, then we
-	// don't need to filter anything.
-	if containsWildcard(allowedPods) && len(deniedPods) == 0 {
-		return nil
-	}
-	return func(contentType string, responseCode int) (responsewriters.Filter, error) {
-		negotiator := newClientNegotiator()
-		encoder, decoder, err := newEncoderAndDecoderForContentType(contentType, negotiator)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		return &podFilterer{
-			encoder:          encoder,
-			decoder:          decoder,
-			contentType:      contentType,
-			responseCode:     responseCode,
-			negotiator:       negotiator,
-			allowedResources: allowedPods,
-			deniedResources:  deniedPods,
-			log:              log,
-		}, nil
-	}
-}
-
-// wildcardFilter is a filter that matches all pods.
-var wildcardFilter = types.KubernetesResource{
-	Kind:      types.KindKubePod,
-	Namespace: types.Wildcard,
-	Name:      types.Wildcard,
-}
-
-// containsWildcard returns true if the list of resources contains a wildcard filter.
-func containsWildcard(resources []types.KubernetesResource) bool {
-	for _, r := range resources {
-		if r.Kind == wildcardFilter.Kind &&
-			r.Name == wildcardFilter.Name &&
-			r.Namespace == wildcardFilter.Namespace {
-			return true
-		}
-	}
-	return false
-}
-
-// podFilterer is a pod filterer instance.
-type podFilterer struct {
-	encoder runtime.Encoder
-	decoder runtime.Decoder
-	// contentType is the response "Content-Type" header.
-	contentType string
-	// responseCode is the response status code.
-	responseCode int
-	// negotiator is an instance of a client negotiator.
-	negotiator runtime.ClientNegotiator
-	// allowedResources is the list of kubernetes resources the user has access to.
-	allowedResources []types.KubernetesResource
-	// deniedResources is the list of kubernetes resources the user must not access.
-	deniedResources []types.KubernetesResource
-	// log is the logger.
-	log logrus.FieldLogger
-}
-
-// FilterBuffer receives a byte array, decodes the response into the appropriate
-// type and filters the resources based on allowed and denied rules configured.
-// After filtering them, it serializes the response and dumps it into output buffer.
-// If any error occurs, the call returns an error.
-func (d *podFilterer) FilterBuffer(buf []byte, output io.Writer) error {
-	// decode the response into the appropriate Kubernetes API type.
-	obj, bf, err := d.decode(buf)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// if bf is not empty, it means that response does not contain any valid response
-	// and it should be safe to write it back into the buffer.
-	if len(bf) > 0 {
-		_, err = output.Write(buf)
-		return trace.Wrap(err)
-	}
-
-	var filtered runtime.Object
-	switch o := obj.(type) {
-	case *metav1.Status:
-		// Status object is returned when the Kubernetes API returns an error and
-		// should be forwarded to the user.
-		filtered = obj
-	case *corev1.Pod:
-		// filterPod filters a single corev1.Pod and returns an error if access to
-		// pod was denied.
-		if err := filterPod(o, d.allowedResources, d.deniedResources); err != nil {
-			if !trace.IsAccessDenied(err) {
-				d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
-			}
-			return trace.Wrap(err)
-		}
-		filtered = obj
-	case *corev1.PodList:
-		filtered = filterCoreV1PodList(o, d.allowedResources, d.deniedResources, d.log)
-	case *metav1.Table:
-		filtered, err = d.filterMetaV1Table(o, d.allowedResources, d.deniedResources)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	default:
-		// It's important default types are never blindly forwarded or protocol
-		// extensions could result in information disclosures.
-		return trace.BadParameter("unexpected type received; got %T", obj)
-	}
-	// encode the filterer response back to the user.
-	return d.encode(filtered, output)
-}
-
-// FilterObj receives a runtime.Object type and filters the resources on it
-// based on allowed and denied rules.
-// After filtering them, the obj is manipulated to hold the filtered information.
-// The boolean returned indicates if the client is allowed to receive the event
-// that originated this check.
-func (d *podFilterer) FilterObj(obj runtime.Object) (bool, error) {
-	switch o := obj.(type) {
-	case *corev1.Pod:
-		err := filterPod(o, d.allowedResources, d.deniedResources)
-		if err != nil && !trace.IsAccessDenied(err) {
-			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
-		}
-		// if err is not nil we should not include it.
-		return err == nil, nil
-	case *corev1.PodList:
-		_ = filterCoreV1PodList(o, d.allowedResources, d.deniedResources, d.log)
-		return len(o.Items) > 0, nil
-	case *metav1.Table:
-		_, err := d.filterMetaV1Table(o, d.allowedResources, d.deniedResources)
-		if err != nil {
-			return false, trace.Wrap(err)
-		}
-		return len(o.Rows) > 0, nil
-	default:
-		// It's important default types are never blindly forwarded or protocol
-		// extensions could result in information disclosures.
-		return false, trace.BadParameter("unexpected type received; got %T", obj)
-	}
-}
-
-// decode decodes the buffer into the appropriate type if the responseCode
-// belongs to the range 200(OK)-206(PartialContent).
-// If it does not belong, it returns the buffer unchanged since it contains
-// an error message from the Kubernetes API server and it's safe to return
-// it back to the user.
-func (d *podFilterer) decode(buffer []byte) (runtime.Object, []byte, error) {
-	switch {
-	case d.responseCode == http.StatusSwitchingProtocols:
-		// no-op, we've been upgraded
-		return nil, buffer, nil
-	case d.responseCode < http.StatusOK /* 200 */ || d.responseCode > http.StatusPartialContent /* 206 */ :
-		// calculate an unstructured error from the response which the Result object may use if the caller
-		// did not return a structured error.
-		// Logic from: https://github.com/kubernetes/client-go/blob/58ff029093df37cad9fa28778a37f11fa495d9cf/rest/request.go#L1040
-		return nil, buffer, nil
-	default:
-		out, err := decodeAndSetGVK(d.decoder, buffer)
-		return out, nil, trace.Wrap(err)
-	}
-}
-
-// decodePartialObjectMetadata decodes the metav1.PartialObjectMetadata present
-// in the metav1.TableRow entry. This information comes from server side and
-// includes the resource name and namespace as a structured object.
-func (d *podFilterer) decodePartialObjectMetadata(row *metav1.TableRow) error {
-	if row.Object.Object != nil {
-		return nil
-	}
-	var err error
-	// decode only if row.Object.Object was not decoded before.
-	row.Object.Object, err = decodeAndSetGVK(d.decoder, row.Object.Raw)
-	return trace.Wrap(err)
-}
-
-// encode encodes the filtered object into the io.Writer using the same
-// content-type.
-func (d *podFilterer) encode(obj runtime.Object, w io.Writer) error {
-	return trace.Wrap(d.encoder.Encode(obj, w))
-}
-
-// filterCoreV1PodList excludes pods the user should not have access to.
-func filterCoreV1PodList(list *corev1.PodList, allowed, denied []types.KubernetesResource, log logrus.FieldLogger) *corev1.PodList {
-	pods := make([]corev1.Pod, 0, len(list.Items))
-	for _, pod := range list.Items {
-		if err := filterPod(&pod, allowed, denied); err == nil {
-			pods = append(pods, pod)
-		} else if !trace.IsAccessDenied(err) {
-			log.WithError(err).Warnf("Unable to compile role kubernetes_resources.")
-		}
-	}
-	list.Items = pods
-	return list
-}
-
-// filterPod validates if the user should access the current resource.
-func filterPod(pod *corev1.Pod, allowed, denied []types.KubernetesResource) error {
-	err := matchKubernetesResource(
-		types.KubernetesResource{
-			Kind:      types.KindKubePod,
-			Namespace: pod.Namespace,
-			Name:      pod.Name,
-		},
-		allowed, denied,
-	)
-	return trace.Wrap(err)
-}
-
-// filterMetaV1Table filters the serverside printed table to exclude pods
-// that the user must not have access to.
-func (d *podFilterer) filterMetaV1Table(table *metav1.Table, allowedPods, deniedPods []types.KubernetesResource) (*metav1.Table, error) {
-	pods := make([]metav1.TableRow, 0, len(table.Rows))
-	for i := range table.Rows {
-		row := &(table.Rows[i])
-		if err := d.decodePartialObjectMetadata(row); err != nil {
-			return nil, trace.Wrap(err)
-		}
-		resource, err := getKubeResourcePartialMetadataObject(row.Object.Object)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		if err := matchKubernetesResource(resource, allowedPods, deniedPods); err == nil {
-			pods = append(pods, *row)
-		} else if !trace.IsAccessDenied(err) {
-			d.log.WithError(err).Warn("Unable to compile regex expression.")
-		}
-	}
-	table.Rows = pods
-	return table, nil
-}
-
-// getKubeResourcePartialMetadataObject checks if obj is of type *metav1.PartialObjectMetadata
-// otherwise returns an error.
-func getKubeResourcePartialMetadataObject(obj runtime.Object) (types.KubernetesResource, error) {
-	switch o := obj.(type) {
-	case *metav1.PartialObjectMetadata:
-		return types.KubernetesResource{
-			Namespace: o.Namespace,
-			Name:      o.Name,
-			Kind:      types.KindKubePod,
-		}, nil
-	default:
-		return types.KubernetesResource{}, trace.BadParameter("expected *metav1.PartialObjectMetadata object, got %T", obj)
-	}
-}
-
-// newEncoderAndDecoderForContentType creates a new encoder and decoder instances
-// for the given contentType.
-// If the contentType is invalid or not supported this function returns an error.
-// Supported content types:
-// - "application/json"
-// - "application/yaml"
-// - "application/vnd.kubernetes.protobuf"
-func newEncoderAndDecoderForContentType(contentType string, negotiator runtime.ClientNegotiator) (runtime.Encoder, runtime.Decoder, error) {
-	mediaType, params, err := mime.ParseMediaType(contentType)
-	if err != nil {
-		return nil, nil, trace.WrapWithMessage(err, "unable to parse %q header %q", responsewriters.ContentTypeHeader, contentType)
-	}
-	dec, err := negotiator.Decoder(mediaType, params)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	enc, err := negotiator.Encoder(mediaType, params)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	return enc, dec, nil
-}
-
-// decodeAndSetGVK decodes the payload into the appropriate type using the decoder
-// provider and sets the GVK if available.
-func decodeAndSetGVK(decoder runtime.Decoder, payload []byte) (runtime.Object, error) {
-	obj, gvk, err := decoder.Decode(payload, nil, nil)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	if gvk != nil {
-		// objects from decode do not contain GroupVersionKind.
-		// We force it to be present for later encoding.
-		obj.GetObjectKind().SetGroupVersionKind(*gvk)
-	}
-	return obj, nil
-}
-
-// filterBuffer filters the response buffer before writing it into the original
-// MemoryResponseWriter.
-func filterBuffer(filterWrapper responsewriters.FilterWrapper, src *responsewriters.MemoryResponseWriter) error {
-	if filterWrapper == nil {
-		return nil
-	}
-
-	filter, err := filterWrapper(responsewriters.GetContentTypeHeader(src.Header()), src.Status())
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// copy body into another slice so we can manipulate it.
-	b := bytes.NewBuffer(make([]byte, 0, src.Buffer().Len()))
-
-	// get the compressor and decompressor for the response based on the content type.
-	compressor, decompressor, err := getResponseCompressorDecompressor(src.Header())
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	// decompress the response body into b.
-	if err := decompressor(b, src.Buffer()); err != nil {
-		return trace.Wrap(err)
-	}
-	// filter.FilterBuffer encodes the filtered payload into src.Buffer, so we need to
-	// reset it to discard the old payload.
-	src.Buffer().Reset()
-	// creates a compressor that writes the filtered payload into src.Buffer.
-	comp := compressor(src.Buffer())
-	// Close is a no-op operation into src but it's required to put the gzip writer
-	// into the sync.Pool.
-	defer comp.Close()
-	return trace.Wrap(filter.FilterBuffer(b.Bytes(), comp))
-}
diff --git a/lib/kube/proxy/pod_filters_test.go b/lib/kube/proxy/pod_filters_test.go
deleted file mode 100644
index aa6e4c5aa8459..0000000000000
--- a/lib/kube/proxy/pod_filters_test.go
+++ /dev/null
@@ -1,152 +0,0 @@
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package proxy
-
-import (
-	"bytes"
-	"compress/gzip"
-	"io"
-	"os"
-	"sort"
-	"testing"
-
-	"github.com/gravitational/trace"
-	"github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/kube/proxy/responsewriters"
-)
-
-func Test_filterBuffer(t *testing.T) {
-	log := logrus.New()
-	data, err := os.ReadFile("testing/data/pod_list.json")
-	require.NoError(t, err)
-
-	_, decoder, err := newEncoderAndDecoderForContentType(responsewriters.DefaultContentType, newClientNegotiator())
-	require.NoError(t, err)
-
-	type args struct {
-		allowedPods     []types.KubernetesResource
-		contentEncoding string
-	}
-	tests := []struct {
-		name string
-		args args
-		want []string
-	}{
-		{
-			name: "Test filterBuffer with gzip",
-			args: args{
-				contentEncoding: "gzip",
-				allowedPods: []types.KubernetesResource{
-					{
-						Kind:      types.KindKubePod,
-						Namespace: "default",
-						Name:      "*",
-					},
-				},
-			},
-			want: []string{
-				"default/nginx-deployment-6595874d85-6j2zm",
-				"default/nginx-deployment-6595874d85-7xgmb",
-				"default/nginx-deployment-6595874d85-c4kz8",
-			},
-		},
-		{
-			name: "Test filterBuffer with no gzip",
-			args: args{
-				contentEncoding: "",
-				allowedPods: []types.KubernetesResource{
-					{
-						Kind:      types.KindKubePod,
-						Namespace: "default",
-						Name:      "*",
-					},
-				},
-			},
-			want: []string{
-				"default/nginx-deployment-6595874d85-6j2zm",
-				"default/nginx-deployment-6595874d85-7xgmb",
-				"default/nginx-deployment-6595874d85-c4kz8",
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			buf, decompress := newMemoryResponseWriter(t, data, tt.args.contentEncoding)
-
-			err := filterBuffer(newPodFilterer(tt.args.allowedPods, nil, log), buf)
-			require.NoError(t, err)
-
-			// Decompress the buffer to compare the result.
-			decompressedBuf := bytes.NewBuffer(nil)
-
-			err = decompress(decompressedBuf, buf.Buffer())
-			require.NoError(t, err)
-			obj, _, err := decoder.Decode(decompressedBuf.Bytes(), nil, nil)
-			require.NoError(t, err)
-			switch o := obj.(type) {
-			case *corev1.PodList:
-				pods := collectPodsFromResponse(o)
-				sort.Strings(pods)
-				sort.Strings(tt.want)
-				require.Equal(t, tt.want, pods)
-			default:
-				t.Errorf("filterBuffer() = %v, want %v", obj, &corev1.PodList{})
-			}
-		})
-	}
-}
-
-func collectPodsFromResponse(podList *corev1.PodList) []string {
-	pods := []string{}
-	for _, pod := range podList.Items {
-		pods = append(pods, pod.Namespace+"/"+pod.Name)
-	}
-	return pods
-}
-
-func newMemoryResponseWriter(t *testing.T, payload []byte, contentEncoding string) (*responsewriters.MemoryResponseWriter, decompressionFunc) {
-	buf := responsewriters.NewMemoryResponseWriter()
-	buf.Header().Set(contentEncodingHeader, contentEncoding)
-	buf.Header().Set(responsewriters.ContentTypeHeader, responsewriters.DefaultContentType)
-
-	switch contentEncoding {
-	case "gzip":
-		w, err := gzip.NewWriterLevel(buf, defaultGzipContentEncodingLevel)
-		require.NoError(t, err)
-		defer w.Close()
-		defer w.Flush()
-		_, err = w.Write(payload)
-		require.NoError(t, err)
-		return buf, func(dst io.Writer, src io.Reader) error {
-			gzr, err := gzip.NewReader(src)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			defer gzr.Close()
-			_, err = io.Copy(dst, gzr)
-			return trace.Wrap(err)
-		}
-	default:
-		buf.Write(payload)
-		return buf, func(dst io.Writer, src io.Reader) error {
-			_, err := io.Copy(dst, src)
-			return trace.Wrap(err)
-		}
-	}
-}
diff --git a/lib/kube/proxy/resource_filters.go b/lib/kube/proxy/resource_filters.go
new file mode 100644
index 0000000000000..523a6369f61ec
--- /dev/null
+++ b/lib/kube/proxy/resource_filters.go
@@ -0,0 +1,673 @@
+// Copyright 2022 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package proxy
+
+import (
+	"bytes"
+	"io"
+	"mime"
+	"net/http"
+
+	"github.com/gravitational/trace"
+	"github.com/sirupsen/logrus"
+	appsv1 "k8s.io/api/apps/v1"
+	batchv1 "k8s.io/api/batch/v1"
+	certificatesv1 "k8s.io/api/certificates/v1"
+	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	authv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/kube/proxy/responsewriters"
+)
+
+// newResourceFilterer creates a wrapper function that once executed creates
+// a runtime filter for kubernetes resources.
+// The filter exclusion criteria is:
+// - deniedResources: excluded if (namespace,name) matches an entry even if it matches
+// the allowedResources's list.
+// - allowedResources: excluded if (namespace,name) not match a single entry.
+func newResourceFilterer(kind string, allowedResources, deniedResources []types.KubernetesResource, log logrus.FieldLogger) responsewriters.FilterWrapper {
+	// If the list of allowed resources contains a wildcard and no deniedResources, then we
+	// don't need to filter anything.
+	if containsWildcard(allowedResources) && len(deniedResources) == 0 {
+		return nil
+	}
+	return func(contentType string, responseCode int) (responsewriters.Filter, error) {
+		negotiator := newClientNegotiator()
+		encoder, decoder, err := newEncoderAndDecoderForContentType(contentType, negotiator)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &resourceFilterer{
+			encoder:          encoder,
+			decoder:          decoder,
+			contentType:      contentType,
+			responseCode:     responseCode,
+			negotiator:       negotiator,
+			allowedResources: allowedResources,
+			deniedResources:  deniedResources,
+			log:              log,
+			kind:             kind,
+		}, nil
+	}
+}
+
+// wildcardFilter is a filter that matches all pods.
+var wildcardFilter = types.KubernetesResource{
+	Kind:      types.KindKubePod,
+	Namespace: types.Wildcard,
+	Name:      types.Wildcard,
+}
+
+// containsWildcard returns true if the list of resources contains a wildcard filter.
+func containsWildcard(resources []types.KubernetesResource) bool {
+	for _, r := range resources {
+		if r.Kind == wildcardFilter.Kind &&
+			r.Name == wildcardFilter.Name &&
+			r.Namespace == wildcardFilter.Namespace {
+			return true
+		}
+	}
+	return false
+}
+
+// resourceFilterer is a resource filterer instance.
+type resourceFilterer struct {
+	encoder runtime.Encoder
+	decoder runtime.Decoder
+	// contentType is the response "Content-Type" header.
+	contentType string
+	// responseCode is the response status code.
+	responseCode int
+	// negotiator is an instance of a client negotiator.
+	negotiator runtime.ClientNegotiator
+	// allowedResources is the list of kubernetes resources the user has access to.
+	allowedResources []types.KubernetesResource
+	// deniedResources is the list of kubernetes resources the user must not access.
+	deniedResources []types.KubernetesResource
+	// log is the logger.
+	log logrus.FieldLogger
+	// kind is the type of the resource.
+	kind string
+}
+
+// FilterBuffer receives a byte array, decodes the response into the appropriate
+// type and filters the resources based on allowed and denied rules configured.
+// After filtering them, it serializes the response and dumps it into output buffer.
+// If any error occurs, the call returns an error.
+func (d *resourceFilterer) FilterBuffer(buf []byte, output io.Writer) error {
+	// decode the response into the appropriate Kubernetes API type.
+	obj, bf, err := d.decode(buf)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// if bf is not empty, it means that response does not contain any valid response
+	// and it should be safe to write it back into the buffer.
+	if len(bf) > 0 {
+		_, err = output.Write(buf)
+		return trace.Wrap(err)
+	}
+
+	switch allowed, isList, err := d.FilterObj(obj); {
+	case err != nil:
+		return trace.Wrap(err)
+	case isList:
+	case !allowed:
+		// if the object is not a list and it's not allowed, then we should
+		// return an error.
+		return trace.AccessDenied("access denied")
+	}
+	// encode the filterer response back to the user.
+	return d.encode(obj, output)
+}
+
+func arrayToPointerArray[T any](arr []T) []*T {
+	out := make([]*T, len(arr))
+	for i := range arr {
+		out[i] = &arr[i]
+	}
+	return out
+}
+
+func pointerArrayToArray[T any](arr []*T) []T {
+	out := make([]T, len(arr))
+	for i := range arr {
+		if arr[i] == nil {
+			continue
+		}
+		out[i] = *arr[i]
+	}
+	return out
+}
+
+// FilterObj receives a runtime.Object type and filters the resources on it
+// based on allowed and denied rules.
+// After filtering them, the obj is manipulated to hold the filtered information.
+// The isAllowed boolean returned indicates if the client is allowed to receive the event
+// with the object.
+// The isListObj boolean returned indicates if the object is a list of resources.
+func (d *resourceFilterer) FilterObj(obj runtime.Object) (isAllowed bool, isList bool, err error) {
+	switch o := obj.(type) {
+	case *metav1.Status:
+		// Status object is returned when the Kubernetes API returns an error and
+		// should be forwarded to the user.
+		return true, false, nil
+	case *corev1.Pod:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *corev1.PodList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *corev1.Secret:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *corev1.SecretList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *corev1.ConfigMap:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *corev1.ConfigMapList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *corev1.Namespace:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *corev1.NamespaceList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *corev1.Service:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *corev1.ServiceList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *corev1.ServiceAccount:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *corev1.ServiceAccountList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *corev1.Node:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *corev1.NodeList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *corev1.PersistentVolume:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *corev1.PersistentVolumeList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *corev1.PersistentVolumeClaim:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *corev1.PersistentVolumeClaimList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+
+	case *appsv1.Deployment:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *appsv1.DeploymentList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+
+	case *appsv1.ReplicaSet:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *appsv1.ReplicaSetList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *appsv1.StatefulSet:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *appsv1.StatefulSetList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+
+	case *appsv1.DaemonSet:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *appsv1.DaemonSetList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *authv1.ClusterRole:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *authv1.ClusterRoleList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *authv1.Role:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *authv1.RoleList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+
+	case *authv1.ClusterRoleBinding:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *authv1.ClusterRoleBindingList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+
+	case *authv1.RoleBinding:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *authv1.RoleBindingList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+
+	case *batchv1.CronJob:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *batchv1.CronJobList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+
+	case *batchv1.Job:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *batchv1.JobList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+
+	case *certificatesv1.CertificateSigningRequest:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *certificatesv1.CertificateSigningRequestList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+	case *networkingv1.Ingress:
+		result, err := filterResource(d.kind, o, d.allowedResources, d.deniedResources)
+		if err != nil && !trace.IsAccessDenied(err) {
+			d.log.WithError(err).Warn("Unable to compile role kubernetes_resources.")
+		}
+		// if err is not nil or result is false, we should not include it.
+		return err == nil && result, false, nil
+	case *networkingv1.IngressList:
+		o.Items = pointerArrayToArray(
+			filterResourceList(
+				d.kind,
+				arrayToPointerArray(o.Items), d.allowedResources, d.deniedResources, d.log),
+		)
+		return len(o.Items) > 0, true, nil
+
+	case *metav1.Table:
+		_, err := d.filterMetaV1Table(o, d.allowedResources, d.deniedResources)
+		if err != nil {
+			return false, false, trace.Wrap(err)
+		}
+		return len(o.Rows) > 0, true, nil
+
+	default:
+		// It's important default types are never blindly forwarded or protocol
+		// extensions could result in information disclosures.
+		return false, false, trace.BadParameter("unexpected type received; got %T", obj)
+	}
+}
+
+// decode decodes the buffer into the appropriate type if the responseCode
+// belongs to the range 200(OK)-206(PartialContent).
+// If it does not belong, it returns the buffer unchanged since it contains
+// an error message from the Kubernetes API server and it's safe to return
+// it back to the user.
+func (d *resourceFilterer) decode(buffer []byte) (runtime.Object, []byte, error) {
+	switch {
+	case d.responseCode == http.StatusSwitchingProtocols:
+		// no-op, we've been upgraded
+		return nil, buffer, nil
+	case d.responseCode < http.StatusOK /* 200 */ || d.responseCode > http.StatusPartialContent /* 206 */ :
+		// calculate an unstructured error from the response which the Result object may use if the caller
+		// did not return a structured error.
+		// Logic from: https://github.com/kubernetes/client-go/blob/58ff029093df37cad9fa28778a37f11fa495d9cf/rest/request.go#L1040
+		return nil, buffer, nil
+	default:
+		out, err := decodeAndSetGVK(d.decoder, buffer)
+		return out, nil, trace.Wrap(err)
+	}
+}
+
+// decodePartialObjectMetadata decodes the metav1.PartialObjectMetadata present
+// in the metav1.TableRow entry. This information comes from server side and
+// includes the resource name and namespace as a structured object.
+func (d *resourceFilterer) decodePartialObjectMetadata(row *metav1.TableRow) error {
+	if row.Object.Object != nil {
+		return nil
+	}
+	var err error
+	// decode only if row.Object.Object was not decoded before.
+	row.Object.Object, err = decodeAndSetGVK(d.decoder, row.Object.Raw)
+	return trace.Wrap(err)
+}
+
+// encode encodes the filtered object into the io.Writer using the same
+// content-type.
+func (d *resourceFilterer) encode(obj runtime.Object, w io.Writer) error {
+	return trace.Wrap(d.encoder.Encode(obj, w))
+}
+
+// filterResourceList excludes resources the user should not have access to.
+func filterResourceList[T kubeObjectInterface](kind string, originalList []T, allowed, denied []types.KubernetesResource, log logrus.FieldLogger) []T {
+	filteredList := make([]T, 0, len(originalList))
+	for _, resource := range originalList {
+		if result, err := filterResource(kind, resource, allowed, denied); err == nil && result {
+			filteredList = append(filteredList, resource)
+		} else if err != nil {
+			log.WithError(err).Warnf("Unable to compile role kubernetes_resources.")
+		}
+	}
+	return filteredList
+}
+
+// kubeObjectInterface is an interface that all Kubernetes objects must
+// implement to be able to filter them. It is used to extract the kind of the
+// object from the GroupVersionKind object, the namespace and the name.
+type kubeObjectInterface interface {
+	GetNamespace() string
+	GetName() string
+}
+
+// filterResource validates if the user should access the current resource.
+func filterResource(kind string, resource kubeObjectInterface, allowed, denied []types.KubernetesResource) (bool, error) {
+	result, err := matchKubernetesResource(
+		getKubeResource(kind, resource),
+		allowed, denied,
+	)
+	return result, trace.Wrap(err)
+}
+
+func getKubeResource(kind string, obj kubeObjectInterface) types.KubernetesResource {
+	return types.KubernetesResource{
+		Kind:      kind,
+		Namespace: obj.GetNamespace(),
+		Name:      obj.GetName(),
+	}
+}
+
+// filterMetaV1Table filters the serverside printed table to exclude resources
+// that the user must not have access to.
+func (d *resourceFilterer) filterMetaV1Table(table *metav1.Table, allowedResources, deniedResources []types.KubernetesResource) (*metav1.Table, error) {
+	resources := make([]metav1.TableRow, 0, len(table.Rows))
+	for i := range table.Rows {
+		row := &(table.Rows[i])
+		if err := d.decodePartialObjectMetadata(row); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		resource, err := getKubeResourcePartialMetadataObject(d.kind, row.Object.Object)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if result, err := matchKubernetesResource(resource, allowedResources, deniedResources); err == nil && result {
+			resources = append(resources, *row)
+		} else if err != nil {
+			d.log.WithError(err).Warn("Unable to compile regex expression.")
+		}
+	}
+	table.Rows = resources
+	return table, nil
+}
+
+// getKubeResourcePartialMetadataObject checks if obj is of type *metav1.PartialObjectMetadata
+// otherwise returns an error.
+func getKubeResourcePartialMetadataObject(kind string, obj runtime.Object) (types.KubernetesResource, error) {
+	switch o := obj.(type) {
+	case *metav1.PartialObjectMetadata:
+		return types.KubernetesResource{
+			Namespace: o.Namespace,
+			Name:      o.Name,
+			Kind:      kind,
+		}, nil
+	default:
+		return types.KubernetesResource{}, trace.BadParameter("expected *metav1.PartialObjectMetadata object, got %T", obj)
+	}
+}
+
+// newEncoderAndDecoderForContentType creates a new encoder and decoder instances
+// for the given contentType.
+// If the contentType is invalid or not supported this function returns an error.
+// Supported content types:
+// - "application/json"
+// - "application/yaml"
+// - "application/vnd.kubernetes.protobuf"
+func newEncoderAndDecoderForContentType(contentType string, negotiator runtime.ClientNegotiator) (runtime.Encoder, runtime.Decoder, error) {
+	mediaType, params, err := mime.ParseMediaType(contentType)
+	if err != nil {
+		return nil, nil, trace.WrapWithMessage(err, "unable to parse %q header %q", responsewriters.ContentTypeHeader, contentType)
+	}
+	dec, err := negotiator.Decoder(mediaType, params)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	enc, err := negotiator.Encoder(mediaType, params)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	return enc, dec, nil
+}
+
+// decodeAndSetGVK decodes the payload into the appropriate type using the decoder
+// provider and sets the GVK if available.
+func decodeAndSetGVK(decoder runtime.Decoder, payload []byte) (runtime.Object, error) {
+	obj, gvk, err := decoder.Decode(payload, nil, nil)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	if gvk != nil {
+		// objects from decode do not contain GroupVersionKind.
+		// We force it to be present for later encoding.
+		obj.GetObjectKind().SetGroupVersionKind(*gvk)
+	}
+	return obj, nil
+}
+
+// filterBuffer filters the response buffer before writing it into the original
+// MemoryResponseWriter.
+func filterBuffer(filterWrapper responsewriters.FilterWrapper, src *responsewriters.MemoryResponseWriter) error {
+	if filterWrapper == nil {
+		return nil
+	}
+
+	filter, err := filterWrapper(responsewriters.GetContentTypeHeader(src.Header()), src.Status())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// copy body into another slice so we can manipulate it.
+	b := bytes.NewBuffer(make([]byte, 0, src.Buffer().Len()))
+
+	// get the compressor and decompressor for the response based on the content type.
+	compressor, decompressor, err := getResponseCompressorDecompressor(src.Header())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// decompress the response body into b.
+	if err := decompressor(b, src.Buffer()); err != nil {
+		return trace.Wrap(err)
+	}
+	// filter.FilterBuffer encodes the filtered payload into src.Buffer, so we need to
+	// reset it to discard the old payload.
+	src.Buffer().Reset()
+	// creates a compressor that writes the filtered payload into src.Buffer.
+	comp := compressor(src.Buffer())
+	// Close is a no-op operation into src but it's required to put the gzip writer
+	// into the sync.Pool.
+	defer comp.Close()
+	return trace.Wrap(filter.FilterBuffer(b.Bytes(), comp))
+}
diff --git a/lib/kube/proxy/resource_filters_test.go b/lib/kube/proxy/resource_filters_test.go
new file mode 100644
index 0000000000000..fb196493f1b5f
--- /dev/null
+++ b/lib/kube/proxy/resource_filters_test.go
@@ -0,0 +1,254 @@
+// Copyright 2022 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package proxy
+
+import (
+	"bytes"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"path"
+	"path/filepath"
+	"testing"
+	"text/template"
+
+	"github.com/gravitational/trace"
+	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/exp/slices"
+	appsv1 "k8s.io/api/apps/v1"
+	batchv1 "k8s.io/api/batch/v1"
+	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	authv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/kube/proxy/responsewriters"
+)
+
+func Test_filterBuffer(t *testing.T) {
+	log := logrus.New()
+	type objectAndAPI struct {
+		obj string
+		api string
+	}
+	teleToKubeResource := map[string]objectAndAPI{
+		types.KindKubePod:                   {obj: "Pod", api: "v1"},
+		types.KindKubeSecret:                {obj: "Secret", api: "v1"},
+		types.KindKubeConfigmap:             {obj: "ConfigMap", api: "v1"},
+		types.KindKubeService:               {obj: "Service", api: "v1"},
+		types.KindKubeServiceAccount:        {obj: "ServiceAccount", api: "v1"},
+		types.KindKubePersistentVolumeClaim: {obj: "PersistentVolumeClaim", api: "v1"},
+		types.KindKubeDeployment:            {obj: "Deployment", api: "apps/v1"},
+		types.KindKubeReplicaSet:            {obj: "ReplicaSet", api: "apps/v1"},
+		types.KindKubeStatefulset:           {obj: "StatefulSet", api: "apps/v1"},
+		types.KindKubeDaemonSet:             {obj: "DaemonSet", api: "apps/v1"},
+		types.KindKubeRole:                  {obj: "Role", api: "rbac.authorization.k8s.io/v1"},
+		types.KindKubeRoleBinding:           {obj: "RoleBinding", api: "rbac.authorization.k8s.io/v1"},
+		types.KindKubeCronjob:               {obj: "CronJob", api: "batch/v1"},
+		types.KindKubeJob:                   {obj: "Job", api: "batch/v1"},
+		types.KindKubeIngress:               {obj: "Ingress", api: "networking.k8s.io/v1"},
+	}
+
+	_, decoder, err := newEncoderAndDecoderForContentType(responsewriters.DefaultContentType, newClientNegotiator())
+	require.NoError(t, err)
+
+	type args struct {
+		contentEncoding string
+		dataFile        string
+	}
+	tests := []struct {
+		name string
+		args args
+		want []string
+	}{
+		{
+			name: "resource list compressed with gzip",
+			args: args{
+				dataFile:        "testing/data/resources_list.tmpl",
+				contentEncoding: "gzip",
+			},
+			want: []string{
+				"default/nginx-deployment-6595874d85-6j2zm",
+				"default/nginx-deployment-6595874d85-7xgmb",
+				"default/nginx-deployment-6595874d85-c4kz8",
+			},
+		},
+		{
+			name: "resource list uncompressed",
+			args: args{
+				dataFile:        "testing/data/resources_list.tmpl",
+				contentEncoding: "",
+			},
+			want: []string{
+				"default/nginx-deployment-6595874d85-6j2zm",
+				"default/nginx-deployment-6595874d85-7xgmb",
+				"default/nginx-deployment-6595874d85-c4kz8",
+			},
+		},
+		{
+			name: "table response compressed with gzip",
+			args: args{
+				dataFile:        "testing/data/partial_table.json",
+				contentEncoding: "gzip",
+			},
+			want: []string{
+				"default/kubernetes",
+			},
+		},
+		{
+			name: "table response uncompressed",
+			args: args{
+				dataFile:        "testing/data/partial_table.json",
+				contentEncoding: "",
+			},
+			want: []string{
+				"default/kubernetes",
+			},
+		},
+	}
+	for _, tt := range tests {
+		for _, r := range types.KubernetesResourcesKinds {
+			if slices.Contains(types.KubernetesClusterWideResourceKinds, r) {
+				continue
+			}
+			r := r
+			tt := tt
+			allowedResources := []types.KubernetesResource{
+				{
+					Kind:      r,
+					Namespace: "default",
+					Name:      "*",
+				},
+			}
+			t.Run(fmt.Sprintf("%s %s", r, tt.name), func(t *testing.T) {
+				t.Parallel()
+				temp, err := template.ParseFiles(tt.args.dataFile)
+				require.NoError(t, err)
+				data := &bytes.Buffer{}
+				name := filepath.Base(tt.args.dataFile)
+				err = temp.ExecuteTemplate(data, name, map[string]interface{}{
+					"Kind": teleToKubeResource[r].obj,
+					"API":  teleToKubeResource[r].api,
+				},
+				)
+				require.NoError(t, err)
+
+				buf, decompress := newMemoryResponseWriter(t, data.Bytes(), tt.args.contentEncoding)
+
+				err = filterBuffer(newResourceFilterer(r, allowedResources, nil, log), buf)
+				require.NoError(t, err)
+
+				// Decompress the buffer to compare the result.
+				decompressedBuf := bytes.NewBuffer(nil)
+
+				err = decompress(decompressedBuf, buf.Buffer())
+				require.NoError(t, err)
+				obj, _, err := decoder.Decode(decompressedBuf.Bytes(), nil, nil)
+				require.NoError(t, err)
+				var resources []string
+				switch o := obj.(type) {
+				case *corev1.SecretList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *appsv1.DeploymentList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *appsv1.DaemonSetList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *appsv1.StatefulSetList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *authv1.RoleBindingList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *batchv1.CronJobList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *batchv1.JobList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *corev1.PodList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *corev1.ConfigMapList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *corev1.ServiceAccountList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *appsv1.ReplicaSetList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *corev1.ServiceList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *corev1.PersistentVolumeClaimList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *authv1.RoleList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *networkingv1.IngressList:
+					resources = collectResourcesFromResponse(arrayToPointerArray(o.Items))
+				case *metav1.Table:
+					for i := range o.Rows {
+						row := &(o.Rows[i])
+						if row.Object.Object == nil {
+							var err error
+							// decode only if row.Object.Object was not decoded before.
+							row.Object.Object, err = decodeAndSetGVK(decoder, row.Object.Raw)
+							require.NoError(t, err)
+						}
+
+						resource, err := getKubeResourcePartialMetadataObject(r, row.Object.Object)
+						require.NoError(t, err)
+						resources = append(resources, resource.Namespace+"/"+resource.Name)
+					}
+				default:
+					t.Errorf("filterBuffer() = %v (%T)", obj, obj)
+				}
+				require.ElementsMatch(t, tt.want, resources)
+			})
+		}
+	}
+}
+
+func collectResourcesFromResponse[T kubeObjectInterface](originalList []T) []string {
+	resources := make([]string, 0, len(originalList))
+	for _, resource := range originalList {
+		resources = append(resources, path.Join(resource.GetNamespace(), resource.GetName()))
+	}
+	return resources
+}
+
+func newMemoryResponseWriter(t *testing.T, payload []byte, contentEncoding string) (*responsewriters.MemoryResponseWriter, decompressionFunc) {
+	buf := responsewriters.NewMemoryResponseWriter()
+	buf.Header().Set(contentEncodingHeader, contentEncoding)
+	buf.Header().Set(responsewriters.ContentTypeHeader, responsewriters.DefaultContentType)
+
+	switch contentEncoding {
+	case "gzip":
+		w, err := gzip.NewWriterLevel(buf, defaultGzipContentEncodingLevel)
+		require.NoError(t, err)
+		defer w.Close()
+		defer w.Flush()
+		_, err = w.Write(payload)
+		require.NoError(t, err)
+		return buf, func(dst io.Writer, src io.Reader) error {
+			gzr, err := gzip.NewReader(src)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			defer gzr.Close()
+			_, err = io.Copy(dst, gzr)
+			return trace.Wrap(err)
+		}
+	default:
+		buf.Write(payload)
+		return buf, func(dst io.Writer, src io.Reader) error {
+			_, err := io.Copy(dst, src)
+			return trace.Wrap(err)
+		}
+	}
+}
diff --git a/lib/kube/proxy/pod_rbac_test.go b/lib/kube/proxy/resource_rbac_test.go
similarity index 76%
rename from lib/kube/proxy/pod_rbac_test.go
rename to lib/kube/proxy/resource_rbac_test.go
index 01dd9b99d388f..54112166367de 100644
--- a/lib/kube/proxy/pod_rbac_test.go
+++ b/lib/kube/proxy/resource_rbac_test.go
@@ -22,7 +22,7 @@ import (
 	"io"
 	"mime"
 	"net/http"
-	"path/filepath"
+	"path"
 	"strings"
 	"sync"
 	"testing"
@@ -33,6 +33,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
+	authv1 "k8s.io/api/rbac/v1"
 	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -51,6 +52,7 @@ func TestListPodRBAC(t *testing.T) {
 		usernameWithFullAccess      = "full_user"
 		usernameWithNamespaceAccess = "default_user"
 		usernameWithLimitedAccess   = "limited_user"
+		usernameWithDenyRule        = "denied_user"
 		testPodName                 = "test"
 	)
 	// kubeMock is a Kubernetes API mock for the session tests.
@@ -141,6 +143,39 @@ func TestListPodRBAC(t *testing.T) {
 		},
 	)
 
+	// create a user allowed to access all namespaces except the default namespace.
+	// (kubernetes_user and kubernetes_groups specified)
+	userWithDenyRule, _ := testCtx.CreateUserAndRole(
+		testCtx.Context,
+		t,
+		usernameWithDenyRule,
+		RoleSpec{
+			Name:       usernameWithDenyRule,
+			KubeUsers:  roleKubeUsers,
+			KubeGroups: roleKubeGroups,
+			SetupRoleFunc: func(r types.Role) {
+				r.SetKubeResources(types.Allow,
+					[]types.KubernetesResource{
+						{
+							Kind:      types.KindKubePod,
+							Name:      types.Wildcard,
+							Namespace: types.Wildcard,
+						},
+					},
+				)
+				r.SetKubeResources(types.Deny,
+					[]types.KubernetesResource{
+						{
+							Kind:      types.KindKubePod,
+							Name:      types.Wildcard,
+							Namespace: metav1.NamespaceDefault,
+						},
+					},
+				)
+			},
+		},
+	)
+
 	type args struct {
 		user      types.User
 		namespace string
@@ -234,6 +269,26 @@ func TestListPodRBAC(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "list pods in every namespace for user with default namespace deny rule",
+			args: args{
+				user: userWithDenyRule,
+			},
+			want: want{
+				listPodsResult: []string{
+					"dev/nginx-1",
+					"dev/nginx-2",
+				},
+				getTestPodResult: &kubeerrors.StatusError{
+					ErrStatus: metav1.Status{
+						Status:  "Failure",
+						Message: "pods \"test\" is forbidden: User \"denied_user\" cannot get resource \"pods\" in API group \"\" in the namespace \"default\"",
+						Code:    403,
+						Reason:  metav1.StatusReasonForbidden,
+					},
+				},
+			},
+		},
 		{
 			name: "list default namespace pods for user with limited access and a resource access request",
 			args: args{
@@ -295,7 +350,13 @@ func TestListPodRBAC(t *testing.T) {
 			},
 		},
 	}
-
+	getPodsFromPodList := func(items []corev1.Pod) []string {
+		pods := make([]string, 0, len(items))
+		for _, item := range items {
+			pods = append(pods, path.Join(item.Namespace, item.Name))
+		}
+		return pods
+	}
 	for _, tt := range tests {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
@@ -332,14 +393,6 @@ func TestListPodRBAC(t *testing.T) {
 	}
 }
 
-func getPodsFromPodList(items []corev1.Pod) []string {
-	pods := make([]string, 0, len(items))
-	for _, item := range items {
-		pods = append(pods, filepath.Join(item.Namespace, item.Name))
-	}
-	return pods
-}
-
 func TestWatcherResponseWriter(t *testing.T) {
 	defaultNamespace := "default"
 	devNamespace := "dev"
@@ -453,7 +506,7 @@ func TestWatcherResponseWriter(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			userReader, userWriter := io.Pipe()
 			negotiator := newClientNegotiator()
-			filterWrapper := newPodFilterer(tt.args.allowed, tt.args.denied, log)
+			filterWrapper := newResourceFilterer(types.KindKubePod, tt.args.allowed, tt.args.denied, log)
 			// watcher parses the data written into itself and if the user is allowed to
 			// receive the update, it writes the event into target.
 			watcher, err := responsewriters.NewWatcherResponseWriter(newFakeResponseWriter(userWriter) /*target*/, negotiator, filterWrapper)
@@ -826,3 +879,193 @@ func TestDeletePodCollectionRBAC(t *testing.T) {
 	}
 	require.Empty(t, kubeMock.DeletedPods(""), "a request as received without metav1.DeleteOptions.Preconditions.UID")
 }
+
+func TestListClusterRoleRBAC(t *testing.T) {
+	const (
+		usernameWithFullAccess    = "full_user"
+		usernameWithLimitedAccess = "limited_user"
+		testPodName               = "test"
+	)
+	// kubeMock is a Kubernetes API mock for the session tests.
+	// Once a new session is created, this mock will write to
+	// stdout and stdin (if available) the pod name, followed
+	// by copying the contents of stdin into both streams.
+	kubeMock, err := testingkubemock.NewKubeAPIMock()
+	require.NoError(t, err)
+	t.Cleanup(func() { kubeMock.Close() })
+
+	// creates a Kubernetes service with a configured cluster pointing to mock api server
+	testCtx := SetupTestContext(
+		context.Background(),
+		t,
+		TestConfig{
+			Clusters: []KubeClusterConfig{{Name: kubeCluster, APIEndpoint: kubeMock.URL}},
+		},
+	)
+	// close tests
+	t.Cleanup(func() { require.NoError(t, testCtx.Close()) })
+
+	// create a user with full access to kubernetes Pods.
+	// (kubernetes_user and kubernetes_groups specified)
+	userWithFullAccess, _ := testCtx.CreateUserAndRole(
+		testCtx.Context,
+		t,
+		usernameWithFullAccess,
+		RoleSpec{
+			Name:       usernameWithFullAccess,
+			KubeUsers:  roleKubeUsers,
+			KubeGroups: roleKubeGroups,
+
+			SetupRoleFunc: func(r types.Role) {
+				r.SetKubeResources(types.Allow, []types.KubernetesResource{
+					{
+						Kind: types.KindKubeClusterRole,
+						Name: types.Wildcard,
+					},
+				})
+			},
+		},
+	)
+
+	// create a moderator user with access to kubernetes
+	// (kubernetes_user and kubernetes_groups specified)
+	userWithLimitedAccess, _ := testCtx.CreateUserAndRole(
+		testCtx.Context,
+		t,
+		usernameWithLimitedAccess,
+		RoleSpec{
+			Name:       usernameWithLimitedAccess,
+			KubeUsers:  roleKubeUsers,
+			KubeGroups: roleKubeGroups,
+			SetupRoleFunc: func(r types.Role) {
+				r.SetKubeResources(types.Allow,
+					[]types.KubernetesResource{
+						{
+							Kind: types.KindKubeClusterRole,
+							Name: "nginx-*",
+						},
+					},
+				)
+			},
+		},
+	)
+
+	type args struct {
+		user types.User
+		opts []GenTestKubeClientTLSCertOptions
+	}
+	type want struct {
+		listClusterRolesResult []string
+		getTestResult          error
+	}
+	tests := []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "list cluster roles for user with full access",
+			args: args{
+				user: userWithFullAccess,
+			},
+			want: want{
+				listClusterRolesResult: []string{
+					"nginx-1",
+					"nginx-2",
+					"test",
+				},
+			},
+		},
+		{
+			name: "list cluster roles for user with limited access",
+			args: args{
+				user: userWithLimitedAccess,
+			},
+			want: want{
+				listClusterRolesResult: []string{
+					"nginx-1",
+					"nginx-2",
+				},
+				getTestResult: &kubeerrors.StatusError{
+					ErrStatus: metav1.Status{
+						Status:  "Failure",
+						Message: "clusterroles \"test\" is forbidden: User \"limited_user\" cannot get resource \"clusterroles\" in API group \"rbac.authorization.k8s.io\"",
+						Code:    403,
+						Reason:  metav1.StatusReasonForbidden,
+					},
+				},
+			},
+		},
+
+		{
+			name: "user with cluster role access request that no longer fullfills the role requirements",
+			args: args{
+				user: userWithLimitedAccess,
+				opts: []GenTestKubeClientTLSCertOptions{
+					WithResourceAccessRequests(
+						types.ResourceID{
+							ClusterName:     testCtx.ClusterName,
+							Kind:            types.KindKubePod,
+							Name:            kubeCluster,
+							SubResourceName: fmt.Sprintf("%s/%s", metav1.NamespaceDefault, testPodName),
+						},
+					),
+				},
+			},
+			want: want{
+				listClusterRolesResult: []string{},
+				getTestResult: &kubeerrors.StatusError{
+					ErrStatus: metav1.Status{
+						Status:  "Failure",
+						Message: "clusterroles \"test\" is forbidden: User \"limited_user\" cannot get resource \"clusterroles\" in API group \"rbac.authorization.k8s.io\"",
+						Code:    403,
+						Reason:  metav1.StatusReasonForbidden,
+					},
+				},
+			},
+		},
+	}
+
+	getClusterRolesFromList := func(items []authv1.ClusterRole) []string {
+		clusterroles := make([]string, 0, len(items))
+		for _, item := range items {
+			clusterroles = append(clusterroles, item.Name)
+		}
+		return clusterroles
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			// generate a kube client with user certs for auth
+			client, _ := testCtx.GenTestKubeClientTLSCert(
+				t,
+				tt.args.user.GetName(),
+				kubeCluster,
+				tt.args.opts...,
+			)
+
+			rsp, err := client.RbacV1().ClusterRoles().List(
+				testCtx.Context,
+				metav1.ListOptions{},
+			)
+			require.NoError(t, err)
+
+			require.Equal(t, tt.want.listClusterRolesResult, getClusterRolesFromList(rsp.Items))
+
+			_, err = client.RbacV1().ClusterRoles().Get(
+				testCtx.Context,
+				testPodName,
+				metav1.GetOptions{},
+			)
+
+			if tt.want.getTestResult == nil {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.want.getTestResult.Error())
+			}
+		})
+	}
+}
diff --git a/lib/kube/proxy/responsewriters/filters.go b/lib/kube/proxy/responsewriters/filters.go
index 73ff1d3992182..7670c183ef43f 100644
--- a/lib/kube/proxy/responsewriters/filters.go
+++ b/lib/kube/proxy/responsewriters/filters.go
@@ -27,9 +27,10 @@ type FilterObj interface {
 	// FilterObj receives a runtime.Object type and filters the resources on it
 	// based on allowed and denied rules.
 	// After filtering them, the obj is manipulated to hold the filtered information.
-	// The boolean returned indicates if the client is allowed to receive the event
+	// The isAllowed boolean returned indicates if the client is allowed to receive the event
 	// with the object.
-	FilterObj(runtime.Object) (bool, error)
+	// The isListObj boolean returned indicates if the object is a list of resources.
+	FilterObj(obj runtime.Object) (isAllowed bool, isListObj bool, err error)
 }
 
 // FilterBuffer is the interface a Kubernetes Resource response filter must implement.
diff --git a/lib/kube/proxy/responsewriters/memory_response.go b/lib/kube/proxy/responsewriters/memory_response.go
index 2b4214b811404..88540a9e60d9c 100644
--- a/lib/kube/proxy/responsewriters/memory_response.go
+++ b/lib/kube/proxy/responsewriters/memory_response.go
@@ -19,9 +19,10 @@ import (
 	"net/http"
 	"strconv"
 
-	"github.com/gravitational/oxy/forward"
 	"github.com/gravitational/trace"
 	"golang.org/x/exp/maps"
+
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 )
 
 // NewMemoryResponseWriter creates a MemoryResponseWriter that satisfies
@@ -92,6 +93,6 @@ func (f *MemoryResponseWriter) CopyInto(dst http.ResponseWriter) error {
 // includes the size of the response with the excluded resources.
 // For the "Content-Length" header, we replace the value with the new body size.
 func copyHeader(dst, src http.Header, contentLength int) {
-	src.Set(forward.ContentLength, strconv.Itoa(contentLength))
+	src.Set(reverseproxy.ContentLength, strconv.Itoa(contentLength))
 	maps.Copy(dst, src)
 }
diff --git a/lib/kube/proxy/responsewriters/watcher.go b/lib/kube/proxy/responsewriters/watcher.go
index ef6cbcc7115f9..c2db48f0d87ed 100644
--- a/lib/kube/proxy/responsewriters/watcher.go
+++ b/lib/kube/proxy/responsewriters/watcher.go
@@ -235,7 +235,7 @@ func (w *WatcherResponseWriter) watchDecoder(contentType string, writer io.Write
 			if filter != nil {
 				// check if the event object matches the filtering criteria.
 				// If it does not match, ignore the event.
-				publish, err := filter.FilterObj(obj)
+				publish, _, err := filter.FilterObj(obj)
 				if err != nil {
 					return trace.Wrap(err)
 				}
diff --git a/lib/kube/proxy/self_subject_reviews.go b/lib/kube/proxy/self_subject_reviews.go
index 33556e11a1a14..900b5a5d17e01 100644
--- a/lib/kube/proxy/self_subject_reviews.go
+++ b/lib/kube/proxy/self_subject_reviews.go
@@ -20,13 +20,12 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"strings"
+	"path"
 
 	"github.com/gravitational/trace"
 	"github.com/julienschmidt/httprouter"
 	semconv "go.opentelemetry.io/otel/semconv/v1.4.0"
 	oteltrace "go.opentelemetry.io/otel/trace"
-	"golang.org/x/exp/slices"
 	authv1 "k8s.io/api/authorization/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 
@@ -115,13 +114,18 @@ func (f *Forwarder) validateSelfSubjectAccessReview(actx *authContext, w http.Re
 	}
 
 	namespace := accessReview.Spec.ResourceAttributes.Namespace
-	resource := depluralizeResource(accessReview.Spec.ResourceAttributes.Resource)
-	name := accessReview.Spec.ResourceAttributes.Name
+	resource := getResourceWithKey(
+		allowedResourcesKey{
+			apiGroup:     accessReview.Spec.ResourceAttributes.Group,
+			resourceKind: accessReview.Spec.ResourceAttributes.Resource,
+		},
+	)
 	// If the request is for a resource that Teleport does not support, return
 	// nil and let the Kubernetes API server handle the request.
-	if !slices.Contains(types.KubernetesResourcesKinds, resource) {
+	if resource == "" {
 		return nil
 	}
+	name := accessReview.Spec.ResourceAttributes.Name
 
 	authPref, err := f.cfg.CachingAuthClient.GetAuthPreference(req.Context())
 	if err != nil {
@@ -146,16 +150,28 @@ func (f *Forwarder) validateSelfSubjectAccessReview(actx *authContext, w http.Re
 	case errors.Is(err, services.ErrTrustedDeviceRequired):
 		return trace.Wrap(err)
 	case err != nil:
+		namespaceNameToString := func(namespace, name string) string {
+			switch {
+			case namespace == "" && name == "":
+				return ""
+			case namespace != "" && name != "":
+				return path.Join(namespace, name)
+			case namespace != "":
+				return path.Join(namespace, "*")
+			default:
+				return path.Join("*", name)
+			}
+		}
 		accessReview.Status = authv1.SubjectAccessReviewStatus{
 			Allowed: false,
 			Denied:  true,
 			Reason: fmt.Sprintf(
-				"access to %s %s/%s denied by Teleport: please ensure that %q field in your Teleport role defines access to the desired resource.\n\n"+
+				"access to %s %s denied by Teleport: please ensure that %q field in your Teleport role defines access to the desired resource.\n\n"+
 					"Valid example:\n"+
 					"kubernetes_resources:\n"+
 					"- kind: %s\n"+
 					"  name: %s\n"+
-					"  namespace: %s\n", resource, namespace, name, kubernetesResourcesKey, resource, emptyOrWildcard(name), emptyOrWildcard(namespace)),
+					"  namespace: %s\n", accessReview.Spec.ResourceAttributes.Resource, namespaceNameToString(namespace, name), kubernetesResourcesKey, resource, emptyOrWildcard(name), emptyOrWildcard(namespace)),
 		}
 
 		responsewriters.SetContentTypeHeader(w, req.Header)
@@ -199,14 +215,6 @@ func parseSelfSubjectAccessReviewRequest(decoder runtime.Decoder, req *http.Requ
 	}
 }
 
-// depluralizeResource returns the singular form of the resource if it is plural.
-func depluralizeResource(resource string) string {
-	if strings.HasSuffix(resource, "s") {
-		return resource[:len(resource)-1]
-	}
-	return resource
-}
-
 // kubernetesResourceMatcher matches a role against a Kubernetes Resource.
 // This matcher is different form services.KubernetesResourceMatcher because
 // if skips some validations if the user doesn't ask for a specific resource.
diff --git a/lib/kube/proxy/self_subject_reviews_test.go b/lib/kube/proxy/self_subject_reviews_test.go
index a9bc815ff02e6..d65260f97500c 100644
--- a/lib/kube/proxy/self_subject_reviews_test.go
+++ b/lib/kube/proxy/self_subject_reviews_test.go
@@ -206,13 +206,14 @@ func TestSelfSubjectAccessReviewsRBAC(t *testing.T) {
 				user.GetName(),
 				kubeCluster,
 			)
-
+			resource, apiGroup := getKubeResourceAndAPIGroupFromType(tt.args.kind)
 			rsp, err := client.AuthorizationV1().SelfSubjectAccessReviews().Create(
 				context.TODO(),
 				&authv1.SelfSubjectAccessReview{
 					Spec: authv1.SelfSubjectAccessReviewSpec{
 						ResourceAttributes: &authv1.ResourceAttributes{
-							Resource:  pluralize(tt.args.kind),
+							Resource:  resource,
+							Group:     apiGroup,
 							Name:      tt.args.name,
 							Namespace: tt.args.namespace,
 							Verb:      "list",
diff --git a/lib/kube/proxy/sess.go b/lib/kube/proxy/sess.go
index b5f5402769868..aba9fc4352b32 100644
--- a/lib/kube/proxy/sess.go
+++ b/lib/kube/proxy/sess.go
@@ -31,6 +31,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/julienschmidt/httprouter"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/slices"
 	"k8s.io/client-go/tools/remotecommand"
 
 	"github.com/gravitational/teleport"
@@ -556,7 +557,7 @@ func (s *session) launch() error {
 			Protocol:   events.EventProtocolKube,
 		},
 		TerminalSize:              termParams.Serialize(),
-		KubernetesClusterMetadata: s.ctx.eventClusterMeta(),
+		KubernetesClusterMetadata: s.ctx.eventClusterMeta(s.req),
 		KubernetesPodMetadata:     eventPodMeta,
 		InitialCommand:            q["command"],
 		SessionRecording:          s.ctx.recordingConfig.GetMode(),
@@ -655,7 +656,7 @@ func (s *session) lockedSetupLaunch(request *remoteCommandRequest, q url.Values,
 				},
 				UserMetadata:              s.ctx.eventUserMeta(),
 				TerminalSize:              params.Serialize(),
-				KubernetesClusterMetadata: s.ctx.eventClusterMeta(),
+				KubernetesClusterMetadata: s.ctx.eventClusterMeta(s.req),
 				KubernetesPodMetadata:     eventPodMeta,
 			}
 
@@ -769,7 +770,7 @@ func (s *session) lockedSetupLaunch(request *remoteCommandRequest, q url.Values,
 			CommandMetadata: apievents.CommandMetadata{
 				Command: strings.Join(request.cmd, " "),
 			},
-			KubernetesClusterMetadata: s.ctx.eventClusterMeta(),
+			KubernetesClusterMetadata: s.ctx.eventClusterMeta(s.req),
 			KubernetesPodMetadata:     eventPodMeta,
 		}
 
@@ -817,7 +818,7 @@ func (s *session) lockedSetupLaunch(request *remoteCommandRequest, q url.Values,
 			Participants:              s.allParticipants(),
 			StartTime:                 sessionStart,
 			EndTime:                   s.forwarder.cfg.Clock.Now().UTC(),
-			KubernetesClusterMetadata: s.ctx.eventClusterMeta(),
+			KubernetesClusterMetadata: s.ctx.eventClusterMeta(s.req),
 			KubernetesPodMetadata:     eventPodMeta,
 			InitialCommand:            request.cmd,
 			SessionRecording:          s.ctx.recordingConfig.GetMode(),
@@ -840,7 +841,7 @@ func (s *session) join(p *party) error {
 		}
 
 		modes := s.accessEvaluator.CanJoin(accessContext)
-		if !auth.SliceContainsMode(modes, p.Mode) {
+		if !slices.Contains(modes, p.Mode) {
 			return trace.AccessDenied("insufficient permissions to join session")
 		}
 	}
diff --git a/lib/kube/proxy/testing/data/partial_table.json b/lib/kube/proxy/testing/data/partial_table.json
new file mode 100644
index 0000000000000..b0aa462c7406d
--- /dev/null
+++ b/lib/kube/proxy/testing/data/partial_table.json
@@ -0,0 +1,403 @@
+{
+  "kind": "Table",
+  "apiVersion": "meta.k8s.io/v1",
+  "metadata": {
+    "resourceVersion": "1306304"
+  },
+  "columnDefinitions": [
+    {
+      "name": "Name",
+      "type": "string",
+      "format": "name",
+      "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names",
+      "priority": 0
+    },
+    {
+      "name": "Type",
+      "type": "string",
+      "format": "",
+      "description": "type determines how the Service is exposed. Defaults to ClusterIP. Valid options are ExternalName, ClusterIP, NodePort, and LoadBalancer. \"ClusterIP\" allocates a cluster-internal IP address for load-balancing to endpoints. Endpoints are determined by the selector or if that is not specified, by manual construction of an Endpoints object or EndpointSlice objects. If clusterIP is \"None\", no virtual IP is allocated and the endpoints are published as a set of endpoints rather than a virtual IP. \"NodePort\" builds on ClusterIP and allocates a port on every node which routes to the same endpoints as the clusterIP. \"LoadBalancer\" builds on NodePort and creates an external load-balancer (if supported in the current cloud) which routes to the same endpoints as the clusterIP. \"ExternalName\" aliases this service to the specified externalName. Several other fields do not apply to ExternalName services. More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types",
+      "priority": 0
+    },
+    {
+      "name": "Cluster-IP",
+      "type": "string",
+      "format": "",
+      "description": "clusterIP is the IP address of the service and is usually assigned randomly. If an address is specified manually, is in-range (as per system configuration), and is not in use, it will be allocated to the service; otherwise creation of the service will fail. This field may not be changed through updates unless the type field is also being changed to ExternalName (which requires this field to be blank) or the type field is being changed from ExternalName (in which case this field may optionally be specified, as describe above).  Valid values are \"None\", empty string (\"\"), or a valid IP address. Setting this to \"None\" makes a \"headless service\" (no virtual IP), which is useful when direct endpoint connections are preferred and proxying is not required.  Only applies to types ClusterIP, NodePort, and LoadBalancer. If this field is specified when creating a Service of type ExternalName, creation will fail. This field will be wiped when updating a Service to type ExternalName. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies",
+      "priority": 0
+    },
+    {
+      "name": "External-IP",
+      "type": "string",
+      "format": "",
+      "description": "externalIPs is a list of IP addresses for which nodes in the cluster will also accept traffic for this service.  These IPs are not managed by Kubernetes.  The user is responsible for ensuring that traffic arrives at a node with this IP.  A common example is external load-balancers that are not part of the Kubernetes system.",
+      "priority": 0
+    },
+    {
+      "name": "Port(s)",
+      "type": "string",
+      "format": "",
+      "description": "The list of ports that are exposed by this service. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies",
+      "priority": 0
+    },
+    {
+      "name": "Age",
+      "type": "string",
+      "format": "",
+      "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+      "priority": 0
+    },
+    {
+      "name": "Selector",
+      "type": "string",
+      "format": "",
+      "description": "Route service traffic to pods with label keys and values matching this selector. If empty or not present, the service is assumed to have an external process managing its endpoints, which Kubernetes will not modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. Ignored if type is ExternalName. More info: https://kubernetes.io/docs/concepts/services-networking/service/",
+      "priority": 1
+    }
+  ],
+  "rows": [
+    {
+      "cells": [
+        "kubernetes",
+        "ClusterIP",
+        "10.43.0.1",
+        "\u003cnone\u003e",
+        "443/TCP",
+        "104d",
+        "\u003cnone\u003e"
+      ],
+      "object": {
+        "kind": "PartialObjectMetadata",
+        "apiVersion": "meta.k8s.io/v1",
+        "metadata": {
+          "name": "kubernetes",
+          "namespace": "default",
+          "uid": "ac504cf9-ee0b-46c9-b999-776a3c81416c",
+          "resourceVersion": "191",
+          "creationTimestamp": "2023-02-10T16:00:11Z",
+          "labels": {
+            "component": "apiserver",
+            "provider": "kubernetes"
+          },
+          "managedFields": [
+            {
+              "manager": "k3s",
+              "operation": "Update",
+              "apiVersion": "v1",
+              "time": "2023-02-10T16:00:11Z",
+              "fieldsType": "FieldsV1",
+              "fieldsV1": {
+                "f:metadata": {
+                  "f:labels": {
+                    ".": {},
+                    "f:component": {},
+                    "f:provider": {}
+                  }
+                },
+                "f:spec": {
+                  "f:clusterIP": {},
+                  "f:internalTrafficPolicy": {},
+                  "f:ipFamilyPolicy": {},
+                  "f:ports": {
+                    ".": {},
+                    "k:{\"port\":443,\"protocol\":\"TCP\"}": {
+                      ".": {},
+                      "f:name": {},
+                      "f:port": {},
+                      "f:protocol": {},
+                      "f:targetPort": {}
+                    }
+                  },
+                  "f:sessionAffinity": {},
+                  "f:type": {}
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "cells": [
+        "kube-dns",
+        "ClusterIP",
+        "10.43.0.10",
+        "\u003cnone\u003e",
+        "53/UDP,53/TCP,9153/TCP",
+        "104d",
+        "k8s-app=kube-dns"
+      ],
+      "object": {
+        "kind": "PartialObjectMetadata",
+        "apiVersion": "meta.k8s.io/v1",
+        "metadata": {
+          "name": "kube-dns",
+          "namespace": "kube-system",
+          "uid": "cf3250e0-a75b-472e-bc61-1da279f30c93",
+          "resourceVersion": "257",
+          "creationTimestamp": "2023-02-10T16:00:14Z",
+          "labels": {
+            "k8s-app": "kube-dns",
+            "kubernetes.io/cluster-service": "true",
+            "kubernetes.io/name": "CoreDNS",
+            "objectset.rio.cattle.io/hash": "bce283298811743a0386ab510f2f67ef74240c57"
+          },
+          "annotations": {
+            "objectset.rio.cattle.io/applied": "H4sIAAAAAAAA/4yRwY7TMBCGXwXN2Qlx026zljig3QtCQistcEEcHGdKTRKP5ZkWoSrvjtxmRWEV2Fui+fzpn39OYKP/jIk9BTBw1KCg96EDA4+Yjt4hKBhRbGfFgjmBDYHEiqfA+Zfa7+iEUcrkqXRWZMDS02ufDaAW5/QjYCq+HXsw0Nd8NTlq9eq9D92bt11H4b+KYEcEA44SdoFfhHO0Lr/pDy0W/JMFR1AQE40oezxwpiMlAQO3elM/m7FLNmaBpAPCpGCwLQ7nOvqGCxvjk/ySKH+mgILn1244sGAqeK531vyNzXvdUcL7D4//2GtveQ8GWoerpl7dNo3W23Vtq7q5se1GV7vV7maLu+16ta7cZpvzzu6riEu1TAo4osurzbnfPYABXZXruqxKXeVyKAmD+XJ68l6UlwY39bk9IUcDGPh0/wCTuiYLcXGJ/nj3Bz2iJO9+u/NxnvNfFTAO6ITSwkWmafoVAAD//yO4Hor3AgAA",
+            "objectset.rio.cattle.io/id": "",
+            "objectset.rio.cattle.io/owner-gvk": "k3s.cattle.io/v1, Kind=Addon",
+            "objectset.rio.cattle.io/owner-name": "coredns",
+            "objectset.rio.cattle.io/owner-namespace": "kube-system",
+            "prometheus.io/port": "9153",
+            "prometheus.io/scrape": "true"
+          },
+          "managedFields": [
+            {
+              "manager": "deploy@tiago-linux",
+              "operation": "Update",
+              "apiVersion": "v1",
+              "time": "2023-02-10T16:00:14Z",
+              "fieldsType": "FieldsV1",
+              "fieldsV1": {
+                "f:metadata": {
+                  "f:annotations": {
+                    ".": {},
+                    "f:objectset.rio.cattle.io/applied": {},
+                    "f:objectset.rio.cattle.io/id": {},
+                    "f:objectset.rio.cattle.io/owner-gvk": {},
+                    "f:objectset.rio.cattle.io/owner-name": {},
+                    "f:objectset.rio.cattle.io/owner-namespace": {},
+                    "f:prometheus.io/port": {},
+                    "f:prometheus.io/scrape": {}
+                  },
+                  "f:labels": {
+                    ".": {},
+                    "f:k8s-app": {},
+                    "f:kubernetes.io/cluster-service": {},
+                    "f:kubernetes.io/name": {},
+                    "f:objectset.rio.cattle.io/hash": {}
+                  }
+                },
+                "f:spec": {
+                  "f:clusterIP": {},
+                  "f:internalTrafficPolicy": {},
+                  "f:ports": {
+                    ".": {},
+                    "k:{\"port\":53,\"protocol\":\"TCP\"}": {
+                      ".": {},
+                      "f:name": {},
+                      "f:port": {},
+                      "f:protocol": {},
+                      "f:targetPort": {}
+                    },
+                    "k:{\"port\":53,\"protocol\":\"UDP\"}": {
+                      ".": {},
+                      "f:name": {},
+                      "f:port": {},
+                      "f:protocol": {},
+                      "f:targetPort": {}
+                    },
+                    "k:{\"port\":9153,\"protocol\":\"TCP\"}": {
+                      ".": {},
+                      "f:name": {},
+                      "f:port": {},
+                      "f:protocol": {},
+                      "f:targetPort": {}
+                    }
+                  },
+                  "f:selector": {},
+                  "f:sessionAffinity": {},
+                  "f:type": {}
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "cells": [
+        "metrics-server",
+        "ClusterIP",
+        "10.43.238.253",
+        "\u003cnone\u003e",
+        "443/TCP",
+        "104d",
+        "k8s-app=metrics-server"
+      ],
+      "object": {
+        "kind": "PartialObjectMetadata",
+        "apiVersion": "meta.k8s.io/v1",
+        "metadata": {
+          "name": "metrics-server",
+          "namespace": "kube-system",
+          "uid": "e973a7cd-5aed-4db0-abb6-4a9f9936b6b4",
+          "resourceVersion": "299",
+          "creationTimestamp": "2023-02-10T16:00:15Z",
+          "labels": {
+            "kubernetes.io/cluster-service": "true",
+            "kubernetes.io/name": "Metrics-server",
+            "objectset.rio.cattle.io/hash": "a5d3bc601c871e123fa32b27f549b6ea770bcf4a"
+          },
+          "annotations": {
+            "objectset.rio.cattle.io/applied": "H4sIAAAAAAAA/4SQQWvjMBCF/8oyZzkbx06cFexh2WMpBFp6KT2M5Umi2pGEZuJSgv97kZNCQpvmJKQ37833dAAM9okiW+9AQ5+Dgta6BjQ8UOytIVCwI8EGBUEfAJ3zgmK943T19SsZYZJJtH5iUKSjifW/bUoAdVX3b45itulb0NAWfKb0ufp1Z13z91/TeHczwuGOQCfEaA1nTLGnOB5H9ttuDmhSRLuvKeN3FtrBoKDDmrqxYxKiIyFORtPtWc5WaJC4T5sux05c9xdcP/BskbegAedNUZvFNDfLKqd8VqyxmNWzaj0v/9QLwqqa1mZdYiL8tjoc36+U4kAmVQo+CoN+PnyGbEUCgxoF0GVZKAjRize+Aw2P/1egQDBuSFbjxMkwvChg6siIj+NXLTnDEL5SDcPwEQAA//8Uey7TawIAAA",
+            "objectset.rio.cattle.io/id": "",
+            "objectset.rio.cattle.io/owner-gvk": "k3s.cattle.io/v1, Kind=Addon",
+            "objectset.rio.cattle.io/owner-name": "metrics-server-service",
+            "objectset.rio.cattle.io/owner-namespace": "kube-system"
+          },
+          "managedFields": [
+            {
+              "manager": "deploy@tiago-linux",
+              "operation": "Update",
+              "apiVersion": "v1",
+              "time": "2023-02-10T16:00:15Z",
+              "fieldsType": "FieldsV1",
+              "fieldsV1": {
+                "f:metadata": {
+                  "f:annotations": {
+                    ".": {},
+                    "f:objectset.rio.cattle.io/applied": {},
+                    "f:objectset.rio.cattle.io/id": {},
+                    "f:objectset.rio.cattle.io/owner-gvk": {},
+                    "f:objectset.rio.cattle.io/owner-name": {},
+                    "f:objectset.rio.cattle.io/owner-namespace": {}
+                  },
+                  "f:labels": {
+                    ".": {},
+                    "f:kubernetes.io/cluster-service": {},
+                    "f:kubernetes.io/name": {},
+                    "f:objectset.rio.cattle.io/hash": {}
+                  }
+                },
+                "f:spec": {
+                  "f:internalTrafficPolicy": {},
+                  "f:ports": {
+                    ".": {},
+                    "k:{\"port\":443,\"protocol\":\"TCP\"}": {
+                      ".": {},
+                      "f:name": {},
+                      "f:port": {},
+                      "f:protocol": {},
+                      "f:targetPort": {}
+                    }
+                  },
+                  "f:selector": {},
+                  "f:sessionAffinity": {},
+                  "f:type": {}
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "cells": [
+        "traefik",
+        "LoadBalancer",
+        "10.43.175.231",
+        "192.168.1.219",
+        "80:31715/TCP,443:30989/TCP",
+        "104d",
+        "app.kubernetes.io/instance=traefik-kube-system,app.kubernetes.io/name=traefik"
+      ],
+      "object": {
+        "kind": "PartialObjectMetadata",
+        "apiVersion": "meta.k8s.io/v1",
+        "metadata": {
+          "name": "traefik",
+          "namespace": "kube-system",
+          "uid": "50917fa4-2961-4098-b6c1-c4aa0a49e2ec",
+          "resourceVersion": "997771",
+          "creationTimestamp": "2023-02-10T16:00:40Z",
+          "labels": {
+            "app.kubernetes.io/instance": "traefik-kube-system",
+            "app.kubernetes.io/managed-by": "Helm",
+            "app.kubernetes.io/name": "traefik",
+            "helm.sh/chart": "traefik-20.3.1_up20.3.0"
+          },
+          "annotations": {
+            "meta.helm.sh/release-name": "traefik",
+            "meta.helm.sh/release-namespace": "kube-system"
+          },
+          "finalizers": [
+            "service.kubernetes.io/load-balancer-cleanup"
+          ],
+          "managedFields": [
+            {
+              "manager": "helm",
+              "operation": "Update",
+              "apiVersion": "v1",
+              "time": "2023-02-10T16:00:40Z",
+              "fieldsType": "FieldsV1",
+              "fieldsV1": {
+                "f:metadata": {
+                  "f:annotations": {
+                    ".": {},
+                    "f:meta.helm.sh/release-name": {},
+                    "f:meta.helm.sh/release-namespace": {}
+                  },
+                  "f:labels": {
+                    ".": {},
+                    "f:app.kubernetes.io/instance": {},
+                    "f:app.kubernetes.io/managed-by": {},
+                    "f:app.kubernetes.io/name": {},
+                    "f:helm.sh/chart": {}
+                  }
+                },
+                "f:spec": {
+                  "f:allocateLoadBalancerNodePorts": {},
+                  "f:externalTrafficPolicy": {},
+                  "f:internalTrafficPolicy": {},
+                  "f:ipFamilyPolicy": {},
+                  "f:ports": {
+                    ".": {},
+                    "k:{\"port\":80,\"protocol\":\"TCP\"}": {
+                      ".": {},
+                      "f:name": {},
+                      "f:port": {},
+                      "f:protocol": {},
+                      "f:targetPort": {}
+                    },
+                    "k:{\"port\":443,\"protocol\":\"TCP\"}": {
+                      ".": {},
+                      "f:name": {},
+                      "f:port": {},
+                      "f:protocol": {},
+                      "f:targetPort": {}
+                    }
+                  },
+                  "f:selector": {},
+                  "f:sessionAffinity": {},
+                  "f:type": {}
+                }
+              }
+            },
+            {
+              "manager": "k3s",
+              "operation": "Update",
+              "apiVersion": "v1",
+              "time": "2023-05-06T14:07:15Z",
+              "fieldsType": "FieldsV1",
+              "fieldsV1": {
+                "f:metadata": {
+                  "f:finalizers": {
+                    ".": {},
+                    "v:\"service.kubernetes.io/load-balancer-cleanup\"": {}
+                  }
+                },
+                "f:status": {
+                  "f:loadBalancer": {
+                    "f:ingress": {}
+                  }
+                }
+              },
+              "subresource": "status"
+            }
+          ]
+        }
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/lib/kube/proxy/testing/data/pod_list.json b/lib/kube/proxy/testing/data/pod_list.json
deleted file mode 100644
index 31b36a48fa0f9..0000000000000
--- a/lib/kube/proxy/testing/data/pod_list.json
+++ /dev/null
@@ -1,2453 +0,0 @@
-{
-    "apiVersion": "v1",
-    "items": [
-        {
-            "apiVersion": "v1",
-            "kind": "Pod",
-            "metadata": {
-                "creationTimestamp": "2023-01-02T17:13:00Z",
-                "generateName": "nginx-deployment-6595874d85-",
-                "labels": {
-                    "app": "nginx",
-                    "pod-template-hash": "6595874d85"
-                },
-                "name": "nginx-deployment-6595874d85-6j2zm",
-                "namespace": "default",
-                "ownerReferences": [
-                    {
-                        "apiVersion": "apps/v1",
-                        "blockOwnerDeletion": true,
-                        "controller": true,
-                        "kind": "ReplicaSet",
-                        "name": "nginx-deployment-6595874d85",
-                        "uid": "7064ed44-c725-48db-88e5-0b7b240bcd3b"
-                    }
-                ],
-                "resourceVersion": "6574533",
-                "uid": "93a690d5-6f15-4c4c-95d6-b74bcf1feb04"
-            },
-            "spec": {
-                "containers": [
-                    {
-                        "image": "nginx:1.14.2",
-                        "imagePullPolicy": "IfNotPresent",
-                        "name": "nginx",
-                        "ports": [
-                            {
-                                "containerPort": 80,
-                                "protocol": "TCP"
-                            }
-                        ],
-                        "resources": {},
-                        "terminationMessagePath": "/dev/termination-log",
-                        "terminationMessagePolicy": "File",
-                        "volumeMounts": [
-                            {
-                                "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
-                                "name": "kube-api-access-fbcbf",
-                                "readOnly": true
-                            }
-                        ]
-                    }
-                ],
-                "dnsPolicy": "ClusterFirst",
-                "enableServiceLinks": true,
-                "preemptionPolicy": "PreemptLowerPriority",
-                "priority": 0,
-                "restartPolicy": "Always",
-                "schedulerName": "default-scheduler",
-                "securityContext": {},
-                "serviceAccount": "default",
-                "serviceAccountName": "default",
-                "terminationGracePeriodSeconds": 30,
-                "tolerations": [
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/not-ready",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    },
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/unreachable",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    }
-                ],
-                "volumes": [
-                    {
-                        "name": "kube-api-access-fbcbf",
-                        "projected": {
-                            "defaultMode": 420,
-                            "sources": [
-                                {
-                                    "serviceAccountToken": {
-                                        "expirationSeconds": 3607,
-                                        "path": "token"
-                                    }
-                                },
-                                {
-                                    "configMap": {
-                                        "items": [
-                                            {
-                                                "key": "ca.crt",
-                                                "path": "ca.crt"
-                                            }
-                                        ],
-                                        "name": "kube-root-ca.crt"
-                                    }
-                                },
-                                {
-                                    "downwardAPI": {
-                                        "items": [
-                                            {
-                                                "fieldRef": {
-                                                    "apiVersion": "v1",
-                                                    "fieldPath": "metadata.namespace"
-                                                },
-                                                "path": "namespace"
-                                            }
-                                        ]
-                                    }
-                                }
-                            ]
-                        }
-                    }
-                ]
-            },
-            "status": {
-                "conditions": [
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-02T17:13:00Z",
-                        "status": "True",
-                        "type": "Initialized"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-18T10:39:01Z",
-                        "status": "True",
-                        "type": "Ready"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-18T10:39:01Z",
-                        "status": "True",
-                        "type": "ContainersReady"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-02T17:13:00Z",
-                        "status": "True",
-                        "type": "PodScheduled"
-                    }
-                ],
-                "containerStatuses": [
-                    {
-                        "containerID": "docker://82413eafc93e0dfaa4bb509dccde00efb21c7b2d4326df44f05292385e4c89ab",
-                        "image": "nginx:1.14.2",
-                        "imageID": "docker-pullable://nginx@sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d",
-                        "lastState": {
-                            "terminated": {
-                                "containerID": "docker://9307e8ecf54d3caa01d67b929abfc5cd1ed33f5eb5ea0b332a887a52c3c25fef",
-                                "exitCode": 0,
-                                "finishedAt": "2023-01-26T09:50:26Z",
-                                "reason": "Completed",
-                                "startedAt": "2023-01-18T10:39:00Z"
-                            }
-                        },
-                        "name": "nginx",
-                        "ready": true,
-                        "restartCount": 7,
-                        "started": true,
-                        "state": {
-                            "running": {
-                                "startedAt": "2023-01-26T09:50:45Z"
-                            }
-                        }
-                    }
-                ],
-                "hostIP": "192.168.49.2",
-                "phase": "Running",
-                "podIP": "172.17.0.3",
-                "podIPs": [
-                    {
-                        "ip": "172.17.0.3"
-                    }
-                ],
-                "qosClass": "BestEffort",
-                "startTime": "2023-01-02T17:13:00Z"
-            }
-        },
-        {
-            "apiVersion": "v1",
-            "kind": "Pod",
-            "metadata": {
-                "creationTimestamp": "2022-12-23T12:28:30Z",
-                "generateName": "nginx-deployment-6595874d85-",
-                "labels": {
-                    "app": "nginx",
-                    "pod-template-hash": "6595874d85"
-                },
-                "name": "nginx-deployment-6595874d85-7xgmb",
-                "namespace": "default",
-                "ownerReferences": [
-                    {
-                        "apiVersion": "apps/v1",
-                        "blockOwnerDeletion": true,
-                        "controller": true,
-                        "kind": "ReplicaSet",
-                        "name": "nginx-deployment-6595874d85",
-                        "uid": "7064ed44-c725-48db-88e5-0b7b240bcd3b"
-                    }
-                ],
-                "resourceVersion": "6574527",
-                "uid": "a58aa9e8-b192-4221-b2c1-d2accb19f395"
-            },
-            "spec": {
-                "containers": [
-                    {
-                        "image": "nginx:1.14.2",
-                        "imagePullPolicy": "IfNotPresent",
-                        "name": "nginx",
-                        "ports": [
-                            {
-                                "containerPort": 80,
-                                "protocol": "TCP"
-                            }
-                        ],
-                        "resources": {},
-                        "terminationMessagePath": "/dev/termination-log",
-                        "terminationMessagePolicy": "File",
-                        "volumeMounts": [
-                            {
-                                "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
-                                "name": "kube-api-access-h8d7r",
-                                "readOnly": true
-                            }
-                        ]
-                    }
-                ],
-                "dnsPolicy": "ClusterFirst",
-                "enableServiceLinks": true,
-                "preemptionPolicy": "PreemptLowerPriority",
-                "priority": 0,
-                "restartPolicy": "Always",
-                "schedulerName": "default-scheduler",
-                "securityContext": {},
-                "serviceAccount": "default",
-                "serviceAccountName": "default",
-                "terminationGracePeriodSeconds": 30,
-                "tolerations": [
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/not-ready",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    },
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/unreachable",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    }
-                ],
-                "volumes": [
-                    {
-                        "name": "kube-api-access-h8d7r",
-                        "projected": {
-                            "defaultMode": 420,
-                            "sources": [
-                                {
-                                    "serviceAccountToken": {
-                                        "expirationSeconds": 3607,
-                                        "path": "token"
-                                    }
-                                },
-                                {
-                                    "configMap": {
-                                        "items": [
-                                            {
-                                                "key": "ca.crt",
-                                                "path": "ca.crt"
-                                            }
-                                        ],
-                                        "name": "kube-root-ca.crt"
-                                    }
-                                },
-                                {
-                                    "downwardAPI": {
-                                        "items": [
-                                            {
-                                                "fieldRef": {
-                                                    "apiVersion": "v1",
-                                                    "fieldPath": "metadata.namespace"
-                                                },
-                                                "path": "namespace"
-                                            }
-                                        ]
-                                    }
-                                }
-                            ]
-                        }
-                    }
-                ]
-            },
-            "status": {
-                "conditions": [
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2022-12-23T12:28:30Z",
-                        "status": "True",
-                        "type": "Initialized"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-18T10:39:04Z",
-                        "status": "True",
-                        "type": "Ready"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-18T10:39:04Z",
-                        "status": "True",
-                        "type": "ContainersReady"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2022-12-23T12:28:30Z",
-                        "status": "True",
-                        "type": "PodScheduled"
-                    }
-                ],
-                "containerStatuses": [
-                    {
-                        "containerID": "docker://588abf772e833533bee289aa23fd644e79855d2ddbda4617bec0b4e9d1d4f59d",
-                        "image": "nginx:1.14.2",
-                        "imageID": "docker-pullable://nginx@sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d",
-                        "lastState": {
-                            "terminated": {
-                                "containerID": "docker://b7fcee722cbdb5b56e6906a1bd2c8ab1dc2e95949b4db4d244408932b553d397",
-                                "exitCode": 0,
-                                "finishedAt": "2023-01-26T09:50:26Z",
-                                "reason": "Completed",
-                                "startedAt": "2023-01-18T10:39:03Z"
-                            }
-                        },
-                        "name": "nginx",
-                        "ready": true,
-                        "restartCount": 11,
-                        "started": true,
-                        "state": {
-                            "running": {
-                                "startedAt": "2023-01-26T09:50:43Z"
-                            }
-                        }
-                    }
-                ],
-                "hostIP": "192.168.49.2",
-                "phase": "Running",
-                "podIP": "172.17.0.2",
-                "podIPs": [
-                    {
-                        "ip": "172.17.0.2"
-                    }
-                ],
-                "qosClass": "BestEffort",
-                "startTime": "2022-12-23T12:28:30Z"
-            }
-        },
-        {
-            "apiVersion": "v1",
-            "kind": "Pod",
-            "metadata": {
-                "creationTimestamp": "2022-12-23T12:28:30Z",
-                "generateName": "nginx-deployment-6595874d85-",
-                "labels": {
-                    "app": "nginx",
-                    "pod-template-hash": "6595874d85"
-                },
-                "name": "nginx-deployment-6595874d85-c4kz8",
-                "namespace": "default",
-                "ownerReferences": [
-                    {
-                        "apiVersion": "apps/v1",
-                        "blockOwnerDeletion": true,
-                        "controller": true,
-                        "kind": "ReplicaSet",
-                        "name": "nginx-deployment-6595874d85",
-                        "uid": "7064ed44-c725-48db-88e5-0b7b240bcd3b"
-                    }
-                ],
-                "resourceVersion": "6574530",
-                "uid": "5dbfba7c-42a7-4db6-ad65-7694b0752ea3"
-            },
-            "spec": {
-                "containers": [
-                    {
-                        "image": "nginx:1.14.2",
-                        "imagePullPolicy": "IfNotPresent",
-                        "name": "nginx",
-                        "ports": [
-                            {
-                                "containerPort": 80,
-                                "protocol": "TCP"
-                            }
-                        ],
-                        "resources": {},
-                        "terminationMessagePath": "/dev/termination-log",
-                        "terminationMessagePolicy": "File",
-                        "volumeMounts": [
-                            {
-                                "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
-                                "name": "kube-api-access-jfr5p",
-                                "readOnly": true
-                            }
-                        ]
-                    }
-                ],
-                "dnsPolicy": "ClusterFirst",
-                "enableServiceLinks": true,
-                "preemptionPolicy": "PreemptLowerPriority",
-                "priority": 0,
-                "restartPolicy": "Always",
-                "schedulerName": "default-scheduler",
-                "securityContext": {},
-                "serviceAccount": "default",
-                "serviceAccountName": "default",
-                "terminationGracePeriodSeconds": 30,
-                "tolerations": [
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/not-ready",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    },
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/unreachable",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    }
-                ],
-                "volumes": [
-                    {
-                        "name": "kube-api-access-jfr5p",
-                        "projected": {
-                            "defaultMode": 420,
-                            "sources": [
-                                {
-                                    "serviceAccountToken": {
-                                        "expirationSeconds": 3607,
-                                        "path": "token"
-                                    }
-                                },
-                                {
-                                    "configMap": {
-                                        "items": [
-                                            {
-                                                "key": "ca.crt",
-                                                "path": "ca.crt"
-                                            }
-                                        ],
-                                        "name": "kube-root-ca.crt"
-                                    }
-                                },
-                                {
-                                    "downwardAPI": {
-                                        "items": [
-                                            {
-                                                "fieldRef": {
-                                                    "apiVersion": "v1",
-                                                    "fieldPath": "metadata.namespace"
-                                                },
-                                                "path": "namespace"
-                                            }
-                                        ]
-                                    }
-                                }
-                            ]
-                        }
-                    }
-                ]
-            },
-            "status": {
-                "conditions": [
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2022-12-23T12:28:30Z",
-                        "status": "True",
-                        "type": "Initialized"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-18T10:39:05Z",
-                        "status": "True",
-                        "type": "Ready"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-18T10:39:05Z",
-                        "status": "True",
-                        "type": "ContainersReady"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2022-12-23T12:28:30Z",
-                        "status": "True",
-                        "type": "PodScheduled"
-                    }
-                ],
-                "containerStatuses": [
-                    {
-                        "containerID": "docker://dfb6db5acf40dd4fca08384e1d2534190bb62d1dc6c7f1d988b9e9d88c3f9154",
-                        "image": "nginx:1.14.2",
-                        "imageID": "docker-pullable://nginx@sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d",
-                        "lastState": {
-                            "terminated": {
-                                "containerID": "docker://7d3008ffa0708bda4caa52d0b35bd0382523563c2c11faab1bda22bf21425569",
-                                "exitCode": 0,
-                                "finishedAt": "2023-01-26T09:50:31Z",
-                                "reason": "Completed",
-                                "startedAt": "2023-01-26T09:50:30Z"
-                            }
-                        },
-                        "name": "nginx",
-                        "ready": true,
-                        "restartCount": 11,
-                        "started": true,
-                        "state": {
-                            "running": {
-                                "startedAt": "2023-01-26T09:50:45Z"
-                            }
-                        }
-                    }
-                ],
-                "hostIP": "192.168.49.2",
-                "phase": "Running",
-                "podIP": "172.17.0.4",
-                "podIPs": [
-                    {
-                        "ip": "172.17.0.4"
-                    }
-                ],
-                "qosClass": "BestEffort",
-                "startTime": "2022-12-23T12:28:30Z"
-            }
-        },
-        {
-            "apiVersion": "v1",
-            "kind": "Pod",
-            "metadata": {
-                "creationTimestamp": "2022-08-17T15:36:12Z",
-                "generateName": "coredns-6d4b75cb6d-",
-                "labels": {
-                    "k8s-app": "kube-dns",
-                    "pod-template-hash": "6d4b75cb6d"
-                },
-                "name": "coredns-6d4b75cb6d-k84h9",
-                "namespace": "kube-system",
-                "ownerReferences": [
-                    {
-                        "apiVersion": "apps/v1",
-                        "blockOwnerDeletion": true,
-                        "controller": true,
-                        "kind": "ReplicaSet",
-                        "name": "coredns-6d4b75cb6d",
-                        "uid": "b77a13d3-0c48-4509-a308-5e7ac01577dd"
-                    }
-                ],
-                "resourceVersion": "6574544",
-                "uid": "463a633d-a90b-44e8-8f66-c25724391329"
-            },
-            "spec": {
-                "containers": [
-                    {
-                        "args": [
-                            "-conf",
-                            "/etc/coredns/Corefile"
-                        ],
-                        "image": "registry.k8s.io/coredns/coredns:v1.8.6",
-                        "imagePullPolicy": "IfNotPresent",
-                        "livenessProbe": {
-                            "failureThreshold": 5,
-                            "httpGet": {
-                                "path": "/health",
-                                "port": 8080,
-                                "scheme": "HTTP"
-                            },
-                            "initialDelaySeconds": 60,
-                            "periodSeconds": 10,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 5
-                        },
-                        "name": "coredns",
-                        "ports": [
-                            {
-                                "containerPort": 53,
-                                "name": "dns",
-                                "protocol": "UDP"
-                            },
-                            {
-                                "containerPort": 53,
-                                "name": "dns-tcp",
-                                "protocol": "TCP"
-                            },
-                            {
-                                "containerPort": 9153,
-                                "name": "metrics",
-                                "protocol": "TCP"
-                            }
-                        ],
-                        "readinessProbe": {
-                            "failureThreshold": 3,
-                            "httpGet": {
-                                "path": "/ready",
-                                "port": 8181,
-                                "scheme": "HTTP"
-                            },
-                            "periodSeconds": 10,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 1
-                        },
-                        "resources": {
-                            "limits": {
-                                "memory": "170Mi"
-                            },
-                            "requests": {
-                                "cpu": "100m",
-                                "memory": "70Mi"
-                            }
-                        },
-                        "securityContext": {
-                            "allowPrivilegeEscalation": false,
-                            "capabilities": {
-                                "add": [
-                                    "NET_BIND_SERVICE"
-                                ],
-                                "drop": [
-                                    "all"
-                                ]
-                            },
-                            "readOnlyRootFilesystem": true
-                        },
-                        "terminationMessagePath": "/dev/termination-log",
-                        "terminationMessagePolicy": "File",
-                        "volumeMounts": [
-                            {
-                                "mountPath": "/etc/coredns",
-                                "name": "config-volume",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
-                                "name": "kube-api-access-gx679",
-                                "readOnly": true
-                            }
-                        ]
-                    }
-                ],
-                "dnsPolicy": "Default",
-                "enableServiceLinks": true,
-                "nodeSelector": {
-                    "kubernetes.io/os": "linux"
-                },
-                "preemptionPolicy": "PreemptLowerPriority",
-                "priority": 2000000000,
-                "priorityClassName": "system-cluster-critical",
-                "restartPolicy": "Always",
-                "schedulerName": "default-scheduler",
-                "securityContext": {},
-                "serviceAccount": "coredns",
-                "serviceAccountName": "coredns",
-                "terminationGracePeriodSeconds": 30,
-                "tolerations": [
-                    {
-                        "key": "CriticalAddonsOnly",
-                        "operator": "Exists"
-                    },
-                    {
-                        "effect": "NoSchedule",
-                        "key": "node-role.kubernetes.io/master"
-                    },
-                    {
-                        "effect": "NoSchedule",
-                        "key": "node-role.kubernetes.io/control-plane"
-                    },
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/not-ready",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    },
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/unreachable",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    }
-                ],
-                "volumes": [
-                    {
-                        "configMap": {
-                            "defaultMode": 420,
-                            "items": [
-                                {
-                                    "key": "Corefile",
-                                    "path": "Corefile"
-                                }
-                            ],
-                            "name": "coredns"
-                        },
-                        "name": "config-volume"
-                    },
-                    {
-                        "name": "kube-api-access-gx679",
-                        "projected": {
-                            "defaultMode": 420,
-                            "sources": [
-                                {
-                                    "serviceAccountToken": {
-                                        "expirationSeconds": 3607,
-                                        "path": "token"
-                                    }
-                                },
-                                {
-                                    "configMap": {
-                                        "items": [
-                                            {
-                                                "key": "ca.crt",
-                                                "path": "ca.crt"
-                                            }
-                                        ],
-                                        "name": "kube-root-ca.crt"
-                                    }
-                                },
-                                {
-                                    "downwardAPI": {
-                                        "items": [
-                                            {
-                                                "fieldRef": {
-                                                    "apiVersion": "v1",
-                                                    "fieldPath": "metadata.namespace"
-                                                },
-                                                "path": "namespace"
-                                            }
-                                        ]
-                                    }
-                                }
-                            ]
-                        }
-                    }
-                ]
-            },
-            "status": {
-                "conditions": [
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2022-08-17T15:36:12Z",
-                        "status": "True",
-                        "type": "Initialized"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:08Z",
-                        "status": "True",
-                        "type": "Ready"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:08Z",
-                        "status": "True",
-                        "type": "ContainersReady"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2022-08-17T15:36:12Z",
-                        "status": "True",
-                        "type": "PodScheduled"
-                    }
-                ],
-                "containerStatuses": [
-                    {
-                        "containerID": "docker://e7669c7bb99cfaab164142e585b8098202259dbeed58d0ce0b89705ed07788e9",
-                        "image": "registry.k8s.io/coredns/coredns:v1.8.6",
-                        "imageID": "docker-pullable://registry.k8s.io/coredns/coredns@sha256:5b6ec0d6de9baaf3e92d0f66cd96a25b9edbce8716f5f15dcd1a616b3abd590e",
-                        "lastState": {
-                            "terminated": {
-                                "containerID": "docker://12ec695031d540dbd00c5458e97d20917e8eb8e2ef1cbe3be24642f85333c554",
-                                "exitCode": 0,
-                                "finishedAt": "2023-01-26T09:50:58Z",
-                                "reason": "Completed",
-                                "startedAt": "2023-01-26T09:50:45Z"
-                            }
-                        },
-                        "name": "coredns",
-                        "ready": true,
-                        "restartCount": 30,
-                        "started": true,
-                        "state": {
-                            "running": {
-                                "startedAt": "2023-01-26T09:51:07Z"
-                            }
-                        }
-                    }
-                ],
-                "hostIP": "192.168.49.2",
-                "phase": "Running",
-                "podIP": "172.17.0.5",
-                "podIPs": [
-                    {
-                        "ip": "172.17.0.5"
-                    }
-                ],
-                "qosClass": "Burstable",
-                "startTime": "2022-08-17T15:36:12Z"
-            }
-        },
-        {
-            "apiVersion": "v1",
-            "kind": "Pod",
-            "metadata": {
-                "annotations": {
-                    "kubeadm.kubernetes.io/etcd.advertise-client-urls": "https://192.168.49.2:2379",
-                    "kubernetes.io/config.hash": "906edd533192a4db2396a938662a5271",
-                    "kubernetes.io/config.mirror": "906edd533192a4db2396a938662a5271",
-                    "kubernetes.io/config.seen": "2022-08-17T15:35:59.685875416Z",
-                    "kubernetes.io/config.source": "file",
-                    "seccomp.security.alpha.kubernetes.io/pod": "runtime/default"
-                },
-                "creationTimestamp": "2022-08-17T15:35:59Z",
-                "labels": {
-                    "component": "etcd",
-                    "tier": "control-plane"
-                },
-                "name": "etcd-",
-                "namespace": "kube-system",
-                "ownerReferences": [
-                    {
-                        "apiVersion": "v1",
-                        "controller": true,
-                        "kind": "Node",
-                        "name": "",
-                        "uid": "10086d86-06bd-4e9d-a8da-e88ba2775570"
-                    }
-                ],
-                "resourceVersion": "6574547",
-                "uid": "8ebddd8f-4a9d-4204-b319-b8c47f8b0fb8"
-            },
-            "spec": {
-                "containers": [
-                    {
-                        "command": [
-                            "etcd",
-                            "--advertise-client-urls=https://192.168.49.2:2379",
-                            "--cert-file=/var/lib//certs/etcd/server.crt",
-                            "--client-cert-auth=true",
-                            "--data-dir=/var/lib//etcd",
-                            "--experimental-initial-corrupt-check=true",
-                            "--initial-advertise-peer-urls=https://192.168.49.2:2380",
-                            "--initial-cluster==https://192.168.49.2:2380",
-                            "--key-file=/var/lib//certs/etcd/server.key",
-                            "--listen-client-urls=https://127.0.0.1:2379,https://192.168.49.2:2379",
-                            "--listen-metrics-urls=http://127.0.0.1:2381",
-                            "--listen-peer-urls=https://192.168.49.2:2380",
-                            "--name=",
-                            "--peer-cert-file=/var/lib//certs/etcd/peer.crt",
-                            "--peer-client-cert-auth=true",
-                            "--peer-key-file=/var/lib//certs/etcd/peer.key",
-                            "--peer-trusted-ca-file=/var/lib//certs/etcd/ca.crt",
-                            "--proxy-refresh-interval=70000",
-                            "--snapshot-count=10000",
-                            "--trusted-ca-file=/var/lib//certs/etcd/ca.crt"
-                        ],
-                        "image": "registry.k8s.io/etcd:3.5.3-0",
-                        "imagePullPolicy": "IfNotPresent",
-                        "livenessProbe": {
-                            "failureThreshold": 8,
-                            "httpGet": {
-                                "host": "127.0.0.1",
-                                "path": "/health",
-                                "port": 2381,
-                                "scheme": "HTTP"
-                            },
-                            "initialDelaySeconds": 10,
-                            "periodSeconds": 10,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 15
-                        },
-                        "name": "etcd",
-                        "resources": {
-                            "requests": {
-                                "cpu": "100m",
-                                "memory": "100Mi"
-                            }
-                        },
-                        "startupProbe": {
-                            "failureThreshold": 24,
-                            "httpGet": {
-                                "host": "127.0.0.1",
-                                "path": "/health",
-                                "port": 2381,
-                                "scheme": "HTTP"
-                            },
-                            "initialDelaySeconds": 10,
-                            "periodSeconds": 10,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 15
-                        },
-                        "terminationMessagePath": "/dev/termination-log",
-                        "terminationMessagePolicy": "File",
-                        "volumeMounts": [
-                            {
-                                "mountPath": "/var/lib//etcd",
-                                "name": "etcd-data"
-                            },
-                            {
-                                "mountPath": "/var/lib//certs/etcd",
-                                "name": "etcd-certs"
-                            }
-                        ]
-                    }
-                ],
-                "dnsPolicy": "ClusterFirst",
-                "enableServiceLinks": true,
-                "hostNetwork": true,
-                "preemptionPolicy": "PreemptLowerPriority",
-                "priority": 2000001000,
-                "priorityClassName": "system-node-critical",
-                "restartPolicy": "Always",
-                "schedulerName": "default-scheduler",
-                "securityContext": {
-                    "seccompProfile": {
-                        "type": "RuntimeDefault"
-                    }
-                },
-                "terminationGracePeriodSeconds": 30,
-                "tolerations": [
-                    {
-                        "effect": "NoExecute",
-                        "operator": "Exists"
-                    }
-                ],
-                "volumes": [
-                    {
-                        "hostPath": {
-                            "path": "/var/lib//certs/etcd",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "etcd-certs"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/var/lib//etcd",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "etcd-data"
-                    }
-                ]
-            },
-            "status": {
-                "conditions": [
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-16T11:32:34Z",
-                        "status": "True",
-                        "type": "Initialized"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:12Z",
-                        "status": "True",
-                        "type": "Ready"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:12Z",
-                        "status": "True",
-                        "type": "ContainersReady"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-16T11:32:34Z",
-                        "status": "True",
-                        "type": "PodScheduled"
-                    }
-                ],
-                "containerStatuses": [
-                    {
-                        "containerID": "docker://e943905db852a7184ec7bf12b2168093095299a8889b3b7243bace3199f590b9",
-                        "image": "registry.k8s.io/etcd:3.5.3-0",
-                        "imageID": "docker-pullable://registry.k8s.io/etcd@sha256:13f53ed1d91e2e11aac476ee9a0269fdda6cc4874eba903efd40daf50c55eee5",
-                        "lastState": {
-                            "terminated": {
-                                "containerID": "docker://d18e67be5f16538b4482ca5d87c9d82306ad5923d9a8c1031d1db5ae481d1b6c",
-                                "exitCode": 0,
-                                "finishedAt": "2023-01-26T09:50:50Z",
-                                "reason": "Completed",
-                                "startedAt": "2023-01-26T09:50:43Z"
-                            }
-                        },
-                        "name": "etcd",
-                        "ready": true,
-                        "restartCount": 29,
-                        "started": true,
-                        "state": {
-                            "running": {
-                                "startedAt": "2023-01-26T09:51:01Z"
-                            }
-                        }
-                    }
-                ],
-                "hostIP": "192.168.49.2",
-                "phase": "Running",
-                "podIP": "192.168.49.2",
-                "podIPs": [
-                    {
-                        "ip": "192.168.49.2"
-                    }
-                ],
-                "qosClass": "Burstable",
-                "startTime": "2023-01-16T11:32:34Z"
-            }
-        },
-        {
-            "apiVersion": "v1",
-            "kind": "Pod",
-            "metadata": {
-                "annotations": {
-                    "kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint": "192.168.49.2:8443",
-                    "kubernetes.io/config.hash": "af8a252bb89a737e9c95199d01283487",
-                    "kubernetes.io/config.mirror": "af8a252bb89a737e9c95199d01283487",
-                    "kubernetes.io/config.seen": "2022-08-17T15:35:54.018490803Z",
-                    "kubernetes.io/config.source": "file",
-                    "seccomp.security.alpha.kubernetes.io/pod": "runtime/default"
-                },
-                "creationTimestamp": "2022-08-17T15:35:58Z",
-                "labels": {
-                    "component": "kube-apiserver",
-                    "tier": "control-plane"
-                },
-                "name": "kube-apiserver-",
-                "namespace": "kube-system",
-                "ownerReferences": [
-                    {
-                        "apiVersion": "v1",
-                        "controller": true,
-                        "kind": "Node",
-                        "name": "",
-                        "uid": "10086d86-06bd-4e9d-a8da-e88ba2775570"
-                    }
-                ],
-                "resourceVersion": "6574550",
-                "uid": "2e180ba1-dfc9-4ec7-adde-44dc972dfb49"
-            },
-            "spec": {
-                "containers": [
-                    {
-                        "command": [
-                            "kube-apiserver",
-                            "--advertise-address=192.168.49.2",
-                            "--allow-privileged=true",
-                            "--authorization-mode=Node,RBAC",
-                            "--client-ca-file=/var/lib//certs/ca.crt",
-                            "--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota",
-                            "--enable-bootstrap-token-auth=true",
-                            "--etcd-cafile=/var/lib//certs/etcd/ca.crt",
-                            "--etcd-certfile=/var/lib//certs/apiserver-etcd-client.crt",
-                            "--etcd-keyfile=/var/lib//certs/apiserver-etcd-client.key",
-                            "--etcd-servers=https://127.0.0.1:2379",
-                            "--kubelet-client-certificate=/var/lib//certs/apiserver-kubelet-client.crt",
-                            "--kubelet-client-key=/var/lib//certs/apiserver-kubelet-client.key",
-                            "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname",
-                            "--proxy-client-cert-file=/var/lib//certs/front-proxy-client.crt",
-                            "--proxy-client-key-file=/var/lib//certs/front-proxy-client.key",
-                            "--requestheader-allowed-names=front-proxy-client",
-                            "--requestheader-client-ca-file=/var/lib//certs/front-proxy-ca.crt",
-                            "--requestheader-extra-headers-prefix=X-Remote-Extra-",
-                            "--requestheader-group-headers=X-Remote-Group",
-                            "--requestheader-username-headers=X-Remote-User",
-                            "--secure-port=8443",
-                            "--service-account-issuer=https://kubernetes.default.svc.cluster.local",
-                            "--service-account-key-file=/var/lib//certs/sa.pub",
-                            "--service-account-signing-key-file=/var/lib//certs/sa.key",
-                            "--service-cluster-ip-range=10.96.0.0/12",
-                            "--tls-cert-file=/var/lib//certs/apiserver.crt",
-                            "--tls-private-key-file=/var/lib//certs/apiserver.key"
-                        ],
-                        "image": "registry.k8s.io/kube-apiserver:v1.24.3",
-                        "imagePullPolicy": "IfNotPresent",
-                        "livenessProbe": {
-                            "failureThreshold": 8,
-                            "httpGet": {
-                                "host": "192.168.49.2",
-                                "path": "/livez",
-                                "port": 8443,
-                                "scheme": "HTTPS"
-                            },
-                            "initialDelaySeconds": 10,
-                            "periodSeconds": 10,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 15
-                        },
-                        "name": "kube-apiserver",
-                        "readinessProbe": {
-                            "failureThreshold": 3,
-                            "httpGet": {
-                                "host": "192.168.49.2",
-                                "path": "/readyz",
-                                "port": 8443,
-                                "scheme": "HTTPS"
-                            },
-                            "periodSeconds": 1,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 15
-                        },
-                        "resources": {
-                            "requests": {
-                                "cpu": "250m"
-                            }
-                        },
-                        "startupProbe": {
-                            "failureThreshold": 24,
-                            "httpGet": {
-                                "host": "192.168.49.2",
-                                "path": "/livez",
-                                "port": 8443,
-                                "scheme": "HTTPS"
-                            },
-                            "initialDelaySeconds": 10,
-                            "periodSeconds": 10,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 15
-                        },
-                        "terminationMessagePath": "/dev/termination-log",
-                        "terminationMessagePolicy": "File",
-                        "volumeMounts": [
-                            {
-                                "mountPath": "/etc/ssl/certs",
-                                "name": "ca-certs",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/etc/ca-certificates",
-                                "name": "etc-ca-certificates",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/var/lib//certs",
-                                "name": "k8s-certs",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/usr/local/share/ca-certificates",
-                                "name": "usr-local-share-ca-certificates",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/usr/share/ca-certificates",
-                                "name": "usr-share-ca-certificates",
-                                "readOnly": true
-                            }
-                        ]
-                    }
-                ],
-                "dnsPolicy": "ClusterFirst",
-                "enableServiceLinks": true,
-                "hostNetwork": true,
-                "preemptionPolicy": "PreemptLowerPriority",
-                "priority": 2000001000,
-                "priorityClassName": "system-node-critical",
-                "restartPolicy": "Always",
-                "schedulerName": "default-scheduler",
-                "securityContext": {
-                    "seccompProfile": {
-                        "type": "RuntimeDefault"
-                    }
-                },
-                "terminationGracePeriodSeconds": 30,
-                "tolerations": [
-                    {
-                        "effect": "NoExecute",
-                        "operator": "Exists"
-                    }
-                ],
-                "volumes": [
-                    {
-                        "hostPath": {
-                            "path": "/etc/ssl/certs",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "ca-certs"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/etc/ca-certificates",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "etc-ca-certificates"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/var/lib//certs",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "k8s-certs"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/usr/local/share/ca-certificates",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "usr-local-share-ca-certificates"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/usr/share/ca-certificates",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "usr-share-ca-certificates"
-                    }
-                ]
-            },
-            "status": {
-                "conditions": [
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-13T19:29:16Z",
-                        "status": "True",
-                        "type": "Initialized"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:16Z",
-                        "status": "True",
-                        "type": "Ready"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:16Z",
-                        "status": "True",
-                        "type": "ContainersReady"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-13T19:29:16Z",
-                        "status": "True",
-                        "type": "PodScheduled"
-                    }
-                ],
-                "containerStatuses": [
-                    {
-                        "containerID": "docker://4cddc5b41771ce81f7d1a2fbd982769fb5f558dd29b3a254e961cbc90d2b16b9",
-                        "image": "registry.k8s.io/kube-apiserver:v1.24.3",
-                        "imageID": "docker-pullable://registry.k8s.io/kube-apiserver@sha256:a04609b85962da7e6531d32b75f652b4fb9f5fe0b0ee0aa160856faad8ec5d96",
-                        "lastState": {
-                            "terminated": {
-                                "containerID": "docker://0640da5deb4f599a63574e7aacc4b7f935ad8f6e008fc6338b746111357e698c",
-                                "exitCode": 137,
-                                "finishedAt": "2023-01-26T09:50:41Z",
-                                "reason": "Error",
-                                "startedAt": "2023-01-26T09:50:29Z"
-                            }
-                        },
-                        "name": "kube-apiserver",
-                        "ready": true,
-                        "restartCount": 29,
-                        "started": true,
-                        "state": {
-                            "running": {
-                                "startedAt": "2023-01-26T09:50:52Z"
-                            }
-                        }
-                    }
-                ],
-                "hostIP": "192.168.49.2",
-                "phase": "Running",
-                "podIP": "192.168.49.2",
-                "podIPs": [
-                    {
-                        "ip": "192.168.49.2"
-                    }
-                ],
-                "qosClass": "Burstable",
-                "startTime": "2023-01-13T19:29:16Z"
-            }
-        },
-        {
-            "apiVersion": "v1",
-            "kind": "Pod",
-            "metadata": {
-                "annotations": {
-                    "kubernetes.io/config.hash": "76444121a189d8a30add20fb32ab6d4e",
-                    "kubernetes.io/config.mirror": "76444121a189d8a30add20fb32ab6d4e",
-                    "kubernetes.io/config.seen": "2022-08-17T15:35:59.685886125Z",
-                    "kubernetes.io/config.source": "file",
-                    "seccomp.security.alpha.kubernetes.io/pod": "runtime/default"
-                },
-                "creationTimestamp": "2022-08-17T15:36:00Z",
-                "labels": {
-                    "component": "kube-controller-manager",
-                    "tier": "control-plane"
-                },
-                "name": "kube-controller-manager-",
-                "namespace": "kube-system",
-                "ownerReferences": [
-                    {
-                        "apiVersion": "v1",
-                        "controller": true,
-                        "kind": "Node",
-                        "name": "",
-                        "uid": "10086d86-06bd-4e9d-a8da-e88ba2775570"
-                    }
-                ],
-                "resourceVersion": "6574558",
-                "uid": "753103a9-5571-4739-a13d-6f792ce705a2"
-            },
-            "spec": {
-                "containers": [
-                    {
-                        "command": [
-                            "kube-controller-manager",
-                            "--allocate-node-cidrs=true",
-                            "--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf",
-                            "--authorization-kubeconfig=/etc/kubernetes/controller-manager.conf",
-                            "--bind-address=127.0.0.1",
-                            "--client-ca-file=/var/lib//certs/ca.crt",
-                            "--cluster-cidr=10.244.0.0/16",
-                            "--cluster-name=mk",
-                            "--cluster-signing-cert-file=/var/lib//certs/ca.crt",
-                            "--cluster-signing-key-file=/var/lib//certs/ca.key",
-                            "--controllers=*,bootstrapsigner,tokencleaner",
-                            "--kubeconfig=/etc/kubernetes/controller-manager.conf",
-                            "--leader-elect=false",
-                            "--requestheader-client-ca-file=/var/lib//certs/front-proxy-ca.crt",
-                            "--root-ca-file=/var/lib//certs/ca.crt",
-                            "--service-account-private-key-file=/var/lib//certs/sa.key",
-                            "--service-cluster-ip-range=10.96.0.0/12",
-                            "--use-service-account-credentials=true"
-                        ],
-                        "image": "registry.k8s.io/kube-controller-manager:v1.24.3",
-                        "imagePullPolicy": "IfNotPresent",
-                        "livenessProbe": {
-                            "failureThreshold": 8,
-                            "httpGet": {
-                                "host": "127.0.0.1",
-                                "path": "/healthz",
-                                "port": 10257,
-                                "scheme": "HTTPS"
-                            },
-                            "initialDelaySeconds": 10,
-                            "periodSeconds": 10,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 15
-                        },
-                        "name": "kube-controller-manager",
-                        "resources": {
-                            "requests": {
-                                "cpu": "200m"
-                            }
-                        },
-                        "startupProbe": {
-                            "failureThreshold": 24,
-                            "httpGet": {
-                                "host": "127.0.0.1",
-                                "path": "/healthz",
-                                "port": 10257,
-                                "scheme": "HTTPS"
-                            },
-                            "initialDelaySeconds": 10,
-                            "periodSeconds": 10,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 15
-                        },
-                        "terminationMessagePath": "/dev/termination-log",
-                        "terminationMessagePolicy": "File",
-                        "volumeMounts": [
-                            {
-                                "mountPath": "/etc/ssl/certs",
-                                "name": "ca-certs",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/etc/ca-certificates",
-                                "name": "etc-ca-certificates",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/usr/libexec/kubernetes/kubelet-plugins/volume/exec",
-                                "name": "flexvolume-dir"
-                            },
-                            {
-                                "mountPath": "/var/lib//certs",
-                                "name": "k8s-certs",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/etc/kubernetes/controller-manager.conf",
-                                "name": "kubeconfig",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/usr/local/share/ca-certificates",
-                                "name": "usr-local-share-ca-certificates",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/usr/share/ca-certificates",
-                                "name": "usr-share-ca-certificates",
-                                "readOnly": true
-                            }
-                        ]
-                    }
-                ],
-                "dnsPolicy": "ClusterFirst",
-                "enableServiceLinks": true,
-                "hostNetwork": true,
-                "preemptionPolicy": "PreemptLowerPriority",
-                "priority": 2000001000,
-                "priorityClassName": "system-node-critical",
-                "restartPolicy": "Always",
-                "schedulerName": "default-scheduler",
-                "securityContext": {
-                    "seccompProfile": {
-                        "type": "RuntimeDefault"
-                    }
-                },
-                "terminationGracePeriodSeconds": 30,
-                "tolerations": [
-                    {
-                        "effect": "NoExecute",
-                        "operator": "Exists"
-                    }
-                ],
-                "volumes": [
-                    {
-                        "hostPath": {
-                            "path": "/etc/ssl/certs",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "ca-certs"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/etc/ca-certificates",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "etc-ca-certificates"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/usr/libexec/kubernetes/kubelet-plugins/volume/exec",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "flexvolume-dir"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/var/lib//certs",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "k8s-certs"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/etc/kubernetes/controller-manager.conf",
-                            "type": "FileOrCreate"
-                        },
-                        "name": "kubeconfig"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/usr/local/share/ca-certificates",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "usr-local-share-ca-certificates"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/usr/share/ca-certificates",
-                            "type": "DirectoryOrCreate"
-                        },
-                        "name": "usr-share-ca-certificates"
-                    }
-                ]
-            },
-            "status": {
-                "conditions": [
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-13T19:29:16Z",
-                        "status": "True",
-                        "type": "Initialized"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:19Z",
-                        "status": "True",
-                        "type": "Ready"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:19Z",
-                        "status": "True",
-                        "type": "ContainersReady"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-13T19:29:16Z",
-                        "status": "True",
-                        "type": "PodScheduled"
-                    }
-                ],
-                "containerStatuses": [
-                    {
-                        "containerID": "docker://e17ee54be70db4380e6c3985ad5e166c42acddeabf73fb7671559f510bc15725",
-                        "image": "registry.k8s.io/kube-controller-manager:v1.24.3",
-                        "imageID": "docker-pullable://registry.k8s.io/kube-controller-manager@sha256:f504eead8b8674ebc9067370ef51abbdc531b4a81813bfe464abccb8c76b6a53",
-                        "lastState": {
-                            "terminated": {
-                                "containerID": "docker://e8fb5e5d87186bae070b6e1dd818c14a340e68056f3d750868dac8e0a2cfc3ad",
-                                "exitCode": 2,
-                                "finishedAt": "2023-01-26T09:50:50Z",
-                                "reason": "Error",
-                                "startedAt": "2023-01-26T09:50:43Z"
-                            }
-                        },
-                        "name": "kube-controller-manager",
-                        "ready": true,
-                        "restartCount": 28,
-                        "started": true,
-                        "state": {
-                            "running": {
-                                "startedAt": "2023-01-26T09:51:01Z"
-                            }
-                        }
-                    }
-                ],
-                "hostIP": "192.168.49.2",
-                "phase": "Running",
-                "podIP": "192.168.49.2",
-                "podIPs": [
-                    {
-                        "ip": "192.168.49.2"
-                    }
-                ],
-                "qosClass": "Burstable",
-                "startTime": "2023-01-13T19:29:16Z"
-            }
-        },
-        {
-            "apiVersion": "v1",
-            "kind": "Pod",
-            "metadata": {
-                "creationTimestamp": "2022-08-17T15:36:12Z",
-                "generateName": "kube-proxy-",
-                "labels": {
-                    "controller-revision-hash": "94985b49",
-                    "k8s-app": "kube-proxy",
-                    "pod-template-generation": "1"
-                },
-                "name": "kube-proxy-g7j5r",
-                "namespace": "kube-system",
-                "ownerReferences": [
-                    {
-                        "apiVersion": "apps/v1",
-                        "blockOwnerDeletion": true,
-                        "controller": true,
-                        "kind": "DaemonSet",
-                        "name": "kube-proxy",
-                        "uid": "e5ab6c13-91cd-469e-866b-c8559ccfda7d"
-                    }
-                ],
-                "resourceVersion": "6574541",
-                "uid": "28448d81-0b4e-4ea7-89a8-effed9d97be2"
-            },
-            "spec": {
-                "affinity": {
-                    "nodeAffinity": {
-                        "requiredDuringSchedulingIgnoredDuringExecution": {
-                            "nodeSelectorTerms": [
-                                {
-                                    "matchFields": [
-                                        {
-                                            "key": "metadata.name",
-                                            "operator": "In",
-                                            "values": [
-                                                ""
-                                            ]
-                                        }
-                                    ]
-                                }
-                            ]
-                        }
-                    }
-                },
-                "containers": [
-                    {
-                        "command": [
-                            "/usr/local/bin/kube-proxy",
-                            "--config=/var/lib/kube-proxy/config.conf",
-                            "--hostname-override=$(NODE_NAME)"
-                        ],
-                        "env": [
-                            {
-                                "name": "NODE_NAME",
-                                "valueFrom": {
-                                    "fieldRef": {
-                                        "apiVersion": "v1",
-                                        "fieldPath": "spec.nodeName"
-                                    }
-                                }
-                            }
-                        ],
-                        "image": "registry.k8s.io/kube-proxy:v1.24.3",
-                        "imagePullPolicy": "IfNotPresent",
-                        "name": "kube-proxy",
-                        "resources": {},
-                        "securityContext": {
-                            "privileged": true
-                        },
-                        "terminationMessagePath": "/dev/termination-log",
-                        "terminationMessagePolicy": "File",
-                        "volumeMounts": [
-                            {
-                                "mountPath": "/var/lib/kube-proxy",
-                                "name": "kube-proxy"
-                            },
-                            {
-                                "mountPath": "/run/xtables.lock",
-                                "name": "xtables-lock"
-                            },
-                            {
-                                "mountPath": "/lib/modules",
-                                "name": "lib-modules",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
-                                "name": "kube-api-access-9b94x",
-                                "readOnly": true
-                            }
-                        ]
-                    }
-                ],
-                "dnsPolicy": "ClusterFirst",
-                "enableServiceLinks": true,
-                "hostNetwork": true,
-                "nodeSelector": {
-                    "kubernetes.io/os": "linux"
-                },
-                "preemptionPolicy": "PreemptLowerPriority",
-                "priority": 2000001000,
-                "priorityClassName": "system-node-critical",
-                "restartPolicy": "Always",
-                "schedulerName": "default-scheduler",
-                "securityContext": {},
-                "serviceAccount": "kube-proxy",
-                "serviceAccountName": "kube-proxy",
-                "terminationGracePeriodSeconds": 30,
-                "tolerations": [
-                    {
-                        "operator": "Exists"
-                    },
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/not-ready",
-                        "operator": "Exists"
-                    },
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/unreachable",
-                        "operator": "Exists"
-                    },
-                    {
-                        "effect": "NoSchedule",
-                        "key": "node.kubernetes.io/disk-pressure",
-                        "operator": "Exists"
-                    },
-                    {
-                        "effect": "NoSchedule",
-                        "key": "node.kubernetes.io/memory-pressure",
-                        "operator": "Exists"
-                    },
-                    {
-                        "effect": "NoSchedule",
-                        "key": "node.kubernetes.io/pid-pressure",
-                        "operator": "Exists"
-                    },
-                    {
-                        "effect": "NoSchedule",
-                        "key": "node.kubernetes.io/unschedulable",
-                        "operator": "Exists"
-                    },
-                    {
-                        "effect": "NoSchedule",
-                        "key": "node.kubernetes.io/network-unavailable",
-                        "operator": "Exists"
-                    }
-                ],
-                "volumes": [
-                    {
-                        "configMap": {
-                            "defaultMode": 420,
-                            "name": "kube-proxy"
-                        },
-                        "name": "kube-proxy"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/run/xtables.lock",
-                            "type": "FileOrCreate"
-                        },
-                        "name": "xtables-lock"
-                    },
-                    {
-                        "hostPath": {
-                            "path": "/lib/modules",
-                            "type": ""
-                        },
-                        "name": "lib-modules"
-                    },
-                    {
-                        "name": "kube-api-access-9b94x",
-                        "projected": {
-                            "defaultMode": 420,
-                            "sources": [
-                                {
-                                    "serviceAccountToken": {
-                                        "expirationSeconds": 3607,
-                                        "path": "token"
-                                    }
-                                },
-                                {
-                                    "configMap": {
-                                        "items": [
-                                            {
-                                                "key": "ca.crt",
-                                                "path": "ca.crt"
-                                            }
-                                        ],
-                                        "name": "kube-root-ca.crt"
-                                    }
-                                },
-                                {
-                                    "downwardAPI": {
-                                        "items": [
-                                            {
-                                                "fieldRef": {
-                                                    "apiVersion": "v1",
-                                                    "fieldPath": "metadata.namespace"
-                                                },
-                                                "path": "namespace"
-                                            }
-                                        ]
-                                    }
-                                }
-                            ]
-                        }
-                    }
-                ]
-            },
-            "status": {
-                "conditions": [
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2022-08-17T15:36:12Z",
-                        "status": "True",
-                        "type": "Initialized"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:07Z",
-                        "status": "True",
-                        "type": "Ready"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:07Z",
-                        "status": "True",
-                        "type": "ContainersReady"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2022-08-17T15:36:12Z",
-                        "status": "True",
-                        "type": "PodScheduled"
-                    }
-                ],
-                "containerStatuses": [
-                    {
-                        "containerID": "docker://08c86ce7f98c283ba322717bd03039bb5e31ac251b2df0c5341cbba3e54a64d1",
-                        "image": "registry.k8s.io/kube-proxy:v1.24.3",
-                        "imageID": "docker-pullable://registry.k8s.io/kube-proxy@sha256:c1b135231b5b1a6799346cd701da4b59e5b7ef8e694ec7b04fb23b8dbe144137",
-                        "lastState": {
-                            "terminated": {
-                                "containerID": "docker://6527453bf4318bd4d4b7befd7be7b1d4dc39c0102a29eac3d296564f7aa58d0a",
-                                "exitCode": 2,
-                                "finishedAt": "2023-01-26T09:50:50Z",
-                                "reason": "Error",
-                                "startedAt": "2023-01-26T09:50:44Z"
-                            }
-                        },
-                        "name": "kube-proxy",
-                        "ready": true,
-                        "restartCount": 28,
-                        "started": true,
-                        "state": {
-                            "running": {
-                                "startedAt": "2023-01-26T09:51:07Z"
-                            }
-                        }
-                    }
-                ],
-                "hostIP": "192.168.49.2",
-                "phase": "Running",
-                "podIP": "192.168.49.2",
-                "podIPs": [
-                    {
-                        "ip": "192.168.49.2"
-                    }
-                ],
-                "qosClass": "BestEffort",
-                "startTime": "2022-08-17T15:36:12Z"
-            }
-        },
-        {
-            "apiVersion": "v1",
-            "kind": "Pod",
-            "metadata": {
-                "annotations": {
-                    "kubernetes.io/config.hash": "2e95d5efbc70e877d20097c03ba4ff89",
-                    "kubernetes.io/config.mirror": "2e95d5efbc70e877d20097c03ba4ff89",
-                    "kubernetes.io/config.seen": "2022-08-17T15:35:54.018492220Z",
-                    "kubernetes.io/config.source": "file",
-                    "seccomp.security.alpha.kubernetes.io/pod": "runtime/default"
-                },
-                "creationTimestamp": "2022-08-17T15:35:57Z",
-                "labels": {
-                    "component": "kube-scheduler",
-                    "tier": "control-plane"
-                },
-                "name": "kube-scheduler-",
-                "namespace": "kube-system",
-                "ownerReferences": [
-                    {
-                        "apiVersion": "v1",
-                        "controller": true,
-                        "kind": "Node",
-                        "name": "",
-                        "uid": "10086d86-06bd-4e9d-a8da-e88ba2775570"
-                    }
-                ],
-                "resourceVersion": "6574560",
-                "uid": "0cae729f-e9d9-4384-bf2e-47db7cf77339"
-            },
-            "spec": {
-                "containers": [
-                    {
-                        "command": [
-                            "kube-scheduler",
-                            "--authentication-kubeconfig=/etc/kubernetes/scheduler.conf",
-                            "--authorization-kubeconfig=/etc/kubernetes/scheduler.conf",
-                            "--bind-address=127.0.0.1",
-                            "--kubeconfig=/etc/kubernetes/scheduler.conf",
-                            "--leader-elect=false"
-                        ],
-                        "image": "registry.k8s.io/kube-scheduler:v1.24.3",
-                        "imagePullPolicy": "IfNotPresent",
-                        "livenessProbe": {
-                            "failureThreshold": 8,
-                            "httpGet": {
-                                "host": "127.0.0.1",
-                                "path": "/healthz",
-                                "port": 10259,
-                                "scheme": "HTTPS"
-                            },
-                            "initialDelaySeconds": 10,
-                            "periodSeconds": 10,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 15
-                        },
-                        "name": "kube-scheduler",
-                        "resources": {
-                            "requests": {
-                                "cpu": "100m"
-                            }
-                        },
-                        "startupProbe": {
-                            "failureThreshold": 24,
-                            "httpGet": {
-                                "host": "127.0.0.1",
-                                "path": "/healthz",
-                                "port": 10259,
-                                "scheme": "HTTPS"
-                            },
-                            "initialDelaySeconds": 10,
-                            "periodSeconds": 10,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 15
-                        },
-                        "terminationMessagePath": "/dev/termination-log",
-                        "terminationMessagePolicy": "File",
-                        "volumeMounts": [
-                            {
-                                "mountPath": "/etc/kubernetes/scheduler.conf",
-                                "name": "kubeconfig",
-                                "readOnly": true
-                            }
-                        ]
-                    }
-                ],
-                "dnsPolicy": "ClusterFirst",
-                "enableServiceLinks": true,
-                "hostNetwork": true,
-                "preemptionPolicy": "PreemptLowerPriority",
-                "priority": 2000001000,
-                "priorityClassName": "system-node-critical",
-                "restartPolicy": "Always",
-                "schedulerName": "default-scheduler",
-                "securityContext": {
-                    "seccompProfile": {
-                        "type": "RuntimeDefault"
-                    }
-                },
-                "terminationGracePeriodSeconds": 30,
-                "tolerations": [
-                    {
-                        "effect": "NoExecute",
-                        "operator": "Exists"
-                    }
-                ],
-                "volumes": [
-                    {
-                        "hostPath": {
-                            "path": "/etc/kubernetes/scheduler.conf",
-                            "type": "FileOrCreate"
-                        },
-                        "name": "kubeconfig"
-                    }
-                ]
-            },
-            "status": {
-                "conditions": [
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-12T17:41:45Z",
-                        "status": "True",
-                        "type": "Initialized"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:19Z",
-                        "status": "True",
-                        "type": "Ready"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-26T09:51:19Z",
-                        "status": "True",
-                        "type": "ContainersReady"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-12T17:41:45Z",
-                        "status": "True",
-                        "type": "PodScheduled"
-                    }
-                ],
-                "containerStatuses": [
-                    {
-                        "containerID": "docker://bb7c6190db2b82aa25e45628398333ff66dbc6cd992f0202147361d6ee0ee9b0",
-                        "image": "registry.k8s.io/kube-scheduler:v1.24.3",
-                        "imageID": "docker-pullable://registry.k8s.io/kube-scheduler@sha256:e199523298224cd9f2a9a43c7c2c37fa57aff87648ed1e1de9984eba6f6005f0",
-                        "lastState": {
-                            "terminated": {
-                                "containerID": "docker://f15aee7a47dbdf7b7b9a62e27f2974af54e4b48aabd2d8b4d8eeb5a9e1587321",
-                                "exitCode": 1,
-                                "finishedAt": "2023-01-26T09:50:50Z",
-                                "reason": "Error",
-                                "startedAt": "2023-01-26T09:50:44Z"
-                            }
-                        },
-                        "name": "kube-scheduler",
-                        "ready": true,
-                        "restartCount": 28,
-                        "started": true,
-                        "state": {
-                            "running": {
-                                "startedAt": "2023-01-26T09:51:01Z"
-                            }
-                        }
-                    }
-                ],
-                "hostIP": "192.168.49.2",
-                "phase": "Running",
-                "podIP": "192.168.49.2",
-                "podIPs": [
-                    {
-                        "ip": "192.168.49.2"
-                    }
-                ],
-                "qosClass": "Burstable",
-                "startTime": "2023-01-12T17:41:45Z"
-            }
-        },
-        {
-            "apiVersion": "v1",
-            "kind": "Pod",
-            "metadata": {
-                "annotations": {
-                    "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"Pod\",\"metadata\":{\"annotations\":{},\"labels\":{\"addonmanager.kubernetes.io/mode\":\"Reconcile\",\"integration-test\":\"storage-provisioner\"},\"name\":\"storage-provisioner\",\"namespace\":\"kube-system\"},\"spec\":{\"containers\":[{\"command\":[\"/storage-provisioner\"],\"image\":\"gcr.io/k8s-/storage-provisioner:v5\",\"imagePullPolicy\":\"IfNotPresent\",\"name\":\"storage-provisioner\",\"volumeMounts\":[{\"mountPath\":\"/tmp\",\"name\":\"tmp\"}]}],\"hostNetwork\":true,\"serviceAccountName\":\"storage-provisioner\",\"volumes\":[{\"hostPath\":{\"path\":\"/tmp\",\"type\":\"Directory\"},\"name\":\"tmp\"}]}}\n"
-                },
-                "creationTimestamp": "2022-08-17T15:36:01Z",
-                "labels": {
-                    "addonmanager.kubernetes.io/mode": "Reconcile",
-                    "integration-test": "storage-provisioner"
-                },
-                "name": "storage-provisioner",
-                "namespace": "kube-system",
-                "resourceVersion": "6829727",
-                "uid": "d81fa902-f7f2-4fe4-bcde-ed756114f643"
-            },
-            "spec": {
-                "containers": [
-                    {
-                        "command": [
-                            "/storage-provisioner"
-                        ],
-                        "image": "gcr.io/k8s-/storage-provisioner:v5",
-                        "imagePullPolicy": "IfNotPresent",
-                        "name": "storage-provisioner",
-                        "resources": {},
-                        "terminationMessagePath": "/dev/termination-log",
-                        "terminationMessagePolicy": "File",
-                        "volumeMounts": [
-                            {
-                                "mountPath": "/tmp",
-                                "name": "tmp"
-                            },
-                            {
-                                "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
-                                "name": "kube-api-access-p6vbz",
-                                "readOnly": true
-                            }
-                        ]
-                    }
-                ],
-                "dnsPolicy": "ClusterFirst",
-                "enableServiceLinks": true,
-                "hostNetwork": true,
-                "preemptionPolicy": "PreemptLowerPriority",
-                "priority": 0,
-                "restartPolicy": "Always",
-                "schedulerName": "default-scheduler",
-                "securityContext": {},
-                "serviceAccount": "storage-provisioner",
-                "serviceAccountName": "storage-provisioner",
-                "terminationGracePeriodSeconds": 30,
-                "tolerations": [
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/not-ready",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    },
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/unreachable",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    }
-                ],
-                "volumes": [
-                    {
-                        "hostPath": {
-                            "path": "/tmp",
-                            "type": "Directory"
-                        },
-                        "name": "tmp"
-                    },
-                    {
-                        "name": "kube-api-access-p6vbz",
-                        "projected": {
-                            "defaultMode": 420,
-                            "sources": [
-                                {
-                                    "serviceAccountToken": {
-                                        "expirationSeconds": 3607,
-                                        "path": "token"
-                                    }
-                                },
-                                {
-                                    "configMap": {
-                                        "items": [
-                                            {
-                                                "key": "ca.crt",
-                                                "path": "ca.crt"
-                                            }
-                                        ],
-                                        "name": "kube-root-ca.crt"
-                                    }
-                                },
-                                {
-                                    "downwardAPI": {
-                                        "items": [
-                                            {
-                                                "fieldRef": {
-                                                    "apiVersion": "v1",
-                                                    "fieldPath": "metadata.namespace"
-                                                },
-                                                "path": "namespace"
-                                            }
-                                        ]
-                                    }
-                                }
-                            ]
-                        }
-                    }
-                ]
-            },
-            "status": {
-                "conditions": [
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2022-08-17T15:36:11Z",
-                        "status": "True",
-                        "type": "Initialized"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-30T15:23:29Z",
-                        "status": "True",
-                        "type": "Ready"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-30T15:23:29Z",
-                        "status": "True",
-                        "type": "ContainersReady"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2022-08-17T15:36:11Z",
-                        "status": "True",
-                        "type": "PodScheduled"
-                    }
-                ],
-                "containerStatuses": [
-                    {
-                        "containerID": "docker://587d2d582ca8ec85482f4a8c01c729e7c5b9e7f34894a120f49eaed91047ea79",
-                        "image": "gcr.io/k8s-/storage-provisioner:v5",
-                        "imageID": "docker-pullable://gcr.io/k8s-/storage-provisioner@sha256:18eb69d1418e854ad5a19e399310e52808a8321e4c441c1dddad8977a0d7a944",
-                        "lastState": {
-                            "terminated": {
-                                "containerID": "docker://3a1216051146d822a511d230181aa2c7b53358e74d14d4676c30aa335b2a1461",
-                                "exitCode": 255,
-                                "finishedAt": "2023-01-30T15:23:27Z",
-                                "reason": "Error",
-                                "startedAt": "2023-01-26T09:51:08Z"
-                            }
-                        },
-                        "name": "storage-provisioner",
-                        "ready": true,
-                        "restartCount": 66,
-                        "started": true,
-                        "state": {
-                            "running": {
-                                "startedAt": "2023-01-30T15:23:29Z"
-                            }
-                        }
-                    }
-                ],
-                "hostIP": "192.168.49.2",
-                "phase": "Running",
-                "podIP": "192.168.49.2",
-                "podIPs": [
-                    {
-                        "ip": "192.168.49.2"
-                    }
-                ],
-                "qosClass": "BestEffort",
-                "startTime": "2022-08-17T15:36:11Z"
-            }
-        },
-        {
-            "apiVersion": "v1",
-            "kind": "Pod",
-            "metadata": {
-                "annotations": {
-                    "checksum/config": "cec97c9fa908ccde2f13ba02005250c50e977cbf07bf37fc9a0b10cc9126437c"
-                },
-                "creationTimestamp": "2023-01-30T13:58:46Z",
-                "generateName": "teleport-agent-",
-                "labels": {
-                    "app": "teleport-agent",
-                    "controller-revision-hash": "teleport-agent-75d57b58f8",
-                    "statefulset.kubernetes.io/pod-name": "teleport-agent-0"
-                },
-                "name": "teleport-agent-0",
-                "namespace": "teleport-agent",
-                "ownerReferences": [
-                    {
-                        "apiVersion": "apps/v1",
-                        "blockOwnerDeletion": true,
-                        "controller": true,
-                        "kind": "StatefulSet",
-                        "name": "teleport-agent",
-                        "uid": "5818849f-dfd0-4a02-af34-58667af341e6"
-                    }
-                ],
-                "resourceVersion": "6826207",
-                "uid": "a6c0791d-d5d3-44d4-a569-5299140222dd"
-            },
-            "spec": {
-                "containers": [
-                    {
-                        "args": [
-                            "--diag-addr=0.0.0.0:3000"
-                        ],
-                        "env": [
-                            {
-                                "name": "TELEPORT_REPLICA_NAME",
-                                "valueFrom": {
-                                    "fieldRef": {
-                                        "apiVersion": "v1",
-                                        "fieldPath": "metadata.name"
-                                    }
-                                }
-                            },
-                            {
-                                "name": "KUBE_NAMESPACE",
-                                "valueFrom": {
-                                    "fieldRef": {
-                                        "apiVersion": "v1",
-                                        "fieldPath": "metadata.namespace"
-                                    }
-                                }
-                            },
-                            {
-                                "name": "RELEASE_NAME",
-                                "value": "teleport-agent"
-                            }
-                        ],
-                        "image": "public.ecr.aws/gravitational/teleport:11.2.1",
-                        "imagePullPolicy": "IfNotPresent",
-                        "livenessProbe": {
-                            "failureThreshold": 6,
-                            "httpGet": {
-                                "path": "/healthz",
-                                "port": "diag",
-                                "scheme": "HTTP"
-                            },
-                            "initialDelaySeconds": 5,
-                            "periodSeconds": 5,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 1
-                        },
-                        "name": "teleport",
-                        "ports": [
-                            {
-                                "containerPort": 3000,
-                                "name": "diag",
-                                "protocol": "TCP"
-                            }
-                        ],
-                        "readinessProbe": {
-                            "failureThreshold": 12,
-                            "httpGet": {
-                                "path": "/readyz",
-                                "port": "diag",
-                                "scheme": "HTTP"
-                            },
-                            "initialDelaySeconds": 5,
-                            "periodSeconds": 5,
-                            "successThreshold": 1,
-                            "timeoutSeconds": 1
-                        },
-                        "resources": {},
-                        "securityContext": {
-                            "allowPrivilegeEscalation": false,
-                            "capabilities": {
-                                "drop": [
-                                    "all"
-                                ]
-                            },
-                            "readOnlyRootFilesystem": true,
-                            "runAsNonRoot": true,
-                            "runAsUser": 9807
-                        },
-                        "terminationMessagePath": "/dev/termination-log",
-                        "terminationMessagePolicy": "File",
-                        "volumeMounts": [
-                            {
-                                "mountPath": "/etc/teleport",
-                                "name": "config",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/etc/teleport-secrets",
-                                "name": "auth-token",
-                                "readOnly": true
-                            },
-                            {
-                                "mountPath": "/var/lib/teleport",
-                                "name": "data"
-                            },
-                            {
-                                "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
-                                "name": "kube-api-access-hklpt",
-                                "readOnly": true
-                            }
-                        ]
-                    }
-                ],
-                "dnsPolicy": "ClusterFirst",
-                "enableServiceLinks": true,
-                "hostname": "teleport-agent-0",
-                "preemptionPolicy": "PreemptLowerPriority",
-                "priority": 0,
-                "restartPolicy": "Always",
-                "schedulerName": "default-scheduler",
-                "securityContext": {
-                    "fsGroup": 9807
-                },
-                "serviceAccount": "teleport-agent",
-                "serviceAccountName": "teleport-agent",
-                "subdomain": "teleport-agent",
-                "terminationGracePeriodSeconds": 30,
-                "tolerations": [
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/not-ready",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    },
-                    {
-                        "effect": "NoExecute",
-                        "key": "node.kubernetes.io/unreachable",
-                        "operator": "Exists",
-                        "tolerationSeconds": 300
-                    }
-                ],
-                "volumes": [
-                    {
-                        "configMap": {
-                            "defaultMode": 420,
-                            "name": "teleport-agent"
-                        },
-                        "name": "config"
-                    },
-                    {
-                        "name": "auth-token",
-                        "secret": {
-                            "defaultMode": 420,
-                            "secretName": "teleport-kube-agent-join-token"
-                        }
-                    },
-                    {
-                        "emptyDir": {},
-                        "name": "data"
-                    },
-                    {
-                        "name": "kube-api-access-hklpt",
-                        "projected": {
-                            "defaultMode": 420,
-                            "sources": [
-                                {
-                                    "serviceAccountToken": {
-                                        "expirationSeconds": 3607,
-                                        "path": "token"
-                                    }
-                                },
-                                {
-                                    "configMap": {
-                                        "items": [
-                                            {
-                                                "key": "ca.crt",
-                                                "path": "ca.crt"
-                                            }
-                                        ],
-                                        "name": "kube-root-ca.crt"
-                                    }
-                                },
-                                {
-                                    "downwardAPI": {
-                                        "items": [
-                                            {
-                                                "fieldRef": {
-                                                    "apiVersion": "v1",
-                                                    "fieldPath": "metadata.namespace"
-                                                },
-                                                "path": "namespace"
-                                            }
-                                        ]
-                                    }
-                                }
-                            ]
-                        }
-                    }
-                ]
-            },
-            "status": {
-                "conditions": [
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-30T13:58:46Z",
-                        "status": "True",
-                        "type": "Initialized"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-30T13:59:21Z",
-                        "status": "True",
-                        "type": "Ready"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-30T13:59:21Z",
-                        "status": "True",
-                        "type": "ContainersReady"
-                    },
-                    {
-                        "lastProbeTime": null,
-                        "lastTransitionTime": "2023-01-30T13:58:46Z",
-                        "status": "True",
-                        "type": "PodScheduled"
-                    }
-                ],
-                "containerStatuses": [
-                    {
-                        "containerID": "docker://fb3140e251b2506771b8fcdaca96fb722515f13234057d04d081dc9cabbb826f",
-                        "image": "public.ecr.aws/gravitational/teleport:11.2.1",
-                        "imageID": "docker-pullable://public.ecr.aws/gravitational/teleport@sha256:02a38fd71b7f1775f3ae131093f740de63a8746013ecddaff6402103da1cbb7c",
-                        "lastState": {},
-                        "name": "teleport",
-                        "ready": true,
-                        "restartCount": 0,
-                        "started": true,
-                        "state": {
-                            "running": {
-                                "startedAt": "2023-01-30T13:59:14Z"
-                            }
-                        }
-                    }
-                ],
-                "hostIP": "192.168.49.2",
-                "phase": "Running",
-                "podIP": "172.17.0.6",
-                "podIPs": [
-                    {
-                        "ip": "172.17.0.6"
-                    }
-                ],
-                "qosClass": "BestEffort",
-                "startTime": "2023-01-30T13:58:46Z"
-            }
-        }
-    ],
-    "kind": "PodList",
-    "metadata": {
-        "resourceVersion": ""
-    }
-}
\ No newline at end of file
diff --git a/lib/kube/proxy/testing/data/resources_list.tmpl b/lib/kube/proxy/testing/data/resources_list.tmpl
new file mode 100644
index 0000000000000..149b5092b3d8e
--- /dev/null
+++ b/lib/kube/proxy/testing/data/resources_list.tmpl
@@ -0,0 +1,155 @@
+{
+    "apiVersion": "{{ .API }}",
+    "items": [
+        {
+            "apiVersion": "{{ .API }}",
+            "kind": "{{ .Kind }}",
+            "metadata": {
+                "labels": {
+                    "app": "nginx",
+                    "pod-template-hash": "6595874d85"
+                },
+                "name": "nginx-deployment-6595874d85-6j2zm",
+                "namespace": "default"
+            }
+        },
+        {
+            "apiVersion": "{{ .API }}",
+            "kind": "{{ .Kind }}",
+            "metadata": {
+                "name": "nginx-deployment-6595874d85-7xgmb",
+                "namespace": "default"
+            }
+        },
+        {
+            "apiVersion": "{{ .API }}",
+            "kind": "{{ .Kind }}",
+            "metadata": {
+                "labels": {
+                    "app": "nginx",
+                    "pod-template-hash": "6595874d85"
+                },
+                "name": "nginx-deployment-6595874d85-c4kz8",
+                "namespace": "default"
+            }
+        },
+        {
+            "apiVersion": "{{ .API }}",
+            "kind": "{{ .Kind }}",
+            "metadata": {
+                "name": "coredns-6d4b75cb6d-k84h9",
+                "namespace": "kube-system"
+            }
+        },
+        {
+            "apiVersion": "{{ .API }}",
+            "kind": "{{ .Kind }}",
+            "metadata": {
+                "labels": {
+                    "component": "etcd",
+                    "tier": "control-plane"
+                },
+                "name": "etcd-"
+            }
+        },
+        {
+            "apiVersion": "{{ .API }}",
+            "kind": "{{ .Kind }}",
+            "metadata": {
+                "name": "kube-apiserver-",
+                "namespace": "kube-system"
+            }
+        },
+        {
+            "apiVersion": "{{ .API }}",
+            "kind": "{{ .Kind }}",
+            "metadata": {
+                "labels": {
+                    "component": "kube-controller-manager",
+                    "tier": "control-plane"
+                },
+                "name": "kube-controller-manager-",
+                "namespace": "kube-system"
+            }
+        },
+        {
+            "apiVersion": "{{ .API }}",
+            "kind": "{{ .Kind }}",
+            "metadata": {
+                "name": "kube-proxy-g7j5r",
+                "namespace": "kube-system"
+            }
+        },
+        {
+            "apiVersion": "{{ .API }}",
+            "kind": "{{ .Kind }}",
+            "metadata": {
+                "annotations": {
+                    "kubernetes.io/config.hash": "2e95d5efbc70e877d20097c03ba4ff89",
+                    "kubernetes.io/config.mirror": "2e95d5efbc70e877d20097c03ba4ff89",
+                    "kubernetes.io/config.seen": "2022-08-17T15:35:54.018492220Z",
+                    "kubernetes.io/config.source": "file",
+                    "seccomp.security.alpha.kubernetes.io/pod": "runtime/default"
+                },
+                "labels": {
+                    "component": "kube-scheduler",
+                    "tier": "control-plane"
+                },
+                "name": "kube-scheduler-",
+                "namespace": "kube-system"
+            }
+        },
+        {
+            "apiVersion": "{{ .API }}",
+            "kind": "{{ .Kind }}",
+            "metadata": {
+                "annotations": {
+                    "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"Pod\",\"metadata\":{\"annotations\":{},\"labels\":{\"addonmanager.kubernetes.io/mode\":\"Reconcile\",\"integration-test\":\"storage-provisioner\"},\"name\":\"storage-provisioner\",\"namespace\":\"kube-system\"},\"spec\":{\"containers\":[{\"command\":[\"/storage-provisioner\"],\"image\":\"gcr.io/k8s-/storage-provisioner:v5\",\"imagePullPolicy\":\"IfNotPresent\",\"name\":\"storage-provisioner\",\"volumeMounts\":[{\"mountPath\":\"/tmp\",\"name\":\"tmp\"}]}],\"hostNetwork\":true,\"serviceAccountName\":\"storage-provisioner\",\"volumes\":[{\"hostPath\":{\"path\":\"/tmp\",\"type\":\"Directory\"},\"name\":\"tmp\"}]}}\n"
+                },
+                "creationTimestamp": "2022-08-17T15:36:01Z",
+                "labels": {
+                    "addonmanager.kubernetes.io/mode": "Reconcile",
+                    "integration-test": "storage-provisioner"
+                },
+                "name": "storage-provisioner",
+                "namespace": "kube-system",
+                "resourceVersion": "6829727",
+                "uid": "d81fa902-f7f2-4fe4-bcde-ed756114f643"
+            }
+        },
+        {
+            "apiVersion": "{{ .API }}",
+            "kind": "{{ .Kind }}",
+            "metadata": {
+                "annotations": {
+                    "checksum/config": "cec97c9fa908ccde2f13ba02005250c50e977cbf07bf37fc9a0b10cc9126437c"
+                },
+                "creationTimestamp": "2023-01-30T13:58:46Z",
+                "generateName": "teleport-agent-",
+                "labels": {
+                    "app": "teleport-agent",
+                    "controller-revision-hash": "teleport-agent-75d57b58f8",
+                    "statefulset.kubernetes.io/pod-name": "teleport-agent-0"
+                },
+                "name": "teleport-agent-0",
+                "namespace": "teleport-agent",
+                "ownerReferences": [
+                    {
+                        "apiVersion": "apps/v1",
+                        "blockOwnerDeletion": true,
+                        "controller": true,
+                        "kind": "StatefulSet",
+                        "name": "teleport-agent",
+                        "uid": "5818849f-dfd0-4a02-af34-58667af341e6"
+                    }
+                ],
+                "resourceVersion": "6826207",
+                "uid": "a6c0791d-d5d3-44d4-a569-5299140222dd"
+            }
+        }
+    ],
+    "kind": "{{ .Kind }}List",
+    "metadata": {
+        "resourceVersion": ""
+    }
+}
\ No newline at end of file
diff --git a/lib/kube/proxy/testing/kube_server/clusterrole.go b/lib/kube/proxy/testing/kube_server/clusterrole.go
new file mode 100644
index 0000000000000..4fc49bbe8134e
--- /dev/null
+++ b/lib/kube/proxy/testing/kube_server/clusterrole.go
@@ -0,0 +1,108 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kubeserver
+
+import (
+	"net/http"
+	"sort"
+
+	"github.com/gravitational/trace"
+	"github.com/julienschmidt/httprouter"
+	authv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+var clusterRoleList = authv1.ClusterRoleList{
+	TypeMeta: metav1.TypeMeta{
+		Kind:       "ClusterRoleList",
+		APIVersion: "rbac.authorization.k8s.io/v1",
+	},
+	ListMeta: metav1.ListMeta{
+		ResourceVersion: "1231415",
+	},
+	Items: []authv1.ClusterRole{
+		newClusterRole("nginx-1"),
+		newClusterRole("nginx-2"),
+		newClusterRole("test"),
+	},
+}
+
+func newClusterRole(name string) authv1.ClusterRole {
+	return authv1.ClusterRole{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ClusterRole",
+			APIVersion: "rbac.authorization.k8s.io/v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+	}
+}
+
+func (s *KubeMockServer) listClusterRoles(w http.ResponseWriter, req *http.Request, p httprouter.Params) (any, error) {
+	return &clusterRoleList, nil
+}
+
+func (s *KubeMockServer) getClusterRole(w http.ResponseWriter, req *http.Request, p httprouter.Params) (any, error) {
+	name := p.ByName("name")
+	filter := func(role authv1.ClusterRole) bool {
+		return role.Name == name
+	}
+	for _, role := range clusterRoleList.Items {
+		if filter(role) {
+			return role, nil
+		}
+	}
+	return nil, trace.NotFound("cluster role %q not found", name)
+}
+
+func (s *KubeMockServer) deleteClusterRole(w http.ResponseWriter, req *http.Request, p httprouter.Params) (any, error) {
+	name := p.ByName("name")
+	deleteOpts, err := parseDeleteCollectionBody(req.Body)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	reqID := ""
+	if deleteOpts.Preconditions != nil && deleteOpts.Preconditions.UID != nil {
+		reqID = string(*deleteOpts.Preconditions.UID)
+	}
+	filter := func(role authv1.ClusterRole) bool {
+		return role.Name == name
+	}
+	for _, role := range clusterRoleList.Items {
+		if filter(role) {
+			s.mu.Lock()
+			key := deletedResource{reqID, types.KindKubeClusterRole}
+			s.deletedResources[key] = append(s.deletedResources[key], name)
+			s.mu.Unlock()
+			return role, nil
+		}
+	}
+	return nil, trace.NotFound("cluster %q not found", name)
+}
+
+func (s *KubeMockServer) DeletedClusterRoles(reqID string) []string {
+	s.mu.Lock()
+	key := deletedResource{reqID, types.KindKubeClusterRole}
+	deleted := make([]string, len(s.deletedResources[key]))
+	copy(deleted, s.deletedResources[key])
+	s.mu.Unlock()
+	sort.Strings(deleted)
+	return deleted
+}
diff --git a/lib/kube/proxy/testing/kube_server/kube_mock.go b/lib/kube/proxy/testing/kube_server/kube_mock.go
index 26c4ac9215110..b44239ba31506 100644
--- a/lib/kube/proxy/testing/kube_server/kube_mock.go
+++ b/lib/kube/proxy/testing/kube_server/kube_mock.go
@@ -89,16 +89,20 @@ const (
 	PortForwardPayload = "Portforward handler message"
 )
 
+type deletedResource struct {
+	requestID string
+	kind      string
+}
 type KubeMockServer struct {
-	router      *httprouter.Router
-	log         *log.Entry
-	server      *httptest.Server
-	TLS         *tls.Config
-	Addr        net.Addr
-	URL         string
-	CA          []byte
-	deletedPods map[string][]string
-	mu          sync.Mutex
+	router           *httprouter.Router
+	log              *log.Entry
+	server           *httptest.Server
+	TLS              *tls.Config
+	Addr             net.Addr
+	URL              string
+	CA               []byte
+	deletedResources map[deletedResource][]string
+	mu               sync.Mutex
 }
 
 // NewKubeAPIMock creates Kubernetes API server for handling exec calls.
@@ -110,9 +114,9 @@ type KubeMockServer struct {
 // TODO(tigrato): add support for other endpoints
 func NewKubeAPIMock() (*KubeMockServer, error) {
 	s := &KubeMockServer{
-		router:      httprouter.New(),
-		log:         log.NewEntry(log.New()),
-		deletedPods: make(map[string][]string),
+		router:           httprouter.New(),
+		log:              log.NewEntry(log.New()),
+		deletedResources: make(map[deletedResource][]string),
 	}
 	s.setup()
 	if err := http2.ConfigureServer(s.server.Config, &http2.Server{}); err != nil {
@@ -131,6 +135,11 @@ func (s *KubeMockServer) setup() {
 	s.router.GET("/api/:ver/namespaces/:podNamespace/pods/:podName/exec", s.withWriter(s.exec))
 	s.router.GET("/api/:ver/namespaces/:podNamespace/pods/:podName/portforward", s.withWriter(s.portforward))
 	s.router.POST("/api/:ver/namespaces/:podNamespace/pods/:podName/portforward", s.withWriter(s.portforward))
+
+	s.router.GET("/apis/rbac.authorization.k8s.io/:ver/clusterroles", s.withWriter(s.listClusterRoles))
+	s.router.GET("/apis/rbac.authorization.k8s.io/:ver/clusterroles/:name", s.withWriter(s.getClusterRole))
+	s.router.DELETE("/apis/rbac.authorization.k8s.io/:ver/clusterroles/:name", s.withWriter(s.deleteClusterRole))
+
 	s.router.GET("/api/:ver/namespaces/:podNamespace/pods", s.withWriter(s.listPods))
 	s.router.GET("/api/:ver/pods", s.withWriter(s.listPods))
 	s.router.GET("/api/:ver/namespaces/:podNamespace/pods/:podName", s.withWriter(s.getPod))
diff --git a/lib/kube/proxy/testing/kube_server/pods.go b/lib/kube/proxy/testing/kube_server/pods.go
index c1c95827e2d85..f9bec772a65f4 100644
--- a/lib/kube/proxy/testing/kube_server/pods.go
+++ b/lib/kube/proxy/testing/kube_server/pods.go
@@ -27,6 +27,8 @@ import (
 	"github.com/julienschmidt/httprouter"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/gravitational/teleport/api/types"
 )
 
 var podList = corev1.PodList{
@@ -115,7 +117,7 @@ func (s *KubeMockServer) deletePod(w http.ResponseWriter, req *http.Request, p h
 	for _, pod := range podList.Items {
 		if filter(pod) {
 			s.mu.Lock()
-			s.deletedPods[reqID] = append(s.deletedPods[reqID], filepath.Join(namespace, name))
+			s.deletedResources[deletedResource{kind: types.KindKubePod, requestID: reqID}] = append(s.deletedResources[deletedResource{kind: types.KindKubePod, requestID: reqID}], filepath.Join(namespace, name))
 			s.mu.Unlock()
 			return pod, nil
 		}
@@ -125,8 +127,9 @@ func (s *KubeMockServer) deletePod(w http.ResponseWriter, req *http.Request, p h
 
 func (s *KubeMockServer) DeletedPods(reqID string) []string {
 	s.mu.Lock()
-	deleted := make([]string, len(s.deletedPods[reqID]))
-	copy(deleted, s.deletedPods[reqID])
+	key := deletedResource{kind: types.KindKubePod, requestID: reqID}
+	deleted := make([]string, len(s.deletedResources[key]))
+	copy(deleted, s.deletedResources[key])
 	s.mu.Unlock()
 	sort.Strings(deleted)
 	return deleted
diff --git a/lib/kube/proxy/transport.go b/lib/kube/proxy/transport.go
index e9ec4dcedbf30..33253fe51aa8c 100644
--- a/lib/kube/proxy/transport.go
+++ b/lib/kube/proxy/transport.go
@@ -39,7 +39,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
@@ -384,7 +383,7 @@ func (f *Forwarder) remoteClusterDialer(clusterName string) dialContextFunc {
 			return nil, trace.Wrap(err)
 		}
 
-		return targetCluster.DialTCP(reversetunnel.DialParams{
+		return targetCluster.DialTCP(reversetunnelclient.DialParams{
 			// Send a sentinel value to the remote cluster because this connection
 			// will be used to forward multiple requests to the remote cluster from
 			// different users.
@@ -471,7 +470,7 @@ func (f *Forwarder) localClusterDialer(kubeClusterName string, opts ...contextDi
 			// It is a combination of the server's hostname and the cluster name.
 			// <host_id>.<cluster_name>
 			serverID := fmt.Sprintf("%s.%s", s.GetHostID(), f.cfg.ClusterName)
-			conn, err := localCluster.DialTCP(reversetunnel.DialParams{
+			conn, err := localCluster.DialTCP(reversetunnelclient.DialParams{
 				// Send a sentinel value to the remote cluster because this connection
 				// will be used to forward multiple requests to the remote cluster from
 				// different users.
diff --git a/lib/kube/proxy/transport_test.go b/lib/kube/proxy/transport_test.go
index d6bffde188167..12a34a17aaf35 100644
--- a/lib/kube/proxy/transport_test.go
+++ b/lib/kube/proxy/transport_test.go
@@ -26,7 +26,6 @@ import (
 	"go.opentelemetry.io/otel"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -158,14 +157,14 @@ func TestForwarderClusterDialer(t *testing.T) {
 	tests := []struct {
 		name          string
 		dialerCreator func(kubeClusterName string) dialContextFunc
-		want          reversetunnel.DialParams
+		want          reversetunnelclient.DialParams
 	}{
 		{
 			name: "local site",
 			dialerCreator: func(kubeClusterName string) dialContextFunc {
 				return f.localClusterDialer(kubeClusterName)
 			},
-			want: reversetunnel.DialParams{
+			want: reversetunnelclient.DialParams{
 				From: &utils.NetAddr{
 					Addr:        "0.0.0.0:0",
 					AddrNetwork: "tcp",
@@ -182,7 +181,7 @@ func TestForwarderClusterDialer(t *testing.T) {
 		{
 			name:          "remote site",
 			dialerCreator: f.remoteClusterDialer,
-			want: reversetunnel.DialParams{
+			want: reversetunnelclient.DialParams{
 				From: &utils.NetAddr{
 					Addr:        "0.0.0.0:0",
 					AddrNetwork: "tcp",
@@ -207,12 +206,12 @@ func TestForwarderClusterDialer(t *testing.T) {
 }
 
 type fakeReverseTunnel struct {
-	reversetunnel.Server
-	want reversetunnel.DialParams
+	reversetunnelclient.Server
+	want reversetunnelclient.DialParams
 	t    *testing.T
 }
 
-func (f *fakeReverseTunnel) GetSite(_ string) (reversetunnel.RemoteSite, error) {
+func (f *fakeReverseTunnel) GetSite(_ string) (reversetunnelclient.RemoteSite, error) {
 	return &fakeRemoteSiteTunnel{
 		want: f.want,
 		t:    f.t,
@@ -220,12 +219,12 @@ func (f *fakeReverseTunnel) GetSite(_ string) (reversetunnel.RemoteSite, error)
 }
 
 type fakeRemoteSiteTunnel struct {
-	reversetunnel.RemoteSite
-	want reversetunnel.DialParams
+	reversetunnelclient.RemoteSite
+	want reversetunnelclient.DialParams
 	t    *testing.T
 }
 
-func (f *fakeRemoteSiteTunnel) DialTCP(p reversetunnel.DialParams) (net.Conn, error) {
+func (f *fakeRemoteSiteTunnel) DialTCP(p reversetunnelclient.DialParams) (net.Conn, error) {
 	require.Equal(f.t, f.want, p)
 	return nil, nil
 }
diff --git a/lib/kube/proxy/url.go b/lib/kube/proxy/url.go
index 34b2fbc791b01..8405bfc984814 100644
--- a/lib/kube/proxy/url.go
+++ b/lib/kube/proxy/url.go
@@ -17,19 +17,20 @@ limitations under the License.
 package proxy
 
 import (
-	"fmt"
 	"path"
 	"strings"
 
+	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 )
 
 type apiResource struct {
-	apiGroup     string
-	namespace    string
-	resourceKind string
-	resourceName string
-	skipEvent    bool
+	apiGroup        string
+	apiGroupVersion string
+	namespace       string
+	resourceKind    string
+	resourceName    string
+	skipEvent       bool
 }
 
 // parseResourcePath does best-effort parsing of a Kubernetes API request path.
@@ -70,11 +71,12 @@ func parseResourcePath(p string) apiResource {
 	switch {
 	// Core API group has a "special" URL prefix /api/v1/.
 	case len(parts) >= 3 && parts[1] == "api" && parts[2] == "v1":
-		r.apiGroup = "core/v1"
+		r.apiGroup = "core"
+		r.apiGroupVersion = parts[2]
 		parts = parts[3:]
 	// Other API groups have URL prefix /apis/{group}/{version}.
 	case len(parts) >= 4 && parts[1] == "apis":
-		r.apiGroup = fmt.Sprintf("%s/%s", parts[2], parts[3])
+		r.apiGroup, r.apiGroupVersion = parts[2], parts[3]
 		parts = parts[4:]
 	case len(parts) >= 2 && (parts[1] == "api" || parts[1] == "apis"):
 		// /api or /apis.
@@ -138,8 +140,99 @@ func parseResourcePath(p string) apiResource {
 }
 
 func (r apiResource) populateEvent(e *apievents.KubeRequest) {
-	e.ResourceAPIGroup = r.apiGroup
+	e.ResourceAPIGroup = path.Join(r.apiGroup, r.apiGroupVersion)
 	e.ResourceNamespace = r.namespace
 	e.ResourceKind = r.resourceKind
 	e.ResourceName = r.resourceName
 }
+
+// allowedResourcesKey is a key used to identify a resource in the allowedResources map.
+type allowedResourcesKey struct {
+	apiGroup     string
+	resourceKind string
+}
+
+// allowedResources is a map of supported resources and their corresponding
+// teleport resource kind for the purpose of resource rbac.
+var allowedResources = map[allowedResourcesKey]string{
+	{apiGroup: "core", resourceKind: "pods"}:                                      types.KindKubePod,
+	{apiGroup: "core", resourceKind: "secrets"}:                                   types.KindKubeSecret,
+	{apiGroup: "core", resourceKind: "configmaps"}:                                types.KindKubeConfigmap,
+	{apiGroup: "core", resourceKind: "namespaces"}:                                types.KindKubeNamespace,
+	{apiGroup: "core", resourceKind: "services"}:                                  types.KindKubeService,
+	{apiGroup: "core", resourceKind: "serviceaccounts"}:                           types.KindKubeServiceAccount,
+	{apiGroup: "core", resourceKind: "nodes"}:                                     types.KindKubeNode,
+	{apiGroup: "core", resourceKind: "persistentvolumes"}:                         types.KindKubePersistentVolume,
+	{apiGroup: "core", resourceKind: "persistentvolumeclaims"}:                    types.KindKubePersistentVolumeClaim,
+	{apiGroup: "apps", resourceKind: "deployments"}:                               types.KindKubeDeployment,
+	{apiGroup: "apps", resourceKind: "replicasets"}:                               types.KindKubeReplicaSet,
+	{apiGroup: "apps", resourceKind: "statefulsets"}:                              types.KindKubeStatefulset,
+	{apiGroup: "apps", resourceKind: "daemonsets"}:                                types.KindKubeDaemonSet,
+	{apiGroup: "rbac.authorization.k8s.io", resourceKind: "clusterroles"}:         types.KindKubeClusterRole,
+	{apiGroup: "rbac.authorization.k8s.io", resourceKind: "roles"}:                types.KindKubeRole,
+	{apiGroup: "rbac.authorization.k8s.io", resourceKind: "clusterrolebindings"}:  types.KindKubeClusterRoleBinding,
+	{apiGroup: "rbac.authorization.k8s.io", resourceKind: "rolebindings"}:         types.KindKubeRoleBinding,
+	{apiGroup: "batch", resourceKind: "cronjobs"}:                                 types.KindKubeCronjob,
+	{apiGroup: "batch", resourceKind: "jobs"}:                                     types.KindKubeJob,
+	{apiGroup: "certificates.k8s.io", resourceKind: "certificatesigningrequests"}: types.KindKubeCertificateSigningRequest,
+	{apiGroup: "networking.k8s.io", resourceKind: "ingresses"}:                    types.KindKubeIngress,
+}
+
+// getKubeResourceAndAPIGroupFromType returns the Kubernetes resource kind and
+// API group for a given Teleport resource kind. If the Teleport resource kind
+// is not supported, it returns the Teleport resource kind as the Kubernetes
+// resource kind and an empty string as the API group.
+func getKubeResourceAndAPIGroupFromType(s string) (kind string, apiGroup string) {
+	for k, v := range allowedResources {
+		if v == s {
+			apiGroup := ""
+			if k.apiGroup != "core" {
+				apiGroup = k.apiGroup
+			}
+			return k.resourceKind, apiGroup
+		}
+	}
+	return s + "s", ""
+}
+
+// getResourceWithKey returns the teleport resource kind for a given resource key if
+// it exists, otherwise returns an empty string.
+func getResourceWithKey(k allowedResourcesKey) string {
+	if k.apiGroup == "" {
+		k.apiGroup = "core"
+	}
+	return allowedResources[k]
+}
+
+// getResourceFromRequest returns a KubernetesResource if the user tried to access
+// a specific endpoint that Teleport support resource filtering. Otherwise, returns nil.
+func getResourceFromRequest(requestURI string) (*types.KubernetesResource, apiResource) {
+	apiResource := parseResourcePath(requestURI)
+	resourceType, ok := getTeleportResourceKindFromAPIResource(apiResource)
+	// if the resource is not supported, return nil.
+	// if the resource is supported but the resource name is not present, return nil because it's a list request.
+	if !ok || apiResource.resourceName == "" {
+		return nil, apiResource
+	}
+	return &types.KubernetesResource{
+		Kind:      resourceType,
+		Namespace: apiResource.namespace,
+		Name:      apiResource.resourceName,
+	}, apiResource
+}
+
+func getTeleportResourceKindFromAPIResource(r apiResource) (string, bool) {
+	resource := getResourceFromAPIResource(r.resourceKind)
+	resourceType, ok := allowedResources[allowedResourcesKey{apiGroup: r.apiGroup, resourceKind: resource}]
+	return resourceType, ok
+}
+
+// getResourceFromAPIResource returns the resource kind from the api resource.
+// If the resource kind contains sub resources (e.g. pods/exec), it returns the
+// resource kind without the subresource.
+func getResourceFromAPIResource(resourceKind string) string {
+	if idx := strings.Index(resourceKind, "/"); idx != -1 {
+		return resourceKind[:idx]
+	}
+	return resourceKind
+}
diff --git a/lib/kube/proxy/url_test.go b/lib/kube/proxy/url_test.go
index 0ec5585b94843..651269c006e1f 100644
--- a/lib/kube/proxy/url_test.go
+++ b/lib/kube/proxy/url_test.go
@@ -21,6 +21,8 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
 )
 
 func TestParseResourcePath(t *testing.T) {
@@ -32,29 +34,29 @@ func TestParseResourcePath(t *testing.T) {
 		{path: "/", want: apiResource{}},
 		{path: "/api", want: apiResource{skipEvent: true}},
 		{path: "/api/", want: apiResource{skipEvent: true}},
-		{path: "/api/v1", want: apiResource{skipEvent: true, apiGroup: "core/v1"}},
-		{path: "/api/v1/", want: apiResource{skipEvent: true, apiGroup: "core/v1"}},
+		{path: "/api/v1", want: apiResource{skipEvent: true, apiGroup: "core", apiGroupVersion: "v1"}},
+		{path: "/api/v1/", want: apiResource{skipEvent: true, apiGroup: "core", apiGroupVersion: "v1"}},
 		{path: "/apis", want: apiResource{skipEvent: true}},
 		{path: "/apis/", want: apiResource{skipEvent: true}},
 		{path: "/apis/apps", want: apiResource{skipEvent: true}},
 		{path: "/apis/apps/", want: apiResource{skipEvent: true}},
-		{path: "/apis/apps/v1", want: apiResource{skipEvent: true, apiGroup: "apps/v1"}},
-		{path: "/apis/apps/v1/", want: apiResource{skipEvent: true, apiGroup: "apps/v1"}},
-		{path: "/api/v1/pods", want: apiResource{apiGroup: "core/v1", resourceKind: "pods"}},
-		{path: "/api/v1/watch/pods", want: apiResource{apiGroup: "core/v1", resourceKind: "pods"}},
-		{path: "/api/v1/namespaces/kube-system", want: apiResource{apiGroup: "core/v1", resourceKind: "namespaces", resourceName: "kube-system"}},
-		{path: "/api/v1/watch/namespaces/kube-system", want: apiResource{apiGroup: "core/v1", resourceKind: "namespaces", resourceName: "kube-system"}},
-		{path: "/apis/rbac.authorization.k8s.io/v1/clusterroles", want: apiResource{apiGroup: "rbac.authorization.k8s.io/v1", resourceKind: "clusterroles"}},
-		{path: "/apis/rbac.authorization.k8s.io/v1/watch/clusterroles", want: apiResource{apiGroup: "rbac.authorization.k8s.io/v1", resourceKind: "clusterroles"}},
-		{path: "/apis/rbac.authorization.k8s.io/v1/clusterroles/foo", want: apiResource{apiGroup: "rbac.authorization.k8s.io/v1", resourceKind: "clusterroles", resourceName: "foo"}},
-		{path: "/apis/rbac.authorization.k8s.io/v1/watch/clusterroles/foo", want: apiResource{apiGroup: "rbac.authorization.k8s.io/v1", resourceKind: "clusterroles", resourceName: "foo"}},
-		{path: "/api/v1/namespaces/kube-system/pods", want: apiResource{apiGroup: "core/v1", namespace: "kube-system", resourceKind: "pods"}},
-		{path: "/api/v1/watch/namespaces/kube-system/pods", want: apiResource{apiGroup: "core/v1", namespace: "kube-system", resourceKind: "pods"}},
-		{path: "/api/v1/namespaces/kube-system/pods/foo", want: apiResource{apiGroup: "core/v1", namespace: "kube-system", resourceKind: "pods", resourceName: "foo"}},
-		{path: "/api/v1/watch/namespaces/kube-system/pods/foo", want: apiResource{apiGroup: "core/v1", namespace: "kube-system", resourceKind: "pods", resourceName: "foo"}},
-		{path: "/api/v1/namespaces/kube-system/pods/foo/exec", want: apiResource{apiGroup: "core/v1", namespace: "kube-system", resourceKind: "pods/exec", resourceName: "foo"}},
-		{path: "/apis/apiregistration.k8s.io/v1/apiservices/foo/status", want: apiResource{apiGroup: "apiregistration.k8s.io/v1", resourceKind: "apiservices/status", resourceName: "foo"}},
-		{path: "/api/v1/nodes/foo/proxy/bar", want: apiResource{apiGroup: "core/v1", resourceKind: "nodes/proxy/bar", resourceName: "foo"}},
+		{path: "/apis/apps/v1", want: apiResource{skipEvent: true, apiGroup: "apps", apiGroupVersion: "v1"}},
+		{path: "/apis/apps/v1/", want: apiResource{skipEvent: true, apiGroup: "apps", apiGroupVersion: "v1"}},
+		{path: "/api/v1/pods", want: apiResource{apiGroup: "core", apiGroupVersion: "v1", resourceKind: "pods"}},
+		{path: "/api/v1/watch/pods", want: apiResource{apiGroup: "core", apiGroupVersion: "v1", resourceKind: "pods"}},
+		{path: "/api/v1/namespaces/kube-system", want: apiResource{apiGroup: "core", apiGroupVersion: "v1", resourceKind: "namespaces", resourceName: "kube-system"}},
+		{path: "/api/v1/watch/namespaces/kube-system", want: apiResource{apiGroup: "core", apiGroupVersion: "v1", resourceKind: "namespaces", resourceName: "kube-system"}},
+		{path: "/apis/rbac.authorization.k8s.io/v1/clusterroles", want: apiResource{apiGroup: "rbac.authorization.k8s.io", apiGroupVersion: "v1", resourceKind: "clusterroles"}},
+		{path: "/apis/rbac.authorization.k8s.io/v1/watch/clusterroles", want: apiResource{apiGroup: "rbac.authorization.k8s.io", apiGroupVersion: "v1", resourceKind: "clusterroles"}},
+		{path: "/apis/rbac.authorization.k8s.io/v1/clusterroles/foo", want: apiResource{apiGroup: "rbac.authorization.k8s.io", apiGroupVersion: "v1", resourceKind: "clusterroles", resourceName: "foo"}},
+		{path: "/apis/rbac.authorization.k8s.io/v1/watch/clusterroles/foo", want: apiResource{apiGroup: "rbac.authorization.k8s.io", apiGroupVersion: "v1", resourceKind: "clusterroles", resourceName: "foo"}},
+		{path: "/api/v1/namespaces/kube-system/pods", want: apiResource{apiGroup: "core", apiGroupVersion: "v1", namespace: "kube-system", resourceKind: "pods"}},
+		{path: "/api/v1/watch/namespaces/kube-system/pods", want: apiResource{apiGroup: "core", apiGroupVersion: "v1", namespace: "kube-system", resourceKind: "pods"}},
+		{path: "/api/v1/namespaces/kube-system/pods/foo", want: apiResource{apiGroup: "core", apiGroupVersion: "v1", namespace: "kube-system", resourceKind: "pods", resourceName: "foo"}},
+		{path: "/api/v1/watch/namespaces/kube-system/pods/foo", want: apiResource{apiGroup: "core", apiGroupVersion: "v1", namespace: "kube-system", resourceKind: "pods", resourceName: "foo"}},
+		{path: "/api/v1/namespaces/kube-system/pods/foo/exec", want: apiResource{apiGroup: "core", apiGroupVersion: "v1", namespace: "kube-system", resourceKind: "pods/exec", resourceName: "foo"}},
+		{path: "/apis/apiregistration.k8s.io/v1/apiservices/foo/status", want: apiResource{apiGroup: "apiregistration.k8s.io", apiGroupVersion: "v1", resourceKind: "apiservices/status", resourceName: "foo"}},
+		{path: "/api/v1/nodes/foo/proxy/bar", want: apiResource{apiGroup: "core", apiGroupVersion: "v1", resourceKind: "nodes/proxy/bar", resourceName: "foo"}},
 	}
 
 	for _, tt := range tests {
@@ -65,3 +67,126 @@ func TestParseResourcePath(t *testing.T) {
 		})
 	}
 }
+
+func Test_getResourceFromRequest(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		path string
+		want *types.KubernetesResource
+	}{
+		{path: "", want: nil},
+		{path: "/", want: nil},
+		{path: "/api", want: nil},
+		{path: "/api/", want: nil},
+		{path: "/api/v1", want: nil},
+		{path: "/api/v1/", want: nil},
+		{path: "/apis", want: nil},
+		{path: "/apis/", want: nil},
+		{path: "/apis/apps", want: nil},
+		{path: "/apis/apps/", want: nil},
+		{path: "/apis/apps/v1", want: nil},
+		{path: "/apis/apps/v1/", want: nil},
+		{path: "/api/v1/pods", want: nil},
+		{path: "/api/v1/watch/pods", want: nil},
+		{path: "/api/v1/namespaces/kube-system", want: &types.KubernetesResource{Kind: types.KindKubeNamespace, Name: "kube-system"}},
+		{path: "/api/v1/watch/namespaces/kube-system", want: &types.KubernetesResource{Kind: types.KindKubeNamespace, Name: "kube-system"}},
+		{path: "/api/v1/namespaces/kube-system/pods", want: nil},
+		{path: "/api/v1/watch/namespaces/kube-system/pods", want: nil},
+		{path: "/api/v1/namespaces/kube-system/pods/foo", want: &types.KubernetesResource{Kind: types.KindKubePod, Namespace: "kube-system", Name: "foo"}},
+		{path: "/api/v1/watch/namespaces/kube-system/pods/foo", want: &types.KubernetesResource{Kind: types.KindKubePod, Namespace: "kube-system", Name: "foo"}},
+		{path: "/apis/apiregistration.k8s.io/v1/apiservices/foo/status", want: nil},
+
+		// core
+		// Pods
+		{path: "/api/v1/pods", want: nil},
+		{path: "/api/v1/namespaces/default/pods", want: nil},
+		{path: "/api/v1/namespaces/default/pods/foo", want: &types.KubernetesResource{Kind: types.KindKubePod, Namespace: "default", Name: "foo"}},
+		{path: "/api/v1/watch/namespaces/default/pods/foo", want: &types.KubernetesResource{Kind: types.KindKubePod, Namespace: "default", Name: "foo"}},
+		{path: "/api/v1/namespaces/kube-system/pods/foo/exec", want: &types.KubernetesResource{Kind: types.KindKubePod, Namespace: "kube-system", Name: "foo"}},
+		// Secrets
+		{path: "/api/v1/secrets", want: nil},
+		{path: "/api/v1/namespaces/default/secrets", want: nil},
+		{path: "/api/v1/namespaces/default/secrets/foo", want: &types.KubernetesResource{Kind: types.KindKubeSecret, Namespace: "default", Name: "foo"}},
+		{path: "/api/v1/watch/namespaces/default/secrets/foo", want: &types.KubernetesResource{Kind: types.KindKubeSecret, Namespace: "default", Name: "foo"}},
+		// Configmaps
+		{path: "/api/v1/configmaps", want: nil},
+		{path: "/api/v1/namespaces/default/configmaps", want: nil},
+		{path: "/api/v1/namespaces/default/configmaps/foo", want: &types.KubernetesResource{Kind: types.KindKubeConfigmap, Namespace: "default", Name: "foo"}},
+		{path: "/api/v1/watch/namespaces/default/configmaps/foo", want: &types.KubernetesResource{Kind: types.KindKubeConfigmap, Namespace: "default", Name: "foo"}},
+		// Namespaces
+		{path: "/api/v1/namespaces", want: nil},
+		{path: "/api/v1/namespaces/default", want: &types.KubernetesResource{Kind: types.KindKubeNamespace, Name: "default"}},
+		{path: "/api/v1/watch/namespaces/default", want: &types.KubernetesResource{Kind: types.KindKubeNamespace, Name: "default"}},
+		// Nodes
+		{path: "/api/v1/nodes", want: nil},
+		{path: "/api/v1/nodes/foo/proxy/bar", want: &types.KubernetesResource{Kind: types.KindKubeNode, Name: "foo"}},
+		// Services
+		{path: "/api/v1/services", want: nil},
+		{path: "/api/v1/namespaces/default/services", want: nil},
+		{path: "/api/v1/namespaces/default/services/foo", want: &types.KubernetesResource{Kind: types.KindKubeService, Namespace: "default", Name: "foo"}},
+		// ServiceAccounts
+		{path: "/api/v1/serviceaccounts", want: nil},
+		{path: "/api/v1/namespaces/default/serviceaccounts", want: nil},
+		{path: "/api/v1/namespaces/default/serviceaccounts/foo", want: &types.KubernetesResource{Kind: types.KindKubeServiceAccount, Namespace: "default", Name: "foo"}},
+		{path: "/api/v1/watch/namespaces/default/serviceaccounts/foo", want: &types.KubernetesResource{Kind: types.KindKubeServiceAccount, Namespace: "default", Name: "foo"}},
+		// PersistentVolumes
+		{path: "/api/v1/persistentvolumes", want: nil},
+		{path: "/api/v1/namespaces/default/persistentvolumes", want: nil},
+		{path: "/api/v1/namespaces/default/persistentvolumes/foo", want: &types.KubernetesResource{Kind: types.KindKubePersistentVolume, Namespace: "default", Name: "foo"}},
+		{path: "/api/v1/watch/namespaces/default/persistentvolumes/foo", want: &types.KubernetesResource{Kind: types.KindKubePersistentVolume, Namespace: "default", Name: "foo"}},
+		// PersistentVolumeClaims
+		{path: "/api/v1/persistentvolumeclaims", want: nil},
+		{path: "/api/v1/namespaces/default/persistentvolumeclaims", want: nil},
+		{path: "/api/v1/namespaces/default/persistentvolumeclaims/foo", want: &types.KubernetesResource{Kind: types.KindKubePersistentVolumeClaim, Namespace: "default", Name: "foo"}},
+		{path: "/api/v1/watch/namespaces/default/persistentvolumeclaims/foo", want: &types.KubernetesResource{Kind: types.KindKubePersistentVolumeClaim, Namespace: "default", Name: "foo"}},
+
+		// apis/apps
+		// Deployments
+		{path: "/apis/apps/v1/deployments", want: nil},
+		{path: "/apis/apps/v1/namespaces/default/deployments", want: nil},
+		{path: "/apis/apps/v1/namespaces/default/deployments/foo", want: &types.KubernetesResource{Kind: types.KindKubeDeployment, Namespace: "default", Name: "foo"}},
+		{path: "/apis/apps/v1/watch/namespaces/default/deployments/foo", want: &types.KubernetesResource{Kind: types.KindKubeDeployment, Namespace: "default", Name: "foo"}},
+		// Statefulsets
+		{path: "/apis/apps/v1/statefulsets", want: nil},
+		{path: "/apis/apps/v1/namespaces/default/statefulsets", want: nil},
+		{path: "/apis/apps/v1/namespaces/default/statefulsets/foo", want: &types.KubernetesResource{Kind: types.KindKubeStatefulset, Namespace: "default", Name: "foo"}},
+		{path: "/apis/apps/v1/watch/namespaces/default/statefulsets/foo", want: &types.KubernetesResource{Kind: types.KindKubeStatefulset, Namespace: "default", Name: "foo"}},
+		// Replicasets
+		{path: "/apis/apps/v1/replicasets", want: nil},
+		{path: "/apis/apps/v1/namespaces/default/replicasets", want: nil},
+		{path: "/apis/apps/v1/namespaces/default/replicasets/foo", want: &types.KubernetesResource{Kind: types.KindKubeReplicaSet, Namespace: "default", Name: "foo"}},
+		{path: "/apis/apps/v1/watch/namespaces/default/replicasets/foo", want: &types.KubernetesResource{Kind: types.KindKubeReplicaSet, Namespace: "default", Name: "foo"}},
+		// Daemonsets
+		{path: "/apis/apps/v1/daemonsets", want: nil},
+		{path: "/apis/apps/v1/namespaces/default/daemonsets", want: nil},
+		{path: "/apis/apps/v1/namespaces/default/daemonsets/foo", want: &types.KubernetesResource{Kind: types.KindKubeDaemonSet, Namespace: "default", Name: "foo"}},
+		{path: "/apis/apps/v1/watch/namespaces/default/daemonsets/foo", want: &types.KubernetesResource{Kind: types.KindKubeDaemonSet, Namespace: "default", Name: "foo"}},
+
+		// apis/batch
+		// Job
+		{path: "/apis/batch/v1/jobs", want: nil},
+		{path: "/apis/batch/v1/namespaces/default/jobs", want: nil},
+		{path: "/apis/batch/v1/namespaces/default/jobs/foo", want: &types.KubernetesResource{Kind: types.KindKubeJob, Namespace: "default", Name: "foo"}},
+		{path: "/apis/batch/v1/watch/namespaces/default/jobs/foo", want: &types.KubernetesResource{Kind: types.KindKubeJob, Namespace: "default", Name: "foo"}},
+		// CronJob
+		{path: "/apis/batch/v1/cronjobs", want: nil},
+		{path: "/apis/batch/v1/namespaces/default/cronjobs", want: nil},
+		{path: "/apis/batch/v1/namespaces/default/cronjobs/foo", want: &types.KubernetesResource{Kind: types.KindKubeCronjob, Namespace: "default", Name: "foo"}},
+		{path: "/apis/batch/v1/watch/namespaces/default/cronjobs/foo", want: &types.KubernetesResource{Kind: types.KindKubeCronjob, Namespace: "default", Name: "foo"}},
+
+		// apis/certificates.k8s.io
+		{path: "/apis/certificates.k8s.io/v1/certificatesigningrequests", want: nil},
+		{path: "/apis/certificates.k8s.io/v1/certificatesigningrequests/foo", want: &types.KubernetesResource{Kind: types.KindKubeCertificateSigningRequest, Name: "foo"}},
+
+		// apis/networking.k8s.io
+		{path: "/apis/networking.k8s.io/v1/ingresses", want: nil},
+		{path: "/apis/networking.k8s.io/v1/ingresses/foo", want: &types.KubernetesResource{Kind: types.KindKubeIngress, Name: "foo"}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.path, func(t *testing.T) {
+			got, _ := getResourceFromRequest(tt.path)
+			require.Equal(t, tt.want, got, "parsing path %q", tt.path)
+		})
+	}
+}
diff --git a/lib/kube/proxy/utils_testing.go b/lib/kube/proxy/utils_testing.go
index d103b662f178e..7ca7fb89e313d 100644
--- a/lib/kube/proxy/utils_testing.go
+++ b/lib/kube/proxy/utils_testing.go
@@ -53,7 +53,7 @@ import (
 	"github.com/gravitational/teleport/lib/kube/proxy/streamproto"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/multiplexer"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	sessPkg "github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -290,10 +290,10 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 	// Create kubernetes service server.
 	testCtx.KubeProxy, err = NewTLSServer(TLSServerConfig{
 		ForwarderConfig: ForwarderConfig{
-			ReverseTunnelSrv: &reversetunnel.FakeServer{
-				Sites: []reversetunnel.RemoteSite{
+			ReverseTunnelSrv: &reversetunnelclient.FakeServer{
+				Sites: []reversetunnelclient.RemoteSite{
 					&fakeRemoteSite{
-						FakeRemoteSite: reversetunnel.NewFakeRemoteSite(testCtx.ClusterName, client),
+						FakeRemoteSite: reversetunnelclient.NewFakeRemoteSite(testCtx.ClusterName, client),
 						idToAddr: map[string]string{
 							testCtx.HostID: testCtx.kubeServerListener.Addr().String(),
 						},
@@ -587,11 +587,11 @@ func (f *fakeClient) CreateSessionTracker(ctx context.Context, st types.SessionT
 // fakeRemoteSite is a fake remote site that uses a map to map server IDs to
 // addresses to simulate reverse tunneling.
 type fakeRemoteSite struct {
-	*reversetunnel.FakeRemoteSite
+	*reversetunnelclient.FakeRemoteSite
 	idToAddr map[string]string
 }
 
-func (f *fakeRemoteSite) DialTCP(p reversetunnel.DialParams) (conn net.Conn, err error) {
+func (f *fakeRemoteSite) DialTCP(p reversetunnelclient.DialParams) (conn net.Conn, err error) {
 	// The server ID is the first part of the address.
 	addr, ok := f.idToAddr[strings.Split(p.ServerID, ".")[0]]
 	if !ok {
diff --git a/lib/kube/proxy/watcher.go b/lib/kube/proxy/watcher.go
index 04373f33d02be..7ab5f8d32893b 100644
--- a/lib/kube/proxy/watcher.go
+++ b/lib/kube/proxy/watcher.go
@@ -181,10 +181,13 @@ func (m *monitoredKubeClusters) get() types.ResourcesWithLabelsMap {
 func (s *TLSServer) registerKubeCluster(ctx context.Context, cluster types.KubeCluster) error {
 	clusterDetails, err := newClusterDetails(
 		ctx,
-		s.CloudClients,
-		cluster,
-		s.log,
-		s.CheckImpersonationPermissions,
+		clusterDetailsConfig{
+			cloudClients:     s.CloudClients,
+			cluster:          cluster,
+			log:              s.log,
+			checker:          s.CheckImpersonationPermissions,
+			resourceMatchers: s.ResourceMatchers,
+		},
 	)
 	if err != nil {
 		return trace.Wrap(err)
@@ -196,10 +199,13 @@ func (s *TLSServer) registerKubeCluster(ctx context.Context, cluster types.KubeC
 func (s *TLSServer) updateKubeCluster(ctx context.Context, cluster types.KubeCluster) error {
 	clusterDetails, err := newClusterDetails(
 		ctx,
-		s.CloudClients,
-		cluster,
-		s.log,
-		s.CheckImpersonationPermissions,
+		clusterDetailsConfig{
+			cloudClients:     s.CloudClients,
+			cluster:          cluster,
+			log:              s.log,
+			checker:          s.CheckImpersonationPermissions,
+			resourceMatchers: s.ResourceMatchers,
+		},
 	)
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/limiter/limiter.go b/lib/limiter/limiter.go
index 3c2de367221c6..7cc58458aacef 100644
--- a/lib/limiter/limiter.go
+++ b/lib/limiter/limiter.go
@@ -181,3 +181,16 @@ func (l *Limiter) StreamServerInterceptor(srv interface{}, serverStream grpc.Ser
 func (l *Limiter) WrapListener(ln net.Listener) *Listener {
 	return NewListener(ln, l.ConnectionsLimiter)
 }
+
+type handlerWrapper interface {
+	http.Handler
+	WrapHandle(http.Handler)
+}
+
+// MakeMiddleware creates an HTTP middleware that wraps provided handle.
+func MakeMiddleware(limiter handlerWrapper) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		limiter.WrapHandle(next)
+		return limiter
+	}
+}
diff --git a/lib/limiter/limiter_test.go b/lib/limiter/limiter_test.go
index e2d78091cb32e..08388d917c077 100644
--- a/lib/limiter/limiter_test.go
+++ b/lib/limiter/limiter_test.go
@@ -19,6 +19,8 @@ import (
 	"context"
 	"errors"
 	"net"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"testing"
 	"time"
@@ -475,3 +477,39 @@ func (f *fakeConn) RemoteAddr() net.Addr {
 func (f *fakeConn) Close() error {
 	return nil
 }
+
+func TestMakeMiddleware(t *testing.T) {
+	t.Parallel()
+
+	limiter, err := NewLimiter(Config{
+		MaxConnections: 1,
+		Rates: []Rate{
+			{
+				Period:  time.Minute,
+				Average: 1,
+				Burst:   1,
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	middleware := MakeMiddleware(limiter)
+	handler := middleware(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusAccepted)
+	}))
+
+	mustServeAndReceiveStatusCode(t, handler, http.StatusAccepted)
+	mustServeAndReceiveStatusCode(t, handler, http.StatusTooManyRequests)
+}
+
+func mustServeAndReceiveStatusCode(t *testing.T, handler http.Handler, wantStatusCode int) {
+	t.Helper()
+
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest("", "/", nil))
+
+	response := recorder.Result()
+	defer response.Body.Close()
+
+	require.Equal(t, wantStatusCode, response.StatusCode)
+}
diff --git a/lib/proxy/clusterdial/dial.go b/lib/proxy/clusterdial/dial.go
index 59a01e9a97dd8..124f8d919c3f0 100644
--- a/lib/proxy/clusterdial/dial.go
+++ b/lib/proxy/clusterdial/dial.go
@@ -20,7 +20,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/proxy/peer"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 )
 
 // ClusterDialerFunc is a function that implements a peer.ClusterDialer.
@@ -32,14 +32,14 @@ func (f ClusterDialerFunc) Dial(clusterName string, request peer.DialParams) (ne
 }
 
 // NewClusterDialer implements proxy.ClusterDialer for a reverse tunnel server.
-func NewClusterDialer(server reversetunnel.Server) ClusterDialerFunc {
+func NewClusterDialer(server reversetunnelclient.Server) ClusterDialerFunc {
 	return func(clusterName string, request peer.DialParams) (net.Conn, error) {
 		site, err := server.GetSite(clusterName)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		dialParams := reversetunnel.DialParams{
+		dialParams := reversetunnelclient.DialParams{
 			ServerID:      request.ServerID,
 			ConnType:      request.ConnType,
 			From:          request.From,
diff --git a/lib/proxy/router.go b/lib/proxy/router.go
index 33809cd8a7f84..787b4167059ed 100644
--- a/lib/proxy/router.go
+++ b/lib/proxy/router.go
@@ -37,7 +37,6 @@ import (
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/observability/metrics"
-	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/teleagent"
@@ -102,7 +101,7 @@ type serverResolverFn = func(ctx context.Context, host, port string, site site)
 // SiteGetter provides access to connected local or remote sites
 type SiteGetter interface {
 	// GetSite returns the site matching the provided clusterName
-	GetSite(clusterName string) (reversetunnel.RemoteSite, error)
+	GetSite(clusterName string) (reversetunnelclient.RemoteSite, error)
 }
 
 // RemoteClusterGetter provides access to remote cluster resources
@@ -164,7 +163,7 @@ type Router struct {
 	clusterName    string
 	log            *logrus.Entry
 	clusterGetter  RemoteClusterGetter
-	localSite      reversetunnel.RemoteSite
+	localSite      reversetunnelclient.RemoteSite
 	siteGetter     SiteGetter
 	tracer         oteltrace.Tracer
 	serverResolver serverResolverFn
@@ -290,7 +289,7 @@ func (r *Router) DialHost(ctx context.Context, clientSrcAddr, clientDstAddr net.
 		agentGetter = nil
 	}
 
-	conn, err := site.Dial(reversetunnel.DialParams{
+	conn, err := site.Dial(reversetunnelclient.DialParams{
 		From:                  clientSrcAddr,
 		To:                    &utils.NetAddr{AddrNetwork: "tcp", Addr: serverAddr},
 		OriginalClientDstAddr: clientDstAddr,
@@ -313,7 +312,7 @@ func (r *Router) DialHost(ctx context.Context, clientSrcAddr, clientDstAddr net.
 
 // getRemoteCluster looks up the provided clusterName to determine if a remote site exists with
 // that name and determines if the user has access to it.
-func (r *Router) getRemoteCluster(ctx context.Context, clusterName string, checker services.AccessChecker) (reversetunnel.RemoteSite, error) {
+func (r *Router) getRemoteCluster(ctx context.Context, clusterName string, checker services.AccessChecker) (reversetunnelclient.RemoteSite, error) {
 	_, span := r.tracer.Start(
 		ctx,
 		"router/getRemoteCluster",
@@ -341,16 +340,16 @@ func (r *Router) getRemoteCluster(ctx context.Context, clusterName string, check
 }
 
 // site is the minimum interface needed to match servers
-// for a reversetunnel.RemoteSite. It makes testing easier.
+// for a reversetunnelclient.RemoteSite. It makes testing easier.
 type site interface {
 	GetNodes(ctx context.Context, fn func(n services.Node) bool) ([]types.Server, error)
 	GetClusterNetworkingConfig(ctx context.Context, opts ...services.MarshalOption) (types.ClusterNetworkingConfig, error)
 }
 
 // remoteSite is a site implementation that wraps
-// a reversetunnel.RemoteSite
+// a reversetunnelclient.RemoteSite
 type remoteSite struct {
-	site reversetunnel.RemoteSite
+	site reversetunnelclient.RemoteSite
 }
 
 // GetNodes uses the wrapped sites NodeWatcher to filter nodes
@@ -472,7 +471,7 @@ func (r *Router) DialSite(ctx context.Context, clusterName string, clientSrcAddr
 
 	// dial the local auth server
 	if clusterName == r.clusterName {
-		conn, err := r.localSite.DialAuthServer(reversetunnel.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
+		conn, err := r.localSite.DialAuthServer(reversetunnelclient.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
 		return conn, trace.Wrap(err)
 	}
 
@@ -482,7 +481,7 @@ func (r *Router) DialSite(ctx context.Context, clusterName string, clientSrcAddr
 		return nil, trace.Wrap(err)
 	}
 
-	conn, err := site.DialAuthServer(reversetunnel.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
+	conn, err := site.DialAuthServer(reversetunnelclient.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/proxy/router_test.go b/lib/proxy/router_test.go
index 8ad851f287eee..6af6a006f7f73 100644
--- a/lib/proxy/router_test.go
+++ b/lib/proxy/router_test.go
@@ -30,7 +30,7 @@ import (
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/native"
 	"github.com/gravitational/teleport/lib/observability/tracing"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/teleagent"
 	"github.com/gravitational/teleport/lib/utils"
@@ -298,31 +298,31 @@ func serverResolver(srv types.Server, err error) serverResolverFn {
 }
 
 type tunnel struct {
-	reversetunnel.Tunnel
+	reversetunnelclient.Tunnel
 
-	site reversetunnel.RemoteSite
+	site reversetunnelclient.RemoteSite
 	err  error
 }
 
-func (t tunnel) GetSite(cluster string) (reversetunnel.RemoteSite, error) {
+func (t tunnel) GetSite(cluster string) (reversetunnelclient.RemoteSite, error) {
 	return t.site, t.err
 }
 
 type testRemoteSite struct {
-	reversetunnel.RemoteSite
+	reversetunnelclient.RemoteSite
 
-	params reversetunnel.DialParams
+	params reversetunnelclient.DialParams
 
 	conn net.Conn
 	err  error
 }
 
-func (r *testRemoteSite) Dial(params reversetunnel.DialParams) (net.Conn, error) {
+func (r *testRemoteSite) Dial(params reversetunnelclient.DialParams) (net.Conn, error) {
 	r.params = params
 	return r.conn, r.err
 }
 
-func (r testRemoteSite) DialAuthServer(reversetunnel.DialParams) (net.Conn, error) {
+func (r testRemoteSite) DialAuthServer(reversetunnelclient.DialParams) (net.Conn, error) {
 	return r.conn, r.err
 }
 
@@ -331,10 +331,10 @@ func (r testRemoteSite) GetClient() (auth.ClientI, error) {
 }
 
 type testSiteGetter struct {
-	site reversetunnel.RemoteSite
+	site reversetunnelclient.RemoteSite
 }
 
-func (s testSiteGetter) GetSite(clusterName string) (reversetunnel.RemoteSite, error) {
+func (s testSiteGetter) GetSite(clusterName string) (reversetunnelclient.RemoteSite, error) {
 	return s.site, nil
 }
 
@@ -385,7 +385,7 @@ func TestRouter_DialHost(t *testing.T) {
 	cases := []struct {
 		name      string
 		router    Router
-		assertion func(t *testing.T, params reversetunnel.DialParams, conn net.Conn, err error)
+		assertion func(t *testing.T, params reversetunnelclient.DialParams, conn net.Conn, err error)
 	}{
 		{
 			name: "failure resolving node",
@@ -395,7 +395,7 @@ func TestRouter_DialHost(t *testing.T) {
 				tracer:         tracing.NoopTracer("test"),
 				serverResolver: serverResolver(nil, trace.NotFound(teleport.NodeIsAmbiguous)),
 			},
-			assertion: func(t *testing.T, params reversetunnel.DialParams, conn net.Conn, err error) {
+			assertion: func(t *testing.T, params reversetunnelclient.DialParams, conn net.Conn, err error) {
 				require.Error(t, err)
 				require.Nil(t, conn)
 			},
@@ -408,7 +408,7 @@ func TestRouter_DialHost(t *testing.T) {
 				log:         logger,
 				tracer:      tracing.NoopTracer("test"),
 			},
-			assertion: func(t *testing.T, params reversetunnel.DialParams, conn net.Conn, err error) {
+			assertion: func(t *testing.T, params reversetunnelclient.DialParams, conn net.Conn, err error) {
 				require.Error(t, err)
 				require.True(t, trace.IsNotFound(err))
 				require.Nil(t, conn)
@@ -423,7 +423,7 @@ func TestRouter_DialHost(t *testing.T) {
 				tracer:         tracing.NoopTracer("test"),
 				serverResolver: serverResolver(srv, nil),
 			},
-			assertion: func(t *testing.T, params reversetunnel.DialParams, conn net.Conn, err error) {
+			assertion: func(t *testing.T, params reversetunnelclient.DialParams, conn net.Conn, err error) {
 				require.Error(t, err)
 				require.True(t, trace.IsConnectionProblem(err))
 				require.Nil(t, conn)
@@ -438,7 +438,7 @@ func TestRouter_DialHost(t *testing.T) {
 				tracer:         tracing.NoopTracer("test"),
 				serverResolver: serverResolver(srv, nil),
 			},
-			assertion: func(t *testing.T, params reversetunnel.DialParams, conn net.Conn, err error) {
+			assertion: func(t *testing.T, params reversetunnelclient.DialParams, conn net.Conn, err error) {
 				require.NoError(t, err)
 				require.Equal(t, srv, params.TargetServer)
 				require.NotNil(t, params.GetUserAgent)
@@ -456,7 +456,7 @@ func TestRouter_DialHost(t *testing.T) {
 				tracer:         tracing.NoopTracer("test"),
 				serverResolver: serverResolver(agentlessSrv, nil),
 			},
-			assertion: func(t *testing.T, params reversetunnel.DialParams, conn net.Conn, err error) {
+			assertion: func(t *testing.T, params reversetunnelclient.DialParams, conn net.Conn, err error) {
 				require.NoError(t, err)
 				require.Equal(t, agentlessSrv, params.TargetServer)
 				require.Nil(t, params.GetUserAgent)
@@ -472,7 +472,7 @@ func TestRouter_DialHost(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			conn, _, err := tt.router.DialHost(ctx, &utils.NetAddr{}, &utils.NetAddr{}, "host", "0", "test", nil, agentGetter, createSigner)
 
-			var params reversetunnel.DialParams
+			var params reversetunnelclient.DialParams
 			if tt.router.localSite != nil {
 				params = tt.router.localSite.(*testRemoteSite).params
 			}
diff --git a/lib/reversetunnel/agent_dialer.go b/lib/reversetunnel/agent_dialer.go
index 549042f6326d6..fa5f5bbd9cc95 100644
--- a/lib/reversetunnel/agent_dialer.go
+++ b/lib/reversetunnel/agent_dialer.go
@@ -41,61 +41,66 @@ type agentDialer struct {
 	fips        bool
 	options     []proxy.DialerOptionFunc
 	log         logrus.FieldLogger
+	isClaimed   func(principals ...string) bool
 }
 
 // DialContext creates an ssh connection to the given address.
 func (d *agentDialer) DialContext(ctx context.Context, addr utils.NetAddr) (SSHClient, error) {
+	// Create a dialer (that respects HTTP proxies) and connect to remote host.
+	dialer := proxy.DialerFromEnvironment(addr.Addr, d.options...)
+	pconn, err := dialer.DialTimeout(ctx, addr.AddrNetwork, addr.Addr, apidefaults.DefaultIOTimeout)
+	if err != nil {
+		d.log.WithError(err).Debugf("Failed to dial %s.", addr.Addr)
+		return nil, trace.Wrap(err)
+	}
 
-	for _, authMethod := range d.authMethods {
-		// Create a dialer (that respects HTTP proxies) and connect to remote host.
-		dialer := proxy.DialerFromEnvironment(addr.Addr, d.options...)
-		pconn, err := dialer.DialTimeout(ctx, addr.AddrNetwork, addr.Addr, apidefaults.DefaultIOTimeout)
-		if err != nil {
-			d.log.WithError(err).Debugf("Failed to dial %s.", addr.Addr)
-			continue
-		}
-
-		principals := make([]string, 0)
-		callback, err := apisshutils.NewHostKeyCallback(
-			apisshutils.HostKeyCallbackConfig{
-				GetHostCheckers: d.hostCheckerFunc(ctx),
-				OnCheckCert: func(c *ssh.Certificate) {
-					principals = c.ValidPrincipals
-				},
-				FIPS: d.fips,
-			})
-		if err != nil {
-			d.log.Debugf("Failed to create host key callback for %v: %v.", addr.Addr, err)
-			continue
-		}
-
-		// Build a new client connection. This is done to get access to incoming
-		// global requests which dialer.Dial would not provide.
-		conn, chans, reqs, err := tracessh.NewClientConn(ctx, pconn, addr.Addr, &ssh.ClientConfig{
-			User:            d.username,
-			Auth:            []ssh.AuthMethod{authMethod},
-			HostKeyCallback: callback,
-			Timeout:         apidefaults.DefaultIOTimeout,
+	var principals []string
+	callback, err := apisshutils.NewHostKeyCallback(
+		apisshutils.HostKeyCallbackConfig{
+			GetHostCheckers: d.hostCheckerFunc(ctx),
+			OnCheckCert: func(c *ssh.Certificate) error {
+				if d.isClaimed != nil && d.isClaimed(c.ValidPrincipals...) {
+					d.log.Debugf("Aborting SSH handshake because the proxy %q is already claimed by some other agent.", c.ValidPrincipals[0])
+					return trace.Errorf("proxy already claimed")
+				}
+
+				principals = c.ValidPrincipals
+				return nil
+			},
+			FIPS: d.fips,
 		})
-		if err != nil {
-			d.log.WithError(err).Debugf("Failed to create client to %v.", addr.Addr)
-			continue
-		}
+	if err != nil {
+		d.log.Debugf("Failed to create host key callback for %v: %v.", addr.Addr, err)
+		return nil, trace.Wrap(err)
+	}
 
-		emptyRequests := make(chan *ssh.Request)
-		close(emptyRequests)
+	// Build a new client connection. This is done to get access to incoming
+	// global requests which dialer.Dial would not provide.
+	conn, chans, reqs, err := tracessh.NewClientConn(ctx, pconn, addr.Addr, &ssh.ClientConfig{
+		User:            d.username,
+		Auth:            d.authMethods,
+		HostKeyCallback: callback,
+		Timeout:         apidefaults.DefaultIOTimeout,
+	})
+	if err != nil {
+		d.log.WithError(err).Debugf("Failed to create client to %v.", addr.Addr)
+		return nil, trace.Wrap(err)
+	}
 
-		client := tracessh.NewClient(conn, chans, emptyRequests)
+	// ssh.NewClient will loop over the global requests channel in a goroutine,
+	// rejecting all requests; we want to handle the global requests ourselves,
+	// so we feed it a closed channel to have the goroutine exit immediately.
+	emptyRequests := make(chan *ssh.Request)
+	close(emptyRequests)
 
-		return &sshClient{
-			Client:      client,
-			requests:    reqs,
-			newChannels: chans,
-			principals:  principals,
-		}, nil
-	}
+	client := tracessh.NewClient(conn, chans, emptyRequests)
 
-	return nil, trace.BadParameter("failed to dial: all auth methods failed")
+	return &sshClient{
+		Client:      client,
+		requests:    reqs,
+		newChannels: chans,
+		principals:  principals,
+	}, nil
 }
 
 // hostCheckerFunc wraps a apisshutils.CheckersGetter function with a context.
diff --git a/lib/reversetunnel/agentpool.go b/lib/reversetunnel/agentpool.go
index 4f14ab7e0d6fd..9cb33b1b2e511 100644
--- a/lib/reversetunnel/agentpool.go
+++ b/lib/reversetunnel/agentpool.go
@@ -119,7 +119,7 @@ type AgentPoolConfig struct {
 	// either be proxy (trusted clusters) or node (dial back).
 	Component string
 	// ReverseTunnelServer holds all reverse tunnel connections.
-	ReverseTunnelServer Server
+	ReverseTunnelServer reversetunnelclient.Server
 	// Resolver retrieves the reverse tunnel address
 	Resolver reversetunnelclient.Resolver
 	// Cluster is a cluster name of the proxy.
@@ -493,6 +493,7 @@ func (p *AgentPool) newAgent(ctx context.Context, tracker *track.Tracker, lease
 		options:     options,
 		username:    p.HostUUID,
 		log:         p.log,
+		isClaimed:   p.tracker.IsClaimed,
 	}
 
 	agent, err := newAgent(agentConfig{
@@ -732,7 +733,7 @@ func (c *agentPoolRuntimeConfig) updateRemote(ctx context.Context, addr *utils.N
 
 	c.remoteTLSRoutingEnabled = tlsRoutingEnabled
 	if c.remoteTLSRoutingEnabled {
-		c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(addr.Addr, lib.IsInsecureDevMode())
+		c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, addr.Addr, lib.IsInsecureDevMode())
 		logrus.Debugf("ALPN upgrade required for remote %v: %v", addr.Addr, c.tlsRoutingConnUpgradeRequired)
 	}
 	return nil
@@ -765,7 +766,7 @@ func (c *agentPoolRuntimeConfig) update(ctx context.Context, netConfig types.Clu
 	if c.proxyListenerMode == types.ProxyListenerMode_Multiplex && oldProxyListenerMode != c.proxyListenerMode {
 		addr, _, err := resolver(ctx)
 		if err == nil {
-			c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(addr.Addr, lib.IsInsecureDevMode())
+			c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, addr.Addr, lib.IsInsecureDevMode())
 		} else {
 			logrus.WithError(err).Warnf("Failed to resolve addr.")
 		}
diff --git a/lib/reversetunnel/api.go b/lib/reversetunnel/api.go
index 9f4eb48d5ca47..8b08716f8bd85 100644
--- a/lib/reversetunnel/api.go
+++ b/lib/reversetunnel/api.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2016 Gravitational, Inc.
+Copyright 2020 Gravitational, Inc.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -16,192 +16,8 @@ limitations under the License.
 
 package reversetunnel
 
-import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"time"
+import "github.com/gravitational/teleport/lib/reversetunnelclient"
 
-	"golang.org/x/crypto/ssh"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
-	"github.com/gravitational/teleport/lib/proxy/peer"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/teleagent"
-)
-
-// DialParams is a list of parameters used to Dial to a node within a cluster.
-type DialParams struct {
-	// From is the source address.
-	From net.Addr
-
-	// To is the destination address.
-	To net.Addr
-
-	// GetUserAgent gets an SSH agent for use in connecting to the remote host. Used by the
-	// forwarding proxy.
-	GetUserAgent teleagent.Getter
-
-	// AgentlessSigner is used for authenticating to the remote host when it is an
-	// agentless node.
-	AgentlessSigner ssh.Signer
-
-	// Address is used by the forwarding proxy to generate a host certificate for
-	// the target node. This is needed because while dialing occurs via IP
-	// address, tsh thinks it's connecting via DNS name and that's how it
-	// validates the host certificate.
-	Address string
-
-	// Principals are additional principals that need to be added to the host
-	// certificate. Used by the recording proxy to correctly generate a host
-	// certificate.
-	Principals []string
-
-	// ServerID the hostUUID.clusterName of a Teleport node. Used with nodes
-	// that are connected over a reverse tunnel.
-	ServerID string
-
-	// ProxyIDs is a list of proxy ids the node is connected to.
-	ProxyIDs []string
-
-	// ConnType is the type of connection requested, either node or application.
-	// Only used when connecting through a tunnel.
-	ConnType types.TunnelType
-
-	// TargetServer is the host that the connection is being established for.
-	// It **MUST** only be populated when the target is a teleport ssh server
-	// or an agentless server.
-	TargetServer types.Server
-
-	// FromPeerProxy indicates that the dial request is being tunneled from
-	// a peer proxy.
-	FromPeerProxy bool
-
-	// TeleportVersion shows version of the target node, if we know that it's teleport node.
-	TeleportVersion string
-
-	// OriginalClientDstAddr is used in PROXY headers to show where client originally contacted Teleport infrastructure
-	OriginalClientDstAddr net.Addr
-}
-
-func (params DialParams) String() string {
-	to := params.To.String()
-	if to == "" {
-		to = params.ServerID
-	}
-	return fmt.Sprintf("from: %q to: %q", params.From, to)
-}
-
-func stringOrEmpty(addr net.Addr) string {
-	if addr == nil {
-		return ""
-	}
-	return addr.String()
-}
-
-// shouldDialAndForward returns whether a connection should be proxied
-// and forwarded or not.
-func shouldDialAndForward(params DialParams, recConfig types.SessionRecordingConfig) bool {
-	// connection is already being tunneled, do not forward
-	if params.FromPeerProxy {
-		return false
-	}
-	// the node is an agentless node, the connection must be forwarded
-	if params.TargetServer != nil && params.TargetServer.GetSubKind() == types.SubKindOpenSSHNode {
-		return true
-	}
-	// proxy session recording mode is being used and an SSH session
-	// is being requested, the connection must be forwarded
-	if params.ConnType == types.NodeTunnel && services.IsRecordAtProxy(recConfig.GetMode()) {
-		return true
-	}
-	return false
-}
-
-// RemoteSite represents remote teleport site that can be accessed via
-// teleport tunnel or directly by proxy
-//
-// There are two implementations of this interface: local and remote sites.
-type RemoteSite interface {
-	// DialAuthServer returns a net.Conn to the Auth Server of a site.
-	DialAuthServer(DialParams) (conn net.Conn, err error)
-	// Dial dials any address within the site network, in terminating
-	// mode it uses local instance of forwarding server to terminate
-	// and record the connection.
-	Dial(DialParams) (conn net.Conn, err error)
-	// DialTCP dials any address within the site network and
-	// ignores recording mode, used in components that need direct dialer.
-	DialTCP(DialParams) (conn net.Conn, err error)
-	// GetLastConnected returns last time the remote site was seen connected
-	GetLastConnected() time.Time
-	// GetName returns site name (identified by authority domain's name)
-	GetName() string
-	// GetStatus returns status of this site (either offline or connected)
-	GetStatus() string
-	// GetClient returns client connected to remote auth server
-	GetClient() (auth.ClientI, error)
-	// CachingAccessPoint returns access point that is lightweight
-	// but is resilient to auth server crashes
-	CachingAccessPoint() (auth.RemoteProxyAccessPoint, error)
-	// NodeWatcher returns the node watcher that maintains the node set for the site
-	NodeWatcher() (*services.NodeWatcher, error)
-	// GetTunnelsCount returns the amount of active inbound tunnels
-	// from the remote cluster
-	GetTunnelsCount() int
-	// IsClosed reports whether this RemoteSite has been closed and should no
-	// longer be used.
-	IsClosed() bool
-	// Closer allows the site to be closed
-	io.Closer
-}
-
-// Tunnel provides access to connected local or remote clusters
-// using unified interface.
-type Tunnel interface {
-	// GetSites returns a list of connected remote sites
-	GetSites() ([]RemoteSite, error)
-	// GetSite returns remote site this node belongs to
-	GetSite(domainName string) (RemoteSite, error)
-}
-
-// Server is a TCP/IP SSH server which listens on an SSH endpoint and remote/local
-// sites connect and register with it.
-type Server interface {
-	Tunnel
-	// Start starts server
-	Start() error
-	// Close closes server's operations immediately
-	Close() error
-	// DrainConnections closes listeners and begins draining connections without
-	// closing open connections.
-	DrainConnections(context.Context) error
-	// Shutdown performs graceful server shutdown closing open connections.
-	Shutdown(context.Context) error
-	// Wait waits for server to close all outstanding operations
-	Wait(ctx context.Context)
-	// GetProxyPeerClient returns the proxy peer client
-	GetProxyPeerClient() *peer.Client
-}
-
-const (
-	// NoApplicationTunnel is the error message returned when application
-	// reverse tunnel cannot be found.
-	//
-	// It usually happens when an app agent has shut down (or crashed) but
-	// hasn't expired from the backend yet.
-	NoApplicationTunnel = "could not find reverse tunnel, check that Application Service agent proxying this application is up and running"
-	// NoDatabaseTunnel is the error message returned when database reverse
-	// tunnel cannot be found.
-	//
-	// It usually happens when a database agent has shut down (or crashed) but
-	// hasn't expired from the backend yet.
-	NoDatabaseTunnel = "could not find reverse tunnel, check that Database Service agent proxying this database is up and running"
-	// NoOktaTunnel is the error message returned when an Okta
-	// reverse tunnel cannot be found.
-	//
-	// It usually happens when an Okta service has shut down (or crashed) but
-	// hasn't expired from the backend yet.
-	NoOktaTunnel = "could not find reverse tunnel, check that Okta Service agent proxying this application is up and running"
-)
+// RemoteSite is an alias used to prevent breaking e.
+// TODO(tross): remove once e has been updated to use reversetunnelclient
+type RemoteSite = reversetunnelclient.RemoteSite
diff --git a/lib/reversetunnel/localsite.go b/lib/reversetunnel/localsite.go
index 6001a6c057720..80024870d90ef 100644
--- a/lib/reversetunnel/localsite.go
+++ b/lib/reversetunnel/localsite.go
@@ -220,7 +220,7 @@ func (s *localSite) GetLastConnected() time.Time {
 	return s.clock.Now()
 }
 
-func (s *localSite) DialAuthServer(params DialParams) (net.Conn, error) {
+func (s *localSite) DialAuthServer(params reversetunnelclient.DialParams) (net.Conn, error) {
 	if len(s.authServers) == 0 {
 		return nil, trace.ConnectionProblem(nil, "no auth servers available")
 	}
@@ -238,7 +238,26 @@ func (s *localSite) DialAuthServer(params DialParams) (net.Conn, error) {
 	return conn, nil
 }
 
-func (s *localSite) Dial(params DialParams) (net.Conn, error) {
+// shouldDialAndForward returns whether a connection should be proxied
+// and forwarded or not.
+func shouldDialAndForward(params reversetunnelclient.DialParams, recConfig types.SessionRecordingConfig) bool {
+	// connection is already being tunneled, do not forward
+	if params.FromPeerProxy {
+		return false
+	}
+	// the node is an agentless node, the connection must be forwarded
+	if params.TargetServer != nil && params.TargetServer.GetSubKind() == types.SubKindOpenSSHNode {
+		return true
+	}
+	// proxy session recording mode is being used and an SSH session
+	// is being requested, the connection must be forwarded
+	if params.ConnType == types.NodeTunnel && services.IsRecordAtProxy(recConfig.GetMode()) {
+		return true
+	}
+	return false
+}
+
+func (s *localSite) Dial(params reversetunnelclient.DialParams) (net.Conn, error) {
 	recConfig, err := s.accessPoint.GetSessionRecordingConfig(s.srv.Context)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -263,7 +282,7 @@ func shouldSendSignedPROXYHeader(signer multiplexer.PROXYHeaderSigner, version s
 		dstAddr == nil)
 }
 
-func (s *localSite) maybeSendSignedPROXYHeader(params DialParams, conn net.Conn, useTunnel, checkVersion bool) error {
+func (s *localSite) maybeSendSignedPROXYHeader(params reversetunnelclient.DialParams, conn net.Conn, useTunnel, checkVersion bool) error {
 	if !shouldSendSignedPROXYHeader(s.srv.proxySigner, params.TeleportVersion, useTunnel, checkVersion, params.From, params.OriginalClientDstAddr) {
 		return nil
 	}
@@ -281,7 +300,7 @@ func (s *localSite) maybeSendSignedPROXYHeader(params DialParams, conn net.Conn,
 }
 
 // TODO(awly): unit test this
-func (s *localSite) DialTCP(params DialParams) (net.Conn, error) {
+func (s *localSite) DialTCP(params reversetunnelclient.DialParams) (net.Conn, error) {
 	s.log.Debugf("Dialing %v.", params)
 
 	conn, useTunnel, err := s.getConn(params)
@@ -336,7 +355,7 @@ func (s *localSite) adviseReconnect(ctx context.Context) {
 	}
 }
 
-func (s *localSite) dialAndForward(params DialParams) (_ net.Conn, retErr error) {
+func (s *localSite) dialAndForward(params reversetunnelclient.DialParams) (_ net.Conn, retErr error) {
 	if params.GetUserAgent == nil && params.AgentlessSigner == nil {
 		return nil, trace.BadParameter("user agent getter and agentless signer both missing")
 	}
@@ -439,7 +458,7 @@ func (s *localSite) dialTunnel(dreq *sshutils.DialReq) (net.Conn, error) {
 
 // tryProxyPeering determines whether the node should try to be reached over
 // a peer proxy.
-func (s *localSite) tryProxyPeering(params DialParams) bool {
+func (s *localSite) tryProxyPeering(params reversetunnelclient.DialParams) bool {
 	if s.peerClient == nil {
 		return false
 	}
@@ -454,7 +473,7 @@ func (s *localSite) tryProxyPeering(params DialParams) bool {
 }
 
 // skipDirectDial determines if a direct dial attempt should be made.
-func (s *localSite) skipDirectDial(params DialParams) (bool, error) {
+func (s *localSite) skipDirectDial(params reversetunnelclient.DialParams) (bool, error) {
 	// Connections to application and database servers should never occur
 	// over a direct dial.
 	switch params.ConnType {
@@ -480,7 +499,7 @@ func (s *localSite) skipDirectDial(params DialParams) (bool, error) {
 	return false, nil
 }
 
-func getTunnelErrorMessage(params DialParams, connStr string, err error) string {
+func getTunnelErrorMessage(params reversetunnelclient.DialParams, connStr string, err error) string {
 	errorMessageTemplate := `Teleport proxy failed to connect to %q agent %q over %s:
 
   %v
@@ -497,7 +516,14 @@ with the cluster.`
 	return fmt.Sprintf(errorMessageTemplate, params.ConnType, toAddr, connStr, err)
 }
 
-func (s *localSite) getConn(params DialParams) (conn net.Conn, useTunnel bool, err error) {
+func stringOrEmpty(addr net.Addr) string {
+	if addr == nil {
+		return ""
+	}
+	return addr.String()
+}
+
+func (s *localSite) getConn(params reversetunnelclient.DialParams) (conn net.Conn, useTunnel bool, err error) {
 	dreq := &sshutils.DialReq{
 		ServerID:        params.ServerID,
 		ConnType:        params.ConnType,
diff --git a/lib/reversetunnel/peer.go b/lib/reversetunnel/peer.go
index d59117a2977f2..45eb8082b4712 100644
--- a/lib/reversetunnel/peer.go
+++ b/lib/reversetunnel/peer.go
@@ -29,6 +29,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -127,18 +128,18 @@ func (p *clusterPeers) GetLastConnected() time.Time {
 	return peer.GetLastConnected()
 }
 
-func (p *clusterPeers) DialAuthServer(DialParams) (net.Conn, error) {
+func (p *clusterPeers) DialAuthServer(reversetunnelclient.DialParams) (net.Conn, error) {
 	return nil, trace.ConnectionProblem(nil, "unable to dial to auth server, this proxy has not been discovered yet, try again later")
 }
 
 // Dial is used to connect a requesting client (say, tsh) to an SSH server
 // located in a remote connected site, the connection goes through the
 // reverse proxy tunnel.
-func (p *clusterPeers) Dial(params DialParams) (conn net.Conn, err error) {
+func (p *clusterPeers) Dial(params reversetunnelclient.DialParams) (conn net.Conn, err error) {
 	return p.DialTCP(params)
 }
 
-func (p *clusterPeers) DialTCP(params DialParams) (conn net.Conn, err error) {
+func (p *clusterPeers) DialTCP(params reversetunnelclient.DialParams) (conn net.Conn, err error) {
 	return nil, trace.ConnectionProblem(nil, "unable to dial, this proxy has not been discovered yet, try again later")
 }
 
@@ -234,7 +235,7 @@ func (s *clusterPeer) GetLastConnected() time.Time {
 // Dial is used to connect a requesting client (say, tsh) to an SSH server
 // located in a remote connected site, the connection goes through the
 // reverse proxy tunnel.
-func (s *clusterPeer) Dial(params DialParams) (conn net.Conn, err error) {
+func (s *clusterPeer) Dial(params reversetunnelclient.DialParams) (conn net.Conn, err error) {
 	return nil, trace.ConnectionProblem(nil, "unable to dial, this proxy %v has not been discovered yet, try again later", s)
 }
 
diff --git a/lib/reversetunnel/rc_manager.go b/lib/reversetunnel/rc_manager.go
index 0549451570657..a6b22d9d1f1ab 100644
--- a/lib/reversetunnel/rc_manager.go
+++ b/lib/reversetunnel/rc_manager.go
@@ -72,7 +72,7 @@ type RemoteClusterTunnelManagerConfig struct {
 	LocalCluster string
 	// Local ReverseTunnelServer to reach other cluster members connecting to
 	// this proxy over a tunnel.
-	ReverseTunnelServer Server
+	ReverseTunnelServer reversetunnelclient.Server
 	// Clock is a mock-able clock.
 	Clock clockwork.Clock
 	// KubeDialAddr is an optional address of a local kubernetes proxy.
diff --git a/lib/reversetunnel/remotesite.go b/lib/reversetunnel/remotesite.go
index c952f12d72f7a..c21b5b06ac734 100644
--- a/lib/reversetunnel/remotesite.go
+++ b/lib/reversetunnel/remotesite.go
@@ -36,6 +36,7 @@ import (
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/forward"
 	"github.com/gravitational/teleport/lib/teleagent"
@@ -67,7 +68,7 @@ type remoteSite struct {
 	certificateCache *certificateCache
 
 	// localClient provides access to the Auth Server API of the cluster
-	// within which reversetunnel.Server is running.
+	// within which reversetunnelclient.Server is running.
 	localClient auth.ClientI
 	// remoteClient provides access to the Auth Server API of the remote cluster that
 	// this site belongs to.
@@ -136,7 +137,7 @@ func (s *remoteSite) getRemoteClient() (auth.ClientI, bool, error) {
 }
 
 func (s *remoteSite) authServerContextDialer(ctx context.Context, network, address string) (net.Conn, error) {
-	conn, err := s.DialAuthServer(DialParams{})
+	conn, err := s.DialAuthServer(reversetunnelclient.DialParams{})
 	return conn, err
 }
 
@@ -742,7 +743,7 @@ func (s *remoteSite) watchLocks() error {
 	}
 }
 
-func (s *remoteSite) DialAuthServer(params DialParams) (net.Conn, error) {
+func (s *remoteSite) DialAuthServer(params reversetunnelclient.DialParams) (net.Conn, error) {
 	conn, err := s.connThroughTunnel(&sshutils.DialReq{
 		Address:       constants.RemoteAuthServer,
 		ClientSrcAddr: stringOrEmpty(params.From),
@@ -754,7 +755,7 @@ func (s *remoteSite) DialAuthServer(params DialParams) (net.Conn, error) {
 // Dial is used to connect a requesting client (say, tsh) to an SSH server
 // located in a remote connected site, the connection goes through the
 // reverse proxy tunnel.
-func (s *remoteSite) Dial(params DialParams) (net.Conn, error) {
+func (s *remoteSite) Dial(params reversetunnelclient.DialParams) (net.Conn, error) {
 	recConfig, err := s.localAccessPoint.GetSessionRecordingConfig(s.ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -771,7 +772,7 @@ func (s *remoteSite) Dial(params DialParams) (net.Conn, error) {
 	return s.DialTCP(params)
 }
 
-func (s *remoteSite) DialTCP(params DialParams) (net.Conn, error) {
+func (s *remoteSite) DialTCP(params reversetunnelclient.DialParams) (net.Conn, error) {
 	s.logger.Debugf("Dialing from %v to %v.", params.From, params.To)
 
 	conn, err := s.connThroughTunnel(&sshutils.DialReq{
@@ -789,7 +790,7 @@ func (s *remoteSite) DialTCP(params DialParams) (net.Conn, error) {
 	return conn, nil
 }
 
-func (s *remoteSite) dialAndForward(params DialParams) (_ net.Conn, retErr error) {
+func (s *remoteSite) dialAndForward(params reversetunnelclient.DialParams) (_ net.Conn, retErr error) {
 	if params.GetUserAgent == nil && params.AgentlessSigner == nil {
 		return nil, trace.BadParameter("user agent getter and agentless signer both missing")
 	}
diff --git a/lib/reversetunnel/srv.go b/lib/reversetunnel/srv.go
index 24ee20083c5b3..8a588ca129e5d 100644
--- a/lib/reversetunnel/srv.go
+++ b/lib/reversetunnel/srv.go
@@ -45,6 +45,7 @@ import (
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/observability/metrics"
 	"github.com/gravitational/teleport/lib/proxy/peer"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/ingress"
 	"github.com/gravitational/teleport/lib/sshca"
@@ -281,7 +282,7 @@ func (cfg *Config) CheckAndSetDefaults() error {
 
 // NewServer creates and returns a reverse tunnel server which is fully
 // initialized but hasn't been started yet
-func NewServer(cfg Config) (Server, error) {
+func NewServer(cfg Config) (reversetunnelclient.Server, error) {
 	err := metrics.RegisterPrometheusCollectors(prometheusCollectors...)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -965,10 +966,10 @@ func (s *server) upsertRemoteCluster(conn net.Conn, sshConn *ssh.ServerConn) (*r
 	return site, remoteConn, nil
 }
 
-func (s *server) GetSites() ([]RemoteSite, error) {
+func (s *server) GetSites() ([]reversetunnelclient.RemoteSite, error) {
 	s.RLock()
 	defer s.RUnlock()
-	out := make([]RemoteSite, 0, len(s.remoteSites)+len(s.clusterPeers)+1)
+	out := make([]reversetunnelclient.RemoteSite, 0, len(s.remoteSites)+len(s.clusterPeers)+1)
 	out = append(out, s.localSite)
 
 	haveLocalConnection := make(map[string]bool)
@@ -1002,7 +1003,7 @@ func (s *server) getRemoteClusters() []*remoteSite {
 // with a cluster peer your best bet is to wait until the agent has discovered
 // all proxies behind a load balancer. Note, the cluster peer is a
 // services.TunnelConnection that was created by another proxy.
-func (s *server) GetSite(name string) (RemoteSite, error) {
+func (s *server) GetSite(name string) (reversetunnelclient.RemoteSite, error) {
 	s.RLock()
 	defer s.RUnlock()
 	if s.localSite.GetName() == name {
@@ -1029,7 +1030,7 @@ func (s *server) GetProxyPeerClient() *peer.Client {
 // alwaysClose forces onSiteTunnelClose to remove and close
 // the site by always returning false from HasValidConnections.
 type alwaysClose struct {
-	RemoteSite
+	reversetunnelclient.RemoteSite
 }
 
 func (a *alwaysClose) HasValidConnections() bool {
@@ -1122,7 +1123,7 @@ func newRemoteSite(srv *server, domainName string, sconn ssh.Conn) (*remoteSite,
 	}
 
 	// configure access to the full Auth Server API and the cached subset for
-	// the local cluster within which reversetunnel.Server is running.
+	// the local cluster within which reversetunnelclient.Server is running.
 	remoteSite.localClient = srv.localAuthClient
 	remoteSite.localAccessPoint = srv.localAccessPoint
 
diff --git a/lib/reversetunnel/track/tracker.go b/lib/reversetunnel/track/tracker.go
index 278891aee7395..5133ba91820e8 100644
--- a/lib/reversetunnel/track/tracker.go
+++ b/lib/reversetunnel/track/tracker.go
@@ -170,7 +170,6 @@ func (t *Tracker) tick() {
 		}
 		t.wp.Set(uint64(count))
 	}
-
 }
 
 func (t *Tracker) getOrCreate() *proxySet {
@@ -210,6 +209,20 @@ func (t *Tracker) release(principals ...string) {
 	t.sets.release(principals...)
 }
 
+// IsClaimed returns true if the proxy identified by the given principals is
+// already claimed by some other agent at the time of the call. Keep in mind
+// that a return value of false doesn't imply that a subsequent call to Claim is
+// guaranteed to succeed, as other goroutines might claim the same proxy between
+// IsClaimed and Claim.
+func (t *Tracker) IsClaimed(principals ...string) bool {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if t.sets == nil {
+		return false
+	}
+	return t.sets.isClaimed(principals...)
+}
+
 type entry struct {
 	lastSeen time.Time
 	claimed  bool
@@ -251,6 +264,11 @@ func (p *proxySet) release(principals ...string) {
 	}
 }
 
+func (p *proxySet) isClaimed(principals ...string) bool {
+	proxy := p.resolveName(principals)
+	return p.proxies[proxy].claimed
+}
+
 func (p *proxySet) markSeen(t time.Time, proxy string) {
 	e, ok := p.proxies[proxy]
 	if !ok {
diff --git a/lib/reversetunnel/track/tracker_test.go b/lib/reversetunnel/track/tracker_test.go
index 217040f4c8ec0..2d54009fb1ee4 100644
--- a/lib/reversetunnel/track/tracker_test.go
+++ b/lib/reversetunnel/track/tracker_test.go
@@ -273,7 +273,6 @@ func TestUUIDHandling(t *testing.T) {
 
 		t.Logf("Successfully claimed proxy")
 		<-ctx.Done()
-
 	}()
 	// Wait for proxy to be claimed
 Wait:
@@ -311,3 +310,29 @@ Wait:
 		}
 	}
 }
+
+func TestIsClaimed(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	tracker, err := New(ctx, Config{ClusterName: "test-cluster"})
+	require.NoError(t, err)
+
+	tracker.Start()
+	t.Cleanup(tracker.StopAll)
+
+	tracker.TrackExpected("proxy1", "proxy2")
+	require.False(t, tracker.IsClaimed("proxy1.test-cluster"))
+
+	unclaim, ok := tracker.Claim("proxy1.test-cluster")
+	require.True(t, ok)
+
+	require.True(t, tracker.IsClaimed("proxy1"))
+	require.True(t, tracker.IsClaimed("proxy1.test-cluster"))
+	require.False(t, tracker.IsClaimed("proxy2"))
+
+	unclaim()
+
+	require.False(t, tracker.IsClaimed("proxy1"))
+	require.False(t, tracker.IsClaimed("proxy2"))
+}
diff --git a/lib/reversetunnel/transport.go b/lib/reversetunnel/transport.go
index bc346ef11b8c2..76214cd3d35eb 100644
--- a/lib/reversetunnel/transport.go
+++ b/lib/reversetunnel/transport.go
@@ -76,7 +76,7 @@ type transport struct {
 	sconn sshutils.Conn
 
 	// reverseTunnelServer holds all reverse tunnel connections.
-	reverseTunnelServer Server
+	reverseTunnelServer reversetunnelclient.Server
 
 	// server is either an SSH or application server. It can handle a connection
 	// (perform handshake and handle request).
@@ -194,7 +194,7 @@ func (p *transport) start() {
 			var clientConn net.Conn = sshutils.NewChConn(p.sconn, p.channel)
 			src, err := utils.ParseAddr(dreq.ClientSrcAddr)
 			if err == nil {
-				clientConn = newConnectionWithSrcAddr(clientConn, src)
+				clientConn = utils.NewConnWithSrcAddr(clientConn, getTCPAddr(src))
 			}
 			p.server.HandleConnection(clientConn)
 			return
@@ -237,7 +237,7 @@ func (p *transport) start() {
 			var clientConn net.Conn = sshutils.NewChConn(p.sconn, p.channel)
 			src, err := utils.ParseAddr(dreq.ClientSrcAddr)
 			if err == nil {
-				clientConn = newConnectionWithSrcAddr(clientConn, src)
+				clientConn = utils.NewConnWithSrcAddr(clientConn, getTCPAddr(src))
 			}
 			p.server.HandleConnection(clientConn)
 			return
@@ -377,11 +377,11 @@ func (p *transport) getConn(addr string, r *sshutils.DialReq) (net.Conn, bool, e
 		// a direct dial, return right away.
 		switch r.ConnType {
 		case types.AppTunnel:
-			return nil, false, trace.ConnectionProblem(err, NoApplicationTunnel)
+			return nil, false, trace.ConnectionProblem(err, reversetunnelclient.NoApplicationTunnel)
 		case types.OktaTunnel:
-			return nil, false, trace.ConnectionProblem(err, NoOktaTunnel)
+			return nil, false, trace.ConnectionProblem(err, reversetunnelclient.NoOktaTunnel)
 		case types.DatabaseTunnel:
-			return nil, false, trace.ConnectionProblem(err, NoDatabaseTunnel)
+			return nil, false, trace.ConnectionProblem(err, reversetunnelclient.NoDatabaseTunnel)
 		}
 
 		errTun := err
@@ -450,37 +450,9 @@ func (p *transport) directDial(addr string) (net.Conn, error) {
 	return conn, nil
 }
 
-// connectionWithSrcAddr is a net.Conn wrapper that allows us to specify remote client address
-type connectionWithSrcAddr struct {
-	net.Conn
-	clientSrcAddr net.Addr
-}
-
-// RemoteAddr returns specified client source address
-func (c *connectionWithSrcAddr) RemoteAddr() net.Addr {
-	return c.clientSrcAddr
-}
-
-// NetConn returns the underlying net.Conn.
-func (c *connectionWithSrcAddr) NetConn() net.Conn {
-	return c.Conn
-}
-
-// newConnectionWithSrcAddr wraps provided connection and overrides client remote address
-func newConnectionWithSrcAddr(conn net.Conn, clientSrcAddr net.Addr) *connectionWithSrcAddr {
-	var addr net.Addr
-	if clientSrcAddr != nil {
-		addr = getTCPAddr(clientSrcAddr) // SSH package requires net.TCPAddr for source-address check
-	}
-	if addr == nil {
-		addr = conn.RemoteAddr()
-	}
-	return &connectionWithSrcAddr{
-		Conn:          conn,
-		clientSrcAddr: addr,
-	}
-}
-
+// getTCPAddr converts net.Addr to *net.TCPAddr.
+//
+// SSH package requires net.TCPAddr for source-address check.
 func getTCPAddr(addr net.Addr) *net.TCPAddr {
 	ap, err := netip.ParseAddrPort(addr.String())
 	if err != nil {
diff --git a/lib/reversetunnelclient/api.go b/lib/reversetunnelclient/api.go
new file mode 100644
index 0000000000000..3a6f9ab9df255
--- /dev/null
+++ b/lib/reversetunnelclient/api.go
@@ -0,0 +1,181 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package reversetunnelclient
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/proxy/peer"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/teleagent"
+)
+
+// DialParams is a list of parameters used to Dial to a node within a cluster.
+type DialParams struct {
+	// From is the source address.
+	From net.Addr
+
+	// To is the destination address.
+	To net.Addr
+
+	// GetUserAgent gets an SSH agent for use in connecting to the remote host. Used by the
+	// forwarding proxy.
+	GetUserAgent teleagent.Getter
+
+	// AgentlessSigner is used for authenticating to the remote host when it is an
+	// agentless node.
+	AgentlessSigner ssh.Signer
+
+	// Address is used by the forwarding proxy to generate a host certificate for
+	// the target node. This is needed because while dialing occurs via IP
+	// address, tsh thinks it's connecting via DNS name and that's how it
+	// validates the host certificate.
+	Address string
+
+	// Principals are additional principals that need to be added to the host
+	// certificate. Used by the recording proxy to correctly generate a host
+	// certificate.
+	Principals []string
+
+	// ServerID the hostUUID.clusterName of a Teleport node. Used with nodes
+	// that are connected over a reverse tunnel.
+	ServerID string
+
+	// ProxyIDs is a list of proxy ids the node is connected to.
+	ProxyIDs []string
+
+	// ConnType is the type of connection requested, either node or application.
+	// Only used when connecting through a tunnel.
+	ConnType types.TunnelType
+
+	// TargetServer is the host that the connection is being established for.
+	// It **MUST** only be populated when the target is a teleport ssh server
+	// or an agentless server.
+	TargetServer types.Server
+
+	// FromPeerProxy indicates that the dial request is being tunneled from
+	// a peer proxy.
+	FromPeerProxy bool
+
+	// TeleportVersion shows version of the target node, if we know that it's teleport node.
+	TeleportVersion string
+
+	// OriginalClientDstAddr is used in PROXY headers to show where client originally contacted Teleport infrastructure
+	OriginalClientDstAddr net.Addr
+}
+
+func (params DialParams) String() string {
+	to := params.To.String()
+	if to == "" {
+		to = params.ServerID
+	}
+	return fmt.Sprintf("from: %q to: %q", params.From, to)
+}
+
+// RemoteSite represents remote teleport site that can be accessed via
+// teleport tunnel or directly by proxy
+//
+// There are two implementations of this interface: local and remote sites.
+type RemoteSite interface {
+	// DialAuthServer returns a net.Conn to the Auth Server of a site.
+	DialAuthServer(DialParams) (conn net.Conn, err error)
+	// Dial dials any address within the site network, in terminating
+	// mode it uses local instance of forwarding server to terminate
+	// and record the connection.
+	Dial(DialParams) (conn net.Conn, err error)
+	// DialTCP dials any address within the site network and
+	// ignores recording mode, used in components that need direct dialer.
+	DialTCP(DialParams) (conn net.Conn, err error)
+	// GetLastConnected returns last time the remote site was seen connected
+	GetLastConnected() time.Time
+	// GetName returns site name (identified by authority domain's name)
+	GetName() string
+	// GetStatus returns status of this site (either offline or connected)
+	GetStatus() string
+	// GetClient returns client connected to remote auth server
+	GetClient() (auth.ClientI, error)
+	// CachingAccessPoint returns access point that is lightweight
+	// but is resilient to auth server crashes
+	CachingAccessPoint() (auth.RemoteProxyAccessPoint, error)
+	// NodeWatcher returns the node watcher that maintains the node set for the site
+	NodeWatcher() (*services.NodeWatcher, error)
+	// GetTunnelsCount returns the amount of active inbound tunnels
+	// from the remote cluster
+	GetTunnelsCount() int
+	// IsClosed reports whether this RemoteSite has been closed and should no
+	// longer be used.
+	IsClosed() bool
+	// Closer allows the site to be closed
+	io.Closer
+}
+
+// Tunnel provides access to connected local or remote clusters
+// using unified interface.
+type Tunnel interface {
+	// GetSites returns a list of connected remote sites
+	GetSites() ([]RemoteSite, error)
+	// GetSite returns remote site this node belongs to
+	GetSite(domainName string) (RemoteSite, error)
+}
+
+// Server is a TCP/IP SSH server which listens on an SSH endpoint and remote/local
+// sites connect and register with it.
+type Server interface {
+	Tunnel
+	// Start starts server
+	Start() error
+	// Close closes server's operations immediately
+	Close() error
+	// DrainConnections closes listeners and begins draining connections without
+	// closing open connections.
+	DrainConnections(context.Context) error
+	// Shutdown performs graceful server shutdown closing open connections.
+	Shutdown(context.Context) error
+	// Wait waits for server to close all outstanding operations
+	Wait(ctx context.Context)
+	// GetProxyPeerClient returns the proxy peer client
+	GetProxyPeerClient() *peer.Client
+}
+
+const (
+	// NoApplicationTunnel is the error message returned when application
+	// reverse tunnel cannot be found.
+	//
+	// It usually happens when an app agent has shut down (or crashed) but
+	// hasn't expired from the backend yet.
+	NoApplicationTunnel = "could not find reverse tunnel, check that Application Service agent proxying this application is up and running"
+	// NoDatabaseTunnel is the error message returned when database reverse
+	// tunnel cannot be found.
+	//
+	// It usually happens when a database agent has shut down (or crashed) but
+	// hasn't expired from the backend yet.
+	NoDatabaseTunnel = "could not find reverse tunnel, check that Database Service agent proxying this database is up and running"
+	// NoOktaTunnel is the error message returned when an Okta
+	// reverse tunnel cannot be found.
+	//
+	// It usually happens when an Okta service has shut down (or crashed) but
+	// hasn't expired from the backend yet.
+	NoOktaTunnel = "could not find reverse tunnel, check that Okta Service agent proxying this application is up and running"
+)
diff --git a/lib/reversetunnel/api_with_roles.go b/lib/reversetunnelclient/api_with_roles.go
similarity index 88%
rename from lib/reversetunnel/api_with_roles.go
rename to lib/reversetunnelclient/api_with_roles.go
index 598df413f7808..b2bd2f4ce2b95 100644
--- a/lib/reversetunnel/api_with_roles.go
+++ b/lib/reversetunnelclient/api_with_roles.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2020 Gravitational, Inc.
+Copyright 2023 Gravitational, Inc.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package reversetunnel
+package reversetunnelclient
 
 import (
 	"github.com/gravitational/trace"
@@ -32,9 +32,10 @@ type ClusterGetter interface {
 }
 
 // NewTunnelWithRoles returns new authorizing tunnel
-func NewTunnelWithRoles(tunnel Tunnel, accessChecker services.AccessChecker, access ClusterGetter) *TunnelWithRoles {
+func NewTunnelWithRoles(tunnel Tunnel, localCluster string, accessChecker services.AccessChecker, access ClusterGetter) *TunnelWithRoles {
 	return &TunnelWithRoles{
 		tunnel:        tunnel,
+		localCluster:  localCluster,
 		accessChecker: accessChecker,
 		access:        access,
 	}
@@ -44,6 +45,8 @@ func NewTunnelWithRoles(tunnel Tunnel, accessChecker services.AccessChecker, acc
 type TunnelWithRoles struct {
 	tunnel Tunnel
 
+	localCluster string
+
 	// accessChecker is used to check RBAC permissions.
 	accessChecker services.AccessChecker
 
@@ -58,7 +61,7 @@ func (t *TunnelWithRoles) GetSites() ([]RemoteSite, error) {
 	}
 	out := make([]RemoteSite, 0, len(clusters))
 	for _, cluster := range clusters {
-		if _, ok := cluster.(*localSite); ok {
+		if t.localCluster == cluster.GetName() {
 			out = append(out, cluster)
 			continue
 		}
@@ -87,7 +90,7 @@ func (t *TunnelWithRoles) GetSite(clusterName string) (RemoteSite, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if _, ok := cluster.(*localSite); ok {
+	if t.localCluster == cluster.GetName() {
 		return cluster, nil
 	}
 	rc, err := t.access.GetRemoteCluster(clusterName)
diff --git a/lib/reversetunnel/fake.go b/lib/reversetunnelclient/fake.go
similarity index 94%
rename from lib/reversetunnel/fake.go
rename to lib/reversetunnelclient/fake.go
index ea9439115ba19..6cc39242b89f1 100644
--- a/lib/reversetunnel/fake.go
+++ b/lib/reversetunnelclient/fake.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package reversetunnel
+package reversetunnelclient
 
 import (
 	"net"
@@ -26,7 +26,7 @@ import (
 	"github.com/gravitational/teleport/lib/auth"
 )
 
-// FakeServer is a fake reversetunnel.Server implementation used in tests.
+// FakeServer is a fake Server implementation used in tests.
 type FakeServer struct {
 	Server
 	// Sites is a list of sites registered via this fake reverse tunnel.
@@ -48,7 +48,7 @@ func (s *FakeServer) GetSite(name string) (RemoteSite, error) {
 	return nil, trace.NotFound("site %q not found", name)
 }
 
-// FakeRemoteSite is a fake reversetunnel.RemoteSite implementation used in tests.
+// FakeRemoteSite is a fake reversetunnelclient.RemoteSite implementation used in tests.
 type FakeRemoteSite struct {
 	RemoteSite
 	// Name is the remote site name.
diff --git a/lib/reversetunnelclient/transport.go b/lib/reversetunnelclient/transport.go
index 6a16df585d31a..f0af1caba1fc2 100644
--- a/lib/reversetunnelclient/transport.go
+++ b/lib/reversetunnelclient/transport.go
@@ -87,11 +87,14 @@ func (t *TunnelAuthDialer) DialContext(ctx context.Context, _, _ string) (net.Co
 	if mode == types.ProxyListenerMode_Multiplex {
 		opts = append(opts, proxy.WithALPNDialer(client.ALPNDialerConfig{
 			TLSConfig: &tls.Config{
-				NextProtos:         []string{string(alpncommon.ProtocolReverseTunnel)},
+				NextProtos: []string{
+					string(alpncommon.ProtocolReverseTunnelV2),
+					string(alpncommon.ProtocolReverseTunnel),
+				},
 				InsecureSkipVerify: t.InsecureSkipTLSVerify,
 			},
 			DialTimeout:             t.ClientConfig.Timeout,
-			ALPNConnUpgradeRequired: client.IsALPNConnUpgradeRequired(addr.Addr, t.InsecureSkipTLSVerify),
+			ALPNConnUpgradeRequired: client.IsALPNConnUpgradeRequired(ctx, addr.Addr, t.InsecureSkipTLSVerify),
 			GetClusterCAs:           client.ClusterCAsFromCertPool(t.ClusterCAs),
 		}))
 	}
diff --git a/lib/service/acme.go b/lib/service/acme.go
index 3651e905d8b44..f2b3febab6c3c 100644
--- a/lib/service/acme.go
+++ b/lib/service/acme.go
@@ -24,7 +24,7 @@ import (
 	"github.com/gravitational/trace"
 	"golang.org/x/exp/slices"
 
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/web/app"
 )
@@ -35,7 +35,7 @@ type hostPolicyCheckerConfig struct {
 	// clt is used to get the list of registered applications
 	clt app.Getter
 	// tun is a reverse tunnel
-	tun reversetunnel.Tunnel
+	tun reversetunnelclient.Tunnel
 	// clusterName is a name of this cluster
 	clusterName string
 }
diff --git a/lib/service/connect.go b/lib/service/connect.go
index a66bc70f8a635..188ddeced8f03 100644
--- a/lib/service/connect.go
+++ b/lib/service/connect.go
@@ -228,7 +228,7 @@ func (process *TeleportProcess) connect(role types.SystemRole, opts ...certOptio
 	for _, opt := range opts {
 		opt(&options)
 	}
-	state, err := process.storage.GetState(role)
+	state, err := process.storage.GetState(context.TODO(), role)
 	if err != nil {
 		if !trace.IsNotFound(err) {
 			return nil, trace.Wrap(err)
@@ -737,7 +737,7 @@ func (process *TeleportProcess) syncOpenSSHRotationState() error {
 		return trace.Wrap(err)
 	}
 
-	state, err := process.storage.GetState(types.RoleNode)
+	state, err := process.storage.GetState(ctx, types.RoleNode)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -975,7 +975,7 @@ func (process *TeleportProcess) syncRotationState(conn *Connector) (*rotationSta
 // syncServiceRotationState syncs up rotation state for internal services (Auth, Proxy, Node) and
 // if necessary, updates credentials. Returns true if the service will need to reload.
 func (process *TeleportProcess) syncServiceRotationState(ca types.CertAuthority, conn *Connector) (*rotationStatus, error) {
-	state, err := process.storage.GetState(conn.ClientIdentity.ID.Role)
+	state, err := process.storage.GetState(context.TODO(), conn.ClientIdentity.ID.Role)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/service/service.go b/lib/service/service.go
index 88530b92c8628..765df2012fd46 100644
--- a/lib/service/service.go
+++ b/lib/service/service.go
@@ -66,8 +66,10 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/agentless"
+	"github.com/gravitational/teleport/lib/ai"
 	"github.com/gravitational/teleport/lib/auditd"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/keygen"
@@ -223,7 +225,7 @@ const (
 	// been set up.
 	InstanceReady = "InstanceReady"
 
-	// DiscoveryReady is generated when the Teleport database proxy service
+	// DiscoveryReady is generated when the Teleport discovery service
 	// is ready to start accepting connections.
 	DiscoveryReady = "DiscoveryReady"
 
@@ -256,6 +258,15 @@ const (
 	TeleportOKEvent = "TeleportOKEvent"
 )
 
+const (
+	// embeddingInitialDelay is the time to wait before the first embedding
+	// routine is started.
+	embeddingInitialDelay = 10 * time.Second
+	// embeddingPeriod is the time between two embedding routines.
+	// A seventh jitter is applied on the period.
+	embeddingPeriod = time.Hour
+)
+
 // Connector has all resources process needs to connect to other parts of the
 // cluster: client and identity.
 type Connector struct {
@@ -1061,7 +1072,7 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 	if cfg.Tracing.Enabled {
 		eventMapping.In = append(eventMapping.In, TracingReady)
 	}
-	if cfg.Discovery.Enabled {
+	if process.shouldInitDiscovery() {
 		eventMapping.In = append(eventMapping.In, DiscoveryReady)
 	}
 
@@ -1113,6 +1124,9 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 		process.initDatabases()
 		serviceStarted = true
 	} else {
+		if process.Config.Databases.Enabled {
+			process.log.Warn("Database service is enabled with empty configuration, skipping initialization")
+		}
 		warnOnErr(process.closeImportedDescriptors(teleport.ComponentDatabase), process.log)
 	}
 
@@ -1134,6 +1148,9 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 		process.initDiscovery()
 		serviceStarted = true
 	} else {
+		if process.Config.Discovery.Enabled {
+			process.log.Warn("Discovery service is enabled with empty configuration, skipping initialization")
+		}
 		warnOnErr(process.closeImportedDescriptors(teleport.ComponentDiscovery), process.log)
 	}
 
@@ -1153,7 +1170,7 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 	// run one upload completer per-process
 	// even in sync recording modes, since the recording mode can be changed
 	// at any time with dynamic configuration
-	process.RegisterFunc("common.upload", process.initUploaderService)
+	process.RegisterFunc("common.upload.init", process.initUploaderService)
 
 	if !serviceStarted {
 		return nil, trace.BadParameter("all services failed to start")
@@ -1617,6 +1634,13 @@ func (process *TeleportProcess) initAuthService() error {
 		traceClt = clt
 	}
 
+	var embedderClient ai.Embedder
+	if cfg.Auth.AssistAPIKey != "" {
+		embedderClient = ai.NewClient(cfg.Auth.AssistAPIKey)
+	}
+
+	embeddingsRetriever := ai.NewSimpleRetriever()
+
 	// first, create the AuthServer
 	authServer, err := auth.Init(auth.InitConfig{
 		Backend:                 b,
@@ -1655,6 +1679,8 @@ func (process *TeleportProcess) initAuthService() error {
 		LoadAllCAs:              cfg.Auth.LoadAllCAs,
 		Clock:                   cfg.Clock,
 		HTTPClientForAWSSTS:     cfg.Auth.HTTPClientForAWSSTS,
+		EmbeddingRetriever:      embeddingsRetriever,
+		EmbeddingClient:         embedderClient,
 	}, func(as *auth.Server) error {
 		if !process.Config.CachePolicy.Enabled {
 			return nil
@@ -1694,6 +1720,40 @@ func (process *TeleportProcess) initAuthService() error {
 	}
 	authServer.SetLockWatcher(lockWatcher)
 
+	if embedderClient != nil {
+		log.Debugf("Starting embedding watcher")
+		embeddingProcessor := ai.NewEmbeddingProcessor(&ai.EmbeddingProcessorConfig{
+			AIClient:            embedderClient,
+			EmbeddingsRetriever: embeddingsRetriever,
+			EmbeddingSrv:        authServer,
+			NodeSrv:             authServer,
+			Log:                 log,
+			Jitter:              retryutils.NewFullJitter(),
+		})
+
+		process.RegisterFunc("ai.embedding-processor", func() error {
+			// We check the Assist feature flag here rather than on creation of TeleportProcess,
+			// as when running Enterprise and the feature source is Cloud,
+			// features may be loaded at two different times:
+			// 1. When Cloud is reachable, features will be fetched from Cloud
+			//    before constructing TeleportProcess
+			// 2. When Cloud is not reachable, we will attempt to load cached features
+			//    from the Teleport backend.
+			// In the second case, we don't know the final value of Features().Assist
+			// when constructing the process.
+			// Services in the supervisor will only start after either 1 or 2 has succeeded,
+			// so we can make the decision here.
+			//
+			// Ref: e/tool/teleport/process/process.go
+			if !modules.GetModules().Features().Assist {
+				log.Debug("Skipping start of embedding processor: Assist feature not enabled for license")
+				return nil
+			}
+			log.Debugf("Starting embedding processor")
+			return embeddingProcessor.Run(process.GracefulExitContext(), embeddingInitialDelay, embeddingPeriod)
+		})
+	}
+
 	headlessAuthenticationWatcher, err := local.NewHeadlessAuthenticationWatcher(process.ExitContext(), local.HeadlessAuthenticationWatcherConfig{
 		Backend: b,
 	})
@@ -1886,7 +1946,7 @@ func (process *TeleportProcess) initAuthService() error {
 					Version:  teleport.Version,
 				},
 			}
-			state, err := process.storage.GetState(types.RoleAdmin)
+			state, err := process.storage.GetState(process.GracefulExitContext(), types.RoleAdmin)
 			if err != nil {
 				if !trace.IsNotFound(err) {
 					log.Warningf("Failed to get rotation state: %v.", err)
@@ -2199,7 +2259,7 @@ func (process *TeleportProcess) NewLocalCache(clt auth.ClientI, setupConfig cach
 
 // GetRotation returns the process rotation.
 func (process *TeleportProcess) GetRotation(role types.SystemRole) (*types.Rotation, error) {
-	state, err := process.storage.GetState(role)
+	state, err := process.storage.GetState(context.TODO(), role)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3612,7 +3672,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 
 	// register SSH reverse tunnel server that accepts connections
 	// from remote teleport nodes
-	var tsrv reversetunnel.Server
+	var tsrv reversetunnelclient.Server
 	var peerClient *peer.Client
 
 	if !process.Config.Proxy.DisableReverseTunnel {
@@ -3789,14 +3849,17 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			ProxyKubeAddr:    proxyKubeAddr,
 			TraceClient:      traceClt,
 			Router:           proxyRouter,
-			SessionControl:   sessionController,
-			PROXYSigner:      proxySigner,
+			SessionControl: web.SessionControllerFunc(func(ctx context.Context, sctx *web.SessionContext, login, localAddr, remoteAddr string) (context.Context, error) {
+				controller := srv.WebSessionController(sessionController)
+				ctx, err := controller(ctx, sctx, login, localAddr, remoteAddr)
+				return ctx, trace.Wrap(err)
+			}),
+			PROXYSigner: proxySigner,
 		}
 		webHandler, err := web.NewHandler(webConfig)
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		proxyLimiter.WrapHandle(webHandler)
 		if !cfg.Proxy.DisableTLS && cfg.Proxy.DisableALPNSNIListener {
 			listeners.tls, err = multiplexer.NewWebListener(multiplexer.WebListenerConfig{
 				Listener: tls.NewListener(listeners.web, tlsConfigWeb),
@@ -3819,7 +3882,12 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 
 		webServer, err = web.NewServer(web.ServerConfig{
 			Server: &http.Server{
-				Handler:           httplib.MakeTracingHandler(proxyLimiter, teleport.ComponentProxy),
+				Handler: utils.ChainHTTPMiddlewares(
+					webHandler,
+					makeXForwardedForMiddleware(cfg),
+					limiter.MakeMiddleware(proxyLimiter),
+					httplib.MakeTracingMiddleware(teleport.ComponentProxy),
+				),
 				ReadHeaderTimeout: apidefaults.DefaultIOTimeout,
 				IdleTimeout:       apidefaults.DefaultIdleTimeout,
 				ErrorLog:          utils.NewStdlogger(log.Error, teleport.ComponentProxy),
@@ -4429,6 +4497,19 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			if alpnServer != nil {
 				warnOnErr(alpnServer.Close(), log)
 			}
+
+			// Explicitly deleting proxy heartbeats helps the behavior of
+			// reverse tunnel agents during rollouts, as otherwise they'll keep
+			// trying to reach proxies until the heartbeats expire.
+			if services.ShouldDeleteServerHeartbeatsOnShutdown(ctx) {
+				if err := conn.Client.DeleteProxy(ctx, process.Config.HostUUID); err != nil {
+					if !trace.IsNotFound(err) {
+						log.WithError(err).Warn("Failed to delete heartbeat.")
+					} else {
+						log.WithError(err).Debug("Failed to delete heartbeat.")
+					}
+				}
+			}
 		}
 		warnOnErr(asyncEmitter.Close(), log)
 		warnOnErr(conn.Close(), log)
@@ -4528,7 +4609,7 @@ func kubeDialAddr(config servicecfg.ProxyConfig, mode types.ProxyListenerMode) u
 	return config.Kube.ListenAddr
 }
 
-func (process *TeleportProcess) setupProxyTLSConfig(conn *Connector, tsrv reversetunnel.Server, accessPoint auth.ReadProxyAccessPoint, clusterName string) (*tls.Config, error) {
+func (process *TeleportProcess) setupProxyTLSConfig(conn *Connector, tsrv reversetunnelclient.Server, accessPoint auth.ReadProxyAccessPoint, clusterName string) (*tls.Config, error) {
 	cfg := process.Config
 	var tlsConfig *tls.Config
 	acmeCfg := process.Config.Proxy.ACME
@@ -5652,3 +5733,10 @@ func copyAndConfigureTLS(config *tls.Config, log logrus.FieldLogger, accessPoint
 
 	return tlsConfig
 }
+
+func makeXForwardedForMiddleware(cfg *servicecfg.Config) utils.HTTPMiddleware {
+	if cfg.Proxy.TrustXForwardedFor {
+		return web.NewXForwardedForMiddleware
+	}
+	return utils.NoopHTTPMiddleware
+}
diff --git a/lib/service/service_test.go b/lib/service/service_test.go
index 3b31487f13848..d0aca3ad6ea66 100644
--- a/lib/service/service_test.go
+++ b/lib/service/service_test.go
@@ -56,7 +56,6 @@ import (
 	"github.com/gravitational/teleport/lib/events/athena"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/modules"
-	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
@@ -617,7 +616,7 @@ type mockAccessPoint struct {
 }
 
 type mockReverseTunnelServer struct {
-	reversetunnel.Server
+	reversetunnelclient.Server
 }
 
 func TestSetupProxyTLSConfig(t *testing.T) {
diff --git a/lib/service/servicecfg/app.go b/lib/service/servicecfg/app.go
index 6b4b582b3e33d..d7f881445fcc4 100644
--- a/lib/service/servicecfg/app.go
+++ b/lib/service/servicecfg/app.go
@@ -101,7 +101,7 @@ func (a *App) CheckAndSetDefaults() error {
 	// are invalid subdomains because for trusted clusters the name is used to
 	// construct the domain that the application will be available at.
 	if errs := validation.IsDNS1035Label(a.Name); len(errs) > 0 {
-		return trace.BadParameter("application name %q must be a valid DNS subdomain: https://goteleport.com/teleport/docs/application-access/#application-name", a.Name)
+		return trace.BadParameter("application name %q must be a valid DNS subdomain: https://goteleport.com/docs/application-access/guides/connecting-apps/#application-name", a.Name)
 	}
 	// Parse and validate URL.
 	if _, err := url.Parse(a.URI); err != nil {
diff --git a/lib/service/servicecfg/auth.go b/lib/service/servicecfg/auth.go
index 8a647f8e56575..5e9dee5b8ba80 100644
--- a/lib/service/servicecfg/auth.go
+++ b/lib/service/servicecfg/auth.go
@@ -105,6 +105,10 @@ type AuthConfig struct {
 	// HTTPClientForAWSSTS overwrites the default HTTP client used for making
 	// STS requests. Used in test.
 	HTTPClientForAWSSTS utils.HTTPDoClient
+
+	// AssistAPIKey is the OpenAI API key.
+	// TODO: This key will be moved to a plugin once support for plugins is implemented.
+	AssistAPIKey string
 }
 
 // HostedPluginsConfig configures the hosted plugin runtime.
diff --git a/lib/service/servicecfg/database.go b/lib/service/servicecfg/database.go
index b75c6cecd248e..271eaa2d9a22e 100644
--- a/lib/service/servicecfg/database.go
+++ b/lib/service/servicecfg/database.go
@@ -37,9 +37,9 @@ type DatabasesConfig struct {
 	// ResourceMatchers match cluster database resources.
 	ResourceMatchers []services.ResourceMatcher
 	// AWSMatchers match AWS hosted databases.
-	AWSMatchers []services.AWSMatcher
+	AWSMatchers []types.AWSMatcher
 	// AzureMatchers match Azure hosted databases.
-	AzureMatchers []services.AzureMatcher
+	AzureMatchers []types.AzureMatcher
 	// Limiter limits the connection and request rates.
 	Limiter limiter.Config
 }
diff --git a/lib/service/servicecfg/discovery.go b/lib/service/servicecfg/discovery.go
index a5c0ea549218c..ce2bbe8717de9 100644
--- a/lib/service/servicecfg/discovery.go
+++ b/lib/service/servicecfg/discovery.go
@@ -14,16 +14,18 @@
 
 package servicecfg
 
-import "github.com/gravitational/teleport/lib/services"
+import (
+	"github.com/gravitational/teleport/api/types"
+)
 
 type DiscoveryConfig struct {
 	Enabled bool
 	// AWSMatchers are used to match EC2 instances for auto enrollment.
-	AWSMatchers []services.AWSMatcher
+	AWSMatchers []types.AWSMatcher
 	// AzureMatchers are used to match resources for auto enrollment.
-	AzureMatchers []services.AzureMatcher
+	AzureMatchers []types.AzureMatcher
 	// GCPMatchers are used to match GCP resources for auto discovery.
-	GCPMatchers []services.GCPMatcher
+	GCPMatchers []types.GCPMatcher
 	// DiscoveryGroup is the name of the discovery group that the current
 	// discovery service is a part of.
 	// It is used to filter out discovered resources that belong to another
diff --git a/lib/service/servicecfg/proxy.go b/lib/service/servicecfg/proxy.go
index 447e0a174c459..32d0eed6ca25e 100644
--- a/lib/service/servicecfg/proxy.go
+++ b/lib/service/servicecfg/proxy.go
@@ -136,6 +136,11 @@ type ProxyConfig struct {
 	// AssistAPIKey is the OpenAI API key.
 	// TODO: This key will be moved to a plugin once support for plugins is implemented.
 	AssistAPIKey string
+
+	// TrustXForwardedFor enables the service to take client source IPs from
+	// the "X-Forwarded-For" headers for web APIs recevied from layer 7 load
+	// balancers or reverse proxies.
+	TrustXForwardedFor bool
 }
 
 // WebPublicAddr returns the address for the web endpoint on this proxy that
diff --git a/lib/service/supervisor.go b/lib/service/supervisor.go
index f9cb650cf573d..6d775f8621367 100644
--- a/lib/service/supervisor.go
+++ b/lib/service/supervisor.go
@@ -114,20 +114,25 @@ func (e EventMapping) String() string {
 	return fmt.Sprintf("EventMapping(in=%v, out=%v)", e.In, e.Out)
 }
 
-func (e EventMapping) matches(currentEvent string, m map[string]Event) bool {
+// matches indicates whether the event mapping has been satisfied.
+// If returns an error only if the mapping is unsatisified because
+// we are still waiting on one or more events.
+func (e EventMapping) matches(currentEvent string, m map[string]Event) (bool, error) {
 	// existing events that have been fired should match
 	for _, in := range e.In {
 		if _, ok := m[in]; !ok {
-			return false
+			return false, fmt.Errorf("still waiting for %v", in)
 		}
 	}
 	// current event that is firing should match one of the expected events
 	for _, in := range e.In {
 		if currentEvent == in {
-			return true
+			return true, nil
 		}
 	}
-	return false
+
+	// mapping not satisfied, and this event is not part of the mapping
+	return false, nil
 }
 
 // LocalSupervisor is a Teleport's implementation of the Supervisor interface.
@@ -392,7 +397,7 @@ func (s *LocalSupervisor) BroadcastEvent(event Event) {
 	}()
 
 	for _, m := range s.eventMappings {
-		if m.matches(event.Name, s.events) {
+		if matches, err := m.matches(event.Name, s.events); matches && err == nil {
 			mappedEvent := Event{Name: m.Out}
 			s.events[mappedEvent.Name] = mappedEvent
 			go func(e Event) {
@@ -406,6 +411,8 @@ func (s *LocalSupervisor) BroadcastEvent(event Event) {
 				"in":  event.String(),
 				"out": m.String(),
 			}).Debug("Broadcasting mapped event.")
+		} else if err != nil {
+			s.log.Debugf("Teleport not yet ready: %v", err)
 		}
 	}
 }
diff --git a/lib/services/access_checker.go b/lib/services/access_checker.go
index 5e73219734f5b..f8e438a182570 100644
--- a/lib/services/access_checker.go
+++ b/lib/services/access_checker.go
@@ -17,6 +17,7 @@ limitations under the License.
 package services
 
 import (
+	"context"
 	"strings"
 	"time"
 
@@ -28,6 +29,7 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/wrappers"
+	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
@@ -42,6 +44,9 @@ type AccessChecker interface {
 	// RoleNames returns a list of role names
 	RoleNames() []string
 
+	// Traits returns the set of user traits
+	Traits() wrappers.Traits
+
 	// Roles returns the list underlying roles this AccessChecker is based on.
 	Roles() []types.Role
 
@@ -213,6 +218,34 @@ type AccessChecker interface {
 	// GetKubeResources returns the allowed and denied Kubernetes Resources configured
 	// for a user.
 	GetKubeResources(cluster types.KubeCluster) (allowed, denied []types.KubernetesResource)
+
+	// EnumerateEntities works on a given role set to return a minimal description
+	// of allowed set of entities (db_users, db_names, etc). It is biased towards
+	// *allowed* entities; It is meant to describe what the user can do, rather than
+	// cannot do. For that reason if the user isn't allowed to pick *any* entities,
+	// the output will be empty.
+	//
+	// In cases where * is listed in set of allowed entities, it may be hard for
+	// users to figure out the expected entity to use. For this reason the parameter
+	// extraEntities provides an extra set of entities to be checked against
+	// RoleSet. This extra set of entities may be sourced e.g. from user connection
+	// history.
+	EnumerateEntities(resource AccessCheckable, listFn roleEntitiesListFn, newMatcher roleMatcherFactoryFn, extraEntities ...string) EnumerationResult
+
+	// EnumerateDatabaseUsers specializes EnumerateEntities to enumerate db_users.
+	EnumerateDatabaseUsers(database types.Database, extraUsers ...string) EnumerationResult
+
+	// EnumerateDatabaseNames specializes EnumerateEntities to enumerate db_names.
+	EnumerateDatabaseNames(database types.Database, extraNames ...string) EnumerationResult
+
+	// GetAllowedLoginsForResource returns all of the allowed logins for the passed resource.
+	//
+	// Supports the following resource types:
+	//
+	// - types.Server with GetKind() == types.KindNode
+	//
+	// - types.KindWindowsDesktop
+	GetAllowedLoginsForResource(resource AccessCheckable) ([]string, error)
 }
 
 // AccessInfo hold information about an identity necessary to check whether that
@@ -275,6 +308,65 @@ func NewAccessCheckerWithRoleSet(info *AccessInfo, localCluster string, roleSet
 	}
 }
 
+// CurrentUserRoleGetter limits the interface of auth.ClientI to methods needed
+// by NewAccessCheckerForRemoteCluster.
+type CurrentUserRoleGetter interface {
+	// GetCurrentUserRoles returns the remote cluster roles for the current
+	// user, traits have not been applied.
+	GetCurrentUserRoles(context.Context) ([]types.Role, error)
+	// GetCurrentUser returns the remote cluster's view of the current user.
+	GetCurrentUser(context.Context) (types.User, error)
+}
+
+// NewAccessCheckerForRemoteCluster returns an AccessChecker that can check
+// user's access to resources that may be located in remote/leaf Teleport
+// clusters.
+func NewAccessCheckerForRemoteCluster(ctx context.Context, localAccessInfo *AccessInfo, clusterName string, access CurrentUserRoleGetter) (AccessChecker, error) {
+	// Fetch the remote cluster's view of the current user's roles.
+	remoteRoles, err := access.GetCurrentUserRoles(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// Fetch the remote cluster's view of the current user's traits.
+	// These can technically be different than the local user's traits, see
+	// AccessInfoFromRemote(Certificate|Identity).
+	remoteUser, err := access.GetCurrentUser(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	remoteAccessInfo := &AccessInfo{
+		Traits: remoteUser.GetTraits(),
+		// Will fill this in with the names of the remote/mapped roles we got
+		// from GetCurrentUserRoles.
+		Roles: make([]string, 0, len(remoteRoles)),
+		// AllowedResourceIDs are always the same across clusters.
+		AllowedResourceIDs: localAccessInfo.AllowedResourceIDs,
+	}
+
+	for i := range remoteRoles {
+		remoteRoles[i], err = ApplyTraits(remoteRoles[i], remoteAccessInfo.Traits)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		remoteAccessInfo.Roles = append(remoteAccessInfo.Roles, remoteRoles[i].GetName())
+	}
+	roleSet := NewRoleSet(remoteRoles...)
+
+	return &accessChecker{
+		info: remoteAccessInfo,
+		// localCluster is a bit of a misnomer here, but it means the local
+		// cluster of the resources to which access will be checked, which in
+		// this case may be a remote cluster. localCluster is used for access
+		// checks involving Resource Access Requests, the cluster name is
+		// included in the unique ID of the resource, the accessChecker can only
+		// check access to resources in that cluster.
+		localCluster: clusterName,
+		RoleSet:      roleSet,
+	}, nil
+}
+
 func (a *accessChecker) checkAllowedResources(r AccessCheckable) error {
 	if len(a.info.AllowedResourceIDs) == 0 {
 		// certificate does not contain a list of specifically allowed
@@ -289,11 +381,12 @@ func (a *accessChecker) checkAllowedResources(r AccessCheckable) error {
 
 	for _, resourceID := range a.info.AllowedResourceIDs {
 		if resourceID.ClusterName == a.localCluster &&
-			// If the allowed resource has `Kind=types.KindKubePod`, we allow the user to
+			// If the allowed resource has `Kind=types.KindKubePod` or any other
+			// Kubernetes supported kinds - types.KubernetesResourcesKinds-, we allow the user to
 			// access the Kubernetes cluster that it belongs to.
 			// At this point, we do not verify that the accessed resource matches the
 			// allowed resources, but that verification happens in the caller function.
-			(resourceID.Kind == r.GetKind() || (resourceID.Kind == types.KindKubePod && r.GetKind() == types.KindKubernetesCluster)) &&
+			(resourceID.Kind == r.GetKind() || (slices.Contains(types.KubernetesResourcesKinds, resourceID.Kind) && r.GetKind() == types.KindKubernetesCluster)) &&
 			resourceID.Name == r.GetName() {
 			// Allowed to access this resource by resource ID, move on to role checks.
 			if isDebugEnabled {
@@ -322,17 +415,17 @@ func (a *accessChecker) CheckAccess(r AccessCheckable, state AccessState, matche
 	if err := a.checkAllowedResources(r); err != nil {
 		return trace.Wrap(err)
 	}
-	return trace.Wrap(a.RoleSet.checkAccess(r, state, matchers...))
+	return trace.Wrap(a.RoleSet.checkAccess(r, a.info.Traits, state, matchers...))
 }
 
 // GetKubeResources returns the allowed and denied Kubernetes Resources configured
 // for a user.
 func (a *accessChecker) GetKubeResources(cluster types.KubeCluster) (allowed, denied []types.KubernetesResource) {
 	if len(a.info.AllowedResourceIDs) == 0 {
-		return a.RoleSet.GetKubeResources(cluster)
+		return a.RoleSet.GetKubeResources(cluster, a.info.Traits)
 	}
 
-	rolesAllowed, rolesDenied := a.RoleSet.GetKubeResources(cluster)
+	rolesAllowed, rolesDenied := a.RoleSet.GetKubeResources(cluster, a.info.Traits)
 	// Allways append the denied resources from the roles. This is because
 	// the denied resources from the roles take precedence over the allowed
 	// resources from the certificate.
@@ -398,6 +491,436 @@ func (a *accessChecker) GetAllowedResourceIDs() []types.ResourceID {
 	return a.info.AllowedResourceIDs
 }
 
+// Traits returns the set of user traits
+func (a *accessChecker) Traits() wrappers.Traits {
+	return a.info.Traits
+}
+
+// CheckDatabaseRoles returns whether a user should be auto-created in the
+// database and a list of database roles to assign.
+func (a *accessChecker) CheckDatabaseRoles(database types.Database) (create bool, roles []string, err error) {
+	// First, collect roles from this roleset that have "create_db_user" option.
+	var autoCreateRoles RoleSet
+	for _, role := range a.RoleSet {
+		if role.GetCreateDatabaseUserOption() {
+			autoCreateRoles = append(autoCreateRoles, role)
+		}
+	}
+	// If there are no "auto-create user" roles, nothing to do.
+	if len(autoCreateRoles) == 0 {
+		return false, nil, nil
+	}
+	// Otherwise, iterate over auto-create roles matching the database user
+	// is connecting to and compile a list of roles database user should be
+	// assigned.
+	rolesMap := make(map[string]struct{})
+	var matched bool
+	for _, role := range autoCreateRoles {
+		match, _, err := checkRoleLabelsMatch(types.Allow, role, a.info.Traits, database, false)
+		if err != nil {
+			return false, nil, trace.Wrap(err)
+		}
+		if !match {
+			continue
+		}
+		for _, dbRole := range role.GetDatabaseRoles(types.Allow) {
+			rolesMap[dbRole] = struct{}{}
+		}
+		matched = true
+	}
+	for _, role := range autoCreateRoles {
+		match, _, err := checkRoleLabelsMatch(types.Deny, role, a.info.Traits, database, false)
+		if err != nil {
+			return false, nil, trace.Wrap(err)
+		}
+		if !match {
+			continue
+		}
+		for _, dbRole := range role.GetDatabaseRoles(types.Deny) {
+			delete(rolesMap, dbRole)
+		}
+	}
+	// The collected role list can be empty and that should be ok, we want to
+	// leave the behavior of what happens when a user is created with default
+	// "no roles" configuration up to the target database.
+	return matched, utils.StringsSliceFromSet(rolesMap), nil
+}
+
+// EnumerateDatabaseUsers specializes EnumerateEntities to enumerate db_users.
+func (a *accessChecker) EnumerateDatabaseUsers(database types.Database, extraUsers ...string) EnumerationResult {
+	listFn := func(role types.Role, condition types.RoleConditionType) []string {
+		return role.GetDatabaseUsers(condition)
+	}
+	newMatcher := func(user string) RoleMatcher {
+		return NewDatabaseUserMatcher(database, user)
+	}
+	return a.EnumerateEntities(database, listFn, newMatcher, extraUsers...)
+}
+
+// EnumerateDatabaseNames specializes EnumerateEntities to enumerate db_names.
+func (a *accessChecker) EnumerateDatabaseNames(database types.Database, extraNames ...string) EnumerationResult {
+	listFn := func(role types.Role, condition types.RoleConditionType) []string {
+		return role.GetDatabaseNames(condition)
+	}
+	newMatcher := func(dbName string) RoleMatcher {
+		return &DatabaseNameMatcher{Name: dbName}
+	}
+	return a.EnumerateEntities(database, listFn, newMatcher, extraNames...)
+}
+
+// roleEntitiesListFn is used for listing a role's allowed/denied entities.
+type roleEntitiesListFn func(types.Role, types.RoleConditionType) []string
+
+// roleMatcherFactoryFn is used for making a role matcher for a given entity.
+type roleMatcherFactoryFn func(entity string) RoleMatcher
+
+// EnumerateEntities works on a given role set to return a minimal description
+// of allowed set of entities (db_users, db_names, etc). It is biased towards
+// *allowed* entities; It is meant to describe what the user can do, rather than
+// cannot do. For that reason if the user isn't allowed to pick *any* entities,
+// the output will be empty.
+//
+// In cases where * is listed in set of allowed entities, it may be hard for
+// users to figure out the expected entity to use. For this reason the parameter
+// extraEntities provides an extra set of entities to be checked against
+// RoleSet. This extra set of entities may be sourced e.g. from user connection
+// history.
+func (a *accessChecker) EnumerateEntities(resource AccessCheckable, listFn roleEntitiesListFn, newMatcher roleMatcherFactoryFn, extraEntities ...string) EnumerationResult {
+	result := NewEnumerationResult()
+
+	// gather entities for checking from the roles, check wildcards.
+	var entities []string
+	for _, role := range a.RoleSet {
+		wildcardAllowed := false
+		wildcardDenied := false
+
+		for _, e := range listFn(role, types.Allow) {
+			if e == types.Wildcard {
+				wildcardAllowed = true
+			} else {
+				entities = append(entities, e)
+			}
+		}
+
+		for _, e := range listFn(role, types.Deny) {
+			if e == types.Wildcard {
+				wildcardDenied = true
+			} else {
+				entities = append(entities, e)
+			}
+		}
+
+		result.wildcardDenied = result.wildcardDenied || wildcardDenied
+
+		if err := NewRoleSet(role).checkAccess(resource, a.info.Traits, AccessState{MFAVerified: true}); err == nil {
+			result.wildcardAllowed = result.wildcardAllowed || wildcardAllowed
+		}
+
+	}
+
+	entities = apiutils.Deduplicate(append(entities, extraEntities...))
+
+	// check each individual role spec entity against the resource.
+	for _, e := range entities {
+		err := a.CheckAccess(resource, AccessState{MFAVerified: true}, newMatcher(e))
+		result.allowedDeniedMap[e] = err == nil
+	}
+
+	return result
+}
+
+// GetAllowedLoginsForResource returns all of the allowed logins for the passed resource.
+//
+// Supports the following resource types:
+//
+// - types.Server with GetKind() == types.KindNode
+//
+// - types.KindWindowsDesktop
+func (a *accessChecker) GetAllowedLoginsForResource(resource AccessCheckable) ([]string, error) {
+	// Create a map indexed by all logins in the RoleSet,
+	// mapped to false if any role has it in its deny section,
+	// true otherwise.
+	mapped := make(map[string]bool)
+
+	for _, role := range a.RoleSet {
+		var loginGetter func(types.RoleConditionType) []string
+
+		switch resource.GetKind() {
+		case types.KindNode:
+			loginGetter = role.GetLogins
+		case types.KindWindowsDesktop:
+			loginGetter = role.GetWindowsLogins
+		default:
+			return nil, trace.BadParameter("received unsupported resource kind: %s", resource.GetKind())
+		}
+
+		for _, login := range loginGetter(types.Allow) {
+			// Only set to true if not already set, the login is denied if any
+			// role denies it.
+			if _, alreadySet := mapped[login]; !alreadySet {
+				mapped[login] = true
+			}
+		}
+		for _, login := range loginGetter(types.Deny) {
+			mapped[login] = false
+		}
+	}
+
+	// Create a list of only the logins not denied by a role in the set.
+	var notDenied []string
+	for login, isNotDenied := range mapped {
+		if isNotDenied {
+			notDenied = append(notDenied, login)
+		}
+	}
+
+	var newLoginMatcher func(login string) RoleMatcher
+	switch resource.GetKind() {
+	case types.KindNode:
+		newLoginMatcher = NewLoginMatcher
+	case types.KindWindowsDesktop:
+		newLoginMatcher = NewWindowsLoginMatcher
+	default:
+		return nil, trace.BadParameter("received unsupported resource kind: %s", resource.GetKind())
+	}
+
+	// Filter the not-denied logins for those allowed to be used with the given resource.
+	var allowed []string
+	for _, login := range notDenied {
+		err := a.CheckAccess(resource, AccessState{MFAVerified: true}, newLoginMatcher(login))
+		if err == nil {
+			allowed = append(allowed, login)
+		}
+	}
+
+	return allowed, nil
+}
+
+// CheckAccessToRemoteCluster checks if a role has access to remote cluster. Deny rules are
+// checked first then allow rules. Access to a cluster is determined by
+// namespaces, labels, and logins.
+func (a *accessChecker) CheckAccessToRemoteCluster(rc types.RemoteCluster) error {
+	if len(a.RoleSet) == 0 {
+		return trace.AccessDenied("access to cluster denied")
+	}
+
+	// Note: logging in this function only happens in debug mode, this is because
+	// adding logging to this function (which is called on every server returned
+	// by GetRemoteClusters) can slow down this function by 50x for large clusters!
+	isDebugEnabled, debugf := rbacDebugLogger()
+
+	rcLabels := rc.GetMetadata().Labels
+
+	// For backwards compatibility, if there is no role in the set with label
+	// matchers and the cluster has no labels, assume that the role set has
+	// access to the cluster.
+	usesLabels := false
+	for _, role := range a.RoleSet {
+		unset, err := labelMatchersUnset(role, types.KindRemoteCluster)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if !unset {
+			usesLabels = true
+			break
+		}
+	}
+
+	if !usesLabels && len(rcLabels) == 0 {
+		debugf("Grant access to cluster %v - no role in %v uses cluster labels and the cluster is not labeled.",
+			rc.GetName(), a.RoleNames())
+		return nil
+	}
+
+	// Check deny rules first: a single matching label from
+	// the deny role set prohibits access.
+	var errs []error
+	for _, role := range a.RoleSet {
+		matchLabels, labelsMessage, err := checkRoleLabelsMatch(types.Deny, role, a.info.Traits, rc, isDebugEnabled)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if matchLabels {
+			// This condition avoids formatting calls on large scale.
+			debugf("Access to cluster %v denied, deny rule in %v matched; match(%s)",
+				rc.GetName(), role.GetName(), labelsMessage)
+			return trace.AccessDenied("access to cluster denied")
+		}
+	}
+
+	// Check allow rules: label has to match in any role in the role set to be granted access.
+	for _, role := range a.RoleSet {
+		matchLabels, labelsMessage, err := checkRoleLabelsMatch(types.Allow, role, a.info.Traits, rc, isDebugEnabled)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		labelMatchers, err := role.GetLabelMatchers(types.Allow, types.KindRemoteCluster)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		debugf("Check access to role(%v) rc(%v, labels=%v) matchLabels=%v, msg=%v, err=%v allow=%v rcLabels=%v",
+			role.GetName(), rc.GetName(), rcLabels, matchLabels, labelsMessage, err, labelMatchers, rcLabels)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		if matchLabels {
+			return nil
+		}
+		if isDebugEnabled {
+			deniedError := trace.AccessDenied("role=%v, match(%s)",
+				role.GetName(), labelsMessage)
+			errs = append(errs, deniedError)
+		}
+	}
+
+	debugf("Access to cluster %v denied, no allow rule matched; %v", rc.GetName(), errs)
+	return trace.AccessDenied("access to cluster denied")
+}
+
+// DesktopGroups returns the desktop groups a user is allowed to create or an access denied error if a role disallows desktop user creation
+func (a *accessChecker) DesktopGroups(s types.WindowsDesktop) ([]string, error) {
+	groups := make(map[string]struct{})
+	for _, role := range a.RoleSet {
+		result, _, err := checkRoleLabelsMatch(types.Allow, role, a.info.Traits, s, false)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		// skip nodes that dont have matching labels
+		if !result {
+			continue
+		}
+		createDesktopUser := role.GetOptions().CreateDesktopUser
+		// if any of the matching roles do not enable create host
+		// user, the user should not be allowed on
+		if createDesktopUser == nil || !createDesktopUser.Value {
+			return nil, trace.AccessDenied("user is not allowed to create host users")
+		}
+		for _, group := range role.GetDesktopGroups(types.Allow) {
+			groups[group] = struct{}{}
+		}
+	}
+	for _, role := range a.RoleSet {
+		result, _, err := checkRoleLabelsMatch(types.Deny, role, a.info.Traits, s, false)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if !result {
+			continue
+		}
+		for _, group := range role.GetDesktopGroups(types.Deny) {
+			delete(groups, group)
+		}
+	}
+
+	return utils.StringsSliceFromSet(groups), nil
+}
+
+// HostUsersInfo keeps information about groups and sudoers entries
+// for a particular host user
+type HostUsersInfo struct {
+	// Groups is the list of groups to include host users in
+	Groups []string
+	// Sudoers is a list of entries for a users sudoers file
+	Sudoers []string
+	// Mode determines if a host user should be deleted after a session
+	// ends or not.
+	Mode types.CreateHostUserMode
+}
+
+// HostUsers returns host user information matching a server or nil if
+// a role disallows host user creation
+func (a *accessChecker) HostUsers(s types.Server) (*HostUsersInfo, error) {
+	groups := make(map[string]struct{})
+	var sudoers []string
+	var mode types.CreateHostUserMode
+
+	roleSet := make([]types.Role, len(a.RoleSet))
+	copy(roleSet, a.RoleSet)
+	slices.SortStableFunc(roleSet, func(a types.Role, b types.Role) bool {
+		return strings.Compare(a.GetName(), b.GetName()) == -1
+	})
+
+	seenSudoers := make(map[string]struct{})
+	for _, role := range roleSet {
+		result, _, err := checkRoleLabelsMatch(types.Allow, role, a.info.Traits, s, false)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		// skip nodes that dont have matching labels
+		if !result {
+			continue
+		}
+
+		createHostUserMode := role.GetOptions().CreateHostUserMode
+		createHostUser := role.GetOptions().CreateHostUser
+		if createHostUserMode == types.CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED {
+			createHostUserMode = types.CreateHostUserMode_HOST_USER_MODE_OFF
+			if createHostUser != nil && createHostUser.Value {
+				createHostUserMode = types.CreateHostUserMode_HOST_USER_MODE_DROP
+			}
+		}
+
+		// if any of the matching roles do not enable create host
+		// user, the user should not be allowed on
+		if createHostUserMode == types.CreateHostUserMode_HOST_USER_MODE_OFF {
+			return nil, trace.AccessDenied("user is not allowed to create host users")
+		}
+
+		if mode == types.CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED {
+			mode = createHostUserMode
+		}
+		// prefer to use HostUserModeKeep over Drop if mode has already been set.
+		if mode == types.CreateHostUserMode_HOST_USER_MODE_DROP && createHostUserMode == types.CreateHostUserMode_HOST_USER_MODE_KEEP {
+			mode = types.CreateHostUserMode_HOST_USER_MODE_KEEP
+		}
+
+		for _, group := range role.GetHostGroups(types.Allow) {
+			groups[group] = struct{}{}
+		}
+		for _, sudoer := range role.GetHostSudoers(types.Allow) {
+			if _, ok := seenSudoers[sudoer]; ok {
+				continue
+			}
+			seenSudoers[sudoer] = struct{}{}
+			sudoers = append(sudoers, sudoer)
+		}
+	}
+
+	var finalSudoers []string
+	for _, role := range roleSet {
+		result, _, err := checkRoleLabelsMatch(types.Deny, role, a.info.Traits, s, false)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if !result {
+			continue
+		}
+		for _, group := range role.GetHostGroups(types.Deny) {
+			delete(groups, group)
+		}
+
+	outer:
+		for _, sudoer := range sudoers {
+			for _, deniedSudoer := range role.GetHostSudoers(types.Deny) {
+				if deniedSudoer == "*" {
+					finalSudoers = nil
+					break outer
+				}
+				if sudoer != deniedSudoer {
+					finalSudoers = append(finalSudoers, sudoer)
+				}
+			}
+		}
+		sudoers = finalSudoers
+	}
+
+	return &HostUsersInfo{
+		Groups:  utils.StringsSliceFromSet(groups),
+		Sudoers: sudoers,
+		Mode:    mode,
+	}, nil
+}
+
 // AccessInfoFromLocalCertificate returns a new AccessInfo populated from the
 // given ssh certificate. Should only be used for cluster local users as roles
 // will not be mapped.
diff --git a/lib/services/access_request.go b/lib/services/access_request.go
index eb455c08e6d71..45c2ff05229f1 100644
--- a/lib/services/access_request.go
+++ b/lib/services/access_request.go
@@ -1558,7 +1558,7 @@ func (m *RequestValidator) pruneResourceRequestRoles(
 			resourceMatcher = NewKubeResourcesMatcher(kubernetesResources)
 		}
 		for _, role := range allRoles {
-			roleAllowsAccess, err := roleAllowsResource(ctx, role, resource, loginHint, resourceMatcherToMatcherSlice(resourceMatcher)...)
+			roleAllowsAccess, err := m.roleAllowsResource(ctx, role, resource, loginHint, resourceMatcherToMatcherSlice(resourceMatcher)...)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
@@ -1638,7 +1638,7 @@ func countAllowedLogins(role types.Role) int {
 	return len(allowed)
 }
 
-func roleAllowsResource(
+func (m *RequestValidator) roleAllowsResource(
 	ctx context.Context,
 	role types.Role,
 	resource types.ResourceWithLabels,
@@ -1651,7 +1651,7 @@ func roleAllowsResource(
 		matchers = append(matchers, NewLoginMatcher(loginHint))
 	}
 	matchers = append(matchers, extraMatchers...)
-	err := roleSet.checkAccess(resource, AccessState{MFAVerified: true}, matchers...)
+	err := roleSet.checkAccess(resource, m.user.GetTraits(), AccessState{MFAVerified: true}, matchers...)
 	if trace.IsAccessDenied(err) {
 		// Access denied, this role does not allow access to this resource, no
 		// unexpected error to report.
@@ -1668,14 +1668,14 @@ func roleAllowsResource(
 type ListResourcesRequestOption func(*proto.ListResourcesRequest)
 
 func GetResourceDetails(ctx context.Context, clusterName string, lister ResourceLister, ids []types.ResourceID) (map[string]types.ResourceDetails, error) {
-	var nodeIDs []types.ResourceID
+	var resourceIDs []types.ResourceID
 	for _, resourceID := range ids {
-		if resourceID.Kind != types.KindNode {
-			// The only detail we want, for now, is the server hostname, so we
-			// can skip all other resource kinds as a minor optimization.
-			continue
+		// We're interested in hostname or friendly name details. These apply to
+		// nodes, app servers, and user groups.
+		switch resourceID.Kind {
+		case types.KindNode, types.KindApp, types.KindUserGroup:
+			resourceIDs = append(resourceIDs, resourceID)
 		}
-		nodeIDs = append(nodeIDs, resourceID)
 	}
 
 	withExtraRoles := func(req *proto.ListResourcesRequest) {
@@ -1683,36 +1683,37 @@ func GetResourceDetails(ctx context.Context, clusterName string, lister Resource
 		req.UsePreviewAsRoles = true
 	}
 
-	resources, err := GetResourcesByResourceIDs(ctx, lister, nodeIDs, withExtraRoles)
+	resources, err := GetResourcesByResourceIDs(ctx, lister, resourceIDs, withExtraRoles)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	result := make(map[string]types.ResourceDetails)
 	for _, resource := range resources {
-		hn, ok := resource.(interface{ GetHostname() string })
-		if !ok {
+		friendlyName := FriendlyName(resource)
+
+		// No friendly name was found, so skip to the next resource.
+		if friendlyName == "" {
 			continue
 		}
+
 		id := types.ResourceID{
 			ClusterName: clusterName,
 			Kind:        resource.GetKind(),
 			Name:        resource.GetName(),
 		}
 		result[types.ResourceIDToString(id)] = types.ResourceDetails{
-			Hostname: hn.GetHostname(),
+			FriendlyName: friendlyName,
 		}
 	}
 
 	return result, nil
 }
 
-func GetNodeResourceIDsByCluster(r types.AccessRequest) map[string][]types.ResourceID {
+// GetResourceIDsByCluster will return resource IDs grouped by cluster.
+func GetResourceIDsByCluster(r types.AccessRequest) map[string][]types.ResourceID {
 	resourceIDsByCluster := make(map[string][]types.ResourceID)
 	for _, resourceID := range r.GetRequestedResourceIDs() {
-		if resourceID.Kind != types.KindNode {
-			continue
-		}
 		resourceIDsByCluster[resourceID.ClusterName] = append(resourceIDsByCluster[resourceID.ClusterName], resourceID)
 	}
 	return resourceIDsByCluster
diff --git a/lib/services/access_request_test.go b/lib/services/access_request_test.go
index 0f96cfb1b898d..b31d6ee64fc79 100644
--- a/lib/services/access_request_test.go
+++ b/lib/services/access_request_test.go
@@ -1095,6 +1095,7 @@ func TestPruneRequestRoles(t *testing.T) {
 					SearchAsRoles: []string{
 						"node-admins",
 						"node-access",
+						"node-team",
 						"kube-admins",
 						"db-admins",
 						"app-admins",
@@ -1122,6 +1123,14 @@ func TestPruneRequestRoles(t *testing.T) {
 				Logins: []string{"{{internal.logins}}", "root"},
 			},
 		},
+		"node-team": {
+			// Grants root access to nodes owned by user's team via label
+			// expression.
+			Allow: types.RoleConditions{
+				NodeLabelsExpression: `contains(user.spec.traits["team"], labels["owner"])`,
+				Logins:               []string{"{{internal.logins}}", "root"},
+			},
+		},
 		"kube-admins": {
 			Allow: types.RoleConditions{
 				KubernetesLabels: types.Labels{
@@ -1163,6 +1172,7 @@ func TestPruneRequestRoles(t *testing.T) {
 	user := g.user(t, "response-team")
 	g.users[user].SetTraits(map[string][]string{
 		"logins": {"responder"},
+		"team":   {"response-team"},
 	})
 
 	nodeDesc := []struct {
@@ -1181,6 +1191,12 @@ func TestPruneRequestRoles(t *testing.T) {
 				"owner": "node-admins",
 			},
 		},
+		{
+			name: "responders-node",
+			labels: map[string]string{
+				"owner": "response-team",
+			},
+		},
 		{
 			name: "denied-node",
 		},
@@ -1239,7 +1255,6 @@ func TestPruneRequestRoles(t *testing.T) {
 		desc               string
 		requestResourceIDs []types.ResourceID
 		loginHint          string
-		userTraits         map[string][]string
 		expectRoles        []string
 		expectError        bool
 	}{
@@ -1256,6 +1271,17 @@ func TestPruneRequestRoles(t *testing.T) {
 			// requested.
 			expectRoles: []string{"node-admins", "node-access"},
 		},
+		{
+			desc: "label expression role",
+			requestResourceIDs: []types.ResourceID{
+				{
+					ClusterName: clusterName,
+					Kind:        types.KindNode,
+					Name:        "responders-node",
+				},
+			},
+			expectRoles: []string{"node-team", "node-access"},
+		},
 		{
 			desc: "user login hint",
 			requestResourceIDs: []types.ResourceID{
@@ -1404,7 +1430,7 @@ func TestPruneRequestRoles(t *testing.T) {
 			},
 			// Request for foreign resource should request all available roles,
 			// we don't know which one is necessary
-			expectRoles: []string{"node-access", "node-admins", "kube-admins", "db-admins", "app-admins", "windows-admins", "empty"},
+			expectRoles: []string{"node-access", "node-admins", "node-team", "kube-admins", "db-admins", "app-admins", "windows-admins", "empty"},
 		},
 	}
 	for _, tc := range testCases {
@@ -1790,3 +1816,100 @@ func TestValidateAccessRequestClusterNames(t *testing.T) {
 		})
 	}
 }
+
+type mockResourceLister struct {
+	resources []types.ResourceWithLabels
+}
+
+func (m *mockResourceLister) ListResources(ctx context.Context, _ proto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
+	return &types.ListResourcesResponse{
+		Resources: m.resources,
+	}, nil
+}
+
+func TestGetResourceDetails(t *testing.T) {
+	clusterName := "cluster"
+
+	presence := &mockResourceLister{
+		resources: []types.ResourceWithLabels{
+			newNode(t, "node1", "hostname 1"),
+			newApp(t, "app1", "friendly app 1", types.OriginDynamic),
+			newApp(t, "app2", "friendly app 2", types.OriginDynamic),
+			newApp(t, "app3", "friendly app 3", types.OriginOkta),
+			newUserGroup(t, "group1", "friendly group 1", types.OriginOkta),
+		},
+	}
+	resourceIDs := []types.ResourceID{
+		newResourceID(clusterName, types.KindNode, "node1"),
+		newResourceID(clusterName, types.KindApp, "app1"),
+		newResourceID(clusterName, types.KindApp, "app2"),
+		newResourceID(clusterName, types.KindApp, "app3"),
+		newResourceID(clusterName, types.KindUserGroup, "group1"),
+	}
+
+	ctx := context.Background()
+
+	details, err := GetResourceDetails(ctx, clusterName, presence, resourceIDs)
+	require.NoError(t, err)
+
+	// Check the resource details to see if friendly names properly propagated.
+
+	// Node should be named for its hostname.
+	require.Equal(t, "hostname 1", details[types.ResourceIDToString(resourceIDs[0])].FriendlyName)
+
+	// app1 and app2 are expected to be empty because they're not Okta sourced resources.
+	require.Empty(t, details[types.ResourceIDToString(resourceIDs[1])].FriendlyName)
+
+	require.Empty(t, details[types.ResourceIDToString(resourceIDs[2])].FriendlyName)
+
+	// This Okta sourced app should have a friendly name.
+	require.Equal(t, "friendly app 3", details[types.ResourceIDToString(resourceIDs[3])].FriendlyName)
+
+	// This Okta sourced user group should have a friendly name.
+	require.Equal(t, "friendly group 1", details[types.ResourceIDToString(resourceIDs[4])].FriendlyName)
+}
+
+func newNode(t *testing.T, name, hostname string) types.Server {
+	node, err := types.NewServer(name, types.KindNode,
+		types.ServerSpecV2{
+			Hostname: hostname,
+		})
+	require.NoError(t, err)
+	return node
+}
+
+func newApp(t *testing.T, name, description, origin string) types.Application {
+	app, err := types.NewAppV3(types.Metadata{
+		Name:        name,
+		Description: description,
+		Labels: map[string]string{
+			types.OriginLabel: origin,
+		},
+	},
+		types.AppSpecV3{
+			URI:        "https://some-addr.com",
+			PublicAddr: "https://some-addr.com",
+		})
+	require.NoError(t, err)
+	return app
+}
+
+func newUserGroup(t *testing.T, name, description, origin string) types.UserGroup {
+	userGroup, err := types.NewUserGroup(types.Metadata{
+		Name:        name,
+		Description: description,
+		Labels: map[string]string{
+			types.OriginLabel: origin,
+		},
+	}, types.UserGroupSpecV1{})
+	require.NoError(t, err)
+	return userGroup
+}
+
+func newResourceID(clusterName, kind, name string) types.ResourceID {
+	return types.ResourceID{
+		ClusterName: clusterName,
+		Kind:        kind,
+		Name:        name,
+	}
+}
diff --git a/lib/services/database.go b/lib/services/database.go
index 44ae538ad2207..43a864ab1ecdc 100644
--- a/lib/services/database.go
+++ b/lib/services/database.go
@@ -34,6 +34,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/aws/aws-sdk-go/service/memorydb"
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	"github.com/aws/aws-sdk-go/service/redshiftserverless"
@@ -807,7 +808,7 @@ func NewDatabaseFromRDSProxy(dbProxy *rds.DBProxy, port int64, tags []*rds.Tag)
 		})
 }
 
-// NewDatabaseFromRDSProxyCustomEndpiont creates database resource from RDS
+// NewDatabaseFromRDSProxyCustomEndpoint creates database resource from RDS
 // Proxy custom endpoint.
 func NewDatabaseFromRDSProxyCustomEndpoint(dbProxy *rds.DBProxy, customEndpoint *rds.DBProxyEndpoint, port int64, tags []*rds.Tag) (types.Database, error) {
 	metadata, err := MetadataFromRDSProxyCustomEndpoint(dbProxy, customEndpoint)
@@ -924,6 +925,95 @@ func newElastiCacheDatabase(cluster *elasticache.ReplicationGroup, endpoint *ela
 	})
 }
 
+// NewDatabaseFromOpenSearchDomain creates a database resource from an OpenSearch domain.
+func NewDatabaseFromOpenSearchDomain(domain *opensearchservice.DomainStatus, tags []*opensearchservice.Tag) (types.Databases, error) {
+	var databases types.Databases
+
+	if aws.StringValue(domain.Endpoint) != "" {
+		metadata, err := MetadataFromOpenSearchDomain(domain, apiawsutils.OpenSearchDefaultEndpoint)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		meta := types.Metadata{
+			Description: fmt.Sprintf("OpenSearch domain in %v (default endpoint)", metadata.Region),
+			Labels:      labelsFromOpenSearchDomain(domain, metadata, apiawsutils.OpenSearchDefaultEndpoint, tags),
+		}
+
+		meta = setDBName(meta, aws.StringValue(domain.DomainName))
+		spec := types.DatabaseSpecV3{
+			Protocol: defaults.ProtocolOpenSearch,
+			URI:      fmt.Sprintf("%v:443", aws.StringValue(domain.Endpoint)),
+			AWS:      *metadata,
+		}
+
+		db, err := types.NewDatabaseV3(meta, spec)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		databases = append(databases, db)
+	}
+
+	if domain.DomainEndpointOptions != nil && aws.StringValue(domain.DomainEndpointOptions.CustomEndpoint) != "" {
+		metadata, err := MetadataFromOpenSearchDomain(domain, apiawsutils.OpenSearchCustomEndpoint)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		meta := types.Metadata{
+			Description: fmt.Sprintf("OpenSearch domain in %v (custom endpoint)", metadata.Region),
+			Labels:      labelsFromOpenSearchDomain(domain, metadata, apiawsutils.OpenSearchCustomEndpoint, tags),
+		}
+
+		meta = setDBName(meta, aws.StringValue(domain.DomainName), "custom")
+		spec := types.DatabaseSpecV3{
+			Protocol: defaults.ProtocolOpenSearch,
+			URI:      fmt.Sprintf("%v:443", aws.StringValue(domain.DomainEndpointOptions.CustomEndpoint)),
+			AWS:      *metadata,
+		}
+
+		db, err := types.NewDatabaseV3(meta, spec)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		databases = append(databases, db)
+	}
+
+	for name, url := range domain.Endpoints {
+		metadata, err := MetadataFromOpenSearchDomain(domain, apiawsutils.OpenSearchVPCEndpoint)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		meta := types.Metadata{
+			Description: fmt.Sprintf("OpenSearch domain in %v (endpoint %q)", metadata.Region, name),
+			Labels:      labelsFromOpenSearchDomain(domain, metadata, apiawsutils.OpenSearchVPCEndpoint, tags),
+		}
+
+		if domain.VPCOptions != nil {
+			meta.Labels[labelVPCID] = aws.StringValue(domain.VPCOptions.VPCId)
+		}
+
+		meta = setDBName(meta, aws.StringValue(domain.DomainName), name)
+		spec := types.DatabaseSpecV3{
+			Protocol: defaults.ProtocolOpenSearch,
+			URI:      fmt.Sprintf("%v:443", aws.StringValue(url)),
+			AWS:      *metadata,
+		}
+
+		db, err := types.NewDatabaseV3(meta, spec)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		databases = append(databases, db)
+	}
+
+	return databases, nil
+}
+
 // NewDatabaseFromMemoryDBCluster creates a database resource from a MemoryDB
 // cluster.
 func NewDatabaseFromMemoryDBCluster(cluster *memorydb.Cluster, extraLabels map[string]string) (types.Database, error) {
@@ -1121,6 +1211,24 @@ func MetadataFromElastiCacheCluster(cluster *elasticache.ReplicationGroup, endpo
 	}, nil
 }
 
+// MetadataFromOpenSearchDomain creates AWS metadata for the provided OpenSearch domain.
+func MetadataFromOpenSearchDomain(domain *opensearchservice.DomainStatus, endpointType string) (*types.AWS, error) {
+	parsedARN, err := arn.Parse(aws.StringValue(domain.ARN))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &types.AWS{
+		Region:    parsedARN.Region,
+		AccountID: parsedARN.AccountID,
+		OpenSearch: types.OpenSearch{
+			DomainName:   aws.StringValue(domain.DomainName),
+			DomainID:     aws.StringValue(domain.DomainId),
+			EndpointType: endpointType,
+		},
+	}, nil
+}
+
 // MetadataFromMemoryDBCluster creates AWS metadata for the provided MemoryDB
 // cluster.
 func MetadataFromMemoryDBCluster(cluster *memorydb.Cluster, endpointType string) (*types.AWS, error) {
@@ -1412,6 +1520,12 @@ func labelsFromAWSMetadata(meta *types.AWS) map[string]string {
 	return labels
 }
 
+func labelsFromOpenSearchDomain(domain *opensearchservice.DomainStatus, meta *types.AWS, endpointType string, tags []*opensearchservice.Tag) map[string]string {
+	labels := labelsFromMetaAndEndpointType(meta, endpointType, libcloudaws.TagsToLabels(tags))
+	labels[labelEngineVersion] = aws.StringValue(domain.EngineVersion)
+	return labels
+}
+
 // labelsFromMetaAndEndpointType creates database labels from provided AWS meta and endpoint type.
 func labelsFromMetaAndEndpointType(meta *types.AWS, endpointType string, extraLabels map[string]string) map[string]string {
 	labels := labelsFromAWSMetadata(meta)
@@ -1625,6 +1739,11 @@ func IsMemoryDBClusterAvailable(cluster *memorydb.Cluster) bool {
 	return IsAWSResourceAvailable(cluster, cluster.Status)
 }
 
+// IsOpenSearchDomainAvailable checks if the OpenSearch domain is available.
+func IsOpenSearchDomainAvailable(domain *opensearchservice.DomainStatus) bool {
+	return aws.BoolValue(domain.Created) && !aws.BoolValue(domain.Deleted)
+}
+
 // IsRDSProxyAvailable checks if the RDS Proxy is available.
 func IsRDSProxyAvailable(dbProxy *rds.DBProxy) bool {
 	return IsAWSResourceAvailable(dbProxy, dbProxy.Status)
diff --git a/lib/services/device.go b/lib/services/device.go
new file mode 100644
index 0000000000000..9075343d8b916
--- /dev/null
+++ b/lib/services/device.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import (
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// UnmarshalDevice unmarshals a DeviceV1 resource and runs CheckAndSetDefaults.
+func UnmarshalDevice(raw []byte) (*types.DeviceV1, error) {
+	dev := &types.DeviceV1{}
+	if err := utils.FastUnmarshal(raw, dev); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return dev, trace.Wrap(dev.CheckAndSetDefaults())
+}
+
+// MarshalDevice marshals a DeviceV1 resource.
+func MarshalDevice(dev *types.DeviceV1) ([]byte, error) {
+	devBytes, err := utils.FastMarshal(dev)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return devBytes, nil
+}
diff --git a/lib/services/device_test.go b/lib/services/device_test.go
new file mode 100644
index 0000000000000..aa4b92d65787d
--- /dev/null
+++ b/lib/services/device_test.go
@@ -0,0 +1,96 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// TestUnmarshalDevice tests that devices can be successfully
+// unmarshalled from YAML and JSON.
+func TestUnmarshalDevice(t *testing.T) {
+	for _, tc := range []struct {
+		desc          string
+		input         string
+		errorContains string
+		expected      *types.DeviceV1
+	}{
+		{
+			desc: "success",
+			input: `
+{
+  "kind": "device",
+	"version": "v1",
+	"metadata": {
+		"name": "xaa"
+	},
+	"spec": {
+		"asset_tag": "mymachine",
+		"os_type": "macos",
+		"enroll_status": "enrolled"
+	}
+}`,
+			expected: &types.DeviceV1{
+				ResourceHeader: types.ResourceHeader{
+					Kind:    types.KindDevice,
+					Version: "v1",
+					Metadata: types.Metadata{
+						Namespace: defaults.Namespace,
+						Name:      "xaa",
+					},
+				},
+				Spec: &types.DeviceSpec{
+					OsType:       "macos",
+					AssetTag:     "mymachine",
+					EnrollStatus: "enrolled",
+				},
+			},
+		},
+		{
+			desc:          "fail string as num",
+			errorContains: `ReadString: expects " or n, but found 4`,
+			input: `
+{
+  "kind": "device",
+	"version": "v1",
+	"metadata": {
+		"name": "xdd"
+	},
+	"spec": {
+		"asset_tag": 4,
+		"os_type": "macos",
+		"enroll_status": "enrolled"
+	}
+}`,
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			out, err := UnmarshalDevice([]byte(tc.input))
+			if tc.errorContains != "" {
+				require.ErrorContains(t, err, tc.errorContains, "error from UnmarshalDevice does not contain the expected string")
+				return
+			}
+			require.NoError(t, err, "UnmarshalDevice returned unexpected error")
+			require.Equal(t, tc.expected, out, "unmarshalled device does not match what was expected")
+		})
+	}
+}
diff --git a/lib/services/embeddings.go b/lib/services/embeddings.go
new file mode 100644
index 0000000000000..1149213bf69cb
--- /dev/null
+++ b/lib/services/embeddings.go
@@ -0,0 +1,36 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package services
+
+import (
+	"context"
+
+	"github.com/gravitational/teleport/api/internalutils/stream"
+	"github.com/gravitational/teleport/lib/ai"
+)
+
+// Embeddings service is responsible for storing and retrieving embeddings in
+// the backend. The backend acts as an embedding cache. Embeddings can be
+// re-generated by an ai.Embedder.
+type Embeddings interface {
+	// GetEmbedding looks up a single embedding by its name in the backend.
+	GetEmbedding(ctx context.Context, kind, resourceID string) (*ai.Embedding, error)
+	// GetEmbeddings returns all embeddings for a given kind.
+	GetEmbeddings(ctx context.Context, kind string) stream.Stream[*ai.Embedding]
+	// UpsertEmbedding creates or updates a single ai.Embedding in the backend.
+	UpsertEmbedding(ctx context.Context, embedding *ai.Embedding) (*ai.Embedding, error)
+}
diff --git a/lib/services/friendlyname.go b/lib/services/friendlyname.go
new file mode 100644
index 0000000000000..99c6a41b5c214
--- /dev/null
+++ b/lib/services/friendlyname.go
@@ -0,0 +1,34 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import "github.com/gravitational/teleport/api/types"
+
+// FriendlyName will return the friendly name for a resource if it has one. Otherwise, it
+// will return an empty string.
+func FriendlyName(resource types.ResourceWithLabels) string {
+	// Right now, only resources sourced from Okta and nodes have friendly names.
+	if resource.Origin() == types.OriginOkta {
+		return resource.GetMetadata().Description
+	}
+
+	if hn, ok := resource.(interface{ GetHostname() string }); ok {
+		return hn.GetHostname()
+	}
+
+	return ""
+}
diff --git a/lib/services/friendlyname_test.go b/lib/services/friendlyname_test.go
new file mode 100644
index 0000000000000..f5c7f3affb07f
--- /dev/null
+++ b/lib/services/friendlyname_test.go
@@ -0,0 +1,81 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestFriendlyName(t *testing.T) {
+	appNoFriendly, err := types.NewAppV3(types.Metadata{
+		Name: "no friendly",
+	}, types.AppSpecV3{
+		URI: "https://some-uri.com",
+	},
+	)
+	require.NoError(t, err)
+
+	appFriendly, err := types.NewAppV3(types.Metadata{
+		Name:        "no friendly",
+		Description: "friendly name",
+		Labels: map[string]string{
+			types.OriginLabel: types.OriginOkta,
+		},
+	}, types.AppSpecV3{
+		URI: "https://some-uri.com",
+	},
+	)
+	require.NoError(t, err)
+
+	node, err := types.NewServer("node", types.KindNode, types.ServerSpecV2{
+		Hostname: "friendly hostname",
+	})
+	require.NoError(t, err)
+
+	tests := []struct {
+		name     string
+		resource types.ResourceWithLabels
+		expected string
+	}{
+		{
+			name:     "no friendly name",
+			resource: appNoFriendly,
+			expected: "",
+		},
+		{
+			name:     "friendly app name",
+			resource: appFriendly,
+			expected: "friendly name",
+		},
+		{
+			name:     "friendly node name",
+			resource: node,
+			expected: "friendly hostname",
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			require.Equal(t, test.expected, FriendlyName(test.resource))
+		})
+	}
+}
diff --git a/lib/services/headlessauthn.go b/lib/services/headlessauthn.go
index e056d00110387..f7922b5ec1728 100644
--- a/lib/services/headlessauthn.go
+++ b/lib/services/headlessauthn.go
@@ -25,19 +25,22 @@ import (
 	"github.com/gravitational/teleport/api/types"
 )
 
+// HeadlessAuthenticationUserStubID is the ID of a headless authentication stub.
+const HeadlessAuthenticationUserStubID = "stub"
+
 // ValidateHeadlessAuthentication verifies that the headless authentication has
-// all of the required fields set. headless authentication stubs created with
-// CreateHeadlessAuthenticationStub will not pass this validation.
+// all of the required fields set. Headless authentication stubs will not pass
+// this validation.
 func ValidateHeadlessAuthentication(h *types.HeadlessAuthentication) error {
 	if err := h.CheckAndSetDefaults(); err != nil {
 		return trace.Wrap(err)
 	}
 
 	switch {
+	case h.State.IsUnspecified():
+		return trace.BadParameter("headless authentication resource state must be specified")
 	case h.Version != types.V1:
 		return trace.BadParameter("unsupported headless authentication resource version %q, current supported version is %s", h.Version, types.V1)
-	case h.User == "":
-		return trace.BadParameter("headless authentication resource must have non-empty user")
 	case h.PublicKey == nil:
 		return trace.BadParameter("headless authentication resource must have non-empty publicKey")
 	case h.Metadata.Name != NewHeadlessAuthenticationID(h.PublicKey):
diff --git a/lib/services/headlessauthn_test.go b/lib/services/headlessauthn_test.go
new file mode 100644
index 0000000000000..ba6db4a3198df
--- /dev/null
+++ b/lib/services/headlessauthn_test.go
@@ -0,0 +1,119 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+// TestValidateHeadlessAuthentication tests headless authentication validation logic.
+func TestValidateHeadlessAuthentication(t *testing.T) {
+	t.Parallel()
+
+	pubUUID := services.NewHeadlessAuthenticationID([]byte(sshPubKey))
+	expires := time.Now().Add(time.Minute)
+
+	newHA := func(modify func(*types.HeadlessAuthentication)) *types.HeadlessAuthentication {
+		ha := &types.HeadlessAuthentication{
+			ResourceHeader: types.ResourceHeader{
+				Metadata: types.Metadata{
+					Name:    pubUUID,
+					Expires: &expires,
+				},
+			},
+			State:     types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING,
+			User:      "user",
+			PublicKey: []byte(sshPubKey),
+		}
+		if modify != nil {
+			modify(ha)
+		}
+		return ha
+	}
+
+	tests := []struct {
+		name      string
+		ha        *types.HeadlessAuthentication
+		wantErr   string
+		assertErr require.ErrorAssertionFunc
+	}{
+		{
+			name: "OK valid headless authentication",
+			ha:   newHA(nil),
+		}, {
+			name: "NOK name missing",
+			ha: newHA(func(ha *types.HeadlessAuthentication) {
+				ha.SetName("")
+			}),
+			wantErr: "missing parameter Name",
+		}, {
+			name: "NOK name not derived from public key",
+			ha: newHA(func(ha *types.HeadlessAuthentication) {
+				// use a random UUID instead of the uuid.NewHash of the public key used above.
+				ha.SetName(uuid.NewString())
+			}),
+			wantErr: "headless authentication authentication resource name must be derived from public key",
+		}, {
+			name: "NOK expires missing",
+			ha: newHA(func(ha *types.HeadlessAuthentication) {
+				ha.SetExpiry(time.Time{})
+			}),
+			wantErr: "headless authentication resource must have non-zero header.metadata.expires",
+		}, {
+			name: "NOK username missing",
+			ha: newHA(func(ha *types.HeadlessAuthentication) {
+				ha.User = ""
+			}),
+			wantErr: "headless authentication resource must have non-empty user",
+		}, {
+			name: "NOK state not specified",
+			ha: newHA(func(ha *types.HeadlessAuthentication) {
+				ha.State = types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_UNSPECIFIED
+			}),
+			wantErr: "headless authentication resource state must be specified",
+		}, {
+			name: "NOK public key missing",
+			ha: newHA(func(ha *types.HeadlessAuthentication) {
+				ha.PublicKey = nil
+			}),
+			wantErr: "headless authentication resource must have non-empty publicKey",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := services.ValidateHeadlessAuthentication(test.ha)
+			if test.wantErr == "" {
+				require.NoError(t, err, "ValidateHeadlessAuthentication errored unexpectedly")
+				return
+			}
+			require.True(t, trace.IsBadParameter(err), "ValidateHeadlessAuthentication returned non-BadParameter error: %v", err)
+			require.ErrorContains(t, err, test.wantErr, "ValidateHeadlessAuthentication error mismatch")
+		})
+	}
+}
+
+// sshPubKey is a randomly-generated public key used for login tests.
+const sshPubKey = `ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGv+gN2C23P08ieJRA9gU/Ik4bsOh3Kw193UYscJDw41mATj+Kqyf45Rmj8F8rs3i7mYKRXXu1IjNRBzNgpXxqc=`
diff --git a/lib/services/identity.go b/lib/services/identity.go
index ceb280c0d3b75..00e4301e960bd 100644
--- a/lib/services/identity.go
+++ b/lib/services/identity.go
@@ -257,15 +257,7 @@ type Identity interface {
 	// GetKeyAttestationData gets a verified public key attestation response.
 	GetKeyAttestationData(ctx context.Context, publicKey crypto.PublicKey) (*keys.AttestationData, error)
 
-	// CreateHeadlessAuthenticationStub creates a headless authentication stub.
-	CreateHeadlessAuthenticationStub(ctx context.Context, name string) (*types.HeadlessAuthentication, error)
-
-	// CompareAndSwapHeadlessAuthentication performs a compare
-	// and swap replacement on a headless authentication resource.
-	CompareAndSwapHeadlessAuthentication(ctx context.Context, old, new *types.HeadlessAuthentication) (*types.HeadlessAuthentication, error)
-
-	// DeleteHeadlessAuthentication deletes a headless authentication from the backend by name.
-	DeleteHeadlessAuthentication(ctx context.Context, name string) error
+	HeadlessAuthenticationService
 
 	types.WebSessionsGetter
 	types.WebTokensGetter
@@ -326,6 +318,28 @@ type SAMLIdPSession interface {
 	DeleteUserSAMLIdPSessions(ctx context.Context, user string) error
 }
 
+// HeadlessAuthenticationService is responsible for headless authentication resource management
+type HeadlessAuthenticationService interface {
+	// GetHeadlessAuthentication gets a headless authentication.
+	GetHeadlessAuthentication(ctx context.Context, username, name string) (*types.HeadlessAuthentication, error)
+
+	// GetHeadlessAuthentications gets all headless authentications.
+	GetHeadlessAuthentications(ctx context.Context) ([]*types.HeadlessAuthentication, error)
+
+	// UpsertHeadlessAuthentication upserts a headless authentication.
+	UpsertHeadlessAuthentication(ctx context.Context, ha *types.HeadlessAuthentication) error
+
+	// CompareAndSwapHeadlessAuthentication performs a compare
+	// and swap replacement on a headless authentication resource.
+	CompareAndSwapHeadlessAuthentication(ctx context.Context, old, new *types.HeadlessAuthentication) (*types.HeadlessAuthentication, error)
+
+	// DeleteHeadlessAuthentication deletes a headless authentication from the backend.
+	DeleteHeadlessAuthentication(ctx context.Context, username, name string) error
+
+	// DeleteAllHeadlessAuthentications deletes all headless authentications from the backend.
+	DeleteAllHeadlessAuthentications(ctx context.Context) error
+}
+
 // VerifyPassword makes sure password satisfies our requirements (relaxed),
 // mostly to avoid putting garbage in
 func VerifyPassword(password []byte) error {
diff --git a/lib/services/label_expressions.go b/lib/services/label_expressions.go
index d5ac466fee06c..6e385dfef5f2d 100644
--- a/lib/services/label_expressions.go
+++ b/lib/services/label_expressions.go
@@ -65,10 +65,13 @@ func newLabelExpressionParser() (*typical.CachedParser[labelExpressionEnv, bool]
 				}),
 		},
 		Functions: map[string]typical.Function{
+			"labels_matching": typical.UnaryFunctionWithEnv(labelsMatching),
 			"contains": typical.BinaryFunction[labelExpressionEnv](
 				func(list []string, item string) (bool, error) {
 					return slices.Contains(list, item), nil
 				}),
+			"contains_any": typical.BinaryFunction[labelExpressionEnv](containsAny),
+			"contains_all": typical.BinaryFunction[labelExpressionEnv](containsAll),
 			"regexp.match": typical.BinaryFunction[labelExpressionEnv](
 				func(list []string, re string) (bool, error) {
 					match, err := utils.RegexMatchesAny(list, re)
@@ -77,9 +80,10 @@ func newLabelExpressionParser() (*typical.CachedParser[labelExpressionEnv, bool]
 					}
 					return match, nil
 				}),
-			// Use regexp.replace from lib/utils/parse to get behavior identical
+			// Use regexp.replace and email.local from lib/utils/parse to get behavior identical
 			// to role templates.
 			"regexp.replace": typical.TernaryFunction[labelExpressionEnv](parse.RegexpReplace),
+			"email.local":    typical.UnaryFunction[labelExpressionEnv](parse.EmailLocal),
 			"strings.upper": typical.UnaryFunction[labelExpressionEnv](
 				func(list []string) ([]string, error) {
 					out := make([]string, len(list))
@@ -100,3 +104,56 @@ func newLabelExpressionParser() (*typical.CachedParser[labelExpressionEnv, bool]
 	})
 	return parser, trace.Wrap(err)
 }
+
+// labelsMatching returns the aggregate of all label values for all keys that
+// match keyExpr. It supports globs or full regular expressions and must find
+// a complete match for the key.
+func labelsMatching(env labelExpressionEnv, keyExpr string) ([]string, error) {
+	allLabels := env.resourceLabelGetter.GetAllLabels()
+	var matchingLabelValues []string
+	for key, value := range allLabels {
+		match, err := utils.MatchString(key, keyExpr)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		if match {
+			matchingLabelValues = append(matchingLabelValues, value)
+		}
+	}
+	return matchingLabelValues, nil
+}
+
+// containsAny returns true if [list] contains any element of [items].
+func containsAny(list []string, items []string) (bool, error) {
+	s := set(list)
+	for _, item := range items {
+		if _, ok := s[item]; ok {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// containsAny returns true if [list] contains every element of [items]. If
+// [items] is empty, it returns false, to avoid matching resources that
+// otherwise appear unrelated to the expression.
+func containsAll(list []string, items []string) (bool, error) {
+	if len(items) == 0 {
+		return false, nil
+	}
+	s := set(list)
+	for _, item := range items {
+		if _, ok := s[item]; !ok {
+			return false, nil
+		}
+	}
+	return true, nil
+}
+
+func set(list []string) map[string]struct{} {
+	m := make(map[string]struct{}, len(list))
+	for _, l := range list {
+		m[l] = struct{}{}
+	}
+	return m
+}
diff --git a/lib/services/label_expressions_test.go b/lib/services/label_expressions_test.go
index f373253250edf..cc79933efc666 100644
--- a/lib/services/label_expressions_test.go
+++ b/lib/services/label_expressions_test.go
@@ -22,15 +22,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-type labelExpressionTestResource struct {
-	labels map[string]string
-}
-
-func (t labelExpressionTestResource) GetLabel(key string) (string, bool) {
-	label, ok := t.labels[key]
-	return label, ok
-}
-
 func TestLabelExpressions(t *testing.T) {
 	t.Parallel()
 
@@ -145,6 +136,30 @@ func TestLabelExpressions(t *testing.T) {
 			},
 			expectMatch: true,
 		},
+		{
+			desc: "email.local",
+			expr: `contains(email.local(user.spec.traits["email"]), labels["owner"]) &&
+			       contains(email.local(user.spec.traits["full email"]), labels["owner"])`,
+			resourceLabels: map[string]string{
+				"owner": "test",
+			},
+			userTraits: map[string][]string{
+				"email":      {"test@example.com"},
+				"full email": {"Test <test@example.com>"},
+			},
+			expectMatch: true,
+		},
+		{
+			desc: "email.local error",
+			expr: `contains(email.local(user.spec.traits["email"]), labels["owner"])`,
+			resourceLabels: map[string]string{
+				"owner": "test",
+			},
+			userTraits: map[string][]string{
+				"email": {"test"},
+			},
+			expectEvaluateError: []string{`failed to parse "email.local" argument`},
+		},
 		{
 			desc: "string helpers",
 			expr: `
@@ -158,6 +173,136 @@ func TestLabelExpressions(t *testing.T) {
 			},
 			expectMatch: true,
 		},
+		{
+			desc: "labels_matching name",
+			expr: `contains(labels_matching("^project-(name|label)$"), "skunkworks")`,
+			resourceLabels: map[string]string{
+				"project-name":  "skunkworks",
+				"project-label": "secret",
+			},
+			expectMatch: true,
+		},
+		{
+			desc: "labels_matching label",
+			expr: `contains(labels_matching("^project-(name|label)$"), "skunkworks")`,
+			resourceLabels: map[string]string{
+				"project-name":  "secret",
+				"project-label": "skunkworks",
+			},
+			expectMatch: true,
+		},
+		{
+			desc: "labels_matching glob",
+			expr: `contains(labels_matching("project-*"), "skunkworks")`,
+			resourceLabels: map[string]string{
+				"project-name":  "skunkworks",
+				"project-label": "secret",
+			},
+			expectMatch: true,
+		},
+		{
+			desc: "labels_matching no match",
+			expr: `contains(labels_matching("project-*"), "skunkworks")`,
+			resourceLabels: map[string]string{
+				"project": "skunkworks",
+			},
+			expectMatch: false,
+		},
+		{
+			desc: "contains_any match",
+			expr: `contains_any(user.spec.traits["projects"], labels_matching("project-*"))`,
+			userTraits: map[string][]string{
+				"projects": []string{"parser", "skunkworks", "algorithms"},
+			},
+			resourceLabels: map[string]string{
+				"project-name":  "skunkworks",
+				"project-label": "secret",
+			},
+			expectMatch: true,
+		},
+		{
+			desc: "contains_any no match",
+			expr: `contains_any(user.spec.traits["projects"], labels_matching("project-*"))`,
+			userTraits: map[string][]string{
+				"projects": []string{"parser", "algorithms"},
+			},
+			resourceLabels: map[string]string{
+				"project-name":  "skunkworks",
+				"project-label": "secret",
+			},
+			expectMatch: false,
+		},
+		{
+			desc:       "contains_any empty first arg",
+			expr:       `contains_any(user.spec.traits["projects"], labels_matching("project-*"))`,
+			userTraits: map[string][]string{},
+			resourceLabels: map[string]string{
+				"project-name":  "skunkworks",
+				"project-label": "secret",
+			},
+			expectMatch: false,
+		},
+		{
+			desc: "contains_any empty second arg",
+			expr: `contains_any(user.spec.traits["projects"], labels_matching("project-*"))`,
+			userTraits: map[string][]string{
+				"projects": []string{"parser", "algorithms"},
+			},
+			resourceLabels: map[string]string{
+				"team": "security",
+			},
+			expectMatch: false,
+		},
+		{
+			desc: "contains_all match",
+			expr: `contains_all(user.spec.traits["projects"], labels_matching("project-*"))`,
+			userTraits: map[string][]string{
+				"projects": []string{"parser", "skunkworks", "algorithms"},
+			},
+			resourceLabels: map[string]string{
+				"project-primary":   "parser",
+				"project-secondary": "algorithms",
+			},
+			expectMatch: true,
+		},
+		{
+			desc: "contains_all no match",
+			expr: `contains_all(user.spec.traits["projects"], labels_matching("project-*"))`,
+			userTraits: map[string][]string{
+				"projects": []string{"parser", "skunkworks", "algorithms"},
+			},
+			resourceLabels: map[string]string{
+				"project-primary":   "parser",
+				"project-secondary": "algorithms",
+				"project-label":     "secret",
+			},
+			expectMatch: false,
+		},
+		{
+			desc:       "contains_all empty first arg",
+			expr:       `contains_all(user.spec.traits["projects"], labels_matching("project-*"))`,
+			userTraits: map[string][]string{},
+			resourceLabels: map[string]string{
+				"project-primary":   "parser",
+				"project-secondary": "algorithms",
+				"project-label":     "secret",
+			},
+			expectMatch: false,
+		},
+		{
+			desc: "contains_all empty second arg",
+			expr: `contains_all(user.spec.traits["projects"], labels_matching("project-*"))`,
+			userTraits: map[string][]string{
+				"projects": []string{"parser", "skunkworks", "algorithms"},
+			},
+			// This resource seems unrelated to the contains_all expression. To
+			// avoid footguns, contains_all intentionally returns false when the
+			// second argument is empty.
+			resourceLabels: map[string]string{
+				"team": "security",
+			},
+			expectMatch: false,
+		},
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
 			parsedExpr, err := parseLabelExpression(tc.expr)
@@ -170,10 +315,8 @@ func TestLabelExpressions(t *testing.T) {
 			require.NoError(t, err, trace.DebugReport(err))
 
 			env := labelExpressionEnv{
-				resourceLabelGetter: labelExpressionTestResource{
-					labels: tc.resourceLabels,
-				},
-				userTraits: tc.userTraits,
+				resourceLabelGetter: mapLabelGetter(tc.resourceLabels),
+				userTraits:          tc.userTraits,
 			}
 
 			match, err := parsedExpr.Evaluate(env)
diff --git a/lib/services/local/databases.go b/lib/services/local/databases.go
index bb4b6aebe31f3..b61a2908400c8 100644
--- a/lib/services/local/databases.go
+++ b/lib/services/local/databases.go
@@ -74,7 +74,7 @@ func (s *DatabaseService) GetDatabase(ctx context.Context, name string) (types.D
 
 // CreateDatabase creates a new database resource.
 func (s *DatabaseService) CreateDatabase(ctx context.Context, database types.Database) error {
-	if err := services.ValidateDatabase(database); err != nil {
+	if err := database.CheckAndSetDefaults(); err != nil {
 		return trace.Wrap(err)
 	}
 	value, err := services.MarshalDatabase(database)
diff --git a/lib/services/local/databases_test.go b/lib/services/local/databases_test.go
index 6e0703a518cc0..1607532241e90 100644
--- a/lib/services/local/databases_test.go
+++ b/lib/services/local/databases_test.go
@@ -78,13 +78,12 @@ func TestDatabasesCRUD(t *testing.T) {
 		URI:      "localhost",
 	})
 	require.NoError(t, err)
-	err = service.CreateDatabase(ctx, dbBadURI)
-	require.True(t, trace.IsBadParameter(err))
+	require.NoError(t, service.CreateDatabase(ctx, dbBadURI))
 
 	// Fetch all databases.
 	out, err = service.GetDatabases(ctx)
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.Database{db1, db2}, out,
+	require.Empty(t, cmp.Diff([]types.Database{dbBadURI, db1, db2}, out,
 		cmpopts.IgnoreFields(types.Metadata{}, "ID"),
 	))
 
@@ -118,7 +117,7 @@ func TestDatabasesCRUD(t *testing.T) {
 	require.NoError(t, err)
 	out, err = service.GetDatabases(ctx)
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]types.Database{db2}, out,
+	require.Empty(t, cmp.Diff([]types.Database{dbBadURI, db2}, out,
 		cmpopts.IgnoreFields(types.Metadata{}, "ID"),
 	))
 
diff --git a/lib/services/local/embeddings.go b/lib/services/local/embeddings.go
new file mode 100644
index 0000000000000..d782e1448b573
--- /dev/null
+++ b/lib/services/local/embeddings.go
@@ -0,0 +1,97 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package local
+
+import (
+	"context"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/sirupsen/logrus"
+
+	"github.com/gravitational/teleport/api/internalutils/stream"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/ai"
+	"github.com/gravitational/teleport/lib/backend"
+)
+
+// EmbeddingsService implements the services.Embeddings interface.
+type EmbeddingsService struct {
+	log    *logrus.Entry
+	jitter retryutils.Jitter
+	backend.Backend
+	clock clockwork.Clock
+}
+
+const (
+	embeddingsPrefix = "embeddings"
+	embeddingExpiry  = 30 * 24 * time.Hour // 30 days
+)
+
+// GetEmbedding looks up a single embedding by its name in the backend.
+func (e EmbeddingsService) GetEmbedding(ctx context.Context, kind, resourceID string) (*ai.Embedding, error) {
+	result, err := e.Get(ctx, backend.Key(embeddingsPrefix, kind, resourceID))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return ai.UnmarshalEmbedding(result.Value)
+}
+
+// GetEmbeddings returns a stream of embeddings for a given kind.
+func (e EmbeddingsService) GetEmbeddings(ctx context.Context, kind string) stream.Stream[*ai.Embedding] {
+	startKey := backend.ExactKey(embeddingsPrefix, kind)
+	items := backend.StreamRange(ctx, e, startKey, backend.RangeEnd(startKey), 50)
+	return stream.FilterMap(items, func(item backend.Item) (*ai.Embedding, bool) {
+		embedding, err := ai.UnmarshalEmbedding(item.Value)
+		if err != nil {
+			e.log.Warnf("Skipping embedding at %s, failed to unmarshal: %v", item.Key, err)
+			return nil, false
+		}
+		return embedding, true
+	})
+}
+
+// UpsertEmbedding creates or update a single ai.Embedding in the backend.
+func (e EmbeddingsService) UpsertEmbedding(ctx context.Context, embedding *ai.Embedding) (*ai.Embedding, error) {
+	value, err := ai.MarshalEmbedding(embedding)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	_, err = e.Put(ctx, backend.Item{
+		Key:     embeddingItemKey(embedding),
+		Value:   value,
+		Expires: e.clock.Now().Add(embeddingExpiry),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return embedding, nil
+}
+
+// NewEmbeddingsService is a constructor for the EmbeddingsService.
+func NewEmbeddingsService(b backend.Backend) *EmbeddingsService {
+	return &EmbeddingsService{
+		log:     logrus.WithFields(logrus.Fields{trace.Component: "Embeddings"}),
+		jitter:  retryutils.NewFullJitter(),
+		Backend: b,
+		clock:   clockwork.NewRealClock(),
+	}
+}
+
+// embeddingItemKey builds the backend item key for a given ai.Embedding.
+func embeddingItemKey(embedding *ai.Embedding) []byte {
+	return backend.Key(embeddingsPrefix, embedding.GetName())
+}
diff --git a/lib/services/local/embeddings_test.go b/lib/services/local/embeddings_test.go
new file mode 100644
index 0000000000000..f9eaa3e16b272
--- /dev/null
+++ b/lib/services/local/embeddings_test.go
@@ -0,0 +1,233 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package local
+
+import (
+	"context"
+	"crypto/sha256"
+	"sort"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/internalutils/stream"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/ai"
+	"github.com/gravitational/teleport/lib/backend/memory"
+)
+
+var (
+	embedding1 = ai.NewEmbedding(types.KindNode, "foo", ai.Vector64{0, 0}, sha256.Sum256([]byte("test1")))
+	embedding2 = ai.NewEmbedding(types.KindNode, "bar", ai.Vector64{1, 1, 1}, sha256.Sum256([]byte("test2")))
+	embedding3 = ai.NewEmbedding(types.KindDatabase, "bar", ai.Vector64{2}, sha256.Sum256([]byte("test3")))
+)
+
+func errorIsNotFound(t require.TestingT, err error, msgAndArgs ...interface{}) {
+	require.True(t, trace.IsNotFound(err), msgAndArgs...)
+}
+
+func TestGetEmbedding(t *testing.T) {
+	t.Parallel()
+	// Test setup: create the backend, the service, and load all fixtures
+	ctx := context.Background()
+
+	fixtures := []*ai.Embedding{embedding1, embedding2, embedding3}
+
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+
+	service := NewEmbeddingsService(backend)
+
+	for _, fixture := range fixtures {
+		_, err := service.UpsertEmbedding(ctx, fixture)
+		require.NoError(t, err)
+	}
+
+	// Test execution
+	tests := []struct {
+		name      string
+		kind      string
+		id        string
+		assertErr require.ErrorAssertionFunc
+		expected  *ai.Embedding
+	}{
+		{
+			name:      "Simple get",
+			kind:      types.KindNode,
+			id:        "foo",
+			assertErr: require.NoError,
+			expected:  embedding1,
+		},
+		{
+			name:      "Kind conflict",
+			kind:      types.KindDatabase,
+			id:        "bar",
+			assertErr: require.NoError,
+			expected:  embedding3,
+		},
+		{
+			name:      "Non-existing",
+			kind:      types.KindDatabase,
+			id:        "foo",
+			assertErr: errorIsNotFound,
+			expected:  nil,
+		},
+	}
+
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			embedding, err := service.GetEmbedding(ctx, tc.kind, tc.id)
+			tc.assertErr(t, err)
+			requireEmbeddingsEqual(t, tc.expected, embedding)
+		})
+	}
+}
+
+func TestGetEmbeddings(t *testing.T) {
+	t.Parallel()
+	// Test setup: create the backend, the service, and load all fixtures
+	ctx := context.Background()
+
+	fixtures := []*ai.Embedding{embedding1, embedding2, embedding3}
+
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+
+	service := NewEmbeddingsService(backend)
+
+	for _, fixture := range fixtures {
+		_, err := service.UpsertEmbedding(ctx, fixture)
+		require.NoError(t, err)
+	}
+
+	// Test execution
+	tests := []struct {
+		name      string
+		kind      string
+		assertErr require.ErrorAssertionFunc
+		expected  sortableEmbeddings
+	}{
+		{
+			name:      "Get multiple embeddings",
+			kind:      types.KindNode,
+			assertErr: require.NoError,
+			expected:  sortableEmbeddings{embedding1, embedding2},
+		},
+		{
+			name:      "Get single embedding",
+			kind:      types.KindDatabase,
+			assertErr: require.NoError,
+			expected:  sortableEmbeddings{embedding3},
+		},
+		{
+			name:      "Get no embeddings",
+			kind:      types.KindApp,
+			assertErr: require.NoError,
+			expected:  nil,
+		},
+	}
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			var embeddings sortableEmbeddings
+			var err error
+			embeddings, err = stream.Collect(service.GetEmbeddings(ctx, tc.kind))
+			tc.assertErr(t, err)
+			sort.Sort(embeddings)
+			sort.Sort(tc.expected)
+			require.Equal(t, len(tc.expected), len(embeddings))
+			for i, expected := range tc.expected {
+				requireEmbeddingsEqual(t, expected, embeddings[i])
+			}
+		})
+	}
+}
+
+func TestUpsertEmbedding(t *testing.T) {
+	t.Parallel()
+	// Test setup: create the backend, the service
+	ctx := context.Background()
+
+	backend, err := memory.New(memory.Config{
+		Context: ctx,
+		Clock:   clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+
+	service := NewEmbeddingsService(backend)
+
+	// Test: check there's nothing in the backend first
+	_, err = service.GetEmbedding(ctx, types.KindNode, "foo")
+	errorIsNotFound(t, err)
+
+	// Test: add an element in the backend and check if we can retrieve it
+	embedding := ai.NewEmbedding(types.KindNode, "foo", ai.Vector64{0, 0}, sha256.Sum256([]byte("test")))
+	embedding, err = service.UpsertEmbedding(ctx, embedding)
+	require.NoError(t, err)
+	result, err := service.GetEmbedding(ctx, types.KindNode, "foo")
+	require.NoError(t, err)
+	requireEmbeddingsEqual(t, embedding, result)
+
+	// Test: update the embedding and check we now retrieve the new version
+	embedding = ai.NewEmbedding(types.KindNode, "foo", ai.Vector64{1, 1, 1, 1, 1}, sha256.Sum256([]byte("test2")))
+	embedding, err = service.UpsertEmbedding(ctx, embedding)
+	require.NoError(t, err)
+	result, err = service.GetEmbedding(ctx, types.KindNode, "foo")
+	require.NoError(t, err)
+	requireEmbeddingsEqual(t, embedding, result)
+}
+
+// sortableEmbeddings is an ai.Embedding list that can be sorted. This is used
+// in tests to compare two lists and their content.
+type sortableEmbeddings []*ai.Embedding
+
+func (s sortableEmbeddings) Len() int {
+	return len(s)
+}
+
+func (s sortableEmbeddings) Less(i, j int) bool {
+	return s[i].GetName() < s[j].GetName()
+}
+
+func (s sortableEmbeddings) Swap(i, j int) {
+	s[i], s[j] = s[j], s[i]
+}
+
+// requireEmbeddingsEqual checks if two embeddings are equal or fails the test otherwise.
+// This is required because equivalent ai.Embedding might differ depending on
+// how they have been created (marshaling/unmarshalling protobuf messages set
+// some internal fields that a freshly created ai.Embedding doesn't have).
+func requireEmbeddingsEqual(t require.TestingT, expected, actual *ai.Embedding) {
+	if expected == nil {
+		require.Nil(t, actual)
+		return
+	}
+	require.NotNil(t, actual)
+	require.Equal(t, expected.EmbeddedId, actual.EmbeddedId)
+	require.Equal(t, expected.EmbeddedKind, actual.EmbeddedKind)
+	require.Equal(t, expected.EmbeddedHash, actual.EmbeddedHash)
+	require.Equal(t, expected.Vector, actual.Vector)
+}
diff --git a/lib/services/local/events.go b/lib/services/local/events.go
index 9419405a648e6..992333eee256f 100644
--- a/lib/services/local/events.go
+++ b/lib/services/local/events.go
@@ -162,6 +162,8 @@ func (e *EventsService) NewWatcher(ctx context.Context, watch types.Watch) (type
 			parser = newOktaAssignmentParser()
 		case types.KindIntegration:
 			parser = newIntegrationParser()
+		case types.KindHeadlessAuthentication:
+			parser = newHeadlessAuthenticationParser()
 		default:
 			if watch.AllowPartialSuccess {
 				continue
@@ -673,7 +675,7 @@ type roleParser struct {
 func (p *roleParser) parse(event backend.Event) (types.Resource, error) {
 	switch event.Type {
 	case types.OpDelete:
-		return resourceHeader(event, types.KindRole, types.V6, 1)
+		return resourceHeader(event, types.KindRole, types.V7, 1)
 	case types.OpPut:
 		resource, err := services.UnmarshalRole(event.Item.Value,
 			services.WithResourceID(event.Item.ID),
@@ -1551,6 +1553,27 @@ func (p *integrationParser) parse(event backend.Event) (types.Resource, error) {
 	}
 }
 
+func newHeadlessAuthenticationParser() *headlessAuthenticationParser {
+	return &headlessAuthenticationParser{
+		baseParser: newBaseParser(backend.Key(headlessAuthenticationPrefix)),
+	}
+}
+
+type headlessAuthenticationParser struct {
+	baseParser
+}
+
+func (p *headlessAuthenticationParser) parse(event backend.Event) (types.Resource, error) {
+	switch event.Type {
+	case types.OpDelete:
+		return resourceHeader(event, types.KindIntegration, types.V1, 0)
+	case types.OpPut:
+		return unmarshalHeadlessAuthentication(event.Item.Value)
+	default:
+		return nil, trace.BadParameter("event %v is not supported", event.Type)
+	}
+}
+
 func resourceHeader(event backend.Event, kind, version string, offset int) (types.Resource, error) {
 	name, err := base(event.Item.Key, offset)
 	if err != nil {
diff --git a/lib/services/local/headlessauthn.go b/lib/services/local/headlessauthn.go
index ca69c24cce98d..664432b7e1514 100644
--- a/lib/services/local/headlessauthn.go
+++ b/lib/services/local/headlessauthn.go
@@ -23,29 +23,19 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
-// CreateHeadlessAuthenticationStub creates a headless authentication stub in the backend.
-func (s *IdentityService) CreateHeadlessAuthenticationStub(ctx context.Context, name string) (*types.HeadlessAuthentication, error) {
-	expires := s.Clock().Now().Add(defaults.CallbackTimeout)
-	headlessAuthn, err := types.NewHeadlessAuthenticationStub(name, expires)
+// UpsertHeadlessAuthentication upserts a headless authentication in the backend.
+func (s *IdentityService) UpsertHeadlessAuthentication(ctx context.Context, ha *types.HeadlessAuthentication) error {
+	item, err := marshalHeadlessAuthenticationToItem(ha)
 	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	item, err := MarshalHeadlessAuthenticationToItem(headlessAuthn)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if _, err = s.Create(ctx, *item); err != nil {
-		return nil, trace.Wrap(err)
+		return trace.Wrap(err)
 	}
 
-	return headlessAuthn, nil
+	_, err = s.Put(ctx, *item)
+	return trace.Wrap(err)
 }
 
 // CompareAndSwapHeadlessAuthentication validates the new headless authentication and
@@ -55,12 +45,12 @@ func (s *IdentityService) CompareAndSwapHeadlessAuthentication(ctx context.Conte
 		return nil, trace.Wrap(err)
 	}
 
-	oldItem, err := MarshalHeadlessAuthenticationToItem(old)
+	oldItem, err := marshalHeadlessAuthenticationToItem(old)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	newItem, err := MarshalHeadlessAuthenticationToItem(new)
+	newItem, err := marshalHeadlessAuthenticationToItem(new)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -73,9 +63,9 @@ func (s *IdentityService) CompareAndSwapHeadlessAuthentication(ctx context.Conte
 	return new, nil
 }
 
-// GetHeadlessAuthentication returns a headless authentication from the backend by name.
-func (s *IdentityService) GetHeadlessAuthentication(ctx context.Context, name string) (*types.HeadlessAuthentication, error) {
-	item, err := s.Get(ctx, headlessAuthenticationKey(name))
+// GetHeadlessAuthentication returns a headless authentication from the backend.
+func (s *IdentityService) GetHeadlessAuthentication(ctx context.Context, username, name string) (*types.HeadlessAuthentication, error) {
+	item, err := s.Get(ctx, headlessAuthenticationKey(username, name))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -90,8 +80,9 @@ func (s *IdentityService) GetHeadlessAuthentication(ctx context.Context, name st
 
 // GetHeadlessAuthentications returns all headless authentications from the backend.
 func (s *IdentityService) GetHeadlessAuthentications(ctx context.Context) ([]*types.HeadlessAuthentication, error) {
-	rangeStart := headlessAuthenticationKey("")
+	rangeStart := backend.ExactKey(headlessAuthenticationPrefix)
 	rangeEnd := backend.RangeEnd(rangeStart)
+
 	items, err := s.GetRange(ctx, rangeStart, rangeEnd, 0)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -109,34 +100,49 @@ func (s *IdentityService) GetHeadlessAuthentications(ctx context.Context) ([]*ty
 	return headlessAuthns, nil
 }
 
-// DeleteHeadlessAuthentication deletes a headless authentication from the backend by name.
-func (s *IdentityService) DeleteHeadlessAuthentication(ctx context.Context, name string) error {
-	err := s.Delete(ctx, headlessAuthenticationKey(name))
-	return trace.Wrap(err)
+// DeleteHeadlessAuthentication deletes a headless authentication from the backend.
+func (s *IdentityService) DeleteHeadlessAuthentication(ctx context.Context, username, name string) error {
+	return trace.Wrap(s.Delete(ctx, headlessAuthenticationKey(username, name)))
 }
 
-// MarshalHeadlessAuthenticationToItem marshals a headless authentication to a backend.Item.
-func MarshalHeadlessAuthenticationToItem(headlessAuthn *types.HeadlessAuthentication) (*backend.Item, error) {
-	if err := headlessAuthn.CheckAndSetDefaults(); err != nil {
-		return nil, trace.Wrap(err)
-	}
+// DeleteAllHeadlessAuthentications deletes all headless authentications from the backend.
+func (s *IdentityService) DeleteAllHeadlessAuthentications(ctx context.Context) error {
+	startKey := backend.ExactKey(headlessAuthenticationPrefix)
+	return s.DeleteRange(ctx, startKey, backend.RangeEnd(startKey))
+}
 
-	value, err := utils.FastMarshal(headlessAuthn)
+// marshalHeadlessAuthenticationToItem marshals a headless authentication to a backend.Item.
+func marshalHeadlessAuthenticationToItem(headlessAuthn *types.HeadlessAuthentication) (*backend.Item, error) {
+	value, err := marshalHeadlessAuthentication(headlessAuthn)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	return &backend.Item{
-		Key:     headlessAuthenticationKey(headlessAuthn.Metadata.Name),
+		Key:     headlessAuthenticationKey(headlessAuthn.User, headlessAuthn.Metadata.Name),
 		Value:   value,
 		Expires: *headlessAuthn.Metadata.Expires,
 	}, nil
 }
 
+// marshalHeadlessAuthentication marshals a headless authentication to JSON.
+func marshalHeadlessAuthentication(ha *types.HeadlessAuthentication) ([]byte, error) {
+	if err := ha.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return utils.FastMarshal(ha)
+}
+
 // unmarshalHeadlessAuthenticationFromItem unmarshals a headless authentication from a backend.Item.
 func unmarshalHeadlessAuthenticationFromItem(item *backend.Item) (*types.HeadlessAuthentication, error) {
+	return unmarshalHeadlessAuthentication(item.Value)
+}
+
+// unmarshalHeadlessAuthentication unmarshals a headless authentication from JSON.
+func unmarshalHeadlessAuthentication(data []byte) (*types.HeadlessAuthentication, error) {
 	var headlessAuthn types.HeadlessAuthentication
-	if err := utils.FastUnmarshal(item.Value, &headlessAuthn); err != nil {
+	if err := utils.FastUnmarshal(data, &headlessAuthn); err != nil {
 		return nil, trace.Wrap(err, "error unmarshalling headless authentication from storage")
 	}
 
@@ -147,6 +153,8 @@ func unmarshalHeadlessAuthenticationFromItem(item *backend.Item) (*types.Headles
 	return &headlessAuthn, nil
 }
 
-func headlessAuthenticationKey(name string) []byte {
-	return backend.Key("headless_authentication", name)
+const headlessAuthenticationPrefix = "headless_authentication"
+
+func headlessAuthenticationKey(username, name string) []byte {
+	return backend.Key(headlessAuthenticationPrefix, usersPrefix, username, name)
 }
diff --git a/lib/services/local/headlessauthn_test.go b/lib/services/local/headlessauthn_test.go
index a1e9b9dc1ef40..23779329e85aa 100644
--- a/lib/services/local/headlessauthn_test.go
+++ b/lib/services/local/headlessauthn_test.go
@@ -21,7 +21,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
@@ -30,123 +29,52 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 )
 
-// TestIdentityService_HeadlessAuthenticationBackend tests headless authentication
-// backend methods for functionality and validation.
+// TestIdentityService_HeadlessAuthenticationBackend tests headless authentication backend methods.
 func TestIdentityService_HeadlessAuthenticationBackend(t *testing.T) {
 	t.Parallel()
 	identity := newIdentityService(t, clockwork.NewFakeClock())
 
 	ctx := context.Background()
 	pubUUID := services.NewHeadlessAuthenticationID([]byte(sshPubKey))
-	expires := time.Now().Add(time.Minute)
-
-	expectBadParameter := func(tt require.TestingT, err error, i ...interface{}) {
-		require.True(t, trace.IsBadParameter(err), "expected bad parameter error but got: %v", err)
-	}
-
-	tests := []struct {
-		name              string
-		ha                *types.HeadlessAuthentication
-		createStubErr     require.ErrorAssertionFunc
-		compareAndSwapErr require.ErrorAssertionFunc
-	}{
-		{
-			name: "OK headless authentication",
-			ha: &types.HeadlessAuthentication{
-				ResourceHeader: types.ResourceHeader{
-					Metadata: types.Metadata{
-						Name:    pubUUID,
-						Expires: &expires,
-					},
-				},
-				User:      "user",
-				PublicKey: []byte(sshPubKey),
-			},
-		}, {
-			name: "NOK name missing",
-			ha: &types.HeadlessAuthentication{
-				ResourceHeader: types.ResourceHeader{
-					Metadata: types.Metadata{
-						Expires: &expires,
-					},
-				},
-				User:      "user",
-				PublicKey: []byte(sshPubKey),
-			},
-			createStubErr: expectBadParameter,
-		}, {
-			name: "NOK expires missing",
-			ha: &types.HeadlessAuthentication{
-				ResourceHeader: types.ResourceHeader{
-					Metadata: types.Metadata{
-						Name: pubUUID,
-					},
-				},
-				User:      "user",
-				PublicKey: []byte(sshPubKey),
-			},
-			compareAndSwapErr: expectBadParameter,
-		}, {
-			name: "NOK username missing",
-			ha: &types.HeadlessAuthentication{
-				ResourceHeader: types.ResourceHeader{
-					Metadata: types.Metadata{
-						Name:    pubUUID,
-						Expires: &expires,
-					},
-				},
-				PublicKey: []byte(sshPubKey),
-			},
-			compareAndSwapErr: expectBadParameter,
-		}, {
-			name: "NOK name not derived from public key",
-			ha: &types.HeadlessAuthentication{
-				ResourceHeader: types.ResourceHeader{
-					Metadata: types.Metadata{
-						Name:    uuid.NewString(),
-						Expires: &expires,
-					},
-				},
-				User:      "user",
-				PublicKey: []byte(sshPubKey),
+	expires := identity.Clock().Now().Add(time.Minute)
+	headlessAuthn := &types.HeadlessAuthentication{
+		ResourceHeader: types.ResourceHeader{
+			Metadata: types.Metadata{
+				Name:    pubUUID,
+				Expires: &expires,
 			},
-			compareAndSwapErr: expectBadParameter,
 		},
+		User:      "user",
+		PublicKey: []byte(sshPubKey),
+		State:     types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING,
 	}
 
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			stub, err := identity.CreateHeadlessAuthenticationStub(ctx, test.ha.Metadata.Name)
-			if test.createStubErr != nil {
-				test.createStubErr(t, err)
-				return
-			}
-			require.NoError(t, err, "CreateHeadlessAuthenticationStub returned non-nil error")
-
-			t.Cleanup(func() {
-				err = identity.DeleteHeadlessAuthentication(ctx, test.ha.Metadata.Name)
-				require.NoError(t, err)
-
-				_, err = identity.GetHeadlessAuthentication(ctx, test.ha.Metadata.Name)
-				require.True(t, trace.IsNotFound(err), "expected not found error but got: %v", err)
-			})
-
-			swapped, err := identity.CompareAndSwapHeadlessAuthentication(ctx, stub, test.ha)
-			if test.compareAndSwapErr != nil {
-				test.compareAndSwapErr(t, err)
-				return
-			}
-			require.NoError(t, err, "CompareAndSwapHeadlessAuthentication returned non-nil error")
-
-			retrieved, err := identity.GetHeadlessAuthentication(ctx, test.ha.Metadata.Name)
-			require.NoError(t, err, "GetHeadlessAuthentication returned non-nil error")
-			require.Equal(t, swapped, retrieved)
-
-			retrievedList, err := identity.GetHeadlessAuthentications(ctx)
-			require.NoError(t, err, "GetHeadlessAuthentications returned non-nil error")
-			require.Equal(t, []*types.HeadlessAuthentication{swapped}, retrievedList)
-		})
-	}
+	// Create a headless authentication with minimal fields set (stub)
+	stub, err := types.NewHeadlessAuthentication(headlessAuthn.User, headlessAuthn.Metadata.Name, headlessAuthn.Expiry())
+	require.NoError(t, err)
+	err = identity.UpsertHeadlessAuthentication(ctx, stub)
+	require.NoError(t, err, "UpsertHeadlessAuthentication returned non-nil error")
+
+	swapped, err := identity.CompareAndSwapHeadlessAuthentication(ctx, stub, headlessAuthn)
+	require.NoError(t, err, "CompareAndSwapHeadlessAuthentication returned non-nil error")
+
+	// Compare and swap should fail if the new headless authn fails validation.
+	_, err = identity.CompareAndSwapHeadlessAuthentication(ctx, swapped, stub)
+	require.True(t, trace.IsBadParameter(err), "CompareAndSwapHeadlessAuthentication expected bad parameter error but got: %v", err)
+
+	retrieved, err := identity.GetHeadlessAuthentication(ctx, headlessAuthn.User, headlessAuthn.Metadata.Name)
+	require.NoError(t, err, "GetHeadlessAuthentication returned non-nil error")
+	require.Equal(t, swapped, retrieved)
+
+	retrievedList, err := identity.GetHeadlessAuthentications(ctx)
+	require.NoError(t, err, "GetHeadlessAuthentications returned non-nil error")
+	require.Equal(t, []*types.HeadlessAuthentication{swapped}, retrievedList)
+
+	err = identity.DeleteHeadlessAuthentication(ctx, headlessAuthn.User, headlessAuthn.Metadata.Name)
+	require.NoError(t, err)
+
+	_, err = identity.GetHeadlessAuthentication(ctx, headlessAuthn.User, headlessAuthn.Metadata.Name)
+	require.True(t, trace.IsNotFound(err), "expected not found error but got: %v", err)
 }
 
 // sshPubKey is a randomly-generated public key used for login tests.
diff --git a/lib/services/local/headlessauthn_watcher.go b/lib/services/local/headlessauthn_watcher.go
index b18f92194984d..946c0457320c5 100644
--- a/lib/services/local/headlessauthn_watcher.go
+++ b/lib/services/local/headlessauthn_watcher.go
@@ -82,10 +82,10 @@ type HeadlessAuthenticationWatcher struct {
 	HeadlessAuthenticationWatcherConfig
 	identityService *IdentityService
 	retry           retryutils.Retry
-	mux             sync.Mutex
-	subscribers     [maxSubscribers]*headlessAuthenticationSubscriber
-	closed          chan struct{}
-	running         chan struct{}
+	sync.Mutex
+	subscribers [maxSubscribers]*headlessAuthenticationSubscriber
+	closed      chan struct{}
+	running     chan struct{}
 }
 
 // NewHeadlessAuthenticationWatcher creates a new headless authentication resource watcher.
@@ -134,9 +134,15 @@ func (h *HeadlessAuthenticationWatcher) Done() <-chan struct{} {
 }
 
 func (h *HeadlessAuthenticationWatcher) close() {
-	h.mux.Lock()
-	defer h.mux.Unlock()
+	h.Lock()
+	defer h.Unlock()
 	close(h.closed)
+
+	for _, s := range h.subscribers {
+		if s != nil {
+			s.Close()
+		}
+	}
 }
 
 func (h *HeadlessAuthenticationWatcher) runWatchLoop(ctx context.Context) {
@@ -198,7 +204,7 @@ func (h *HeadlessAuthenticationWatcher) newWatcher(ctx context.Context) (backend
 	watcher, err := h.identityService.NewWatcher(ctx, backend.Watch{
 		Name:            types.KindHeadlessAuthentication,
 		MetricComponent: types.KindHeadlessAuthentication,
-		Prefixes:        [][]byte{headlessAuthenticationKey("")},
+		Prefixes:        [][]byte{backend.Key(headlessAuthenticationPrefix)},
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -220,68 +226,65 @@ func (h *HeadlessAuthenticationWatcher) newWatcher(ctx context.Context) (backend
 }
 
 func (h *HeadlessAuthenticationWatcher) notify(headlessAuthns ...*types.HeadlessAuthentication) {
-	h.mux.Lock()
-	defer h.mux.Unlock()
+	h.Lock()
+	defer h.Unlock()
 
 	for _, ha := range headlessAuthns {
 		for _, s := range h.subscribers {
-			if s != nil && s.name == ha.Metadata.Name {
-				select {
-				case s.updates <- apiutils.CloneProtoMsg(ha):
-				default:
-					select {
-					case s.stale <- struct{}{}:
-					default:
-						// subscriber is already stale, skip.
-					}
-				}
+			if s != nil && s.name == ha.Metadata.Name && s.username == ha.User {
+				s.update(ha)
 			}
 		}
 	}
 }
 
-// HeadlessAuthenticationSubscriber is a subscriber of updates
-// for a specific headless authentication resource.
+// HeadlessAuthenticationSubscriber is a subscriber for a specific headless authentication.
 type HeadlessAuthenticationSubscriber interface {
-	Name() string
 	// Updates is a channel used by the watcher to send headless authentication updates.
-	// After receiving an update, the caller should check the stale channel to ensure it
-	// is not a stale update.
 	Updates() <-chan *types.HeadlessAuthentication
-	// Stale is a channel used by the watcher to notify the subscriber that one or more
-	// updates have been missed, due to slow receives on the Updates channel.
-	Stale() <-chan struct{}
+	// WaitForUpdate returns the first update which passes the given condition, or returns
+	// early if the condition results in an error or if the subscriber or given context is closed.
+	WaitForUpdate(ctx context.Context, cond func(*types.HeadlessAuthentication) (bool, error)) (*types.HeadlessAuthentication, error)
+	// Done returns a channel that's closed when the subscriber is closed.
+	Done() <-chan struct{}
 	// Close closes the subscriber and its channels. This frees up resources for the watcher
 	// and should always be called on completion.
 	Close()
 }
 
-// Subscribe creates a new headless authentication subscriber for the given headless authentication name.
-func (h *HeadlessAuthenticationWatcher) Subscribe(ctx context.Context, name string) (HeadlessAuthenticationSubscriber, error) {
-	i, err := h.assignSubscriber(name)
+// Subscribe creates a subscriber for a specific headless authentication.
+func (h *HeadlessAuthenticationWatcher) Subscribe(ctx context.Context, username, name string) (HeadlessAuthenticationSubscriber, error) {
+	if name == "" {
+		return nil, trace.BadParameter("name must be provided")
+	}
+	if username == "" {
+		return nil, trace.BadParameter("username must be provided")
+	}
+
+	i, err := h.assignSubscriber(username, name)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	subscriber := h.subscribers[i]
 
 	go func() {
-		select {
-		case <-ctx.Done():
-		case <-subscriber.closed:
-		}
-
-		// reclaim the subscriber and close remaining open channels.
+		<-subscriber.Done()
 		h.unassignSubscriber(i)
-		close(subscriber.updates)
-		close(subscriber.stale)
 	}()
 
+	// Check for an existing backend entry and send it as the first update.
+	if ha, err := h.identityService.GetHeadlessAuthentication(ctx, username, name); err == nil {
+		subscriber.update(ha)
+	} else if !trace.IsNotFound(err) {
+		return nil, trace.Wrap(err)
+	}
+
 	return subscriber, nil
 }
 
-func (h *HeadlessAuthenticationWatcher) assignSubscriber(name string) (int, error) {
-	h.mux.Lock()
-	defer h.mux.Unlock()
+func (h *HeadlessAuthenticationWatcher) assignSubscriber(username, name string) (int, error) {
+	h.Lock()
+	defer h.Unlock()
 
 	select {
 	case <-h.closed:
@@ -292,12 +295,11 @@ func (h *HeadlessAuthenticationWatcher) assignSubscriber(name string) (int, erro
 	for i := range h.subscribers {
 		if h.subscribers[i] == nil {
 			h.subscribers[i] = &headlessAuthenticationSubscriber{
-				name: name,
-				// small buffer for updates to avoid unnecessary stale checks.
+				name:     name,
+				username: username,
+				// small buffer for updates so we can replace stale updates.
 				updates: make(chan *types.HeadlessAuthentication, 1),
-				// buffer required to mark as stale.
-				stale:  make(chan struct{}, 1),
-				closed: make(chan struct{}),
+				closed:  make(chan struct{}),
 			}
 			return i, nil
 		}
@@ -307,67 +309,38 @@ func (h *HeadlessAuthenticationWatcher) assignSubscriber(name string) (int, erro
 }
 
 func (h *HeadlessAuthenticationWatcher) unassignSubscriber(i int) {
-	h.mux.Lock()
-	defer h.mux.Unlock()
+	h.Lock()
+	defer h.Unlock()
 	h.subscribers[i] = nil
 }
 
 // headlessAuthenticationSubscriber is a subscriber for a specific headless authentication.
 type headlessAuthenticationSubscriber struct {
-	// name is the name of the headless authentication resource being subscribed to.
+	// name is a headless authentication name.
 	name string
-	// updates is a channel used by the watcher to send resource updates.
-	updates chan *types.HeadlessAuthentication
-	// stale is a channel used to determine if the subscriber is stale and
-	// needs to check the backend for missed data.
-	stale chan struct{}
+	// username is a teleport username.
+	username string
+	// updates is a channel used by the watcher to send resource updates. This channel
+	// will either be empty or have the latest update in its buffer.
+	updates   chan *types.HeadlessAuthentication
+	updatesMu sync.Mutex
 	// closed is a channel used to determine if the subscriber is closed.
 	closed chan struct{}
 }
 
-func (s *headlessAuthenticationSubscriber) Name() string {
-	return s.name
-}
-
+// Updates is a channel used by the watcher to send headless authentication updates.
 func (s *headlessAuthenticationSubscriber) Updates() <-chan *types.HeadlessAuthentication {
 	return s.updates
 }
 
-func (s *headlessAuthenticationSubscriber) Stale() <-chan struct{} {
-	return s.stale
-}
-
-func (s *headlessAuthenticationSubscriber) Close() {
-	close(s.closed)
-}
-
-// WaitForUpdate waits until the headless authentication with the given name is updated in the
-// backend to meet the given condition or returns early if the condition results in an
-// error or if the watcher or given context is closed.
-func (h *HeadlessAuthenticationWatcher) WaitForUpdate(ctx context.Context, subscriber HeadlessAuthenticationSubscriber, cond func(*types.HeadlessAuthentication) (bool, error)) (*types.HeadlessAuthentication, error) {
-	// First check for an existing backend entry.
-	ha, err := h.identityService.GetHeadlessAuthentication(ctx, subscriber.Name())
-	if trace.IsNotFound(err) {
-		// If not found, that's ok. Continue to watch update channel.
-	} else if err != nil {
-		return nil, trace.Wrap(err)
-	} else if ok, err := cond(ha); err != nil {
-		return nil, trace.Wrap(err)
-	} else if ok {
-		return ha, nil
-	}
-
+// WaitForUpdate returns the first update which passes the given condition, or returns
+// early if the condition results in an error or if the subscriber or given context is closed.
+func (s *headlessAuthenticationSubscriber) WaitForUpdate(ctx context.Context, cond func(*types.HeadlessAuthentication) (bool, error)) (*types.HeadlessAuthentication, error) {
 	for {
 		select {
-		case ha := <-subscriber.Updates():
-			select {
-			case <-subscriber.Stale():
-				// If stale, then this update is not the most recent. Check the backend.
-				ha, err = h.identityService.GetHeadlessAuthentication(ctx, subscriber.Name())
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-			default:
+		case ha, ok := <-s.Updates():
+			if !ok {
+				return nil, ErrHeadlessAuthenticationWatcherClosed
 			}
 			if ok, err := cond(ha); err != nil {
 				return nil, trace.Wrap(err)
@@ -376,8 +349,44 @@ func (h *HeadlessAuthenticationWatcher) WaitForUpdate(ctx context.Context, subsc
 			}
 		case <-ctx.Done():
 			return nil, trace.Wrap(ctx.Err())
-		case <-h.Done():
+		case <-s.Done():
 			return nil, ErrHeadlessAuthenticationWatcherClosed
 		}
 	}
 }
+
+// Done returns a channel that's closed when the subscriber is closed.
+func (s *headlessAuthenticationSubscriber) Done() <-chan struct{} {
+	return s.closed
+}
+
+// Close closes the subscriber and its channels. This frees up resources for the watcher
+// and should always be called on completion.
+func (s *headlessAuthenticationSubscriber) Close() {
+	s.updatesMu.Lock()
+	defer s.updatesMu.Unlock()
+
+	select {
+	case <-s.closed:
+	default:
+		close(s.closed)
+		close(s.updates)
+	}
+}
+
+func (s *headlessAuthenticationSubscriber) update(ha *types.HeadlessAuthentication) {
+	s.updatesMu.Lock()
+	defer s.updatesMu.Unlock()
+
+	// Drain stale update if there is one.
+	select {
+	case _, ok := <-s.updates:
+		if !ok {
+			// updates channel is closed, subscriber is closing.
+			return
+		}
+	default:
+	}
+
+	s.updates <- apiutils.CloneProtoMsg(ha)
+}
diff --git a/lib/services/local/headlessauthn_watcher_test.go b/lib/services/local/headlessauthn_watcher_test.go
index a44a7a8c23297..bb59d2335946c 100644
--- a/lib/services/local/headlessauthn_watcher_test.go
+++ b/lib/services/local/headlessauthn_watcher_test.go
@@ -63,37 +63,37 @@ func newHeadlessAuthenticationWatcherTestEnv(t *testing.T, clock clockwork.Clock
 func TestHeadlessAuthenticationWatcher_Subscribe(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
+
 	pubUUID := services.NewHeadlessAuthenticationID([]byte(sshPubKey))
+	username := "username"
+
+	newHeadlessAuthn := func(t *testing.T, s *headlessAuthenticationWatcherTestEnv) *types.HeadlessAuthentication {
+		headlessAuthn, err := types.NewHeadlessAuthentication(username, pubUUID, s.watcher.Clock.Now().Add(time.Minute))
+		require.NoError(t, err)
+		headlessAuthn.User = username
+		return headlessAuthn
+	}
 
 	t.Run("Updates", func(t *testing.T) {
 		t.Parallel()
 		s := newHeadlessAuthenticationWatcherTestEnv(t, clockwork.NewFakeClock())
+		headlessAuthn := newHeadlessAuthn(t, s)
 
-		sub, err := s.watcher.Subscribe(ctx, pubUUID)
+		sub, err := s.watcher.Subscribe(ctx, username, pubUUID)
 		require.NoError(t, err)
 		t.Cleanup(sub.Close)
 
-		// Make an update. Make sure we are servicing the updates channel first.
-		readyForUpdate := make(chan struct{})
-		stubC := make(chan *types.HeadlessAuthentication, 1)
-		go func() {
-			<-readyForUpdate
-			stub, err := s.identity.CreateHeadlessAuthenticationStub(ctx, pubUUID)
-			assert.NoError(t, err)
-			stubC <- stub
-		}()
+		err = s.identity.UpsertHeadlessAuthentication(ctx, headlessAuthn)
+		assert.NoError(t, err)
 
 		for {
 			select {
 			case update := <-sub.Updates():
 				// We should receive the update.
-				require.Equal(t, <-stubC, update)
+				require.Equal(t, headlessAuthn, update)
 				return
-			case <-sub.Stale():
-				t.Fatal("Expected subscriber to not be marked as stale")
 			case <-time.After(time.Second):
 				t.Fatal("Expected subscriber to receive an update")
-			case readyForUpdate <- struct{}{}:
 			}
 		}
 	})
@@ -101,26 +101,50 @@ func TestHeadlessAuthenticationWatcher_Subscribe(t *testing.T) {
 	t.Run("Stale", func(t *testing.T) {
 		t.Parallel()
 		s := newHeadlessAuthenticationWatcherTestEnv(t, clockwork.NewFakeClock())
+		headlessAuthn := newHeadlessAuthn(t, s)
 
-		sub, err := s.watcher.Subscribe(ctx, pubUUID)
+		sub, err := s.watcher.Subscribe(ctx, username, pubUUID)
 		require.NoError(t, err)
 		t.Cleanup(sub.Close)
 
-		// Make an 2 updates without servicing the subscriber's Updates channel.
-		// The second update will be dropped and result in the subscriber being
-		// marked as stale.
-		stub, err := s.identity.CreateHeadlessAuthenticationStub(ctx, pubUUID)
+		// Create a second subscriber to wait for the update below. Since this
+		// subscriber was created second, it should receive the update second.
+		drain, err := s.watcher.Subscribe(ctx, username, pubUUID)
+		require.NoError(t, err)
+		t.Cleanup(drain.Close)
+
+		// Create 2 updates without servicing the subscriber's Updates channel.
+		// The backend update should be dropped in favor of the second update.
+		err = s.identity.UpsertHeadlessAuthentication(ctx, headlessAuthn)
 		require.NoError(t, err)
-		replace := *stub
-		replace.User = "user"
+
+		replace := *headlessAuthn
 		replace.PublicKey = []byte(sshPubKey)
-		_, err = s.identity.CompareAndSwapHeadlessAuthentication(ctx, stub, &replace)
+		replace.State = types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED
+		swapped, err := s.identity.CompareAndSwapHeadlessAuthentication(ctx, headlessAuthn, &replace)
 		require.NoError(t, err)
 
+		// Drain updates and wait for the second update. Depending on the speed
+		// of the watcher above, we may see one or both updates.
+	DRAIN:
+		for {
+			select {
+			case update := <-drain.Updates():
+				if assert.ObjectsAreEqual(swapped, update) {
+					break DRAIN
+				}
+			case <-time.After(time.Second):
+				t.Fatal("Expected subscriber to receive an update")
+			}
+		}
+
 		select {
-		case <-sub.Stale():
-		case <-time.After(time.Second):
-			t.Fatal("Expected subscriber to be marked as stale")
+		case update := <-sub.Updates():
+			// The first update should be replaced by the second.
+			require.Equal(t, swapped, update)
+			return
+		default:
+			t.Fatal("Expected subscriber to receive an update")
 		}
 	})
 
@@ -128,8 +152,9 @@ func TestHeadlessAuthenticationWatcher_Subscribe(t *testing.T) {
 		t.Parallel()
 		clock := clockwork.NewFakeClock()
 		s := newHeadlessAuthenticationWatcherTestEnv(t, clock)
+		headlessAuthn := newHeadlessAuthn(t, s)
 
-		sub, err := s.watcher.Subscribe(ctx, pubUUID)
+		sub, err := s.watcher.Subscribe(ctx, username, pubUUID)
 		require.NoError(t, err)
 		t.Cleanup(sub.Close)
 
@@ -137,8 +162,8 @@ func TestHeadlessAuthenticationWatcher_Subscribe(t *testing.T) {
 		s.identity.Backend.CloseWatchers()
 		clock.BlockUntil(1)
 
-		stub, err := s.identity.CreateHeadlessAuthenticationStub(ctx, pubUUID)
-		assert.NoError(t, err)
+		err = s.identity.UpsertHeadlessAuthentication(ctx, headlessAuthn)
+		require.NoError(t, err)
 
 		// Reset the watcher. Make sure we are servicing the updates channel first.
 		readyForUpdate := make(chan struct{})
@@ -151,10 +176,8 @@ func TestHeadlessAuthenticationWatcher_Subscribe(t *testing.T) {
 		select {
 		case update := <-sub.Updates():
 			// We should receive an update of the current backend state on watcher reset.
-			require.Equal(t, stub, update)
+			require.Equal(t, headlessAuthn, update)
 			return
-		case <-sub.Stale():
-			t.Fatal("Expected subscriber to not be marked as stale")
 		case <-time.After(time.Second):
 			t.Fatal("Expected subscriber to receive an update")
 		}
@@ -164,13 +187,36 @@ func TestHeadlessAuthenticationWatcher_Subscribe(t *testing.T) {
 func TestHeadlessAuthenticationWatcher_WaitForUpdate(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
+
 	pubUUID := services.NewHeadlessAuthenticationID([]byte(sshPubKey))
+	username := "username"
+
+	newHeadlessAuthn := func(t *testing.T, s *headlessAuthenticationWatcherTestEnv) *types.HeadlessAuthentication {
+		headlessAuthn, err := types.NewHeadlessAuthentication(username, pubUUID, s.watcher.Clock.Now().Add(time.Minute))
+		require.NoError(t, err)
+		headlessAuthn.User = username
+		return headlessAuthn
+	}
+
+	deniedErr := errors.New("headless authentication denied")
+	conditionFunc := func(ha *types.HeadlessAuthentication) (bool, error) {
+		switch ha.State {
+		case types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_PENDING:
+			return false, nil
+		case types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED:
+			return true, nil
+		case types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_DENIED:
+			return false, deniedErr
+		}
+		return false, nil
+	}
 
 	t.Run("ConditionMet", func(t *testing.T) {
 		t.Parallel()
 		s := newHeadlessAuthenticationWatcherTestEnv(t, clockwork.NewFakeClock())
+		headlessAuthn := newHeadlessAuthn(t, s)
 
-		sub, err := s.watcher.Subscribe(ctx, pubUUID)
+		sub, err := s.watcher.Subscribe(ctx, username, pubUUID)
 		require.NoError(t, err)
 		t.Cleanup(sub.Close)
 
@@ -180,108 +226,91 @@ func TestHeadlessAuthenticationWatcher_WaitForUpdate(t *testing.T) {
 		headlessAuthnCh := make(chan *types.HeadlessAuthentication, 1)
 		errC := make(chan error, 1)
 		go func() {
-			ha, err := s.watcher.WaitForUpdate(ctx, sub, func(ha *types.HeadlessAuthentication) (bool, error) {
-				return ha.User != "", nil
-			})
+			ha, err := sub.WaitForUpdate(ctx, conditionFunc)
 			headlessAuthnCh <- ha
 			errC <- err
 		}()
 
 		// Make an update that passes the condition.
-		stub, err := s.identity.CreateHeadlessAuthenticationStub(ctx, pubUUID)
-		require.NoError(t, err)
-
-		replace := *stub
-		replace.User = "user"
-		replace.PublicKey = []byte(sshPubKey)
-		_, err = s.identity.CompareAndSwapHeadlessAuthentication(ctx, stub, &replace)
+		headlessAuthn.State = types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED
+		err = s.identity.UpsertHeadlessAuthentication(ctx, headlessAuthn)
 		require.NoError(t, err)
 
 		require.NoError(t, <-errC)
-		require.Equal(t, &replace, <-headlessAuthnCh)
+		require.Equal(t, headlessAuthn, <-headlessAuthnCh)
 	})
 
 	t.Run("ConditionUnmet", func(t *testing.T) {
 		t.Parallel()
 		s := newHeadlessAuthenticationWatcherTestEnv(t, clockwork.NewFakeClock())
+		headlessAuthn := newHeadlessAuthn(t, s)
 
-		sub, err := s.watcher.Subscribe(ctx, pubUUID)
+		sub, err := s.watcher.Subscribe(ctx, username, pubUUID)
 		require.NoError(t, err)
 		t.Cleanup(sub.Close)
 
-		unknownUserErr := errors.New("Unknown user")
-		conditionFunc := func(ha *types.HeadlessAuthentication) (bool, error) {
-			if ha.User == "" {
-				return false, nil
-			} else if ha.User == "unknown" {
-				return false, unknownUserErr
-			}
-			return true, nil
-		}
-
-		// Make an update that doesn't pass the condition (user not set).
+		// Make an update that doesn't pass the condition (pending).
 		// The waiter should ignore this update and timeout.
-		stub, err := s.identity.CreateHeadlessAuthenticationStub(ctx, pubUUID)
+		err = s.identity.UpsertHeadlessAuthentication(ctx, headlessAuthn)
 		require.NoError(t, err)
 
-		ctx, cancel := context.WithTimeout(ctx, 100*time.Millisecond)
+		timeoutCtx, cancel := context.WithTimeout(ctx, 100*time.Millisecond)
 		t.Cleanup(cancel)
 
-		_, err = s.watcher.WaitForUpdate(ctx, sub, conditionFunc)
+		_, err = sub.WaitForUpdate(timeoutCtx, conditionFunc)
 		require.Error(t, err)
 		require.ErrorIs(t, err, context.DeadlineExceeded)
 
-		// Make an update that causes the condition to error (user "unknown").
+		// Make an update that causes the condition to error (denied).
 		// The waiter should return the condition error during the initial backend check.
-		replace := *stub
-		replace.User = "unknown"
-		replace.PublicKey = []byte(sshPubKey)
-		_, err = s.identity.CompareAndSwapHeadlessAuthentication(ctx, stub, &replace)
+		headlessAuthn.State = types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_DENIED
+		err = s.identity.UpsertHeadlessAuthentication(ctx, headlessAuthn)
 		require.NoError(t, err)
 
-		ctx, cancel = context.WithTimeout(ctx, 100*time.Millisecond)
+		waitCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
 		t.Cleanup(cancel)
 
-		_, err = s.watcher.WaitForUpdate(ctx, sub, conditionFunc)
+		_, err = sub.WaitForUpdate(waitCtx, conditionFunc)
 		require.Error(t, err)
-		require.ErrorIs(t, err, unknownUserErr)
+		require.ErrorIs(t, err, deniedErr)
 	})
 
 	t.Run("InitialBackendCheck", func(t *testing.T) {
 		t.Parallel()
 		s := newHeadlessAuthenticationWatcherTestEnv(t, clockwork.NewFakeClock())
+		headlessAuthn := newHeadlessAuthn(t, s)
 
-		stub, err := s.identity.CreateHeadlessAuthenticationStub(ctx, pubUUID)
+		// Create a headless authentication that passes the condition before starting WaitForUpdate.
+		headlessAuthn.State = types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_APPROVED
+		err := s.identity.UpsertHeadlessAuthentication(ctx, headlessAuthn)
 		require.NoError(t, err)
 
 		waitCtx, waitCancel := context.WithTimeout(ctx, 5*time.Second)
 		t.Cleanup(waitCancel)
 
-		sub, err := s.watcher.Subscribe(ctx, pubUUID)
+		sub, err := s.watcher.Subscribe(ctx, username, pubUUID)
 		require.NoError(t, err)
 		t.Cleanup(sub.Close)
 
-		// WaitForUpdate should immediately check the backend and return the existing headless authentication stub.
-		headlessAuthn, err := s.watcher.WaitForUpdate(waitCtx, sub, func(ha *types.HeadlessAuthentication) (bool, error) {
-			return true, nil
-		})
+		// WaitForUpdate should immediately check the backend and return the existing headless authentication.
+		headlessAuthnUpdate, err := sub.WaitForUpdate(waitCtx, conditionFunc)
 
 		require.NoError(t, err)
-		require.Equal(t, stub, headlessAuthn)
+		require.Equal(t, headlessAuthn, headlessAuthnUpdate)
 	})
 
 	t.Run("Timeout", func(t *testing.T) {
 		t.Parallel()
 		s := newHeadlessAuthenticationWatcherTestEnv(t, clockwork.NewFakeClock())
 
-		sub, err := s.watcher.Subscribe(ctx, pubUUID)
+		sub, err := s.watcher.Subscribe(ctx, username, pubUUID)
 		require.NoError(t, err)
 		t.Cleanup(sub.Close)
 
 		waitCtx, waitCancel := context.WithTimeout(ctx, 10*time.Millisecond)
 		t.Cleanup(waitCancel)
 
-		_, err = s.watcher.WaitForUpdate(waitCtx, sub, func(ha *types.HeadlessAuthentication) (bool, error) { return true, nil })
+		_, err = sub.WaitForUpdate(waitCtx, func(ha *types.HeadlessAuthentication) (bool, error) { return true, nil })
 		require.Error(t, err)
 		require.ErrorIs(t, err, context.DeadlineExceeded)
 	})
@@ -290,13 +319,13 @@ func TestHeadlessAuthenticationWatcher_WaitForUpdate(t *testing.T) {
 		t.Parallel()
 		s := newHeadlessAuthenticationWatcherTestEnv(t, clockwork.NewFakeClock())
 
-		sub, err := s.watcher.Subscribe(ctx, pubUUID)
+		sub, err := s.watcher.Subscribe(ctx, username, pubUUID)
 		require.NoError(t, err)
 		t.Cleanup(sub.Close)
 
 		errC := make(chan error)
 		go func() {
-			_, err := s.watcher.WaitForUpdate(ctx, sub, func(ha *types.HeadlessAuthentication) (bool, error) {
+			_, err := sub.WaitForUpdate(ctx, func(ha *types.HeadlessAuthentication) (bool, error) {
 				return true, nil
 			})
 			errC <- err
@@ -310,7 +339,7 @@ func TestHeadlessAuthenticationWatcher_WaitForUpdate(t *testing.T) {
 		require.ErrorIs(t, waitErr, local.ErrHeadlessAuthenticationWatcherClosed)
 
 		// New subscribers should be prevented.
-		_, err = s.watcher.Subscribe(ctx, pubUUID)
+		_, err = s.watcher.Subscribe(ctx, username, pubUUID)
 		require.Error(t, err)
 	})
 }
diff --git a/lib/services/local/plugins.go b/lib/services/local/plugins.go
index 20a166c090f9f..df44362d81f35 100644
--- a/lib/services/local/plugins.go
+++ b/lib/services/local/plugins.go
@@ -158,6 +158,22 @@ func (s *PluginsService) ListPlugins(ctx context.Context, limit int, startKey st
 	return plugins, nextKey, nil
 }
 
+// HasPluginType will return true if a plugin of the given type is registered.
+func (s *PluginsService) HasPluginType(ctx context.Context, pluginType types.PluginType) (bool, error) {
+	plugins, err := s.GetPlugins(ctx, false)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	for _, plugin := range plugins {
+		if plugin.GetType() == pluginType {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
 // SetPluginCredentials implements services.Plugins
 func (s *PluginsService) SetPluginCredentials(ctx context.Context, name string, creds types.PluginCredentials) error {
 	return s.updateAndSwap(ctx, name, func(p types.Plugin) error {
diff --git a/lib/services/local/plugins_test.go b/lib/services/local/plugins_test.go
index 09962a848fcb1..88d7ffc321d1c 100644
--- a/lib/services/local/plugins_test.go
+++ b/lib/services/local/plugins_test.go
@@ -109,6 +109,15 @@ func TestPluginsCRUD(t *testing.T) {
 	))
 	require.Empty(t, cmp.Diff(status, cluster.GetStatus()))
 
+	// Test if plugin types exist.
+	exists, err := service.HasPluginType(ctx, types.PluginTypeOkta)
+	require.NoError(t, err)
+	require.False(t, exists)
+
+	exists, err = service.HasPluginType(ctx, types.PluginTypeSlack)
+	require.NoError(t, err)
+	require.True(t, exists)
+
 	// Delete a plugin.
 	err = service.DeletePlugin(ctx, plugin1.GetName())
 	require.NoError(t, err)
diff --git a/lib/services/local/presence.go b/lib/services/local/presence.go
index 93bf7f7c557c7..da37f8f95270f 100644
--- a/lib/services/local/presence.go
+++ b/lib/services/local/presence.go
@@ -317,6 +317,20 @@ func (s *PresenceService) GetNodes(ctx context.Context, namespace string) ([]typ
 	return servers, nil
 }
 
+// GetNodeStream returns a stream of nodes in a namespace.
+func (s *PresenceService) GetNodeStream(ctx context.Context, namespace string) stream.Stream[types.Server] {
+	startKey := backend.ExactKey(nodesPrefix, namespace)
+	items := backend.StreamRange(ctx, s, startKey, backend.RangeEnd(startKey), 50)
+	return stream.FilterMap(items, func(item backend.Item) (types.Server, bool) {
+		embedding, err := services.UnmarshalServer(item.Value, types.KindNode)
+		if err != nil {
+			s.log.Warnf("Skipping node at %s, failed to unmarshal: %v", item.Key, err)
+			return nil, false
+		}
+		return embedding, true
+	})
+}
+
 // UpsertNode registers node presence, permanently if TTL is 0 or for the
 // specified duration with second resolution if it's >= 1 second.
 func (s *PresenceService) UpsertNode(ctx context.Context, server types.Server) (*types.KeepAlive, error) {
@@ -357,8 +371,8 @@ func (s *PresenceService) GetAuthServers() ([]types.Server, error) {
 
 // UpsertAuthServer registers auth server presence, permanently if ttl is 0 or
 // for the specified duration with second resolution if it's >= 1 second
-func (s *PresenceService) UpsertAuthServer(server types.Server) error {
-	return s.upsertServer(context.TODO(), authServersPrefix, server)
+func (s *PresenceService) UpsertAuthServer(ctx context.Context, server types.Server) error {
+	return s.upsertServer(ctx, authServersPrefix, server)
 }
 
 // DeleteAllAuthServers deletes all auth servers
@@ -375,8 +389,8 @@ func (s *PresenceService) DeleteAuthServer(name string) error {
 
 // UpsertProxy registers proxy server presence, permanently if ttl is 0 or
 // for the specified duration with second resolution if it's >= 1 second
-func (s *PresenceService) UpsertProxy(server types.Server) error {
-	return s.upsertServer(context.TODO(), proxiesPrefix, server)
+func (s *PresenceService) UpsertProxy(ctx context.Context, server types.Server) error {
+	return s.upsertServer(ctx, proxiesPrefix, server)
 }
 
 // GetProxies returns a list of registered proxies
@@ -391,9 +405,9 @@ func (s *PresenceService) DeleteAllProxies() error {
 }
 
 // DeleteProxy deletes proxy
-func (s *PresenceService) DeleteProxy(name string) error {
+func (s *PresenceService) DeleteProxy(ctx context.Context, name string) error {
 	key := backend.Key(proxiesPrefix, name)
-	return s.Delete(context.TODO(), key)
+	return s.Delete(ctx, key)
 }
 
 // DeleteAllReverseTunnels deletes all reverse tunnels
diff --git a/lib/services/local/presence_test.go b/lib/services/local/presence_test.go
index 26aabe19a5ac2..bbde4e378e24c 100644
--- a/lib/services/local/presence_test.go
+++ b/lib/services/local/presence_test.go
@@ -886,6 +886,7 @@ func TestListResources_Helpers(t *testing.T) {
 		req := proto.ListResourcesRequest{
 			ResourceType: types.KindNode,
 			Namespace:    namespace,
+			Limit:        -1,
 		}
 		for _, tc := range tests {
 			tc := tc
diff --git a/lib/services/local/sessiontracker.go b/lib/services/local/sessiontracker.go
index c2165eb8a2ff1..07fbe6f6e71aa 100644
--- a/lib/services/local/sessiontracker.go
+++ b/lib/services/local/sessiontracker.go
@@ -72,7 +72,7 @@ func (s *sessionTracker) UpdatePresence(ctx context.Context, sessionID, user str
 			return trace.Wrap(err)
 		}
 
-		err = session.UpdatePresence(user)
+		err = session.UpdatePresence(user, s.bk.Clock().Now().UTC())
 		if err != nil {
 			return trace.Wrap(err)
 		}
diff --git a/lib/services/local/usergroup_test.go b/lib/services/local/usergroup_test.go
index 816a43d1d4459..f3f26a5c244fa 100644
--- a/lib/services/local/usergroup_test.go
+++ b/lib/services/local/usergroup_test.go
@@ -47,14 +47,12 @@ func TestUserGroupCRUD(t *testing.T) {
 	g1, err := types.NewUserGroup(
 		types.Metadata{
 			Name: "g1",
-		},
-	)
+		}, types.UserGroupSpecV1{})
 	require.NoError(t, err)
 	g2, err := types.NewUserGroup(
 		types.Metadata{
 			Name: "g2",
-		},
-	)
+		}, types.UserGroupSpecV1{})
 	require.NoError(t, err)
 
 	// Initially we expect no user groups.
diff --git a/lib/services/local/userpreferences.go b/lib/services/local/userpreferences.go
new file mode 100644
index 0000000000000..98badee39a828
--- /dev/null
+++ b/lib/services/local/userpreferences.go
@@ -0,0 +1,177 @@
+/*
+ *
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package local
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/gravitational/trace"
+
+	userpreferencesv1 "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1"
+	"github.com/gravitational/teleport/lib/backend"
+)
+
+// UserPreferencesService is responsible for managing a user's preferences.
+type UserPreferencesService struct {
+	backend.Backend
+}
+
+func DefaultUserPreferences() *userpreferencesv1.UserPreferences {
+	return &userpreferencesv1.UserPreferences{
+		Assist: &userpreferencesv1.AssistUserPreferences{
+			PreferredLogins: nil,
+			ViewMode:        userpreferencesv1.AssistViewMode_ASSIST_VIEW_MODE_DOCKED,
+		},
+		Theme: userpreferencesv1.Theme_THEME_LIGHT,
+		Onboard: &userpreferencesv1.OnboardUserPreferences{
+			PreferredResources: nil,
+		},
+	}
+}
+
+// NewUserPreferencesService returns a new instance of the UserPreferencesService.
+func NewUserPreferencesService(backend backend.Backend) *UserPreferencesService {
+	return &UserPreferencesService{
+		Backend: backend,
+	}
+}
+
+// GetUserPreferences returns the user preferences for the given user.
+func (u *UserPreferencesService) GetUserPreferences(ctx context.Context, req *userpreferencesv1.GetUserPreferencesRequest) (*userpreferencesv1.GetUserPreferencesResponse, error) {
+	preferences, err := u.getUserPreferences(ctx, req.Username)
+	if err != nil {
+		if trace.IsNotFound(err) {
+			return &userpreferencesv1.GetUserPreferencesResponse{Preferences: DefaultUserPreferences()}, nil
+		}
+
+		return nil, trace.Wrap(err)
+	}
+
+	return &userpreferencesv1.GetUserPreferencesResponse{Preferences: preferences}, nil
+}
+
+// UpsertUserPreferences creates or updates user preferences for a given username.
+func (u *UserPreferencesService) UpsertUserPreferences(ctx context.Context, req *userpreferencesv1.UpsertUserPreferencesRequest) error {
+	if req.Username == "" {
+		return trace.BadParameter("missing username")
+	}
+	if err := validatePreferences(req.Preferences); err != nil {
+		return trace.Wrap(err)
+	}
+
+	preferences, err := u.getUserPreferences(ctx, req.Username)
+	if err != nil {
+		if !trace.IsNotFound(err) {
+			return trace.Wrap(err)
+		}
+		preferences = DefaultUserPreferences()
+	}
+
+	mergePreferences(preferences, req.Preferences)
+
+	item, err := createBackendItem(req.Username, preferences)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	_, err = u.Put(ctx, item)
+
+	return trace.Wrap(err)
+}
+
+// getUserPreferences returns the user preferences for the given username.
+func (u *UserPreferencesService) getUserPreferences(ctx context.Context, username string) (*userpreferencesv1.UserPreferences, error) {
+	existing, err := u.Get(ctx, backendKey(username))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var p userpreferencesv1.UserPreferences
+	if err := json.Unmarshal(existing.Value, &p); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &p, nil
+}
+
+// backendKey returns the backend key for the user preferences for the given username.
+func backendKey(username string) []byte {
+	return backend.Key(userPreferencesPrefix, username)
+}
+
+// validatePreferences validates the given preferences.
+func validatePreferences(preferences *userpreferencesv1.UserPreferences) error {
+	if preferences == nil {
+		return trace.BadParameter("missing preferences")
+	}
+
+	return nil
+}
+
+// createBackendItem creates a backend.Item for the given username and user preferences.
+func createBackendItem(username string, preferences *userpreferencesv1.UserPreferences) (backend.Item, error) {
+	settingsKey := backend.Key(userPreferencesPrefix, username)
+
+	payload, err := json.Marshal(preferences)
+	if err != nil {
+		return backend.Item{}, trace.Wrap(err)
+	}
+
+	item := backend.Item{
+		Key:   settingsKey,
+		Value: payload,
+	}
+
+	return item, nil
+}
+
+// mergePreferences merges the values from src into dest.
+func mergePreferences(dest, src *userpreferencesv1.UserPreferences) {
+	if src.Theme != userpreferencesv1.Theme_THEME_UNSPECIFIED {
+		dest.Theme = src.Theme
+	}
+
+	if src.Assist != nil {
+		mergeAssistUserPreferences(dest.Assist, src.Assist)
+	}
+
+	if src.Onboard != nil {
+		mergeOnboardUserPreferences(dest.Onboard, src.Onboard)
+	}
+
+}
+
+// mergeAssistUserPreferences merges src preferences into the given dest assist user preferences.
+func mergeAssistUserPreferences(dest, src *userpreferencesv1.AssistUserPreferences) {
+	if src.PreferredLogins != nil {
+		dest.PreferredLogins = src.PreferredLogins
+	}
+
+	if src.ViewMode != userpreferencesv1.AssistViewMode_ASSIST_VIEW_MODE_UNSPECIFIED {
+		dest.ViewMode = src.ViewMode
+	}
+}
+
+// mergeOnboardUserPreferences merges src preferences into the given dest onboard user preferences.
+func mergeOnboardUserPreferences(dest, src *userpreferencesv1.OnboardUserPreferences) {
+	if src.PreferredResources != nil {
+		dest.PreferredResources = src.PreferredResources
+	}
+}
diff --git a/lib/services/local/userpreferences_test.go b/lib/services/local/userpreferences_test.go
new file mode 100644
index 0000000000000..29057fd9dbf5e
--- /dev/null
+++ b/lib/services/local/userpreferences_test.go
@@ -0,0 +1,177 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package local_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+
+	userpreferencesv1 "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1"
+	"github.com/gravitational/teleport/lib/backend/memory"
+	"github.com/gravitational/teleport/lib/services/local"
+)
+
+func newUserPreferencesService(t *testing.T) *local.UserPreferencesService {
+	t.Helper()
+	backend, err := memory.New(memory.Config{
+		Context: context.Background(),
+		Clock:   clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+	return local.NewUserPreferencesService(backend)
+}
+
+func TestUserPreferencesCRUD2(t *testing.T) {
+	ctx := context.Background()
+	defaultPref := local.DefaultUserPreferences()
+	username := "something"
+
+	tests := []struct {
+		name     string
+		req      *userpreferencesv1.UpsertUserPreferencesRequest
+		expected *userpreferencesv1.UserPreferences
+	}{
+		{
+			name:     "no existing preferences returns the default preferences",
+			req:      nil,
+			expected: defaultPref,
+		},
+		{
+			name: "update the theme preference only",
+			req: &userpreferencesv1.UpsertUserPreferencesRequest{
+				Username: username,
+				Preferences: &userpreferencesv1.UserPreferences{
+					Theme: userpreferencesv1.Theme_THEME_DARK,
+				},
+			},
+			expected: &userpreferencesv1.UserPreferences{
+				Assist:  defaultPref.Assist,
+				Onboard: defaultPref.Onboard,
+				Theme:   userpreferencesv1.Theme_THEME_DARK,
+			},
+		},
+		{
+			name: "update the assist preferred logins only",
+			req: &userpreferencesv1.UpsertUserPreferencesRequest{
+				Username: username,
+				Preferences: &userpreferencesv1.UserPreferences{
+					Assist: &userpreferencesv1.AssistUserPreferences{
+						PreferredLogins: []string{"foo", "bar"},
+					},
+				},
+			},
+			expected: &userpreferencesv1.UserPreferences{
+				Theme:   defaultPref.Theme,
+				Onboard: defaultPref.Onboard,
+				Assist: &userpreferencesv1.AssistUserPreferences{
+					PreferredLogins: []string{"foo", "bar"},
+					ViewMode:        defaultPref.Assist.ViewMode,
+				},
+			},
+		},
+		{
+			name: "update the assist view mode only",
+			req: &userpreferencesv1.UpsertUserPreferencesRequest{
+				Username: username,
+				Preferences: &userpreferencesv1.UserPreferences{
+					Assist: &userpreferencesv1.AssistUserPreferences{
+						ViewMode: userpreferencesv1.AssistViewMode_ASSIST_VIEW_MODE_POPUP_EXPANDED_SIDEBAR_VISIBLE,
+					},
+				},
+			},
+			expected: &userpreferencesv1.UserPreferences{
+				Theme:   defaultPref.Theme,
+				Onboard: defaultPref.Onboard,
+				Assist: &userpreferencesv1.AssistUserPreferences{
+					PreferredLogins: defaultPref.Assist.PreferredLogins,
+					ViewMode:        userpreferencesv1.AssistViewMode_ASSIST_VIEW_MODE_POPUP_EXPANDED_SIDEBAR_VISIBLE,
+				},
+			},
+		},
+		{
+			name: "update the onboard preference only",
+			req: &userpreferencesv1.UpsertUserPreferencesRequest{
+				Username: username,
+				Preferences: &userpreferencesv1.UserPreferences{
+					Onboard: &userpreferencesv1.OnboardUserPreferences{
+						PreferredResources: []userpreferencesv1.Resource{userpreferencesv1.Resource_RESOURCE_DATABASES},
+					},
+				},
+			},
+			expected: &userpreferencesv1.UserPreferences{
+				Assist: defaultPref.Assist,
+				Theme:  defaultPref.Theme,
+				Onboard: &userpreferencesv1.OnboardUserPreferences{
+					PreferredResources: []userpreferencesv1.Resource{userpreferencesv1.Resource_RESOURCE_DATABASES},
+				},
+			},
+		},
+		{
+			name: "update all the settings at once",
+			req: &userpreferencesv1.UpsertUserPreferencesRequest{
+				Username: username,
+				Preferences: &userpreferencesv1.UserPreferences{
+					Theme: userpreferencesv1.Theme_THEME_LIGHT,
+					Assist: &userpreferencesv1.AssistUserPreferences{
+						PreferredLogins: []string{"baz"},
+						ViewMode:        userpreferencesv1.AssistViewMode_ASSIST_VIEW_MODE_POPUP,
+					},
+					Onboard: &userpreferencesv1.OnboardUserPreferences{
+						PreferredResources: []userpreferencesv1.Resource{userpreferencesv1.Resource_RESOURCE_KUBERNETES},
+					},
+				},
+			},
+			expected: &userpreferencesv1.UserPreferences{
+				Theme: userpreferencesv1.Theme_THEME_LIGHT,
+				Assist: &userpreferencesv1.AssistUserPreferences{
+					PreferredLogins: []string{"baz"},
+					ViewMode:        userpreferencesv1.AssistViewMode_ASSIST_VIEW_MODE_POPUP,
+				},
+				Onboard: &userpreferencesv1.OnboardUserPreferences{
+					PreferredResources: []userpreferencesv1.Resource{userpreferencesv1.Resource_RESOURCE_KUBERNETES},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			identity := newUserPreferencesService(t)
+
+			res, err := identity.GetUserPreferences(ctx, &userpreferencesv1.GetUserPreferencesRequest{
+				Username: username,
+			})
+			require.NoError(t, err)
+			require.Equal(t, defaultPref, res.Preferences)
+
+			if test.req != nil {
+				err := identity.UpsertUserPreferences(ctx, test.req)
+				require.NoError(t, err)
+			}
+
+			res, err = identity.GetUserPreferences(ctx, &userpreferencesv1.GetUserPreferencesRequest{
+				Username: username,
+			})
+
+			require.NoError(t, err)
+			require.Equal(t, test.expected, res.Preferences)
+		})
+	}
+}
diff --git a/lib/services/local/users.go b/lib/services/local/users.go
index 3438fae309d4b..152e783feb4d9 100644
--- a/lib/services/local/users.go
+++ b/lib/services/local/users.go
@@ -1540,4 +1540,5 @@ const (
 	attestationsPrefix          = "key_attestations"
 	assistantMessagePrefix      = "assistant_messages"
 	assistantConversationPrefix = "assistant_conversations"
+	userPreferencesPrefix       = "user_preferences"
 )
diff --git a/lib/services/matchers.go b/lib/services/matchers.go
index 449884c6ffae7..ce5122fc6384f 100644
--- a/lib/services/matchers.go
+++ b/lib/services/matchers.go
@@ -30,6 +30,17 @@ import (
 type ResourceMatcher struct {
 	// Labels match resource labels.
 	Labels types.Labels
+	// AWS contains AWS specific settings.
+	AWS ResourceMatcherAWS
+}
+
+// ResourceMatcherAWS contains AWS specific settings.
+type ResourceMatcherAWS struct {
+	// AssumeRoleARN is the AWS role to assume for accessing the resource.
+	AssumeRoleARN string
+	// ExternalID is an optional AWS external ID used to enable assuming an AWS
+	// role across accounts.
+	ExternalID string
 }
 
 // ResourceMatchersToTypes converts []]services.ResourceMatchers into []*types.ResourceMatcher
@@ -39,110 +50,29 @@ func ResourceMatchersToTypes(in []ResourceMatcher) []*types.DatabaseResourceMatc
 		resMatcher := resMatcher
 		out[i] = &types.DatabaseResourceMatcher{
 			Labels: &resMatcher.Labels,
+			AWS: types.ResourceMatcherAWS{
+				AssumeRoleARN: resMatcher.AWS.AssumeRoleARN,
+				ExternalID:    resMatcher.AWS.ExternalID,
+			},
 		}
 	}
 	return out
 }
 
-// AWSSSM provides options to use when executing SSM documents
-type AWSSSM struct {
-	// DocumentName is the name of the document to use when executing an
-	// SSM command
-	DocumentName string
-}
-
-// InstallerParams are passed to the AWS SSM document or installation script
-type InstallerParams struct {
-	// JoinMethod is the method to use when joining the cluster
-	JoinMethod types.JoinMethod
-	// JoinToken is the token to use when joining the cluster
-	JoinToken string
-	// ScriptName is the name of the teleport script for the cloud
-	// instance to execute
-	ScriptName string
-	// InstallTeleport disables agentless discovery
-	InstallTeleport bool
-	// SSHDConfig provides the path to write sshd configuration changes
-	SSHDConfig string
-	// PublicProxyAddr is the address of the proxy the discovered node should use
-	// to connect to the cluster. Used only in Azure.
-	PublicProxyAddr string
-}
-
-// AssumeRole provides a role ARN and ExternalID to assume an AWS role
-// when interacting with AWS resources.
-type AssumeRole struct {
-	// RoleARN is the fully specified AWS IAM role ARN.
-	RoleARN string
-	// ExternalID is the external ID used to assume a role in another account.
-	ExternalID string
-}
-
-// IsEmpty is a helper function that returns whether the assume role info
-// is empty.
-func (a *AssumeRole) IsEmpty() bool {
-	return a.RoleARN == "" && a.ExternalID == ""
-}
-
 // AssumeRoleFromAWSMetadata is a conversion helper function that extracts
 // AWS IAM role ARN and external ID from AWS metadata.
-func AssumeRoleFromAWSMetadata(meta *types.AWS) AssumeRole {
-	return AssumeRole{
+func AssumeRoleFromAWSMetadata(meta *types.AWS) types.AssumeRole {
+	return types.AssumeRole{
 		RoleARN:    meta.AssumeRoleARN,
 		ExternalID: meta.ExternalID,
 	}
 }
 
-// AWSMatcher matches AWS databases.
-type AWSMatcher struct {
-	// Types are AWS database types to match, "rds" or "redshift".
-	Types []string
-	// Regions are AWS regions to query for databases.
-	Regions []string
-	// AssumeRole is the AWS role to assume when discovering AWS databases.
-	AssumeRole AssumeRole
-	// Tags are AWS tags to match.
-	Tags types.Labels
-	// Params are passed to AWS when executing the SSM document
-	Params InstallerParams
-	// SSM provides options to use when sending a document command to
-	// an EC2 node
-	SSM *AWSSSM
-}
-
-// AzureMatcher matches Azure databases.
-type AzureMatcher struct {
-	// Subscriptions are Azure subscriptions to query for resources.
-	Subscriptions []string
-	// ResourceGroups are Azure resource groups to query for resources.
-	ResourceGroups []string
-	// Types are Azure resource types to match, for example "mysql" or "postgres".
-	Types []string
-	// Regions are Azure regions to query for resources.
-	Regions []string
-	// ResourceTags are Azure tags to match.
-	ResourceTags types.Labels
-	// Params are passed to Azure when installing.
-	Params InstallerParams
-}
-
-// GCPMatcher matches GCP resources.
-type GCPMatcher struct {
-	// Types are GKE resource types to match: "gke".
-	Types []string `yaml:"types,omitempty"`
-	// Locations are GCP locations to search resources for.
-	Locations []string `yaml:"locations,omitempty"`
-	// Tags are GCP labels to match.
-	Tags types.Labels `yaml:"tags,omitempty"`
-	// ProjectIDs are the GCP project IDs where the resources are deployed.
-	ProjectIDs []string `yaml:"project_ids,omitempty"`
-}
-
 // SimplifyAzureMatchers returns simplified Azure Matchers.
 // Selectors are deduplicated, wildcard in a selector reduces the selector
 // to just the wildcard, and defaults are applied.
-func SimplifyAzureMatchers(matchers []AzureMatcher) []AzureMatcher {
-	result := make([]AzureMatcher, 0, len(matchers))
+func SimplifyAzureMatchers(matchers []types.AzureMatcher) []types.AzureMatcher {
+	result := make([]types.AzureMatcher, 0, len(matchers))
 	for _, m := range matchers {
 		subs := apiutils.Deduplicate(m.Subscriptions)
 		groups := apiutils.Deduplicate(m.ResourceGroups)
@@ -161,7 +91,7 @@ func SimplifyAzureMatchers(matchers []AzureMatcher) []AzureMatcher {
 				regions[i] = azureutils.NormalizeLocation(region)
 			}
 		}
-		result = append(result, AzureMatcher{
+		result = append(result, types.AzureMatcher{
 			Subscriptions:  subs,
 			ResourceGroups: groups,
 			Regions:        regions,
@@ -355,6 +285,8 @@ const (
 	AWSMatcherElastiCache = "elasticache"
 	// AWSMatcherMemoryDB is the AWS matcher type for MemoryDB databases.
 	AWSMatcherMemoryDB = "memorydb"
+	// AWSMatcherOpenSearch is the AWS matcher type for OpenSearch databases.
+	AWSMatcherOpenSearch = "opensearch"
 )
 
 // SupportedAWSMatchers is list of AWS services currently supported by the
@@ -373,6 +305,7 @@ var SupportedAWSDatabaseMatchers = []string{
 	AWSMatcherRedshiftServerless,
 	AWSMatcherElastiCache,
 	AWSMatcherMemoryDB,
+	AWSMatcherOpenSearch,
 }
 
 // RequireAWSIAMRolesAsUsersMatchers is a list of the AWS databases that
diff --git a/lib/services/plugins.go b/lib/services/plugins.go
index 21c227180fd66..96a8febe89f59 100644
--- a/lib/services/plugins.go
+++ b/lib/services/plugins.go
@@ -35,6 +35,7 @@ type Plugins interface {
 	GetPlugin(ctx context.Context, name string, withSecrets bool) (types.Plugin, error)
 	GetPlugins(ctx context.Context, withSecrets bool) ([]types.Plugin, error)
 	ListPlugins(ctx context.Context, limit int, startKey string, withSecrets bool) ([]types.Plugin, string, error)
+	HasPluginType(ctx context.Context, pluginType types.PluginType) (bool, error)
 	SetPluginCredentials(ctx context.Context, name string, creds types.PluginCredentials) error
 	SetPluginStatus(ctx context.Context, name string, creds types.PluginStatus) error
 }
diff --git a/lib/services/presence.go b/lib/services/presence.go
index 691524653a394..bb27dc4f9fa48 100644
--- a/lib/services/presence.go
+++ b/lib/services/presence.go
@@ -36,6 +36,12 @@ type NodesGetter interface {
 	GetNodes(ctx context.Context, namespace string) ([]types.Server, error)
 }
 
+// NodesStreamGetter is a service that gets nodes.
+type NodesStreamGetter interface {
+	// GetNodeStream returns a list of registered servers.
+	GetNodeStream(ctx context.Context, namespace string) stream.Stream[types.Server]
+}
+
 // Presence records and reports the presence of all components
 // of the cluster - Nodes, Proxies and SSH nodes
 type Presence interface {
@@ -52,6 +58,9 @@ type Presence interface {
 	// NodesGetter gets nodes
 	NodesGetter
 
+	// NodesStreamGetter gets nodes as a stream
+	NodesStreamGetter
+
 	// DeleteAllNodes deletes all nodes in a namespace.
 	DeleteAllNodes(ctx context.Context, namespace string) error
 
@@ -67,7 +76,7 @@ type Presence interface {
 
 	// UpsertAuthServer registers auth server presence, permanently if ttl is 0 or
 	// for the specified duration with second resolution if it's >= 1 second
-	UpsertAuthServer(server types.Server) error
+	UpsertAuthServer(ctx context.Context, server types.Server) error
 
 	// DeleteAuthServer deletes auth server by name
 	DeleteAuthServer(name string) error
@@ -77,13 +86,13 @@ type Presence interface {
 
 	// UpsertProxy registers proxy server presence, permanently if ttl is 0 or
 	// for the specified duration with second resolution if it's >= 1 second
-	UpsertProxy(server types.Server) error
+	UpsertProxy(ctx context.Context, server types.Server) error
 
 	// ProxyGetter gets a list of proxies
 	ProxyGetter
 
 	// DeleteProxy deletes proxy by name
-	DeleteProxy(name string) error
+	DeleteProxy(ctx context.Context, name string) error
 
 	// DeleteAllProxies deletes all proxies
 	DeleteAllProxies() error
diff --git a/lib/services/presets.go b/lib/services/presets.go
index 49d20f269c979..d430fbe45ac18 100644
--- a/lib/services/presets.go
+++ b/lib/services/presets.go
@@ -29,17 +29,86 @@ import (
 	"github.com/gravitational/teleport/lib/modules"
 )
 
+// NewSystemAutomaticAccessApproverRole creates a new Role that is allowed to
+// approve any Access Request. This is restricted to Teleport Enterprise, and
+// returns nil in non-Enterproise builds.
+func NewSystemAutomaticAccessApproverRole() types.Role {
+	enterprise := modules.GetModules().BuildType() == modules.BuildEnterprise
+	if !enterprise {
+		return nil
+	}
+	role := &types.RoleV6{
+		Kind:    types.KindRole,
+		Version: types.V7,
+		Metadata: types.Metadata{
+			Name:        teleport.SystemAutomaticAccessApprovalRoleName,
+			Namespace:   apidefaults.Namespace,
+			Description: "Approves any access request",
+			Labels: map[string]string{
+				types.TeleportInternalResourceType: types.SystemResource,
+				types.TeleportResourceRevision:     "1",
+			},
+		},
+		Spec: types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				ReviewRequests: &types.AccessReviewConditions{
+					Roles: []string{"*"},
+				},
+			},
+		},
+	}
+	role.CheckAndSetDefaults()
+	return role
+}
+
+// NewSystemAutomaticAccessBotUser returns a new User that has (via the
+// the `PresetAutomaticAccessApprovalRoleName` role) the right to automatically
+// approve any access requests.
+//
+// This user must not:
+//   - Be allowed to log into the cluster
+//   - Show up in user lists in WebUI
+//
+// TODO(tcsc): Implement/enforce above restrictions on this user
+func NewSystemAutomaticAccessBotUser() types.User {
+	enterprise := modules.GetModules().BuildType() == modules.BuildEnterprise
+	if !enterprise {
+		return nil
+	}
+
+	user := &types.UserV2{
+		Kind:    types.KindUser,
+		Version: types.V2,
+		Metadata: types.Metadata{
+			Name:        teleport.SystemAccessApproverUserName,
+			Namespace:   apidefaults.Namespace,
+			Description: "Used internally by Teleport to automatically approve access requests",
+			Labels: map[string]string{
+				types.TeleportInternalResourceType: string(types.SystemResource),
+				types.TeleportResourceRevision:     "1",
+			},
+		},
+		Spec: types.UserSpecV2{
+			Roles: []string{teleport.SystemAutomaticAccessApprovalRoleName},
+		},
+	}
+	user.CheckAndSetDefaults()
+	return user
+}
+
 // NewPresetEditorRole returns a new pre-defined role for cluster
 // editors who can edit cluster configuration resources.
 func NewPresetEditorRole() types.Role {
-	enterprise := modules.GetModules().BuildType() == modules.BuildEnterprise
 	role := &types.RoleV6{
 		Kind:    types.KindRole,
-		Version: types.V6,
+		Version: types.V7,
 		Metadata: types.Metadata{
 			Name:        teleport.PresetEditorRoleName,
 			Namespace:   apidefaults.Namespace,
 			Description: "Edit cluster configuration",
+			Labels: map[string]string{
+				types.TeleportInternalResourceType: types.PresetResource,
+			},
 		},
 		Spec: types.RoleSpecV6{
 			Options: types.RoleOptions{
@@ -93,8 +162,6 @@ func NewPresetEditorRole() types.Role {
 					types.NewRule(types.KindClusterAlert, RW()),
 					// Please see defaultAllowRules when adding a new rule.
 				},
-				// By default, allow editors to approve any user group access requests.
-				ReviewRequests: defaultAllowAccessReviewConditions(enterprise)[teleport.PresetEditorRoleName],
 			},
 		},
 	}
@@ -104,14 +171,16 @@ func NewPresetEditorRole() types.Role {
 // NewPresetAccessRole creates a role for users who are allowed to initiate
 // interactive sessions.
 func NewPresetAccessRole() types.Role {
-	enterprise := modules.GetModules().BuildType() == modules.BuildEnterprise
 	role := &types.RoleV6{
 		Kind:    types.KindRole,
-		Version: types.V6,
+		Version: types.V7,
 		Metadata: types.Metadata{
 			Name:        teleport.PresetAccessRoleName,
 			Namespace:   apidefaults.Namespace,
 			Description: "Access cluster resources",
+			Labels: map[string]string{
+				types.TeleportInternalResourceType: types.PresetResource,
+			},
 		},
 		Spec: types.RoleSpecV6{
 			Options: types.RoleOptions{
@@ -135,7 +204,7 @@ func NewPresetAccessRole() types.Role {
 				DatabaseRoles:         []string{teleport.TraitInternalDBRolesVariable},
 				KubernetesResources: []types.KubernetesResource{
 					{
-						Kind:      types.KindKubePod,
+						Kind:      types.Wildcard,
 						Namespace: types.Wildcard,
 						Name:      types.Wildcard,
 					},
@@ -148,10 +217,9 @@ func NewPresetAccessRole() types.Role {
 						Where:     "contains(session.participants, user.metadata.name)",
 					},
 					types.NewRule(types.KindInstance, RO()),
+					types.NewRule(types.KindAssistant, append(RW(), types.VerbUse)),
 					// Please see defaultAllowRules when adding a new rule.
 				},
-				// By default, allow users with the access role to request any user group.
-				Request: defaultAllowAccessRequestConditions(enterprise)[teleport.PresetAccessRoleName],
 			},
 		},
 	}
@@ -171,11 +239,14 @@ func NewPresetAccessRole() types.Role {
 func NewPresetAuditorRole() types.Role {
 	role := &types.RoleV6{
 		Kind:    types.KindRole,
-		Version: types.V6,
+		Version: types.V7,
 		Metadata: types.Metadata{
 			Name:        teleport.PresetAuditorRoleName,
 			Namespace:   apidefaults.Namespace,
 			Description: "Review cluster events and replay sessions",
+			Labels: map[string]string{
+				types.TeleportInternalResourceType: types.PresetResource,
+			},
 		},
 		Spec: types.RoleSpecV6{
 			Options: types.RoleOptions{
@@ -201,9 +272,67 @@ func NewPresetAuditorRole() types.Role {
 	return role
 }
 
+// NewPresetReviewerRole returns a new pre-defined role for reviewer. The
+// reviewer will be able to review all access requests.
+func NewPresetReviewerRole() types.Role {
+	if modules.GetModules().BuildType() != modules.BuildEnterprise {
+		return nil
+	}
+
+	role := &types.RoleV6{
+		Kind:    types.KindRole,
+		Version: types.V6,
+		Metadata: types.Metadata{
+			Name:        teleport.PresetReviewerRoleName,
+			Namespace:   apidefaults.Namespace,
+			Description: "Review access requests",
+			Labels: map[string]string{
+				types.TeleportInternalResourceType: types.PresetResource,
+			},
+		},
+		Spec: types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				ReviewRequests: defaultAllowAccessReviewConditions(true)[teleport.PresetReviewerRoleName],
+			},
+		},
+	}
+	return role
+}
+
+// NewPresetRequesterRole returns a new pre-defined role for requester. The
+// requester will be able to request all resources.
+func NewPresetRequesterRole() types.Role {
+	if modules.GetModules().BuildType() != modules.BuildEnterprise {
+		return nil
+	}
+
+	role := &types.RoleV6{
+		Kind:    types.KindRole,
+		Version: types.V6,
+		Metadata: types.Metadata{
+			Name:        teleport.PresetRequesterRoleName,
+			Namespace:   apidefaults.Namespace,
+			Description: "Request all resources",
+			Labels: map[string]string{
+				types.TeleportInternalResourceType: types.PresetResource,
+			},
+		},
+		Spec: types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				Request: defaultAllowAccessRequestConditions(true)[teleport.PresetRequesterRoleName],
+			},
+		},
+	}
+	return role
+}
+
 // NewPresetGroupAccessRole returns a new pre-defined role for group access -
 // a role used for requesting and reviewing user group access.
 func NewPresetGroupAccessRole() types.Role {
+	if modules.GetModules().BuildType() != modules.BuildEnterprise {
+		return nil
+	}
+
 	role := &types.RoleV6{
 		Kind:    types.KindRole,
 		Version: types.V6,
@@ -211,6 +340,9 @@ func NewPresetGroupAccessRole() types.Role {
 			Name:        teleport.PresetGroupAccessRoleName,
 			Namespace:   apidefaults.Namespace,
 			Description: "Have access to all user groups",
+			Labels: map[string]string{
+				types.TeleportInternalResourceType: types.PresetResource,
+			},
 		},
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
@@ -225,10 +357,27 @@ func NewPresetGroupAccessRole() types.Role {
 			},
 		},
 	}
-	role.SetLogins(types.Allow, []string{"no-login-" + uuid.New().String()})
 	return role
 }
 
+// bootstrapRoleMetadataLabels are metadata labels that will be applied to each role.
+// These are intended to add labels for older roles that didn't previously have them.
+func bootstrapRoleMetadataLabels() map[string]map[string]string {
+	return map[string]map[string]string{
+		teleport.PresetAccessRoleName: {
+			types.TeleportInternalResourceType: types.PresetResource,
+		},
+		teleport.PresetEditorRoleName: {
+			types.TeleportInternalResourceType: types.PresetResource,
+		},
+		teleport.PresetAuditorRoleName: {
+			types.TeleportInternalResourceType: types.PresetResource,
+		},
+		// Group access, reviewer and requester are intentionally not added here as there may be
+		// existing customer defined roles that have these labels.
+	}
+}
+
 // defaultAllowRules has the Allow rules that should be set as default when
 // they were not explicitly defined. This is used to update the current cluster
 // roles when deploying a new resource. It will also update all existing roles
@@ -254,6 +403,11 @@ func defaultAllowRules() map[string][]types.Rule {
 			types.NewRule(types.KindBilling, RW()),
 			types.NewRule(types.KindAssistant, append(RW(), types.VerbUse)),
 		},
+		teleport.PresetAccessRoleName: {
+			// Allow assist access to access role. This role only allow access
+			// to the assist console, not any other cluster resources.
+			types.NewRule(types.KindAssistant, append(RW(), types.VerbUse)),
+		},
 	}
 }
 
@@ -275,8 +429,9 @@ func defaultAllowLabels() map[string]types.RoleConditions {
 func defaultAllowAccessRequestConditions(enterprise bool) map[string]*types.AccessRequestConditions {
 	if enterprise {
 		return map[string]*types.AccessRequestConditions{
-			teleport.PresetAccessRoleName: {
+			teleport.PresetRequesterRoleName: {
 				SearchAsRoles: []string{
+					teleport.PresetAccessRoleName,
 					teleport.PresetGroupAccessRoleName,
 				},
 			},
@@ -291,11 +446,13 @@ func defaultAllowAccessRequestConditions(enterprise bool) map[string]*types.Acce
 func defaultAllowAccessReviewConditions(enterprise bool) map[string]*types.AccessReviewConditions {
 	if enterprise {
 		return map[string]*types.AccessReviewConditions{
-			teleport.PresetEditorRoleName: {
+			teleport.PresetReviewerRoleName: {
 				PreviewAsRoles: []string{
+					teleport.PresetAccessRoleName,
 					teleport.PresetGroupAccessRoleName,
 				},
 				Roles: []string{
+					teleport.PresetAccessRoleName,
 					teleport.PresetGroupAccessRoleName,
 				},
 			},
@@ -310,6 +467,34 @@ func defaultAllowAccessReviewConditions(enterprise bool) map[string]*types.Acces
 func AddRoleDefaults(role types.Role) (types.Role, error) {
 	changed := false
 
+	// Role labels
+	defaultRoleLabels, ok := bootstrapRoleMetadataLabels()[role.GetName()]
+	if ok {
+		metadata := role.GetMetadata()
+
+		if metadata.Labels == nil {
+			metadata.Labels = make(map[string]string, len(defaultRoleLabels))
+		}
+		for label, value := range defaultRoleLabels {
+			if _, ok := metadata.Labels[label]; !ok {
+				metadata.Labels[label] = value
+				changed = true
+			}
+		}
+
+		if changed {
+			role.SetMetadata(metadata)
+		}
+	}
+
+	// Check if the role has a TeleportInternalResourceType attached. We do this after setting the role metadata
+	// labels because we set the role metadata labels for roles that have been well established (access,
+	// editor, auditor) that may not already have this label set, but we don't set it for newer roles
+	// (group-access, reviewer, requester) that may have customer definitions.
+	if role.GetMetadata().Labels[types.TeleportInternalResourceType] != types.PresetResource {
+		return nil, trace.AlreadyExists("not modifying user created role")
+	}
+
 	// Resource Rules
 	defaultRules, ok := defaultAllowRules()[role.GetName()]
 	if ok {
@@ -331,8 +516,12 @@ func AddRoleDefaults(role types.Role) (types.Role, error) {
 	// Labels
 	defaultLabels, ok := defaultAllowLabels()[role.GetName()]
 	if ok {
-		if len(defaultLabels.DatabaseServiceLabels) > 0 && len(role.GetDatabaseServiceLabels(types.Allow)) == 0 && len(role.GetDatabaseServiceLabels(types.Deny)) == 0 {
-			role.SetDatabaseServiceLabels(types.Allow, defaultLabels.DatabaseServiceLabels)
+		if unset, err := labelMatchersUnset(role, types.KindDatabaseService); err != nil {
+			return nil, trace.Wrap(err)
+		} else if unset && len(defaultLabels.DatabaseServiceLabels) > 0 {
+			role.SetLabelMatchers(types.Allow, types.KindDatabaseService, types.LabelMatchers{
+				Labels: defaultLabels.DatabaseServiceLabels,
+			})
 			changed = true
 		}
 		if len(defaultLabels.DatabaseRoles) > 0 && len(role.GetDatabaseRoles(types.Allow)) == 0 {
@@ -366,6 +555,19 @@ func AddRoleDefaults(role types.Role) (types.Role, error) {
 	return role, nil
 }
 
+func labelMatchersUnset(role types.Role, kind string) (bool, error) {
+	for _, cond := range []types.RoleConditionType{types.Allow, types.Deny} {
+		labelMatchers, err := role.GetLabelMatchers(cond, kind)
+		if err != nil {
+			return false, trace.Wrap(err)
+		}
+		if !labelMatchers.Empty() {
+			return false, nil
+		}
+	}
+	return true, nil
+}
+
 func resourceBelongsToRules(rules []types.Rule, resources []string) bool {
 	for _, rule := range rules {
 		for _, ruleResource := range rule.Resources {
diff --git a/lib/services/presets_test.go b/lib/services/presets_test.go
index 0be8c7987eb32..a830c20aef352 100644
--- a/lib/services/presets_test.go
+++ b/lib/services/presets_test.go
@@ -24,6 +24,8 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/constants"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/modules"
 )
@@ -32,20 +34,29 @@ func TestAddRoleDefaults(t *testing.T) {
 	noChange := func(t require.TestingT, err error, i ...interface{}) {
 		require.ErrorIs(t, err, trace.AlreadyExists("no change"))
 	}
+	notModifying := func(t require.TestingT, err error, i ...interface{}) {
+		require.ErrorIs(t, err, trace.AlreadyExists("not modifying user created role"))
+	}
 
 	tests := []struct {
 		name                   string
 		role                   types.Role
 		enterprise             bool
-		reviewRequestsNotEmpty bool
-		accessReviewNotEmpty   bool
+		reviewNotEmpty         bool
+		accessRequestsNotEmpty bool
 
 		expectedErr require.ErrorAssertionFunc
 		expected    types.Role
 	}{
 		{
-			name:        "nothing added",
-			role:        &types.RoleV6{},
+			name: "nothing added",
+			role: &types.RoleV6{
+				Metadata: types.Metadata{
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+			},
 			expectedErr: noChange,
 			expected:    nil,
 		},
@@ -54,35 +65,35 @@ func TestAddRoleDefaults(t *testing.T) {
 			role: &types.RoleV6{
 				Metadata: types.Metadata{
 					Name: teleport.PresetEditorRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
 				},
 			},
 			expectedErr: require.NoError,
 			expected: &types.RoleV6{
 				Metadata: types.Metadata{
 					Name: teleport.PresetEditorRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
 				},
 				Spec: types.RoleSpecV6{
 					Allow: types.RoleConditions{
-						Rules:          defaultAllowRules()[teleport.PresetEditorRoleName],
-						ReviewRequests: defaultAllowAccessReviewConditions(false)[teleport.PresetEditorRoleName],
+						Rules: defaultAllowRules()[teleport.PresetEditorRoleName],
 					},
 				},
 			},
 		},
 		{
-			name: "editor (existing rules)",
+			name: "editor (only missing label)",
 			role: &types.RoleV6{
 				Metadata: types.Metadata{
 					Name: teleport.PresetEditorRoleName,
 				},
 				Spec: types.RoleSpecV6{
 					Allow: types.RoleConditions{
-						Rules: []types.Rule{
-							{
-								Resources: []string{"test"},
-								Verbs:     []string{"test"},
-							},
-						},
+						Rules: defaultAllowRules()[teleport.PresetEditorRoleName],
 					},
 				},
 			},
@@ -90,131 +101,304 @@ func TestAddRoleDefaults(t *testing.T) {
 			expected: &types.RoleV6{
 				Metadata: types.Metadata{
 					Name: teleport.PresetEditorRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
 				},
 				Spec: types.RoleSpecV6{
 					Allow: types.RoleConditions{
-						Rules: append([]types.Rule{
-							{
-								Resources: []string{"test"},
-								Verbs:     []string{"test"},
-							},
-						}, defaultAllowRules()[teleport.PresetEditorRoleName]...),
-						ReviewRequests: defaultAllowAccessReviewConditions(false)[teleport.PresetEditorRoleName],
+						Rules: defaultAllowRules()[teleport.PresetEditorRoleName],
 					},
 				},
 			},
 		},
 		{
-			name: "editor (existing rules, enterprise)",
+			name: "access (access review, db labels, identical rules)",
 			role: &types.RoleV6{
 				Metadata: types.Metadata{
-					Name: teleport.PresetEditorRoleName,
+					Name: teleport.PresetAccessRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
 				},
 				Spec: types.RoleSpecV6{
 					Allow: types.RoleConditions{
-						Rules: []types.Rule{
-							{
-								Resources: []string{"test"},
-								Verbs:     []string{"test"},
-							},
-						},
+						Rules: defaultAllowRules()[teleport.PresetAccessRoleName],
 					},
 				},
 			},
-			enterprise:           true,
-			accessReviewNotEmpty: true,
-			expectedErr:          require.NoError,
+			expectedErr: require.NoError,
 			expected: &types.RoleV6{
 				Metadata: types.Metadata{
-					Name: teleport.PresetEditorRoleName,
+					Name: teleport.PresetAccessRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
 				},
 				Spec: types.RoleSpecV6{
 					Allow: types.RoleConditions{
-						Rules: append([]types.Rule{
-							{
-								Resources: []string{"test"},
-								Verbs:     []string{"test"},
-							},
-						}, defaultAllowRules()[teleport.PresetEditorRoleName]...),
-						ReviewRequests: defaultAllowAccessReviewConditions(true)[teleport.PresetEditorRoleName],
+						DatabaseServiceLabels: defaultAllowLabels()[teleport.PresetAccessRoleName].DatabaseServiceLabels,
+						DatabaseRoles:         defaultAllowLabels()[teleport.PresetAccessRoleName].DatabaseRoles,
+						Rules:                 defaultAllowRules()[teleport.PresetAccessRoleName],
 					},
 				},
 			},
 		},
 		{
-			name: "editor (existing review requests, identical rules)",
+			name: "access (only missing label)",
 			role: &types.RoleV6{
 				Metadata: types.Metadata{
-					Name: teleport.PresetEditorRoleName,
+					Name: teleport.PresetAccessRoleName,
 				},
 				Spec: types.RoleSpecV6{
 					Allow: types.RoleConditions{
-						Rules: defaultAllowRules()[teleport.PresetEditorRoleName],
-						ReviewRequests: &types.AccessReviewConditions{
-							Where: "test",
+						DatabaseServiceLabels: defaultAllowLabels()[teleport.PresetAccessRoleName].DatabaseServiceLabels,
+						DatabaseRoles:         defaultAllowLabels()[teleport.PresetAccessRoleName].DatabaseRoles,
+						Rules:                 defaultAllowRules()[teleport.PresetAccessRoleName],
+					},
+				},
+			},
+			expectedErr: require.NoError,
+			expected: &types.RoleV6{
+				Metadata: types.Metadata{
+					Name: teleport.PresetAccessRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+				Spec: types.RoleSpecV6{
+					Allow: types.RoleConditions{
+						DatabaseServiceLabels: defaultAllowLabels()[teleport.PresetAccessRoleName].DatabaseServiceLabels,
+						DatabaseRoles:         defaultAllowLabels()[teleport.PresetAccessRoleName].DatabaseRoles,
+						Rules:                 defaultAllowRules()[teleport.PresetAccessRoleName],
+					},
+				},
+			},
+		},
+		{
+			name: "auditor",
+			role: &types.RoleV6{
+				Metadata: types.Metadata{
+					Name: teleport.PresetAuditorRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CertificateFormat: constants.CertificateFormatStandard,
+						MaxSessionTTL:     types.NewDuration(apidefaults.MaxCertDuration),
+						RecordSession: &types.RecordSession{
+							Desktop: types.NewBoolOption(false),
 						},
 					},
 				},
 			},
-			expectedErr: noChange,
-			expected:    nil,
+			expectedErr: require.NoError,
+			expected: &types.RoleV6{
+				Metadata: types.Metadata{
+					Name: teleport.PresetAuditorRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CertificateFormat: constants.CertificateFormatStandard,
+						MaxSessionTTL:     types.NewDuration(apidefaults.MaxCertDuration),
+						RecordSession: &types.RecordSession{
+							Desktop: types.NewBoolOption(false),
+						},
+					},
+					Allow: types.RoleConditions{
+						Rules: defaultAllowRules()[teleport.PresetAuditorRoleName],
+					},
+				},
+			},
 		},
 		{
-			name: "access (access review, db labels, identical rules)",
+			name: "auditor (only missing label)",
 			role: &types.RoleV6{
 				Metadata: types.Metadata{
-					Name: teleport.PresetAccessRoleName,
+					Name: teleport.PresetAuditorRoleName,
 				},
 				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CertificateFormat: constants.CertificateFormatStandard,
+						MaxSessionTTL:     types.NewDuration(apidefaults.MaxCertDuration),
+						RecordSession: &types.RecordSession{
+							Desktop: types.NewBoolOption(false),
+						},
+					},
 					Allow: types.RoleConditions{
-						Rules: defaultAllowRules()[teleport.PresetAccessRoleName],
+						Rules: defaultAllowRules()[teleport.PresetAuditorRoleName],
 					},
 				},
 			},
 			expectedErr: require.NoError,
 			expected: &types.RoleV6{
 				Metadata: types.Metadata{
-					Name: teleport.PresetAccessRoleName,
+					Name: teleport.PresetAuditorRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
 				},
 				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CertificateFormat: constants.CertificateFormatStandard,
+						MaxSessionTTL:     types.NewDuration(apidefaults.MaxCertDuration),
+						RecordSession: &types.RecordSession{
+							Desktop: types.NewBoolOption(false),
+						},
+					},
 					Allow: types.RoleConditions{
-						DatabaseServiceLabels: defaultAllowLabels()[teleport.PresetAccessRoleName].DatabaseServiceLabels,
-						DatabaseRoles:         defaultAllowLabels()[teleport.PresetAccessRoleName].DatabaseRoles,
-						Rules:                 defaultAllowRules()[teleport.PresetAccessRoleName],
-						Request:               defaultAllowAccessRequestConditions(false)[teleport.PresetAccessRoleName],
+						Rules: defaultAllowRules()[teleport.PresetAuditorRoleName],
 					},
 				},
 			},
 		},
 		{
-			name: "access (access review, db labels, identical rules, enterprise)",
+			name: "reviewer (not enterprise)",
 			role: &types.RoleV6{
 				Metadata: types.Metadata{
-					Name: teleport.PresetAccessRoleName,
+					Name: teleport.PresetReviewerRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+			},
+			expectedErr: noChange,
+			expected:    nil,
+		},
+		{
+			name: "reviewer (enterprise)",
+			role: &types.RoleV6{
+				Metadata: types.Metadata{
+					Name: teleport.PresetReviewerRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+			},
+			enterprise:     true,
+			expectedErr:    require.NoError,
+			reviewNotEmpty: true,
+			expected: &types.RoleV6{
+				Metadata: types.Metadata{
+					Name: teleport.PresetReviewerRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
 				},
 				Spec: types.RoleSpecV6{
 					Allow: types.RoleConditions{
-						Rules: defaultAllowRules()[teleport.PresetAccessRoleName],
+						ReviewRequests: defaultAllowAccessReviewConditions(true)[teleport.PresetReviewerRoleName],
+					},
+				},
+			},
+		},
+		{
+			name: "reviewer (enterprise, created by user)",
+			role: &types.RoleV6{
+				Metadata: types.Metadata{
+					Name: teleport.PresetReviewerRoleName,
+				},
+			},
+			enterprise:  true,
+			expectedErr: notModifying,
+			expected:    nil,
+		},
+		{
+			name: "reviewer (enterprise, existing review requests)",
+			role: &types.RoleV6{
+				Metadata: types.Metadata{
+					Name: teleport.PresetReviewerRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+				Spec: types.RoleSpecV6{
+					Allow: types.RoleConditions{
+						ReviewRequests: &types.AccessReviewConditions{
+							Roles: []string{"some-role"},
+						},
+					},
+				},
+			},
+			enterprise:  true,
+			expectedErr: noChange,
+		},
+		{
+			name: "requester (not enterprise)",
+			role: &types.RoleV6{
+				Metadata: types.Metadata{
+					Name: teleport.PresetRequesterRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+			},
+			expectedErr: noChange,
+			expected:    nil,
+		},
+		{
+			name: "requester (enterprise)",
+			role: &types.RoleV6{
+				Metadata: types.Metadata{
+					Name: teleport.PresetRequesterRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
 					},
 				},
 			},
 			enterprise:             true,
-			reviewRequestsNotEmpty: true,
 			expectedErr:            require.NoError,
+			accessRequestsNotEmpty: true,
 			expected: &types.RoleV6{
 				Metadata: types.Metadata{
-					Name: teleport.PresetAccessRoleName,
+					Name: teleport.PresetRequesterRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
 				},
 				Spec: types.RoleSpecV6{
 					Allow: types.RoleConditions{
-						DatabaseServiceLabels: defaultAllowLabels()[teleport.PresetAccessRoleName].DatabaseServiceLabels,
-						DatabaseRoles:         defaultAllowLabels()[teleport.PresetAccessRoleName].DatabaseRoles,
-						Rules:                 defaultAllowRules()[teleport.PresetAccessRoleName],
-						Request:               defaultAllowAccessRequestConditions(true)[teleport.PresetAccessRoleName],
+						Request: defaultAllowAccessRequestConditions(true)[teleport.PresetRequesterRoleName],
 					},
 				},
 			},
 		},
+		{
+			name: "requester (enterprise, created by user)",
+			role: &types.RoleV6{
+				Metadata: types.Metadata{
+					Name: teleport.PresetRequesterRoleName,
+				},
+			},
+			enterprise:  true,
+			expectedErr: notModifying,
+			expected:    nil,
+		},
+		{
+			name: "requester (enterprise, existing requests)",
+			role: &types.RoleV6{
+				Metadata: types.Metadata{
+					Name: teleport.PresetRequesterRoleName,
+					Labels: map[string]string{
+						types.TeleportInternalResourceType: types.PresetResource,
+					},
+				},
+				Spec: types.RoleSpecV6{
+					Allow: types.RoleConditions{
+						Request: &types.AccessRequestConditions{
+							Roles: []string{"some-role"},
+						},
+					},
+				},
+			},
+			enterprise:  true,
+			expectedErr: noChange,
+		},
 	}
 
 	for _, test := range tests {
@@ -231,8 +415,8 @@ func TestAddRoleDefaults(t *testing.T) {
 			require.Empty(t, cmp.Diff(role, test.expected))
 
 			if test.expected != nil {
-				require.Equal(t, test.reviewRequestsNotEmpty, !role.GetAccessRequestConditions(types.Allow).IsEmpty())
-				require.Equal(t, test.accessReviewNotEmpty, !role.GetAccessReviewConditions(types.Allow).IsEmpty())
+				require.Equal(t, test.reviewNotEmpty, !role.GetAccessReviewConditions(types.Allow).IsEmpty())
+				require.Equal(t, test.accessRequestsNotEmpty, !role.GetAccessRequestConditions(types.Allow).IsEmpty())
 			}
 		})
 	}
diff --git a/lib/services/role.go b/lib/services/role.go
index e96bafece24dc..3f7480cd15e5d 100644
--- a/lib/services/role.go
+++ b/lib/services/role.go
@@ -301,25 +301,37 @@ func validateRoleExpressions(r types.Role) error {
 		}
 
 		for _, labels := range []struct {
-			name   string
-			labels types.Labels
+			name string
+			kind string
 		}{
-			{"node_labels", r.GetNodeLabels(condition.condition)},
-			{"app_labels", r.GetAppLabels(condition.condition)},
-			{"kubernetes_labels", r.GetKubernetesLabels(condition.condition)},
-			{"db_labels", r.GetDatabaseLabels(condition.condition)},
-			{"windows_desktop_labels", r.GetWindowsDesktopLabels(condition.condition)},
-			{"cluster_labels", r.GetClusterLabels(condition.condition)},
+			{"cluster_labels", types.KindRemoteCluster},
+			{"node_labels", types.KindNode},
+			{"kubernetes_labels", types.KindKubernetesCluster},
+			{"app_labels", types.KindApp},
+			{"db_labels", types.KindDatabase},
+			{"db_service_labels", types.KindDatabaseService},
+			{"windows_desktop_labels", types.KindWindowsDesktop},
+			{"group_labels", types.KindUserGroup},
 		} {
-			for _, labelValues := range labels.labels {
+			labelMatchers, err := r.GetLabelMatchers(condition.condition, labels.kind)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			for _, labelValues := range labelMatchers.Labels {
 				for _, label := range labelValues {
 					_, err := parse.NewTraitsTemplateExpression(label)
 					if err != nil {
-						err = trace.BadParameter("parsing %s.%s expression: %v", condition.name, labels.name, err)
+						err = trace.BadParameter("parsing %s.%s template expression: %v", condition.name, labels.name, err)
 						errs = append(errs, err)
 					}
 				}
 			}
+			if len(labelMatchers.Expression) > 0 {
+				if _, err := parseLabelExpression(labelMatchers.Expression); err != nil {
+					err = trace.BadParameter("parsing %s.%s_expression: %v", condition.name, labels.name, err)
+					errs = append(errs, err)
+				}
+			}
 		}
 	}
 	return trace.NewAggregate(errs...)
@@ -411,8 +423,9 @@ func MatchValidAzureIdentity(identity string) bool {
 
 // ApplyTraits applies the passed in traits to any variables within the role
 // and returns itself.
-func ApplyTraits(r types.Role, traits map[string][]string) types.Role {
+func ApplyTraits(r types.Role, traits map[string][]string) (types.Role, error) {
 	for _, condition := range []types.RoleConditionType{types.Allow, types.Deny} {
+
 		inLogins := r.GetLogins(condition)
 		outLogins := applyValueTraitsSlice(inLogins, traits, "login")
 		outLogins = filterInvalidUnixLogins(outLogins)
@@ -461,46 +474,31 @@ func ApplyTraits(r types.Role, traits map[string][]string) types.Role {
 		outDbRoles := applyValueTraitsSlice(inDbRoles, traits, "database role")
 		r.SetDatabaseRoles(condition, apiutils.Deduplicate(outDbRoles))
 
-		// apply templates to node labels
-		inLabels := r.GetNodeLabels(condition)
-		if inLabels != nil {
-			r.SetNodeLabels(condition, applyLabelsTraits(inLabels, traits))
-		}
-
-		// apply templates to cluster labels
-		inLabels = r.GetClusterLabels(condition)
-		if inLabels != nil {
-			r.SetClusterLabels(condition, applyLabelsTraits(inLabels, traits))
-		}
-
-		// apply templates to kube labels
-		inLabels = r.GetKubernetesLabels(condition)
-		if inLabels != nil {
-			r.SetKubernetesLabels(condition, applyLabelsTraits(inLabels, traits))
-		}
-
-		// apply templates to app labels
-		inLabels = r.GetAppLabels(condition)
-		if inLabels != nil {
-			r.SetAppLabels(condition, applyLabelsTraits(inLabels, traits))
-		}
-
-		// apply templates to group labels
-		inLabels = r.GetGroupLabels(condition)
-		if inLabels != nil {
-			r.SetGroupLabels(condition, applyLabelsTraits(inLabels, traits))
-		}
-
-		// apply templates to database labels
-		inLabels = r.GetDatabaseLabels(condition)
-		if inLabels != nil {
-			r.SetDatabaseLabels(condition, applyLabelsTraits(inLabels, traits))
-		}
-
-		// apply templates to windows desktop labels
-		inLabels = r.GetWindowsDesktopLabels(condition)
-		if inLabels != nil {
-			r.SetWindowsDesktopLabels(condition, applyLabelsTraits(inLabels, traits))
+		for _, kind := range []string{
+			types.KindRemoteCluster,
+			types.KindNode,
+			types.KindKubernetesCluster,
+			types.KindApp,
+			types.KindDatabase,
+			types.KindDatabaseService,
+			types.KindWindowsDesktop,
+			types.KindUserGroup,
+		} {
+			labelMatchers, err := r.GetLabelMatchers(condition, kind)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			// Only labelMatchers.Labels is templated, if empty we can skip
+			// these label matchers. labelMatchers.Expression can reference user
+			// traits later during the access check through the expression
+			// environment, they are not templated in here.
+			if len(labelMatchers.Labels) == 0 {
+				continue
+			}
+			labelMatchers.Labels = applyLabelsTraits(labelMatchers.Labels, traits)
+			if err := r.SetLabelMatchers(condition, kind, labelMatchers); err != nil {
+				return nil, trace.Wrap(err)
+			}
 		}
 
 		r.SetHostGroups(condition,
@@ -535,7 +533,7 @@ func ApplyTraits(r types.Role, traits map[string][]string) types.Role {
 		r.SetImpersonateConditions(condition, outCond)
 	}
 
-	return r
+	return r, nil
 }
 
 // applyValueTraitsSlice iterates over a slice of input strings, calling
@@ -795,15 +793,6 @@ func (set RuleSet) Slice() []types.Rule {
 	return out
 }
 
-// HostUsersInfo keeps information about groups and sudoers entries
-// for a particular host user
-type HostUsersInfo struct {
-	// Groups is the list of groups to include host users in
-	Groups []string
-	// Sudoers is a list of entries for a users sudoers file
-	Sudoers []string
-}
-
 // RoleFromSpec returns new Role created from spec
 func RoleFromSpec(name string, spec types.RoleSpecV6) (types.Role, error) {
 	role, err := types.NewRole(name, spec)
@@ -889,7 +878,11 @@ func FetchRoleList(roleNames []string, access RoleGetter, traits map[string][]st
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		roles = append(roles, ApplyTraits(role, traits))
+		role, err = ApplyTraits(role, traits)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		roles = append(roles, role)
 	}
 
 	return roles, nil
@@ -906,50 +899,6 @@ func FetchRoles(roleNames []string, access RoleGetter, traits map[string][]strin
 	return NewRoleSet(roles...), nil
 }
 
-// CurrentUserRoleGetter limits the interface of auth.ClientI to methods needed by FetchAllClusterRoles.
-type CurrentUserRoleGetter interface {
-	GetCurrentUser(context.Context) (types.User, error)
-	GetCurrentUserRoles(context.Context) ([]types.Role, error)
-	RoleGetter
-}
-
-// FetchAllClusterRoles fetches all roles available to the user on the
-// specified cluster, applies traits, and adds runtime roles like the default
-// implicit role to RoleSet.
-func FetchAllClusterRoles(ctx context.Context, access CurrentUserRoleGetter, defaultRoleNames []string, defaultTraits wrappers.Traits) (RoleSet, error) {
-	user, err := access.GetCurrentUser(ctx)
-	if err != nil {
-		// DELETE IN 12.0.0
-		if trace.IsNotImplemented(err) {
-			// get the role definition for all roles of user.
-			// this may only fail if the role which we are looking for does not exist, or we don't have access to it.
-			// example scenario when this may happen:
-			// 1. we have set of roles [foo bar] from profile.
-			// 2. the cluster is remote and maps the [foo, bar] roles to single role [guest]
-			// 3. the remote cluster doesn't implement GetCurrentUser(), so we have no way to learn of [guest].
-			// 4. FetchRoles([foo bar], ..., ...) fails as [foo bar] does not exist on remote cluster.
-			roleSet, err := FetchRoles(defaultRoleNames, access, defaultTraits)
-			return roleSet, trace.Wrap(err)
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	roles, err := access.GetCurrentUserRoles(ctx)
-	if err != nil {
-		// DELETE IN 12.0
-		if trace.IsNotImplemented(err) {
-			roleSet, err := FetchRoles(user.GetRoles(), access, user.GetTraits())
-			return roleSet, trace.Wrap(err)
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	for i := range roles {
-		roles[i] = ApplyTraits(roles[i], user.GetTraits())
-	}
-	return NewRoleSet(roles...), nil
-}
-
 // ExtractRolesFromCert extracts roles from certificate metadata extensions.
 func ExtractRolesFromCert(cert *ssh.Certificate) ([]string, error) {
 	data, ok := cert.Extensions[teleport.CertExtensionTeleportRoles]
@@ -1049,152 +998,6 @@ func NewEnumerationResult() EnumerationResult {
 	}
 }
 
-// EnumerateDatabaseUsers specializes EnumerateEntities to enumerate db_users.
-func (set RoleSet) EnumerateDatabaseUsers(database types.Database, extraUsers ...string) EnumerationResult {
-	listFn := func(role types.Role, condition types.RoleConditionType) []string {
-		return role.GetDatabaseUsers(condition)
-	}
-	newMatcher := func(user string) RoleMatcher {
-		return NewDatabaseUserMatcher(database, user)
-	}
-	return set.EnumerateEntities(database, listFn, newMatcher, extraUsers...)
-}
-
-// EnumerateDatabaseNames specializes EnumerateEntities to enumerate db_names.
-func (set RoleSet) EnumerateDatabaseNames(database types.Database, extraNames ...string) EnumerationResult {
-	listFn := func(role types.Role, condition types.RoleConditionType) []string {
-		return role.GetDatabaseNames(condition)
-	}
-	newMatcher := func(dbName string) RoleMatcher {
-		return &DatabaseNameMatcher{Name: dbName}
-	}
-	return set.EnumerateEntities(database, listFn, newMatcher, extraNames...)
-}
-
-// roleEntitiesListFn is used for listing a role's allowed/denied entities.
-type roleEntitiesListFn func(types.Role, types.RoleConditionType) []string
-
-// roleMatcherFactoryFn is used for making a role matcher for a given entity.
-type roleMatcherFactoryFn func(entity string) RoleMatcher
-
-// EnumerateEntities works on a given role set to return a minimal description
-// of allowed set of entities (db_users, db_names, etc). It is biased towards
-// *allowed* entities; It is meant to describe what the user can do, rather than
-// cannot do. For that reason if the user isn't allowed to pick *any* entities,
-// the output will be empty.
-//
-// In cases where * is listed in set of allowed entities, it may be hard for
-// users to figure out the expected entity to use. For this reason the parameter
-// extraEntities provides an extra set of entities to be checked against
-// RoleSet. This extra set of entities may be sourced e.g. from user connection
-// history.
-func (set RoleSet) EnumerateEntities(resource AccessCheckable, listFn roleEntitiesListFn, newMatcher roleMatcherFactoryFn, extraEntities ...string) EnumerationResult {
-	result := NewEnumerationResult()
-
-	// gather entities for checking from the roles, check wildcards.
-	var entities []string
-	for _, role := range set {
-		wildcardAllowed := false
-		wildcardDenied := false
-
-		for _, e := range listFn(role, types.Allow) {
-			if e == types.Wildcard {
-				wildcardAllowed = true
-			} else {
-				entities = append(entities, e)
-			}
-		}
-
-		for _, e := range listFn(role, types.Deny) {
-			if e == types.Wildcard {
-				wildcardDenied = true
-			} else {
-				entities = append(entities, e)
-			}
-		}
-
-		result.wildcardDenied = result.wildcardDenied || wildcardDenied
-
-		if err := NewRoleSet(role).checkAccess(resource, AccessState{MFAVerified: true}); err == nil {
-			result.wildcardAllowed = result.wildcardAllowed || wildcardAllowed
-		}
-
-	}
-
-	entities = apiutils.Deduplicate(append(entities, extraEntities...))
-
-	// check each individual role spec entity against the resource.
-	for _, e := range entities {
-		err := set.checkAccess(resource, AccessState{MFAVerified: true}, newMatcher(e))
-		result.allowedDeniedMap[e] = err == nil
-	}
-
-	return result
-}
-
-// GetAllowedLoginsForResource returns all of the allowed logins for the passed resource.
-//
-// Supports the following resource types:
-//
-// - types.Server with GetKind() == types.KindNode
-//
-// - types.KindWindowsDesktop
-func (set RoleSet) GetAllowedLoginsForResource(resource AccessCheckable) ([]string, error) {
-	// Create a map indexed by all logins in the RoleSet,
-	// mapped to false if any role has it in its deny section,
-	// true otherwise.
-	mapped := make(map[string]bool)
-
-	for _, role := range set {
-		var loginGetter func(types.RoleConditionType) []string
-
-		switch resource.GetKind() {
-		case types.KindNode:
-			loginGetter = role.GetLogins
-		case types.KindWindowsDesktop:
-			loginGetter = role.GetWindowsLogins
-		default:
-			return nil, trace.BadParameter("received unsupported resource kind: %s", resource.GetKind())
-		}
-
-		for _, login := range loginGetter(types.Allow) {
-			mapped[login] = true
-		}
-		for _, login := range loginGetter(types.Deny) {
-			mapped[login] = false
-		}
-	}
-
-	// Create a list of only the logins not denied by a role in the set.
-	var notDenied []string
-	for login, isNotDenied := range mapped {
-		if isNotDenied {
-			notDenied = append(notDenied, login)
-		}
-	}
-
-	var newLoginMatcher func(login string) RoleMatcher
-	switch resource.GetKind() {
-	case types.KindNode:
-		newLoginMatcher = NewLoginMatcher
-	case types.KindWindowsDesktop:
-		newLoginMatcher = NewWindowsLoginMatcher
-	default:
-		return nil, trace.BadParameter("received unsupported resource kind: %s", resource.GetKind())
-	}
-
-	// Filter the not-denied logins for those allowed to be used with the given resource.
-	var allowed []string
-	for _, login := range notDenied {
-		err := set.checkAccess(resource, AccessState{MFAVerified: true}, newLoginMatcher(login))
-		if err == nil {
-			allowed = append(allowed, login)
-		}
-	}
-
-	return allowed, nil
-}
-
 // MatchNamespace returns true if given list of namespace matches
 // target namespace, wildcard matches everything.
 func MatchNamespace(selectors []string, namespace string) (bool, string) {
@@ -1272,9 +1075,12 @@ func MatchLabels(selector types.Labels, target map[string]string) (bool, string,
 	return MatchLabelGetter(selector, mapLabelGetter(target))
 }
 
-// LabelGetter allows retrieving a particular label by name.
+// LabelGetter allows retrieving a particular label by name or retreiving all
+// labels at once. Prefer to use GetLabel when possible to avoid unnecessary
+// copies.
 type LabelGetter interface {
 	GetLabel(key string) (value string, ok bool)
+	GetAllLabels() map[string]string
 }
 
 type mapLabelGetter map[string]string
@@ -1284,6 +1090,10 @@ func (m mapLabelGetter) GetLabel(key string) (value string, ok bool) {
 	return v, ok
 }
 
+func (m mapLabelGetter) GetAllLabels() map[string]string {
+	return map[string]string(m)
+}
+
 // MatchLabelGetter matches selector against labelGetter. Empty selector matches
 // nothing, wildcard matches everything.
 func MatchLabelGetter(selector types.Labels, labelGetter LabelGetter) (bool, string, error) {
@@ -1536,56 +1346,6 @@ func (set RoleSet) AdjustDisconnectExpiredCert(disconnect bool) bool {
 	return disconnect
 }
 
-// CheckDatabaseRoles returns whether a user should be auto-created in the
-// database and a list of database roles to assign.
-func (set RoleSet) CheckDatabaseRoles(database types.Database) (create bool, roles []string, err error) {
-	// First, collect roles from this roleset that have "create_db_user" option.
-	var autoCreateRoles RoleSet
-	for _, role := range set {
-		if role.GetCreateDatabaseUserOption() {
-			autoCreateRoles = append(autoCreateRoles, role)
-		}
-	}
-	// If there are no "auto-create user" roles, nothing to do.
-	if len(autoCreateRoles) == 0 {
-		return false, nil, nil
-	}
-	// Otherwise, iterate over auto-create roles matching the database user
-	// is connecting to and compile a list of roles database user should be
-	// assigned.
-	rolesMap := make(map[string]struct{})
-	var matched bool
-	for _, role := range autoCreateRoles {
-		match, _, err := MatchLabels(role.GetDatabaseLabels(types.Allow), database.GetAllLabels())
-		if err != nil {
-			return false, nil, trace.Wrap(err)
-		}
-		if !match {
-			continue
-		}
-		for _, dbRole := range role.GetDatabaseRoles(types.Allow) {
-			rolesMap[dbRole] = struct{}{}
-		}
-		matched = true
-	}
-	for _, role := range autoCreateRoles {
-		match, _, err := MatchLabels(role.GetDatabaseLabels(types.Deny), database.GetAllLabels())
-		if err != nil {
-			return false, nil, trace.Wrap(err)
-		}
-		if !match {
-			continue
-		}
-		for _, dbRole := range role.GetDatabaseRoles(types.Deny) {
-			delete(rolesMap, dbRole)
-		}
-	}
-	// The collected role list can be empty and that should be ok, we want to
-	// leave the behavior of what happens when a user is created with default
-	// "no roles" configuration up to the target database.
-	return matched, utils.StringsSliceFromSet(rolesMap), nil
-}
-
 // CheckKubeGroupsAndUsers check if role can login into kubernetes
 // and returns two lists of allowed groups and users
 func (set RoleSet) CheckKubeGroupsAndUsers(ttl time.Duration, overrideTTL bool, matchers ...RoleMatcher) ([]string, []string, error) {
@@ -1838,75 +1598,6 @@ func (set RoleSet) GetLoginsForTTL(ttl time.Duration) (logins []string, matchedT
 	return apiutils.Deduplicate(logins), matchedTTL
 }
 
-// CheckAccessToRemoteCluster checks if a role has access to remote cluster. Deny rules are
-// checked first then allow rules. Access to a cluster is determined by
-// namespaces, labels, and logins.
-func (set RoleSet) CheckAccessToRemoteCluster(rc types.RemoteCluster) error {
-	if len(set) == 0 {
-		return trace.AccessDenied("access to cluster denied")
-	}
-
-	// Note: logging in this function only happens in debug mode, this is because
-	// adding logging to this function (which is called on every server returned
-	// by GetRemoteClusters) can slow down this function by 50x for large clusters!
-	isDebugEnabled, debugf := rbacDebugLogger()
-
-	rcLabels := rc.GetMetadata().Labels
-
-	// For backwards compatibility, if there is no role in the set with labels and the cluster
-	// has no labels, assume that the role set has access to the cluster.
-	usesLabels := false
-	for _, role := range set {
-		if len(role.GetClusterLabels(types.Allow)) != 0 || len(role.GetClusterLabels(types.Deny)) != 0 {
-			usesLabels = true
-			break
-		}
-	}
-
-	if !usesLabels && len(rcLabels) == 0 {
-		debugf("Grant access to cluster %v - no role in %v uses cluster labels and the cluster is not labeled.",
-			rc.GetName(), set.RoleNames())
-		return nil
-	}
-
-	// Check deny rules first: a single matching label from
-	// the deny role set prohibits access.
-	var errs []error
-	for _, role := range set {
-		matchLabels, labelsMessage, err := MatchLabels(role.GetClusterLabels(types.Deny), rcLabels)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		if matchLabels {
-			// This condition avoids formatting calls on large scale.
-			debugf("Access to cluster %v denied, deny rule in %v matched; match(label=%v)",
-				rc.GetName(), role.GetName(), labelsMessage)
-			return trace.AccessDenied("access to cluster denied")
-		}
-	}
-
-	// Check allow rules: label has to match in any role in the role set to be granted access.
-	for _, role := range set {
-		matchLabels, labelsMessage, err := MatchLabels(role.GetClusterLabels(types.Allow), rcLabels)
-		debugf("Check access to role(%v) rc(%v, labels=%v) matchLabels=%v, msg=%v, err=%v allow=%v rcLabels=%v",
-			role.GetName(), rc.GetName(), rcLabels, matchLabels, labelsMessage, err, role.GetClusterLabels(types.Allow), rcLabels)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		if matchLabels {
-			return nil
-		}
-		if isDebugEnabled {
-			deniedError := trace.AccessDenied("role=%v, match(label=%v)",
-				role.GetName(), labelsMessage)
-			errs = append(errs, deniedError)
-		}
-	}
-
-	debugf("Access to cluster %v denied, no allow rule matched; %v", rc.GetName(), errs)
-	return trace.AccessDenied("access to cluster denied")
-}
-
 func (set RoleSet) hasPossibleLogins() bool {
 	for _, role := range set {
 		if role.GetName() == constants.DefaultImplicitRole {
@@ -2332,6 +2023,13 @@ type databaseUserMatcher struct {
 // NewDatabaseUserMatcher creates a RoleMatcher that checks whether the role's
 // database users match the specified condition.
 func NewDatabaseUserMatcher(db types.Database, user string) RoleMatcher {
+	if db.SupportAWSIAMRoleARNAsUsers() {
+		return &databaseUserMatcher{
+			user:             user,
+			alternativeNames: makeUsernamesForAWSRoleARN(db, user),
+		}
+	}
+
 	if db.RequireAWSIAMRolesAsUsers() {
 		return &databaseUserMatcher{
 			user:             user,
@@ -2387,6 +2085,31 @@ func makeAlternativeNamesForAWSRole(db types.Database, user string) []string {
 	return []string{roleARN}
 }
 
+// makeUsernamesForAWSRoleARN builds ARN alternatives for database users who are full or
+// partial ARN.
+func makeUsernamesForAWSRoleARN(db types.Database, user string) []string {
+	if !awsutils.IsRoleARN(user) {
+		return nil
+	}
+
+	metadata := db.GetAWS()
+	if metadata.Region != "" && metadata.AccountID != "" && awsutils.IsPartialRoleARN(user) {
+		roleARN, err := awsutils.BuildRoleARN(user, metadata.Region, metadata.AccountID)
+		if err != nil {
+			return nil
+		}
+
+		return []string{roleARN}
+	}
+
+	roleARN, err := awsutils.ParseRoleARN(user)
+	if err != nil {
+		return nil
+	}
+
+	return []string{roleARN.Resource}
+}
+
 // DatabaseNameMatcher matches a role against database name.
 type DatabaseNameMatcher struct {
 	Name string
@@ -2447,6 +2170,7 @@ func (l *windowsLoginMatcher) Match(role types.Role, typ types.RoleConditionType
 
 type kubernetesClusterLabelMatcher struct {
 	clusterLabels map[string]string
+	userTraits    wrappers.Traits
 }
 
 // NewKubeResourcesMatcher creates a new KubeResourcesMatcher matcher that
@@ -2534,19 +2258,26 @@ func (m *KubernetesResourceMatcher) String() string {
 
 // NewKubernetesClusterLabelMatcher creates a RoleMatcher that checks whether a role's
 // Kubernetes service labels match.
-func NewKubernetesClusterLabelMatcher(clustersLabels map[string]string) RoleMatcher {
-	return &kubernetesClusterLabelMatcher{clusterLabels: clustersLabels}
+func NewKubernetesClusterLabelMatcher(clustersLabels map[string]string, userTraits wrappers.Traits) RoleMatcher {
+	return &kubernetesClusterLabelMatcher{clusterLabels: clustersLabels, userTraits: userTraits}
 }
 
 // Match matches a Kubernetes cluster labels against a role.
 func (l *kubernetesClusterLabelMatcher) Match(role types.Role, typ types.RoleConditionType) (bool, error) {
-	ok, _, err := MatchLabels(l.getKubeLabels(role, typ), l.clusterLabels)
+	labelMatchers, err := l.getKubeLabelMatchers(role, typ)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	ok, _, err := checkLabelsMatch(typ, labelMatchers, l.userTraits, mapLabelGetter(l.clusterLabels), false)
 	return ok, trace.Wrap(err)
 }
 
-// getKubeLabels returns kubernetes_labels based on resource version and role type.
-func (l kubernetesClusterLabelMatcher) getKubeLabels(role types.Role, typ types.RoleConditionType) types.Labels {
-	labels := role.GetKubernetesLabels(typ)
+// getKubeLabelMatchers returns kubernetes_labels based on resource version and role type.
+func (l kubernetesClusterLabelMatcher) getKubeLabelMatchers(role types.Role, typ types.RoleConditionType) (types.LabelMatchers, error) {
+	labelMatchers, err := role.GetLabelMatchers(typ, types.KindKubernetesCluster)
+	if err != nil {
+		return types.LabelMatchers{}, trace.Wrap(err)
+	}
 
 	// After the introduction of https://github.com/gravitational/teleport/pull/9759 the
 	// kubernetes_labels started to be respected. Former role behavior evaluated deny rules
@@ -2555,10 +2286,10 @@ func (l kubernetesClusterLabelMatcher) getKubeLabels(role types.Role, typ types.
 	// Default wildcard rules should be added to  deny.kubernetes_labels if
 	// deny.kubernetes_labels is empty to ensure that deny rule will be evaluated
 	// even if kubernetes_labels are empty.
-	if len(labels) == 0 && typ == types.Deny {
-		return map[string]apiutils.Strings{types.Wildcard: []string{types.Wildcard}}
+	if labelMatchers.Empty() && typ == types.Deny {
+		labelMatchers.Labels = types.Labels{types.Wildcard: []string{types.Wildcard}}
 	}
-	return labels
+	return labelMatchers, nil
 }
 
 // AccessCheckable is the subset of types.Resource required for the RBAC checks.
@@ -2567,6 +2298,7 @@ type AccessCheckable interface {
 	GetName() string
 	GetMetadata() types.Metadata
 	GetLabel(key string) (value string, ok bool)
+	GetAllLabels() map[string]string
 }
 
 // rbacDebugLogger creates a debug logger for Teleport's RBAC component.
@@ -2578,9 +2310,7 @@ func rbacDebugLogger() (debugEnabled bool, debugf func(format string, args ...in
 	return isDebugEnabled, log.Tracef
 }
 
-// checkAccess checks if this role set has access to a particular resource r,
-// based on the passed AccessState, the resource's labels, and the passed matchers.
-func (set RoleSet) checkAccess(r AccessCheckable, state AccessState, matchers ...RoleMatcher) error {
+func (set RoleSet) checkAccess(r AccessCheckable, traits wrappers.Traits, state AccessState, matchers ...RoleMatcher) error {
 	// Note: logging in this function only happens in debug mode. This is because
 	// adding logging to this function (which is called on every resource returned
 	// by the backend) can slow down this function by 50x for large clusters!
@@ -2596,32 +2326,15 @@ func (set RoleSet) checkAccess(r AccessCheckable, state AccessState, matchers ..
 	// Additional message depending on kind of resource
 	// so there's more context on why the user might not have access.
 	additionalDeniedMessage := ""
-
-	var getRoleLabels func(types.Role, types.RoleConditionType) types.Labels
-
 	switch r.GetKind() {
 	case types.KindDatabase:
-		getRoleLabels = types.Role.GetDatabaseLabels
 		additionalDeniedMessage = "Confirm database user and name."
-	case types.KindDatabaseService:
-		getRoleLabels = types.Role.GetDatabaseServiceLabels
-	case types.KindApp:
-		getRoleLabels = types.Role.GetAppLabels
-	case types.KindUserGroup:
-		getRoleLabels = types.Role.GetGroupLabels
 	case types.KindNode:
-		getRoleLabels = types.Role.GetNodeLabels
 		additionalDeniedMessage = "Confirm SSH login."
 	case types.KindKubernetesCluster:
-		getRoleLabels = types.Role.GetKubernetesLabels
 		additionalDeniedMessage = "Confirm Kubernetes user or group."
 	case types.KindWindowsDesktop:
-		getRoleLabels = types.Role.GetWindowsDesktopLabels
 		additionalDeniedMessage = "Confirm Windows user."
-	case types.KindWindowsDesktopService:
-		getRoleLabels = types.Role.GetWindowsDesktopLabels
-	default:
-		return trace.BadParameter("cannot match labels for kind %v", r.GetKind())
 	}
 
 	// Check deny rules.
@@ -2631,12 +2344,12 @@ func (set RoleSet) checkAccess(r AccessCheckable, state AccessState, matchers ..
 			continue
 		}
 
-		matchLabels, labelsMessage, err := MatchLabelGetter(getRoleLabels(role, types.Deny), r)
+		matchLabels, labelsMessage, err := checkRoleLabelsMatch(types.Deny, role, traits, r, isDebugEnabled)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 		if matchLabels {
-			debugf("Access to %v %q denied, deny rule in role %q matched; match(namespace=%v, label=%v)",
+			debugf("Access to %v %q denied, deny rule in role %q matched; match(namespace=%v, %s)",
 				r.GetKind(), r.GetName(), role.GetName(), namespaceMessage, labelsMessage)
 			return trace.AccessDenied("access to %v denied. User does not have permissions. %v",
 				r.GetKind(), additionalDeniedMessage)
@@ -2675,14 +2388,14 @@ func (set RoleSet) checkAccess(r AccessCheckable, state AccessState, matchers ..
 			continue
 		}
 
-		matchLabels, labelsMessage, err := MatchLabelGetter(getRoleLabels(role, types.Allow), r)
+		matchLabels, labelsMessage, err := checkRoleLabelsMatch(types.Allow, role, traits, r, isDebugEnabled)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
 		if !matchLabels {
 			if isDebugEnabled {
-				errs = append(errs, trace.AccessDenied("role=%v, match(label=%v)",
+				errs = append(errs, trace.AccessDenied("role=%v, match(%s)",
 					role.GetName(), labelsMessage))
 			}
 			continue
@@ -2748,6 +2461,118 @@ func (set RoleSet) checkAccess(r AccessCheckable, state AccessState, matchers ..
 		r.GetKind(), additionalDeniedMessage)
 }
 
+// checkRoleLabelsMatch checks if the [role] matches the labels of [resource]
+// for [condition].
+// It considers both the role labels (<kind>_labels) and label expression
+// (<kind>_labels_expression).
+//
+// Returns a match boolean, a debug message, and any unexpected error.
+//
+// If [condition] is types.Deny, the match is greedy, if either one matches it's
+// considered a match.
+//
+// If [condition] is types.Allow, the match is not greedy, if either doesn't
+// match it's not considered a match.
+//
+// If neither is set, it's not a match in either case.
+func checkRoleLabelsMatch(
+	condition types.RoleConditionType,
+	role types.Role,
+	userTraits wrappers.Traits,
+	resource AccessCheckable,
+	debug bool,
+) (bool, string, error) {
+	labelMatchers, err := role.GetLabelMatchers(condition, resource.GetKind())
+	if err != nil {
+		return false, "", trace.Wrap(err)
+	}
+	return checkLabelsMatch(condition, labelMatchers, userTraits, resource, debug)
+}
+
+// checkLabelsMatch checks if the [labelMatchers] match the labels of [resource]
+// for [condition].
+// It considers both [labelMatchers.Labels] and [labelMatchers.Expression].
+//
+// Returns a match boolean, a debug message, and any unexpected error.
+//
+// If [condition] is types.Deny, the match is greedy, if either one matches it's
+// considered a match.
+//
+// If [condition] is types.Allow, the match is not greedy, if either doesn't
+// match it's not considered a match.
+//
+// If neither is set, it's not a match in either case.
+func checkLabelsMatch(
+	condition types.RoleConditionType,
+	labelMatchers types.LabelMatchers,
+	userTraits wrappers.Traits,
+	resource LabelGetter,
+	debug bool,
+) (bool, string, error) {
+	if labelMatchers.Empty() {
+		return false, "no label matchers or label expression", nil
+	}
+
+	var message string
+	labelsUnsetOrMatch, expressionUnsetOrMatch := true, true
+
+	if len(labelMatchers.Labels) > 0 {
+		match, msg, err := MatchLabelGetter(labelMatchers.Labels, resource)
+		if err != nil {
+			return false, "", trace.Wrap(err)
+		}
+		if debug {
+			message += "label=" + msg
+		}
+		// Deny rules are greedy, if either matches, it's a match.
+		if condition == types.Deny && match {
+			return true, message, nil
+		}
+		labelsUnsetOrMatch = match
+	}
+
+	if len(labelMatchers.Expression) > 0 {
+		match, msg, err := matchLabelExpression(labelMatchers.Expression, resource, userTraits)
+		if err != nil {
+			return false, "", trace.Wrap(err)
+		}
+		if debug {
+			message = strings.Join([]string{message, "expression=" + msg}, ", ")
+		}
+		// Deny rules are greedy, if either matches, it's a match.
+		if condition == types.Deny {
+			return match, message, nil
+		}
+		expressionUnsetOrMatch = match
+	}
+
+	if condition == types.Deny {
+		// Either branch would have returned if it was a match.
+		return false, message, nil
+	}
+
+	// Allow rules are not greedy, both must match if they are set.
+	return labelsUnsetOrMatch && expressionUnsetOrMatch, message, nil
+}
+
+func matchLabelExpression(labelExpression string, resource LabelGetter, userTraits wrappers.Traits) (bool, string, error) {
+	parsedExpr, err := parseLabelExpression(labelExpression)
+	if err != nil {
+		return false, "", trace.Wrap(err)
+	}
+	match, err := parsedExpr.Evaluate(labelExpressionEnv{
+		resourceLabelGetter: resource,
+		userTraits:          userTraits,
+	})
+	if err != nil {
+		return false, "", trace.Wrap(err, "evaluating label expression %q", labelExpression)
+	}
+	if match {
+		return true, "matched", nil
+	}
+	return false, "no match", nil
+}
+
 // CanForwardAgents returns true if role set allows forwarding agents.
 func (set RoleSet) CanForwardAgents() bool {
 	for _, role := range set {
@@ -2888,120 +2713,6 @@ func (set RoleSet) EnhancedRecordingSet() map[string]bool {
 	return m
 }
 
-// DesktopGroups returns the desktop groups a user is allowed to create or an access denied error if a role disallows desktop user creation
-func (set RoleSet) DesktopGroups(s types.WindowsDesktop) ([]string, error) {
-	groups := make(map[string]struct{})
-	labels := s.GetAllLabels()
-	for _, role := range set {
-		result, _, err := MatchLabels(role.GetWindowsDesktopLabels(types.Allow), labels)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		// skip nodes that dont have matching labels
-		if !result {
-			continue
-		}
-		createDesktopUser := role.GetOptions().CreateDesktopUser
-		// if any of the matching roles do not enable create host
-		// user, the user should not be allowed on
-		if createDesktopUser == nil || !createDesktopUser.Value {
-			return nil, trace.AccessDenied("user is not allowed to create host users")
-		}
-		for _, group := range role.GetDesktopGroups(types.Allow) {
-			groups[group] = struct{}{}
-		}
-	}
-	for _, role := range set {
-		result, _, err := MatchLabels(role.GetWindowsDesktopLabels(types.Deny), labels)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		if !result {
-			continue
-		}
-		for _, group := range role.GetDesktopGroups(types.Deny) {
-			delete(groups, group)
-		}
-	}
-
-	return utils.StringsSliceFromSet(groups), nil
-}
-
-// HostUsers returns host user information matching a server or nil if
-// a role disallows host user creation
-func (set RoleSet) HostUsers(s types.Server) (*HostUsersInfo, error) {
-	groups := make(map[string]struct{})
-	var sudoers []string
-	serverLabels := s.GetAllLabels()
-
-	roleSet := make([]types.Role, len(set))
-	copy(roleSet, set)
-	slices.SortStableFunc(roleSet, func(a types.Role, b types.Role) bool {
-		return strings.Compare(a.GetName(), b.GetName()) == -1
-	})
-
-	seenSudoers := make(map[string]struct{})
-	for _, role := range roleSet {
-		result, _, err := MatchLabels(role.GetNodeLabels(types.Allow), serverLabels)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		// skip nodes that dont have matching labels
-		if !result {
-			continue
-		}
-		createHostUser := role.GetOptions().CreateHostUser
-		// if any of the matching roles do not enable create host
-		// user, the user should not be allowed on
-		if createHostUser == nil || !createHostUser.Value {
-			return nil, trace.AccessDenied("user is not allowed to create host users")
-		}
-		for _, group := range role.GetHostGroups(types.Allow) {
-			groups[group] = struct{}{}
-		}
-		for _, sudoer := range role.GetHostSudoers(types.Allow) {
-			if _, ok := seenSudoers[sudoer]; ok {
-				continue
-			}
-			seenSudoers[sudoer] = struct{}{}
-			sudoers = append(sudoers, sudoer)
-		}
-	}
-
-	var finalSudoers []string
-	for _, role := range roleSet {
-		result, _, err := MatchLabels(role.GetNodeLabels(types.Deny), serverLabels)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		if !result {
-			continue
-		}
-		for _, group := range role.GetHostGroups(types.Deny) {
-			delete(groups, group)
-		}
-
-	outer:
-		for _, sudoer := range sudoers {
-			for _, deniedSudoer := range role.GetHostSudoers(types.Deny) {
-				if deniedSudoer == "*" {
-					finalSudoers = nil
-					break outer
-				}
-				if sudoer != deniedSudoer {
-					finalSudoers = append(finalSudoers, sudoer)
-				}
-			}
-		}
-		sudoers = finalSudoers
-	}
-
-	return &HostUsersInfo{
-		Groups:  utils.StringsSliceFromSet(groups),
-		Sudoers: sudoers,
-	}, nil
-}
-
 // certificatePriority returns the priority of the certificate format. The
 // most permissive has lowest value.
 func certificatePriority(s string) int {
@@ -3094,9 +2805,9 @@ func (set RoleSet) CheckAccessToRule(ctx RuleContext, namespace string, resource
 }
 
 // GetKubeResources returns allowed and denied list of Kubernetes Resources configured in the RoleSet.
-func (set RoleSet) GetKubeResources(cluster types.KubeCluster) (allowed, denied []types.KubernetesResource) {
+func (set RoleSet) GetKubeResources(cluster types.KubeCluster, userTraits wrappers.Traits) (allowed, denied []types.KubernetesResource) {
 	for _, role := range set {
-		matchLabels, _, err := MatchLabels(role.GetKubernetesLabels(types.Allow), cluster.GetAllLabels())
+		matchLabels, _, err := checkRoleLabelsMatch(types.Allow, role, userTraits, cluster, false)
 		if err != nil || !matchLabels {
 			continue
 		}
@@ -3104,11 +2815,12 @@ func (set RoleSet) GetKubeResources(cluster types.KubeCluster) (allowed, denied
 	}
 
 	for _, role := range set {
-		matchLabels, _, err := MatchLabels(role.GetKubernetesLabels(types.Deny), cluster.GetAllLabels())
-		if err != nil || !matchLabels {
-			continue
-		}
-
+		// deny rules are not checked for labels because they are greedy. It means that
+		// if there is a deny rule for a cluster, it will deny access to all resources
+		// in that cluster, regardless of kubernetes_resources (i.e. making them irrelevant).
+		// If the goal is to deny access to a specific resource, it should be done by collecting
+		// all kube resources in deny rules and ignoring if the role matches or not
+		// the cluster (i.e. no labels check).
 		denied = append(denied, role.GetKubeResources(types.Deny)...)
 	}
 
@@ -3389,6 +3101,8 @@ func UnmarshalRole(bytes []byte, opts ...MarshalOption) (types.Role, error) {
 	}
 
 	switch h.Version {
+	case types.V7:
+		fallthrough
 	case types.V6:
 		fallthrough
 	case types.V5:
diff --git a/lib/services/role_test.go b/lib/services/role_test.go
index 71643012af760..8ae105d5bc193 100644
--- a/lib/services/role_test.go
+++ b/lib/services/role_test.go
@@ -45,6 +45,8 @@ import (
 	"github.com/gravitational/teleport/lib/tlsca"
 )
 
+const matchAllExpression = `"" == ""`
+
 // TestConnAndSessLimits verifies that role sets correctly calculate
 // a user's MaxConnections and MaxSessions values from multiple
 // roles with different individual values.  These are tested together since
@@ -235,7 +237,7 @@ func TestRoleParse(t *testing.T) {
 						DesktopClipboard:        types.NewBoolOption(true),
 						DesktopDirectorySharing: types.NewBoolOption(true),
 						CreateDesktopUser:       types.NewBoolOption(false),
-						CreateHostUser:          types.NewBoolOption(false),
+						CreateHostUser:          nil,
 						CreateDatabaseUser:      types.NewBoolOption(false),
 						SSHFileCopy:             types.NewBoolOption(true),
 						IDP: &types.IdPOptions{
@@ -288,7 +290,7 @@ func TestRoleParse(t *testing.T) {
 						DesktopClipboard:        types.NewBoolOption(true),
 						DesktopDirectorySharing: types.NewBoolOption(true),
 						CreateDesktopUser:       types.NewBoolOption(false),
-						CreateHostUser:          types.NewBoolOption(false),
+						CreateHostUser:          nil,
 						CreateDatabaseUser:      types.NewBoolOption(false),
 						SSHFileCopy:             types.NewBoolOption(true),
 						IDP: &types.IdPOptions{
@@ -374,7 +376,7 @@ func TestRoleParse(t *testing.T) {
 						DesktopDirectorySharing: types.NewBoolOption(true),
 						CreateDesktopUser:       types.NewBoolOption(false),
 						CreateDatabaseUser:      types.NewBoolOption(false),
-						CreateHostUser:          types.NewBoolOption(false),
+						CreateHostUser:          nil,
 						SSHFileCopy:             types.NewBoolOption(false),
 						IDP: &types.IdPOptions{
 							SAML: &types.IdPSAMLOptions{
@@ -476,7 +478,7 @@ func TestRoleParse(t *testing.T) {
 						DesktopClipboard:        types.NewBoolOption(true),
 						DesktopDirectorySharing: types.NewBoolOption(true),
 						CreateDesktopUser:       types.NewBoolOption(false),
-						CreateHostUser:          types.NewBoolOption(false),
+						CreateHostUser:          nil,
 						CreateDatabaseUser:      types.NewBoolOption(false),
 						SSHFileCopy:             types.NewBoolOption(false),
 						IDP: &types.IdPOptions{
@@ -585,7 +587,7 @@ func TestRoleParse(t *testing.T) {
 						DesktopClipboard:        types.NewBoolOption(true),
 						DesktopDirectorySharing: types.NewBoolOption(true),
 						CreateDesktopUser:       types.NewBoolOption(false),
-						CreateHostUser:          types.NewBoolOption(false),
+						CreateHostUser:          nil,
 						CreateDatabaseUser:      types.NewBoolOption(false),
 						SSHFileCopy:             types.NewBoolOption(true),
 						IDP: &types.IdPOptions{
@@ -680,7 +682,7 @@ func TestRoleParse(t *testing.T) {
 						DesktopClipboard:        types.NewBoolOption(true),
 						DesktopDirectorySharing: types.NewBoolOption(true),
 						CreateDesktopUser:       types.NewBoolOption(false),
-						CreateHostUser:          types.NewBoolOption(false),
+						CreateHostUser:          nil,
 						CreateDatabaseUser:      types.NewBoolOption(false),
 						SSHFileCopy:             types.NewBoolOption(true),
 						IDP: &types.IdPOptions{
@@ -880,21 +882,61 @@ func TestValidateRole(t *testing.T) {
 				},
 			},
 			expectWarnings: []string{
-				"parsing allow.node_labels expression",
-				"parsing allow.app_labels expression",
-				"parsing allow.kubernetes_labels expression",
-				"parsing allow.db_labels expression",
-				"parsing allow.windows_desktop_labels expression",
-				"parsing allow.cluster_labels expression",
-				"parsing deny.node_labels expression",
-				"parsing deny.app_labels expression",
-				"parsing deny.kubernetes_labels expression",
-				"parsing deny.db_labels expression",
-				"parsing deny.windows_desktop_labels expression",
-				"parsing deny.cluster_labels expression",
+				"parsing allow.node_labels template expression",
+				"parsing allow.app_labels template expression",
+				"parsing allow.kubernetes_labels template expression",
+				"parsing allow.db_labels template expression",
+				"parsing allow.windows_desktop_labels template expression",
+				"parsing allow.cluster_labels template expression",
+				"parsing deny.node_labels template expression",
+				"parsing deny.app_labels template expression",
+				"parsing deny.kubernetes_labels template expression",
+				"parsing deny.db_labels template expression",
+				"parsing deny.windows_desktop_labels template expression",
+				"parsing deny.cluster_labels template expression",
 				"unsupported function: email.localz",
 			},
 		},
+		{
+			name: "unsupported function in labels expression",
+			spec: types.RoleSpecV6{
+				Allow: types.RoleConditions{
+					ClusterLabelsExpression:         `containz(labels["env"], "staging")`,
+					NodeLabelsExpression:            `containz(labels["env"], "staging")`,
+					AppLabelsExpression:             `containz(labels["env"], "staging")`,
+					KubernetesLabelsExpression:      `containz(labels["env"], "staging")`,
+					DatabaseLabelsExpression:        `containz(labels["env"], "staging")`,
+					DatabaseServiceLabelsExpression: `containz(labels["env"], "staging")`,
+					WindowsDesktopLabelsExpression:  `containz(labels["env"], "staging")`,
+					GroupLabelsExpression:           `containz(labels["env"], "staging")`,
+				},
+				Deny: types.RoleConditions{
+					ClusterLabelsExpression:         `containz(labels["env"], "staging")`,
+					NodeLabelsExpression:            `containz(labels["env"], "staging")`,
+					AppLabelsExpression:             `containz(labels["env"], "staging")`,
+					KubernetesLabelsExpression:      `containz(labels["env"], "staging")`,
+					DatabaseLabelsExpression:        `containz(labels["env"], "staging")`,
+					DatabaseServiceLabelsExpression: `containz(labels["env"], "staging")`,
+					WindowsDesktopLabelsExpression:  `containz(labels["env"], "staging")`,
+					GroupLabelsExpression:           `containz(labels["env"], "staging")`,
+				},
+			},
+			expectWarnings: []string{
+				"parsing allow.node_labels_expression",
+				"parsing allow.app_labels_expression",
+				"parsing allow.kubernetes_labels_expression",
+				"parsing allow.db_labels_expression",
+				"parsing allow.windows_desktop_labels_expression",
+				"parsing allow.cluster_labels_expression",
+				"parsing deny.node_labels_expression",
+				"parsing deny.app_labels_expression",
+				"parsing deny.kubernetes_labels_expression",
+				"parsing deny.db_labels_expression",
+				"parsing deny.windows_desktop_labels_expression",
+				"parsing deny.cluster_labels_expression",
+				"unsupported function: containz",
+			},
+		},
 		{
 			name: "unsupported function in slice fields",
 			spec: types.RoleSpecV6{
@@ -988,6 +1030,9 @@ func TestValidateRole(t *testing.T) {
 			}
 			require.NoError(t, err, trace.DebugReport(err))
 
+			if len(tc.expectWarnings) == 0 {
+				require.Empty(t, warning)
+			}
 			for _, msg := range tc.expectWarnings {
 				require.ErrorContains(t, warning, msg)
 			}
@@ -1121,6 +1166,7 @@ func newRole(mut func(*types.RoleV6)) *types.RoleV6 {
 		},
 	}
 	mut(r)
+	r.CheckAndSetDefaults()
 	return r
 }
 
@@ -1605,23 +1651,35 @@ func TestCheckAccessToServer(t *testing.T) {
 				{server: serverDB, login: "root", hasAccess: true},
 			},
 		},
+		{
+			name: "label expressions",
+			roles: []*types.RoleV6{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.NodeLabels = nil
+					r.Spec.Allow.NodeLabelsExpression = `labels.role == "worker" && labels.status == "follower"`
+					r.Spec.Allow.Logins = []string{"root"}
+				}),
+			},
+			checks: []check{
+				{server: serverNoLabels, login: "root", hasAccess: false},
+				{server: serverWorker, login: "root", hasAccess: true},
+				{server: serverDB, login: "root", hasAccess: false},
+			},
+		},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			authPref, err := types.NewAuthPreference(tc.authSpec)
 			require.NoError(t, err, "NewAuthPreference failed")
 
-			var set RoleSet
-			for i := range tc.roles {
-				set = append(set, tc.roles[i])
-			}
+			accessChecker := makeAccessCheckerWithRolePointers(tc.roles)
 			for j, check := range tc.checks {
 				comment := fmt.Sprintf("check #%v: user: %v, server: %v, should access: %v", j, check.login, check.server.GetName(), check.hasAccess)
-				state := set.GetAccessState(authPref)
+				state := accessChecker.GetAccessState(authPref)
 				state.MFAVerified = tc.mfaVerified
 				state.EnableDeviceVerification = tc.enableDeviceVerification
 				state.DeviceVerified = tc.deviceVerified
-				err := set.checkAccess(
+				err := accessChecker.CheckAccess(
 					check.server,
 					state,
 					NewLoginMatcher(check.login))
@@ -1657,6 +1715,9 @@ func TestCheckAccessToRemoteCluster(t *testing.T) {
 			Labels: map[string]string{"role": "db", "status": "follower"},
 		},
 	}
+	require.NoError(t, rcA.CheckAndSetDefaults())
+	require.NoError(t, rcB.CheckAndSetDefaults())
+	require.NoError(t, rcC.CheckAndSetDefaults())
 	testCases := []struct {
 		name   string
 		roles  []types.RoleV6
@@ -1880,15 +1941,25 @@ func TestCheckAccessToRemoteCluster(t *testing.T) {
 				{rc: rcC, hasAccess: true},
 			},
 		},
+		{
+			name: "label expressions",
+			roles: []types.RoleV6{
+				*newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.ClusterLabelsExpression = `labels.role == "worker" && labels.status == "follower"`
+				}),
+			},
+			checks: []check{
+				{rc: rcA, hasAccess: false},
+				{rc: rcB, hasAccess: true},
+				{rc: rcC, hasAccess: false},
+			},
+		},
 	}
 	for i, tc := range testCases {
-		var set RoleSet
-		for i := range tc.roles {
-			set = append(set, &tc.roles[i])
-		}
+		accessChecker := makeAccessCheckerWithRoles(tc.roles)
 		for j, check := range tc.checks {
 			comment := fmt.Sprintf("test case %v '%v', check %v", i, tc.name, j)
-			result := set.CheckAccessToRemoteCluster(check.rc)
+			result := accessChecker.CheckAccessToRemoteCluster(check.rc)
 			if check.hasAccess {
 				require.NoError(t, result, comment)
 			} else {
@@ -1898,6 +1969,35 @@ func TestCheckAccessToRemoteCluster(t *testing.T) {
 	}
 }
 
+func makeAccessCheckerWithRoles(roles []types.RoleV6) AccessChecker {
+	roleSet := make(RoleSet, len(roles))
+	for i := range roles {
+		roleSet[i] = &roles[i]
+	}
+	return makeAccessCheckerWithRoleSet(roleSet)
+}
+
+func makeAccessCheckerWithRolePointers(roles []*types.RoleV6) AccessChecker {
+	roleSet := make(RoleSet, len(roles))
+	for i := range roles {
+		roleSet[i] = roles[i]
+	}
+	return makeAccessCheckerWithRoleSet(roleSet)
+}
+
+func makeAccessCheckerWithRoleSet(roleSet RoleSet) AccessChecker {
+	roleNames := make([]string, len(roleSet))
+	for i, role := range roleSet {
+		roleNames[i] = role.GetName()
+	}
+	accessInfo := &AccessInfo{
+		Roles:              roleNames,
+		Traits:             nil,
+		AllowedResourceIDs: nil,
+	}
+	return NewAccessCheckerWithRoleSet(accessInfo, "clustername", roleSet)
+}
+
 // testContext overrides context and captures log writes in action
 type testContext struct {
 	Context
@@ -3159,7 +3259,8 @@ func TestApplyTraits(t *testing.T) {
 				},
 			}
 
-			outRole := ApplyTraits(role, tt.inTraits)
+			outRole, err := ApplyTraits(role, tt.inTraits)
+			require.NoError(t, err)
 			rules := []struct {
 				condition types.RoleConditionType
 				spec      *rule
@@ -3356,10 +3457,10 @@ func TestCheckAccessToDatabase(t *testing.T) {
 		Version:  types.V3,
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
-				Namespaces:     []string{apidefaults.Namespace},
-				DatabaseLabels: types.Labels{"env": []string{"prod"}},
-				DatabaseNames:  []string{"test"},
-				DatabaseUsers:  []string{"dev"},
+				Namespaces:               []string{apidefaults.Namespace},
+				DatabaseLabelsExpression: `labels["env"] == "prod"`,
+				DatabaseNames:            []string{"test"},
+				DatabaseUsers:            []string{"dev"},
 			},
 		},
 	}
@@ -3517,7 +3618,7 @@ func TestCheckAccessToDatabase(t *testing.T) {
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			for _, access := range tc.access {
-				err := tc.roles.checkAccess(access.server, tc.state,
+				err := tc.roles.checkAccess(access.server, wrappers.Traits{}, tc.state,
 					NewDatabaseUserMatcher(access.server, access.dbUser),
 					&DatabaseNameMatcher{Name: access.dbName})
 				if access.access {
@@ -3566,9 +3667,9 @@ func TestCheckAccessToDatabaseUser(t *testing.T) {
 		Metadata: types.Metadata{Name: "dev-prod", Namespace: apidefaults.Namespace},
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
-				Namespaces:     []string{apidefaults.Namespace},
-				DatabaseLabels: types.Labels{"env": []string{"prod"}},
-				DatabaseUsers:  []string{"dev"},
+				Namespaces:               []string{apidefaults.Namespace},
+				DatabaseLabelsExpression: `labels["env"] == "prod"`,
+				DatabaseUsers:            []string{"dev"},
 			},
 		},
 	}
@@ -3577,6 +3678,7 @@ func TestCheckAccessToDatabaseUser(t *testing.T) {
 		Name: "dynamodb",
 	}, types.DatabaseSpecV3{
 		Protocol: "dynamodb",
+		URI:      "test.xxxxxxx.mongodb.net",
 		AWS: types.AWS{
 			AccountID: "123456789012",
 			Region:    "us-east-1",
@@ -3598,6 +3700,36 @@ func TestCheckAccessToDatabaseUser(t *testing.T) {
 		},
 	}
 
+	roleWithUsersAndAWSRoles := &types.RoleV6{
+		Metadata: types.Metadata{Name: "users-and-aws-roles", Namespace: apidefaults.Namespace},
+		Spec: types.RoleSpecV6{
+			Allow: types.RoleConditions{
+				Namespaces:     []string{apidefaults.Namespace},
+				DatabaseLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
+				DatabaseUsers: []string{
+					"regular-user",
+					"role/allow-role-with-partial-arn",
+					"arn:aws:iam::123456789012:role/allow-role-with-full-arn",
+				},
+			},
+		},
+	}
+	dbSupportAWSRoles, err := types.NewDatabaseV3(types.Metadata{
+		Name: "mongo-atlas",
+	}, types.DatabaseSpecV3{
+		Protocol: "mongodb",
+		URI:      "test.xxxxxxx.mongodb.net",
+		MongoAtlas: types.MongoAtlas{
+			Name: "instance",
+		},
+		AWS: types.AWS{
+			AccountID: "123456789012",
+			Region:    "us-east-1",
+		},
+	})
+	require.NoError(t, err)
+	require.True(t, dbSupportAWSRoles.SupportAWSIAMRoleARNAsUsers())
+
 	type access struct {
 		server types.Database
 		dbUser string
@@ -3639,15 +3771,32 @@ func TestCheckAccessToDatabaseUser(t *testing.T) {
 				{server: dbRequireAWSRoles, dbUser: "arn:aws-cn:iam::123456789012:role/allow-role-with-short-name", access: false},
 			},
 		},
+		{
+			name:  "database types support AWS roles and regular users",
+			roles: RoleSet{roleWithUsersAndAWSRoles},
+			access: []access{
+				{server: dbSupportAWSRoles, dbUser: "role/allow-role-with-partial-arn", access: true},
+				{server: dbSupportAWSRoles, dbUser: "arn:aws:iam::123456789012:role/allow-role-with-partial-arn", access: true},
+				{server: dbSupportAWSRoles, dbUser: "role/unknown-role", access: false},
+				{server: dbSupportAWSRoles, dbUser: "allow-role-with-partial-arn", access: false},
+				{server: dbSupportAWSRoles, dbUser: "arn:aws:iam::123456789012:role/allow-role-with-full-arn", access: true},
+				{server: dbSupportAWSRoles, dbUser: "role/allow-role-with-full-arn", access: true},
+				{server: dbSupportAWSRoles, dbUser: "arn:aws:iam::123456789012:role/unknown-role", access: false},
+				{server: dbSupportAWSRoles, dbUser: "regular-user", access: true},
+				{server: dbSupportAWSRoles, dbUser: "role/regular-user", access: false},
+				{server: dbSupportAWSRoles, dbUser: "arn:aws:iam::123456789012:role/regular-user", access: false},
+				{server: dbSupportAWSRoles, dbUser: "unknown-user", access: false},
+			},
+		},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			for _, access := range tc.access {
-				err := tc.roles.checkAccess(access.server, AccessState{}, NewDatabaseUserMatcher(access.server, access.dbUser))
+				err := tc.roles.checkAccess(access.server, wrappers.Traits{}, AccessState{}, NewDatabaseUserMatcher(access.server, access.dbUser))
 				if access.access {
-					require.NoError(t, err)
+					require.NoError(t, err, "access check shouldn't have failed for username %q", access.dbUser)
 				} else {
-					require.Error(t, err)
+					require.Error(t, err, "access check should have failed for username %q", access.dbUser)
 					require.True(t, trace.IsAccessDenied(err))
 				}
 			}
@@ -3775,10 +3924,11 @@ func TestRoleSetEnumerateDatabaseUsersAndNames(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		accessChecker := makeAccessCheckerWithRoleSet(tc.roles)
 		t.Run(tc.name, func(t *testing.T) {
-			enumResult := tc.roles.EnumerateDatabaseUsers(tc.server)
+			enumResult := accessChecker.EnumerateDatabaseUsers(tc.server)
 			require.Equal(t, tc.enumResult, enumResult)
-			enumResult = tc.roles.EnumerateDatabaseNames(tc.server)
+			enumResult = accessChecker.EnumerateDatabaseNames(tc.server)
 			require.Equal(t, tc.enumResult, enumResult)
 		})
 	}
@@ -3969,13 +4119,14 @@ func TestGetAllowedLoginsForResource(t *testing.T) {
 		},
 	}
 	for _, tc := range tt {
+		accessChecker := makeAccessCheckerWithRoleSet(tc.roleSet)
 		t.Run(tc.name, func(t *testing.T) {
 			server := mustMakeTestServer(tc.labels)
 			desktop := mustMakeTestWindowsDesktop(tc.labels)
 
-			serverLogins, err := tc.roleSet.GetAllowedLoginsForResource(server)
+			serverLogins, err := accessChecker.GetAllowedLoginsForResource(server)
 			require.NoError(t, err)
-			desktopLogins, err := tc.roleSet.GetAllowedLoginsForResource(desktop)
+			desktopLogins, err := accessChecker.GetAllowedLoginsForResource(desktop)
 			require.NoError(t, err)
 
 			require.ElementsMatch(t, tc.expectedLogins, serverLogins)
@@ -4013,7 +4164,8 @@ func TestCheckDatabaseRoles(t *testing.T) {
 		},
 	}
 
-	// roleB allows auto-user provisioning for production database.
+	// roleB allows auto-user provisioning for production database and uses
+	// label expressions.
 	roleB := &types.RoleV6{
 		Metadata: types.Metadata{Name: "roleB", Namespace: apidefaults.Namespace},
 		Spec: types.RoleSpecV6{
@@ -4021,17 +4173,18 @@ func TestCheckDatabaseRoles(t *testing.T) {
 				CreateDatabaseUser: types.NewBoolOption(true),
 			},
 			Allow: types.RoleConditions{
-				DatabaseLabels: types.Labels{"env": []string{"prod"}},
-				DatabaseRoles:  []string{"reader"},
+				DatabaseLabelsExpression: `labels["env"] == "prod"`,
+				DatabaseRoles:            []string{"reader"},
 			},
 			Deny: types.RoleConditions{
-				DatabaseLabels: types.Labels{"env": []string{"prod"}},
-				DatabaseRoles:  []string{"writer"},
+				DatabaseLabelsExpression: `labels["env"] == "prod"`,
+				DatabaseRoles:            []string{"writer"},
 			},
 		},
 	}
 
-	// roleC allows auto-user provisioning for metrics database.
+	// roleC allows auto-user provisioning for metrics database and uses label
+	// expressions.
 	roleC := &types.RoleV6{
 		Metadata: types.Metadata{Name: "roleC", Namespace: apidefaults.Namespace},
 		Spec: types.RoleSpecV6{
@@ -4091,6 +4244,7 @@ func TestCheckDatabaseRoles(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			accessChecker := makeAccessCheckerWithRoleSet(test.roleSet)
 			database, err := types.NewDatabaseV3(types.Metadata{
 				Name:   "test",
 				Labels: test.inDatabaseLabels,
@@ -4100,7 +4254,7 @@ func TestCheckDatabaseRoles(t *testing.T) {
 			})
 			require.NoError(t, err)
 
-			create, roles, err := test.roleSet.CheckDatabaseRoles(database)
+			create, roles, err := accessChecker.CheckDatabaseRoles(database)
 			require.NoError(t, err)
 			require.Equal(t, test.outCreateUser, create)
 			require.Equal(t, test.outRoles, roles)
@@ -4247,8 +4401,8 @@ func TestCheckAccessToDatabaseService(t *testing.T) {
 		Metadata: types.Metadata{Name: "dev", Namespace: apidefaults.Namespace},
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
-				Namespaces:     []string{apidefaults.Namespace},
-				DatabaseLabels: types.Labels{"env": []string{"stage"}},
+				Namespaces:               []string{apidefaults.Namespace},
+				DatabaseLabelsExpression: `contains(user.spec.traits["allow-env"], labels["env"])`,
 			},
 			Deny: types.RoleConditions{
 				Namespaces:     []string{apidefaults.Namespace},
@@ -4264,6 +4418,9 @@ func TestCheckAccessToDatabaseService(t *testing.T) {
 			},
 		},
 	}
+	userTraits := wrappers.Traits{
+		"allow-env": {"stage"},
+	}
 	type access struct {
 		server types.Database
 		access bool
@@ -4317,7 +4474,7 @@ func TestCheckAccessToDatabaseService(t *testing.T) {
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			for _, access := range tc.access {
-				err := tc.roles.checkAccess(access.server, AccessState{})
+				err := tc.roles.checkAccess(access.server, userTraits, AccessState{})
 				if access.access {
 					require.NoError(t, err)
 				} else {
@@ -4359,9 +4516,9 @@ func TestCheckAccessToAWSConsole(t *testing.T) {
 		},
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
-				Namespaces:  []string{apidefaults.Namespace},
-				AppLabels:   types.Labels{types.Wildcard: []string{types.Wildcard}},
-				AWSRoleARNs: []string{readOnlyARN},
+				Namespaces:          []string{apidefaults.Namespace},
+				AppLabelsExpression: matchAllExpression,
+				AWSRoleARNs:         []string{readOnlyARN},
 			},
 		},
 	}
@@ -4425,6 +4582,7 @@ func TestCheckAccessToAWSConsole(t *testing.T) {
 			for _, access := range test.access {
 				err := test.roles.checkAccess(
 					app,
+					wrappers.Traits{},
 					AccessState{},
 					&AWSRoleARNMatcher{RoleARN: access.roleARN})
 				if access.hasAccess {
@@ -4464,9 +4622,9 @@ func TestCheckAccessToAzureCloud(t *testing.T) {
 		},
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
-				Namespaces:      []string{apidefaults.Namespace},
-				AppLabels:       types.Labels{types.Wildcard: []string{types.Wildcard}},
-				AzureIdentities: []string{readOnlyIdentity},
+				Namespaces:          []string{apidefaults.Namespace},
+				AppLabelsExpression: matchAllExpression,
+				AzureIdentities:     []string{readOnlyIdentity},
 			},
 		},
 	}
@@ -4524,7 +4682,7 @@ func TestCheckAccessToAzureCloud(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			for identity, hasAccess := range test.access {
-				err := test.roles.checkAccess(app, AccessState{}, &AzureIdentityMatcher{Identity: identity})
+				err := test.roles.checkAccess(app, wrappers.Traits{}, AccessState{}, &AzureIdentityMatcher{Identity: identity})
 				if hasAccess {
 					require.NoError(t, err)
 				} else {
@@ -4575,9 +4733,9 @@ func TestCheckAccessToGCP(t *testing.T) {
 		},
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
-				Namespaces:         []string{apidefaults.Namespace},
-				AppLabels:          types.Labels{types.Wildcard: []string{types.Wildcard}},
-				GCPServiceAccounts: []string{readOnlyAccount, fullAccessAccount},
+				Namespaces:          []string{apidefaults.Namespace},
+				AppLabelsExpression: matchAllExpression,
+				GCPServiceAccounts:  []string{readOnlyAccount, fullAccessAccount},
 			},
 		},
 	}
@@ -4622,7 +4780,7 @@ func TestCheckAccessToGCP(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			for account, hasAccess := range test.access {
-				err := test.roles.checkAccess(app, AccessState{}, &GCPServiceAccountMatcher{ServiceAccount: account})
+				err := test.roles.checkAccess(app, wrappers.Traits{}, AccessState{}, &GCPServiceAccountMatcher{ServiceAccount: account})
 				if hasAccess {
 					require.NoError(t, err)
 				} else {
@@ -5195,11 +5353,8 @@ func TestCheckAccessToKubernetes(t *testing.T) {
 				RequireMFAType: types.RequireMFAType_SESSION,
 			},
 			Allow: types.RoleConditions{
-				Namespaces: []string{apidefaults.Namespace},
-				KubernetesLabels: types.Labels{
-					"foo": apiutils.Strings{"bar"},
-					"baz": apiutils.Strings{"qux"},
-				},
+				Namespaces:                 []string{apidefaults.Namespace},
+				KubernetesLabelsExpression: `labels.foo == "bar" && labels.baz == "qux"`,
 			},
 		},
 	}
@@ -5363,14 +5518,11 @@ func TestCheckAccessToKubernetes(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			var set RoleSet
-			for _, r := range tc.roles {
-				set = append(set, r)
-			}
 			k8sV3, err := types.NewKubernetesClusterV3FromLegacyCluster(apidefaults.Namespace, tc.cluster)
 			require.NoError(t, err)
 
-			err = set.checkAccess(k8sV3, tc.state)
+			accessChecker := makeAccessCheckerWithRolePointers(tc.roles)
+			err = accessChecker.CheckAccess(k8sV3, tc.state)
 			if tc.hasAccess {
 				require.NoError(t, err)
 			} else {
@@ -5622,12 +5774,32 @@ func TestCheckAccessToWindowsDesktop(t *testing.T) {
 				{desktop: desktop2012, login: "admin", hasAccess: true},
 			},
 		},
+		{
+			name: "labels expression more permissive than another role",
+			roleSet: RoleSet{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.WindowsDesktopLogins = []string{"admin"}
+					r.Spec.Allow.NodeLabels = types.Labels{"win_version": []string{"2012"}}
+				}),
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.WindowsDesktopLabels = nil
+					r.Spec.Allow.WindowsDesktopLabelsExpression = matchAllExpression
+					r.Spec.Allow.WindowsDesktopLogins = []string{"root", "admin"}
+				}),
+			},
+			checks: []check{
+				{desktop: desktopNoLabels, login: "root", hasAccess: true},
+				{desktop: desktopNoLabels, login: "admin", hasAccess: true},
+				{desktop: desktop2012, login: "root", hasAccess: true},
+				{desktop: desktop2012, login: "admin", hasAccess: true},
+			},
+		},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			for i, check := range test.checks {
 				msg := fmt.Sprintf("check=%d, user=%v, server=%v, should_have_access=%v",
 					i, check.login, check.desktop.GetName(), check.hasAccess)
-				err := test.roleSet.checkAccess(check.desktop, AccessState{}, NewWindowsLoginMatcher(check.login))
+				err := test.roleSet.checkAccess(check.desktop, wrappers.Traits{}, AccessState{}, NewWindowsLoginMatcher(check.login))
 				if check.hasAccess {
 					require.NoError(t, err, msg)
 				} else {
@@ -5716,12 +5888,25 @@ func TestCheckAccessToUserGroups(t *testing.T) {
 				{userGroup: userGroupLabels, hasAccess: true},
 			},
 		},
+		{
+			name: "labels expression, access",
+			roleSet: RoleSet{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Deny.Namespaces = []string{apidefaults.Namespace}
+					r.Spec.Allow.GroupLabelsExpression = matchAllExpression
+				}),
+			},
+			checks: []check{
+				{userGroup: userGroupNoLabels, hasAccess: true},
+				{userGroup: userGroupLabels, hasAccess: true},
+			},
+		},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			for i, check := range test.checks {
 				msg := fmt.Sprintf("check=%d, userGroup=%v, should_have_access=%v",
 					i, check.userGroup.GetName(), check.hasAccess)
-				err := test.roleSet.checkAccess(check.userGroup, AccessState{})
+				err := test.roleSet.checkAccess(check.userGroup, wrappers.Traits{}, AccessState{})
 				if check.hasAccess {
 					require.NoError(t, err, msg)
 				} else {
@@ -5792,6 +5977,7 @@ func BenchmarkCheckAccessToServer(b *testing.B) {
 			},
 		})
 	}
+	userTraits := wrappers.Traits{}
 
 	// Initialization is complete, start the benchmark timer.
 	b.ResetTimer()
@@ -5812,6 +5998,7 @@ func BenchmarkCheckAccessToServer(b *testing.B) {
 				// is testing the performance of failed RBAC checks
 				_ = set.checkAccess(
 					servers[i],
+					userTraits,
 					AccessState{},
 					NewLoginMatcher(login),
 				)
@@ -6000,11 +6187,9 @@ func TestCheckKubeGroupsAndUsers(t *testing.T) {
 		Metadata: types.Metadata{Name: "roleA", Namespace: apidefaults.Namespace},
 		Spec: types.RoleSpecV6{
 			Allow: types.RoleConditions{
-				KubeGroups: []string{"system:masters"},
-				KubeUsers:  []string{"dev-user"},
-				KubernetesLabels: map[string]apiutils.Strings{
-					"env": []string{"dev"},
-				},
+				KubeGroups:                 []string{"system:masters"},
+				KubeUsers:                  []string{"dev-user"},
+				KubernetesLabelsExpression: `labels["env"] == "dev"`,
 			},
 		},
 	}
@@ -6289,9 +6474,11 @@ func TestCheckKubeGroupsAndUsers(t *testing.T) {
 		},
 	}
 
+	var userTraits wrappers.Traits
+
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			matcher := NewKubernetesClusterLabelMatcher(tc.kubeResLabels)
+			matcher := NewKubernetesClusterLabelMatcher(tc.kubeResLabels, userTraits)
 			gotGroups, gotUsers, err := tc.roles.CheckKubeGroupsAndUsers(time.Hour, true, matcher)
 			if tc.errorFunc == nil {
 				require.NoError(t, err)
@@ -6305,6 +6492,194 @@ func TestCheckKubeGroupsAndUsers(t *testing.T) {
 	}
 }
 
+func TestWindowsDesktopGroups(t *testing.T) {
+	t.Parallel()
+	for _, tc := range []struct {
+		desc          string
+		roles         []types.Role
+		desktopLabels map[string]string
+		expectDenied  bool
+		expectGroups  []string
+	}{
+		{
+			desc: "allow labels",
+			roles: []types.Role{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.WindowsDesktopLabels = types.Labels{"env": {"prod"}}
+					r.Spec.Allow.DesktopGroups = []string{"a", "b", "c"}
+					r.Spec.Options.CreateDesktopUser = types.NewBoolOption(true)
+				}),
+			},
+			desktopLabels: map[string]string{"env": "prod"},
+			expectGroups:  []string{"a", "b", "c"},
+		},
+		{
+			desc: "allow expression",
+			roles: []types.Role{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.WindowsDesktopLabels = nil
+					r.Spec.Allow.WindowsDesktopLabelsExpression = `labels["env"] == "prod"`
+					r.Spec.Allow.DesktopGroups = []string{"a", "b", "c"}
+					r.Spec.Options.CreateDesktopUser = types.NewBoolOption(true)
+				}),
+			},
+			desktopLabels: map[string]string{"env": "prod"},
+			expectGroups:  []string{"a", "b", "c"},
+		},
+		{
+			desc: "option denied",
+			roles: []types.Role{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.WindowsDesktopLabels = types.Labels{"*": {"*"}}
+					r.Spec.Allow.DesktopGroups = []string{"a", "b", "c"}
+					r.Spec.Options.CreateDesktopUser = types.NewBoolOption(true)
+				}),
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.WindowsDesktopLabels = types.Labels{"env": {"prod"}}
+					r.Spec.Options.CreateDesktopUser = types.NewBoolOption(false)
+				}),
+			},
+			desktopLabels: map[string]string{"env": "prod"},
+			expectDenied:  true,
+		},
+		{
+			desc: "irrelevant deny",
+			roles: []types.Role{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.WindowsDesktopLabels = types.Labels{"*": {"*"}}
+					r.Spec.Allow.DesktopGroups = []string{"a", "b", "c"}
+					r.Spec.Options.CreateDesktopUser = types.NewBoolOption(true)
+				}),
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.WindowsDesktopLabels = types.Labels{"env": {"prod"}}
+					r.Spec.Options.CreateDesktopUser = types.NewBoolOption(false)
+				}),
+			},
+			desktopLabels: map[string]string{"env": "staging"},
+			expectGroups:  []string{"a", "b", "c"},
+		},
+		{
+			desc: "one group denied",
+			roles: []types.Role{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.WindowsDesktopLabels = types.Labels{"env": {"prod"}}
+					r.Spec.Allow.DesktopGroups = []string{"a", "b", "c"}
+					r.Spec.Options.CreateDesktopUser = types.NewBoolOption(true)
+				}),
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Deny.WindowsDesktopLabels = nil
+					r.Spec.Deny.WindowsDesktopLabelsExpression = matchAllExpression
+					r.Spec.Deny.DesktopGroups = []string{"b"}
+					r.Spec.Options.CreateDesktopUser = types.NewBoolOption(true)
+				}),
+			},
+			desktopLabels: map[string]string{"env": "prod"},
+			expectGroups:  []string{"a", "c"},
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			desktop := mustMakeTestWindowsDesktop(tc.desktopLabels)
+			set := NewRoleSet(tc.roles...)
+			accessChecker := makeAccessCheckerWithRoleSet(set)
+			groups, err := accessChecker.DesktopGroups(desktop)
+			if tc.expectDenied {
+				require.True(t, trace.IsAccessDenied(err), "expected access denied error, got %v", err)
+				return
+			}
+			require.NoError(t, err, trace.DebugReport(err))
+			require.ElementsMatch(t, tc.expectGroups, groups)
+		})
+	}
+}
+
+func TestGetKubeResources(t *testing.T) {
+	t.Parallel()
+	podA := types.KubernetesResource{
+		Kind:      types.KindKubePod,
+		Namespace: "test",
+		Name:      "podA",
+	}
+	podB := types.KubernetesResource{
+		Kind:      types.KindKubePod,
+		Namespace: "test",
+		Name:      "podB",
+	}
+	for _, tc := range []struct {
+		desc                        string
+		roles                       []types.Role
+		clusterLabels               map[string]string
+		expectAllowed, expectDenied []types.KubernetesResource
+	}{
+		{
+			desc: "labels allow",
+			roles: []types.Role{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.KubernetesLabels = types.Labels{"env": {"prod"}}
+					r.Spec.Allow.KubernetesResources = []types.KubernetesResource{podA, podB}
+				}),
+			},
+			clusterLabels: map[string]string{"env": "prod"},
+			expectAllowed: []types.KubernetesResource{podA, podB},
+		},
+		{
+			desc: "labels expression allow",
+			roles: []types.Role{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.KubernetesLabelsExpression = `labels["env"] == "prod"`
+					r.Spec.Allow.KubernetesResources = []types.KubernetesResource{podA, podB}
+				}),
+			},
+			clusterLabels: map[string]string{"env": "prod"},
+			expectAllowed: []types.KubernetesResource{podA, podB},
+		},
+		{
+			desc: "one denied",
+			roles: []types.Role{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.KubernetesLabelsExpression = `labels["env"] == "prod"`
+					r.Spec.Allow.KubernetesResources = []types.KubernetesResource{podA, podB}
+				}),
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Deny.KubernetesLabels = types.Labels{"env": {"prod"}}
+					r.Spec.Deny.KubernetesResources = []types.KubernetesResource{podA}
+				}),
+			},
+			clusterLabels: map[string]string{"env": "prod"},
+			expectAllowed: []types.KubernetesResource{podA, podB},
+			expectDenied:  []types.KubernetesResource{podA},
+		},
+		{
+			desc: "irrelevant deny",
+			roles: []types.Role{
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Allow.KubernetesLabelsExpression = `labels["env"] == "staging"`
+					r.Spec.Allow.KubernetesResources = []types.KubernetesResource{podA, podB}
+				}),
+				newRole(func(r *types.RoleV6) {
+					r.Spec.Deny.KubernetesLabels = types.Labels{"env": {"prod"}}
+					r.Spec.Deny.KubernetesResources = []types.KubernetesResource{podA}
+				}),
+			},
+			clusterLabels: map[string]string{"env": "staging"},
+			expectAllowed: []types.KubernetesResource{podA, podB},
+			expectDenied:  []types.KubernetesResource{podA},
+		},
+	} {
+		t.Run(tc.desc, func(t *testing.T) {
+			cluster, err := types.NewKubernetesClusterV3(types.Metadata{
+				Name:   "testcluster",
+				Labels: tc.clusterLabels,
+			}, types.KubernetesClusterSpecV3{})
+			require.NoError(t, err)
+			set := NewRoleSet(tc.roles...)
+			accessChecker := makeAccessCheckerWithRoleSet(set)
+			allowed, denied := accessChecker.GetKubeResources(cluster)
+			require.ElementsMatch(t, tc.expectAllowed, allowed, "allow list mismatch")
+			require.ElementsMatch(t, tc.expectDenied, denied, "deny list mismatch")
+		})
+	}
+}
+
 func TestSessionRecordingMode(t *testing.T) {
 	tests := map[string]struct {
 		service      constants.SessionRecordingService
@@ -6392,6 +6767,7 @@ func TestHostUsers_getGroups(t *testing.T) {
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6424,6 +6800,7 @@ func TestHostUsers_getGroups(t *testing.T) {
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6463,6 +6840,7 @@ func TestHostUsers_getGroups(t *testing.T) {
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6472,7 +6850,8 @@ func TestHostUsers_getGroups(t *testing.T) {
 		},
 	} {
 		t.Run(tc.test, func(t *testing.T) {
-			info, err := tc.roles.HostUsers(tc.server)
+			accessChecker := makeAccessCheckerWithRoleSet(tc.roles)
+			info, err := accessChecker.HostUsers(tc.server)
 			require.NoError(t, err)
 			require.Equal(t, tc.groups, info.Groups)
 		})
@@ -6502,6 +6881,7 @@ func TestHostUsers_HostSudoers(t *testing.T) {
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6550,6 +6930,7 @@ func TestHostUsers_HostSudoers(t *testing.T) {
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6582,6 +6963,7 @@ func TestHostUsers_HostSudoers(t *testing.T) {
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6617,6 +6999,7 @@ func TestHostUsers_HostSudoers(t *testing.T) {
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6668,6 +7051,7 @@ func TestHostUsers_HostSudoers(t *testing.T) {
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6719,6 +7103,7 @@ func TestHostUsers_HostSudoers(t *testing.T) {
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6728,7 +7113,8 @@ func TestHostUsers_HostSudoers(t *testing.T) {
 		},
 	} {
 		t.Run(tc.test, func(t *testing.T) {
-			info, err := tc.roles.HostUsers(tc.server)
+			accessChecker := makeAccessCheckerWithRoleSet(tc.roles)
+			info, err := accessChecker.HostUsers(tc.server)
 			require.NoError(t, err)
 			require.Equal(t, tc.sudoers, info.Sudoers)
 		})
@@ -6737,15 +7123,45 @@ func TestHostUsers_HostSudoers(t *testing.T) {
 
 func TestHostUsers_CanCreateHostUser(t *testing.T) {
 	t.Parallel()
-	for _, tc := range []struct {
-		test      string
-		canCreate bool
-		roles     RoleSet
-		server    types.Server
-	}{
+	type testCase struct {
+		test         string
+		canCreate    bool
+		roles        RoleSet
+		server       types.Server
+		expectedMode types.CreateHostUserMode
+	}
+
+	createDefaultTCWithMode := func(name string, canCreate bool, mode types.CreateHostUserMode) testCase {
+		return testCase{
+			test:         name,
+			canCreate:    canCreate,
+			expectedMode: mode,
+			roles: NewRoleSet(&types.RoleV6{
+				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CreateHostUserMode: mode,
+					},
+					Allow: types.RoleConditions{
+						NodeLabels: types.Labels{"success": []string{"abc"}},
+					},
+				},
+			}),
+			server: &types.ServerV2{
+				Kind: types.KindNode,
+				Metadata: types.Metadata{
+					Labels: map[string]string{
+						"success": "abc",
+					},
+				},
+			},
+		}
+	}
+
+	for _, tc := range []testCase{
 		{
-			test:      "test exact match, one role, can create",
-			canCreate: true,
+			test:         "test exact match, one role, can create",
+			canCreate:    true,
+			expectedMode: types.CreateHostUserMode_HOST_USER_MODE_DROP,
 			roles: NewRoleSet(&types.RoleV6{
 				Spec: types.RoleSpecV6{
 					Options: types.RoleOptions{
@@ -6757,6 +7173,7 @@ func TestHostUsers_CanCreateHostUser(t *testing.T) {
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6765,8 +7182,9 @@ func TestHostUsers_CanCreateHostUser(t *testing.T) {
 			},
 		},
 		{
-			test:      "test two roles, 1 exact match, one can create",
-			canCreate: false,
+			test:         "test two roles, 1 exact match, one can create",
+			canCreate:    false,
+			expectedMode: types.CreateHostUserMode_HOST_USER_MODE_DROP,
 			roles: NewRoleSet(&types.RoleV6{
 				Spec: types.RoleSpecV6{
 					Options: types.RoleOptions{
@@ -6782,11 +7200,12 @@ func TestHostUsers_CanCreateHostUser(t *testing.T) {
 						CreateHostUser: types.NewBoolOption(false),
 					},
 					Allow: types.RoleConditions{
-						NodeLabels: types.Labels{"success": []string{"abc"}},
+						NodeLabelsExpression: `labels["success"] == "abc"`,
 					},
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6795,8 +7214,9 @@ func TestHostUsers_CanCreateHostUser(t *testing.T) {
 			},
 		},
 		{
-			test:      "test three roles, 2 exact match, both can create",
-			canCreate: true,
+			test:         "test three roles, 2 exact match, both can create",
+			canCreate:    true,
+			expectedMode: types.CreateHostUserMode_HOST_USER_MODE_DROP,
 			roles: NewRoleSet(&types.RoleV6{
 				Spec: types.RoleSpecV6{
 					Options: types.RoleOptions{
@@ -6812,7 +7232,7 @@ func TestHostUsers_CanCreateHostUser(t *testing.T) {
 						CreateHostUser: types.NewBoolOption(true),
 					},
 					Allow: types.RoleConditions{
-						NodeLabels: types.Labels{"success": []string{"abc"}},
+						NodeLabelsExpression: `labels["success"] == "abc"`,
 					},
 				},
 			}, &types.RoleV6{
@@ -6826,6 +7246,124 @@ func TestHostUsers_CanCreateHostUser(t *testing.T) {
 				},
 			}),
 			server: &types.ServerV2{
+				Kind: types.KindNode,
+				Metadata: types.Metadata{
+					Labels: map[string]string{
+						"success": "abc",
+					},
+				},
+			},
+		},
+		{
+			test:      "test cant create when create host user is nil",
+			canCreate: false,
+			roles: NewRoleSet(&types.RoleV6{
+				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CreateHostUser: nil,
+					},
+					Allow: types.RoleConditions{
+						NodeLabels: types.Labels{"success": []string{"abc"}},
+					},
+				},
+			}),
+			server: &types.ServerV2{
+				Kind: types.KindNode,
+				Metadata: types.Metadata{
+					Labels: map[string]string{
+						"success": "abc",
+					},
+				},
+			},
+		},
+		createDefaultTCWithMode(
+			"test cant create when create host user mode is off",
+			false,
+			types.CreateHostUserMode_HOST_USER_MODE_OFF,
+		),
+		createDefaultTCWithMode(
+			"test can create when create host user mode is drop",
+			true,
+			types.CreateHostUserMode_HOST_USER_MODE_DROP,
+		),
+		createDefaultTCWithMode(
+			"test can create when create host user mode is keep",
+			true,
+			types.CreateHostUserMode_HOST_USER_MODE_KEEP,
+		),
+		{
+			test:      "test three roles, 3 exact match, one off",
+			canCreate: false,
+			roles: NewRoleSet(&types.RoleV6{
+				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CreateHostUserMode: types.CreateHostUserMode_HOST_USER_MODE_KEEP,
+					},
+					Allow: types.RoleConditions{
+						NodeLabels: types.Labels{"success": []string{"abc"}},
+					},
+				},
+			}, &types.RoleV6{
+				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CreateHostUserMode: types.CreateHostUserMode_HOST_USER_MODE_OFF,
+					},
+					Allow: types.RoleConditions{
+						NodeLabels: types.Labels{"success": []string{"abc"}},
+					},
+				},
+			}, &types.RoleV6{
+				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CreateHostUserMode: types.CreateHostUserMode_HOST_USER_MODE_DROP,
+					},
+					Allow: types.RoleConditions{
+						NodeLabels: types.Labels{"success": []string{"abc"}},
+					},
+				},
+			}),
+			server: &types.ServerV2{
+				Metadata: types.Metadata{
+					Labels: map[string]string{
+						"success": "abc",
+					},
+				},
+			},
+		},
+		{
+			test:         "test three roles, 3 exact match, mode defaults to keep",
+			canCreate:    true,
+			expectedMode: types.CreateHostUserMode_HOST_USER_MODE_KEEP,
+			roles: NewRoleSet(&types.RoleV6{
+				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CreateHostUserMode: types.CreateHostUserMode_HOST_USER_MODE_KEEP,
+					},
+					Allow: types.RoleConditions{
+						NodeLabels: types.Labels{"success": []string{"abc"}},
+					},
+				},
+			}, &types.RoleV6{
+				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CreateHostUserMode: types.CreateHostUserMode_HOST_USER_MODE_KEEP,
+					},
+					Allow: types.RoleConditions{
+						NodeLabels: types.Labels{"success": []string{"abc"}},
+					},
+				},
+			}, &types.RoleV6{
+				Spec: types.RoleSpecV6{
+					Options: types.RoleOptions{
+						CreateHostUserMode: types.CreateHostUserMode_HOST_USER_MODE_KEEP,
+					},
+					Allow: types.RoleConditions{
+						NodeLabels: types.Labels{"success": []string{"abc"}},
+					},
+				},
+			}),
+			server: &types.ServerV2{
+				Kind: types.KindNode,
 				Metadata: types.Metadata{
 					Labels: map[string]string{
 						"success": "abc",
@@ -6835,8 +7373,12 @@ func TestHostUsers_CanCreateHostUser(t *testing.T) {
 		},
 	} {
 		t.Run(tc.test, func(t *testing.T) {
-			info, err := tc.roles.HostUsers(tc.server)
+			accessChecker := makeAccessCheckerWithRoleSet(tc.roles)
+			info, err := accessChecker.HostUsers(tc.server)
 			require.Equal(t, tc.canCreate, err == nil && info != nil)
+			if tc.canCreate {
+				require.Equal(t, tc.expectedMode, info.Mode)
+			}
 		})
 	}
 }
@@ -6886,12 +7428,7 @@ func (u mockCurrentUser) GetTraits() map[string][]string {
 	return u.traits
 }
 
-func TestFetchAllClusterRoles_PrefersRolesAndTraitsFromCurrentUser(t *testing.T) {
-	defaultRoles := []string{"access", "editor"}
-	defaultTraits := map[string][]string{
-		"logins": {"defaultTraitLogin"},
-	}
-
+func TestNewAccessCheckerForRemoteCluster(t *testing.T) {
 	user := mockCurrentUser{
 		roles: []string{"dev", "admin"},
 		traits: map[string][]string{
@@ -6915,52 +7452,17 @@ func TestFetchAllClusterRoles_PrefersRolesAndTraitsFromCurrentUser(t *testing.T)
 		currentUser: user,
 	}
 
-	roleSet, err := FetchAllClusterRoles(context.Background(), currentUserRoleGetter,
-		defaultRoles, defaultTraits)
-
+	accessInfo := AccessInfoFromUser(user)
+	accessChecker, err := NewAccessCheckerForRemoteCluster(context.Background(), accessInfo, "clustername", currentUserRoleGetter)
 	require.NoError(t, err)
 
 	// After sort: "admin","default-implicit-role","dev"
-	sort.Sort(SortedRoles(roleSet))
-	require.Len(t, roleSet, 3)
-	require.Contains(t, roleSet, devRole, "devRole not found in roleSet")
-	require.Contains(t, roleSet, adminRole, "adminRole not found in roleSet")
-	require.Equal(t, []string{"currentUserTraitLogin"}, roleSet[2].GetLogins(types.Allow))
-}
-
-func TestFetchAllClusterRoles_UsesDefaultRolesAndTraitsIfCurrentUserIsUnavailable(t *testing.T) {
-	defaultRoles := []string{"access", "editor"}
-	defaultTraits := map[string][]string{
-		"logins": {"defaultTraitLogin"},
-	}
-
-	accessRole := newRole(func(r *types.RoleV6) {
-		r.Metadata.Name = "access"
-		r.Spec.Allow.Logins = []string{"{{internal.logins}}"}
-	})
-	editorRole := newRole(func(r *types.RoleV6) {
-		r.Metadata.Name = "editor"
-	})
-
-	currentUserRoleGetter := mockCurrentUserRoleGetter{
-		getCurrentUserError: trace.NotImplemented("GetCurrentUser not implemented on server"),
-		nameToRole: map[string]types.Role{
-			"access": accessRole,
-			"editor": editorRole,
-		},
-	}
-
-	roleSet, err := FetchAllClusterRoles(context.Background(), currentUserRoleGetter,
-		defaultRoles, defaultTraits)
-
-	require.NoError(t, err)
-
-	// After sort: "access","default-implicit-role","editor"
-	sort.Sort(SortedRoles(roleSet))
-	require.Len(t, roleSet, 3)
-	require.Contains(t, roleSet, accessRole, "accessRole not found in roleSet")
-	require.Contains(t, roleSet, editorRole, "editorRole not found in roleSet")
-	require.Equal(t, []string{"defaultTraitLogin"}, roleSet[0].GetLogins(types.Allow))
+	roles := accessChecker.Roles()
+	sort.Sort(SortedRoles(roles))
+	require.Len(t, roles, 3)
+	require.Contains(t, roles, devRole, "devRole not found in roleSet")
+	require.Contains(t, roles, adminRole, "adminRole not found in roleSet")
+	require.Equal(t, []string{"currentUserTraitLogin"}, roles[2].GetLogins(types.Allow))
 }
 
 func TestRoleSet_GetAccessState(t *testing.T) {
@@ -7688,3 +8190,145 @@ func TestKubeResourcesMatcher(t *testing.T) {
 func boolsToSlice(v ...bool) []bool {
 	return v
 }
+
+func TestCheckAccessWithLabelExpressions(t *testing.T) {
+	t.Parallel()
+
+	resources := []types.ResourceWithLabels{
+		&types.ServerV2{Kind: types.KindNode},
+		&types.KubernetesClusterV3{Kind: types.KindKubernetesCluster},
+		&types.AppV3{Kind: types.KindApp},
+		&types.DatabaseV3{Kind: types.KindDatabase},
+		&types.DatabaseServiceV1{ResourceHeader: types.ResourceHeader{Kind: types.KindDatabaseService}},
+		&types.WindowsDesktopV3{ResourceHeader: types.ResourceHeader{Kind: types.KindWindowsDesktop}},
+		&types.WindowsDesktopServiceV3{ResourceHeader: types.ResourceHeader{Kind: types.KindWindowsDesktopService}},
+		&types.UserGroupV1{ResourceHeader: types.ResourceHeader{Kind: types.KindUserGroup}},
+	}
+	for _, r := range resources {
+		r.SetStaticLabels(map[string]string{"env": "prod"})
+	}
+	// remoteCluster doesn't implement ResourceWithLabels and access is checked
+	// with CheckAccessToRemoteCluster instead of checkAccess
+	remoteCluster := &types.RemoteClusterV3{
+		Kind: types.KindRemoteCluster,
+		Metadata: types.Metadata{
+			Labels: map[string]string{"env": "prod"},
+		},
+	}
+
+	type option string
+	const (
+		unset   option = "unset"
+		match   option = "match"
+		nomatch option = "nomatch"
+	)
+	allOptions := []option{unset, match, nomatch}
+
+	type testcase struct {
+		allowLabels, allowLabelsExpression, denyLabels, denyLabelsExpression option
+	}
+	var testcases []testcase
+	for _, al := range allOptions {
+		for _, ae := range allOptions {
+			for _, dl := range allOptions {
+				for _, de := range allOptions {
+					testcases = append(testcases, testcase{al, ae, dl, de})
+				}
+			}
+		}
+	}
+
+	matchLabels := types.Labels{"env": {"prod"}}
+	noMatchLabels := types.Labels{"env": {"staging"}}
+	matchExpression := `contains(user.spec.traits["allow-env"], labels["env"])`
+	noMatchExpression := `!contains(user.spec.traits["allow-env"], labels["env"])`
+	labelsForOption := func(o option) types.Labels {
+		switch o {
+		case match:
+			return matchLabels
+		case nomatch:
+			return noMatchLabels
+		}
+		return nil
+	}
+	expressionForOption := func(o option) string {
+		switch o {
+		case match:
+			return matchExpression
+		case nomatch:
+			return noMatchExpression
+		}
+		return ""
+	}
+	makeRole := func(tc testcase, kind string) types.Role {
+		role, err := types.NewRole("rolename", types.RoleSpecV6{})
+		require.NoError(t, err)
+		require.NoError(t, role.SetLabelMatchers(types.Allow, kind, types.LabelMatchers{
+			Labels:     labelsForOption(tc.allowLabels),
+			Expression: expressionForOption(tc.allowLabelsExpression),
+		}))
+		require.NoError(t, role.SetLabelMatchers(types.Deny, kind, types.LabelMatchers{
+			Labels:     labelsForOption(tc.denyLabels),
+			Expression: expressionForOption(tc.denyLabelsExpression),
+		}))
+		return role
+	}
+
+	expectDenied := func(tc testcase) bool {
+		return tc.denyLabels == match ||
+			tc.denyLabelsExpression == match ||
+			tc.allowLabels == nomatch ||
+			tc.allowLabelsExpression == nomatch ||
+			(tc.allowLabels == unset && tc.allowLabelsExpression == unset)
+	}
+
+	for _, resource := range resources {
+		resource := resource
+		t.Run(resource.GetKind(), func(t *testing.T) {
+			t.Parallel()
+			for _, tc := range testcases {
+				t.Run(fmt.Sprint(tc), func(t *testing.T) {
+					role := makeRole(tc, resource.GetKind())
+					rs := NewRoleSet(role)
+					accessInfo := &AccessInfo{
+						Roles: []string{role.GetName()},
+						Traits: wrappers.Traits{
+							"allow-env": {"prod"},
+						},
+					}
+					accessChecker := NewAccessCheckerWithRoleSet(accessInfo, "testcluster", rs)
+					err := accessChecker.CheckAccess(resource, AccessState{})
+					if expectDenied(tc) {
+						require.True(t, trace.IsAccessDenied(err),
+							"expected AccessDenied error, got: %v", err)
+						return
+					}
+					require.NoError(t, err, trace.DebugReport(err))
+				})
+			}
+		})
+	}
+	t.Run("remote cluster", func(t *testing.T) {
+		t.Parallel()
+		for _, tc := range testcases {
+			t.Run(fmt.Sprint(tc), func(t *testing.T) {
+				role := makeRole(tc, types.KindRemoteCluster)
+				rs := NewRoleSet(role)
+				accessInfo := &AccessInfo{
+					Roles: []string{role.GetName()},
+					Traits: wrappers.Traits{
+						"allow-env": {"prod"},
+					},
+				}
+				accessChecker := NewAccessCheckerWithRoleSet(accessInfo, "testcluster", rs)
+				err := accessChecker.CheckAccessToRemoteCluster(remoteCluster)
+				if expectDenied(tc) {
+					require.True(t, trace.IsAccessDenied(err),
+						"expected AccessDenied error, got: %v", err)
+					return
+				}
+				require.NoError(t, err, trace.DebugReport(err))
+			})
+		}
+	})
+}
diff --git a/lib/services/saml_idp_service_provider.go b/lib/services/saml_idp_service_provider.go
index 500fdbc0dbd4d..31f76648688b0 100644
--- a/lib/services/saml_idp_service_provider.go
+++ b/lib/services/saml_idp_service_provider.go
@@ -97,3 +97,21 @@ func UnmarshalSAMLIdPServiceProvider(data []byte, opts ...MarshalOption) (types.
 	}
 	return nil, trace.BadParameter("unsupported SAML IdP service provider resource version %q", h.Version)
 }
+
+// GenerateIdPServiceProviderFromFields takes `name` and `entityDescriptor` fields and returns a SAMLIdPServiceProvider.
+func GenerateIdPServiceProviderFromFields(name string, entityDescriptor string) (types.SAMLIdPServiceProvider, error) {
+	if len(name) == 0 {
+		return nil, trace.BadParameter("missing name")
+	}
+	if len(entityDescriptor) == 0 {
+		return nil, trace.BadParameter("missing entity descriptor")
+	}
+
+	var s types.SAMLIdPServiceProviderV1
+	s.SetName(name)
+	s.SetEntityDescriptor(entityDescriptor)
+	if err := s.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &s, nil
+}
diff --git a/lib/services/suite/suite.go b/lib/services/suite/suite.go
index 696cb635d7183..721e155d68a6b 100644
--- a/lib/services/suite/suite.go
+++ b/lib/services/suite/suite.go
@@ -404,7 +404,7 @@ func (s *ServicesTestSuite) ServerCRUD(t *testing.T) {
 	require.Equal(t, len(out), 0)
 
 	proxy := NewServer(types.KindProxy, "proxy1", "127.0.0.1:2023", apidefaults.Namespace)
-	require.NoError(t, s.PresenceS.UpsertProxy(proxy))
+	require.NoError(t, s.PresenceS.UpsertProxy(ctx, proxy))
 
 	out, err = s.PresenceS.GetProxies()
 	require.NoError(t, err)
@@ -412,7 +412,7 @@ func (s *ServicesTestSuite) ServerCRUD(t *testing.T) {
 	proxy.SetResourceID(out[0].GetResourceID())
 	require.Empty(t, cmp.Diff(out, []types.Server{proxy}))
 
-	err = s.PresenceS.DeleteProxy(proxy.GetName())
+	err = s.PresenceS.DeleteProxy(ctx, proxy.GetName())
 	require.NoError(t, err)
 
 	out, err = s.PresenceS.GetProxies()
@@ -425,7 +425,7 @@ func (s *ServicesTestSuite) ServerCRUD(t *testing.T) {
 	require.Equal(t, len(out), 0)
 
 	auth := NewServer(types.KindAuthServer, "auth1", "127.0.0.1:2025", apidefaults.Namespace)
-	require.NoError(t, s.PresenceS.UpsertAuthServer(auth))
+	require.NoError(t, s.PresenceS.UpsertAuthServer(ctx, auth))
 
 	out, err = s.PresenceS.GetAuthServers()
 	require.NoError(t, err)
@@ -1509,7 +1509,7 @@ func (s *ServicesTestSuite) Events(t *testing.T) {
 			crud: func(context.Context) types.Resource {
 				srv := NewServer(types.KindProxy, "srv1", "127.0.0.1:2022", apidefaults.Namespace)
 
-				err := s.PresenceS.UpsertProxy(srv)
+				err := s.PresenceS.UpsertProxy(ctx, srv)
 				require.NoError(t, err)
 
 				out, err := s.PresenceS.GetProxies()
diff --git a/lib/services/useracl.go b/lib/services/useracl.go
new file mode 100644
index 0000000000000..3b7d4ce7e3fbb
--- /dev/null
+++ b/lib/services/useracl.go
@@ -0,0 +1,192 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package services
+
+import (
+	"github.com/gravitational/teleport/api/client/proto"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+)
+
+type ResourceAccess struct {
+	List   bool `json:"list"`
+	Read   bool `json:"read"`
+	Edit   bool `json:"edit"`
+	Create bool `json:"create"`
+	Delete bool `json:"remove"`
+	Use    bool `json:"use"`
+}
+
+// UserACL is derived from a user's role set and includes
+// information as to what features the user is allowed to use.
+type UserACL struct {
+	// RecordedSessions defines access to recorded sessions.
+	RecordedSessions ResourceAccess `json:"recordedSessions"`
+	// ActiveSessions defines access to active sessions.
+	ActiveSessions ResourceAccess `json:"activeSessions"`
+	// AuthConnectors defines access to auth.connectors.
+	AuthConnectors ResourceAccess `json:"authConnectors"`
+	// Roles defines access to roles.
+	Roles ResourceAccess `json:"roles"`
+	// Users defines access to users.
+	Users ResourceAccess `json:"users"`
+	// TrustedClusters defines access to trusted clusters.
+	TrustedClusters ResourceAccess `json:"trustedClusters"`
+	// Events defines access to audit logs.
+	Events ResourceAccess `json:"events"`
+	// Tokens defines access to tokens.
+	Tokens ResourceAccess `json:"tokens"`
+	// Nodes defines access to nodes.
+	Nodes ResourceAccess `json:"nodes"`
+	// AppServers defines access to application servers
+	AppServers ResourceAccess `json:"appServers"`
+	// DBServers defines access to database servers.
+	DBServers ResourceAccess `json:"dbServers"`
+	// DB defines access to database resource.
+	DB ResourceAccess `json:"db"`
+	// KubeServers defines access to kubernetes servers.
+	KubeServers ResourceAccess `json:"kubeServers"`
+	// Desktops defines access to desktops.
+	Desktops ResourceAccess `json:"desktops"`
+	// AccessRequests defines access to access requests.
+	AccessRequests ResourceAccess `json:"accessRequests"`
+	// Billing defines access to billing information.
+	Billing ResourceAccess `json:"billing"`
+	// ConnectionDiagnostic defines access to connection diagnostics.
+	ConnectionDiagnostic ResourceAccess `json:"connectionDiagnostic"`
+	// Clipboard defines whether the user can use a shared clipboard during windows desktop sessions.
+	Clipboard bool `json:"clipboard"`
+	// DesktopSessionRecording defines whether the user's desktop sessions are being recorded.
+	DesktopSessionRecording bool `json:"desktopSessionRecording"`
+	// DirectorySharing defines whether a user is permitted to share a directory during windows desktop sessions.
+	DirectorySharing bool `json:"directorySharing"`
+	// Download defines whether the user has access to download Teleport Enterprise Binaries
+	Download ResourceAccess `json:"download"`
+	// Download defines whether the user has access to download the license
+	License ResourceAccess `json:"license"`
+	// Plugins defines whether the user has access to manage hosted plugin instances
+	Plugins ResourceAccess `json:"plugins"`
+	// Integrations defines whether the user has access to manage integrations.
+	Integrations ResourceAccess `json:"integrations"`
+	// DeviceTrust defines access to device trust.
+	DeviceTrust ResourceAccess `json:"deviceTrust"`
+	// Locks defines access to locking resources.
+	Locks ResourceAccess `json:"lock"`
+	// Assist defines access to assist feature.
+	Assist ResourceAccess `json:"assist"`
+	// SAMLIdpServiceProvider defines access to `saml_idp_service_provider` objects.
+	SAMLIdpServiceProvider ResourceAccess `json:"samlIdpServiceProvider"`
+}
+
+func hasAccess(roleSet RoleSet, ctx *Context, kind string, verbs ...string) bool {
+	for _, verb := range verbs {
+		// Since this check occurs often and does not imply the caller is trying to
+		// ResourceAccess any resource, silence any logging done on the proxy.
+		if err := roleSet.GuessIfAccessIsPossible(ctx, apidefaults.Namespace, kind, verb, true); err != nil {
+			return false
+		}
+	}
+	return true
+}
+
+func newAccess(roleSet RoleSet, ctx *Context, kind string) ResourceAccess {
+	return ResourceAccess{
+		List:   hasAccess(roleSet, ctx, kind, types.VerbList),
+		Read:   hasAccess(roleSet, ctx, kind, types.VerbRead),
+		Edit:   hasAccess(roleSet, ctx, kind, types.VerbUpdate),
+		Create: hasAccess(roleSet, ctx, kind, types.VerbCreate),
+		Delete: hasAccess(roleSet, ctx, kind, types.VerbDelete),
+		Use:    hasAccess(roleSet, ctx, kind, types.VerbUse),
+	}
+}
+
+// NewUserACL builds an ACL for a user based on their roles.
+func NewUserACL(user types.User, userRoles RoleSet, features proto.Features, desktopRecordingEnabled bool) UserACL {
+	ctx := &Context{User: user}
+	recordedSessionAccess := newAccess(userRoles, ctx, types.KindSession)
+	activeSessionAccess := newAccess(userRoles, ctx, types.KindSSHSession)
+	roleAccess := newAccess(userRoles, ctx, types.KindRole)
+	authConnectors := newAccess(userRoles, ctx, types.KindAuthConnector)
+	trustedClusterAccess := newAccess(userRoles, ctx, types.KindTrustedCluster)
+	eventAccess := newAccess(userRoles, ctx, types.KindEvent)
+	userAccess := newAccess(userRoles, ctx, types.KindUser)
+	tokenAccess := newAccess(userRoles, ctx, types.KindToken)
+	nodeAccess := newAccess(userRoles, ctx, types.KindNode)
+	appServerAccess := newAccess(userRoles, ctx, types.KindAppServer)
+	dbServerAccess := newAccess(userRoles, ctx, types.KindDatabaseServer)
+	dbAccess := newAccess(userRoles, ctx, types.KindDatabase)
+	kubeServerAccess := newAccess(userRoles, ctx, types.KindKubeServer)
+	requestAccess := newAccess(userRoles, ctx, types.KindAccessRequest)
+	desktopAccess := newAccess(userRoles, ctx, types.KindWindowsDesktop)
+	cnDiagnosticAccess := newAccess(userRoles, ctx, types.KindConnectionDiagnostic)
+	samlIdpServiceProviderAccess := newAccess(userRoles, ctx, types.KindSAMLIdPServiceProvider)
+
+	var assistAccess ResourceAccess
+	if features.Assist {
+		assistAccess = newAccess(userRoles, ctx, types.KindAssistant)
+	}
+
+	var billingAccess ResourceAccess
+	if features.Cloud {
+		billingAccess = newAccess(userRoles, ctx, types.KindBilling)
+	}
+
+	var pluginsAccess ResourceAccess
+	if features.Plugins {
+		pluginsAccess = newAccess(userRoles, ctx, types.KindPlugin)
+	}
+
+	clipboard := userRoles.DesktopClipboard()
+	desktopSessionRecording := desktopRecordingEnabled && userRoles.RecordDesktopSession()
+	directorySharing := userRoles.DesktopDirectorySharing()
+	download := newAccess(userRoles, ctx, types.KindDownload)
+	license := newAccess(userRoles, ctx, types.KindLicense)
+	deviceTrust := newAccess(userRoles, ctx, types.KindDevice)
+	integrationsAccess := newAccess(userRoles, ctx, types.KindIntegration)
+	lockAccess := newAccess(userRoles, ctx, types.KindLock)
+
+	return UserACL{
+		AccessRequests:          requestAccess,
+		AppServers:              appServerAccess,
+		DBServers:               dbServerAccess,
+		DB:                      dbAccess,
+		KubeServers:             kubeServerAccess,
+		Desktops:                desktopAccess,
+		AuthConnectors:          authConnectors,
+		TrustedClusters:         trustedClusterAccess,
+		RecordedSessions:        recordedSessionAccess,
+		ActiveSessions:          activeSessionAccess,
+		Roles:                   roleAccess,
+		Events:                  eventAccess,
+		Users:                   userAccess,
+		Tokens:                  tokenAccess,
+		Nodes:                   nodeAccess,
+		Billing:                 billingAccess,
+		ConnectionDiagnostic:    cnDiagnosticAccess,
+		Clipboard:               clipboard,
+		DesktopSessionRecording: desktopSessionRecording,
+		DirectorySharing:        directorySharing,
+		Download:                download,
+		License:                 license,
+		Plugins:                 pluginsAccess,
+		Integrations:            integrationsAccess,
+		DeviceTrust:             deviceTrust,
+		Locks:                   lockAccess,
+		Assist:                  assistAccess,
+		SAMLIdpServiceProvider:  samlIdpServiceProviderAccess,
+	}
+}
diff --git a/lib/services/useracl_test.go b/lib/services/useracl_test.go
new file mode 100644
index 0000000000000..cafeeec12d0d9
--- /dev/null
+++ b/lib/services/useracl_test.go
@@ -0,0 +1,157 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package services
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestNewUserACL(t *testing.T) {
+	t.Parallel()
+
+	user := &types.UserV2{}
+
+	// set some rules
+	role1 := &types.RoleV6{}
+	role1.SetNamespaces(types.Allow, []string{apidefaults.Namespace})
+	role1.SetRules(types.Allow, []types.Rule{
+		{
+			Resources: []string{types.KindAuthConnector},
+			Verbs:     RW(),
+		},
+		{
+			Resources: []string{types.KindWindowsDesktop},
+			Verbs:     RW(),
+		},
+		{
+			Resources: []string{types.KindIntegration},
+			Verbs:     append(RW(), types.VerbUse),
+		},
+	})
+
+	// not setting the rule, or explicitly denying, both denies Access
+	role1.SetRules(types.Deny, []types.Rule{
+		{
+			Resources: []string{types.KindEvent},
+			Verbs:     RW(),
+		},
+	})
+
+	role2 := &types.RoleV6{}
+	role2.SetNamespaces(types.Allow, []string{apidefaults.Namespace})
+	role2.SetRules(types.Allow, []types.Rule{
+		{
+			Resources: []string{types.KindTrustedCluster},
+			Verbs:     RW(),
+		},
+		{
+			Resources: []string{types.KindBilling},
+			Verbs:     RO(),
+		},
+	})
+
+	roleSet := []types.Role{role1, role2}
+	userContext := NewUserACL(user, roleSet, proto.Features{}, true)
+
+	allowedRW := ResourceAccess{true, true, true, true, true, false}
+	denied := ResourceAccess{false, false, false, false, false, false}
+
+	require.Empty(t, cmp.Diff(userContext.AuthConnectors, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.TrustedClusters, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.AppServers, denied))
+	require.Empty(t, cmp.Diff(userContext.Locks, denied))
+	require.Empty(t, cmp.Diff(userContext.DBServers, denied))
+	require.Empty(t, cmp.Diff(userContext.KubeServers, denied))
+	require.Empty(t, cmp.Diff(userContext.Events, denied))
+	require.Empty(t, cmp.Diff(userContext.RecordedSessions, denied))
+	require.Empty(t, cmp.Diff(userContext.Roles, denied))
+	require.Empty(t, cmp.Diff(userContext.Users, denied))
+	require.Empty(t, cmp.Diff(userContext.Tokens, denied))
+	require.Empty(t, cmp.Diff(userContext.Nodes, denied))
+	require.Empty(t, cmp.Diff(userContext.AccessRequests, denied))
+	require.Empty(t, cmp.Diff(userContext.ConnectionDiagnostic, denied))
+	require.Empty(t, cmp.Diff(userContext.Desktops, allowedRW))
+
+	require.Empty(t, cmp.Diff(userContext.Billing, denied))
+	require.Equal(t, userContext.Clipboard, true)
+	require.Equal(t, userContext.DesktopSessionRecording, true)
+	require.Empty(t, cmp.Diff(userContext.License, denied))
+	require.Empty(t, cmp.Diff(userContext.Download, denied))
+
+	// test enabling of the 'Use' verb
+	require.Empty(t, cmp.Diff(userContext.Integrations, ResourceAccess{true, true, true, true, true, true}))
+
+	userContext = NewUserACL(user, roleSet, proto.Features{Cloud: true}, true)
+	require.Empty(t, cmp.Diff(userContext.Billing, ResourceAccess{true, true, false, false, false, false}))
+
+	// test that desktopRecordingEnabled being false overrides the roleSet.RecordDesktopSession() returning true
+	userContext = NewUserACL(user, roleSet, proto.Features{}, false)
+	require.Equal(t, userContext.DesktopSessionRecording, false)
+}
+
+func TestNewUserACLCloud(t *testing.T) {
+	t.Parallel()
+
+	user := &types.UserV2{
+		Metadata: types.Metadata{},
+	}
+
+	role := &types.RoleV6{}
+	role.SetNamespaces(types.Allow, []string{"*"})
+	role.SetRules(types.Allow, []types.Rule{
+		{
+			Resources: []string{"*"},
+			Verbs:     RW(),
+		},
+	})
+
+	role.SetWindowsLogins(types.Allow, []string{"a", "b"})
+	role.SetWindowsLogins(types.Deny, []string{"c"})
+
+	roleSet := []types.Role{role}
+
+	allowedRW := ResourceAccess{true, true, true, true, true, false}
+
+	userContext := NewUserACL(user, roleSet, proto.Features{Cloud: true}, true)
+
+	require.Empty(t, cmp.Diff(userContext.AuthConnectors, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.TrustedClusters, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.AppServers, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.DBServers, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.KubeServers, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.Events, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.RecordedSessions, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.Roles, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.Users, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.Tokens, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.Nodes, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.AccessRequests, allowedRW))
+
+	require.Equal(t, userContext.Clipboard, true)
+	require.Equal(t, userContext.DesktopSessionRecording, true)
+
+	// cloud-specific asserts
+	require.Empty(t, cmp.Diff(userContext.Billing, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.Desktops, allowedRW))
+}
diff --git a/lib/services/usergroup_test.go b/lib/services/usergroup_test.go
index 37d3192dedbae..9ebaaccacb48f 100644
--- a/lib/services/usergroup_test.go
+++ b/lib/services/usergroup_test.go
@@ -30,8 +30,7 @@ func TestUserGroupUnmarshal(t *testing.T) {
 	expected, err := types.NewUserGroup(
 		types.Metadata{
 			Name: "test-group",
-		},
-	)
+		}, types.UserGroupSpecV1{})
 	require.NoError(t, err)
 	data, err := utils.ToJSON([]byte(userGroupYAML))
 	require.NoError(t, err)
@@ -45,8 +44,7 @@ func TestUserGroupMarshal(t *testing.T) {
 	expected, err := types.NewUserGroup(
 		types.Metadata{
 			Name: "test-group",
-		},
-	)
+		}, types.UserGroupSpecV1{})
 	require.NoError(t, err)
 	data, err := MarshalUserGroup(expected)
 	require.NoError(t, err)
diff --git a/lib/services/userpreferences.go b/lib/services/userpreferences.go
new file mode 100644
index 0000000000000..fcc683e7f3128
--- /dev/null
+++ b/lib/services/userpreferences.go
@@ -0,0 +1,33 @@
+/*
+ *
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * /
+ */
+
+package services
+
+import (
+	"context"
+
+	userpreferencesv1 "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1"
+)
+
+// UserPreferences is the interface for managing user preferences.
+type UserPreferences interface {
+	// GetUserPreferences returns the user preferences for a given user.
+	GetUserPreferences(ctx context.Context, req *userpreferencesv1.GetUserPreferencesRequest) (*userpreferencesv1.GetUserPreferencesResponse, error)
+	// UpsertUserPreferences creates or updates user preferences for a given username.
+	UpsertUserPreferences(ctx context.Context, req *userpreferencesv1.UpsertUserPreferencesRequest) error
+}
diff --git a/lib/services/watcher_test.go b/lib/services/watcher_test.go
index de34725d58a2f..0224342021a01 100644
--- a/lib/services/watcher_test.go
+++ b/lib/services/watcher_test.go
@@ -137,7 +137,7 @@ func TestProxyWatcher(t *testing.T) {
 	require.NoError(t, w.WaitInitialization())
 	// Add a proxy server.
 	proxy := newProxyServer(t, "proxy1", "127.0.0.1:2023")
-	require.NoError(t, presence.UpsertProxy(proxy))
+	require.NoError(t, presence.UpsertProxy(ctx, proxy))
 
 	// The first event is always the current list of proxies.
 	select {
@@ -152,7 +152,7 @@ func TestProxyWatcher(t *testing.T) {
 
 	// Add a second proxy.
 	proxy2 := newProxyServer(t, "proxy2", "127.0.0.1:2023")
-	require.NoError(t, presence.UpsertProxy(proxy2))
+	require.NoError(t, presence.UpsertProxy(ctx, proxy2))
 
 	// Watcher should detect the proxy list change.
 	select {
@@ -165,7 +165,7 @@ func TestProxyWatcher(t *testing.T) {
 	}
 
 	// Delete the first proxy.
-	require.NoError(t, presence.DeleteProxy(proxy.GetName()))
+	require.NoError(t, presence.DeleteProxy(ctx, proxy.GetName()))
 
 	// Watcher should detect the proxy list change.
 	select {
@@ -179,7 +179,7 @@ func TestProxyWatcher(t *testing.T) {
 	}
 
 	// Delete the second proxy.
-	require.NoError(t, presence.DeleteProxy(proxy2.GetName()))
+	require.NoError(t, presence.DeleteProxy(ctx, proxy2.GetName()))
 
 	// Watcher should detect the proxy list change.
 	select {
diff --git a/lib/srv/alpnproxy/auth/auth_proxy.go b/lib/srv/alpnproxy/auth/auth_proxy.go
index 5a3cdefde0008..1a6c7af95b4d8 100644
--- a/lib/srv/alpnproxy/auth/auth_proxy.go
+++ b/lib/srv/alpnproxy/auth/auth_proxy.go
@@ -31,14 +31,14 @@ import (
 	"github.com/gravitational/teleport/api/defaults"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/multiplexer"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/srv/alpnproxy"
 	"github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
 type sitesGetter interface {
-	GetSites() ([]reversetunnel.RemoteSite, error)
+	GetSites() ([]reversetunnelclient.RemoteSite, error)
 }
 
 // NewAuthProxyDialerService create new instance of AuthProxyDialerService.
@@ -169,7 +169,7 @@ func (s *AuthProxyDialerService) dialRemoteAuthServer(ctx context.Context, clust
 		if site.GetName() != clusterName {
 			continue
 		}
-		conn, err := site.DialAuthServer(reversetunnel.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
+		conn, err := site.DialAuthServer(reversetunnelclient.DialParams{From: clientSrcAddr, OriginalClientDstAddr: clientDstAddr})
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/srv/alpnproxy/local_proxy_config_opt.go b/lib/srv/alpnproxy/local_proxy_config_opt.go
index f2af0b5ed81ae..532de01b4fcd0 100644
--- a/lib/srv/alpnproxy/local_proxy_config_opt.go
+++ b/lib/srv/alpnproxy/local_proxy_config_opt.go
@@ -42,7 +42,7 @@ type GetClusterCACertPoolFunc func(ctx context.Context) (*x509.CertPool, error)
 // already been set.
 func WithALPNConnUpgradeTest(ctx context.Context, getClusterCertPool GetClusterCACertPoolFunc) LocalProxyConfigOpt {
 	return func(config *LocalProxyConfig) error {
-		config.ALPNConnUpgradeRequired = client.IsALPNConnUpgradeRequired(config.RemoteProxyAddr, config.InsecureSkipVerify)
+		config.ALPNConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, config.RemoteProxyAddr, config.InsecureSkipVerify)
 		return trace.Wrap(WithClusterCAsIfConnUpgrade(ctx, getClusterCertPool)(config))
 	}
 }
diff --git a/lib/srv/app/aws/handler.go b/lib/srv/app/aws/handler.go
index f9e4556262a48..daec1f7528eb7 100644
--- a/lib/srv/app/aws/handler.go
+++ b/lib/srv/app/aws/handler.go
@@ -26,8 +26,6 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/sts"
-	"github.com/gravitational/oxy/forward"
-	oxyutils "github.com/gravitational/oxy/utils"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/sirupsen/logrus"
@@ -35,6 +33,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 	"github.com/gravitational/teleport/lib/srv/app/common"
 	"github.com/gravitational/teleport/lib/utils"
 	awsutils "github.com/gravitational/teleport/lib/utils/aws"
@@ -43,7 +42,7 @@ import (
 // signerHandler is an http.Handler for signing and forwarding requests to AWS API.
 type signerHandler struct {
 	// fwd is a Forwarder used to forward signed requests to AWS API.
-	fwd *forward.Forwarder
+	fwd *reverseproxy.Forwarder
 	// SignerHandlerConfig is the configuration for the handler.
 	SignerHandlerConfig
 	// closeContext is the app server close context.
@@ -53,7 +52,7 @@ type signerHandler struct {
 // SignerHandlerConfig is the awsSignerHandler configuration.
 type SignerHandlerConfig struct {
 	// Log is a logger for the handler.
-	Log logrus.FieldLogger
+	Log utils.FieldLoggerWithWriter
 	// RoundTripper is an http.RoundTripper instance used for requests.
 	RoundTripper http.RoundTripper
 	// SigningService is used to sign requests before forwarding them.
@@ -93,18 +92,15 @@ func NewAWSSignerHandler(ctx context.Context, config SignerHandlerConfig) (http.
 		SignerHandlerConfig: config,
 		closeContext:        ctx,
 	}
-	fwd, err := forward.New(
-		forward.RoundTripper(config.RoundTripper),
-		forward.ErrorHandler(oxyutils.ErrorHandlerFunc(handler.formatForwardResponseError)),
-		// Explicitly passing false here to be clear that we always want the host
-		// header to be the same as the outbound request's URL host.
-		forward.PassHostHeader(false),
+
+	var err error
+	handler.fwd, err = reverseproxy.New(
+		reverseproxy.WithRoundTripper(config.RoundTripper),
+		reverseproxy.WithLogger(config.Log),
+		reverseproxy.WithErrorHandler(reverseproxy.ErrorHandlerFunc(handler.formatForwardResponseError)),
 	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	handler.fwd = fwd
-	return handler, nil
+
+	return handler, trace.Wrap(err)
 }
 
 // formatForwardResponseError converts an error to a status code and writes the code to a response.
diff --git a/lib/srv/app/azure/handler.go b/lib/srv/app/azure/handler.go
index 7811106a73b87..4993b46d3fe09 100644
--- a/lib/srv/app/azure/handler.go
+++ b/lib/srv/app/azure/handler.go
@@ -26,8 +26,6 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
-	"github.com/gravitational/oxy/forward"
-	oxyutils "github.com/gravitational/oxy/utils"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/sirupsen/logrus"
@@ -36,6 +34,7 @@ import (
 	"github.com/gravitational/teleport/api/utils/azure"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 	"github.com/gravitational/teleport/lib/jwt"
 	"github.com/gravitational/teleport/lib/srv/app/common"
 	"github.com/gravitational/teleport/lib/utils"
@@ -46,7 +45,7 @@ type HandlerConfig struct {
 	// RoundTripper is the underlying transport given to an oxy Forwarder.
 	RoundTripper http.RoundTripper
 	// Log is the Logger.
-	Log logrus.FieldLogger
+	Log utils.FieldLoggerWithWriter
 	// Clock is used to override time in tests.
 	Clock clockwork.Clock
 
@@ -82,7 +81,7 @@ type handler struct {
 	HandlerConfig
 
 	// fwd is used to forward requests to Azure API after the handler has rewritten them.
-	fwd *forward.Forwarder
+	fwd *reverseproxy.Forwarder
 
 	// tokenCache caches access tokens.
 	tokenCache *utils.FnCache
@@ -113,18 +112,13 @@ func newAzureHandler(ctx context.Context, config HandlerConfig) (*handler, error
 		tokenCache:    tokenCache,
 	}
 
-	fwd, err := forward.New(
-		forward.RoundTripper(config.RoundTripper),
-		forward.ErrorHandler(oxyutils.ErrorHandlerFunc(svc.formatForwardResponseError)),
-		// Explicitly passing false here to be clear that we always want the host
-		// header to be the same as the outbound request's URL host.
-		forward.PassHostHeader(false),
+	svc.fwd, err = reverseproxy.New(
+		reverseproxy.WithRoundTripper(config.RoundTripper),
+		reverseproxy.WithLogger(config.Log),
+		reverseproxy.WithErrorHandler(svc.formatForwardResponseError),
 	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	svc.fwd = fwd
-	return svc, nil
+
+	return svc, trace.Wrap(err)
 }
 
 // RoundTrip handles incoming requests and forwards them to the proper API.
@@ -207,7 +201,6 @@ func getPeerKey(certs []*x509.Certificate) (crypto.PublicKey, error) {
 	}
 
 	return pk, nil
-
 }
 
 func (s *handler) replaceAuthHeaders(r *http.Request, sessionCtx *common.SessionContext, reqCopy *http.Request) error {
diff --git a/lib/srv/app/common/header.go b/lib/srv/app/common/header.go
index 2e1945a406f7d..f7c60169da5da 100644
--- a/lib/srv/app/common/header.go
+++ b/lib/srv/app/common/header.go
@@ -19,10 +19,10 @@ package common
 import (
 	"net/http"
 
-	"github.com/gravitational/oxy/forward"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 )
 
 // SetTeleportAPIErrorHeader saves the provided error in X-Teleport-API-Error header of response.
@@ -64,7 +64,7 @@ var ReservedHeaders = append([]string{
 	TeleportAWSAssumedRole,
 	TeleportAWSAssumedRoleAuthorization,
 },
-	forward.XHeaders...,
+	reverseproxy.XHeaders...,
 )
 
 // IsReservedHeader returns true if the provided header is one of headers
diff --git a/lib/srv/app/common/header_rewriter.go b/lib/srv/app/common/header_rewriter.go
index f5d15f064e556..7678f446c08d8 100644
--- a/lib/srv/app/common/header_rewriter.go
+++ b/lib/srv/app/common/header_rewriter.go
@@ -19,7 +19,7 @@ package common
 import (
 	"net/http"
 
-	"github.com/gravitational/oxy/forward"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 )
 
 const (
@@ -27,14 +27,14 @@ const (
 	sslOff = "off"
 )
 
-// HeaderRewriter delegates to oxy's rewriter and then appends its own headers.
+// HeaderRewriter delegates to rewriters and then appends its own headers.
 type HeaderRewriter struct {
-	delegates []forward.ReqRewriter
+	delegates []reverseproxy.Rewriter
 }
 
 // NewHeaderRewriter will create a new header rewriter with a number of delegates.
 // The delegates will be executed in the order supplied
-func NewHeaderRewriter(delegates ...forward.ReqRewriter) *HeaderRewriter {
+func NewHeaderRewriter(delegates ...reverseproxy.Rewriter) *HeaderRewriter {
 	return &HeaderRewriter{
 		delegates: delegates,
 	}
diff --git a/lib/srv/app/common/header_rewriter_test.go b/lib/srv/app/common/header_rewriter_test.go
index aba81e152b6a7..6b06102469eb6 100644
--- a/lib/srv/app/common/header_rewriter_test.go
+++ b/lib/srv/app/common/header_rewriter_test.go
@@ -23,8 +23,9 @@ import (
 	"net/url"
 	"testing"
 
-	"github.com/gravitational/oxy/forward"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 )
 
 func mustParseURL(urlString string) *url.URL {
@@ -56,7 +57,7 @@ func TestHeaderRewriter(t *testing.T) {
 	tests := []struct {
 		name               string
 		req                *http.Request
-		extraDelegates     []forward.ReqRewriter
+		extraDelegates     []reverseproxy.Rewriter
 		expectedHeaders    http.Header
 		expectedSSLHeader  string
 		expectedPortHeader string
@@ -69,8 +70,8 @@ func TestHeaderRewriter(t *testing.T) {
 				Header: http.Header{},
 			},
 			expectedHeaders: http.Header{
-				XForwardedSSL:          []string{sslOff},
-				forward.XForwardedPort: []string{"80"},
+				XForwardedSSL:               []string{sslOff},
+				reverseproxy.XForwardedPort: []string{"80"},
 			},
 		},
 		{
@@ -81,8 +82,8 @@ func TestHeaderRewriter(t *testing.T) {
 				Header: http.Header{},
 			},
 			expectedHeaders: http.Header{
-				XForwardedSSL:          []string{sslOff},
-				forward.XForwardedPort: []string{"12345"},
+				XForwardedSSL:               []string{sslOff},
+				reverseproxy.XForwardedPort: []string{"12345"},
 			},
 		},
 		{
@@ -94,8 +95,8 @@ func TestHeaderRewriter(t *testing.T) {
 				TLS:    &tls.ConnectionState{},
 			},
 			expectedHeaders: http.Header{
-				XForwardedSSL:          []string{sslOn},
-				forward.XForwardedPort: []string{"443"},
+				XForwardedSSL:               []string{sslOn},
+				reverseproxy.XForwardedPort: []string{"443"},
 			},
 		},
 		{
@@ -106,22 +107,22 @@ func TestHeaderRewriter(t *testing.T) {
 				Header: http.Header{},
 				TLS:    &tls.ConnectionState{},
 			},
-			extraDelegates: []forward.ReqRewriter{
+			extraDelegates: []reverseproxy.Rewriter{
 				newTestDelegate("test-1", "value-1"),
 				newTestDelegate("test-2", "value-2"),
 			},
 			expectedHeaders: http.Header{
-				XForwardedSSL:          []string{sslOn},
-				forward.XForwardedPort: []string{"12345"},
-				"test-1":               []string{"value-1"},
-				"test-2":               []string{"value-2"},
+				XForwardedSSL:               []string{sslOn},
+				reverseproxy.XForwardedPort: []string{"12345"},
+				"test-1":                    []string{"value-1"},
+				"test-2":                    []string{"value-2"},
 			},
 		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			delegates := []forward.ReqRewriter{&forward.HeaderRewriter{}}
+			delegates := []reverseproxy.Rewriter{&reverseproxy.HeaderRewriter{}}
 			delegates = append(delegates, test.extraDelegates...)
 			hr := NewHeaderRewriter(delegates...)
 
diff --git a/lib/srv/app/gcp/handler.go b/lib/srv/app/gcp/handler.go
index 3ca604556ce74..14f454aa1a657 100644
--- a/lib/srv/app/gcp/handler.go
+++ b/lib/srv/app/gcp/handler.go
@@ -24,8 +24,6 @@ import (
 	gcpcredentials "cloud.google.com/go/iam/credentials/apiv1"
 	"cloud.google.com/go/iam/credentials/apiv1/credentialspb"
 	"github.com/googleapis/gax-go/v2"
-	"github.com/gravitational/oxy/forward"
-	oxyutils "github.com/gravitational/oxy/utils"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/sirupsen/logrus"
@@ -34,6 +32,7 @@ import (
 	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 	"github.com/gravitational/teleport/lib/srv/app/common"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -65,7 +64,7 @@ type HandlerConfig struct {
 	// RoundTripper is the underlying transport given to an oxy Forwarder.
 	RoundTripper http.RoundTripper
 	// Log is the Logger.
-	Log logrus.FieldLogger
+	Log utils.FieldLoggerWithWriter
 	// Clock is used to override time in tests.
 	Clock clockwork.Clock
 	// cloudClientGCP holds a reference to GCP IAM client. Normally set in CheckAndSetDefaults, it is overridden in tests.
@@ -104,7 +103,7 @@ type handler struct {
 	HandlerConfig
 
 	// fwd is used to forward requests to GCP API after the handler has rewritten them.
-	fwd *forward.Forwarder
+	fwd *reverseproxy.Forwarder
 
 	// tokenCache caches access tokens.
 	tokenCache *utils.FnCache
@@ -135,18 +134,12 @@ func newGCPHandler(ctx context.Context, config HandlerConfig) (*handler, error)
 		tokenCache:    tokenCache,
 	}
 
-	fwd, err := forward.New(
-		forward.RoundTripper(config.RoundTripper),
-		forward.ErrorHandler(oxyutils.ErrorHandlerFunc(svc.formatForwardResponseError)),
-		// Explicitly passing false here to be clear that we always want the host
-		// header to be the same as the outbound request's URL host.
-		forward.PassHostHeader(false),
+	svc.fwd, err = reverseproxy.New(
+		reverseproxy.WithRoundTripper(config.RoundTripper),
+		reverseproxy.WithLogger(config.Log),
+		reverseproxy.WithErrorHandler(svc.formatForwardResponseError),
 	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	svc.fwd = fwd
-	return svc, nil
+	return svc, trace.Wrap(err)
 }
 
 // RoundTrip handles incoming requests and forwards them to the proper API.
diff --git a/lib/srv/app/server.go b/lib/srv/app/server.go
index a71455db33f89..e1c2bf65dad70 100644
--- a/lib/srv/app/server.go
+++ b/lib/srv/app/server.go
@@ -61,10 +61,10 @@ const (
 	connContextKey appServerContextKey = "teleport-connContextKey"
 )
 
-// ConnMonitor monitors authorized connnections and terminates them when
+// ConnMonitor monitors authorized connections and terminates them when
 // session controls dictate so.
 type ConnMonitor interface {
-	MonitorConn(ctx context.Context, authzCtx *authz.Context, conn net.Conn) (context.Context, error)
+	MonitorConn(ctx context.Context, authzCtx *authz.Context, conn net.Conn) (context.Context, net.Conn, error)
 }
 
 // Config is the configuration for an application server.
@@ -700,14 +700,25 @@ func (s *Server) HandleConnection(conn net.Conn) {
 }
 
 func (s *Server) handleConnection(conn net.Conn) (func(), error) {
+	ctx, cancel := context.WithCancel(s.closeContext)
+	tc, err := srv.NewTrackingReadConn(srv.TrackingReadConnConfig{
+		Conn:    conn,
+		Clock:   s.c.Clock,
+		Context: ctx,
+		Cancel:  cancel,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	// Proxy sends a X.509 client certificate to pass identity information,
 	// extract it and run authorization checks on it.
-	tlsConn, user, app, err := s.getConnectionInfo(s.closeContext, conn)
+	tlsConn, user, app, err := s.getConnectionInfo(s.closeContext, tc)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	ctx := authz.ContextWithUser(s.closeContext, user)
+	ctx = authz.ContextWithUser(s.closeContext, user)
 	ctx = authz.ContextWithClientAddr(ctx, conn.RemoteAddr())
 	authCtx, _, err := s.authorizeContext(ctx)
 
@@ -725,7 +736,7 @@ func (s *Server) handleConnection(conn net.Conn) (func(), error) {
 		}
 	} else {
 		// Monitor the connection an update the context.
-		ctx, err = s.c.ConnectionMonitor.MonitorConn(ctx, authCtx, conn)
+		ctx, _, err = s.c.ConnectionMonitor.MonitorConn(ctx, authCtx, tc)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/srv/app/server_test.go b/lib/srv/app/server_test.go
index 93580eddb278f..eaaf620ca71d4 100644
--- a/lib/srv/app/server_test.go
+++ b/lib/srv/app/server_test.go
@@ -38,7 +38,6 @@ import (
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/google/uuid"
 	"github.com/gorilla/websocket"
-	"github.com/gravitational/oxy/forward"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 
@@ -52,6 +51,7 @@ import (
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 	"github.com/gravitational/teleport/lib/labels"
 	"github.com/gravitational/teleport/lib/services"
 	libsession "github.com/gravitational/teleport/lib/session"
@@ -132,8 +132,8 @@ type suiteConfig struct {
 
 type fakeConnMonitor struct{}
 
-func (f fakeConnMonitor) MonitorConn(ctx context.Context, authzCtx *authz.Context, conn net.Conn) (context.Context, error) {
-	return ctx, nil
+func (f fakeConnMonitor) MonitorConn(ctx context.Context, authzCtx *authz.Context, conn net.Conn) (context.Context, net.Conn, error) {
+	return ctx, conn, nil
 }
 
 func SetUpSuite(t *testing.T) *Suite {
@@ -647,7 +647,7 @@ func TestHandleConnection(t *testing.T) {
 	s := SetUpSuiteWithConfig(t, suiteConfig{
 		ValidateRequest: func(_ *Suite, r *http.Request) {
 			require.Equal(t, "on", r.Header.Get(common.XForwardedSSL))
-			require.Equal(t, "443", r.Header.Get(forward.XForwardedPort))
+			require.Equal(t, "443", r.Header.Get(reverseproxy.XForwardedPort))
 		},
 	})
 	s.checkHTTPResponse(t, s.clientCertificate, func(resp *http.Response) {
@@ -664,9 +664,9 @@ func TestHandleConnectionWS(t *testing.T) {
 	s := SetUpSuiteWithConfig(t, suiteConfig{
 		ValidateRequest: func(s *Suite, r *http.Request) {
 			require.Equal(t, "on", r.Header.Get(common.XForwardedSSL))
-			// Websockets will pass on the server port at this level due to the
-			// websocket transport header rewriter delegate.
-			require.Equal(t, s.serverPort, r.Header.Get(forward.XForwardedPort))
+			// The port is not rewritten for WebSocket requests because it uses
+			// the same port as the original request.
+			require.Equal(t, "443", r.Header.Get(reverseproxy.XForwardedPort))
 		},
 	})
 
diff --git a/lib/srv/app/session.go b/lib/srv/app/session.go
index bf3b3fede3a28..3655ca8adcf3b 100644
--- a/lib/srv/app/session.go
+++ b/lib/srv/app/session.go
@@ -25,7 +25,6 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	"github.com/gravitational/oxy/forward"
 	"github.com/gravitational/trace"
 	"github.com/gravitational/ttlmap"
 	"github.com/sirupsen/logrus"
@@ -37,6 +36,7 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/filesessions"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
 	"github.com/gravitational/teleport/lib/services"
 	rsession "github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/srv"
@@ -183,19 +183,17 @@ func (s *Server) withJWTTokenForwarder(ctx context.Context, sess *sessionChunk,
 		return trace.Wrap(err)
 	}
 
-	delegate := forward.NewHeaderRewriter()
-	fwd, err := forward.New(
-		forward.FlushInterval(100*time.Millisecond),
-		forward.RoundTripper(transport),
-		forward.Logger(logrus.StandardLogger()),
-		forward.WebsocketRewriter(common.NewHeaderRewriter(transport.ws, delegate)),
-		forward.WebsocketDial(transport.ws.dialer),
-		forward.Rewriter(common.NewHeaderRewriter(delegate)),
+	delegate := reverseproxy.NewHeaderRewriter()
+	sess.handler, err = reverseproxy.New(
+		reverseproxy.WithFlushInterval(100*time.Millisecond),
+		reverseproxy.WithRoundTripper(transport),
+		reverseproxy.WithLogger(sess.log),
+		reverseproxy.WithRewriter(common.NewHeaderRewriter(delegate)),
 	)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	sess.handler = fwd
+
 	return nil
 }
 
diff --git a/lib/srv/app/transport.go b/lib/srv/app/transport.go
index 16b376d47e662..14b646429eb75 100644
--- a/lib/srv/app/transport.go
+++ b/lib/srv/app/transport.go
@@ -24,7 +24,6 @@ import (
 	"net/url"
 	"path"
 
-	"github.com/gravitational/oxy/forward"
 	"github.com/gravitational/trace"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/exp/slices"
@@ -77,8 +76,6 @@ type transport struct {
 	tr http.RoundTripper
 
 	uri *url.URL
-
-	ws *websocketTransport
 }
 
 // newTransport creates a new transport.
@@ -108,7 +105,6 @@ func newTransport(ctx context.Context, c *transportConfig) (*transport, error) {
 		transportConfig: c,
 		uri:             uri,
 		tr:              tr,
-		ws:              newWebsocketTransport(uri, tr.TLSClientConfig.Clone(), c),
 	}, nil
 }
 
@@ -293,43 +289,3 @@ func host(addr string) string {
 	}
 	return host
 }
-
-// websocketTransport combines parameters for websockets transport.
-//
-// Implements forward.ReqRewriter.
-type websocketTransport struct {
-	uri    *url.URL
-	dialer forward.Dialer
-	c      *transportConfig
-}
-
-// newWebsocketTransport returns transport that knows how to rewrite and
-// dial websocket requests.
-func newWebsocketTransport(uri *url.URL, tlsConfig *tls.Config, c *transportConfig) *websocketTransport {
-	return &websocketTransport{
-		uri: uri,
-		dialer: func(network, address string) (net.Conn, error) {
-			// Request is going to "wss://".
-			if uri.Scheme == "https" {
-				return tls.Dial(network, address, tlsConfig)
-			}
-			// Request is going to "ws://".
-			return net.Dial(network, address)
-		},
-		c: c,
-	}
-}
-
-// Rewrite rewrites the websocket request.
-func (r *websocketTransport) Rewrite(req *http.Request) {
-	// Update scheme and host to those of the target app's to make sure
-	// it's forwarded correctly.
-	req.URL.Scheme = "ws"
-	if r.uri.Scheme == "https" {
-		req.URL.Scheme = "wss"
-	}
-	req.URL.Host = r.uri.Host
-	req.Host = r.uri.Host
-
-	rewriteHeaders(req, r.c)
-}
diff --git a/lib/srv/authhandlers.go b/lib/srv/authhandlers.go
index 11846bf41b1a2..694ab0908fb1e 100644
--- a/lib/srv/authhandlers.go
+++ b/lib/srv/authhandlers.go
@@ -583,17 +583,29 @@ func (a *ahLoginChecker) canLoginWithRBAC(cert *ssh.Certificate, ca types.CertAu
 		return trace.Wrap(err)
 	}
 
-	// we don't need to check the RBAC for the node if they are only allowed to join sessions
-	if osUser == teleport.SSHSessionJoinPrincipal && auth.RoleSupportsModeratedSessions(accessChecker.Roles()) {
-		return nil
-	}
-
 	authPref, err := a.c.AccessPoint.GetAuthPreference(ctx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	state := accessChecker.GetAccessState(authPref)
 	_, state.MFAVerified = cert.Extensions[teleport.CertExtensionMFAVerified]
+
+	// we don't need to check the RBAC for the node if they are only allowed to join sessions
+	if osUser == teleport.SSHSessionJoinPrincipal &&
+		auth.RoleSupportsModeratedSessions(accessChecker.Roles()) {
+
+		// allow joining if cluster wide MFA is not required
+		if state.MFARequired != services.MFARequiredAlways {
+			return nil
+		}
+
+		// only allow joining if the MFA ceremony was completed
+		// first if cluster wide MFA is enabled
+		if state.MFAVerified {
+			return nil
+		}
+	}
+
 	state.EnableDeviceVerification = true
 	state.DeviceVerified = dtauthz.IsSSHDeviceVerified(cert)
 
diff --git a/lib/srv/db/access_test.go b/lib/srv/db/access_test.go
index bb33b755023c7..b564c847cf40f 100644
--- a/lib/srv/db/access_test.go
+++ b/lib/srv/db/access_test.go
@@ -61,7 +61,7 @@ import (
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/multiplexer"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv"
 	"github.com/gravitational/teleport/lib/srv/alpnproxy"
@@ -807,13 +807,15 @@ func TestAccessMongoDB(t *testing.T) {
 		opts []mongodb.TestServerOption
 	}{
 		{
-			name: "new server",
-			opts: []mongodb.TestServerOption{},
+			name: "current server",
+			opts: []mongodb.TestServerOption{
+				mongodb.TestServerWireVersion(wiremessage.OpmsgWireVersion),
+			},
 		},
 		{
-			name: "old server",
+			name: "mongodb 3.6 server",
 			opts: []mongodb.TestServerOption{
-				mongodb.TestServerWireVersion(wiremessage.OpmsgWireVersion - 1),
+				mongodb.TestServerWireVersion(6),
 			},
 		},
 	}
@@ -1252,7 +1254,7 @@ type testContext struct {
 	mux            *multiplexer.Mux
 	mysqlListener  net.Listener
 	webListener    *multiplexer.WebListener
-	fakeRemoteSite *reversetunnel.FakeRemoteSite
+	fakeRemoteSite *reversetunnelclient.FakeRemoteSite
 	server         *Server
 	emitter        *eventstest.ChannelEmitter
 	databaseCA     types.CertAuthority
@@ -1988,10 +1990,10 @@ func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDa
 	}
 
 	// Establish fake reversetunnel b/w database proxy and database service.
-	testCtx.fakeRemoteSite = reversetunnel.NewFakeRemoteSite(testCtx.clusterName, proxyAuthClient)
+	testCtx.fakeRemoteSite = reversetunnelclient.NewFakeRemoteSite(testCtx.clusterName, proxyAuthClient)
 	t.Cleanup(func() { require.NoError(t, testCtx.fakeRemoteSite.Close()) })
-	tunnel := &reversetunnel.FakeServer{
-		Sites: []reversetunnel.RemoteSite{
+	tunnel := &reversetunnelclient.FakeServer{
+		Sites: []reversetunnelclient.RemoteSite{
 			testCtx.fakeRemoteSite,
 		},
 	}
@@ -2059,9 +2061,9 @@ type agentParams struct {
 	// CloudClients is the cloud API clients for database service.
 	CloudClients clients.Clients
 	// AWSMatchers is a list of AWS databases matchers.
-	AWSMatchers []services.AWSMatcher
+	AWSMatchers []types.AWSMatcher
 	// AzureMatchers is a list of Azure databases matchers.
-	AzureMatchers []services.AzureMatcher
+	AzureMatchers []types.AzureMatcher
 }
 
 func (p *agentParams) setDefaults(c *testContext) {
@@ -2183,6 +2185,7 @@ func (c *testContext) setupDatabaseServer(ctx context.Context, t *testing.T, p a
 		CloudClients:             p.CloudClients,
 		AWSMatchers:              p.AWSMatchers,
 		AzureMatchers:            p.AzureMatchers,
+		ShutdownPollPeriod:       100 * time.Millisecond,
 		discoveryResourceChecker: &fakeDiscoveryResourceChecker{},
 	})
 	require.NoError(t, err)
@@ -2533,6 +2536,40 @@ func withAzureMySQL(name, authUser, authToken string) withDatabaseOption {
 	}
 }
 
+func withAtlasMongo(name, authUser, authSession string) withDatabaseOption {
+	return func(t *testing.T, ctx context.Context, testCtx *testContext) types.Database {
+		mongoServer, err := mongodb.NewTestServer(common.TestServerConfig{
+			Name:       name,
+			AuthClient: testCtx.authClient,
+			AuthUser:   authUser,
+			AuthToken:  authSession,
+		})
+		require.NoError(t, err)
+		go mongoServer.Serve()
+		t.Cleanup(func() { mongoServer.Close() })
+		database, err := types.NewDatabaseV3(types.Metadata{
+			Name: name,
+		}, types.DatabaseSpecV3{
+			Protocol:      defaults.ProtocolMongoDB,
+			URI:           net.JoinHostPort("localhost", mongoServer.Port()),
+			DynamicLabels: dynamicLabels,
+			AWS: types.AWS{
+				AccountID: "000000000000",
+			},
+			MongoAtlas: types.MongoAtlas{
+				Name: "test",
+			},
+			CACert: string(testCtx.databaseCA.GetActiveKeys().TLS[0].Cert),
+		})
+		require.NoError(t, err)
+		testCtx.mongo[name] = testMongoDB{
+			db:       mongoServer,
+			resource: database,
+		}
+		return database
+	}
+}
+
 func withSelfHostedMongo(name string, opts ...mongodb.TestServerOption) withDatabaseOption {
 	return func(t *testing.T, ctx context.Context, testCtx *testContext) types.Database {
 		mongoServer, err := mongodb.NewTestServer(common.TestServerConfig{
diff --git a/lib/srv/db/auth_test.go b/lib/srv/db/auth_test.go
index 8a58d9db87eaf..c15ffb50c232c 100644
--- a/lib/srv/db/auth_test.go
+++ b/lib/srv/db/auth_test.go
@@ -245,6 +245,12 @@ const (
 	azureRedisToken = "azure-redis-token"
 	// elastiCacheRedisToken is a mock ElastiCache Redis token.
 	elastiCacheRedisToken = "elasticache-redis-token"
+	// atlasAuthUser is a mock Mongo Atlas IAM auth user.
+	atlasAuthUser = "arn:aws:iam::111111111111:role/alice"
+	// atlasAuthToken is a mock Mongo Atlas IAM auth token.
+	atlasAuthToken = "atlas-auth-token"
+	// atlasAuthSessionToken is a mock Mongo Atlas IAM auth session token.
+	atlasAuthSessionToken = "atlas-session-token"
 )
 
 // GetRDSAuthToken generates RDS/Aurora auth token.
@@ -291,6 +297,13 @@ func (a *testAuth) GetAzureCacheForRedisToken(ctx context.Context, sessionCtx *c
 	return azureRedisToken, nil
 }
 
+// GetAWSIAMCreds returns the AWS IAM credentials, including access key, secret
+// access key and session token.
+func (a *testAuth) GetAWSIAMCreds(ctx context.Context, sessionCtx *common.Session) (string, string, string, error) {
+	a.Infof("Generating AWS IAM credentials for %v.", sessionCtx)
+	return atlasAuthUser, atlasAuthToken, atlasAuthSessionToken, nil
+}
+
 func TestDBCertSigning(t *testing.T) {
 	authServer, err := auth.NewTestAuthServer(auth.TestAuthServerConfig{
 		Clock:       clockwork.NewFakeClockAt(time.Now()),
@@ -378,3 +391,55 @@ func TestDBCertSigning(t *testing.T) {
 		})
 	}
 }
+
+func TestMongoDBAtlas(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	testCtx := setupTestContext(ctx, t,
+		withAtlasMongo("iam-auth", atlasAuthUser, atlasAuthSessionToken),
+		withAtlasMongo("certs-auth", "", ""),
+	)
+	go testCtx.startHandlingConnections()
+	testCtx.createUserAndRole(ctx, t, "alice", "admin", []string{types.Wildcard}, []string{types.Wildcard})
+
+	for name, tt := range map[string]struct {
+		service   string
+		dbUser    string
+		expectErr require.ErrorAssertionFunc
+	}{
+		"authenticates with arn username": {
+			service:   "iam-auth",
+			dbUser:    "arn:aws:iam::111111111111:role/alice",
+			expectErr: require.NoError,
+		},
+		"disabled iam authentication": {
+			service:   "certs-auth",
+			dbUser:    "arn:aws:iam::111111111111:role/alice",
+			expectErr: require.Error,
+		},
+		"partial arn authentication": {
+			service:   "iam-auth",
+			dbUser:    "role/alice",
+			expectErr: require.NoError,
+		},
+		"IAM user arn": {
+			service:   "iam-auth",
+			dbUser:    "arn:aws:iam::111111111111:user/alice",
+			expectErr: require.Error,
+		},
+		"certs authentication": {
+			service:   "certs-auth",
+			dbUser:    "alice",
+			expectErr: require.NoError,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			conn, err := testCtx.mongoClient(ctx, "alice", tt.service, tt.dbUser)
+			tt.expectErr(t, err)
+			if err != nil {
+				require.NoError(t, conn.Disconnect(ctx))
+			}
+		})
+	}
+}
diff --git a/lib/srv/db/cloud/iam_test.go b/lib/srv/db/cloud/iam_test.go
index 40eb0863d2562..05be065b51118 100644
--- a/lib/srv/db/cloud/iam_test.go
+++ b/lib/srv/db/cloud/iam_test.go
@@ -138,7 +138,7 @@ func TestAWSIAM(t *testing.T) {
 			require.Fail(t, "Failed to wait for task is processed")
 		}
 	}
-	assumedRole := services.AssumeRole{
+	assumedRole := types.AssumeRole{
 		RoleARN:    "arn:aws:iam::123456789012:role/role-to-assume",
 		ExternalID: "externalid123",
 	}
@@ -210,7 +210,7 @@ func TestAWSIAM(t *testing.T) {
 	}
 
 	for testName, tt := range tests {
-		for _, assumeRole := range []services.AssumeRole{{}, assumedRole} {
+		for _, assumeRole := range []types.AssumeRole{{}, assumedRole} {
 			getRolePolicyInput := &iam.GetRolePolicyInput{
 				RoleName:   aws.String("test-role"),
 				PolicyName: aws.String(policyName),
diff --git a/lib/srv/db/common/auth.go b/lib/srv/db/common/auth.go
index 774dcb5d3020c..22766812e6147 100644
--- a/lib/srv/db/common/auth.go
+++ b/lib/srv/db/common/auth.go
@@ -50,6 +50,7 @@ import (
 	libauth "github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/native"
 	"github.com/gravitational/teleport/lib/cloud"
+	awslib "github.com/gravitational/teleport/lib/cloud/aws"
 	libazure "github.com/gravitational/teleport/lib/cloud/azure"
 	"github.com/gravitational/teleport/lib/cloud/gcp"
 	"github.com/gravitational/teleport/lib/defaults"
@@ -89,6 +90,9 @@ type Auth interface {
 	// attached to the current compute instance. If Teleport is not running on
 	// Azure VM returns an error.
 	GetAzureIdentityResourceID(ctx context.Context, identityName string) (string, error)
+	// GetAWSIAMCreds returns the AWS IAM credentials, including access key,
+	// secret access key and session token.
+	GetAWSIAMCreds(ctx context.Context, sessionCtx *Session) (string, string, string, error)
 	// Closer releases all resources used by authenticator.
 	io.Closer
 }
@@ -541,6 +545,12 @@ func (a *dbAuth) getTLSConfigVerifyFull(ctx context.Context, sessionCtx *Session
 		return tlsConfig, nil
 	}
 
+	// MongoDB Atlas doesn't not require client certificates if is using AWS
+	// authentication.
+	if awsutils.IsRoleARN(sessionCtx.DatabaseUser) && sessionCtx.Database.GetType() == types.DatabaseTypeMongoAtlas {
+		return tlsConfig, nil
+	}
+
 	// Otherwise, when connecting to an onprem database, generate a client
 	// certificate. The database instance should be configured with
 	// Teleport's CA obtained with 'tctl auth sign --type=db'.
@@ -822,6 +832,68 @@ func (a *dbAuth) getCurrentAzureVM(ctx context.Context) (*libazure.VirtualMachin
 	return vm, nil
 }
 
+// GetAWSIAMCreds returns the AWS IAM credentials, including access key, secret
+// access key and session token.
+func (a *dbAuth) GetAWSIAMCreds(ctx context.Context, sessionCtx *Session) (string, string, string, error) {
+	dbAWS := sessionCtx.Database.GetAWS()
+	awsAccountID := dbAWS.AccountID
+
+	if awsutils.IsPartialRoleARN(sessionCtx.DatabaseUser) && awsAccountID == "" {
+		switch {
+		case dbAWS.AssumeRoleARN != "":
+			a.cfg.Log.Debugf("Using AWS Account ID from assumed role")
+			assumeRoleARN, err := awsutils.ParseRoleARN(dbAWS.AssumeRoleARN)
+			if err != nil {
+				return "", "", "", trace.Wrap(err)
+			}
+
+			awsAccountID = assumeRoleARN.AccountID
+		default:
+			a.cfg.Log.Debugf("Fetching AWS Account ID to build role ARN")
+			stsClient, err := a.cfg.Clients.GetAWSSTSClient(ctx, dbAWS.Region)
+			if err != nil {
+				return "", "", "", trace.Wrap(err)
+			}
+
+			identity, err := awslib.GetIdentityWithClient(ctx, stsClient)
+			if err != nil {
+				return "", "", "", trace.Wrap(err)
+			}
+
+			awsAccountID = identity.GetAccountID()
+		}
+	}
+
+	arn, err := awsutils.BuildRoleARN(sessionCtx.DatabaseUser, dbAWS.Region, awsAccountID)
+	if err != nil {
+		return "", "", "", trace.Wrap(err)
+	}
+
+	baseSession, err := a.cfg.Clients.GetAWSSession(ctx, dbAWS.Region, cloud.WithAssumeRoleFromAWSMeta(dbAWS))
+	if err != nil {
+		return "", "", "", trace.Wrap(err)
+	}
+
+	// ExternalID should only be used once. If the baseSession assumes a role,
+	// the chained sessions should have an empty external ID.
+	awsExternalID := ""
+	if dbAWS.AssumeRoleARN == "" {
+		awsExternalID = dbAWS.ExternalID
+	}
+
+	sess, err := a.cfg.Clients.GetAWSSession(ctx, dbAWS.Region, cloud.WithChainedAssumeRole(baseSession, arn, awsExternalID))
+	if err != nil {
+		return "", "", "", trace.Wrap(err)
+	}
+
+	creds, err := sess.Config.Credentials.Get()
+	if err != nil {
+		return "", "", "", trace.Wrap(err)
+	}
+
+	return creds.AccessKeyID, creds.SecretAccessKey, creds.SessionToken, nil
+}
+
 // Close releases all resources used by authenticator.
 func (a *dbAuth) Close() error {
 	return a.cfg.Clients.Close()
diff --git a/lib/srv/db/common/auth_test.go b/lib/srv/db/common/auth_test.go
index 1de7ee0cc628a..eac5c33cea740 100644
--- a/lib/srv/db/common/auth_test.go
+++ b/lib/srv/db/common/auth_test.go
@@ -39,7 +39,6 @@ import (
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/fixtures"
-	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
 
@@ -455,7 +454,7 @@ func TestAuthGetAWSTokenWithAssumedRole(t *testing.T) {
 		"Redshift": {
 			database: newRedshiftDatabase(t,
 				withCA(fixtures.SAMLOktaCertPEM),
-				withAssumeRole(services.AssumeRole{
+				withAssumeRole(types.AssumeRole{
 					RoleARN:    "arn:aws:iam::123456789012:role/RedshiftRole",
 					ExternalID: "externalRedshift",
 				})),
@@ -474,7 +473,7 @@ func TestAuthGetAWSTokenWithAssumedRole(t *testing.T) {
 		},
 		"Redshift Serverless": {
 			database: newRedshiftServerlessDatabase(t,
-				withAssumeRole(services.AssumeRole{
+				withAssumeRole(types.AssumeRole{
 					RoleARN:    "arn:aws:iam::123456789012:role/RedshiftServerlessRole",
 					ExternalID: "externalRedshiftServerless",
 				})),
@@ -494,7 +493,7 @@ func TestAuthGetAWSTokenWithAssumedRole(t *testing.T) {
 		},
 		"RDS Proxy": {
 			database: newRDSProxyDatabase(t, "my-proxy.proxy-abcdefghijklmnop.us-east-1.rds.amazonaws.com:5432",
-				withAssumeRole(services.AssumeRole{
+				withAssumeRole(types.AssumeRole{
 					RoleARN:    "arn:aws:iam::123456789012:role/RDSProxyRole",
 					ExternalID: "externalRDSProxy",
 				})),
@@ -512,7 +511,7 @@ func TestAuthGetAWSTokenWithAssumedRole(t *testing.T) {
 		},
 		"ElastiCache Redis": {
 			database: newElastiCacheRedisDatabase(t,
-				withAssumeRole(services.AssumeRole{
+				withAssumeRole(types.AssumeRole{
 					RoleARN:    "arn:aws:iam::123456789012:role/RedisRole",
 					ExternalID: "externalElastiCacheRedis",
 				})),
@@ -571,6 +570,89 @@ func TestAuthGetAWSTokenWithAssumedRole(t *testing.T) {
 	}
 }
 
+func TestGetAWSIAMCreds(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+	ctx := context.Background()
+
+	for name, tt := range map[string]struct {
+		db                   types.Database
+		stsMock              *mocks.STSMock
+		username             string
+		expectedKeyId        string
+		expectedAssumedRoles []string
+		expectedExternalIDs  []string
+		expectErr            require.ErrorAssertionFunc
+	}{
+		"username is full role ARN": {
+			db:                   newMongoAtlasDatabase(t, types.AWS{}),
+			stsMock:              &mocks.STSMock{},
+			username:             "arn:aws:iam::123456789012:role/role-name",
+			expectedKeyId:        "arn:aws:iam::123456789012:role/role-name",
+			expectedAssumedRoles: []string{"arn:aws:iam::123456789012:role/role-name"},
+			expectedExternalIDs:  []string{""},
+			expectErr:            require.NoError,
+		},
+		"username is partial role ARN": {
+			db: newMongoAtlasDatabase(t, types.AWS{}),
+			stsMock: &mocks.STSMock{
+				// This is the role returned by the STS GetCallerIdentity.
+				ARN: "arn:aws:iam::222222222222:role/teleport-service-role",
+			},
+			username:             "role/role-name",
+			expectedKeyId:        "arn:aws:iam::222222222222:role/role-name",
+			expectedAssumedRoles: []string{"arn:aws:iam::222222222222:role/role-name"},
+			expectedExternalIDs:  []string{""},
+			expectErr:            require.NoError,
+		},
+		"unable to fetch account ID": {
+			db: newMongoAtlasDatabase(t, types.AWS{}),
+			stsMock: &mocks.STSMock{
+				ARN: "",
+			},
+			username:  "role/role-name",
+			expectErr: require.Error,
+		},
+		"chained IAM role": {
+			db: newMongoAtlasDatabase(t, types.AWS{
+				ExternalID:    "123123",
+				AssumeRoleARN: "arn:aws:iam::222222222222:role/teleport-service-role-external",
+			}),
+			stsMock: &mocks.STSMock{
+				ARN: "arn:aws:iam::111111111111:role/teleport-service-role",
+			},
+			username:      "role/role-name",
+			expectedKeyId: "arn:aws:iam::222222222222:role/role-name",
+			expectedAssumedRoles: []string{
+				"arn:aws:iam::222222222222:role/teleport-service-role-external",
+				"arn:aws:iam::222222222222:role/role-name",
+			},
+			expectedExternalIDs: []string{"123123", ""},
+			expectErr:           require.NoError,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			auth, err := NewAuth(AuthConfig{
+				Clock:      clock,
+				AuthClient: new(authClientMock),
+				Clients: &cloud.TestCloudClients{
+					STS: tt.stsMock,
+				},
+			})
+			require.NoError(t, err)
+
+			keyId, _, _, err := auth.GetAWSIAMCreds(ctx, &Session{
+				Database:     tt.db,
+				DatabaseUser: tt.username,
+			})
+			tt.expectErr(t, err)
+			require.Equal(t, tt.expectedKeyId, keyId)
+			require.ElementsMatch(t, tt.expectedAssumedRoles, tt.stsMock.GetAssumedRoleARNs())
+			require.ElementsMatch(t, tt.expectedExternalIDs, tt.stsMock.GetAssumedRoleExternalIDs())
+		})
+	}
+}
+
 func newAzureRedisDatabase(t *testing.T, resourceID string) types.Database {
 	t.Helper()
 
@@ -617,6 +699,23 @@ func newCloudSQLDatabase(t *testing.T, projectID, instanceID string) types.Datab
 	return database
 }
 
+func newMongoAtlasDatabase(t *testing.T, aws types.AWS) types.Database {
+	t.Helper()
+
+	database, err := types.NewDatabaseV3(types.Metadata{
+		Name: "test-database",
+	}, types.DatabaseSpecV3{
+		Protocol: defaults.ProtocolMongoDB,
+		URI:      "test.xxxxxxx.mongodb.net",
+		MongoAtlas: types.MongoAtlas{
+			Name: "test",
+		},
+		AWS: aws,
+	})
+	require.NoError(t, err)
+	return database
+}
+
 type databaseSpecOpt func(spec *types.DatabaseSpecV3)
 
 func withCA(ca string) databaseSpecOpt {
@@ -625,7 +724,7 @@ func withCA(ca string) databaseSpecOpt {
 	}
 }
 
-func withAssumeRole(assumeRole services.AssumeRole) databaseSpecOpt {
+func withAssumeRole(assumeRole types.AssumeRole) databaseSpecOpt {
 	return func(spec *types.DatabaseSpecV3) {
 		spec.AWS.AssumeRoleARN = assumeRole.RoleARN
 		spec.AWS.ExternalID = assumeRole.ExternalID
diff --git a/lib/srv/db/common/interfaces.go b/lib/srv/db/common/interfaces.go
index ea5d81fd66af4..aed2363093d62 100644
--- a/lib/srv/db/common/interfaces.go
+++ b/lib/srv/db/common/interfaces.go
@@ -22,7 +22,7 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/authz"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -59,7 +59,7 @@ type ProxyContext struct {
 	// Identity is the authorized client Identity.
 	Identity tlsca.Identity
 	// Cluster is the remote Cluster running the database server.
-	Cluster reversetunnel.RemoteSite
+	Cluster reversetunnelclient.RemoteSite
 	// Servers is a list of database Servers that proxy the requested database.
 	Servers []types.DatabaseServer
 	// AuthContext is a context of authenticated user.
diff --git a/lib/srv/db/elasticsearch/util_test.go b/lib/srv/db/elasticsearch/util_test.go
index 4560be2d137ca..9115feaf8c47f 100644
--- a/lib/srv/db/elasticsearch/util_test.go
+++ b/lib/srv/db/elasticsearch/util_test.go
@@ -132,7 +132,6 @@ func TestEngineGetQueryFromRequestBody(t *testing.T) {
 			e.Log = logrus.StandardLogger()
 
 			result := GetQueryFromRequestBody(e.EngineConfig, tt.contentType, []byte(tt.body))
-			t.Log(result)
 			require.Equal(t, tt.want, result)
 		})
 	}
diff --git a/lib/srv/db/mongodb/connect.go b/lib/srv/db/mongodb/connect.go
index 91a86da0b989e..d01c2fce11e34 100644
--- a/lib/srv/db/mongodb/connect.go
+++ b/lib/srv/db/mongodb/connect.go
@@ -19,12 +19,12 @@ package mongodb
 import (
 	"context"
 	"crypto/tls"
-	"net/url"
-	"time"
+	"strings"
 
 	"github.com/gravitational/trace"
 	"go.mongodb.org/mongo-driver/mongo/address"
 	"go.mongodb.org/mongo-driver/mongo/description"
+	"go.mongodb.org/mongo-driver/mongo/options"
 	"go.mongodb.org/mongo-driver/mongo/readpref"
 	"go.mongodb.org/mongo-driver/x/mongo/driver"
 	"go.mongodb.org/mongo-driver/x/mongo/driver/auth"
@@ -32,7 +32,19 @@ import (
 	"go.mongodb.org/mongo-driver/x/mongo/driver/ocsp"
 	"go.mongodb.org/mongo-driver/x/mongo/driver/topology"
 
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/srv/db/common"
+	awsutils "github.com/gravitational/teleport/lib/utils/aws"
+)
+
+const (
+	// awsSecretTokenKey is the authenticator property name used to pass AWS
+	// session token. This name is defined by the mongo driver.
+	awsSecretTokenKey = "AWS_SESSION_TOKEN"
+	// awsIAMSource is the authenticator source value used when authenticating
+	// using AWS IAM.
+	// https://www.mongodb.com/docs/manual/reference/connection-string/#mongodb-urioption-urioption.authSource
+	awsIAMSource = "$external"
 )
 
 // connect returns connection to a MongoDB server.
@@ -49,7 +61,7 @@ func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (drive
 	// over server connections (reading/writing wire messages) but at the
 	// same time get access to logic such as picking a server to connect to
 	// in a replica set.
-	top, err := topology.New(options...)
+	top, err := topology.New(options)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -79,35 +91,41 @@ func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (drive
 }
 
 // getTopologyOptions constructs topology options for connecting to a MongoDB server.
-func (e *Engine) getTopologyOptions(ctx context.Context, sessionCtx *common.Session) ([]topology.Option, description.ServerSelector, error) {
-	connString, err := getConnectionString(sessionCtx)
+func (e *Engine) getTopologyOptions(ctx context.Context, sessionCtx *common.Session) (*topology.Config, description.ServerSelector, error) {
+	clientCfg := options.Client()
+	clientCfg.SetServerSelectionTimeout(common.DefaultMongoDBServerSelectionTimeout)
+	if strings.HasPrefix(sessionCtx.Database.GetURI(), connstring.SchemeMongoDB) ||
+		strings.HasPrefix(sessionCtx.Database.GetURI(), connstring.SchemeMongoDBSRV) {
+		clientCfg.ApplyURI(sessionCtx.Database.GetURI())
+	} else {
+		clientCfg.Hosts = []string{sessionCtx.Database.GetURI()}
+	}
+	err := clientCfg.Validate()
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
-	selector, err := getServerSelector(connString)
+	topoConfig, err := topology.NewConfig(clientCfg, nil)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
-	serverOptions, err := e.getServerOptions(ctx, sessionCtx)
+
+	serverOptions, err := e.getServerOptions(ctx, sessionCtx, clientCfg)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
-	return []topology.Option{
-		topology.WithConnString(func(cs connstring.ConnString) connstring.ConnString {
-			return connString
-		}),
-		topology.WithServerSelectionTimeout(func(time.Duration) time.Duration {
-			return common.DefaultMongoDBServerSelectionTimeout
-		}),
-		topology.WithServerOptions(func(so ...topology.ServerOption) []topology.ServerOption {
-			return serverOptions
-		}),
-	}, selector, nil
+	topoConfig.ServerOpts = serverOptions
+
+	selector, err := getServerSelector(clientCfg)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	return topoConfig, selector, nil
 }
 
 // getServerOptions constructs server options for connecting to a MongoDB server.
-func (e *Engine) getServerOptions(ctx context.Context, sessionCtx *common.Session) ([]topology.ServerOption, error) {
-	connectionOptions, err := e.getConnectionOptions(ctx, sessionCtx)
+func (e *Engine) getServerOptions(ctx context.Context, sessionCtx *common.Session, clientCfg *options.ClientOptions) ([]topology.ServerOption, error) {
+	connectionOptions, err := e.getConnectionOptions(ctx, sessionCtx, clientCfg)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -119,15 +137,12 @@ func (e *Engine) getServerOptions(ctx context.Context, sessionCtx *common.Sessio
 }
 
 // getConnectionOptions constructs connection options for connecting to a MongoDB server.
-func (e *Engine) getConnectionOptions(ctx context.Context, sessionCtx *common.Session) ([]topology.ConnectionOption, error) {
+func (e *Engine) getConnectionOptions(ctx context.Context, sessionCtx *common.Session, clientCfg *options.ClientOptions) ([]topology.ConnectionOption, error) {
 	tlsConfig, err := e.Auth.GetTLSConfig(ctx, sessionCtx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	authenticator, err := auth.CreateAuthenticator(auth.MongoDBX509, &auth.Cred{
-		// MongoDB uses full certificate Subject field as a username.
-		Username: "CN=" + sessionCtx.DatabaseUser,
-	})
+	authenticator, err := e.getAuthenticator(ctx, sessionCtx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -148,37 +163,71 @@ func (e *Engine) getConnectionOptions(ctx context.Context, sessionCtx *common.Se
 				// client connecting to Teleport will get an error when they try
 				// to send its own metadata since client metadata is immutable.
 				&handshaker{},
-				&auth.HandshakeOptions{Authenticator: authenticator})
+				&auth.HandshakeOptions{Authenticator: authenticator, HTTPClient: clientCfg.HTTPClient})
 		}),
 	}, nil
 }
 
-// getConnectionString returns connection string for the server.
-func getConnectionString(sessionCtx *common.Session) (connstring.ConnString, error) {
-	uri, err := url.Parse(sessionCtx.Database.GetURI())
+func (e *Engine) getAuthenticator(ctx context.Context, sessionCtx *common.Session) (auth.Authenticator, error) {
+	isAtlasDB := sessionCtx.Database.GetType() == types.DatabaseTypeMongoAtlas
+
+	// Currently, the MongoDB Atlas IAM Authentication doesn't work with IAM
+	// users. Here we provide a better error message to the users.
+	if isAtlasDB && awsutils.IsUserARN(sessionCtx.DatabaseUser) {
+		return nil, trace.BadParameter("MongoDB Atlas AWS IAM Authentication with IAM users is not supported.")
+	}
+
+	switch {
+	case isAtlasDB && awsutils.IsRoleARN(sessionCtx.DatabaseUser):
+		return e.getAWSAuthenticator(ctx, sessionCtx)
+	default:
+		e.Log.Debug("Authenticating to database using certificates.")
+		authenticator, err := auth.CreateAuthenticator(auth.MongoDBX509, &auth.Cred{
+			// MongoDB uses full certificate Subject field as a username.
+			Username: "CN=" + sessionCtx.DatabaseUser,
+		})
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return authenticator, nil
+	}
+}
+
+// getAWSAuthenticator fetches the AWS credentials and initializes the MongoDB
+// authenticator.
+func (e *Engine) getAWSAuthenticator(ctx context.Context, sessionCtx *common.Session) (auth.Authenticator, error) {
+	e.Log.Debug("Authenticating to database using AWS IAM authentication.")
+
+	username, password, sessToken, err := e.Auth.GetAWSIAMCreds(ctx, sessionCtx)
 	if err != nil {
-		return connstring.ConnString{}, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
-	switch uri.Scheme {
-	case connstring.SchemeMongoDB, connstring.SchemeMongoDBSRV:
-		return connstring.ParseAndValidate(sessionCtx.Database.GetURI())
+
+	authenticator, err := auth.CreateAuthenticator(auth.MongoDBAWS, &auth.Cred{
+		Source:   awsIAMSource,
+		Username: username,
+		Password: password,
+		Props: map[string]string{
+			awsSecretTokenKey: sessToken,
+		},
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
-	return connstring.ConnString{Hosts: []string{sessionCtx.Database.GetURI()}}, nil
+
+	return authenticator, nil
 }
 
 // getServerSelector returns selector for picking the server to connect to,
 // which is mostly useful when connecting to a MongoDB replica set.
 //
 // It uses readPreference connection flag. Defaults to "primary".
-func getServerSelector(connString connstring.ConnString) (description.ServerSelector, error) {
-	if connString.ReadPreference == "" {
+func getServerSelector(clientOptions *options.ClientOptions) (description.ServerSelector, error) {
+	if clientOptions.ReadPreference == nil {
 		return description.ReadPrefSelector(readpref.Primary()), nil
 	}
-	readPrefMode, err := readpref.ModeFromString(connString.ReadPreference)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	readPref, err := readpref.New(readPrefMode)
+	readPref, err := readpref.New(clientOptions.ReadPreference.Mode())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/srv/db/mongodb/protocol/fuzz_test.go b/lib/srv/db/mongodb/protocol/fuzz_test.go
index 5bf92d850e840..bcd3ceb6ac8bd 100644
--- a/lib/srv/db/mongodb/protocol/fuzz_test.go
+++ b/lib/srv/db/mongodb/protocol/fuzz_test.go
@@ -18,80 +18,136 @@ package protocol
 
 import (
 	"bytes"
+	"crypto/rand"
+	"encoding/binary"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 )
 
+// prefixLength adds the length to the bytes, used in the header for valid full message parsing
+func prefixLength(bytes []byte) []byte {
+	length := uint32(len(bytes)) + 4 // add 4 for the 32bit length itself
+	resultBytes := make([]byte, length)
+	binary.LittleEndian.PutUint32(resultBytes, length)
+	copy(resultBytes[4:], bytes)
+	return resultBytes
+}
+
+// prefixID will add a random 4 byte id.  This is typically used for building the header which needs a request
+// followed by response id.
+func prefixID(bytes []byte) []byte {
+	prefix := make([]byte, 4)
+	_, err := rand.Read(prefix)
+	if err != nil {
+		panic(err)
+	}
+	return append(prefix, bytes...)
+}
+
 func FuzzMongoRead(f *testing.F) {
-	f.Add([]byte{})
+	// normal op msg single document
+	f.Add(prefixLength(prefixID(prefixID([]byte{0xdd, 0x7, 0x0, 0x0, // (end header) op code
+		0x30, 0x30, 0x30, 0x30, // msg flags
+		0x0,                // section type
+		0x5, 0x0, 0x0, 0x0, // msg size
+		0x20})))) // msg
+	// normal op query
+	f.Add(prefixLength(prefixID(prefixID([]byte{0xd4, 0x7, 0x0, 0x0, // (end header) op code
+		0x30, 0x30, 0x30, 0x30, // read flags
+		0x0,                // collection name
+		0x0, 0x0, 0x0, 0x0, // skip number
+		0x1, 0x0, 0x0, 0x0, // return number
+		0x5, 0x0, 0x0, 0x0, // msg size
+		0x20})))) // msg
+	// normal op get more
+	f.Add(prefixLength(prefixID(prefixID([]byte{0xd5, 0x7, 0x0, 0x0, // (end header) op code
+		0x30, 0x30, 0x30, 0x30, // zero
+		0x0,                // collection name
+		0x1, 0x0, 0x0, 0x0, // return number
+		0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})))) // cursor id
+	// normal op insert
+	f.Add(prefixLength(prefixID(prefixID([]byte{0xd2, 0x7, 0x0, 0x0, // (end header) op code
+		0x30, 0x30, 0x30, 0x30, // insert flags
+		0x0,                // collection name
+		0x5, 0x0, 0x0, 0x0, // document size
+		0x20,               // document
+		0x6, 0x0, 0x0, 0x0, // document size
+		0x20, 0x20})))) // document
+	// normal op update
+	f.Add(prefixLength(prefixID(prefixID([]byte{0xd1, 0x7, 0x0, 0x0, // (end header) op code
+		0x30, 0x30, 0x30, 0x30, // zero
+		0x0,                    // collection name
+		0x30, 0x30, 0x30, 0x30, // flags
+		0x5, 0x0, 0x0, 0x0, // select document size
+		0x20,               // select document
+		0x6, 0x0, 0x0, 0x0, // update document size
+		0x20, 0x20})))) // update document
+	// normal op delete
+	f.Add(prefixLength(prefixID(prefixID([]byte{0xd6, 0x7, 0x0, 0x0, // (end header) op code
+		0x30, 0x30, 0x30, 0x30, // zero
+		0x0,                    // collection name
+		0x30, 0x30, 0x30, 0x30, // flags
+		0x5, 0x0, 0x0, 0x0, // document size
+		0x20})))) // document
+	// normal op reply
+	f.Add([]byte{0x30, 0x0, 0x0, 0x0, // (start header) length
+		0x30, 0x30, 0x40, 0x30, // request id
+		0x30, 0x30, 0x30, 0x30, // response to
+		0x1, 0x0, 0x0, 0x0, // (end header) op code
+		0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30,
+		0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x1, 0x0, 0x0, 0x0, 0x0, 0x30,
+		0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30})
+	// normal op kill cursor
+	f.Add(prefixLength(prefixID(prefixID([]byte{0xd7, 0x7, 0x0, 0x0, // (end header) op code
+		0x30, 0x30, 0x30, 0x30, // zero
+		0x2, 0x0, 0x0, 0x0, // cursor id count
+		0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, // cursor id
+		0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22})))) // cursor id
+	// typical header start seed
+	f.Add([]byte{0x1a, 0x0, 0x0, 0x0, // arbitrary length for fuzz to fill in suffix of
+		0x30, 0x30, 0x11, 0x30, 0x30, 0x30, 0x30, 0x30})
+	// large decompression test (Zstd mode but large size declared early)
+	f.Add([]byte{0x1b, 0x0, 0x0, 0x0, 0x30, 0x30, 0x30, 0x30, 0x7f, 0x30, 0x30, 0x30,
+		0xdc, 0x7, 0x0, 0x0, // op code
+		0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x3, 0x30, 0x30})
+	// large Snappy decompression (size declared small till Snappy size decoded)
+	f.Add([]byte{0x20, 0x0, 0x0, 0x0, 0x30, 0x30, 0x30, 0x30, 0x50, 0x30, 0x30, 0x30,
+		0xdc, 0x7, 0x0, 0x0, // op code
+		0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x0, 0x1, 0xf5, 0xf5, 0xf6,
+		0x80, 0xe, 0x30, 0x30, 0x30, 0x30, 0x30})
+	// op msg with too small of msg
+	f.Add([]byte{0x20, 0x0, 0x0, 0x0, // (start header) length
+		0x30, 0x30, 0x11, 0x30, // request id
+		0x30, 0x30, 0x30, 0x30, // response to
+		0xdd, 0x7, 0x0, 0x0, // (end header) op code
+		0x30, 0x30, 0x30, 0x30, 0x30, 0x1, 0xa, 0x0, 0x0, 0x0, 0x0,
+		0x0, 0x0, 0x0, 0xF, // msg size
+		0x20})
+	// op msg sequence without body
+	f.Add([]byte{0x20, 0x0, 0x0, 0x0, // (start header) length
+		0x30, 0x30, 0x11, 0x30, // request id
+		0x30, 0x30, 0x30, 0x30, // response to
+		0xdd, 0x7, 0x0, 0x0, // (end header) op code
+		0x30, 0x30, 0x30, 0x30, 0x30, 0x1, 0xa, 0x0, 0x0, 0x0, 0x0,
+		0x5, 0x0, 0x0, 0x0, // msg size
+		0x20})
+	// compressed with invalid message size
 	f.Add([]byte(" \x00\x00\x0000000000\xdc\a\x00\x000000000\xca\x010000000"))
+	// op message document sequence with invalid size
 	f.Add([]byte(" \x00\x00\x0000000000\xdd\a\x00\x000000\x01000\x8e0000000000000"))
-	f.Add([]byte(" \x00\x00\x0000000000\xdd\a\x00\x00000000000\x01\x02\x00\x00\x0000"))
-	f.Add([]byte(" \x00\x00\x0000000000\xdd\a\x00\x00000000000\x01\x01\x00\x00\x0000"))
-	f.Add([]byte("0\x00\x00\x0000000000\x01\x00\x00\x0000000000000000000000\x03\x00\x00\x00\x00\x00\x00\x000000"))
+	// op message document sequence with multiple document iteration ending in too short of document
+	f.Add([]byte(" \x00\x00\x0000000000\xdd\a\x00\x00000000000000\x01000"))
+	// op insert with zero length document
 	f.Add([]byte(" \x00\x00\x0000000000\xd2\a\x00\x000000\x00\x00\x00\x00\x00\x00000000"))
+	// invalid header
 	f.Add([]byte("000\xa4000000000000"))
-	f.Add([]byte("0\x00\x00\x0000@00000\x01\x00\x00\x000000000000000000000\x01\x00\x00\x00\x0000000000"))
-	f.Add([]byte(" \x00\x00\x0000000000\xdd\a\x00\x00000000000000\x01000"))
-	f.Add([]byte{0x3f, 0x2d, 0x0, 0x0, 0x0, 0xf7, 0xfe, 0x0, 0xff, 0xff, 0xff, 0x29, 0xff, 0xdc, 0x7, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x71, 0x1, 0xff, 0xff, 0x2e, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0xb4,
-		0x1a, 0x54, 0x6d, 0xff, 0xff, 0x0, 0xff, 0x53, 0x0, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff, 0xff, 0xff, 0x6, 0x36,
-		0xd0, 0x4, 0x0, 0x84, 0x0, 0x0, 0x4, 0x29, 0x0})
-	f.Add([]byte{0x1d, 0x1d, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, 0x0, 0x30, 0x13, 0x0, 0x0, 0xdc, 0x7, 0x0, 0x0, 0x30, 0x20,
-		0x1d, 0x1d, 0x3, 0x0, 0x0, 0x0, 0x1, 0xff, 0xff, 0xff, 0x65, 0x0, 0xe2, 0xff, 0xff, 0xe2, 0x1d, 0x0, 0x0})
-	f.Add([]byte{0x7e, 0x1c, 0x0, 0x0, 0x0, 0x0, 0xd3, 0xc3, 0xd1, 0x26, 0x0, 0xfd, 0xa5, 0xdd, 0x7, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0xa6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa5, 0xa5, 0xa5,
-		0x7, 0x0, 0x0, 0xa5, 0xff, 0x9, 0x0, 0x0, 0xa5, 0xa5, 0x2a, 0xa5, 0xa5, 0x0, 0x0, 0x0, 0xa5, 0x10, 0xa5, 0xd3,
-		0xc3, 0xd1, 0x26, 0x0, 0xfd, 0xa5})
-	f.Add([]byte{0x42, 0x42, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x0, 0x0, 0xdd, 0x7, 0x0, 0x0, 0x13, 0xa9,
-		0x29, 0x13, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0xa9, 0x2,
-		0xa, 0x16, 0x60, 0x56, 0x56, 0x56, 0xff, 0xa9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0xa9, 0xa9, 0x0, 0xdc,
-		0x7, 0x0, 0x0, 0xd4, 0x7, 0x0, 0x0, 0x11, 0x0, 0x92, 0x76, 0x76, 0xa9, 0x76, 0x76})
-	f.Add([]byte{0x1c, 0x1a, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdd, 0x7, 0x0, 0x0, 0x12, 0x0, 0x0,
-		0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x26, 0x0, 0x80, 0xa, 0x0, 0x0, 0x15, 0x0, 0x0, 0x0})
-	f.Add([]byte{0x30, 0x30, 0x0, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x1, 0x0, 0x0, 0x0, 0xff,
-		0xff, 0xff, 0xff, 0xff, 0xff, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
+	// Header EOF due to large size defined
+	f.Add([]byte{0x1d, 0x1d, 0x0, 0x0, // (start header) length
+		0x0, 0x0, 0x2f, 0x0, // request id
+		0x0, 0x30, 0x13, 0x0, // response to
+		0x0, 0xdc, 0x7, 0x0, // (end header) op code
 		0x0})
-	f.Add([]byte{0x60, 0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x11, 0x0, 0x0, 0xaa, 0xdc, 0x7, 0x0, 0x0, 0x0, 0x0,
-		0x68, 0x0, 0x11, 0x1, 0x0, 0x3f, 0x1, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5,
-		0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5,
-		0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5,
-		0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0xf5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x3b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0xa4})
-	f.Add([]byte{0x43, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30, 0x30, 0x30, 0xd2, 0x7, 0x0, 0x0, 0x1, 0x10,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c, 0x3c, 0x3c, 0x3c, 0x3c, 0x3c, 0x3c,
-		0x3c, 0x3c, 0x3c, 0xb})
-	f.Add([]byte{0x47, 0x47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13, 0x1, 0x0, 0x0, 0x0, 0xbf, 0xbf,
-		0xbf, 0xbf, 0xbf, 0xbf, 0xbf, 0x0, 0x0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xb,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x1, 0x0, 0x0, 0x4e, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x20, 0x32, 0x1, 0x1, 0xff, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0xff,
-		0xff, 0xff, 0xff, 0xff, 0xff})
-	f.Add([]byte{0x30, 0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0xdd, 0x7, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-		0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0xd6, 0x7, 0x0, 0x0, 0xfe, 0x1d, 0x0, 0x3a, 0x0, 0x0, 0x3a, 0x3a, 0x3a,
-		0x31, 0x3a, 0x3a, 0x2a, 0x3a, 0x3a, 0x3a, 0x3a, 0x3a, 0x0, 0x7a, 0x0})
-	f.Add([]byte{0x26, 0x24, 0x00, 0x00, 0x00, 0xdd, 0xff, 0xc7, 0xff, 0xff, 0xde, 0xff,
-		0xf6, 0xdd, 0x07, 0x00, 0x00, 0x23, 0xad, 0x00, 0x39, 0x01, 0x00, 0x07,
-		0xd7, 0x8e, 0x7e, 0xdf, 0x50, 0x00, 0x00, 0x00, 0x00, 0xd4, 0x00, 0x26,
-		0x24, 0xe2, 0xff, 0xff, 0x06, 0xd6, 0xff, 0x77, 0x10, 0x00,
-	})
-	f.Add([]byte(" \x00\x00\x0000000000\xdd\a\x00\x0000000000000\x01\x02\x00\x00\x00"))
 
 	f.Fuzz(func(t *testing.T, msgBytes []byte) {
 		msg := bytes.NewReader(msgBytes)
diff --git a/lib/srv/db/mongodb/protocol/message.go b/lib/srv/db/mongodb/protocol/message.go
index d231c7a3d1c1e..6fa601c0a299b 100644
--- a/lib/srv/db/mongodb/protocol/message.go
+++ b/lib/srv/db/mongodb/protocol/message.go
@@ -78,8 +78,7 @@ func ReadMessage(reader io.Reader) (Message, error) {
 
 // ReadServerMessage reads wire protocol message from the MongoDB server connection.
 func ReadServerMessage(ctx context.Context, conn driver.Connection) (Message, error) {
-	var wm []byte
-	wm, err := conn.ReadWireMessage(ctx, wm)
+	wm, err := conn.ReadWireMessage(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -103,10 +102,7 @@ func readHeaderAndPayload(reader io.Reader) (*MessageHeader, []byte, error) {
 	}
 
 	payloadLength := int64(length - headerSizeBytes)
-	// TODO: get the max limit from Mongo handshake
-	// https://github.com/gravitational/teleport/issues/21286
-	// For now allow 2x default mongoDB limit.
-	if payloadLength >= 2*defaultMaxMessageSizeBytes {
+	if payloadLength >= defaultMaxMessageSizeBytes {
 		return nil, nil, trace.BadParameter("exceeded the maximum message size, got length: %d", length)
 	}
 
@@ -132,7 +128,10 @@ func readHeaderAndPayload(reader io.Reader) (*MessageHeader, []byte, error) {
 // defaultMaxMessageSizeBytes is the default max size of mongoDB message.
 // It can be obtained by following command:
 // db.isMaster().maxMessageSizeBytes    48000000 (default)
-const defaultMaxMessageSizeBytes = int64(48000000)
+// TODO(jent): get the max limit from Mongo handshake
+// https://github.com/gravitational/teleport/issues/21286
+// For now allow 2x default mongoDB limit.
+const defaultMaxMessageSizeBytes = int64(48000000) * 2
 
 // buffCapacity returns the capacity for the payload buffer.
 // If payloadLength is greater than defaultMaxMessageSizeBytes the defaultMaxMessageSizeBytes is returned.
diff --git a/lib/srv/db/mongodb/protocol/message_test.go b/lib/srv/db/mongodb/protocol/message_test.go
index b6b5d52bae6a6..eae2ff5139f4c 100644
--- a/lib/srv/db/mongodb/protocol/message_test.go
+++ b/lib/srv/db/mongodb/protocol/message_test.go
@@ -337,8 +337,10 @@ func TestInvalidPayloadSize(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		payloadSize := tt.payloadSize
+		errMsg := tt.errMsg
 		t.Run(tt.name, func(t *testing.T) {
-			payloadSize := tt.payloadSize
+			t.Parallel()
 
 			src := [4]byte{}
 			src[0] = byte(payloadSize & 0xFF)
@@ -347,7 +349,7 @@ func TestInvalidPayloadSize(t *testing.T) {
 			src[3] = byte((payloadSize >> 24) & 0xFF)
 
 			buf := bytes.NewBuffer(src[:])
-			size := tt.payloadSize
+			size := payloadSize
 			if size < 0 {
 				size = 1024
 			}
@@ -356,11 +358,27 @@ func TestInvalidPayloadSize(t *testing.T) {
 			msg := bytes.NewReader(buf.Bytes())
 
 			_, err := ReadMessage(msg)
-			require.ErrorContains(t, err, tt.errMsg)
+			require.ErrorContains(t, err, errMsg)
 		})
 	}
 }
 
+func TestInvalidDecompressPayloadSize(t *testing.T) {
+	t.Parallel()
+
+	msgBytes := []byte{
+		0x1b, 0x0, 0x0, 0x0, 0x30, 0x30, 0x30, 0x30, 0x7f, 0x30, 0x30, 0x30, // size and id header
+		0xdc, 0x7, 0x0, 0x0, // compressed message op code
+		0x30, 0x30, 0x30, 0x30, // original op code
+		0x30, 0x30, 0x30, 0x30, // excessive large size for test
+		0x3, 0x30, 0x30, // fake data
+	}
+	msg := bytes.NewReader(msgBytes)
+
+	_, err := ReadMessage(msg)
+	require.ErrorContains(t, err, "uncompressed size exceeded max")
+}
+
 func makeTestOpCompressed(t *testing.T, message Message) *MessageOpCompressed {
 	// Marshal the original message to wire representation.
 	bytes := message.ToWire(0)
diff --git a/lib/srv/db/mongodb/protocol/opcompressed.go b/lib/srv/db/mongodb/protocol/opcompressed.go
index 452ce0377ef31..e0e780dfac935 100644
--- a/lib/srv/db/mongodb/protocol/opcompressed.go
+++ b/lib/srv/db/mongodb/protocol/opcompressed.go
@@ -115,6 +115,8 @@ func readOpCompressed(header MessageHeader, payload []byte) (message *MessageOpC
 	}
 	if uncompressedSize <= 0 || len(compressedMessage) == 0 {
 		return nil, trace.BadParameter("malformed OP_COMPRESSED: invalid message size %v", payload)
+	} else if uncompressedSize > int32(defaultMaxMessageSizeBytes) {
+		return nil, trace.BadParameter("malformed OP_COMPRESSED: uncompressed size exceeded max %v", payload)
 	}
 
 	message.originalMessage, err = decompress(message)
diff --git a/lib/srv/db/mongodb/test.go b/lib/srv/db/mongodb/test.go
index 667dc978764df..c0555361b11b7 100644
--- a/lib/srv/db/mongodb/test.go
+++ b/lib/srv/db/mongodb/test.go
@@ -18,8 +18,11 @@ package mongodb
 
 import (
 	"context"
+	"crypto/rand"
 	"crypto/tls"
 	"net"
+	"strings"
+	"sync"
 	"sync/atomic"
 	"time"
 
@@ -29,6 +32,7 @@ import (
 	"go.mongodb.org/mongo-driver/bson/primitive"
 	"go.mongodb.org/mongo-driver/mongo"
 	"go.mongodb.org/mongo-driver/mongo/options"
+	"go.mongodb.org/mongo-driver/x/bsonx/bsoncore"
 
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/srv/db/common"
@@ -76,6 +80,14 @@ type TestServer struct {
 
 	wireVersion      int
 	activeConnection int32
+
+	// conversationIdx conversion ID control number. It is increased every time
+	// a SASL conversation is started.
+	conversationIdx int32
+
+	// saslConversionTracker map to track which SASL mechanism is being used by
+	// the conversion ID.
+	saslConversationTracker sync.Map
 }
 
 // TestServerOption allows to set test server options.
@@ -186,12 +198,23 @@ func (s *TestServer) handleMessage(message protocol.Message) (protocol.Message,
 		return s.handlePing(message)
 	case commandFind:
 		return s.handleFind(message)
+	case commandSaslStart:
+		return s.handleSaslStart(message)
+	case commandSaslContinue:
+		return s.handleSaslContinue(message)
 	}
 	return nil, trace.NotImplemented("unsupported message: %v", message)
 }
 
 // handleAuth makes response to the client's "authenticate" command.
 func (s *TestServer) handleAuth(message protocol.Message) (protocol.Message, error) {
+	// If authentication token is set on the server, it should only use SASL.
+	// This avoid false positives where Teleport uses the wrong authentication
+	// method.
+	if s.cfg.AuthUser != "" || s.cfg.AuthToken != "" {
+		return nil, trace.BadParameter("expected SASL authentication but got certificate")
+	}
+
 	command, err := message.GetCommand()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -247,6 +270,109 @@ func (s *TestServer) handleFind(message protocol.Message) (protocol.Message, err
 	return protocol.MakeOpMsg(findReply), nil
 }
 
+// handleSaslStart makes response to the client's "saslStart" command.
+func (s *TestServer) handleSaslStart(message protocol.Message) (protocol.Message, error) {
+	opmsg, ok := message.(*protocol.MessageOpQuery)
+	if !ok {
+		return nil, trace.BadParameter("expected message type *protocol.MessageOpQuery but got %T", message)
+	}
+
+	mechanism := opmsg.Query.Lookup("mechanism").StringValue()
+	conversationID := atomic.AddInt32(&s.conversationIdx, 1)
+	s.saslConversationTracker.Store(conversationID, mechanism)
+
+	switch mechanism {
+	case authMechanismAWS:
+		return s.handleAWSIAMSaslStart(conversationID, opmsg)
+	default:
+		return nil, trace.NotImplemented("authentication mechanism %q not supported", mechanism)
+	}
+}
+
+// handleSaslContinue makes response to the client's "saslContinue" command.
+// It expects a conversion to be present at `saslConversationTracker`,
+// otherwise it won't be able to define which authentication mechanism to use.
+func (s *TestServer) handleSaslContinue(message protocol.Message) (protocol.Message, error) {
+	opmsg, ok := message.(*protocol.MessageOpQuery)
+	if !ok {
+		return nil, trace.BadParameter("expected message type *protocol.MessageOpQuery but got %T", message)
+	}
+
+	conversationID := opmsg.Query.Lookup("conversationId").Int32()
+	mechanism, ok := s.saslConversationTracker.Load(conversationID)
+	if !ok {
+		return nil, trace.NotFound("conversationID not found")
+	}
+
+	switch mechanism {
+	case authMechanismAWS:
+		return s.handleAWSIAMSaslContinue(conversationID, opmsg)
+	default:
+		return nil, trace.NotImplemented("authentication mechanism %q not supported", mechanism)
+	}
+}
+
+// handleAWSIAMSaslStart handles the "saslStart" command for "MONGODB-AWS"
+// authentication.
+func (s *TestServer) handleAWSIAMSaslStart(conversationID int32, opmsg *protocol.MessageOpQuery) (protocol.Message, error) {
+	_, userPass := opmsg.Query.Lookup("payload").Binary()
+	doc, _, ok := bsoncore.ReadDocument(userPass)
+	if !ok {
+		return nil, trace.BadParameter("invalid payload")
+	}
+
+	// Append server "Nonce" to client "Nonce".
+	_, clientNonce := doc.Lookup("r").Binary()
+	serverNonce := make([]byte, 32)
+	_, _ = rand.Read(serverNonce)
+
+	firstResponse, err := bson.Marshal(struct {
+		Nonce primitive.Binary `bson:"s"`
+		Host  string           `bson:"h"`
+	}{
+		Nonce: primitive.Binary{
+			Subtype: 0x00,
+			Data:    append(clientNonce, serverNonce...),
+		},
+		Host: "sts.amazonaws.com",
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	authReply, err := makeSaslReply(conversationID, firstResponse)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return protocol.MakeOpMsg(authReply), nil
+}
+
+// handleAWSIAMSaslContinue handles the "saslStart" command for "MONGODB-AWS"
+// authentication.
+func (s *TestServer) handleAWSIAMSaslContinue(conversationID int32, opmsg *protocol.MessageOpQuery) (protocol.Message, error) {
+	_, awsSaslPayload := opmsg.Query.Lookup("payload").Binary()
+	doc, _, ok := bsoncore.ReadDocument(awsSaslPayload)
+	if !ok {
+		return nil, trace.BadParameter("invalid payload")
+	}
+
+	if !strings.Contains(doc.Lookup("a").StringValue(), s.cfg.AuthUser) {
+		return nil, trace.AccessDenied("invalid username")
+	}
+
+	if s.cfg.AuthToken != doc.Lookup("t").StringValue() {
+		return nil, trace.AccessDenied("invalid session token")
+	}
+
+	authReply, err := makeSaslReply(conversationID, []byte{})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return protocol.MakeOpMsg(authReply), nil
+}
+
 // getWireVersion returns the server's wire protocol version.
 func (s *TestServer) getWireVersion() int {
 	if s.wireVersion != 0 {
@@ -271,10 +397,14 @@ func (s *TestServer) Close() error {
 }
 
 const (
-	commandAuth     = "authenticate"
-	commandIsMaster = "isMaster"
-	commandPing     = "ping"
-	commandFind     = "find"
+	authMechanismAWS = "MONGODB-AWS"
+
+	commandAuth         = "authenticate"
+	commandIsMaster     = "isMaster"
+	commandPing         = "ping"
+	commandFind         = "find"
+	commandSaslStart    = "saslStart"
+	commandSaslContinue = "saslContinue"
 )
 
 // makeOKReply builds a generic document used to indicate success e.g.
@@ -304,3 +434,14 @@ func makeFindReply(result interface{}) ([]byte, error) {
 		},
 	})
 }
+
+// makeSaslReply builds a document used as reply for "saslStart" and "saslContinue"
+// commands.
+func makeSaslReply(conversationID int32, payload []byte) ([]byte, error) {
+	return bson.Marshal(bson.M{
+		"ok":             1,
+		"conversationId": conversationID,
+		"done":           true,
+		"payload":        payload,
+	})
+}
diff --git a/lib/srv/db/opensearch/fuzz_test.go b/lib/srv/db/opensearch/fuzz_test.go
index 2a9201e8ff8db..ec75265b8feb5 100644
--- a/lib/srv/db/opensearch/fuzz_test.go
+++ b/lib/srv/db/opensearch/fuzz_test.go
@@ -21,6 +21,9 @@ import (
 )
 
 func FuzzPathToMatcher(f *testing.F) {
+	f.Add("")
+	f.Add("a/b/c")
+
 	f.Add("/_security/foo")
 	f.Add("/_ssl/asd")
 	f.Add("/_search/")
diff --git a/lib/srv/db/proxyserver.go b/lib/srv/db/proxyserver.go
index aa8cae904f5ae..d3f4763eff3f3 100644
--- a/lib/srv/db/proxyserver.go
+++ b/lib/srv/db/proxyserver.go
@@ -41,7 +41,6 @@ import (
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/limiter"
-	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/enterprise"
@@ -68,10 +67,10 @@ type ProxyServer struct {
 	log logrus.FieldLogger
 }
 
-// ConnMonitor monitors authorized connnections and terminates them when
+// ConnMonitor monitors authorized connections and terminates them when
 // session controls dictate so.
 type ConnMonitor interface {
-	MonitorConn(ctx context.Context, authzCtx *authz.Context, conn net.Conn) (context.Context, error)
+	MonitorConn(ctx context.Context, authzCtx *authz.Context, conn net.Conn) (context.Context, net.Conn, error)
 }
 
 // ProxyServerConfig is the proxy configuration.
@@ -83,7 +82,7 @@ type ProxyServerConfig struct {
 	// Authorizer is responsible for authorizing user identities.
 	Authorizer authz.Authorizer
 	// Tunnel is the reverse tunnel server.
-	Tunnel reversetunnel.Server
+	Tunnel reversetunnelclient.Server
 	// TLSConfig is the proxy server TLS configuration.
 	TLSConfig *tls.Config
 	// Limiter is the connection/rate limiter.
@@ -446,7 +445,7 @@ func (s *ProxyServer) Connect(ctx context.Context, proxyCtx *common.ProxyContext
 			return nil, trace.Wrap(err)
 		}
 
-		serviceConn, err := proxyCtx.Cluster.Dial(reversetunnel.DialParams{
+		serviceConn, err := proxyCtx.Cluster.Dial(reversetunnelclient.DialParams{
 			From:                  clientSrcAddr,
 			To:                    &utils.NetAddr{AddrNetwork: "tcp", Addr: reversetunnelclient.LocalNode},
 			OriginalClientDstAddr: clientDstAddr,
@@ -475,7 +474,7 @@ func (s *ProxyServer) Connect(ctx context.Context, proxyCtx *common.ProxyContext
 // the reverse tunnel connection is down e.g. because the agent is down.
 func isReverseTunnelDownError(err error) bool {
 	return trace.IsConnectionProblem(err) ||
-		strings.Contains(err.Error(), reversetunnel.NoDatabaseTunnel)
+		strings.Contains(err.Error(), reversetunnelclient.NoDatabaseTunnel)
 }
 
 // Proxy starts proxying all traffic received from database client between
@@ -485,7 +484,8 @@ func isReverseTunnelDownError(err error) bool {
 func (s *ProxyServer) Proxy(ctx context.Context, proxyCtx *common.ProxyContext, clientConn, serviceConn net.Conn) error {
 	// Wrap a client connection with a monitor that auto-terminates
 	// idle connection and connection with expired cert.
-	ctx, err := s.cfg.ConnectionMonitor.MonitorConn(ctx, proxyCtx.AuthContext, clientConn)
+	var err error
+	ctx, clientConn, err = s.cfg.ConnectionMonitor.MonitorConn(ctx, proxyCtx.AuthContext, clientConn)
 	if err != nil {
 		clientConn.Close()
 		serviceConn.Close()
@@ -530,7 +530,7 @@ func (s *ProxyServer) Authorize(ctx context.Context, tlsConn utils.TLSConn, para
 
 // getDatabaseServers finds database servers that proxy the database instance
 // encoded in the provided identity.
-func (s *ProxyServer) getDatabaseServers(ctx context.Context, identity tlsca.Identity) (reversetunnel.RemoteSite, []types.DatabaseServer, error) {
+func (s *ProxyServer) getDatabaseServers(ctx context.Context, identity tlsca.Identity) (reversetunnelclient.RemoteSite, []types.DatabaseServer, error) {
 	cluster, err := s.cfg.Tunnel.GetSite(identity.RouteToCluster)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
diff --git a/lib/srv/db/redis/connection/fuzz_test.go b/lib/srv/db/redis/connection/fuzz_test.go
index 1e808e6a71834..df8452515a9a9 100644
--- a/lib/srv/db/redis/connection/fuzz_test.go
+++ b/lib/srv/db/redis/connection/fuzz_test.go
@@ -23,6 +23,11 @@ import (
 )
 
 func FuzzParseRedisAddress(f *testing.F) {
+	f.Add("foo:1234")
+	f.Add(URIScheme + "://foo")
+	f.Add(URIScheme + "://foo:1234?mode=standalone")
+	f.Add(URIScheme + "://foo:1234?mode=cluster")
+
 	f.Fuzz(func(t *testing.T, addr string) {
 		require.NotPanics(t, func() {
 			ParseRedisAddress(addr)
diff --git a/lib/srv/db/server.go b/lib/srv/db/server.go
index f8bc97b8b4356..80a1754b91d9c 100644
--- a/lib/srv/db/server.go
+++ b/lib/srv/db/server.go
@@ -21,6 +21,7 @@ import (
 	"crypto/tls"
 	"net"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/google/uuid"
@@ -104,9 +105,9 @@ type Config struct {
 	// ResourceMatchers is a list of database resource matchers.
 	ResourceMatchers []services.ResourceMatcher
 	// AWSMatchers is a list of AWS databases matchers.
-	AWSMatchers []services.AWSMatcher
+	AWSMatchers []types.AWSMatcher
 	// AzureMatchers is a list of Azure databases matchers.
-	AzureMatchers []services.AzureMatcher
+	AzureMatchers []types.AzureMatcher
 	// Databases is a list of proxied databases from static configuration.
 	Databases types.Databases
 	// CloudLabels is a service that imports labels from a cloud provider. The labels are shared
@@ -133,6 +134,8 @@ type Config struct {
 	// ConnectionMonitor monitors and closes connections if session controls
 	// prevent the connections.
 	ConnectionMonitor ConnMonitor
+	// ShutdownPollPeriod defines the shutdown poll period.
+	ShutdownPollPeriod time.Duration
 
 	// discoveryResourceChecker performs some pre-checks when creating databases
 	// discovered by the discovery service.
@@ -248,6 +251,11 @@ func (c *Config) CheckAndSetDefaults(ctx context.Context) (err error) {
 			return trace.Wrap(err)
 		}
 	}
+
+	if c.ShutdownPollPeriod == 0 {
+		c.ShutdownPollPeriod = defaults.ShutdownPollPeriod
+	}
+
 	return nil
 }
 
@@ -280,6 +288,13 @@ type Server struct {
 	mu sync.RWMutex
 	// log is used for logging.
 	log *logrus.Entry
+	// activeConnections counts the number of database active connections.
+	activeConnections atomic.Int32
+	// connContext context used by connection resources. Canceling will cause
+	// active connections to drop.
+	connContext context.Context
+	// closeConnFunc is the cancel function of the connContext context.
+	closeConnFunc context.CancelFunc
 }
 
 // monitoredDatabases is a collection of databases from different sources
@@ -358,12 +373,13 @@ func New(ctx context.Context, config Config) (*Server, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	ctx, cancel := context.WithCancel(ctx)
+	closeCtx, closeCancelFunc := context.WithCancel(ctx)
+	connCtx, connCancelFunc := context.WithCancel(ctx)
 	server := &Server{
 		cfg:              config,
 		log:              logrus.WithField(trace.Component, teleport.ComponentDatabase),
-		closeContext:     ctx,
-		closeFunc:        cancel,
+		closeContext:     closeCtx,
+		closeFunc:        closeCancelFunc,
 		dynamicLabels:    make(map[string]*labels.Dynamic),
 		heartbeats:       make(map[string]*srv.Heartbeat),
 		proxiedDatabases: config.Databases.ToMap(),
@@ -375,6 +391,8 @@ func New(ctx context.Context, config Config) (*Server, error) {
 			ClusterName:   clustername.GetClusterName(),
 			AcceptedUsage: []string{teleport.UsageDatabaseOnly},
 		},
+		connContext:   connCtx,
+		closeConnFunc: connCancelFunc,
 	}
 
 	// Update TLS config to require client certificate.
@@ -769,15 +787,45 @@ func (s *Server) startServiceHeartbeat() error {
 	return nil
 }
 
-// Close stops proxying all server's databases and frees up other resources.
+// Close stops proxying all server's databases, drops active connections, and
+// frees up other resources.
 func (s *Server) Close() error {
+	s.closeConnFunc()
 	return trace.Wrap(s.close(s.closeContext))
 }
 
 // Shutdown performs a graceful shutdown.
-func (s *Server) Shutdown(ctx context.Context) error {
-	// TODO wait active connections.
-	return trace.Wrap(s.close(ctx))
+func (s *Server) Shutdown(ctx context.Context) (err error) {
+	err = s.close(ctx)
+	defer s.closeConnFunc()
+
+	activeConnections := s.activeConnections.Load()
+	if activeConnections == 0 {
+		return
+	}
+
+	s.log.Infof("Shutdown: waiting for %v connections to finish.", activeConnections)
+	lastReport := time.Time{}
+	ticker := time.NewTicker(s.cfg.ShutdownPollPeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			activeConnections = s.activeConnections.Load()
+			if activeConnections == 0 {
+				return
+			}
+
+			if time.Since(lastReport) > 10*s.cfg.ShutdownPollPeriod {
+				s.log.Infof("Shutdown: waiting for %v connections to finish.", activeConnections)
+				lastReport = time.Now()
+			}
+		case <-ctx.Done():
+			s.log.Infof("Context canceled wait, returning.")
+			return
+		}
+	}
 }
 
 func (s *Server) close(ctx context.Context) error {
@@ -803,11 +851,16 @@ func (s *Server) close(ctx context.Context) error {
 
 // Wait will block while the server is running.
 func (s *Server) Wait() error {
-	<-s.closeContext.Done()
-	if err := s.closeContext.Err(); err != nil && err != context.Canceled {
-		return trace.Wrap(err)
+	var errors []error
+	for _, ctx := range []context.Context{s.closeContext, s.connContext} {
+		<-ctx.Done()
+
+		if err := ctx.Err(); err != nil && err != context.Canceled {
+			errors = append(errors, err)
+		}
 	}
-	return nil
+
+	return trace.NewAggregate(errors...)
 }
 
 // ForceHeartbeat is used by tests to force-heartbeat all registered databases.
@@ -827,6 +880,10 @@ func (s *Server) ForceHeartbeat() error {
 // upgrades it to TLS, extracts identity information from it, performs
 // authorization and dispatches to the appropriate database engine.
 func (s *Server) HandleConnection(conn net.Conn) {
+	// Track active connections.
+	s.activeConnections.Add(1)
+	defer s.activeConnections.Add(-1)
+
 	log := s.log.WithField("addr", conn.RemoteAddr())
 	log.Debug("Accepted connection.")
 	// Upgrade the connection to TLS since the other side of the reverse
@@ -845,7 +902,7 @@ func (s *Server) HandleConnection(conn net.Conn) {
 	}
 	// Now that the handshake has completed and the client has sent us a
 	// certificate, extract identity information from it.
-	ctx, err := s.middleware.WrapContextWithUser(s.closeContext, tlsConn)
+	ctx, err := s.middleware.WrapContextWithUser(s.connContext, tlsConn)
 	if err != nil {
 		log.WithError(err).Error("Failed to extract identity from connection.")
 		return
@@ -886,7 +943,7 @@ func (s *Server) handleConnection(ctx context.Context, clientConn net.Conn) erro
 		go func() {
 			// Use the server closing context to make sure that upload
 			// continues beyond the session lifetime.
-			err := streamWriter.Close(s.closeContext)
+			err := streamWriter.Close(s.connContext)
 			if err != nil {
 				sessionCtx.Log.WithError(err).Warn("Failed to close stream writer.")
 			}
@@ -909,7 +966,7 @@ func (s *Server) handleConnection(ctx context.Context, clientConn net.Conn) erro
 
 	// Wrap a client connection into monitor that auto-terminates
 	// idle connection and connection with expired cert.
-	ctx, err = s.cfg.ConnectionMonitor.MonitorConn(ctx, sessionCtx.AuthContext, clientConn)
+	ctx, clientConn, err = s.cfg.ConnectionMonitor.MonitorConn(ctx, sessionCtx.AuthContext, clientConn)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -981,7 +1038,7 @@ func (s *Server) createEngine(sessionCtx *common.Session, audit common.Audit) (c
 		Audit:        audit,
 		AuthClient:   s.cfg.AuthClient,
 		CloudClients: s.cfg.CloudClients,
-		Context:      s.closeContext,
+		Context:      s.connContext,
 		Clock:        s.cfg.Clock,
 		Log:          sessionCtx.Log,
 		Users:        s.cfg.CloudUsers,
@@ -1128,7 +1185,7 @@ func (s *Server) trackSession(ctx context.Context, sessionCtx *common.Session) e
 
 	go func() {
 		<-ctx.Done()
-		if err := tracker.Close(s.closeContext); err != nil {
+		if err := tracker.Close(s.connContext); err != nil {
 			s.log.WithError(err).Debugf("Failed to close session tracker for session %v", sessionCtx.ID)
 		}
 	}()
diff --git a/lib/srv/db/server_test.go b/lib/srv/db/server_test.go
index 9a64c4f3c023b..2dafc3c732d29 100644
--- a/lib/srv/db/server_test.go
+++ b/lib/srv/db/server_test.go
@@ -18,12 +18,14 @@ package db
 
 import (
 	"context"
+	"io"
 	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/go-mysql-org/go-mysql/client"
 	"github.com/jackc/pgconn"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.mongodb.org/mongo-driver/mongo"
 
@@ -315,3 +317,177 @@ func TestShutdown(t *testing.T) {
 		})
 	}
 }
+
+func TestTrackActiveConnections(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	testCtx := setupTestContext(ctx, t, withSelfHostedPostgres("postgres"))
+	go testCtx.startHandlingConnections()
+	testCtx.createUserAndRole(ctx, t, "alice", "admin", []string{"*"}, []string{"*"})
+
+	numActiveConnections := 5
+	closeFuncs := []func() error{}
+
+	// Create a few connections, increasing the active connections. Keep track
+	// of the closer functions, so we can close them later.
+	for i := 0; i < numActiveConnections; i++ {
+		expectedActiveConnections := int32(i + 1)
+		conn, err := testCtx.postgresClient(ctx, "alice", "postgres", "postgres", "postgres")
+		require.NoError(t, err)
+		closeFuncs = append(closeFuncs, func() error { return conn.Close(ctx) })
+		// We're also adding them to the test cleanup to ensure connections are
+		// closed even when the test fails.
+		t.Cleanup(func() { conn.Close(ctx) })
+
+		require.Eventually(t, func() bool {
+			return expectedActiveConnections == testCtx.server.activeConnections.Load()
+		}, 2*time.Second, 100*time.Millisecond, "expected %d active connections, but got %d", expectedActiveConnections, testCtx.server.activeConnections.Load())
+	}
+
+	// For each connection we close, the active connections should drop too.
+	for i := 0; i < numActiveConnections; i++ {
+		expectedActiveConnections := int32(numActiveConnections - (i + 1))
+		require.NoError(t, closeFuncs[i]())
+
+		// Decreasing the active connection counter is one of the last things to
+		// happen when closing a connection. We might need to give it sometime
+		// to properly close the connection.
+		require.Eventually(t, func() bool {
+			return expectedActiveConnections == testCtx.server.activeConnections.Load()
+		}, 2*time.Second, 100*time.Millisecond, "expected %d active connections, but got %d", expectedActiveConnections, testCtx.server.activeConnections.Load())
+	}
+}
+
+// TestShutdownWithActiveConnections given that a running database server with
+// one active connection constantly sending queries, when the server is
+// gracefully shut down, it should keep running until the client closes the
+// connection.
+func TestShutdownWithActiveConnections(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	server, connErrCh, cancelConn := databaseServerWithActiveConnection(t, ctx)
+
+	shutdownCtx, cancelShutdown := context.WithTimeout(ctx, time.Second*5)
+	defer cancelShutdown()
+	shutdownErrCh := make(chan error)
+	go func() {
+		shutdownErrCh <- server.Shutdown(shutdownCtx)
+	}()
+
+	// Shutdown doesn't return immediately. We must wait for a short period to
+	// ensure it hasn't been completed.
+	require.Never(t, func() bool {
+		select {
+		case <-shutdownErrCh:
+			return true
+		default:
+			return false
+		}
+	}, time.Second, 100*time.Millisecond, "unexpected server shutdown")
+
+	select {
+	case err := <-connErrCh:
+		require.Fail(t, "unexpected connection close", err)
+	default:
+	}
+
+	cancelConn()
+	require.EventuallyWithT(t, func(c *assert.CollectT) {
+		select {
+		case err := <-connErrCh:
+			assert.NoError(c, err, "unexpected connection error")
+		default:
+		}
+	}, time.Second, 100*time.Millisecond)
+
+	require.EventuallyWithT(t, func(c *assert.CollectT) {
+		select {
+		case err := <-shutdownErrCh:
+			assert.NoError(c, err, "unexpected server shutdown error")
+		default:
+		}
+	}, time.Second, 100*time.Millisecond)
+
+	require.EventuallyWithT(t, func(c *assert.CollectT) {
+		assert.NoError(c, server.Wait(), "unexpected server Wait error")
+	}, time.Second, 100*time.Millisecond)
+}
+
+// TestShutdownWithActiveConnections given that a running database server with
+// one active connection constantly sending queries, when the server is
+// killed/stopped, it should drop connections and cleanup resources.
+func TestCloseWithActiveConnections(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	server, connErrCh, _ := databaseServerWithActiveConnection(t, ctx)
+
+	require.NoError(t, server.Close())
+	require.EventuallyWithT(t, func(c *assert.CollectT) {
+		select {
+		case err := <-connErrCh:
+			assert.ErrorIs(c, err, io.ErrUnexpectedEOF)
+		default:
+		}
+	}, time.Second, 100*time.Millisecond)
+
+	require.EventuallyWithT(t, func(c *assert.CollectT) {
+		assert.NoError(t, server.Wait(), "unexpected error from server Wait")
+	}, time.Second, 100*time.Millisecond)
+}
+
+// serverWithActiveConnection starts a server with one active connection that
+// will actively make queries.
+func databaseServerWithActiveConnection(t *testing.T, ctx context.Context) (*Server, chan error, context.CancelFunc) {
+	t.Helper()
+
+	databaseName := "postgres"
+	testCtx := setupTestContext(ctx, t, withSelfHostedPostgres(databaseName))
+	go testCtx.startHandlingConnections()
+	testCtx.createUserAndRole(ctx, t, "alice", "admin", []string{"*"}, []string{"*"})
+	dbTestServer, ok := testCtx.postgres[databaseName]
+	require.True(t, ok)
+
+	connCtx, cancelConn := context.WithCancel(ctx)
+	t.Cleanup(func() { cancelConn() })
+	connErrCh := make(chan error)
+
+	go func() {
+		conn, err := testCtx.postgresClient(ctx, "alice", "postgres", "postgres", "postgres")
+		if err != nil {
+			connErrCh <- err
+			return
+		}
+
+		ticker := time.NewTicker(100 * time.Millisecond)
+		defer ticker.Stop()
+		defer conn.Close(ctx)
+
+		for {
+			select {
+			case <-ticker.C:
+				_, err := conn.Exec(ctx, "select 1").ReadAll()
+				if err != nil {
+					connErrCh <- err
+					return
+				}
+			case <-connCtx.Done():
+				connErrCh <- nil
+				return
+			}
+		}
+	}()
+
+	require.Eventually(t, func() bool {
+		return testCtx.server.activeConnections.Load() == int32(1)
+	}, time.Second, 100*time.Millisecond, "expected one active connection, but got none")
+
+	// Ensures the first query has been received.
+	require.Eventually(t, func() bool {
+		return dbTestServer.db.QueryCount() > uint32(1)
+	}, time.Second, 100*time.Millisecond, "database test server hasn't received queries")
+
+	return testCtx.server, connErrCh, cancelConn
+}
diff --git a/lib/srv/db/streamer.go b/lib/srv/db/streamer.go
index b91936a3a8e80..28c14c1456273 100644
--- a/lib/srv/db/streamer.go
+++ b/lib/srv/db/streamer.go
@@ -35,7 +35,7 @@ import (
 // newStreamWriter creates a streamer that will be used to stream the
 // requests that occur within this session to the audit log.
 func (s *Server) newStreamWriter(sessionCtx *common.Session) (libevents.StreamWriter, error) {
-	recConfig, err := s.cfg.AccessPoint.GetSessionRecordingConfig(s.closeContext)
+	recConfig, err := s.cfg.AccessPoint.GetSessionRecordingConfig(s.connContext)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -45,14 +45,14 @@ func (s *Server) newStreamWriter(sessionCtx *common.Session) (libevents.StreamWr
 	}
 	// TODO(r0mant): Add support for record-at-proxy.
 	// Create a sync or async streamer depending on configuration of cluster.
-	streamer, err := s.newStreamer(s.closeContext, sessionCtx.ID, recConfig)
+	streamer, err := s.newStreamer(s.connContext, sessionCtx.ID, recConfig)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	// Audit stream is using server context, not session context,
 	// to make sure that session is uploaded even after it is closed
 	return libevents.NewAuditWriter(libevents.AuditWriterConfig{
-		Context:      s.closeContext,
+		Context:      s.connContext,
 		Streamer:     streamer,
 		Clock:        s.cfg.Clock,
 		SessionID:    session.ID(sessionCtx.ID),
diff --git a/lib/srv/db/watcher.go b/lib/srv/db/watcher.go
index 9051104e8ec84..d3571e106c233 100644
--- a/lib/srv/db/watcher.go
+++ b/lib/srv/db/watcher.go
@@ -94,6 +94,8 @@ func (s *Server) startResourceWatcher(ctx context.Context) (*services.DatabaseWa
 		for {
 			select {
 			case databases := <-watcher.DatabasesC:
+				// Overwrite database specs like AssumeRoleARN before reconcile.
+				applyResourceMatchersToDatabases(databases, s.cfg.ResourceMatchers)
 				s.monitoredDatabases.setResources(databases)
 				select {
 				case s.reconcileCh <- struct{}{}:
@@ -348,3 +350,23 @@ func (c *cloudCredentialsChecker) isWildcardMatcher() bool {
 	wildcardLabels := c.resourceMatchers[0].Labels[types.Wildcard]
 	return len(wildcardLabels) == 1 && wildcardLabels[0] == types.Wildcard
 }
+
+func applyResourceMatchersToDatabases(databases types.Databases, resourceMatchers []services.ResourceMatcher) {
+	for _, database := range databases {
+		applyResourceMatcherToDatabase(database, resourceMatchers)
+	}
+}
+
+func applyResourceMatcherToDatabase(database types.Database, resourceMatchers []services.ResourceMatcher) {
+	for _, matcher := range resourceMatchers {
+		if len(matcher.Labels) == 0 || matcher.AWS.AssumeRoleARN == "" {
+			continue
+		}
+		if match, _, _ := services.MatchLabels(matcher.Labels, database.GetAllLabels()); !match {
+			continue
+		}
+
+		database.SetAWSAssumeRole(matcher.AWS.AssumeRoleARN)
+		database.SetAWSExternalID(matcher.AWS.ExternalID)
+	}
+}
diff --git a/lib/srv/db/watcher_test.go b/lib/srv/db/watcher_test.go
index 92dee3f7787fa..4bdde2818f9f0 100644
--- a/lib/srv/db/watcher_test.go
+++ b/lib/srv/db/watcher_test.go
@@ -133,7 +133,7 @@ func TestWatcher(t *testing.T) {
 // ResourceMatchers should be always evaluated for the dynamic registered
 // resources.
 func TestWatcherDynamicResource(t *testing.T) {
-	var db1, db2, db3, db4 *types.DatabaseV3
+	var db1, db2, db3, db4, db5 *types.DatabaseV3
 	ctx := context.Background()
 	testCtx := setupTestContext(ctx, t)
 
@@ -144,9 +144,20 @@ func TestWatcherDynamicResource(t *testing.T) {
 	testCtx.setupDatabaseServer(ctx, t, agentParams{
 		Databases: []types.Database{db0},
 		ResourceMatchers: []services.ResourceMatcher{
-			{Labels: types.Labels{
-				"group": []string{"a"},
-			}},
+			{
+				Labels: types.Labels{
+					"group": []string{"a"},
+				},
+			},
+			{
+				Labels: types.Labels{
+					"group": []string{"b"},
+				},
+				AWS: services.ResourceMatcherAWS{
+					AssumeRoleARN: "arn:aws:iam::123456789012:role/DBAccess",
+					ExternalID:    "external-id",
+				},
+			},
 		},
 		OnReconcile: func(d types.Databases) {
 			reconcileCh <- d
@@ -156,6 +167,10 @@ func TestWatcherDynamicResource(t *testing.T) {
 
 	withRDSURL := func(v3 *types.DatabaseSpecV3) {
 		v3.URI = "mypostgresql.c6c8mwvfdgv0.us-west-2.rds.amazonaws.com:5432"
+		v3.AWS.AccountID = "123456789012"
+	}
+	withDiscoveryAssumeRoleARN := func(v3 *types.DatabaseSpecV3) {
+		v3.AWS.AssumeRoleARN = "arn:aws:iam::123456789012:role/DBDiscovery"
 	}
 
 	t.Run("dynamic resource - no match", func(t *testing.T) {
@@ -205,6 +220,25 @@ func TestWatcherDynamicResource(t *testing.T) {
 		// The db4 service should be properly registered by the agent.
 		assertReconciledResource(t, reconcileCh, types.Databases{db0, db2, db4})
 	})
+
+	t.Run("discovery resource - AssumeRoleARN", func(t *testing.T) {
+		// Created a discovery service created database resource that matches
+		// ResourceMatchers and has AssumeRoleARN set by the discovery service.
+		discoveredDB5, err := makeDiscoveryDatabase("db5", map[string]string{"group": "b"}, withRDSURL, withDiscoveryAssumeRoleARN)
+		require.NoError(t, err)
+		require.True(t, db4.IsRDS())
+
+		err = testCtx.authServer.CreateDatabase(ctx, discoveredDB5)
+		require.NoError(t, err)
+
+		// Validate that AssumeRoleARN is overwritten by the one configured in
+		// the resource matcher.
+		db5 = discoveredDB5.Copy()
+		db5.SetAWSAssumeRole("arn:aws:iam::123456789012:role/DBAccess")
+		db5.SetAWSExternalID("external-id")
+
+		assertReconciledResource(t, reconcileCh, types.Databases{db0, db2, db4, db5})
+	})
 }
 
 func setDiscoveryGroupLabel(r types.ResourceWithLabels, discoveryGroup string) {
@@ -252,12 +286,12 @@ func TestWatcherCloudFetchers(t *testing.T) {
 			}),
 			AzureManagedSQLServer: azure.NewManagedSQLClientByAPI(&azure.ARMSQLManagedServerMock{}),
 		},
-		AzureMatchers: []services.AzureMatcher{{
+		AzureMatchers: []types.AzureMatcher{{
 			Subscriptions: []string{"sub"},
 			Types:         []string{services.AzureMatcherSQLServer},
 			ResourceTags:  types.Labels{types.Wildcard: []string{types.Wildcard}},
 		}},
-		AWSMatchers: []services.AWSMatcher{{
+		AWSMatchers: []types.AWSMatcher{{
 			Types:   []string{services.AWSMatcherRDS, services.AWSMatcherRedshiftServerless},
 			Regions: []string{"us-east-1"},
 			Tags:    types.Labels{types.Wildcard: []string{types.Wildcard}},
diff --git a/lib/srv/desktop/rdp/rdpclient/Cargo.toml b/lib/srv/desktop/rdp/rdpclient/Cargo.toml
index a947d787bb9ae..622881a82a24a 100644
--- a/lib/srv/desktop/rdp/rdpclient/Cargo.toml
+++ b/lib/srv/desktop/rdp/rdpclient/Cargo.toml
@@ -8,26 +8,26 @@ edition = "2018"
 crate-type = ["staticlib"]
 
 [dependencies]
-bitflags = "2.3.1"
+bitflags = "2.3.3"
 byteorder = "1.4.3"
 env_logger = "0.10.0"
-iso7816 = "0.1.0"
+iso7816 = "0.1.1"
 iso7816-tlv = "0.4.3"
-libc = "0.2.144"
-log = "0.4.18"
-num-derive = "0.3.3"
+libc = "0.2.147"
+log = "0.4.19"
+num-derive = "0.4.0"
 num-traits = "0.2.15"
 rand = { version = "0.8.5", features = ["getrandom"] }
 rand_chacha = "0.3.1"
 rsa = "0.9.2"
 rdp-rs = { git = "https://github.com/gravitational/rdp-rs", rev = "75eb6a30b83e7152ee6213964b5ac6e783304840" }
-uuid = { version = "1.3.3", features = ["v4"] }
+uuid = { version = "1.4.0", features = ["v4"] }
 utf16string = "0.2.0"
-png = "0.17.8"
+png = "0.17.9"
 
 [build-dependencies]
-cbindgen = "0.24.3"
-tempfile = "3.5.0"
+cbindgen = "0.24.5"
+tempfile = "3.6.0"
 
 [features]
 fips = ["rdp-rs/fips"]
diff --git a/lib/srv/desktop/rdp/rdpclient/src/rdpdr.rs b/lib/srv/desktop/rdp/rdpclient/src/rdpdr.rs
index a03a1368347cd..ca0efe4db83e8 100644
--- a/lib/srv/desktop/rdp/rdpclient/src/rdpdr.rs
+++ b/lib/srv/desktop/rdp/rdpclient/src/rdpdr.rs
@@ -49,6 +49,7 @@ use std::collections::HashMap;
 use std::convert::{TryFrom, TryInto};
 use std::ffi::CString;
 use std::io::{Read, Seek, SeekFrom};
+use std::vec;
 
 /// Client implements a device redirection (RDPDR) client, as defined in
 /// https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-RDPEFS/%5bMS-RDPEFS%5d.pdf
@@ -326,24 +327,29 @@ impl Client {
             return Err(Error::TryError("received a drive redirection major function when drive redirection was not allowed".to_string()));
         }
 
-        let output = if is_smart_card_op {
+        let device_control_responses = if is_smart_card_op {
             // Smart card control
-            if let Some(res) = self.scard.ioctl(ioctl.io_control_code, payload)? {
-                res
-            } else {
-                return Ok(vec![]);
-            }
+            self.scard.ioctl(&ioctl, payload)?
         } else {
             // Drive redirection, mimic FreeRDP's "no-op"
             // https://github.com/FreeRDP/FreeRDP/blob/511444a65e7aa2f537c5e531fa68157a50c1bd4d/channels/drive/client/drive_main.c#L677-L684
-            Box::new(NoOp::new())
+            vec![DeviceControlResponse::new(
+                &ioctl,
+                NTSTATUS::STATUS_SUCCESS,
+                Box::new(NoOp::new()),
+            )]
         };
-        let resp = DeviceControlResponse::new(&ioctl, NTSTATUS::STATUS_SUCCESS, output);
 
-        debug!("sending RDP: {:?}", resp);
-        let resp = self
-            .add_headers_and_chunkify(PacketId::PAKID_CORE_DEVICE_IOCOMPLETION, resp.encode()?)?;
-        Ok(resp)
+        let mut messages: Messages = vec![];
+        for resp in device_control_responses {
+            debug!("sending RDP: {:?}", resp);
+            messages.extend(self.add_headers_and_chunkify(
+                PacketId::PAKID_CORE_DEVICE_IOCOMPLETION,
+                resp.encode()?,
+            )?);
+        }
+
+        Ok(messages)
     }
 
     fn process_irp_create(
@@ -2129,6 +2135,23 @@ pub struct DeviceIoRequest {
 }
 
 impl DeviceIoRequest {
+    #[cfg(test)]
+    fn new(
+        device_id: u32,
+        file_id: u32,
+        completion_id: u32,
+        major_function: MajorFunction,
+        minor_function: MinorFunction,
+    ) -> Self {
+        Self {
+            device_id,
+            file_id,
+            completion_id,
+            major_function,
+            minor_function,
+        }
+    }
+
     fn decode(payload: &mut Payload) -> RdpResult<Self> {
         let device_id = payload.read_u32::<LittleEndian>()?;
         let file_id = payload.read_u32::<LittleEndian>()?;
@@ -2192,6 +2215,21 @@ struct DeviceControlRequest {
 }
 
 impl DeviceControlRequest {
+    #[cfg(test)]
+    fn new(
+        header: DeviceIoRequest,
+        output_buffer_length: u32,
+        input_buffer_length: u32,
+        io_control_code: IoctlCode,
+    ) -> Self {
+        Self {
+            header,
+            output_buffer_length,
+            input_buffer_length,
+            io_control_code,
+        }
+    }
+
     fn decode(header: DeviceIoRequest, payload: &mut Payload) -> RdpResult<Self> {
         let output_buffer_length = payload.read_u32::<LittleEndian>()?;
         let input_buffer_length = payload.read_u32::<LittleEndian>()?;
diff --git a/lib/srv/desktop/rdp/rdpclient/src/rdpdr/scard.rs b/lib/srv/desktop/rdp/rdpclient/src/rdpdr/scard.rs
index d12896ffb1350..540f7290ea67b 100644
--- a/lib/srv/desktop/rdp/rdpclient/src/rdpdr/scard.rs
+++ b/lib/srv/desktop/rdp/rdpclient/src/rdpdr/scard.rs
@@ -12,7 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use crate::errors::invalid_data_error;
+use crate::errors::{invalid_data_error, not_implemented_error};
+use crate::rdpdr::consts::NTSTATUS;
 use crate::{piv, Message};
 use crate::{Encode, Payload};
 use bitflags::bitflags;
@@ -25,8 +26,11 @@ use std::char::{decode_utf16, REPLACEMENT_CHARACTER};
 use std::collections::HashMap;
 use std::convert::TryInto;
 use std::io::{Read, Write};
+use std::vec;
 use uuid::Uuid;
 
+use super::{DeviceControlRequest, DeviceControlResponse};
+
 // Client implements the smartcard emulator, forwarded over an RDP virtual channel.
 // Spec: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-RDPESC/%5bMS-RDPESC%5d.pdf
 //
@@ -57,10 +61,10 @@ impl Client {
     // ioctl handles messages coming from the RDP server over the RDPDR channel.
     pub(super) fn ioctl(
         &mut self,
-        code: IoctlCode,
+        ioctl: &DeviceControlRequest,
         input: &mut Payload,
-    ) -> RdpResult<Option<Box<dyn Encode>>> {
-        debug!("got IoctlCode {:?}", &code);
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
+        debug!("got IoctlCode {:?}", &ioctl.io_control_code);
         // Note: this is an incomplete implementation of the scard API.
         // It's the bare minimum needed to make RDP authentication using a smartcard work.
         //
@@ -68,115 +72,215 @@ impl Client {
         // fail, but most modern Windows hosts shouldn't call those. If you're reading this because
         // some SCARD_IOCTL_*A call is failing, I was wrong and you'll have to implement the Ascii
         // calls.
-        match code {
-            IoctlCode::SCARD_IOCTL_ACCESSSTARTEDEVENT => self.handle_access_started_event(input),
-            IoctlCode::SCARD_IOCTL_ESTABLISHCONTEXT => self.handle_establish_context(input),
-            IoctlCode::SCARD_IOCTL_RELEASECONTEXT => self.handle_release_context(input),
-            IoctlCode::SCARD_IOCTL_CANCEL => self.handle_cancel(input),
-            IoctlCode::SCARD_IOCTL_ISVALIDCONTEXT => self.handle_is_valid_context(input),
-            IoctlCode::SCARD_IOCTL_LISTREADERSW => self.handle_list_readers(input),
-            IoctlCode::SCARD_IOCTL_GETSTATUSCHANGEW => self.handle_get_status_change(input),
-            IoctlCode::SCARD_IOCTL_CONNECTW => self.handle_connect(input),
-            IoctlCode::SCARD_IOCTL_DISCONNECT => self.handle_disconnect(input),
-            IoctlCode::SCARD_IOCTL_BEGINTRANSACTION => self.handle_begin_transaction(input),
-            IoctlCode::SCARD_IOCTL_ENDTRANSACTION => self.handle_end_transaction(input),
-            IoctlCode::SCARD_IOCTL_STATUSA => self.handle_status(input, StringEncoding::Ascii),
-            IoctlCode::SCARD_IOCTL_STATUSW => self.handle_status(input, StringEncoding::Unicode),
+        match ioctl.io_control_code {
+            IoctlCode::SCARD_IOCTL_ACCESSSTARTEDEVENT => {
+                self.handle_access_started_event(ioctl, input)
+            }
+            IoctlCode::SCARD_IOCTL_ESTABLISHCONTEXT => self.handle_establish_context(ioctl, input),
+            IoctlCode::SCARD_IOCTL_RELEASECONTEXT => self.handle_release_context(ioctl, input),
+            IoctlCode::SCARD_IOCTL_CANCEL => self.handle_cancel(ioctl, input),
+            IoctlCode::SCARD_IOCTL_ISVALIDCONTEXT => self.handle_is_valid_context(ioctl, input),
+            IoctlCode::SCARD_IOCTL_LISTREADERSW => self.handle_list_readers(ioctl, input),
+            IoctlCode::SCARD_IOCTL_GETSTATUSCHANGEW => self.handle_get_status_change(ioctl, input),
+            IoctlCode::SCARD_IOCTL_CONNECTW => self.handle_connect(ioctl, input),
+            IoctlCode::SCARD_IOCTL_DISCONNECT => self.handle_disconnect(ioctl, input),
+            IoctlCode::SCARD_IOCTL_BEGINTRANSACTION => self.handle_begin_transaction(ioctl, input),
+            IoctlCode::SCARD_IOCTL_ENDTRANSACTION => self.handle_end_transaction(ioctl, input),
+            IoctlCode::SCARD_IOCTL_STATUSA => {
+                self.handle_status(ioctl, input, StringEncoding::Ascii)
+            }
+            IoctlCode::SCARD_IOCTL_STATUSW => {
+                self.handle_status(ioctl, input, StringEncoding::Unicode)
+            }
             // Transmit is where communication with the actual smartcard (and the PIV application
             // on it) happens. All other messages are managing the smartcard reader and
             // establishing a connection to the smartcard.
-            IoctlCode::SCARD_IOCTL_TRANSMIT => self.handle_transmit(input),
-            IoctlCode::SCARD_IOCTL_GETDEVICETYPEID => self.handle_get_device_type_id(input),
+            IoctlCode::SCARD_IOCTL_TRANSMIT => self.handle_transmit(ioctl, input),
+            IoctlCode::SCARD_IOCTL_GETDEVICETYPEID => self.handle_get_device_type_id(ioctl, input),
             // Note: we keep an in-memory hashmap as a cache to implement these commands. Windows
             // doesn't seem to like a smartcard without a functioning cache.
-            IoctlCode::SCARD_IOCTL_READCACHEW => self.handle_read_cache(input),
-            IoctlCode::SCARD_IOCTL_WRITECACHEW => self.handle_write_cache(input),
-            IoctlCode::SCARD_IOCTL_GETREADERICON => self.handle_get_reader_icon(input),
-            _ => self.handle_unimplemented_ioctl(code),
+            IoctlCode::SCARD_IOCTL_READCACHEW => self.handle_read_cache(ioctl, input),
+            IoctlCode::SCARD_IOCTL_WRITECACHEW => self.handle_write_cache(ioctl, input),
+            IoctlCode::SCARD_IOCTL_GETREADERICON => self.handle_get_reader_icon(ioctl, input),
+            _ => self.handle_unimplemented_ioctl(ioctl, ioctl.io_control_code),
         }
     }
 
     fn handle_access_started_event(
         &self,
+        ioctl: &DeviceControlRequest,
         input: &mut Payload,
-    ) -> RdpResult<Option<Box<dyn Encode>>> {
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = ScardAccessStartedEvent_Call::decode(input)?;
         debug!("got {:?}", req);
         let resp = Long_Return::new(ReturnCode::SCARD_S_SUCCESS);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
     fn handle_establish_context(
         &mut self,
+        ioctl: &DeviceControlRequest,
         input: &mut Payload,
-    ) -> RdpResult<Option<Box<dyn Encode>>> {
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = EstablishContext_Call::decode(input)?;
         debug!("got {:?}", req);
         let ctx = self.contexts.establish();
         let resp = EstablishContext_Return::new(ReturnCode::SCARD_S_SUCCESS, ctx);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
     fn handle_release_context(
         &mut self,
+        ioctl: &DeviceControlRequest,
         input: &mut Payload,
-    ) -> RdpResult<Option<Box<dyn Encode>>> {
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = Context_Call::decode(input)?;
         debug!("got {:?}", req);
         self.contexts.release(req.context.value);
         let resp = Long_Return::new(ReturnCode::SCARD_S_SUCCESS);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
-    fn handle_cancel(&self, input: &mut Payload) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_cancel(
+        &mut self,
+        ioctl: &DeviceControlRequest,
+        input: &mut Payload,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
+        let mut responses = vec![];
         let req = Context_Call::decode(input)?;
         debug!("got {:?}", req);
-        let resp = Long_Return::new(ReturnCode::SCARD_S_SUCCESS);
-        debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+
+        // Fetch the pending SCARD_IOCTL_GETSTATUSCHANGEW response and add it to the responses.
+        if let Some(dcr) = self
+            .contexts
+            .get(req.context.value)?
+            .scard_cancel_response
+            .take()
+        {
+            responses.push(dcr);
+        } else {
+            warn!("Received SCARD_IOCTL_CANCEL for a context without a pending SCARD_IOCTL_GETSTATUSCHANGEW.")
+        }
+
+        // Also add the response to the SCARD_IOCTL_CANCEL request.
+        responses.push(DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(Long_Return::new(ReturnCode::SCARD_S_SUCCESS)),
+        ));
+        debug!("sending {:?}", responses);
+        Ok(responses)
     }
 
-    fn handle_is_valid_context(&self, input: &mut Payload) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_is_valid_context(
+        &self,
+        ioctl: &DeviceControlRequest,
+        input: &mut Payload,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = Context_Call::decode(input)?;
         debug!("got {:?}", req);
         let resp = Long_Return::new(ReturnCode::SCARD_S_SUCCESS);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
-    fn handle_list_readers(&self, input: &mut Payload) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_list_readers(
+        &self,
+        ioctl: &DeviceControlRequest,
+        input: &mut Payload,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = ListReaders_Call::decode(input)?;
         debug!("got {:?}", req);
         let resp =
             ListReaders_Return::new(ReturnCode::SCARD_S_SUCCESS, vec!["Teleport".to_string()]);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
-    fn handle_get_status_change(&self, input: &mut Payload) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_get_status_change(
+        &mut self,
+        ioctl: &DeviceControlRequest,
+        input: &mut Payload,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = GetStatusChange_Call::decode(input)?;
+        let timeout = req.timeout;
+        let context_value = req.context.value;
         debug!("got {:?}", req);
-        let resp = GetStatusChange_Return::new(ReturnCode::SCARD_S_SUCCESS, req);
+
+        if timeout != TIMEOUT_INFINITE && timeout != TIMEOUT_IMMEDIATE {
+            // We've never seen one of these but we log a warning here in case we ever come
+            // across one and need to debug a related issue.
+            warn!(
+                "logic for a non-infinite/non-immediate timeout [{}] is not implemented",
+                timeout
+            );
+        }
+
+        let mut resp = GetStatusChange_Return::new(ReturnCode::SCARD_S_SUCCESS, req);
         if resp.no_change() {
-            debug!("blocking GetStatusChange call indefinitely, no response since our status will never change");
-            Ok(None)
+            if timeout != TIMEOUT_INFINITE {
+                return Err(not_implemented_error(&format!(
+                    "no change for non-infinite timeout [{}] is not implemented",
+                    timeout
+                )));
+            }
+
+            // Received a GetStatusChange_Call with an infinite timeout, so we're adding
+            // a corresponding DeviceControlResponse request holding a GetStatusChange_Return
+            // with its return code set to SCARD_E_CANCELLED to this Context. This value will
+            // be returned when we get an SCARD_IOCTL_CANCEL call for this Context.
+            resp.set_return_code(ReturnCode::SCARD_E_CANCELLED);
+            self.contexts
+                .get(context_value)?
+                .set_scard_cancel_response(DeviceControlResponse::new(
+                    ioctl,
+                    NTSTATUS::STATUS_SUCCESS,
+                    Box::new(resp),
+                ))?;
+            debug!("blocking GetStatusChange call indefinitely (since our status never changes) until we receive an SCARD_IOCTL_CANCEL");
+            Ok(vec![])
         } else {
             debug!("sending {:?}", resp);
-            Ok(Some(Box::new(resp)))
+            Ok(vec![DeviceControlResponse::new(
+                ioctl,
+                NTSTATUS::STATUS_SUCCESS,
+                Box::new(resp),
+            )])
         }
     }
 
-    fn handle_connect(&mut self, input: &mut Payload) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_connect(
+        &mut self,
+        ioctl: &DeviceControlRequest,
+        input: &mut Payload,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = Connect_Call::decode(input)?;
         debug!("got {:?}", req);
 
-        let ctx = self
-            .contexts
-            .get(req.common.context.value)
-            .ok_or_else(|| invalid_data_error("unknown context ID"))?;
+        let ctx = self.contexts.get(req.common.context.value)?;
         let handle = ctx.connect(
             req.common.context,
             self.uuid,
@@ -187,44 +291,72 @@ impl Client {
 
         let resp = Connect_Return::new(ReturnCode::SCARD_S_SUCCESS, handle);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
-    fn handle_disconnect(&mut self, input: &mut Payload) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_disconnect(
+        &mut self,
+        ioctl: &DeviceControlRequest,
+        input: &mut Payload,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = HCardAndDisposition_Call::decode(input)?;
         debug!("got {:?}", req);
 
         self.contexts
-            .get(req.handle.context.value)
-            .ok_or_else(|| invalid_data_error("unknown context ID"))?
+            .get(req.handle.context.value)?
             .disconnect(req.handle.value);
 
         let resp = Long_Return::new(ReturnCode::SCARD_S_SUCCESS);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
-    fn handle_begin_transaction(&self, input: &mut Payload) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_begin_transaction(
+        &self,
+        ioctl: &DeviceControlRequest,
+        input: &mut Payload,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = HCardAndDisposition_Call::decode(input)?;
         debug!("got {:?}", req);
         let resp = Long_Return::new(ReturnCode::SCARD_S_SUCCESS);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
-    fn handle_end_transaction(&self, input: &mut Payload) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_end_transaction(
+        &self,
+        ioctl: &DeviceControlRequest,
+        input: &mut Payload,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = HCardAndDisposition_Call::decode(input)?;
         debug!("got {:?}", req);
         let resp = Long_Return::new(ReturnCode::SCARD_S_SUCCESS);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
     fn handle_status(
         &self,
+        ioctl: &DeviceControlRequest,
         input: &mut Payload,
         enc: StringEncoding,
-    ) -> RdpResult<Option<Box<dyn Encode>>> {
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = Status_Call::decode(input)?;
         debug!("got {:?}", req);
         let resp = Status_Return::new(
@@ -233,10 +365,18 @@ impl Client {
             enc,
         );
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
-    fn handle_transmit(&mut self, input: &mut Payload) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_transmit(
+        &mut self,
+        ioctl: &DeviceControlRequest,
+        input: &mut Payload,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = Transmit_Call::decode(input)?;
         debug!("got {:?}", req);
 
@@ -252,8 +392,7 @@ impl Client {
 
         let card = self
             .contexts
-            .get(req.handle.context.value)
-            .ok_or_else(|| invalid_data_error("unknown context ID"))?
+            .get(req.handle.context.value)?
             .get(req.handle.value)
             .ok_or_else(|| invalid_data_error("unknown handle ID"))?;
 
@@ -261,77 +400,107 @@ impl Client {
 
         let resp = Transmit_Return::new(ReturnCode::SCARD_S_SUCCESS, resp.encode());
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
     fn handle_get_device_type_id(
         &mut self,
+        ioctl: &DeviceControlRequest,
         input: &mut Payload,
-    ) -> RdpResult<Option<Box<dyn Encode>>> {
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = GetDeviceTypeId_Call::decode(input)?;
         debug!("got {:?}", req);
 
-        let _ctx = self
-            .contexts
-            .get(req.context.value)
-            .ok_or_else(|| invalid_data_error("unknown context ID"))?;
+        let _ctx = self.contexts.get(req.context.value)?;
 
         let resp = GetDeviceTypeId_Return::new(ReturnCode::SCARD_S_SUCCESS);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
-    fn handle_read_cache(&mut self, input: &mut Payload) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_read_cache(
+        &mut self,
+        ioctl: &DeviceControlRequest,
+        input: &mut Payload,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = ReadCache_Call::decode(input)?;
         debug!("got {:?}", req);
 
         let val = self
             .contexts
-            .get(req.common.context.value)
-            .ok_or_else(|| invalid_data_error("unknown context ID"))?
+            .get(req.common.context.value)?
             .cache_read(&req.lookup_name);
 
         let resp = ReadCache_Return::new(val);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
-    fn handle_write_cache(&mut self, input: &mut Payload) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_write_cache(
+        &mut self,
+        ioctl: &DeviceControlRequest,
+        input: &mut Payload,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = WriteCache_Call::decode(input)?;
         debug!("got {:?}", req);
 
         self.contexts
-            .get(req.common.context.value)
-            .ok_or_else(|| invalid_data_error("unknown context ID"))?
+            .get(req.common.context.value)?
             .cache_write(req.lookup_name, req.common.data);
 
         let resp = Long_Return::new(ReturnCode::SCARD_S_SUCCESS);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
     fn handle_get_reader_icon(
         &mut self,
+        ioctl: &DeviceControlRequest,
         input: &mut Payload,
-    ) -> RdpResult<Option<Box<dyn Encode>>> {
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         let req = GetReaderIcon_Call::decode(input)?;
         debug!("got {:?}", req);
 
-        let _ctx = self
-            .contexts
-            .get(req.context.value)
-            .ok_or_else(|| invalid_data_error("unknown context ID"))?;
+        let _ctx = self.contexts.get(req.context.value)?;
 
         let resp = GetReaderIcon_Return::new(ReturnCode::SCARD_E_UNSUPPORTED_FEATURE);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 
-    fn handle_unimplemented_ioctl(&self, code: IoctlCode) -> RdpResult<Option<Box<dyn Encode>>> {
+    fn handle_unimplemented_ioctl(
+        &self,
+        ioctl: &DeviceControlRequest,
+        code: IoctlCode,
+    ) -> RdpResult<Vec<DeviceControlResponse>> {
         warn!("unimplemented IOCTL: {:?}", code);
         let resp = Long_Return::new(ReturnCode::SCARD_F_INTERNAL_ERROR);
         debug!("sending {:?}", resp);
-        Ok(Some(Box::new(resp)))
+        Ok(vec![DeviceControlResponse::new(
+            ioctl,
+            NTSTATUS::STATUS_SUCCESS,
+            Box::new(resp),
+        )])
     }
 }
 
@@ -548,6 +717,9 @@ impl Encode for ScardAccessStartedEvent_Call {
     }
 }
 
+const TIMEOUT_INFINITE: u32 = 0xffffffff;
+const TIMEOUT_IMMEDIATE: u32 = 0;
+
 #[derive(Debug, FromPrimitive, ToPrimitive)]
 #[allow(non_camel_case_types)]
 #[repr(u32)]
@@ -1245,6 +1417,10 @@ impl GetStatusChange_Return {
         }
     }
 
+    fn set_return_code(&mut self, return_code: ReturnCode) {
+        self.return_code = return_code;
+    }
+
     fn no_change(&self) -> bool {
         for state in &self.reader_states {
             if state.current_state != state.event_state {
@@ -2172,8 +2348,10 @@ impl Contexts {
         ctx
     }
 
-    fn get(&mut self, id: u32) -> Option<&mut ContextInternal> {
-        self.contexts.get_mut(&id)
+    fn get(&mut self, id: u32) -> RdpResult<&mut ContextInternal> {
+        self.contexts
+            .get_mut(&id)
+            .ok_or_else(|| invalid_data_error(&format!("unknown context id: {}", id)))
     }
 
     fn release(&mut self, id: u32) {
@@ -2181,11 +2359,19 @@ impl Contexts {
     }
 }
 
-#[derive(Debug, PartialEq)]
+#[derive(Debug)]
 struct ContextInternal {
     handles: HashMap<u32, piv::Card<TRANSMIT_DATA_LIMIT>>,
     next_id: u32,
     cache: HashMap<String, Vec<u8>>,
+    // If we receive a SCARD_IOCTL_GETSTATUSCHANGEW with an infinite timeout, we need to
+    // return a GetStatusChange_Return (embedded in a DeviceControlResponse) with
+    // its return code set to SCARD_E_CANCELLED in the case that we receive a
+    // SCARD_IOCTL_CANCEL.
+    //
+    // This value will be set during the handling of the SCARD_IOCTL_GETSTATUSCHANGEW, so that
+    // it can be fetched and returned in response to a SCARD_IOCTL_CANCEL.
+    scard_cancel_response: Option<DeviceControlResponse>,
 }
 
 impl ContextInternal {
@@ -2194,7 +2380,16 @@ impl ContextInternal {
             next_id: 1,
             handles: HashMap::new(),
             cache: HashMap::new(),
+            scard_cancel_response: None,
+        }
+    }
+
+    fn set_scard_cancel_response(&mut self, response: DeviceControlResponse) -> RdpResult<()> {
+        if self.scard_cancel_response.is_some() {
+            return Err(invalid_data_error("SCARD_IOCTL_CANCEL already received"));
         }
+        self.scard_cancel_response = Some(response);
+        Ok(())
     }
 
     fn connect(
@@ -2241,7 +2436,13 @@ fn debug_print_payload(payload: &mut Payload) {
 
 #[cfg(test)]
 mod tests {
-    use crate::Encode;
+    use crate::{
+        rdpdr::{
+            consts::{MajorFunction, MinorFunction, SCARD_DEVICE_ID},
+            DeviceIoRequest,
+        },
+        Encode,
+    };
 
     use super::*;
     fn client() -> Client {
@@ -2404,10 +2605,29 @@ mod tests {
         }
 
         let res = c
-            .ioctl(ctl_code, &mut to_payload(payload))
-            .unwrap()
+            .ioctl(
+                &DeviceControlRequest::new(
+                    DeviceIoRequest::new(
+                        SCARD_DEVICE_ID,
+                        0,
+                        0,
+                        MajorFunction::IRP_MJ_DEVICE_CONTROL,
+                        MinorFunction::IRP_MN_NONE,
+                    ),
+                    0,
+                    0,
+                    ctl_code,
+                ),
+                &mut to_payload(payload),
+            )
             .unwrap();
-        assert_eq!(expected.encode().unwrap(), res.encode().unwrap());
+        assert_eq!(
+            expected.encode().unwrap(),
+            // Only SCARD_IOCTL_CANCEL every returns more than a single
+            // result, and it's currently not tested, so res[0] works here
+            // for now.
+            res[0].output_buffer.encode().unwrap()
+        );
     }
 
     /// Connects a piv::Card to the client's internal context cache
diff --git a/lib/srv/discovery/discovery.go b/lib/srv/discovery/discovery.go
index 1610ff95ab93b..497f7dd244b3e 100644
--- a/lib/srv/discovery/discovery.go
+++ b/lib/srv/discovery/discovery.go
@@ -50,11 +50,11 @@ type Config struct {
 	// Clients is an interface for retrieving cloud clients.
 	Clients cloud.Clients
 	// AWSMatchers is a list of AWS EC2 matchers.
-	AWSMatchers []services.AWSMatcher
+	AWSMatchers []types.AWSMatcher
 	// AzureMatchers is a list of Azure matchers to discover resources.
-	AzureMatchers []services.AzureMatcher
+	AzureMatchers []types.AzureMatcher
 	// GCPMatchers is a list of GCP matchers to discover resources.
-	GCPMatchers []services.GCPMatcher
+	GCPMatchers []types.GCPMatcher
 	// Emitter is events emitter, used to submit discrete events
 	Emitter apievents.Emitter
 	// AccessPoint is a discovery access point
@@ -164,7 +164,7 @@ func New(ctx context.Context, cfg *Config) (*Server, error) {
 }
 
 // initAWSWatchers starts AWS resource watchers based on types provided.
-func (s *Server) initAWSWatchers(matchers []services.AWSMatcher) error {
+func (s *Server) initAWSWatchers(matchers []types.AWSMatcher) error {
 	ec2Matchers, otherMatchers := splitAWSMatchers(matchers, func(matcherType string) bool {
 		return matcherType == services.AWSMatcherEC2
 	})
@@ -195,6 +195,11 @@ func (s *Server) initAWSWatchers(matchers []services.AWSMatcher) error {
 
 	// Add kube fetchers.
 	for _, matcher := range otherMatchers {
+		matcherAssumeRole := &types.AssumeRole{}
+		if matcher.AssumeRole != nil {
+			matcherAssumeRole = matcher.AssumeRole
+		}
+
 		for _, t := range matcher.Types {
 			for _, region := range matcher.Regions {
 				switch t {
@@ -203,8 +208,8 @@ func (s *Server) initAWSWatchers(matchers []services.AWSMatcher) error {
 						s.ctx,
 						region,
 						cloud.WithAssumeRole(
-							matcher.AssumeRole.RoleARN,
-							matcher.AssumeRole.ExternalID,
+							matcherAssumeRole.RoleARN,
+							matcherAssumeRole.ExternalID,
 						),
 					)
 					if err != nil {
@@ -231,7 +236,7 @@ func (s *Server) initAWSWatchers(matchers []services.AWSMatcher) error {
 }
 
 // initAzureWatchers starts Azure resource watchers based on types provided.
-func (s *Server) initAzureWatchers(ctx context.Context, matchers []services.AzureMatcher) error {
+func (s *Server) initAzureWatchers(ctx context.Context, matchers []types.AzureMatcher) error {
 	vmMatchers, otherMatchers := splitAzureMatchers(matchers, func(matcherType string) bool {
 		return matcherType == services.AzureMatcherVM
 	})
@@ -292,7 +297,7 @@ func (s *Server) initAzureWatchers(ctx context.Context, matchers []services.Azur
 }
 
 // initGCPWatchers starts GCP resource watchers based on types provided.
-func (s *Server) initGCPWatchers(ctx context.Context, matchers []services.GCPMatcher) error {
+func (s *Server) initGCPWatchers(ctx context.Context, matchers []types.GCPMatcher) error {
 	// return early if there are no matchers as GetGCPGKEClient causes
 	// an error if there are no credentials present
 	if len(matchers) == 0 {
@@ -679,7 +684,7 @@ func splitSlice(ss []string, check func(string) bool) (split, other []string) {
 }
 
 // splitAWSMatchers splits the AWS matchers by checking the matcher types.
-func splitAWSMatchers(matchers []services.AWSMatcher, matcherTypeCheck func(string) bool) (split, other []services.AWSMatcher) {
+func splitAWSMatchers(matchers []types.AWSMatcher, matcherTypeCheck func(string) bool) (split, other []types.AWSMatcher) {
 	for _, matcher := range matchers {
 		splitTypes, otherTypes := splitSlice(matcher.Types, matcherTypeCheck)
 
@@ -694,7 +699,7 @@ func splitAWSMatchers(matchers []services.AWSMatcher, matcherTypeCheck func(stri
 }
 
 // splitAzureMatchers splits the Azure matchers by checking the matcher types.
-func splitAzureMatchers(matchers []services.AzureMatcher, matcherTypeCheck func(string) bool) (split, other []services.AzureMatcher) {
+func splitAzureMatchers(matchers []types.AzureMatcher, matcherTypeCheck func(string) bool) (split, other []types.AzureMatcher) {
 	for _, matcher := range matchers {
 		splitTypes, otherTypes := splitSlice(matcher.Types, matcherTypeCheck)
 
@@ -709,14 +714,14 @@ func splitAzureMatchers(matchers []services.AzureMatcher, matcherTypeCheck func(
 }
 
 // copyAWSMatcherWithNewTypes copies an AWS Matcher and replaces the types with newTypes
-func copyAWSMatcherWithNewTypes(matcher services.AWSMatcher, newTypes []string) services.AWSMatcher {
+func copyAWSMatcherWithNewTypes(matcher types.AWSMatcher, newTypes []string) types.AWSMatcher {
 	newMatcher := matcher
 	newMatcher.Types = newTypes
 	return newMatcher
 }
 
 // copyAzureMatcherWithNewTypes copies an Azure Matcher and replaces the types with newTypes.
-func copyAzureMatcherWithNewTypes(matcher services.AzureMatcher, newTypes []string) services.AzureMatcher {
+func copyAzureMatcherWithNewTypes(matcher types.AzureMatcher, newTypes []string) types.AzureMatcher {
 	newMatcher := matcher
 	newMatcher.Types = newTypes
 	return newMatcher
diff --git a/lib/srv/discovery/discovery_test.go b/lib/srv/discovery/discovery_test.go
index 4dd60c41f87b2..0dca1c7e3646b 100644
--- a/lib/srv/discovery/discovery_test.go
+++ b/lib/srv/discovery/discovery_test.go
@@ -364,12 +364,12 @@ func TestDiscoveryServer(t *testing.T) {
 			server, err := New(context.Background(), &Config{
 				Clients:     &testClients,
 				AccessPoint: tlsServer.Auth(),
-				AWSMatchers: []services.AWSMatcher{{
+				AWSMatchers: []types.AWSMatcher{{
 					Types:   []string{"ec2"},
 					Regions: []string{"eu-central-1"},
 					Tags:    map[string]utils.Strings{"teleport": {"yes"}},
-					SSM:     &services.AWSSSM{DocumentName: "document"},
-					Params: services.InstallerParams{
+					SSM:     &types.AWSSSM{DocumentName: "document"},
+					Params: &types.InstallerParams{
 						InstallTeleport: true,
 					},
 				}},
@@ -421,9 +421,9 @@ func TestDiscoveryKube(t *testing.T) {
 	tcs := []struct {
 		name                          string
 		existingKubeClusters          []types.KubeCluster
-		awsMatchers                   []services.AWSMatcher
-		azureMatchers                 []services.AzureMatcher
-		gcpMatchers                   []services.GCPMatcher
+		awsMatchers                   []types.AWSMatcher
+		azureMatchers                 []types.AzureMatcher
+		gcpMatchers                   []types.GCPMatcher
 		expectedClustersToExistInAuth []types.KubeCluster
 		clustersNotUpdated            []string
 		expectedAssumedRoles          []string
@@ -432,7 +432,7 @@ func TestDiscoveryKube(t *testing.T) {
 		{
 			name:                 "no clusters in auth server, import 2 prod clusters from EKS",
 			existingKubeClusters: []types.KubeCluster{},
-			awsMatchers: []services.AWSMatcher{
+			awsMatchers: []types.AWSMatcher{
 				{
 					Types:   []string{"eks"},
 					Regions: []string{"eu-west-1"},
@@ -447,12 +447,12 @@ func TestDiscoveryKube(t *testing.T) {
 		{
 			name:                 "no clusters in auth server, import 2 prod clusters from EKS with assumed roles",
 			existingKubeClusters: []types.KubeCluster{},
-			awsMatchers: []services.AWSMatcher{
+			awsMatchers: []types.AWSMatcher{
 				{
 					Types:   []string{"eks"},
 					Regions: []string{"eu-west-1"},
 					Tags:    map[string]utils.Strings{"env": {"prod"}},
-					AssumeRole: services.AssumeRole{
+					AssumeRole: &types.AssumeRole{
 						RoleARN:    "arn:aws:iam::123456789012:role/teleport-role",
 						ExternalID: "external-id",
 					},
@@ -461,7 +461,7 @@ func TestDiscoveryKube(t *testing.T) {
 					Types:   []string{"eks"},
 					Regions: []string{"eu-west-1"},
 					Tags:    map[string]utils.Strings{"env": {"prod"}},
-					AssumeRole: services.AssumeRole{
+					AssumeRole: &types.AssumeRole{
 						RoleARN:    "arn:aws:iam::123456789012:role/teleport-role2",
 						ExternalID: "external-id2",
 					},
@@ -477,7 +477,7 @@ func TestDiscoveryKube(t *testing.T) {
 		{
 			name:                 "no clusters in auth server, import 2 stg clusters from EKS",
 			existingKubeClusters: []types.KubeCluster{},
-			awsMatchers: []services.AWSMatcher{
+			awsMatchers: []types.AWSMatcher{
 				{
 					Types:   []string{"eks"},
 					Regions: []string{"eu-west-1"},
@@ -494,7 +494,7 @@ func TestDiscoveryKube(t *testing.T) {
 			existingKubeClusters: []types.KubeCluster{
 				mustConvertEKSToKubeCluster(t, eksMockClusters[0], mainDiscoveryGroup),
 			},
-			awsMatchers: []services.AWSMatcher{
+			awsMatchers: []types.AWSMatcher{
 				{
 					Types:   []string{"eks"},
 					Regions: []string{"eu-west-1"},
@@ -512,7 +512,7 @@ func TestDiscoveryKube(t *testing.T) {
 			existingKubeClusters: []types.KubeCluster{
 				mustConvertEKSToKubeCluster(t, eksMockClusters[3], mainDiscoveryGroup),
 			},
-			awsMatchers: []services.AWSMatcher{
+			awsMatchers: []types.AWSMatcher{
 				{
 					Types:   []string{"eks"},
 					Regions: []string{"eu-west-1"},
@@ -530,7 +530,7 @@ func TestDiscoveryKube(t *testing.T) {
 			existingKubeClusters: []types.KubeCluster{
 				mustConvertEKSToKubeCluster(t, eksMockClusters[3], otherDiscoveryGroup),
 			},
-			awsMatchers: []services.AWSMatcher{
+			awsMatchers: []types.AWSMatcher{
 				{
 					Types:   []string{"eks"},
 					Regions: []string{"eu-west-1"},
@@ -550,7 +550,7 @@ func TestDiscoveryKube(t *testing.T) {
 				// add an extra static label to force update in auth server
 				modifyKubeCluster(mustConvertEKSToKubeCluster(t, eksMockClusters[1], mainDiscoveryGroup)),
 			},
-			awsMatchers: []services.AWSMatcher{
+			awsMatchers: []types.AWSMatcher{
 				{
 					Types:   []string{"eks"},
 					Regions: []string{"eu-west-1"},
@@ -570,14 +570,14 @@ func TestDiscoveryKube(t *testing.T) {
 				modifyKubeCluster(mustConvertEKSToKubeCluster(t, eksMockClusters[1], mainDiscoveryGroup)),
 				mustConvertAKSToKubeCluster(t, aksMockClusters["group1"][0], mainDiscoveryGroup),
 			},
-			awsMatchers: []services.AWSMatcher{
+			awsMatchers: []types.AWSMatcher{
 				{
 					Types:   []string{"eks"},
 					Regions: []string{"eu-west-1"},
 					Tags:    map[string]utils.Strings{"env": {"prod"}},
 				},
 			},
-			azureMatchers: []services.AzureMatcher{
+			azureMatchers: []types.AzureMatcher{
 				{
 					Types:          []string{"aks"},
 					ResourceTags:   map[string]utils.Strings{"env": {"prod"}},
@@ -597,7 +597,7 @@ func TestDiscoveryKube(t *testing.T) {
 		{
 			name:                 "no clusters in auth server, import 2 prod clusters from GKE",
 			existingKubeClusters: []types.KubeCluster{},
-			gcpMatchers: []services.GCPMatcher{
+			gcpMatchers: []types.GCPMatcher{
 				{
 					Types:      []string{"gke"},
 					Locations:  []string{"*"},
@@ -994,7 +994,7 @@ func TestDiscoveryDatabase(t *testing.T) {
 	awsRDSInstance, awsRDSDB := makeRDSInstance(t, "aws-rds", "us-west-1", mainDiscoveryGroup)
 	azRedisResource, azRedisDB := makeAzureRedisServer(t, "az-redis", "sub1", "group1", "East US", mainDiscoveryGroup)
 
-	role := services.AssumeRole{RoleARN: "arn:aws:iam::123456789012:role/test-role", ExternalID: "test123"}
+	role := types.AssumeRole{RoleARN: "arn:aws:iam::123456789012:role/test-role", ExternalID: "test123"}
 	awsRDSDBWithRole := awsRDSDB.Copy()
 	awsRDSDBWithRole.SetAWSAssumeRole("arn:aws:iam::123456789012:role/test-role")
 	awsRDSDBWithRole.SetAWSExternalID("test123")
@@ -1022,13 +1022,13 @@ func TestDiscoveryDatabase(t *testing.T) {
 	tcs := []struct {
 		name              string
 		existingDatabases []types.Database
-		awsMatchers       []services.AWSMatcher
-		azureMatchers     []services.AzureMatcher
+		awsMatchers       []types.AWSMatcher
+		azureMatchers     []types.AzureMatcher
 		expectDatabases   []types.Database
 	}{
 		{
 			name: "discover AWS database",
-			awsMatchers: []services.AWSMatcher{{
+			awsMatchers: []types.AWSMatcher{{
 				Types:   []string{services.AWSMatcherRedshift},
 				Tags:    map[string]utils.Strings{types.Wildcard: {types.Wildcard}},
 				Regions: []string{"us-east-1"},
@@ -1037,17 +1037,17 @@ func TestDiscoveryDatabase(t *testing.T) {
 		},
 		{
 			name: "discover AWS database with assumed role",
-			awsMatchers: []services.AWSMatcher{{
+			awsMatchers: []types.AWSMatcher{{
 				Types:      []string{services.AWSMatcherRDS},
 				Tags:       map[string]utils.Strings{types.Wildcard: {types.Wildcard}},
 				Regions:    []string{"us-west-1"},
-				AssumeRole: role,
+				AssumeRole: &role,
 			}},
 			expectDatabases: []types.Database{awsRDSDBWithRole},
 		},
 		{
 			name: "discover Azure database",
-			azureMatchers: []services.AzureMatcher{{
+			azureMatchers: []types.AzureMatcher{{
 				Types:          []string{services.AzureMatcherRedis},
 				ResourceTags:   map[string]utils.Strings{types.Wildcard: {types.Wildcard}},
 				Regions:        []string{types.Wildcard},
@@ -1073,7 +1073,7 @@ func TestDiscoveryDatabase(t *testing.T) {
 					},
 				}),
 			},
-			awsMatchers: []services.AWSMatcher{{
+			awsMatchers: []types.AWSMatcher{{
 				Types:   []string{services.AWSMatcherRedshift},
 				Tags:    map[string]utils.Strings{types.Wildcard: {types.Wildcard}},
 				Regions: []string{"us-east-1"},
@@ -1092,11 +1092,11 @@ func TestDiscoveryDatabase(t *testing.T) {
 					URI:      "should.be.updated.com:12345",
 				}),
 			},
-			awsMatchers: []services.AWSMatcher{{
+			awsMatchers: []types.AWSMatcher{{
 				Types:      []string{services.AWSMatcherRDS},
 				Tags:       map[string]utils.Strings{types.Wildcard: {types.Wildcard}},
 				Regions:    []string{"us-west-1"},
-				AssumeRole: role,
+				AssumeRole: &role,
 			}},
 			expectDatabases: []types.Database{awsRDSDBWithRole},
 		},
@@ -1112,7 +1112,7 @@ func TestDiscoveryDatabase(t *testing.T) {
 					URI:      "should.not.be.deleted.com:12345",
 				}),
 			},
-			awsMatchers: []services.AWSMatcher{{
+			awsMatchers: []types.AWSMatcher{{
 				Types:   []string{services.AWSMatcherRedshift},
 				Tags:    map[string]utils.Strings{"do-not-match": {"do-not-match"}},
 				Regions: []string{"us-east-1"},
@@ -1140,7 +1140,7 @@ func TestDiscoveryDatabase(t *testing.T) {
 					URI:      "localhost:12345",
 				}),
 			},
-			awsMatchers: []services.AWSMatcher{{
+			awsMatchers: []types.AWSMatcher{{
 				Types:   []string{services.AWSMatcherRedshift},
 				Tags:    map[string]utils.Strings{"do-not-match": {"do-not-match"}},
 				Regions: []string{"us-east-1"},
@@ -1477,7 +1477,7 @@ func TestAzureVMDiscovery(t *testing.T) {
 			server, err := New(context.Background(), &Config{
 				Clients:     &testClients,
 				AccessPoint: tlsServer.Auth(),
-				AzureMatchers: []services.AzureMatcher{{
+				AzureMatchers: []types.AzureMatcher{{
 					Types:          []string{"vm"},
 					Subscriptions:  []string{"testsub"},
 					ResourceGroups: []string{"testrg"},
diff --git a/lib/srv/discovery/fetchers/db/aws_elasticache.go b/lib/srv/discovery/fetchers/db/aws_elasticache.go
index b648282b9bd74..fab1883190377 100644
--- a/lib/srv/discovery/fetchers/db/aws_elasticache.go
+++ b/lib/srv/discovery/fetchers/db/aws_elasticache.go
@@ -40,7 +40,7 @@ type elastiCacheFetcherConfig struct {
 	// Region is the AWS region to query databases in.
 	Region string
 	// AssumeRole is the AWS IAM role to assume before discovering databases.
-	AssumeRole services.AssumeRole
+	AssumeRole types.AssumeRole
 }
 
 // CheckAndSetDefaults validates the config and sets defaults.
diff --git a/lib/srv/discovery/fetchers/db/aws_memorydb.go b/lib/srv/discovery/fetchers/db/aws_memorydb.go
index f538421940f26..f6732aeb9403f 100644
--- a/lib/srv/discovery/fetchers/db/aws_memorydb.go
+++ b/lib/srv/discovery/fetchers/db/aws_memorydb.go
@@ -40,7 +40,7 @@ type memoryDBFetcherConfig struct {
 	// Region is the AWS region to query databases in.
 	Region string
 	// AssumeRole is the AWS IAM role to assume before discovering databases.
-	AssumeRole services.AssumeRole
+	AssumeRole types.AssumeRole
 }
 
 // CheckAndSetDefaults validates the config and sets defaults.
diff --git a/lib/srv/discovery/fetchers/db/aws_opensearch.go b/lib/srv/discovery/fetchers/db/aws_opensearch.go
new file mode 100644
index 0000000000000..4e491b9b1c68e
--- /dev/null
+++ b/lib/srv/discovery/fetchers/db/aws_opensearch.go
@@ -0,0 +1,160 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package db
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
+	"github.com/aws/aws-sdk-go/service/opensearchservice/opensearchserviceiface"
+	"github.com/gravitational/trace"
+	"github.com/sirupsen/logrus"
+
+	"github.com/gravitational/teleport/api/types"
+	libcloudaws "github.com/gravitational/teleport/lib/cloud/aws"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/srv/discovery/common"
+)
+
+// openSearchFetcherConfig is the OpenSearch databases fetcher configuration.
+type openSearchFetcherConfig struct {
+	// Labels is a selector to match cloud databases.
+	Labels types.Labels
+	// openSearch is the OpenSearch API client.
+	openSearch opensearchserviceiface.OpenSearchServiceAPI
+	// Region is the AWS region to query databases in.
+	Region string
+	// AssumeRole is the AWS IAM role to assume before discovering databases.
+	AssumeRole types.AssumeRole
+}
+
+// CheckAndSetDefaults validates the config and sets defaults.
+func (c *openSearchFetcherConfig) CheckAndSetDefaults() error {
+	if len(c.Labels) == 0 {
+		return trace.BadParameter("missing parameter Labels")
+	}
+	if c.openSearch == nil {
+		return trace.BadParameter("missing parameter openSearch")
+	}
+	if c.Region == "" {
+		return trace.BadParameter("missing parameter Region")
+	}
+	return nil
+}
+
+// openSearchFetcher retrieves OpenSearch databases.
+type openSearchFetcher struct {
+	awsFetcher
+
+	cfg openSearchFetcherConfig
+	log logrus.FieldLogger
+}
+
+// newOpenSearchFetcher returns a new OpenSearch databases fetcher instance.
+func newOpenSearchFetcher(config openSearchFetcherConfig) (common.Fetcher, error) {
+	if err := config.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &openSearchFetcher{
+		cfg: config,
+		log: logrus.WithFields(logrus.Fields{
+			trace.Component: "watch:opensearch",
+			"labels":        config.Labels,
+			"region":        config.Region,
+			"role":          config.AssumeRole,
+		}),
+	}, nil
+}
+
+// Get returns OpenSearch databases matching the watcher's selectors.
+func (f *openSearchFetcher) Get(ctx context.Context) (types.ResourcesWithLabels, error) {
+	domains, err := getOpenSearchDomains(ctx, f.cfg.openSearch)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	var eligibleDomains []*opensearchservice.DomainStatus
+	for _, domain := range domains {
+		if !services.IsOpenSearchDomainAvailable(domain) {
+			f.log.Debugf("OpenSearch domain %q is unavailable. Skipping.", aws.StringValue(domain.DomainName))
+			continue
+		}
+
+		eligibleDomains = append(eligibleDomains, domain)
+	}
+
+	if len(eligibleDomains) == 0 {
+		return types.ResourcesWithLabels{}, nil
+	}
+
+	var databases types.Databases
+	for _, domain := range eligibleDomains {
+		tags, err := getOpenSearchResourceTags(ctx, f.cfg.openSearch, domain.ARN)
+
+		if err != nil {
+			if trace.IsAccessDenied(err) {
+				f.log.WithError(err).Debug("No permissions to list resource tags")
+			} else {
+				f.log.WithError(err).Infof("Failed to list resource tags for OpenSearch domain %q.", aws.StringValue(domain.DomainName))
+			}
+		}
+
+		dbs, err := services.NewDatabaseFromOpenSearchDomain(domain, tags)
+		if err != nil {
+			f.log.WithError(err).Infof("Could not convert OpenSearch domain %q configuration to database resource.", aws.StringValue(domain.DomainName))
+		} else {
+			databases = append(databases, dbs...)
+		}
+	}
+
+	applyAssumeRoleToDatabases(databases, f.cfg.AssumeRole)
+	return filterDatabasesByLabels(databases, f.cfg.Labels, f.log).AsResources(), nil
+}
+
+// String returns the fetcher's string description.
+func (f *openSearchFetcher) String() string {
+	return fmt.Sprintf("openSearchFetcher(Region=%v, Labels=%v)",
+		f.cfg.Region, f.cfg.Labels)
+}
+
+// getOpenSearchDomains fetches all OpenSearch domains.
+func getOpenSearchDomains(ctx context.Context, client opensearchserviceiface.OpenSearchServiceAPI) ([]*opensearchservice.DomainStatus, error) {
+	names, err := client.ListDomainNamesWithContext(ctx, nil)
+	if err != nil {
+		return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
+	}
+
+	req := &opensearchservice.DescribeDomainsInput{DomainNames: []*string{}}
+	for _, domain := range names.DomainNames {
+		req.DomainNames = append(req.DomainNames, domain.DomainName)
+	}
+
+	domains, err := client.DescribeDomainsWithContext(ctx, req)
+	if err != nil {
+		return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
+	}
+	return domains.DomainStatusList, nil
+}
+
+// getOpenSearchResourceTags fetches resource tags for provided ARN.
+func getOpenSearchResourceTags(ctx context.Context, client opensearchserviceiface.OpenSearchServiceAPI, resourceARN *string) ([]*opensearchservice.Tag, error) {
+	output, err := client.ListTagsWithContext(ctx, &opensearchservice.ListTagsInput{ARN: resourceARN})
+	if err != nil {
+		return nil, trace.Wrap(libcloudaws.ConvertRequestFailureError(err))
+	}
+
+	return output.TagList, nil
+}
diff --git a/lib/srv/discovery/fetchers/db/aws_opensearch_test.go b/lib/srv/discovery/fetchers/db/aws_opensearch_test.go
new file mode 100644
index 0000000000000..3381a1c701069
--- /dev/null
+++ b/lib/srv/discovery/fetchers/db/aws_opensearch_test.go
@@ -0,0 +1,157 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package db
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	apiawsutils "github.com/gravitational/teleport/api/utils/aws"
+	"github.com/gravitational/teleport/lib/cloud"
+	"github.com/gravitational/teleport/lib/cloud/mocks"
+	"github.com/gravitational/teleport/lib/services"
+)
+
+func TestOpenSearchFetcher(t *testing.T) {
+	t.Parallel()
+
+	tags := map[string][]*opensearchservice.Tag{}
+	prod, prodDBs := makeOpenSearchDomain(t, tags, "os1", "us-east-1", "prod")
+	prodDisabled, _ := makeOpenSearchDomain(t, tags, "os2", "us-east-1", "prod", func(status *opensearchservice.DomainStatus) {
+		status.Created = aws.Bool(false)
+	})
+
+	prodVPC, prodVPCDBs := makeOpenSearchDomain(t, tags, "os3", "us-east-1", "prod", func(status *opensearchservice.DomainStatus) {
+		if status.Endpoints == nil {
+			status.Endpoints = map[string]*string{}
+		}
+		status.Endpoints["vpc"] = aws.String("vpc-" + aws.StringValue(status.Endpoint))
+		status.Endpoint = nil
+	})
+
+	prodCustom, prodCustomDBs := makeOpenSearchDomain(t, tags, "os4", "us-east-1", "prod", func(status *opensearchservice.DomainStatus) {
+		status.DomainEndpointOptions = &opensearchservice.DomainEndpointOptions{
+			CustomEndpoint:        aws.String("opensearch.example.com"),
+			CustomEndpointEnabled: aws.Bool(true),
+			EnforceHTTPS:          aws.Bool(true),
+		}
+	})
+
+	test, testDBs := makeOpenSearchDomain(t, tags, "os5", "us-east-1", "test")
+
+	tests := []awsFetcherTest{
+		{
+			name: "fetch all",
+			inputClients: &cloud.TestCloudClients{
+				OpenSearch: &mocks.OpenSearchMock{
+					Domains:   []*opensearchservice.DomainStatus{prod, test},
+					TagsByARN: tags,
+				},
+			},
+			inputMatchers: makeAWSMatchersForType(services.AWSMatcherOpenSearch, "us-east-1", wildcardLabels),
+			wantDatabases: append(append(types.Databases{}, prodDBs...), testDBs...),
+		},
+		{
+			name: "fetch prod",
+			inputClients: &cloud.TestCloudClients{
+				OpenSearch: &mocks.OpenSearchMock{
+					Domains:   []*opensearchservice.DomainStatus{prod, test},
+					TagsByARN: tags,
+				},
+			},
+			inputMatchers: makeAWSMatchersForType(services.AWSMatcherOpenSearch, "us-east-1", envProdLabels),
+			wantDatabases: prodDBs,
+		},
+		{
+			name: "skip unavailable",
+			inputClients: &cloud.TestCloudClients{
+				OpenSearch: &mocks.OpenSearchMock{
+					Domains:   []*opensearchservice.DomainStatus{prod, prodDisabled},
+					TagsByARN: tags,
+				},
+			},
+			inputMatchers: makeAWSMatchersForType(services.AWSMatcherOpenSearch, "us-east-1", wildcardLabels),
+			wantDatabases: prodDBs,
+		},
+		{
+			name: "prod default",
+			inputClients: &cloud.TestCloudClients{
+				OpenSearch: &mocks.OpenSearchMock{
+					Domains:   []*opensearchservice.DomainStatus{prod, prodVPC, prodCustom},
+					TagsByARN: tags,
+				},
+			},
+			inputMatchers: makeAWSMatchersForType(services.AWSMatcherOpenSearch, "us-east-1", map[string]string{"endpoint-type": apiawsutils.OpenSearchDefaultEndpoint}),
+			wantDatabases: types.Databases{prodDBs[0], prodCustomDBs[0]}, // domain with custom endpoint will still have default endpoint populated
+		},
+		{
+			name: "prod custom",
+			inputClients: &cloud.TestCloudClients{
+				OpenSearch: &mocks.OpenSearchMock{
+					Domains:   []*opensearchservice.DomainStatus{prod, prodVPC, prodCustom},
+					TagsByARN: tags,
+				},
+			},
+			inputMatchers: makeAWSMatchersForType(services.AWSMatcherOpenSearch, "us-east-1", map[string]string{"endpoint-type": apiawsutils.OpenSearchCustomEndpoint}),
+			wantDatabases: types.Databases{prodCustomDBs[1]}, // domain with custom endpoint will still have default endpoint populated
+		},
+		{
+			name: "prod vpc",
+			inputClients: &cloud.TestCloudClients{
+				OpenSearch: &mocks.OpenSearchMock{
+					Domains:   []*opensearchservice.DomainStatus{prod, prodVPC, prodCustom},
+					TagsByARN: tags,
+				},
+			},
+			inputMatchers: makeAWSMatchersForType(services.AWSMatcherOpenSearch, "us-east-1", map[string]string{"endpoint-type": apiawsutils.OpenSearchVPCEndpoint}),
+			wantDatabases: prodVPCDBs,
+		},
+	}
+	testAWSFetchers(t, tests...)
+}
+
+func makeOpenSearchDomain(t *testing.T, tagMap map[string][]*opensearchservice.Tag, name, region, env string, opts ...func(status *opensearchservice.DomainStatus)) (*opensearchservice.DomainStatus, types.Databases) {
+	domain := &opensearchservice.DomainStatus{
+		ARN:           aws.String(fmt.Sprintf("arn:aws:es:%s:123456789012:domain/%s", region, name)),
+		DomainId:      aws.String("123456789012/" + name),
+		DomainName:    aws.String(name),
+		Created:       aws.Bool(true),
+		Deleted:       aws.Bool(false),
+		EngineVersion: aws.String("OpenSearch_2.5"),
+
+		Endpoint: aws.String(fmt.Sprintf("search-%s-aaaabbbbcccc4444.%s.es.amazonaws.com", name, region)),
+	}
+
+	for _, opt := range opts {
+		opt(domain)
+	}
+
+	tags := []*opensearchservice.Tag{{
+		Key:   aws.String("env"),
+		Value: aws.String(env),
+	}}
+
+	tagMap[aws.StringValue(domain.ARN)] = tags
+
+	database, err := services.NewDatabaseFromOpenSearchDomain(domain, tags)
+	require.NoError(t, err)
+
+	return domain, database
+}
diff --git a/lib/srv/discovery/fetchers/db/aws_rds.go b/lib/srv/discovery/fetchers/db/aws_rds.go
index 36b73bd32370a..0d8aacf3cc7ca 100644
--- a/lib/srv/discovery/fetchers/db/aws_rds.go
+++ b/lib/srv/discovery/fetchers/db/aws_rds.go
@@ -42,7 +42,7 @@ type rdsFetcherConfig struct {
 	// Region is the AWS region to query databases in.
 	Region string
 	// AssumeRole is the AWS IAM role to assume before discovering databases.
-	AssumeRole services.AssumeRole
+	AssumeRole types.AssumeRole
 }
 
 // CheckAndSetDefaults validates the config and sets defaults.
diff --git a/lib/srv/discovery/fetchers/db/aws_rds_test.go b/lib/srv/discovery/fetchers/db/aws_rds_test.go
index 6640884f71d12..f86f80cd4a661 100644
--- a/lib/srv/discovery/fetchers/db/aws_rds_test.go
+++ b/lib/srv/discovery/fetchers/db/aws_rds_test.go
@@ -72,7 +72,7 @@ func TestRDSFetchers(t *testing.T) {
 					},
 				},
 			},
-			inputMatchers: []services.AWSMatcher{
+			inputMatchers: []types.AWSMatcher{
 				{
 					Types:   []string{services.AWSMatcherRDS},
 					Regions: []string{"us-east-1"},
@@ -105,7 +105,7 @@ func TestRDSFetchers(t *testing.T) {
 					},
 				},
 			},
-			inputMatchers: []services.AWSMatcher{
+			inputMatchers: []types.AWSMatcher{
 				{
 					Types:   []string{services.AWSMatcherRDS},
 					Regions: []string{"us-east-1"},
@@ -138,7 +138,7 @@ func TestRDSFetchers(t *testing.T) {
 					},
 				},
 			},
-			inputMatchers: []services.AWSMatcher{
+			inputMatchers: []types.AWSMatcher{
 				{
 					Types:   []string{services.AWSMatcherRDS},
 					Regions: []string{"us-east-1"},
@@ -162,7 +162,7 @@ func TestRDSFetchers(t *testing.T) {
 					},
 				},
 			},
-			inputMatchers: []services.AWSMatcher{{
+			inputMatchers: []types.AWSMatcher{{
 				Types:   []string{services.AWSMatcherRDS},
 				Regions: []string{"us-east-1"},
 				Tags:    toTypeLabels(wildcardLabels),
@@ -178,7 +178,7 @@ func TestRDSFetchers(t *testing.T) {
 					DBEngineVersions: []*rds.DBEngineVersion{auroraMySQLEngine, postgresEngine},
 				},
 			},
-			inputMatchers: []services.AWSMatcher{{
+			inputMatchers: []types.AWSMatcher{{
 				Types:   []string{services.AWSMatcherRDS},
 				Regions: []string{"us-east-1"},
 				Tags:    toTypeLabels(wildcardLabels),
@@ -193,7 +193,7 @@ func TestRDSFetchers(t *testing.T) {
 					DBEngineVersions: []*rds.DBEngineVersion{auroraMySQLEngine},
 				},
 			},
-			inputMatchers: []services.AWSMatcher{{
+			inputMatchers: []types.AWSMatcher{{
 				Types:   []string{services.AWSMatcherRDS},
 				Regions: []string{"us-east-1"},
 				Tags:    toTypeLabels(wildcardLabels),
@@ -237,7 +237,7 @@ func makeRDSCluster(t *testing.T, name, region string, labels map[string]string,
 		Endpoint:            aws.String("localhost"),
 		Port:                aws.Int64(3306),
 		TagList:             libcloudaws.LabelsToTags[rds.Tag](labels),
-		DBClusterMembers: []*rds.DBClusterMember{&rds.DBClusterMember{
+		DBClusterMembers: []*rds.DBClusterMember{{
 			IsClusterWriter: aws.Bool(true), // Only one writer.
 		}},
 	}
@@ -262,7 +262,7 @@ func makeRDSClusterWithExtraEndpoints(t *testing.T, name, region string, labels
 		ReaderEndpoint:      aws.String("reader.host"),
 		Port:                aws.Int64(3306),
 		TagList:             libcloudaws.LabelsToTags[rds.Tag](labels),
-		DBClusterMembers: []*rds.DBClusterMember{&rds.DBClusterMember{
+		DBClusterMembers: []*rds.DBClusterMember{{
 			IsClusterWriter: aws.Bool(false), // Add reader by default. Writer is added below based on hasWriter.
 		}},
 		CustomEndpoints: []*string{
diff --git a/lib/srv/discovery/fetchers/db/aws_redshift.go b/lib/srv/discovery/fetchers/db/aws_redshift.go
index 9836dc2ec73e8..771e183644dfb 100644
--- a/lib/srv/discovery/fetchers/db/aws_redshift.go
+++ b/lib/srv/discovery/fetchers/db/aws_redshift.go
@@ -41,7 +41,7 @@ type redshiftFetcherConfig struct {
 	// Region is the AWS region to query databases in.
 	Region string
 	// AssumeRole is the AWS IAM role to assume before discovering databases.
-	AssumeRole services.AssumeRole
+	AssumeRole types.AssumeRole
 }
 
 // CheckAndSetDefaults validates the config and sets defaults.
diff --git a/lib/srv/discovery/fetchers/db/aws_redshift_serverless.go b/lib/srv/discovery/fetchers/db/aws_redshift_serverless.go
index 2436b6a9bb48a..6dc3535330671 100644
--- a/lib/srv/discovery/fetchers/db/aws_redshift_serverless.go
+++ b/lib/srv/discovery/fetchers/db/aws_redshift_serverless.go
@@ -42,7 +42,7 @@ type redshiftServerlessFetcherConfig struct {
 	// Client is the Redshift Serverless API client.
 	Client redshiftserverlessiface.RedshiftServerlessAPI
 	// AssumeRole is the AWS IAM role to assume before discovering databases.
-	AssumeRole services.AssumeRole
+	AssumeRole types.AssumeRole
 }
 
 // CheckAndSetDefaults validates the config and sets defaults.
diff --git a/lib/srv/discovery/fetchers/db/azure_dbserver_test.go b/lib/srv/discovery/fetchers/db/azure_dbserver_test.go
index 48044bd0d5814..67cfb43dbf132 100644
--- a/lib/srv/discovery/fetchers/db/azure_dbserver_test.go
+++ b/lib/srv/discovery/fetchers/db/azure_dbserver_test.go
@@ -73,12 +73,12 @@ func TestAzureDBServerFetchers(t *testing.T) {
 	tests := []struct {
 		name          string
 		inputClients  cloud.AzureClients
-		inputMatchers []services.AzureMatcher
+		inputMatchers []types.AzureMatcher
 		wantDatabases types.Databases
 	}{
 		{
 			name: "match labels",
-			inputMatchers: []services.AzureMatcher{
+			inputMatchers: []types.AzureMatcher{
 				{
 					Subscriptions:  []string{subscription1},
 					ResourceGroups: []string{group1},
@@ -116,7 +116,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 		},
 		{
 			name: "match labels with all subscriptions, resource groups, and regions",
-			inputMatchers: []services.AzureMatcher{
+			inputMatchers: []types.AzureMatcher{
 				{
 					Subscriptions:  []string{"*"},
 					ResourceGroups: []string{"*"},
@@ -156,7 +156,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 		},
 		{
 			name: "skip unsupported and unknown database versions",
-			inputMatchers: []services.AzureMatcher{
+			inputMatchers: []types.AzureMatcher{
 				{
 					Subscriptions:  []string{subscription1},
 					ResourceGroups: []string{"*"},
@@ -190,7 +190,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 		},
 		{
 			name: "skip unavailable",
-			inputMatchers: []services.AzureMatcher{
+			inputMatchers: []types.AzureMatcher{
 				{
 					Subscriptions:  []string{subscription1},
 					ResourceGroups: []string{"*"},
@@ -225,7 +225,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 		},
 		{
 			name: "skip access denied errors",
-			inputMatchers: []services.AzureMatcher{
+			inputMatchers: []types.AzureMatcher{
 				{
 					Subscriptions:  []string{subscription1, subscription2},
 					ResourceGroups: []string{"*"},
@@ -264,7 +264,7 @@ func TestAzureDBServerFetchers(t *testing.T) {
 		},
 		{
 			name: "skip group not found errors",
-			inputMatchers: []services.AzureMatcher{
+			inputMatchers: []types.AzureMatcher{
 				{
 					Subscriptions:  []string{subscription1},
 					ResourceGroups: []string{"foobar", group1, "baz"},
diff --git a/lib/srv/discovery/fetchers/db/azure_mysql_flex_test.go b/lib/srv/discovery/fetchers/db/azure_mysql_flex_test.go
index 6cecc6df1a436..fd629ea44824e 100644
--- a/lib/srv/discovery/fetchers/db/azure_mysql_flex_test.go
+++ b/lib/srv/discovery/fetchers/db/azure_mysql_flex_test.go
@@ -35,7 +35,7 @@ func TestAzureMySQLFlexFetchers(t *testing.T) {
 
 	azureSub := makeAzureSubscription(t, "sub123")
 	azMySQLFlexServer, azMySQLFlexDB := makeAzureMySQLFlexServer(t, "mysql-flex", "sub123", "group 1", "East US", map[string]string{"env": "prod"})
-	azureMatchers := []services.AzureMatcher{{
+	azureMatchers := []types.AzureMatcher{{
 		Types:        []string{services.AzureMatcherMySQL},
 		ResourceTags: types.Labels{"env": []string{"prod"}},
 		Regions:      []string{"eastus"},
diff --git a/lib/srv/discovery/fetchers/db/azure_postgres_flex_test.go b/lib/srv/discovery/fetchers/db/azure_postgres_flex_test.go
index c175f5caa3365..8114ffe1e9c98 100644
--- a/lib/srv/discovery/fetchers/db/azure_postgres_flex_test.go
+++ b/lib/srv/discovery/fetchers/db/azure_postgres_flex_test.go
@@ -35,7 +35,7 @@ func TestAzurePostgresFlexFetchers(t *testing.T) {
 
 	azureSub := makeAzureSubscription(t, "sub123")
 	azPostgresFlexServer, azPostgresFlexDB := makeAzurePostgresFlexServer(t, "postgres-flex", "sub123", "group 1", "East US", map[string]string{"env": "prod"})
-	azureMatchers := []services.AzureMatcher{{
+	azureMatchers := []types.AzureMatcher{{
 		Types:        []string{services.AzureMatcherPostgres},
 		ResourceTags: types.Labels{"env": []string{"prod"}},
 		Regions:      []string{"eastus"},
diff --git a/lib/srv/discovery/fetchers/db/azure_redis_test.go b/lib/srv/discovery/fetchers/db/azure_redis_test.go
index 0c71e1fc1bc9b..2b62678f4be7a 100644
--- a/lib/srv/discovery/fetchers/db/azure_redis_test.go
+++ b/lib/srv/discovery/fetchers/db/azure_redis_test.go
@@ -45,7 +45,7 @@ func TestAzureRedisFetchers(t *testing.T) {
 	azRedisServer, azRedisDB := makeAzureRedisServer(t, "redis", "sub", "group", "East US", map[string]string{"env": "prod"})
 	azRedisEnterpriseCluster, azRedisEnterpriseDatabase, azRedisEnterpriseDB := makeAzureRedisEnterpriseCluster(t, "redis-enterprise", "sub", "group", "eastus", map[string]string{"env": "prod"})
 
-	azureMatchers := []services.AzureMatcher{{
+	azureMatchers := []types.AzureMatcher{{
 		Types:        []string{services.AzureMatcherRedis},
 		ResourceTags: types.Labels{"env": []string{"prod"}},
 		Regions:      []string{"eastus"},
diff --git a/lib/srv/discovery/fetchers/db/db.go b/lib/srv/discovery/fetchers/db/db.go
index d9077bbb2e221..1d6a07a8c3cee 100644
--- a/lib/srv/discovery/fetchers/db/db.go
+++ b/lib/srv/discovery/fetchers/db/db.go
@@ -29,7 +29,7 @@ import (
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 )
 
-type makeAWSFetcherFunc func(context.Context, cloud.AWSClients, string, types.Labels, services.AssumeRole) (common.Fetcher, error)
+type makeAWSFetcherFunc func(context.Context, cloud.AWSClients, string, types.Labels, types.AssumeRole) (common.Fetcher, error)
 type makeAzureFetcherFunc func(azureFetcherConfig) (common.Fetcher, error)
 
 var (
@@ -40,6 +40,7 @@ var (
 		services.AWSMatcherRedshiftServerless: {makeRedshiftServerlessFetcher},
 		services.AWSMatcherElastiCache:        {makeElastiCacheFetcher},
 		services.AWSMatcherMemoryDB:           {makeMemoryDBFetcher},
+		services.AWSMatcherOpenSearch:         {makeOpenSearchFetcher},
 	}
 
 	makeAzureFetcherFuncs = map[string][]makeAzureFetcherFunc{
@@ -61,8 +62,12 @@ func IsAzureMatcherType(matcherType string) bool {
 }
 
 // MakeAWSFetchers creates new AWS database fetchers.
-func MakeAWSFetchers(ctx context.Context, clients cloud.AWSClients, matchers []services.AWSMatcher) (result []common.Fetcher, err error) {
+func MakeAWSFetchers(ctx context.Context, clients cloud.AWSClients, matchers []types.AWSMatcher) (result []common.Fetcher, err error) {
 	for _, matcher := range matchers {
+		assumeRole := types.AssumeRole{}
+		if matcher.AssumeRole != nil {
+			assumeRole = *matcher.AssumeRole
+		}
 		for _, matcherType := range matcher.Types {
 			makeFetchers, found := makeAWSFetcherFuncs[matcherType]
 			if !found {
@@ -71,7 +76,7 @@ func MakeAWSFetchers(ctx context.Context, clients cloud.AWSClients, matchers []s
 
 			for _, makeFetcher := range makeFetchers {
 				for _, region := range matcher.Regions {
-					fetcher, err := makeFetcher(ctx, clients, region, matcher.Tags, matcher.AssumeRole)
+					fetcher, err := makeFetcher(ctx, clients, region, matcher.Tags, assumeRole)
 					if err != nil {
 						return nil, trace.Wrap(err)
 					}
@@ -84,7 +89,7 @@ func MakeAWSFetchers(ctx context.Context, clients cloud.AWSClients, matchers []s
 }
 
 // MakeAzureFetchers creates new Azure database fetchers.
-func MakeAzureFetchers(clients cloud.AzureClients, matchers []services.AzureMatcher) (result []common.Fetcher, err error) {
+func MakeAzureFetchers(clients cloud.AzureClients, matchers []types.AzureMatcher) (result []common.Fetcher, err error) {
 	for _, matcher := range services.SimplifyAzureMatchers(matchers) {
 		for _, matcherType := range matcher.Types {
 			makeFetchers, found := makeAzureFetcherFuncs[matcherType]
@@ -116,7 +121,7 @@ func MakeAzureFetchers(clients cloud.AzureClients, matchers []services.AzureMatc
 }
 
 // makeRDSInstanceFetcher returns RDS instance fetcher for the provided region and tags.
-func makeRDSInstanceFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole services.AssumeRole) (common.Fetcher, error) {
+func makeRDSInstanceFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole types.AssumeRole) (common.Fetcher, error) {
 	rds, err := clients.GetAWSRDSClient(ctx, region, cloud.WithAssumeRole(assumeRole.RoleARN, assumeRole.ExternalID))
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -132,7 +137,7 @@ func makeRDSInstanceFetcher(ctx context.Context, clients cloud.AWSClients, regio
 }
 
 // makeRDSAuroraFetcher returns RDS Aurora fetcher for the provided region and tags.
-func makeRDSAuroraFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole services.AssumeRole) (common.Fetcher, error) {
+func makeRDSAuroraFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole types.AssumeRole) (common.Fetcher, error) {
 	rds, err := clients.GetAWSRDSClient(ctx, region, cloud.WithAssumeRole(assumeRole.RoleARN, assumeRole.ExternalID))
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -148,7 +153,7 @@ func makeRDSAuroraFetcher(ctx context.Context, clients cloud.AWSClients, region
 }
 
 // makeRDSProxyFetcher returns RDS proxy fetcher for the provided region and tags.
-func makeRDSProxyFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole services.AssumeRole) (common.Fetcher, error) {
+func makeRDSProxyFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole types.AssumeRole) (common.Fetcher, error) {
 	rds, err := clients.GetAWSRDSClient(ctx, region, cloud.WithAssumeRole(assumeRole.RoleARN, assumeRole.ExternalID))
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -163,7 +168,7 @@ func makeRDSProxyFetcher(ctx context.Context, clients cloud.AWSClients, region s
 }
 
 // makeRedshiftFetcher returns Redshift fetcher for the provided region and tags.
-func makeRedshiftFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole services.AssumeRole) (common.Fetcher, error) {
+func makeRedshiftFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole types.AssumeRole) (common.Fetcher, error) {
 	redshift, err := clients.GetAWSRedshiftClient(ctx, region, cloud.WithAssumeRole(assumeRole.RoleARN, assumeRole.ExternalID))
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -177,7 +182,7 @@ func makeRedshiftFetcher(ctx context.Context, clients cloud.AWSClients, region s
 }
 
 // makeElastiCacheFetcher returns ElastiCache fetcher for the provided region and tags.
-func makeElastiCacheFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole services.AssumeRole) (common.Fetcher, error) {
+func makeElastiCacheFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole types.AssumeRole) (common.Fetcher, error) {
 	elastiCache, err := clients.GetAWSElastiCacheClient(ctx, region, cloud.WithAssumeRole(assumeRole.RoleARN, assumeRole.ExternalID))
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -191,7 +196,7 @@ func makeElastiCacheFetcher(ctx context.Context, clients cloud.AWSClients, regio
 }
 
 // makeMemoryDBFetcher returns MemoryDB fetcher for the provided region and tags.
-func makeMemoryDBFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole services.AssumeRole) (common.Fetcher, error) {
+func makeMemoryDBFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole types.AssumeRole) (common.Fetcher, error) {
 	memorydb, err := clients.GetAWSMemoryDBClient(ctx, region, cloud.WithAssumeRole(assumeRole.RoleARN, assumeRole.ExternalID))
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -204,9 +209,24 @@ func makeMemoryDBFetcher(ctx context.Context, clients cloud.AWSClients, region s
 	})
 }
 
+// makeOpenSearchFetcher returns OpenSearch fetcher for the provided region and tags.
+func makeOpenSearchFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole types.AssumeRole) (common.Fetcher, error) {
+	opensearch, err := clients.GetAWSOpenSearchClient(ctx, region, cloud.WithAssumeRole(assumeRole.RoleARN, assumeRole.ExternalID))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return newOpenSearchFetcher(openSearchFetcherConfig{
+		Region:     region,
+		Labels:     tags,
+		openSearch: opensearch,
+		AssumeRole: assumeRole,
+	})
+}
+
 // makeRedshiftServerlessFetcher returns Redshift Serverless fetcher for the
 // provided region and tags.
-func makeRedshiftServerlessFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole services.AssumeRole) (common.Fetcher, error) {
+func makeRedshiftServerlessFetcher(ctx context.Context, clients cloud.AWSClients, region string, tags types.Labels, assumeRole types.AssumeRole) (common.Fetcher, error) {
 	client, err := clients.GetAWSRedshiftServerlessClient(ctx, region, cloud.WithAssumeRole(assumeRole.RoleARN, assumeRole.ExternalID))
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -236,7 +256,7 @@ func filterDatabasesByLabels(databases types.Databases, labels types.Labels, log
 }
 
 // applyAssumeRoleToDatabases applies assume role settings from fetcher to databases.
-func applyAssumeRoleToDatabases(databases types.Databases, assumeRole services.AssumeRole) {
+func applyAssumeRoleToDatabases(databases types.Databases, assumeRole types.AssumeRole) {
 	for _, db := range databases {
 		db.SetAWSAssumeRole(assumeRole.RoleARN)
 		db.SetAWSExternalID(assumeRole.ExternalID)
diff --git a/lib/srv/discovery/fetchers/db/helpers_test.go b/lib/srv/discovery/fetchers/db/helpers_test.go
index 27dd07933007c..a2a81e18c3f2d 100644
--- a/lib/srv/discovery/fetchers/db/helpers_test.go
+++ b/lib/srv/discovery/fetchers/db/helpers_test.go
@@ -26,7 +26,6 @@ import (
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
-	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 )
 
@@ -44,15 +43,15 @@ func toTypeLabels(labels map[string]string) types.Labels {
 	return result
 }
 
-func makeAWSMatchersForType(matcherType, region string, tags map[string]string) []services.AWSMatcher {
-	return []services.AWSMatcher{{
+func makeAWSMatchersForType(matcherType, region string, tags map[string]string) []types.AWSMatcher {
+	return []types.AWSMatcher{{
 		Types:   []string{matcherType},
 		Regions: []string{region},
 		Tags:    toTypeLabels(tags),
 	}}
 }
 
-func mustMakeAWSFetchers(t *testing.T, clients cloud.AWSClients, matchers []services.AWSMatcher) []common.Fetcher {
+func mustMakeAWSFetchers(t *testing.T, clients cloud.AWSClients, matchers []types.AWSMatcher) []common.Fetcher {
 	t.Helper()
 
 	fetchers, err := MakeAWSFetchers(context.Background(), clients, matchers)
@@ -66,7 +65,7 @@ func mustMakeAWSFetchers(t *testing.T, clients cloud.AWSClients, matchers []serv
 	return fetchers
 }
 
-func mustMakeAzureFetchers(t *testing.T, clients cloud.AzureClients, matchers []services.AzureMatcher) []common.Fetcher {
+func mustMakeAzureFetchers(t *testing.T, clients cloud.AzureClients, matchers []types.AzureMatcher) []common.Fetcher {
 	t.Helper()
 
 	fetchers, err := MakeAzureFetchers(clients, matchers)
@@ -101,7 +100,7 @@ func mustGetDatabases(t *testing.T, fetchers []common.Fetcher) types.Databases {
 // Tests will cover:
 //   - that fetchers use the configured assume role when using AWS cloud clients.
 //   - that databases discovered and created by fetchers have the assumed role used to discover them populated.
-var testAssumeRole = services.AssumeRole{
+var testAssumeRole = types.AssumeRole{
 	RoleARN:    "arn:aws:iam::123456789012:role/test-role",
 	ExternalID: "externalID123",
 }
@@ -110,7 +109,7 @@ var testAssumeRole = services.AssumeRole{
 type awsFetcherTest struct {
 	name          string
 	inputClients  *cloud.TestCloudClients
-	inputMatchers []services.AWSMatcher
+	inputMatchers []types.AWSMatcher
 	wantDatabases types.Databases
 }
 
@@ -141,7 +140,7 @@ func testAWSFetchers(t *testing.T, tests ...awsFetcherTest) {
 }
 
 // copyDatabasesWithAWSAssumeRole copies input databases and sets a given AWS assume role for each copy.
-func copyDatabasesWithAWSAssumeRole(role services.AssumeRole, databases ...types.Database) types.Databases {
+func copyDatabasesWithAWSAssumeRole(role types.AssumeRole, databases ...types.Database) types.Databases {
 	if len(databases) == 0 {
 		return databases
 	}
@@ -154,13 +153,13 @@ func copyDatabasesWithAWSAssumeRole(role services.AssumeRole, databases ...types
 }
 
 // copyAWSMatchersWithAssumeRole copies input AWS matchers and sets a given AWS assume role for each copy.
-func copyAWSMatchersWithAssumeRole(role services.AssumeRole, matchers ...services.AWSMatcher) []services.AWSMatcher {
+func copyAWSMatchersWithAssumeRole(role types.AssumeRole, matchers ...types.AWSMatcher) []types.AWSMatcher {
 	if len(matchers) == 0 {
 		return matchers
 	}
-	out := make([]services.AWSMatcher, 0, len(matchers))
+	out := make([]types.AWSMatcher, 0, len(matchers))
 	for _, m := range matchers {
-		m.AssumeRole = role
+		m.AssumeRole = &role
 		out = append(out, m)
 	}
 	return out
diff --git a/lib/srv/heartbeat.go b/lib/srv/heartbeat.go
index 7f55fdc652b7e..79be188d224a5 100644
--- a/lib/srv/heartbeat.go
+++ b/lib/srv/heartbeat.go
@@ -399,7 +399,7 @@ func (h *Heartbeat) announce() error {
 			if !ok {
 				return trace.BadParameter("expected services.Server, got %#v", h.current)
 			}
-			err := h.Announcer.UpsertProxy(proxy)
+			err := h.Announcer.UpsertProxy(h.cancelCtx, proxy)
 			if err != nil {
 				// try next announce using keep alive period,
 				// that happens more frequently
@@ -416,7 +416,7 @@ func (h *Heartbeat) announce() error {
 			if !ok {
 				return trace.BadParameter("expected services.Server, got %#v", h.current)
 			}
-			err := h.Announcer.UpsertAuthServer(auth)
+			err := h.Announcer.UpsertAuthServer(h.cancelCtx, auth)
 			if err != nil {
 				h.nextAnnounce = h.Clock.Now().UTC().Add(h.KeepAlivePeriod)
 				h.setState(HeartbeatStateAnnounceWait)
diff --git a/lib/srv/heartbeat_test.go b/lib/srv/heartbeat_test.go
index bb9d62a3487b7..d36e101e93cb9 100644
--- a/lib/srv/heartbeat_test.go
+++ b/lib/srv/heartbeat_test.go
@@ -353,12 +353,12 @@ func (f *fakeAnnouncer) UpsertNode(ctx context.Context, s types.Server) (*types.
 	return &types.KeepAlive{}, nil
 }
 
-func (f *fakeAnnouncer) UpsertProxy(s types.Server) error {
+func (f *fakeAnnouncer) UpsertProxy(ctx context.Context, s types.Server) error {
 	f.upsertCalls[HeartbeatModeProxy]++
 	return f.err
 }
 
-func (f *fakeAnnouncer) UpsertAuthServer(s types.Server) error {
+func (f *fakeAnnouncer) UpsertAuthServer(ctx context.Context, s types.Server) error {
 	f.upsertCalls[HeartbeatModeAuth]++
 	return f.err
 }
diff --git a/lib/srv/monitor.go b/lib/srv/monitor.go
index e574bea323755..bab55c739a385 100644
--- a/lib/srv/monitor.go
+++ b/lib/srv/monitor.go
@@ -118,18 +118,36 @@ func NewConnectionMonitor(cfg ConnectionMonitorConfig) (*ConnectionMonitor, erro
 	return &ConnectionMonitor{cfg: cfg}, nil
 }
 
+func getTrackingReadConn(conn net.Conn) (*TrackingReadConn, bool) {
+	type netConn interface {
+		NetConn() net.Conn
+	}
+
+	for {
+		if tconn, ok := conn.(*TrackingReadConn); ok {
+			return tconn, true
+		}
+
+		connGetter, ok := conn.(netConn)
+		if !ok {
+			return nil, false
+		}
+		conn = connGetter.NetConn()
+	}
+}
+
 // MonitorConn ensures that the provided [net.Conn] is allowed per cluster configuration
 // and security controls. If at any point during the lifetime of the connection the
 // cluster controls dictate that the connection is not permitted it will be closed and the
 // returned [context.Context] will be canceled.
-func (c *ConnectionMonitor) MonitorConn(ctx context.Context, authzCtx *authz.Context, conn net.Conn) (context.Context, error) {
+func (c *ConnectionMonitor) MonitorConn(ctx context.Context, authzCtx *authz.Context, conn net.Conn) (context.Context, net.Conn, error) {
 	authPref, err := c.cfg.AccessPoint.GetAuthPreference(ctx)
 	if err != nil {
-		return ctx, trace.Wrap(err)
+		return ctx, conn, trace.Wrap(err)
 	}
 	netConfig, err := c.cfg.AccessPoint.GetClusterNetworkingConfig(ctx)
 	if err != nil {
-		return ctx, trace.Wrap(err)
+		return ctx, conn, trace.Wrap(err)
 	}
 
 	identity := authzCtx.Identity.GetIdentity()
@@ -137,15 +155,18 @@ func (c *ConnectionMonitor) MonitorConn(ctx context.Context, authzCtx *authz.Con
 
 	idleTimeout := checker.AdjustClientIdleTimeout(netConfig.GetClientIdleTimeout())
 
-	monitorCtx, cancel := context.WithCancel(ctx)
-	tconn, err := NewTrackingReadConn(TrackingReadConnConfig{
-		Conn:    conn,
-		Clock:   c.cfg.Clock,
-		Context: monitorCtx,
-		Cancel:  cancel,
-	})
-	if err != nil {
-		return ctx, trace.Wrap(err)
+	tconn, ok := getTrackingReadConn(conn)
+	if !ok {
+		tctx, cancel := context.WithCancel(ctx)
+		tconn, err = NewTrackingReadConn(TrackingReadConnConfig{
+			Conn:    conn,
+			Clock:   c.cfg.Clock,
+			Context: tctx,
+			Cancel:  cancel,
+		})
+		if err != nil {
+			return ctx, conn, trace.Wrap(err)
+		}
 	}
 
 	// Start monitoring client connection. When client connection is closed the monitor goroutine exits.
@@ -166,10 +187,10 @@ func (c *ConnectionMonitor) MonitorConn(ctx context.Context, authzCtx *authz.Con
 		IdleTimeoutMessage:    netConfig.GetClientIdleTimeoutMessage(),
 		MonitorCloseChannel:   c.cfg.MonitorCloseChannel,
 	}); err != nil {
-		return ctx, trace.Wrap(err)
+		return ctx, conn, trace.Wrap(err)
 	}
 
-	return monitorCtx, nil
+	return tconn.cfg.Context, tconn, nil
 }
 
 // MonitorConfig is a wiretap configuration
diff --git a/lib/srv/monitor_test.go b/lib/srv/monitor_test.go
index 04db939614513..c4dfa789a4268 100644
--- a/lib/srv/monitor_test.go
+++ b/lib/srv/monitor_test.go
@@ -101,8 +101,8 @@ func TestConnectionMonitorLockInForce(t *testing.T) {
 
 	t.Run("lock created after connection has been established", func(t *testing.T) {
 		// Create a fake connection and monitor it.
-		conn := &mockTrackingConn{closedC: make(chan struct{})}
-		monitorCtx, err := monitor.MonitorConn(ctx, authzCtx, conn)
+		tconn := &mockTrackingConn{closedC: make(chan struct{})}
+		monitorCtx, _, err := monitor.MonitorConn(ctx, authzCtx, tconn)
 		require.NoError(t, err)
 		require.Nil(t, monitorCtx.Err())
 
@@ -111,7 +111,7 @@ func TestConnectionMonitorLockInForce(t *testing.T) {
 
 		// Assert that the connection was terminated.
 		select {
-		case <-conn.closedC:
+		case <-tconn.closedC:
 		case <-time.After(2 * time.Second):
 			t.Fatal("Timeout waiting for connection close.")
 		}
@@ -126,14 +126,14 @@ func TestConnectionMonitorLockInForce(t *testing.T) {
 	t.Run("connection terminated if lock already exists", func(t *testing.T) {
 		// Create another connection for the locked user and validate
 		// that it is terminated right away.
-		conn := &mockTrackingConn{closedC: make(chan struct{})}
-		monitorCtx, err := monitor.MonitorConn(ctx, authzCtx, conn)
+		tconn := &mockTrackingConn{closedC: make(chan struct{})}
+		monitorCtx, _, err := monitor.MonitorConn(ctx, authzCtx, tconn)
 		require.NoError(t, err)
 
 		// Assert that the context was canceled and that the connection was terminated.
 		require.Error(t, monitorCtx.Err())
 		select {
-		case <-conn.closedC:
+		case <-tconn.closedC:
 		case <-time.After(2 * time.Second):
 			t.Fatal("Timeout waiting for connection close.")
 		}
diff --git a/lib/srv/regular/fuzz_test.go b/lib/srv/regular/fuzz_test.go
index a70a48fec9da6..fb0b5a7b1e303 100644
--- a/lib/srv/regular/fuzz_test.go
+++ b/lib/srv/regular/fuzz_test.go
@@ -25,6 +25,15 @@ import (
 )
 
 func FuzzParseProxySubsys(f *testing.F) {
+	f.Add("")
+	f.Add("proxy:")
+	f.Add("proxy:@")
+	f.Add("proxy:foo@bar")
+	f.Add("proxy:host:22")
+	f.Add("proxy:@clustername")
+	f.Add("proxy:host:22@clustername")
+	f.Add("proxy:host:22@namespace@clustername")
+
 	f.Fuzz(func(t *testing.T, request string) {
 		server := &Server{
 			hostname:  "redhorse",
diff --git a/lib/srv/regular/proxy.go b/lib/srv/regular/proxy.go
index eae50d6a151d5..9c71af4c4e39a 100644
--- a/lib/srv/regular/proxy.go
+++ b/lib/srv/regular/proxy.go
@@ -177,8 +177,12 @@ func newProxySubsys(ctx *srv.ServerContext, srv *Server, req proxySubsysRequest)
 		req.clusterName = ctx.Identity.RouteToCluster
 	}
 	if req.clusterName != "" && srv.proxyTun != nil {
-		_, err := srv.tunnelWithAccessChecker(ctx).GetSite(req.clusterName)
+		checker, err := srv.tunnelWithAccessChecker(ctx)
 		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if _, err := checker.GetSite(req.clusterName); err != nil {
 			return nil, trace.BadParameter("invalid format for proxy request: unknown cluster %q", req.clusterName)
 		}
 	}
diff --git a/lib/srv/regular/sites.go b/lib/srv/regular/sites.go
index d4ad0cbfff110..04e3800e89cb5 100644
--- a/lib/srv/regular/sites.go
+++ b/lib/srv/regular/sites.go
@@ -52,7 +52,12 @@ func (t *proxySitesSubsys) Wait() error {
 // service.Site structures, and writes it serialized as JSON back to the SSH client
 func (t *proxySitesSubsys) Start(ctx context.Context, sconn *ssh.ServerConn, ch ssh.Channel, req *ssh.Request, serverContext *srv.ServerContext) error {
 	log.Debugf("proxysites.start(%v)", serverContext)
-	remoteSites, err := t.srv.tunnelWithAccessChecker(serverContext).GetSites()
+	checker, err := t.srv.tunnelWithAccessChecker(serverContext)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	remoteSites, err := checker.GetSites()
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/srv/regular/sshserver.go b/lib/srv/regular/sshserver.go
index 720d7e020da04..982aecbbf7448 100644
--- a/lib/srv/regular/sshserver.go
+++ b/lib/srv/regular/sshserver.go
@@ -56,6 +56,7 @@ import (
 	"github.com/gravitational/teleport/lib/proxy"
 	restricted "github.com/gravitational/teleport/lib/restrictedsession"
 	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
@@ -101,7 +102,7 @@ type Server struct {
 	cloudLabels labels.Importer
 
 	proxyMode        bool
-	proxyTun         reversetunnel.Tunnel
+	proxyTun         reversetunnelclient.Tunnel
 	proxyAccessPoint auth.ReadProxyAccessPoint
 	peerAddr         string
 
@@ -438,7 +439,7 @@ func SetShell(shell string) ServerOption {
 }
 
 // SetProxyMode starts this server in SSH proxying mode
-func SetProxyMode(peerAddr string, tsrv reversetunnel.Tunnel, ap auth.ReadProxyAccessPoint, router *proxy.Router) ServerOption {
+func SetProxyMode(peerAddr string, tsrv reversetunnelclient.Tunnel, ap auth.ReadProxyAccessPoint, router *proxy.Router) ServerOption {
 	return func(s *Server) error {
 		// always set proxy mode to true,
 		// because in some tests reverse tunnel is disabled,
@@ -903,8 +904,13 @@ func (s *Server) getNamespace() string {
 	return types.ProcessNamespace(s.namespace)
 }
 
-func (s *Server) tunnelWithAccessChecker(ctx *srv.ServerContext) reversetunnel.Tunnel {
-	return reversetunnel.NewTunnelWithRoles(s.proxyTun, ctx.Identity.AccessChecker, s.proxyAccessPoint)
+func (s *Server) tunnelWithAccessChecker(ctx *srv.ServerContext) (reversetunnelclient.Tunnel, error) {
+	clusterName, err := s.GetAccessPoint().GetClusterName()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return reversetunnelclient.NewTunnelWithRoles(s.proxyTun, clusterName.GetClusterName(), ctx.Identity.AccessChecker, s.proxyAccessPoint), nil
 }
 
 // Context returns server shutdown context
@@ -1642,14 +1648,14 @@ func (s *Server) dispatch(ctx context.Context, ch ssh.Channel, req *ssh.Request,
 	case tracessh.TracingRequest:
 		return nil
 	case sshutils.ExecRequest:
-		if _, err := s.termHandlers.SessionRegistry.TryCreateHostUser(serverContext); err != nil {
+		if err := s.termHandlers.SessionRegistry.TryCreateHostUser(serverContext); err != nil {
 			return trace.Wrap(err)
 		}
 		return s.termHandlers.HandleExec(ctx, ch, req, serverContext)
 	case sshutils.PTYRequest:
 		return s.termHandlers.HandlePTYReq(ctx, ch, req, serverContext)
 	case sshutils.ShellRequest:
-		if _, err := s.termHandlers.SessionRegistry.TryCreateHostUser(serverContext); err != nil {
+		if err := s.termHandlers.SessionRegistry.TryCreateHostUser(serverContext); err != nil {
 			return trace.Wrap(err)
 		}
 		return s.termHandlers.HandleShell(ctx, ch, req, serverContext)
@@ -1678,7 +1684,7 @@ func (s *Server) dispatch(ctx context.Context, ch ssh.Channel, req *ssh.Request,
 		// https://tools.ietf.org/html/draft-ietf-secsh-agent-02
 		// the open ssh proto spec that we implement is here:
 		// http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.agent
-		if _, err := s.termHandlers.SessionRegistry.TryCreateHostUser(serverContext); err != nil {
+		if err := s.termHandlers.SessionRegistry.TryCreateHostUser(serverContext); err != nil {
 			s.Logger.Warn(err)
 			return nil
 		}
diff --git a/lib/srv/server/azure_watcher.go b/lib/srv/server/azure_watcher.go
index 4671ab818c65b..06973a23e9c72 100644
--- a/lib/srv/server/azure_watcher.go
+++ b/lib/srv/server/azure_watcher.go
@@ -51,7 +51,7 @@ type AzureInstances struct {
 }
 
 // NewAzureWatcher creates a new Azure watcher instance.
-func NewAzureWatcher(ctx context.Context, matchers []services.AzureMatcher, clients cloud.Clients) (*Watcher, error) {
+func NewAzureWatcher(ctx context.Context, matchers []types.AzureMatcher, clients cloud.Clients) (*Watcher, error) {
 	cancelCtx, cancelFn := context.WithCancel(ctx)
 	watcher := Watcher{
 		fetchers:      []Fetcher{},
@@ -81,7 +81,7 @@ func NewAzureWatcher(ctx context.Context, matchers []services.AzureMatcher, clie
 }
 
 type azureFetcherConfig struct {
-	Matcher       services.AzureMatcher
+	Matcher       types.AzureMatcher
 	Subscription  string
 	ResourceGroup string
 	AzureClient   azure.VirtualMachinesClient
@@ -97,18 +97,23 @@ type azureInstanceFetcher struct {
 }
 
 func newAzureInstanceFetcher(cfg azureFetcherConfig) *azureInstanceFetcher {
-	return &azureInstanceFetcher{
+	ret := &azureInstanceFetcher{
 		Azure:         cfg.AzureClient,
 		Regions:       cfg.Matcher.Regions,
 		Subscription:  cfg.Subscription,
 		ResourceGroup: cfg.ResourceGroup,
 		Labels:        cfg.Matcher.ResourceTags,
-		Parameters: map[string]string{
+	}
+
+	if cfg.Matcher.Params != nil {
+		ret.Parameters = map[string]string{
 			"token":           cfg.Matcher.Params.JoinToken,
 			"scriptName":      cfg.Matcher.Params.ScriptName,
 			"publicProxyAddr": cfg.Matcher.Params.PublicProxyAddr,
-		},
+		}
 	}
+
+	return ret
 }
 
 func (*azureInstanceFetcher) GetMatchingInstances(_ []types.Server, _ bool) ([]Instances, error) {
diff --git a/lib/srv/server/azure_watcher_test.go b/lib/srv/server/azure_watcher_test.go
index ec10b6923fd5b..c47c17ca31bbb 100644
--- a/lib/srv/server/azure_watcher_test.go
+++ b/lib/srv/server/azure_watcher_test.go
@@ -27,7 +27,6 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/cloud/azure"
-	"github.com/gravitational/teleport/lib/services"
 )
 
 func (c *mockClients) GetAzureVirtualMachinesClient(subscription string) (azure.VirtualMachinesClient, error) {
@@ -80,12 +79,12 @@ func TestAzureWatcher(t *testing.T) {
 
 	tests := []struct {
 		name    string
-		matcher services.AzureMatcher
+		matcher types.AzureMatcher
 		wantVMs []string
 	}{
 		{
 			name: "all vms",
-			matcher: services.AzureMatcher{
+			matcher: types.AzureMatcher{
 				ResourceGroups: []string{"rg1", "rg2"},
 				Regions:        []string{"location1", "location2"},
 				ResourceTags:   types.Labels{"*": []string{"*"}},
@@ -94,7 +93,7 @@ func TestAzureWatcher(t *testing.T) {
 		},
 		{
 			name: "filter by resource group",
-			matcher: services.AzureMatcher{
+			matcher: types.AzureMatcher{
 				ResourceGroups: []string{"rg1"},
 				Regions:        []string{"location1", "location2"},
 				ResourceTags:   types.Labels{"*": []string{"*"}},
@@ -103,7 +102,7 @@ func TestAzureWatcher(t *testing.T) {
 		},
 		{
 			name: "filter by location",
-			matcher: services.AzureMatcher{
+			matcher: types.AzureMatcher{
 				ResourceGroups: []string{"rg1", "rg2"},
 				Regions:        []string{"location2"},
 				ResourceTags:   types.Labels{"*": []string{"*"}},
@@ -112,7 +111,7 @@ func TestAzureWatcher(t *testing.T) {
 		},
 		{
 			name: "filter by tag",
-			matcher: services.AzureMatcher{
+			matcher: types.AzureMatcher{
 				ResourceGroups: []string{"rg1", "rg2"},
 				Regions:        []string{"location1", "location2"},
 				ResourceTags:   types.Labels{"teleport": []string{"yes"}},
@@ -128,7 +127,7 @@ func TestAzureWatcher(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 			t.Cleanup(cancel)
-			watcher, err := NewAzureWatcher(ctx, []services.AzureMatcher{tc.matcher}, &clients)
+			watcher, err := NewAzureWatcher(ctx, []types.AzureMatcher{tc.matcher}, &clients)
 			require.NoError(t, err)
 
 			go watcher.Run()
diff --git a/lib/srv/server/ec2_watcher.go b/lib/srv/server/ec2_watcher.go
index ce299a564a1d0..e04c068dfd6bc 100644
--- a/lib/srv/server/ec2_watcher.go
+++ b/lib/srv/server/ec2_watcher.go
@@ -29,7 +29,6 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/cloud"
-	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 )
 
@@ -83,7 +82,7 @@ func ToEC2Instances(insts []*ec2.Instance) []EC2Instance {
 }
 
 // NewEC2Watcher creates a new EC2 watcher instance.
-func NewEC2Watcher(ctx context.Context, matchers []services.AWSMatcher, clients cloud.Clients, missedRotation <-chan []types.Server) (*Watcher, error) {
+func NewEC2Watcher(ctx context.Context, matchers []types.AWSMatcher, clients cloud.Clients, missedRotation <-chan []types.Server) (*Watcher, error) {
 	cancelCtx, cancelFn := context.WithCancel(ctx)
 	watcher := Watcher{
 		fetchers:       []Fetcher{},
@@ -119,7 +118,7 @@ func NewEC2Watcher(ctx context.Context, matchers []services.AWSMatcher, clients
 }
 
 type ec2FetcherConfig struct {
-	Matcher   services.AWSMatcher
+	Matcher   types.AWSMatcher
 	Region    string
 	Document  string
 	EC2Client ec2iface.EC2API
@@ -197,6 +196,9 @@ func newEC2InstanceFetcher(cfg ec2FetcherConfig) *ec2InstanceFetcher {
 		log.Debug("Not setting any tag filters as there is a '*:...' tag present and AWS doesnt allow globbing on keys")
 	}
 	var parameters map[string]string
+	if cfg.Matcher.Params == nil {
+		cfg.Matcher.Params = &types.InstallerParams{}
+	}
 	if cfg.Matcher.Params.InstallTeleport {
 		parameters = map[string]string{
 			ParamToken:      cfg.Matcher.Params.JoinToken,
diff --git a/lib/srv/server/ec2_watcher_test.go b/lib/srv/server/ec2_watcher_test.go
index 83a61c51efcc2..d440c4bd68464 100644
--- a/lib/srv/server/ec2_watcher_test.go
+++ b/lib/srv/server/ec2_watcher_test.go
@@ -30,7 +30,6 @@ import (
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/cloud"
 	"github.com/gravitational/teleport/lib/cloud/azure"
-	"github.com/gravitational/teleport/lib/services"
 )
 
 type mockClients struct {
@@ -141,24 +140,24 @@ func TestEC2Watcher(t *testing.T) {
 	clients := mockClients{
 		ec2Client: &mockEC2Client{},
 	}
-	matchers := []services.AWSMatcher{
+	matchers := []types.AWSMatcher{
 		{
-			Params: services.InstallerParams{
+			Params: &types.InstallerParams{
 				InstallTeleport: true,
 			},
 			Types:   []string{"EC2"},
 			Regions: []string{"us-west-2"},
 			Tags:    map[string]utils.Strings{"teleport": {"yes"}},
-			SSM:     &services.AWSSSM{},
+			SSM:     &types.AWSSSM{},
 		},
 		{
-			Params: services.InstallerParams{
+			Params: &types.InstallerParams{
 				InstallTeleport: true,
 			},
 			Types:   []string{"EC2"},
 			Regions: []string{"us-west-2"},
 			Tags:    map[string]utils.Strings{"env": {"dev"}},
-			SSM:     &services.AWSSSM{},
+			SSM:     &types.AWSSSM{},
 		},
 	}
 	ctx := context.Background()
diff --git a/lib/srv/sess.go b/lib/srv/sess.go
index ca04ecf673643..817ade8d57a37 100644
--- a/lib/srv/sess.go
+++ b/lib/srv/sess.go
@@ -21,7 +21,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"os/user"
 	"path/filepath"
 	"sync"
 	"sync/atomic"
@@ -36,6 +35,7 @@ import (
 	"go.opentelemetry.io/otel/attribute"
 	oteltrace "go.opentelemetry.io/otel/trace"
 	"golang.org/x/crypto/ssh"
+	"golang.org/x/exp/slices"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
@@ -185,38 +185,37 @@ func (s *SessionRegistry) Close() {
 	s.log.Debug("Closing Session Registry.")
 }
 
-func (s *SessionRegistry) TryCreateHostUser(ctx *ServerContext) (*user.User, error) {
+func (s *SessionRegistry) TryCreateHostUser(ctx *ServerContext) error {
 	if !ctx.srv.GetCreateHostUser() || s.users == nil {
-		return nil, nil // not an error to not be able to create a host user
+		return nil // not an error to not be able to create a host user
 	}
 
 	ui, err := ctx.Identity.AccessChecker.HostUsers(ctx.srv.GetInfo())
 	if err != nil {
 		if trace.IsAccessDenied(err) {
-			return nil, nil
+			return nil
 		}
 		log.Debug("Error while checking host users creation permission: ", err)
-		return nil, trace.Wrap(err)
+		return trace.Wrap(err)
 	}
 
-	tempUser, existsErr := s.users.UserExists(ctx.Identity.Login)
+	existsErr := s.users.UserExists(ctx.Identity.Login)
 	if trace.IsAccessDenied(err) && existsErr != nil {
-		return tempUser,
-			trace.WrapWithMessage(err, "Insufficient permission for host user creation")
-	}
-	tempUser, userCloser, err := s.users.CreateUser(ctx.Identity.Login, ui)
-	if err != nil && !trace.IsAlreadyExists(err) {
-		log.Debugf("Error creating user %s: %s", ctx.Identity.Login, err)
-		return nil, trace.Wrap(err)
+		return trace.WrapWithMessage(err, "Insufficient permission for host user creation")
 	}
+	userCloser, err := s.users.CreateUser(ctx.Identity.Login, ui)
 	if userCloser != nil {
 		ctx.AddCloser(userCloser)
 	}
+	if err != nil && !trace.IsAlreadyExists(err) {
+		log.Debugf("Error creating user %s: %s", ctx.Identity.Login, err)
+		return trace.Wrap(err)
+	}
 
 	// Indicate that the user was created by Teleport.
 	ctx.UserCreatedByTeleport = true
 
-	return tempUser, nil
+	return nil
 }
 
 // OpenSession either joins an existing active session or starts a new session.
@@ -1065,19 +1064,18 @@ func (s *session) launch() {
 	// If the identity is verified with an MFA device, we enabled MFA-based presence for the session.
 	if s.presenceEnabled {
 		go func() {
-			ticker := time.NewTicker(PresenceVerifyInterval)
+			ticker := s.registry.clock.NewTicker(PresenceVerifyInterval)
 			defer ticker.Stop()
-		outer:
 			for {
 				select {
-				case <-ticker.C:
-					err := s.checkPresence()
+				case <-ticker.Chan():
+					err := s.checkPresence(s.serverCtx)
 					if err != nil {
 						s.log.WithError(err).Error("Failed to check presence, terminating session as a security measure")
 						s.Stop()
 					}
 				case <-s.stopC:
-					break outer
+					return
 				}
 			}
 		}()
@@ -1127,7 +1125,7 @@ func (s *session) startInteractive(ctx context.Context, scx *ServerContext, p *p
 	s.inWriter = inWriter
 	s.io.AddReader("reader", inReader)
 	s.io.AddWriter(sessionRecorderID, utils.WriteCloserWithContext(scx.srv.Context(), s.Recorder()))
-	s.BroadcastMessage("Creating session with ID: %v...", s.id)
+	s.BroadcastMessage("Creating session with ID: %v", s.id)
 	s.BroadcastMessage(SessionControlsInfoBroadcast)
 
 	if err := s.startTerminal(ctx, scx); err != nil {
@@ -1546,16 +1544,24 @@ func (s *session) lingerAndDie(ctx context.Context, party *party) {
 	}
 }
 
-func (s *session) checkPresence() error {
+func (s *session) checkPresence(ctx context.Context) error {
+	// We cannot check presence on the local tracker as that will not
+	// be updated in response to parties performing their presence
+	// checks. To prevent the stale version of the session tracker from
+	// terminating a session we must get the session tracker from Auth.
+	tracker, err := s.registry.SessionTrackerService.GetSessionTracker(ctx, s.tracker.tracker.GetSessionID())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
 	s.mu.Lock()
 	defer s.mu.Unlock()
-
-	for _, participant := range s.tracker.GetParticipants() {
+	for _, participant := range tracker.GetParticipants() {
 		if participant.User == s.initiator {
 			continue
 		}
 
-		if participant.Mode == string(types.SessionModeratorMode) && time.Now().UTC().After(participant.LastActive.Add(PresenceMaxDifference)) {
+		if participant.Mode == string(types.SessionModeratorMode) && s.registry.clock.Now().UTC().After(participant.LastActive.Add(PresenceMaxDifference)) {
 			s.log.Warnf("Participant %v is not active, kicking.", participant.ID)
 			if party := s.parties[rsession.ID(participant.ID)]; party != nil {
 				if err := party.closeUnderSessionLock(); err != nil {
@@ -1834,12 +1840,12 @@ func (s *session) join(ch ssh.Channel, scx *ServerContext, mode types.SessionPar
 		}
 
 		modes := s.access.CanJoin(accessContext)
-		if !auth.SliceContainsMode(modes, mode) {
+		if !slices.Contains(modes, mode) {
 			return trace.AccessDenied("insufficient permissions to join session %v", s.id)
 		}
 
 		if s.presenceEnabled {
-			_, err := ch.SendRequest(teleport.MFAPresenceRequest, false, nil)
+			_, _, err := scx.ServerConn.SendRequest(teleport.MFAPresenceRequest, false, nil)
 			if err != nil {
 				return trace.WrapWithMessage(err, "failed to send MFA presence request")
 			}
@@ -1970,13 +1976,13 @@ func (s *session) trackSession(ctx context.Context, teleportUser string, policyS
 		HostUser:     teleportUser,
 		Reason:       s.scx.env[teleport.EnvSSHSessionReason],
 		HostPolicies: policySet,
-		Created:      s.registry.clock.Now(),
+		Created:      s.registry.clock.Now().UTC(),
 		Participants: []types.Participant{
 			{
 				ID:         p.id.String(),
 				User:       p.user,
 				Mode:       string(p.mode),
-				LastActive: time.Now().UTC(),
+				LastActive: s.registry.clock.Now().UTC(),
 			},
 		},
 		HostID: s.registry.Srv.ID(),
diff --git a/lib/srv/session_control.go b/lib/srv/session_control.go
index 067fee75a74dc..4e38190d94653 100644
--- a/lib/srv/session_control.go
+++ b/lib/srv/session_control.go
@@ -24,6 +24,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/sirupsen/logrus"
 	oteltrace "go.opentelemetry.io/otel/trace"
+	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
@@ -140,6 +141,53 @@ func NewSessionController(cfg SessionControllerConfig) (*SessionController, erro
 	return &SessionController{cfg: cfg}, nil
 }
 
+// WebSessionContext contains information associated with a session
+// established via the web ui.
+type WebSessionContext interface {
+	GetUserAccessChecker() (services.AccessChecker, error)
+	GetSSHCertificate() (*ssh.Certificate, error)
+	GetUser() string
+}
+
+// WebSessionController is a wrapper around [SessionController] which can be
+// used to create an [IdentityContext] and apply session controls for a web session.
+// This allows `lib/web` to not depend on `lib/srv`.
+func WebSessionController(controller *SessionController) func(ctx context.Context, sctx WebSessionContext, login, localAddr, remoteAddr string) (context.Context, error) {
+	return func(ctx context.Context, sctx WebSessionContext, login, localAddr, remoteAddr string) (context.Context, error) {
+		accessChecker, err := sctx.GetUserAccessChecker()
+		if err != nil {
+			return ctx, trace.Wrap(err)
+		}
+
+		sshCert, err := sctx.GetSSHCertificate()
+		if err != nil {
+			return ctx, trace.Wrap(err)
+		}
+
+		unmappedRoles, err := services.ExtractRolesFromCert(sshCert)
+		if err != nil {
+			return ctx, trace.Wrap(err)
+		}
+
+		accessRequestIDs, err := ParseAccessRequestIDs(sshCert.Extensions[teleport.CertExtensionTeleportActiveRequests])
+		if err != nil {
+			return ctx, trace.Wrap(err)
+		}
+
+		identity := IdentityContext{
+			AccessChecker:  accessChecker,
+			TeleportUser:   sctx.GetUser(),
+			Login:          login,
+			Certificate:    sshCert,
+			UnmappedRoles:  unmappedRoles,
+			ActiveRequests: accessRequestIDs,
+			Impersonator:   sshCert.Extensions[teleport.CertExtensionImpersonator],
+		}
+		ctx, err = controller.AcquireSessionContext(ctx, identity, localAddr, remoteAddr)
+		return ctx, trace.Wrap(err)
+	}
+}
+
 // AcquireSessionContext attempts to create a context for the session. If the session is
 // not allowed due to session control an error is returned. The returned
 // context is scoped to the session and will be canceled in the event the semaphore lock
diff --git a/lib/srv/transport/transportv1/transport.go b/lib/srv/transport/transportv1/transport.go
index 91970d8e7202f..2987e75dbbaab 100644
--- a/lib/srv/transport/transportv1/transport.go
+++ b/lib/srv/transport/transportv1/transport.go
@@ -43,10 +43,10 @@ type Dialer interface {
 	DialHost(ctx context.Context, clientSrcAddr, clientDstAddr net.Addr, host, port, cluster string, checker services.AccessChecker, agentGetter teleagent.Getter, singer agentless.SignerCreator) (_ net.Conn, teleportVersion string, err error)
 }
 
-// ConnMonitor monitors authorized connections and terminates them when
+// ConnectionMonitor monitors authorized connections and terminates them when
 // session controls dictate so.
 type ConnectionMonitor interface {
-	MonitorConn(ctx context.Context, authCtx *authz.Context, conn net.Conn) (context.Context, error)
+	MonitorConn(ctx context.Context, authCtx *authz.Context, conn net.Conn) (context.Context, net.Conn, error)
 }
 
 // ServerConfig holds creation parameters for Service.
@@ -296,8 +296,8 @@ func (s *Service) ProxySSH(stream transportv1pb.TransportService_ProxySSHServer)
 	}
 
 	// monitor the user connection
-	userConn := streamutils.NewConn(sshStreamRW, p.Addr, targetAddr)
-	monitorCtx, err := s.cfg.ConnectionMonitor.MonitorConn(ctx, authzContext, userConn)
+	conn := streamutils.NewConn(sshStreamRW, p.Addr, targetAddr)
+	monitorCtx, userConn, err := s.cfg.ConnectionMonitor.MonitorConn(ctx, authzContext, conn)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/srv/transport/transportv1/transport_test.go b/lib/srv/transport/transportv1/transport_test.go
index 3d5748831f52b..00b61e155b1ce 100644
--- a/lib/srv/transport/transportv1/transport_test.go
+++ b/lib/srv/transport/transportv1/transport_test.go
@@ -227,8 +227,8 @@ func fakeSigner(authzCtx *authz.Context, clusterName string) agentless.SignerCre
 
 type fakeMonitor struct{}
 
-func (f fakeMonitor) MonitorConn(ctx context.Context, authCtx *authz.Context, conn net.Conn) (context.Context, error) {
-	return ctx, nil
+func (f fakeMonitor) MonitorConn(ctx context.Context, authCtx *authz.Context, conn net.Conn) (context.Context, net.Conn, error) {
+	return ctx, conn, nil
 }
 
 // TestService_GetClusterDetails validates that a [Service] returns
diff --git a/lib/srv/usermgmt.go b/lib/srv/usermgmt.go
index 8ea7bd6476c31..a6130070551a2 100644
--- a/lib/srv/usermgmt.go
+++ b/lib/srv/usermgmt.go
@@ -99,7 +99,7 @@ var ErrUserLoggedIn = errors.New("User logged in error")
 
 type HostUsers interface {
 	// CreateUser creates a temporary Teleport user in the TeleportServiceGroup
-	CreateUser(name string, hostRoleInfo *services.HostUsersInfo) (*user.User, io.Closer, error)
+	CreateUser(name string, hostRoleInfo *services.HostUsersInfo) (io.Closer, error)
 	// DeleteUser deletes a temporary Teleport user only if they are
 	// in a specified group
 	DeleteUser(name string, gid string) error
@@ -112,7 +112,7 @@ type HostUsers interface {
 	Shutdown()
 
 	// UserExists returns nil should a hostuser exist
-	UserExists(string) (*user.User, error)
+	UserExists(string) error
 
 	// doWithUserLock runs the passed function with a host user
 	// interaction lock
@@ -151,23 +151,27 @@ func sanitizeSudoersName(username string) string {
 }
 
 // CreateUser creates a temporary Teleport user in the TeleportServiceGroup
-func (u *HostUserManagement) CreateUser(name string, ui *services.HostUsersInfo) (*user.User, io.Closer, error) {
+func (u *HostUserManagement) CreateUser(name string, ui *services.HostUsersInfo) (io.Closer, error) {
+	if ui.Mode == types.CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED {
+		return nil, trace.BadParameter("Mode is a required argument to CreateUser")
+	}
+
 	tempUser, err := u.backend.Lookup(name)
 	if err != nil && err != user.UnknownUserError(name) {
-		return nil, nil, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
 	if tempUser != nil {
 		gids, err := u.backend.UserGIDs(tempUser)
 		if err != nil {
-			return nil, nil, trace.Wrap(err)
+			return nil, trace.Wrap(err)
 		}
 		systemGroup, err := u.backend.LookupGroup(types.TeleportServiceGroup)
 		if err != nil {
 			if isUnknownGroupError(err, types.TeleportServiceGroup) {
-				return nil, nil, trace.AlreadyExists("User %q already exists, however no users are currently managed by teleport", name)
+				return nil, trace.AlreadyExists("User %q already exists, however no users are currently managed by teleport", name)
 			}
-			return nil, nil, trace.Wrap(err)
+			return nil, trace.Wrap(err)
 		}
 		var found bool
 		for _, gid := range gids {
@@ -177,7 +181,7 @@ func (u *HostUserManagement) CreateUser(name string, ui *services.HostUsersInfo)
 			}
 		}
 		if !found {
-			return nil, nil, trace.AlreadyExists("User %q already exists and is not managed by teleport", name)
+			return nil, trace.AlreadyExists("User %q already exists and is not managed by teleport", name)
 		}
 
 		err = u.doWithUserLock(func(_ types.SemaphoreLease) error {
@@ -187,20 +191,24 @@ func (u *HostUserManagement) CreateUser(name string, ui *services.HostUsersInfo)
 			return nil
 		})
 		if err != nil {
-			return nil, nil, trace.Wrap(err)
+			return nil, trace.Wrap(err)
 		}
 		// try to delete even if the user already exists as only users
 		// in the teleport-system group will be deleted and this way
 		// if a user creates multiple sessions the account will
 		// succeed in deletion
-		return tempUser, &userCloser{
+		return &userCloser{
 			username: name,
 			users:    u,
 			backend:  u.backend,
 		}, trace.AlreadyExists("User %q already exists", name)
 	}
 
-	groups := append(ui.Groups, types.TeleportServiceGroup)
+	groups := make([]string, len(ui.Groups))
+	copy(groups, ui.Groups)
+	if ui.Mode == types.CreateHostUserMode_HOST_USER_MODE_DROP {
+		groups = append(groups, types.TeleportServiceGroup)
+	}
 	var errs []error
 	for _, group := range groups {
 		if err := u.createGroupIfNotExist(group); err != nil {
@@ -209,7 +217,7 @@ func (u *HostUserManagement) CreateUser(name string, ui *services.HostUsersInfo)
 		}
 	}
 	if err := trace.NewAggregate(errs...); err != nil {
-		return nil, nil, trace.WrapWithMessage(err, "error while creating groups")
+		return nil, trace.WrapWithMessage(err, "error while creating groups")
 	}
 
 	err = u.doWithUserLock(func(_ types.SemaphoreLease) error {
@@ -224,30 +232,33 @@ func (u *HostUserManagement) CreateUser(name string, ui *services.HostUsersInfo)
 		return nil
 	})
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
-	tempUser, err = u.backend.Lookup(name)
+	_, err = u.backend.Lookup(name)
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-	closer := &userCloser{
-		username: name,
-		users:    u,
-		backend:  u.backend,
+		return nil, trace.Wrap(err)
 	}
+
 	if len(ui.Sudoers) != 0 {
 		var sudoers strings.Builder
 		for _, entry := range ui.Sudoers {
 			sudoers.WriteString(fmt.Sprintf("%s %s\n", name, entry))
 		}
-		err := u.backend.WriteSudoersFile(name, []byte(sudoers.String()))
-		if err != nil {
-			return tempUser, closer, trace.Wrap(err)
-		}
+		err = u.backend.WriteSudoersFile(name, []byte(sudoers.String()))
 	}
 
-	return tempUser, closer, nil
+	if ui.Mode == types.CreateHostUserMode_HOST_USER_MODE_KEEP {
+		return nil, trace.Wrap(err)
+	}
+
+	closer := &userCloser{
+		username: name,
+		users:    u,
+		backend:  u.backend,
+	}
+
+	return closer, trace.Wrap(err)
 }
 
 func (u *HostUserManagement) doWithUserLock(f func(types.SemaphoreLease) error) error {
@@ -334,8 +345,8 @@ func (u *HostUserManagement) DeleteAllUsers() error {
 	return trace.NewAggregate(errs...)
 }
 
-// DeleteUser deletes the user only if they are
-// present in the specified group
+// DeleteUser deletes the specified user only if they are
+// present in the specified group.
 func (u *HostUserManagement) DeleteUser(username string, gid string) error {
 	tempUser, err := u.backend.Lookup(username)
 	if err != nil {
@@ -388,16 +399,16 @@ func (u *HostUserManagement) Shutdown() {
 	u.cancel()
 }
 
-// UserExists returns nil should a hostuser exist
-func (u *HostUserManagement) UserExists(username string) (*user.User, error) {
-	tempUser, err := u.backend.Lookup(username)
+// UserExists looks up an existing host user.
+func (u *HostUserManagement) UserExists(username string) error {
+	_, err := u.backend.Lookup(username)
 	if err != nil {
 		if err == user.UnknownUserError(username) {
-			return nil, trace.NotFound("User not found: %s", err)
+			return trace.NotFound("User not found: %s", err)
 		}
-		return nil, trace.Wrap(err)
+		return trace.Wrap(err)
 	}
-	return tempUser, nil
+	return nil
 }
 
 func (u *HostUserManagement) SetHostUserDeletionGrace(d time.Duration) {
diff --git a/lib/srv/usermgmt_linux.go b/lib/srv/usermgmt_linux.go
index 6caecaad8d172..c99ba09cc549d 100644
--- a/lib/srv/usermgmt_linux.go
+++ b/lib/srv/usermgmt_linux.go
@@ -77,7 +77,8 @@ func (*HostUsersProvisioningBackend) CreateUser(name string, groups []string) er
 	return trace.Wrap(err)
 }
 
-// CreateUser creates a user on a host
+// DeleteUser deletes a user on a host.
+// The user must not be logged in.
 func (*HostUsersProvisioningBackend) DeleteUser(name string) error {
 	code, err := host.UserDel(name)
 	if code == host.UserLoggedInExit {
diff --git a/lib/srv/usermgmt_test.go b/lib/srv/usermgmt_test.go
index c12b86cbf120c..f65de0df01e23 100644
--- a/lib/srv/usermgmt_test.go
+++ b/lib/srv/usermgmt_test.go
@@ -144,9 +144,12 @@ func TestUserMgmt_CreateTemporaryUser(t *testing.T) {
 		storage: pres,
 	}
 
-	userinfo := &services.HostUsersInfo{Groups: []string{"hello", "sudo"}}
+	userinfo := &services.HostUsersInfo{
+		Groups: []string{"hello", "sudo"},
+		Mode:   types.CreateHostUserMode_HOST_USER_MODE_DROP,
+	}
 	// create a user with some groups
-	_, closer, err := users.CreateUser("bob", userinfo)
+	closer, err := users.CreateUser("bob", userinfo)
 	require.NoError(t, err)
 	require.NotNil(t, closer, "user closer was nil")
 
@@ -156,7 +159,7 @@ func TestUserMgmt_CreateTemporaryUser(t *testing.T) {
 	}, backend.users["bob"])
 
 	// try creat the same user again
-	_, secondCloser, err := users.CreateUser("bob", userinfo)
+	secondCloser, err := users.CreateUser("bob", userinfo)
 	require.True(t, trace.IsAlreadyExists(err))
 	require.NotNil(t, secondCloser)
 
@@ -168,7 +171,7 @@ func TestUserMgmt_CreateTemporaryUser(t *testing.T) {
 	backend.CreateUser("simon", []string{})
 
 	// try to create a temporary user for simon
-	_, closer, err = users.CreateUser("simon", userinfo)
+	closer, err = users.CreateUser("simon", userinfo)
 	require.True(t, trace.IsAlreadyExists(err))
 	require.Nil(t, closer)
 }
@@ -185,9 +188,10 @@ func TestUserMgmtSudoers_CreateTemporaryUser(t *testing.T) {
 		storage: pres,
 	}
 
-	_, closer, err := users.CreateUser("bob", &services.HostUsersInfo{
+	closer, err := users.CreateUser("bob", &services.HostUsersInfo{
 		Groups:  []string{"hello", "sudo"},
 		Sudoers: []string{"validsudoers"},
+		Mode:    types.CreateHostUserMode_HOST_USER_MODE_DROP,
 	})
 	require.NoError(t, err)
 	require.NotNil(t, closer)
@@ -196,9 +200,10 @@ func TestUserMgmtSudoers_CreateTemporaryUser(t *testing.T) {
 
 	require.NoError(t, closer.Close())
 	require.Empty(t, backend.sudoers)
-	_, _, err = users.CreateUser("bob", &services.HostUsersInfo{
+	_, err = users.CreateUser("bob", &services.HostUsersInfo{
 		Groups:  []string{"hello", "sudo"},
 		Sudoers: []string{"invalid"},
+		Mode:    types.CreateHostUserMode_HOST_USER_MODE_DROP,
 	})
 	require.Error(t, err)
 
@@ -211,11 +216,15 @@ func TestUserMgmtSudoers_CreateTemporaryUser(t *testing.T) {
 		// test user already exists but teleport-service group has not yet
 		// been created
 		backend.CreateUser("testuser", nil)
-		_, _, err := users.CreateUser("testuser", &services.HostUsersInfo{})
+		_, err := users.CreateUser("testuser", &services.HostUsersInfo{
+			Mode: types.CreateHostUserMode_HOST_USER_MODE_DROP,
+		})
 		require.True(t, trace.IsAlreadyExists(err))
 		backend.CreateGroup(types.TeleportServiceGroup)
 		// IsAlreadyExists error when teleport-service group now exists
-		_, _, err = users.CreateUser("testuser", &services.HostUsersInfo{})
+		_, err = users.CreateUser("testuser", &services.HostUsersInfo{
+			Mode: types.CreateHostUserMode_HOST_USER_MODE_DROP,
+		})
 		require.True(t, trace.IsAlreadyExists(err))
 	})
 }
diff --git a/lib/tbot/bot/destination.go b/lib/tbot/bot/destination.go
index 71965ea0c52a3..00f39bf2ea4be 100644
--- a/lib/tbot/bot/destination.go
+++ b/lib/tbot/bot/destination.go
@@ -39,4 +39,13 @@ type Destination interface {
 	// TryLock should be used to lock a destination so it cannot be used by
 	// multiple processes of tbot concurrently.
 	TryLock() (func() error, error)
+
+	// CheckAndSetDefaults validates the configuration and sets any defaults.
+	//
+	// This must be called before other methods on Destination can be called.
+	CheckAndSetDefaults() error
+
+	// MarshalYAML enables the yaml package to correctly marshal the Destination
+	// as YAML including the type header.
+	MarshalYAML() (interface{}, error)
 }
diff --git a/lib/tbot/bot_identity.go b/lib/tbot/bot_identity.go
new file mode 100644
index 0000000000000..e9c8807964fa5
--- /dev/null
+++ b/lib/tbot/bot_identity.go
@@ -0,0 +1,243 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tbot
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"math"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/sirupsen/logrus"
+
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/retryutils"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// botIdentityRenewalRetryLimit is the number of permissible consecutive
+// failures in renewing the bot identity before the loop exits fatally.
+const botIdentityRenewalRetryLimit = 7
+
+func (b *Bot) renewBotIdentityLoop(
+	ctx context.Context,
+	reloadChan <-chan struct{},
+) error {
+	b.log.Infof(
+		"Beginning bot identity renewal loop: ttl=%s interval=%s",
+		b.cfg.CertificateTTL,
+		b.cfg.RenewalInterval,
+	)
+
+	// Determine where the bot should write its internal data (renewable cert
+	// etc)
+	storageDestination := b.cfg.Storage.Destination
+
+	ticker := time.NewTicker(b.cfg.RenewalInterval)
+	jitter := retryutils.NewJitter()
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+		case <-reloadChan:
+		}
+
+		var err error
+		for attempt := 1; attempt <= botIdentityRenewalRetryLimit; attempt++ {
+			b.log.Infof(
+				"Renewing bot identity. Attempt %d of %d.",
+				attempt,
+				botIdentityRenewalRetryLimit,
+			)
+			err = b.renewBotIdentity(
+				ctx, storageDestination,
+			)
+			if err == nil {
+				break
+			}
+
+			if attempt != botIdentityRenewalRetryLimit {
+				// exponentially back off with jitter, starting at 1 second.
+				backoffTime := time.Second * time.Duration(math.Pow(2, float64(attempt-1)))
+				backoffTime = jitter(backoffTime)
+				b.log.WithError(err).Errorf(
+					"Bot identity renewal attempt %d of %d failed. Retrying after %s.",
+					attempt,
+					botIdentityRenewalRetryLimit,
+					backoffTime,
+				)
+				select {
+				case <-ctx.Done():
+					return nil
+				case <-time.After(backoffTime):
+				}
+			}
+		}
+		if err != nil {
+			b.log.WithError(err).Errorf("%d bot identity renewals failed. All retry attempts exhausted. Exiting.", botIdentityRenewalRetryLimit)
+			return trace.Wrap(err)
+		}
+		b.log.Infof("Renewed bot identity. Next bot identity renewal in approximately %s.", b.cfg.RenewalInterval)
+	}
+}
+
+func (b *Bot) renewBotIdentity(
+	ctx context.Context,
+	botDestination bot.Destination,
+) error {
+	currentIdentity := b.ident()
+	// Make sure we can still write to the bot's destination.
+	if err := identity.VerifyWrite(botDestination); err != nil {
+		return trace.Wrap(err, "Cannot write to destination %s, aborting.", botDestination)
+	}
+
+	var newIdentity *identity.Identity
+	var err error
+	if b.cfg.Onboarding.RenewableJoinMethod() {
+		// When using a renewable join method, we use GenerateUserCerts to
+		// request a new certificate using our current identity.
+		authClient, err := b.AuthenticatedUserClientFromIdentity(ctx, b.ident())
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		newIdentity, err = botIdentityFromAuth(
+			ctx, b.log, currentIdentity, authClient, b.cfg.CertificateTTL,
+		)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	} else {
+		// When using the non-renewable join methods, we rejoin each time rather
+		// than using certificate renewal.
+		newIdentity, err = botIdentityFromToken(b.log, b.cfg)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	b.log.WithField("identity", describeTLSIdentity(b.log, newIdentity)).Info("Fetched new bot identity.")
+	b.setIdent(newIdentity)
+
+	if err := identity.SaveIdentity(newIdentity, botDestination, identity.BotKinds()...); err != nil {
+		return trace.Wrap(err)
+	}
+	b.log.WithField("identity", describeTLSIdentity(b.log, newIdentity)).Debug("Bot identity persisted.")
+
+	return nil
+}
+
+// botIdentityFromAuth uses an existing identity to request a new from the auth
+// server using GenerateUserCerts. This only works for renewable join types.
+func botIdentityFromAuth(
+	ctx context.Context,
+	log logrus.FieldLogger,
+	ident *identity.Identity,
+	client auth.ClientI,
+	ttl time.Duration,
+) (*identity.Identity, error) {
+	log.Info("Fetching bot identity using existing bot identity.")
+	if ident == nil || client == nil {
+		return nil, trace.BadParameter("renewIdentityWithAuth must be called with non-nil client and identity")
+	}
+	// Ask the auth server to generate a new set of certs with a new
+	// expiration date.
+	certs, err := client.GenerateUserCerts(ctx, proto.UserCertsRequest{
+		PublicKey: ident.PublicKeyBytes,
+		Username:  ident.X509Cert.Subject.CommonName,
+		Expires:   time.Now().Add(ttl),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	newIdentity, err := identity.ReadIdentityFromStore(
+		ident.Params(),
+		certs,
+		identity.BotKinds()...,
+	)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return newIdentity, nil
+}
+
+// botIdentityFromToken uses a join token to request a bot identity from an auth
+// server using auth.Register.
+func botIdentityFromToken(log logrus.FieldLogger, cfg *config.BotConfig) (*identity.Identity, error) {
+	log.Info("Fetching bot identity using token.")
+	addr, err := utils.ParseAddr(cfg.AuthServer)
+	if err != nil {
+		return nil, trace.Wrap(err, "invalid auth server address %+v", cfg.AuthServer)
+	}
+
+	tlsPrivateKey, sshPublicKey, tlsPublicKey, err := generateKeys()
+	if err != nil {
+		return nil, trace.Wrap(err, "unable to generate new keypairs")
+	}
+
+	token, err := cfg.Onboarding.Token()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	expires := time.Now().Add(cfg.CertificateTTL)
+	params := auth.RegisterParams{
+		Token: token,
+		ID: auth.IdentityID{
+			Role: types.RoleBot,
+		},
+		AuthServers:        []utils.NetAddr{*addr},
+		PublicTLSKey:       tlsPublicKey,
+		PublicSSHKey:       sshPublicKey,
+		CAPins:             cfg.Onboarding.CAPins,
+		CAPath:             cfg.Onboarding.CAPath,
+		GetHostCredentials: client.HostCredentials,
+		JoinMethod:         cfg.Onboarding.JoinMethod,
+		Expires:            &expires,
+		FIPS:               cfg.FIPS,
+		CipherSuites:       cfg.CipherSuites(),
+	}
+	if params.JoinMethod == types.JoinMethodAzure {
+		params.AzureParams = auth.AzureParams{
+			ClientID: cfg.Onboarding.Azure.ClientID,
+		}
+	}
+
+	certs, err := auth.Register(params)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	sha := sha256.Sum256([]byte(params.Token))
+	tokenHash := hex.EncodeToString(sha[:])
+	ident, err := identity.ReadIdentityFromStore(&identity.LoadIdentityParams{
+		PrivateKeyBytes: tlsPrivateKey,
+		PublicKeyBytes:  sshPublicKey,
+		TokenHashBytes:  []byte(tokenHash),
+	}, certs, identity.BotKinds()...)
+	return ident, trace.Wrap(err)
+}
diff --git a/lib/tbot/botfs/fs_other.go b/lib/tbot/botfs/fs_other.go
index 27606b339c5ac..eff8e517eab8f 100644
--- a/lib/tbot/botfs/fs_other.go
+++ b/lib/tbot/botfs/fs_other.go
@@ -22,10 +22,15 @@ package botfs
 import (
 	"io"
 	"os/user"
+	"sync"
 
 	"github.com/gravitational/trace"
 )
 
+// unsupportedPlatformWarning is used to reduce log spam when on an unsupported
+// platform.
+var unsupportedPlatformWarning sync.Once
+
 // Create attempts to create the given file or directory without
 // evaluating symlinks. This is only supported on recent Linux kernel versions
 // (5.6+). The resulting file permissions are unspecified; Chmod should be
@@ -44,7 +49,9 @@ func Read(path string, symlinksMode SymlinksMode) ([]byte, error) {
 	case SymlinksSecure:
 		return nil, trace.BadParameter("cannot read with `symlinks: secure` on unsupported platform")
 	case SymlinksTrySecure:
-		log.Warn("Secure symlinks not supported on this platform, set `symlinks: insecure` to disable this message", path)
+		unsupportedPlatformWarning.Do(func() {
+			log.Warn("Secure symlinks not supported on this platform, set `symlinks: insecure` to disable this message", path)
+		})
 	}
 
 	file, err := openStandard(path, ReadMode)
@@ -68,7 +75,9 @@ func Write(path string, data []byte, symlinksMode SymlinksMode) error {
 	case SymlinksSecure:
 		return trace.BadParameter("cannot write with `symlinks: secure` on unsupported platform")
 	case SymlinksTrySecure:
-		log.Warn("Secure symlinks not supported on this platform, set `symlinks: insecure` to disable this message", path)
+		unsupportedPlatformWarning.Do(func() {
+			log.Warn("Secure symlinks not supported on this platform, set `symlinks: insecure` to disable this message", path)
+		})
 	}
 
 	file, err := openStandard(path, WriteMode)
diff --git a/lib/tbot/ca_rotation.go b/lib/tbot/ca_rotation.go
index f0c5c929267ef..105507d613ffa 100644
--- a/lib/tbot/ca_rotation.go
+++ b/lib/tbot/ca_rotation.go
@@ -84,6 +84,41 @@ func (rd *debouncer) attempt() {
 	})
 }
 
+type channelBroadcaster struct {
+	mu      sync.Mutex
+	chanSet map[chan struct{}]struct{}
+}
+
+func (cb *channelBroadcaster) subscribe() (ch chan struct{}, unsubscribe func()) {
+	cb.mu.Lock()
+	defer cb.mu.Unlock()
+	ch = make(chan struct{}, 1)
+	cb.chanSet[ch] = struct{}{}
+	// Returns a function that should be called to unsubscribe the channel
+	return ch, func() {
+		cb.mu.Lock()
+		defer cb.mu.Unlock()
+		_, ok := cb.chanSet[ch]
+		if ok {
+			delete(cb.chanSet, ch)
+			close(ch)
+		}
+	}
+}
+
+func (cb *channelBroadcaster) broadcast() {
+	cb.mu.Lock()
+	defer cb.mu.Unlock()
+	for ch := range cb.chanSet {
+		select {
+		case ch <- struct{}{}:
+			// Successfully sent notification
+		default:
+			// Channel already has valued queued
+		}
+	}
+}
+
 const caRotationRetryBackoff = time.Second * 2
 
 // caRotationLoop continually triggers `watchCARotations` until the context is
@@ -91,22 +126,9 @@ const caRotationRetryBackoff = time.Second * 2
 //
 // caRotationLoop also manages debouncing the renewals across multiple watch
 // attempts.
-func (b *Bot) caRotationLoop(ctx context.Context) error {
+func (b *Bot) caRotationLoop(ctx context.Context, reload func()) error {
 	rd := debouncer{
-		f: func() {
-			select {
-			case <-ctx.Done():
-				return
-			default:
-			}
-
-			select {
-			case b.reloadChan <- struct{}{}:
-				b.log.Infof("Renewal triggered due to CA rotation.")
-			default:
-				b.log.Debugf("Renewal already queued, ignoring reload request.")
-			}
-		},
+		f:              reload,
 		debouncePeriod: time.Second * 10,
 	}
 	jitter := retryutils.NewJitter()
@@ -147,9 +169,17 @@ func (b *Bot) caRotationLoop(ctx context.Context) error {
 // attempts to trigger a renewal via the debounced reload channel when it
 // detects the entry into an important rotation phase.
 func (b *Bot) watchCARotations(ctx context.Context, queueReload func()) error {
-	clusterName := b.ident().ClusterName
 	b.log.Debugf("Attempting to establish watch for CA events")
-	watcher, err := b.Client().NewWatcher(ctx, types.Watch{
+
+	ident := b.ident()
+	client, err := b.AuthenticatedUserClientFromIdentity(ctx, ident)
+	if err != nil {
+		return trace.Wrap(err, "creating client for ca watcher")
+	}
+	defer client.Close()
+
+	clusterName := ident.ClusterName
+	watcher, err := client.NewWatcher(ctx, types.Watch{
 		Kinds: []types.WatchKind{{
 			Kind: types.KindCertAuthority,
 			Filter: types.CertAuthorityFilter{
diff --git a/lib/tbot/ca_rotation_test.go b/lib/tbot/ca_rotation_test.go
index 751b552a26799..50c82dbb1f7d1 100644
--- a/lib/tbot/ca_rotation_test.go
+++ b/lib/tbot/ca_rotation_test.go
@@ -17,11 +17,21 @@ limitations under the License.
 package tbot
 
 import (
+	"context"
+	"sync"
 	"testing"
+	"time"
 
+	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/cloud"
+	"github.com/gravitational/teleport/lib/config"
+	"github.com/gravitational/teleport/lib/service"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/tbot/testhelpers"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -132,3 +142,194 @@ func Test_filterCAEvent(t *testing.T) {
 		})
 	}
 }
+
+func TestChannelBroadcaster(t *testing.T) {
+	cb := channelBroadcaster{chanSet: map[chan struct{}]struct{}{}}
+	sub1, unsubscribe1 := cb.subscribe()
+	t.Cleanup(unsubscribe1)
+	sub2, unsubscribe2 := cb.subscribe()
+	t.Cleanup(unsubscribe2)
+
+	cb.broadcast()
+	require.NotEmpty(t, sub1)
+	require.NotEmpty(t, sub2)
+
+	// remove value from sub1 to check that if sub2 is full broadcasting still
+	// works
+	<-sub1
+	cb.broadcast()
+	require.NotEmpty(t, sub1)
+
+	// empty out both channels and ensure unsubscribing means they no longer
+	// receive values
+	<-sub1
+	<-sub2
+	unsubscribe1()
+	unsubscribe2()
+	cb.broadcast()
+	require.Empty(t, sub1)
+	require.Empty(t, sub2)
+
+	// ensure unsubscribing twice doesn't cause panic
+	unsubscribe1()
+}
+
+func rotate( //nolint:unused // used in skipped test
+	ctx context.Context, t *testing.T, log logrus.FieldLogger, svc *service.TeleportProcess, phase string,
+) {
+	t.Helper()
+	log.Infof("Triggering rotation: %s", phase)
+	err := svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+		// only rotate Host CA as to avoid race condition serverside when
+		// multiple CAs are rotated at once and the database closes off.
+		Type:        types.HostCA,
+		Mode:        "manual",
+		TargetPhase: phase,
+	})
+	if err != nil {
+		log.WithError(err).Infof("Error occurred during triggering rotation: %s", phase)
+	}
+	require.NoError(t, err)
+	log.Infof("Triggered rotation: %s", phase)
+}
+
+func setupServerForCARotationTest(ctx context.Context, log utils.Logger, t *testing.T, wg *sync.WaitGroup, //nolint:unused // used in skipped test
+) (auth.ClientI, func() *service.TeleportProcess, *config.FileConfig) {
+	fc, fds := testhelpers.DefaultConfig(t)
+
+	cfg := servicecfg.MakeDefaultConfig()
+	require.NoError(t, config.ApplyFileConfig(fc, cfg))
+	cfg.FileDescriptors = fds
+	cfg.Log = log
+	cfg.CachePolicy.Enabled = false
+	cfg.Proxy.DisableWebInterface = true
+	cfg.InstanceMetadataClient = cloud.NewDisabledIMDSClient()
+
+	svcC := make(chan *service.TeleportProcess)
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		err := service.Run(ctx, *cfg, func(cfg *servicecfg.Config) (service.Process, error) {
+			svc, err := service.NewTeleport(cfg)
+			if err == nil {
+				svcC <- svc
+			}
+			return svc, err
+		})
+		require.NoError(t, err)
+	}()
+
+	var svc *service.TeleportProcess
+	select {
+	case <-time.After(30 * time.Second):
+		// this should really happen quite quickly, but under the load during
+		// parallel test run, it can take a while.
+		t.Fatal("teleport process did not instantiate in 30 seconds")
+	case svc = <-svcC:
+	}
+
+	// Ensure the service starts correctly the first time before proceeding
+	_, err := svc.WaitForEventTimeout(30*time.Second, service.TeleportReadyEvent)
+	// in reality, the auth server should start *much* sooner than this.  we use a very large
+	// timeout here because this isn't the kind of problem that this test is meant to catch.
+	require.NoError(t, err, "auth server didn't start after 30s")
+
+	// Tracks the latest instance of the Teleport service through reloads
+	activeSvc := svc
+	activeSvcMu := sync.Mutex{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for {
+			select {
+			case svc := <-svcC:
+				activeSvcMu.Lock()
+				activeSvc = svc
+				activeSvcMu.Unlock()
+			case <-ctx.Done():
+				return
+			}
+		}
+	}()
+
+	return testhelpers.MakeDefaultAuthClient(t, log, fc), func() *service.TeleportProcess {
+		activeSvcMu.Lock()
+		defer activeSvcMu.Unlock()
+		return activeSvc
+	}, fc
+}
+
+// TestCARotation is a heavy integration test that through a rotation, the bot
+// receives credentials for a new CA.
+func TestBot_Run_CARotation(t *testing.T) {
+	// TODO(jakule): Re-enable this test https://github.com/gravitational/teleport/issues/19403
+	t.Skip("Temporary disable until it's fixed - flaky")
+
+	t.Parallel()
+	if testing.Short() {
+		t.Skip("test skipped when -short provided")
+	}
+
+	// wg and context manage the cancellation of long running processes e.g
+	// teleport and tbot in the test.
+	log := utils.NewLoggerForTests()
+	wg := &sync.WaitGroup{}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(func() {
+		log.Infof("Shutting down long running test processes..")
+		cancel()
+		wg.Wait()
+	})
+
+	client, teleportProcess, fc := setupServerForCARotationTest(ctx, log, t, wg)
+
+	// Make and join a new bot instance.
+	botParams := testhelpers.MakeBot(t, client, "test", "access")
+	botConfig := testhelpers.DefaultBotConfig(t, fc, botParams, nil)
+	b := New(botConfig, log)
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		err := b.Run(ctx)
+		require.NoError(t, err)
+	}()
+	// Allow time for bot to start running and watching for CA rotations
+	// TODO: We should modify the bot to emit events that may be useful...
+	time.Sleep(10 * time.Second)
+
+	// fetch initial host cert
+	require.Len(t, b.ident().TLSCACertsBytes, 2)
+	initialCAs := [][]byte{}
+	copy(initialCAs, b.ident().TLSCACertsBytes)
+
+	// Begin rotating through all of the phases, testing the client after
+	// each rotation phase has completed.
+	rotate(ctx, t, log, teleportProcess(), types.RotationPhaseInit)
+	// TODO: These sleeps allow the client time to rotate. They could be
+	// replaced if tbot emitted a CA rotation/renewal event.
+	time.Sleep(time.Second * 30)
+	_, err := b.AuthenticatedUserClientFromIdentity(ctx, b.ident())
+	require.NoError(t, err)
+
+	rotate(ctx, t, log, teleportProcess(), types.RotationPhaseUpdateClients)
+	time.Sleep(time.Second * 30)
+	// Ensure both sets of CA certificates are now available locally
+	require.Len(t, b.ident().TLSCACertsBytes, 3)
+	_, err = b.AuthenticatedUserClientFromIdentity(ctx, b.ident())
+	require.NoError(t, err)
+
+	rotate(ctx, t, log, teleportProcess(), types.RotationPhaseUpdateServers)
+	time.Sleep(time.Second * 30)
+	_, err = b.AuthenticatedUserClientFromIdentity(ctx, b.ident())
+	require.NoError(t, err)
+
+	rotate(ctx, t, log, teleportProcess(), types.RotationStateStandby)
+	time.Sleep(time.Second * 30)
+	_, err = b.AuthenticatedUserClientFromIdentity(ctx, b.ident())
+	require.NoError(t, err)
+
+	require.Len(t, b.ident().TLSCACertsBytes, 2)
+	finalCAs := b.ident().TLSCACertsBytes
+	require.NotEqual(t, initialCAs, finalCAs)
+}
diff --git a/lib/tbot/config/bot.go b/lib/tbot/config/bot.go
index f9df74f3cbadd..1cdcc34899cb9 100644
--- a/lib/tbot/config/bot.go
+++ b/lib/tbot/config/bot.go
@@ -18,17 +18,17 @@ package config
 
 import (
 	"context"
+	"time"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/client/webclient"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
-	"github.com/gravitational/teleport/lib/tbot/identity"
+	"github.com/gravitational/teleport/lib/services"
 )
 
-// Bot is an interface covering various public tbot.Bot methods to circumvent
-// import cycle issues.
-type Bot interface {
+// provider is an interface that allows Templates to fetch information they
+// need to render from the bot hosting the template rendering.
+type provider interface {
 	// AuthPing pings the auth server and returns the (possibly cached) response.
 	AuthPing(ctx context.Context) (*proto.PingResponse, error)
 
@@ -41,10 +41,15 @@ type Bot interface {
 	// requests them from the server if unavailable.
 	GetCertAuthorities(ctx context.Context, caType types.CertAuthType) ([]types.CertAuthority, error)
 
-	// AuthenticatedUserClientFromIdentity returns a client backed by a specific
-	// identity.
-	AuthenticatedUserClientFromIdentity(ctx context.Context, id *identity.Identity) (auth.ClientI, error)
-
 	// Config returns the current bot config
 	Config() *BotConfig
+
+	// GenerateHostCert uses the impersonatedClient to call GenerateHostCert.
+	GenerateHostCert(ctx context.Context, key []byte, hostID, nodeName string, principals []string, clusterName string, role types.SystemRole, ttl time.Duration) ([]byte, error)
+
+	// GetRemoteClusters uses the impersonatedClient to call GetRemoteClusters.
+	GetRemoteClusters(opts ...services.MarshalOption) ([]types.RemoteCluster, error)
+
+	// GetCertAuthority uses the impersonatedClient to call GetCertAuthority.
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool) (types.CertAuthority, error)
 }
diff --git a/lib/tbot/config/bot_test.go b/lib/tbot/config/bot_test.go
index 7657882a6e630..4941e0411d2f5 100644
--- a/lib/tbot/config/bot_test.go
+++ b/lib/tbot/config/bot_test.go
@@ -21,15 +21,16 @@ import (
 	"testing"
 	"time"
 
+	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
+	"golang.org/x/exp/slices"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/client/webclient"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/services"
@@ -49,50 +50,44 @@ const (
 	mockRemoteClusterName = "tele.aperture.labs"
 )
 
-// mockAuth is a minimal fake auth client, used in tests
-type mockAuth struct {
-	auth.ClientI
-
-	clusterName       string
-	remoteClusterName string
-	proxyAddr         string
-	t                 *testing.T
+// fakeGetExecutablePath can be injected into outputs to ensure they output the
+// same path in tests across multiple systems.
+func fakeGetExecutablePath() (string, error) {
+	return "/path/to/tbot", nil
 }
 
-func (m *mockAuth) GetDomainName(ctx context.Context) (string, error) {
-	return m.clusterName, nil
+// mockProvider is a minimal Bot impl that can be used in tests
+type mockProvider struct {
+	cfg               *BotConfig
+	proxyAddr         string
+	remoteClusterName string
+	clusterName       string
 }
 
-func (m *mockAuth) GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error) {
-	cn, err := types.NewClusterName(types.ClusterNameSpecV2{
-		ClusterName: m.clusterName,
-		ClusterID:   "aa-bb-cc",
-	})
-	require.NoError(m.t, err)
-	return cn, nil
+func newMockProvider(cfg *BotConfig) *mockProvider {
+	return &mockProvider{
+		cfg:               cfg,
+		proxyAddr:         mockProxyAddr,
+		clusterName:       mockClusterName,
+		remoteClusterName: mockRemoteClusterName,
+	}
 }
 
-func (m *mockAuth) GetRemoteClusters(opts ...services.MarshalOption) ([]types.RemoteCluster, error) {
-	rc, err := types.NewRemoteCluster(m.remoteClusterName)
-	require.NoError(m.t, err)
+func (p *mockProvider) GetRemoteClusters(opts ...services.MarshalOption) ([]types.RemoteCluster, error) {
+	rc, err := types.NewRemoteCluster(p.remoteClusterName)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	return []types.RemoteCluster{rc}, nil
 }
 
-func (m *mockAuth) Ping(ctx context.Context) (proto.PingResponse, error) {
-	require.NotNil(m.t, ctx)
-	return proto.PingResponse{
-		ProxyPublicAddr: m.proxyAddr,
-	}, nil
-}
-
-func (m *mockAuth) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool) (types.CertAuthority, error) {
-	require.NotNil(m.t, ctx)
-	require.Contains(
-		m.t,
-		[]string{m.clusterName, m.remoteClusterName},
-		id.DomainName,
-	)
-	require.False(m.t, loadKeys)
+func (p *mockProvider) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool) (types.CertAuthority, error) {
+	if !slices.Contains([]string{p.clusterName, p.remoteClusterName}, id.DomainName) {
+		return nil, trace.NotFound("specified id %q not found", id)
+	}
+	if loadKeys {
+		return nil, trace.BadParameter("unexpected loading of key")
+	}
 
 	ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
 		// Pretend to be the correct type.
@@ -118,74 +113,51 @@ func (m *mockAuth) GetCertAuthority(ctx context.Context, id types.CertAuthID, lo
 			},
 		},
 	})
-	require.NoError(m.t, err)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	return ca, nil
 }
 
-func (m *mockAuth) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool) ([]types.CertAuthority, error) {
-	require.NotNil(m.t, ctx)
-	require.False(m.t, loadKeys)
-
+func (p *mockProvider) GetCertAuthorities(ctx context.Context, caType types.CertAuthType) ([]types.CertAuthority, error) {
 	// We'll just wrap GetCertAuthority()'s dummy CA.
-	ca, err := m.GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := p.GetCertAuthority(ctx, types.CertAuthID{
 		// Just pretend to be whichever type of CA was requested.
 		Type:       caType,
-		DomainName: m.clusterName,
-	}, loadKeys)
-	require.NoError(m.t, err)
-
-	return []types.CertAuthority{ca}, nil
-}
-
-func newMockAuth(t *testing.T) *mockAuth {
-	return &mockAuth{
-		t:                 t,
-		clusterName:       mockClusterName,
-		proxyAddr:         mockProxyAddr,
-		remoteClusterName: mockRemoteClusterName,
-	}
-}
-
-func (m *mockAuth) Close() error {
-	return nil
-}
-
-// mockBot is a minimal Bot impl that can be used in tests
-type mockBot struct {
-	cfg  *BotConfig
-	auth auth.ClientI
-}
-
-func (b *mockBot) AuthPing(ctx context.Context) (*proto.PingResponse, error) {
-	ping, err := b.auth.Ping(ctx)
+		DomainName: p.clusterName,
+	}, false)
 	if err != nil {
-		return nil, err
+		return nil, trace.Wrap(err)
 	}
 
-	return &ping, err
-}
-
-func (b *mockBot) ProxyPing(ctx context.Context) (*webclient.PingResponse, error) {
-	return &webclient.PingResponse{}, nil
+	return []types.CertAuthority{ca}, nil
 }
 
-func (b *mockBot) GetCertAuthorities(ctx context.Context, caType types.CertAuthType) ([]types.CertAuthority, error) {
-	return b.auth.GetCertAuthorities(ctx, caType, false)
+func (p *mockProvider) AuthPing(_ context.Context) (*proto.PingResponse, error) {
+	return &proto.PingResponse{
+		ProxyPublicAddr: p.proxyAddr,
+		ClusterName:     p.clusterName,
+	}, nil
 }
 
-func (b *mockBot) AuthenticatedUserClientFromIdentity(ctx context.Context, id *identity.Identity) (auth.ClientI, error) {
-	return b.auth, nil
+func (p *mockProvider) GenerateHostCert(
+	ctx context.Context,
+	key []byte, hostID, nodeName string, principals []string,
+	clusterName string, role types.SystemRole, ttl time.Duration,
+) ([]byte, error) {
+	// We could generate a cert easily enough here, but the template generates a
+	// random key each run so the resulting cert will change too.
+	// The CA fixture isn't even a cert but we never examine it, so it'll do the
+	// job.
+	return []byte(fixtures.SSHCAPublicKey), nil
 }
 
-func (b *mockBot) Config() *BotConfig {
-	return b.cfg
+func (p *mockProvider) ProxyPing(ctx context.Context) (*webclient.PingResponse, error) {
+	return &webclient.PingResponse{}, nil
 }
 
-func newMockBot(cfg *BotConfig, auth auth.ClientI) *mockBot {
-	return &mockBot{
-		cfg:  cfg,
-		auth: auth,
-	}
+func (p *mockProvider) Config() *BotConfig {
+	return p.cfg
 }
 
 // identRequest is a function used to add additional requests to an identity in
diff --git a/lib/tbot/config/config.go b/lib/tbot/config/config.go
index 4114236555c39..09aa8c9600f95 100644
--- a/lib/tbot/config/config.go
+++ b/lib/tbot/config/config.go
@@ -21,33 +21,35 @@ import (
 	"io"
 	"net/url"
 	"os"
+	"reflect"
 	"strings"
 	"time"
 
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/gravitational/trace"
 	"github.com/sirupsen/logrus"
+	"golang.org/x/exp/slices"
 	"gopkg.in/yaml.v3"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/tbot/bot"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
 const (
 	DefaultCertificateTTL = 60 * time.Minute
 	DefaultRenewInterval  = 20 * time.Minute
-	DefaultJoinMethod     = "token"
 )
 
 var SupportedJoinMethods = []string{
+	string(types.JoinMethodToken),
 	string(types.JoinMethodAzure),
 	string(types.JoinMethodCircleCI),
 	string(types.JoinMethodGitHub),
 	string(types.JoinMethodGitLab),
 	string(types.JoinMethodIAM),
-	string(types.JoinMethodToken),
 }
 
 var log = logrus.WithFields(logrus.Fields{
@@ -117,7 +119,7 @@ type CLIConf struct {
 	// Oneshot controls whether the bot quits after a single renewal.
 	Oneshot bool
 
-	// InitDir specifies which destination to initialize if multiple are
+	// InitDir specifies which Destination to initialize if multiple are
 	// configured.
 	InitDir string
 
@@ -127,7 +129,7 @@ type CLIConf struct {
 	// ReaderUser is the Unix username that will be reading the files
 	ReaderUser string
 
-	// Owner is the user:group that will own the destination files. Due to SSH
+	// Owner is the user:group that will own the Destination files. Due to SSH
 	// restrictions on key permissions, it cannot be the same as the reader
 	// user. If ACL support is unused or unavailable, the reader user will own
 	// files directly.
@@ -179,16 +181,16 @@ type OnboardingConfig struct {
 	// TokenValue is either the token needed to join the auth server, or a path pointing to a file
 	// that contains the token
 	//
-	// You should use Token() instead - this has to be an exported field for YAML unmarshalling
+	// You should use Token() instead - this has to be an exported field for YAML unmarshaling
 	// to work correctly, but this could be a path instead of a token
-	TokenValue string `yaml:"token"`
+	TokenValue string `yaml:"token,omitempty"`
 
 	// CAPath is an optional path to a CA certificate.
-	CAPath string `yaml:"ca_path"`
+	CAPath string `yaml:"ca_path,omitempty"`
 
 	// CAPins is a list of certificate authority pins, used to validate the
 	// connection to the Teleport auth server.
-	CAPins []string `yaml:"ca_pins"`
+	CAPins []string `yaml:"ca_pins,omitempty"`
 
 	// JoinMethod is the method the bot should use to exchange a token for the
 	// initial certificate
@@ -204,6 +206,12 @@ func (conf *OnboardingConfig) HasToken() bool {
 	return conf.TokenValue != ""
 }
 
+// RenewableJoinMethod indicates that certificate renewal should be used with
+// this join method rather than rejoining each time.
+func (conf *OnboardingConfig) RenewableJoinMethod() bool {
+	return conf.JoinMethod == types.JoinMethodToken
+}
+
 // SetToken stores the value for --token or auth_token in the config
 //
 // In the case of the token value pointing to a file, this allows us to
@@ -230,10 +238,12 @@ func (conf *OnboardingConfig) Token() (string, error) {
 }
 
 // BotConfig is the bot's root config object.
+// This is currently at version "v2".
 type BotConfig struct {
-	Onboarding   *OnboardingConfig    `yaml:"onboarding,omitempty"`
-	Storage      *StorageConfig       `yaml:"storage,omitempty"`
-	Destinations []*DestinationConfig `yaml:"destinations,omitempty"`
+	Version    Version          `yaml:"version"`
+	Onboarding OnboardingConfig `yaml:"onboarding,omitempty"`
+	Storage    *StorageConfig   `yaml:"storage,omitempty"`
+	Outputs    Outputs          `yaml:"outputs,omitempty"`
 
 	Debug           bool          `yaml:"debug"`
 	AuthServer      string        `yaml:"auth_server"`
@@ -250,6 +260,14 @@ type BotConfig struct {
 	// DiagAddr is the address the diagnostics http service should listen on.
 	// If not set, no diagnostics listener is created.
 	DiagAddr string `yaml:"diag_addr,omitempty"`
+
+	// ReloadCh allows a channel to be injected into the bot to trigger a
+	// renewal.
+	ReloadCh <-chan struct{} `yaml:"-"`
+
+	// Insecure configures the bot to blindly trust the certificates offered by
+	// the auth server. Used for tests.
+	Insecure bool `yaml:"-"`
 }
 
 func (conf *BotConfig) CipherSuites() []uint16 {
@@ -260,6 +278,10 @@ func (conf *BotConfig) CipherSuites() []uint16 {
 }
 
 func (conf *BotConfig) CheckAndSetDefaults() error {
+	if conf.Version == "" {
+		conf.Version = V2
+	}
+
 	if conf.Storage == nil {
 		conf.Storage = &StorageConfig{}
 	}
@@ -268,10 +290,30 @@ func (conf *BotConfig) CheckAndSetDefaults() error {
 		return trace.Wrap(err)
 	}
 
-	for _, dest := range conf.Destinations {
-		if err := dest.CheckAndSetDefaults(); err != nil {
+	destinationPaths := map[string]int{}
+	for _, output := range conf.Outputs {
+		if err := output.CheckAndSetDefaults(); err != nil {
 			return trace.Wrap(err)
 		}
+
+		// This check currently only handles directory destinations, but we'll
+		// need to create a more polymorphic way of doing this when we introduce
+		// more destination types.
+		directoryDestination, ok := output.GetDestination().(*DestinationDirectory)
+		if ok {
+			destinationPaths[directoryDestination.Path]++
+		}
+	}
+	// Check for outputs reusing the same destination. This is a deeply
+	// uncharted/unknown behavior area. For now we'll emit a heavy warning,
+	// in 15+ this will be an explicit area as outputs writing over one another
+	// is too complex to support.
+	for path, count := range destinationPaths {
+		if count > 1 {
+			log.WithField("path", path).Error(
+				"Multiple outputs reusing the same destination path. This can produce unusable results. In Teleport 15.0, this will be a fatal error.",
+			)
+		}
 	}
 
 	if conf.CertificateTTL == 0 {
@@ -282,18 +324,117 @@ func (conf *BotConfig) CheckAndSetDefaults() error {
 		conf.RenewalInterval = DefaultRenewInterval
 	}
 
+	// We require the join method for `configure` and `start` but not for `init`
+	// Therefore, we need to check its valid here, but enforce its presence
+	// elsewhere.
+	if conf.Onboarding.JoinMethod != types.JoinMethodUnspecified {
+		if !slices.Contains(SupportedJoinMethods, string(conf.Onboarding.JoinMethod)) {
+			return trace.BadParameter("unrecognized join method: %q", conf.Onboarding.JoinMethod)
+		}
+	}
+
 	return nil
 }
 
-// GetDestinationByPath attempts to fetch a destination by its filesystem path.
-// Only valid for filesystem destinations; returns nil if no matching
-// destination exists.
-func (conf *BotConfig) GetDestinationByPath(path string) (*DestinationConfig, error) {
-	for _, dest := range conf.Destinations {
-		destImpl, err := dest.GetDestination()
-		if err != nil {
+// Outputs assists polymorphic unmarshaling of a slice of Outputs
+type Outputs []Output
+
+func (o *Outputs) UnmarshalYAML(node *yaml.Node) error {
+	var out []Output
+	for _, node := range node.Content {
+		header := struct {
+			Type string `yaml:"type"`
+		}{}
+		if err := node.Decode(&header); err != nil {
+			return trace.Wrap(err)
+		}
+
+		switch header.Type {
+		case IdentityOutputType:
+			v := &IdentityOutput{}
+			if err := node.Decode(v); err != nil {
+				return trace.Wrap(err)
+			}
+			out = append(out, v)
+		case ApplicationOutputType:
+			v := &ApplicationOutput{}
+			if err := node.Decode(v); err != nil {
+				return trace.Wrap(err)
+			}
+			out = append(out, v)
+		case KubernetesOutputType:
+			v := &KubernetesOutput{}
+			if err := node.Decode(v); err != nil {
+				return trace.Wrap(err)
+			}
+			out = append(out, v)
+		case DatabaseOutputType:
+			v := &DatabaseOutput{}
+			if err := node.Decode(v); err != nil {
+				return trace.Wrap(err)
+			}
+			out = append(out, v)
+		case SSHHostOutputType:
+			v := &SSHHostOutput{}
+			if err := node.Decode(v); err != nil {
+				return trace.Wrap(err)
+			}
+			out = append(out, v)
+		default:
+			return trace.BadParameter("unrecognized output type (%s)", header.Type)
+		}
+	}
+
+	*o = out
+	return nil
+}
+
+func withTypeHeader[T any](payload T, payloadType string) (interface{}, error) {
+	header := struct {
+		Type    string `yaml:"type"`
+		Payload T      `yaml:",inline"`
+	}{
+		Type:    payloadType,
+		Payload: payload,
+	}
+
+	return header, nil
+}
+
+// unmarshalDestination takes a *yaml.Node and produces a bot.Destination by
+// considering the `type` field.
+func unmarshalDestination(node *yaml.Node) (bot.Destination, error) {
+	header := struct {
+		Type string `yaml:"type"`
+	}{}
+	if err := node.Decode(&header); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	switch header.Type {
+	case DestinationMemoryType:
+		v := &DestinationMemory{}
+		if err := node.Decode(v); err != nil {
 			return nil, trace.Wrap(err)
 		}
+		return v, nil
+	case DestinationDirectoryType:
+		v := &DestinationDirectory{}
+		if err := node.Decode(v); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return v, nil
+	default:
+		return nil, trace.BadParameter("unrecognized destination type (%s)", header.Type)
+	}
+}
+
+// GetOutputByPath attempts to fetch a Destination by its filesystem path.
+// Only valid for filesystem destinations; returns nil if no matching
+// Destination exists.
+func (conf *BotConfig) GetOutputByPath(path string) (Output, error) {
+	for _, output := range conf.Outputs {
+		destImpl := output.GetDestination()
 
 		destDir, ok := destImpl.(*DestinationDirectory)
 		if !ok {
@@ -304,19 +445,22 @@ func (conf *BotConfig) GetDestinationByPath(path string) (*DestinationConfig, er
 		// might want to compare .Abs() if that proves to be confusing (though
 		// this may have its own problems)
 		if destDir.Path == path {
-			return dest, nil
+			return output, nil
 		}
 	}
 
 	return nil, nil
 }
 
-// NewDefaultConfig creates a new minimal bot configuration from defaults.
-// CheckAndSetDefaults() will be called.
-func NewDefaultConfig(authServer string) (*BotConfig, error) {
+// newTestConfig creates a new minimal bot configuration from defaults for use
+// in tests
+func newTestConfig(authServer string) (*BotConfig, error) {
 	// Note: we need authServer for CheckAndSetDefaults to succeed.
 	cfg := BotConfig{
 		AuthServer: authServer,
+		Onboarding: OnboardingConfig{
+			JoinMethod: types.JoinMethodToken,
+		},
 	}
 	if err := cfg.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
@@ -325,14 +469,8 @@ func NewDefaultConfig(authServer string) (*BotConfig, error) {
 	return &cfg, nil
 }
 
-// isJoinMethodDefault determines if the given join method (as input on the
-// CLI) is set to a default value.
-func isJoinMethodDefault(joinMethod string) bool {
-	return joinMethod == "" || joinMethod == DefaultJoinMethod
-}
-
-func storageConfigFromCLIConf(dataDir string) (*StorageConfig, error) {
-	uri, err := url.Parse(dataDir)
+func destinationFromURI(uriString string) (bot.Destination, error) {
+	uri, err := url.Parse(uriString)
 	if err != nil {
 		return nil, trace.Wrap(err, "parsing --data-dir")
 	}
@@ -345,12 +483,8 @@ func storageConfigFromCLIConf(dataDir string) (*StorageConfig, error) {
 		}
 		// TODO(strideynet): eventually we can allow for URI query parameters
 		// to be used to configure symlinks/acl protection.
-		return &StorageConfig{
-			DestinationMixin: DestinationMixin{
-				Directory: &DestinationDirectory{
-					Path: uri.Path,
-				},
-			},
+		return &DestinationDirectory{
+			Path: uri.Path,
 		}, nil
 	case "memory":
 		if uri.Host != "" || uri.Path != "" {
@@ -358,11 +492,7 @@ func storageConfigFromCLIConf(dataDir string) (*StorageConfig, error) {
 				"memory-backed data storage should not have host or path specified",
 			)
 		}
-		return &StorageConfig{
-			DestinationMixin: DestinationMixin{
-				Memory: &DestinationMemory{},
-			},
-		}, nil
+		return &DestinationMemory{}, nil
 	default:
 		return nil, trace.BadParameter(
 			"unrecognized data storage scheme",
@@ -378,7 +508,7 @@ func FromCLIConf(cf *CLIConf) (*BotConfig, error) {
 	var err error
 
 	if cf.ConfigPath != "" {
-		config, err = ReadConfigFromFile(cf.ConfigPath)
+		config, err = ReadConfigFromFile(cf.ConfigPath, false)
 
 		if err != nil {
 			return nil, trace.Wrap(err, "loading bot config from path %s", cf.ConfigPath)
@@ -418,53 +548,56 @@ func FromCLIConf(cf *CLIConf) (*BotConfig, error) {
 
 	// DataDir overrides any previously-configured storage config
 	if cf.DataDir != "" {
-		if config.Storage != nil {
-			if _, err := config.Storage.GetDestination(); err != nil {
-				log.Warnf(
-					"CLI parameters are overriding storage location from %s",
-					cf.ConfigPath,
-				)
-			}
+		if config.Storage != nil && config.Storage.Destination != nil {
+			log.Warnf(
+				"CLI parameters are overriding storage location from %s",
+				cf.ConfigPath,
+			)
 		}
-		config.Storage, err = storageConfigFromCLIConf(cf.DataDir)
+		dest, err := destinationFromURI(cf.DataDir)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
+		config.Storage = &StorageConfig{Destination: dest}
 	}
 
 	if cf.DestinationDir != "" {
-		// CLI only supports a single filesystem destination with SSH client config
+		// WARNING:
+		// See: https://github.com/gravitational/teleport/issues/27206 for
+		// potential gotchas that currently exist when dealing with this
+		// override behavior.
+
+		// CLI only supports a single filesystem Destination with SSH client config
 		// and all roles.
-		if len(config.Destinations) > 0 {
+		if len(config.Outputs) > 0 {
 			log.Warnf("CLI parameters are overriding destinations from %s", cf.ConfigPath)
 		}
 
-		// CheckAndSetDefaults() will configure default kinds and templates
-		config.Destinations = []*DestinationConfig{{
-			DestinationMixin: DestinationMixin{
-				Directory: &DestinationDirectory{
+		// When using the CLI --Destination-dir we configure an Identity type
+		// output for that directory.
+		config.Outputs = []Output{
+			&IdentityOutput{
+				Destination: &DestinationDirectory{
 					Path: cf.DestinationDir,
 				},
 			},
-		}}
+		}
 	}
 
 	// If any onboarding flags are set, override the whole section.
 	// (CAPath, CAPins, etc follow different codepaths so we don't want a
 	// situation where different fields become set weirdly due to struct
 	// merging)
-	if cf.Token != "" || len(cf.CAPins) > 0 || !isJoinMethodDefault(cf.JoinMethod) {
-		onboarding := config.Onboarding
-		if onboarding != nil && (onboarding.HasToken() || onboarding.CAPath != "" || len(onboarding.CAPins) > 0) || !isJoinMethodDefault(cf.JoinMethod) {
+	if cf.Token != "" || cf.JoinMethod != "" || len(cf.CAPins) > 0 {
+		if !reflect.DeepEqual(config.Onboarding, OnboardingConfig{}) {
 			// To be safe, warn about possible confusion.
 			log.Warnf("CLI parameters are overriding onboarding config from %s", cf.ConfigPath)
 		}
 
-		config.Onboarding = &OnboardingConfig{
+		config.Onboarding = OnboardingConfig{
 			CAPins:     cf.CAPins,
 			JoinMethod: types.JoinMethod(cf.JoinMethod),
 		}
-
 		config.Onboarding.SetToken(cf.Token)
 	}
 
@@ -486,26 +619,68 @@ func FromCLIConf(cf *CLIConf) (*BotConfig, error) {
 	return config, nil
 }
 
-// ReadFromFile reads and parses a YAML config from a file.
-func ReadConfigFromFile(filePath string) (*BotConfig, error) {
+// ReadConfigFromFile reads and parses a YAML config from a file.
+func ReadConfigFromFile(filePath string, manualMigration bool) (*BotConfig, error) {
 	f, err := os.Open(filePath)
 	if err != nil {
 		return nil, trace.Wrap(err, fmt.Sprintf("failed to open file: %v", filePath))
 	}
 
 	defer f.Close()
-	return ReadConfig(f)
+	return ReadConfig(f, manualMigration)
 }
 
-// ReadConfig parses a YAML config file from a Reader.
-func ReadConfig(reader io.Reader) (*BotConfig, error) {
-	var config BotConfig
+type Version string
 
+var (
+	V1 Version = "v1"
+	V2 Version = "v2"
+)
+
+// ReadConfig parses a YAML config file from a Reader.
+func ReadConfig(reader io.ReadSeeker, manualMigration bool) (*BotConfig, error) {
+	var version struct {
+		Version Version `yaml:"version"`
+	}
 	decoder := yaml.NewDecoder(reader)
-	decoder.KnownFields(true)
-	if err := decoder.Decode(&config); err != nil {
-		return nil, trace.BadParameter("failed parsing config file: %s", strings.Replace(err.Error(), "\n", "", -1))
+	if err := decoder.Decode(&version); err != nil {
+		return nil, trace.BadParameter("failed parsing config file version: %s", strings.Replace(err.Error(), "\n", "", -1))
+	}
+
+	// Reset reader and decoder
+	if _, err := reader.Seek(0, io.SeekStart); err != nil {
+		return nil, trace.Wrap(err)
 	}
+	decoder = yaml.NewDecoder(reader)
 
-	return &config, nil
+	switch version.Version {
+	case V1, "":
+		if !manualMigration {
+			log.Warn("Deprecated config version (V1) detected. Attempting to perform an on-the-fly in-memory migration to latest version. Please persist the config migration by following the guidance at https://goteleport.com/docs/machine-id/reference/v14-upgrade-guide/")
+		}
+		config := &configV1{}
+		if err := decoder.Decode(config); err != nil {
+			return nil, trace.BadParameter("failed parsing config file: %s", strings.Replace(err.Error(), "\n", "", -1))
+		}
+		latestConfig, err := config.migrate()
+		if err != nil {
+			return nil, trace.WithUserMessage(
+				trace.Wrap(err, "migrating v1 config"),
+				"Failed to migrate. See https://goteleport.com/docs/machine-id/reference/v14-upgrade-guide/",
+			)
+		}
+		return latestConfig, nil
+	case V2:
+		if manualMigration {
+			return nil, trace.BadParameter("configuration already the latest version. nothing to migrate.")
+		}
+		decoder.KnownFields(true)
+		config := &BotConfig{}
+		if err := decoder.Decode(config); err != nil {
+			return nil, trace.BadParameter("failed parsing config file: %s", strings.Replace(err.Error(), "\n", "", -1))
+		}
+		return config, nil
+	default:
+		return nil, trace.BadParameter("unrecognized config version %q", version.Version)
+	}
 }
diff --git a/lib/tbot/config/config_destination.go b/lib/tbot/config/config_destination.go
deleted file mode 100644
index ebc538bec0a8a..0000000000000
--- a/lib/tbot/config/config_destination.go
+++ /dev/null
@@ -1,279 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package config
-
-import (
-	"reflect"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-)
-
-// Database is the config for a database access request.
-type Database struct {
-	// Service is the service name of the Teleport database. Generally this is
-	// the name of the Teleport resource.
-	Service string `yaml:"service,omitempty"`
-
-	// Database is the name of the database to request access to.
-	Database string `yaml:"database,omitempty"`
-
-	// Username is the database username to request access as.
-	Username string `yaml:"username,omitempty"`
-}
-
-func (dc *Database) CheckAndSetDefaults() error {
-	if dc.Service == "" {
-		return trace.BadParameter("database `service` field must specify a database service name")
-	}
-
-	// Note: tsh has special checks for MongoDB and Redis. We don't know the
-	// protocol at this point so we'll need to defer those checks.
-
-	return nil
-}
-
-// KubernetesCluster is a Kubernetes cluster certificate request.
-type KubernetesCluster struct {
-	// ClusterName is the name of the Kubernetes cluster in Teleport.
-	ClusterName string
-}
-
-func (kc *KubernetesCluster) UnmarshalYAML(node *yaml.Node) error {
-	// We don't care for multiple YAML shapes here, we just want our Kubernetes
-	// config field to be compatible with CheckAndSetDefaults().
-
-	var clusterName string
-	if err := node.Decode(&clusterName); err != nil {
-		return trace.Wrap(err)
-	}
-
-	kc.ClusterName = clusterName
-	return nil
-}
-
-func (kc *KubernetesCluster) MarshalYAML() (interface{}, error) {
-	return kc.ClusterName, nil
-}
-
-func (kc *KubernetesCluster) CheckAndSetDefaults() error {
-	if kc.ClusterName == "" {
-		return trace.BadParameter("Kubernetes cluster name must not be empty")
-	}
-
-	return nil
-}
-
-// App is a cert request for app access.
-type App struct {
-	App string `yaml:"app,omitempty"`
-}
-
-func (ac *App) UnmarshalYAML(node *yaml.Node) error {
-	// As with KubernetesCluster, this is a plain string field that we want to
-	// implement CheckAndSetDefaults().
-
-	var app string
-	if err := node.Decode(&app); err != nil {
-		return trace.Wrap(err)
-	}
-
-	ac.App = app
-	return nil
-}
-
-func (ac *App) MarshalYAML() (interface{}, error) {
-	// The marshaler needs to match the unmarshaler.
-	return ac.App, nil
-}
-
-func (ac *App) CheckAndSetDefaults() error {
-	if ac.App == "" {
-		return trace.BadParameter("app name must not be empty")
-	}
-
-	return nil
-}
-
-// DestinationConfig configures a user certificate destination.
-type DestinationConfig struct {
-	DestinationMixin `yaml:",inline"`
-
-	Roles   []string         `yaml:"roles,omitempty"`
-	Configs []TemplateConfig `yaml:"configs,omitempty"`
-
-	// Database is a database to request access to. Mutually exclusive with
-	// `kubernetes_cluster` and other special cert requests.
-	Database *Database `yaml:"database,omitempty"`
-
-	// KubernetesCluster is a cluster to request access to. Mutually exclusive
-	// with `database` and other special cert requests.
-	KubernetesCluster *KubernetesCluster `yaml:"kubernetes_cluster,omitempty"`
-
-	// App is an app access request. Mutually exclusive with `database`,
-	// `kubernetes_cluster`, and other special cert requests.
-	App *App `yaml:"app,omitempty"`
-
-	// Cluster allows certificates to be generated for a leaf cluster of the
-	// cluster that the bot is connected to. These certificates can be used
-	// to directly connect to a Teleport proxy of that leaf cluster, or used
-	// with the root cluster's proxy which will forward the request to the
-	// leaf cluster.
-	// For now, only SSH is supported.
-	Cluster string `yaml:"cluster,omitempty"`
-}
-
-// destinationDefaults applies defaults for an output sink's destination. Since
-// these have no sane defaults, in practice it just returns an error if no
-// config is provided.
-func destinationDefaults(dm *DestinationMixin) error {
-	return trace.BadParameter("destinations require some valid output sink")
-}
-
-// addRequiredConfigs adds all configs with default parameters that were not
-// explicitly requested by users. Several configs, including `identity`, `tls`,
-// and `ssh_client`, are always generated (with defaults set, if any) but will
-// not be overridden if already included by the user.
-func (dc *DestinationConfig) addRequiredConfigs() {
-	if dc.GetConfigByName(TemplateSSHClientName) == nil {
-		dc.Configs = append(dc.Configs, TemplateConfig{
-			SSHClient: &TemplateSSHClient{},
-		})
-	}
-
-	if dc.GetConfigByName(TemplateIdentityName) == nil {
-		dc.Configs = append(dc.Configs, TemplateConfig{
-			Identity: &TemplateIdentity{},
-		})
-	}
-
-	if dc.GetConfigByName(TemplateTLSCAsName) == nil {
-		dc.Configs = append(dc.Configs, TemplateConfig{
-			TLSCAs: &TemplateTLSCAs{},
-		})
-	}
-
-	// If a k8s request exists, enable the kubernetes template.
-	if dc.KubernetesCluster != nil && dc.GetConfigByName(TemplateKubernetesName) == nil {
-		dc.Configs = append(dc.Configs, TemplateConfig{
-			Kubernetes: &TemplateKubernetes{},
-		})
-	}
-}
-
-func (dc *DestinationConfig) CheckAndSetDefaults() error {
-	if err := dc.DestinationMixin.CheckAndSetDefaults(destinationDefaults); err != nil {
-		return trace.Wrap(err)
-	}
-
-	certRequests := []interface{ CheckAndSetDefaults() error }{
-		dc.Database,
-		dc.KubernetesCluster,
-		dc.App,
-	}
-	notNilCount := 0
-	for _, request := range certRequests {
-		// Note: this check is fragile and will fail if the templates aren't
-		// all simple pointer types. They are, though, and the "correct"
-		// solution is insane, so we'll stick with this.
-		if reflect.ValueOf(request).IsNil() {
-			continue
-		}
-
-		if request != nil {
-			if err := request.CheckAndSetDefaults(); err != nil {
-				return trace.Wrap(err)
-			}
-
-			notNilCount++
-		}
-	}
-
-	if notNilCount > 1 {
-		return trace.BadParameter("a destination can make at most one " +
-			"special certificate request (database, kubernetes_cluster, etc)")
-	}
-
-	if notNilCount > 0 && dc.Cluster != "" {
-		return trace.BadParameter("the cluster option can only be used with ssh certificates")
-	}
-
-	// Note: empty roles is allowed; interpreted to mean "all" at generation
-	// time
-
-	dc.addRequiredConfigs()
-
-	for _, cfg := range dc.Configs {
-		if err := cfg.CheckAndSetDefaults(); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	return nil
-}
-
-// ListSubdirectories lists all subdirectories that should be contained within
-// this destination. Primarily used for on-the-fly directory creation.
-func (dc *DestinationConfig) ListSubdirectories() ([]string, error) {
-	// Note: currently no standard identity.Artifacts create subdirs. If that
-	// ever changes, we'll need to adapt this to ensure we initialize them
-	// properly on the fly.
-	var subdirs []string
-
-	dest, err := dc.GetDestination()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	for _, config := range dc.Configs {
-		template, err := config.GetConfigTemplate()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		for _, file := range template.Describe(dest) {
-			if file.IsDir {
-				subdirs = append(subdirs, file.Name)
-			}
-		}
-	}
-
-	return subdirs, nil
-}
-
-// GetConfigByName returns the first valid template with the given name
-// contained within this destination.
-func (dc *DestinationConfig) GetConfigByName(name string) Template {
-	for _, cfg := range dc.Configs {
-		tpl, err := cfg.GetConfigTemplate()
-		if err != nil {
-			continue
-		}
-
-		if tpl.Name() == name {
-			return tpl
-		}
-	}
-
-	return nil
-}
-
-// GetRequiredConfig returns the static list of all default / required config
-// templates.
-func GetRequiredConfigs() []string {
-	return []string{TemplateTLSCAsName, TemplateSSHClientName, TemplateIdentityName}
-}
diff --git a/lib/tbot/config/config_storage.go b/lib/tbot/config/config_storage.go
index 0a128f2c71748..8bcb24aeb7367 100644
--- a/lib/tbot/config/config_storage.go
+++ b/lib/tbot/config/config_storage.go
@@ -20,8 +20,10 @@ import (
 	"path/filepath"
 
 	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
 
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/tbot/bot"
 )
 
 var defaultStoragePath = filepath.Join(defaults.DataDir, "bot")
@@ -29,23 +31,31 @@ var defaultStoragePath = filepath.Join(defaults.DataDir, "bot")
 // StorageConfig contains config parameters for the bot's internal certificate
 // storage.
 type StorageConfig struct {
-	DestinationMixin `yaml:",inline"`
+	// Destination's yaml is handled by MarshalYAML/UnmarshalYAML
+	Destination bot.Destination
 }
 
-// storageDefaults applies default destinations for the bot's internal storage
-// section.
-func storageDefaults(dm *DestinationMixin) error {
-	dm.Directory = &DestinationDirectory{
-		Path: defaultStoragePath,
+func (sc *StorageConfig) CheckAndSetDefaults() error {
+	if sc.Destination == nil {
+		sc.Destination = &DestinationDirectory{
+			Path: defaultStoragePath,
+		}
 	}
 
-	return nil
+	return trace.Wrap(sc.Destination.CheckAndSetDefaults(), "validating storage")
 }
 
-func (sc *StorageConfig) CheckAndSetDefaults() error {
-	if err := sc.DestinationMixin.CheckAndSetDefaults(storageDefaults); err != nil {
+func (sc *StorageConfig) MarshalYAML() (interface{}, error) {
+	// Effectively inlines the destination
+	return sc.Destination.MarshalYAML()
+}
+
+func (sc *StorageConfig) UnmarshalYAML(node *yaml.Node) error {
+	// Effectively inlines the destination
+	dest, err := unmarshalDestination(node)
+	if err != nil {
 		return trace.Wrap(err)
 	}
-
+	sc.Destination = dest
 	return nil
 }
diff --git a/lib/tbot/config/config_test.go b/lib/tbot/config/config_test.go
index 1902f14752cf7..9c15341f71f39 100644
--- a/lib/tbot/config/config_test.go
+++ b/lib/tbot/config/config_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package config
 
 import (
+	"bytes"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -25,29 +26,13 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/require"
-)
-
-func TestConfigDefaults(t *testing.T) {
-	cfg, err := NewDefaultConfig("auth.example.com")
-	require.NoError(t, err)
-
-	require.Equal(t, DefaultCertificateTTL, cfg.CertificateTTL)
-	require.Equal(t, DefaultRenewInterval, cfg.RenewalInterval)
-
-	storageDest, err := cfg.Storage.GetDestination()
-	require.NoError(t, err)
-
-	storageImpl, ok := storageDest.(*DestinationDirectory)
-	require.True(t, ok)
+	"gopkg.in/yaml.v3"
 
-	require.Equal(t, defaultStoragePath, storageImpl.Path)
-
-	// Onboarding config unset
-	require.Nil(t, cfg.Onboarding)
-
-	// Default config has no destinations (without CLI)
-	require.Empty(t, cfg.Destinations)
-}
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+	"github.com/gravitational/teleport/lib/utils/golden"
+)
 
 func TestConfigCLIOnlySample(t *testing.T) {
 	// Test the sample config generated by `tctl bots add ...`
@@ -58,6 +43,7 @@ func TestConfigCLIOnlySample(t *testing.T) {
 		AuthServer:     "auth.example.com",
 		DiagAddr:       "127.0.0.1:1337",
 		Debug:          true,
+		JoinMethod:     string(types.JoinMethodToken),
 	}
 	cfg, err := FromCLIConf(&cf)
 	require.NoError(t, err)
@@ -72,22 +58,15 @@ func TestConfigCLIOnlySample(t *testing.T) {
 	require.Equal(t, cf.CAPins, cfg.Onboarding.CAPins)
 
 	// Storage is still default
-	storageDest, err := cfg.Storage.GetDestination()
-	require.NoError(t, err)
-	storageImpl, ok := storageDest.(*DestinationDirectory)
+	storageImpl, ok := cfg.Storage.Destination.(*DestinationDirectory)
 	require.True(t, ok)
 	require.Equal(t, defaultStoragePath, storageImpl.Path)
 
-	// A single default destination should exist
-	require.Len(t, cfg.Destinations, 1)
-	dest := cfg.Destinations[0]
-
-	// We have 3 required/default templates.
-	require.Len(t, dest.Configs, 3)
-	template := dest.Configs[0]
-	require.NotNil(t, template.SSHClient)
+	// A single default Destination should exist
+	require.Len(t, cfg.Outputs, 1)
+	output := cfg.Outputs[0]
 
-	destImpl, err := dest.GetDestination()
+	destImpl := output.GetDestination()
 	require.NoError(t, err)
 	destImplReal, ok := destImpl.(*DestinationDirectory)
 	require.True(t, ok)
@@ -99,7 +78,7 @@ func TestConfigCLIOnlySample(t *testing.T) {
 
 func TestConfigFile(t *testing.T) {
 	configData := fmt.Sprintf(exampleConfigFile, "foo")
-	cfg, err := ReadConfig(strings.NewReader(configData))
+	cfg, err := ReadConfig(strings.NewReader(configData), false)
 	require.NoError(t, err)
 
 	require.Equal(t, "auth.example.com", cfg.AuthServer)
@@ -112,25 +91,15 @@ func TestConfigFile(t *testing.T) {
 	require.Equal(t, "foo", token)
 	require.ElementsMatch(t, []string{"sha256:abc123"}, cfg.Onboarding.CAPins)
 
-	storage, err := cfg.Storage.GetDestination()
-	require.NoError(t, err)
-
-	_, ok := storage.(*DestinationMemory)
+	_, ok := cfg.Storage.Destination.(*DestinationMemory)
 	require.True(t, ok)
 
-	require.Len(t, cfg.Destinations, 1)
-	destination := cfg.Destinations[0]
-
-	require.Len(t, destination.Configs, 1)
-	template := destination.Configs[0]
-	templateImpl, err := template.GetConfigTemplate()
-	require.NoError(t, err)
-	sshTemplate, ok := templateImpl.(*TemplateSSHClient)
+	require.Len(t, cfg.Outputs, 1)
+	output := cfg.Outputs[0]
+	_, ok = output.(*IdentityOutput)
 	require.True(t, ok)
-	require.Equal(t, uint16(1234), sshTemplate.ProxyPort)
 
-	destImpl, err := destination.GetDestination()
-	require.NoError(t, err)
+	destImpl := output.GetDestination()
 	destImplReal, ok := destImpl.(*DestinationDirectory)
 	require.True(t, ok)
 	require.Equal(t, "/tmp/foo", destImplReal.Path)
@@ -145,7 +114,7 @@ func TestLoadTokenFromFile(t *testing.T) {
 	require.NoError(t, os.WriteFile(tokenFile, []byte("xxxyyy"), 0660))
 
 	configData := fmt.Sprintf(exampleConfigFile, tokenFile)
-	cfg, err := ReadConfig(strings.NewReader(configData))
+	cfg, err := ReadConfig(strings.NewReader(configData), false)
 	require.NoError(t, err)
 
 	token, err := cfg.Onboarding.Token()
@@ -154,6 +123,7 @@ func TestLoadTokenFromFile(t *testing.T) {
 }
 
 const exampleConfigFile = `
+version: v2
 auth_server: auth.example.com
 renewal_interval: 5m
 debug: true
@@ -163,69 +133,48 @@ onboarding:
   ca_pins:
     - sha256:abc123
 storage:
-  memory: {}
-destinations:
-  - directory:
+  type: memory
+outputs:
+  - type: identity
+    destination:
+      type: directory
       path: /tmp/foo
-    configs:
-      - ssh_client:
-          proxy_port: 1234
 `
 
-func TestStorageConfigFromCLIConf(t *testing.T) {
+func TestDestinationFromURI(t *testing.T) {
 	tests := []struct {
 		in      string
-		want    *StorageConfig
+		want    bot.Destination
 		wantErr bool
 	}{
 		{
 			in: "/absolute/dir",
-			want: &StorageConfig{
-				DestinationMixin: DestinationMixin{
-					Directory: &DestinationDirectory{
-						Path: "/absolute/dir",
-					},
-				},
+			want: &DestinationDirectory{
+				Path: "/absolute/dir",
 			},
 		},
 		{
 			in: "relative/dir",
-			want: &StorageConfig{
-				DestinationMixin: DestinationMixin{
-					Directory: &DestinationDirectory{
-						Path: "relative/dir",
-					},
-				},
+			want: &DestinationDirectory{
+				Path: "relative/dir",
 			},
 		},
 		{
 			in: "./relative/dir",
-			want: &StorageConfig{
-				DestinationMixin: DestinationMixin{
-					Directory: &DestinationDirectory{
-						Path: "./relative/dir",
-					},
-				},
+			want: &DestinationDirectory{
+				Path: "./relative/dir",
 			},
 		},
 		{
 			in: "file:///absolute/dir",
-			want: &StorageConfig{
-				DestinationMixin: DestinationMixin{
-					Directory: &DestinationDirectory{
-						Path: "/absolute/dir",
-					},
-				},
+			want: &DestinationDirectory{
+				Path: "/absolute/dir",
 			},
 		},
 		{
 			in: "file:/absolute/dir",
-			want: &StorageConfig{
-				DestinationMixin: DestinationMixin{
-					Directory: &DestinationDirectory{
-						Path: "/absolute/dir",
-					},
-				},
+			want: &DestinationDirectory{
+				Path: "/absolute/dir",
 			},
 		},
 		{
@@ -233,12 +182,8 @@ func TestStorageConfigFromCLIConf(t *testing.T) {
 			wantErr: true,
 		},
 		{
-			in: "memory://",
-			want: &StorageConfig{
-				DestinationMixin: DestinationMixin{
-					Memory: &DestinationMemory{},
-				},
-			},
+			in:   "memory://",
+			want: &DestinationMemory{},
 		},
 		{
 			in:      "memory://foo/bar",
@@ -251,7 +196,7 @@ func TestStorageConfigFromCLIConf(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.in, func(t *testing.T) {
-			got, err := storageConfigFromCLIConf(tt.in)
+			got, err := destinationFromURI(tt.in)
 			if tt.wantErr {
 				require.Error(t, err)
 				return
@@ -261,3 +206,92 @@ func TestStorageConfigFromCLIConf(t *testing.T) {
 		})
 	}
 }
+
+// TestBotConfig_YAML ensures that as a whole YAML marshaling and unmarshaling
+// of the config works as expected. Avoid testing exhaustive cases here and
+// prefer the Output YAML tests for testing the intricacies of marshaling and
+// unmarshaling specific objects.
+func TestBotConfig_YAML(t *testing.T) {
+	tests := []testYAMLCase[BotConfig]{
+		{
+			name: "standard config",
+			in: BotConfig{
+				Version: V2,
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path:     "/bot/storage",
+						ACLs:     botfs.ACLTry,
+						Symlinks: botfs.SymlinksSecure,
+					},
+				},
+				FIPS:            true,
+				Debug:           true,
+				Oneshot:         true,
+				AuthServer:      "example.teleport.sh:443",
+				DiagAddr:        "127.0.0.1:1337",
+				CertificateTTL:  time.Minute,
+				RenewalInterval: time.Second * 30,
+				Outputs: Outputs{
+					&IdentityOutput{
+						Destination: &DestinationDirectory{
+							Path: "/bot/output",
+						},
+						Roles:   []string{"editor"},
+						Cluster: "example.teleport.sh",
+					},
+					&IdentityOutput{
+						Destination: &DestinationMemory{},
+					},
+				},
+			},
+		},
+		{
+			name: "minimal config",
+			in: BotConfig{
+				Version:         V2,
+				AuthServer:      "example.teleport.sh:443",
+				CertificateTTL:  time.Minute,
+				RenewalInterval: time.Second * 30,
+				Outputs: Outputs{
+					&IdentityOutput{
+						Destination: &DestinationMemory{},
+					},
+				},
+			},
+		},
+	}
+
+	testYAML(t, tests)
+}
+
+type testYAMLCase[T any] struct {
+	name string
+	in   T
+}
+
+func testYAML[T any](t *testing.T, tests []testYAMLCase[T]) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := bytes.NewBuffer(nil)
+			encoder := yaml.NewEncoder(b)
+			encoder.SetIndent(2)
+			require.NoError(t, encoder.Encode(tt.in))
+
+			if golden.ShouldSet() {
+				golden.Set(t, b.Bytes())
+			}
+			require.Equal(
+				t,
+				string(golden.Get(t)),
+				b.String(),
+				"results of marshal did not match golden file, rerun tests with GOLDEN_UPDATE=1",
+			)
+
+			// Now test unmarshalling to see if we get the same object back
+			decoder := yaml.NewDecoder(b)
+			var unmarshalled T
+			require.NoError(t, decoder.Decode(&unmarshalled))
+			require.Equal(t, unmarshalled, tt.in, "unmarshalling did not result in same object as input")
+		})
+	}
+}
diff --git a/lib/tbot/config/configtemplate_ssh_host_cert_test.go b/lib/tbot/config/configtemplate_ssh_host_cert_test.go
deleted file mode 100644
index 053476d8539d0..0000000000000
--- a/lib/tbot/config/configtemplate_ssh_host_cert_test.go
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package config
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/fixtures"
-)
-
-type mockHostCertAuth struct {
-	mockAuth
-}
-
-func (m *mockHostCertAuth) GenerateHostCert(
-	ctx context.Context,
-	key []byte, hostID, nodeName string, principals []string,
-	clusterName string, role types.SystemRole, ttl time.Duration,
-) ([]byte, error) {
-	// We could generate a cert easily enough here, but the template generates a
-	// random key each run so the resulting cert will change too.
-	// The CA fixture isn't even a cert but we never examine it, so it'll do the
-	// job.
-	return []byte(fixtures.SSHCAPublicKey), nil
-}
-
-func TestTemplateSSHHostCertRender(t *testing.T) {
-	mockAuth := &mockHostCertAuth{
-		mockAuth: *newMockAuth(t),
-	}
-
-	cfg, err := NewDefaultConfig("example.com")
-	require.NoError(t, err)
-
-	mockBot := newMockBot(cfg, mockAuth)
-
-	template := TemplateSSHHostCert{
-		Prefix:     "example",
-		Principals: []string{"foo.example.com"},
-	}
-	require.NoError(t, template.CheckAndSetDefaults())
-
-	memory := &DestinationMemory{}
-	dest := &DestinationConfig{
-		DestinationMixin: DestinationMixin{
-			Memory: memory,
-		},
-	}
-	require.NoError(t, dest.CheckAndSetDefaults())
-
-	ident := getTestIdent(t, "bot-test")
-	err = template.Render(context.Background(), mockBot, ident, ident, dest)
-	require.NoError(t, err)
-
-	// Make sure a cert is written. We just use a dummy cert (the CA fixture)
-	certBytes, err := memory.Read(template.Prefix + sshHostCertSuffix)
-	require.NoError(t, err)
-
-	require.Equal(t, fixtures.SSHCAPublicKey, string(certBytes))
-
-	// Make sure a CA is written.
-	caBytes, err := memory.Read(template.Prefix + sshHostUserCASuffix)
-	require.NoError(t, err)
-
-	require.True(t, strings.HasPrefix(string(caBytes), fixtures.SSHCAPublicKey))
-}
diff --git a/lib/tbot/config/configtemplate_tls.go b/lib/tbot/config/configtemplate_tls.go
deleted file mode 100644
index c73b45fab215a..0000000000000
--- a/lib/tbot/config/configtemplate_tls.go
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package config
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/client/identityfile"
-	"github.com/gravitational/teleport/lib/tbot/bot"
-	"github.com/gravitational/teleport/lib/tbot/identity"
-)
-
-const defaultTLSPrefix = "tls"
-
-// CertAuthType is a types.CertAuthType wrapper with unmarshalling support.
-type CertAuthType types.CertAuthType
-
-const defaultCAType = types.HostCA
-
-func (c *CertAuthType) UnmarshalYAML(node *yaml.Node) error {
-	var certType string
-	err := node.Decode(&certType)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	switch certType {
-	case "":
-		*c = CertAuthType(defaultCAType)
-	case string(types.HostCA), string(types.UserCA), string(types.DatabaseCA):
-		*c = CertAuthType(certType)
-	default:
-		return trace.BadParameter("invalid CA certificate type: %q", certType)
-	}
-
-	return nil
-}
-
-func (c *CertAuthType) CheckAndSetDefaults() error {
-	switch types.CertAuthType(*c) {
-	case "":
-		*c = CertAuthType(defaultCAType)
-	case types.HostCA, types.UserCA, types.DatabaseCA:
-		// valid, nothing to do
-	default:
-		return trace.BadParameter("unsupported CA certificate type: %q", string(*c))
-	}
-
-	return nil
-}
-
-// TemplateTLS is a config template that wraps identityfile's TLS writer.
-// It's not generally needed but can be used to write out TLS certificates with
-// alternative prefix and file extensions if needed for application
-// compatibility reasons.
-type TemplateTLS struct {
-	// Prefix is the filename prefix for the output files.
-	Prefix string `yaml:"prefix,omitempty"`
-
-	// CACertType is the type of CA cert to be written
-	CACertType CertAuthType `yaml:"ca_cert_type,omitempty"`
-}
-
-func (t *TemplateTLS) CheckAndSetDefaults() error {
-	if t.Prefix == "" {
-		t.Prefix = defaultTLSPrefix
-	}
-
-	if err := t.CACertType.CheckAndSetDefaults(); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
-}
-
-func (t *TemplateTLS) Name() string {
-	return TemplateTLSName
-}
-
-func (t *TemplateTLS) Describe(destination bot.Destination) []FileDescription {
-	return []FileDescription{
-		{
-			Name: t.Prefix + ".key",
-		},
-		{
-			Name: t.Prefix + ".crt",
-		},
-		{
-			Name: t.Prefix + ".cas",
-		},
-	}
-}
-
-func (t *TemplateTLS) Render(
-	ctx context.Context,
-	bot Bot,
-	currentIdentity, _ *identity.Identity,
-	destination *DestinationConfig,
-) error {
-	dest, err := destination.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	cas, err := bot.GetCertAuthorities(ctx, types.CertAuthType(t.CACertType))
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	key, err := newClientKey(currentIdentity, cas)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	cfg := identityfile.WriteConfig{
-		OutputPath: t.Prefix,
-		Writer: &BotConfigWriter{
-			dest: dest,
-		},
-		Key:    key,
-		Format: identityfile.FormatTLS,
-
-		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
-		OverwriteDestination: true,
-	}
-
-	files, err := identityfile.Write(ctx, cfg)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	log.Debugf("Wrote TLS identity files: %+v", files)
-
-	return nil
-}
diff --git a/lib/tbot/config/destination.go b/lib/tbot/config/destination.go
deleted file mode 100644
index eeb49ac6db10c..0000000000000
--- a/lib/tbot/config/destination.go
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package config
-
-import (
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/lib/tbot/bot"
-)
-
-// DestinationMixin is a reusable struct for all config elements that accept a
-// destination. Note that if embedded, DestinationMixin.CheckAndSetDefaults()
-// must be called.
-type DestinationMixin struct {
-	Directory *DestinationDirectory `yaml:"directory,omitempty"`
-	Memory    *DestinationMemory    `yaml:"memory,omitempty"`
-}
-
-type DestinationDefaults = func(*DestinationMixin) error
-
-// checkAndSetDefaultsInner performs member initialization that won't recurse
-func (dm *DestinationMixin) checkAndSetDefaultsInner() (int, error) {
-	notNilCount := 0
-	if dm.Directory != nil {
-		if err := dm.Directory.CheckAndSetDefaults(); err != nil {
-			return 0, trace.Wrap(err)
-		}
-
-		notNilCount++
-	}
-
-	if dm.Memory != nil {
-		if err := dm.Memory.CheckAndSetDefaults(); err != nil {
-			return 0, trace.Wrap(err)
-		}
-
-		notNilCount++
-	}
-	return notNilCount, nil
-}
-
-func (dm *DestinationMixin) CheckAndSetDefaults(applyDefaults DestinationDefaults) error {
-	notNilCount, err := dm.checkAndSetDefaultsInner()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if notNilCount == 0 {
-		// use defaults
-		if err := applyDefaults(dm); err != nil {
-			return trace.Wrap(err)
-		}
-
-		// CheckAndSetDefaults() again
-		notNilCount, err := dm.checkAndSetDefaultsInner()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		if notNilCount == 0 {
-			return trace.BadParameter("a destination is required")
-		}
-	} else if notNilCount > 1 {
-		return trace.BadParameter("only one destination backend may be specified at a time")
-	}
-
-	return nil
-}
-
-// GetDestination returns the first non-nil Destination set. Note that
-// CheckAndSetDefaults() does attempt to ensure that only a single
-// destination is set, though this may change at runtime.
-func (dm *DestinationMixin) GetDestination() (bot.Destination, error) {
-	if dm.Directory != nil {
-		return dm.Directory, nil
-	}
-
-	if dm.Memory != nil {
-		return dm.Memory, nil
-	}
-
-	return nil, trace.BadParameter("no valid destination exists")
-}
diff --git a/lib/tbot/config/destination_directory.go b/lib/tbot/config/destination_directory.go
index c148016ae7739..765e4ef63408b 100644
--- a/lib/tbot/config/destination_directory.go
+++ b/lib/tbot/config/destination_directory.go
@@ -32,6 +32,8 @@ import (
 	"github.com/gravitational/teleport/lib/utils"
 )
 
+const DestinationDirectoryType = "directory"
+
 // DestinationDirectory is a Destination that writes to the local filesystem
 type DestinationDirectory struct {
 	Path     string             `yaml:"path,omitempty"`
@@ -78,13 +80,11 @@ func (dd *DestinationDirectory) CheckAndSetDefaults() error {
 
 	switch dd.Symlinks {
 	case "":
-		if secureSupported {
-			// We expect Openat2 to be available, so try to use it by default.
-			dd.Symlinks = botfs.SymlinksSecure
-		} else {
-			// TrySecure will print a warning on fallback.
-			dd.Symlinks = botfs.SymlinksTrySecure
-		}
+		// We default to SymlinksTrySecure. It's become apparent that the
+		// kernel version alone is not usually enough information to know that
+		// secure symlinks is supported by the OS. In future, we should aim to
+		// perform a more definitive test.
+		dd.Symlinks = botfs.SymlinksTrySecure
 	case botfs.SymlinksInsecure, botfs.SymlinksTrySecure:
 		// valid
 	case botfs.SymlinksSecure:
@@ -185,8 +185,8 @@ func (dd *DestinationDirectory) Verify(keys []string) error {
 		return trace.Wrap(err)
 	}
 
-	// Make sure it's worth warning about ACLs for this destination. If ACLs
-	// are disabled, unsupported, or the destination is owned by the bot
+	// Make sure it's worth warning about ACLs for this Destination. If ACLs
+	// are disabled, unsupported, or the Destination is owned by the bot
 	// (implying the user is not trying to use ACLs), just bail.
 	if dd.ACLs == botfs.ACLOff || !aclsSupported || ownedByBot {
 		return nil
@@ -228,7 +228,7 @@ func (dd *DestinationDirectory) Read(name string) ([]byte, error) {
 }
 
 func (dd *DestinationDirectory) String() string {
-	return fmt.Sprintf("directory %s", dd.Path)
+	return fmt.Sprintf("%s: %s", DestinationDirectoryType, dd.Path)
 }
 
 func (dd *DestinationDirectory) TryLock() (func() error, error) {
@@ -238,3 +238,8 @@ func (dd *DestinationDirectory) TryLock() (func() error, error) {
 	unlock, err := utils.FSTryWriteLock(filepath.Join(dd.Path, "lock"))
 	return unlock, trace.Wrap(err)
 }
+
+func (dm DestinationDirectory) MarshalYAML() (interface{}, error) {
+	type raw DestinationDirectory
+	return withTypeHeader(raw(dm), DestinationDirectoryType)
+}
diff --git a/lib/tbot/config/destination_directory_test.go b/lib/tbot/config/destination_directory_test.go
index b857e546df058..75712bee48f91 100644
--- a/lib/tbot/config/destination_directory_test.go
+++ b/lib/tbot/config/destination_directory_test.go
@@ -50,3 +50,23 @@ func TestDestinationDirectory_Lock(t *testing.T) {
 	// Release the lock
 	require.NoError(t, unlock())
 }
+
+func TestDestinationDirectory_YAML(t *testing.T) {
+	tests := []testYAMLCase[DestinationDirectory]{
+		{
+			name: "full",
+			in: DestinationDirectory{
+				Path:     "/my/path",
+				ACLs:     botfs.ACLRequired,
+				Symlinks: botfs.SymlinksSecure,
+			},
+		},
+		{
+			name: "minimal",
+			in: DestinationDirectory{
+				Path: "/my/path",
+			},
+		},
+	}
+	testYAML(t, tests)
+}
diff --git a/lib/tbot/config/destination_memory.go b/lib/tbot/config/destination_memory.go
index 1273a354370b2..931b7b888596d 100644
--- a/lib/tbot/config/destination_memory.go
+++ b/lib/tbot/config/destination_memory.go
@@ -21,7 +21,9 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
-// DestinationMemory is a memory certificate destination
+const DestinationMemoryType = "memory"
+
+// DestinationMemory is a memory certificate Destination
 type DestinationMemory struct {
 	store map[string][]byte `yaml:"-"`
 }
@@ -76,13 +78,18 @@ func (dm *DestinationMemory) Read(name string) ([]byte, error) {
 }
 
 func (dm *DestinationMemory) String() string {
-	return "[memory]"
+	return DestinationMemoryType
 }
 
 func (dm *DestinationMemory) TryLock() (func() error, error) {
 	// As this is purely in-memory, no locking behavior is required for the
-	// destination.
+	// Destination.
 	return func() error {
 		return nil
 	}, nil
 }
+
+func (dm DestinationMemory) MarshalYAML() (interface{}, error) {
+	type raw DestinationMemory
+	return withTypeHeader(raw(dm), DestinationMemoryType)
+}
diff --git a/lib/tbot/config/migrate.go b/lib/tbot/config/migrate.go
new file mode 100644
index 0000000000000..bd50c504c2680
--- /dev/null
+++ b/lib/tbot/config/migrate.go
@@ -0,0 +1,415 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"time"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/exp/slices"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+)
+
+type destinationMixinV1 struct {
+	Directory *DestinationDirectory `yaml:"directory"`
+	Memory    *DestinationMemory    `yaml:"memory"`
+}
+
+func (c *destinationMixinV1) migrate() (bot.Destination, error) {
+	switch {
+	case c.Memory != nil && c.Directory != nil:
+		return nil, trace.BadParameter("both 'memory' and 'directory' cannot be specified")
+	case c.Memory != nil:
+		return c.Memory, nil
+	case c.Directory != nil:
+		return c.Directory, nil
+	default:
+		return nil, trace.BadParameter("at least one of `memory' and 'directory' must be specified")
+	}
+}
+
+type storageConfigV1 struct {
+	Mixin destinationMixinV1 `yaml:",inline"`
+}
+
+func (c *storageConfigV1) migrate() (*StorageConfig, error) {
+	dest, err := c.Mixin.migrate()
+	if err != nil {
+		return nil, trace.Wrap(err, "migrating destination mixin")
+	}
+
+	return &StorageConfig{
+		Destination: dest,
+	}, nil
+}
+
+type configV1Database struct {
+	Service  string `yaml:"service"`
+	Database string `yaml:"database"`
+	Username string `yaml:"username"`
+}
+
+type configV1DestinationConfigHostCert struct {
+	Principals []string `yaml:"principals"`
+}
+
+type configV1DestinationConfig struct {
+	SSHClient   map[string]any                     `yaml:"ssh_client"`
+	Identity    map[string]any                     `yaml:"identity"`
+	TLS         map[string]any                     `yaml:"tls"`
+	TLSCAs      map[string]any                     `yaml:"tls_cas"`
+	Mongo       map[string]any                     `yaml:"mongo"`
+	Cockroach   map[string]any                     `yaml:"cockroach"`
+	Kubernetes  map[string]any                     `yaml:"kubernetes"`
+	SSHHostCert *configV1DestinationConfigHostCert `yaml:"ssh_host_cert"`
+}
+
+func (c *configV1DestinationConfig) UnmarshalYAML(node *yaml.Node) error {
+	var simpleTemplate string
+	if err := node.Decode(&simpleTemplate); err == nil {
+		switch simpleTemplate {
+		case TemplateSSHClientName:
+			c.SSHClient = map[string]any{}
+		case TemplateIdentityName:
+			c.Identity = map[string]any{}
+		case TemplateTLSName:
+			c.TLS = map[string]any{}
+		case TemplateTLSCAsName:
+			c.TLSCAs = map[string]any{}
+		case TemplateMongoName:
+			c.Mongo = map[string]any{}
+		case TemplateCockroachName:
+			c.Cockroach = map[string]any{}
+		case TemplateKubernetesName:
+			c.Kubernetes = map[string]any{}
+		case TemplateSSHHostCertName:
+			c.SSHHostCert = &configV1DestinationConfigHostCert{}
+		default:
+			return trace.BadParameter("unrecognized config template %q", simpleTemplate)
+		}
+		return nil
+	}
+
+	// Fall back to the full struct; alias it to get standard unmarshal
+	// behavior and avoid recursion
+	type rawTemplate configV1DestinationConfig
+	return trace.Wrap(node.Decode((*rawTemplate)(c)))
+}
+
+type configV1Destination struct {
+	Mixin destinationMixinV1 `yaml:",inline"`
+
+	Roles   []string                    `yaml:"roles"`
+	Configs []configV1DestinationConfig `yaml:"configs"`
+
+	Database          *configV1Database `yaml:"database"`
+	KubernetesCluster string            `yaml:"kubernetes_cluster"`
+	App               string            `yaml:"app"`
+	Cluster           string            `yaml:"cluster"`
+}
+
+func validateTemplates(configs []configV1DestinationConfig, allowedTypes []string, requiredTypes []string) error {
+	var allConfiguredTypes []string
+
+	configUnsupportedErr := func(typeName string) error {
+		return trace.BadParameter("configuration options are not supported by migration for %s config template", typeName)
+	}
+
+	for _, templateConfig := range configs {
+		var configuredTypes []string
+		if templateConfig.SSHClient != nil {
+			if len(templateConfig.SSHClient) > 0 {
+				return configUnsupportedErr(TemplateSSHClientName)
+			}
+			configuredTypes = append(configuredTypes, TemplateSSHClientName)
+		}
+		if templateConfig.Identity != nil {
+			if len(templateConfig.Identity) > 0 {
+				return configUnsupportedErr(TemplateIdentityName)
+			}
+			configuredTypes = append(configuredTypes, TemplateIdentityName)
+		}
+		if templateConfig.TLS != nil {
+			if len(templateConfig.TLS) > 0 {
+				return configUnsupportedErr(TemplateTLSName)
+			}
+			configuredTypes = append(configuredTypes, TemplateTLSName)
+		}
+		if templateConfig.TLSCAs != nil {
+			if len(templateConfig.TLSCAs) > 0 {
+				return configUnsupportedErr(TemplateTLSCAsName)
+			}
+			configuredTypes = append(configuredTypes, TemplateTLSCAsName)
+		}
+		if templateConfig.Mongo != nil {
+			if len(templateConfig.Mongo) > 0 {
+				return configUnsupportedErr(TemplateMongoName)
+			}
+			configuredTypes = append(configuredTypes, TemplateMongoName)
+		}
+		if templateConfig.Cockroach != nil {
+			if len(templateConfig.Cockroach) > 0 {
+				return configUnsupportedErr(TemplateCockroachName)
+			}
+			configuredTypes = append(configuredTypes, TemplateCockroachName)
+		}
+		if templateConfig.Kubernetes != nil {
+			if len(templateConfig.Kubernetes) > 0 {
+				return configUnsupportedErr(TemplateKubernetesName)
+			}
+			configuredTypes = append(configuredTypes, TemplateKubernetesName)
+		}
+		if templateConfig.SSHHostCert != nil {
+			if len(templateConfig.SSHHostCert.Principals) == 0 {
+				return trace.BadParameter("no principals specified for %s config template", TemplateSSHHostCertName)
+			}
+			configuredTypes = append(configuredTypes, TemplateSSHHostCertName)
+		}
+
+		if len(configuredTypes) == 0 {
+			return trace.BadParameter("config template must not be empty")
+		}
+		if len(configuredTypes) > 1 {
+			return trace.BadParameter("config template must have exactly one configuration")
+		}
+
+		allConfiguredTypes = append(allConfiguredTypes, configuredTypes...)
+	}
+
+	// Ensure all types are allowed by the new output type
+	for _, typeName := range allConfiguredTypes {
+		if !slices.Contains(allowedTypes, typeName) {
+			return trace.BadParameter("config template %q unsupported by new output type", typeName)
+		}
+	}
+
+	// Ensure the required types are specified for the new output type
+	for _, typeName := range requiredTypes {
+		if !slices.Contains(allConfiguredTypes, typeName) {
+			return trace.BadParameter("old config templates missing required template %s", typeName)
+		}
+	}
+
+	// Check for any weird duplicates we can't handle correctly
+	typeCounts := map[string]int{}
+	for _, typeName := range allConfiguredTypes {
+		typeCounts[typeName]++
+	}
+	for typeName, count := range typeCounts {
+		if count > 1 {
+			return trace.BadParameter("multiple config template entries found for %q", typeName)
+		}
+	}
+
+	return nil
+}
+
+func (c *configV1Destination) migrate() (Output, error) {
+	dest, err := c.Mixin.migrate()
+	if err != nil {
+		return nil, trace.Wrap(err, "migrating destination")
+	}
+
+	appConfigured := c.App != ""
+	databaseConfigured := c.Database != nil
+	kubernetesConfigured := c.KubernetesCluster != ""
+	hostCertConfigured := false
+	for _, templateConfig := range c.Configs {
+		if templateConfig.SSHHostCert != nil {
+			hostCertConfigured = true
+		}
+	}
+	outputTypesCount := 0
+	for _, val := range []bool{appConfigured, databaseConfigured, kubernetesConfigured, hostCertConfigured} {
+		if val {
+			outputTypesCount++
+		}
+	}
+	if outputTypesCount > 1 {
+		return nil, trace.BadParameter("multiple potential output types detected, cannot determine correct type")
+	}
+
+	switch {
+	case appConfigured:
+		if err := validateTemplates(
+			c.Configs,
+			[]string{TemplateTLSCAsName, TemplateTLSName, TemplateIdentityName},
+			[]string{},
+		); err != nil {
+			return nil, trace.Wrap(err, "validating template configs")
+		}
+		specificTLSExtensions := false
+		for _, templateConfig := range c.Configs {
+			if templateConfig.TLS != nil {
+				specificTLSExtensions = true
+				break
+			}
+		}
+		return &ApplicationOutput{
+			Destination:           dest,
+			Roles:                 c.Roles,
+			AppName:               c.App,
+			SpecificTLSExtensions: specificTLSExtensions,
+		}, nil
+	case databaseConfigured:
+		if err := validateTemplates(
+			c.Configs,
+			[]string{TemplateTLSCAsName, TemplateIdentityName, TemplateMongoName, TemplateCockroachName, TemplateTLSName},
+			[]string{},
+		); err != nil {
+			return nil, trace.Wrap(err, "validating template configs")
+		}
+		format := UnspecifiedDatabaseFormat
+		for _, templateConfig := range c.Configs {
+			if templateConfig.Mongo != nil {
+				if format != UnspecifiedDatabaseFormat {
+					return nil, trace.BadParameter("multiple candidate formats for database output")
+				}
+				format = MongoDatabaseFormat
+			}
+			if templateConfig.Cockroach != nil {
+				if format != UnspecifiedDatabaseFormat {
+					return nil, trace.BadParameter("multiple candidate formats for database output")
+				}
+				format = CockroachDatabaseFormat
+			}
+			if templateConfig.TLS != nil {
+				if format != UnspecifiedDatabaseFormat {
+					return nil, trace.BadParameter("multiple candidate formats for database output")
+				}
+				format = TLSDatabaseFormat
+			}
+		}
+		return &DatabaseOutput{
+			Destination: dest,
+			Roles:       c.Roles,
+			Format:      format,
+			Database:    c.Database.Database,
+			Service:     c.Database.Service,
+			Username:    c.Database.Username,
+		}, nil
+	case kubernetesConfigured:
+		if err := validateTemplates(
+			c.Configs,
+			[]string{TemplateTLSCAsName, TemplateIdentityName, TemplateKubernetesName},
+			[]string{},
+		); err != nil {
+			return nil, trace.Wrap(err, "validating template configs")
+		}
+		return &KubernetesOutput{
+			Destination:       dest,
+			Roles:             c.Roles,
+			KubernetesCluster: c.KubernetesCluster,
+		}, nil
+	case hostCertConfigured:
+		if err := validateTemplates(
+			c.Configs,
+			[]string{TemplateSSHHostCertName},
+			[]string{TemplateSSHHostCertName},
+		); err != nil {
+			return nil, trace.Wrap(err, "validating template configs")
+		}
+
+		// Extract principals from template config
+		principals := []string{}
+		for _, c := range c.Configs {
+			if c.SSHHostCert != nil {
+				principals = c.SSHHostCert.Principals
+				break
+			}
+		}
+		return &SSHHostOutput{
+			Destination: dest,
+			Roles:       c.Roles,
+			Principals:  principals,
+		}, nil
+	default:
+		if err := validateTemplates(
+			c.Configs,
+			[]string{TemplateTLSCAsName, TemplateIdentityName, TemplateSSHClientName},
+			[]string{},
+		); err != nil {
+			return nil, trace.Wrap(err, "validating template configs")
+		}
+		return &IdentityOutput{
+			Destination: dest,
+			Roles:       c.Roles,
+			Cluster:     c.Cluster,
+		}, nil
+	}
+}
+
+type configV1 struct {
+	Onboarding      OnboardingConfig `yaml:"onboarding"`
+	Debug           bool             `yaml:"debug"`
+	AuthServer      string           `yaml:"auth_server"`
+	CertificateTTL  time.Duration    `yaml:"certificate_ttl"`
+	RenewalInterval time.Duration    `yaml:"renewal_interval"`
+	Oneshot         bool             `yaml:"oneshot"`
+	FIPS            bool             `yaml:"fips"`
+	DiagAddr        string           `yaml:"diag_addr"`
+
+	Destinations  []configV1Destination `yaml:"destinations"`
+	StorageConfig *storageConfigV1      `yaml:"storage"`
+
+	// This field doesn't exist in V1, but, it exists here so we can detect
+	// a scenario where for some reason we're trying to migrate a V2 config
+	// that's missing the version header.
+	Outputs []any `yaml:"outputs"`
+}
+
+func (c *configV1) migrate() (*BotConfig, error) {
+	if len(c.Outputs) > 0 {
+		return nil, trace.BadParameter("config has been detected as potentially v1, but includes the v2 outputs field")
+	}
+
+	var storage *StorageConfig
+	var err error
+	if c.StorageConfig != nil {
+		storage, err = c.StorageConfig.migrate()
+		if err != nil {
+			return nil, trace.Wrap(err, "migrating storage config")
+		}
+	}
+
+	var outputs []Output
+	for _, d := range c.Destinations {
+		o, err := d.migrate()
+		if err != nil {
+			return nil, trace.Wrap(err, "migrating output")
+		}
+		outputs = append(outputs, o)
+	}
+
+	return &BotConfig{
+		Version: V2,
+
+		Onboarding:      c.Onboarding,
+		Debug:           c.Debug,
+		AuthServer:      c.AuthServer,
+		CertificateTTL:  c.CertificateTTL,
+		RenewalInterval: c.RenewalInterval,
+		Oneshot:         c.Oneshot,
+		FIPS:            c.FIPS,
+		DiagAddr:        c.DiagAddr,
+
+		Storage: storage,
+		Outputs: outputs,
+	}, nil
+}
diff --git a/lib/tbot/config/migrate_test.go b/lib/tbot/config/migrate_test.go
new file mode 100644
index 0000000000000..b6b80257eb41c
--- /dev/null
+++ b/lib/tbot/config/migrate_test.go
@@ -0,0 +1,1145 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"bytes"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+)
+
+func TestMigrate(t *testing.T) {
+	tests := []struct {
+		name       string
+		input      string
+		wantError  string
+		wantOutput *BotConfig
+	}{
+		{
+			name: "very full config",
+			input: `
+auth_server: example.teleport.sh:443
+oneshot: true
+debug: true
+certificate_ttl: 30m
+diag_addr: 127.0.0.1:621
+renewal_interval: 10m
+onboarding:
+  join_method: "token"
+  token: "my-token"
+  ca_pins:
+  - "sha256:my-pin"
+storage:
+  directory:
+    path: /path/storage
+    acls: required
+    symlinks: secure
+destinations:
+- directory:
+    path: /path/destination
+  roles: ["foo"]
+  configs:
+  - identity: {}
+  - ssh_client
+  - tls_cas
+- memory: true
+  app: my-app
+  configs:
+  - identity: {}
+  - tls_cas: {}
+  - tls: {}
+- memory: true
+  app: my-app
+- memory: {}
+  kubernetes_cluster: my-kubernetes-cluster
+  configs:
+  - identity
+  - tls_cas
+  - kubernetes
+- memory: {}
+  database:
+    service: "my-db-service"
+    database: "the-db"
+    username: "alice"
+- memory: {}
+  database:
+    service: "my-db-service"
+  configs:
+  - mongo
+- memory: {}
+  database:
+    service: "my-db-service"
+  configs:
+  - tls
+- memory: {}
+  database:
+    service: "my-db-service"
+  configs:
+  - cockroach
+- memory: {}
+  roles: ["foo"]
+  configs:
+  - ssh_host_cert:
+      principals:
+      - example.com
+      - second.example.com
+`,
+			wantOutput: &BotConfig{
+				Version:         V2,
+				AuthServer:      "example.teleport.sh:443",
+				Oneshot:         true,
+				Debug:           true,
+				RenewalInterval: time.Minute * 10,
+				CertificateTTL:  time.Minute * 30,
+				DiagAddr:        "127.0.0.1:621",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodToken,
+					TokenValue: "my-token",
+					CAPins: []string{
+						"sha256:my-pin",
+					},
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path:     "/path/storage",
+						ACLs:     botfs.ACLRequired,
+						Symlinks: botfs.SymlinksSecure,
+					},
+				},
+				Outputs: []Output{
+					&IdentityOutput{
+						Destination: &DestinationDirectory{
+							Path: "/path/destination",
+						},
+						Roles: []string{"foo"},
+					},
+					&ApplicationOutput{
+						Destination:           &DestinationMemory{},
+						AppName:               "my-app",
+						SpecificTLSExtensions: true,
+					},
+					&ApplicationOutput{
+						Destination: &DestinationMemory{},
+						AppName:     "my-app",
+					},
+					&KubernetesOutput{
+						Destination:       &DestinationMemory{},
+						KubernetesCluster: "my-kubernetes-cluster",
+					},
+					&DatabaseOutput{
+						Destination: &DestinationMemory{},
+						Service:     "my-db-service",
+						Database:    "the-db",
+						Username:    "alice",
+						Format:      UnspecifiedDatabaseFormat,
+					},
+					&DatabaseOutput{
+						Destination: &DestinationMemory{},
+						Service:     "my-db-service",
+						Format:      MongoDatabaseFormat,
+					},
+					&DatabaseOutput{
+						Destination: &DestinationMemory{},
+						Service:     "my-db-service",
+						Format:      TLSDatabaseFormat,
+					},
+					&DatabaseOutput{
+						Destination: &DestinationMemory{},
+						Service:     "my-db-service",
+						Format:      CockroachDatabaseFormat,
+					},
+					&SSHHostOutput{
+						Destination: &DestinationMemory{},
+						Roles:       []string{"foo"},
+						Principals:  []string{"example.com", "second.example.com"},
+					},
+				},
+			},
+		},
+		// Backwards compat with GHA
+		{
+			name: "backwards compat with @teleport-actions/auth",
+			input: `
+auth_server: example.teleport.sh:443
+oneshot: true
+debug: true
+onboarding:
+  join_method: github
+  token: my-token
+storage:
+  memory: true
+destinations:
+- directory:
+    path: /path/example
+    symlinks: try-secure
+  roles: []
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "example.teleport.sh:443",
+				Oneshot:    true,
+				Debug:      true,
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodGitHub,
+					TokenValue: "my-token",
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationMemory{},
+				},
+				Outputs: []Output{
+					&IdentityOutput{
+						Destination: &DestinationDirectory{
+							Path:     "/path/example",
+							Symlinks: "try-secure",
+						},
+						Roles: []string{},
+					},
+				},
+			},
+		},
+		{
+			name: "backwards compat with @teleport-actions/auth-k8s",
+			input: `
+auth_server: example.teleport.sh:443
+oneshot: true
+debug: true
+onboarding:
+  join_method: github
+  token: my-token
+storage:
+  memory: true
+destinations:
+- directory:
+    path: /path/example
+    symlinks: try-secure
+  roles: []
+  kubernetes_cluster: my-cluster
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "example.teleport.sh:443",
+				Oneshot:    true,
+				Debug:      true,
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodGitHub,
+					TokenValue: "my-token",
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationMemory{},
+				},
+				Outputs: []Output{
+					&KubernetesOutput{
+						Destination: &DestinationDirectory{
+							Path:     "/path/example",
+							Symlinks: "try-secure",
+						},
+						Roles:             []string{},
+						KubernetesCluster: "my-cluster",
+					},
+				},
+			},
+		},
+		{
+			name: "backwards compat with @teleport-actions/auth-application",
+			input: `
+auth_server: example.teleport.sh:443
+oneshot: true
+debug: true
+onboarding:
+  join_method: github
+  token: my-token
+storage:
+  memory: true
+destinations:
+- directory:
+    path: /path/example
+    symlinks: try-secure
+  roles: []
+  app: my-app
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "example.teleport.sh:443",
+				Oneshot:    true,
+				Debug:      true,
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodGitHub,
+					TokenValue: "my-token",
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationMemory{},
+				},
+				Outputs: []Output{
+					&ApplicationOutput{
+						Destination: &DestinationDirectory{
+							Path:     "/path/example",
+							Symlinks: "try-secure",
+						},
+						Roles:   []string{},
+						AppName: "my-app",
+					},
+				},
+			},
+		},
+		// Backwards compat with guides
+		{
+			name: "backwards compat with https://goteleport.com/docs/machine-id/guides/jenkins/",
+			input: `
+auth_server: "auth.example.com:3025"
+onboarding:
+  join_method: "token"
+  token: "00000000000000000000000000000000"
+  ca_pins:
+  - "sha256:1111111111111111111111111111111111111111111111111111111111111111"
+storage:
+  directory: /var/lib/teleport/bot
+destinations:
+  - directory: /opt/machine-id
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "auth.example.com:3025",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodToken,
+					TokenValue: "00000000000000000000000000000000",
+					CAPins: []string{
+						"sha256:1111111111111111111111111111111111111111111111111111111111111111",
+					},
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/bot",
+					},
+				},
+				Outputs: []Output{
+					&IdentityOutput{
+						Destination: &DestinationDirectory{
+							Path: "/opt/machine-id",
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "backwards compat with https://goteleport.com/docs/machine-id/guides/databases/",
+			input: `
+auth_server: "teleport.example.com:443"
+onboarding:
+  join_method: "token"
+  token: "abcd123-insecure-do-not-use-this"
+  ca_pins:
+  - "sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678"
+storage:
+  directory: /var/lib/teleport/bot
+destinations:
+  - directory: /opt/machine-id
+    
+    database:
+      service: example-server
+      username: alice
+      database: example
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "teleport.example.com:443",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodToken,
+					TokenValue: "abcd123-insecure-do-not-use-this",
+					CAPins: []string{
+						"sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678",
+					},
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/bot",
+					},
+				},
+				Outputs: []Output{
+					&DatabaseOutput{
+						Destination: &DestinationDirectory{
+							Path: "/opt/machine-id",
+						},
+						Service:  "example-server",
+						Username: "alice",
+						Database: "example",
+					},
+				},
+			},
+		},
+		{
+			name: "backwards compat with https://goteleport.com/docs/machine-id/guides/databases/ - mongo",
+			input: `
+auth_server: "teleport.example.com:443"
+onboarding:
+  join_method: "token"
+  token: "abcd123-insecure-do-not-use-this"
+  ca_pins:
+  - "sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678"
+storage:
+  directory: /var/lib/teleport/bot
+destinations:
+  - directory: /opt/machine-id
+    
+    database:
+      service: example-server
+      username: alice
+      database: example
+    
+    # If using MongoDB, be sure to include the Mongo-formatted certificates:
+    configs:
+      - mongo
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "teleport.example.com:443",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodToken,
+					TokenValue: "abcd123-insecure-do-not-use-this",
+					CAPins: []string{
+						"sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678",
+					},
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/bot",
+					},
+				},
+				Outputs: []Output{
+					&DatabaseOutput{
+						Destination: &DestinationDirectory{
+							Path: "/opt/machine-id",
+						},
+						Format:   MongoDatabaseFormat,
+						Service:  "example-server",
+						Username: "alice",
+						Database: "example",
+					},
+				},
+			},
+		},
+		{
+			name: "backwards compat with https://goteleport.com/docs/machine-id/guides/databases/ - cockroach",
+			input: `
+auth_server: "teleport.example.com:443"
+onboarding:
+  join_method: "token"
+  token: "abcd123-insecure-do-not-use-this"
+  ca_pins:
+  - "sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678"
+storage:
+  directory: /var/lib/teleport/bot
+destinations:
+  - directory: /opt/machine-id
+    
+    database:
+      service: example-server
+      username: alice
+      database: example
+
+    configs:
+      - cockroach
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "teleport.example.com:443",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodToken,
+					TokenValue: "abcd123-insecure-do-not-use-this",
+					CAPins: []string{
+						"sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678",
+					},
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/bot",
+					},
+				},
+				Outputs: []Output{
+					&DatabaseOutput{
+						Destination: &DestinationDirectory{
+							Path: "/opt/machine-id",
+						},
+						Format:   CockroachDatabaseFormat,
+						Service:  "example-server",
+						Username: "alice",
+						Database: "example",
+					},
+				},
+			},
+		},
+		{
+			name: "backwards compat with https://goteleport.com/docs/machine-id/guides/databases/ - tls",
+			input: `
+auth_server: "teleport.example.com:443"
+onboarding:
+  join_method: "token"
+  token: "abcd123-insecure-do-not-use-this"
+  ca_pins:
+  - "sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678"
+storage:
+  directory: /var/lib/teleport/bot
+destinations:
+  - directory: /opt/machine-id
+    
+    database:
+      service: example-server
+      username: alice
+      database: example
+
+    configs:
+      - tls
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "teleport.example.com:443",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodToken,
+					TokenValue: "abcd123-insecure-do-not-use-this",
+					CAPins: []string{
+						"sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678",
+					},
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/bot",
+					},
+				},
+				Outputs: []Output{
+					&DatabaseOutput{
+						Destination: &DestinationDirectory{
+							Path: "/opt/machine-id",
+						},
+						Format:   TLSDatabaseFormat,
+						Service:  "example-server",
+						Username: "alice",
+						Database: "example",
+					},
+				},
+			},
+		},
+		{
+			name: "backwards compat with https://goteleport.com/docs/machine-id/guides/host-certificate/",
+			input: `
+onboarding:
+  token: "1234abcd5678efgh9"
+  ca_path: ""
+  ca_pins:
+  - sha256:1234abcd5678efgh910ijklmnop
+  join_method: token
+storage:
+  directory:
+    path: /var/lib/teleport/bot
+    symlinks: secure
+    acls: try
+destinations:
+  - directory:
+      path: /opt/machine-id
+    configs:
+      - ssh_host_cert:
+          principals: [nodename.my.domain.com]
+debug: false
+auth_server: example.teleport.sh:443
+certificate_ttl: 1h0m0s
+renewal_interval: 20m0s
+oneshot: false
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "example.teleport.sh:443",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodToken,
+					TokenValue: "1234abcd5678efgh9",
+					CAPins: []string{
+						"sha256:1234abcd5678efgh910ijklmnop",
+					},
+				},
+				RenewalInterval: DefaultRenewInterval,
+				CertificateTTL:  DefaultCertificateTTL,
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path:     "/var/lib/teleport/bot",
+						Symlinks: "secure",
+						ACLs:     "try",
+					},
+				},
+				Outputs: []Output{
+					&SSHHostOutput{
+						Destination: &DestinationDirectory{
+							Path: "/opt/machine-id",
+						},
+						Principals: []string{"nodename.my.domain.com"},
+					},
+				},
+			},
+		},
+		{
+			name: "backwards compat with https://goteleport.com/docs/machine-id/guides/applications/",
+			input: `
+auth_server: "teleport.example.com:443"
+onboarding:
+  join_method: "token"
+  token: "abcd123-insecure-do-not-use-this"
+  ca_pins:
+  - "sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678"
+storage:
+  directory: /var/lib/teleport/bot
+destinations:
+  - directory: /opt/machine-id
+    app: grafana-example
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "teleport.example.com:443",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodToken,
+					TokenValue: "abcd123-insecure-do-not-use-this",
+					CAPins: []string{
+						"sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678",
+					},
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/bot",
+					},
+				},
+				Outputs: []Output{
+					&ApplicationOutput{
+						Destination: &DestinationDirectory{
+							Path: "/opt/machine-id",
+						},
+						AppName: "grafana-example",
+					},
+				},
+			},
+		},
+		{
+			name: "backwards compat with https://goteleport.com/docs/machine-id/guides/applications/ - with tls config",
+			input: `
+auth_server: "teleport.example.com:443"
+onboarding:
+  join_method: "token"
+  token: "abcd123-insecure-do-not-use-this"
+  ca_pins:
+  - "sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678"
+storage:
+  directory: /var/lib/teleport/bot
+destinations:
+  - directory: /opt/machine-id
+    app: grafana-example
+
+    configs:
+      - tls
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "teleport.example.com:443",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodToken,
+					TokenValue: "abcd123-insecure-do-not-use-this",
+					CAPins: []string{
+						"sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678",
+					},
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/bot",
+					},
+				},
+				Outputs: []Output{
+					&ApplicationOutput{
+						Destination: &DestinationDirectory{
+							Path: "/opt/machine-id",
+						},
+						AppName:               "grafana-example",
+						SpecificTLSExtensions: true,
+					},
+				},
+			},
+		},
+		{
+			name: "backwards compat with https://goteleport.com/docs/machine-id/guides/kubernetes/",
+			input: `
+auth_server: "teleport.example.com:443"
+onboarding:
+  join_method: "token"
+  token: "abcd123-insecure-do-not-use-this"
+  ca_pins:
+  - "sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678"
+storage:
+  directory: /var/lib/teleport/bot
+destinations:
+  - directory: /opt/machine-id
+    kubernetes_cluster: example-k8s-cluster
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "teleport.example.com:443",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodToken,
+					TokenValue: "abcd123-insecure-do-not-use-this",
+					CAPins: []string{
+						"sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678",
+					},
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/bot",
+					},
+				},
+				Outputs: []Output{
+					&KubernetesOutput{
+						Destination: &DestinationDirectory{
+							Path: "/opt/machine-id",
+						},
+						KubernetesCluster: "example-k8s-cluster",
+					},
+				},
+			},
+		},
+		// Niche cases
+		{
+			name: "no storage config",
+			input: `
+auth_server: "teleport.example.com:443"
+onboarding:
+  join_method: "token"
+  token: "abcd123-insecure-do-not-use-this"
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "teleport.example.com:443",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodToken,
+					TokenValue: "abcd123-insecure-do-not-use-this",
+				},
+				Storage: nil,
+				Outputs: nil,
+			},
+		},
+		// Real-world cases
+		{
+			name: "real world 1",
+			input: `
+auth_server: "teleport.example.com:443"
+onboarding:
+  join_method: "iam"
+  token: "iam-token-kube"
+storage:
+  directory:
+    path: /var/lib/teleport/bot
+    symlinks: insecure
+    acls: off
+debug: true
+destinations:
+  - directory:
+      path: /opt/machine-id
+      symlinks: insecure
+      acls: off
+  - directory:
+      path: /opt/machine-id/tools
+      symlinks: insecure
+      acls: off
+    kubernetes_cluster: "tools"
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "teleport.example.com:443",
+				Onboarding: OnboardingConfig{
+					JoinMethod: types.JoinMethodIAM,
+					TokenValue: "iam-token-kube",
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path:     "/var/lib/teleport/bot",
+						Symlinks: botfs.SymlinksInsecure,
+						ACLs:     botfs.ACLOff,
+					},
+				},
+				Debug: true,
+				Outputs: Outputs{
+					&IdentityOutput{
+						Destination: &DestinationDirectory{
+							Path:     "/opt/machine-id",
+							Symlinks: botfs.SymlinksInsecure,
+							ACLs:     botfs.ACLOff,
+						},
+					},
+					&KubernetesOutput{
+						Destination: &DestinationDirectory{
+							Path:     "/opt/machine-id/tools",
+							Symlinks: botfs.SymlinksInsecure,
+							ACLs:     botfs.ACLOff,
+						},
+						KubernetesCluster: "tools",
+					},
+				},
+			},
+		},
+		{
+			name: "real world 2",
+			input: `
+storage:
+    directory:
+        path: /var/tmp/teleport/bot
+        symlinks: insecure
+
+destinations:
+    - directory:
+          path: /var/tmp/machine-id
+          symlinks: insecure
+`,
+			wantOutput: &BotConfig{
+				Version: V2,
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path:     "/var/tmp/teleport/bot",
+						Symlinks: botfs.SymlinksInsecure,
+					},
+				},
+				Outputs: Outputs{
+					&IdentityOutput{
+						Destination: &DestinationDirectory{
+							Path:     "/var/tmp/machine-id",
+							Symlinks: botfs.SymlinksInsecure,
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "real world 3",
+			input: `
+Machine ID config created at /etc/tbot.yaml:
+auth_server: teleportvm.example.com:443
+onboarding:
+  token: redacted
+storage:
+  directory: /var/lib/teleport/bot
+
+destinations:
+  - directory: /opt/machine-id
+    roles: [access]
+    database:
+      service: self-hosted
+      username: alice
+      database: Payroll
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "teleportvm.example.com:443",
+				Onboarding: OnboardingConfig{
+					TokenValue: "redacted",
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/bot",
+					},
+				},
+				Outputs: Outputs{
+					&DatabaseOutput{
+						Destination: &DestinationDirectory{
+							Path: "/opt/machine-id",
+						},
+						Roles:    []string{"access"},
+						Service:  "self-hosted",
+						Username: "alice",
+						Database: "Payroll",
+					},
+				},
+			},
+		},
+		{
+			name: "real world 4",
+			input: `
+auth_server: "redacted.teleport.sh:443"
+onboarding:
+  join_method: "iam"
+  token: "redacted-scanner-token"
+  ca_pins:
+  - "sha256:redacted"
+storage:
+  directory: /var/lib/teleport/bot
+destinations:
+  - directory: /opt/machine-id
+    kubernetes_cluster: devops
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "redacted.teleport.sh:443",
+				Onboarding: OnboardingConfig{
+					TokenValue: "redacted-scanner-token",
+					JoinMethod: types.JoinMethodIAM,
+					CAPins: []string{
+						"sha256:redacted",
+					},
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/bot",
+					},
+				},
+				Outputs: Outputs{
+					&KubernetesOutput{
+						Destination: &DestinationDirectory{
+							Path: "/opt/machine-id",
+						},
+						KubernetesCluster: "devops",
+					},
+				},
+			},
+		},
+		{
+			name: "real world 5",
+			input: `
+auth_server: "redacted.teleport.sh:443"
+onboarding:
+  join_method: "iam"
+  token: "redacted-argocd-token"
+  ca_pins:
+  - "sha256:redacted"
+storage:
+  directory: /var/lib/teleport/bot
+destinations:
+  - directory: 
+      path: /mount/redacted-prod-global
+      acls: off
+    kubernetes_cluster: redacted-prod-global
+  - directory: 
+      path: /mount/redacted-prod-au
+      acls: off
+    kubernetes_cluster: redacted-prod-au
+  - directory: 
+      path: /mount/redacted-prod-eu2
+      acls: off
+    kubernetes_cluster: redacted-prod-eu2
+  - directory: 
+      path: /mount/redacted-prod-ca
+      acls: off
+    kubernetes_cluster: redacted-prod-ca
+  - directory: 
+      path: /mount/redacted-prod-us
+      acls: off
+    kubernetes_cluster: redacted-prod-us
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "redacted.teleport.sh:443",
+				Onboarding: OnboardingConfig{
+					TokenValue: "redacted-argocd-token",
+					JoinMethod: types.JoinMethodIAM,
+					CAPins: []string{
+						"sha256:redacted",
+					},
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/bot",
+					},
+				},
+				Outputs: Outputs{
+					&KubernetesOutput{
+						Destination: &DestinationDirectory{
+							Path: "/mount/redacted-prod-global",
+							ACLs: botfs.ACLOff,
+						},
+						KubernetesCluster: "redacted-prod-global",
+					},
+					&KubernetesOutput{
+						Destination: &DestinationDirectory{
+							Path: "/mount/redacted-prod-au",
+							ACLs: botfs.ACLOff,
+						},
+						KubernetesCluster: "redacted-prod-au",
+					},
+					&KubernetesOutput{
+						Destination: &DestinationDirectory{
+							Path: "/mount/redacted-prod-eu2",
+							ACLs: botfs.ACLOff,
+						},
+						KubernetesCluster: "redacted-prod-eu2",
+					},
+					&KubernetesOutput{
+						Destination: &DestinationDirectory{
+							Path: "/mount/redacted-prod-ca",
+							ACLs: botfs.ACLOff,
+						},
+						KubernetesCluster: "redacted-prod-ca",
+					},
+					&KubernetesOutput{
+						Destination: &DestinationDirectory{
+							Path: "/mount/redacted-prod-us",
+							ACLs: botfs.ACLOff,
+						},
+						KubernetesCluster: "redacted-prod-us",
+					},
+				},
+			},
+		},
+		{
+			name: "real world 6",
+			// up to 10 roles/destinations depending on the environment
+			input: `
+auth_server: "redacted.teleport.sh:443"
+onboarding:
+  join_method: "token"
+  token: "redacted"
+
+storage:
+  directory: "/var/lib/teleport/tbot"
+
+destinations:
+  - directory:
+      acls: required
+      path: /path/to/role1_creds
+    roles:
+    - role1
+  - directory:
+      acls: required
+      path: /path/to/role2_creds
+    roles:
+    - role2
+  - directory:
+      acls: required
+      path: /path/to/roleN_creds
+    roles:
+    - roleN
+`,
+			wantOutput: &BotConfig{
+				Version:    V2,
+				AuthServer: "redacted.teleport.sh:443",
+				Onboarding: OnboardingConfig{
+					TokenValue: "redacted",
+					JoinMethod: types.JoinMethodToken,
+				},
+				Storage: &StorageConfig{
+					Destination: &DestinationDirectory{
+						Path: "/var/lib/teleport/tbot",
+					},
+				},
+				Outputs: Outputs{
+					&IdentityOutput{
+						Destination: &DestinationDirectory{
+							Path: "/path/to/role1_creds",
+							ACLs: botfs.ACLRequired,
+						},
+						Roles: []string{"role1"},
+					},
+					&IdentityOutput{
+						Destination: &DestinationDirectory{
+							Path: "/path/to/role2_creds",
+							ACLs: botfs.ACLRequired,
+						},
+						Roles: []string{"role2"},
+					},
+					&IdentityOutput{
+						Destination: &DestinationDirectory{
+							Path: "/path/to/roleN_creds",
+							ACLs: botfs.ACLRequired,
+						},
+						Roles: []string{"roleN"},
+					},
+				},
+			},
+		},
+		// Error cases
+		{
+			name:      "storage config with no destination",
+			input:     `storage: {}`,
+			wantError: "at least one of `memory' and 'directory' must be specified",
+		},
+		{
+			name: "storage config with absurd destination",
+			input: `
+storage:
+  memory: true
+  directory:
+    path: /opt/machine-id`,
+			wantError: "both 'memory' and 'directory' cannot be specified",
+		},
+		{
+			name: "destination with duplicate config types",
+			input: `
+destinations:
+- memory: true
+  configs:
+  - ssh_client
+  - ssh_client: {}`,
+			wantError: `multiple config template entries found for "ssh_client"`,
+		},
+		{
+			name: "destination with unsupported config type",
+			input: `
+destinations:
+- memory: true
+  app: my-app
+  configs:
+  - kubernetes`,
+			wantError: `config template "kubernetes" unsupported by new output type`,
+		},
+		{
+			name: "destination with empty config type",
+			input: `
+destinations:
+- memory: true
+  configs:
+  - {}`,
+			wantError: `config template must not be empty`,
+		},
+		{
+			name: "destination with indeterminate type",
+			input: `
+destinations:
+- memory: true
+  app: my-app
+  kubernetes_cluster: my-cluster
+`,
+			wantError: `multiple potential output types detected, cannot determine correct type`,
+		},
+		{
+			name: "v2 config without version field",
+			input: `
+outputs:
+  - type: identity
+    destination:
+      type: memory
+  - type: identity
+    destination:
+      type: memory
+`,
+			wantError: "config has been detected as potentially v1, but includes the v2 outputs field",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := bytes.NewReader([]byte(tt.input))
+			out, err := ReadConfig(r, true)
+			if tt.wantError != "" {
+				require.ErrorContains(t, err, tt.wantError)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tt.wantOutput, out)
+
+		})
+	}
+}
diff --git a/lib/tbot/config/output.go b/lib/tbot/config/output.go
new file mode 100644
index 0000000000000..d770e42f9bbac
--- /dev/null
+++ b/lib/tbot/config/output.go
@@ -0,0 +1,118 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+)
+
+// Output is an interface that represents configurable Outputs for a bot.
+// These outputs are the core unit of generating artifacts in tbot and are the
+// element users configure to control what is output.
+type Output interface {
+	// GetDestination returns the bot.Destination that the Output writing to.
+	//
+	// This can be useful for extracting content that has been written in
+	// tests or as part of the `tbot init` command.
+	GetDestination() bot.Destination
+	// CheckAndSetDefaults validates the configuration and sets any defaults.
+	//
+	// This must be called before other methods on Output can be called as the
+	// implementations may depend on the default values.
+	CheckAndSetDefaults() error
+	// GetRoles returns the roles configured for that Output so that the
+	// tbot.Bot the Output belongs to knows what impersonated identity to pass
+	// to Render.
+	//
+	// This will eventually be removed as we move more logic into the Outputs.
+	GetRoles() []string
+	// Render executes the Output with the given identity and provider, causing
+	// the Output to write to the configured bot.Destination.
+	Render(context.Context, provider, *identity.Identity) error
+	// Init instructs the Output to initialize its underlying bot.Destination.
+	// Typical Init activities include creating any necessary folders or
+	// initializing in-memory maps.
+	//
+	// This must be called before Render.
+	Init() error
+	// MarshalYAML enables the yaml package to correctly marshal the Output as
+	// YAML.
+	MarshalYAML() (interface{}, error)
+	// Describe returns a list of all files that will be created by an Output,
+	// this enables commands like `tbot init` to pre-create and configure these
+	// files with the correct permissions
+	Describe() []FileDescription
+}
+
+// ListSubdirectories lists all subdirectories that will be used by the given
+// templates. Primarily used for on-the-fly directory creation.
+func listSubdirectories(templates []template) ([]string, error) {
+	// Note: currently no standard identity.Artifacts create subdirs. If that
+	// ever changes, we'll need to adapt this to ensure we initialize them
+	// properly on the fly.
+	var subDirs []string
+
+	for _, t := range templates {
+		for _, file := range t.describe() {
+			if file.IsDir {
+				subDirs = append(subDirs, file.Name)
+			}
+		}
+	}
+
+	return subDirs, nil
+}
+
+// extractOutputDestination performs surgery on yaml.Node to unmarshal a
+// destination and then remove key/values from the yaml.Node that specify
+// the destination. This *hack* allows us to have the bot.Destination as a
+// field directly on an Output without needing a struct to wrap it for
+// polymorphic unmarshaling.
+//
+// If there's no destination in the provided yaml node, then this will return
+// nil, nil.
+func extractOutputDestination(node *yaml.Node) (bot.Destination, error) {
+	for i, subNode := range node.Content {
+		if subNode.Value == "destination" {
+			// Next node will be the contents
+			dest, err := unmarshalDestination(node.Content[i+1])
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			// Remove key and contents from root node
+			node.Content = append(node.Content[:i], node.Content[i+2:]...)
+			return dest, nil
+		}
+	}
+	return nil, nil
+}
+
+func validateOutputDestination(dest bot.Destination) error {
+	if dest == nil {
+		return trace.BadParameter("no destination configured for output")
+	}
+	if err := dest.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating configured destination")
+	}
+	return nil
+}
diff --git a/lib/tbot/config/output_application.go b/lib/tbot/config/output_application.go
new file mode 100644
index 0000000000000..de276901fd4e8
--- /dev/null
+++ b/lib/tbot/config/output_application.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+)
+
+const ApplicationOutputType = "application"
+
+type ApplicationOutput struct {
+	// Destination is where the credentials should be written to.
+	Destination bot.Destination `yaml:"destination"`
+	// Roles is the list of roles to request for the generated credentials.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+
+	AppName string `yaml:"app_name"`
+
+	// SpecificTLSExtensions creates additional outputs named `tls.crt`,
+	// `tls.key` and `tls.cas`. This is unneeded for most clients which can
+	// be configured with specific paths to use, but exists for compatibility.
+	SpecificTLSExtensions bool `yaml:"specific_tls_naming"`
+}
+
+func (o *ApplicationOutput) templates() []template {
+	templates := []template{
+		&templateTLSCAs{},
+		&templateIdentity{},
+	}
+	if o.SpecificTLSExtensions {
+		templates = append(templates, &templateTLS{
+			caCertType: types.HostCA,
+		})
+	}
+	return templates
+}
+
+func (o *ApplicationOutput) Render(ctx context.Context, p provider, ident *identity.Identity) error {
+	if err := identity.SaveIdentity(ident, o.Destination, identity.DestinationKinds()...); err != nil {
+		return trace.Wrap(err, "persisting identity")
+	}
+
+	for _, t := range o.templates() {
+		if err := t.render(ctx, p, ident, o.Destination); err != nil {
+			return trace.Wrap(err, "rendering template %s", t.name())
+		}
+	}
+
+	return nil
+}
+
+func (o *ApplicationOutput) Init() error {
+	subDirs, err := listSubdirectories(o.templates())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(o.Destination.Init(subDirs))
+}
+
+func (o *ApplicationOutput) CheckAndSetDefaults() error {
+	if err := validateOutputDestination(o.Destination); err != nil {
+		return trace.Wrap(err)
+	}
+	if o.AppName == "" {
+		return trace.BadParameter("app_name must not be empty")
+	}
+
+	return nil
+}
+
+func (o *ApplicationOutput) GetDestination() bot.Destination {
+	return o.Destination
+}
+
+func (o *ApplicationOutput) GetRoles() []string {
+	return o.Roles
+}
+
+func (o *ApplicationOutput) Describe() []FileDescription {
+	var fds []FileDescription
+	for _, t := range o.templates() {
+		fds = append(fds, t.describe()...)
+	}
+
+	return fds
+}
+
+func (o ApplicationOutput) MarshalYAML() (interface{}, error) {
+	type raw ApplicationOutput
+	return withTypeHeader(raw(o), ApplicationOutputType)
+}
+
+func (o *ApplicationOutput) UnmarshalYAML(node *yaml.Node) error {
+	dest, err := extractOutputDestination(node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid recursion
+	type raw ApplicationOutput
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *ApplicationOutput) String() string {
+	return fmt.Sprintf("%s (%s)", ApplicationOutputType, o.GetDestination())
+}
diff --git a/lib/tbot/config/output_application_test.go b/lib/tbot/config/output_application_test.go
new file mode 100644
index 0000000000000..87fdc69a572b6
--- /dev/null
+++ b/lib/tbot/config/output_application_test.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"testing"
+)
+
+func TestApplicationOutput_YAML(t *testing.T) {
+	dest := &DestinationMemory{}
+	tests := []testYAMLCase[ApplicationOutput]{
+		{
+			name: "full",
+			in: ApplicationOutput{
+				Destination: dest,
+				Roles:       []string{"access"},
+				AppName:     "my-app",
+			},
+		},
+		{
+			name: "minimal",
+			in: ApplicationOutput{
+				Destination: dest,
+				AppName:     "my-app",
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestApplicationOutput_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*ApplicationOutput]{
+		{
+			name: "valid",
+			in: func() *ApplicationOutput {
+				return &ApplicationOutput{
+					Destination: memoryDestForTest(),
+					Roles:       []string{"access"},
+					AppName:     "app",
+				}
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *ApplicationOutput {
+				return &ApplicationOutput{
+					Destination: nil,
+					AppName:     "app",
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "missing app_name",
+			in: func() *ApplicationOutput {
+				return &ApplicationOutput{
+					Destination: memoryDestForTest(),
+				}
+			},
+			wantErr: "app_name must not be empty",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/config/output_database.go b/lib/tbot/config/output_database.go
new file mode 100644
index 0000000000000..6b5607e4d8748
--- /dev/null
+++ b/lib/tbot/config/output_database.go
@@ -0,0 +1,184 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/exp/slices"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+)
+
+const DatabaseOutputType = "database"
+
+// DatabaseFormat specifies if any special behavior should be invoked when
+// producing artifacts. This allows for databases/clients that require unique
+// formats or paths to be used.
+type DatabaseFormat string
+
+const (
+	// UnspecifiedDatabaseFormat is the unset value and the default. This
+	// should work for most databases.
+	UnspecifiedDatabaseFormat DatabaseFormat = ""
+	// TLSDatabaseFormat is for databases that require specifically named
+	// outputs: tls.key, tls.crt and tls.cas
+	TLSDatabaseFormat DatabaseFormat = "tls"
+	// MongoDatabaseFormat indicates credentials should be generated which
+	// are compatible with MongoDB.
+	// This outputs `mongo.crt` and `mongo.cas`.
+	MongoDatabaseFormat DatabaseFormat = "mongo"
+	// CockroachDatabaseFormat indicates credentials should be generated which
+	// are compatible with CockroachDB.
+	// This outputs `cockroach/node.key`, `cockroach/node.crt` and
+	// `cockroach/ca.crt`.
+	CockroachDatabaseFormat DatabaseFormat = "cockroach"
+)
+
+var databaseFormats = []DatabaseFormat{
+	UnspecifiedDatabaseFormat,
+	TLSDatabaseFormat,
+	MongoDatabaseFormat,
+	CockroachDatabaseFormat,
+}
+
+// DatabaseOutput produces credentials which can be used to connect to a
+// database through teleport.
+type DatabaseOutput struct {
+	// Destination is where the credentials should be written to.
+	Destination bot.Destination `yaml:"destination"`
+	// Roles is the list of roles to request for the generated credentials.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+
+	// Formats specifies if any special behavior should be invoked when
+	// producing artifacts. An empty value is supported by most database,
+	// but CockroachDB and MongoDB require this value to be set to
+	// `mongo` and `cockroach` respectively.
+	Format DatabaseFormat `yaml:"format,omitempty"`
+	// Service is the service name of the Teleport database. Generally this is
+	// the name of the Teleport resource. This field is required for all types
+	// of database.
+	Service string `yaml:"service"`
+	// Database is the name of the database to request access to.
+	Database string `yaml:"database,omitempty"`
+	// Username is the database username to request access as.
+	Username string `yaml:"username,omitempty"`
+}
+
+func (o *DatabaseOutput) templates() []template {
+	templates := []template{
+		&templateTLSCAs{},
+		&templateIdentity{},
+	}
+	if o.Format == MongoDatabaseFormat {
+		templates = append(templates, &templateMongo{})
+	}
+	if o.Format == CockroachDatabaseFormat {
+		templates = append(templates, &templateCockroach{})
+	}
+	if o.Format == TLSDatabaseFormat {
+		templates = append(templates, &templateTLS{
+			caCertType: types.HostCA,
+		})
+	}
+	return templates
+}
+
+func (o *DatabaseOutput) Render(ctx context.Context, p provider, ident *identity.Identity) error {
+	if err := identity.SaveIdentity(ident, o.Destination, identity.DestinationKinds()...); err != nil {
+		return trace.Wrap(err, "persisting identity")
+	}
+
+	for _, t := range o.templates() {
+		if err := t.render(ctx, p, ident, o.Destination); err != nil {
+			return trace.Wrap(err, "rendering template %s", t.name())
+		}
+	}
+
+	return nil
+}
+
+func (o *DatabaseOutput) Init() error {
+	subDirs, err := listSubdirectories(o.templates())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(o.Destination.Init(subDirs))
+}
+
+func (o *DatabaseOutput) CheckAndSetDefaults() error {
+	if err := validateOutputDestination(o.Destination); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if o.Service == "" {
+		return trace.BadParameter("service must not be empty")
+	}
+
+	if !slices.Contains(databaseFormats, o.Format) {
+		return trace.BadParameter("unrecognized format (%s)", o.Format)
+	}
+
+	return nil
+}
+
+func (o *DatabaseOutput) GetDestination() bot.Destination {
+	return o.Destination
+}
+
+func (o *DatabaseOutput) GetRoles() []string {
+	return o.Roles
+}
+
+func (o *DatabaseOutput) Describe() []FileDescription {
+	var fds []FileDescription
+	for _, t := range o.templates() {
+		fds = append(fds, t.describe()...)
+	}
+
+	return fds
+}
+
+func (o DatabaseOutput) MarshalYAML() (interface{}, error) {
+	type raw DatabaseOutput
+	return withTypeHeader(raw(o), DatabaseOutputType)
+}
+
+func (o *DatabaseOutput) UnmarshalYAML(node *yaml.Node) error {
+	dest, err := extractOutputDestination(node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid recursion
+	type raw DatabaseOutput
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *DatabaseOutput) String() string {
+	return fmt.Sprintf("%s (%s)", DatabaseOutputType, o.GetDestination())
+}
diff --git a/lib/tbot/config/output_database_test.go b/lib/tbot/config/output_database_test.go
new file mode 100644
index 0000000000000..b77c9a8809add
--- /dev/null
+++ b/lib/tbot/config/output_database_test.go
@@ -0,0 +1,92 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import "testing"
+
+func TestDatabaseOutput_YAML(t *testing.T) {
+	dest := &DestinationMemory{}
+	tests := []testYAMLCase[DatabaseOutput]{
+		{
+			name: "full",
+			in: DatabaseOutput{
+				Destination: dest,
+				Roles:       []string{"access"},
+				Format:      TLSDatabaseFormat,
+				Service:     "my-database-service",
+				Database:    "my-database",
+				Username:    "my-username",
+			},
+		},
+		{
+			name: "minimal",
+			in: DatabaseOutput{
+				Destination: dest,
+				Service:     "my-database-service",
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestDatabaseOutput_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*DatabaseOutput]{
+		{
+			name: "valid",
+			in: func() *DatabaseOutput {
+				return &DatabaseOutput{
+					Destination: memoryDestForTest(),
+					Roles:       []string{"access"},
+					Database:    "db",
+					Service:     "service",
+					Username:    "username",
+				}
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *DatabaseOutput {
+				return &DatabaseOutput{
+					Destination: nil,
+					Service:     "service",
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "missing service",
+			in: func() *DatabaseOutput {
+				return &DatabaseOutput{
+					Destination: memoryDestForTest(),
+				}
+			},
+			wantErr: "service must not be empty",
+		},
+		{
+			name: "invalid format",
+			in: func() *DatabaseOutput {
+				return &DatabaseOutput{
+					Destination: memoryDestForTest(),
+					Service:     "service",
+					Format:      "no-such-format",
+				}
+			},
+			wantErr: "unrecognized format (no-such-format)",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/config/output_identity.go b/lib/tbot/config/output_identity.go
new file mode 100644
index 0000000000000..f19d027a5e2db
--- /dev/null
+++ b/lib/tbot/config/output_identity.go
@@ -0,0 +1,151 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/config/openssh"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+)
+
+const IdentityOutputType = "identity"
+
+// IdentityOutput produces credentials which can be used with `tsh`, `tctl`,
+// `openssh` and most SSH compatible tooling. It can also be used with the
+// Teleport API and things which use the API client (e.g the terraform provider)
+//
+// It cannot be used to connect to Applications, Databases or Kubernetes
+// Clusters.
+type IdentityOutput struct {
+	// Destination is where the credentials should be written to.
+	Destination bot.Destination `yaml:"destination"`
+	// Roles is the list of roles to request for the generated credentials.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+
+	// Cluster allows certificates to be generated for a leaf cluster of the
+	// cluster that the bot is connected to. These certificates can be used
+	// to directly connect to a Teleport proxy of that leaf cluster, or used
+	// with the root cluster's proxy which will forward the request to the
+	// leaf cluster.
+	// For now, only SSH is supported.
+	Cluster string `yaml:"cluster,omitempty"`
+
+	destPath string
+}
+
+func (o *IdentityOutput) templates() []template {
+	return []template{
+		&templateTLSCAs{},
+		&templateSSHClient{
+			getSSHVersion:        openssh.GetSystemSSHVersion,
+			executablePathGetter: os.Executable,
+			destPath:             o.destPath,
+		},
+		&templateIdentity{},
+	}
+}
+
+func (o *IdentityOutput) Render(ctx context.Context, p provider, ident *identity.Identity) error {
+	dest := o.GetDestination()
+	if err := identity.SaveIdentity(ident, dest, identity.DestinationKinds()...); err != nil {
+		return trace.Wrap(err, "persisting identity")
+	}
+
+	for _, t := range o.templates() {
+		if err := t.render(ctx, p, ident, dest); err != nil {
+			return trace.Wrap(err, "rendering template %s", t.name())
+		}
+	}
+
+	return nil
+}
+
+func (o *IdentityOutput) Init() error {
+	subDirs, err := listSubdirectories(o.templates())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(o.Destination.Init(subDirs))
+}
+
+func (o *IdentityOutput) GetDestination() bot.Destination {
+	return o.Destination
+}
+
+func (o *IdentityOutput) GetRoles() []string {
+	return o.Roles
+}
+
+func (o *IdentityOutput) CheckAndSetDefaults() error {
+	if err := validateOutputDestination(o.Destination); err != nil {
+		return trace.Wrap(err)
+	}
+	dest, ok := o.Destination.(*DestinationDirectory)
+	if ok {
+		o.destPath = dest.Path
+	} else {
+		// If destDir is unset, we're not using a filesystem destination and
+		// ssh_config will not be sensible. Log a note and bail early without
+		// writing ssh_config. (Future users of k8s secrets will need to bring
+		// their own config, we can't predict where paths will be in practice.)
+		log.Infof("Note: no ssh_config will be written for non-filesystem "+
+			"destination %q.", o.Destination)
+	}
+
+	return nil
+}
+
+func (o *IdentityOutput) Describe() []FileDescription {
+	var fds []FileDescription
+	for _, t := range o.templates() {
+		fds = append(fds, t.describe()...)
+	}
+
+	return fds
+}
+
+func (o IdentityOutput) MarshalYAML() (interface{}, error) {
+	type raw IdentityOutput
+	return withTypeHeader(raw(o), IdentityOutputType)
+}
+
+func (o *IdentityOutput) UnmarshalYAML(node *yaml.Node) error {
+	dest, err := extractOutputDestination(node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid recursion
+	type raw IdentityOutput
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *IdentityOutput) String() string {
+	return fmt.Sprintf("%s (%s)", IdentityOutputType, o.GetDestination())
+}
diff --git a/lib/tbot/config/output_identity_test.go b/lib/tbot/config/output_identity_test.go
new file mode 100644
index 0000000000000..f2d310af4eca4
--- /dev/null
+++ b/lib/tbot/config/output_identity_test.go
@@ -0,0 +1,66 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"testing"
+)
+
+func TestIdentityOutput_YAML(t *testing.T) {
+	dest := &DestinationMemory{}
+	tests := []testYAMLCase[IdentityOutput]{
+		{
+			name: "full",
+			in: IdentityOutput{
+				Destination: dest,
+				Roles:       []string{"access"},
+				Cluster:     "leaf.example.com",
+			},
+		},
+		{
+			name: "minimal",
+			in: IdentityOutput{
+				Destination: dest,
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestIdentityOutput_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*IdentityOutput]{
+		{
+			name: "valid",
+			in: func() *IdentityOutput {
+				return &IdentityOutput{
+					Destination: memoryDestForTest(),
+					Roles:       []string{"access"},
+				}
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *IdentityOutput {
+				return &IdentityOutput{
+					Destination: nil,
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/config/output_kubernetes.go b/lib/tbot/config/output_kubernetes.go
new file mode 100644
index 0000000000000..41d77560bfa3b
--- /dev/null
+++ b/lib/tbot/config/output_kubernetes.go
@@ -0,0 +1,131 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+)
+
+const KubernetesOutputType = "kubernetes"
+
+// KubernetesOutput produces credentials which can be used to connect to a
+// Kubernetes Cluster through teleport.
+type KubernetesOutput struct {
+	// Destination is where the credentials should be written to.
+	Destination bot.Destination `yaml:"destination"`
+	// Roles is the list of roles to request for the generated credentials.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+
+	// KubernetesCluster is the name of the Kubernetes cluster in Teleport.
+	// This is named a little more verbosely to avoid conflicting with the
+	// name of the Teleport cluster to use.
+	KubernetesCluster string `yaml:"kubernetes_cluster"`
+}
+
+func (o *KubernetesOutput) templates() []template {
+	return []template{
+		&templateTLSCAs{},
+		&templateIdentity{},
+		&templateKubernetes{
+			clusterName:          o.KubernetesCluster,
+			executablePathGetter: os.Executable,
+		},
+	}
+}
+
+func (o *KubernetesOutput) Render(ctx context.Context, p provider, ident *identity.Identity) error {
+	dest := o.GetDestination()
+	if err := identity.SaveIdentity(ident, dest, identity.DestinationKinds()...); err != nil {
+		return trace.Wrap(err, "persisting identity")
+	}
+
+	for _, t := range o.templates() {
+		if err := t.render(ctx, p, ident, dest); err != nil {
+			return trace.Wrap(err, "rendering template %s", t.name())
+		}
+	}
+
+	return nil
+}
+
+func (o *KubernetesOutput) Init() error {
+	subDirs, err := listSubdirectories(o.templates())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(o.Destination.Init(subDirs))
+}
+
+func (o *KubernetesOutput) CheckAndSetDefaults() error {
+	if err := validateOutputDestination(o.Destination); err != nil {
+		return trace.Wrap(err)
+	}
+	if o.KubernetesCluster == "" {
+		return trace.BadParameter("kubernetes_cluster must not be empty")
+	}
+	return nil
+}
+
+func (o *KubernetesOutput) GetDestination() bot.Destination {
+	return o.Destination
+}
+
+func (o *KubernetesOutput) GetRoles() []string {
+	return o.Roles
+}
+
+func (o *KubernetesOutput) Describe() []FileDescription {
+	var fds []FileDescription
+	for _, t := range o.templates() {
+		fds = append(fds, t.describe()...)
+	}
+
+	return fds
+}
+
+func (o KubernetesOutput) MarshalYAML() (interface{}, error) {
+	type raw KubernetesOutput
+	return withTypeHeader(raw(o), KubernetesOutputType)
+}
+
+func (o *KubernetesOutput) UnmarshalYAML(node *yaml.Node) error {
+	dest, err := extractOutputDestination(node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid recursion
+	type raw KubernetesOutput
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *KubernetesOutput) String() string {
+	return fmt.Sprintf("%s (%s)", KubernetesOutputType, o.GetDestination())
+}
diff --git a/lib/tbot/config/output_kubernetes_test.go b/lib/tbot/config/output_kubernetes_test.go
new file mode 100644
index 0000000000000..45631004a1132
--- /dev/null
+++ b/lib/tbot/config/output_kubernetes_test.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import "testing"
+
+func TestKubernetesOutput_YAML(t *testing.T) {
+	dest := &DestinationMemory{}
+	tests := []testYAMLCase[KubernetesOutput]{
+		{
+			name: "full",
+			in: KubernetesOutput{
+				Destination:       dest,
+				Roles:             []string{"access"},
+				KubernetesCluster: "k8s.example.com",
+			},
+		},
+		{
+			name: "minimal",
+			in: KubernetesOutput{
+				Destination:       dest,
+				KubernetesCluster: "k8s.example.com",
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestKubernetesOutput_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*KubernetesOutput]{
+		{
+			name: "valid",
+			in: func() *KubernetesOutput {
+				return &KubernetesOutput{
+					Destination:       memoryDestForTest(),
+					Roles:             []string{"access"},
+					KubernetesCluster: "my-cluster",
+				}
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *KubernetesOutput {
+				return &KubernetesOutput{
+					Destination:       nil,
+					KubernetesCluster: "my-cluster",
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "missing kubernetes_config",
+			in: func() *KubernetesOutput {
+				return &KubernetesOutput{
+					Destination: memoryDestForTest(),
+				}
+			},
+			wantErr: "kubernetes_cluster must not be empty",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/config/output_ssh_host.go b/lib/tbot/config/output_ssh_host.go
new file mode 100644
index 0000000000000..c3758a90ad1f4
--- /dev/null
+++ b/lib/tbot/config/output_ssh_host.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+)
+
+const SSHHostOutputType = "ssh_host"
+
+// SSHHostOutput generates a host certificate signed by the Teleport CA. This
+// can be used to allow OpenSSH server to be trusted by Teleport SSH clients.
+type SSHHostOutput struct {
+	// Destination is where the credentials should be written to.
+	Destination bot.Destination `yaml:"destination"`
+	// Roles is the list of roles to request for the generated credentials.
+	// If empty, it defaults to all the bot's roles.
+	Roles []string `yaml:"roles,omitempty"`
+
+	// Principals is a list of principals to request for the host cert.
+	Principals []string `yaml:"principals"`
+}
+
+func (o *SSHHostOutput) templates() []template {
+	return []template{
+		&templateSSHHostCert{
+			principals: o.Principals,
+		},
+	}
+}
+
+func (o *SSHHostOutput) Render(ctx context.Context, p provider, ident *identity.Identity) error {
+	for _, t := range o.templates() {
+		if err := t.render(ctx, p, ident, o.Destination); err != nil {
+			return trace.Wrap(err, "rendering template %s", t.name())
+		}
+	}
+
+	return nil
+}
+
+func (o *SSHHostOutput) Init() error {
+	subDirs, err := listSubdirectories(o.templates())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return trace.Wrap(o.Destination.Init(subDirs))
+}
+
+func (o *SSHHostOutput) GetDestination() bot.Destination {
+	return o.Destination
+}
+
+func (o *SSHHostOutput) GetRoles() []string {
+	return o.Roles
+}
+
+func (o *SSHHostOutput) CheckAndSetDefaults() error {
+	if err := validateOutputDestination(o.Destination); err != nil {
+		return trace.Wrap(err)
+	}
+	if len(o.Principals) == 0 {
+		return trace.BadParameter("at least one principal must be specified")
+	}
+
+	return nil
+}
+
+func (o *SSHHostOutput) Describe() []FileDescription {
+	var fds []FileDescription
+	for _, t := range o.templates() {
+		fds = append(fds, t.describe()...)
+	}
+
+	return fds
+}
+
+func (o SSHHostOutput) MarshalYAML() (interface{}, error) {
+	type raw SSHHostOutput
+	return withTypeHeader(raw(o), SSHHostOutputType)
+}
+
+func (o *SSHHostOutput) UnmarshalYAML(node *yaml.Node) error {
+	dest, err := extractOutputDestination(node)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	// Alias type to remove UnmarshalYAML to avoid recursion
+	type raw SSHHostOutput
+	if err := node.Decode((*raw)(o)); err != nil {
+		return trace.Wrap(err)
+	}
+	o.Destination = dest
+	return nil
+}
+
+func (o *SSHHostOutput) String() string {
+	return fmt.Sprintf("%s (%s)", SSHHostOutputType, o.GetDestination())
+}
diff --git a/lib/tbot/config/output_ssh_host_test.go b/lib/tbot/config/output_ssh_host_test.go
new file mode 100644
index 0000000000000..666fad5198de7
--- /dev/null
+++ b/lib/tbot/config/output_ssh_host_test.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import "testing"
+
+func TestSSHHostOutput_YAML(t *testing.T) {
+	dest := &DestinationMemory{}
+	tests := []testYAMLCase[SSHHostOutput]{
+		{
+			name: "full",
+			in: SSHHostOutput{
+				Destination: dest,
+				Roles:       []string{"access"},
+				Principals:  []string{"host.example.com"},
+			},
+		},
+		{
+			name: "minimal",
+			in: SSHHostOutput{
+				Destination: dest,
+				Principals:  []string{"host.example.com"},
+			},
+		},
+	}
+	testYAML(t, tests)
+}
+
+func TestSSHHostOutput_CheckAndSetDefaults(t *testing.T) {
+	tests := []testCheckAndSetDefaultsCase[*SSHHostOutput]{
+		{
+			name: "valid",
+			in: func() *SSHHostOutput {
+				return &SSHHostOutput{
+					Destination: memoryDestForTest(),
+					Roles:       []string{"access"},
+					Principals:  []string{"host.example.com"},
+				}
+			},
+		},
+		{
+			name: "missing destination",
+			in: func() *SSHHostOutput {
+				return &SSHHostOutput{
+					Destination: nil,
+					Principals:  []string{"host.example.com"},
+				}
+			},
+			wantErr: "no destination configured for output",
+		},
+		{
+			name: "missing principals",
+			in: func() *SSHHostOutput {
+				return &SSHHostOutput{
+					Destination: memoryDestForTest(),
+				}
+			},
+			wantErr: "at least one principal must be specified",
+		},
+	}
+	testCheckAndSetDefaults(t, tests)
+}
diff --git a/lib/tbot/config/output_test.go b/lib/tbot/config/output_test.go
new file mode 100644
index 0000000000000..430f5aee06bf5
--- /dev/null
+++ b/lib/tbot/config/output_test.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/tbot/bot"
+)
+
+type testCheckAndSetDefaultsCase[T Output] struct {
+	name string
+	in   func() T
+
+	// want specifies the desired state of the Output after check and set
+	// defaults has been run. If want is nil, the Output is compared to its
+	// initial state.
+	want    Output
+	wantErr string
+}
+
+func memoryDestForTest() bot.Destination {
+	return &DestinationMemory{store: map[string][]byte{}}
+}
+
+func testCheckAndSetDefaults[T Output](t *testing.T, tests []testCheckAndSetDefaultsCase[T]) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.in()
+			err := got.CheckAndSetDefaults()
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+
+			want := tt.want
+			if want == nil {
+				want = tt.in()
+			}
+			require.NoError(t, err)
+			require.Equal(t, want, got)
+		})
+	}
+}
diff --git a/lib/tbot/config/configtemplate.go b/lib/tbot/config/template.go
similarity index 51%
rename from lib/tbot/config/configtemplate.go
rename to lib/tbot/config/template.go
index 970d15b0a7031..b74a95a1ce47a 100644
--- a/lib/tbot/config/configtemplate.go
+++ b/lib/tbot/config/template.go
@@ -21,11 +21,8 @@ import (
 	"io/fs"
 	"os"
 	"path"
-	"reflect"
-	"strings"
 
 	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
@@ -65,19 +62,6 @@ const (
 	TemplateSSHHostCertName = "ssh_host_cert"
 )
 
-// AllConfigTemplates lists all valid config templates, intended for help
-// messages
-var AllConfigTemplates = [...]string{
-	TemplateSSHClientName,
-	TemplateIdentityName,
-	TemplateTLSName,
-	TemplateTLSCAsName,
-	TemplateMongoName,
-	TemplateCockroachName,
-	TemplateKubernetesName,
-	TemplateSSHHostCertName,
-}
-
 // FileDescription is a minimal spec needed to create an empty end-user-owned
 // file with bot-writable ACLs during `tbot init`.
 type FileDescription struct {
@@ -85,163 +69,44 @@ type FileDescription struct {
 	Name string
 
 	// IsDir designates whether this describes a subdirectory inside the
-	// destination.
+	// Destination.
 	IsDir bool
 }
 
-// Template defines functions for dynamically writing additional files to
+// template defines functions for dynamically writing additional files to
 // a Destination.
-type Template interface {
+type template interface {
 	// Name returns the name of this config template.
-	Name() string
+	name() string
 
 	// Describe generates a list of all files this ConfigTemplate will generate
 	// at runtime. Currently ConfigTemplates are required to know this
 	// statically as this must be callable without any auth clients (or any
 	// secrets) for use with `tbot init`. If an arbitrary number of files must
 	// be generated, they should be placed in a subdirectory.
-	Describe(destination bot.Destination) []FileDescription
+	describe() []FileDescription
 
-	// Render writes the config template to the destination.
-	Render(
+	// Render writes the config template to the Destination.
+	render(
 		ctx context.Context,
-		bot Bot,
-		routedIdentity, unroutedIdentity *identity.Identity,
-		destination *DestinationConfig,
+		p provider,
+		identity *identity.Identity,
+		destination bot.Destination,
 	) error
 }
 
-// TemplateConfig contains all possible config template variants. Exactly one
-// variant must be set to be considered valid.
-type TemplateConfig struct {
-	SSHClient   *TemplateSSHClient   `yaml:"ssh_client,omitempty"`
-	Identity    *TemplateIdentity    `yaml:"identity,omitempty"`
-	TLS         *TemplateTLS         `yaml:"tls,omitempty"`
-	TLSCAs      *TemplateTLSCAs      `yaml:"tls_cas,omitempty"`
-	Mongo       *TemplateMongo       `yaml:"mongo,omitempty"`
-	Cockroach   *TemplateCockroach   `yaml:"cockroach,omitempty"`
-	Kubernetes  *TemplateKubernetes  `yaml:"kubernetes,omitempty"`
-	SSHHostCert *TemplateSSHHostCert `yaml:"ssh_host_cert,omitempty"`
-}
-
-func (c *TemplateConfig) UnmarshalYAML(node *yaml.Node) error {
-	// Accept either a template name (with no options) or a verbose struct, e.g.
-	//   configs:
-	//     - ssh_client
-	//     - ssh_client:
-	//         proxy_port: 1234
-
-	var simpleTemplate string
-	if err := node.Decode(&simpleTemplate); err == nil {
-		switch simpleTemplate {
-		case TemplateSSHClientName:
-			c.SSHClient = &TemplateSSHClient{}
-		case TemplateIdentityName:
-			c.Identity = &TemplateIdentity{}
-		case TemplateTLSName:
-			c.TLS = &TemplateTLS{}
-		case TemplateTLSCAsName:
-			c.TLSCAs = &TemplateTLSCAs{}
-		case TemplateMongoName:
-			c.Mongo = &TemplateMongo{}
-		case TemplateCockroachName:
-			c.Cockroach = &TemplateCockroach{}
-		case TemplateKubernetesName:
-			c.Kubernetes = &TemplateKubernetes{}
-		case TemplateSSHHostCertName:
-			c.SSHHostCert = &TemplateSSHHostCert{}
-		default:
-			return trace.BadParameter(
-				"invalid config template '%s' on line %d, expected one of: %s",
-				simpleTemplate, node.Line, strings.Join(AllConfigTemplates[:], ", "),
-			)
-		}
-		return nil
-	}
-
-	// Fall back to the full struct; alias it to get standard unmarshal
-	// behavior and avoid recursion
-	type rawTemplate TemplateConfig
-	return trace.Wrap(node.Decode((*rawTemplate)(c)))
-}
-
-func (c *TemplateConfig) CheckAndSetDefaults() error {
-	templates := []interface{ CheckAndSetDefaults() error }{
-		c.SSHClient,
-		c.Identity,
-		c.TLS,
-		c.TLSCAs,
-		c.Mongo,
-		c.Cockroach,
-		c.Kubernetes,
-		c.SSHHostCert,
-	}
-
-	notNilCount := 0
-	for _, template := range templates {
-		// Note: this check is fragile and will fail if the templates aren't
-		// all simple pointer types. They are, though, and the "correct"
-		// solution is insane, so we'll stick with this.
-		if reflect.ValueOf(template).IsNil() {
-			continue
-		}
-
-		if template != nil {
-			if err := template.CheckAndSetDefaults(); err != nil {
-				return trace.Wrap(err)
-			}
-
-			notNilCount++
-		}
-	}
-
-	if notNilCount == 0 {
-		return trace.BadParameter("config template must not be empty")
-	} else if notNilCount > 1 {
-		return trace.BadParameter("config template must have exactly one configuration")
-	}
-
-	return nil
-}
-
-// GetConfigTemplate returns the first not-nil config template implementation
-// in the struct.
-func (c *TemplateConfig) GetConfigTemplate() (Template, error) {
-	templates := []Template{
-		c.SSHClient,
-		c.Identity,
-		c.TLS,
-		c.TLSCAs,
-		c.Mongo,
-		c.Cockroach,
-		c.Kubernetes,
-		c.SSHHostCert,
-	}
-
-	for _, template := range templates {
-		// Note: same caveats as above.
-		if reflect.ValueOf(template).IsNil() {
-			continue
-		}
-
-		return template, nil
-	}
-
-	return nil, trace.BadParameter("no valid config template")
-}
-
 // BotConfigWriter is a trivial adapter to use the identityfile package with
 // bot destinations.
 type BotConfigWriter struct {
-	// dest is the destination that will handle writing of files.
+	// dest is the Destination that will handle writing of files.
 	dest bot.Destination
 
-	// subpath is the subdirectory within the destination to which the files
+	// subpath is the subdirectory within the Destination to which the files
 	// should be written.
 	subpath string
 }
 
-// WriteFile writes the file to the destination. Only the basename of the path
+// WriteFile writes the file to the Destination. Only the basename of the path
 // is used. Specified permissions are ignored.
 func (b *BotConfigWriter) WriteFile(name string, data []byte, _ os.FileMode) error {
 	p := path.Base(name)
@@ -285,3 +150,7 @@ func newClientKey(ident *identity.Identity, hostCAs []types.CertAuthority) (*cli
 		DBTLSCerts:   make(map[string][]byte),
 	}, nil
 }
+
+// executablePathGetter is a function that returns the path of the current
+// executable.
+type executablePathGetter = func() (string, error)
diff --git a/lib/tbot/config/configtemplate_cockroach.go b/lib/tbot/config/template_cockroach.go
similarity index 69%
rename from lib/tbot/config/configtemplate_cockroach.go
rename to lib/tbot/config/template_cockroach.go
index 3fadb73bd379d..d7bf9cd1a5a0b 100644
--- a/lib/tbot/config/configtemplate_cockroach.go
+++ b/lib/tbot/config/template_cockroach.go
@@ -29,60 +29,45 @@ import (
 
 const defaultCockroachDirName = "cockroach"
 
-// TemplateCockroach generates certificates for CockroachDB. These are standard
+// templateCockroach generates certificates for CockroachDB. These are standard
 // TLS certs but have specific naming requirements. We write them to a
 // subdirectory to ensure naming is clear.
-type TemplateCockroach struct {
-	DirName string `yaml:"dir_name,omitempty"`
-}
-
-func (t *TemplateCockroach) CheckAndSetDefaults() error {
-	if t.DirName == "" {
-		t.DirName = defaultCockroachDirName
-	}
-
-	return nil
-}
+type templateCockroach struct{}
 
-func (t *TemplateCockroach) Name() string {
+func (t *templateCockroach) name() string {
 	return TemplateCockroachName
 }
 
-func (t *TemplateCockroach) Describe(destination bot.Destination) []FileDescription {
+func (t *templateCockroach) describe() []FileDescription {
 	return []FileDescription{
 		{
-			Name:  t.DirName,
+			Name:  defaultCockroachDirName,
 			IsDir: true,
 		},
 	}
 }
 
-func (t *TemplateCockroach) Render(
+func (t *templateCockroach) render(
 	ctx context.Context,
-	bot Bot,
-	currentIdentity, _ *identity.Identity,
-	destination *DestinationConfig,
+	bot provider,
+	identity *identity.Identity,
+	destination bot.Destination,
 ) error {
-	dest, err := destination.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
 	dbCAs, err := bot.GetCertAuthorities(ctx, types.DatabaseCA)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	key, err := newClientKey(currentIdentity, dbCAs)
+	key, err := newClientKey(identity, dbCAs)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	cfg := identityfile.WriteConfig{
-		OutputPath: t.DirName,
+		OutputPath: defaultCockroachDirName,
 		Writer: &BotConfigWriter{
-			dest:    dest,
-			subpath: t.DirName,
+			dest:    destination,
+			subpath: defaultCockroachDirName,
 		},
 		Key:    key,
 		Format: identityfile.FormatCockroach,
diff --git a/lib/tbot/config/configtemplate_identity.go b/lib/tbot/config/template_identity.go
similarity index 66%
rename from lib/tbot/config/configtemplate_identity.go
rename to lib/tbot/config/template_identity.go
index b31c5358549c9..18128c06b403b 100644
--- a/lib/tbot/config/configtemplate_identity.go
+++ b/lib/tbot/config/template_identity.go
@@ -27,59 +27,44 @@ import (
 	"github.com/gravitational/teleport/lib/tbot/identity"
 )
 
-const defaultIdentityFileName = "identity"
+const IdentityFilePath = "identity"
 
-// TemplateIdentity is a config template that generates a Teleport identity
+// templateIdentity is a config template that generates a Teleport identity
 // file that can be used by tsh and tctl.
-type TemplateIdentity struct {
-	FileName string `yaml:"file_name,omitempty"`
-}
-
-func (t *TemplateIdentity) CheckAndSetDefaults() error {
-	if t.FileName == "" {
-		t.FileName = defaultIdentityFileName
-	}
-
-	return nil
-}
+type templateIdentity struct{}
 
-func (t *TemplateIdentity) Name() string {
+func (t *templateIdentity) name() string {
 	return TemplateIdentityName
 }
 
-func (t *TemplateIdentity) Describe(destination bot.Destination) []FileDescription {
+func (t *templateIdentity) describe() []FileDescription {
 	return []FileDescription{
 		{
-			Name: t.FileName,
+			Name: IdentityFilePath,
 		},
 	}
 }
 
-func (t *TemplateIdentity) Render(
+func (t *templateIdentity) render(
 	ctx context.Context,
-	bot Bot,
-	routedIdentity, _ *identity.Identity,
-	destination *DestinationConfig,
+	bot provider,
+	identity *identity.Identity,
+	destination bot.Destination,
 ) error {
-	dest, err := destination.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
 	hostCAs, err := bot.GetCertAuthorities(ctx, types.HostCA)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	key, err := newClientKey(routedIdentity, hostCAs)
+	key, err := newClientKey(identity, hostCAs)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	cfg := identityfile.WriteConfig{
-		OutputPath: t.FileName,
+		OutputPath: IdentityFilePath,
 		Writer: &BotConfigWriter{
-			dest: dest,
+			dest: destination,
 		},
 		Key:    key,
 		Format: identityfile.FormatFile,
diff --git a/lib/tbot/config/configtemplate_kubernetes.go b/lib/tbot/config/template_kubernetes.go
similarity index 72%
rename from lib/tbot/config/configtemplate_kubernetes.go
rename to lib/tbot/config/template_kubernetes.go
index f4b6ba76de3a6..dc098e9bfb416 100644
--- a/lib/tbot/config/configtemplate_kubernetes.go
+++ b/lib/tbot/config/template_kubernetes.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"fmt"
 	"net"
-	"os"
 
 	"github.com/gravitational/trace"
 	"k8s.io/client-go/tools/clientcmd"
@@ -41,37 +40,19 @@ import (
 
 const defaultKubeconfigPath = "kubeconfig.yaml"
 
-type TemplateKubernetes struct {
-	Path string `yaml:"path,omitempty"`
-
-	// ClusterAddress may be used to override the k8s cluster address. It's
-	// resolved from Teleport's ping responses if unset.
-	ClusterAddress string `yaml:"cluster_addr,omitempty"`
-
-	getExecutablePath func() (string, error)
-}
-
-func (t *TemplateKubernetes) CheckAndSetDefaults() error {
-	if t.Path == "" {
-		t.Path = defaultKubeconfigPath
-	}
-
-	if t.getExecutablePath == nil {
-		t.getExecutablePath = os.Executable
-	}
-
-	return nil
+type templateKubernetes struct {
+	clusterName          string
+	executablePathGetter executablePathGetter
 }
 
-func (t *TemplateKubernetes) Name() string {
+func (t *templateKubernetes) name() string {
 	return TemplateKubernetesName
 }
 
-func (t *TemplateKubernetes) Describe(destination bot.Destination) []FileDescription {
+func (t *templateKubernetes) describe() []FileDescription {
 	return []FileDescription{
 		{
-			Name:  t.Path,
-			IsDir: false,
+			Name: defaultKubeconfigPath,
 		},
 	}
 }
@@ -108,13 +89,13 @@ func getKubeProxyHostPort(authPong *proto.PingResponse, proxyPong *webclient.Pin
 
 // generateKubeConfig creates a Kubernetes config object with the given cluster
 // config.
-func generateKubeConfig(t *TemplateKubernetes, ks *kubernetesStatus, destPath string) (*clientcmdapi.Config, error) {
+func generateKubeConfig(ks *kubernetesStatus, destPath string, executablePath string) (*clientcmdapi.Config, error) {
 	config := clientcmdapi.NewConfig()
 
 	// Implementation note: tsh/kube.go generates a kubeconfig with all
 	// available clusters. This isn't especially useful in Machine ID when
 	// there's _at most_ one cluster we have permission to access for this
-	// destination's set of certs, so instead of fetching all the k8s clusters
+	// Destination's set of certs, so instead of fetching all the k8s clusters
 	// and adding everything, we'll just stick with the single cluster name in
 	// our config file.
 	// Otherwise, we adapt this from lib/kube/kubeconfig/kubeconfig.go's
@@ -143,14 +124,10 @@ func generateKubeConfig(t *TemplateKubernetes, ks *kubernetesStatus, destPath st
 	execArgs := []string{"kube", "credentials",
 		fmt.Sprintf("--destination-dir=%s", destPath),
 	}
-	binaryPath, err := t.getExecutablePath()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
 	config.AuthInfos[contextName] = &clientcmdapi.AuthInfo{
 		Exec: &clientcmdapi.ExecConfig{
 			APIVersion: "client.authentication.k8s.io/v1beta1",
-			Command:    binaryPath,
+			Command:    executablePath,
 			Args:       execArgs,
 		},
 	}
@@ -165,31 +142,17 @@ func generateKubeConfig(t *TemplateKubernetes, ks *kubernetesStatus, destPath st
 	return config, nil
 }
 
-func (t *TemplateKubernetes) Render(
+func (t *templateKubernetes) render(
 	ctx context.Context,
-	bot Bot,
-	routedIdentity, unroutedIdentity *identity.Identity,
-	destination *DestinationConfig,
+	bot provider,
+	identity *identity.Identity,
+	destination bot.Destination,
 ) error {
-	if destination.KubernetesCluster == nil {
-		dest, err := destination.GetDestination()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		return trace.BadParameter("No Kubernetes cluster was configured for destination %s, cannot generate config", dest)
-	}
-
-	dest, err := destination.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Only destination dirs are supported right now, but we could be flexible
+	// Only Destination dirs are supported right now, but we could be flexible
 	// on this in the future if needed.
-	destinationDir, ok := dest.(*DestinationDirectory)
+	destinationDir, ok := destination.(*DestinationDirectory)
 	if !ok {
-		return trace.BadParameter("destination %s must be a directory", dest)
+		return trace.BadParameter("Destination %s must be a directory", destination)
 	}
 
 	// Ping the auth server and proxy to resolve connection addresses.
@@ -223,18 +186,7 @@ func (t *TemplateKubernetes) Render(
 		return trace.Wrap(err)
 	}
 
-	authClient, err := bot.AuthenticatedUserClientFromIdentity(ctx, unroutedIdentity)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer authClient.Close()
-
-	clusterName, err := authClient.GetDomainName(ctx)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	key, err := newClientKey(routedIdentity, hostCAs)
+	key, err := newClientKey(identity, hostCAs)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -243,15 +195,20 @@ func (t *TemplateKubernetes) Render(
 		clusterAddr:           kubeAddr,
 		proxyAddr:             authPong.ProxyPublicAddr,
 		credentials:           key,
-		teleportClusterName:   clusterName,
-		kubernetesClusterName: destination.KubernetesCluster.ClusterName,
+		teleportClusterName:   authPong.ClusterName,
+		kubernetesClusterName: t.clusterName,
 	}
 
 	if proxyPong.Proxy.TLSRoutingEnabled {
 		status.tlsServerName = serverName
 	}
 
-	cfg, err := generateKubeConfig(t, status, destinationDir.Path)
+	executablePath, err := t.executablePathGetter()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	cfg, err := generateKubeConfig(status, destinationDir.Path, executablePath)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -261,5 +218,5 @@ func (t *TemplateKubernetes) Render(
 		return trace.Wrap(err)
 	}
 
-	return trace.Wrap(dest.Write(t.Path, yamlCfg))
+	return trace.Wrap(destination.Write(defaultKubeconfigPath, yamlCfg))
 }
diff --git a/lib/tbot/config/configtemplate_kubernetes_test.go b/lib/tbot/config/template_kubernetes_test.go
similarity index 65%
rename from lib/tbot/config/configtemplate_kubernetes_test.go
rename to lib/tbot/config/template_kubernetes_test.go
index 7c81af75967e4..f64323c78202a 100644
--- a/lib/tbot/config/configtemplate_kubernetes_test.go
+++ b/lib/tbot/config/template_kubernetes_test.go
@@ -33,40 +33,29 @@ import (
 // to the saved golden result.
 func TestTemplateKubernetesRender(t *testing.T) {
 	dir := t.TempDir()
-	mockAuth := newMockAuth(t)
 
-	cfg, err := NewDefaultConfig("example.com")
+	cfg, err := newTestConfig("example.com")
 	require.NoError(t, err)
 
-	mockBot := newMockBot(cfg, mockAuth)
-	template := TemplateKubernetes{
-		getExecutablePath: func() (string, error) {
-			return "tbot", nil
-		},
+	k8sCluster := "example"
+	mockBot := newMockProvider(cfg)
+	tmpl := templateKubernetes{
+		clusterName:          k8sCluster,
+		executablePathGetter: fakeGetExecutablePath,
 	}
-	require.NoError(t, template.CheckAndSetDefaults())
 
-	k8sCluster := "example"
-	dest := &DestinationConfig{
-		DestinationMixin: DestinationMixin{
-			Directory: &DestinationDirectory{
-				Path:     dir,
-				Symlinks: botfs.SymlinksInsecure,
-				ACLs:     botfs.ACLOff,
-			},
-		},
-		KubernetesCluster: &KubernetesCluster{
-			ClusterName: k8sCluster,
-		},
+	dest := &DestinationDirectory{
+		Path:     dir,
+		Symlinks: botfs.SymlinksInsecure,
+		ACLs:     botfs.ACLOff,
 	}
 
 	ident := getTestIdent(t, "bot-test", kubernetesRequest(k8sCluster))
-	unroutedIdent := getTestIdent(t, "bot-test")
 
-	err = template.Render(context.Background(), mockBot, ident, unroutedIdent, dest)
+	err = tmpl.render(context.Background(), mockBot, ident, dest)
 	require.NoError(t, err)
 
-	kubeconfigBytes, err := os.ReadFile(filepath.Join(dir, template.Path))
+	kubeconfigBytes, err := os.ReadFile(filepath.Join(dir, defaultKubeconfigPath))
 	require.NoError(t, err)
 
 	kubeconfigBytes = bytes.ReplaceAll(kubeconfigBytes, []byte(dir), []byte("/test/dir"))
diff --git a/lib/tbot/config/configtemplate_mongo.go b/lib/tbot/config/template_mongo.go
similarity index 69%
rename from lib/tbot/config/configtemplate_mongo.go
rename to lib/tbot/config/template_mongo.go
index 171cea0825c93..aea22e05f2fdd 100644
--- a/lib/tbot/config/configtemplate_mongo.go
+++ b/lib/tbot/config/template_mongo.go
@@ -30,60 +30,45 @@ import (
 // defaultMongoPrefix is the default prefix in generated MongoDB certs.
 const defaultMongoPrefix = "mongo"
 
-// TemplateMongo is a config template that generates TLS certs formatted for
+// templateMongo is a config template that generates TLS certs formatted for
 // use with MongoDB.
-type TemplateMongo struct {
-	Prefix string `yaml:"prefix,omitempty"`
-}
-
-func (t *TemplateMongo) CheckAndSetDefaults() error {
-	if t.Prefix == "" {
-		t.Prefix = defaultMongoPrefix
-	}
-
-	return nil
-}
+type templateMongo struct{}
 
-func (t *TemplateMongo) Name() string {
+func (t *templateMongo) name() string {
 	return TemplateMongoName
 }
 
-func (t *TemplateMongo) Describe(destination bot.Destination) []FileDescription {
+func (t *templateMongo) describe() []FileDescription {
 	return []FileDescription{
 		{
-			Name: t.Prefix + ".crt",
+			Name: defaultMongoPrefix + ".crt",
 		},
 		{
-			Name: t.Prefix + ".cas",
+			Name: defaultMongoPrefix + ".cas",
 		},
 	}
 }
 
-func (t *TemplateMongo) Render(
+func (t *templateMongo) render(
 	ctx context.Context,
-	bot Bot,
-	currentIdentity, _ *identity.Identity,
-	destination *DestinationConfig,
+	bot provider,
+	identity *identity.Identity,
+	destination bot.Destination,
 ) error {
-	dest, err := destination.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
 	dbCAs, err := bot.GetCertAuthorities(ctx, types.DatabaseCA)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	key, err := newClientKey(currentIdentity, dbCAs)
+	key, err := newClientKey(identity, dbCAs)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	cfg := identityfile.WriteConfig{
-		OutputPath: t.Prefix,
+		OutputPath: defaultMongoPrefix,
 		Writer: &BotConfigWriter{
-			dest: dest,
+			dest: destination,
 		},
 		Key:    key,
 		Format: identityfile.FormatMongo,
diff --git a/lib/tbot/config/configtemplate_ssh_client.go b/lib/tbot/config/template_ssh_client.go
similarity index 52%
rename from lib/tbot/config/configtemplate_ssh_client.go
rename to lib/tbot/config/template_ssh_client.go
index 22bb2bb56b561..603efad1dcd70 100644
--- a/lib/tbot/config/configtemplate_ssh_client.go
+++ b/lib/tbot/config/template_ssh_client.go
@@ -19,10 +19,8 @@ package config
 import (
 	"context"
 	"fmt"
-	"os"
 	"path/filepath"
 	"strings"
-	"sync"
 
 	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/trace"
@@ -36,12 +34,15 @@ import (
 	"github.com/gravitational/teleport/lib/utils"
 )
 
-// TemplateSSHClient contains parameters for the ssh_config config
+// templateSSHClient contains parameters for the ssh_config config
 // template
-type TemplateSSHClient struct {
-	ProxyPort         uint16 `yaml:"proxy_port"`
-	getSSHVersion     func() (*semver.Version, error)
-	getExecutablePath func() (string, error)
+type templateSSHClient struct {
+	getSSHVersion        func() (*semver.Version, error)
+	executablePathGetter executablePathGetter
+	// destPath controls whether or not to write the SSH config file.
+	// This is lets this be skipped on non-directory destinations where this
+	// doesn't make sense.
+	destPath string
 }
 
 const (
@@ -52,53 +53,32 @@ const (
 	knownHostsName = "known_hosts"
 )
 
-func (c *TemplateSSHClient) CheckAndSetDefaults() error {
-	if c.ProxyPort != 0 {
-		log.Warn("ssh_client's proxy_port parameter is deprecated and will be removed in a future release.")
-	}
-	if c.getSSHVersion == nil {
-		c.getSSHVersion = openssh.GetSystemSSHVersion
-	}
-	if c.getExecutablePath == nil {
-		c.getExecutablePath = os.Executable
-	}
-	return nil
-}
-
-func (c *TemplateSSHClient) Name() string {
+func (c *templateSSHClient) name() string {
 	return TemplateSSHClientName
 }
 
-func (c *TemplateSSHClient) Describe(destination bot.Destination) []FileDescription {
-	ret := []FileDescription{
+func (c *templateSSHClient) describe() []FileDescription {
+	fds := []FileDescription{
 		{
-			Name: "known_hosts",
+			Name: knownHostsName,
 		},
 	}
 
-	// Only include ssh_config if we're using a filesystem destination as
-	// otherwise ssh_config will not be sensible.
-	if _, ok := destination.(*DestinationDirectory); ok {
-		ret = append(ret, FileDescription{
-			Name: "ssh_config",
+	if c.destPath != "" {
+		fds = append(fds, FileDescription{
+			Name: sshConfigName,
 		})
 	}
 
-	return ret
+	return fds
 }
 
-// sshConfigUnsupportedWarning is used to ensure we don't spam log messages if
-// using non-filesystem backends.
-var sshConfigUnsupportedWarning sync.Once
+func getClusterNames(
+	bot provider, connectedClusterName string,
+) ([]string, error) {
+	allClusterNames := []string{connectedClusterName}
 
-func getClusterNames(client auth.ClientI) ([]string, error) {
-	cn, err := client.GetClusterName()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	allClusterNames := []string{cn.GetClusterName()}
-
-	leafClusters, err := client.GetRemoteClusters()
+	leafClusters, err := bot.GetRemoteClusters()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -109,58 +89,32 @@ func getClusterNames(client auth.ClientI) ([]string, error) {
 	return allClusterNames, nil
 }
 
-func (c *TemplateSSHClient) Render(
+func (c *templateSSHClient) render(
 	ctx context.Context,
-	bot Bot,
-	_, unroutedIdentity *identity.Identity,
-	destination *DestinationConfig,
+	bot provider,
+	_ *identity.Identity,
+	destination bot.Destination,
 ) error {
-	dest, err := destination.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	authClient, err := bot.AuthenticatedUserClientFromIdentity(ctx, unroutedIdentity)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer authClient.Close()
-
 	ping, err := bot.AuthPing(ctx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	proxyHost, _, err := utils.SplitHostPort(ping.ProxyPublicAddr)
+	proxyHost, proxyPort, err := utils.SplitHostPort(ping.ProxyPublicAddr)
 	if err != nil {
 		return trace.BadParameter("proxy %+v has no usable public address: %v", ping.ProxyPublicAddr, err)
 	}
 
-	clusterNames, err := getClusterNames(authClient)
+	clusterNames, err := getClusterNames(bot, ping.ClusterName)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	// Backend note: Prefer to use absolute paths for filesystem backends.
-	// If the backend is something else, use "". ssh_config will generate with
-	// paths relative to the destination. This doesn't work with ssh in
-	// practice so adjusting the config for impossible-to-determine-in-advance
-	// destination backends is left as an exercise to the user.
-	var destDir string
-	if dir, ok := dest.(*DestinationDirectory); ok {
-		destDir, err = filepath.Abs(dir.Path)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	} else {
-		destDir = ""
-	}
-
-	// We'll write known_hosts regardless of destination type, it's still
+	// We'll write known_hosts regardless of Destination type, it's still
 	// useful alongside a manually-written ssh_config.
 	knownHosts, err := fetchKnownHosts(
 		ctx,
-		authClient,
+		bot,
 		clusterNames,
 		proxyHost,
 	)
@@ -168,31 +122,33 @@ func (c *TemplateSSHClient) Render(
 		return trace.Wrap(err)
 	}
 
-	if err := dest.Write(knownHostsName, []byte(knownHosts)); err != nil {
+	if err := destination.Write(knownHostsName, []byte(knownHosts)); err != nil {
 		return trace.Wrap(err)
 	}
 
-	// If destDir is unset, we're not using a filesystem destination and
-	// ssh_config will not be sensible. Log a note and bail early without
-	// writing ssh_config. (Future users of k8s secrets will need to bring
-	// their own config, we can't predict where paths will be in practice.)
-	if destDir == "" {
-		sshConfigUnsupportedWarning.Do(func() {
-			log.Infof("Note: no ssh_config will be written for non-filesystem "+
-				"destination %s.", dest)
-		})
+	if c.destPath == "" {
 		return nil
 	}
 
-	executablePath, err := c.getExecutablePath()
+	// Backend note: Prefer to use absolute paths for filesystem backends.
+	// If the backend is something else, use "". ssh_config will generate with
+	// paths relative to the Destination. This doesn't work with ssh in
+	// practice so adjusting the config for impossible-to-determine-in-advance
+	// Destination backends is left as an exercise to the user.
+	absDestPath, err := filepath.Abs(c.destPath)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	executablePath, err := c.executablePathGetter()
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	var sshConfigBuilder strings.Builder
-	knownHostsPath := filepath.Join(destDir, knownHostsName)
-	identityFilePath := filepath.Join(destDir, identity.PrivateKeyKey)
-	certificateFilePath := filepath.Join(destDir, identity.SSHCertKey)
+	knownHostsPath := filepath.Join(absDestPath, knownHostsName)
+	identityFilePath := filepath.Join(absDestPath, identity.PrivateKeyKey)
+	certificateFilePath := filepath.Join(absDestPath, identity.SSHCertKey)
 
 	sshConf := openssh.NewSSHConfig(c.getSSHVersion, log)
 	if err := sshConf.GetSSHConfig(&sshConfigBuilder, &openssh.SSHConfigParameters{
@@ -202,23 +158,24 @@ func (c *TemplateSSHClient) Render(
 		IdentityFilePath:    identityFilePath,
 		CertificateFilePath: certificateFilePath,
 		ProxyHost:           proxyHost,
+		ProxyPort:           proxyPort,
 		ExecutablePath:      executablePath,
-		DestinationDir:      destDir,
+		DestinationDir:      absDestPath,
 	}); err != nil {
 		return trace.Wrap(err)
 	}
 
-	if err := dest.Write(sshConfigName, []byte(sshConfigBuilder.String())); err != nil {
+	if err := destination.Write(sshConfigName, []byte(sshConfigBuilder.String())); err != nil {
 		return trace.Wrap(err)
 	}
 
 	return nil
 }
 
-func fetchKnownHosts(ctx context.Context, client auth.ClientI, clusterNames []string, proxyHosts string) (string, error) {
+func fetchKnownHosts(ctx context.Context, bot provider, clusterNames []string, proxyHosts string) (string, error) {
 	certAuthorities := make([]types.CertAuthority, 0, len(clusterNames))
 	for _, cn := range clusterNames {
-		ca, err := client.GetCertAuthority(ctx, types.CertAuthID{
+		ca, err := bot.GetCertAuthority(ctx, types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: cn,
 		}, false)
diff --git a/lib/tbot/config/configtemplate_ssh_client_test.go b/lib/tbot/config/template_ssh_client_test.go
similarity index 80%
rename from lib/tbot/config/configtemplate_ssh_client_test.go
rename to lib/tbot/config/template_ssh_client_test.go
index f650e08dbcd67..f0dd6ab4032f0 100644
--- a/lib/tbot/config/configtemplate_ssh_client_test.go
+++ b/lib/tbot/config/template_ssh_client_test.go
@@ -49,34 +49,28 @@ func TestTemplateSSHClient_Render(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.Name, func(t *testing.T) {
 			dir := t.TempDir()
-			mockAuth := newMockAuth(t)
 
-			cfg, err := NewDefaultConfig("example.com")
+			cfg, err := newTestConfig("example.com")
 			require.NoError(t, err)
 
-			mockBot := newMockBot(cfg, mockAuth)
-			template := TemplateSSHClient{
-				ProxyPort: 1337,
-				getSSHVersion: func() (*semver.Version, error) {
-					return semver.New(tc.Version), nil
-				},
-				getExecutablePath: func() (string, error) {
-					return "/path/to/tbot", nil
-				},
-			}
 			// ident is passed in, but not used.
 			var ident *identity.Identity
-			dest := &DestinationConfig{
-				DestinationMixin: DestinationMixin{
-					Directory: &DestinationDirectory{
-						Path:     dir,
-						Symlinks: botfs.SymlinksInsecure,
-						ACLs:     botfs.ACLOff,
-					},
+			dest := &DestinationDirectory{
+				Path:     dir,
+				Symlinks: botfs.SymlinksInsecure,
+				ACLs:     botfs.ACLOff,
+			}
+
+			mockBot := newMockProvider(cfg)
+			tmpl := templateSSHClient{
+				getSSHVersion: func() (*semver.Version, error) {
+					return semver.New(tc.Version), nil
 				},
+				executablePathGetter: fakeGetExecutablePath,
+				destPath:             dest.Path,
 			}
 
-			err = template.Render(context.Background(), mockBot, ident, ident, dest)
+			err = tmpl.render(context.Background(), mockBot, ident, dest)
 			require.NoError(t, err)
 
 			replaceTestDir := func(b []byte) []byte {
diff --git a/lib/tbot/config/configtemplate_ssh_host_cert.go b/lib/tbot/config/template_ssh_host_cert.go
similarity index 66%
rename from lib/tbot/config/configtemplate_ssh_host_cert.go
rename to lib/tbot/config/template_ssh_host_cert.go
index ec033b45b994a..cf83e44dc3beb 100644
--- a/lib/tbot/config/configtemplate_ssh_host_cert.go
+++ b/lib/tbot/config/template_ssh_host_cert.go
@@ -46,46 +46,29 @@ const (
 	sshHostTrimPrefix = "cert-authority "
 )
 
-// TemplateSSHHostCert contains parameters for the ssh_config config
+// templateSSHHostCert contains parameters for the ssh_config config
 // template
-type TemplateSSHHostCert struct {
-	// Prefix is the filename prefix for the generated SSH host
-	// certificates
-	Prefix string `yaml:"prefix,omitempty"`
-
-	// Principals is a list of principals to request for the host cert.
-	Principals []string `yaml:"principals"`
-}
-
-// CheckAndSetDefaults validates a TemplateSSHHostCert.
-func (c *TemplateSSHHostCert) CheckAndSetDefaults() error {
-	if c.Prefix == "" {
-		c.Prefix = defaultSSHHostCertPrefix
-	}
-
-	if len(c.Principals) == 0 {
-		return trace.BadParameter("at least one principal must be specified")
-	}
-
-	return nil
+type templateSSHHostCert struct {
+	// principals is a list of principals to request for the host cert.
+	principals []string
 }
 
 // Name returns the name for the ssh_host_cert template.
-func (c *TemplateSSHHostCert) Name() string {
+func (c *templateSSHHostCert) name() string {
 	return TemplateSSHHostCertName
 }
 
 // Describe lists the files to be generated by the ssh_host_cert template.
-func (c *TemplateSSHHostCert) Describe(destination bot.Destination) []FileDescription {
+func (c *templateSSHHostCert) describe() []FileDescription {
 	ret := []FileDescription{
 		{
-			Name: c.Prefix,
+			Name: defaultSSHHostCertPrefix,
 		},
 		{
-			Name: c.Prefix + sshHostCertSuffix,
+			Name: defaultSSHHostCertPrefix + sshHostCertSuffix,
 		},
 		{
-			Name: c.Prefix + sshHostUserCASuffix,
+			Name: defaultSSHHostCertPrefix + sshHostUserCASuffix,
 		},
 	}
 
@@ -119,28 +102,17 @@ func exportSSHUserCAs(cas []types.CertAuthority, localAuthName string) (string,
 }
 
 // Render generates SSH host cert files.
-func (c *TemplateSSHHostCert) Render(
+func (c *templateSSHHostCert) render(
 	ctx context.Context,
-	bot Bot,
-	_, unroutedIdentity *identity.Identity,
-	destination *DestinationConfig,
+	bot provider,
+	_ *identity.Identity,
+	destination bot.Destination,
 ) error {
-	dest, err := destination.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// We'll need a client for the impersonated identity to request the certs.
-	authClient, err := bot.AuthenticatedUserClientFromIdentity(ctx, unroutedIdentity)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	defer authClient.Close()
-
-	clusterName, err := authClient.GetDomainName(ctx)
+	authPong, err := bot.AuthPing(ctx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
+	clusterName := authPong.ClusterName
 
 	// generate a keypair
 	key, err := client.GenerateRSAKey()
@@ -150,18 +122,24 @@ func (c *TemplateSSHHostCert) Render(
 
 	// For now, we'll reuse the bot's regular TTL, and hostID and nodeName are
 	// left unset.
-	botCfg := bot.Config()
-	key.Cert, err = authClient.GenerateHostCert(ctx, key.MarshalSSHPublicKey(),
-		"", "", c.Principals,
-		clusterName, types.RoleNode, botCfg.CertificateTTL)
+	key.Cert, err = bot.GenerateHostCert(
+		ctx,
+		key.MarshalSSHPublicKey(),
+		"",
+		"",
+		c.principals,
+		clusterName,
+		types.RoleNode,
+		bot.Config().CertificateTTL,
+	)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	cfg := identityfile.WriteConfig{
-		OutputPath: c.Prefix,
+		OutputPath: defaultSSHHostCertPrefix,
 		Writer: &BotConfigWriter{
-			dest: dest,
+			dest: destination,
 		},
 		Key:    key,
 		Format: identityfile.FormatOpenSSH,
@@ -185,8 +163,8 @@ func (c *TemplateSSHHostCert) Render(
 		return trace.Wrap(err)
 	}
 
-	userCAPath := c.Prefix + sshHostUserCASuffix
-	if err := dest.Write(userCAPath, []byte(exportedCAs)); err != nil {
+	userCAPath := defaultSSHHostCertPrefix + sshHostUserCASuffix
+	if err := destination.Write(userCAPath, []byte(exportedCAs)); err != nil {
 		return trace.Wrap(err)
 	}
 
diff --git a/lib/tbot/config/template_ssh_host_cert_test.go b/lib/tbot/config/template_ssh_host_cert_test.go
new file mode 100644
index 0000000000000..ddf1da2256ae1
--- /dev/null
+++ b/lib/tbot/config/template_ssh_host_cert_test.go
@@ -0,0 +1,57 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/fixtures"
+)
+
+func TestTemplateSSHHostCertRender(t *testing.T) {
+	cfg, err := newTestConfig("example.com")
+	require.NoError(t, err)
+
+	mockBot := newMockProvider(cfg)
+
+	tmpl := templateSSHHostCert{
+		principals: []string{"foo.example.com"},
+	}
+
+	dest := &DestinationMemory{}
+	require.NoError(t, dest.CheckAndSetDefaults())
+
+	ident := getTestIdent(t, "bot-test")
+	err = tmpl.render(context.Background(), mockBot, ident, dest)
+	require.NoError(t, err)
+
+	// Make sure a cert is written. We just use a dummy cert (the CA fixture)
+	certBytes, err := dest.Read(defaultSSHHostCertPrefix + sshHostCertSuffix)
+	require.NoError(t, err)
+
+	require.Equal(t, fixtures.SSHCAPublicKey, string(certBytes))
+
+	// Make sure a CA is written.
+	caBytes, err := dest.Read(defaultSSHHostCertPrefix + sshHostUserCASuffix)
+	require.NoError(t, err)
+
+	require.True(t, strings.HasPrefix(string(caBytes), fixtures.SSHCAPublicKey))
+}
diff --git a/lib/tbot/config/template_tls.go b/lib/tbot/config/template_tls.go
new file mode 100644
index 0000000000000..b66aa16c514a1
--- /dev/null
+++ b/lib/tbot/config/template_tls.go
@@ -0,0 +1,95 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/client/identityfile"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/identity"
+)
+
+const defaultTLSPrefix = "tls"
+
+// templateTLS is a config template that wraps identityfile's TLS writer.
+// It's not generally needed but can be used to write out TLS certificates with
+// alternative prefix and file extensions if needed for application
+// compatibility reasons.
+type templateTLS struct {
+	// caCertType is the type of CA cert to be written
+	caCertType types.CertAuthType
+}
+
+func (t *templateTLS) name() string {
+	return TemplateTLSName
+}
+
+func (t *templateTLS) describe() []FileDescription {
+	return []FileDescription{
+		{
+			Name: defaultTLSPrefix + ".key",
+		},
+		{
+			Name: defaultTLSPrefix + ".crt",
+		},
+		{
+			Name: defaultTLSPrefix + ".cas",
+		},
+	}
+}
+
+func (t *templateTLS) render(
+	ctx context.Context,
+	bot provider,
+	identity *identity.Identity,
+	destination bot.Destination,
+) error {
+	cas, err := bot.GetCertAuthorities(ctx, t.caCertType)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	key, err := newClientKey(identity, cas)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	cfg := identityfile.WriteConfig{
+		OutputPath: defaultTLSPrefix,
+		Writer: &BotConfigWriter{
+			dest: destination,
+		},
+		Key:    key,
+		Format: identityfile.FormatTLS,
+
+		// Always overwrite to avoid hitting our no-op Stat() and Remove() functions.
+		OverwriteDestination: true,
+	}
+
+	files, err := identityfile.Write(ctx, cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	log.Debugf("Wrote TLS identity files: %+v", files)
+
+	return nil
+}
diff --git a/lib/tbot/config/configtemplate_tls_cas.go b/lib/tbot/config/template_tls_cas.go
similarity index 51%
rename from lib/tbot/config/configtemplate_tls_cas.go
rename to lib/tbot/config/template_tls_cas.go
index c3753661b6766..49dad488d5e33 100644
--- a/lib/tbot/config/configtemplate_tls_cas.go
+++ b/lib/tbot/config/template_tls_cas.go
@@ -28,65 +28,35 @@ import (
 )
 
 const (
-	// defaultHostCAPath is the default filename for the host CA certificate
-	defaultHostCAPath = "teleport-host-ca.crt"
+	// HostCAPath is the default filename for the host CA certificate
+	HostCAPath = "teleport-host-ca.crt"
 
-	// defaultUserCAPath is the default filename for the user CA certificate
-	defaultUserCAPath = "teleport-user-ca.crt"
+	// UserCAPath is the default filename for the user CA certificate
+	UserCAPath = "teleport-user-ca.crt"
 
-	// defaultDatabaseCAPath is the default filename for the database CA
+	// DatabaseCAPath is the default filename for the database CA
 	// certificate
-	defaultDatabaseCAPath = "teleport-database-ca.crt"
+	DatabaseCAPath = "teleport-database-ca.crt"
 )
 
-// TemplateTLSCAs outputs Teleport's host and user CAs for miscellaneous TLS
+// templateTLSCAs outputs Teleport's host and user CAs for miscellaneous TLS
 // client use.
-type TemplateTLSCAs struct {
-	// HostCAPath is the path to which Teleport's host CAs will be written.
-	HostCAPath string `yaml:"host_ca_path,omitempty"`
+type templateTLSCAs struct{}
 
-	// UserCAPath is the path to which Teleport's user CAs will be written.
-	UserCAPath string `yaml:"user_ca_path,omitempty"`
-
-	// DatabaseCAPath is the path to which Teleport's database CA will be
-	// written.
-	DatabaseCAPath string `yaml:"database_ca_path,omitempty"`
-}
-
-func (t *TemplateTLSCAs) CheckAndSetDefaults() error {
-	// As much as it seems silly to make these configurable, some apps require
-	// certs to have a certain name / file extension and it's trivial to make
-	// that configurable.
-
-	if t.HostCAPath == "" {
-		t.HostCAPath = defaultHostCAPath
-	}
-
-	if t.UserCAPath == "" {
-		t.UserCAPath = defaultUserCAPath
-	}
-
-	if t.DatabaseCAPath == "" {
-		t.DatabaseCAPath = defaultDatabaseCAPath
-	}
-
-	return nil
-}
-
-func (t *TemplateTLSCAs) Name() string {
+func (t *templateTLSCAs) name() string {
 	return TemplateTLSCAsName
 }
 
-func (t *TemplateTLSCAs) Describe(destination bot.Destination) []FileDescription {
+func (t *templateTLSCAs) describe() []FileDescription {
 	return []FileDescription{
 		{
-			Name: t.UserCAPath,
+			Name: HostCAPath,
 		},
 		{
-			Name: t.HostCAPath,
+			Name: UserCAPath,
 		},
 		{
-			Name: t.DatabaseCAPath,
+			Name: DatabaseCAPath,
 		},
 	}
 }
@@ -105,11 +75,11 @@ func concatCACerts(cas []types.CertAuthority) []byte {
 	return caCerts
 }
 
-func (t *TemplateTLSCAs) Render(
+func (t *templateTLSCAs) render(
 	ctx context.Context,
-	bot Bot,
-	_, _ *identity.Identity,
-	destination *DestinationConfig,
+	bot provider,
+	_ *identity.Identity,
+	destination bot.Destination,
 ) error {
 	hostCAs, err := bot.GetCertAuthorities(ctx, types.HostCA)
 	if err != nil {
@@ -126,25 +96,19 @@ func (t *TemplateTLSCAs) Render(
 		return trace.Wrap(err)
 	}
 
-	dest, err := destination.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
 	// Note: This implementation mirrors tctl's current behavior. I've noticed
 	// that mariadb at least does not seem to like being passed more than one
 	// CA so there may be some compat issues to address in the future for the
 	// rare case where a CA rotation is in progress.
-
-	if err := dest.Write(t.HostCAPath, concatCACerts(hostCAs)); err != nil {
+	if err := destination.Write(HostCAPath, concatCACerts(hostCAs)); err != nil {
 		return trace.Wrap(err)
 	}
 
-	if err := dest.Write(t.UserCAPath, concatCACerts(userCAs)); err != nil {
+	if err := destination.Write(UserCAPath, concatCACerts(userCAs)); err != nil {
 		return trace.Wrap(err)
 	}
 
-	if err := dest.Write(t.DatabaseCAPath, concatCACerts(databaseCAs)); err != nil {
+	if err := destination.Write(DatabaseCAPath, concatCACerts(databaseCAs)); err != nil {
 		return trace.Wrap(err)
 	}
 
diff --git a/lib/tbot/config/testdata/TestApplicationOutput_YAML/full.golden b/lib/tbot/config/testdata/TestApplicationOutput_YAML/full.golden
new file mode 100644
index 0000000000000..031fdb542955c
--- /dev/null
+++ b/lib/tbot/config/testdata/TestApplicationOutput_YAML/full.golden
@@ -0,0 +1,7 @@
+type: application
+destination:
+  type: memory
+roles:
+  - access
+app_name: my-app
+specific_tls_naming: false
diff --git a/lib/tbot/config/testdata/TestApplicationOutput_YAML/minimal.golden b/lib/tbot/config/testdata/TestApplicationOutput_YAML/minimal.golden
new file mode 100644
index 0000000000000..b924bd10c9e7c
--- /dev/null
+++ b/lib/tbot/config/testdata/TestApplicationOutput_YAML/minimal.golden
@@ -0,0 +1,5 @@
+type: application
+destination:
+  type: memory
+app_name: my-app
+specific_tls_naming: false
diff --git a/lib/tbot/config/testdata/TestBotConfig_MarshalYAML/minimal_config.golden b/lib/tbot/config/testdata/TestBotConfig_MarshalYAML/minimal_config.golden
new file mode 100644
index 0000000000000..d7c7e1c311518
--- /dev/null
+++ b/lib/tbot/config/testdata/TestBotConfig_MarshalYAML/minimal_config.golden
@@ -0,0 +1,11 @@
+version: v2
+outputs:
+  - type: identity
+    destination:
+      type: memory
+debug: false
+auth_server: example.teleport.sh:443
+certificate_ttl: 1m0s
+renewal_interval: 30s
+oneshot: false
+fips: false
diff --git a/lib/tbot/config/testdata/TestBotConfig_MarshalYAML/standard_config.golden b/lib/tbot/config/testdata/TestBotConfig_MarshalYAML/standard_config.golden
new file mode 100644
index 0000000000000..4665a14ba494e
--- /dev/null
+++ b/lib/tbot/config/testdata/TestBotConfig_MarshalYAML/standard_config.golden
@@ -0,0 +1,24 @@
+version: v2
+storage:
+  type: directory
+  path: /bot/storage
+  symlinks: secure
+  acls: try
+outputs:
+  - type: identity
+    destination:
+      type: directory
+      path: /bot/output
+    roles:
+      - editor
+    cluster: example.teleport.sh
+  - type: identity
+    destination:
+      type: memory
+debug: true
+auth_server: example.teleport.sh:443
+certificate_ttl: 1m0s
+renewal_interval: 30s
+oneshot: true
+fips: true
+diag_addr: 127.0.0.1:1337
diff --git a/lib/tbot/config/testdata/TestBotConfig_YAML/minimal_config.golden b/lib/tbot/config/testdata/TestBotConfig_YAML/minimal_config.golden
new file mode 100644
index 0000000000000..d7c7e1c311518
--- /dev/null
+++ b/lib/tbot/config/testdata/TestBotConfig_YAML/minimal_config.golden
@@ -0,0 +1,11 @@
+version: v2
+outputs:
+  - type: identity
+    destination:
+      type: memory
+debug: false
+auth_server: example.teleport.sh:443
+certificate_ttl: 1m0s
+renewal_interval: 30s
+oneshot: false
+fips: false
diff --git a/lib/tbot/config/testdata/TestBotConfig_YAML/standard_config.golden b/lib/tbot/config/testdata/TestBotConfig_YAML/standard_config.golden
new file mode 100644
index 0000000000000..4665a14ba494e
--- /dev/null
+++ b/lib/tbot/config/testdata/TestBotConfig_YAML/standard_config.golden
@@ -0,0 +1,24 @@
+version: v2
+storage:
+  type: directory
+  path: /bot/storage
+  symlinks: secure
+  acls: try
+outputs:
+  - type: identity
+    destination:
+      type: directory
+      path: /bot/output
+    roles:
+      - editor
+    cluster: example.teleport.sh
+  - type: identity
+    destination:
+      type: memory
+debug: true
+auth_server: example.teleport.sh:443
+certificate_ttl: 1m0s
+renewal_interval: 30s
+oneshot: true
+fips: true
+diag_addr: 127.0.0.1:1337
diff --git a/lib/tbot/config/testdata/TestDatabaseOutput_YAML/full.golden b/lib/tbot/config/testdata/TestDatabaseOutput_YAML/full.golden
new file mode 100644
index 0000000000000..cda1ff705341a
--- /dev/null
+++ b/lib/tbot/config/testdata/TestDatabaseOutput_YAML/full.golden
@@ -0,0 +1,9 @@
+type: database
+destination:
+  type: memory
+roles:
+  - access
+format: tls
+service: my-database-service
+database: my-database
+username: my-username
diff --git a/lib/tbot/config/testdata/TestDatabaseOutput_YAML/minimal.golden b/lib/tbot/config/testdata/TestDatabaseOutput_YAML/minimal.golden
new file mode 100644
index 0000000000000..1b9233d9ed83b
--- /dev/null
+++ b/lib/tbot/config/testdata/TestDatabaseOutput_YAML/minimal.golden
@@ -0,0 +1,4 @@
+type: database
+destination:
+  type: memory
+service: my-database-service
diff --git a/lib/tbot/config/testdata/TestDestinationDirectory_YAML/full.golden b/lib/tbot/config/testdata/TestDestinationDirectory_YAML/full.golden
new file mode 100644
index 0000000000000..c62135828a3e6
--- /dev/null
+++ b/lib/tbot/config/testdata/TestDestinationDirectory_YAML/full.golden
@@ -0,0 +1,4 @@
+type: directory
+path: /my/path
+symlinks: secure
+acls: required
diff --git a/lib/tbot/config/testdata/TestDestinationDirectory_YAML/minimal.golden b/lib/tbot/config/testdata/TestDestinationDirectory_YAML/minimal.golden
new file mode 100644
index 0000000000000..a9b6056c48ebe
--- /dev/null
+++ b/lib/tbot/config/testdata/TestDestinationDirectory_YAML/minimal.golden
@@ -0,0 +1,2 @@
+type: directory
+path: /my/path
diff --git a/lib/tbot/config/testdata/TestIdentityOutput_YAML/full.golden b/lib/tbot/config/testdata/TestIdentityOutput_YAML/full.golden
new file mode 100644
index 0000000000000..9cc0f55ba0040
--- /dev/null
+++ b/lib/tbot/config/testdata/TestIdentityOutput_YAML/full.golden
@@ -0,0 +1,6 @@
+type: identity
+destination:
+  type: memory
+roles:
+  - access
+cluster: leaf.example.com
diff --git a/lib/tbot/config/testdata/TestIdentityOutput_YAML/minimal.golden b/lib/tbot/config/testdata/TestIdentityOutput_YAML/minimal.golden
new file mode 100644
index 0000000000000..62782e8bc892f
--- /dev/null
+++ b/lib/tbot/config/testdata/TestIdentityOutput_YAML/minimal.golden
@@ -0,0 +1,3 @@
+type: identity
+destination:
+  type: memory
diff --git a/lib/tbot/config/testdata/TestKubernetesOutput_YAML/full.golden b/lib/tbot/config/testdata/TestKubernetesOutput_YAML/full.golden
new file mode 100644
index 0000000000000..2e7770a40a0ea
--- /dev/null
+++ b/lib/tbot/config/testdata/TestKubernetesOutput_YAML/full.golden
@@ -0,0 +1,6 @@
+type: kubernetes
+destination:
+  type: memory
+roles:
+  - access
+kubernetes_cluster: k8s.example.com
diff --git a/lib/tbot/config/testdata/TestKubernetesOutput_YAML/minimal.golden b/lib/tbot/config/testdata/TestKubernetesOutput_YAML/minimal.golden
new file mode 100644
index 0000000000000..94e41076bac7e
--- /dev/null
+++ b/lib/tbot/config/testdata/TestKubernetesOutput_YAML/minimal.golden
@@ -0,0 +1,4 @@
+type: kubernetes
+destination:
+  type: memory
+kubernetes_cluster: k8s.example.com
diff --git a/lib/tbot/config/testdata/TestSSHHostOutput_YAML/full.golden b/lib/tbot/config/testdata/TestSSHHostOutput_YAML/full.golden
new file mode 100644
index 0000000000000..feca5c898976c
--- /dev/null
+++ b/lib/tbot/config/testdata/TestSSHHostOutput_YAML/full.golden
@@ -0,0 +1,7 @@
+type: ssh_host
+destination:
+  type: memory
+roles:
+  - access
+principals:
+  - host.example.com
diff --git a/lib/tbot/config/testdata/TestSSHHostOutput_YAML/minimal.golden b/lib/tbot/config/testdata/TestSSHHostOutput_YAML/minimal.golden
new file mode 100644
index 0000000000000..007d24c3b2a62
--- /dev/null
+++ b/lib/tbot/config/testdata/TestSSHHostOutput_YAML/minimal.golden
@@ -0,0 +1,5 @@
+type: ssh_host
+destination:
+  type: memory
+principals:
+  - host.example.com
diff --git a/lib/tbot/config/testdata/TestTemplateKubernetesRender/kubeconfig.yaml.golden b/lib/tbot/config/testdata/TestTemplateKubernetesRender/kubeconfig.yaml.golden
index daf257d071aca..833bb19b4be44 100644
--- a/lib/tbot/config/testdata/TestTemplateKubernetesRender/kubeconfig.yaml.golden
+++ b/lib/tbot/config/testdata/TestTemplateKubernetesRender/kubeconfig.yaml.golden
@@ -21,6 +21,6 @@ users:
       - kube
       - credentials
       - --destination-dir=/test/dir
-      command: tbot
+      command: /path/to/tbot
       env: null
       provideClusterInfo: false
diff --git a/lib/tbot/config/testdata/TestTemplateSSHClient_Render/latest_OpenSSH/ssh_config.golden b/lib/tbot/config/testdata/TestTemplateSSHClient_Render/latest_OpenSSH/ssh_config.golden
index bf9342d2f363c..2c0c89af51bfd 100644
--- a/lib/tbot/config/testdata/TestTemplateSSHClient_Render/latest_OpenSSH/ssh_config.golden
+++ b/lib/tbot/config/testdata/TestTemplateSSHClient_Render/latest_OpenSSH/ssh_config.golden
@@ -10,7 +10,7 @@ Host *.tele.blackmesa.gov tele.blackmesa.gov
 # Flags for all tele.blackmesa.gov hosts except the proxy
 Host *.tele.blackmesa.gov !tele.blackmesa.gov
     Port 3022
-    ProxyCommand "/path/to/tbot" proxy --destination-dir=/test/dir --proxy=tele.blackmesa.gov ssh --cluster=tele.blackmesa.gov  %r@%h:%p
+    ProxyCommand "/path/to/tbot" proxy --destination-dir=/test/dir --proxy=tele.blackmesa.gov:443 ssh --cluster=tele.blackmesa.gov  %r@%h:%p
 # Common flags for all tele.aperture.labs hosts
 Host *.tele.aperture.labs tele.blackmesa.gov
     UserKnownHostsFile "/test/dir/known_hosts"
@@ -21,6 +21,6 @@ Host *.tele.aperture.labs tele.blackmesa.gov
 # Flags for all tele.aperture.labs hosts except the proxy
 Host *.tele.aperture.labs !tele.blackmesa.gov
     Port 3022
-    ProxyCommand "/path/to/tbot" proxy --destination-dir=/test/dir --proxy=tele.blackmesa.gov ssh --cluster=tele.aperture.labs  %r@%h:%p
+    ProxyCommand "/path/to/tbot" proxy --destination-dir=/test/dir --proxy=tele.blackmesa.gov:443 ssh --cluster=tele.aperture.labs  %r@%h:%p
 
 # End generated Teleport configuration
diff --git a/lib/tbot/config/testdata/TestTemplateSSHClient_Render/legacy_OpenSSH/ssh_config.golden b/lib/tbot/config/testdata/TestTemplateSSHClient_Render/legacy_OpenSSH/ssh_config.golden
index 60c651ee0676f..7f2ab5aef2813 100644
--- a/lib/tbot/config/testdata/TestTemplateSSHClient_Render/legacy_OpenSSH/ssh_config.golden
+++ b/lib/tbot/config/testdata/TestTemplateSSHClient_Render/legacy_OpenSSH/ssh_config.golden
@@ -10,7 +10,7 @@ Host *.tele.blackmesa.gov tele.blackmesa.gov
 # Flags for all tele.blackmesa.gov hosts except the proxy
 Host *.tele.blackmesa.gov !tele.blackmesa.gov
     Port 3022
-    ProxyCommand "/path/to/tbot" proxy --destination-dir=/test/dir --proxy=tele.blackmesa.gov ssh --cluster=tele.blackmesa.gov  %r@%h:%p
+    ProxyCommand "/path/to/tbot" proxy --destination-dir=/test/dir --proxy=tele.blackmesa.gov:443 ssh --cluster=tele.blackmesa.gov  %r@%h:%p
 # Common flags for all tele.aperture.labs hosts
 Host *.tele.aperture.labs tele.blackmesa.gov
     UserKnownHostsFile "/test/dir/known_hosts"
@@ -21,6 +21,6 @@ Host *.tele.aperture.labs tele.blackmesa.gov
 # Flags for all tele.aperture.labs hosts except the proxy
 Host *.tele.aperture.labs !tele.blackmesa.gov
     Port 3022
-    ProxyCommand "/path/to/tbot" proxy --destination-dir=/test/dir --proxy=tele.blackmesa.gov ssh --cluster=tele.aperture.labs  %r@%h:%p
+    ProxyCommand "/path/to/tbot" proxy --destination-dir=/test/dir --proxy=tele.blackmesa.gov:443 ssh --cluster=tele.aperture.labs  %r@%h:%p
 
 # End generated Teleport configuration
diff --git a/lib/tbot/configtemplate_test.go b/lib/tbot/configtemplate_test.go
deleted file mode 100644
index 91cd9dd9b14a3..0000000000000
--- a/lib/tbot/configtemplate_test.go
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package tbot
-
-import (
-	"bytes"
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/identityfile"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/tbot/bot"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/testhelpers"
-	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
-)
-
-// Note: This test lives in main to avoid otherwise inevitable import cycles
-// if we tried importing renewal code from the config package.
-
-// validateTemplate loads and validates a config template from the destination
-func validateTemplate(t *testing.T, tplI config.Template, dest bot.Destination) {
-	t.Helper()
-
-	// First, make sure all advertised files exist.
-	for _, file := range tplI.Describe(dest) {
-		// Don't bother checking directories, they're meant to be black
-		// boxes. We could implement type-specific checks if we really
-		// wanted.
-		if file.IsDir {
-			continue
-		}
-
-		bytes, err := dest.Read(file.Name)
-		require.NoError(t, err)
-
-		// Should at least be non-empty.
-		t.Logf("Expected file %q for template %q has length: %d", file.Name, tplI.Name(), len(bytes))
-		require.Truef(t, len(bytes) > 0, "file %q in template %q must be non-empty", file.Name, tplI.Name())
-	}
-
-	// Next, for supported template types, make sure they're valid.
-	// TODO: consider adding further type-specific tests.
-	switch tpl := tplI.(type) {
-	case *config.TemplateIdentity:
-		// Make sure the identityfile package can read this identity file.
-		b, err := dest.Read(tpl.FileName)
-		require.NoError(t, err)
-
-		buf := bytes.NewBuffer(b)
-		_, err = identityfile.Read(buf)
-		require.NoError(t, err)
-	case *config.TemplateTLSCAs:
-		b, err := dest.Read(tpl.HostCAPath)
-		require.NoError(t, err)
-		_, err = tlsca.ParseCertificatePEM(b)
-		require.NoError(t, err)
-
-		b, err = dest.Read(tpl.UserCAPath)
-		require.NoError(t, err)
-		_, err = tlsca.ParseCertificatePEM(b)
-		require.NoError(t, err)
-	}
-}
-
-// TestTemplateRendering performs a full renewal and ensures all expected
-// default config templates are present.
-func TestDefaultTemplateRendering(t *testing.T) {
-	t.Parallel()
-
-	// Make a new auth server.
-	log := utils.NewLoggerForTests()
-	fc, fds := testhelpers.DefaultConfig(t)
-	_ = testhelpers.MakeAndRunTestAuthServer(t, log, fc, fds)
-	rootClient := testhelpers.MakeDefaultAuthClient(t, log, fc)
-
-	// Make and join a new bot instance.
-	const roleName = "dummy-role"
-	role, err := types.NewRole(roleName, types.RoleSpecV6{})
-	require.NoError(t, err)
-	require.NoError(t, rootClient.UpsertRole(context.Background(), role))
-
-	botParams := testhelpers.MakeBot(t, rootClient, "test", roleName)
-	botConfig := testhelpers.MakeMemoryBotConfig(t, fc, botParams)
-	storage, err := botConfig.Storage.GetDestination()
-	require.NoError(t, err)
-	b := New(botConfig, log, nil)
-
-	ident, err := b.getIdentityFromToken()
-	require.NoError(t, err)
-	botClient := testhelpers.MakeBotAuthClient(t, fc, ident)
-	b._ident = ident
-	b._client = botClient
-
-	err = b.renew(context.Background(), storage)
-	require.NoError(t, err)
-
-	dest := botConfig.Destinations[0]
-	destImpl, err := dest.GetDestination()
-	require.NoError(t, err)
-
-	for _, templateName := range config.GetRequiredConfigs() {
-		cfg := dest.GetConfigByName(templateName)
-		require.NotNilf(t, cfg, "template %q must exist", templateName)
-
-		validateTemplate(t, cfg, destImpl)
-	}
-}
diff --git a/lib/tbot/identity/kinds.go b/lib/tbot/identity/kinds.go
index 6b9e3058c8d85..e5a7a45fe160a 100644
--- a/lib/tbot/identity/kinds.go
+++ b/lib/tbot/identity/kinds.go
@@ -29,18 +29,6 @@ const (
 	KindBotInternal ArtifactKind = "bot-internal"
 )
 
-// ContainsKind determines if a particular artifact kind is included in the
-// list of kinds.
-func ContainsKind(kind ArtifactKind, kinds []ArtifactKind) bool {
-	for _, k := range kinds {
-		if kind == k {
-			return true
-		}
-	}
-
-	return false
-}
-
 // BotKinds returns a list of all artifact kinds used internally by the bot.
 // End-user destinations may contain a different set of artifacts.
 func BotKinds() []ArtifactKind {
diff --git a/lib/tbot/renew.go b/lib/tbot/impersonated_identity.go
similarity index 51%
rename from lib/tbot/renew.go
rename to lib/tbot/impersonated_identity.go
index efd905599329b..ad60ad1919a4e 100644
--- a/lib/tbot/renew.go
+++ b/lib/tbot/impersonated_identity.go
@@ -18,34 +18,92 @@ package tbot
 
 import (
 	"context"
-	"crypto/sha256"
-	"encoding/hex"
 	"fmt"
 	"math"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/sirupsen/logrus"
 	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/client/webclient"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/lib/auth"
-	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/native"
-	"github.com/gravitational/teleport/lib/client"
 	libdefaults "github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/tbot/bot"
 	"github.com/gravitational/teleport/lib/tbot/config"
 	"github.com/gravitational/teleport/lib/tbot/identity"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
 )
 
+const renewalRetryLimit = 5
+
+func (b *Bot) renewOutputsLoop(
+	ctx context.Context, reloadChan <-chan struct{},
+) error {
+	b.log.Infof(
+		"Beginning output renewal loop: ttl=%s interval=%s",
+		b.cfg.CertificateTTL,
+		b.cfg.RenewalInterval,
+	)
+
+	ticker := time.NewTicker(b.cfg.RenewalInterval)
+	jitter := retryutils.NewJitter()
+	defer ticker.Stop()
+	for {
+		var err error
+		for attempt := 1; attempt <= renewalRetryLimit; attempt++ {
+			b.log.Infof(
+				"Renewing outputs. Attempt %d of %d.",
+				attempt,
+				renewalRetryLimit,
+			)
+			err = b.renewOutputs(ctx)
+			if err == nil {
+				break
+			}
+
+			if attempt != renewalRetryLimit {
+				// exponentially back off with jitter, starting at 1 second.
+				backoffTime := time.Second * time.Duration(math.Pow(2, float64(attempt-1)))
+				backoffTime = jitter(backoffTime)
+				b.log.WithError(err).Warnf(
+					"Output renewal attempt %d of %d failed. Retrying after %s.",
+					attempt,
+					renewalRetryLimit,
+					backoffTime,
+				)
+				select {
+				case <-ctx.Done():
+					return nil
+				case <-time.After(backoffTime):
+				}
+			}
+		}
+		if err != nil {
+			b.log.Warnf("%d retry attempts exhausted renewing outputs. Waiting for next normal renewal cycle in %s.", renewalRetryLimit, b.cfg.RenewalInterval)
+		} else {
+			b.log.Infof("Renewed outputs. Next output renewal in approximately %s.", b.cfg.RenewalInterval)
+		}
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+			continue
+		case <-reloadChan:
+			continue
+		}
+	}
+}
+
 // generateKeys generates TLS and SSH keypairs.
 func generateKeys() (private, sshpub, tlspub []byte, err error) {
 	privateKey, publicKey, err := native.GenerateKeyPair()
@@ -66,52 +124,20 @@ func generateKeys() (private, sshpub, tlspub []byte, err error) {
 	return privateKey, publicKey, tlsPublicKey, nil
 }
 
-// AuthenticatedUserClientFromIdentity creates a new auth client from the given
-// identity. Note that depending on the connection address given, this may
-// attempt to connect via the proxy and therefore requires both SSH and TLS
-// credentials.
-func (b *Bot) AuthenticatedUserClientFromIdentity(ctx context.Context, id *identity.Identity) (auth.ClientI, error) {
-	if id.SSHCert == nil || id.X509Cert == nil {
-		return nil, trace.BadParameter("auth client requires a fully formed identity")
-	}
-
-	tlsConfig, err := id.TLSConfig(b.cfg.CipherSuites())
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	sshConfig, err := id.SSHClientConfig(b.cfg.FIPS)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	authAddr, err := utils.ParseAddr(b.cfg.AuthServer)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	authClientConfig := &authclient.Config{
-		TLS:         tlsConfig,
-		SSH:         sshConfig,
-		AuthServers: []utils.NetAddr{*authAddr},
-		Log:         b.log,
-	}
-
-	c, err := authclient.Connect(ctx, authClientConfig)
-	return c, trace.Wrap(err)
-}
-
 // describeTLSIdentity generates an informational message about the given
 // TLS identity, appropriate for user-facing log messages.
-func describeTLSIdentity(ident *identity.Identity) (string, error) {
+func describeTLSIdentity(log logrus.FieldLogger, ident *identity.Identity) string {
+	failedToDescribe := "failed-to-describe"
 	cert := ident.X509Cert
 	if cert == nil {
-		return "", trace.BadParameter("attempted to describe TLS identity without TLS credentials")
+		log.Warn("Attempted to describe TLS identity without TLS credentials.")
+		return failedToDescribe
 	}
 
 	tlsIdent, err := tlsca.FromSubject(cert.Subject, cert.NotAfter)
 	if err != nil {
-		return "", trace.Wrap(err, "bot TLS certificate can not be parsed as an identity")
+		log.WithError(err).Warn("Bot TLS certificate can not be parsed as an identity")
+		return failedToDescribe
 	}
 
 	var principals []string
@@ -132,7 +158,7 @@ func describeTLSIdentity(ident *identity.Identity) (string, error) {
 		tlsIdent.Groups,
 		principals,
 		tlsIdent.Generation,
-	), nil
+	)
 }
 
 // identityConfigurator is a function that alters a cert request
@@ -147,8 +173,9 @@ type identityConfigurator = func(req *proto.UserCertsRequest)
 // certs.
 func (b *Bot) generateIdentity(
 	ctx context.Context,
+	client auth.ClientI,
 	currentIdentity *identity.Identity,
-	destCfg *config.DestinationConfig,
+	output config.Output,
 	defaultRoles []string,
 	configurator identityConfigurator,
 ) (*identity.Identity, error) {
@@ -165,10 +192,10 @@ func (b *Bot) generateIdentity(
 	}
 
 	var roleRequests []string
-	if len(destCfg.Roles) > 0 {
-		roleRequests = destCfg.Roles
+	if roles := output.GetRoles(); len(roles) > 0 {
+		roleRequests = roles
 	} else {
-		b.log.Debugf("Destination specified no roles, defaults will be requested: %v", defaultRoles)
+		b.log.Debugf("Output specified no roles, defaults will be requested: %v", defaultRoles)
 		roleRequests = defaultRoles
 	}
 
@@ -191,7 +218,6 @@ func (b *Bot) generateIdentity(
 
 	// First, ask the auth server to generate a new set of certs with a new
 	// expiration date.
-	client := b.Client()
 	certs, err := client.GenerateUserCerts(ctx, req)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -265,30 +291,30 @@ func getDatabase(ctx context.Context, client auth.ClientI, name string) (types.D
 	return databases[0], nil
 }
 
-func (b *Bot) getRouteToDatabase(ctx context.Context, client auth.ClientI, dbCfg *config.Database) (proto.RouteToDatabase, error) {
-	if dbCfg.Service == "" {
+func (b *Bot) getRouteToDatabase(ctx context.Context, client auth.ClientI, output *config.DatabaseOutput) (proto.RouteToDatabase, error) {
+	if output.Service == "" {
 		return proto.RouteToDatabase{}, nil
 	}
 
-	db, err := getDatabase(ctx, client, dbCfg.Service)
+	db, err := getDatabase(ctx, client, output.Service)
 	if err != nil {
 		return proto.RouteToDatabase{}, trace.Wrap(err)
 	}
 
-	username := dbCfg.Username
+	username := output.Username
 	if db.GetProtocol() == libdefaults.ProtocolMongoDB && username == "" {
 		// This isn't strictly a runtime error so killing the process seems
 		// wrong. We'll just loudly warn about it.
-		b.log.Errorf("Database `username` field for %q is unset but is required for MongoDB databases.", dbCfg.Service)
+		b.log.Errorf("Database `username` field for %q is unset but is required for MongoDB databases.", output.Service)
 	} else if db.GetProtocol() == libdefaults.ProtocolRedis && username == "" {
 		// Per tsh's lead, fall back to the default username.
 		username = libdefaults.DefaultRedisUsername
 	}
 
 	return proto.RouteToDatabase{
-		ServiceName: dbCfg.Service,
+		ServiceName: output.Service,
 		Protocol:    db.GetProtocol(),
-		Database:    dbCfg.Database,
+		Database:    output.Database,
 		Username:    username,
 	}, nil
 }
@@ -322,21 +348,16 @@ func getApp(ctx context.Context, client auth.ClientI, appName string) (types.App
 	return apps[0], nil
 }
 
-func (b *Bot) getRouteToApp(ctx context.Context, client auth.ClientI, appCfg *config.App) (proto.RouteToApp, error) {
-	if appCfg.App == "" {
-		return proto.RouteToApp{}, trace.BadParameter("App name must be configured")
-	}
-
-	app, err := getApp(ctx, client, appCfg.App)
+func (b *Bot) getRouteToApp(ctx context.Context, botIdentity *identity.Identity, client auth.ClientI, output *config.ApplicationOutput) (proto.RouteToApp, error) {
+	app, err := getApp(ctx, client, output.AppName)
 	if err != nil {
 		return proto.RouteToApp{}, trace.Wrap(err)
 	}
 
 	// TODO: AWS?
-	ident := b.ident()
 	ws, err := client.CreateAppSession(ctx, types.CreateAppSessionRequest{
-		ClusterName: ident.ClusterName,
-		Username:    ident.X509Cert.Subject.CommonName,
+		ClusterName: botIdentity.ClusterName,
+		Username:    botIdentity.X509Cert.Subject.CommonName,
 		PublicAddr:  app.GetPublicAddr(),
 	})
 	if err != nil {
@@ -352,44 +373,59 @@ func (b *Bot) getRouteToApp(ctx context.Context, client auth.ClientI, appCfg *co
 		Name:        app.GetName(),
 		SessionID:   ws.GetName(),
 		PublicAddr:  app.GetPublicAddr(),
-		ClusterName: ident.ClusterName,
+		ClusterName: botIdentity.ClusterName,
 	}, nil
 }
 
 // generateImpersonatedIdentity generates an impersonated identity for a given
-// destination.
-//
-// It returns two identities:
-// - unroutedIdentity: impersonates the roles of the destination, but does not
-// include any routing specified within the destination. This gives an
-// identity which can be used to act as the roleset when interacting with the
-// Teleport API.
-// - routedIdentity: impersonates the roles and routes of the destination.
-// This identity should be the one actually written to the destination, but,
-// may not behave as expected when used to interact with the Teleport API
+// output. It also returns a client that is authenticated with that
+// impersonated identity.
 func (b *Bot) generateImpersonatedIdentity(
 	ctx context.Context,
-	destCfg *config.DestinationConfig,
+	botClient auth.ClientI,
+	botIdentity *identity.Identity,
+	output config.Output,
 	defaultRoles []string,
-) (routedIdentity *identity.Identity, unroutedIdentity *identity.Identity, err error) {
-	unroutedIdentity, err = b.generateIdentity(
-		ctx, b.ident(), destCfg, defaultRoles, nil,
+) (impersonatedIdentity *identity.Identity, impersonatedClient auth.ClientI, err error) {
+	impersonatedIdentity, err = b.generateIdentity(
+		ctx, botClient, botIdentity, output, defaultRoles, nil,
 	)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
 
+	// create a client that uses the impersonated identity, so that when we
+	// fetch information, we can ensure access rights are enforced.
+	impersonatedClient, err = b.AuthenticatedUserClientFromIdentity(ctx, impersonatedIdentity)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+	defer func() {
+		// In success cases, this client is used by the caller and they manage
+		// closing, in failure cases, we need to close the client.
+		if err != nil && impersonatedClient != nil {
+			impersonatedClient.Close()
+		}
+	}()
+
 	// Now that we have an initial impersonated identity, we can use it to
 	// request any app/db/etc certs
-	if destCfg.Database != nil {
-		impClient, err := b.AuthenticatedUserClientFromIdentity(ctx, unroutedIdentity)
+	switch output := output.(type) {
+	case *config.IdentityOutput:
+		if output.Cluster == "" {
+			return impersonatedIdentity, impersonatedClient, nil
+		}
+
+		routedIdentity, err := b.generateIdentity(ctx, botClient, impersonatedIdentity, output, defaultRoles, func(req *proto.UserCertsRequest) {
+			req.RouteToCluster = output.Cluster
+		},
+		)
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
-
-		defer impClient.Close()
-
-		route, err := b.getRouteToDatabase(ctx, impClient, destCfg.Database)
+		return routedIdentity, impersonatedClient, nil
+	case *config.DatabaseOutput:
+		route, err := b.getRouteToDatabase(ctx, impersonatedClient, output)
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
@@ -398,172 +434,51 @@ func (b *Bot) generateImpersonatedIdentity(
 		// so we'll request the database access identity using the main bot
 		// identity (having gathered the necessary info for RouteToDatabase
 		// using the correct impersonated unroutedIdentity.)
-		routedIdentity, err := b.generateIdentity(ctx, unroutedIdentity, destCfg, defaultRoles, func(req *proto.UserCertsRequest) {
+		routedIdentity, err := b.generateIdentity(ctx, botClient, impersonatedIdentity, output, defaultRoles, func(req *proto.UserCertsRequest) {
 			req.RouteToDatabase = route
 		})
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
 
-		b.log.Infof("Generated identity for database %q", destCfg.Database.Service)
+		b.log.Infof("Generated identity for database %q", output.Service)
 
-		return routedIdentity, unroutedIdentity, nil
-	} else if destCfg.KubernetesCluster != nil {
+		return routedIdentity, impersonatedClient, nil
+	case *config.KubernetesOutput:
 		// Note: the Teleport server does attempt to verify k8s cluster names
 		// and will fail to generate certs if the cluster doesn't exist or is
 		// offline.
-		routedIdentity, err := b.generateIdentity(ctx, unroutedIdentity, destCfg, defaultRoles, func(req *proto.UserCertsRequest) {
-			req.KubernetesCluster = destCfg.KubernetesCluster.ClusterName
+		routedIdentity, err := b.generateIdentity(ctx, botClient, impersonatedIdentity, output, defaultRoles, func(req *proto.UserCertsRequest) {
+			req.KubernetesCluster = output.KubernetesCluster
 		})
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
 
-		b.log.Infof("Generated identity for Kubernetes cluster %q", *destCfg.KubernetesCluster)
-
-		return routedIdentity, unroutedIdentity, nil
-	} else if destCfg.App != nil {
-		impClient, err := b.AuthenticatedUserClientFromIdentity(ctx, unroutedIdentity)
-		if err != nil {
-			return nil, nil, trace.Wrap(err)
-		}
-		defer impClient.Close()
+		b.log.Infof("Generated identity for Kubernetes cluster %q", output.KubernetesCluster)
 
-		routeToApp, err := b.getRouteToApp(ctx, impClient, destCfg.App)
+		return routedIdentity, impersonatedClient, nil
+	case *config.ApplicationOutput:
+		routeToApp, err := b.getRouteToApp(ctx, botIdentity, impersonatedClient, output)
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
 
-		routedIdentity, err := b.generateIdentity(ctx, unroutedIdentity, destCfg, defaultRoles, func(req *proto.UserCertsRequest) {
+		routedIdentity, err := b.generateIdentity(ctx, botClient, impersonatedIdentity, output, defaultRoles, func(req *proto.UserCertsRequest) {
 			req.RouteToApp = routeToApp
 		})
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
 
-		b.log.Infof("Generated identity for app %q", *destCfg.App)
-
-		return routedIdentity, unroutedIdentity, nil
-	} else if destCfg.Cluster != "" {
-		routedIdentity, err := b.generateIdentity(
-			ctx, unroutedIdentity, destCfg, defaultRoles, func(req *proto.UserCertsRequest) {
-				req.RouteToCluster = destCfg.Cluster
-			},
-		)
-		if err != nil {
-			return nil, nil, trace.Wrap(err)
-		}
-		return routedIdentity, unroutedIdentity, nil
-	}
-
-	return unroutedIdentity, unroutedIdentity, nil
-}
+		b.log.Infof("Generated identity for app %q", output.AppName)
 
-func (b *Bot) getIdentityFromToken() (*identity.Identity, error) {
-	if b.cfg.Onboarding == nil {
-		return nil, trace.BadParameter("onboarding config required via CLI or YAML")
-	}
-	if !b.cfg.Onboarding.HasToken() {
-		return nil, trace.BadParameter("unable to start: no token present")
-	}
-	addr, err := utils.ParseAddr(b.cfg.AuthServer)
-	if err != nil {
-		return nil, trace.Wrap(err, "invalid auth server address %+v", b.cfg.AuthServer)
-	}
-
-	tlsPrivateKey, sshPublicKey, tlsPublicKey, err := generateKeys()
-	if err != nil {
-		return nil, trace.Wrap(err, "unable to generate new keypairs")
-	}
-
-	b.log.Info("Attempting to generate new identity from token")
-
-	token, err := b.cfg.Onboarding.Token()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	expires := time.Now().Add(b.cfg.CertificateTTL)
-	params := auth.RegisterParams{
-		Token: token,
-		ID: auth.IdentityID{
-			Role: types.RoleBot,
-		},
-		AuthServers:        []utils.NetAddr{*addr},
-		PublicTLSKey:       tlsPublicKey,
-		PublicSSHKey:       sshPublicKey,
-		CAPins:             b.cfg.Onboarding.CAPins,
-		CAPath:             b.cfg.Onboarding.CAPath,
-		GetHostCredentials: client.HostCredentials,
-		JoinMethod:         b.cfg.Onboarding.JoinMethod,
-		Expires:            &expires,
-		FIPS:               b.cfg.FIPS,
-		CipherSuites:       b.cfg.CipherSuites(),
-	}
-	if params.JoinMethod == types.JoinMethodAzure {
-		params.AzureParams = auth.AzureParams{
-			ClientID: b.cfg.Onboarding.Azure.ClientID,
-		}
-	}
-
-	certs, err := auth.Register(params)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	sha := sha256.Sum256([]byte(params.Token))
-	tokenHash := hex.EncodeToString(sha[:])
-	ident, err := identity.ReadIdentityFromStore(&identity.LoadIdentityParams{
-		PrivateKeyBytes: tlsPrivateKey,
-		PublicKeyBytes:  sshPublicKey,
-		TokenHashBytes:  []byte(tokenHash),
-	}, certs, identity.BotKinds()...)
-	return ident, trace.Wrap(err)
-}
-
-func (b *Bot) renewIdentityViaAuth(
-	ctx context.Context,
-) (*identity.Identity, error) {
-	// If using the IAM join method we always go through the initial join flow
-	// and fetch new nonrenewable certs
-	var joinMethod types.JoinMethod
-	if b.cfg.Onboarding != nil {
-		joinMethod = b.cfg.Onboarding.JoinMethod
-	}
-	switch joinMethod {
-	// When using join methods that are repeatable - renew fully rather than
-	// renewing using existing credentials.
-	case types.JoinMethodAzure,
-		types.JoinMethodCircleCI,
-		types.JoinMethodGitHub,
-		types.JoinMethodGitLab,
-		types.JoinMethodIAM:
-		ident, err := b.getIdentityFromToken()
-		return ident, trace.Wrap(err)
+		return routedIdentity, impersonatedClient, nil
+	case *config.SSHHostOutput:
+		return impersonatedIdentity, impersonatedClient, nil
 	default:
+		return nil, nil, trace.BadParameter("generateImpersonatedIdentity does not support output type (%T)", output)
 	}
-
-	// Ask the auth server to generate a new set of certs with a new
-	// expiration date.
-	ident := b.ident()
-	certs, err := b.Client().GenerateUserCerts(ctx, proto.UserCertsRequest{
-		PublicKey: ident.PublicKeyBytes,
-		Username:  ident.X509Cert.Subject.CommonName,
-		Expires:   time.Now().Add(b.cfg.CertificateTTL),
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	newIdentity, err := identity.ReadIdentityFromStore(
-		ident.Params(),
-		certs,
-		identity.BotKinds()...,
-	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return newIdentity, nil
 }
 
 // fetchDefaultRoles requests the bot's own role from the auth server and
@@ -578,68 +493,45 @@ func fetchDefaultRoles(ctx context.Context, roleGetter services.RoleGetter, botR
 	return conditions.Roles, nil
 }
 
-// renew performs a single renewal
-func (b *Bot) renew(
-	ctx context.Context, botDestination bot.Destination,
+// renewOutputs performs a single renewal
+func (b *Bot) renewOutputs(
+	ctx context.Context,
 ) error {
-	// Make sure we can still write to the bot's destination.
-	if err := identity.VerifyWrite(botDestination); err != nil {
-		return trace.Wrap(err, "Cannot write to destination %s, aborting.", botDestination)
-	}
-
-	b.log.Debug("Attempting to renew bot certificates...")
-	newIdentity, err := b.renewIdentityViaAuth(ctx)
+	botIdentity := b.ident()
+	client, err := b.AuthenticatedUserClientFromIdentity(ctx, botIdentity)
 	if err != nil {
 		return trace.Wrap(err)
 	}
+	defer client.Close()
 
-	identStr, err := describeTLSIdentity(newIdentity)
-	if err != nil {
-		return trace.Wrap(err, "Could not describe bot identity at %s", botDestination)
-	}
-
-	b.log.Infof("Successfully renewed bot certificates, %s", identStr)
-
-	// TODO: warn if duration < certTTL? would indicate TTL > server's max renewable cert TTL
-	// TODO: error if duration < renewalInterval? next renewal attempt will fail
-
-	// Immediately attempt to reconnect using the new identity (still
-	// haven't persisted the known-good certs).
-	newClient, err := b.AuthenticatedUserClientFromIdentity(ctx, newIdentity)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	b.setClient(newClient)
-	b.setIdent(newIdentity)
-	b.log.Debug("Auth client now using renewed credentials.")
-
-	// Now that we're sure the new creds work, persist them.
-	if err := identity.SaveIdentity(newIdentity, botDestination, identity.BotKinds()...); err != nil {
-		return trace.Wrap(err)
+	// create a cache shared across outputs so they don't hammer the auth
+	// server with similar requests
+	drc := &outputRenewalCache{
+		client: client,
+		cfg:    b.cfg,
 	}
 
 	// Determine the default role list based on the bot role. The role's
 	// name should match the certificate's Key ID (user and role names
 	// should all match bot-$name)
-	botResourceName := newIdentity.X509Cert.Subject.CommonName
-	defaultRoles, err := fetchDefaultRoles(ctx, newClient, botResourceName)
+	botResourceName := botIdentity.X509Cert.Subject.CommonName
+	defaultRoles, err := fetchDefaultRoles(ctx, client, botResourceName)
 	if err != nil {
 		b.log.WithError(err).Warnf("Unable to determine default roles, no roles will be requested if unspecified")
 		defaultRoles = []string{}
 	}
 
 	// Next, generate impersonated certs
-	for _, dest := range b.cfg.Destinations {
-		destImpl, err := dest.GetDestination()
-		if err != nil {
-			return trace.Wrap(err)
-		}
+	for _, output := range b.cfg.Outputs {
+		b.log.WithFields(logrus.Fields{
+			"output": output,
+		}).Info("Generating output.")
 
+		dest := output.GetDestination()
 		// Check the ACLs. We can't fix them, but we can warn if they're
 		// misconfigured. We'll need to precompute a list of keys to check.
 		// Note: This may only log a warning, depending on configuration.
-		if err := destImpl.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
+		if err := dest.Verify(identity.ListKeys(identity.DestinationKinds()...)); err != nil {
 			return trace.Wrap(err)
 		}
 
@@ -647,117 +539,172 @@ func (b *Bot) renew(
 		// ACLs are misconfigured, regardless of configuration.
 		// TODO: consider not making these a hard error? e.g. write other
 		// destinations even if this one is broken?
-		if err := identity.VerifyWrite(destImpl); err != nil {
-			return trace.Wrap(err, "Could not write to destination %s, aborting.", destImpl)
+		if err := identity.VerifyWrite(dest); err != nil {
+			return trace.Wrap(err, "testing output destination: %s", output)
 		}
 
-		routedIdentity, unroutedIdentity, err := b.generateImpersonatedIdentity(ctx, dest, defaultRoles)
+		impersonatedIdentity, impersonatedClient, err := b.generateImpersonatedIdentity(
+			ctx, client, botIdentity, output, defaultRoles,
+		)
 		if err != nil {
-			return trace.Wrap(err, "Failed to generate impersonated certs for %s: %+v", destImpl, err)
+			return trace.Wrap(err, "generating impersonated certs for output: %s", output)
 		}
-
-		impersonatedIdentStr, err := describeTLSIdentity(routedIdentity)
-		if err != nil {
-			return trace.Wrap(err, "could not describe impersonated certs for destination %s", destImpl)
+		defer impersonatedClient.Close()
+
+		b.log.WithFields(logrus.Fields{
+			"identity": describeTLSIdentity(b.log, impersonatedIdentity),
+			"output":   output,
+		}).Debug("Fetched identity for output.")
+
+		// Create a destination provider to bundle up all the dependencies that
+		// a destination template might need to render.
+		dp := &outputProvider{
+			outputRenewalCache: drc,
+			impersonatedClient: impersonatedClient,
 		}
 
-		b.log.Infof("Successfully renewed impersonated certificates for %s, %s", destImpl, impersonatedIdentStr)
-
-		if err := identity.SaveIdentity(routedIdentity, destImpl, identity.DestinationKinds()...); err != nil {
-			return trace.Wrap(err, "failed to save impersonated identity to destination %s", destImpl)
+		if err := output.Render(ctx, dp, impersonatedIdentity); err != nil {
+			b.log.WithError(err).Warnf("Failed to render output %s", output)
+			return trace.Wrap(err, "rendering output: %s", output)
 		}
 
-		for _, templateConfig := range dest.Configs {
-			template, err := templateConfig.GetConfigTemplate()
-			if err != nil {
-				return trace.Wrap(err)
-			}
-
-			if err := template.Render(ctx, b, routedIdentity, unroutedIdentity, dest); err != nil {
-				b.log.WithError(err).Warnf("Failed to render config template %+v", templateConfig)
-			}
-		}
+		b.log.WithFields(logrus.Fields{
+			"output": output,
+		}).Info("Generated output.")
 	}
 
-	// Purge the CA cache. We could be smarter about this in the future if
-	// desired, since generally CAs don't change that often.
-	b.clearCertAuthorities()
 	return nil
 }
 
-const renewalRetryLimit = 5
+// outputRenewalCache is used to cache information during a renewal to pass
+// to outputs. This prevents them all hammering the auth server with
+// requests for the same information. This is shared between all of the
+// outputs.
+type outputRenewalCache struct {
+	client auth.ClientI
+
+	cfg *config.BotConfig
+	mu  sync.Mutex
+	// These are protected by getter/setters with mutex locks
+	_cas       map[types.CertAuthType][]types.CertAuthority
+	_authPong  *proto.PingResponse
+	_proxyPong *webclient.PingResponse
+}
 
-func (b *Bot) renewLoop(ctx context.Context) error {
-	// TODO: validate that bot certificates are valid before attempting renewal
+func (drc *outputRenewalCache) getCertAuthorities(
+	ctx context.Context, caType types.CertAuthType,
+) ([]types.CertAuthority, error) {
+	if cas := drc._cas[caType]; len(cas) > 0 {
+		return cas, nil
+	}
 
-	b.log.Infof(
-		"Beginning renewal loop: ttl=%s interval=%s",
-		b.cfg.CertificateTTL,
-		b.cfg.RenewalInterval,
-	)
-	if b.cfg.RenewalInterval > b.cfg.CertificateTTL {
-		b.log.Errorf(
-			"Certificate TTL (%s) is shorter than the renewal interval (%s). The next renewal is likely to fail.",
-			b.cfg.CertificateTTL,
-			b.cfg.RenewalInterval,
-		)
+	cas, err := drc.client.GetCertAuthorities(ctx, caType, false)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if drc._cas == nil {
+		drc._cas = map[types.CertAuthType][]types.CertAuthority{}
+	}
+	drc._cas[caType] = cas
+	return cas, nil
+}
+
+// GetCertAuthorities returns the possibly cached CAs of the given type and
+// requests them from the server if unavailable.
+func (drc *outputRenewalCache) GetCertAuthorities(
+	ctx context.Context, caType types.CertAuthType,
+) ([]types.CertAuthority, error) {
+	drc.mu.Lock()
+	defer drc.mu.Unlock()
+	return drc.getCertAuthorities(ctx, caType)
+}
+
+func (drc *outputRenewalCache) authPing(ctx context.Context) (*proto.PingResponse, error) {
+	if drc._authPong != nil {
+		return drc._authPong, nil
 	}
 
-	// Determine where the bot should write its internal data (renewable cert
-	// etc)
-	botDestination, err := b.cfg.Storage.GetDestination()
+	pong, err := drc.client.Ping(ctx)
 	if err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
+	drc._authPong = &pong
 
-	ticker := time.NewTicker(b.cfg.RenewalInterval)
-	jitter := retryutils.NewJitter()
-	defer ticker.Stop()
-	for {
-		var err error
-		for attempt := 1; attempt <= renewalRetryLimit; attempt++ {
-			err = b.renew(ctx, botDestination)
-			if err == nil {
-				break
-			}
+	return &pong, nil
+}
 
-			if attempt != renewalRetryLimit {
-				// exponentially back off with jitter, starting at 1 second.
-				backoffTime := time.Second * time.Duration(math.Pow(2, float64(attempt-1)))
-				backoffTime = jitter(backoffTime)
-				b.log.WithError(err).Warnf(
-					"Renewal attempt %d of %d failed. Retrying after %s.",
-					attempt,
-					renewalRetryLimit,
-					backoffTime,
-				)
-				select {
-				case <-ctx.Done():
-					return nil
-				case <-time.After(backoffTime):
-				}
-			}
-		}
-		if err != nil {
-			b.log.Warnf("All %d retry attempts exhausted.", renewalRetryLimit)
-			return trace.Wrap(err)
-		}
+// AuthPing pings the auth server and returns the (possibly cached) response.
+func (drc *outputRenewalCache) AuthPing(ctx context.Context) (*proto.PingResponse, error) {
+	drc.mu.Lock()
+	defer drc.mu.Unlock()
+	return drc.authPing(ctx)
+}
 
-		if b.cfg.Oneshot {
-			b.log.Info("Persisted certificates successfully. One-shot mode enabled so exiting.")
-			break
-		}
-		b.log.Infof("Persisted certificates successfully. Next renewal in approximately %s.", b.cfg.RenewalInterval)
+func (drc *outputRenewalCache) proxyPing(ctx context.Context) (*webclient.PingResponse, error) {
+	if drc._proxyPong != nil {
+		return drc._proxyPong, nil
+	}
 
-		select {
-		case <-ctx.Done():
-			return nil
-		case <-ticker.C:
-			continue
-		case <-b.reloadChan:
-			continue
-		}
+	// Note: this relies on the auth server's proxy address. We could
+	// potentially support some manual parameter here in the future if desired.
+	authPong, err := drc.authPing(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
 
-	return nil
+	proxyPong, err := webclient.Ping(&webclient.Config{
+		Context:   ctx,
+		ProxyAddr: authPong.ProxyPublicAddr,
+		Insecure:  drc.cfg.Insecure,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	drc._proxyPong = proxyPong
+
+	return proxyPong, nil
+}
+
+// ProxyPing returns a (possibly cached) ping response from the Teleport proxy.
+// Note that it relies on the auth server being configured with a sane proxy
+// public address.
+func (drc *outputRenewalCache) ProxyPing(ctx context.Context) (*webclient.PingResponse, error) {
+	drc.mu.Lock()
+	defer drc.mu.Unlock()
+	return drc.proxyPing(ctx)
+}
+
+// Config returns the bots config.
+func (op *outputRenewalCache) Config() *config.BotConfig {
+	return op.cfg
+}
+
+// outputProvider bundles the dependencies an output needs in order to render.
+// It provides a handy point for controlling what templates are allowed to call
+// and how they are allowed to call them. This makes ensuring that they call
+// RPCs with the correct identity much easier.
+type outputProvider struct {
+	// we embed the cache shared across all outputs to provide access to
+	// non-identity specific methods like `AuthPing`.
+	*outputRenewalCache
+	// impersonatedClient is a client using the impersonated identity configured
+	// for that output.
+	impersonatedClient auth.ClientI
+}
+
+// GetRemoteClusters uses the impersonatedClient to call GetRemoteClusters.
+func (op *outputProvider) GetRemoteClusters(opts ...services.MarshalOption) ([]types.RemoteCluster, error) {
+	return op.impersonatedClient.GetRemoteClusters(opts...)
+}
+
+// GenerateHostCert uses the impersonatedClient to call GenerateHostCert.
+func (op *outputProvider) GenerateHostCert(ctx context.Context, key []byte, hostID, nodeName string, principals []string, clusterName string, role types.SystemRole, ttl time.Duration) ([]byte, error) {
+	return op.impersonatedClient.GenerateHostCert(ctx, key, hostID, nodeName, principals, clusterName, role, ttl)
+}
+
+// GetCertAuthority uses the impersonatedClient to call GetCertAuthority.
+func (op *outputProvider) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool) (types.CertAuthority, error) {
+	return op.impersonatedClient.GetCertAuthority(ctx, id, loadKeys)
 }
diff --git a/lib/tbot/renew_test.go b/lib/tbot/renew_test.go
deleted file mode 100644
index e84e8f40f3ee6..0000000000000
--- a/lib/tbot/renew_test.go
+++ /dev/null
@@ -1,240 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package tbot
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/utils"
-	libconfig "github.com/gravitational/teleport/lib/config"
-	"github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/testhelpers"
-	"github.com/gravitational/teleport/lib/tlsca"
-	libutils "github.com/gravitational/teleport/lib/utils"
-)
-
-// TestOnboardViaToken ensures a bot can join using token auth.
-func TestOnboardViaToken(t *testing.T) {
-	t.Parallel()
-
-	log := libutils.NewLoggerForTests()
-
-	// Make a new auth server.
-	fc, fds := testhelpers.DefaultConfig(t)
-	_ = testhelpers.MakeAndRunTestAuthServer(t, log, fc, fds)
-	rootClient := testhelpers.MakeDefaultAuthClient(t, log, fc)
-
-	// Make and join a new bot instance.
-	const roleName = "dummy-role"
-	role, err := types.NewRole(roleName, types.RoleSpecV6{})
-	require.NoError(t, err)
-	require.NoError(t, rootClient.UpsertRole(context.Background(), role))
-
-	botParams := testhelpers.MakeBot(t, rootClient, "test", roleName)
-	botConfig := testhelpers.MakeMemoryBotConfig(t, fc, botParams)
-	b := New(botConfig, log, nil)
-	ident, err := b.getIdentityFromToken()
-	require.NoError(t, err)
-
-	tlsIdent, err := tlsca.FromSubject(ident.X509Cert.Subject, ident.X509Cert.NotAfter)
-	require.NoError(t, err)
-
-	require.True(t, tlsIdent.Renewable)
-	require.False(t, tlsIdent.DisallowReissue)
-	require.Equal(t, uint64(1), tlsIdent.Generation)
-	require.ElementsMatch(t, []string{botParams.RoleName}, tlsIdent.Groups)
-
-	// Make sure the bot identity actually works.
-	botClient := testhelpers.MakeBotAuthClient(t, fc, ident)
-	_, err = botClient.GetClusterName()
-	require.NoError(t, err)
-}
-
-func TestDatabaseRequest(t *testing.T) {
-	t.Parallel()
-
-	log := libutils.NewLoggerForTests()
-	// Make a new auth server.
-	fc, fds := testhelpers.DefaultConfig(t)
-	fc.Databases.Databases = []*libconfig.Database{
-		{
-			Name:     "foo",
-			Protocol: "mysql",
-			URI:      "foo.example.com:1234",
-			StaticLabels: map[string]string{
-				"env": "dev",
-			},
-		},
-	}
-	_ = testhelpers.MakeAndRunTestAuthServer(t, log, fc, fds)
-	rootClient := testhelpers.MakeDefaultAuthClient(t, log, fc)
-
-	// Wait for the database to become available. Sometimes this takes a bit
-	// of time in CI.
-	for i := 0; i < 10; i++ {
-		_, err := getDatabase(context.Background(), rootClient, "foo")
-		if err == nil {
-			break
-		} else if !trace.IsNotFound(err) {
-			require.NoError(t, err)
-		}
-
-		if i >= 9 {
-			t.Fatalf("database never became available")
-		}
-
-		t.Logf("Database not yet available, waiting...")
-		time.Sleep(time.Second * 1)
-	}
-
-	// Note: we don't actually need a role granting us database access to
-	// request it. Actual access is validated via RBAC at connection time.
-	// We do need an actual database and permission to list them, however.
-
-	// Create a role to grant access to the database.
-	const roleName = "db-role"
-	role, err := types.NewRole(roleName, types.RoleSpecV6{
-		Allow: types.RoleConditions{
-			DatabaseLabels: types.Labels{
-				"*": utils.Strings{"*"},
-			},
-			DatabaseNames: []string{"bar"},
-			DatabaseUsers: []string{"baz"},
-			Rules: []types.Rule{
-				types.NewRule("db_server", []string{"read", "list"}),
-			},
-		},
-	})
-	require.NoError(t, err)
-
-	require.NoError(t, rootClient.UpsertRole(context.Background(), role))
-
-	// Make and join a new bot instance.
-	botParams := testhelpers.MakeBot(t, rootClient, "test", roleName)
-	botConfig := testhelpers.MakeMemoryBotConfig(t, fc, botParams)
-
-	dest := botConfig.Destinations[0]
-	dest.Database = &config.Database{
-		Service:  "foo",
-		Database: "bar",
-		Username: "baz",
-	}
-
-	// Onboard the bot.
-	b := New(botConfig, log, nil)
-	ident, err := b.getIdentityFromToken()
-	require.NoError(t, err)
-
-	b._client = testhelpers.MakeBotAuthClient(t, fc, ident)
-	b._ident = ident
-
-	impersonatedIdent, _, err := b.generateImpersonatedIdentity(
-		context.Background(), dest, []string{roleName},
-	)
-	require.NoError(t, err)
-
-	tlsIdent, err := tlsca.FromSubject(impersonatedIdent.X509Cert.Subject, impersonatedIdent.X509Cert.NotAfter)
-	require.NoError(t, err)
-
-	route := tlsIdent.RouteToDatabase
-
-	require.Equal(t, "foo", route.ServiceName)
-	require.Equal(t, "bar", route.Database)
-	require.Equal(t, "baz", route.Username)
-	require.Equal(t, "mysql", route.Protocol)
-}
-
-func TestAppRequest(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-
-	const appName = "foo"
-	log := libutils.NewLoggerForTests()
-	// Make a new auth server.
-	fc, fds := testhelpers.DefaultConfig(t)
-	fc.Apps.Service = libconfig.Service{
-		EnabledFlag: "true",
-	}
-	fc.Apps.Apps = []*libconfig.App{
-		{
-			Name:       appName,
-			PublicAddr: "foo.example.com",
-			URI:        "http://foo.example.com:1234",
-			StaticLabels: map[string]string{
-				"env": "dev",
-			},
-		},
-	}
-	_ = testhelpers.MakeAndRunTestAuthServer(t, log, fc, fds)
-	rootClient := testhelpers.MakeDefaultAuthClient(t, log, fc)
-
-	// Wait for the app to become available. Sometimes this takes a bit
-	// of time in CI.
-	require.Eventually(t, func() bool {
-		_, err := getApp(ctx, rootClient, appName)
-		return err == nil
-	}, 10*time.Second, 100*time.Millisecond)
-
-	// Create a role to grant access to the app.
-	const roleName = "app-role"
-	role, err := types.NewRole(roleName, types.RoleSpecV6{
-		Allow: types.RoleConditions{
-			AppLabels: types.Labels{
-				"env": utils.Strings{"dev"},
-			},
-		},
-	})
-	require.NoError(t, err)
-
-	require.NoError(t, rootClient.UpsertRole(ctx, role))
-
-	// Make and join a new bot instance.
-	botParams := testhelpers.MakeBot(t, rootClient, "test", roleName)
-	botConfig := testhelpers.MakeMemoryBotConfig(t, fc, botParams)
-
-	dest := botConfig.Destinations[0]
-	dest.App = &config.App{
-		App: appName,
-	}
-
-	// Onboard the bot.
-	b := New(botConfig, log, nil)
-	ident, err := b.getIdentityFromToken()
-	require.NoError(t, err)
-
-	b._client = testhelpers.MakeBotAuthClient(t, fc, ident)
-	b._ident = ident
-
-	impersonatedIdent, _, err := b.generateImpersonatedIdentity(
-		ctx, dest, []string{roleName},
-	)
-	require.NoError(t, err)
-
-	tlsIdent, err := tlsca.FromSubject(impersonatedIdent.X509Cert.Subject, impersonatedIdent.X509Cert.NotAfter)
-	require.NoError(t, err)
-
-	route := tlsIdent.RouteToApp
-	require.Equal(t, appName, route.Name)
-	require.Equal(t, "foo.example.com", route.PublicAddr)
-	require.NotEmpty(t, route.SessionID)
-}
diff --git a/lib/tbot/tbot.go b/lib/tbot/tbot.go
index 541f88752b64a..c21355c7db3b1 100644
--- a/lib/tbot/tbot.go
+++ b/lib/tbot/tbot.go
@@ -28,75 +28,43 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sync/errgroup"
 
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/teleport/api/client/webclient"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/tbot/bot"
 	"github.com/gravitational/teleport/lib/tbot/config"
 	"github.com/gravitational/teleport/lib/tbot/identity"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
 type Bot struct {
-	cfg        *config.BotConfig
-	log        logrus.FieldLogger
-	reloadChan chan struct{}
-	modules    modules.Modules
+	cfg     *config.BotConfig
+	log     logrus.FieldLogger
+	modules modules.Modules
 
 	// These are protected by getter/setters with mutex locks
-	mu         sync.Mutex
-	_client    auth.ClientI
-	_ident     *identity.Identity
-	_authPong  *proto.PingResponse
-	_proxyPong *webclient.PingResponse
-	_cas       map[types.CertAuthType][]types.CertAuthority
-	started    bool
+	mu      sync.Mutex
+	_ident  *identity.Identity
+	started bool
 }
 
-func New(cfg *config.BotConfig, log logrus.FieldLogger, reloadChan chan struct{}) *Bot {
+func New(cfg *config.BotConfig, log logrus.FieldLogger) *Bot {
 	if log == nil {
 		log = utils.NewLogger()
 	}
 
 	return &Bot{
-		cfg:        cfg,
-		log:        log,
-		reloadChan: reloadChan,
-		modules:    modules.GetModules(),
-
-		_cas: map[types.CertAuthType][]types.CertAuthority{},
+		cfg:     cfg,
+		log:     log,
+		modules: modules.GetModules(),
 	}
 }
 
-// Config returns the current bot config
-func (b *Bot) Config() *config.BotConfig {
-	return b.cfg
-}
-
-// Client retrieves the current auth client.
-func (b *Bot) Client() auth.ClientI {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	return b._client
-}
-
-func (b *Bot) setClient(client auth.ClientI) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	// Make sure the previous client is closed.
-	if b._client != nil {
-		_ = b._client.Close()
-	}
-
-	b._client = client
-}
-
 func (b *Bot) ident() *identity.Identity {
 	b.mu.Lock()
 	defer b.mu.Unlock()
@@ -123,108 +91,6 @@ func (b *Bot) markStarted() error {
 	return nil
 }
 
-// certAuthorities returns cached CAs of the given type.
-func (b *Bot) certAuthorities(caType types.CertAuthType) []types.CertAuthority {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	return b._cas[caType]
-}
-
-// clearCertAuthorities purges the CA cache. This should be run at least as
-// frequently as CAs are rotated.
-func (b *Bot) clearCertAuthorities() {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	b._cas = map[types.CertAuthType][]types.CertAuthority{}
-}
-
-// GetCertAuthorities returns the possibly cached CAs of the given type and
-// requests them from the server if unavailable.
-func (b *Bot) GetCertAuthorities(ctx context.Context, caType types.CertAuthType) ([]types.CertAuthority, error) {
-	if cas := b.certAuthorities(caType); len(cas) > 0 {
-		return cas, nil
-	}
-
-	cas, err := b.Client().GetCertAuthorities(ctx, caType, false)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	b._cas[caType] = cas
-	return cas, nil
-}
-
-// authPong returns the last ping response from the auth server. It may be nil
-// if no ping has succeeded.
-func (b *Bot) authPong() *proto.PingResponse {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	return b._authPong
-}
-
-// AuthPing pings the auth server and returns the (possibly cached) response.
-func (b *Bot) AuthPing(ctx context.Context) (*proto.PingResponse, error) {
-	if authPong := b.authPong(); authPong != nil {
-		return authPong, nil
-	}
-
-	pong, err := b.Client().Ping(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	b._authPong = &pong
-
-	return &pong, nil
-}
-
-// proxyPong returns the last proxy ping response. It may be nil if no proxy
-// ping has succeeded.
-func (b *Bot) proxyPong() *webclient.PingResponse {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	return b._proxyPong
-}
-
-// ProxyPing returns a (possibly cached) ping response from the Teleport proxy.
-// Note that it relies on the auth server being configured with a sane proxy
-// public address.
-func (b *Bot) ProxyPing(ctx context.Context) (*webclient.PingResponse, error) {
-	if proxyPong := b.proxyPong(); proxyPong != nil {
-		return proxyPong, nil
-	}
-
-	// Note: this relies on the auth server's proxy address. We could
-	// potentially support some manual parameter here in the future if desired.
-	authPong, err := b.AuthPing(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	proxyPong, err := webclient.Ping(&webclient.Config{
-		Context:   ctx,
-		ProxyAddr: authPong.ProxyPublicAddr,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	b._proxyPong = proxyPong
-
-	return proxyPong, nil
-}
-
 func (b *Bot) Run(ctx context.Context) error {
 	if err := b.markStarted(); err != nil {
 		return trace.Wrap(err)
@@ -242,34 +108,77 @@ func (b *Bot) Run(ctx context.Context) error {
 		return trace.Wrap(err)
 	}
 
-	// Maintain a context that we can cancel if the bot is running in one shot.
-	ctx, cancel := context.WithCancel(ctx)
+	// One-shot mode just invokes the output of credentials to the destinations.
+	// There's no retry logic here - this means we fail fast in the most common
+	// oneshot use-cases like CI-CD where backing off over several minutes on
+	// failure will just cost the customer money.
+	if b.cfg.Oneshot {
+		b.log.Info("One-shot mode enabled. Generating outputs.")
+		if err := b.renewOutputs(ctx); err != nil {
+			return trace.Wrap(err)
+		}
+
+		b.log.Info("Generated outputs. One-shot mode is enabled so exiting.")
+		return nil
+	}
+
+	// Warn about weird non-oneshot configuration.
+	if b.cfg.RenewalInterval > b.cfg.CertificateTTL {
+		b.log.Errorf(
+			"Certificate TTL (%s) is shorter than the renewal interval (%s). This is likely an invalid configuration. Increase the certificate TTL or decrease the renewal interval.",
+			b.cfg.CertificateTTL,
+			b.cfg.RenewalInterval,
+		)
+	}
+
+	reloadBroadcast := channelBroadcaster{
+		chanSet: map[chan struct{}]struct{}{},
+	}
+
+	// If in daemon mode, we spin up all of our separate concurrent components.
 	eg, egCtx := errgroup.WithContext(ctx)
 	eg.Go(func() error {
-		return trace.Wrap(b.caRotationLoop(egCtx))
+		return trace.Wrap(b.caRotationLoop(egCtx, reloadBroadcast.broadcast))
 	})
 	eg.Go(func() error {
-		err := b.renewLoop(egCtx)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		// If `renewLoop` exits with nil, the bot is running in "one-shot", so
-		// we should indicate to other long-running processes that they can
-		// finish up.
-		cancel()
-		return nil
+		reloadCh, unsubscribe := reloadBroadcast.subscribe()
+		defer unsubscribe()
+		return trace.Wrap(b.renewBotIdentityLoop(egCtx, reloadCh))
 	})
-	if b.cfg.Debug && b.cfg.DiagAddr != "" {
+	eg.Go(func() error {
+		reloadCh, unsubscribe := reloadBroadcast.subscribe()
+		defer unsubscribe()
+		return trace.Wrap(b.renewOutputsLoop(egCtx, reloadCh))
+	})
+	if b.cfg.ReloadCh != nil {
+		eg.Go(func() error {
+			for {
+				select {
+				case <-egCtx.Done():
+					return nil
+				case <-b.cfg.ReloadCh:
+					reloadBroadcast.broadcast()
+				}
+			}
+		})
+	}
+
+	if b.cfg.DiagAddr != "" {
 		eg.Go(func() error {
 			b.log.WithField("addr", b.cfg.DiagAddr).Info(
-				"DiagAddr configured, diagnostics service will be started.",
+				"diag_addr configured, diagnostics service will be started.",
 			)
 			mux := http.NewServeMux()
-			mux.HandleFunc("/debug/pprof/", pprof.Index)
-			mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
-			mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
-			mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
-			mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+			mux.Handle("/metrics", promhttp.Handler())
+			// Only expose pprof when `-d` is provided.
+			if b.cfg.Debug {
+				b.log.Info("debug mode enabled, profiling endpoints will be served on the diagnostics service.")
+				mux.HandleFunc("/debug/pprof/", pprof.Index)
+				mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
+				mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
+				mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+				mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+			}
 			mux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				w.WriteHeader(http.StatusNotFound)
 				msg := "404 - Not Found\n\nI'm a little tbot,\nshort and stout,\nthe page you seek,\nis not about."
@@ -302,6 +211,10 @@ func (b *Bot) initialize(ctx context.Context) (func() error, error) {
 			"an auth or proxy server must be set via --auth-server or configuration",
 		)
 	}
+	// Ensure they have provided a join method.
+	if b.cfg.Onboarding.JoinMethod == types.JoinMethodUnspecified {
+		return nil, trace.BadParameter("join method must be provided")
+	}
 
 	if b.cfg.FIPS {
 		if !b.modules.IsBoringBinary() {
@@ -316,16 +229,15 @@ func (b *Bot) initialize(ctx context.Context) (func() error, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	// Start by loading the bot's primary destination.
-	dest, err := b.cfg.Storage.GetDestination()
-	if err != nil {
+	// Start by loading the bot's primary storage.
+	store := b.cfg.Storage.Destination
+	if err := identity.VerifyWrite(store); err != nil {
 		return nil, trace.Wrap(
-			err, "could not read bot storage destination from config",
+			err, "Could not write to destination %s, aborting.", store,
 		)
 	}
-
 	// Now attempt to lock the destination so we have sole use of it
-	unlock, err := dest.TryLock()
+	unlock, err := store.TryLock()
 	if err != nil {
 		if errors.Is(err, utils.ErrUnsuccessfulLockTry) {
 			return unlock, trace.WrapWithMessage(err, "Failed to acquire exclusive lock for tbot destination directory - is tbot already running?")
@@ -333,108 +245,114 @@ func (b *Bot) initialize(ctx context.Context) (func() error, error) {
 		return unlock, trace.Wrap(err)
 	}
 
-	var authClient auth.ClientI
-
-	fetchNewIdentity := true
-	// First, attempt to load an identity from storage.
-	ident, err := identity.LoadIdentity(dest, identity.BotKinds()...)
-	if err == nil {
-		if b.cfg.Onboarding != nil && b.cfg.Onboarding.HasToken() {
-			// try to grab the token to see if it's changed, as we'll need to fetch a new identity if it has
-			if token, err := b.cfg.Onboarding.Token(); err == nil {
-				sha := sha256.Sum256([]byte(token))
-				configTokenHashBytes := []byte(hex.EncodeToString(sha[:]))
-
-				fetchNewIdentity = hasTokenChanged(ident.TokenHashBytes, configTokenHashBytes)
-			} else {
-				// we failed to get the token, we'll continue on trying to use the existing identity
-				b.log.WithError(err).Error("There was an error loading the token")
-
-				fetchNewIdentity = false
-
-				b.log.Info("Using the last good identity")
-			}
-		}
-
-		if !fetchNewIdentity {
-			identStr, err := describeTLSIdentity(ident)
-			if err != nil {
-				return unlock, trace.Wrap(err)
-			}
-
-			b.log.Infof("Successfully loaded bot identity, %s", identStr)
-
-			if err := b.checkIdentity(ident); err != nil {
-				return unlock, trace.Wrap(err)
-			}
-
-			if b.cfg.Onboarding != nil {
-				b.log.Warn("Note: onboarding config ignored as identity was loaded from persistent storage")
-			}
-
-			authClient, err = b.AuthenticatedUserClientFromIdentity(ctx, ident)
-			if err != nil {
-				return unlock, trace.Wrap(err)
-			}
+	b.log.Info("Initializing bot identity.")
+	var loadedIdent *identity.Identity
+	if b.cfg.Onboarding.RenewableJoinMethod() {
+		// Nil, nil will be returned if no identity can be found in store or
+		// the identity in the store is no longer relevant.
+		loadedIdent, err = b.loadIdentityFromStore(store)
+		if err != nil {
+			return unlock, trace.Wrap(err)
 		}
 	}
 
-	if fetchNewIdentity {
-		if ident != nil {
-			// If ident is set here, we detected a token change above.
-			b.log.Warnf("Detected a token change, will attempt to fetch a new identity.")
-		} else if trace.IsNotFound(err) {
-			// This is _probably_ a fresh start, so we'll log the true error
-			// and try to fetch a fresh identity.
-			b.log.Debugf("Identity %s is not found or empty and could not be loaded, will start from scratch: %+v", dest, err)
-		} else {
+	var newIdentity *identity.Identity
+	if b.cfg.Onboarding.RenewableJoinMethod() && loadedIdent != nil {
+		// If using a renewable join method and we loaded an identity, let's
+		// immediately renew it so we know that after initialisation we have the
+		// full certificate TTL.
+		if err := b.checkIdentity(loadedIdent); err != nil {
 			return unlock, trace.Wrap(err)
 		}
-
-		// Verify we can write to the destination.
-		if err := identity.VerifyWrite(dest); err != nil {
-			return unlock, trace.Wrap(
-				err, "Could not write to destination %s, aborting.", dest,
-			)
-		}
-
-		// Get first identity
-		ident, err = b.getIdentityFromToken()
+		authClient, err := b.AuthenticatedUserClientFromIdentity(ctx, loadedIdent)
 		if err != nil {
 			return unlock, trace.Wrap(err)
 		}
-
-		b.log.Debug("Attempting first connection using initial auth client")
-		authClient, err = b.AuthenticatedUserClientFromIdentity(ctx, ident)
+		defer authClient.Close()
+		newIdentity, err = botIdentityFromAuth(
+			ctx, b.log, loadedIdent, authClient, b.cfg.CertificateTTL,
+		)
 		if err != nil {
 			return unlock, trace.Wrap(err)
 		}
-
-		// Attempt a request to make sure our client works.
-		if _, err := authClient.Ping(ctx); err != nil {
-			return unlock, trace.Wrap(err, "unable to communicate with auth server")
-		}
-
-		identStr, err := describeTLSIdentity(ident)
+	} else if b.cfg.Onboarding.HasToken() {
+		// If using a non-renewable join method, or we weren't able to load an
+		// identity from the store, let's get a new identity using the
+		// configured token.
+		newIdentity, err = botIdentityFromToken(b.log, b.cfg)
 		if err != nil {
 			return unlock, trace.Wrap(err)
 		}
-		b.log.Infof("Successfully generated new bot identity, %s", identStr)
+	} else {
+		// There's no loaded identity to work with, and they've not configured
+		// a token to use to request an identity :(
+		return unlock, trace.BadParameter("no existing identity found on disk or join token configured")
+	}
 
-		b.log.Debugf("Storing new bot identity to %s", dest)
-		if err := identity.SaveIdentity(ident, dest, identity.BotKinds()...); err != nil {
-			return unlock, trace.Wrap(
-				err, "unable to save generated identity back to destination",
-			)
-		}
+	b.log.WithField("identity", describeTLSIdentity(b.log, newIdentity)).Info("Fetched new bot identity.")
+	if err := identity.SaveIdentity(newIdentity, store, identity.BotKinds()...); err != nil {
+		return unlock, trace.Wrap(err)
 	}
 
-	b.setClient(authClient)
-	b.setIdent(ident)
+	testClient, err := b.AuthenticatedUserClientFromIdentity(ctx, newIdentity)
+	if err != nil {
+		return unlock, trace.Wrap(err)
+	}
+	defer testClient.Close()
+
+	b.setIdent(newIdentity)
+
+	// Attempt a request to make sure our client works so we can exit early if
+	// we are in a bad state.
+	if _, err := testClient.Ping(ctx); err != nil {
+		return unlock, trace.Wrap(err, "unable to communicate with auth server")
+	}
+	b.log.Info("Bot initialization complete.")
 
 	return unlock, nil
 }
 
+// loadIdentityFromStore attempts to load a persisted identity from a store.
+// It checks this loaded identity against the configured onboarding profile
+// and ignores the loaded identity if there has been a configuration change.
+func (b *Bot) loadIdentityFromStore(store bot.Destination) (*identity.Identity, error) {
+	b.log.WithField("store", store).Info("Loading existing bot identity from store.")
+	loadedIdent, err := identity.LoadIdentity(store, identity.BotKinds()...)
+	if err != nil {
+		if trace.IsNotFound(err) {
+			b.log.Info("No existing bot identity found in store. Bot will join using configured token.")
+			return nil, nil
+		} else {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	// Determine if the token configured in the onboarding matches the
+	// one used to produce the credentials loaded from disk.
+	if b.cfg.Onboarding.HasToken() {
+		if token, err := b.cfg.Onboarding.Token(); err == nil {
+			sha := sha256.Sum256([]byte(token))
+			configTokenHashBytes := []byte(hex.EncodeToString(sha[:]))
+			if hasTokenChanged(loadedIdent.TokenHashBytes, configTokenHashBytes) {
+				b.log.Info("Bot identity loaded from store does not match configured token. Bot will fetch identity using configured token.")
+				// If the token has changed, do not return the loaded
+				// identity.
+				return nil, nil
+			}
+		} else {
+			// we failed to get the newly configured token to compare to,
+			// we'll assume the last good credentials written to disk should
+			// still be used.
+			b.log.
+				WithError(err).
+				Error("There was an error loading the configured token. Bot identity loaded from store will be tried.")
+		}
+	}
+	b.log.WithField("identity", describeTLSIdentity(b.log, loadedIdent)).Info("Loaded existing bot identity from store.")
+
+	return loadedIdent, nil
+}
+
 func hasTokenChanged(configTokenBytes, identityBytes []byte) bool {
 	if len(configTokenBytes) == 0 || len(identityBytes) == 0 {
 		return false
@@ -451,30 +369,16 @@ func checkDestinations(cfg *config.BotConfig) error {
 	//  - if the destination was properly created via tbot init this is a no-op
 	//  - if users intend to follow that advice but miss a step, it should fail
 	//    due to lack of permissions
-	storage, err := cfg.Storage.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// TODO: consider warning if ownership of all destintions is not expected.
+	storageDest := cfg.Storage.Destination
 
 	// Note: no subdirs to init for bot's internal storage.
-	if err := storage.Init([]string{}); err != nil {
+	if err := storageDest.Init([]string{}); err != nil {
 		return trace.Wrap(err)
 	}
 
-	for _, dest := range cfg.Destinations {
-		destImpl, err := dest.GetDestination()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		subdirs, err := dest.ListSubdirectories()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		if err := destImpl.Init(subdirs); err != nil {
+	// TODO: consider warning if ownership of all destintions is not expected.
+	for _, output := range cfg.Outputs {
+		if err := output.Init(); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -515,3 +419,38 @@ func (b *Bot) checkIdentity(ident *identity.Identity) error {
 
 	return nil
 }
+
+// AuthenticatedUserClientFromIdentity creates a new auth client from the given
+// identity. Note that depending on the connection address given, this may
+// attempt to connect via the proxy and therefore requires both SSH and TLS
+// credentials.
+func (b *Bot) AuthenticatedUserClientFromIdentity(ctx context.Context, id *identity.Identity) (auth.ClientI, error) {
+	if id.SSHCert == nil || id.X509Cert == nil {
+		return nil, trace.BadParameter("auth client requires a fully formed identity")
+	}
+
+	tlsConfig, err := id.TLSConfig(b.cfg.CipherSuites())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	sshConfig, err := id.SSHClientConfig(b.cfg.FIPS)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	authAddr, err := utils.ParseAddr(b.cfg.AuthServer)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	authClientConfig := &authclient.Config{
+		TLS:         tlsConfig,
+		SSH:         sshConfig,
+		AuthServers: []utils.NetAddr{*authAddr},
+		Log:         b.log,
+	}
+
+	c, err := authclient.Connect(ctx, authClientConfig)
+	return c, trace.Wrap(err)
+}
diff --git a/lib/tbot/tbot_test.go b/lib/tbot/tbot_test.go
index d805e130a64b1..a087bc0b625ac 100644
--- a/lib/tbot/tbot_test.go
+++ b/lib/tbot/tbot_test.go
@@ -17,23 +17,27 @@ limitations under the License.
 package tbot
 
 import (
+	"bytes"
 	"context"
+	"crypto/rand"
+	"fmt"
 	"os"
-	"sync"
 	"testing"
-	"time"
 
-	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
+	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/auth/native"
-	"github.com/gravitational/teleport/lib/cloud"
-	"github.com/gravitational/teleport/lib/config"
-	"github.com/gravitational/teleport/lib/service"
-	"github.com/gravitational/teleport/lib/service/servicecfg"
+	apisshutils "github.com/gravitational/teleport/lib/sshutils"
+	"github.com/gravitational/teleport/lib/tbot/bot"
+	"github.com/gravitational/teleport/lib/tbot/botfs"
+	"github.com/gravitational/teleport/lib/tbot/config"
+	"github.com/gravitational/teleport/lib/tbot/identity"
 	"github.com/gravitational/teleport/lib/tbot/testhelpers"
+	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -43,162 +47,350 @@ func TestMain(m *testing.M) {
 	os.Exit(m.Run())
 }
 
-func rotate( //nolint:unused // used in skipped test
-	ctx context.Context, t *testing.T, log logrus.FieldLogger, svc *service.TeleportProcess, phase string,
-) {
-	t.Helper()
-	log.Infof("Triggering rotation: %s", phase)
-	err := svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
-		// only rotate Host CA as to avoid race condition serverside when
-		// multiple CAs are rotated at once and the database closes off.
-		Type:        types.HostCA,
-		Mode:        "manual",
-		TargetPhase: phase,
+// TestBot is a one-shot run of the bot that communicates with a stood up
+// in memory auth server.
+//
+// This test suite should ensure that outputs result in credentials with the
+// expected attributes. The exact format of rendered templates is a concern
+// that should be tested at a lower level. Generally assume that the auth server
+// has good behavior (e.g is enforcing rbac correctly) and avoid testing cases
+// such as the bot not having a role granting access to a resource.
+func TestBot(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	log := utils.NewLoggerForTests()
+
+	// Make a new auth server.
+	fc, fds := testhelpers.DefaultConfig(t)
+	const (
+		fakeHostname        = "test-host"
+		fakeHostID          = "uuid"
+		appName             = "test-app"
+		databaseServiceName = "test-database-service"
+		databaseUsername    = "test-database-username"
+		databaseName        = "test-database"
+		kubeClusterName     = "test-kube-cluster"
+	)
+	clusterName := string(fc.Auth.ClusterName)
+	_ = testhelpers.MakeAndRunTestAuthServer(t, log, fc, fds)
+	rootClient := testhelpers.MakeDefaultAuthClient(t, log, fc)
+
+	// Register an application server so the bot can request certs for it.
+	app, err := types.NewAppV3(types.Metadata{
+		Name: appName,
+	}, types.AppSpecV3{
+		PublicAddr: "test-app.example.com",
+		URI:        "http://test-app.example.com:1234",
 	})
-	if err != nil {
-		log.WithError(err).Infof("Error occurred during triggering rotation: %s", phase)
-	}
 	require.NoError(t, err)
-	log.Infof("Triggered rotation: %s", phase)
-}
+	appServer, err := types.NewAppServerV3FromApp(app, fakeHostname, fakeHostID)
+	require.NoError(t, err)
+	_, err = rootClient.UpsertApplicationServer(ctx, appServer)
+	require.NoError(t, err)
+	// Register a database server so the bot can request certs for it.
+	db, err := types.NewDatabaseV3(types.Metadata{
+		Name: databaseServiceName,
+	}, types.DatabaseSpecV3{
+		Protocol: "mysql",
+		URI:      "example.com:1234",
+	})
+	require.NoError(t, err)
+	dbServer, err := types.NewDatabaseServerV3(types.Metadata{
+		Name: databaseServiceName,
+	}, types.DatabaseServerSpecV3{
+		HostID:   fakeHostID,
+		Hostname: fakeHostname,
+		Database: db,
+	})
+	require.NoError(t, err)
+	_, err = rootClient.UpsertDatabaseServer(ctx, dbServer)
+	require.NoError(t, err)
+	// Register a kubernetes server so the bot can request certs for it.
+	kubeCluster, err := types.NewKubernetesClusterV3(
+		types.Metadata{
+			Name: kubeClusterName,
+		},
+		types.KubernetesClusterSpecV3{},
+	)
+	require.NoError(t, err)
+	kubeServer, err := types.NewKubernetesServerV3FromCluster(kubeCluster, fakeHostname, fakeHostID)
+	require.NoError(t, err)
+	_, err = rootClient.UpsertKubernetesServer(ctx, kubeServer)
+	require.NoError(t, err)
 
-func setupServerForCARotationTest(ctx context.Context, log utils.Logger, t *testing.T, wg *sync.WaitGroup, //nolint:unused // used in skipped test
-) (auth.ClientI, func() *service.TeleportProcess, *config.FileConfig) {
-	fc, fds := testhelpers.DefaultConfig(t)
+	// Fetch CAs from auth server to compare to artifacts later
+	hostCA, err := rootClient.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.HostCA,
+		DomainName: clusterName,
+	}, false)
+	require.NoError(t, err)
+	userCA, err := rootClient.GetCertAuthority(ctx, types.CertAuthID{
+		Type:       types.UserCA,
+		DomainName: clusterName,
+	}, false)
+	require.NoError(t, err)
 
-	cfg := servicecfg.MakeDefaultConfig()
-	require.NoError(t, config.ApplyFileConfig(fc, cfg))
-	cfg.FileDescriptors = fds
-	cfg.Log = log
-	cfg.CachePolicy.Enabled = false
-	cfg.Proxy.DisableWebInterface = true
-	cfg.InstanceMetadataClient = cloud.NewDisabledIMDSClient()
-
-	svcC := make(chan *service.TeleportProcess)
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		err := service.Run(ctx, *cfg, func(cfg *servicecfg.Config) (service.Process, error) {
-			svc, err := service.NewTeleport(cfg)
-			if err == nil {
-				svcC <- svc
-			}
-			return svc, err
-		})
-		require.NoError(t, err)
-	}()
-
-	var svc *service.TeleportProcess
-	select {
-	case <-time.After(30 * time.Second):
-		// this should really happen quite quickly, but under the load during
-		// parallel test run, it can take a while.
-		t.Fatal("teleport process did not instantiate in 30 seconds")
-	case svc = <-svcC:
-	}
+	var (
+		mainRole      = "main-role"
+		secondaryRole = "secondary-role"
+		defaultRoles  = []string{mainRole, secondaryRole}
+		hostPrincipal = "node.example.com"
+		kubeGroups    = []string{"system:masters"}
+		kubeUsers     = []string{"kubernetes-user"}
+	)
+	hostCertRule := types.NewRule("host_cert", []string{"create"})
+	hostCertRule.Where = fmt.Sprintf("is_subset(host_cert.principals, \"%s\")", hostPrincipal)
+	role, err := types.NewRole(mainRole, types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			// Grant access to all apps
+			AppLabels: types.Labels{
+				"*": apiutils.Strings{"*"},
+			},
 
-	// Ensure the service starts correctly the first time before proceeding
-	_, err := svc.WaitForEventTimeout(30*time.Second, service.TeleportReadyEvent)
-	// in reality, the auth server should start *much* sooner than this.  we use a very large
-	// timeout here because this isn't the kind of problem that this test is meant to catch.
-	require.NoError(t, err, "auth server didn't start after 30s")
-
-	// Tracks the latest instance of the Teleport service through reloads
-	activeSvc := svc
-	activeSvcMu := sync.Mutex{}
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		for {
-			select {
-			case svc := <-svcC:
-				activeSvcMu.Lock()
-				activeSvc = svc
-				activeSvcMu.Unlock()
-			case <-ctx.Done():
-				return
-			}
-		}
-	}()
+			// Grant access to all kubernetes clusters
+			KubernetesLabels: types.Labels{
+				"*": apiutils.Strings{"*"},
+			},
+			KubeGroups: kubeGroups,
+			KubeUsers:  kubeUsers,
 
-	return testhelpers.MakeDefaultAuthClient(t, log, fc), func() *service.TeleportProcess {
-		activeSvcMu.Lock()
-		defer activeSvcMu.Unlock()
-		return activeSvc
-	}, fc
-}
+			// Grant access to database
+			// Note: we don't actually need a role granting us database access to
+			// request it. Actual access is validated via RBAC at connection time.
+			// We do need an actual database and permission to list them, however.
+			DatabaseLabels: types.Labels{
+				"*": apiutils.Strings{"*"},
+			},
+			DatabaseNames: []string{databaseName},
+			DatabaseUsers: []string{databaseUsername},
+			Rules: []types.Rule{
+				types.NewRule("db_server", []string{"read", "list"}),
+				// Grant ability to generate a host cert
+				hostCertRule,
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.NoError(t, rootClient.UpsertRole(ctx, role))
+	// Create a blank secondary role that we can use to check that the default
+	// behavior of impersonating all roles available works
+	role, err = types.NewRole(secondaryRole, types.RoleSpecV6{})
+	require.NoError(t, err)
+	require.NoError(t, rootClient.UpsertRole(ctx, role))
 
-// TestCARotation is a heavy integration test that through a rotation, the bot
-// receives credentials for a new CA.
-func TestBot_Run_CARotation(t *testing.T) {
-	// TODO(jakule): Re-enable this test https://github.com/gravitational/teleport/issues/19403
-	t.Skip("Temporary disable until it's fixed - flaky")
+	// Make and join a new bot instance.
+	botParams := testhelpers.MakeBot(t, rootClient, "test", defaultRoles...)
 
-	t.Parallel()
-	if testing.Short() {
-		t.Skip("test skipped when -short provided")
+	identityOutput := &config.IdentityOutput{
+		Destination: &config.DestinationMemory{},
+	}
+	identityOutputWithRoles := &config.IdentityOutput{
+		Destination: &config.DestinationMemory{},
+		Roles:       []string{mainRole},
+	}
+	appOutput := &config.ApplicationOutput{
+		Destination: &config.DestinationMemory{},
+		AppName:     appName,
+	}
+	dbOutput := &config.DatabaseOutput{
+		Destination: &config.DestinationMemory{},
+		Service:     databaseServiceName,
+		Database:    databaseName,
+		Username:    databaseUsername,
+	}
+	kubeOutput := &config.KubernetesOutput{
+		// DestinationDirectory required or output will fail.
+		Destination: &config.DestinationDirectory{
+			Path: t.TempDir(),
+		},
+		KubernetesCluster: kubeClusterName,
 	}
+	sshHostOutput := &config.SSHHostOutput{
+		Destination: &config.DestinationMemory{},
+		Principals:  []string{hostPrincipal},
+	}
+	botConfig := testhelpers.DefaultBotConfig(
+		t, fc, botParams, []config.Output{
+			identityOutput,
+			identityOutputWithRoles,
+			appOutput,
+			dbOutput,
+			sshHostOutput,
+			kubeOutput,
+		},
+	)
+	b := New(botConfig, log)
+	require.NoError(t, b.Run(ctx))
 
-	// wg and context manage the cancellation of long running processes e.g
-	// teleport and tbot in the test.
-	log := utils.NewLoggerForTests()
-	wg := &sync.WaitGroup{}
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(func() {
-		log.Infof("Shutting down long running test processes..")
-		cancel()
-		wg.Wait()
+	t.Run("bot identity", func(t *testing.T) {
+		// Some rough checks to ensure the bot identity used follows our
+		// expected rules for bot identities.
+		botIdent := b.ident()
+		tlsIdent, err := tlsca.FromSubject(botIdent.X509Cert.Subject, botIdent.X509Cert.NotAfter)
+		require.NoError(t, err)
+		require.True(t, tlsIdent.Renewable)
+		require.False(t, tlsIdent.DisallowReissue)
+		require.Equal(t, uint64(1), tlsIdent.Generation)
+		require.ElementsMatch(t, []string{botParams.RoleName}, tlsIdent.Groups)
 	})
 
-	client, teleportProcess, fc := setupServerForCARotationTest(ctx, log, t, wg)
+	t.Run("output: identity", func(t *testing.T) {
+		tlsIdent := tlsIdentFromDest(t, identityOutput.GetDestination())
+		requireValidOutputTLSIdent(t, tlsIdent, defaultRoles, botParams.UserName)
+	})
 
-	// Make and join a new bot instance.
-	botParams := testhelpers.MakeBot(t, client, "test", "access")
-	botConfig := testhelpers.MakeMemoryBotConfig(t, fc, botParams)
-	b := New(botConfig, log, make(chan struct{}))
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		err := b.Run(ctx)
+	t.Run("output: identity with role specified", func(t *testing.T) {
+		tlsIdent := tlsIdentFromDest(t, identityOutputWithRoles.GetDestination())
+		requireValidOutputTLSIdent(t, tlsIdent, []string{mainRole}, botParams.UserName)
+	})
+
+	t.Run("output: kubernetes", func(t *testing.T) {
+		tlsIdent := tlsIdentFromDest(t, kubeOutput.GetDestination())
+		requireValidOutputTLSIdent(t, tlsIdent, defaultRoles, botParams.UserName)
+		require.Equal(t, kubeClusterName, tlsIdent.KubernetesCluster)
+		require.Equal(t, kubeGroups, tlsIdent.KubernetesGroups)
+		require.Equal(t, kubeUsers, tlsIdent.KubernetesUsers)
+	})
+
+	t.Run("output: application", func(t *testing.T) {
+		tlsIdent := tlsIdentFromDest(t, appOutput.GetDestination())
+		requireValidOutputTLSIdent(t, tlsIdent, defaultRoles, botParams.UserName)
+		route := tlsIdent.RouteToApp
+		require.Equal(t, appName, route.Name)
+		require.Equal(t, "test-app.example.com", route.PublicAddr)
+		require.NotEmpty(t, route.SessionID)
+	})
+
+	t.Run("output: database", func(t *testing.T) {
+		tlsIdent := tlsIdentFromDest(t, dbOutput.GetDestination())
+		requireValidOutputTLSIdent(t, tlsIdent, defaultRoles, botParams.UserName)
+		route := tlsIdent.RouteToDatabase
+		require.Equal(t, databaseServiceName, route.ServiceName)
+		require.Equal(t, databaseName, route.Database)
+		require.Equal(t, databaseUsername, route.Username)
+		require.Equal(t, "mysql", route.Protocol)
+	})
+
+	t.Run("output: ssh_host", func(t *testing.T) {
+		dest := sshHostOutput.GetDestination()
+
+		// Validate ssh_host
+		hostKeyBytes, err := dest.Read("ssh_host")
+		require.NoError(t, err)
+		hostKey, err := ssh.ParsePrivateKey(hostKeyBytes)
+		require.NoError(t, err)
+		testData := []byte("test-data")
+		signedTestData, err := hostKey.Sign(rand.Reader, testData)
 		require.NoError(t, err)
-	}()
-	// Allow time for bot to start running and watching for CA rotations
-	// TODO: We should modify the bot to emit events that may be useful...
-	time.Sleep(10 * time.Second)
 
-	// fetch initial host cert
-	require.Len(t, b.ident().TLSCACertsBytes, 2)
-	initialCAs := [][]byte{}
-	copy(initialCAs, b.ident().TLSCACertsBytes)
+		// Validate ssh_host-cert.pub
+		hostCertBytes, err := dest.Read("ssh_host-cert.pub")
+		require.NoError(t, err)
+		hostCert, err := sshutils.ParseCertificate(hostCertBytes)
+		require.NoError(t, err)
 
-	// Begin rotating through all of the phases, testing the client after
-	// each rotation phase has completed.
-	rotate(ctx, t, log, teleportProcess(), types.RotationPhaseInit)
-	// TODO: These sleeps allow the client time to rotate. They could be
-	// replaced if tbot emitted a CA rotation/renewal event.
-	time.Sleep(time.Second * 30)
-	_, err := b.Client().Ping(ctx)
-	require.NoError(t, err)
+		// Check cert is signed by host CA, and that the host key can sign things
+		// which can be verified with the host cert.
+		publicKeys, err := apisshutils.GetCheckers(hostCA)
+		require.NoError(t, err)
+		hostCertChecker := ssh.CertChecker{
+			IsHostAuthority: func(v ssh.PublicKey, _ string) bool {
+				for _, pk := range publicKeys {
+					return bytes.Equal(v.Marshal(), pk.Marshal())
+				}
+				return false
+			},
+		}
+		require.NoError(t, hostCertChecker.CheckCert(hostPrincipal, hostCert), "host cert does not pass verification")
+		require.NoError(t, hostCert.Key.Verify(testData, signedTestData), "signature by host key does not verify with public key in host certificate")
 
-	rotate(ctx, t, log, teleportProcess(), types.RotationPhaseUpdateClients)
-	time.Sleep(time.Second * 30)
-	// Ensure both sets of CA certificates are now available locally
-	require.Len(t, b.ident().TLSCACertsBytes, 3)
-	_, err = b.Client().Ping(ctx)
-	require.NoError(t, err)
+		// Validate ssh_host-user-ca.pub
+		userCABytes, err := dest.Read("ssh_host-user-ca.pub")
+		require.NoError(t, err)
+		userCAKey, _, _, _, err := ssh.ParseAuthorizedKey(userCABytes)
+		require.NoError(t, err)
+		matchesUserCA := false
+		for _, trustedKeyPair := range userCA.GetTrustedSSHKeyPairs() {
+			wantUserCAKey, _, _, _, err := ssh.ParseAuthorizedKey(trustedKeyPair.PublicKey)
+			require.NoError(t, err)
+			if bytes.Equal(userCAKey.Marshal(), wantUserCAKey.Marshal()) {
+				matchesUserCA = true
+				break
+			}
+		}
+		require.True(t, matchesUserCA)
+	})
+}
+
+// requireValidOutputTLSIdent runs general validation against the TLS identity
+// created by a normal output. This ensures several key parts of the identity
+// have sane values.
+func requireValidOutputTLSIdent(t *testing.T, ident *tlsca.Identity, wantRoles []string, botUsername string) {
+	require.True(t, ident.DisallowReissue)
+	require.False(t, ident.Renewable)
+	require.Equal(t, botUsername, ident.Impersonator)
+	require.Equal(t, botUsername, ident.Username)
+	require.Equal(t, wantRoles, ident.Groups)
+}
 
-	rotate(ctx, t, log, teleportProcess(), types.RotationPhaseUpdateServers)
-	time.Sleep(time.Second * 30)
-	_, err = b.Client().Ping(ctx)
+func tlsIdentFromDest(t *testing.T, dest bot.Destination) *tlsca.Identity {
+	t.Helper()
+	keyBytes, err := dest.Read(identity.PrivateKeyKey)
+	require.NoError(t, err)
+	certBytes, err := dest.Read(identity.TLSCertKey)
+	require.NoError(t, err)
+	hostCABytes, err := dest.Read(config.HostCAPath)
+	require.NoError(t, err)
+	ident := &identity.Identity{}
+	err = identity.ReadTLSIdentityFromKeyPair(ident, keyBytes, certBytes, [][]byte{hostCABytes})
 	require.NoError(t, err)
 
-	rotate(ctx, t, log, teleportProcess(), types.RotationStateStandby)
-	time.Sleep(time.Second * 30)
-	_, err = b.Client().Ping(ctx)
+	tlsIdent, err := tlsca.FromSubject(
+		ident.X509Cert.Subject, ident.X509Cert.NotAfter,
+	)
 	require.NoError(t, err)
+	return tlsIdent
+}
+
+// TestBot_ResumeFromStorage ensures that after the bot stops, another instance
+// of the bot can be started from the state persisted to the storage
+// destination. This ensures that the renewable token join method will function
+// correctly.
+func TestBot_ResumeFromStorage(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	log := utils.NewLoggerForTests()
+
+	// Make a new auth server.
+	fc, fds := testhelpers.DefaultConfig(t)
+	_ = testhelpers.MakeAndRunTestAuthServer(t, log, fc, fds)
+	rootClient := testhelpers.MakeDefaultAuthClient(t, log, fc)
+
+	// Create bot user and join token
+	botParams := testhelpers.MakeBot(t, rootClient, "test", "access")
+
+	botConfig := testhelpers.DefaultBotConfig(t, fc, botParams, []config.Output{})
+	// Use a destination directory to ensure locking behaves correctly and
+	// the bot isn't left in a locked state.
+	directoryDest := &config.DestinationDirectory{
+		Path:     t.TempDir(),
+		Symlinks: botfs.SymlinksInsecure,
+		ACLs:     botfs.ACLOff,
+	}
+	botConfig.Storage.Destination = directoryDest
+
+	// Run the bot a first time
+	firstBot := New(botConfig, log)
+	require.NoError(t, firstBot.Run(ctx))
+
+	// Run the bot a second time, with the exact same config
+	secondBot := New(botConfig, log)
+	require.NoError(t, secondBot.Run(ctx))
 
-	require.Len(t, b.ident().TLSCACertsBytes, 2)
-	finalCAs := b.ident().TLSCACertsBytes
-	require.NotEqual(t, initialCAs, finalCAs)
+	// Simulate user removing token from config, and run the bot a third time.
+	// It should see it already has a valid identity and use that - ignoring
+	// the fact that the token has been cleared from config.
+	botConfig.Onboarding.TokenValue = ""
+	thirdBot := New(botConfig, log)
+	require.NoError(t, thirdBot.Run(ctx))
 }
diff --git a/lib/tbot/testhelpers/srv.go b/lib/tbot/testhelpers/srv.go
index a27e7169f0719..f6979bec0d403 100644
--- a/lib/tbot/testhelpers/srv.go
+++ b/lib/tbot/testhelpers/srv.go
@@ -18,7 +18,6 @@ package testhelpers
 
 import (
 	"context"
-	"net"
 	"path/filepath"
 	"testing"
 	"time"
@@ -34,17 +33,8 @@ import (
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	botconfig "github.com/gravitational/teleport/lib/tbot/config"
-	"github.com/gravitational/teleport/lib/tbot/identity"
 	"github.com/gravitational/teleport/lib/utils"
-)
-
-// from lib/service/listeners.go
-// TODO(espadolini): have the constants exported
-const (
-	listenerAuth        = "auth"
-	listenerProxySSH    = "proxy:ssh"
-	listenerProxyWeb    = "proxy:web"
-	listenerProxyTunnel = "proxy:tunnel"
+	"github.com/gravitational/teleport/tool/teleport/testenv"
 )
 
 // DefaultConfig returns a FileConfig to be used in tests, with random listen
@@ -59,24 +49,20 @@ func DefaultConfig(t *testing.T) (*config.FileConfig, []servicecfg.FileDescripto
 		Global: config.Global{
 			DataDir: t.TempDir(),
 		},
-		Databases: config.Databases{
-			Service: config.Service{
-				EnabledFlag: "true",
-			},
-		},
 		Proxy: config.Proxy{
 			Service: config.Service{
 				EnabledFlag:   "true",
-				ListenAddress: newListener(t, listenerProxySSH, &fds),
+				ListenAddress: testenv.NewTCPListener(t, service.ListenerProxySSH, &fds),
 			},
-			WebAddr:    newListener(t, listenerProxyWeb, &fds),
-			TunAddr:    newListener(t, listenerProxyTunnel, &fds),
-			PublicAddr: []string{"proxy.example.com"},
+			WebAddr:    testenv.NewTCPListener(t, service.ListenerProxyWeb, &fds),
+			TunAddr:    testenv.NewTCPListener(t, service.ListenerProxyTunnel, &fds),
+			PublicAddr: []string{"localhost"}, // ListenerProxyWeb port will be appended
 		},
 		Auth: config.Auth{
+			ClusterName: "localhost",
 			Service: config.Service{
 				EnabledFlag:   "true",
-				ListenAddress: newListener(t, listenerAuth, &fds),
+				ListenAddress: testenv.NewTCPListener(t, service.ListenerAuth, &fds),
 			},
 		},
 	}
@@ -84,41 +70,6 @@ func DefaultConfig(t *testing.T) (*config.FileConfig, []servicecfg.FileDescripto
 	return fc, fds
 }
 
-// newListener creates a new TCP listener on 127.0.0.1:0, adds it to the
-// FileDescriptor slice (with the specified type) and returns its actual local
-// address as a string (for use in configuration). Takes a pointer to the slice
-// so that it's convenient to call in the middle of a FileConfig or Config
-// struct literal.
-// TODO(espadolini): move this to a more generic place so we can use the same
-// approach in other tests that spin up a TeleportProcess
-func newListener(t *testing.T, ty string, fds *[]servicecfg.FileDescriptor) string {
-	t.Helper()
-
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err)
-	defer l.Close()
-	addr := l.Addr().String()
-
-	// File() returns a dup of the listener's file descriptor as an *os.File, so
-	// the original net.Listener still needs to be closed.
-	lf, err := l.(*net.TCPListener).File()
-	require.NoError(t, err)
-	// If the file descriptor slice ends up being passed to a TeleportProcess
-	// that successfully starts, listeners will either get "imported" and used
-	// or discarded and closed, this is just an extra safety measure that closes
-	// the listener at the end of the test anyway (the finalizer would do that
-	// anyway, in principle).
-	t.Cleanup(func() { lf.Close() })
-
-	*fds = append(*fds, servicecfg.FileDescriptor{
-		Type:    ty,
-		Address: addr,
-		File:    lf,
-	})
-
-	return addr
-}
-
 // MakeAndRunTestAuthServer creates an auth server useful for testing purposes.
 func MakeAndRunTestAuthServer(t *testing.T, log utils.Logger, fc *config.FileConfig, fds []servicecfg.FileDescriptor) (auth *service.TeleportProcess) {
 	t.Helper()
@@ -148,27 +99,6 @@ func MakeAndRunTestAuthServer(t *testing.T, log utils.Logger, fc *config.FileCon
 	return auth
 }
 
-// MakeBotAuthClient creates a new auth client using a Bot identity.
-func MakeBotAuthClient(t *testing.T, fc *config.FileConfig, ident *identity.Identity) auth.ClientI {
-	t.Helper()
-
-	cfg := servicecfg.MakeDefaultConfig()
-	err := config.ApplyFileConfig(fc, cfg)
-	require.NoError(t, err)
-
-	authConfig := new(authclient.Config)
-	authConfig.TLS, err = ident.TLSConfig(cfg.CipherSuites)
-	require.NoError(t, err)
-
-	authConfig.AuthServers = cfg.AuthServerAddresses()
-	authConfig.Log = cfg.Log
-
-	client, err := authclient.Connect(context.Background(), authConfig)
-	require.NoError(t, err)
-
-	return client
-}
-
 // MakeDefaultAuthClient reimplements the bare minimum needed to create a
 // default root-level auth client for a Teleport server started by
 // MakeAndRunTestAuthServer.
@@ -230,9 +160,15 @@ func MakeBot(t *testing.T, client auth.ClientI, name string, roles ...string) *p
 	return bot
 }
 
-// MakeMemoryBotConfig creates a usable bot config from joining parameters. It
-// only writes artifacts to memory and can be further modified if desired.
-func MakeMemoryBotConfig(t *testing.T, fc *config.FileConfig, botParams *proto.CreateBotResponse) *botconfig.BotConfig {
+// DefaultBotConfig creates a usable bot config from joining parameters.
+// By default it:
+// - Has the outputs provided to it via the parameter `outputs`
+// - Runs in oneshot mode
+// - Uses a memory storage destination
+// - Does not verify Proxy WebAPI certificates
+func DefaultBotConfig(
+	t *testing.T, fc *config.FileConfig, botParams *proto.CreateBotResponse, outputs []botconfig.Output,
+) *botconfig.BotConfig {
 	t.Helper()
 
 	authCfg := servicecfg.MakeDefaultConfig()
@@ -241,21 +177,17 @@ func MakeMemoryBotConfig(t *testing.T, fc *config.FileConfig, botParams *proto.C
 
 	cfg := &botconfig.BotConfig{
 		AuthServer: authCfg.AuthServerAddresses()[0].String(),
-		Onboarding: &botconfig.OnboardingConfig{
+		Onboarding: botconfig.OnboardingConfig{
 			JoinMethod: botParams.JoinMethod,
 		},
 		Storage: &botconfig.StorageConfig{
-			DestinationMixin: botconfig.DestinationMixin{
-				Memory: &botconfig.DestinationMemory{},
-			},
-		},
-		Destinations: []*botconfig.DestinationConfig{
-			{
-				DestinationMixin: botconfig.DestinationMixin{
-					Memory: &botconfig.DestinationMemory{},
-				},
-			},
+			Destination: &botconfig.DestinationMemory{},
 		},
+		Oneshot: true,
+		Outputs: outputs,
+		// Set Insecure so the bot will trust the Proxy's webapi default signed
+		// certs.
+		Insecure: true,
 	}
 
 	cfg.Onboarding.SetToken(botParams.TokenID)
diff --git a/lib/tbot/tshwrap/wrap.go b/lib/tbot/tshwrap/wrap.go
index 24a7c32b444a2..735eeb94b2db1 100644
--- a/lib/tbot/tshwrap/wrap.go
+++ b/lib/tbot/tshwrap/wrap.go
@@ -167,76 +167,28 @@ func CheckTSHSupported(w *Wrapper) error {
 	return nil
 }
 
-// GetDestination attempts to select an unambiguous destination, either from
+// GetDestinationDirectory attempts to select an unambiguous destination, either from
 // CLI or YAML config. It returns an error if the selected destination is
 // invalid.
-func GetDestination(botConfig *config.BotConfig, cf *config.CLIConf) (*config.DestinationConfig, error) {
-	// Note: this only supports filesystem destinations.
-	if cf.DestinationDir != "" {
-		dest, err := botConfig.GetDestinationByPath(cf.DestinationDir)
-		if err != nil {
-			return nil, trace.Wrap(err, "unable to find destination %s in the "+
-				"configuration; has the configuration file been "+
-				"specified with `-c <path>`?", cf.DestinationDir)
-		}
-
-		return dest, nil
-	}
-
-	if len(botConfig.Destinations) == 0 {
-		return nil, trace.BadParameter("either --destination-dir or a config file must be specified")
-	} else if len(botConfig.Destinations) > 1 {
-		return nil, trace.BadParameter("the config file contains multiple destinations; a --destination-dir must be specified")
-	}
-
-	return botConfig.Destinations[0], nil
-}
-
-// GetDestinationPath returns a path to a filesystem destination.
-func GetDestinationPath(destination *config.DestinationConfig) (string, error) {
-	destinationImpl, err := destination.GetDestination()
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-
-	destinationDir, ok := destinationImpl.(*config.DestinationDirectory)
-	if !ok {
-		return "", trace.BadParameter("destination %s must be a directory", destinationImpl)
-	}
-
-	return destinationDir.Path, nil
-}
-
-// GetTLSCATemplate returns the TLS CA template for the given destination. It's
-// a required template so this should never fail.
-func GetTLSCATemplate(destination *config.DestinationConfig) (*config.TemplateTLSCAs, error) {
-	tpl := destination.GetConfigByName(config.TemplateTLSCAsName)
-	if tpl == nil {
-		return nil, trace.NotFound("no template with name %s found, this is a bug", config.TemplateTLSCAsName)
-	}
-
-	tlsCAs, ok := tpl.(*config.TemplateTLSCAs)
+func GetDestinationDirectory(botConfig *config.BotConfig) (*config.DestinationDirectory, error) {
+	// WARNING:
+	// This code is dependent on some unexpected "behavior" in
+	// config.FromCLIConf() - when users provide --destination-dir then all
+	// outputs configured in the YAML file are overwritten by an identity
+	// output with a directory destination with a path of --destination-dir.
+	// See: https://github.com/gravitational/teleport/issues/27206
+	if len(botConfig.Outputs) == 0 {
+		return nil, trace.BadParameter("either --destination-dir or a config file containing an output must be specified")
+	} else if len(botConfig.Outputs) > 1 {
+		return nil, trace.BadParameter("the config file contains multiple outputs; a --destination-dir must be specified")
+	}
+	destination := botConfig.Outputs[0].GetDestination()
+	destinationDir, ok := destination.(*config.DestinationDirectory)
 	if !ok {
-		return nil, trace.BadParameter("invalid TLS CA template")
+		return nil, trace.BadParameter("destination %s must be a directory", destination)
 	}
 
-	return tlsCAs, nil
-}
-
-// GetIdentityTemplate returns the identity template for the given destination.
-// This is a required template so it _should_ never fail.
-func GetIdentityTemplate(destination *config.DestinationConfig) (*config.TemplateIdentity, error) {
-	tpl := destination.GetConfigByName(config.TemplateIdentityName)
-	if tpl == nil {
-		return nil, trace.NotFound("no template with name %s found, this is a bug", config.TemplateIdentityName)
-	}
-
-	identity, ok := tpl.(*config.TemplateIdentity)
-	if !ok {
-		return nil, trace.BadParameter("invalid identity template")
-	}
-
-	return identity, nil
+	return destinationDir, nil
 }
 
 // mergeEnv applies the given value to each key inside the specified map.
@@ -248,17 +200,7 @@ func mergeEnv(m map[string]string, value string, keys []string) {
 
 // GetEnvForTSH returns a map of environment variables needed to properly wrap
 // tsh so that it uses our Machine ID certificates where necessary.
-func GetEnvForTSH(destination *config.DestinationConfig) (map[string]string, error) {
-	tlsCAs, err := GetTLSCATemplate(destination)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	destPath, err := GetDestinationPath(destination)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
+func GetEnvForTSH(destPath string) (map[string]string, error) {
 	// The env var interface does allow us to set specific resource names for
 	// everything but also has generic fallbacks. We'll use the fallbacks for
 	// now but could eventually communicate more info to tsh if desired.
@@ -274,9 +216,9 @@ func GetEnvForTSH(destination *config.DestinationConfig) (map[string]string, err
 
 	// We don't want to provide a fallback for CAs since it would be ambiguous,
 	// so we'll specify them exactly.
-	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.UserCA))] = filepath.Join(destPath, tlsCAs.UserCAPath)
-	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.HostCA))] = filepath.Join(destPath, tlsCAs.HostCAPath)
-	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.DatabaseCA))] = filepath.Join(destPath, tlsCAs.DatabaseCAPath)
+	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.UserCA))] = filepath.Join(destPath, config.UserCAPath)
+	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.HostCA))] = filepath.Join(destPath, config.HostCAPath)
+	env[client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.DatabaseCA))] = filepath.Join(destPath, config.DatabaseCAPath)
 
 	// TODO(timothyb89): Kubernetes support. We don't generate kubeconfigs yet, so we have
 	// nothing to give tsh for now.
diff --git a/lib/tbot/tshwrap/wrap_test.go b/lib/tbot/tshwrap/wrap_test.go
index 939caba7c7d00..4054f9bdb0bb4 100644
--- a/lib/tbot/tshwrap/wrap_test.go
+++ b/lib/tbot/tshwrap/wrap_test.go
@@ -82,86 +82,53 @@ func TestTSHSupported(t *testing.T) {
 // TestGetEnvForTSH ensures we generate a valid minimum subset of environment
 // parameters needed for tsh wrappers to work.
 func TestGetEnvForTSH(t *testing.T) {
-	destination := config.DestinationConfig{
-		DestinationMixin: config.DestinationMixin{
-			Directory: &config.DestinationDirectory{
-				Path: "/foo",
-			},
-		},
-	}
-	require.NoError(t, destination.CheckAndSetDefaults())
-
-	p, err := GetDestinationPath(&destination)
-	require.NoError(t, err)
-
-	tlsCAs, err := GetTLSCATemplate(&destination)
-	require.NoError(t, err)
+	p := "/foo"
 
 	expected := map[string]string{
 		client.VirtualPathEnvName(client.VirtualPathKey, nil):      filepath.Join(p, identity.PrivateKeyKey),
 		client.VirtualPathEnvName(client.VirtualPathDatabase, nil): filepath.Join(p, identity.TLSCertKey),
 		client.VirtualPathEnvName(client.VirtualPathApp, nil):      filepath.Join(p, identity.TLSCertKey),
 
-		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.UserCA)):     filepath.Join(p, tlsCAs.UserCAPath),
-		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.HostCA)):     filepath.Join(p, tlsCAs.HostCAPath),
-		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.DatabaseCA)): filepath.Join(p, tlsCAs.DatabaseCAPath),
+		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.UserCA)):     filepath.Join(p, config.UserCAPath),
+		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.HostCA)):     filepath.Join(p, config.HostCAPath),
+		client.VirtualPathEnvName(client.VirtualPathCA, client.VirtualPathCAParams(types.DatabaseCA)): filepath.Join(p, config.DatabaseCAPath),
 	}
 
-	env, err := GetEnvForTSH(&destination)
+	env, err := GetEnvForTSH(p)
 	require.NoError(t, err)
 	for k, v := range expected {
 		assert.Equal(t, v, env[k])
 	}
 }
 
-func TestGetDestinationPath(t *testing.T) {
-	destination := config.DestinationConfig{
-		DestinationMixin: config.DestinationMixin{
-			Directory: &config.DestinationDirectory{
-				Path: "/foo",
+func TestGetDestinationDirectory(t *testing.T) {
+	output := func() config.Output {
+		return &config.IdentityOutput{
+			Destination: &config.DestinationDirectory{
+				Path: "/from-bot-config",
 			},
-		},
+		}
 	}
-	require.NoError(t, destination.CheckAndSetDefaults())
-
-	path, err := GetDestinationPath(&destination)
-	require.NoError(t, err)
-	require.Equal(t, "/foo", path)
-}
-
-func TestGetIdentityTemplate(t *testing.T) {
-	destination := config.DestinationConfig{
-		DestinationMixin: config.DestinationMixin{
-			Directory: &config.DestinationDirectory{
-				Path: "/foo",
+	t.Run("one output configured", func(t *testing.T) {
+		dest, err := GetDestinationDirectory(&config.BotConfig{
+			Outputs: []config.Output{
+				output(),
 			},
-		},
-	}
-	require.NoError(t, destination.CheckAndSetDefaults())
-
-	tpl, err := GetIdentityTemplate(&destination)
-	require.NoError(t, err)
-
-	// We don't particularly care where the file goes, but it does need to be
-	// set.
-	require.NotEmpty(t, tpl.FileName)
-}
-
-func TestGetTLSCATemplate(t *testing.T) {
-	destination := config.DestinationConfig{
-		DestinationMixin: config.DestinationMixin{
-			Directory: &config.DestinationDirectory{
-				Path: "/foo",
+		})
+		require.NoError(t, err)
+		require.Equal(t, "/from-bot-config", dest.Path)
+	})
+	t.Run("no outputs specified", func(t *testing.T) {
+		_, err := GetDestinationDirectory(&config.BotConfig{})
+		require.ErrorContains(t, err, "either --destination-dir or a config file containing an output must be specified")
+	})
+	t.Run("multiple outputs specified", func(t *testing.T) {
+		_, err := GetDestinationDirectory(&config.BotConfig{
+			Outputs: []config.Output{
+				output(),
+				output(),
 			},
-		},
-	}
-	require.NoError(t, destination.CheckAndSetDefaults())
-
-	tpl, err := GetTLSCATemplate(&destination)
-	require.NoError(t, err)
-
-	// As above, the name is arbitrary but these do need to exist.
-	require.NotEmpty(t, tpl.HostCAPath)
-	require.NotEmpty(t, tpl.UserCAPath)
-	require.NotEmpty(t, tpl.DatabaseCAPath)
+		})
+		require.ErrorContains(t, err, "the config file contains multiple outputs; a --destination-dir must be specified")
+	})
 }
diff --git a/lib/teleterm/apiserver/handler/handler_access_requests.go b/lib/teleterm/apiserver/handler/handler_access_requests.go
index d7ca1a26fefc4..d1b3e053e1057 100644
--- a/lib/teleterm/apiserver/handler/handler_access_requests.go
+++ b/lib/teleterm/apiserver/handler/handler_access_requests.go
@@ -179,6 +179,7 @@ func resourceIDToString(id *api.ResourceID) string {
 
 func newAPIResourceDetails(details clusters.ResourceDetails) *api.ResourceDetails {
 	return &api.ResourceDetails{
-		Hostname: details.Hostname,
+		Hostname:     details.Hostname,
+		FriendlyName: details.FriendlyName,
 	}
 }
diff --git a/lib/teleterm/apiserver/handler/handler_clusters.go b/lib/teleterm/apiserver/handler/handler_clusters.go
index b7d59895c0601..ec60c6d11cc68 100644
--- a/lib/teleterm/apiserver/handler/handler_clusters.go
+++ b/lib/teleterm/apiserver/handler/handler_clusters.go
@@ -108,10 +108,12 @@ func newAPIRootClusterWithDetails(cluster *clusters.ClusterWithDetails) *api.Clu
 
 	apiCluster.Features = &api.Features{
 		AdvancedAccessWorkflows: cluster.Features.GetAdvancedAccessWorkflows(),
+		IsUsageBasedBilling:     cluster.Features.GetIsUsageBased(),
 	}
 	apiCluster.LoggedInUser.RequestableRoles = cluster.RequestableRoles
 	apiCluster.LoggedInUser.SuggestedReviewers = cluster.SuggestedReviewers
 	apiCluster.AuthClusterId = cluster.AuthClusterID
+	apiCluster.LoggedInUser.Acl = cluster.ACL
 
 	return apiCluster
 }
diff --git a/lib/teleterm/clusters/cluster.go b/lib/teleterm/clusters/cluster.go
index a969e09362e43..5403fd11e2831 100644
--- a/lib/teleterm/clusters/cluster.go
+++ b/lib/teleterm/clusters/cluster.go
@@ -30,6 +30,7 @@ import (
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/teleterm/api/uri"
 )
 
@@ -64,6 +65,8 @@ type ClusterWithDetails struct {
 	SuggestedReviewers []string
 	// RequestableRoles for the given user.
 	RequestableRoles []string
+	// ACL contains user access control list.
+	ACL *api.ACL
 }
 
 // Connected indicates if connection to the cluster can be established
@@ -79,6 +82,7 @@ func (c *Cluster) GetWithDetails(ctx context.Context) (*ClusterWithDetails, erro
 		pingResponse  proto.PingResponse
 		caps          *types.AccessCapabilities
 		authClusterID string
+		acl           *api.ACL
 	)
 
 	err := addMetadataToRetryableError(ctx, func() error {
@@ -113,6 +117,34 @@ func (c *Cluster) GetWithDetails(ctx context.Context) (*ClusterWithDetails, erro
 		}
 		authClusterID = clusterName.GetClusterID()
 
+		user, err := authClient.GetCurrentUser(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		roles, err := authClient.GetCurrentUserRoles(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		roleSet := services.NewRoleSet(roles...)
+		userACL := services.NewUserACL(user, roleSet, *pingResponse.ServerFeatures, false)
+
+		acl = &api.ACL{
+			RecordedSessions: convertToAPIResourceAccess(userACL.RecordedSessions),
+			ActiveSessions:   convertToAPIResourceAccess(userACL.ActiveSessions),
+			AuthConnectors:   convertToAPIResourceAccess(userACL.AuthConnectors),
+			Roles:            convertToAPIResourceAccess(userACL.Roles),
+			Users:            convertToAPIResourceAccess(userACL.Users),
+			TrustedClusters:  convertToAPIResourceAccess(userACL.TrustedClusters),
+			Events:           convertToAPIResourceAccess(userACL.Events),
+			Tokens:           convertToAPIResourceAccess(userACL.Tokens),
+			Servers:          convertToAPIResourceAccess(userACL.Nodes),
+			Apps:             convertToAPIResourceAccess(userACL.AppServers),
+			Dbs:              convertToAPIResourceAccess(userACL.DBServers),
+			Kubeservers:      convertToAPIResourceAccess(userACL.KubeServers),
+			AccessRequests:   convertToAPIResourceAccess(userACL.AccessRequests),
+		}
 		return nil
 	})
 	if err != nil {
@@ -125,11 +157,23 @@ func (c *Cluster) GetWithDetails(ctx context.Context) (*ClusterWithDetails, erro
 		RequestableRoles:   caps.RequestableRoles,
 		Features:           pingResponse.ServerFeatures,
 		AuthClusterID:      authClusterID,
+		ACL:                acl,
 	}
 
 	return withDetails, nil
 }
 
+func convertToAPIResourceAccess(access services.ResourceAccess) *api.ResourceAccess {
+	return &api.ResourceAccess{
+		List:   access.List,
+		Read:   access.Read,
+		Edit:   access.Edit,
+		Create: access.Create,
+		Delete: access.Delete,
+		Use:    access.Use,
+	}
+}
+
 // GetRoles returns currently logged-in user roles
 func (c *Cluster) GetRoles(ctx context.Context) ([]*types.Role, error) {
 	var roles []*types.Role
diff --git a/lib/teleterm/clusters/cluster_access_requests.go b/lib/teleterm/clusters/cluster_access_requests.go
index daa1c95833511..0dee74f68113c 100644
--- a/lib/teleterm/clusters/cluster_access_requests.go
+++ b/lib/teleterm/clusters/cluster_access_requests.go
@@ -30,7 +30,8 @@ import (
 )
 
 type ResourceDetails struct {
-	Hostname string
+	Hostname     string
+	FriendlyName string
 }
 
 type AccessRequest struct {
@@ -252,8 +253,9 @@ func (c *Cluster) AssumeRole(ctx context.Context, req *api.AssumeRoleRequest) er
 				params.AccessRequests = append(params.AccessRequests, reqID)
 			}
 		}
-
-		return c.clusterClient.ReissueUserCerts(ctx, client.CertCacheKeep, params)
+		// When assuming a role, we want to drop all cached certs otherwise
+		// tsh will continue to use the old certs.
+		return c.clusterClient.ReissueUserCerts(ctx, client.CertCacheDrop, params)
 	})
 	if err != nil {
 		return trace.Wrap(err)
@@ -268,7 +270,7 @@ func (c *Cluster) AssumeRole(ctx context.Context, req *api.AssumeRoleRequest) er
 }
 
 func getResourceDetails(ctx context.Context, req types.AccessRequest, clt auth.ClientI) (map[string]ResourceDetails, error) {
-	resourceIDsByCluster := services.GetNodeResourceIDsByCluster(req)
+	resourceIDsByCluster := services.GetResourceIDsByCluster(req)
 
 	resourceDetails := make(map[string]ResourceDetails)
 	for clusterName, resourceIDs := range resourceIDsByCluster {
@@ -278,7 +280,7 @@ func getResourceDetails(ctx context.Context, req types.AccessRequest, clt auth.C
 		}
 		for id, d := range details {
 			resourceDetails[id] = ResourceDetails{
-				Hostname: d.Hostname,
+				FriendlyName: d.FriendlyName,
 			}
 		}
 	}
diff --git a/lib/teleterm/clusters/cluster_auth.go b/lib/teleterm/clusters/cluster_auth.go
index d83ed99a81c89..350b8db4dbe01 100644
--- a/lib/teleterm/clusters/cluster_auth.go
+++ b/lib/teleterm/clusters/cluster_auth.go
@@ -27,6 +27,7 @@ import (
 	apiclient "github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/webclient"
 	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/utils/keys"
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	"github.com/gravitational/teleport/lib/auth"
@@ -46,7 +47,7 @@ func (c *Cluster) SyncAuthPreference(ctx context.Context) (*webclient.WebConfigA
 	// Do the ALPN handshake test to decide if connection upgrades are required
 	// for TLS Routing. Only do the test once Ping verifies the cluster is
 	// reachable.
-	c.clusterClient.TLSRoutingConnUpgradeRequired = apiclient.IsALPNConnUpgradeRequired(c.clusterClient.WebProxyAddr, c.clusterClient.InsecureSkipVerify)
+	c.clusterClient.TLSRoutingConnUpgradeRequired = apiclient.IsALPNConnUpgradeRequired(ctx, c.clusterClient.WebProxyAddr, c.clusterClient.InsecureSkipVerify)
 
 	if err := c.clusterClient.SaveProfile(false); err != nil {
 		return nil, trace.Wrap(err)
@@ -160,6 +161,16 @@ func (c *Cluster) updateClientFromPingResponse(ctx context.Context) (*webclient.
 		return nil, trace.Wrap(err)
 	}
 
+	if c.clusterClient.KeyTTL == 0 {
+		c.clusterClient.KeyTTL = pingResp.Auth.DefaultSessionTTL.Duration()
+	}
+	// todo(lxea): DELETE IN v15 where the auth is guaranteed to
+	// send us a valid MaxSessionTTL or the auth is guaranteed to
+	// interpret 0 duration as the auth's default
+	if c.clusterClient.KeyTTL == 0 {
+		c.clusterClient.KeyTTL = defaults.CertDuration
+	}
+
 	return pingResp, nil
 }
 
@@ -179,12 +190,17 @@ func (c *Cluster) login(ctx context.Context, sshLoginFunc client.SSHLoginFunc) e
 	c.clusterClient.LocalAgent().UpdateUsername(key.Username)
 	c.clusterClient.Username = key.Username
 
-	if err := c.clusterClient.ActivateKey(ctx, key); err != nil {
+	proxyClient, rootAuthClient, err := c.clusterClient.ConnectToRootCluster(ctx, key)
+	if err != nil {
 		return trace.Wrap(err)
 	}
+	defer func() {
+		rootAuthClient.Close()
+		proxyClient.Close()
+	}()
 
 	// Attempt device login. This activates a fresh key if successful.
-	if err := c.clusterClient.AttemptDeviceLogin(ctx, key); err != nil {
+	if err := c.clusterClient.AttemptDeviceLogin(ctx, key, rootAuthClient); err != nil {
 		return trace.Wrap(err)
 	}
 
diff --git a/lib/teleterm/clusters/cluster_databases.go b/lib/teleterm/clusters/cluster_databases.go
index fbca8fdb3b828..7283812a7b8e3 100644
--- a/lib/teleterm/clusters/cluster_databases.go
+++ b/lib/teleterm/clusters/cluster_databases.go
@@ -223,7 +223,7 @@ func (c *Cluster) GetAllowedDatabaseUsers(ctx context.Context, dbURI string) ([]
 	}
 	defer authClient.Close()
 
-	roleSet, err := services.FetchAllClusterRoles(ctx, authClient, c.status.Roles, c.status.Traits)
+	accessChecker, err := services.NewAccessCheckerForRemoteCluster(ctx, c.status.AccessInfo(), c.status.Cluster, authClient)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -233,7 +233,7 @@ func (c *Cluster) GetAllowedDatabaseUsers(ctx context.Context, dbURI string) ([]
 		return nil, trace.Wrap(err)
 	}
 
-	dbUsers := roleSet.EnumerateDatabaseUsers(db)
+	dbUsers := accessChecker.EnumerateDatabaseUsers(db)
 
 	return dbUsers.Allowed(), nil
 }
diff --git a/lib/teleterm/clusters/storage.go b/lib/teleterm/clusters/storage.go
index 4b40a84912638..3253ed4903d00 100644
--- a/lib/teleterm/clusters/storage.go
+++ b/lib/teleterm/clusters/storage.go
@@ -163,7 +163,7 @@ func (s *Storage) addCluster(ctx context.Context, dir, webProxyAddress string) (
 	// Do the ALPN handshake test to decide if connection upgrades are required
 	// for TLS Routing. Only do the test once Ping verifies the cluster is
 	// reachable.
-	clusterClient.TLSRoutingConnUpgradeRequired = apiclient.IsALPNConnUpgradeRequired(webProxyAddress, s.InsecureSkipVerify)
+	clusterClient.TLSRoutingConnUpgradeRequired = apiclient.IsALPNConnUpgradeRequired(ctx, webProxyAddress, s.InsecureSkipVerify)
 
 	if err := clusterClient.SaveProfile(false); err != nil {
 		return nil, trace.Wrap(err)
@@ -217,9 +217,12 @@ func (s *Storage) fromProfile(profileName, leafClusterName string) (*Cluster, er
 	// load profile status if key exists
 	_, err = clusterClient.LocalAgent().GetKey(clusterNameForKey)
 	if err != nil {
-		s.Log.WithError(err).Infof("Unable to load the keys for cluster %v.", clusterNameForKey)
+		if trace.IsNotFound(err) {
+			s.Log.Infof("No keys found for cluster %v.", clusterNameForKey)
+		} else {
+			return nil, trace.Wrap(err)
+		}
 	}
-
 	if err == nil && cfg.Username != "" {
 		status, err = clusterClient.ProfileStatus()
 		if err != nil {
@@ -230,9 +233,6 @@ func (s *Storage) fromProfile(profileName, leafClusterName string) (*Cluster, er
 			return nil, trace.Wrap(err)
 		}
 	}
-	if err != nil && !trace.IsNotFound(err) {
-		return nil, trace.Wrap(err)
-	}
 
 	return &Cluster{
 		URI:           clusterURI,
diff --git a/lib/usagereporter/teleport/aggregating/submitter.go b/lib/usagereporter/teleport/aggregating/submitter.go
index 76d0864bfb5d9..dad13d46a0404 100644
--- a/lib/usagereporter/teleport/aggregating/submitter.go
+++ b/lib/usagereporter/teleport/aggregating/submitter.go
@@ -106,7 +106,7 @@ func RunSubmitter(ctx context.Context, cfg SubmitterConfig) {
 	})
 	defer iv.Stop()
 
-	for {
+	for ctx.Err() == nil {
 		select {
 		case <-ctx.Done():
 			return
diff --git a/lib/usagereporter/teleport/audit.go b/lib/usagereporter/teleport/audit.go
index e206f5e7b2bf9..f3b91a5192bfd 100644
--- a/lib/usagereporter/teleport/audit.go
+++ b/lib/usagereporter/teleport/audit.go
@@ -131,6 +131,17 @@ func ConvertAuditEvent(event apievents.AuditEvent) Anonymizable {
 			UserName: e.User,
 			Action:   int32(e.Action),
 		}
+
+	case *apievents.BotJoin:
+		// Only count successful joins.
+		if !e.Success {
+			return nil
+		}
+		return &BotJoinEvent{
+			BotName:       e.BotName,
+			JoinMethod:    e.Method,
+			JoinTokenName: e.TokenName,
+		}
 	}
 
 	return nil
diff --git a/lib/usagereporter/teleport/types.go b/lib/usagereporter/teleport/types.go
index 27d1cfce504a4..4b6a2af12adc4 100644
--- a/lib/usagereporter/teleport/types.go
+++ b/lib/usagereporter/teleport/types.go
@@ -54,6 +54,22 @@ func (u *UserLoginEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequ
 	}
 }
 
+// BotJoinEvent is an event emitted when a user logs into Teleport,
+// potentially via SSO.
+type BotJoinEvent prehogv1a.BotJoinEvent
+
+func (u *BotJoinEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequest {
+	return prehogv1a.SubmitEventRequest{
+		Event: &prehogv1a.SubmitEventRequest_BotJoin{
+			BotJoin: &prehogv1a.BotJoinEvent{
+				BotName:       a.AnonymizeString(u.BotName),
+				JoinTokenName: a.AnonymizeString(u.JoinTokenName),
+				JoinMethod:    u.JoinMethod,
+			},
+		},
+	}
+}
+
 // SSOCreateEvent is emitted when an SSO connector has been created.
 type SSOCreateEvent prehogv1a.SSOCreateEvent
 
@@ -236,6 +252,20 @@ func (u *UIOnboardSetCredentialSubmitEvent) Anonymize(a utils.Anonymizer) prehog
 	}
 }
 
+// UIOnboardQuestionnaireSubmitEvent is a UI event sent during registration when
+// user submit their onboarding questionnaire.
+type UIOnboardQuestionnaireSubmitEvent prehogv1a.UIOnboardQuestionnaireSubmitEvent
+
+func (u *UIOnboardQuestionnaireSubmitEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequest {
+	return prehogv1a.SubmitEventRequest{
+		Event: &prehogv1a.SubmitEventRequest_UiOnboardQuestionnaireSubmit{
+			UiOnboardQuestionnaireSubmit: &prehogv1a.UIOnboardQuestionnaireSubmitEvent{
+				UserName: a.AnonymizeString(u.UserName),
+			},
+		},
+	}
+}
+
 // UIOnboardRegisterChallengeSubmitEvent is a UI event sent during registration
 // when the MFA challenge is completed.
 type UIOnboardRegisterChallengeSubmitEvent prehogv1a.UIOnboardRegisterChallengeSubmitEvent
@@ -310,6 +340,24 @@ func (u *RoleCreateEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventReq
 	}
 }
 
+// BotCreateEvent is an event emitted when a Machine ID bot is created.
+type BotCreateEvent prehogv1a.BotCreateEvent
+
+func (u *BotCreateEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequest {
+	return prehogv1a.SubmitEventRequest{
+		Event: &prehogv1a.SubmitEventRequest_BotCreate{
+			BotCreate: &prehogv1a.BotCreateEvent{
+				UserName:    a.AnonymizeString(u.UserName),
+				RoleName:    a.AnonymizeString(u.RoleName),
+				BotUserName: a.AnonymizeString(u.BotUserName),
+				BotName:     a.AnonymizeString(u.BotName),
+				RoleCount:   u.RoleCount,
+				JoinMethod:  u.JoinMethod,
+			},
+		},
+	}
+}
+
 // UICreateNewRoleClickEvent is a UI event sent when a user prints recovery codes.
 type UICreateNewRoleClickEvent prehogv1a.UICreateNewRoleClickEvent
 
@@ -508,6 +556,20 @@ func (e *AssistCompletionEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEv
 	}
 }
 
+// EditorChangeEvent is an event emitted when the default editor is added or removed to an user
+type EditorChangeEvent prehogv1a.EditorChangeEvent
+
+func (e *EditorChangeEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequest {
+	return prehogv1a.SubmitEventRequest{
+		Event: &prehogv1a.SubmitEventRequest_EditorChangeEvent{
+			EditorChangeEvent: &prehogv1a.EditorChangeEvent{
+				UserName: a.AnonymizeString(e.UserName),
+				Status:   e.Status,
+			},
+		},
+	}
+}
+
 // UserMetadata contains user metadata information which is used to contextualize events with user information.
 type UserMetadata struct {
 	// Username contains the user's name.
@@ -547,6 +609,10 @@ func ConvertUsageEvent(event *usageeventsv1.UsageEventOneOf, userMD UserMetadata
 		return &UIOnboardSetCredentialSubmitEvent{
 			UserName: e.UiOnboardSetCredentialSubmit.Username,
 		}, nil
+	case *usageeventsv1.UsageEventOneOf_UiOnboardQuestionnaireSubmit:
+		return &UIOnboardQuestionnaireSubmitEvent{
+			UserName: e.UiOnboardQuestionnaireSubmit.Username,
+		}, nil
 	case *usageeventsv1.UsageEventOneOf_UiOnboardRegisterChallengeSubmit:
 		return &UIOnboardRegisterChallengeSubmitEvent{
 			UserName:  e.UiOnboardRegisterChallengeSubmit.Username,
@@ -651,9 +717,11 @@ func ConvertUsageEvent(event *usageeventsv1.UsageEventOneOf, userMD UserMetadata
 
 	case *usageeventsv1.UsageEventOneOf_UiDiscoverDeployServiceEvent:
 		ret := &UIDiscoverDeployServiceEvent{
-			Metadata: discoverMetadataToPrehog(e.UiDiscoverDeployServiceEvent.Metadata, userMD),
-			Resource: discoverResourceToPrehog(e.UiDiscoverDeployServiceEvent.Resource),
-			Status:   discoverStatusToPrehog(e.UiDiscoverDeployServiceEvent.Status),
+			Metadata:     discoverMetadataToPrehog(e.UiDiscoverDeployServiceEvent.Metadata, userMD),
+			Resource:     discoverResourceToPrehog(e.UiDiscoverDeployServiceEvent.Resource),
+			Status:       discoverStatusToPrehog(e.UiDiscoverDeployServiceEvent.Status),
+			DeployMethod: prehogv1a.UIDiscoverDeployServiceEvent_DeployMethod(e.UiDiscoverDeployServiceEvent.DeployMethod),
+			DeployType:   prehogv1a.UIDiscoverDeployServiceEvent_DeployType(e.UiDiscoverDeployServiceEvent.DeployType),
 		}
 		if err := ret.CheckAndSetDefaults(); err != nil {
 			return nil, trace.Wrap(err)
diff --git a/lib/usagereporter/teleport/types_discover.go b/lib/usagereporter/teleport/types_discover.go
index 3e170ef7c257d..fdfaa978196a2 100644
--- a/lib/usagereporter/teleport/types_discover.go
+++ b/lib/usagereporter/teleport/types_discover.go
@@ -224,8 +224,10 @@ func (u *UIDiscoverDeployServiceEvent) Anonymize(a utils.Anonymizer) prehogv1a.S
 					Id:       u.Metadata.Id,
 					UserName: a.AnonymizeString(u.Metadata.UserName),
 				},
-				Resource: u.Resource,
-				Status:   u.Status,
+				Resource:     u.Resource,
+				Status:       u.Status,
+				DeployMethod: u.DeployMethod,
+				DeployType:   u.DeployType,
 			},
 		},
 	}
diff --git a/lib/usagereporter/teleport/usagereporter.go b/lib/usagereporter/teleport/usagereporter.go
index 8be46ef4d5918..bf782eb606e3d 100644
--- a/lib/usagereporter/teleport/usagereporter.go
+++ b/lib/usagereporter/teleport/usagereporter.go
@@ -27,8 +27,10 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/sirupsen/logrus"
+	"golang.org/x/exp/slices"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	prehogv1a "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha"
 	prehogv1ac "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha/prehogv1alphaconnect"
@@ -219,3 +221,24 @@ var _ UsageReporter = DiscardUsageReporter{}
 func (DiscardUsageReporter) AnonymizeAndSubmit(...Anonymizable) {
 	// do nothing
 }
+
+// EmitEditorChangeEvent emits an editor change event if the editor role was added or removed.
+func EmitEditorChangeEvent(username string, prevRoles, newRoles []string, submit func(...Anonymizable)) {
+	prevEditor := slices.Contains(prevRoles, teleport.PresetEditorRoleName)
+	newEditor := slices.Contains(newRoles, teleport.PresetEditorRoleName)
+
+	// don't emit event if editor role wasn't added/removed
+	if prevEditor == newEditor {
+		return
+	}
+
+	eventType := prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_GRANTED
+	if prevEditor {
+		eventType = prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_REMOVED
+	}
+
+	submit(&EditorChangeEvent{
+		UserName: username,
+		Status:   eventType,
+	})
+}
diff --git a/lib/usagereporter/teleport/usagereporter_test.go b/lib/usagereporter/teleport/usagereporter_test.go
index eb280fe8232d4..aa4b35667cba4 100644
--- a/lib/usagereporter/teleport/usagereporter_test.go
+++ b/lib/usagereporter/teleport/usagereporter_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport"
 	usageeventsv1 "github.com/gravitational/teleport/api/gen/proto/go/usageevents/v1"
 	prehogv1a "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha"
 	"github.com/gravitational/teleport/lib/utils"
@@ -231,6 +232,33 @@ func TestConvertUsageEvent(t *testing.T) {
 				},
 			}},
 		},
+		{
+			name: "discover deploy service event",
+			event: &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiDiscoverDeployServiceEvent{
+				UiDiscoverDeployServiceEvent: &usageeventsv1.UIDiscoverDeployServiceEvent{
+					Metadata:     &usageeventsv1.DiscoverMetadata{Id: "someid"},
+					Resource:     &usageeventsv1.DiscoverResourceMetadata{Resource: usageeventsv1.DiscoverResource_DISCOVER_RESOURCE_SERVER},
+					Status:       &usageeventsv1.DiscoverStepStatus{Status: usageeventsv1.DiscoverStatus_DISCOVER_STATUS_SUCCESS},
+					DeployMethod: usageeventsv1.UIDiscoverDeployServiceEvent_DEPLOY_METHOD_AUTO,
+					DeployType:   usageeventsv1.UIDiscoverDeployServiceEvent_DEPLOY_TYPE_AMAZON_ECS,
+				},
+			}},
+			identityUsername: "myuser",
+			errCheck:         require.NoError,
+			expected: &prehogv1a.SubmitEventRequest{Event: &prehogv1a.SubmitEventRequest_UiDiscoverDeployServiceEvent{
+				UiDiscoverDeployServiceEvent: &prehogv1a.UIDiscoverDeployServiceEvent{
+					Metadata: &prehogv1a.DiscoverMetadata{
+						Id:       "someid",
+						UserName: expectedAnonymizedUserString,
+						Sso:      false,
+					},
+					Resource:     &prehogv1a.DiscoverResourceMetadata{Resource: prehogv1a.DiscoverResource_DISCOVER_RESOURCE_SERVER},
+					Status:       &prehogv1a.DiscoverStepStatus{Status: prehogv1a.DiscoverStatus_DISCOVER_STATUS_SUCCESS},
+					DeployMethod: prehogv1a.UIDiscoverDeployServiceEvent_DEPLOY_METHOD_AUTO,
+					DeployType:   prehogv1a.UIDiscoverDeployServiceEvent_DEPLOY_TYPE_AMAZON_ECS,
+				},
+			}},
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			tt := tt
@@ -252,3 +280,109 @@ func TestConvertUsageEvent(t *testing.T) {
 		})
 	}
 }
+
+func TestEmitEditorChangeEvent(t *testing.T) {
+	tt := []struct {
+		name           string
+		username       string
+		prevRoles      []string
+		newRoles       []string
+		expectedStatus prehogv1a.EditorChangeStatus
+	}{
+		{
+			name:           "Role is granted to user",
+			username:       "user1",
+			prevRoles:      []string{"role1", "role2"},
+			newRoles:       []string{"role1", "role2", teleport.PresetEditorRoleName},
+			expectedStatus: prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_GRANTED,
+		},
+		{
+			name:           "Role is removed from user",
+			username:       "user2",
+			prevRoles:      []string{"role1", "role2", teleport.PresetEditorRoleName},
+			newRoles:       []string{"role1", "role2"},
+			expectedStatus: prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_REMOVED,
+		},
+		{
+			name:      "Role remains the same",
+			username:  "user3",
+			prevRoles: []string{"role1", "role2", teleport.PresetEditorRoleName},
+			newRoles:  []string{"role1", "role2", teleport.PresetEditorRoleName},
+		},
+		{
+			name:      "Role is not granted or removed",
+			username:  "user4",
+			prevRoles: []string{"role1", "role2"},
+			newRoles:  []string{"role1", "role2"},
+		},
+		{
+			name:           "User is granted the editor role but had other roles",
+			username:       "user5",
+			prevRoles:      []string{"role1", "role2"},
+			newRoles:       []string{"role1", "role2", teleport.PresetEditorRoleName},
+			expectedStatus: prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_GRANTED,
+		},
+		{
+			name:           "User is removed from the editor role but still has other roles",
+			username:       "user6",
+			prevRoles:      []string{"role1", "role2", teleport.PresetEditorRoleName},
+			newRoles:       []string{"role1", "role2"},
+			expectedStatus: prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_REMOVED,
+		},
+		{
+			name:           "No previous roles, editor role granted",
+			username:       "user7",
+			prevRoles:      nil,
+			newRoles:       []string{teleport.PresetEditorRoleName},
+			expectedStatus: prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_GRANTED,
+		},
+		{
+			name:           "Only had editor role, role removed",
+			username:       "user8",
+			prevRoles:      []string{teleport.PresetEditorRoleName},
+			newRoles:       nil,
+			expectedStatus: prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_REMOVED,
+		},
+		{
+			name:      "Nil roles",
+			username:  "user9",
+			prevRoles: nil,
+			newRoles:  nil,
+		},
+		{
+			name:           "Granted multiple roles, including editor",
+			username:       "user10",
+			prevRoles:      []string{"role1", "role2"},
+			newRoles:       []string{"role1", "role2", "role3", teleport.PresetEditorRoleName},
+			expectedStatus: prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_GRANTED,
+		},
+		{
+			name:           "Removed from multiple roles, including editor",
+			username:       "user11",
+			prevRoles:      []string{"role1", "role2", "role3", teleport.PresetEditorRoleName},
+			newRoles:       []string{"role1", "role2"},
+			expectedStatus: prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_REMOVED,
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			var submittedEvents []Anonymizable
+			mockSubmit := func(a ...Anonymizable) {
+				submittedEvents = append(submittedEvents, a...)
+			}
+
+			EmitEditorChangeEvent(tc.username, tc.prevRoles, tc.newRoles, mockSubmit)
+
+			if tc.expectedStatus == prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_GRANTED || tc.expectedStatus == prehogv1a.EditorChangeStatus_EDITOR_CHANGE_STATUS_ROLE_REMOVED {
+				require.NotEmpty(t, submittedEvents)
+				event, ok := submittedEvents[0].(*EditorChangeEvent)
+				require.True(t, ok, "event is not of type *EditorChangeEvent")
+				require.Equal(t, tc.expectedStatus, event.Status)
+				require.Equal(t, tc.username, event.UserName)
+			} else {
+				require.Empty(t, submittedEvents, "No event should have been submitted")
+			}
+		})
+	}
+}
diff --git a/lib/usagereporter/web/userevent.go b/lib/usagereporter/web/userevent.go
index 6d9accad69110..95b80e3704a76 100644
--- a/lib/usagereporter/web/userevent.go
+++ b/lib/usagereporter/web/userevent.go
@@ -28,12 +28,14 @@ import (
 // these constants are 1:1 with user events found in the web directory
 // web/packages/teleport/src/services/userEvent/types.ts
 const (
-	bannerClickEvent                         = "tp.ui.banner.click"
-	setCredentialSubmitEvent                 = "tp.ui.onboard.setCredential.submit"
-	registerChallengeSubmitEvent             = "tp.ui.onboard.registerChallenge.submit"
-	addFirstResourceClickEvent               = "tp.ui.onboard.addFirstResource.click"
-	addFirstResourceLaterClickEvent          = "tp.ui.onboard.addFirstResourceLater.click"
-	completeGoToDashboardClickEvent          = "tp.ui.onboard.completeGoToDashboard.click"
+	bannerClickEvent                = "tp.ui.banner.click"
+	setCredentialSubmitEvent        = "tp.ui.onboard.setCredential.submit"
+	registerChallengeSubmitEvent    = "tp.ui.onboard.registerChallenge.submit"
+	addFirstResourceClickEvent      = "tp.ui.onboard.addFirstResource.click"
+	addFirstResourceLaterClickEvent = "tp.ui.onboard.addFirstResourceLater.click"
+	completeGoToDashboardClickEvent = "tp.ui.onboard.completeGoToDashboard.click"
+	questionnaireSubmitEvent        = "tp.ui.onboard.questionnaire.submit"
+
 	recoveryCodesContinueClickEvent          = "tp.ui.recoveryCodesContinue.click"
 	recoveryCodesCopyClickEvent              = "tp.ui.recoveryCodesCopy.click"
 	recoveryCodesPrintClickEvent             = "tp.ui.recoveryCodesPrint.click"
@@ -152,6 +154,12 @@ func ConvertPreUserEventRequestToUsageEvent(req CreatePreUserEventRequest) (*usa
 				Username: req.Username,
 			},
 		}
+	case questionnaireSubmitEvent:
+		typedEvent.Event = &usageeventsv1.UsageEventOneOf_UiOnboardQuestionnaireSubmit{
+			UiOnboardQuestionnaireSubmit: &usageeventsv1.UIOnboardQuestionnaireSubmitEvent{
+				Username: req.Username,
+			},
+		}
 	case completeGoToDashboardClickEvent:
 		typedEvent.Event = &usageeventsv1.UsageEventOneOf_UiOnboardCompleteGoToDashboardClick{
 			UiOnboardCompleteGoToDashboardClick: &usageeventsv1.UIOnboardCompleteGoToDashboardClickEvent{
diff --git a/lib/usagereporter/web/userevent_discover.go b/lib/usagereporter/web/userevent_discover.go
index 1a4122cd86b4a..e30418b168f97 100644
--- a/lib/usagereporter/web/userevent_discover.go
+++ b/lib/usagereporter/web/userevent_discover.go
@@ -20,6 +20,14 @@ import (
 	usageeventsv1 "github.com/gravitational/teleport/api/gen/proto/go/usageevents/v1"
 )
 
+// discoverServiceDeploy defines fields for enum string values
+// that describes how a service (agent) got deployed.
+// This struct is only considered for the event 'tp.ui.discover.deployService'
+type discoverServiceDeploy struct {
+	Method string `json:"method,omitempty"`
+	Type   string `json:"type,omitempty"`
+}
+
 // DiscoverEventData contains the required properties to create a Discover UsageEvent.
 type DiscoverEventData struct {
 	// ID is a unique ID per wizard session
@@ -39,6 +47,8 @@ type DiscoverEventData struct {
 	// event tp.ui.discover.database.enroll.rds
 	SelectedResourcesCount int `json:"selectedResourcesCount,omitempty"`
 
+	ServiceDeploy discoverServiceDeploy `json:"serviceDeploy,omitempty"`
+
 	// StepStatus is the Wizard step status result.
 	// Its possible values are the usageevents.DiscoverStepStatus proto enum values.
 	// Example: "DISCOVER_STATUS_SUCCESS"
@@ -116,11 +126,21 @@ func (d *DiscoverEventData) ToUsageEvent(eventName string) (*usageeventsv1.Usage
 		}}, nil
 
 	case uiDiscoverDeployServiceEvent:
+		deployMethodEnum, ok := usageeventsv1.UIDiscoverDeployServiceEvent_DeployMethod_value[d.ServiceDeploy.Method]
+		if !ok {
+			return nil, trace.BadParameter("invalid service deploy method %s", d.ServiceDeploy.Method)
+		}
+		deployTypeEnum, ok := usageeventsv1.UIDiscoverDeployServiceEvent_DeployType_value[d.ServiceDeploy.Type]
+		if !ok {
+			return nil, trace.BadParameter("invalid service deploy type %s", d.ServiceDeploy.Type)
+		}
 		return &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiDiscoverDeployServiceEvent{
 			UiDiscoverDeployServiceEvent: &usageeventsv1.UIDiscoverDeployServiceEvent{
-				Metadata: metadata,
-				Resource: resource,
-				Status:   status,
+				Metadata:     metadata,
+				Resource:     resource,
+				Status:       status,
+				DeployMethod: usageeventsv1.UIDiscoverDeployServiceEvent_DeployMethod(deployMethodEnum),
+				DeployType:   usageeventsv1.UIDiscoverDeployServiceEvent_DeployType(deployTypeEnum),
 			},
 		}}, nil
 
diff --git a/lib/usagereporter/web/userevent_discover_test.go b/lib/usagereporter/web/userevent_discover_test.go
index 8b05ea6740de5..d5715a59656ad 100644
--- a/lib/usagereporter/web/userevent_discover_test.go
+++ b/lib/usagereporter/web/userevent_discover_test.go
@@ -114,6 +114,31 @@ func TestDiscoverEventDataToUsageEvent(t *testing.T) {
 				},
 			}},
 		},
+		{
+			name:     uiDiscoverDeployServiceEvent + "/success_test_deployed_method_type_setting",
+			event:    uiDiscoverDeployServiceEvent,
+			errCheck: require.NoError,
+			req: DiscoverEventData{
+				ID:         "someid",
+				Resource:   "DISCOVER_RESOURCE_SERVER",
+				StepStatus: "DISCOVER_STATUS_SUCCESS",
+				ServiceDeploy: discoverServiceDeploy{
+					Method: "DEPLOY_METHOD_AUTO",
+					Type:   "DEPLOY_TYPE_AMAZON_ECS",
+				},
+			},
+			expected: &usageeventsv1.UsageEventOneOf{Event: &usageeventsv1.UsageEventOneOf_UiDiscoverDeployServiceEvent{
+				UiDiscoverDeployServiceEvent: &usageeventsv1.UIDiscoverDeployServiceEvent{
+					Metadata: &usageeventsv1.DiscoverMetadata{Id: "someid"},
+					Resource: &usageeventsv1.DiscoverResourceMetadata{Resource: usageeventsv1.DiscoverResource_DISCOVER_RESOURCE_SERVER},
+					Status: &usageeventsv1.DiscoverStepStatus{
+						Status: usageeventsv1.DiscoverStatus_DISCOVER_STATUS_SUCCESS,
+					},
+					DeployMethod: usageeventsv1.UIDiscoverDeployServiceEvent_DEPLOY_METHOD_AUTO,
+					DeployType:   usageeventsv1.UIDiscoverDeployServiceEvent_DEPLOY_TYPE_AMAZON_ECS,
+				},
+			}},
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			tt := tt
diff --git a/lib/utils/addr_test.go b/lib/utils/addr_test.go
index 13dc8887b7480..88477746cd17d 100644
--- a/lib/utils/addr_test.go
+++ b/lib/utils/addr_test.go
@@ -180,7 +180,7 @@ func TestLocalAddrs(t *testing.T) {
 func TestGuessesIPAddress(t *testing.T) {
 	t.Parallel()
 
-	var testCases = []struct {
+	testCases := []struct {
 		addrs    []net.Addr
 		expected net.IP
 		comment  string
diff --git a/lib/utils/archive_test.go b/lib/utils/archive_test.go
index bd9e30a65934e..5a0dc0713cb58 100644
--- a/lib/utils/archive_test.go
+++ b/lib/utils/archive_test.go
@@ -114,7 +114,6 @@ func TestCompressAsTarGzArchive(t *testing.T) {
 
 			gotBytes, err := io.ReadAll(tarReader)
 			require.NoError(t, err)
-			t.Log(string(gotBytes))
 
 			require.Equal(t, tt.fsContents[header.Name].content, gotBytes)
 			require.Equal(t, tt.fsContents[header.Name].mode, fs.FileMode(header.Mode))
diff --git a/lib/utils/aws/aws.go b/lib/utils/aws/aws.go
index 8b8dd134093e2..5a1e6339278a8 100644
--- a/lib/utils/aws/aws.go
+++ b/lib/utils/aws/aws.go
@@ -367,7 +367,7 @@ func BuildRoleARN(username, region, accountID string) (string, error) {
 		return username, nil
 	}
 	resource := username
-	if !strings.HasPrefix(resource, "role/") {
+	if !IsPartialRoleARN(resource) {
 		resource = fmt.Sprintf("role/%s", username)
 	}
 	roleARN := &arn.ARN{
@@ -435,3 +435,47 @@ func CheckARNPartitionAndAccount(ARN *arn.ARN, wantPartition, wantAccountID stri
 	}
 	return nil
 }
+
+// IsRoleARN returns true if the provided string is a AWS role ARN.
+func IsRoleARN(roleARN string) bool {
+	if _, err := ParseRoleARN(roleARN); err == nil {
+		return true
+	}
+
+	return IsPartialRoleARN(roleARN)
+}
+
+// IsPartialRoleARN returns true if the provided role ARN only contains the
+// resource name.
+func IsPartialRoleARN(roleARN string) bool {
+	return strings.HasPrefix(roleARN, "role/")
+}
+
+// IsUserARN returns true if the provided string is a AWS user ARN.
+func IsUserARN(userARN string) bool {
+	resourceName := userARN
+	if parsed, err := arn.Parse(userARN); err == nil {
+		resourceName = parsed.Resource
+	}
+
+	return strings.HasPrefix(resourceName, "user/")
+}
+
+// PolicyARN returns the ARN representation of an AWS IAM Policy.
+func PolicyARN(partition, accountID, policy string) string {
+	return iamResourceARN(partition, accountID, "policy", policy)
+}
+
+// RoleARN returns the ARN representation of an AWS IAM Role.
+func RoleARN(partition, accountID, role string) string {
+	return iamResourceARN(partition, accountID, "role", role)
+}
+
+func iamResourceARN(partition, accountID, resourceType, resourceName string) string {
+	return arn.ARN{
+		Partition: partition,
+		Service:   "iam",
+		AccountID: accountID,
+		Resource:  fmt.Sprintf("%s/%s", resourceType, resourceName),
+	}.String()
+}
diff --git a/lib/utils/aws/aws_test.go b/lib/utils/aws/aws_test.go
index 4d617e8842a6d..cb99e41abf0aa 100644
--- a/lib/utils/aws/aws_test.go
+++ b/lib/utils/aws/aws_test.go
@@ -400,3 +400,90 @@ func TestBuildRoleARN(t *testing.T) {
 		})
 	}
 }
+
+func TestIsRoleARN(t *testing.T) {
+	for name, tt := range map[string]struct {
+		arn           string
+		expectedValue bool
+	}{
+		"valid full arn":      {"arn:aws:iam::123456789012:role/role-name", true},
+		"valid partial arn":   {"role/role-name", true},
+		"valid user arn":      {"arn:aws:iam::123456789012:user/user-name", false},
+		"invalid arn":         {"arn:aws:iam:::123456789012:role/role-name", false},
+		"invalid partial arn": {"user/user-name", false},
+		"invalid value":       {"role-name", false},
+	} {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, tt.expectedValue, IsRoleARN(tt.arn))
+		})
+	}
+}
+
+func TestIsUserARN(t *testing.T) {
+	for name, tt := range map[string]struct {
+		arn           string
+		expectedValue bool
+	}{
+		"valid full arn":      {"arn:aws:iam::123456789012:user/user-name", true},
+		"valid partial arn":   {"user/user-name", true},
+		"valid user arn":      {"arn:aws:iam::123456789012:role/role-name", false},
+		"invalid arn":         {"arn:aws:iam:::123456789012:user/user-name", false},
+		"invalid partial arn": {"role/role-name", false},
+		"invalid value":       {"user-name", false},
+	} {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, tt.expectedValue, IsUserARN(tt.arn))
+		})
+	}
+}
+
+func FuzzParseSigV4(f *testing.F) {
+	f.Add("")
+	f.Add("Authorization: AWS4-HMAC-SHA256 " +
+		"Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/s3/aws4_request, " +
+		"SignedHeaders=host;range;x-amz-date, " +
+		"Signature=fe5f80f77d5fa3beca038a248ff027d0445342fe2855ddc963176630326f1024")
+
+	f.Fuzz(func(t *testing.T, str string) {
+		require.NotPanics(t, func() {
+			_, _ = ParseSigV4(str)
+		})
+	})
+}
+
+func TestResourceARN(t *testing.T) {
+	for _, tt := range []struct {
+		name         string
+		resourceType string
+		partition    string
+		accountID    string
+		resourceName string
+		expected     string
+	}{
+		{
+			name:         "role",
+			resourceType: "role",
+			partition:    "aws",
+			accountID:    "123456789012",
+			resourceName: "MyRole",
+			expected:     "arn:aws:iam::123456789012:role/MyRole",
+		},
+		{
+			name:         "policy",
+			resourceType: "policy",
+			partition:    "aws",
+			accountID:    "123456789012",
+			resourceName: "MyPolicy",
+			expected:     "arn:aws:iam::123456789012:policy/MyPolicy",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			switch tt.resourceType {
+			case "role":
+				require.Equal(t, tt.expected, RoleARN(tt.partition, tt.accountID, tt.resourceName))
+			case "policy":
+				require.Equal(t, tt.expected, PolicyARN(tt.partition, tt.accountID, tt.resourceName))
+			}
+		})
+	}
+}
diff --git a/lib/utils/aws/s3.go b/lib/utils/aws/s3.go
index cb63d379127ea..fedf050ab5380 100644
--- a/lib/utils/aws/s3.go
+++ b/lib/utils/aws/s3.go
@@ -15,8 +15,13 @@
 package aws
 
 import (
+	"context"
 	"errors"
+	"io"
 
+	awsV2 "github.com/aws/aws-sdk-go-v2/aws"
+	managerV2 "github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	s3v2 "github.com/aws/aws-sdk-go-v2/service/s3"
 	s3Types "github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/s3"
@@ -62,3 +67,64 @@ func ConvertS3Error(err error, args ...interface{}) error {
 	}
 	return err
 }
+
+// s3V2FileWriter can be used to upload data to s3 via io.WriteCloser interface.
+type s3V2FileWriter struct {
+	// uploadFinisherErrChan is used to wait for completed upload as well as
+	// sending error message.
+	uploadFinisherErrChan <-chan error
+	pipeWriter            *io.PipeWriter
+	pipeReader            *io.PipeReader
+}
+
+// NewS3V2FileWriter created s3V2FileWriter. Close method on writer should be called
+// to make sure that reader has finished.
+func NewS3V2FileWriter(ctx context.Context, s3Client managerV2.UploadAPIClient, bucket, key string, uploaderOptions []func(*managerV2.Uploader), putObjectInputOptions ...func(*s3v2.PutObjectInput)) (*s3V2FileWriter, error) {
+	uploader := managerV2.NewUploader(s3Client, uploaderOptions...)
+	pr, pw := io.Pipe()
+
+	uploadParams := &s3v2.PutObjectInput{
+		Bucket: awsV2.String(bucket),
+		Key:    awsV2.String(key),
+		Body:   pr,
+	}
+
+	for _, f := range putObjectInputOptions {
+		f(uploadParams)
+	}
+	uploadFinisherErrChan := make(chan error)
+	go func() {
+		defer close(uploadFinisherErrChan)
+		_, err := uploader.Upload(ctx, uploadParams)
+		if err != nil {
+			pr.CloseWithError(err)
+		}
+		uploadFinisherErrChan <- trace.Wrap(err)
+	}()
+
+	return &s3V2FileWriter{
+		uploadFinisherErrChan: uploadFinisherErrChan,
+		pipeWriter:            pw,
+		pipeReader:            pr,
+	}, nil
+}
+
+// Write bytes from in to the connected pipe.
+func (s *s3V2FileWriter) Write(in []byte) (int, error) {
+	bytesWritten, writeError := s.pipeWriter.Write(in)
+	if writeError != nil {
+		s.pipeWriter.CloseWithError(writeError)
+		return bytesWritten, writeError
+	}
+	return bytesWritten, nil
+}
+
+// Close signals write completion and cleans up any
+// open streams. Will block until pending uploads are complete.
+func (s *s3V2FileWriter) Close() error {
+	wCloseErr := s.pipeWriter.Close()
+	// wait for reader to finish, it will be triggered by writer.Close
+	readerErr := <-s.uploadFinisherErrChan
+	rCloseErr := s.pipeReader.Close()
+	return trace.Wrap(trace.NewAggregate(wCloseErr, readerErr, rCloseErr))
+}
diff --git a/lib/utils/aws/s3_test.go b/lib/utils/aws/s3_test.go
new file mode 100644
index 0000000000000..8d557d394ed24
--- /dev/null
+++ b/lib/utils/aws/s3_test.go
@@ -0,0 +1,110 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package aws
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewS3V2FileWriter(t *testing.T) {
+	t.Run("writer.Close waits for upload to finish", func(t *testing.T) {
+		ctx := context.Background()
+		mock := &s3ClientMock{}
+		writer, err := NewS3V2FileWriter(ctx, mock, "bucket", "key", nil /* uploader options */)
+		require.NoError(t, err)
+
+		testMessage := "test message"
+		_, err = fmt.Fprint(writer, testMessage)
+		require.NoError(t, err)
+
+		err = writer.Close()
+		require.NoError(t, err)
+
+		require.True(t, mock.getPutOjectCalled())
+		require.Equal(t, testMessage, string(mock.getPutOjectBody()))
+	})
+
+	t.Run("on failure from upload, error is propagated", func(t *testing.T) {
+		ctx := context.Background()
+		mock := &s3ClientMock{
+			putObjectErr: errors.New("error from reading"),
+		}
+		writer, err := NewS3V2FileWriter(ctx, mock, "bucket", "key", nil /* uploader options */)
+		require.NoError(t, err)
+
+		testMessage := "test message"
+		_, err = fmt.Fprint(writer, testMessage)
+		require.NoError(t, err)
+
+		// Error should be received on close.
+		err = writer.Close()
+		require.ErrorContains(t, err, "error from reading")
+	})
+}
+
+type s3ClientMock struct {
+	manager.UploadAPIClient
+
+	putObjectErr error
+
+	// mu protects putObject fields
+	mu              sync.Mutex
+	putObjectCalled bool
+	putObjectBody   []byte
+}
+
+func (s *s3ClientMock) getPutOjectCalled() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.putObjectCalled
+}
+
+func (s *s3ClientMock) getPutOjectBody() []byte {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.putObjectBody
+}
+
+func (s *s3ClientMock) PutObject(ctx context.Context, in *s3.PutObjectInput, opts ...func(*s3.Options)) (*s3.PutObjectOutput, error) {
+	if s.putObjectErr != nil {
+		return nil, s.putObjectErr
+	}
+
+	// simulate some work with sleeping
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case <-time.After(10 * time.Millisecond):
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		s.putObjectCalled = true
+		var err error
+		s.putObjectBody, err = io.ReadAll(in.Body)
+		if err != nil {
+			return nil, err
+		}
+		return &s3.PutObjectOutput{}, nil
+	}
+}
diff --git a/lib/utils/cli.go b/lib/utils/cli.go
index 0634856e36c45..96cfddedda024 100644
--- a/lib/utils/cli.go
+++ b/lib/utils/cli.go
@@ -119,6 +119,14 @@ type Logger interface {
 	SetLevel(level logrus.Level)
 }
 
+// FieldLoggerWithWriter describes a logger that can expose a writer
+// to be used by stdlib loggers.
+type FieldLoggerWithWriter interface {
+	logrus.FieldLogger
+	Writer() *io.PipeWriter
+	WriterLevel(logrus.Level) *io.PipeWriter
+}
+
 // FatalError is for CLI front-ends: it detects gravitational/trace debugging
 // information, sends it to the logger, strips it off and prints a clean message to stderr
 func FatalError(err error) {
diff --git a/lib/utils/conn.go b/lib/utils/conn.go
index af9cd84345507..ea1cfb050816d 100644
--- a/lib/utils/conn.go
+++ b/lib/utils/conn.go
@@ -197,3 +197,30 @@ func (w *TrackingWriter) Write(b []byte) (int, error) {
 	atomic.AddUint64(&w.count, uint64(n))
 	return n, trace.Wrap(err)
 }
+
+// ConnWithSrcAddr is a net.Conn wrapper that allows us to specify remote client address
+type ConnWithSrcAddr struct {
+	net.Conn
+	clientSrcAddr net.Addr
+}
+
+// RemoteAddr returns specified client source address
+func (c *ConnWithSrcAddr) RemoteAddr() net.Addr {
+	if c.clientSrcAddr == nil {
+		return c.Conn.RemoteAddr()
+	}
+	return c.clientSrcAddr
+}
+
+// NetConn returns the underlying net.Conn.
+func (c *ConnWithSrcAddr) NetConn() net.Conn {
+	return c.Conn
+}
+
+// NewConnWithSrcAddr wraps provided connection and overrides client remote address
+func NewConnWithSrcAddr(conn net.Conn, clientSrcAddr net.Addr) *ConnWithSrcAddr {
+	return &ConnWithSrcAddr{
+		Conn:          conn,
+		clientSrcAddr: clientSrcAddr,
+	}
+}
diff --git a/lib/utils/conn_test.go b/lib/utils/conn_test.go
index f67e06f9c5c8a..8797371e6a072 100644
--- a/lib/utils/conn_test.go
+++ b/lib/utils/conn_test.go
@@ -19,6 +19,7 @@ package utils
 import (
 	"bytes"
 	"io"
+	"net"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -35,3 +36,27 @@ func TestTrackingReaderEOF(t *testing.T) {
 	_, err := tr.Read(buf)
 	require.Equal(t, io.EOF, err)
 }
+
+func TestConnWithSrcAddr(t *testing.T) {
+	t.Parallel()
+
+	orgConn, _ := net.Pipe()
+
+	t.Run("nil clientSrcAddr", func(t *testing.T) {
+		conn := NewConnWithSrcAddr(orgConn, nil)
+
+		require.Equal(t, orgConn.RemoteAddr().String(), conn.RemoteAddr().String())
+		require.Equal(t, orgConn.LocalAddr().String(), conn.LocalAddr().String())
+		require.Equal(t, orgConn, conn.NetConn())
+	})
+
+	t.Run("valid clientSrcAddr", func(t *testing.T) {
+		addr := MustParseAddr("11.22.33.44:5566")
+		conn := NewConnWithSrcAddr(orgConn, addr)
+
+		require.NotEqual(t, orgConn.RemoteAddr().String(), conn.RemoteAddr().String())
+		require.Equal(t, "11.22.33.44:5566", conn.RemoteAddr().String())
+		require.Equal(t, orgConn.LocalAddr().String(), conn.LocalAddr().String())
+		require.Equal(t, orgConn, conn.NetConn())
+	})
+}
diff --git a/lib/utils/fuzz_test.go b/lib/utils/fuzz_test.go
index 11ce04da41d0a..1d7c411af6ebc 100644
--- a/lib/utils/fuzz_test.go
+++ b/lib/utils/fuzz_test.go
@@ -26,6 +26,9 @@ import (
 )
 
 func FuzzParseProxyJump(f *testing.F) {
+	f.Add("@:,")
+	f.Add("user@host:port,bob@host:port")
+
 	f.Fuzz(func(t *testing.T, in string) {
 		require.NotPanics(t, func() {
 			ParseProxyJump(in)
@@ -34,6 +37,13 @@ func FuzzParseProxyJump(f *testing.F) {
 }
 
 func FuzzParseWebLinks(f *testing.F) {
+	f.Add("|")
+	f.Add(",")
+	f.Add("<foo>|<bar>")
+	f.Add("<foo>,<bar>")
+	f.Add(`<foo>; rel="next"|<bar>; rel="prev"`)
+	f.Add(`<foo>; rel="first",<bar>; rel="last"`)
+
 	f.Fuzz(func(t *testing.T, s string) {
 		links := strings.Split(s, "|")
 		require.NotPanics(t, func() {
@@ -48,11 +58,18 @@ func FuzzParseWebLinks(f *testing.F) {
 }
 
 func FuzzReadYAML(f *testing.F) {
+	f.Add([]byte("name: Example\nage: 30\nskills:\n  - Python\n  - JavaScript"))
+	f.Add([]byte("---\nname: Document1\n---\nname: Document2"))
+	f.Add([]byte(`name: "John Doe`))
+	f.Add([]byte("level1:\n  level2:\n    level3:\n      level4:\n        key: value"))
+	f.Add([]byte("default: &DEFAULT\n  name: Example\n  age: 30\nperson1:\n  <<: *DEFAULT\n  name: Another Example"))
+	f.Add([]byte("123:\n  name: Example"))
+
 	f.Fuzz(func(t *testing.T, dataBytes []byte) {
 		data := bytes.NewReader(dataBytes)
 
 		require.NotPanics(t, func() {
-			ReadYAML(data)
+			_, _ = ReadYAML(data)
 		})
 	})
 }
diff --git a/lib/utils/host/hostusers.go b/lib/utils/host/hostusers.go
index 1cc4504470ce9..6251d8e36cd37 100644
--- a/lib/utils/host/hostusers.go
+++ b/lib/utils/host/hostusers.go
@@ -40,7 +40,7 @@ func GroupAdd(groupname string) (exitCode int, err error) {
 		return -1, trace.Wrap(err, "cant find groupadd binary")
 	}
 	cmd := exec.Command(groupaddBin, groupname)
-	output, err := cmd.Output()
+	output, err := cmd.CombinedOutput()
 	log.Debugf("%s output: %s", cmd.Path, string(output))
 	if cmd.ProcessState.ExitCode() == GroupExistExit {
 		return cmd.ProcessState.ExitCode(), trace.AlreadyExists("group already exists")
@@ -60,7 +60,7 @@ func UserAdd(username string, groups []string) (exitCode int, err error) {
 		args = append(args, "--groups", strings.Join(groups, ","))
 	}
 	cmd := exec.Command(useraddBin, args...)
-	output, err := cmd.Output()
+	output, err := cmd.CombinedOutput()
 	log.Debugf("%s output: %s", cmd.Path, string(output))
 	if cmd.ProcessState.ExitCode() == UserExistExit {
 		return cmd.ProcessState.ExitCode(), trace.AlreadyExists("user already exists")
@@ -79,12 +79,12 @@ func AddUserToGroups(username string, groups []string) (exitCode int, err error)
 	args = append(args, username)
 	// usermod -aG (append groups) (username)
 	cmd := exec.Command(usermodBin, args...)
-	output, err := cmd.Output()
+	output, err := cmd.CombinedOutput()
 	log.Debugf("%s output: %s", cmd.Path, string(output))
 	return cmd.ProcessState.ExitCode(), trace.Wrap(err)
 }
 
-// UserDel creates a user on a host using `userdel`
+// UserDel deletes a user on a host using `userdel`.
 func UserDel(username string) (exitCode int, err error) {
 	userdelBin, err := exec.LookPath("userdel")
 	if err != nil {
@@ -92,7 +92,7 @@ func UserDel(username string) (exitCode int, err error) {
 	}
 	// userdel --remove (remove home) username
 	cmd := exec.Command(userdelBin, "--remove", username)
-	output, err := cmd.Output()
+	output, err := cmd.CombinedOutput()
 	log.Debugf("%s output: %s", cmd.Path, string(output))
 	return cmd.ProcessState.ExitCode(), trace.Wrap(err)
 }
@@ -104,7 +104,7 @@ func GetAllUsers() ([]string, int, error) {
 	}
 	// getent passwd
 	cmd := exec.Command(getentBin, "passwd")
-	output, err := cmd.Output()
+	output, err := cmd.CombinedOutput()
 	if err != nil {
 		return nil, -1, trace.Wrap(err)
 	}
diff --git a/lib/utils/http.go b/lib/utils/http.go
index 389da1a291c0b..fae574b37e503 100644
--- a/lib/utils/http.go
+++ b/lib/utils/http.go
@@ -121,3 +121,26 @@ func GetAnyHeader(header http.Header, keys ...string) string {
 type HTTPDoClient interface {
 	Do(req *http.Request) (*http.Response, error)
 }
+
+// HTTPMiddleware defines a HTTP middleware.
+type HTTPMiddleware func(next http.Handler) http.Handler
+
+// ChainHTTPMiddlewares wraps an http.Handler with a list of middlewares. Inner
+// middlewares should be provided before outer middlewares.
+func ChainHTTPMiddlewares(handler http.Handler, middlewares ...HTTPMiddleware) http.Handler {
+	if len(middlewares) == 0 {
+		return handler
+	}
+	apply := middlewares[0]
+	middlewares = middlewares[1:]
+	if apply != nil {
+		handler = apply(handler)
+	}
+	return ChainHTTPMiddlewares(handler, middlewares...)
+}
+
+// NoopHTTPMiddleware is a no-operation HTTPMiddleware that returns the
+// original handler.
+func NoopHTTPMiddleware(next http.Handler) http.Handler {
+	return next
+}
diff --git a/lib/utils/http_test.go b/lib/utils/http_test.go
index 5fd47e1a99ee7..df9b0b9cb1c0b 100644
--- a/lib/utils/http_test.go
+++ b/lib/utils/http_test.go
@@ -17,7 +17,9 @@ limitations under the License.
 package utils
 
 import (
+	"io"
 	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -51,3 +53,42 @@ func TestGetAnyHeader(t *testing.T) {
 	require.Equal(t, "a1", GetAnyHeader(header, "ccc", "aaa"))
 	require.Equal(t, "b1", GetAnyHeader(header, "bbb", "aaa"))
 }
+
+func TestChainHTTPMiddlewares(t *testing.T) {
+	baseHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("baseHandler"))
+	})
+
+	middleware2 := func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Write([]byte("middleware2->"))
+			next.ServeHTTP(w, r)
+		})
+	}
+	middleware4 := func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Write([]byte("middleware4->"))
+			next.ServeHTTP(w, r)
+		})
+	}
+
+	handler := ChainHTTPMiddlewares(
+		baseHandler,
+		nil,
+		middleware2,
+		NoopHTTPMiddleware,
+		middleware4,
+	)
+
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest("", "/", nil)
+	handler.ServeHTTP(w, r)
+
+	resp := w.Result()
+	defer resp.Body.Close()
+
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, "middleware4->middleware2->baseHandler", string(body))
+}
diff --git a/lib/utils/net.go b/lib/utils/net.go
index 52772f34d9f46..3877a71843ab4 100644
--- a/lib/utils/net.go
+++ b/lib/utils/net.go
@@ -41,6 +41,11 @@ func ClientAddrContext(ctx context.Context, src net.Addr, dst net.Addr) context.
 	return context.WithValue(ctx, ClientDstAddrContextKey, dst)
 }
 
+// ClientSrcAddrContext sets client source address.
+func ClientSrcAddrContext(ctx context.Context, src net.Addr) context.Context {
+	return context.WithValue(ctx, ClientSrcAddrContextKey, src)
+}
+
 // ClientAddrFromContext gets client source address and destination addresses from the context. If an address is
 // not present, nil will be returned
 func ClientAddrFromContext(ctx context.Context) (src net.Addr, dst net.Addr) {
diff --git a/lib/utils/parse/fuzz_test.go b/lib/utils/parse/fuzz_test.go
index b356a1e99042f..54f329f0c91eb 100644
--- a/lib/utils/parse/fuzz_test.go
+++ b/lib/utils/parse/fuzz_test.go
@@ -23,6 +23,11 @@ import (
 )
 
 func FuzzNewExpression(f *testing.F) {
+	f.Add("")
+	f.Add("foo")
+	f.Add("{{external.foo}}")
+	f.Add(`{{regexp.replace(internal.foo, "foo-(.*)-(.*)", "$1.$2")}}`)
+
 	f.Fuzz(func(t *testing.T, variable string) {
 		require.NotPanics(t, func() {
 			NewTraitsTemplateExpression(variable)
@@ -31,6 +36,12 @@ func FuzzNewExpression(f *testing.F) {
 }
 
 func FuzzNewMatcher(f *testing.F) {
+	f.Add("")
+	f.Add("foo")
+	f.Add("*")
+	f.Add("^foo$")
+	f.Add(`{{regexp.match("foo.*")}}`)
+
 	f.Fuzz(func(t *testing.T, value string) {
 		require.NotPanics(t, func() {
 			NewMatcher(value)
diff --git a/lib/utils/replace.go b/lib/utils/replace.go
index f5e9998a388cc..cec08573bf42f 100644
--- a/lib/utils/replace.go
+++ b/lib/utils/replace.go
@@ -96,9 +96,7 @@ type RegexpConfig struct {
 // The wildcard (*) expansion is also supported.
 func KubeResourceMatchesRegex(input types.KubernetesResource, resources []types.KubernetesResource) (bool, error) {
 	for _, resource := range resources {
-		// TODO(tigrato): evaluate if we should support wildcards as well
-		// for future compatibility.
-		if input.Kind != resource.Kind {
+		if input.Kind != resource.Kind && resource.Kind != types.Wildcard {
 			continue
 		}
 		switch ok, err := MatchString(input.Name, resource.Name); {
diff --git a/lib/utils/stream/zip.go b/lib/utils/stream/zip.go
new file mode 100644
index 0000000000000..74d0f6ab20f7e
--- /dev/null
+++ b/lib/utils/stream/zip.go
@@ -0,0 +1,121 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package stream
+
+import (
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/internalutils/stream"
+)
+
+// ZipStreams is a helper for iterate two streams and process elements in the
+// leader stream only if they don't already exists in the follower stream.
+// The streams must be sorted and comparable.
+type ZipStreams[T, V any] struct {
+	// leader is the stream that will be leading the iteration.
+	leader stream.Stream[T]
+	// follower is the stream that will be following the iteration.
+	follower stream.Stream[V]
+	// onMissing is the function that will be called when the leader element is
+	// missing in the follower stream.
+	onMissing func(elem T) error
+	// onEqualKeys is the function that will be called when the leader element
+	// has the same key as the follower element. It allows additional processing
+	// of the element.
+	onEqualKeys func(leader T, follower V) error
+	// compareKeys is the function that will be used to compare the keys of the
+	// leader and follower elements.
+	// It should return 0 if leader == follower, -1 if leader < follower, and +1 if leader > follower.
+	compareKeys func(leader T, follower V) int
+}
+
+// NewZipStreams returns a new instance of ZipStreams.
+func NewZipStreams[T, V any](leader stream.Stream[T], follower stream.Stream[V],
+	onMissing func(elem T) error,
+	onEqualKeys func(leader T, follower V) error,
+	compare func(leader T, follower V) int,
+) *ZipStreams[T, V] {
+	return &ZipStreams[T, V]{
+		leader:      leader,
+		follower:    follower,
+		onMissing:   onMissing,
+		onEqualKeys: onEqualKeys,
+		compareKeys: compare,
+	}
+}
+
+// Process consumes the streams and returns an error reported by handler functions.
+// Processing will stop on the first error.
+func (z *ZipStreams[T, V]) Process() error {
+	var leaderItem T
+	var followerItem V
+	hasLeader := z.leader.Next()
+	hasFollower := z.follower.Next()
+
+	if hasLeader {
+		leaderItem = z.leader.Item()
+	}
+	if hasFollower {
+		followerItem = z.follower.Item()
+	}
+
+	for hasLeader && hasFollower {
+		cmp := z.compareKeys(leaderItem, followerItem)
+		if cmp == -1 {
+			// leader > follower - follower is missing
+			if err := z.onMissing(leaderItem); err != nil {
+				return trace.Wrap(err)
+			}
+
+			hasLeader = z.leader.Next()
+			if hasLeader {
+				leaderItem = z.leader.Item()
+			}
+		} else if cmp == 1 {
+			// leader < follower - advancde
+			hasFollower = z.follower.Next()
+			if hasFollower {
+				followerItem = z.follower.Item()
+			}
+		} else {
+			// leader == follower
+			if err := z.onEqualKeys(leaderItem, followerItem); err != nil {
+				return trace.Wrap(err)
+			}
+			hasLeader = z.leader.Next()
+			hasFollower = z.follower.Next()
+			if hasLeader {
+				leaderItem = z.leader.Item()
+			}
+			if hasFollower {
+				followerItem = z.follower.Item()
+			}
+		}
+	}
+
+	for hasLeader {
+		if err := z.onMissing(leaderItem); err != nil {
+			return trace.Wrap(err)
+		}
+		hasLeader = z.leader.Next()
+		if hasLeader {
+			leaderItem = z.leader.Item()
+		}
+	}
+
+	return trace.NewAggregate(z.leader.Done(), z.follower.Done())
+}
diff --git a/lib/utils/stream/zip_test.go b/lib/utils/stream/zip_test.go
new file mode 100644
index 0000000000000..c5c555f9f3bda
--- /dev/null
+++ b/lib/utils/stream/zip_test.go
@@ -0,0 +1,254 @@
+/*
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package stream_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/internalutils/stream"
+	streamutils "github.com/gravitational/teleport/lib/utils/stream"
+)
+
+func Test_zipStreams_Process(t *testing.T) {
+	type testCase[T any, V any] struct {
+		name     string
+		validate func(t *testing.T) (*streamutils.ZipStreams[T, V], func())
+		wantErr  bool
+	}
+	tests := []testCase[string, string]{
+		{
+			name: "empty",
+			validate: func(t *testing.T) (*streamutils.ZipStreams[string, string], func()) {
+				counter := 0
+				equalCounter := 0
+				return streamutils.NewZipStreams[string, string](
+						stream.Empty[string](),
+						stream.Empty[string](),
+						func(s1 string) error {
+							counter++
+							return nil
+						},
+						func(leader string, follower string) error {
+							equalCounter++
+							return nil
+						},
+						strings.Compare,
+					), func() {
+						require.Equal(t, 0, counter)
+						require.Equal(t, 0, equalCounter)
+					}
+			},
+			wantErr: false,
+		},
+		{
+			name: "one",
+			validate: func(t *testing.T) (*streamutils.ZipStreams[string, string], func()) {
+				counter := 0
+				equalCounter := 0
+				return streamutils.NewZipStreams[string, string](
+						stream.Slice([]string{"foo"}),
+						stream.Empty[string](),
+						func(s1 string) error {
+							counter++
+							return nil
+						},
+						func(leader string, follower string) error {
+							equalCounter++
+							return nil
+						},
+						strings.Compare,
+					), func() {
+						require.Equal(t, 1, counter)
+						require.Equal(t, 0, equalCounter)
+					}
+			},
+			wantErr: false,
+		},
+		{
+			name: "no leaders",
+			validate: func(t *testing.T) (*streamutils.ZipStreams[string, string], func()) {
+				counter := 0
+				equalCounter := 0
+				return streamutils.NewZipStreams[string, string](
+						stream.Empty[string](),
+						stream.Slice([]string{"foo"}),
+						func(s1 string) error {
+							counter++
+							return nil
+						},
+						func(leader string, follower string) error {
+							equalCounter++
+							return nil
+						},
+						strings.Compare,
+					), func() {
+						require.Equal(t, 0, counter)
+						require.Equal(t, 0, equalCounter)
+					}
+			},
+			wantErr: false,
+		},
+		{
+			name: "already in sync",
+			validate: func(t *testing.T) (*streamutils.ZipStreams[string, string], func()) {
+				counter := 0
+				equalCounter := 0
+				return streamutils.NewZipStreams[string, string](
+						stream.Slice([]string{"foo"}),
+						stream.Slice([]string{"foo"}),
+						func(s1 string) error {
+							counter++
+							return nil
+						},
+						func(leader string, follower string) error {
+							equalCounter++
+							return nil
+						},
+						strings.Compare,
+					), func() {
+						require.Equal(t, 0, counter)
+						require.Equal(t, 1, equalCounter)
+					}
+			},
+			wantErr: false,
+		},
+		{
+			name: "additional leader",
+			validate: func(t *testing.T) (*streamutils.ZipStreams[string, string], func()) {
+				counter := 0
+				equalCounter := 0
+				calledWith := make([]string, 0)
+				return streamutils.NewZipStreams[string, string](
+						stream.Slice([]string{"bar", "foo"}),
+						stream.Slice([]string{"foo"}),
+						func(s1 string) error {
+							counter++
+							calledWith = append(calledWith, s1)
+							return nil
+						},
+						func(leader string, follower string) error {
+							// should be called with "foo" and "foo"
+							require.Equal(t, "foo", leader)
+							require.Equal(t, "foo", follower)
+							equalCounter++
+							return nil
+						},
+						strings.Compare,
+					), func() {
+						require.Equal(t, 1, counter)
+						require.Equal(t, []string{"bar"}, calledWith)
+						require.Equal(t, 1, equalCounter)
+					}
+			},
+			wantErr: false,
+		},
+		{
+			name: "additional follower - no calls",
+			validate: func(t *testing.T) (*streamutils.ZipStreams[string, string], func()) {
+				counter := 0
+				equalCounter := 0
+				return streamutils.NewZipStreams[string, string](
+						stream.Slice([]string{"foo"}),
+						stream.Slice([]string{"bar", "foo"}),
+						func(s1 string) error {
+							counter++
+							return nil
+						},
+						func(leader string, follower string) error {
+							require.Equal(t, "foo", leader)
+							require.Equal(t, "foo", follower)
+							equalCounter++
+							return nil
+						},
+						strings.Compare,
+					), func() {
+						require.Equal(t, 0, counter)
+						require.Equal(t, 1, equalCounter)
+					}
+			},
+			wantErr: false,
+		},
+		{
+			name: "mix",
+			validate: func(t *testing.T) (*streamutils.ZipStreams[string, string], func()) {
+				counter := 0
+				equalCount := 0
+				calledWith := make([]string, 0)
+				sameCalledWith := make([]string, 0)
+				return streamutils.NewZipStreams[string, string](
+						stream.Slice([]string{"1", "2", "4", "5", "8"}),
+						stream.Slice([]string{"2", "3", "4", "9"}),
+						func(s1 string) error {
+							counter++
+							calledWith = append(calledWith, s1)
+							return nil
+						},
+						func(leader string, follower string) error {
+							// Both fields should be the same
+							require.Equal(t, leader, follower)
+							sameCalledWith = append(sameCalledWith, leader)
+							equalCount++
+							return nil
+						},
+						strings.Compare,
+					), func() {
+						require.Equal(t, 3, counter)
+						require.Equal(t, []string{"1", "5", "8"}, calledWith)
+						require.Equal(t, 2, equalCount)
+						require.Equal(t, []string{"2", "4"}, sameCalledWith)
+					}
+			},
+			wantErr: false,
+		},
+		{
+			name: "errors are propagated",
+			validate: func(t *testing.T) (*streamutils.ZipStreams[string, string], func()) {
+				return streamutils.NewZipStreams[string, string](
+						stream.Slice([]string{"1", "2", "5", "8"}),
+						stream.Slice([]string{"2", "3", "9"}),
+						func(s1 string) error {
+							return trace.Errorf("something bad")
+						},
+						func(leader string, follower string) error {
+							return nil
+						},
+						strings.Compare,
+					), func() {
+					}
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			z, validate := tt.validate(t)
+			err := z.Process()
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			validate()
+		})
+	}
+}
diff --git a/lib/utils/typical/parser.go b/lib/utils/typical/parser.go
index 6df9be5ede9f8..9739ded1aaf40 100644
--- a/lib/utils/typical/parser.go
+++ b/lib/utils/typical/parser.go
@@ -386,6 +386,49 @@ func (e unaryFuncExpr[TEnv, TArg, TResult]) Evaluate(env TEnv) (TResult, error)
 	return res, trace.Wrap(err, "evaluating function (%s)", e.name)
 }
 
+type unaryFunctionWithEnv[TEnv, TArg, TResult any] struct {
+	impl func(TEnv, TArg) (TResult, error)
+}
+
+// UnaryFunctionWithEnv returns a definition for a function that can be called with one
+// argument. The argument may be a literal or a subexpression. The [impl] will
+// be called with the evaluation env as the first argument, followed by the
+// actual argument passed in the expression.
+func UnaryFunctionWithEnv[TEnv, TArg, TResult any](impl func(TEnv, TArg) (TResult, error)) Function {
+	return unaryFunctionWithEnv[TEnv, TArg, TResult]{impl}
+}
+
+func (f unaryFunctionWithEnv[TEnv, TArg, TResult]) buildExpression(name string, args ...any) (any, error) {
+	if len(args) != 1 {
+		return nil, trace.BadParameter("function (%s) accepts 1 argument, given %d", name, len(args))
+	}
+	argExpr, err := coerce[TEnv, TArg](args[0])
+	if err != nil {
+		return nil, trace.Wrap(err, "parsing argument to (%s)", name)
+	}
+	return unaryFuncWithEnvExpr[TEnv, TArg, TResult]{
+		name:    name,
+		impl:    f.impl,
+		argExpr: argExpr,
+	}, nil
+}
+
+type unaryFuncWithEnvExpr[TEnv, TArg, TResult any] struct {
+	name    string
+	impl    func(TEnv, TArg) (TResult, error)
+	argExpr Expression[TEnv, TArg]
+}
+
+func (e unaryFuncWithEnvExpr[TEnv, TArg, TResult]) Evaluate(env TEnv) (TResult, error) {
+	var nul TResult
+	arg, err := e.argExpr.Evaluate(env)
+	if err != nil {
+		return nul, trace.Wrap(err, "evaluating argument to function (%s)", e.name)
+	}
+	res, err := e.impl(env, arg)
+	return res, trace.Wrap(err, "evaluating function (%s)", e.name)
+}
+
 type binaryFunction[TEnv, TArg1, TArg2, TResult any] struct {
 	impl func(TArg1, TArg2) (TResult, error)
 }
@@ -692,7 +735,7 @@ func (e ternaryVariadicFuncExpr[TEnv, TArg1, TArg2, TVarArgs, TResult]) Evaluate
 
 type booleanOperator[TEnv, TArgs any] struct {
 	name string
-	f    func(a, b TArgs) bool
+	f    func(env TEnv, a, b Expression[TEnv, TArgs]) (bool, error)
 }
 
 func (b booleanOperator[TEnv, TArgs]) buildExpression(lhs, rhs any) (Expression[TEnv, bool], error) {
@@ -709,47 +752,87 @@ func (b booleanOperator[TEnv, TArgs]) buildExpression(lhs, rhs any) (Expression[
 
 type booleanOperatorExpr[TEnv, TArgs any] struct {
 	name             string
-	f                func(a, b TArgs) bool
+	f                func(env TEnv, a, b Expression[TEnv, TArgs]) (bool, error)
 	lhsExpr, rhsExpr Expression[TEnv, TArgs]
 }
 
 func (b booleanOperatorExpr[TEnv, TArgs]) Evaluate(env TEnv) (bool, error) {
-	lhs, err := b.lhsExpr.Evaluate(env)
-	if err != nil {
-		return false, trace.Wrap(err, "evaluating lhs of (%s) operator", b.name)
-	}
-	rhs, err := b.rhsExpr.Evaluate(env)
-	if err != nil {
-		return false, trace.Wrap(err, "evaluating rhs of (%s) operator", b.name)
-	}
-	return b.f(lhs, rhs), nil
+	return b.f(env, b.lhsExpr, b.rhsExpr)
 }
 
 func and[TEnv any]() func(lhs, rhs any) (Expression[TEnv, bool], error) {
 	return booleanOperator[TEnv, bool]{
 		name: "&&",
-		f:    func(lhs, rhs bool) bool { return lhs && rhs },
+		f: func(env TEnv, lhsExpr, rhsExpr Expression[TEnv, bool]) (bool, error) {
+			lhs, err := lhsExpr.Evaluate(env)
+			if err != nil {
+				return false, trace.Wrap(err, "evaluating lhs of (&&) operator")
+			}
+			// Short-circuit if possible.
+			if !lhs {
+				return false, nil
+			}
+			rhs, err := rhsExpr.Evaluate(env)
+			if err != nil {
+				return false, trace.Wrap(err, "evaluating rhs of (&&) operator")
+			}
+			return rhs, nil
+		},
 	}.buildExpression
 }
 
 func or[TEnv any]() func(lhs, rhs any) (Expression[TEnv, bool], error) {
 	return booleanOperator[TEnv, bool]{
 		name: "||",
-		f:    func(lhs, rhs bool) bool { return lhs || rhs },
+		f: func(env TEnv, lhsExpr, rhsExpr Expression[TEnv, bool]) (bool, error) {
+			lhs, err := lhsExpr.Evaluate(env)
+			if err != nil {
+				return false, trace.Wrap(err, "evaluating lhs of (||) operator")
+			}
+			// Short-circuit if possible.
+			if lhs {
+				return true, nil
+			}
+			rhs, err := rhsExpr.Evaluate(env)
+			if err != nil {
+				return false, trace.Wrap(err, "evaluating rhs of (||) operator")
+			}
+			return rhs, nil
+		},
 	}.buildExpression
 }
 
 func eq[TEnv any]() func(lhs, rhs any) (Expression[TEnv, bool], error) {
 	return booleanOperator[TEnv, string]{
 		name: "==",
-		f:    func(lhs, rhs string) bool { return lhs == rhs },
+		f: func(env TEnv, lhsExpr, rhsExpr Expression[TEnv, string]) (bool, error) {
+			lhs, err := lhsExpr.Evaluate(env)
+			if err != nil {
+				return false, trace.Wrap(err, "evaluating lhs of (==) operator")
+			}
+			rhs, err := rhsExpr.Evaluate(env)
+			if err != nil {
+				return false, trace.Wrap(err, "evaluating rhs of (==) operator")
+			}
+			return lhs == rhs, nil
+		},
 	}.buildExpression
 }
 
 func neq[TEnv any]() func(lhs, rhs any) (Expression[TEnv, bool], error) {
 	return booleanOperator[TEnv, string]{
 		name: "!=",
-		f:    func(lhs, rhs string) bool { return lhs != rhs },
+		f: func(env TEnv, lhsExpr, rhsExpr Expression[TEnv, string]) (bool, error) {
+			lhs, err := lhsExpr.Evaluate(env)
+			if err != nil {
+				return false, trace.Wrap(err, "evaluating lhs of (!=) operator")
+			}
+			rhs, err := rhsExpr.Evaluate(env)
+			if err != nil {
+				return false, trace.Wrap(err, "evaluating rhs of (!=) operator")
+			}
+			return lhs != rhs, nil
+		},
 	}.buildExpression
 }
 
diff --git a/lib/utils/typical/parser_test.go b/lib/utils/typical/parser_test.go
index 16c00ec806a47..b81c7be086a89 100644
--- a/lib/utils/typical/parser_test.go
+++ b/lib/utils/typical/parser_test.go
@@ -24,6 +24,7 @@ import (
 	"golang.org/x/exp/maps"
 	"golang.org/x/exp/slices"
 
+	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/typical"
 )
 
@@ -83,6 +84,19 @@ func TestParser(t *testing.T) {
 				}
 				return list[0], nil
 			}),
+			"labels_matching": typical.UnaryFunctionWithEnv(func(e env, keyExpr string) ([]string, error) {
+				var matchingLabels []string
+				for key, value := range e.labels {
+					match, err := utils.MatchString(key, keyExpr)
+					if err != nil {
+						return nil, trace.Wrap(err)
+					}
+					if match {
+						matchingLabels = append(matchingLabels, value)
+					}
+				}
+				return matchingLabels, nil
+			}),
 		},
 		Methods: map[string]typical.Function{
 			"add_trait_values": typical.TernaryVariadicFunction[env](func(m map[string][]string, key string, values ...string) (map[string][]string, error) {
@@ -319,6 +333,26 @@ func TestParser(t *testing.T) {
 			)`,
 			expectMatch: true,
 		},
+		{
+			desc:        "unary func with env",
+			expr:        `contains_all(labels_matching("*"), "staging", "dev")`,
+			expectMatch: true,
+		},
+		{
+			desc: "unary func with env no arg",
+			expr: `contains_all(labels_matching(), "staging", "dev")`,
+			expectParseError: []string{
+				"function (labels_matching) accepts 1 argument, given 0",
+			},
+		},
+		{
+			desc: "unary func with env wrong type",
+			expr: `contains_all(labels_matching(traits["username"]), "staging", "dev")`,
+			expectParseError: []string{
+				"parsing argument to (labels_matching)",
+				"expected type string, got expression returning type ([]string)",
+			},
+		},
 		{
 			desc: "unsupported function",
 			expr: `compare(traits.logins, "user")`,
diff --git a/lib/utils/utils.go b/lib/utils/utils.go
index b211cb1b23302..0acea1524393e 100644
--- a/lib/utils/utils.go
+++ b/lib/utils/utils.go
@@ -42,7 +42,6 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
 	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/modules"
 )
 
 // WriteContextCloser provides close method with context
@@ -506,11 +505,6 @@ func ReadOrMakeHostUUID(dataDir string) (string, error) {
 	return id, nil
 }
 
-// PrintVersion prints human readable version
-func PrintVersion() {
-	modules.GetModules().PrintVersion()
-}
-
 // StringSliceSubset returns true if b is a subset of a.
 func StringSliceSubset(a []string, b []string) error {
 	aset := make(map[string]bool)
diff --git a/lib/web/addr.go b/lib/web/addr.go
new file mode 100644
index 0000000000000..9cdb597c64d54
--- /dev/null
+++ b/lib/web/addr.go
@@ -0,0 +1,147 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package web
+
+import (
+	"bufio"
+	"net"
+	"net/http"
+	"net/netip"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"github.com/sirupsen/logrus"
+
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+const xForwardedForHeader = "X-Forwarded-For"
+
+// NewXForwardedForMiddleware is an HTTP middleware that overwrites client
+// source address if X-Forwarded-For is set.
+//
+// Both hijacked conn and request context are updated. The hijacked conn can be
+// used for ALPN connection upgrades or Websocket connections.
+func NewXForwardedForMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		clientSrcAddr, err := parseXForwardedForHeaders(r.RemoteAddr, r.Header.Values(xForwardedForHeader))
+		switch {
+		// Skip updating client source address if no X-Forwarded-For is
+		// present. For example, the request may come from an internal
+		// network or the load balancer itself.
+		case trace.IsNotFound(err):
+			next.ServeHTTP(w, r)
+
+		// Reject the request on error.
+		case err != nil:
+			trace.WriteError(w, err)
+
+		// Serve with updated client source address.
+		default:
+			next.ServeHTTP(
+				responseWriterWithClientSrcAddr(w, clientSrcAddr),
+				requestWithClientSrcAddr(r, clientSrcAddr),
+			)
+		}
+	})
+}
+
+// parseXForwardedForHeaders returns a net.Addr from provided values of X-Forwarded-For.
+//
+// MDN reference:
+// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
+//
+// AWS ALB reference:
+// https://docs.aws.amazon.com/elasticloadbalancing/latest/application/x-forwarded-headers.html
+func parseXForwardedForHeaders(observedAddr string, xForwardedForHeaders []string) (net.Addr, error) {
+	switch len(xForwardedForHeaders) {
+	case 0:
+		return nil, trace.NotFound("no X-Forwarded-For headers")
+
+	case 1:
+		// Reject multiple IPs.
+		if strings.Contains(xForwardedForHeaders[0], ",") {
+			return nil, trace.BadParameter("expect a single IP from X-Forwarded-For but got %v", xForwardedForHeaders)
+		}
+
+	default:
+		// Reject multiple IPs.
+		return nil, trace.BadParameter("expect a single IP from X-Forwarded-For but got %v", xForwardedForHeaders)
+	}
+
+	// If forwardedAddr has a port, use that.
+	forwardedAddr := strings.TrimSpace(xForwardedForHeaders[0])
+	if ipAddrPort, err := netip.ParseAddrPort(forwardedAddr); err == nil {
+		return net.TCPAddrFromAddrPort(ipAddrPort), nil
+	}
+
+	// If forwardedAddr does not have a port, use port from observedAddr.
+	ipAddr, err := netip.ParseAddr(forwardedAddr)
+	if err != nil {
+		return nil, trace.BadParameter("invalid X-Forwarded-For %v: %v", xForwardedForHeaders, err)
+	}
+
+	var port int
+	if parsed, err := utils.ParseAddr(observedAddr); err == nil {
+		port = parsed.Port(port)
+	}
+
+	return net.TCPAddrFromAddrPort(netip.AddrPortFrom(ipAddr, uint16(port))), nil
+}
+
+func requestWithClientSrcAddr(r *http.Request, clientSrcAddr net.Addr) *http.Request {
+	ctx := utils.ClientSrcAddrContext(r.Context(), clientSrcAddr)
+	r = r.WithContext(ctx)
+	r.RemoteAddr = clientSrcAddr.String()
+	return r
+}
+
+func responseWriterWithClientSrcAddr(w http.ResponseWriter, clientSrcAddr net.Addr) http.ResponseWriter {
+	// Returns the original ResponseWriter if not a http.Hijacker.
+	_, ok := w.(http.Hijacker)
+	if !ok {
+		logrus.Debug("Provided ResponseWriter is not a hijacker.")
+		return w
+	}
+
+	return &responseWriterWithRemoteAddr{
+		ResponseWriter: w,
+		remoteAddr:     clientSrcAddr,
+	}
+}
+
+// responseWriterWithRemoteAddr is a wrapper of provided http.ResponseWriter
+// and overwrites Hijacker interface to return a net.Conn with provided
+// remoteAddr.
+type responseWriterWithRemoteAddr struct {
+	http.ResponseWriter
+	remoteAddr net.Addr
+}
+
+// Hijack returns a net.Conn with provided remoteAddr.
+func (r *responseWriterWithRemoteAddr) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	hijacker, ok := r.ResponseWriter.(http.Hijacker)
+	if !ok {
+		return nil, nil, trace.BadParameter("provided ResponseWriter is not a hijacker")
+	}
+	conn, buffer, err := hijacker.Hijack()
+	if err != nil {
+		return conn, buffer, trace.Wrap(err)
+	}
+
+	return utils.NewConnWithSrcAddr(conn, r.remoteAddr), buffer, nil
+}
diff --git a/lib/web/addr_test.go b/lib/web/addr_test.go
new file mode 100644
index 0000000000000..f14c38568917c
--- /dev/null
+++ b/lib/web/addr_test.go
@@ -0,0 +1,179 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package web
+
+import (
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func TestNewXForwardedForMiddleware(t *testing.T) {
+	t.Parallel()
+
+	observeredAddr := utils.MustParseAddr("11.22.33.44:1234")
+	xForwardedAddr := utils.MustParseAddr("55.66.77.88:5678")
+
+	// Setup response writer with observeredAddr.
+	fakeConn, _ := net.Pipe()
+
+	// Setup request with observeredAddr.
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req = req.WithContext(utils.ClientSrcAddrContext(req.Context(), observeredAddr))
+	req.RemoteAddr = observeredAddr.String()
+
+	// Setup other requests for testing.
+	reqWithXFF := req.Clone(req.Context())
+	reqWithXFF.Header.Set("X-Forwarded-For", xForwardedAddr.String())
+
+	reqWithMultipleXFF := req.Clone(req.Context())
+	reqWithMultipleXFF.Header.Add("X-Forwarded-For", xForwardedAddr.String())
+	reqWithMultipleXFF.Header.Add("X-Forwarded-For", "88.77.66.55:8765")
+
+	tests := []struct {
+		name           string
+		inputReq       *http.Request
+		wantRemoteAddr string
+		wantError      bool
+	}{
+		{
+			name:           "no X-Forwarded-For header",
+			inputReq:       req,
+			wantRemoteAddr: observeredAddr.String(),
+		},
+		{
+			name:      "multiple X-Forwarded-For values",
+			inputReq:  reqWithMultipleXFF,
+			wantError: true,
+		},
+		{
+			name:           "using X-Forwarded-For header",
+			inputReq:       reqWithXFF,
+			wantRemoteAddr: xForwardedAddr.String(),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			checkRemoteAddr := http.HandlerFunc(func(outputRW http.ResponseWriter, outputReq *http.Request) {
+				// Verify hijacked conn.
+				hj, ok := outputRW.(http.Hijacker)
+				require.True(t, ok)
+				outputConn, _, err := hj.Hijack()
+				require.NoError(t, err)
+				require.Equal(t, test.wantRemoteAddr, outputConn.RemoteAddr().String())
+
+				// Verify request.
+				require.Equal(t, test.wantRemoteAddr, outputReq.RemoteAddr)
+
+				// Verify request context.
+				clientSrcAddr, _ := utils.ClientAddrFromContext(outputReq.Context())
+				require.Equal(t, test.wantRemoteAddr, clientSrcAddr.String())
+
+				outputRW.WriteHeader(http.StatusAccepted)
+			})
+
+			recorder := httptest.NewRecorder()
+			inputResponseWriter := &responseWriterWithRemoteAddr{
+				ResponseWriter: newResponseWriterHijacker(recorder, fakeConn),
+				remoteAddr:     observeredAddr,
+			}
+			handler := NewXForwardedForMiddleware(checkRemoteAddr)
+			handler.ServeHTTP(inputResponseWriter, test.inputReq)
+
+			response := recorder.Result()
+			defer response.Body.Close()
+			if test.wantError {
+				require.Equal(t, http.StatusBadRequest, response.StatusCode)
+			} else {
+				require.Equal(t, http.StatusAccepted, response.StatusCode)
+			}
+		})
+	}
+
+}
+
+func TestParseXForwardedForHeaders(t *testing.T) {
+	t.Parallel()
+
+	inputObserveredAddr := "1.2.3.4:12345"
+	tests := []struct {
+		name                      string
+		inputXForwardedForHeaders []string
+		wantAddr                  string
+		wantError                 func(error) bool
+	}{
+		{
+			name:                      "empty",
+			inputXForwardedForHeaders: []string{},
+			wantError:                 trace.IsNotFound,
+		},
+		{
+			name:                      "invalid X-Forwarded-For",
+			inputXForwardedForHeaders: []string{"not-an-ip"},
+			wantError:                 trace.IsBadParameter,
+		},
+		{
+			name:                      "ipv4",
+			inputXForwardedForHeaders: []string{"3.4.5.6"},
+			wantAddr:                  "3.4.5.6:12345",
+		},
+		{
+			name:                      "ipv4 with port",
+			inputXForwardedForHeaders: []string{"3.4.5.6:22222"},
+			wantAddr:                  "3.4.5.6:22222",
+		},
+		{
+			name:                      "ipv6",
+			inputXForwardedForHeaders: []string{"2001:db8::21f:5bff:febf:ce22:8a2e"},
+			wantAddr:                  "[2001:db8:0:21f:5bff:febf:ce22:8a2e]:12345",
+		},
+		{
+			name:                      "ipv6 with port",
+			inputXForwardedForHeaders: []string{"[2001:db8::21f:5bff:febf:ce22:8a2e]:22222"},
+			wantAddr:                  "[2001:db8:0:21f:5bff:febf:ce22:8a2e]:22222",
+		},
+		{
+			name:                      "multiple IPs",
+			inputXForwardedForHeaders: []string{"3.4.5.6, 7.8.9.10, 11.12.13.14"},
+			wantError:                 trace.IsBadParameter,
+		},
+		{
+			name:                      "multiple headers",
+			inputXForwardedForHeaders: []string{"3.4.5.6", "7.8.9.10", "11.12.13.14"},
+			wantError:                 trace.IsBadParameter,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actualAddr, err := parseXForwardedForHeaders(inputObserveredAddr, test.inputXForwardedForHeaders)
+			if test.wantError != nil {
+				require.True(t, test.wantError(err))
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, test.wantAddr, actualAddr.String())
+			}
+		})
+	}
+}
diff --git a/lib/web/apiserver.go b/lib/web/apiserver.go
index ed3adef73ffeb..3052c294e350c 100644
--- a/lib/web/apiserver.go
+++ b/lib/web/apiserver.go
@@ -80,13 +80,13 @@ import (
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/plugin"
 	"github.com/gravitational/teleport/lib/proxy"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/secret"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/session"
-	"github.com/gravitational/teleport/lib/srv"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/web/app"
+	websession "github.com/gravitational/teleport/lib/web/session"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
@@ -172,7 +172,7 @@ type Config struct {
 	PluginRegistry plugin.Registry
 	// Proxy is a reverse tunnel proxy that handles connections
 	// to local cluster or remote clusters using unified interface
-	Proxy reversetunnel.Tunnel
+	Proxy reversetunnelclient.Tunnel
 	// AuthServers is a list of auth servers this proxy talks to
 	AuthServers utils.NetAddr
 	// DomainName is a domain name served by web handler
@@ -242,7 +242,7 @@ type Config struct {
 
 	// SessionControl is used to determine if users are
 	// allowed to spawn new sessions
-	SessionControl *srv.SessionController
+	SessionControl SessionController
 
 	// PROXYSigner is used to sign PROXY header and securely propagate client IP information
 	PROXYSigner multiplexer.PROXYHeaderSigner
@@ -278,7 +278,6 @@ func (h *APIHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// request has a session cookie or a client cert, forward to
 	// application handlers. If the request is requesting a
 	// FQDN that is not of the proxy, redirect to application launcher.
-
 	if h.appHandler != nil && (app.HasFragment(r) || app.HasSession(r) || app.HasClientCert(r)) {
 		h.appHandler.ServeHTTP(w, r)
 		return
@@ -465,7 +464,7 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 
 			session, err := h.authenticateWebSession(w, r)
 			if err != nil {
-				h.log.WithError(err).Debug("Could not authenticate.")
+				h.log.Debugf("Could not authenticate: %v", err)
 			}
 			session.XCSRF = csrfToken
 
@@ -479,7 +478,7 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 
 				httplib.SetAppLaunchContentSecurityPolicy(w.Header(), applicationURL)
 			} else {
-				httplib.SetIndexContentSecurityPolicy(w.Header())
+				httplib.SetIndexContentSecurityPolicy(w.Header(), cfg.ClusterFeatures)
 			}
 			if err := indexPage.Execute(w, session); err != nil {
 				h.log.WithError(err).Error("Failed to execute index page template.")
@@ -559,7 +558,9 @@ func (h *Handler) bindMinimalEndpoints() {
 	// find is like ping, but is faster because it is optimized for servers
 	// and does not fetch the data that servers don't need, e.g.
 	// OIDC connectors and auth preferences
-	h.GET("/webapi/find", h.WithUnauthenticatedHighLimiter(h.find))
+	// Note that find is a unique endpoint that requires high request rates
+	// sometimes through NATs and thus should not be rate limited by IP.
+	h.GET("/webapi/find", httplib.MakeHandler(h.find))
 	// Issue host credentials.
 	h.POST("/webapi/host/credentials", h.WithUnauthenticatedHighLimiter(h.hostCredentials))
 }
@@ -759,6 +760,8 @@ func (h *Handler) bindDefaultEndpoints() {
 
 	// AWS OIDC Integration Actions
 	h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/databases", h.WithClusterAuth(h.awsOIDCListDatabases))
+	h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/deployservice", h.WithClusterAuth(h.awsOIDCDeployService))
+	h.GET("/webapi/scripts/integrations/configure/deployservice-iam.sh", h.WithLimiter(h.awsOIDCConfigureDeployServiceIAM))
 
 	// AWS OIDC Integration specific endpoints:
 	// Unauthenticated access to OpenID Configuration - used for AWS OIDC IdP integration
@@ -767,7 +770,7 @@ func (h *Handler) bindDefaultEndpoints() {
 	h.GET("/webapi/thumbprint", h.WithLimiter(h.thumbprint))
 
 	// Connection upgrades.
-	h.GET("/webapi/connectionupgrade", h.WithLimiter(h.connectionUpgrade))
+	h.GET("/webapi/connectionupgrade", h.WithHighLimiter(h.connectionUpgrade))
 
 	// create user events.
 	h.POST("/webapi/precapture", h.WithUnauthenticatedLimiter(h.createPreUserEventHandle))
@@ -800,6 +803,12 @@ func (h *Handler) bindDefaultEndpoints() {
 
 	// Allows executing an arbitrary command on multiple nodes.
 	h.GET("/webapi/command/:site/execute", h.WithClusterAuth(h.executeCommand))
+
+	// Fetches the user's preferences
+	h.GET("/webapi/user/preferences", h.WithAuth(h.getUserPreferences))
+
+	// Updates the user's preferences
+	h.PUT("/webapi/user/preferences", h.WithAuth(h.updateUserPreferences))
 }
 
 // GetProxyClient returns authenticated auth server client
@@ -867,7 +876,7 @@ func (h *Handler) handleGetUserOrResetToken(w http.ResponseWriter, r *http.Reque
 // getUserContext returns user context
 //
 // GET /webapi/sites/:site/context
-func (h *Handler) getUserContext(w http.ResponseWriter, r *http.Request, p httprouter.Params, c *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) getUserContext(w http.ResponseWriter, r *http.Request, p httprouter.Params, c *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
 	cn, err := h.cfg.AccessPoint.GetClusterName()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1111,6 +1120,7 @@ func getAuthSettings(ctx context.Context, authClient auth.ClientI) (webclient.Au
 		return webclient.AuthenticationSettings{}, trace.Wrap(err)
 	}
 	as.LoadAllCAs = pingResp.LoadAllCAs
+	as.DefaultSessionTTL = authPreference.GetDefaultSessionTTL()
 
 	return as, nil
 }
@@ -1191,7 +1201,7 @@ func (h *Handler) ping(w http.ResponseWriter, r *http.Request, p httprouter.Para
 		return nil, trace.Wrap(err)
 	}
 
-	// TODO: This part should be removed once the plugin support is added to OSS.
+	// TODO(jakule): This part should be removed once the plugin support is added to OSS.
 	if proxyConfig.AssistEnabled {
 		enabled, err := h.cfg.ProxyClient.IsAssistEnabled(r.Context())
 		if err != nil {
@@ -1218,6 +1228,7 @@ func (h *Handler) ping(w http.ResponseWriter, r *http.Request, p httprouter.Para
 }
 
 func (h *Handler) find(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
+	// TODO(jent,espadolini): add a time-based cache to further reduce load on this endpoint
 	proxyConfig, err := h.cfg.ProxySettings.GetProxySettings(r.Context())
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1394,6 +1405,7 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 			PreferredLocalMFA:  cap.GetPreferredLocalMFA(),
 			LocalConnectorName: localConnectorName,
 			PrivateKeyPolicy:   cap.GetPrivateKeyPolicy(),
+			MOTD:               cap.GetMessageOfTheDay(),
 		}
 	}
 
@@ -1408,13 +1420,24 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 
 	// get tunnel address to display on cloud instances
 	tunnelPublicAddr := ""
-	if clusterFeatures.GetCloud() {
-		proxyConfig, err := h.cfg.ProxySettings.GetProxySettings(r.Context())
-		if err != nil {
-			h.log.WithError(err).Warn("Cannot retrieve ProxySettings, tunnel address won't be set in Web UI.")
-		} else {
+	assistEnabled := false // TODO(jakule) remove when plugins are implemented
+	proxyConfig, err := h.cfg.ProxySettings.GetProxySettings(r.Context())
+	if err != nil {
+		h.log.WithError(err).Warn("Cannot retrieve ProxySettings, tunnel address won't be set in Web UI.")
+	} else {
+		if clusterFeatures.GetCloud() {
 			tunnelPublicAddr = proxyConfig.SSH.TunnelPublicAddr
 		}
+		// TODO(jakule): This part should be removed once the plugin support is added to OSS.
+		if proxyConfig.AssistEnabled {
+			enabled, err := h.cfg.ProxyClient.IsAssistEnabled(r.Context())
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+
+			// disable if auth doesn't support assist
+			assistEnabled = enabled.Enabled
+		}
 	}
 
 	// disable joining sessions if proxy session recording is enabled
@@ -1435,6 +1458,8 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 		UI:                   h.getUIConfig(r.Context()),
 		IsDashboard:          isDashboard(clusterFeatures),
 		IsUsageBasedBilling:  clusterFeatures.GetIsUsageBased(),
+		AutomaticUpgrades:    clusterFeatures.GetAutomaticUpgrades(),
+		AssistEnabled:        assistEnabled,
 	}
 
 	resource, err := h.cfg.ProxyClient.GetClusterName()
@@ -1682,20 +1707,20 @@ func (h *Handler) installer(w http.ResponseWriter, r *http.Request, p httprouter
 	// By default, it uses the stable/v<majorVersion> channel.
 	repoChannel := fmt.Sprintf("stable/%s", version)
 
-	// For Teleport Cloud installations, use the `stable/cloud` channel.
-	if feats.Cloud {
+	// If the updater must be installed, then change the repo to stable/cloud
+	// It must also install the version specified in
+	// https://updates.releases.teleport.dev/v1/stable/cloud/version
+	installUpdater := automaticUpgrades(h.ClusterFeatures)
+	if installUpdater {
 		repoChannel = stableCloudChannelRepo
 	}
 
-	// TODO(marco): remove BuildType check when teleport-upgrade (oss) package is available in apt/yum repos.
-	automaticUpgrades := feats.AutomaticUpgrades && modules.GetModules().BuildType() == modules.BuildEnterprise
-
 	tmpl := installers.Template{
 		PublicProxyAddr:   h.PublicProxyAddr(),
 		MajorVersion:      version,
 		TeleportPackage:   teleportPackage,
 		RepoChannel:       repoChannel,
-		AutomaticUpgrades: strconv.FormatBool(automaticUpgrades),
+		AutomaticUpgrades: strconv.FormatBool(installUpdater),
 	}
 	err = instTmpl.Execute(w, tmpl)
 	return nil, trace.Wrap(err)
@@ -1937,7 +1962,7 @@ func (h *Handler) createWebSession(w http.ResponseWriter, r *http.Request, p htt
 		return nil, trace.Wrap(err)
 	}
 
-	if err := SetSessionCookie(w, req.User, webSession.GetName()); err != nil {
+	if err := websession.SetCookie(w, req.User, webSession.GetName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -1957,8 +1982,6 @@ func (h *Handler) createWebSession(w http.ResponseWriter, r *http.Request, p htt
 }
 
 func clientMetaFromReq(r *http.Request) *auth.ForwardedClientMetadata {
-	// multiplexer handles extracting real client IP using PROXY protocol where
-	// available, so we can omit checking X-Forwarded-For.
 	return &auth.ForwardedClientMetadata{
 		UserAgent:  r.UserAgent(),
 		RemoteAddr: r.RemoteAddr,
@@ -1985,7 +2008,7 @@ func (h *Handler) logout(ctx context.Context, w http.ResponseWriter, sctx *Sessi
 	if err := sctx.Invalidate(ctx); err != nil {
 		return trace.Wrap(err)
 	}
-	ClearSession(w)
+	websession.ClearCookie(w)
 
 	return nil
 }
@@ -2025,7 +2048,7 @@ func (h *Handler) renewWebSession(w http.ResponseWriter, r *http.Request, params
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := SetSessionCookie(w, newSession.GetUser(), newSession.GetName()); err != nil {
+	if err := websession.SetCookie(w, newSession.GetUser(), newSession.GetName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -2112,7 +2135,7 @@ func (h *Handler) changeUserAuthentication(w http.ResponseWriter, r *http.Reques
 		h.log.WithError(err).Error("Failed to set passwordless as connector name.")
 	}
 
-	if err := SetSessionCookie(w, sess.GetUser(), sess.GetName()); err != nil {
+	if err := websession.SetCookie(w, sess.GetUser(), sess.GetName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -2333,7 +2356,7 @@ func (h *Handler) mfaLoginFinishSession(w http.ResponseWriter, r *http.Request,
 
 	// Fetch user from session, user is empty for passwordless requests.
 	user := session.GetUser()
-	if err := SetSessionCookie(w, user, session.GetName()); err != nil {
+	if err := websession.SetCookie(w, user, session.GetName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -2394,7 +2417,7 @@ type getSiteNamespacesResponse struct {
 // Successful response:
 //
 // {"namespaces": [{..namespace resource...}]}
-func (h *Handler) getSiteNamespaces(w http.ResponseWriter, r *http.Request, _ httprouter.Params, c *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) getSiteNamespaces(w http.ResponseWriter, r *http.Request, _ httprouter.Params, c *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	clt, err := site.GetClient()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -2409,7 +2432,7 @@ func (h *Handler) getSiteNamespaces(w http.ResponseWriter, r *http.Request, _ ht
 }
 
 // clusterNodesGet returns a list of nodes for a given cluster site.
-func (h *Handler) clusterNodesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterNodesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	// Get a client to the Auth Server with the logged in user's identity. The
 	// identity of the logged in user is used to fetch the list of nodes.
 	clt, err := sctx.GetUserClient(r.Context(), site)
@@ -2432,7 +2455,7 @@ func (h *Handler) clusterNodesGet(w http.ResponseWriter, r *http.Request, p http
 		return nil, trace.Wrap(err)
 	}
 
-	uiServers, err := ui.MakeServers(site.GetName(), page.Resources, accessChecker.Roles())
+	uiServers, err := ui.MakeServers(site.GetName(), page.Resources, accessChecker)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -2449,7 +2472,7 @@ type getLoginAlertsResponse struct {
 }
 
 // clusterLoginAlertsGet returns a list of on-login alerts for the user.
-func (h *Handler) clusterLoginAlertsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterLoginAlertsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	// Get a client to the Auth Server with the logged in user's identity. The
 	// identity of the logged in user is used to fetch the list of alerts.
 	clt, err := sctx.GetUserClient(r.Context(), site)
@@ -2471,46 +2494,12 @@ func (h *Handler) clusterLoginAlertsGet(w http.ResponseWriter, r *http.Request,
 	}, nil
 }
 
-// createIdentityContext creates a srv.IdentityContext from the ssh cert of the user
-// stored within the SessionContext.
-func createIdentityContext(login string, sessionCtx *SessionContext) (srv.IdentityContext, error) {
-	accessChecker, err := sessionCtx.GetUserAccessChecker()
-	if err != nil {
-		return srv.IdentityContext{}, trace.Wrap(err)
-	}
-
-	sshCert, err := sessionCtx.GetSSHCertificate()
-	if err != nil {
-		return srv.IdentityContext{}, trace.Wrap(err)
-	}
-
-	unmappedRoles, err := services.ExtractRolesFromCert(sshCert)
-	if err != nil {
-		return srv.IdentityContext{}, trace.Wrap(err)
-	}
-
-	accessRequestIDs, err := srv.ParseAccessRequestIDs(sshCert.Extensions[teleport.CertExtensionTeleportActiveRequests])
-	if err != nil {
-		return srv.IdentityContext{}, trace.Wrap(err)
-	}
-
-	return srv.IdentityContext{
-		AccessChecker:  accessChecker,
-		TeleportUser:   sessionCtx.GetUser(),
-		Login:          login,
-		Certificate:    sshCert,
-		UnmappedRoles:  unmappedRoles,
-		ActiveRequests: accessRequestIDs,
-		Impersonator:   sshCert.Extensions[teleport.CertExtensionImpersonator],
-	}, nil
-}
-
 func (h *Handler) getClusterLocks(
 	w http.ResponseWriter,
 	r *http.Request,
 	p httprouter.Params,
 	sessionCtx *SessionContext,
-	site reversetunnel.RemoteSite,
+	site reversetunnelclient.RemoteSite,
 ) (interface{}, error) {
 	ctx := r.Context()
 	clt, err := sessionCtx.GetUserClient(ctx, site)
@@ -2537,7 +2526,7 @@ func (h *Handler) createClusterLock(
 	r *http.Request,
 	p httprouter.Params,
 	sessionCtx *SessionContext,
-	site reversetunnel.RemoteSite,
+	site reversetunnelclient.RemoteSite,
 ) (interface{}, error) {
 	var req *createLockReq
 	if err := httplib.ReadJSON(r, &req); err != nil {
@@ -2585,7 +2574,7 @@ func (h *Handler) deleteClusterLock(
 	r *http.Request,
 	p httprouter.Params,
 	sessionCtx *SessionContext,
-	site reversetunnel.RemoteSite,
+	site reversetunnelclient.RemoteSite,
 ) (interface{}, error) {
 	ctx := r.Context()
 	clt, err := sessionCtx.GetUserClient(ctx, site)
@@ -2601,6 +2590,28 @@ func (h *Handler) deleteClusterLock(
 	return OK(), nil
 }
 
+// SessionController restricts creation of sessions based on
+// cluster session control configuration(locks, connection limits, etc).
+type SessionController interface {
+	// AcquireSessionContext attempts to create a context for the session. If the session is
+	// not allowed due to session control an error is returned. The returned
+	// context is scoped to the session and will be canceled in the event that session
+	// controls terminate the session early.
+	AcquireSessionContext(ctx context.Context, sctx *SessionContext, login, localAddr, remoteAddr string) (context.Context, error)
+}
+
+// SessionControllerFunc type is an adapter to allow the use of
+// ordinary functions a [SessionController]. If f is a function
+// with the appropriate signature, SessionControllerFunc(f) is a
+// SessionController that calls f.
+type SessionControllerFunc func(ctx context.Context, sctx *SessionContext, login, localAddr, remoteAddr string) (context.Context, error)
+
+// AcquireSessionContext calls f(ctx, sctx, localAddr, remoteAddr).
+func (f SessionControllerFunc) AcquireSessionContext(ctx context.Context, sctx *SessionContext, login, localAddr, remoteAddr string) (context.Context, error) {
+	ctx, err := f(ctx, sctx, login, localAddr, remoteAddr)
+	return ctx, trace.Wrap(err)
+}
+
 // siteNodeConnect connect to the site node
 //
 // GET /v1/webapi/sites/:site/namespaces/:namespace/connect?access_token=bearer_token&params=<urlencoded json-structure>
@@ -2616,7 +2627,7 @@ func (h *Handler) siteNodeConnect(
 	r *http.Request,
 	p httprouter.Params,
 	sessionCtx *SessionContext,
-	site reversetunnel.RemoteSite,
+	site reversetunnelclient.RemoteSite,
 ) (interface{}, error) {
 	q := r.URL.Query()
 	params := q.Get("params")
@@ -2633,21 +2644,18 @@ func (h *Handler) siteNodeConnect(
 		return nil, trace.Wrap(err)
 	}
 
-	identity, err := createIdentityContext(req.Login, sessionCtx)
+	ctx, err := h.cfg.SessionControl.AcquireSessionContext(r.Context(), sessionCtx, req.Login, h.cfg.ProxyWebAddr.Addr, r.RemoteAddr)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	ctx, err := h.cfg.SessionControl.AcquireSessionContext(r.Context(), identity, h.cfg.ProxyWebAddr.Addr, r.RemoteAddr)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var sessionData session.Session
-	var displayLogin string
+	var (
+		sessionData  session.Session
+		displayLogin string
+		tracker      types.SessionTracker
+	)
 
 	clusterName := site.GetName()
-
 	if req.SessionID.IsZero() {
 		// An existing session ID was not provided so we need to create a new one.
 		sessionData, err = h.generateSession(ctx, clt, req, clusterName, sessionCtx)
@@ -2656,10 +2664,11 @@ func (h *Handler) siteNodeConnect(
 			return nil, trace.Wrap(err)
 		}
 	} else {
-		sessionData, displayLogin, err = h.fetchExistingSession(ctx, clt, req, clusterName)
+		sessionData, tracker, err = h.fetchExistingSession(ctx, clt, req, clusterName)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
+		displayLogin = tracker.GetLogin()
 	}
 
 	// If the participantMode is not specified, and the user is the one who created the session,
@@ -2675,16 +2684,23 @@ func (h *Handler) siteNodeConnect(
 	h.log.Debugf("New terminal request for server=%s, login=%s, sid=%s, websid=%s.",
 		req.Server, req.Login, sessionData.ID, sessionCtx.GetSessionID())
 
-	authAccessPoint, err := site.CachingAccessPoint()
-	if err != nil {
-		h.log.WithError(err).Debug("Unable to get auth access point.")
-		return nil, trace.Wrap(err)
-	}
+	keepAliveInterval := req.KeepAliveInterval
+	// Try to use the keep alive interval from the request.
+	// When it's not set or below a second, use the cluster's keep alive interval.
+	if keepAliveInterval < time.Second {
+		authAccessPoint, err := site.CachingAccessPoint()
+		if err != nil {
+			h.log.Debugf("Unable to get auth access point: %v", err)
+			return nil, trace.Wrap(err)
+		}
 
-	netConfig, err := authAccessPoint.GetClusterNetworkingConfig(ctx)
-	if err != nil {
-		h.log.WithError(err).Debug("Unable to fetch cluster networking config.")
-		return nil, trace.Wrap(err)
+		netConfig, err := authAccessPoint.GetClusterNetworkingConfig(ctx)
+		if err != nil {
+			h.log.WithError(err).Debug("Unable to fetch cluster networking config.")
+			return nil, trace.Wrap(err)
+		}
+
+		keepAliveInterval = netConfig.GetKeepAliveInterval()
 	}
 
 	terminalConfig := TerminalHandlerConfig{
@@ -2694,13 +2710,16 @@ func (h *Handler) siteNodeConnect(
 		LocalAuthProvider:  h.auth.accessPoint,
 		DisplayLogin:       displayLogin,
 		SessionData:        sessionData,
-		KeepAliveInterval:  netConfig.GetKeepAliveInterval(),
+		KeepAliveInterval:  keepAliveInterval,
 		ProxyHostPort:      h.ProxyHostPort(),
+		ProxyPublicAddr:    h.PublicProxyAddr(),
 		InteractiveCommand: req.InteractiveCommand,
 		Router:             h.cfg.Router,
 		TracerProvider:     h.cfg.TracerProvider,
 		ParticipantMode:    req.ParticipantMode,
 		PROXYSigner:        h.cfg.PROXYSigner,
+		Tracker:            tracker,
+		Clock:              h.clock,
 	}
 
 	term, err := NewTerminal(ctx, terminalConfig)
@@ -2888,20 +2907,20 @@ func findByHost(ctx context.Context, clt auth.ClientI, serverName string) (*host
 }
 
 // fetchExistingSession fetches an active or pending SSH session by the SessionID passed in the TerminalRequest.
-func (h *Handler) fetchExistingSession(ctx context.Context, clt auth.ClientI, req *TerminalRequest, siteName string) (session.Session, string, error) {
+func (h *Handler) fetchExistingSession(ctx context.Context, clt auth.ClientI, req *TerminalRequest, siteName string) (session.Session, types.SessionTracker, error) {
 	sessionID, err := session.ParseID(req.SessionID.String())
 	if err != nil {
-		return session.Session{}, "", trace.Wrap(err)
+		return session.Session{}, nil, trace.Wrap(err)
 	}
 	h.log.Infof("Attempting to join existing session: %s\n", sessionID)
 
 	tracker, err := clt.GetSessionTracker(ctx, string(*sessionID))
 	if err != nil {
-		return session.Session{}, "", trace.Wrap(err)
+		return session.Session{}, nil, trace.Wrap(err)
 	}
 
 	if tracker.GetSessionKind() != types.SSHSessionKind || tracker.GetState() == types.SessionState_SessionStateTerminated {
-		return session.Session{}, "", trace.NotFound("SSH session %v not found", sessionID)
+		return session.Session{}, nil, trace.NotFound("SSH session %v not found", sessionID)
 	}
 
 	sessionData := trackerToLegacySession(tracker, siteName)
@@ -2911,12 +2930,8 @@ func (h *Handler) fetchExistingSession(ctx context.Context, clt auth.ClientI, re
 	// new ones themselves for auditing purposes. Otherwise, the user would
 	// fail the SSH lib username validation step.
 	sessionData.Login = teleport.SSHSessionJoinPrincipal
-	// Using the Login above will then display `-teleport-internal-join` as the
-	// username that the user is logging in as, so we need to instead show the
-	// session username in the UI.
-	displayLogin := tracker.GetLogin()
 
-	return sessionData, displayLogin, nil
+	return sessionData, tracker, nil
 }
 
 type siteSessionGenerateResponse struct {
@@ -2975,7 +2990,7 @@ func trackerToLegacySession(tracker types.SessionTracker, clusterName string) se
 // clusterActiveAndPendingSessionsGet gets the list of active and pending sessions for a site.
 //
 // GET /v1/webapi/sites/:site/sessions
-func (h *Handler) clusterActiveAndPendingSessionsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterActiveAndPendingSessionsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	clt, err := sctx.GetUserClient(r.Context(), site)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -3041,7 +3056,7 @@ func toFieldsSlice(rawEvents []apievents.AuditEvent) ([]events.EventFields, erro
 //	"order":    optional ordering of events. Can be either "asc" or "desc"
 //	            for ascending and descending respectively.
 //	            If no order is provided it defaults to descending.
-func (h *Handler) clusterSearchEvents(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterSearchEvents(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	values := r.URL.Query()
 
 	var eventTypes []string
@@ -3076,7 +3091,7 @@ func (h *Handler) clusterSearchEvents(w http.ResponseWriter, r *http.Request, p
 //	"order":    optional ordering of events. Can be either "asc" or "desc"
 //	            for ascending and descending respectively.
 //	            If no order is provided it defaults to descending.
-func (h *Handler) clusterSearchSessionEvents(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterSearchSessionEvents(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	searchSessionEvents := func(clt auth.ClientI, from, to time.Time, limit int, order types.EventOrder, startKey string) ([]apievents.AuditEvent, string, error) {
 		return clt.SearchSessionEvents(r.Context(), events.SearchSessionEventsRequest{
 			From:     from,
@@ -3091,7 +3106,7 @@ func (h *Handler) clusterSearchSessionEvents(w http.ResponseWriter, r *http.Requ
 
 // clusterEventsList returns a list of audit events obtained using the provided
 // searchEvents method.
-func clusterEventsList(ctx context.Context, sctx *SessionContext, site reversetunnel.RemoteSite, values url.Values, searchEvents func(clt auth.ClientI, from, to time.Time, limit int, order types.EventOrder, startKey string) ([]apievents.AuditEvent, string, error)) (interface{}, error) {
+func clusterEventsList(ctx context.Context, sctx *SessionContext, site reversetunnelclient.RemoteSite, values url.Values, searchEvents func(clt auth.ClientI, from, to time.Time, limit int, order types.EventOrder, startKey string) ([]apievents.AuditEvent, string, error)) (interface{}, error) {
 	from, err := queryTime(values, "from", time.Now().UTC().AddDate(0, -1, 0))
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -3294,7 +3309,7 @@ type eventsListGetResponse struct {
 // Response body (each event is an arbitrary JSON structure)
 //
 // {"events": [{...}, {...}, ...}
-func (h *Handler) siteSessionEventsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) siteSessionEventsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	sessionID, err := session.ParseID(p.ByName("sid"))
 	if err != nil {
 		return nil, trace.BadParameter("invalid session ID %q", p.ByName("sid"))
@@ -3473,7 +3488,7 @@ const currentSiteShortcut = "-current-"
 type ContextHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, ctx *SessionContext) (interface{}, error)
 
 // ClusterHandler is a authenticated handler that is called for some existing remote cluster
-type ClusterHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error)
+type ClusterHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error)
 
 // WithClusterAuth wraps a ClusterHandler to ensure that a request is authenticated to this proxy
 // (the same as WithAuth), as well as to grab the remoteSite (which can represent this local cluster
@@ -3493,7 +3508,7 @@ func (h *Handler) WithClusterAuth(fn ClusterHandler) httprouter.Handle {
 // to this proxy, returning the *SessionContext (same as AuthenticateRequest),
 // and also grabs the remoteSite (which can represent this local cluster or a
 // remote trusted cluster) as specified by the ":site" url parameter.
-func (h *Handler) authenticateRequestWithCluster(w http.ResponseWriter, r *http.Request, p httprouter.Params) (*SessionContext, reversetunnel.RemoteSite, error) {
+func (h *Handler) authenticateRequestWithCluster(w http.ResponseWriter, r *http.Request, p httprouter.Params) (*SessionContext, reversetunnelclient.RemoteSite, error) {
 	sctx, err := h.AuthenticateRequest(w, r, true)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
@@ -3509,7 +3524,7 @@ func (h *Handler) authenticateRequestWithCluster(w http.ResponseWriter, r *http.
 
 // getSiteByParams gets the remoteSite (which can represent this local cluster or a
 // remote trusted cluster) as specified by the ":site" url parameter.
-func (h *Handler) getSiteByParams(sctx *SessionContext, p httprouter.Params) (reversetunnel.RemoteSite, error) {
+func (h *Handler) getSiteByParams(sctx *SessionContext, p httprouter.Params) (reversetunnelclient.RemoteSite, error) {
 	clusterName := p.ByName("site")
 	if clusterName == currentSiteShortcut {
 		res, err := h.cfg.ProxyClient.GetClusterName()
@@ -3528,7 +3543,7 @@ func (h *Handler) getSiteByParams(sctx *SessionContext, p httprouter.Params) (re
 	return site, nil
 }
 
-func (h *Handler) getSiteByClusterName(ctx *SessionContext, clusterName string) (reversetunnel.RemoteSite, error) {
+func (h *Handler) getSiteByClusterName(ctx *SessionContext, clusterName string) (reversetunnelclient.RemoteSite, error) {
 	proxy, err := h.ProxyWithRoles(ctx)
 	if err != nil {
 		h.log.WithError(err).Warn("Failed to get proxy with roles.")
@@ -3594,7 +3609,7 @@ func (h *Handler) WithClusterClientProvider(fn ClusterClientHandler) httprouter.
 }
 
 // ProvisionTokenHandler is a authenticated handler that is called for some existing Token
-type ProvisionTokenHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, site reversetunnel.RemoteSite, token types.ProvisionToken) (interface{}, error)
+type ProvisionTokenHandler func(w http.ResponseWriter, r *http.Request, p httprouter.Params, site reversetunnelclient.RemoteSite, token types.ProvisionToken) (interface{}, error)
 
 // WithProvisionTokenAuth ensures that request is authenticated with a provision token.
 // Provision tokens, when used like this are invalidated as soon as used.
@@ -3795,17 +3810,17 @@ func rateLimitRequest(r *http.Request, limiter *limiter.RateLimiter) error {
 // and bearer token
 func (h *Handler) AuthenticateRequest(w http.ResponseWriter, r *http.Request, checkBearerToken bool) (*SessionContext, error) {
 	const missingCookieMsg = "missing session cookie"
-	cookie, err := r.Cookie(CookieName)
+	cookie, err := r.Cookie(websession.CookieName)
 	if err != nil || (cookie != nil && cookie.Value == "") {
 		return nil, trace.AccessDenied(missingCookieMsg)
 	}
-	decodedCookie, err := DecodeCookie(cookie.Value)
+	decodedCookie, err := websession.DecodeCookie(cookie.Value)
 	if err != nil {
 		return nil, trace.AccessDenied("failed to decode cookie")
 	}
 	ctx, err := h.auth.getOrCreateSession(r.Context(), decodedCookie.User, decodedCookie.SID)
 	if err != nil {
-		ClearSession(w)
+		websession.ClearCookie(w)
 		return nil, trace.AccessDenied("need auth")
 	}
 	if checkBearerToken {
@@ -3822,13 +3837,18 @@ func (h *Handler) AuthenticateRequest(w http.ResponseWriter, r *http.Request, ch
 
 // ProxyWithRoles returns a reverse tunnel proxy verifying the permissions
 // of the given user.
-func (h *Handler) ProxyWithRoles(ctx *SessionContext) (reversetunnel.Tunnel, error) {
+func (h *Handler) ProxyWithRoles(ctx *SessionContext) (reversetunnelclient.Tunnel, error) {
 	accessChecker, err := ctx.GetUserAccessChecker()
 	if err != nil {
 		h.log.WithError(err).Warn("Failed to get client roles.")
 		return nil, trace.Wrap(err)
 	}
-	return reversetunnel.NewTunnelWithRoles(h.cfg.Proxy, accessChecker, h.cfg.AccessPoint), nil
+
+	cn, err := h.cfg.AccessPoint.GetClusterName()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return reversetunnelclient.NewTunnelWithRoles(h.cfg.Proxy, cn.GetClusterName(), accessChecker, h.cfg.AccessPoint), nil
 }
 
 // ProxyHostPort returns the address of the proxy server using --proxy
@@ -4000,7 +4020,7 @@ func SSOSetWebSessionAndRedirectURL(w http.ResponseWriter, r *http.Request, resp
 		}
 	}
 
-	if err := SetSessionCookie(w, response.Username, response.SessionName); err != nil {
+	if err := websession.SetCookie(w, response.Username, response.SessionName); err != nil {
 		return trace.Wrap(err)
 	}
 
diff --git a/lib/web/apiserver_test.go b/lib/web/apiserver_test.go
index a01a8cc4ec06a..1d409f59683da 100644
--- a/lib/web/apiserver_test.go
+++ b/lib/web/apiserver_test.go
@@ -59,6 +59,7 @@ import (
 	"github.com/pquerna/otp/totp"
 	"github.com/sashabaranov/go-openai"
 	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	commonv1 "go.opentelemetry.io/proto/otlp/common/v1"
 	resourcev1 "go.opentelemetry.io/proto/otlp/resource/v1"
@@ -109,6 +110,7 @@ import (
 	"github.com/gravitational/teleport/lib/proxy"
 	restricted "github.com/gravitational/teleport/lib/restrictedsession"
 	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/secret"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
@@ -120,6 +122,7 @@ import (
 	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	websession "github.com/gravitational/teleport/lib/web/session"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
@@ -131,7 +134,7 @@ type WebSuite struct {
 
 	node        *regular.Server
 	proxy       *regular.Server
-	proxyTunnel reversetunnel.Server
+	proxyTunnel reversetunnelclient.Server
 	srvID       string
 
 	user       string
@@ -212,8 +215,7 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 			Dir:                     t.TempDir(),
 			Clock:                   s.clock,
 			ClusterNetworkingConfig: networkingConfig,
-
-			AuthPreferenceSpec: cfg.authPreferenceSpec,
+			AuthPreferenceSpec:      cfg.authPreferenceSpec,
 		},
 	}
 
@@ -235,7 +237,7 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 
 	// Register the auth server, since test auth server doesn't start its own
 	// heartbeat.
-	err = s.server.Auth().UpsertAuthServer(&types.ServerV2{
+	err = s.server.Auth().UpsertAuthServer(ctx, &types.ServerV2{
 		Kind:    types.KindAuthServer,
 		Version: types.V2,
 		Metadata: types.Metadata{
@@ -452,11 +454,15 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 		StaticFS:                        fs,
 		CachedSessionLingeringThreshold: &sessionLingeringThreshold,
 		ProxySettings:                   &mockProxySettings{},
-		SessionControl:                  proxySessionController,
-		Router:                          router,
-		HealthCheckAppServer:            cfg.HealthCheckAppServer,
-		UI:                              cfg.uiConfig,
-		OpenAIConfig:                    cfg.OpenAIConfig,
+		SessionControl: SessionControllerFunc(func(ctx context.Context, sctx *SessionContext, login, localAddr, remoteAddr string) (context.Context, error) {
+			controller := srv.WebSessionController(proxySessionController)
+			ctx, err := controller(ctx, sctx, login, localAddr, remoteAddr)
+			return ctx, trace.Wrap(err)
+		}),
+		Router:               router,
+		HealthCheckAppServer: cfg.HealthCheckAppServer,
+		UI:                   cfg.uiConfig,
+		OpenAIConfig:         cfg.OpenAIConfig,
 	}
 
 	if handlerConfig.HealthCheckAppServer == nil {
@@ -622,11 +628,12 @@ type authPack struct {
 	session   *CreateSessionResponse
 	clt       *TestWebClient
 	cookies   []*http.Cookie
+	device    *auth.TestDevice
 }
 
 // authPack returns new authenticated package consisting of created valid
 // user, otp token, created web session and authenticated client.
-func (s *WebSuite) authPack(t *testing.T, user string) *authPack {
+func (s *WebSuite) authPack(t *testing.T, user string, roles ...string) *authPack {
 	login := s.user
 	pass := "abc123"
 	rawSecret := "def456"
@@ -640,7 +647,7 @@ func (s *WebSuite) authPack(t *testing.T, user string) *authPack {
 	err = s.server.Auth().SetAuthPreference(s.ctx, ap)
 	require.NoError(t, err)
 
-	s.createUser(t, user, login, pass, otpSecret)
+	s.createUser(t, user, login, pass, otpSecret, roles...)
 
 	// create a valid otp token
 	validToken, err := totp.GenerateCode(otpSecret, s.clock.Now())
@@ -679,7 +686,93 @@ func (s *WebSuite) authPack(t *testing.T, user string) *authPack {
 	}
 }
 
-func (s *WebSuite) createUser(t *testing.T, user string, login string, pass string, otpSecret string) {
+func (s *WebSuite) authPackWithMFA(t *testing.T, name string, roles ...types.Role) *authPack {
+	const password = "testing"
+	user, err := types.NewUser(name)
+	require.NoError(t, err)
+
+	userRole := services.RoleForUser(user)
+	userRole.SetLogins(types.Allow, []string{s.user})
+	err = s.server.Auth().UpsertRole(s.ctx, userRole)
+	require.NoError(t, err)
+
+	for _, role := range roles {
+		err = s.server.Auth().UpsertRole(s.ctx, role)
+		require.NoError(t, err)
+		user.AddRole(role.GetName())
+	}
+
+	user.AddRole(userRole.GetName())
+	err = s.server.Auth().CreateUser(s.ctx, user)
+	require.NoError(t, err)
+
+	clt := s.client(t)
+
+	// create register challenge
+	token, err := s.server.Auth().CreateResetPasswordToken(s.ctx, auth.CreateUserTokenRequest{
+		Name: name,
+	})
+	require.NoError(t, err)
+
+	res, err := s.server.Auth().CreateRegisterChallenge(s.ctx, &authproto.CreateRegisterChallengeRequest{
+		TokenID:     token.GetName(),
+		DeviceType:  authproto.DeviceType_DEVICE_TYPE_WEBAUTHN,
+		DeviceUsage: authproto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS,
+	})
+	require.NoError(t, err)
+
+	cc := wanlib.CredentialCreationFromProto(res.GetWebauthn())
+
+	// use passwordless as auth method
+	device, err := mocku2f.Create()
+	require.NoError(t, err)
+
+	device.SetPasswordless()
+
+	ccr, err := device.SignCredentialCreation("https://localhost", cc)
+	require.NoError(t, err)
+
+	_, err = s.server.Auth().ChangeUserAuthentication(s.ctx, &authproto.ChangeUserAuthenticationRequest{
+		TokenID:     token.GetName(),
+		NewPassword: []byte(password),
+		NewMFARegisterResponse: &authproto.MFARegisterResponse{
+			Response: &authproto.MFARegisterResponse_Webauthn{
+				Webauthn: wanlib.CredentialCreationResponseToProto(ccr),
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	beginReq := &client.MFAChallengeRequest{
+		User: name,
+		Pass: password,
+	}
+	re, err := s.loginMFA(clt, beginReq, device)
+	require.NoError(t, err)
+
+	var rawSess *CreateSessionResponse
+	require.NoError(t, json.Unmarshal(re.Bytes(), &rawSess))
+
+	sess, err := rawSess.response()
+	require.NoError(t, err)
+
+	jar, err := cookiejar.New(nil)
+	require.NoError(t, err)
+
+	clt = s.client(t, roundtrip.BearerAuth(sess.Token), roundtrip.CookieJar(jar))
+	jar.SetCookies(s.url(), re.Cookies())
+
+	return &authPack{
+		user:    name,
+		login:   s.user,
+		session: sess,
+		clt:     clt,
+		cookies: re.Cookies(),
+		device:  &auth.TestDevice{Key: device},
+	}
+}
+
+func (s *WebSuite) createUser(t *testing.T, user string, login string, pass string, otpSecret string, roles ...string) {
 	teleUser, err := types.NewUser(user)
 	require.NoError(t, err)
 	role := services.RoleForUser(teleUser)
@@ -691,6 +784,10 @@ func (s *WebSuite) createUser(t *testing.T, user string, login string, pass stri
 	require.NoError(t, err)
 	teleUser.AddRole(role.GetName())
 
+	for _, r := range roles {
+		teleUser.AddRole(r)
+	}
+
 	teleUser.SetCreatedBy(types.CreatedBy{
 		User: types.UserRef{Name: "some-auth-user"},
 	})
@@ -1542,7 +1639,7 @@ func isResizeEventEnvelope(e *Envelope) bool {
 func TestTerminalPing(t *testing.T) {
 	t.Parallel()
 	s := newWebSuite(t)
-	ws, _, err := s.makeTerminal(t, s.authPack(t, "foo"), withKeepaliveInterval(500*time.Millisecond))
+	ws, _, err := s.makeTerminal(t, s.authPack(t, "foo"), withKeepaliveInterval(time.Second))
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, ws.Close()) })
 
@@ -1576,7 +1673,7 @@ func TestTerminalPing(t *testing.T) {
 
 	select {
 	case <-done:
-	case <-time.After(time.Minute):
+	case <-time.After(6 * time.Second):
 		t.Fatal("timeout waiting for ping")
 	}
 }
@@ -1700,8 +1797,7 @@ func TestTerminalRouting(t *testing.T) {
 			require.NoError(t, err)
 			t.Cleanup(func() { tt.wsCloseAssertion(t, ws.Close()) })
 
-			stream, err := NewTerminalStream(ws)
-			require.NoError(t, err)
+			stream := NewTerminalStream(s.ctx, ws, utils.NewLoggerForTests())
 
 			// here we intentionally run a command where the output we're looking
 			// for is not present in the command itself
@@ -1780,7 +1876,7 @@ func TestTerminalNameResolution(t *testing.T) {
 	}
 }
 
-func TestTerminalRequireSessionMfa(t *testing.T) {
+func TestTerminalRequireSessionMFA(t *testing.T) {
 	ctx := context.Background()
 	env := newWebPack(t, 1)
 	proxy := env.proxies[0]
@@ -1820,12 +1916,20 @@ func TestTerminalRequireSessionMfa(t *testing.T) {
 				res, err := dev.SolveAuthn(&authproto.MFAAuthenticateChallenge{
 					WebauthnChallenge: wanlib.CredentialAssertionToProto(chals.WebauthnChallenge),
 				})
-				require.Nil(t, err)
+				require.NoError(t, err)
 
 				webauthnResBytes, err := json.Marshal(wanlib.CredentialAssertionResponseFromProto(res.GetWebauthn()))
-				require.Nil(t, err)
+				require.NoError(t, err)
+
+				envelope := &Envelope{
+					Version: defaults.WebsocketVersion,
+					Type:    defaults.WebsocketWebauthnChallenge,
+					Payload: string(webauthnResBytes),
+				}
+				protoBytes, err := proto.Marshal(envelope)
+				require.NoError(t, err)
 
-				return webauthnResBytes
+				return protoBytes
 			},
 		},
 	}
@@ -1851,15 +1955,14 @@ func TestTerminalRequireSessionMfa(t *testing.T) {
 			require.Nil(t, json.Unmarshal([]byte(env.Payload), &chals))
 
 			// Send response over ws.
-			stream, err := NewTerminalStream(ws)
-			require.NoError(t, err)
-			_, err = stream.Write(tc.getChallengeResponseBytes(chals, dev))
+			stream := NewTerminalStream(ctx, ws, utils.NewLoggerForTests())
+			err = stream.ws.WriteMessage(websocket.BinaryMessage, tc.getChallengeResponseBytes(chals, dev))
 			require.Nil(t, err)
 
 			// Test we can write.
-			_, err = io.WriteString(stream, "echo alpacas\r\n")
+			_, err = io.WriteString(stream, "echo txlxport | sed 's/x/e/g'\r\n")
 			require.Nil(t, err)
-			require.Nil(t, waitForOutput(stream, "alpacas"))
+			require.Nil(t, waitForOutput(stream, "teleport"))
 		})
 	}
 }
@@ -1955,7 +2058,7 @@ func TestDesktopAccessMFARequiresMfa(t *testing.T) {
 				},
 				RequireMFAType: types.RequireMFAType_SESSION,
 			},
-			mfaHandler: handleMFAWebauthnChallenge,
+			mfaHandler: handleDesktopMFAWebauthnChallenge,
 			registerDevice: func(t *testing.T, ctx context.Context, clt *auth.Client) *auth.TestDevice {
 				webauthnDev, err := auth.RegisterTestDevice(ctx, clt, "webauthn", authproto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 				require.NoError(t, err)
@@ -2013,7 +2116,7 @@ func TestDesktopAccessMFARequiresMfa(t *testing.T) {
 	}
 }
 
-func handleMFAWebauthnChallenge(t *testing.T, ws *websocket.Conn, dev *auth.TestDevice) {
+func handleDesktopMFAWebauthnChallenge(t *testing.T, ws *websocket.Conn, dev *auth.TestDevice) {
 	br := bufio.NewReader(&WebsocketIO{Conn: ws})
 	mt, err := br.ReadByte()
 	require.NoError(t, err)
@@ -2043,8 +2146,7 @@ func TestWebAgentForward(t *testing.T) {
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, ws.Close()) })
 
-	stream, err := NewTerminalStream(ws)
-	require.NoError(t, err)
+	stream := NewTerminalStream(s.ctx, ws, utils.NewLoggerForTests())
 
 	_, err = io.WriteString(stream, "echo $SSH_AUTH_SOCK\r\n")
 	require.NoError(t, err)
@@ -2156,14 +2258,13 @@ func TestCloseConnectionsOnLogout(t *testing.T) {
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, ws.Close()) })
 
-	stream, err := NewTerminalStream(ws)
-	require.NoError(t, err)
+	stream := NewTerminalStream(s.ctx, ws, utils.NewLoggerForTests())
 
 	// to make sure we have a session
 	_, err = io.WriteString(stream, "expr 137 + 39\r\n")
 	require.NoError(t, err)
 
-	// make sure server has replied
+	// make sure the server has replied
 	out := make([]byte, 100)
 	_, err = stream.Read(out)
 	require.NoError(t, err)
@@ -2171,7 +2272,7 @@ func TestCloseConnectionsOnLogout(t *testing.T) {
 	_, err = pack.clt.Delete(s.ctx, pack.clt.Endpoint("webapi", "sessions", "web"))
 	require.NoError(t, err)
 
-	// wait until we timeout or detect that connection has been closed
+	// wait until timeout or detect that the connection has been closed.
 	after := time.After(5 * time.Second)
 	errC := make(chan error)
 	go func() {
@@ -2179,6 +2280,7 @@ func TestCloseConnectionsOnLogout(t *testing.T) {
 			_, err := stream.Read(out)
 			if err != nil {
 				errC <- err
+				return
 			}
 		}
 	}()
@@ -2443,43 +2545,43 @@ func TestPingAutomaticUpgrades(t *testing.T) {
 
 // TestInstallerRepoChannel ensures the returned installer script has the proper repo channel
 func TestInstallerRepoChannel(t *testing.T) {
-	s := newWebSuiteWithConfig(t, webSuiteConfig{
-		authPreferenceSpec: &types.AuthPreferenceSpecV2{
-			Type:         constants.Local,
-			SecondFactor: constants.SecondFactorOn,
-			Webauthn:     &types.Webauthn{RPID: "localhost"},
-		},
-	})
+	t.Run("cloud with automatic upgrades", func(t *testing.T) {
+		modules.SetTestModules(t, &modules.TestModules{
+			TestFeatures: modules.Features{
+				Cloud:             true,
+				AutomaticUpgrades: true,
+			},
+		})
 
-	wc := s.client(t)
-	t.Run("documented variables are injected", func(t *testing.T) {
-		// Variables documented here: https://goteleport.com/docs/server-access/guides/ec2-discovery/#step-67-optional-customize-the-default-installer-script
-		err := s.server.Auth().SetInstaller(s.ctx, types.MustNewInstallerV1("custom", `#!/usr/bin/env bash
+		s := newWebSuiteWithConfig(t, webSuiteConfig{
+			authPreferenceSpec: &types.AuthPreferenceSpecV2{
+				Type:         constants.Local,
+				SecondFactor: constants.SecondFactorOn,
+				Webauthn:     &types.Webauthn{RPID: "localhost"},
+			},
+		})
+
+		wc := s.client(t)
+		t.Run("documented variables are injected", func(t *testing.T) {
+			// Variables documented here: https://goteleport.com/docs/server-access/guides/ec2-discovery/#step-67-optional-customize-the-default-installer-script
+			err := s.server.Auth().SetInstaller(s.ctx, types.MustNewInstallerV1("custom", `#!/usr/bin/env bash
 echo {{ .PublicProxyAddr }}
 echo Teleport-{{ .MajorVersion }}
 echo Repository Channel: {{ .RepoChannel }}
 echo AutomaticUpgrades: {{ .AutomaticUpgrades }}
 		`))
-		require.NoError(t, err)
+			require.NoError(t, err)
 
-		re, err := wc.Get(s.ctx, wc.Endpoint("webapi", "scripts", "installer", "custom"), url.Values{})
-		require.NoError(t, err)
+			re, err := wc.Get(s.ctx, wc.Endpoint("webapi", "scripts", "installer", "custom"), url.Values{})
+			require.NoError(t, err)
 
-		responseString := string(re.Bytes())
+			responseString := string(re.Bytes())
 
-		// Variables must be injected
-		require.Contains(t, responseString, "echo Teleport-v")
-		require.Contains(t, responseString, "echo Repository Channel: stable/v")
-		require.NotContains(t, responseString, "echo Repository Channel: stable/cloud")
-		require.Contains(t, responseString, "echo AutomaticUpgrades: false")
-	})
-	t.Run("cloud with automatic upgrades", func(t *testing.T) {
-		modules.SetTestModules(t, &modules.TestModules{
-			TestBuildType: modules.BuildEnterprise,
-			TestFeatures: modules.Features{
-				Cloud:             true,
-				AutomaticUpgrades: true,
-			},
+			// Variables must be injected
+			require.Contains(t, responseString, "echo Teleport-v")
+			require.NotContains(t, responseString, "echo Repository Channel: stable/v")
+			require.Contains(t, responseString, "echo Repository Channel: stable/cloud")
+			require.Contains(t, responseString, "echo AutomaticUpgrades: true")
 		})
 
 		t.Run("default-installer", func(t *testing.T) {
@@ -2499,6 +2601,7 @@ echo AutomaticUpgrades: {{ .AutomaticUpgrades }}
 				"  fi",
 			)
 		})
+
 		t.Run("default-agentless-installer", func(t *testing.T) {
 			re, err := wc.Get(s.ctx, wc.Endpoint("webapi", "scripts", "installer", "default-agentless-installer"), url.Values{})
 			require.NoError(t, err)
@@ -2517,19 +2620,53 @@ echo AutomaticUpgrades: {{ .AutomaticUpgrades }}
 			)
 		})
 	})
+
 	t.Run("cloud without automatic upgrades", func(t *testing.T) {
-		modules.SetTestModules(t, &modules.TestModules{TestFeatures: modules.Features{
-			Cloud:             true,
-			AutomaticUpgrades: false,
-		}})
+		modules.SetTestModules(t, &modules.TestModules{
+			TestFeatures: modules.Features{
+				Cloud:             true,
+				AutomaticUpgrades: false,
+			},
+		})
 
+		s := newWebSuiteWithConfig(t, webSuiteConfig{
+			authPreferenceSpec: &types.AuthPreferenceSpecV2{
+				Type:         constants.Local,
+				SecondFactor: constants.SecondFactorOn,
+				Webauthn:     &types.Webauthn{RPID: "localhost"},
+			},
+		})
+
+		wc := s.client(t)
+
+		t.Run("documented variables are injected", func(t *testing.T) {
+			// Variables documented here: https://goteleport.com/docs/server-access/guides/ec2-discovery/#step-67-optional-customize-the-default-installer-script
+			err := s.server.Auth().SetInstaller(s.ctx, types.MustNewInstallerV1("custom", `#!/usr/bin/env bash
+	echo {{ .PublicProxyAddr }}
+	echo Teleport-{{ .MajorVersion }}
+	echo Repository Channel: {{ .RepoChannel }}
+	echo AutomaticUpgrades: {{ .AutomaticUpgrades }}
+			`))
+			require.NoError(t, err)
+
+			re, err := wc.Get(s.ctx, wc.Endpoint("webapi", "scripts", "installer", "custom"), url.Values{})
+			require.NoError(t, err)
+
+			responseString := string(re.Bytes())
+
+			// Variables must be injected
+			require.Contains(t, responseString, "echo Teleport-v")
+			require.Contains(t, responseString, "echo Repository Channel: stable/v")
+			require.NotContains(t, responseString, "echo Repository Channel: stable/cloud")
+			require.Contains(t, responseString, "echo AutomaticUpgrades: false")
+		})
 		t.Run("default-installer", func(t *testing.T) {
 			re, err := wc.Get(s.ctx, wc.Endpoint("webapi", "scripts", "installer", "default-installer"), url.Values{})
 			require.NoError(t, err)
 
 			responseString := string(re.Bytes())
 
-			require.Contains(t, responseString, "stable/cloud")
+			require.NotContains(t, responseString, "stable/cloud")
 		})
 		t.Run("default-agentless-installer", func(t *testing.T) {
 			re, err := wc.Get(s.ctx, wc.Endpoint("webapi", "scripts", "installer", "default-agentless-installer"), url.Values{})
@@ -2537,7 +2674,82 @@ echo AutomaticUpgrades: {{ .AutomaticUpgrades }}
 
 			responseString := string(re.Bytes())
 
-			require.Contains(t, responseString, "stable/cloud")
+			require.NotContains(t, responseString, "stable/cloud")
+		})
+	})
+
+	t.Run("oss or enterprise with automatic upgrades", func(t *testing.T) {
+		modules.SetTestModules(t, &modules.TestModules{
+			TestBuildType: modules.BuildOSS,
+			TestFeatures: modules.Features{
+				Cloud:             false,
+				AutomaticUpgrades: true,
+			},
+		})
+
+		s := newWebSuiteWithConfig(t, webSuiteConfig{
+			authPreferenceSpec: &types.AuthPreferenceSpecV2{
+				Type:         constants.Local,
+				SecondFactor: constants.SecondFactorOn,
+				Webauthn:     &types.Webauthn{RPID: "localhost"},
+			},
+		})
+
+		wc := s.client(t)
+		t.Run("documented variables are injected", func(t *testing.T) {
+			// Variables documented here: https://goteleport.com/docs/server-access/guides/ec2-discovery/#step-67-optional-customize-the-default-installer-script
+			err := s.server.Auth().SetInstaller(s.ctx, types.MustNewInstallerV1("custom", `#!/usr/bin/env bash
+echo {{ .PublicProxyAddr }}
+echo Teleport-{{ .MajorVersion }}
+echo Repository Channel: {{ .RepoChannel }}
+echo AutomaticUpgrades: {{ .AutomaticUpgrades }}
+		`))
+			require.NoError(t, err)
+
+			re, err := wc.Get(s.ctx, wc.Endpoint("webapi", "scripts", "installer", "custom"), url.Values{})
+			require.NoError(t, err)
+
+			responseString := string(re.Bytes())
+
+			// Variables must be injected
+			require.Contains(t, responseString, "echo Teleport-v")
+			require.Contains(t, responseString, "echo Repository Channel: stable/v")
+			require.NotContains(t, responseString, "echo Repository Channel: stable/cloud")
+			require.Contains(t, responseString, "echo AutomaticUpgrades: false")
+		})
+		t.Run("default-installer", func(t *testing.T) {
+			re, err := wc.Get(s.ctx, wc.Endpoint("webapi", "scripts", "installer", "default-installer"), url.Values{})
+			require.NoError(t, err)
+
+			responseString := string(re.Bytes())
+
+			// The repo's channel to use is stable/cloud
+			require.NotContains(t, responseString, "stable/cloud")
+			require.Contains(t, responseString, "stable/v")
+			require.Contains(t, responseString, ""+
+				"  PACKAGE_LIST=\"teleport jq\"\n"+
+				"  # shellcheck disable=SC2050\n"+
+				"  if [ \"false\" = \"true\" ]; then\n"+
+				"    PACKAGE_LIST=\"${PACKAGE_LIST} teleport-updater\"\n"+
+				"  fi",
+			)
+		})
+		t.Run("default-agentless-installer", func(t *testing.T) {
+			re, err := wc.Get(s.ctx, wc.Endpoint("webapi", "scripts", "installer", "default-agentless-installer"), url.Values{})
+			require.NoError(t, err)
+
+			responseString := string(re.Bytes())
+
+			// The repo's channel to use is stable/cloud
+			require.NotContains(t, responseString, "stable/cloud")
+			require.Contains(t, responseString, "stable/v")
+			require.Contains(t, responseString, ""+
+				"  PACKAGE_LIST=\"jq teleport\"\n"+
+				"  # shellcheck disable=SC2050\n"+
+				"  if [[ \"false\" == \"true\" ]]; then\n"+
+				"    PACKAGE_LIST=\"${PACKAGE_LIST} teleport-updater\"\n"+
+				"  fi\n",
+			)
 		})
 	})
 }
@@ -4059,6 +4271,14 @@ func TestClusterAppsGet(t *testing.T) {
 		TotalCount int      `json:"totalCount"`
 	}
 
+	// add a user group
+	ug, err := types.NewUserGroup(types.Metadata{
+		Name: "ug1", Description: "ug1-description"},
+		types.UserGroupSpecV1{Applications: []string{"app1"}})
+	require.NoError(t, err)
+	err = env.server.Auth().CreateUserGroup(context.Background(), ug)
+	require.NoError(t, err)
+
 	resource := &types.AppServerV3{
 		Metadata: types.Metadata{Name: "test-app"},
 		Kind:     types.KindAppServer,
@@ -4067,13 +4287,14 @@ func TestClusterAppsGet(t *testing.T) {
 			HostID: "hostid",
 			App: &types.AppV3{
 				Metadata: types.Metadata{
-					Name:        "name",
+					Name:        "app1",
 					Description: "description",
 					Labels:      map[string]string{"test-field": "test-value"},
 				},
 				Spec: types.AppSpecV3{
 					URI:        "https://console.aws.amazon.com", // sets field awsConsole to true
 					PublicAddr: "publicaddrs",
+					UserGroups: []string{"ug1"},
 				},
 			},
 		},
@@ -4105,7 +4326,7 @@ func TestClusterAppsGet(t *testing.T) {
 	require.Len(t, resp.Items, 2)
 	require.Equal(t, 2, resp.TotalCount)
 	require.ElementsMatch(t, resp.Items, []ui.App{{
-		Name:        resource.Spec.App.GetName(),
+		Name:        "app1",
 		Description: resource.Spec.App.GetDescription(),
 		URI:         resource.Spec.App.GetURI(),
 		PublicAddr:  resource.Spec.App.GetPublicAddr(),
@@ -4113,6 +4334,7 @@ func TestClusterAppsGet(t *testing.T) {
 		FQDN:        resource.Spec.App.GetPublicAddr(),
 		ClusterID:   env.server.ClusterName(),
 		AWSConsole:  true,
+		UserGroups:  []ui.UserGroupAndDescription{{Name: "ug1", Description: "ug1-description"}},
 	}, {
 		Name:       "app2",
 		URI:        "uri",
@@ -4224,6 +4446,7 @@ func TestGetWebConfig(t *testing.T) {
 	env := newWebPack(t, 1)
 
 	// Set auth preference with passwordless.
+	const MOTD = "Welcome to cluster, your activity will be recorded."
 	ap, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{
 		Type:          constants.Local,
 		SecondFactor:  constants.SecondFactorOptional,
@@ -4231,6 +4454,7 @@ func TestGetWebConfig(t *testing.T) {
 		Webauthn: &types.Webauthn{
 			RPID: "localhost",
 		},
+		MessageOfTheDay: MOTD,
 	})
 	require.NoError(t, err)
 	err = env.server.Auth().SetAuthPreference(ctx, ap)
@@ -4264,10 +4488,13 @@ func TestGetWebConfig(t *testing.T) {
 			PreferredLocalMFA:  constants.SecondFactorWebauthn,
 			LocalConnectorName: constants.PasswordlessConnector,
 			PrivateKeyPolicy:   keys.PrivateKeyPolicyNone,
+			MOTD:               MOTD,
 		},
-		CanJoinSessions:  true,
-		ProxyClusterName: env.server.ClusterName(),
-		IsCloud:          false,
+		CanJoinSessions:   true,
+		ProxyClusterName:  env.server.ClusterName(),
+		IsCloud:           false,
+		AssistEnabled:     false,
+		AutomaticUpgrades: false,
 	}
 
 	// Make a request.
@@ -4290,13 +4517,23 @@ func TestGetWebConfig(t *testing.T) {
 		TestFeatures: modules.Features{
 			Cloud:               true,
 			IsUsageBasedBilling: true,
+			AutomaticUpgrades:   true,
 		},
 	})
 
+	mockProxySetting := &mockProxySettings{
+		mockedGetProxySettings: func(ctx context.Context) (*webclient.ProxySettings, error) {
+			return &webclient.ProxySettings{AssistEnabled: true}, nil
+		},
+	}
+	env.proxies[0].handler.handler.cfg.ProxySettings = mockProxySetting
+
 	expectedCfg.IsCloud = true
 	expectedCfg.IsUsageBasedBilling = true
+	expectedCfg.AutomaticUpgrades = true
+	expectedCfg.AssistEnabled = true
 
-	// request and verify again
+	// request and verify enabled features are enabled.
 	re, err = clt.Get(ctx, endpoint, nil)
 	require.NoError(t, err)
 	require.True(t, strings.HasPrefix(string(re.Bytes()), "var GRV_CONFIG"))
@@ -4313,6 +4550,7 @@ func TestGetWebConfig(t *testing.T) {
 		},
 	}
 	env.proxies[0].client = mockClient
+	expectedCfg.AutomaticUpgrades = false
 
 	// update modules but NOT the expected config
 	modules.SetTestModules(t, &modules.TestModules{
@@ -4756,7 +4994,7 @@ func TestCreateAppSession(t *testing.T) {
 	rawCookie := *pack.cookies[0]
 	cookieBytes, err := hex.DecodeString(rawCookie.Value)
 	require.NoError(t, err)
-	var sessionCookie SessionCookie
+	var sessionCookie websession.Cookie
 	err = json.Unmarshal(cookieBytes, &sessionCookie)
 	require.NoError(t, err)
 
@@ -4921,7 +5159,7 @@ func TestCreateAppSessionHealthCheckAppServer(t *testing.T) {
 	rawCookie := *pack.cookies[0]
 	cookieBytes, err := hex.DecodeString(rawCookie.Value)
 	require.NoError(t, err)
-	var sessionCookie SessionCookie
+	var sessionCookie websession.Cookie
 	err = json.Unmarshal(cookieBytes, &sessionCookie)
 	require.NoError(t, err)
 
@@ -5727,6 +5965,16 @@ func TestDiagnoseSSHConnection(t *testing.T) {
 	env := newWebPack(t, 1)
 	nodeName := env.node.GetInfo().GetHostname()
 
+	// Wait for node to show up
+	require.Eventually(t, func() bool {
+		_, err := env.server.Auth().GetNode(ctx, apidefaults.Namespace, nodeName)
+		if trace.IsNotFound(err) {
+			return false
+		}
+		assert.NoError(t, err, "GetNode returned an unexpected error")
+		return true
+	}, 5*time.Second, 250*time.Millisecond)
+
 	for _, tt := range []struct {
 		name            string
 		teleportUser    string
@@ -5873,9 +6121,6 @@ func TestDiagnoseSSHConnection(t *testing.T) {
 				ResourceKind: types.KindNode,
 				ResourceName: tt.resourceName,
 				SSHPrincipal: tt.nodeUser,
-				// Default is 30 seconds but since tests run locally, we can reduce this value to also improve test responsiveness
-				// A value too low (eg 1s) will introduce test flakiness on some systems.
-				DialTimeout: 5 * time.Second,
 			})
 			require.NoError(t, err)
 			require.Equal(t, http.StatusOK, resp.Code())
@@ -5945,9 +6190,7 @@ func TestDiagnoseSSHConnection(t *testing.T) {
 		ResourceKind: types.KindNode,
 		ResourceName: nodeName,
 		SSHPrincipal: osUsername,
-		// Default is 30 seconds but since tests run locally, we can reduce this value to also improve test responsiveness
-		DialTimeout: 5 * time.Second,
-		MFAResponse: client.MFAChallengeResponse{TOTPCode: totpCode},
+		MFAResponse:  client.MFAChallengeResponse{TOTPCode: totpCode},
 	})
 	require.NoError(t, err)
 	require.Equal(t, http.StatusOK, resp.Code())
@@ -6945,6 +7188,10 @@ func (mock authProviderMock) GenerateOpenSSHCert(ctx context.Context, req *authp
 	return nil, nil
 }
 
+func (mock authProviderMock) MaintainSessionPresence(ctx context.Context) (authproto.AuthService_MaintainSessionPresenceClient, error) {
+	return nil, nil
+}
+
 func (mock authProviderMock) GetUser(_ string, _ bool) (types.User, error) {
 	return nil, nil
 }
@@ -7042,9 +7289,11 @@ func (s *WebSuite) makeTerminal(t *testing.T, pack *authPack, opts ...terminalOp
 	return ws, &sessResp.Session, nil
 }
 
-func waitForOutput(stream *TerminalStream, substr string) error {
+func waitForOutput(r io.Reader, substr string) error {
 	timeoutCh := time.After(10 * time.Second)
 
+	var prev string
+	out := make([]byte, int64(len(substr)*2))
 	for {
 		select {
 		case <-timeoutCh:
@@ -7052,17 +7301,23 @@ func waitForOutput(stream *TerminalStream, substr string) error {
 		default:
 		}
 
-		out := make([]byte, 100)
-		n, err := stream.Read(out)
-
-		// check for the string before checking the error,
-		// as it's valid for n > 0 even when there is an error
-		if n > 0 && strings.Contains(removeSpace(string(out[:n])), substr) {
+		n, err := r.Read(out)
+		outStr := removeSpace(string(out[:n]))
+
+		// Check for [substr] before checking the error,
+		// as it's valid for n > 0 even when there is an error.
+		// The [substr] is checked against the current and previous
+		// output to account for scenarios where the [substr] is split
+		// across two reads. While we try to prevent this by reading
+		// twice the length of [substr] there are no guarantees the
+		// whole thing will arrive in a single read.
+		if n > 0 && strings.Contains(prev+outStr, substr) {
 			return nil
 		}
 		if err != nil {
 			return trace.Wrap(err)
 		}
+		prev = outStr
 	}
 }
 
@@ -7109,6 +7364,54 @@ func (s *WebSuite) login(clt *TestWebClient, cookieToken string, reqToken string
 	}))
 }
 
+func (s *WebSuite) loginMFA(clt *TestWebClient, reqData *client.MFAChallengeRequest, device *mocku2f.Key) (*roundtrip.Response, error) {
+	resp, err := httplib.ConvertResponse(clt.RoundTrip(func() (*http.Response, error) {
+		data, err := json.Marshal(reqData)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		req, err := http.NewRequest("POST", clt.Endpoint("webapi", "mfa", "login", "begin"), bytes.NewBuffer(data))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := clt.HTTPClient().Do(req)
+		return resp, trace.Wrap(err)
+	}))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var challenge client.MFAAuthenticateChallenge
+	err = json.Unmarshal(resp.Bytes(), &challenge)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	car, err := device.SignAssertion("https://localhost", challenge.WebauthnChallenge)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return httplib.ConvertResponse(clt.RoundTrip(func() (*http.Response, error) {
+		respData := &client.AuthenticateWebUserRequest{
+			User:                      reqData.User,
+			WebauthnAssertionResponse: car,
+		}
+		data, err := json.Marshal(respData)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		req, err := http.NewRequest("POST", clt.Endpoint("webapi", "mfa", "login", "finishsession"), bytes.NewBuffer(data))
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := clt.HTTPClient().Do(req)
+		return resp, trace.Wrap(err)
+	}))
+}
+
 func (s *WebSuite) url() *url.URL {
 	u, err := url.Parse("https://" + s.webServer.Listener.Addr().String())
 	if err != nil {
@@ -7157,14 +7460,22 @@ func newWebPack(t *testing.T, numProxies int, opts ...proxyOption) *webPack {
 			ClusterName: "localhost",
 			Dir:         t.TempDir(),
 			Clock:       clock,
+			AuditLog:    events.NewDiscardAuditLog(),
 		},
 	})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, server.Shutdown(ctx)) })
 
+	// use a sync recording mode because the disk-based uploader
+	// that runs in the background introduces races with test cleanup
+	recConfig := types.DefaultSessionRecordingConfig()
+	recConfig.SetMode(types.RecordAtNodeSync)
+	err = server.AuthServer.AuthServer.SetSessionRecordingConfig(context.Background(), recConfig)
+	require.NoError(t, err)
+
 	// Register the auth server, since test auth server doesn't start its own
 	// heartbeat.
-	err = server.Auth().UpsertAuthServer(&types.ServerV2{
+	err = server.Auth().UpsertAuthServer(ctx, &types.ServerV2{
 		Kind:    types.KindAuthServer,
 		Version: types.V2,
 		Metadata: types.Metadata{
@@ -7405,19 +7716,23 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula
 	fs, err := newDebugFileSystem()
 	require.NoError(t, err)
 	handler, err := NewHandler(Config{
-		Proxy:                          revTunServer,
-		AuthServers:                    utils.FromAddr(authServer.Addr()),
-		DomainName:                     authServer.ClusterName(),
-		ProxyClient:                    client,
-		ProxyPublicAddrs:               utils.MustParseAddrList("proxy-1.example.com", "proxy-2.example.com"),
-		CipherSuites:                   utils.DefaultCipherSuites(),
-		AccessPoint:                    client,
-		Context:                        ctx,
-		HostUUID:                       proxyID,
-		Emitter:                        client,
-		StaticFS:                       fs,
-		ProxySettings:                  &mockProxySettings{},
-		SessionControl:                 sessionController,
+		Proxy:            revTunServer,
+		AuthServers:      utils.FromAddr(authServer.Addr()),
+		DomainName:       authServer.ClusterName(),
+		ProxyClient:      client,
+		ProxyPublicAddrs: utils.MustParseAddrList("proxy-1.example.com", "proxy-2.example.com"),
+		CipherSuites:     utils.DefaultCipherSuites(),
+		AccessPoint:      client,
+		Context:          ctx,
+		HostUUID:         proxyID,
+		Emitter:          client,
+		StaticFS:         fs,
+		ProxySettings:    &mockProxySettings{},
+		SessionControl: SessionControllerFunc(func(ctx context.Context, sctx *SessionContext, login, localAddr, remoteAddr string) (context.Context, error) {
+			controller := srv.WebSessionController(sessionController)
+			ctx, err := controller(ctx, sctx, login, localAddr, remoteAddr)
+			return ctx, trace.Wrap(err)
+		}),
 		Router:                         router,
 		HealthCheckAppServer:           func(context.Context, string, string) error { return nil },
 		MinimalReverseTunnelRoutesOnly: cfg.minimalHandler,
@@ -7479,7 +7794,7 @@ type testProxy struct {
 	clock   clockwork.FakeClock
 	client  auth.ClientI
 	auth    *auth.TestTLSServer
-	revTun  reversetunnel.Server
+	revTun  reversetunnelclient.Server
 	node    *regular.Server
 	proxy   *regular.Server
 	handler *APIHandler
@@ -7746,19 +8061,23 @@ func login(t *testing.T, clt *TestWebClient, cookieToken, reqToken string, reqDa
 
 func validateTerminalStream(t *testing.T, ws *websocket.Conn) {
 	t.Helper()
-	stream, err := NewTerminalStream(ws)
-	require.NoError(t, err)
+	stream := NewTerminalStream(context.Background(), ws, utils.NewLoggerForTests())
 
 	// here we intentionally run a command where the output we're looking
 	// for is not present in the command itself
-	_, err = io.WriteString(stream, "echo txlxport | sed 's/x/e/g'\r\n")
+	_, err := io.WriteString(stream, "echo txlxport | sed 's/x/e/g'\r\n")
 	require.NoError(t, err)
 	require.NoError(t, waitForOutput(stream, "teleport"))
 }
 
-type mockProxySettings struct{}
+type mockProxySettings struct {
+	mockedGetProxySettings func(ctx context.Context) (*webclient.ProxySettings, error)
+}
 
 func (mock *mockProxySettings) GetProxySettings(ctx context.Context) (*webclient.ProxySettings, error) {
+	if mock.mockedGetProxySettings != nil {
+		return mock.mockedGetProxySettings(ctx)
+	}
 	return &webclient.ProxySettings{}, nil
 }
 
@@ -8034,7 +8353,7 @@ func newKubeConfigFile(ctx context.Context, t *testing.T, clusters ...kubeCluste
 type startKubeOptions struct {
 	clusters    []kubeClusterConfig
 	authServer  *auth.TestTLSServer
-	revTunnel   reversetunnel.Server
+	revTunnel   reversetunnelclient.Server
 	serviceType kubeproxy.KubeServiceType
 }
 
@@ -8774,3 +9093,225 @@ type mockedPingTestProxy struct {
 func (m mockedPingTestProxy) Ping(ctx context.Context) (authproto.PingResponse, error) {
 	return m.mockedPing(ctx)
 }
+
+// TestModeratedSession validates that peers are able to start Moderated
+// Sessions and remain in the waiting room until the required number of
+// moderators are present. Only when the moderator is present the peer
+// is allowed to access the host and start entering input and receiving
+// output until the moderator terminates the session.
+func TestModeratedSession(t *testing.T) {
+	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+
+	ctx := context.Background()
+	s := newWebSuiteWithConfig(t, webSuiteConfig{disableDiskBasedRecording: true})
+
+	peerRole, err := types.NewRole("moderated", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			RequireSessionJoin: []*types.SessionRequirePolicy{
+				{
+					Name:   "moderated",
+					Filter: "contains(user.roles, \"moderator\")",
+					Kinds:  []string{string(types.SSHSessionKind)},
+					Count:  1,
+					Modes:  []string{string(types.SessionModeratorMode)},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.NoError(t, s.server.Auth().UpsertRole(s.ctx, peerRole))
+
+	moderatorRole, err := types.NewRole("moderator", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			JoinSessions: []*types.SessionJoinPolicy{
+				{
+					Name:  "moderated",
+					Roles: []string{peerRole.GetName()},
+					Kinds: []string{string(types.SSHSessionKind)},
+					Modes: []string{string(types.SessionModeratorMode), string(types.SessionObserverMode)},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.NoError(t, s.server.Auth().UpsertRole(s.ctx, moderatorRole))
+
+	peer := s.authPack(t, "foo", peerRole.GetName())
+
+	peerWS, sess, err := s.makeTerminal(t, peer)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, peerWS.Close()) })
+
+	peerStream := NewTerminalStream(ctx, peerWS, utils.NewLoggerForTests())
+
+	require.NoError(t, waitForOutput(peerStream, "Teleport > User foo joined the session with participant mode: peer."))
+
+	moderator := s.authPack(t, "bar", moderatorRole.GetName())
+	moderatorWS, _, err := s.makeTerminal(t, moderator, withSessionID(sess.ID), withParticipantMode(types.SessionModeratorMode))
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, moderatorWS.Close()) })
+
+	moderatorStream := NewTerminalStream(ctx, moderatorWS, utils.NewLoggerForTests())
+
+	require.NoError(t, waitForOutput(peerStream, "Teleport > Connecting to node over SSH"))
+
+	// here we intentionally run a command where the output we're looking
+	// for is not present in the command itself
+	_, err = io.WriteString(peerStream, "echo llxmx | sed 's/x/a/g'\r\n")
+	require.NoError(t, err)
+	require.NoError(t, waitForOutput(peerStream, "llama"))
+	require.NoError(t, waitForOutput(moderatorStream, "llama"))
+
+	// the moderator terminates the session
+	_, err = io.WriteString(moderatorStream, "t")
+	require.NoError(t, err)
+
+	require.NoError(t, waitForOutput(moderatorStream, "Stopping session..."))
+	require.NoError(t, waitForOutput(peerStream, "Process exited with status 255"))
+}
+
+// TestModeratedSessionWithMFA validates the same behavior as TestModeratedSession while
+// also ensuring that MFA is performed prior to accessing the host and that periodic
+// presence checks are performed by the moderator. When presence checks are not performed
+// the session is aborted.
+func TestModeratedSessionWithMFA(t *testing.T) {
+	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	ctx := context.Background()
+
+	const RPID = "localhost"
+
+	s := newWebSuiteWithConfig(t, webSuiteConfig{
+		disableDiskBasedRecording: true,
+		authPreferenceSpec: &types.AuthPreferenceSpecV2{
+			Type:           constants.Local,
+			ConnectorName:  constants.PasswordlessConnector,
+			SecondFactor:   constants.SecondFactorOn,
+			RequireMFAType: types.RequireMFAType_SESSION,
+			Webauthn: &types.Webauthn{
+				RPID: RPID,
+			},
+		},
+	})
+
+	peerRole, err := types.NewRole("moderated", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			RequireSessionJoin: []*types.SessionRequirePolicy{
+				{
+					Name:   "moderated",
+					Filter: "contains(user.roles, \"moderator\")",
+					Kinds:  []string{string(types.SSHSessionKind)},
+					Count:  1,
+					Modes:  []string{string(types.SessionModeratorMode)},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	moderatorRole, err := types.NewRole("moderator", types.RoleSpecV6{
+		Allow: types.RoleConditions{
+			JoinSessions: []*types.SessionJoinPolicy{
+				{
+					Name:  "moderated",
+					Roles: []string{peerRole.GetName()},
+					Kinds: []string{string(types.SSHSessionKind)},
+					Modes: []string{string(types.SessionModeratorMode), string(types.SessionObserverMode)},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	peer := s.authPackWithMFA(t, "foo", peerRole)
+	moderator := s.authPackWithMFA(t, "bar", moderatorRole)
+
+	peerWS, sess, err := s.makeTerminal(t, peer)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, peerWS.Close()) })
+
+	handleMFAWebauthnChallenge(t, peerWS, peer.device)
+
+	peerStream := NewTerminalStream(ctx, peerWS, utils.NewLoggerForTests())
+
+	require.NoError(t, waitForOutput(peerStream, "Teleport > User foo joined the session with participant mode: peer."))
+
+	moderatorWS, _, err := s.makeTerminal(t, moderator, withSessionID(sess.ID), withParticipantMode(types.SessionModeratorMode))
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, moderatorWS.Close()) })
+
+	handleMFAWebauthnChallenge(t, moderatorWS, moderator.device)
+
+	moderatorStream := NewTerminalStream(ctx, moderatorWS, utils.NewLoggerForTests())
+
+	require.NoError(t, waitForOutput(peerStream, "Teleport > Connecting to node over SSH"))
+
+	// here we intentionally run a command where the output we're looking
+	// for is not present in the command itself
+	_, err = io.WriteString(peerStream, "echo llxmx | sed 's/x/a/g'\r\n")
+	require.NoError(t, err)
+	require.NoError(t, waitForOutput(peerStream, "llama"))
+	require.NoError(t, waitForOutput(moderatorStream, "llama"))
+
+	// run the presence check a few times
+	for i := 0; i < 3; i++ {
+		s.clock.Advance(30 * time.Second)
+		require.NoError(t, waitForOutput(moderatorStream, "Teleport > Please tap your MFA key"))
+
+		challenge, err := moderatorStream.readChallenge(protobufMFACodec{})
+		require.NoError(t, err)
+
+		res, err := moderator.device.SolveAuthn(challenge)
+		require.NoError(t, err)
+
+		webauthnResBytes, err := json.Marshal(wanlib.CredentialAssertionResponseFromProto(res.GetWebauthn()))
+		require.NoError(t, err)
+
+		envelope := &Envelope{
+			Version: defaults.WebsocketVersion,
+			Type:    defaults.WebsocketWebauthnChallenge,
+			Payload: string(webauthnResBytes),
+		}
+		envelopeBytes, err := proto.Marshal(envelope)
+		require.NoError(t, err)
+
+		require.NoError(t, moderatorWS.WriteMessage(websocket.BinaryMessage, envelopeBytes))
+	}
+
+	// advance the clock far enough in the future to make the moderator stale
+	// which will terminate the session
+	s.clock.Advance(180 * time.Second)
+	require.NoError(t, waitForOutput(moderatorStream, "wait: remote command exited without exit status or exit signal"))
+	require.NoError(t, waitForOutput(peerStream, "Process exited with status 255"))
+}
+
+func handleMFAWebauthnChallenge(t *testing.T, ws *websocket.Conn, dev *auth.TestDevice) {
+	// Wait for websocket authn challenge event.
+	ty, raw, err := ws.ReadMessage()
+	require.NoError(t, err)
+	require.Equal(t, websocket.BinaryMessage, ty)
+
+	var env Envelope
+	require.NoError(t, proto.Unmarshal(raw, &env))
+
+	var challenge client.MFAAuthenticateChallenge
+	require.NoError(t, json.Unmarshal([]byte(env.Payload), &challenge))
+
+	res, err := dev.SolveAuthn(&authproto.MFAAuthenticateChallenge{
+		WebauthnChallenge: wanlib.CredentialAssertionToProto(challenge.WebauthnChallenge),
+	})
+	require.NoError(t, err)
+
+	webauthnResBytes, err := json.Marshal(wanlib.CredentialAssertionResponseFromProto(res.GetWebauthn()))
+	require.NoError(t, err)
+
+	envelope := &Envelope{
+		Version: defaults.WebsocketVersion,
+		Type:    defaults.WebsocketWebauthnChallenge,
+		Payload: string(webauthnResBytes),
+	}
+	envelopeBytes, err := proto.Marshal(envelope)
+	require.NoError(t, err)
+
+	require.NoError(t, ws.WriteMessage(websocket.BinaryMessage, envelopeBytes))
+
+}
diff --git a/lib/web/app/handler.go b/lib/web/app/handler.go
index 227ef0ab25352..cbcf4e7f14524 100644
--- a/lib/web/app/handler.go
+++ b/lib/web/app/handler.go
@@ -22,12 +22,12 @@ import (
 	"context"
 	"crypto/tls"
 	"fmt"
+	"io"
 	"net"
 	"net/http"
 	"net/url"
 	"strconv"
 
-	oxyutils "github.com/gravitational/oxy/utils"
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/julienschmidt/httprouter"
@@ -38,7 +38,8 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 )
@@ -52,7 +53,7 @@ type HandlerConfig struct {
 	// AccessPoint is caching client to auth.
 	AccessPoint auth.ProxyAccessPoint
 	// ProxyClient holds connections to leaf clusters.
-	ProxyClient reversetunnel.Tunnel
+	ProxyClient reversetunnelclient.Tunnel
 	// ProxyPublicAddrs contains web proxy public addresses.
 	ProxyPublicAddrs []utils.NetAddr
 	// CipherSuites is the list of TLS cipher suites that have been configured
@@ -283,6 +284,24 @@ func (h *Handler) HealthCheckAppServer(ctx context.Context, publicAddr string, c
 
 // handleForward forwards the request to the application service.
 func (h *Handler) handleForward(w http.ResponseWriter, r *http.Request, session *session) error {
+	if r.Body != nil {
+		// We replace the request body with a NopCloser so that the request body can
+		// be closed multiple times. This is needed because Go's HTTP RoundTripper
+		// will close the request body once called, even if the request
+		// fails. This is a problem because fwd can retry the request if no app servers
+		// are available. This retry process happens in `handleForwardError`.
+		// If the request body is closed, the retry will fail.
+		// Because the request body is closed after the first request, we need to
+		// replace the request body with a NopCloser so that the closed body can be
+		// used again and finally closed when the request handling finishes.
+		// Teleport only retries requests if DialContext returns a trace.ConnectionProblem.
+		// Because of this,  we can safely assume that the request body is never read
+		// under those conditions so the retry attempt will start reading from the beginning
+		// of the request body.
+		originalBody := r.Body
+		defer originalBody.Close()
+		r.Body = io.NopCloser(originalBody)
+	}
 	session.fwd.ServeHTTP(w, r)
 	return nil
 }
@@ -295,7 +314,7 @@ func (h *Handler) handleForwardError(w http.ResponseWriter, req *http.Request, e
 	// if it is not an agent connection problem, return without creating a new
 	// session.
 	if !trace.IsConnectionProblem(err) {
-		oxyutils.DefaultHandler.ServeHTTP(w, req, err)
+		reverseproxy.DefaultHandler.ServeHTTP(w, req, err)
 		return
 	}
 
@@ -304,7 +323,7 @@ func (h *Handler) handleForwardError(w http.ResponseWriter, req *http.Request, e
 	// done to have a consistent UX to when launching an application.
 	session, err := h.renewSession(req)
 	if err != nil {
-		if redirectErr := h.redirectToLauncher(w, req, launcherURLParams{}); redirectErr == nil {
+		if redirectErr := h.redirectToLauncher(w, req); redirectErr == nil {
 			return
 		}
 
@@ -312,7 +331,19 @@ func (h *Handler) handleForwardError(w http.ResponseWriter, req *http.Request, e
 		w.Write([]byte(http.StatusText(http.StatusInternalServerError)))
 		return
 	}
-
+	// NOTE: This handler is called by the forwarder when it encounters an error
+	// during the `ServeHTTP` call. This means that the request forwarding was not successful.
+	// Since the request was not forwarded, and above we ignore all errors that are not
+	// connection problems, we can safely assume that the request body was not read.
+	// This happens because the connection problem is returned by the DialContext
+	// function, which is the HTTP transport requires before reading the request body.
+	// Although the request body is not read, the request body is closed by the
+	// HTTP Transport but we replace the request body in (*Handler).handleForward
+	// with a NopCloser so that the request body can be closed multiple times without
+	// impacting the request forwarding.
+	// If in the future we decide to retry requests that fail for other reasons,
+	// we need to support body rewinding with `req.GetBody` together with a
+	// `io.TeeReader` to read the request body and then rewind it.
 	session.fwd.ServeHTTP(w, req)
 }
 
@@ -549,13 +580,9 @@ func HasName(r *http.Request, proxyPublicAddrs []utils.NetAddr) (string, bool) {
 	}
 	// At this point, it is assumed the caller is requesting an application and
 	// not the proxy, redirect the caller to the application launcher.
-	u := url.URL{
-		Scheme:   "https",
-		Host:     proxyPublicAddrs[0].String(),
-		Path:     fmt.Sprintf("/web/launch/%s", raddr.Host()),
-		RawQuery: fmt.Sprintf("path=%s", url.QueryEscape(r.URL.Path)),
-	}
-	return u.String(), true
+
+	urlString := makeAppRedirectURL(r, proxyPublicAddrs[0].String(), raddr.Host())
+	return urlString, true
 }
 
 const (
@@ -565,3 +592,61 @@ const (
 	// SubjectCookieName is the name of the application session subject cookie.
 	SubjectCookieName = "__Host-grv_app_session_subject"
 )
+
+// makeAppRedirectURL constructs a URL that will redirect the user to the
+// application launcher route in the web UI.
+//
+// Given app URL example: some-domain.com/arbitrary/path?foo=bar&baz=qux
+// The original requested URL will be separated into three parts:
+//   - hostname (or fqdn): some-domain.com
+//   - path (the URL parts after the app's hostname): arbitrary/path
+//   - query: foo=bar&baz=qux
+//
+// which will be constructed into a redirect URL using this form:
+//   - /web/launch/<fqdn>?path=<encoded path>&query=<encoded query>
+//
+// where the final result for the example URL will be:
+//   - /web/launch/some-domain.com?path=%2Farbitrary%2Fpath&query=foo%3Dbar%26baz%3Dqux
+//
+// The URL is formed this way to help isolate the `fqdn` param
+// from the rest of the URL.
+//
+// The original path and query cannot be formed as `web/launch/<original URL>`
+// because `web/launch` route can differ depending on how the user hits the app
+// endpoint:
+//  1. /web/launch/:fqdn/:clusterID/:publicAddr?/:arn?
+//     This route is formed when user clicks on the web UI's app launcher
+//     button from the application listing screen. The app can be directly
+//     resolved since we are able to determine the app's cluster name,
+//     public address, and AWS role name (if defined).
+//  2. /web/launch/<fqdn>?path=<encoded path>&query=<encoded query>
+//     This route is formed when a user hits the app endpoint outside of
+//     the web UI (clicking from a link or copy/pasta link), and the app will
+//     have to be resolved by the fqdn.
+//
+// Isolating the `fqdn` prevents confusing the rest of the param reserved for
+// clusterId, publicAddr, and arn (where the non-query param values are used to
+// create app session). The `web/launcher` will reconstruct the original
+// app URL when ready to redirect the user to the requested endpoint.
+func makeAppRedirectURL(r *http.Request, proxyPublicAddr, hostname string) string {
+	// Note that r.URL.Path field is stored in decoded form where:
+	//  - `/%47%6f%2f` becomes `/Go/`
+	//  - `siema%20elo` becomes `siema elo`
+	// And QueryEscape() will encode spaces as `+`
+	//
+	// QueryEscape is used on the `r.URL.Path` since it is being placed
+	// into the query part of the URL.
+	query := fmt.Sprintf("path=%s", url.QueryEscape(r.URL.Path))
+	if len(r.URL.RawQuery) > 0 {
+		query = fmt.Sprintf("%s&query=%s", query, url.QueryEscape(r.URL.RawQuery))
+	}
+
+	u := url.URL{
+		Scheme:   "https",
+		Host:     proxyPublicAddr,
+		Path:     fmt.Sprintf("/web/launch/%s", hostname),
+		RawQuery: query,
+	}
+
+	return u.String()
+}
diff --git a/lib/web/app/handler_test.go b/lib/web/app/handler_test.go
index 89fdcfa118ef8..c50dc701a01bb 100644
--- a/lib/web/app/handler_test.go
+++ b/lib/web/app/handler_test.go
@@ -45,7 +45,7 @@ import (
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -349,9 +349,9 @@ func TestMatchApplicationServers(t *testing.T) {
 	}
 
 	// Create a fake remote site and tunnel.
-	fakeRemoteSite := reversetunnel.NewFakeRemoteSite(clusterName, authClient)
-	tunnel := &reversetunnel.FakeServer{
-		Sites: []reversetunnel.RemoteSite{
+	fakeRemoteSite := reversetunnelclient.NewFakeRemoteSite(clusterName, authClient)
+	tunnel := &reversetunnelclient.FakeServer{
+		Sites: []reversetunnelclient.RemoteSite{
 			fakeRemoteSite,
 		},
 	}
@@ -405,14 +405,14 @@ func TestHealthCheckAppServer(t *testing.T) {
 	for _, tc := range []struct {
 		desc                string
 		publicAddr          string
-		appServersFunc      func(t *testing.T, remoteSite *reversetunnel.FakeRemoteSite) []types.AppServer
+		appServersFunc      func(t *testing.T, remoteSite *reversetunnelclient.FakeRemoteSite) []types.AppServer
 		expectedTunnelCalls int
 		expectErr           require.ErrorAssertionFunc
 	}{
 		{
 			desc:       "match and online services",
 			publicAddr: "valid.example.com",
-			appServersFunc: func(t *testing.T, _ *reversetunnel.FakeRemoteSite) []types.AppServer {
+			appServersFunc: func(t *testing.T, _ *reversetunnelclient.FakeRemoteSite) []types.AppServer {
 				return []types.AppServer{createAppServer(t, "valid.example.com")}
 			},
 			expectedTunnelCalls: 1,
@@ -421,7 +421,7 @@ func TestHealthCheckAppServer(t *testing.T) {
 		{
 			desc:       "match and but no online services",
 			publicAddr: "valid.example.com",
-			appServersFunc: func(t *testing.T, tunnel *reversetunnel.FakeRemoteSite) []types.AppServer {
+			appServersFunc: func(t *testing.T, tunnel *reversetunnelclient.FakeRemoteSite) []types.AppServer {
 				appServer := createAppServer(t, "valid.example.com")
 				tunnel.OfflineTunnels = map[string]struct{}{
 					fmt.Sprintf("%s.%s", appServer.GetHostID(), clusterName): {},
@@ -434,7 +434,7 @@ func TestHealthCheckAppServer(t *testing.T) {
 		{
 			desc:       "no match",
 			publicAddr: "valid.example.com",
-			appServersFunc: func(t *testing.T, tunnel *reversetunnel.FakeRemoteSite) []types.AppServer {
+			appServersFunc: func(t *testing.T, tunnel *reversetunnelclient.FakeRemoteSite) []types.AppServer {
 				return []types.AppServer{}
 			},
 			expectedTunnelCalls: 0,
@@ -458,7 +458,7 @@ func TestHealthCheckAppServer(t *testing.T) {
 				caCert:      cert,
 			}
 
-			fakeRemoteSite := reversetunnel.NewFakeRemoteSite(clusterName, authClient)
+			fakeRemoteSite := reversetunnelclient.NewFakeRemoteSite(clusterName, authClient)
 			authClient.appServers = tc.appServersFunc(t, fakeRemoteSite)
 
 			// Create a httptest server to serve the application requests. It must serve
@@ -476,8 +476,8 @@ func TestHealthCheckAppServer(t *testing.T) {
 			}
 			server.StartTLS()
 
-			tunnel := &reversetunnel.FakeServer{
-				Sites: []reversetunnel.RemoteSite{fakeRemoteSite},
+			tunnel := &reversetunnelclient.FakeServer{
+				Sites: []reversetunnelclient.RemoteSite{fakeRemoteSite},
 			}
 
 			appHandler, err := NewHandler(ctx, &HandlerConfig{
@@ -500,7 +500,7 @@ type testServer struct {
 	serverURL *url.URL
 }
 
-func setup(t *testing.T, clock clockwork.FakeClock, authClient auth.ClientI, proxyClient reversetunnel.Tunnel, proxyPublicAddrs []utils.NetAddr) *testServer {
+func setup(t *testing.T, clock clockwork.FakeClock, authClient auth.ClientI, proxyClient reversetunnelclient.Tunnel, proxyPublicAddrs []utils.NetAddr) *testServer {
 	appHandler, err := NewHandler(context.Background(), &HandlerConfig{
 		Clock:            clock,
 		AuthClient:       authClient,
@@ -655,7 +655,7 @@ func (c *mockAuthClient) GetCertAuthority(ctx context.Context, id types.CertAuth
 // fakeRemoteListener Implements a `net.Listener` that return `net.Conn` from
 // the `FakeRemoteSite`.
 type fakeRemoteListener struct {
-	fakeRemote *reversetunnel.FakeRemoteSite
+	fakeRemote *reversetunnelclient.FakeRemoteSite
 }
 
 func (r *fakeRemoteListener) Accept() (net.Conn, error) {
@@ -737,3 +737,65 @@ func createAppServer(t *testing.T, publicAddr string) types.AppServer {
 	require.NoError(t, err)
 	return appServer
 }
+
+func TestMakeAppRedirectURL(t *testing.T) {
+	for _, test := range []struct {
+		name        string
+		reqURL      string
+		expectedURL string
+	}{
+		{
+			name:        "OK - no path",
+			reqURL:      "https://grafana.localhost",
+			expectedURL: "https://proxy.com/web/launch/grafana.localhost?path=",
+		},
+		{
+			name:        "OK - add root path",
+			reqURL:      "https://grafana.localhost/",
+			expectedURL: "https://proxy.com/web/launch/grafana.localhost?path=%2F",
+		},
+		{
+			name:        "OK - add multi path",
+			reqURL:      "https://grafana.localhost/foo/bar",
+			expectedURL: "https://proxy.com/web/launch/grafana.localhost?path=%2Ffoo%2Fbar",
+		},
+		{
+			name:        "OK - add paths with ampersands",
+			reqURL:      "https://grafana.localhost/foo/this&/that",
+			expectedURL: "https://proxy.com/web/launch/grafana.localhost?path=%2Ffoo%2Fthis%26%2Fthat",
+		},
+		{
+			name:        "OK - add only query",
+			reqURL:      "https://grafana.localhost?foo=bar",
+			expectedURL: "https://proxy.com/web/launch/grafana.localhost?path=&query=foo%3Dbar",
+		},
+		{
+			name:        "OK - add query with same keys used to store the original path and query",
+			reqURL:      "https://grafana.localhost?foo=bar&query=test1&path=test",
+			expectedURL: "https://proxy.com/web/launch/grafana.localhost?path=&query=foo%3Dbar%26query%3Dtest1%26path%3Dtest",
+		},
+		{
+			name:        "OK - adds query with root path",
+			reqURL:      "https://grafana.localhost/?foo=bar&baz=qux&fruit=apple",
+			expectedURL: "https://proxy.com/web/launch/grafana.localhost?path=%2F&query=foo%3Dbar%26baz%3Dqux%26fruit%3Dapple",
+		},
+		{
+			name:        "OK - real grafana query example (encoded spaces)",
+			reqURL:      "https://grafana.localhost/alerting/list?search=state:inactive%20type:alerting%20health:nodata",
+			expectedURL: "https://proxy.com/web/launch/grafana.localhost?path=%2Falerting%2Flist&query=search%3Dstate%3Ainactive%2520type%3Aalerting%2520health%3Anodata",
+		},
+		{
+			name:        "OK - query with non-encoded spaces",
+			reqURL:      "https://grafana.localhost/alerting /list?search=state:inactive type:alerting health:nodata",
+			expectedURL: "https://proxy.com/web/launch/grafana.localhost?path=%2Falerting+%2Flist&query=search%3Dstate%3Ainactive+type%3Aalerting+health%3Anodata",
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			req, err := http.NewRequest(http.MethodGet, test.reqURL, nil)
+			require.NoError(t, err)
+
+			urlStr := makeAppRedirectURL(req, "proxy.com", "grafana.localhost")
+			require.Equal(t, test.expectedURL, urlStr)
+		})
+	}
+}
diff --git a/lib/web/app/match.go b/lib/web/app/match.go
index a8697d95ad690..dd6105035376c 100644
--- a/lib/web/app/match.go
+++ b/lib/web/app/match.go
@@ -26,7 +26,7 @@ import (
 
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -99,7 +99,7 @@ func MatchName(name string) Matcher {
 // MatchHealthy tries to establish a connection with the server using the
 // `dialAppServer` function. The app server is matched if the function call
 // doesn't return any error.
-func MatchHealthy(proxyClient reversetunnel.Tunnel, clusterName string) Matcher {
+func MatchHealthy(proxyClient reversetunnelclient.Tunnel, clusterName string) Matcher {
 	return func(ctx context.Context, appServer types.AppServer) bool {
 		conn, err := dialAppServer(ctx, proxyClient, clusterName, appServer)
 		if err != nil {
@@ -132,7 +132,7 @@ func MatchAll(matchers ...Matcher) Matcher {
 // cluster, this method will always return "acme" running within the root
 // cluster. Always supply public address and cluster name to deterministically
 // resolve an application.
-func ResolveFQDN(ctx context.Context, clt Getter, tunnel reversetunnel.Tunnel, proxyDNSNames []string, fqdn string) (types.AppServer, string, error) {
+func ResolveFQDN(ctx context.Context, clt Getter, tunnel reversetunnelclient.Tunnel, proxyDNSNames []string, fqdn string) (types.AppServer, string, error) {
 	// Try and match FQDN to public address of application within cluster.
 	servers, err := Match(ctx, clt, MatchPublicAddr(fqdn))
 	if err == nil && len(servers) > 0 {
diff --git a/lib/web/app/match_test.go b/lib/web/app/match_test.go
index f583f06804df2..0a000a9e7a01c 100644
--- a/lib/web/app/match_test.go
+++ b/lib/web/app/match_test.go
@@ -26,7 +26,7 @@ import (
 
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 )
 
 func TestMatchAll(t *testing.T) {
@@ -79,20 +79,20 @@ func TestMatchHealthy(t *testing.T) {
 }
 
 type mockProxyClient struct {
-	reversetunnel.Tunnel
+	reversetunnelclient.Tunnel
 	remoteSite *mockRemoteSite
 }
 
-func (p *mockProxyClient) GetSite(_ string) (reversetunnel.RemoteSite, error) {
+func (p *mockProxyClient) GetSite(_ string) (reversetunnelclient.RemoteSite, error) {
 	return p.remoteSite, nil
 }
 
 type mockRemoteSite struct {
-	reversetunnel.RemoteSite
+	reversetunnelclient.RemoteSite
 	dialErr error
 }
 
-func (r *mockRemoteSite) Dial(_ reversetunnel.DialParams) (net.Conn, error) {
+func (r *mockRemoteSite) Dial(_ reversetunnelclient.DialParams) (net.Conn, error) {
 	if r.dialErr != nil {
 		return nil, r.dialErr
 	}
diff --git a/lib/web/app/middleware.go b/lib/web/app/middleware.go
index 2b71e31a547ef..1dbfd9fc50f56 100644
--- a/lib/web/app/middleware.go
+++ b/lib/web/app/middleware.go
@@ -18,8 +18,6 @@ package app
 
 import (
 	"net/http"
-	"net/url"
-	"path"
 
 	"github.com/gravitational/trace"
 	"github.com/julienschmidt/httprouter"
@@ -49,7 +47,7 @@ func (h *Handler) withAuth(handler handlerAuthFunc) http.HandlerFunc {
 		// If the caller fails to authenticate, redirect the caller to Teleport.
 		session, err := h.authenticate(r.Context(), r)
 		if err != nil {
-			if redirectErr := h.redirectToLauncher(w, r, launcherURLParams{}); redirectErr == nil {
+			if redirectErr := h.redirectToLauncher(w, r); redirectErr == nil {
 				return nil
 			}
 			return trace.Wrap(err)
@@ -63,7 +61,7 @@ func (h *Handler) withAuth(handler handlerAuthFunc) http.HandlerFunc {
 
 // redirectToLauncher redirects to the proxy web's app launcher if the public
 // address of the proxy is set.
-func (h *Handler) redirectToLauncher(w http.ResponseWriter, r *http.Request, p launcherURLParams) error {
+func (h *Handler) redirectToLauncher(w http.ResponseWriter, r *http.Request) error {
 	// The application launcher can only generate browser sessions (based on
 	// Cookies). Given this, we should only redirect to it when this format is
 	// already in use.
@@ -85,40 +83,11 @@ func (h *Handler) redirectToLauncher(w http.ResponseWriter, r *http.Request, p l
 		return trace.Wrap(err)
 	}
 
-	urlPath := []string{"web", "launch", addr.Host()}
-	if p.clusterName != "" && p.publicAddr != "" {
-		urlPath = append(urlPath, p.clusterName, p.publicAddr)
-	}
-
-	urlQuery := url.Values{}
-	if p.stateToken != "" {
-		urlQuery.Add("state", p.stateToken)
-	}
-	if p.awsRole != "" {
-		urlQuery.Add("awsrole", p.awsRole)
-	}
-	if p.path != "" {
-		urlQuery.Add("path", p.path)
-	}
-
-	u := url.URL{
-		Scheme:   "https",
-		Host:     h.c.WebPublicAddr,
-		Path:     path.Join(urlPath...),
-		RawQuery: urlQuery.Encode(),
-	}
-	http.Redirect(w, r, u.String(), http.StatusFound)
+	urlString := makeAppRedirectURL(r, h.c.WebPublicAddr, addr.Host())
+	http.Redirect(w, r, urlString, http.StatusFound)
 	return nil
 }
 
-type launcherURLParams struct {
-	clusterName string
-	publicAddr  string
-	stateToken  string
-	awsRole     string
-	path        string
-}
-
 // makeRouterHandler creates a httprouter.Handle.
 func makeRouterHandler(handler routerFunc) httprouter.Handle {
 	return func(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
diff --git a/lib/web/app/redirect.go b/lib/web/app/redirect.go
index 23f58310f3ea8..78b6b34bb29bc 100644
--- a/lib/web/app/redirect.go
+++ b/lib/web/app/redirect.go
@@ -20,7 +20,6 @@ import (
 	"fmt"
 	"html/template"
 	"net/http"
-	"strings"
 
 	"github.com/gravitational/trace"
 
@@ -51,13 +50,7 @@ func SetRedirectPageHeaders(h http.Header, nonce string) {
 		// Should match the <script> tab nonce (random value).
 		scriptSrc = fmt.Sprintf("nonce-%v", nonce)
 	}
-	var csp = strings.Join([]string{
-		httplib.GetDefaultContentSecurityPolicy(),
-		fmt.Sprintf("script-src '%v'", scriptSrc),
-		"style-src 'self'",
-		"img-src 'self'",
-	}, ";")
-	h.Set("Content-Security-Policy", csp)
+	httplib.SetRedirectPageContentSecurityPolicy(h, scriptSrc)
 }
 
 // MetaRedirect issues a "meta refresh" redirect.
diff --git a/lib/web/app/session.go b/lib/web/app/session.go
index a02f7db496215..8dd9a7f548e50 100644
--- a/lib/web/app/session.go
+++ b/lib/web/app/session.go
@@ -21,15 +21,14 @@ import (
 	"sync"
 	"time"
 
-	"github.com/gravitational/oxy/forward"
-	oxyutils "github.com/gravitational/oxy/utils"
 	"github.com/gravitational/trace"
 	"github.com/gravitational/ttlmap"
 	"github.com/sirupsen/logrus"
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/httplib/reverseproxy"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/srv/app/common"
 	"github.com/gravitational/teleport/lib/tlsca"
 )
@@ -37,7 +36,7 @@ import (
 // session holds a request forwarder and web session for this request.
 type session struct {
 	// fwd can rewrite and forward requests to the target application.
-	fwd *forward.Forwarder
+	fwd *reverseproxy.Forwarder
 	// ws represents the services.WebSession this requests belongs to.
 	ws types.WebSession
 	// transport allows to dial an application server.
@@ -96,24 +95,22 @@ func (h *Handler) newSession(ctx context.Context, ws types.WebSession) (*session
 	}
 
 	// Don't trust any "X-Forward-*" headers the client sends, instead set our own.
-	delegate := forward.NewHeaderRewriter()
+	delegate := reverseproxy.NewHeaderRewriter()
 	delegate.TrustForwardHeader = false
 	hr := common.NewHeaderRewriter(delegate)
 
-	fwd, err := forward.New(
-		forward.FlushInterval(100*time.Millisecond),
-		forward.RoundTripper(transport),
-		forward.Logger(h.log),
-		forward.PassHostHeader(true),
-		forward.WebsocketDial(transport.DialWebsocket),
-		forward.ErrorHandler(oxyutils.ErrorHandlerFunc(h.handleForwardError)),
-		forward.WebsocketRewriter(hr),
-		forward.Rewriter(hr),
+	// Create a forwarder that will be used to forward requests.
+	fwd, err := reverseproxy.New(
+		reverseproxy.WithPassHostHeader(),
+		reverseproxy.WithFlushInterval(100*time.Millisecond),
+		reverseproxy.WithRoundTripper(transport),
+		reverseproxy.WithLogger(h.log),
+		reverseproxy.WithErrorHandler(h.handleForwardError),
+		reverseproxy.WithRewriter(hr),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-
 	return &session{
 		fwd: fwd,
 		ws:  ws,
@@ -123,7 +120,7 @@ func (h *Handler) newSession(ctx context.Context, ws types.WebSession) (*session
 
 // appServerMatcher returns a Matcher function used to find which AppServer can
 // handle the application requests.
-func appServerMatcher(proxyClient reversetunnel.Tunnel, publicAddr string, clusterName string) Matcher {
+func appServerMatcher(proxyClient reversetunnelclient.Tunnel, publicAddr string, clusterName string) Matcher {
 	// Match healthy and PublicAddr servers. Having a list of only healthy
 	// servers helps the transport fail before the request is forwarded to a
 	// server (in cases where there are no healthy servers). This process might
diff --git a/lib/web/app/transport.go b/lib/web/app/transport.go
index db7117ebbeacd..69aca98ab6018 100644
--- a/lib/web/app/transport.go
+++ b/lib/web/app/transport.go
@@ -34,7 +34,6 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -43,7 +42,7 @@ import (
 
 // transportConfig is configuration for a rewriting transport.
 type transportConfig struct {
-	proxyClient  reversetunnel.Tunnel
+	proxyClient  reversetunnelclient.Tunnel
 	accessPoint  auth.ReadProxyAccessPoint
 	cipherSuites []uint16
 	identity     *tlsca.Identity
@@ -135,6 +134,12 @@ func newTransport(c *transportConfig) (*transport, error) {
 // RoundTrip will rewrite the request, forward the request to the target
 // application, emit an event to the audit log, then rewrite the response.
 func (t *transport) RoundTrip(r *http.Request) (*http.Response, error) {
+	// Clone the request so we can modify it without affecting the original.
+	// This is necessary because the request cookies are deleted when the web
+	// handler forward the request to the app proxy. When this happens, the
+	// cookies are lost and the error handler will not be able to find the
+	// session based on cookies.
+	r = r.Clone(r.Context())
 	// Perform any request rewriting needed before forwarding the request.
 	if err := t.rewriteRequest(r); err != nil {
 		return nil, trace.Wrap(err)
@@ -279,7 +284,7 @@ func (t *transport) DialWebsocket(network, address string) (net.Conn, error) {
 
 // dialAppServer dial and connect to the application service over the reverse
 // tunnel subsystem.
-func dialAppServer(ctx context.Context, proxyClient reversetunnel.Tunnel, clusterName string, server types.AppServer) (net.Conn, error) {
+func dialAppServer(ctx context.Context, proxyClient reversetunnelclient.Tunnel, clusterName string, server types.AppServer) (net.Conn, error) {
 	clusterClient, err := proxyClient.GetSite(clusterName)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -292,7 +297,7 @@ func dialAppServer(ctx context.Context, proxyClient reversetunnel.Tunnel, cluste
 		from = clientSrcAddr
 	}
 
-	conn, err := clusterClient.Dial(reversetunnel.DialParams{
+	conn, err := clusterClient.Dial(reversetunnelclient.DialParams{
 		From:                  from,
 		To:                    &utils.NetAddr{AddrNetwork: "tcp", Addr: reversetunnelclient.LocalNode},
 		OriginalClientDstAddr: originalDst,
@@ -343,5 +348,5 @@ func configureTLS(c *transportConfig) (*tls.Config, error) {
 // the reverse tunnel connection is down e.g. because the agent is down.
 func isReverseTunnelDownError(err error) bool {
 	return trace.IsConnectionProblem(err) ||
-		strings.Contains(err.Error(), reversetunnel.NoApplicationTunnel)
+		strings.Contains(err.Error(), reversetunnelclient.NoApplicationTunnel)
 }
diff --git a/lib/web/apps.go b/lib/web/apps.go
index e6b051ed6624e..819f4d4978f27 100644
--- a/lib/web/apps.go
+++ b/lib/web/apps.go
@@ -21,18 +21,21 @@ package web
 import (
 	"context"
 	"net/http"
+	"sort"
 
 	"github.com/gravitational/trace"
 	"github.com/julienschmidt/httprouter"
 
 	"github.com/gravitational/teleport/api/client"
+	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/httplib"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/web/app"
@@ -40,7 +43,7 @@ import (
 )
 
 // clusterAppsGet returns a list of applications in a form the UI can present.
-func (h *Handler) clusterAppsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterAppsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	identity, err := sctx.GetIdentity()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -62,9 +65,39 @@ func (h *Handler) clusterAppsGet(w http.ResponseWriter, r *http.Request, p httpr
 		return nil, trace.Wrap(err)
 	}
 
+	userGroups, err := apiclient.GetAllResources[types.UserGroup](r.Context(), clt, &proto.ListResourcesRequest{
+		ResourceType:     types.KindUserGroup,
+		Namespace:        apidefaults.Namespace,
+		UseSearchAsRoles: true,
+	})
+	if err != nil {
+		h.log.Debugf("Unable to fetch user groups while listing applications, unable to display associated user groups: %v", err)
+	}
+
+	userGroupLookup := make(map[string]types.UserGroup, len(userGroups))
+	for _, userGroup := range userGroups {
+		userGroupLookup[userGroup.GetName()] = userGroup
+	}
+
 	var apps types.Apps
+	appsToUserGroups := map[string]types.UserGroups{}
 	for _, server := range page.Resources {
 		apps = append(apps, server.GetApp())
+
+		app := server.GetApp()
+
+		ugs := make(types.UserGroups, len(app.GetUserGroups()))
+		for i, userGroupName := range app.GetUserGroups() {
+			userGroup := userGroupLookup[userGroupName]
+			if userGroup == nil {
+				h.log.Debugf("Unable to find user group %s when creating user groups, skipping", userGroupName)
+				continue
+			}
+
+			ugs[i] = userGroup
+		}
+		sort.Sort(ugs)
+		appsToUserGroups[app.GetName()] = ugs
 	}
 
 	return listResourcesGetResponse{
@@ -74,6 +107,7 @@ func (h *Handler) clusterAppsGet(w http.ResponseWriter, r *http.Request, p httpr
 			AppClusterName:    site.GetName(),
 			Identity:          identity,
 			Apps:              apps,
+			AppsToUserGroups:  appsToUserGroups,
 		}),
 		StartKey:   page.NextKey,
 		TotalCount: page.Total,
@@ -283,7 +317,7 @@ type resolveAppResult struct {
 	App types.Application
 }
 
-func (h *Handler) resolveApp(ctx context.Context, clt app.Getter, proxy reversetunnel.Tunnel, params resolveAppParams) (*resolveAppResult, error) {
+func (h *Handler) resolveApp(ctx context.Context, clt app.Getter, proxy reversetunnelclient.Tunnel, params resolveAppParams) (*resolveAppResult, error) {
 	var (
 		server         types.AppServer
 		appClusterName string
@@ -317,7 +351,7 @@ func (h *Handler) resolveApp(ctx context.Context, clt app.Getter, proxy reverset
 
 // resolveDirect takes a public address and cluster name and exactly resolves
 // the application and the server on which it is running.
-func (h *Handler) resolveDirect(ctx context.Context, proxy reversetunnel.Tunnel, publicAddr string, clusterName string) (types.AppServer, string, error) {
+func (h *Handler) resolveDirect(ctx context.Context, proxy reversetunnelclient.Tunnel, publicAddr string, clusterName string) (types.AppServer, string, error) {
 	clusterClient, err := proxy.GetSite(clusterName)
 	if err != nil {
 		return nil, "", trace.Wrap(err)
@@ -342,7 +376,7 @@ func (h *Handler) resolveDirect(ctx context.Context, proxy reversetunnel.Tunnel,
 
 // resolveFQDN makes a best effort attempt to resolve FQDN to an application
 // running within a root or leaf cluster.
-func (h *Handler) resolveFQDN(ctx context.Context, clt app.Getter, proxy reversetunnel.Tunnel, fqdn string) (types.AppServer, string, error) {
+func (h *Handler) resolveFQDN(ctx context.Context, clt app.Getter, proxy reversetunnelclient.Tunnel, fqdn string) (types.AppServer, string, error) {
 	return app.ResolveFQDN(ctx, clt, proxy, h.proxyDNSNames(), fqdn)
 }
 
diff --git a/lib/web/assistant.go b/lib/web/assistant.go
index 4f9edfe298aab..de3d15ac144fe 100644
--- a/lib/web/assistant.go
+++ b/lib/web/assistant.go
@@ -36,7 +36,8 @@ import (
 	"github.com/gravitational/teleport/lib/assist"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/httplib"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 )
 
 // createAssistantConversationResponse is a response for POST /webapi/assistant/conversations.
@@ -250,7 +251,7 @@ type generateAssistantTitleRequest struct {
 	Message string `json:"message"`
 }
 
-// generateAssistantTitle is a handler for POST /webapi/assistant/conversations/:conversation_id/generate_title.
+// generateAssistantTitle is a handler for POST /webapi/assistant/title/summary.
 func (h *Handler) generateAssistantTitle(_ http.ResponseWriter, r *http.Request,
 	_ httprouter.Params, sctx *SessionContext,
 ) (any, error) {
@@ -268,7 +269,7 @@ func (h *Handler) generateAssistantTitle(_ http.ResponseWriter, r *http.Request,
 		return nil, trace.Wrap(err)
 	}
 
-	client, err := assist.NewAssist(r.Context(), h.cfg.ProxyClient,
+	client, err := assist.NewClient(r.Context(), h.cfg.ProxyClient,
 		h.cfg.ProxySettings, h.cfg.OpenAIConfig)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -283,11 +284,26 @@ func (h *Handler) generateAssistantTitle(_ http.ResponseWriter, r *http.Request,
 		Title: titleSummary,
 	}
 
+	// We only want to emmit
+	if modules.GetModules().Features().Cloud {
+		go func() {
+			ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+			defer cancel()
+			class, err := client.ClassifyMessage(ctx, req.Message, assist.MessageClasses)
+			if err != nil {
+				return
+			}
+			h.log.Debugf("message classified as '%s'", class)
+			// TODO(shaka): emit event here to report the message class
+		}()
+
+	}
+
 	return conversationInfo, nil
 }
 
 func (h *Handler) assistant(w http.ResponseWriter, r *http.Request, _ httprouter.Params,
-	sctx *SessionContext, site reversetunnel.RemoteSite,
+	sctx *SessionContext, site reversetunnelclient.RemoteSite,
 ) (any, error) {
 	if err := runAssistant(h, w, r, sctx, site); err != nil {
 		h.log.Warn(trace.DebugReport(err))
@@ -311,8 +327,8 @@ func checkAssistEnabled(a auth.ClientI, ctx context.Context) error {
 
 // runAssistant upgrades the HTTP connection to a websocket and starts a chat loop.
 func runAssistant(h *Handler, w http.ResponseWriter, r *http.Request,
-	sctx *SessionContext, site reversetunnel.RemoteSite,
-) error {
+	sctx *SessionContext, site reversetunnelclient.RemoteSite,
+) (err error) {
 	q := r.URL.Query()
 	conversationID := q.Get("conversation_id")
 	if conversationID == "" {
@@ -328,12 +344,7 @@ func runAssistant(h *Handler, w http.ResponseWriter, r *http.Request,
 		return trace.Wrap(err)
 	}
 
-	identity, err := createIdentityContext(sctx.GetUser(), sctx)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	ctx, err := h.cfg.SessionControl.AcquireSessionContext(r.Context(), identity, h.cfg.ProxyWebAddr.Addr, r.RemoteAddr)
+	ctx, err := h.cfg.SessionControl.AcquireSessionContext(r.Context(), sctx, sctx.GetUser(), h.cfg.ProxyWebAddr.Addr, r.RemoteAddr)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -371,7 +382,31 @@ func runAssistant(h *Handler, w http.ResponseWriter, r *http.Request,
 		h.log.WithError(err).Error("Error setting websocket readline")
 		return nil
 	}
-	defer ws.Close()
+	defer func() {
+		closureReason := websocket.CloseNormalClosure
+		closureMsg := ""
+		if err != nil {
+			h.log.WithError(err).Error("Error in the Assistant loop")
+			_ = ws.WriteJSON(&assistantMessage{
+				Type:        assist.MessageKindError,
+				Payload:     "An error has occurred. Please try again later.",
+				CreatedTime: h.clock.Now().UTC().Format(time.RFC3339),
+			})
+			// Set server error code and message: https://datatracker.ietf.org/doc/html/rfc6455#section-7.4.1
+			closureReason = websocket.CloseInternalServerErr
+			closureMsg = err.Error()
+		}
+		// Send the close message to the client and close the connection
+		if err := ws.WriteControl(websocket.CloseMessage,
+			websocket.FormatCloseMessage(closureReason, closureMsg),
+			time.Now().Add(time.Second),
+		); err != nil {
+			h.log.Warnf("Failed to write close message: %v", err)
+		}
+		if err := ws.Close(); err != nil {
+			h.log.Warnf("Failed to close websocket: %v", err)
+		}
+	}()
 
 	// Update the read deadline upon receiving a pong message.
 	ws.SetPongHandler(func(_ string) error {
@@ -386,13 +421,13 @@ func runAssistant(h *Handler, w http.ResponseWriter, r *http.Request,
 
 	go startPingLoop(ctx, ws, keepAliveInterval, h.log, nil)
 
-	assistClient, err := assist.NewAssist(ctx, h.cfg.ProxyClient,
+	assistClient, err := assist.NewClient(ctx, h.cfg.ProxyClient,
 		h.cfg.ProxySettings, h.cfg.OpenAIConfig)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	chat, err := assistClient.NewChat(ctx, authClient, conversationID, sctx.GetUser())
+	chat, err := assistClient.NewChat(ctx, authClient, authClient.EmbeddingClient(), conversationID, sctx.GetUser())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -410,7 +445,7 @@ func runAssistant(h *Handler, w http.ResponseWriter, r *http.Request,
 
 	if chat.IsNewConversation() {
 		// new conversation, generate a hello message
-		if _, err := chat.ProcessComplete(ctx, onMessageFn); err != nil {
+		if _, err := chat.ProcessComplete(ctx, onMessageFn, ""); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -442,11 +477,7 @@ func runAssistant(h *Handler, w http.ResponseWriter, r *http.Request,
 		}
 
 		//TODO(jakule): Should we sanitize the payload?
-		if err := chat.InsertAssistantMessage(ctx, assist.MessageKindUserMessage, wsIncoming.Payload); err != nil {
-			return trace.Wrap(err)
-		}
-
-		usedTokens, err := chat.ProcessComplete(ctx, onMessageFn)
+		usedTokens, err := chat.ProcessComplete(ctx, onMessageFn, wsIncoming.Payload)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -476,7 +507,6 @@ func runAssistant(h *Handler, w http.ResponseWriter, r *http.Request,
 		}
 	}
 
-	h.log.Debugf("end assistant conversation loop")
-
+	h.log.Debug("end assistant conversation loop")
 	return nil
 }
diff --git a/lib/web/assistant_test.go b/lib/web/assistant_test.go
index 87969a39f8621..7f78c9768df0c 100644
--- a/lib/web/assistant_test.go
+++ b/lib/web/assistant_test.go
@@ -25,16 +25,19 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/gorilla/websocket"
 	"github.com/gravitational/roundtrip"
 	"github.com/gravitational/trace"
 	"github.com/sashabaranov/go-openai"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/time/rate"
 
 	authproto "github.com/gravitational/teleport/api/client/proto"
+	aitest "github.com/gravitational/teleport/lib/ai/testutils"
 	"github.com/gravitational/teleport/lib/assist"
 	"github.com/gravitational/teleport/lib/client"
 )
@@ -42,27 +45,25 @@ import (
 func Test_runAssistant(t *testing.T) {
 	t.Parallel()
 
-	readPartialMessage := func(t *testing.T, ws *websocket.Conn) string {
-		var msg assistantMessage
-		_, payload, err := ws.ReadMessage()
-		require.NoError(t, err)
-
-		err = json.Unmarshal(payload, &msg)
-		require.NoError(t, err)
+	readStreamResponse := func(t *testing.T, ws *websocket.Conn) string {
+		var sb strings.Builder
+		for {
+			var msg assistantMessage
+			_, payload, err := ws.ReadMessage()
+			require.NoError(t, err)
 
-		require.Equal(t, assist.MessageKindAssistantPartialMessage, msg.Type)
-		return msg.Payload
-	}
+			err = json.Unmarshal(payload, &msg)
+			require.NoError(t, err)
 
-	readStreamEnd := func(t *testing.T, ws *websocket.Conn) {
-		var msg assistantMessage
-		_, payload, err := ws.ReadMessage()
-		require.NoError(t, err)
+			if msg.Type == assist.MessageKindAssistantPartialFinalize {
+				break
+			}
 
-		err = json.Unmarshal(payload, &msg)
-		require.NoError(t, err)
+			require.Equal(t, assist.MessageKindAssistantPartialMessage, msg.Type)
+			sb.WriteString(msg.Payload)
+		}
 
-		require.Equal(t, assist.MessageKindAssistantPartialFinalize, msg.Type)
+		return sb.String()
 	}
 
 	readRateLimitedMessage := func(t *testing.T, ws *websocket.Conn) {
@@ -79,32 +80,27 @@ func Test_runAssistant(t *testing.T) {
 
 	testCases := []struct {
 		name      string
-		responses [][]byte
+		responses []string
 		cfg       webSuiteConfig
 		setup     func(*testing.T, *WebSuite)
 		act       func(*testing.T, *websocket.Conn)
 	}{
 		{
 			name: "normal",
-			responses: [][]byte{
+			responses: []string{
 				generateTextResponse(),
 			},
 			act: func(t *testing.T, ws *websocket.Conn) {
 				err := ws.WriteMessage(websocket.TextMessage, []byte(`{"payload": "show free disk space"}`))
 				require.NoError(t, err)
 
-				require.Contains(t, readPartialMessage(t, ws), "Which")
-				require.Contains(t, readPartialMessage(t, ws), "node do")
-				require.Contains(t, readPartialMessage(t, ws), "you want")
-				require.Contains(t, readPartialMessage(t, ws), "use?")
-
-				readStreamEnd(t, ws)
+				const expectedMsg = "Which node do you want to use?"
+				require.Contains(t, readStreamResponse(t, ws), expectedMsg)
 			},
 		},
 		{
 			name: "rate limited",
-			responses: [][]byte{
-				generateTextResponse(),
+			responses: []string{
 				generateTextResponse(),
 			},
 			cfg: webSuiteConfig{
@@ -126,12 +122,8 @@ func Test_runAssistant(t *testing.T) {
 				err := ws.WriteMessage(websocket.TextMessage, []byte(`{"payload": "show free disk space"}`))
 				require.NoError(t, err)
 
-				require.Contains(t, readPartialMessage(t, ws), "Which")
-				require.Contains(t, readPartialMessage(t, ws), "node do")
-				require.Contains(t, readPartialMessage(t, ws), "you want")
-				require.Contains(t, readPartialMessage(t, ws), "use?")
-
-				readStreamEnd(t, ws)
+				const expectedMsg = "Which node do you want to use?"
+				require.Contains(t, readStreamResponse(t, ws), expectedMsg)
 
 				err = ws.WriteMessage(websocket.TextMessage, []byte(`{"payload": "all nodes, please"}`))
 				require.NoError(t, err)
@@ -146,17 +138,7 @@ func Test_runAssistant(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			responses := tc.responses
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.Header().Set("Content-Type", "text/event-stream")
-
-				require.GreaterOrEqual(t, len(responses), 1, "Unexpected request")
-				dataBytes := responses[0]
-
-				_, err := w.Write(dataBytes)
-				require.NoError(t, err, "Write error")
-
-				responses = responses[1:]
-			}))
+			server := httptest.NewServer(aitest.GetTestHandlerFn(t, responses))
 			t.Cleanup(server.Close)
 
 			openaiCfg := openai.DefaultConfig("test-token")
@@ -194,6 +176,92 @@ func Test_runAssistant(t *testing.T) {
 	}
 }
 
+// Test_runAssistError tests that the assistant returns an error message
+// when the OpenAI API returns an error.
+func Test_runAssistError(t *testing.T) {
+	t.Parallel()
+
+	readHelloMsg := func(ws *websocket.Conn) {
+		_, payload, err := ws.ReadMessage()
+		require.NoError(t, err)
+
+		var msg assistantMessage
+		err = json.Unmarshal(payload, &msg)
+		require.NoError(t, err)
+
+		// Expect "hello" message
+		require.Equal(t, assist.MessageKindAssistantMessage, msg.Type)
+		require.Contains(t, msg.Payload, "Hey, I'm Teleport")
+	}
+
+	readErrorMsg := func(ws *websocket.Conn) {
+		err := ws.WriteMessage(websocket.TextMessage, []byte(`{"payload": "show free disk space"}`))
+		require.NoError(t, err)
+
+		_, payload, err := ws.ReadMessage()
+		require.NoError(t, err)
+
+		var msg assistantMessage
+		err = json.Unmarshal(payload, &msg)
+		require.NoError(t, err)
+
+		// Expect OpenAI error message
+		require.Equal(t, assist.MessageKindError, msg.Type)
+		require.Contains(t, msg.Payload, "An error has occurred. Please try again later.")
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		// Simulate rate limit error
+		w.WriteHeader(429)
+
+		errMsg := openai.ErrorResponse{
+			Error: &openai.APIError{
+				Code:           "rate_limit_reached",
+				Message:        "You are sending requests too quickly.",
+				Param:          nil,
+				Type:           "rate_limit_reached",
+				HTTPStatusCode: 429,
+			},
+		}
+
+		dataBytes, err := json.Marshal(errMsg)
+		// Use assert as require doesn't work when called from a goroutine
+		assert.NoError(t, err, "Marshal error")
+
+		_, err = w.Write(dataBytes)
+		assert.NoError(t, err, "Write error")
+	}))
+	t.Cleanup(server.Close)
+
+	openaiCfg := openai.DefaultConfig("test-token")
+	openaiCfg.BaseURL = server.URL
+	s := newWebSuiteWithConfig(t, webSuiteConfig{OpenAIConfig: &openaiCfg})
+
+	ctx := context.Background()
+	authPack := s.authPack(t, "foo")
+	// Create the conversation
+	conversationID := s.makeAssistConversation(t, ctx, authPack)
+
+	// Make WS client and start the conversation
+	ws, err := s.makeAssistant(t, authPack, conversationID)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		// Close should yield an error as the server closes the connection
+		require.Error(t, ws.Close())
+	})
+
+	// verify responses
+	readHelloMsg(ws)
+	readErrorMsg(ws)
+
+	// Check for the close message
+	_, _, err = ws.ReadMessage()
+	closeErr, ok := err.(*websocket.CloseError)
+	require.True(t, ok, "Expected close error")
+	require.Equal(t, websocket.CloseInternalServerErr, closeErr.Code, "Expected abnormal closure")
+}
+
 // makeAssistConversation creates a new assist conversation and returns its ID
 func (s *WebSuite) makeAssistConversation(t *testing.T, ctx context.Context, authPack *authPack) string {
 	clt := authPack.clt
@@ -249,27 +317,43 @@ func (s *WebSuite) makeAssistant(t *testing.T, pack *authPack, conversationID st
 	return ws, nil
 }
 
-func generateTextResponse() []byte {
-	dataBytes := []byte{}
-	dataBytes = append(dataBytes, []byte("event: message\n")...)
+func Test_generateAssistantTitle(t *testing.T) {
+	// Test setup
+	t.Parallel()
+	ctx := context.Background()
+
+	responses := []string{"This is the message summary.", "troubleshooting"}
+	server := httptest.NewServer(aitest.GetTestHandlerFn(t, responses))
+	t.Cleanup(server.Close)
 
-	data := `{"id":"1","object":"completion","created":1598069254,"model":"gpt-4","choices":[{"index": 0, "delta":{"content": "Which ", "role": "assistant"}}]}`
-	dataBytes = append(dataBytes, []byte("data: "+data+"\n\n")...)
-	dataBytes = append(dataBytes, []byte("event: message\n")...)
+	openaiCfg := openai.DefaultConfig("test-token")
+	openaiCfg.BaseURL = server.URL
+	s := newWebSuiteWithConfig(t, webSuiteConfig{
+		ClusterFeatures: &authproto.Features{
+			Cloud: true,
+		},
+		OpenAIConfig: &openaiCfg,
+	})
 
-	data = `{"id":"2","object":"completion","created":1598069254,"model":"gpt-4","choices":[{"index": 0, "delta":{"content": "node do ", "role": "assistant"}}]}`
-	dataBytes = append(dataBytes, []byte("data: "+data+"\n\n")...)
-	dataBytes = append(dataBytes, []byte("event: message\n")...)
+	pack := s.authPack(t, "foo")
 
-	data = `{"id":"3","object":"completion","created":1598069255,"model":"gpt-4","choices":[{"index": 0, "delta":{"content": "you want ", "role": "assistant"}}]}`
-	dataBytes = append(dataBytes, []byte("data: "+data+"\n\n")...)
-	dataBytes = append(dataBytes, []byte("event: message\n")...)
+	// Real test: we craft a request asking for a summary
+	endpoint := pack.clt.Endpoint("webapi", "assistant", "title", "summary")
+	req := generateAssistantTitleRequest{Message: "This is a test user message asking Teleport assist to do something."}
 
-	data = `{"id":"4","object":"completion","created":1598069254,"model":"gpt-4","choices":[{"index": 0, "delta":{"content": "use?", "role": "assistant"}}]}`
-	dataBytes = append(dataBytes, []byte("data: "+data+"\n\n")...)
-	dataBytes = append(dataBytes, []byte("event: done\n")...)
+	// Executing the request and validating the output is as expected
+	resp, err := pack.clt.PostJSON(ctx, endpoint, &req)
+	require.NoError(t, err)
 
-	dataBytes = append(dataBytes, []byte("data: [DONE]\n\n")...)
+	var info conversationInfo
+	body, err := io.ReadAll(resp.Reader())
+	require.NoError(t, err)
+	err = json.Unmarshal(body, &info)
+	require.NoError(t, err)
+	require.NotEmpty(t, info.Title)
+}
 
-	return dataBytes
+// generateTextResponse generates a response for a text completion
+func generateTextResponse() string {
+	return "<FINAL RESPONSE>\nWhich node do you want to use?"
 }
diff --git a/lib/web/command.go b/lib/web/command.go
index 5e758f4f97f0e..ad2814ccfc644 100644
--- a/lib/web/command.go
+++ b/lib/web/command.go
@@ -43,16 +43,23 @@ import (
 	"github.com/gravitational/teleport/api/observability/tracing"
 	"github.com/gravitational/teleport/lib/agentless"
 	assistlib "github.com/gravitational/teleport/lib/assist"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/proxy"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/teleagent"
 )
 
+// summaryBufferCapacity is the summary buffer size in bytes. The summary buffer
+// is shared across all nodes the command is running on and stores the command
+// output. If the command output exceeds the buffer capacity, the summary won't
+// be computed.
+const summaryBufferCapacity = 2000
+
 // CommandRequest is a request to execute a command on all nodes that match the query.
 type CommandRequest struct {
 	// Command is the command to be executed on all nodes.
@@ -67,6 +74,18 @@ type CommandRequest struct {
 	ExecutionID string `json:"execution_id"`
 }
 
+// commandExecResult is a result of a command execution.
+type commandExecResult struct {
+	// NodeID is the ID of the node where the command was executed.
+	NodeID string `json:"node_id"`
+	// NodeName is the name of the node where the command was executed.
+	NodeName string `json:"node_name"`
+	// ExecutionID is a unique ID used to identify the command execution.
+	ExecutionID string `json:"execution_id"`
+	// SessionID is the ID of the session where the command was executed.
+	SessionID string `json:"session_id"`
+}
+
 // Check checks if the request is valid.
 func (c *CommandRequest) Check() error {
 	if c.Command == "" {
@@ -98,7 +117,7 @@ func (h *Handler) executeCommand(
 	r *http.Request,
 	_ httprouter.Params,
 	sessionCtx *SessionContext,
-	site reversetunnel.RemoteSite,
+	site reversetunnelclient.RemoteSite,
 ) (any, error) {
 	q := r.URL.Query()
 	params := q.Get("params")
@@ -123,12 +142,7 @@ func (h *Handler) executeCommand(
 		return nil, trace.Wrap(err)
 	}
 
-	identity, err := createIdentityContext(req.Login, sessionCtx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	ctx, err := h.cfg.SessionControl.AcquireSessionContext(r.Context(), identity, h.cfg.ProxyWebAddr.Addr, r.RemoteAddr)
+	ctx, err := h.cfg.SessionControl.AcquireSessionContext(r.Context(), sessionCtx, req.Login, h.cfg.ProxyWebAddr.Addr, r.RemoteAddr)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -153,7 +167,7 @@ func (h *Handler) executeCommand(
 		CheckOrigin:     func(r *http.Request) bool { return true },
 	}
 
-	ws, err := upgrader.Upgrade(w, r, nil)
+	rawWS, err := upgrader.Upgrade(w, r, nil)
 	if err != nil {
 		errMsg := "Error upgrading to websocket"
 		h.log.WithError(err).Error(errMsg)
@@ -162,16 +176,27 @@ func (h *Handler) executeCommand(
 	}
 
 	defer func() {
-		ws.WriteMessage(websocket.CloseMessage, nil)
-		ws.Close()
+		rawWS.WriteMessage(websocket.CloseMessage, nil)
+		rawWS.Close()
 	}()
 
 	keepAliveInterval := netConfig.GetKeepAliveInterval()
-	err = ws.SetReadDeadline(deadlineForInterval(keepAliveInterval))
+	err = rawWS.SetReadDeadline(deadlineForInterval(keepAliveInterval))
 	if err != nil {
 		h.log.WithError(err).Error("Error setting websocket readline")
 		return nil, trace.Wrap(err)
 	}
+	// Update the read deadline upon receiving a pong message.
+	rawWS.SetPongHandler(func(_ string) error {
+		// This is intentonally called without a lock as this callback is
+		// called from the same goroutine as the read loop which is already locked.
+		return trace.Wrap(rawWS.SetReadDeadline(deadlineForInterval(keepAliveInterval)))
+	})
+
+	// Wrap the raw websocket connection in a syncRWWSConn so that we can
+	// safely read and write to the the single websocket connection from
+	// multiple goroutines/execution nodes.
+	ws := &syncRWWSConn{WSConn: rawWS}
 
 	hosts, err := findByQuery(ctx, clt, req.Query)
 	if err != nil {
@@ -190,6 +215,8 @@ func (h *Handler) executeCommand(
 	mfaCacheFn := getMFACacheFn()
 	interactiveCommand := strings.Split(req.Command, " ")
 
+	buffer := newSummaryBuffer(summaryBufferCapacity)
+
 	runCmd := func(host *hostInfo) error {
 		sessionData, err := h.generateCommandSession(host, req.Login, clusterName, sessionCtx.cfg.User)
 		if err != nil {
@@ -211,6 +238,7 @@ func (h *Handler) executeCommand(
 			TracerProvider:     h.cfg.TracerProvider,
 			LocalAuthProvider:  h.auth.accessPoint,
 			mfaFuncCache:       mfaCacheFn,
+			buffer:             buffer,
 		}
 
 		handler, err := newCommandHandler(ctx, commandHandlerConfig)
@@ -226,12 +254,9 @@ func (h *Handler) executeCommand(
 		h.log.Infof("Executing command: %#v.", req)
 		httplib.MakeTracingHandler(handler, teleport.ComponentProxy).ServeHTTP(w, r)
 
-		msgPayload, err := json.Marshal(struct {
-			NodeID      string `json:"node_id"`
-			ExecutionID string `json:"execution_id"`
-			SessionID   string `json:"session_id"`
-		}{
+		msgPayload, err := json.Marshal(&commandExecResult{
 			NodeID:      host.id,
+			NodeName:    host.hostName,
 			ExecutionID: req.ExecutionID,
 			SessionID:   string(sessionData.ID),
 		})
@@ -242,7 +267,7 @@ func (h *Handler) executeCommand(
 
 		err = clt.CreateAssistantMessage(ctx, &assist.CreateAssistantMessageRequest{
 			ConversationId: req.ConversationID,
-			Username:       identity.TeleportUser,
+			Username:       sessionCtx.GetUser(),
 			Message: &assist.AssistantMessage{
 				Type:        string(assistlib.MessageKindCommandResult),
 				CreatedTime: timestamppb.New(time.Now().UTC()),
@@ -255,9 +280,114 @@ func (h *Handler) executeCommand(
 
 	runCommands(hosts, runCmd, h.log)
 
+	// Optionally, try to compute the command summary.
+	if output, valid := buffer.Export(); valid {
+		summaryReq := summaryRequest{
+			hosts:          hosts,
+			output:         output,
+			authClient:     clt,
+			username:       sessionCtx.GetUser(),
+			executionID:    req.ExecutionID,
+			conversationID: req.ConversationID,
+			command:        req.Command,
+		}
+		err := h.computeAndSendSummary(ctx, &summaryReq, ws)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
 	return nil, nil
 }
 
+type summaryRequest struct {
+	hosts          []hostInfo
+	output         map[string][]byte
+	authClient     auth.ClientI
+	username       string
+	executionID    string
+	conversationID string
+	command        string
+}
+
+func (h *Handler) computeAndSendSummary(
+	ctx context.Context,
+	req *summaryRequest,
+	ws WSConn,
+) error {
+	// Convert the map nodeId->output into a map nodeName->output
+	namedOutput := outputByName(req.hosts, req.output)
+
+	history, err := req.authClient.GetAssistantMessages(ctx, &assist.GetAssistantMessagesRequest{
+		ConversationId: req.conversationID,
+		Username:       req.username,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	assistClient, err := assistlib.NewClient(ctx, req.authClient, h.cfg.ProxySettings, h.cfg.OpenAIConfig)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	summary, err := assistClient.GenerateCommandSummary(ctx, history.GetMessages(), namedOutput)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Add the summary message to the backend so it is persisted on chat
+	// reload.
+	messagePayload, err := json.Marshal(&assistlib.CommandExecSummary{
+		ExecutionID: req.executionID,
+		Command:     req.command,
+		Summary:     summary,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	summaryMessage := &assist.CreateAssistantMessageRequest{
+		ConversationId: req.conversationID,
+		Username:       req.username,
+		Message: &assist.AssistantMessage{
+			Type:        string(assistlib.MessageKindCommandResultSummary),
+			CreatedTime: timestamppb.New(time.Now().UTC()),
+			Payload:     string(messagePayload),
+		},
+	}
+
+	err = req.authClient.CreateAssistantMessage(ctx, summaryMessage)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Send the summary over the execution websocket to provide instant
+	// feedback to the user.
+	out := &outEnvelope{
+		Type:    envelopeTypeSummary,
+		Payload: []byte(summary),
+	}
+	data, err := json.Marshal(out)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	stream := NewWStream(ctx, ws, log, nil)
+	_, err = stream.Write(data)
+	return trace.Wrap(err)
+}
+
+func outputByName(hosts []hostInfo, output map[string][]byte) map[string][]byte {
+	hostIDToName := make(map[string]string, len(hosts))
+	for _, host := range hosts {
+		hostIDToName[host.id] = host.hostName
+	}
+	namedOutput := make(map[string][]byte, len(output))
+	for id, data := range output {
+		namedOutput[hostIDToName[id]] = data
+	}
+	return namedOutput
+}
+
 // runCommands runs the given command on the given hosts.
 func runCommands(hosts []hostInfo, runCmd func(host *hostInfo) error, log logrus.FieldLogger) {
 	// Create a synchronization channel to limit the number of concurrent commands.
@@ -305,8 +435,7 @@ func getMFACacheFn() mfaFuncCache {
 			return authMethods, nil
 		}
 
-		var err error
-		authMethods, err = issueMfaAuthFn()
+		authMethods, err := issueMfaAuthFn()
 		return authMethods, trace.Wrap(err)
 	}
 }
@@ -337,6 +466,7 @@ func newCommandHandler(ctx context.Context, cfg CommandHandlerConfig) (*commandH
 			tracer:             cfg.tracer,
 		},
 		mfaAuthCache: cfg.mfaFuncCache,
+		buffer:       cfg.buffer,
 	}, nil
 }
 
@@ -367,6 +497,9 @@ type CommandHandlerConfig struct {
 	tracer oteltrace.Tracer
 	// mfaFuncCache is used to cache the MFA auth method
 	mfaFuncCache mfaFuncCache
+	// buffer shared across multiple commandHandlers that saves the command
+	// output in order to generate a summary of the executed commands.
+	buffer *summaryBuffer
 }
 
 // CheckAndSetDefaults checks and sets default values.
@@ -432,6 +565,10 @@ type commandHandler struct {
 	// returns a list of ssh.AuthMethods. It is used to cache the result of
 	// the MFA challenge.
 	mfaAuthCache mfaFuncCache
+
+	// buffer shared across multiple commandHandlers that saves the command
+	// output in order to generate a summary of the executed commands.
+	buffer *summaryBuffer
 }
 
 // sendError sends an error message to the client using the provided websocket.
@@ -485,7 +622,7 @@ func (t *commandHandler) ServeHTTP(_ http.ResponseWriter, r *http.Request) {
 }
 
 func (t *commandHandler) handler(r *http.Request) {
-	t.stream = NewWStream(t.ws)
+	t.stream = NewWStream(r.Context(), t.ws, t.log, nil)
 
 	// Create a Teleport client, if not able to, show the reason to the user in
 	// the terminal.
@@ -498,12 +635,6 @@ func (t *commandHandler) handler(r *http.Request) {
 
 	t.log.Debug("Creating websocket stream")
 
-	// Update the read deadline upon receiving a pong message.
-	t.ws.SetPongHandler(func(_ string) error {
-		t.ws.SetReadDeadline(deadlineForInterval(t.keepAliveInterval))
-		return nil
-	})
-
 	// Start sending ping frames through websocket to the client.
 	go startPingLoop(r.Context(), t.ws, t.keepAliveInterval, t.log, t.Close)
 
@@ -537,7 +668,7 @@ func (t *commandHandler) streamOutput(ctx context.Context, tc *client.TeleportCl
 		return
 	}
 
-	if err := t.stream.Close(); err != nil {
+	if err := t.stream.SendCloseMessage(); err != nil {
 		t.log.WithError(err).Error("Unable to send close event to web client.")
 		return
 	}
@@ -584,8 +715,8 @@ func (t *commandHandler) makeClient(ctx context.Context, ws WSConn) (*client.Tel
 	clientConfig.HostLogin = t.sessionData.Login
 	clientConfig.ForwardAgent = client.ForwardAgentLocal
 	clientConfig.Namespace = apidefaults.Namespace
-	clientConfig.Stdout = newPayloadWriter(t.sessionData.ServerID, "stdout", t.stream)
-	clientConfig.Stderr = newPayloadWriter(t.sessionData.ServerID, "stderr", t.stream)
+	clientConfig.Stdout = newBufferedPayloadWriter(newPayloadWriter(t.sessionData.ServerID, envelopeTypeStdout, t.stream), t.buffer)
+	clientConfig.Stderr = newBufferedPayloadWriter(newPayloadWriter(t.sessionData.ServerID, envelopeTypeStderr, t.stream), t.buffer)
 	clientConfig.Stdin = &bytes.Buffer{} // set stdin to a dummy buffer
 	clientConfig.SiteName = t.sessionData.ClusterName
 	if err := clientConfig.ParseProxyHost(t.proxyHostPort); err != nil {
@@ -609,7 +740,7 @@ func (t *commandHandler) makeClient(ctx context.Context, ws WSConn) (*client.Tel
 func (t *commandHandler) writeError(err error) {
 	out := &outEnvelope{
 		NodeID:  t.sessionData.ServerID,
-		Type:    "teleport-error",
+		Type:    envelopeTypeError,
 		Payload: []byte(err.Error()),
 	}
 	data, err := json.Marshal(out)
diff --git a/lib/web/command_test.go b/lib/web/command_test.go
index 7eb5860de1edf..7a73d715099ba 100644
--- a/lib/web/command_test.go
+++ b/lib/web/command_test.go
@@ -17,12 +17,14 @@
 package web
 
 import (
+	"context"
 	"crypto/tls"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"strings"
 	"sync/atomic"
@@ -34,33 +36,192 @@ import (
 	"github.com/gorilla/websocket"
 	"github.com/gravitational/roundtrip"
 	"github.com/gravitational/trace"
+	"github.com/sashabaranov/go-openai"
 	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/gravitational/teleport/api/gen/proto/go/assist/v1"
+	"github.com/gravitational/teleport/lib/ai/testutils"
+	assistlib "github.com/gravitational/teleport/lib/assist"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+const (
+	testCommand = "echo txlxport | sed 's/x/e/g'"
+	testUser    = "foo"
 )
 
 func TestExecuteCommand(t *testing.T) {
 	t.Parallel()
-	s := newWebSuite(t)
+	openAIMock := mockOpenAISummary(t)
+	openAIConfig := openai.DefaultConfig("test-token")
+	openAIConfig.BaseURL = openAIMock.URL + "/v1"
+	s := newWebSuiteWithConfig(t, webSuiteConfig{
+		disableDiskBasedRecording: true,
+		OpenAIConfig:              &openAIConfig,
+	})
 
-	ws, _, err := s.makeCommand(t, s.authPack(t, "foo"))
+	ws, _, err := s.makeCommand(t, s.authPack(t, testUser), uuid.New())
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, ws.Close()) })
 
-	stream := NewWStream(ws)
+	stream := NewWStream(context.Background(), ws, utils.NewLoggerForTests(), nil)
 
 	require.NoError(t, waitForCommandOutput(stream, "teleport"))
 }
 
-func (s *WebSuite) makeCommand(t *testing.T, pack *authPack) (*websocket.Conn, *session.Session, error) {
+func TestExecuteCommandHistory(t *testing.T) {
+	t.Parallel()
+
+	openAIMock := mockOpenAISummary(t)
+	openAIConfig := openai.DefaultConfig("test-token")
+	openAIConfig.BaseURL = openAIMock.URL + "/v1"
+	s := newWebSuiteWithConfig(t, webSuiteConfig{
+		disableDiskBasedRecording: true,
+		OpenAIConfig:              &openAIConfig,
+	})
+	authPack := s.authPack(t, testUser)
+
+	ctx := context.Background()
+	clt, err := s.server.NewClient(auth.TestUser(testUser))
+	require.NoError(t, err)
+
+	// Create conversation, otherwise the command execution will not be saved
+	conversation, err := clt.CreateAssistantConversation(context.Background(), &assist.CreateAssistantConversationRequest{
+		Username:    testUser,
+		CreatedTime: timestamppb.Now(),
+	})
+	require.NoError(t, err)
+
+	require.NotEmpty(t, conversation.GetId())
+
+	conversationID, err := uuid.Parse(conversation.GetId())
+	require.NoError(t, err)
+
+	ws, _, err := s.makeCommand(t, authPack, conversationID)
+	require.NoError(t, err)
+
+	stream := NewWStream(ctx, ws, utils.NewLoggerForTests(), nil)
+
+	// When command executes
+	require.NoError(t, waitForCommandOutput(stream, "teleport"))
+
+	// Close the stream if not already closed
+	_ = stream.Close()
+
+	// Then command execution history is saved
+	var messages *assist.GetAssistantMessagesResponse
+	// Command execution history is saved in asynchronusly, so we need to wait for it.
+	require.Eventually(t, func() bool {
+		messages, err = clt.GetAssistantMessages(ctx, &assist.GetAssistantMessagesRequest{
+			ConversationId: conversationID.String(),
+			Username:       testUser,
+		})
+		require.NoError(t, err)
+
+		return len(messagesByType(messages.GetMessages())[assistlib.MessageKindCommandResult]) == 1
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// Assert the returned message
+	resultMessages, ok := messagesByType(messages.GetMessages())[assistlib.MessageKindCommandResult]
+	require.True(t, ok, "Message must be of type COMMAND_RESULT")
+	msg := resultMessages[0]
+	require.NotZero(t, msg.CreatedTime)
+
+	var result commandExecResult
+	err = json.Unmarshal([]byte(msg.GetPayload()), &result)
+	require.NoError(t, err)
+
+	require.NotEmpty(t, result.ExecutionID)
+	require.NotEmpty(t, result.SessionID)
+	require.Equal(t, "node", result.NodeName)
+	require.Equal(t, "node", result.NodeID)
+}
+
+func TestExecuteCommandSummary(t *testing.T) {
+	t.Parallel()
+
+	openAIMock := mockOpenAISummary(t)
+	openAIConfig := openai.DefaultConfig("test-token")
+	openAIConfig.BaseURL = openAIMock.URL
+	s := newWebSuiteWithConfig(t, webSuiteConfig{
+		disableDiskBasedRecording: true,
+		OpenAIConfig:              &openAIConfig,
+	})
+	authPack := s.authPack(t, testUser)
+
+	ctx := context.Background()
+	clt, err := s.server.NewClient(auth.TestUser(testUser))
+	require.NoError(t, err)
+
+	// Create conversation, otherwise the command execution will not be saved
+	conversation, err := clt.CreateAssistantConversation(context.Background(), &assist.CreateAssistantConversationRequest{
+		Username:    testUser,
+		CreatedTime: timestamppb.Now(),
+	})
+	require.NoError(t, err)
+
+	require.NotEmpty(t, conversation.GetId())
+
+	conversationID, err := uuid.Parse(conversation.GetId())
+	require.NoError(t, err)
+
+	ws, _, err := s.makeCommand(t, authPack, conversationID)
+	require.NoError(t, err)
+
+	// For simplicity, use simple WS to io.Reader adapter
+	stream := &wsReader{conn: ws}
+
+	// Wait for command execution to complete
+	require.NoError(t, waitForCommandOutput(stream, "teleport"))
+
+	var env Envelope
+	dec := json.NewDecoder(stream)
+	err = dec.Decode(&env)
+	require.NoError(t, err)
+	require.Equal(t, envelopeTypeSummary, env.GetType())
+	require.NotEmpty(t, env.GetPayload())
+
+	// Wait for the command execution history to be saved
+	var messages *assist.GetAssistantMessagesResponse
+	// Command execution history is saved in asynchronously, so we need to wait for it.
+	require.Eventually(t, func() bool {
+		messages, err = clt.GetAssistantMessages(ctx, &assist.GetAssistantMessagesRequest{
+			ConversationId: conversationID.String(),
+			Username:       testUser,
+		})
+		assert.NoError(t, err)
+
+		return len(messagesByType(messages.GetMessages())[assistlib.MessageKindCommandResultSummary]) == 1
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// Check the returned summary message
+	summaryMessages, ok := messagesByType(messages.GetMessages())[assistlib.MessageKindCommandResultSummary]
+	require.True(t, ok, "At least one summary message is expected")
+	msg := summaryMessages[0]
+	require.NotZero(t, msg.CreatedTime)
+
+	var result assistlib.CommandExecSummary
+	err = json.Unmarshal([]byte(msg.GetPayload()), &result)
+	require.NoError(t, err)
+
+	require.NotEmpty(t, result.ExecutionID)
+	require.Equal(t, testCommand, result.Command)
+	require.NotEmpty(t, result.Summary)
+}
+
+func (s *WebSuite) makeCommand(t *testing.T, pack *authPack, conversationID uuid.UUID) (*websocket.Conn, *session.Session, error) {
 	req := CommandRequest{
 		Query:          fmt.Sprintf("name == \"%s\"", s.srvID),
 		Login:          pack.login,
-		ConversationID: uuid.New().String(),
+		ConversationID: conversationID.String(),
 		ExecutionID:    uuid.New().String(),
-		Command:        "echo txlxport | sed 's/x/e/g'",
+		Command:        testCommand,
 	}
 
 	u := url.URL{
@@ -131,29 +292,21 @@ func waitForCommandOutput(stream io.Reader, substr string) error {
 		default:
 		}
 
-		out := make([]byte, 100)
-		n, err := stream.Read(out)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
 		var env Envelope
-		err = json.Unmarshal(out[:n], &env)
-		if err != nil {
-			return trace.Wrap(err)
+		dec := json.NewDecoder(stream)
+		if err := dec.Decode(&env); err != nil {
+			return trace.Wrap(err, "decoding envelope JSON from stream")
 		}
 
 		d, err := base64.StdEncoding.DecodeString(env.Payload)
 		if err != nil {
-			return trace.Wrap(err)
+			return trace.Wrap(err, "decoding b64 payload")
 		}
+
 		data := removeSpace(string(d))
-		if n > 0 && strings.Contains(data, substr) {
+		if strings.Contains(data, substr) {
 			return nil
 		}
-		if err != nil {
-			return trace.Wrap(err)
-		}
 	}
 }
 
@@ -182,3 +335,44 @@ func Test_runCommands(t *testing.T) {
 
 	require.Equal(t, int32(100), counter.Load())
 }
+
+func mockOpenAISummary(t *testing.T) *httptest.Server {
+	responses := []string{"This is the summary of the command."}
+	server := httptest.NewServer(testutils.GetTestHandlerFn(t, responses))
+	t.Cleanup(server.Close)
+	return server
+}
+
+func messagesByType(messages []*assist.AssistantMessage) map[assistlib.MessageType][]*assist.AssistantMessage {
+	byType := make(map[assistlib.MessageType][]*assist.AssistantMessage)
+	for _, message := range messages {
+		byType[assistlib.MessageType(message.GetType())] = append(byType[assistlib.MessageType(message.GetType())], message)
+	}
+	return byType
+}
+
+// wsReader implements io.Reader interface over websocket connection
+type wsReader struct {
+	conn *websocket.Conn
+}
+
+// Read reads data from websocket connection.
+// The message should be in web.Envelope format and only the payload will be returned.
+// It expects that the passed buffer is big enough to fit the whole message.
+func (r *wsReader) Read(p []byte) (int, error) {
+	_, data, err := r.conn.ReadMessage()
+	if err != nil {
+		return 0, trace.Wrap(err)
+	}
+
+	var envelope Envelope
+	if err := proto.Unmarshal(data, &envelope); err != nil {
+		return 0, trace.Errorf("Unable to parse message payload %v", err)
+	}
+
+	if len(envelope.Payload) > len(p) {
+		return 0, trace.BadParameter("buffer too small")
+	}
+
+	return copy(p, envelope.Payload), nil
+}
diff --git a/lib/web/command_utils.go b/lib/web/command_utils.go
index 8da217940c62b..49154e47dbca7 100644
--- a/lib/web/command_utils.go
+++ b/lib/web/command_utils.go
@@ -22,9 +22,9 @@ import (
 	"encoding/json"
 	"io"
 	"net"
+	"sync"
 	"time"
 
-	"github.com/gorilla/websocket"
 	"github.com/gravitational/trace"
 )
 
@@ -39,16 +39,19 @@ type WSConn interface {
 
 	WriteControl(messageType int, data []byte, deadline time.Time) error
 	WriteMessage(messageType int, data []byte) error
-	NextReader() (messageType int, r io.Reader, err error)
 	ReadMessage() (messageType int, p []byte, err error)
-
+	SetReadLimit(limit int64)
 	SetReadDeadline(t time.Time) error
-	PingHandler() func(appData string) error
-	SetPingHandler(h func(appData string) error)
-	PongHandler() func(appData string) error
 	SetPongHandler(h func(appData string) error)
 }
 
+const (
+	envelopeTypeStdout  = "stdout"
+	envelopeTypeStderr  = "stderr"
+	envelopeTypeError   = "teleport-error"
+	envelopeTypeSummary = "summary"
+)
+
 // outEnvelope is an envelope used to wrap messages send back to the client connected over WS.
 type outEnvelope struct {
 	NodeID  string `json:"node_id"`
@@ -60,7 +63,7 @@ type outEnvelope struct {
 // outEnvelope and writes it to the underlying stream.
 type payloadWriter struct {
 	nodeID string
-	// output name, can be stdout, stderr or teleport-error.
+	// output name, can be stdout, stderr, teleport-error or summary.
 	outputName string
 	// stream is the underlying stream.
 	stream io.Writer
@@ -98,10 +101,102 @@ func newPayloadWriter(nodeID, outputName string, stream io.Writer) *payloadWrite
 // by any underlying code as we want to keep the connection open until the command
 // is executed on all nodes and a single failure should not close the connection.
 type noopCloserWS struct {
-	*websocket.Conn
+	WSConn
 }
 
 // Close does nothing.
 func (ws *noopCloserWS) Close() error {
 	return nil
 }
+
+// syncRWWSConn is a wrapper around websocket.Conn, which serializes
+// read and write to a web socket connection. This is needed to prevent
+// a race conditions and panics in gorilla/websocket.
+// Details https://pkg.go.dev/github.com/gorilla/websocket#hdr-Concurrency
+// This struct does not lock SetReadDeadline() as the SetReadDeadline()
+// is called from the pong handler, which is interanlly called on ReadMessage()
+// according to https://pkg.go.dev/github.com/gorilla/websocket#hdr-Control_Messages
+// This would prevent the pong handler from being called.
+type syncRWWSConn struct {
+	// WSConn the underlying websocket connection.
+	WSConn
+	// rmtx is a mutex used to serialize reads.
+	rmtx sync.Mutex
+	// wmtx is a mutex used to serialize writes.
+	wmtx sync.Mutex
+}
+
+func (s *syncRWWSConn) WriteMessage(messageType int, data []byte) error {
+	s.wmtx.Lock()
+	defer s.wmtx.Unlock()
+	return s.WSConn.WriteMessage(messageType, data)
+}
+
+func (s *syncRWWSConn) ReadMessage() (messageType int, p []byte, err error) {
+	s.rmtx.Lock()
+	defer s.rmtx.Unlock()
+	return s.WSConn.ReadMessage()
+}
+
+func newBufferedPayloadWriter(pw *payloadWriter, buffer *summaryBuffer) *bufferedPayloadWriter {
+	return &bufferedPayloadWriter{
+		payloadWriter: pw,
+		buffer:        buffer,
+	}
+}
+
+type bufferedPayloadWriter struct {
+	*payloadWriter
+	buffer *summaryBuffer
+}
+
+func (bp *bufferedPayloadWriter) Write(data []byte) (int, error) {
+	bp.buffer.Write(bp.nodeID, data)
+	return bp.payloadWriter.Write(data)
+}
+
+func newSummaryBuffer(capacity int) *summaryBuffer {
+	return &summaryBuffer{
+		buffer:            make(map[string][]byte),
+		remainingCapacity: capacity,
+		invalid:           false,
+		mutex:             sync.Mutex{},
+	}
+}
+
+type summaryBuffer struct {
+	buffer            map[string][]byte
+	remainingCapacity int
+	invalid           bool
+	// mutex protects all members of the struct and must be acquired before
+	// performing any read or write operation
+	mutex sync.Mutex
+}
+
+func (b *summaryBuffer) Write(node string, data []byte) {
+	b.mutex.Lock()
+	defer b.mutex.Unlock()
+	if b.invalid {
+		return
+	}
+	if len(data) > b.remainingCapacity {
+		// We're out of capacity, not all content will be written to the buffer
+		// it should not be used anymore
+		b.invalid = true
+		return
+	}
+	b.buffer[node] = append(b.buffer[node], data...)
+	b.remainingCapacity -= len(data)
+}
+
+// Export returns the buffer content and a whether the Export is valid.
+// Exporting the buffer can only happen once.
+func (b *summaryBuffer) Export() (map[string][]byte, bool) {
+	b.mutex.Lock()
+	defer b.mutex.Unlock()
+	if b.invalid {
+		return nil, false
+	}
+	b.invalid = true
+	return b.buffer, len(b.buffer) != 0
+}
diff --git a/lib/web/command_utils_test.go b/lib/web/command_utils_test.go
new file mode 100644
index 0000000000000..1366c1e6cae3d
--- /dev/null
+++ b/lib/web/command_utils_test.go
@@ -0,0 +1,142 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+package web
+
+import (
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSummaryBuffer(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name           string
+		outputs        map[string][][]byte
+		capacity       int
+		expectedOutput map[string][]byte
+		assertValidity require.BoolAssertionFunc
+	}{
+		{
+			name: "Single node",
+			outputs: map[string][][]byte{
+				"node": {
+					[]byte("foo"),
+					[]byte("bar"),
+					[]byte("baz"),
+				},
+			},
+			capacity: 9,
+			expectedOutput: map[string][]byte{
+				"node": []byte("foobarbaz"),
+			},
+			assertValidity: require.True,
+		},
+		{
+			name: "Single node overflow",
+			outputs: map[string][][]byte{
+				"node": {
+					[]byte("foo"),
+					[]byte("bar"),
+					[]byte("baz"),
+				},
+			},
+			capacity:       8,
+			expectedOutput: nil,
+			assertValidity: require.False,
+		},
+		{
+			name: "Multiple nodes",
+			outputs: map[string][][]byte{
+				"node1": {
+					[]byte("foo"),
+					[]byte("bar"),
+					[]byte("baz"),
+				},
+				"node2": {
+					[]byte("baz"),
+					[]byte("bar"),
+					[]byte("foo"),
+				},
+				"node3": {
+					[]byte("baz"),
+					[]byte("baz"),
+					[]byte("baz"),
+				},
+			},
+			capacity: 30,
+			expectedOutput: map[string][]byte{
+				"node1": []byte("foobarbaz"),
+				"node2": []byte("bazbarfoo"),
+				"node3": []byte("bazbazbaz"),
+			},
+			assertValidity: require.True,
+		},
+		{
+			name: "Multiple nodes overflow",
+			outputs: map[string][][]byte{
+				"node1": {
+					[]byte("foo"),
+					[]byte("bar"),
+					[]byte("baz"),
+				},
+				"node2": {
+					[]byte("baz"),
+					[]byte("bar"),
+					[]byte("foo"),
+				},
+				"node3": {
+					[]byte("baz"),
+					[]byte("baz"),
+					[]byte("baz"),
+				},
+			},
+			capacity:       25,
+			expectedOutput: nil,
+			assertValidity: require.False,
+		},
+		{
+			name:           "No output",
+			outputs:        nil,
+			capacity:       10,
+			expectedOutput: map[string][]byte{},
+			assertValidity: require.False,
+		},
+	}
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			buffer := newSummaryBuffer(tc.capacity)
+			var wg sync.WaitGroup
+			for node, output := range tc.outputs {
+				node := node
+				output := output
+				wg.Add(1)
+				go func() {
+					defer wg.Done()
+					for _, chunk := range output {
+						buffer.Write(node, chunk)
+					}
+				}()
+			}
+			wg.Wait()
+			output, isValid := buffer.Export()
+			require.Equal(t, tc.expectedOutput, output)
+			tc.assertValidity(t, isValid)
+		})
+	}
+}
diff --git a/lib/web/conn_upgrade_test.go b/lib/web/conn_upgrade_test.go
index 7828c47a9dafd..c3dcebcef6a17 100644
--- a/lib/web/conn_upgrade_test.go
+++ b/lib/web/conn_upgrade_test.go
@@ -32,6 +32,7 @@ import (
 
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/utils/pingconn"
+	"github.com/gravitational/teleport/lib/utils"
 )
 
 func TestWriteUpgradeResponse(t *testing.T) {
@@ -53,11 +54,17 @@ func TestHandlerConnectionUpgrade(t *testing.T) {
 	t.Parallel()
 
 	expectedPayload := "hello@"
+	expectedIP := "1.2.3.4"
 	alpnHandler := func(_ context.Context, conn net.Conn) error {
 		// Handles connection asynchronously to verify web handler waits until
 		// connection is closed.
 		go func() {
 			defer conn.Close()
+
+			clientIP, err := utils.ClientIPFromConn(conn)
+			require.NoError(t, err)
+			require.Equal(t, expectedIP, clientIP)
+
 			n, err := conn.Write([]byte(expectedPayload))
 			require.NoError(t, err)
 			require.Equal(t, len(expectedPayload), n)
@@ -89,7 +96,7 @@ func TestHandlerConnectionUpgrade(t *testing.T) {
 		defer serverConn.Close()
 		defer clientConn.Close()
 
-		sendConnUpgradeRequest(t, h, constants.WebAPIConnUpgradeTypeALPN, serverConn, clientConn)
+		sendConnUpgradeRequest(t, h, constants.WebAPIConnUpgradeTypeALPN, serverConn, clientConn, expectedIP)
 
 		// Verify clientConn receives data sent by Config.ALPNHandler.
 		receive, err := bufio.NewReader(clientConn).ReadString(byte('@'))
@@ -102,7 +109,7 @@ func TestHandlerConnectionUpgrade(t *testing.T) {
 		defer serverConn.Close()
 		defer clientConn.Close()
 
-		sendConnUpgradeRequest(t, h, constants.WebAPIConnUpgradeTypeALPNPing, serverConn, clientConn)
+		sendConnUpgradeRequest(t, h, constants.WebAPIConnUpgradeTypeALPNPing, serverConn, clientConn, expectedIP)
 
 		// Verify ping-wrapped clientConn receives data sent by Config.ALPNHandler.
 		receive, err := bufio.NewReader(pingconn.New(clientConn)).ReadString(byte('@'))
@@ -111,17 +118,26 @@ func TestHandlerConnectionUpgrade(t *testing.T) {
 	})
 }
 
-func sendConnUpgradeRequest(t *testing.T, h *Handler, upgradeType string, serverConn, clientConn net.Conn) {
+func sendConnUpgradeRequest(t *testing.T, h *Handler, upgradeType string, serverConn, clientConn net.Conn, xForwardedFor string) {
 	t.Helper()
 
 	r, err := http.NewRequest("GET", "http://localhost/webapi/connectionupgrade", nil)
 	require.NoError(t, err)
 	r.Header.Add("Upgrade", upgradeType)
+	r.Header.Add("X-Forwarded-For", xForwardedFor)
+
+	// serverConn will be hijacked.
+	w := newResponseWriterHijacker(nil, serverConn)
+	require.NoError(t, err)
 
 	go func() {
-		// serverConn will be hijacked.
-		w := newResponseWriterHijacker(nil, serverConn)
-		_, err := h.connectionUpgrade(w, r, nil)
+		// Use XForwardedFor middleware to set IPs.
+		var err error
+		connUpgradeHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			_, err = h.connectionUpgrade(w, r, nil)
+		})
+		NewXForwardedForMiddleware(connUpgradeHandler).ServeHTTP(w, r)
+
 		require.NoError(t, err)
 	}()
 
@@ -145,7 +161,7 @@ type responseWriterHijacker struct {
 	conn net.Conn
 }
 
-func newResponseWriterHijacker(w http.ResponseWriter, conn net.Conn) *responseWriterHijacker {
+func newResponseWriterHijacker(w http.ResponseWriter, conn net.Conn) http.ResponseWriter {
 	if w == nil {
 		w = httptest.NewRecorder()
 	}
@@ -155,6 +171,6 @@ func newResponseWriterHijacker(w http.ResponseWriter, conn net.Conn) *responseWr
 	}
 }
 
-func (h responseWriterHijacker) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+func (h *responseWriterHijacker) Hijack() (net.Conn, *bufio.ReadWriter, error) {
 	return h.conn, nil, nil
 }
diff --git a/lib/web/connection_diagnostic.go b/lib/web/connection_diagnostic.go
index d2b71731d5e80..49f90aaa83f46 100644
--- a/lib/web/connection_diagnostic.go
+++ b/lib/web/connection_diagnostic.go
@@ -24,12 +24,12 @@ import (
 
 	"github.com/gravitational/teleport/lib/client/conntest"
 	"github.com/gravitational/teleport/lib/httplib"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
 // getConnectionDiagnostic returns a connection diagnostic connection diagnostics.
-func (h *Handler) getConnectionDiagnostic(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) getConnectionDiagnostic(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	clt, err := sctx.GetUserClient(r.Context(), site)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -50,7 +50,7 @@ func (h *Handler) getConnectionDiagnostic(w http.ResponseWriter, r *http.Request
 }
 
 // diagnoseConnection executes and returns a connection diagnostic.
-func (h *Handler) diagnoseConnection(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) diagnoseConnection(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	req := conntest.TestConnectionRequest{}
 	if err := httplib.ReadJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/web/databases.go b/lib/web/databases.go
index e904f405b5461..5c79edbbeb1c5 100644
--- a/lib/web/databases.go
+++ b/lib/web/databases.go
@@ -33,7 +33,7 @@ import (
 	"github.com/gravitational/teleport/api/utils/tlsutils"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	dbiam "github.com/gravitational/teleport/lib/srv/db/common/iam"
 	"github.com/gravitational/teleport/lib/web/scripts"
 	"github.com/gravitational/teleport/lib/web/ui"
@@ -80,7 +80,7 @@ func (r *createDatabaseRequest) checkAndSetDefaults() error {
 }
 
 // handleDatabaseCreate creates a database's metadata.
-func (h *Handler) handleDatabaseCreate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) handleDatabaseCreate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	var req *createDatabaseRequest
 	if err := httplib.ReadJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
@@ -156,7 +156,7 @@ func (r *updateDatabaseRequest) checkAndSetDefaults() error {
 }
 
 // handleDatabaseUpdate updates the database
-func (h *Handler) handleDatabaseUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) handleDatabaseUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	databaseName := p.ByName("database")
 	if databaseName == "" {
 		return nil, trace.BadParameter("a database name is required")
@@ -245,7 +245,7 @@ type databaseIAMPolicyAWS struct {
 }
 
 // handleDatabaseGetIAMPolicy returns the required IAM policy for database.
-func (h *Handler) handleDatabaseGetIAMPolicy(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) handleDatabaseGetIAMPolicy(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	databaseName := p.ByName("database")
 	if databaseName == "" {
 		return nil, trace.BadParameter("missing database name")
diff --git a/lib/web/desktop.go b/lib/web/desktop.go
index 69afce3bc3eb4..830ddfde78fba 100644
--- a/lib/web/desktop.go
+++ b/lib/web/desktop.go
@@ -40,14 +40,16 @@ import (
 	"github.com/sirupsen/logrus"
 
 	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/lib/auth"
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/multiplexer"
-	"github.com/gravitational/teleport/lib/reversetunnel"
-	"github.com/gravitational/teleport/lib/srv/desktop"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/srv/desktop/tdp"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/web/scripts"
@@ -59,7 +61,7 @@ func (h *Handler) desktopConnectHandle(
 	r *http.Request,
 	p httprouter.Params,
 	sctx *SessionContext,
-	site reversetunnel.RemoteSite,
+	site reversetunnelclient.RemoteSite,
 ) (interface{}, error) {
 	desktopName := p.ByName("desktopName")
 	if desktopName == "" {
@@ -93,7 +95,7 @@ func (h *Handler) createDesktopConnection(
 	clusterName string,
 	log *logrus.Entry,
 	sctx *SessionContext,
-	site reversetunnel.RemoteSite,
+	site reversetunnelclient.RemoteSite,
 ) error {
 	upgrader := websocket.Upgrader{
 		ReadBufferSize:  1024,
@@ -242,16 +244,24 @@ func proxyClient(ctx context.Context, sessCtx *SessionContext, addr, windowsUser
 	return pc, nil
 }
 
+const (
+	// SNISuffix is the server name suffix used during SNI to specify the
+	// target desktop to connect to. The client (proxy_service) will use SNI
+	// like "${UUID}.desktop.teleport.cluster.local" to pass the UUID of the
+	// desktop.
+	// This is a copy of the same constant in `lib/srv/desktop/desktop.go` to
+	// prevent depending on `lib/srv` in `lib/web`.
+	SNISuffix = ".desktop." + constants.APIDomain
+)
+
 func desktopTLSConfig(ctx context.Context, ws *websocket.Conn, pc *client.ProxyClient, sessCtx *SessionContext, desktopName, username, siteName string) (*tls.Config, error) {
 	pk, err := keys.ParsePrivateKey(sessCtx.cfg.Session.GetPriv())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	stream, err := NewTerminalStream(ws)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
+	codec := tdpMFACodec{}
+
 	key, err := pc.IssueUserCertsWithMFA(ctx, client.ReissueParams{
 		RouteToWindowsDesktop: proto.RouteToWindowsDesktop{
 			WindowsDesktop: desktopName,
@@ -264,7 +274,33 @@ func desktopTLSConfig(ctx context.Context, ws *websocket.Conn, pc *client.ProxyC
 			TLSCert:             sessCtx.cfg.Session.GetTLSCert(),
 			WindowsDesktopCerts: make(map[string][]byte),
 		},
-	}, promptMFAChallenge(&stream.WSStream, tdpMFACodec{}))
+	}, func(ctx context.Context, proxyAddr string, c *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
+		challenge := &client.MFAAuthenticateChallenge{
+			WebauthnChallenge: wanlib.CredentialAssertionFromProto(c.WebauthnChallenge),
+		}
+
+		// Send the challenge over the socket.
+		msg, err := codec.encode(challenge, defaults.WebsocketWebauthnChallenge)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if err := ws.WriteMessage(websocket.BinaryMessage, msg); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		ty, buf, err := ws.ReadMessage()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if ty != websocket.BinaryMessage {
+			return nil, trace.BadParameter("received unexpected web socket message type %d", ty)
+		}
+
+		resp, err := codec.decodeResponse(buf, defaults.WebsocketWebauthnChallenge)
+		return resp, trace.Wrap(err)
+	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -282,14 +318,14 @@ func desktopTLSConfig(ctx context.Context, ws *websocket.Conn, pc *client.ProxyC
 	}
 	tlsConfig.Certificates = []tls.Certificate{certConf}
 	// Pass target desktop name via SNI.
-	tlsConfig.ServerName = desktopName + desktop.SNISuffix
+	tlsConfig.ServerName = desktopName + SNISuffix
 	return tlsConfig, nil
 }
 
 type connector struct {
 	log           *logrus.Entry
 	clt           auth.ClientI
-	site          reversetunnel.RemoteSite
+	site          reversetunnelclient.RemoteSite
 	clientSrcAddr net.Addr
 	clientDstAddr net.Addr
 }
@@ -324,7 +360,7 @@ func (c *connector) tryConnect(clusterName, desktopServiceID string) (net.Conn,
 
 	*c.log = *c.log.WithField("windows-service-uuid", service.GetName())
 	*c.log = *c.log.WithField("windows-service-addr", service.GetAddr())
-	return c.site.DialTCP(reversetunnel.DialParams{
+	return c.site.DialTCP(reversetunnelclient.DialParams{
 		From:                  c.clientSrcAddr,
 		To:                    &utils.NetAddr{AddrNetwork: "tcp", Addr: service.GetAddr()},
 		ConnType:              types.WindowsDesktopTunnel,
diff --git a/lib/web/desktop_playback.go b/lib/web/desktop_playback.go
index 27bb0e245712b..be2035288e580 100644
--- a/lib/web/desktop_playback.go
+++ b/lib/web/desktop_playback.go
@@ -23,7 +23,7 @@ import (
 	"github.com/julienschmidt/httprouter"
 	"golang.org/x/net/websocket"
 
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/web/desktop"
 )
 
@@ -32,7 +32,7 @@ func (h *Handler) desktopPlaybackHandle(
 	r *http.Request,
 	p httprouter.Params,
 	ctx *SessionContext,
-	site reversetunnel.RemoteSite,
+	site reversetunnelclient.RemoteSite,
 ) (interface{}, error) {
 	sID := p.ByName("sid")
 	if sID == "" {
diff --git a/lib/web/files.go b/lib/web/files.go
index 1c5e455690067..87c3fd5ad62f9 100644
--- a/lib/web/files.go
+++ b/lib/web/files.go
@@ -33,7 +33,7 @@ import (
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/multiplexer"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/sshutils/sftp"
 )
 
@@ -60,7 +60,7 @@ type fileTransferRequest struct {
 	moderatedSessionID string
 }
 
-func (h *Handler) transferFile(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) transferFile(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	query := r.URL.Query()
 	req := fileTransferRequest{
 		cluster:               site.GetName(),
diff --git a/lib/web/fuzz_test.go b/lib/web/fuzz_test.go
index 8448abcfca2bf..f421f6faeb28d 100644
--- a/lib/web/fuzz_test.go
+++ b/lib/web/fuzz_test.go
@@ -28,7 +28,7 @@ func FuzzTdpMFACodecDecode(f *testing.F) {
 	f.Fuzz(func(t *testing.T, buf []byte) {
 		require.NotPanics(t, func() {
 			codec := tdpMFACodec{}
-			_, _ = codec.decode(buf, "")
+			_, _ = codec.decodeResponse(buf, "")
 		})
 	})
 }
diff --git a/lib/web/integrations.go b/lib/web/integrations.go
index 2bc3af9ea2e04..9fdf5135c1934 100644
--- a/lib/web/integrations.go
+++ b/lib/web/integrations.go
@@ -25,12 +25,12 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
 // integrationsCreate creates an Integration
-func (h *Handler) integrationsCreate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationsCreate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	var req *ui.Integration
 	if err := httplib.ReadJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
@@ -77,7 +77,7 @@ func (h *Handler) integrationsCreate(w http.ResponseWriter, r *http.Request, p h
 }
 
 // integrationsUpdate updates the Integration based on its name
-func (h *Handler) integrationsUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationsUpdate(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	integrationName := p.ByName("name")
 	if integrationName == "" {
 		return nil, trace.BadParameter("an integration name is required")
@@ -118,7 +118,7 @@ func (h *Handler) integrationsUpdate(w http.ResponseWriter, r *http.Request, p h
 }
 
 // integrationsDelete removes an Integration based on its name
-func (h *Handler) integrationsDelete(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationsDelete(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	integrationName := p.ByName("name")
 	if integrationName == "" {
 		return nil, trace.BadParameter("an integration name is required")
@@ -137,7 +137,7 @@ func (h *Handler) integrationsDelete(w http.ResponseWriter, r *http.Request, p h
 }
 
 // integrationsGet returns an Integration based on its name
-func (h *Handler) integrationsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	integrationName := p.ByName("name")
 	if integrationName == "" {
 		return nil, trace.BadParameter("an integration name is required")
@@ -157,7 +157,7 @@ func (h *Handler) integrationsGet(w http.ResponseWriter, r *http.Request, p http
 }
 
 // integrationsList returns a page of Integrations
-func (h *Handler) integrationsList(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) integrationsList(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	clt, err := sctx.GetUserClient(r.Context(), site)
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/web/integrations_awsoidc.go b/lib/web/integrations_awsoidc.go
index 71b87cde6b036..26a29f437993d 100644
--- a/lib/web/integrations_awsoidc.go
+++ b/lib/web/integrations_awsoidc.go
@@ -15,20 +15,25 @@ package web
 
 import (
 	"context"
+	"fmt"
 	"net/http"
+	"strings"
 
 	"github.com/gravitational/trace"
 	"github.com/julienschmidt/httprouter"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/api/utils/aws"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/integrations/awsoidc"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
+	"github.com/gravitational/teleport/lib/web/scripts/oneoff"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
 // awsOIDCListDatabases returns a list of databases using the ListDatabases action of the AWS OIDC Integration.
-func (h *Handler) awsOIDCListDatabases(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) awsOIDCListDatabases(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
 	ctx := r.Context()
 
 	var req ui.AWSOIDCListDatabasesRequest
@@ -66,7 +71,7 @@ func (h *Handler) awsOIDCListDatabases(w http.ResponseWriter, r *http.Request, p
 }
 
 // awsOIDClientRequest receives a request to execute an action for the AWS OIDC integrations.
-func (h *Handler) awsOIDCClientRequest(ctx context.Context, region string, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (*awsoidc.AWSClientRequest, error) {
+func (h *Handler) awsOIDCClientRequest(ctx context.Context, region string, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (*awsoidc.AWSClientRequest, error) {
 	integrationName := p.ByName("name")
 	if integrationName == "" {
 		return nil, trace.BadParameter("an integration name is required")
@@ -104,8 +109,119 @@ func (h *Handler) awsOIDCClientRequest(ctx context.Context, region string, p htt
 	}
 
 	return &awsoidc.AWSClientRequest{
-		Token:   token,
-		RoleARN: awsoidcSpec.RoleARN,
-		Region:  region,
+		IntegrationName: integrationName,
+		Token:           token,
+		RoleARN:         awsoidcSpec.RoleARN,
+		Region:          region,
 	}, nil
 }
+
+// awsOIDCDeployService deploys a Discovery Service and a Database Service in Amazon ECS.
+func (h *Handler) awsOIDCDeployService(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
+	ctx := r.Context()
+
+	var req ui.AWSOIDCDeployServiceRequest
+	if err := httplib.ReadJSON(r, &req); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	awsClientReq, err := h.awsOIDCClientRequest(ctx, req.Region, p, sctx, site)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	deployDBServiceClient, err := awsoidc.NewDeployServiceClient(ctx, awsClientReq)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	databaseAgentMatcherLabels := make(types.Labels, len(req.DatabaseAgentMatcherLabels))
+	for _, label := range req.DatabaseAgentMatcherLabels {
+		databaseAgentMatcherLabels[label.Name] = utils.Strings{label.Value}
+	}
+
+	deployServiceResp, err := awsoidc.DeployService(ctx, deployDBServiceClient, awsoidc.DeployServiceRequest{
+		Region:                        req.Region,
+		SubnetIDs:                     req.SubnetIDs,
+		ClusterName:                   req.ClusterName,
+		ServiceName:                   req.ServiceName,
+		TaskName:                      req.TaskName,
+		TaskRoleARN:                   req.TaskRoleARN,
+		ProxyServerHostPort:           h.PublicProxyAddr(),
+		TeleportClusterName:           h.auth.clusterName,
+		DeploymentMode:                req.DeploymentMode,
+		IntegrationName:               awsClientReq.IntegrationName,
+		DatabaseResourceMatcherLabels: databaseAgentMatcherLabels,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return ui.AWSOIDCDeployServiceResponse{
+		ClusterARN:          deployServiceResp.ClusterARN,
+		ServiceARN:          deployServiceResp.ServiceARN,
+		TaskDefinitionARN:   deployServiceResp.TaskDefinitionARN,
+		ServiceDashboardURL: deployServiceResp.ServiceDashboardURL,
+	}, nil
+}
+
+// awsOIDCConfigureDeployServiceIAM returns a script that configures the required IAM permissions to enable the usage of DeployService action.
+func (h *Handler) awsOIDCConfigureDeployServiceIAM(w http.ResponseWriter, r *http.Request, p httprouter.Params) (any, error) {
+	ctx := r.Context()
+
+	queryParams := r.URL.Query()
+
+	clusterName, err := h.GetProxyClient().GetDomainName(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	integrationName := queryParams.Get("integrationName")
+	if len(integrationName) == 0 {
+		return nil, trace.BadParameter("missing integrationName param")
+	}
+
+	// Ensure the IntegrationName is valid.
+	_, err = h.GetProxyClient().GetIntegration(ctx, integrationName)
+	// NotFound error is ignored to prevent disclosure of whether the integration exists in a public/no-auth endpoint.
+	if err != nil && !trace.IsNotFound(err) {
+		return nil, trace.Wrap(err)
+	}
+
+	awsRegion := queryParams.Get("awsRegion")
+	if err := aws.IsValidRegion(awsRegion); err != nil {
+		return nil, trace.BadParameter("invalid awsRegion")
+	}
+
+	role := queryParams.Get("role")
+	if err := aws.IsValidIAMRoleName(role); err != nil {
+		return nil, trace.BadParameter("invalid role")
+	}
+
+	taskRole := queryParams.Get("taskRole")
+	if err := aws.IsValidIAMRoleName(taskRole); err != nil {
+		return nil, trace.BadParameter("invalid taskRole")
+	}
+
+	// The script must execute the following command:
+	// teleport integration configure deployservice-iam
+	argsList := []string{
+		"integration", "configure", "deployservice-iam",
+		fmt.Sprintf(`--cluster="%s"`, clusterName),
+		fmt.Sprintf(`--name="%s"`, integrationName),
+		fmt.Sprintf(`--aws-region="%s"`, awsRegion),
+		fmt.Sprintf(`--role="%s"`, role),
+		fmt.Sprintf(`--task-role="%s"`, taskRole),
+	}
+	script, err := oneoff.BuildScript(oneoff.OneOffScriptParams{
+		TeleportArgs: strings.Join(argsList, " "),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	httplib.SetScriptHeaders(w.Header())
+	fmt.Fprint(w, script)
+
+	return nil, trace.Wrap(err)
+}
diff --git a/lib/web/integrations_awsoidc_test.go b/lib/web/integrations_awsoidc_test.go
new file mode 100644
index 0000000000000..3fbc06987b9e5
--- /dev/null
+++ b/lib/web/integrations_awsoidc_test.go
@@ -0,0 +1,146 @@
+/*
+Copyright 2023 Gravitational, Inc.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package web
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildDeployServiceConfigureIAMScript(t *testing.T) {
+	isBadParamErrFn := func(tt require.TestingT, err error, i ...any) {
+		require.True(tt, trace.IsBadParameter(err), "expected bad parameter, got %v", err)
+	}
+
+	ctx := context.Background()
+	env := newWebPack(t, 1)
+
+	// Unauthenticated client for script downloading.
+	publicClt := env.proxies[0].newClient(t)
+	pathVars := []string{
+		"webapi",
+		"scripts",
+		"integrations",
+		"configure",
+		"deployservice-iam.sh",
+	}
+	endpoint := publicClt.Endpoint(pathVars...)
+
+	tests := []struct {
+		name                 string
+		reqRelativeURL       string
+		reqQuery             url.Values
+		errCheck             require.ErrorAssertionFunc
+		expectedTeleportArgs string
+	}{
+		{
+			name: "valid",
+			reqQuery: url.Values{
+				"awsRegion":       []string{"us-east-1"},
+				"role":            []string{"myRole"},
+				"taskRole":        []string{"taskRole"},
+				"integrationName": []string{"myintegration"},
+			},
+			errCheck: require.NoError,
+			expectedTeleportArgs: "integration configure deployservice-iam " +
+				`--cluster="localhost" ` +
+				`--name="myintegration" ` +
+				`--aws-region="us-east-1" ` +
+				`--role="myRole" ` +
+				`--task-role="taskRole"`,
+		},
+		{
+			name: "valid with symbols in role",
+			reqQuery: url.Values{
+				"awsRegion":       []string{"us-east-1"},
+				"role":            []string{"Test+1=2,3.4@5-6_7"},
+				"taskRole":        []string{"taskRole"},
+				"integrationName": []string{"myintegration"},
+			},
+			errCheck: require.NoError,
+			expectedTeleportArgs: "integration configure deployservice-iam " +
+				`--cluster="localhost" ` +
+				`--name="myintegration" ` +
+				`--aws-region="us-east-1" ` +
+				`--role="Test+1=2,3.4@5-6_7" ` +
+				`--task-role="taskRole"`,
+		},
+		{
+			name: "missing aws-region",
+			reqQuery: url.Values{
+				"role":            []string{"myRole"},
+				"taskRole":        []string{"taskRole"},
+				"integrationName": []string{"myintegration"},
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing role",
+			reqQuery: url.Values{
+				"awsRegion":       []string{"us-east-1"},
+				"taskRole":        []string{"taskRole"},
+				"integrationName": []string{"myintegration"},
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing task role",
+			reqQuery: url.Values{
+				"awsRegion":       []string{"us-east-1"},
+				"role":            []string{"role"},
+				"integrationName": []string{"myintegration"},
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "missing integration name",
+			reqQuery: url.Values{
+				"awsRegion": []string{"us-east-1"},
+				"role":      []string{"role"},
+				"taskRole":  []string{"taskRole"},
+			},
+			errCheck: isBadParamErrFn,
+		},
+		{
+			name: "trying to inject escape sequence into query params",
+			reqQuery: url.Values{
+				"awsRegion":       []string{"us-east-1"},
+				"role":            []string{"role"},
+				"taskRole":        []string{"taskRole"},
+				"integrationName": []string{"'; rm -rf /tmp/dir; echo '"},
+			},
+			errCheck: isBadParamErrFn,
+		},
+	}
+
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			resp, err := publicClt.Get(ctx, endpoint, tc.reqQuery)
+			tc.errCheck(t, err)
+			if err != nil {
+				return
+			}
+
+			require.Contains(t, string(resp.Bytes()),
+				fmt.Sprintf("teleportArgs='%s'\n", tc.expectedTeleportArgs),
+			)
+		})
+	}
+}
diff --git a/lib/web/join_tokens.go b/lib/web/join_tokens.go
index 74d6a82fb995c..374c60f082a5f 100644
--- a/lib/web/join_tokens.go
+++ b/lib/web/join_tokens.go
@@ -40,6 +40,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/automaticupgrades"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/modules"
@@ -71,20 +72,22 @@ type nodeJoinToken struct {
 // scriptSettings is used to hold values which are passed into the function that
 // generates the join script.
 type scriptSettings struct {
-	token                  string
-	appInstallMode         bool
-	appName                string
-	appURI                 string
-	joinMethod             string
-	databaseInstallMode    bool
-	stableCloudChannelRepo bool
-	installUpdater         bool
+	token               string
+	appInstallMode      bool
+	appName             string
+	appURI              string
+	joinMethod          string
+	databaseInstallMode bool
+	installUpdater      bool
+
+	// automaticUpgradesVersionBaseURL is the base URL for getting the version when using the cloud/stable channel.
+	// Optional.
+	automaticUpgradesVersionBaseURL string
 }
 
 // automaticUpgrades returns whether automaticUpgrades should be enabled.
 func automaticUpgrades(features proto.Features) bool {
-	// TODO(marco): remove BuildType check when teleport-updater (oss) package is available in apt/yum repos.
-	return features.AutomaticUpgrades && modules.GetModules().BuildType() == modules.BuildEnterprise
+	return features.AutomaticUpgrades && features.Cloud
 }
 
 func (h *Handler) createTokenHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
@@ -207,14 +210,13 @@ func (h *Handler) createTokenHandle(w http.ResponseWriter, r *http.Request, para
 }
 
 func (h *Handler) getNodeJoinScriptHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params) (interface{}, error) {
-	scripts.SetScriptHeaders(w.Header())
+	httplib.SetScriptHeaders(w.Header())
 
 	settings := scriptSettings{
-		token:                  params.ByName("token"),
-		appInstallMode:         false,
-		joinMethod:             r.URL.Query().Get("method"),
-		stableCloudChannelRepo: h.ClusterFeatures.Cloud,
-		installUpdater:         automaticUpgrades(h.ClusterFeatures),
+		token:          params.ByName("token"),
+		appInstallMode: false,
+		joinMethod:     r.URL.Query().Get("method"),
+		installUpdater: automaticUpgrades(h.ClusterFeatures),
 	}
 
 	script, err := getJoinScript(r.Context(), settings, h.GetProxyClient())
@@ -234,7 +236,7 @@ func (h *Handler) getNodeJoinScriptHandle(w http.ResponseWriter, r *http.Request
 }
 
 func (h *Handler) getAppJoinScriptHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params) (interface{}, error) {
-	scripts.SetScriptHeaders(w.Header())
+	httplib.SetScriptHeaders(w.Header())
 	queryValues := r.URL.Query()
 
 	name, err := url.QueryUnescape(queryValues.Get("name"))
@@ -252,12 +254,11 @@ func (h *Handler) getAppJoinScriptHandle(w http.ResponseWriter, r *http.Request,
 	}
 
 	settings := scriptSettings{
-		token:                  params.ByName("token"),
-		appInstallMode:         true,
-		appName:                name,
-		appURI:                 uri,
-		stableCloudChannelRepo: h.ClusterFeatures.Cloud,
-		installUpdater:         automaticUpgrades(h.ClusterFeatures),
+		token:          params.ByName("token"),
+		appInstallMode: true,
+		appName:        name,
+		appURI:         uri,
+		installUpdater: automaticUpgrades(h.ClusterFeatures),
 	}
 
 	script, err := getJoinScript(r.Context(), settings, h.GetProxyClient())
@@ -277,13 +278,12 @@ func (h *Handler) getAppJoinScriptHandle(w http.ResponseWriter, r *http.Request,
 }
 
 func (h *Handler) getDatabaseJoinScriptHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params) (interface{}, error) {
-	scripts.SetScriptHeaders(w.Header())
+	httplib.SetScriptHeaders(w.Header())
 
 	settings := scriptSettings{
-		token:                  params.ByName("token"),
-		databaseInstallMode:    true,
-		stableCloudChannelRepo: h.ClusterFeatures.Cloud,
-		installUpdater:         automaticUpgrades(h.ClusterFeatures),
+		token:               params.ByName("token"),
+		databaseInstallMode: true,
+		installUpdater:      automaticUpgrades(h.ClusterFeatures),
 	}
 
 	script, err := getJoinScript(r.Context(), settings, h.GetProxyClient())
@@ -392,9 +392,19 @@ func getJoinScript(ctx context.Context, settings scriptSettings, m nodeAPIGetter
 	// By default, it will use `stable/v<majorVersion>`, eg stable/v12
 	repoChannel := ""
 
-	// For Teleport Cloud installations, use the `stable/cloud` channel.
-	if settings.stableCloudChannelRepo {
+	// The install script will install the updater (teleport-ent-updater) for Cloud customers enrolled in Automatic Upgrades.
+	// The repo channel used must be `stable/cloud` which has the available packages for the Cloud Customer's agents.
+	// It pins the teleport version to the one specified by https://updates.releases.teleport.dev/v1/stable/cloud/version
+	// This ensures the initial installed version is the same as the `teleport-ent-updater` would install.
+	if settings.installUpdater {
 		repoChannel = stableCloudChannelRepo
+		cloudStableVersion, err := automaticupgrades.Version(ctx, settings.automaticUpgradesVersionBaseURL)
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
+
+		// cloudStableVersion has vX.Y.Z format, however the script expects the version to not include the `v`
+		version = strings.TrimPrefix(cloudStableVersion, "v")
 	}
 
 	// This section relies on Go's default zero values to make sure that the settings
diff --git a/lib/web/join_tokens_test.go b/lib/web/join_tokens_test.go
index 48fa851f3a3b0..e3e6eb1f7f70a 100644
--- a/lib/web/join_tokens_test.go
+++ b/lib/web/join_tokens_test.go
@@ -20,12 +20,16 @@ import (
 	"context"
 	"encoding/hex"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"regexp"
 	"testing"
 
 	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils"
@@ -755,7 +759,6 @@ db_service:
 			}
 
 			if test.extraAssertions != nil {
-				t.Log(script)
 				test.extraAssertions(script)
 			}
 		})
@@ -873,7 +876,10 @@ func TestJoinScript(t *testing.T) {
 		mockGetProxyServers: func() ([]types.Server, error) {
 			return []types.Server{
 				&types.ServerV2{
-					Spec: types.ServerSpecV2{PublicAddrs: []string{"test-host:12345678"}},
+					Spec: types.ServerSpecV2{
+						PublicAddrs: []string{"test-host:12345678"},
+						Version:     teleport.Version,
+					},
 				},
 			}, nil
 		},
@@ -926,10 +932,20 @@ func TestJoinScript(t *testing.T) {
 	})
 
 	t.Run("using repo", func(t *testing.T) {
-		t.Run("installUpdater set to true, list of packages must include updater package", func(t *testing.T) {
-			script, err := getJoinScript(context.Background(), scriptSettings{token: validToken, installUpdater: true}, m)
+		t.Run("installUpdater is true", func(t *testing.T) {
+			currentStableCloudVersion := "v99.1.1"
+
+			httpTestServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				assert.Equal(t, r.URL.Path, "/v1/stable/cloud/version")
+				w.WriteHeader(http.StatusOK)
+				w.Write([]byte(currentStableCloudVersion))
+			}))
+			defer httpTestServer.Close()
+
+			script, err := getJoinScript(context.Background(), scriptSettings{token: validToken, installUpdater: true, automaticUpgradesVersionBaseURL: httpTestServer.URL}, m)
 			require.NoError(t, err)
 
+			// list of packages must include the updater
 			require.Contains(t, script, ""+
 				"    PACKAGE_LIST=${TELEPORT_PACKAGE_PIN_VERSION}\n"+
 				"    # (warning): This expression is constant. Did you forget the $ on a variable?\n"+
@@ -939,11 +955,14 @@ func TestJoinScript(t *testing.T) {
 				"        PACKAGE_LIST+=\" ${TELEPORT_UPDATER_PIN_VERSION}\"\n"+
 				"    fi\n",
 			)
+			// Repo channel is stable/cloud
+			require.Contains(t, script, "REPO_CHANNEL='stable/cloud'")
+			// TELEPORT_VERSION is the one provided by https://updates.releases.teleport.dev/v1/stable/cloud/version
+			require.Contains(t, script, "TELEPORT_VERSION='99.1.1'")
 		})
-		t.Run("installUpdater set to false, list of packages must not include updater package", func(t *testing.T) {
+		t.Run("installUpdater is false", func(t *testing.T) {
 			script, err := getJoinScript(context.Background(), scriptSettings{token: validToken, installUpdater: false}, m)
 			require.NoError(t, err)
-
 			require.Contains(t, script, ""+
 				"    PACKAGE_LIST=${TELEPORT_PACKAGE_PIN_VERSION}\n"+
 				"    # (warning): This expression is constant. Did you forget the $ on a variable?\n"+
@@ -953,26 +972,19 @@ func TestJoinScript(t *testing.T) {
 				"        PACKAGE_LIST+=\" ${TELEPORT_UPDATER_PIN_VERSION}\"\n"+
 				"    fi\n",
 			)
-		})
-		t.Run("using stable/cloud channel", func(t *testing.T) {
-			script, err := getJoinScript(context.Background(), scriptSettings{token: validToken, stableCloudChannelRepo: true}, m)
-			require.NoError(t, err)
-			require.Contains(t, script, "REPO_CHANNEL='stable/cloud'")
-		})
-		t.Run("not hard-coding a particular channel", func(t *testing.T) {
-			script, err := getJoinScript(context.Background(), scriptSettings{token: validToken, stableCloudChannelRepo: false}, m)
-			require.NoError(t, err)
+			// Default based on current version is used instead
 			require.Contains(t, script, "REPO_CHANNEL=''")
+			// Current version must be used
+			require.Contains(t, script, fmt.Sprintf("TELEPORT_VERSION='%s'", teleport.Version))
 		})
 	})
-
 }
 
 func TestAutomaticUpgrades(t *testing.T) {
-	t.Run("enterprise and automatic upgrades enabled", func(t *testing.T) {
+	t.Run("cloud and automatic upgrades enabled", func(t *testing.T) {
 		modules.SetTestModules(t, &modules.TestModules{
-			TestBuildType: modules.BuildEnterprise,
 			TestFeatures: modules.Features{
+				Cloud:             true,
 				AutomaticUpgrades: true,
 			},
 		})
@@ -980,10 +992,10 @@ func TestAutomaticUpgrades(t *testing.T) {
 		got := automaticUpgrades(*modules.GetModules().Features().ToProto())
 		require.True(t, got)
 	})
-	t.Run("enterprise but automatic upgrades disabled", func(t *testing.T) {
+	t.Run("cloud but automatic upgrades disabled", func(t *testing.T) {
 		modules.SetTestModules(t, &modules.TestModules{
-			TestBuildType: modules.BuildEnterprise,
 			TestFeatures: modules.Features{
+				Cloud:             true,
 				AutomaticUpgrades: false,
 			},
 		})
@@ -992,12 +1004,12 @@ func TestAutomaticUpgrades(t *testing.T) {
 		require.False(t, got)
 	})
 
-	// There's no `teleport-updater` (oss) package yet, so even if automatic upgrades are enabled it must return false.
-	t.Run("automatic upgrades enabled but build is OSS", func(t *testing.T) {
+	t.Run("automatic upgrades enabled but is not cloud", func(t *testing.T) {
 		modules.SetTestModules(t, &modules.TestModules{
 			TestBuildType: modules.BuildEnterprise,
 			TestFeatures: modules.Features{
-				AutomaticUpgrades: false,
+				Cloud:             false,
+				AutomaticUpgrades: true,
 			},
 		})
 
diff --git a/lib/web/mfa.go b/lib/web/mfa.go
index e6bb1cc2fcca4..ac5e831915619 100644
--- a/lib/web/mfa.go
+++ b/lib/web/mfa.go
@@ -27,7 +27,7 @@ import (
 	"github.com/gravitational/teleport/lib/auth/webauthn"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/httplib"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
@@ -347,7 +347,7 @@ type isMfaRequiredResponse struct {
 	Required bool `json:"required"`
 }
 
-func (h *Handler) isMFARequired(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) isMFARequired(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	var httpReq *isMFARequiredRequest
 	if err := httplib.ReadJSON(r, &httpReq); err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/web/mfa_codec.go b/lib/web/mfa_codec.go
index 589fe1cf560dc..5222a2c16235f 100644
--- a/lib/web/mfa_codec.go
+++ b/lib/web/mfa_codec.go
@@ -24,6 +24,7 @@ import (
 	"github.com/gravitational/trace"
 
 	authproto "github.com/gravitational/teleport/api/client/proto"
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/srv/desktop/tdp"
@@ -36,8 +37,11 @@ type mfaCodec interface {
 	// encode converts an MFA challenge to wire format
 	encode(chal *client.MFAAuthenticateChallenge, envelopeType string) ([]byte, error)
 
-	// decode parses an MFA authentication response
-	decode(bytes []byte, envelopeType string) (*authproto.MFAAuthenticateResponse, error)
+	// decodeChallenge parses an MFA authentication challenge
+	decodeChallenge(bytes []byte, envelopeType string) (*authproto.MFAAuthenticateChallenge, error)
+
+	// decodeResponse parses an MFA authentication response
+	decodeResponse(bytes []byte, envelopeType string) (*authproto.MFAAuthenticateResponse, error)
 }
 
 // protobufMFACodec converts MFA challenges and responses to the protobuf
@@ -61,13 +65,19 @@ func (protobufMFACodec) encode(chal *client.MFAAuthenticateChallenge, envelopeTy
 	return protoBytes, nil
 }
 
-func (protobufMFACodec) decode(bytes []byte, envelopeType string) (*authproto.MFAAuthenticateResponse, error) {
-	envelope := &Envelope{}
-	if err := proto.Unmarshal(bytes, envelope); err != nil {
+func (protobufMFACodec) decodeResponse(bytes []byte, envelopeType string) (*authproto.MFAAuthenticateResponse, error) {
+	return mfajson.Decode(bytes, envelopeType)
+}
+
+func (protobufMFACodec) decodeChallenge(bytes []byte, envelopeType string) (*authproto.MFAAuthenticateChallenge, error) {
+	var challenge client.MFAAuthenticateChallenge
+	if err := json.Unmarshal(bytes, &challenge); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return mfajson.Decode([]byte(envelope.Payload), envelopeType)
+	return &authproto.MFAAuthenticateChallenge{
+		WebauthnChallenge: wanlib.CredentialAssertionToProto(challenge.WebauthnChallenge),
+	}, nil
 }
 
 // tdpMFACodec converts MFA challenges and responses to Teleport Desktop
@@ -89,7 +99,7 @@ func (tdpMFACodec) encode(chal *client.MFAAuthenticateChallenge, envelopeType st
 	return tdpMsg.Encode()
 }
 
-func (tdpMFACodec) decode(buf []byte, envelopeType string) (*authproto.MFAAuthenticateResponse, error) {
+func (tdpMFACodec) decodeResponse(buf []byte, envelopeType string) (*authproto.MFAAuthenticateResponse, error) {
 	if len(buf) == 0 {
 		return nil, trace.BadParameter("empty MFA message received")
 	}
@@ -102,3 +112,20 @@ func (tdpMFACodec) decode(buf []byte, envelopeType string) (*authproto.MFAAuthen
 	}
 	return msg.MFAAuthenticateResponse, nil
 }
+
+func (tdpMFACodec) decodeChallenge(buf []byte, envelopeType string) (*authproto.MFAAuthenticateChallenge, error) {
+	if len(buf) == 0 {
+		return nil, trace.BadParameter("empty MFA message received")
+	}
+	if tdp.MessageType(buf[0]) != tdp.TypeMFA {
+		return nil, trace.BadParameter("expected MFA message type %v, got %v", tdp.TypeMFA, buf[0])
+	}
+	msg, err := tdp.DecodeMFAChallenge(bytes.NewReader(buf[1:]))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &authproto.MFAAuthenticateChallenge{
+		WebauthnChallenge: wanlib.CredentialAssertionToProto(msg.WebauthnChallenge),
+	}, nil
+}
diff --git a/lib/web/resources.go b/lib/web/resources.go
index 41264e5237582..fef9289b0bba7 100644
--- a/lib/web/resources.go
+++ b/lib/web/resources.go
@@ -32,13 +32,13 @@ import (
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/httplib"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
 // checkAccessToRegisteredResource checks if calling user has access to at least one registered resource.
-func (h *Handler) checkAccessToRegisteredResource(w http.ResponseWriter, r *http.Request, p httprouter.Params, c *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) checkAccessToRegisteredResource(w http.ResponseWriter, r *http.Request, p httprouter.Params, c *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	// Get a client to the Auth Server with the logged in user's identity. The
 	// identity of the logged in user is used to fetch the list of resources.
 	clt, err := c.GetUserClient(r.Context(), site)
diff --git a/lib/web/resources_test.go b/lib/web/resources_test.go
index 053b505e3c9ea..a60fe5f26b038 100644
--- a/lib/web/resources_test.go
+++ b/lib/web/resources_test.go
@@ -220,7 +220,6 @@ spec:
     cert_format: standard
     create_db_user: false
     create_desktop_user: false
-    create_host_user: false
     desktop_clipboard: true
     desktop_directory_sharing: true
     enhanced_recording:
@@ -237,7 +236,7 @@ spec:
       default: best_effort
       desktop: true
     ssh_file_copy: true
-version: v6
+version: v7
 `
 	role, err := types.NewRole("roleName", types.RoleSpecV6{
 		Allow: types.RoleConditions{
diff --git a/lib/web/scripts/install_node.go b/lib/web/scripts/install_node.go
index 91ed32487f8d5..64cbd0ac88776 100644
--- a/lib/web/scripts/install_node.go
+++ b/lib/web/scripts/install_node.go
@@ -19,7 +19,6 @@ package scripts
 import (
 	_ "embed"
 	"fmt"
-	"net/http"
 	"sort"
 	"strings"
 	"text/template"
@@ -31,11 +30,6 @@ import (
 	"github.com/gravitational/teleport/api/utils"
 )
 
-// SetScriptHeaders sets response headers to plain text.
-func SetScriptHeaders(h http.Header) {
-	h.Set("Content-Type", "text/plain")
-}
-
 // ErrorBashScript is used to display friendly error message when
 // there is an error prepping the actual script.
 var ErrorBashScript = []byte(`
diff --git a/lib/web/scripts/oneoff/oneoff.go b/lib/web/scripts/oneoff/oneoff.go
new file mode 100644
index 0000000000000..44d917f76dd1e
--- /dev/null
+++ b/lib/web/scripts/oneoff/oneoff.go
@@ -0,0 +1,109 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oneoff
+
+import (
+	"bytes"
+	_ "embed"
+	"text/template"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+)
+
+const (
+	// teleportCDNLocation is the Teleport's CDN URL
+	// This is used to download the Teleport Binary
+	teleportCDNLocation = "https://cdn.teleport.dev"
+
+	// binUname is the default binary name for inspecting the host's OS.
+	binUname = "uname"
+
+	// binMktemp is the default binary name for creating temporary directories.
+	binMktemp = "mktemp"
+)
+
+var (
+	//go:embed oneoff.sh
+	oneoffScript string
+
+	// oneOffBashScript is a template that can generate oneoff scripts using the `oneoff.sh` shell script.
+	oneOffBashScript = template.Must(template.New("oneoff").Parse(oneoffScript))
+)
+
+// OneOffScriptParams contains the required params to create a script that downloads and executes teleport binary.
+type OneOffScriptParams struct {
+	// TeleportArgs is the arguments to pass to the teleport binary.
+	// Eg, 'version'
+	TeleportArgs string
+
+	// BinUname is the binary used to get OS name and Architecture of the host.
+	// Defaults to `uname`.
+	BinUname string
+	// BinUname is the binary used to create a temporary directory, used to download the files.
+	// Defaults to `mktemp`.
+	BinMktemp string
+	// CDNBaseURL is the URL used to download the teleport tarball.
+	// Defaults to `https://cdn.teleport.dev`
+	CDNBaseURL string
+	// TeleportVersion is the teleport version to download.
+	// Defaults to v<currentTeleportVersion>
+	// Eg, v13.1.0
+	TeleportVersion string
+}
+
+// CheckAndSetDefaults checks if the required params ara present.
+func (p *OneOffScriptParams) CheckAndSetDefaults() error {
+	if p.TeleportArgs == "" {
+		return trace.BadParameter("missing teleport args")
+	}
+
+	if p.BinUname == "" {
+		p.BinUname = binUname
+	}
+
+	if p.BinMktemp == "" {
+		p.BinMktemp = binMktemp
+	}
+
+	if p.CDNBaseURL == "" {
+		p.CDNBaseURL = teleportCDNLocation
+	}
+
+	if p.TeleportVersion == "" {
+		p.TeleportVersion = "v" + teleport.Version
+	}
+
+	return nil
+}
+
+// BuildScript creates a Bash script that:
+// - downloads and extracts teleport binary
+// - runs `teleport ` with the args defined in the  query param
+func BuildScript(p OneOffScriptParams) (string, error) {
+	if err := p.CheckAndSetDefaults(); err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	out := &bytes.Buffer{}
+	if err := oneOffBashScript.Execute(out, p); err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return out.String(), nil
+}
diff --git a/lib/web/scripts/oneoff/oneoff.sh b/lib/web/scripts/oneoff/oneoff.sh
new file mode 100644
index 0000000000000..0a74621f4f00c
--- /dev/null
+++ b/lib/web/scripts/oneoff/oneoff.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cdnBaseURL='{{.CDNBaseURL}}'
+teleportVersion='{{.TeleportVersion}}'
+
+# shellcheck disable=all
+tempDir=$({{.BinMktemp}} -d)
+OS=$({{.BinUname}} -s)
+ARCH=$({{.BinUname}} -m)
+# shellcheck enable=all
+
+teleportArgs='{{.TeleportArgs}}'
+
+function teleportTarballName(){
+    if [[ ${OS} == "Darwin" ]]; then
+        echo teleport-${teleportVersion}-darwin-universal-bin.tar.gz
+        return 0
+    fi;
+
+    if [[ ${OS} != "Linux" ]]; then
+        echo "Only MacOS and Linux are supported." >&2
+        return 1
+    fi;
+
+    if [[ ${ARCH} == "armv7l" ]]; then echo "teleport-${teleportVersion}-linux-arm-bin.tar.gz"
+    elif [[ ${ARCH} == "aarch64" ]]; then echo "teleport-${teleportVersion}-linux-arm64-bin.tar.gz"
+    elif [[ ${ARCH} == "x86_64" ]]; then echo "teleport-${teleportVersion}-linux-amd64-bin.tar.gz"
+    elif [[ ${ARCH} == "i686" ]]; then echo "teleport-${teleportVersion}-linux-386-bin.tar.gz"
+    else
+        echo "Invalid Linux architecture ${ARCH}." >&2
+        return 1
+    fi;
+}
+
+function main() {
+    pushd $tempDir > /dev/null
+
+    tarballName=$(teleportTarballName)
+    curl --show-error --fail --location --remote-name ${cdnBaseURL}/${tarballName}
+    tar -xzf ${tarballName}
+
+    mkdir -p ./bin
+    mv ./teleport/teleport ./bin/teleport
+    echo "> ./bin/teleport ${teleportArgs}"
+    ./bin/teleport ${teleportArgs}
+
+    popd > /dev/null
+}
+
+main
diff --git a/lib/web/scripts/oneoff/oneoff_test.go b/lib/web/scripts/oneoff/oneoff_test.go
new file mode 100644
index 0000000000000..a0dde34231ace
--- /dev/null
+++ b/lib/web/scripts/oneoff/oneoff_test.go
@@ -0,0 +1,168 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oneoff
+
+import (
+	"bytes"
+	_ "embed"
+	"io/fs"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"testing"
+	"time"
+
+	"github.com/buildkite/bintest/v3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+func TestOneOffScript(t *testing.T) {
+	teleportVersionOutput := "Teleport v13.1.0 git:api/v13.1.0-0-gd83ec74 go1.20.4"
+	scriptName := "oneoff.sh"
+
+	unameMock, err := bintest.NewMock("uname")
+	require.NoError(t, err)
+	defer func() {
+		assert.NoError(t, unameMock.Close())
+	}()
+
+	mktempMock, err := bintest.NewMock("mktemp")
+	require.NoError(t, err)
+	defer func() {
+		assert.NoError(t, mktempMock.Close())
+	}()
+
+	script, err := BuildScript(OneOffScriptParams{
+		BinUname:        unameMock.Path,
+		BinMktemp:       mktempMock.Path,
+		CDNBaseURL:      "dummyURL",
+		TeleportVersion: "v13.1.0",
+		TeleportArgs:    "version",
+	})
+	require.NoError(t, err)
+
+	t.Run("command can be executed", func(t *testing.T) {
+		// set up
+		testWorkingDir := t.TempDir()
+		require.NoError(t, os.Mkdir(testWorkingDir+"/bin/", 0o755))
+		scriptLocation := testWorkingDir + "/" + scriptName
+
+		teleportMock, err := bintest.NewMock(testWorkingDir + "/bin/teleport")
+		require.NoError(t, err)
+		defer func() {
+			assert.NoError(t, teleportMock.Close())
+		}()
+
+		teleportBinTarball, err := utils.CompressTarGzArchive([]string{"teleport/teleport"}, singleFileFS{file: teleportMock.Path})
+		require.NoError(t, err)
+
+		testServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			http.ServeContent(w, req, "teleport-v13.1.0-linux-amd64-bin.tar.gz", time.Now(), bytes.NewReader(teleportBinTarball.Bytes()))
+		}))
+		defer func() { testServer.Close() }()
+
+		script, err := BuildScript(OneOffScriptParams{
+			BinUname:        unameMock.Path,
+			BinMktemp:       mktempMock.Path,
+			CDNBaseURL:      testServer.URL,
+			TeleportVersion: "v13.1.0",
+			TeleportArgs:    "version",
+		})
+		require.NoError(t, err)
+
+		unameMock.Expect("-s").AndWriteToStdout("Linux")
+		unameMock.Expect("-m").AndWriteToStdout("x86_64")
+		mktempMock.Expect("-d").AndWriteToStdout(testWorkingDir)
+		teleportMock.Expect("version").AndWriteToStdout(teleportVersionOutput)
+
+		err = os.WriteFile(scriptLocation, []byte(script), 0700)
+		require.NoError(t, err)
+
+		// execute script
+		out, err := exec.Command("bash", scriptLocation).CombinedOutput()
+
+		// validate
+		require.NoError(t, err, string(out))
+
+		require.True(t, unameMock.Check(t))
+		require.True(t, mktempMock.Check(t))
+		require.True(t, teleportMock.Check(t))
+
+		require.Contains(t, string(out), "> ./bin/teleport version")
+		require.Contains(t, string(out), teleportVersionOutput)
+	})
+
+	t.Run("invalid OS", func(t *testing.T) {
+		// set up
+		testWorkingDir := t.TempDir()
+		scriptLocation := testWorkingDir + "/" + scriptName
+
+		unameMock.Expect("-s").AndWriteToStdout("Windows")
+		unameMock.Expect("-m").AndWriteToStdout("x86_64")
+		mktempMock.Expect("-d").AndWriteToStdout(testWorkingDir)
+
+		err = os.WriteFile(scriptLocation, []byte(script), 0700)
+		require.NoError(t, err)
+
+		// execute script
+		out, err := exec.Command("bash", scriptLocation).CombinedOutput()
+
+		// validate
+		require.Error(t, err, string(out))
+		require.Contains(t, string(out), "Only MacOS and Linux are supported.")
+	})
+
+	t.Run("invalid Arch", func(t *testing.T) {
+		// set up
+		testWorkingDir := t.TempDir()
+		scriptLocation := testWorkingDir + "/" + scriptName
+
+		unameMock.Expect("-s").AndWriteToStdout("Linux")
+		unameMock.Expect("-m").AndWriteToStdout("apple-silicon")
+		mktempMock.Expect("-d").AndWriteToStdout(testWorkingDir)
+
+		err = os.WriteFile(scriptLocation, []byte(script), 0700)
+		require.NoError(t, err)
+
+		// execute script
+		out, err := exec.Command("bash", scriptLocation).CombinedOutput()
+
+		// validate
+		require.Error(t, err, string(out))
+		require.Contains(t, string(out), "Invalid Linux architecture apple-silicon.")
+	})
+}
+
+type singleFileFS struct {
+	file string
+}
+
+func (m singleFileFS) ReadFile(name string) ([]byte, error) {
+	return os.ReadFile(m.file)
+}
+
+func (m singleFileFS) Open(name string) (fs.File, error) {
+	return os.Open(m.file)
+}
+
+func (m singleFileFS) Stat(name string) (fs.FileInfo, error) {
+	return os.Stat(m.file)
+}
diff --git a/lib/web/servers.go b/lib/web/servers.go
index 6c1d014b1773d..53640c625cb09 100644
--- a/lib/web/servers.go
+++ b/lib/web/servers.go
@@ -24,13 +24,13 @@ import (
 
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
 // clusterKubesGet returns a list of kube clusters in a form the UI can present.
-func (h *Handler) clusterKubesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterKubesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	clt, err := sctx.GetUserClient(r.Context(), site)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -52,7 +52,7 @@ func (h *Handler) clusterKubesGet(w http.ResponseWriter, r *http.Request, p http
 	}
 
 	return listResourcesGetResponse{
-		Items:      ui.MakeKubeClusters(page.Resources, accessChecker.Roles()),
+		Items:      ui.MakeKubeClusters(page.Resources, accessChecker),
 		StartKey:   page.NextKey,
 		TotalCount: page.Total,
 	}, nil
@@ -60,7 +60,7 @@ func (h *Handler) clusterKubesGet(w http.ResponseWriter, r *http.Request, p http
 
 // clusterKubePodsGet returns a list of Kubernetes Pods in a form the
 // UI can present.
-func (h *Handler) clusterKubePodsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterKubePodsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	clt, err := sctx.NewKubernetesServiceClient(r.Context(), h.cfg.ProxyWebAddr.Addr)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -79,7 +79,7 @@ func (h *Handler) clusterKubePodsGet(w http.ResponseWriter, r *http.Request, p h
 }
 
 // clusterDatabasesGet returns a list of db servers in a form the UI can present.
-func (h *Handler) clusterDatabasesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterDatabasesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	clt, err := sctx.GetUserClient(r.Context(), site)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -119,7 +119,7 @@ func (h *Handler) clusterDatabasesGet(w http.ResponseWriter, r *http.Request, p
 }
 
 // clusterDatabaseGet returns a list of db servers in a form the UI can present.
-func (h *Handler) clusterDatabaseGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterDatabaseGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	databaseName := p.ByName("database")
 	if databaseName == "" {
 		return nil, trace.BadParameter("database name is required")
@@ -149,7 +149,7 @@ func (h *Handler) clusterDatabaseGet(w http.ResponseWriter, r *http.Request, p h
 }
 
 // clusterDatabaseServicesList returns a list of DatabaseServices (database agents) in a form the UI can present.
-func (h *Handler) clusterDatabaseServicesList(w http.ResponseWriter, r *http.Request, p httprouter.Params, ctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterDatabaseServicesList(w http.ResponseWriter, r *http.Request, p httprouter.Params, ctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	clt, err := ctx.GetUserClient(r.Context(), site)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -173,7 +173,7 @@ func (h *Handler) clusterDatabaseServicesList(w http.ResponseWriter, r *http.Req
 }
 
 // clusterDesktopsGet returns a list of desktops in a form the UI can present.
-func (h *Handler) clusterDesktopsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterDesktopsGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	clt, err := sctx.GetUserClient(r.Context(), site)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -194,7 +194,7 @@ func (h *Handler) clusterDesktopsGet(w http.ResponseWriter, r *http.Request, p h
 		return nil, trace.Wrap(err)
 	}
 
-	uiDesktops, err := ui.MakeDesktops(page.Resources, accessChecker.Roles())
+	uiDesktops, err := ui.MakeDesktops(page.Resources, accessChecker)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -207,7 +207,7 @@ func (h *Handler) clusterDesktopsGet(w http.ResponseWriter, r *http.Request, p h
 }
 
 // clusterDesktopServicesGet returns a list of desktop services in a form the UI can present.
-func (h *Handler) clusterDesktopServicesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) clusterDesktopServicesGet(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	// Get a client to the Auth Server with the logged in user's identity. The
 	// identity of the logged in user is used to fetch the list of desktop services.
 	clt, err := sctx.GetUserClient(r.Context(), site)
@@ -233,7 +233,7 @@ func (h *Handler) clusterDesktopServicesGet(w http.ResponseWriter, r *http.Reque
 }
 
 // getDesktopHandle returns a desktop.
-func (h *Handler) getDesktopHandle(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) getDesktopHandle(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	clt, err := sctx.GetUserClient(r.Context(), site)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -258,7 +258,7 @@ func (h *Handler) getDesktopHandle(w http.ResponseWriter, r *http.Request, p htt
 	// windowsDesktops may contain the same desktop multiple times
 	// if multiple Windows Desktop Services are in use. We only need
 	// to see the desktop once in the UI, so just take the first one.
-	uiDesktop, err := ui.MakeDesktop(windowsDesktops[0], accessChecker.Roles())
+	uiDesktop, err := ui.MakeDesktop(windowsDesktops[0], accessChecker)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -273,7 +273,7 @@ func (h *Handler) getDesktopHandle(w http.ResponseWriter, r *http.Request, p htt
 // Response body:
 //
 // {"active": bool}
-func (h *Handler) desktopIsActive(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
+func (h *Handler) desktopIsActive(w http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (interface{}, error) {
 	desktopName := p.ByName("desktopName")
 	trackers, err := h.auth.proxyClient.GetActiveSessionTrackersWithFilter(r.Context(), &types.SessionTrackerFilter{
 		Kind: string(types.WindowsDesktopSessionKind),
diff --git a/lib/web/cookie.go b/lib/web/session/cookie.go
similarity index 65%
rename from lib/web/cookie.go
rename to lib/web/session/cookie.go
index d84d567e65baf..c3fbb24a6e919 100644
--- a/lib/web/cookie.go
+++ b/lib/web/session/cookie.go
@@ -15,7 +15,7 @@ limitations under the License.
 
 */
 
-package web
+package session
 
 import (
 	"encoding/hex"
@@ -23,33 +23,39 @@ import (
 	"net/http"
 )
 
-// SessionCookie stores information about active user and session
-type SessionCookie struct {
+// Cookie stores information about active user and session
+type Cookie struct {
 	User string `json:"user"`
 	SID  string `json:"sid"`
 }
 
+// EncodeCookie returns the string representation of a [Cookie]
+// that should be used to store the user session in the cookies
+// of a [http.ResponseWriter].
 func EncodeCookie(user, sid string) (string, error) {
-	bytes, err := json.Marshal(SessionCookie{User: user, SID: sid})
+	bytes, err := json.Marshal(Cookie{User: user, SID: sid})
 	if err != nil {
 		return "", err
 	}
 	return hex.EncodeToString(bytes), nil
 }
 
-func DecodeCookie(b string) (*SessionCookie, error) {
+// DecodeCookie returns the [Cookie] from the provided string.
+func DecodeCookie(b string) (*Cookie, error) {
 	bytes, err := hex.DecodeString(b)
 	if err != nil {
 		return nil, err
 	}
-	var c *SessionCookie
+	var c *Cookie
 	if err := json.Unmarshal(bytes, &c); err != nil {
 		return nil, err
 	}
 	return c, nil
 }
 
-func SetSessionCookie(w http.ResponseWriter, user, sid string) error {
+// SetCookie encodes the provided user and session id via [EncodeCookie]
+// and then sets the [http.Cookie] of the provided [http.ResponseWriter].
+func SetCookie(w http.ResponseWriter, user, sid string) error {
 	d, err := EncodeCookie(user, sid)
 	if err != nil {
 		return err
@@ -65,7 +71,8 @@ func SetSessionCookie(w http.ResponseWriter, user, sid string) error {
 	return nil
 }
 
-func ClearSession(w http.ResponseWriter) {
+// ClearCookie wipes the session cookie to invalidate the user session.
+func ClearCookie(w http.ResponseWriter) {
 	http.SetCookie(w, &http.Cookie{
 		Name:     CookieName,
 		Value:    "",
diff --git a/lib/web/session/cookie_test.go b/lib/web/session/cookie_test.go
new file mode 100644
index 0000000000000..1b41d80ded029
--- /dev/null
+++ b/lib/web/session/cookie_test.go
@@ -0,0 +1,50 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package session
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCookies(t *testing.T) {
+	const (
+		user      = "llama"
+		sessionID = "98765"
+	)
+	expectedCookie := &Cookie{User: user, SID: sessionID}
+
+	encodedCookie, err := EncodeCookie(user, sessionID)
+	require.NoError(t, err)
+
+	cookie, err := DecodeCookie(encodedCookie)
+	require.NoError(t, err)
+	require.Equal(t, expectedCookie, cookie)
+
+	recorder := httptest.NewRecorder()
+	require.Empty(t, recorder.Header().Get("Set-Cookie"))
+
+	require.NoError(t, SetCookie(recorder, user, sessionID))
+	ClearCookie(recorder)
+	setCookies := recorder.Header().Values("Set-Cookie")
+	require.Len(t, setCookies, 2)
+
+	// SetCookie will store the encoded session in the cookie
+	require.Equal(t, "__Host-session=7b2275736572223a226c6c616d61222c22736964223a223938373635227d; Path=/; HttpOnly; Secure", setCookies[0])
+	// ClearCookie will add an entry with the cookie value cleared out
+	require.Equal(t, "__Host-session=; Path=/; HttpOnly; Secure", setCookies[1])
+}
diff --git a/lib/web/sessions.go b/lib/web/sessions.go
index 2dc5c65a5c25d..f405a6d70edef 100644
--- a/lib/web/sessions.go
+++ b/lib/web/sessions.go
@@ -49,7 +49,7 @@ import (
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/multiplexer"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
@@ -108,7 +108,7 @@ type SessionContextConfig struct {
 	Session types.WebSession
 
 	// newRemoteClient is used by tests to override how remote clients are constructed to allow for fake sites
-	newRemoteClient func(ctx context.Context, sessionContext *SessionContext, site reversetunnel.RemoteSite) (auth.ClientI, error)
+	newRemoteClient func(ctx context.Context, sessionContext *SessionContext, site reversetunnelclient.RemoteSite) (auth.ClientI, error)
 }
 
 func (c *SessionContextConfig) CheckAndSetDefaults() error {
@@ -219,7 +219,7 @@ func (c *SessionContext) GetClientConnection() *grpc.ClientConn {
 // the requested site. If the site is local a client with the users local role
 // is returned. If the site is remote a client with the users remote role is
 // returned.
-func (c *SessionContext) GetUserClient(ctx context.Context, site reversetunnel.RemoteSite) (auth.ClientI, error) {
+func (c *SessionContext) GetUserClient(ctx context.Context, site reversetunnelclient.RemoteSite) (auth.ClientI, error) {
 	// if we're trying to access the local cluster, pass back the local client.
 	if c.cfg.RootClusterName == site.GetName() {
 		return c.cfg.RootClient, nil
@@ -238,7 +238,7 @@ func (c *SessionContext) GetUserClient(ctx context.Context, site reversetunnel.R
 //
 // A [singleflight.Group] is leveraged to prevent duplicate requests for remote
 // clients at the same time to race.
-func (c *SessionContext) remoteClient(ctx context.Context, site reversetunnel.RemoteSite) (auth.ClientI, error) {
+func (c *SessionContext) remoteClient(ctx context.Context, site reversetunnelclient.RemoteSite) (auth.ClientI, error) {
 	cltI, err, _ := c.remoteClientGroup.Do(site.GetName(), func() (interface{}, error) {
 		// check if we already have a connection to this cluster
 		if clt, ok := c.remoteClientCache.getRemoteClient(site); ok {
@@ -274,7 +274,7 @@ func (c *SessionContext) remoteClient(ctx context.Context, site reversetunnel.Re
 }
 
 // newRemoteClient returns a client to a remote cluster with the role of current user.
-func newRemoteClient(ctx context.Context, sctx *SessionContext, site reversetunnel.RemoteSite) (auth.ClientI, error) {
+func newRemoteClient(ctx context.Context, sctx *SessionContext, site reversetunnelclient.RemoteSite) (auth.ClientI, error) {
 	clt, err := sctx.newRemoteTLSClient(ctx, site)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -291,9 +291,9 @@ func newRemoteClient(ctx context.Context, sctx *SessionContext, site reversetunn
 }
 
 // clusterDialer returns DialContext function using cluster's dial function
-func clusterDialer(remoteCluster reversetunnel.RemoteSite, src, dst net.Addr) apiclient.ContextDialer {
+func clusterDialer(remoteCluster reversetunnelclient.RemoteSite, src, dst net.Addr) apiclient.ContextDialer {
 	return apiclient.ContextDialerFunc(func(in context.Context, network, _ string) (net.Conn, error) {
-		dialParams := reversetunnel.DialParams{
+		dialParams := reversetunnelclient.DialParams{
 			From:                  src,
 			OriginalClientDstAddr: dst,
 		}
@@ -386,7 +386,7 @@ func (c *SessionContext) ClientTLSConfig(ctx context.Context, clusterName ...str
 	return tlsConfig, nil
 }
 
-func (c *SessionContext) newRemoteTLSClient(ctx context.Context, cluster reversetunnel.RemoteSite) (auth.ClientI, error) {
+func (c *SessionContext) newRemoteTLSClient(ctx context.Context, cluster reversetunnelclient.RemoteSite) (auth.ClientI, error) {
 	tlsConfig, err := c.ClientTLSConfig(ctx, cluster.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1143,17 +1143,17 @@ type remoteClientCache struct {
 	sync.Mutex
 	clients map[string]struct {
 		auth.ClientI
-		reversetunnel.RemoteSite
+		reversetunnelclient.RemoteSite
 	}
 }
 
-func (c *remoteClientCache) addRemoteClient(site reversetunnel.RemoteSite, remoteClient auth.ClientI) error {
+func (c *remoteClientCache) addRemoteClient(site reversetunnelclient.RemoteSite, remoteClient auth.ClientI) error {
 	c.Lock()
 	defer c.Unlock()
 	if c.clients == nil {
 		c.clients = make(map[string]struct {
 			auth.ClientI
-			reversetunnel.RemoteSite
+			reversetunnelclient.RemoteSite
 		})
 	}
 	var err error
@@ -1162,12 +1162,12 @@ func (c *remoteClientCache) addRemoteClient(site reversetunnel.RemoteSite, remot
 	}
 	c.clients[site.GetName()] = struct {
 		auth.ClientI
-		reversetunnel.RemoteSite
+		reversetunnelclient.RemoteSite
 	}{remoteClient, site}
 	return err
 }
 
-func (c *remoteClientCache) getRemoteClient(site reversetunnel.RemoteSite) (auth.ClientI, bool) {
+func (c *remoteClientCache) getRemoteClient(site reversetunnelclient.RemoteSite) (auth.ClientI, bool) {
 	c.Lock()
 	defer c.Unlock()
 	remoteClt, ok := c.clients[site.GetName()]
diff --git a/lib/web/sessions_test.go b/lib/web/sessions_test.go
index 1187f17e35d26..8d47ab928aca4 100644
--- a/lib/web/sessions_test.go
+++ b/lib/web/sessions_test.go
@@ -25,7 +25,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/auth"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 )
 
 func TestRemoteClientCache(t *testing.T) {
@@ -57,12 +57,12 @@ func TestRemoteClientCache(t *testing.T) {
 	require.Zero(t, openCount.Load())
 }
 
-func newMockRemoteSite(name string) reversetunnel.RemoteSite {
+func newMockRemoteSite(name string) reversetunnelclient.RemoteSite {
 	return &mockRemoteSite{name: name}
 }
 
 type mockRemoteSite struct {
-	reversetunnel.RemoteSite
+	reversetunnelclient.RemoteSite
 	name string
 }
 
@@ -98,7 +98,7 @@ func TestGetUserClient(t *testing.T) {
 	sctx := SessionContext{
 		cfg: SessionContextConfig{
 			RootClusterName: "local",
-			newRemoteClient: func(ctx context.Context, sessionContext *SessionContext, site reversetunnel.RemoteSite) (auth.ClientI, error) {
+			newRemoteClient: func(ctx context.Context, sessionContext *SessionContext, site reversetunnelclient.RemoteSite) (auth.ClientI, error) {
 				return newMockClientI(&openCount, nil), nil
 			},
 		},
diff --git a/lib/web/sign.go b/lib/web/sign.go
index 8dd2e6c5144d3..9a0a122ab4574 100644
--- a/lib/web/sign.go
+++ b/lib/web/sign.go
@@ -30,7 +30,7 @@ import (
 	"github.com/gravitational/teleport/lib/client/db"
 	"github.com/gravitational/teleport/lib/client/identityfile"
 	"github.com/gravitational/teleport/lib/httplib"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/utils"
 )
 
@@ -51,7 +51,7 @@ Should be equivalent to running:
 
 This endpoint returns a tar.gz compressed archive containing the required files to setup mTLS for the database.
 */
-func (h *Handler) signDatabaseCertificate(w http.ResponseWriter, r *http.Request, p httprouter.Params, site reversetunnel.RemoteSite, token types.ProvisionToken) (interface{}, error) {
+func (h *Handler) signDatabaseCertificate(w http.ResponseWriter, r *http.Request, p httprouter.Params, site reversetunnelclient.RemoteSite, token types.ProvisionToken) (interface{}, error) {
 	if !token.GetRoles().Include(types.RoleDatabase) {
 		return nil, trace.AccessDenied("required '%s' role was not provided by the token", types.RoleDatabase)
 	}
diff --git a/lib/web/terminal.go b/lib/web/terminal.go
index d87f898d24acb..b2235271b2ad0 100644
--- a/lib/web/terminal.go
+++ b/lib/web/terminal.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"net"
 	"net/http"
@@ -31,6 +32,7 @@ import (
 	"github.com/gogo/protobuf/proto"
 	"github.com/gorilla/websocket"
 	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
 	"github.com/sirupsen/logrus"
 	oteltrace "go.opentelemetry.io/otel/trace"
 	"golang.org/x/crypto/ssh"
@@ -96,6 +98,7 @@ type AuthProvider interface {
 	GetSessionTracker(ctx context.Context, sessionID string) (types.SessionTracker, error)
 	IsMFARequired(ctx context.Context, req *authproto.IsMFARequiredRequest) (*authproto.IsMFARequiredResponse, error)
 	GenerateUserSingleUseCerts(ctx context.Context) (authproto.AuthService_GenerateUserSingleUseCertsClient, error)
+	MaintainSessionPresence(ctx context.Context) (authproto.AuthService_MaintainSessionPresenceClient, error)
 }
 
 // NewTerminal creates a web-based terminal based on WebSockets and returns a
@@ -121,6 +124,7 @@ func NewTerminal(ctx context.Context, cfg TerminalHandlerConfig) (*TerminalHandl
 			sessionData:        cfg.SessionData,
 			keepAliveInterval:  cfg.KeepAliveInterval,
 			proxyHostPort:      cfg.ProxyHostPort,
+			proxyPublicAddr:    cfg.ProxyPublicAddr,
 			interactiveCommand: cfg.InteractiveCommand,
 			router:             cfg.Router,
 			tracer:             cfg.tracer,
@@ -129,11 +133,13 @@ func NewTerminal(ctx context.Context, cfg TerminalHandlerConfig) (*TerminalHandl
 		term:            cfg.Term,
 		proxySigner:     cfg.PROXYSigner,
 		participantMode: cfg.ParticipantMode,
+		tracker:         cfg.Tracker,
+		clock:           cfg.Clock,
 	}, nil
 }
 
 // TerminalHandlerConfig contains the configuration options necessary to
-// correctly setup the TerminalHandler
+// correctly set up the TerminalHandler
 type TerminalHandlerConfig struct {
 	// Term is the initial PTY size.
 	Term session.TerminalParams
@@ -154,6 +160,8 @@ type TerminalHandlerConfig struct {
 	KeepAliveInterval time.Duration
 	// ProxyHostPort is the address of the server to connect to.
 	ProxyHostPort string
+	// ProxyPublicAddr is the public web proxy address.
+	ProxyPublicAddr string
 	// InteractiveCommand is a command to execute.
 	InteractiveCommand []string
 	// Router determines how connections to nodes are created
@@ -166,6 +174,11 @@ type TerminalHandlerConfig struct {
 	tracer oteltrace.Tracer
 	// ParticipantMode is the mode that determines what you can do when you join an active session.
 	ParticipantMode types.SessionParticipantMode
+	// Tracker is the session tracker of the session being joined. May be nil
+	// if the user is not joining a session.
+	Tracker types.SessionTracker
+	// Clock used for presence checking.
+	Clock clockwork.Clock
 }
 
 func (t *TerminalHandlerConfig) CheckAndSetDefaults() error {
@@ -223,6 +236,8 @@ type sshBaseHandler struct {
 	authProvider AuthProvider
 	// proxyHostPort is the address of the server to connect to.
 	proxyHostPort string
+	// proxyPublicAddr is the public web proxy address.
+	proxyPublicAddr string
 	// keepAliveInterval is the interval for sending ping frames to a web client.
 	// This value is pulled from the cluster network config and
 	// guaranteed to be set to a nonzero value as it's enforced by the configuration.
@@ -248,15 +263,6 @@ type TerminalHandler struct {
 	// displayLogin is the login name to display in the UI.
 	displayLogin string
 
-	// sshSession holds the "shell" SSH channel to the node.
-	sshSession *tracessh.Session
-
-	// terminalContext is used to signal when the terminal sesson is closing.
-	terminalContext context.Context
-
-	// terminalCancel is used to signal when the terminal session is closing.
-	terminalCancel context.CancelFunc
-
 	closeOnce sync.Once
 
 	// term is the initial PTY size.
@@ -271,6 +277,12 @@ type TerminalHandler struct {
 	// stream manages sending and receiving [Envelope] to the UI
 	// for the duration of the session
 	stream *TerminalStream
+	// tracker is the session tracker of the session being joined. May be nil
+	// if the user is not joining a session.
+	tracker types.SessionTracker
+
+	// clock to use for presence checking
+	clock clockwork.Clock
 }
 
 // ServeHTTP builds a connection to the remote node and then pumps back two types of
@@ -343,17 +355,15 @@ func (t *TerminalHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 // Close the websocket stream.
 func (t *TerminalHandler) Close() error {
+	var err error
 	t.closeOnce.Do(func() {
-		// Close the SSH connection to the remote node.
-		if t.sshSession != nil {
-			t.sshSession.Close()
-		}
-
 		// If the terminal handler was closed (most likely due to the *SessionContext
 		// closing) then the stream should be closed as well.
-		t.terminalCancel()
+		if t.stream != nil {
+			err = t.stream.Close()
+		}
 	})
-	return nil
+	return trace.Wrap(err)
 }
 
 // handler is the main websocket loop. It creates a Teleport client and then
@@ -362,61 +372,42 @@ func (t *TerminalHandler) Close() error {
 func (t *TerminalHandler) handler(ws *websocket.Conn, r *http.Request) {
 	defer ws.Close()
 
-	// Create a terminal stream that wraps/unwraps the envelope used to
-	// communicate over the websocket.
-	resizeC := make(chan *session.TerminalParams, 1)
-	fileTransferRequestC := make(chan *session.FileTransferRequestParams, 1)
-	fileTransferDecisionC := make(chan *session.FileTransferDecisionParams, 1)
-	stream, err := NewTerminalStream(ws, WithTerminalStreamResizeHandler(resizeC), WithTerminalStreamFileTransferHandlers(fileTransferRequestC, fileTransferDecisionC))
-	if err != nil {
-		t.log.WithError(err).Info("Failed creating a terminal stream for session")
-		t.writeError(err)
-		return
-	}
-	t.stream = stream
+	// Update the read deadline upon receiving a pong message.
+	ws.SetPongHandler(func(_ string) error {
+		return trace.Wrap(ws.SetReadDeadline(deadlineForInterval(t.keepAliveInterval)))
+	})
 
 	// Create a context for signaling when the terminal session is over and
 	// link it first with the trace context from the request context
 	tctx := oteltrace.ContextWithRemoteSpanContext(context.Background(), oteltrace.SpanContextFromContext(r.Context()))
-	t.terminalContext, t.terminalCancel = context.WithCancel(tctx)
+	ctx, cancel := context.WithCancel(tctx)
+	defer cancel()
+	t.stream = NewTerminalStream(ctx, ws, t.log)
 
 	// Create a Teleport client, if not able to, show the reason to the user in
 	// the terminal.
-	tc, err := t.makeClient(r.Context(), ws)
+	tc, err := t.makeClient(ctx, t.stream, ws.RemoteAddr().String())
 	if err != nil {
 		t.log.WithError(err).Info("Failed creating a client for session")
-		t.writeError(err)
+		t.stream.writeError(err.Error())
 		return
 	}
 
 	t.log.Debug("Creating websocket stream")
 
-	// Update the read deadline upon receiving a pong message.
-	ws.SetPongHandler(func(_ string) error {
-		ws.SetReadDeadline(deadlineForInterval(t.keepAliveInterval))
-		return nil
-	})
-
 	// Start sending ping frames through websocket to client.
-	go startPingLoop(t.terminalContext, ws, t.keepAliveInterval, t.log, t.Close)
+	go startPingLoop(ctx, ws, t.keepAliveInterval, t.log, t.Close)
 
 	// Pump raw terminal in/out and audit events into the websocket.
-	go t.streamTerminal(ws, tc)
-	go t.streamEvents(tc)
-
-	// process window resizing
-	go t.handleWindowResize(resizeC)
-
-	// process file transfer requests/responses
-	go t.handleFileTransfer(fileTransferRequestC, fileTransferDecisionC)
+	go t.streamEvents(ctx, tc)
 
 	// Block until the terminal session is complete.
-	<-t.terminalContext.Done()
+	t.streamTerminal(ctx, tc)
 	t.log.Debug("Closing websocket stream")
 }
 
 // makeClient builds a *client.TeleportClient for the connection.
-func (t *TerminalHandler) makeClient(ctx context.Context, ws *websocket.Conn) (*client.TeleportClient, error) {
+func (t *TerminalHandler) makeClient(ctx context.Context, stream *TerminalStream, clientAddr string) (*client.TeleportClient, error) {
 	ctx, span := tracing.DefaultProvider().Tracer("terminal").Start(ctx, "terminal/makeClient")
 	defer span.End()
 
@@ -428,9 +419,9 @@ func (t *TerminalHandler) makeClient(ctx context.Context, ws *websocket.Conn) (*
 	clientConfig.HostLogin = t.sessionData.Login
 	clientConfig.ForwardAgent = client.ForwardAgentLocal
 	clientConfig.Namespace = apidefaults.Namespace
-	clientConfig.Stdout = t.stream
-	clientConfig.Stderr = t.stream
-	clientConfig.Stdin = t.stream
+	clientConfig.Stdout = stream
+	clientConfig.Stderr = stream
+	clientConfig.Stdin = stream
 	clientConfig.SiteName = t.sessionData.ClusterName
 	if err := clientConfig.ParseProxyHost(t.proxyHostPort); err != nil {
 		return nil, trace.BadParameter("failed to parse proxy address: %v", err)
@@ -438,7 +429,7 @@ func (t *TerminalHandler) makeClient(ctx context.Context, ws *websocket.Conn) (*
 	clientConfig.Host = t.sessionData.ServerHostname
 	clientConfig.HostPort = t.sessionData.ServerHostPort
 	clientConfig.SessionID = t.sessionData.ID.String()
-	clientConfig.ClientAddr = ws.RemoteAddr().String()
+	clientConfig.ClientAddr = clientAddr
 	clientConfig.Tracer = t.tracer
 
 	if len(t.interactiveCommand) > 0 {
@@ -454,8 +445,10 @@ func (t *TerminalHandler) makeClient(ctx context.Context, ws *websocket.Conn) (*
 	// used to update all other parties window size to that of the web client and
 	// to allow future window changes.
 	tc.OnShellCreated = func(s *tracessh.Session, c *tracessh.Client, _ io.ReadWriteCloser) (bool, error) {
-		t.sshSession = s
-		t.windowChange(ctx, &t.term)
+		t.stream.sessionCreated(s)
+		if err := s.WindowChange(ctx, t.term.H, t.term.W); err != nil {
+			t.log.Error(err)
+		}
 
 		return false, nil
 	}
@@ -609,7 +602,7 @@ func promptMFAChallenge(
 			return nil, trace.Wrap(err)
 		}
 
-		resp, err := stream.readChallenge(codec)
+		resp, err := stream.readChallengeResponse(codec)
 		return resp, trace.Wrap(err)
 	}
 }
@@ -621,9 +614,7 @@ type connectWithMFAFn = func(ctx context.Context, ws WSConn, tc *client.Teleport
 // certs and with single use certs after completing the mfa ceremony. Only one of
 // the operations will succeed, and if per session mfa will not gain access to the
 // target it will abort before prompting a user to perform the ceremony.
-func (t *sshBaseHandler) connectToHost(ctx context.Context, ws WSConn,
-	tc *client.TeleportClient, connectToNodeWithMFA connectWithMFAFn,
-) (*client.NodeClient, error) {
+func (t *sshBaseHandler) connectToHost(ctx context.Context, ws WSConn, tc *client.TeleportClient, connectToNodeWithMFA connectWithMFAFn) (*client.NodeClient, error) {
 	ctx, span := t.tracer.Start(ctx, "terminal/connectToHost")
 	defer span.End()
 
@@ -716,29 +707,48 @@ func (t *sshBaseHandler) connectToHost(ctx context.Context, ws WSConn,
 
 // streamTerminal opens a SSH connection to the remote host and streams
 // events back to the web client.
-func (t *TerminalHandler) streamTerminal(ws *websocket.Conn, tc *client.TeleportClient) {
-	ctx, span := t.tracer.Start(t.terminalContext, "terminal/streamTerminal")
+func (t *TerminalHandler) streamTerminal(ctx context.Context, tc *client.TeleportClient) {
+	ctx, span := t.tracer.Start(ctx, "terminal/streamTerminal")
 	defer span.End()
 
-	defer t.terminalCancel()
-
-	nc, err := t.connectToHost(ctx, ws, tc, t.connectToNodeWithMFA)
+	nc, err := t.connectToHost(ctx, t.stream.ws, tc, t.connectToNodeWithMFA)
 	if err != nil {
 		t.log.WithError(err).Warn("Unable to stream terminal - failure connecting to host")
-		t.writeError(err)
+		t.stream.writeError(err.Error())
 		return
 	}
 
 	defer nc.Close()
 
+	var beforeStart func(io.Writer)
+	if t.participantMode == types.SessionModeratorMode {
+		beforeStart = func(out io.Writer) {
+			nc.OnMFA = func() {
+				prompt := func(ctx context.Context, proxyAddr string, c *authproto.MFAAuthenticateChallenge) (*authproto.MFAAuthenticateResponse, error) {
+					resp, err := promptMFAChallenge(t.stream.WSStream, protobufMFACodec{})(ctx, proxyAddr, c)
+					return resp, trace.Wrap(err)
+				}
+				if err := client.RunPresenceTask(ctx, out, t.authProvider, t.sessionData.ID.String(), prompt, client.WithPresenceClock(t.clock)); err != nil {
+					t.log.WithError(err).Warn("Unable to stream terminal - failure performing presence checks")
+					return
+				}
+			}
+		}
+	}
+
 	// Establish SSH connection to the server. This function will block until
 	// either an error occurs or it completes successfully.
-	if err = nc.RunInteractiveShell(ctx, t.participantMode, nil); err != nil {
+	if err = nc.RunInteractiveShell(ctx, t.participantMode, t.tracker, beforeStart); err != nil {
 		t.log.WithError(err).Warn("Unable to stream terminal - failure running interactive shell")
-		t.writeError(err)
+		t.stream.writeError(err.Error())
 		return
 	}
 
+	// Send close envelope to web terminal upon exit without an error.
+	if err := t.stream.SendCloseMessage(); err != nil {
+		t.log.WithError(err).Error("Unable to send close event to web client.")
+	}
+
 	if err := t.stream.Close(); err != nil {
 		t.log.WithError(err).Error("Unable to send close event to web client.")
 		return
@@ -776,6 +786,8 @@ func (t *sshBaseHandler) connectToNode(ctx context.Context, ws WSConn, tc *clien
 		return nil, trace.NewAggregate(err, conn.Close())
 	}
 
+	clt.ProxyPublicAddr = t.proxyPublicAddr
+
 	return clt, nil
 }
 
@@ -783,7 +795,7 @@ func (t *sshBaseHandler) connectToNode(ctx context.Context, ws WSConn, tc *clien
 // host with the retrieved single use certs.
 func (t *TerminalHandler) connectToNodeWithMFA(ctx context.Context, ws WSConn, tc *client.TeleportClient, accessChecker services.AccessChecker, getAgent teleagent.Getter, signer agentless.SignerCreator) (*client.NodeClient, error) {
 	// perform mfa ceremony and retrieve new certs
-	authMethods, err := t.issueSessionMFACerts(ctx, tc, &t.stream.WSStream)
+	authMethods, err := t.issueSessionMFACerts(ctx, tc, t.stream.WSStream)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -814,12 +826,14 @@ func (t *sshBaseHandler) connectToNodeWithMFABase(ctx context.Context, ws WSConn
 		return nil, trace.NewAggregate(err, conn.Close())
 	}
 
+	nc.ProxyPublicAddr = t.proxyPublicAddr
+
 	return nc, nil
 }
 
 // streamEvents receives events over the SSH connection and forwards them to
 // the web client.
-func (t *TerminalHandler) streamEvents(tc *client.TeleportClient) {
+func (t *TerminalHandler) streamEvents(ctx context.Context, tc *client.TeleportClient) {
 	for {
 		select {
 		// Send push events that come over the events channel to the web client.
@@ -847,87 +861,12 @@ func (t *TerminalHandler) streamEvents(tc *client.TeleportClient) {
 
 		// Once the terminal stream is over (and the close envelope has been sent),
 		// close stop streaming envelopes.
-		case <-t.terminalContext.Done():
-			return
-		}
-	}
-}
-
-// handleFileTransfer receives file transfer requests and responses and forwards them
-// to the SSH session
-func (t *TerminalHandler) handleFileTransfer(fileTransferRequestC <-chan *session.FileTransferRequestParams, fileTransferDecisionC <-chan *session.FileTransferDecisionParams) {
-	for {
-		select {
-		case <-t.terminalContext.Done():
-			return
-		case transferRequest := <-fileTransferRequestC:
-			if transferRequest == nil {
-				// channel closed
-				continue
-			}
-			if err := t.sshSession.RequestFileTransfer(t.terminalContext, tracessh.FileTransferReq{
-				Download: transferRequest.Download,
-				Location: transferRequest.Location,
-				Filename: transferRequest.Filename,
-			}); err != nil {
-				t.log.WithError(err).Error("Unable to request file transfer")
-			}
-		case transferResponse := <-fileTransferDecisionC:
-			if transferResponse == nil {
-				// channel closed
-				continue
-			}
-
-			var err error
-			if transferResponse.Approved {
-				err = t.sshSession.ApproveFileTransferRequest(t.terminalContext, transferResponse.RequestID)
-			} else {
-				err = t.sshSession.DenyFileTransferRequest(t.terminalContext, transferResponse.RequestID)
-			}
-			if err != nil {
-				t.log.WithError(err).Error("Unable to respond to file transfer request")
-			}
-		}
-
-	}
-}
-
-// handleWindowResize receives window resize events and forwards
-// them to the SSH session.
-func (t *TerminalHandler) handleWindowResize(resizeC <-chan *session.TerminalParams) {
-	for {
-		select {
-		case <-t.terminalContext.Done():
+		case <-ctx.Done():
 			return
-		case params := <-resizeC:
-			// nil params indicates the channel was closed
-			if params == nil {
-				return
-			}
-			// process window change
-			t.windowChange(t.terminalContext, params)
 		}
 	}
 }
 
-// writeError displays an error in the terminal window.
-func (t *TerminalHandler) windowChange(ctx context.Context, params *session.TerminalParams) {
-	if t.sshSession == nil {
-		return
-	}
-
-	if err := t.sshSession.WindowChange(ctx, params.H, params.W); err != nil {
-		t.log.Error(err)
-	}
-}
-
-// writeError displays an error in the terminal window.
-func (t *TerminalHandler) writeError(err error) {
-	if writeErr := t.stream.writeError(err); writeErr != nil {
-		t.log.WithError(writeErr).Warnf("Unable to send error to terminal: %v", err)
-	}
-}
-
 // the defaultPort of 0 indicates that the port is
 // unknown or was not provided and should be guessed
 const defaultPort = 0
@@ -970,74 +909,58 @@ func serverHostPort(servername string) (string, int, error) {
 	return host, port, nil
 }
 
-// WithTerminalStreamEncoder overrides the default stream encoder
-func WithTerminalStreamEncoder(enc *encoding.Encoder) func(stream *TerminalStream) {
-	return func(stream *TerminalStream) {
-		stream.encoder = enc
-	}
-}
-
-// WithTerminalStreamDecoder overrides the default stream decoder
-func WithTerminalStreamDecoder(dec *encoding.Decoder) func(stream *TerminalStream) {
-	return func(stream *TerminalStream) {
-		stream.decoder = dec
+func NewWStream(ctx context.Context, ws WSConn, log logrus.FieldLogger, handlers map[string]WSHandlerFunc) *WSStream {
+	w := &WSStream{
+		log:        log,
+		ws:         ws,
+		encoder:    unicode.UTF8.NewEncoder(),
+		decoder:    unicode.UTF8.NewDecoder(),
+		rawC:       make(chan Envelope, 100),
+		challengeC: make(chan Envelope, 1),
+		handlers:   handlers,
 	}
-}
-
-// WithTerminalStreamResizeHandler provides a channel to subscribe to
-// terminal resize events
-func WithTerminalStreamResizeHandler(resizeC chan<- *session.TerminalParams) func(stream *TerminalStream) {
-	return func(stream *TerminalStream) {
-		stream.resizeC = resizeC
-	}
-}
 
-// WithTerminalStreamFileTransferHandlers provides two channels, one to subscribe to new file transfer requests, and
-// one to subscribe to file transfer decision requests, such as approve/deny
-func WithTerminalStreamFileTransferHandlers(fileTransferRequestC chan<- *session.FileTransferRequestParams, fileTransferDecisionC chan<- *session.FileTransferDecisionParams) func(stream *TerminalStream) {
-	return func(stream *TerminalStream) {
-		stream.fileTransferRequestC = fileTransferRequestC
-		stream.fileTransferDecisionC = fileTransferDecisionC
-	}
-}
+	go w.processMessages(ctx)
 
-func NewWStream(ws WSConn) *WSStream {
-	return &WSStream{
-		ws:      ws,
-		encoder: unicode.UTF8.NewEncoder(),
-		decoder: unicode.UTF8.NewDecoder(),
-	}
+	return w
 }
 
 // NewTerminalStream creates a stream that manages reading and writing
 // data over the provided [websocket.Conn]
-func NewTerminalStream(ws *websocket.Conn, opts ...func(*TerminalStream)) (*TerminalStream, error) {
-	switch {
-	case ws == nil:
-		return nil, trace.BadParameter("required parameter ws not provided")
-	}
-
+func NewTerminalStream(ctx context.Context, ws *websocket.Conn, log logrus.FieldLogger) *TerminalStream {
 	t := &TerminalStream{
-		WSStream: WSStream{
-			ws:      ws,
-			encoder: unicode.UTF8.NewEncoder(),
-			decoder: unicode.UTF8.NewDecoder(),
-		},
+		sessionReadyC: make(chan struct{}),
 	}
 
-	for _, opt := range opts {
-		opt(t)
+	handlers := map[string]WSHandlerFunc{
+		defaults.WebsocketResize:               t.handleWindowResize,
+		defaults.WebsocketFileTransferRequest:  t.handleFileTransferRequest,
+		defaults.WebsocketFileTransferDecision: t.handleFileTransferDecision,
 	}
 
-	return t, nil
+	t.WSStream = NewWStream(ctx, ws, log, handlers)
+
+	return t
 }
 
+// WSHandlerFunc specifies a handler that processes received a specific
+// [Envelope] received via a web socket.
+type WSHandlerFunc func(context.Context, Envelope)
+
+// WSStream handles web socket communication with
+// the frontend.
 type WSStream struct {
 	// encoder is used to encode UTF-8 strings.
 	encoder *encoding.Encoder
 	// decoder is used to decode UTF-8 strings.
 	decoder *encoding.Decoder
 
+	handlers map[string]WSHandlerFunc
+	// once ensures that all channels are closed at most one time.
+	once       sync.Once
+	challengeC chan Envelope
+	rawC       chan Envelope
+
 	// buffer is a buffer used to store the remaining payload data if it did not
 	// fit into the buffer provided by the callee to Read method
 	buffer []byte
@@ -1046,32 +969,208 @@ type WSStream struct {
 	mu sync.Mutex
 	// ws the connection to the UI
 	ws WSConn
+
+	// log holds the structured logger.
+	log logrus.FieldLogger
 }
 
 // TerminalStream manages the [websocket.Conn] to the web UI
 // for a terminal session.
 type TerminalStream struct {
-	WSStream
+	*WSStream
 
-	// once ensures that all channels are closed at most one time.
-	once sync.Once
-	// resizeC a channel to forward resize events so that
-	// they happen out of band and don't block reads
-	resizeC chan<- *session.TerminalParams
-	// fileTransferRequestC is a channel to facilitate requesting a file transfer
-	fileTransferRequestC chan<- *session.FileTransferRequestParams
-	// fileTransferDecisionC is a channel to facilitate responding to a file transfer
-	// with an approval or denial
-	fileTransferDecisionC chan<- *session.FileTransferDecisionParams
+	// sshSession holds the "shell" SSH channel to the node.
+	sshSession    *tracessh.Session
+	sessionReadyC chan struct{}
 }
 
 // Replace \n with \r\n so the message is correctly aligned.
 var replacer = strings.NewReplacer("\r\n", "\r\n", "\n", "\r\n")
 
 // writeError displays an error in the terminal window.
-func (t *WSStream) writeError(err error) error {
-	_, writeErr := replacer.WriteString(t, err.Error())
-	return trace.Wrap(writeErr)
+func (t *WSStream) writeError(msg string) {
+	if _, writeErr := replacer.WriteString(t, msg); writeErr != nil {
+		t.log.WithError(writeErr).Warnf("Unable to send error to terminal: %v", msg)
+	}
+}
+
+func (t *WSStream) processMessages(ctx context.Context) {
+	defer func() {
+		t.close()
+	}()
+	t.ws.SetReadLimit(teleport.MaxHTTPRequestSize)
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		default:
+			ty, bytes, err := t.ws.ReadMessage()
+			if err != nil {
+				if errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) ||
+					websocket.IsCloseError(err, websocket.CloseAbnormalClosure, websocket.CloseGoingAway, websocket.CloseNormalClosure) {
+					return
+				}
+
+				msg := err.Error()
+				if len(bytes) > 0 {
+					msg = string(bytes)
+				}
+				select {
+				case <-ctx.Done():
+				default:
+					t.writeError(msg)
+					return
+				}
+			}
+
+			if ty != websocket.BinaryMessage {
+				t.writeError(fmt.Sprintf("Expected binary message, got %v", ty))
+				return
+			}
+
+			var envelope Envelope
+			if err := proto.Unmarshal(bytes, &envelope); err != nil {
+				t.writeError(fmt.Sprintf("Unable to parse message payload %v", err))
+				return
+			}
+
+			switch envelope.Type {
+			case defaults.WebsocketClose:
+				return
+			case defaults.WebsocketWebauthnChallenge:
+				select {
+				case <-ctx.Done():
+					return
+				case t.challengeC <- envelope:
+				default:
+				}
+			case defaults.WebsocketRaw:
+				select {
+				case <-ctx.Done():
+					return
+				case t.rawC <- envelope:
+				default:
+				}
+			default:
+				if t.handlers == nil {
+					continue
+				}
+
+				handler, ok := t.handlers[envelope.Type]
+				if !ok {
+					t.log.Warnf("Received web socket envelope with unknown type %v", envelope.Type)
+					continue
+				}
+
+				go handler(ctx, envelope)
+			}
+		}
+	}
+}
+
+// handleWindowResize receives window resize events and forwards
+// them to the SSH session.
+func (t *TerminalStream) handleWindowResize(ctx context.Context, envelope Envelope) {
+	select {
+	case <-ctx.Done():
+		return
+	case <-t.sessionReadyC:
+	}
+
+	if t.sshSession == nil {
+		return
+	}
+
+	var e map[string]string
+	err := json.Unmarshal([]byte(envelope.Payload), &e)
+	if err != nil {
+		t.log.Warnf("Failed to parse resize payload: %v", err)
+		return
+	}
+
+	params, err := session.UnmarshalTerminalParams(e["size"])
+	if err != nil {
+		t.log.Warnf("Failed to retrieve terminal size: %v", err)
+		return
+	}
+
+	// nil params indicates the channel was closed
+	if params == nil {
+		return
+	}
+
+	if err := t.sshSession.WindowChange(ctx, params.H, params.W); err != nil {
+		t.log.Error(err)
+	}
+}
+
+func (t *TerminalStream) handleFileTransferDecision(ctx context.Context, envelope Envelope) {
+	select {
+	case <-ctx.Done():
+		return
+	case <-t.sessionReadyC:
+	}
+
+	if t.sshSession == nil {
+		return
+	}
+
+	var e utils.Fields
+	err := json.Unmarshal([]byte(envelope.Payload), &e)
+	if err != nil {
+		return
+	}
+	approved, ok := e["approved"].(bool)
+	if !ok {
+		t.log.Error("Unable to find approved status on response")
+		return
+	}
+
+	if approved {
+		err = t.sshSession.ApproveFileTransferRequest(ctx, e.GetString("requestId"))
+	} else {
+		err = t.sshSession.DenyFileTransferRequest(ctx, e.GetString("requestId"))
+	}
+	if err != nil {
+		t.log.WithError(err).Error("Unable to respond to file transfer request")
+	}
+}
+
+func (t *TerminalStream) handleFileTransferRequest(ctx context.Context, envelope Envelope) {
+	select {
+	case <-ctx.Done():
+		return
+	case <-t.sessionReadyC:
+	}
+
+	if t.sshSession == nil {
+		return
+	}
+
+	var e utils.Fields
+	err := json.Unmarshal([]byte(envelope.Payload), &e)
+	if err != nil {
+		return
+	}
+	download, ok := e["download"].(bool)
+	if !ok {
+		t.log.Error("Unable to find download param in response")
+		return
+	}
+
+	if err := t.sshSession.RequestFileTransfer(ctx, tracessh.FileTransferReq{
+		Download: download,
+		Location: e.GetString("location"),
+		Filename: e.GetString("filename"),
+	}); err != nil {
+		t.log.WithError(err).Error("Unable to request file transfer")
+	}
+}
+
+func (t *TerminalStream) sessionCreated(s *tracessh.Session) {
+	t.sshSession = s
+	close(t.sessionReadyC)
 }
 
 // writeChallenge encodes and writes the challenge to the
@@ -1088,21 +1187,26 @@ func (t *WSStream) writeChallenge(challenge *client.MFAAuthenticateChallenge, co
 	return trace.Wrap(t.ws.WriteMessage(websocket.BinaryMessage, msg))
 }
 
-// readChallenge reads and decodes the challenge response from the
+// readChallengeResponse reads and decodes the challenge response from the
 // websocket in the correct format.
-func (t *WSStream) readChallenge(codec mfaCodec) (*authproto.MFAAuthenticateResponse, error) {
-	// Read the challenge response.
-	ty, bytes, err := t.ws.ReadMessage()
-	if err != nil {
-		return nil, trace.Wrap(err)
+func (t *WSStream) readChallengeResponse(codec mfaCodec) (*authproto.MFAAuthenticateResponse, error) {
+	envelope, ok := <-t.challengeC
+	if !ok {
+		return nil, io.EOF
 	}
+	resp, err := codec.decodeResponse([]byte(envelope.Payload), defaults.WebsocketWebauthnChallenge)
+	return resp, trace.Wrap(err)
+}
 
-	if ty != websocket.BinaryMessage {
-		return nil, trace.BadParameter("expected websocket.BinaryMessage, got %v", ty)
+// readChallenge reads and decodes the challenge from the
+// websocket in the correct format.
+func (t *WSStream) readChallenge(codec mfaCodec) (*authproto.MFAAuthenticateChallenge, error) {
+	envelope, ok := <-t.challengeC
+	if !ok {
+		return nil, io.EOF
 	}
-
-	resp, err := codec.decode(bytes, defaults.WebsocketWebauthnChallenge)
-	return resp, trace.Wrap(err)
+	challenge, err := codec.decodeChallenge([]byte(envelope.Payload), defaults.WebsocketWebauthnChallenge)
+	return challenge, trace.Wrap(err)
 }
 
 // writeAuditEvent encodes and writes the audit event to the
@@ -1159,7 +1263,10 @@ func (t *WSStream) Write(data []byte) (n int, err error) {
 	return len(data), nil
 }
 
-func (t *WSStream) readMessage(out []byte) (string, []byte, int, error) {
+// Read provides data received from [defaults.WebsocketRaw] envelopes. If
+// the previous envelope was not consumed in the last read, any remaining data
+// is returned prior to processing the next envelope.
+func (t *WSStream) Read(out []byte) (int, error) {
 	if len(t.buffer) > 0 {
 		n := copy(out, t.buffer)
 		if n == len(t.buffer) {
@@ -1167,190 +1274,56 @@ func (t *WSStream) readMessage(out []byte) (string, []byte, int, error) {
 		} else {
 			t.buffer = t.buffer[n:]
 		}
-		return "", nil, n, nil
-	}
-
-	ty, bytes, err := t.ws.ReadMessage()
-	if err != nil {
-		// if the connection has closed, we must return io.EOF in order to abort
-		// the websocket copy loop
-		if errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) ||
-			websocket.IsCloseError(err, websocket.CloseAbnormalClosure, websocket.CloseGoingAway, websocket.CloseNormalClosure) {
-			return "", nil, 0, io.EOF
-		}
-
-		return "", nil, 0, trace.Wrap(err)
-	}
-
-	if ty != websocket.BinaryMessage {
-		return "", nil, 0, trace.BadParameter("expected binary message, got %v", ty)
-	}
-
-	var envelope Envelope
-	err = proto.Unmarshal(bytes, &envelope)
-	if err != nil {
-		return "", nil, 0, trace.Wrap(err)
-	}
-
-	var data []byte
-	data, err = t.decoder.Bytes([]byte(envelope.GetPayload()))
-	if err != nil {
-		return "", nil, 0, trace.Wrap(err)
-	}
-
-	return envelope.Type, data, 0, nil
-}
-
-// Read unwraps the envelope and either fills out the passed in bytes or
-// performs an action on the connection (sending window-change request).
-func (t *WSStream) Read(out []byte) (n int, err error) {
-	messageType, data, n, err := t.readMessage(out)
-	if err != nil || n > 0 {
-		return n, err
+		return n, nil
 	}
 
-	switch messageType {
-	// the session was closed
-	case defaults.WebsocketClose:
+	envelope, ok := <-t.rawC
+	if !ok {
 		return 0, io.EOF
-	case defaults.WebsocketRaw:
-		n := copy(out, data)
-		// if payload size is greater than [out], store the remaining
-		// part in the buffer to be processed on the next Read call
-		if len(data) > n {
-			t.buffer = data[n:]
-		}
-		return n, nil
-	default:
-		return 0, trace.BadParameter("unknown prefix type: %v", messageType)
 	}
-}
 
-func (t *TerminalStream) Read(out []byte) (n int, err error) {
-	messageType, data, n, err := t.readMessage(out)
-	if err != nil || n > 0 {
-		return n, err
+	data, err := t.decoder.Bytes([]byte(envelope.Payload))
+	if err != nil {
+		return 0, trace.Wrap(err)
 	}
 
-	switch messageType {
-	// the session was closed
-	case defaults.WebsocketClose:
-		return 0, io.EOF
-	case defaults.WebsocketRaw:
-		n := copy(out, data)
-		// if payload size is greater than [out], store the remaining
-		// part in the buffer to be processed on the next Read call
-		if len(data) > n {
-			t.buffer = data[n:]
-		}
-		return n, nil
-	case defaults.WebsocketResize:
-		if t.resizeC == nil {
-			return n, nil
-		}
-
-		var e events.EventFields
-		err := json.Unmarshal(data, &e)
-		if err != nil {
-			return 0, trace.Wrap(err)
-		}
-
-		params, err := session.UnmarshalTerminalParams(e.GetString("size"))
-		if err != nil {
-			return 0, trace.Wrap(err)
-		}
-
-		// Send the window change request in a goroutine so reads are not blocked
-		// by network connectivity issues.
-		select {
-		case t.resizeC <- params:
-		default:
-		}
-
-		return 0, nil
-	case defaults.WebsocketFileTransferDecision:
-		if t.fileTransferDecisionC == nil {
-			return n, nil
-		}
-		var e events.EventFields
-		err := json.Unmarshal(data, &e)
-		if err != nil {
-			return 0, trace.Wrap(err)
-		}
-		approved, ok := e["approved"].(bool)
-		if !ok {
-			return 0, trace.BadParameter("Unable to find approved status on response")
-		}
-		select {
-		case t.fileTransferDecisionC <- &session.FileTransferDecisionParams{
-			RequestID: e.GetString("requestId"),
-			Approved:  approved,
-		}:
-		default:
-		}
-		return 0, nil
-	case defaults.WebsocketFileTransferRequest:
-		if t.fileTransferRequestC == nil {
-			return n, nil
-		}
-		var e events.EventFields
-		err := json.Unmarshal(data, &e)
-		if err != nil {
-			return 0, trace.Wrap(err)
-		}
-		download, ok := e["download"].(bool)
-		if !ok {
-			return 0, trace.BadParameter("Unable to find download param in response")
-		}
-		select {
-		case t.fileTransferRequestC <- &session.FileTransferRequestParams{
-			Location: e.GetString("location"),
-			Download: download,
-			Filename: e.GetString("filename"),
-		}:
-		default:
-		}
-		return 0, nil
-	default:
-		return 0, trace.BadParameter("unknown prefix type: %v", messageType)
+	n := copy(out, data)
+	// if the payload size is greater than [out], store the remaining
+	// part in the buffer to be processed on the next Read call
+	if len(data) > n {
+		t.buffer = data[n:]
 	}
+	return n, nil
 }
 
-// Close sends a close message on the web socket and closes the web socket.
-func (t *WSStream) Close() error {
-	// Send close envelope to web terminal upon exit without an error.
+// SendCloseMessage sends a close message on the web socket.
+func (t *WSStream) SendCloseMessage() error {
 	envelope := &Envelope{
 		Version: defaults.WebsocketVersion,
 		Type:    defaults.WebsocketClose,
 	}
 	envelopeBytes, err := proto.Marshal(envelope)
 	if err != nil {
-		return trace.NewAggregate(err, t.ws.Close())
+		return trace.Wrap(err)
 	}
 
 	t.mu.Lock()
 	defer t.mu.Unlock()
-	return trace.NewAggregate(t.ws.WriteMessage(websocket.BinaryMessage, envelopeBytes), t.ws.Close())
+	return trace.Wrap(t.ws.WriteMessage(websocket.BinaryMessage, envelopeBytes))
 }
 
-// Close sends a close message on the web socket
-// prior to closing the web socket altogether.
-func (t *TerminalStream) Close() error {
+func (t *WSStream) close() {
 	t.once.Do(func() {
-		if t.resizeC != nil {
-			close(t.resizeC)
-		}
-
-		if t.fileTransferRequestC != nil {
-			close(t.fileTransferRequestC)
-		}
-
-		if t.fileTransferDecisionC != nil {
-			close(t.fileTransferDecisionC)
-		}
+		defer func() {
+			close(t.rawC)
+			close(t.challengeC)
+		}()
 	})
+}
 
-	return t.WSStream.Close()
+// Close sends a close message on the web socket and closes the web socket.
+func (t *WSStream) Close() error {
+	return trace.Wrap(t.ws.Close())
 }
 
 // deadlineForInterval returns a suitable network read deadline for a given ping interval.
diff --git a/lib/web/terminal_test.go b/lib/web/terminal_test.go
index 816a07e50174d..884613d0a04f8 100644
--- a/lib/web/terminal_test.go
+++ b/lib/web/terminal_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package web_test
 
 import (
+	"context"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -28,6 +29,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/web"
 )
 
@@ -62,12 +64,11 @@ func TestTerminalReadFromClosedConn(t *testing.T) {
 	require.NoError(t, err)
 	defer resp.Body.Close()
 
-	stream, err := web.NewTerminalStream(conn)
-	require.NoError(t, err)
+	stream := web.NewTerminalStream(context.Background(), conn, utils.NewLoggerForTests())
 
 	// close the stream before we attempt to read from it,
 	// this will produce a net.ErrClosed error on the read
-	stream.Close()
+	require.NoError(t, stream.Close())
 
 	_, err = io.Copy(io.Discard, stream)
 	require.NoError(t, err)
diff --git a/lib/web/ui/app.go b/lib/web/ui/app.go
index 9e5efa9a37ede..d6e856e22bac0 100644
--- a/lib/web/ui/app.go
+++ b/lib/web/ui/app.go
@@ -20,6 +20,7 @@ import (
 	"fmt"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils/aws"
 )
@@ -44,6 +45,18 @@ type App struct {
 	AWSConsole bool `json:"awsConsole"`
 	// AWSRoles is a list of AWS IAM roles for the application representing AWS console.
 	AWSRoles []aws.Role `json:"awsRoles,omitempty"`
+	// FriendlyName is a friendly name for the app.
+	FriendlyName string `json:"friendlyName,omitempty"`
+	// UserGroups is a list of associated user groups.
+	UserGroups []UserGroupAndDescription `json:"userGroups,omitempty"`
+}
+
+// UserGroupAndDescription is a user group name and its description.
+type UserGroupAndDescription struct {
+	// Name is the name of the user group.
+	Name string `json:"name"`
+	// Description is the description of the user group.
+	Description string `json:"description"`
 }
 
 // MakeAppsConfig contains parameters for converting apps to UI representation.
@@ -56,6 +69,8 @@ type MakeAppsConfig struct {
 	AppClusterName string
 	// Apps is a list of registered apps.
 	Apps types.Apps
+	// AppsToUserGroups is a mapping of application names to user groups.
+	AppsToUserGroups map[string]types.UserGroups
 	// Identity is identity of the logged in user.
 	Identity *tlsca.Identity
 }
@@ -67,15 +82,27 @@ func MakeApps(c MakeAppsConfig) []App {
 		fqdn := AssembleAppFQDN(c.LocalClusterName, c.LocalProxyDNSName, c.AppClusterName, teleApp)
 		labels := makeLabels(teleApp.GetAllLabels())
 
+		userGroups := c.AppsToUserGroups[teleApp.GetName()]
+
+		userGroupAndDescriptions := make([]UserGroupAndDescription, len(userGroups))
+		for i, userGroup := range userGroups {
+			userGroupAndDescriptions[i] = UserGroupAndDescription{
+				Name:        userGroup.GetName(),
+				Description: userGroup.GetMetadata().Description,
+			}
+		}
+
 		app := App{
-			Name:        teleApp.GetName(),
-			Description: teleApp.GetDescription(),
-			URI:         teleApp.GetURI(),
-			PublicAddr:  teleApp.GetPublicAddr(),
-			Labels:      labels,
-			ClusterID:   c.AppClusterName,
-			FQDN:        fqdn,
-			AWSConsole:  teleApp.IsAWSConsole(),
+			Name:         teleApp.GetName(),
+			Description:  teleApp.GetDescription(),
+			URI:          teleApp.GetURI(),
+			PublicAddr:   teleApp.GetPublicAddr(),
+			Labels:       labels,
+			ClusterID:    c.AppClusterName,
+			FQDN:         fqdn,
+			AWSConsole:   teleApp.IsAWSConsole(),
+			FriendlyName: services.FriendlyName(teleApp),
+			UserGroups:   userGroupAndDescriptions,
 		}
 
 		if teleApp.IsAWSConsole() {
diff --git a/lib/web/ui/app_test.go b/lib/web/ui/app_test.go
index 71f07c1e17dfd..620b78bc8669a 100644
--- a/lib/web/ui/app_test.go
+++ b/lib/web/ui/app_test.go
@@ -19,6 +19,7 @@ package ui
 import (
 	"testing"
 
+	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
@@ -74,3 +75,124 @@ func TestMakeAppsLabelFilter(t *testing.T) {
 		})
 	}
 }
+
+func TestMakeApps(t *testing.T) {
+	tests := []struct {
+		name             string
+		apps             types.Apps
+		appsToUserGroups map[string]types.UserGroups
+		expected         []App
+	}{
+		{
+			name:     "empty",
+			expected: []App{},
+		},
+		{
+			name: "app without user groups",
+			apps: types.Apps{
+				newApp(t, "1", "1.com", "", map[string]string{"label1": "value1"}),
+				newApp(t, "2", "2.com", "group 2 friendly name", map[string]string{"label2": "value2", types.OriginLabel: types.OriginOkta}),
+			},
+			expected: []App{
+				{
+					Name:       "1",
+					URI:        "1.com",
+					PublicAddr: "1.com",
+					FQDN:       "1.com",
+					Labels:     []Label{{Name: "label1", Value: "value1"}},
+					UserGroups: []UserGroupAndDescription{},
+				},
+				{
+					Name:        "2",
+					Description: "group 2 friendly name",
+					URI:         "2.com",
+					PublicAddr:  "2.com",
+					FQDN:        "2.com",
+					Labels: []Label{
+						{Name: "label2", Value: "value2"},
+						{Name: types.OriginLabel, Value: types.OriginOkta},
+					},
+					FriendlyName: "group 2 friendly name",
+					UserGroups:   []UserGroupAndDescription{},
+				},
+			},
+		},
+		{
+			name: "app with user groups",
+			apps: types.Apps{
+				newApp(t, "1", "1.com", "", map[string]string{"label1": "value1"}),
+				newApp(t, "2", "2.com", "group 2 friendly name", map[string]string{"label2": "value2", types.OriginLabel: types.OriginOkta}),
+			},
+			appsToUserGroups: map[string]types.UserGroups{
+				"1": {
+					newGroup(t, "group1", "group1 desc", nil),
+					newGroup(t, "group2", "group2 desc", nil),
+				},
+				"2": {
+					newGroup(t, "group2", "group2 desc", nil),
+					newGroup(t, "group3", "group3 desc", nil),
+				},
+				// This will be ignored
+				"3": {
+					newGroup(t, "group3", "group3 desc", nil),
+				},
+			},
+			expected: []App{
+				{
+					Name:       "1",
+					URI:        "1.com",
+					PublicAddr: "1.com",
+					FQDN:       "1.com",
+					Labels:     []Label{{Name: "label1", Value: "value1"}},
+					UserGroups: []UserGroupAndDescription{
+						{Name: "group1", Description: "group1 desc"},
+						{Name: "group2", Description: "group2 desc"},
+					},
+				},
+				{
+					Name:        "2",
+					Description: "group 2 friendly name",
+					URI:         "2.com",
+					PublicAddr:  "2.com",
+					FQDN:        "2.com",
+					Labels: []Label{
+						{Name: "label2", Value: "value2"},
+						{Name: types.OriginLabel, Value: types.OriginOkta},
+					},
+					FriendlyName: "group 2 friendly name",
+					UserGroups: []UserGroupAndDescription{
+						{Name: "group2", Description: "group2 desc"},
+						{Name: "group3", Description: "group3 desc"},
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			apps := MakeApps(MakeAppsConfig{
+				Apps:             test.apps,
+				AppsToUserGroups: test.appsToUserGroups,
+			})
+
+			require.Empty(t, cmp.Diff(test.expected, apps))
+		})
+	}
+}
+
+func newApp(t *testing.T, name, publicAddr, description string, labels map[string]string) types.Application {
+	app, err := types.NewAppV3(types.Metadata{
+		Name:        name,
+		Description: description,
+		Labels:      labels,
+	}, types.AppSpecV3{
+		URI:        publicAddr,
+		PublicAddr: publicAddr,
+	})
+	require.NoError(t, err)
+	return app
+}
diff --git a/lib/web/ui/cluster.go b/lib/web/ui/cluster.go
index e5656c0538e20..9e3015b99b40d 100644
--- a/lib/web/ui/cluster.go
+++ b/lib/web/ui/cluster.go
@@ -25,7 +25,7 @@ import (
 
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 )
 
@@ -50,7 +50,7 @@ type Cluster struct {
 }
 
 // NewClusters creates a slice of Cluster's, containing data about each cluster.
-func NewClusters(remoteClusters []reversetunnel.RemoteSite) ([]Cluster, error) {
+func NewClusters(remoteClusters []reversetunnelclient.RemoteSite) ([]Cluster, error) {
 	clusters := make([]Cluster, 0, len(remoteClusters))
 	for _, site := range remoteClusters {
 		// Other fields such as node count, url, and proxy/auth versions are not set
@@ -87,7 +87,7 @@ func NewClustersFromRemote(remoteClusters []types.RemoteCluster) ([]Cluster, err
 }
 
 // GetClusterDetails retrieves and sets details about a cluster
-func GetClusterDetails(ctx context.Context, site reversetunnel.RemoteSite, opts ...services.MarshalOption) (*Cluster, error) {
+func GetClusterDetails(ctx context.Context, site reversetunnelclient.RemoteSite, opts ...services.MarshalOption) (*Cluster, error) {
 	clt, err := site.CachingAccessPoint()
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/web/ui/integration.go b/lib/web/ui/integration.go
index d795ba7451fd8..0f42452f5bb89 100644
--- a/lib/web/ui/integration.go
+++ b/lib/web/ui/integration.go
@@ -126,3 +126,56 @@ type AWSOIDCListDatabasesResponse struct {
 	// If non-empty, it can be used to request the next page.
 	NextToken string `json:"nextToken,omitempty"`
 }
+
+// AWSOIDCDeployServiceRequest contains the required fields to perform a DeployService request.
+type AWSOIDCDeployServiceRequest struct {
+	// Region is the AWS Region for the Service.
+	Region string `json:"region"`
+
+	// SubnetIDs associated with the Service.
+	// If deploying a Database Service, you should use the SubnetIDs returned by the List Database API call.
+	SubnetIDs []string `json:"subnetIds"`
+
+	// ClusterName is the ECS Cluster to be used.
+	// Optional.
+	// Defaults to <teleport-cluster-name>-teleport, eg. acme-teleport
+	ClusterName *string `json:"clusterName"`
+
+	// ServiceName is the ECS Service that should be used.
+	// Optional.
+	// Defaults to <teleport-cluster-name>-teleport-service, eg acme-teleport-service
+	ServiceName *string `json:"serviceName"`
+
+	// TaskName is the ECS Task Definition family name.
+	// Optional.
+	// Defaults to <teleport-cluster-name>-teleport-<deployment-mode>, eg acme-teleport-database-service
+	TaskName *string `json:"taskName"`
+
+	// TaskRoleARN is the AWS Role's ARN used within the Task execution.
+	// Ensure the AWS Client's Role has `iam:PassRole` for this Role's ARN.
+	// This can be either the ARN or the short name of the AWS Role.
+	TaskRoleARN string `json:"taskRoleArn"`
+
+	// DeploymentMode is the deployment configuration for the service.
+	// This indicates what set of services should be deployed.
+	DeploymentMode string `json:"deploymentMode"`
+
+	// DatabaseAgentMatcherLabels are the labels to be used when deploying a Database Service.
+	// Those are the resource labels that the Service will monitor and proxy connections to.
+	DatabaseAgentMatcherLabels []Label `json:"databaseAgentMatcherLabels"`
+}
+
+// AWSOIDCDeployServiceResponse contains the resources that were used to deploy a Teleport Service.
+type AWSOIDCDeployServiceResponse struct {
+	// ClusterARN is the Amazon ECS Cluster ARN where the task was started.
+	ClusterARN string `json:"clusterArn"`
+
+	// ServiceARN is the Amazon ECS Cluster Service ARN created to run the task.
+	ServiceARN string `json:"serviceArn"`
+
+	// TaskDefinitionARN is the Amazon ECS Task Definition ARN created to run the Service.
+	TaskDefinitionARN string `json:"taskDefinitionArn"`
+
+	// ServiceDashboardURL is a link to the service's Dashboard URL in Amazon Console.
+	ServiceDashboardURL string `json:"serviceDashboardUrl"`
+}
diff --git a/lib/web/ui/perf_test.go b/lib/web/ui/perf_test.go
index d77f1d7e6a667..a781eb262cbd9 100644
--- a/lib/web/ui/perf_test.go
+++ b/lib/web/ui/perf_test.go
@@ -31,7 +31,7 @@ import (
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/memory"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/local"
 )
@@ -133,9 +133,9 @@ func insertServers(ctx context.Context, b *testing.B, svc services.Presence, kin
 		case types.KindNode:
 			_, err = svc.UpsertNode(ctx, server)
 		case types.KindProxy:
-			err = svc.UpsertProxy(server)
+			err = svc.UpsertProxy(ctx, server)
 		case types.KindAuthServer:
-			err = svc.UpsertAuthServer(server)
+			err = svc.UpsertAuthServer(ctx, server)
 		default:
 			b.Errorf("Unexpected server kind: %s", kind)
 		}
@@ -143,7 +143,7 @@ func insertServers(ctx context.Context, b *testing.B, svc services.Presence, kin
 	}
 }
 
-func benchmarkGetClusterDetails(ctx context.Context, b *testing.B, site reversetunnel.RemoteSite, nodes int, opts ...services.MarshalOption) {
+func benchmarkGetClusterDetails(ctx context.Context, b *testing.B, site reversetunnelclient.RemoteSite, nodes int, opts ...services.MarshalOption) {
 	var cluster *Cluster
 	var err error
 	for i := 0; i < b.N; i++ {
@@ -155,7 +155,7 @@ func benchmarkGetClusterDetails(ctx context.Context, b *testing.B, site reverset
 }
 
 type mockRemoteSite struct {
-	reversetunnel.RemoteSite
+	reversetunnelclient.RemoteSite
 	accessPoint auth.ProxyAccessPoint
 }
 
diff --git a/lib/web/ui/resource.go b/lib/web/ui/resource.go
index a3d349256ed03..c8137fc833745 100644
--- a/lib/web/ui/resource.go
+++ b/lib/web/ui/resource.go
@@ -62,6 +62,11 @@ func NewResourceItem(resource types.Resource) (*ResourceItem, error) {
 func NewRoles(roles []types.Role) ([]ResourceItem, error) {
 	items := make([]ResourceItem, 0, len(roles))
 	for _, role := range roles {
+		// filter out system roles from web UI
+		if types.IsSystemResource(role) {
+			continue
+		}
+
 		item, err := NewResourceItem(role)
 		if err != nil {
 			return nil, trace.Wrap(err)
diff --git a/lib/web/ui/server.go b/lib/web/ui/server.go
index 27c6273c02fb9..6a6ce478ac450 100644
--- a/lib/web/ui/server.go
+++ b/lib/web/ui/server.go
@@ -70,14 +70,14 @@ func (s sortedLabels) Swap(i, j int) {
 }
 
 // MakeServers creates server objects for webapp
-func MakeServers(clusterName string, servers []types.Server, userRoles services.RoleSet) ([]Server, error) {
+func MakeServers(clusterName string, servers []types.Server, accessChecker services.AccessChecker) ([]Server, error) {
 	uiServers := []Server{}
 	for _, server := range servers {
 		serverLabels := server.GetStaticLabels()
 		serverCmdLabels := server.GetCmdLabels()
 		uiLabels := makeLabels(serverLabels, transformCommandLabels(serverCmdLabels))
 
-		serverLogins, err := userRoles.GetAllowedLoginsForResource(server)
+		serverLogins, err := accessChecker.GetAllowedLoginsForResource(server)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -109,14 +109,14 @@ type KubeCluster struct {
 }
 
 // MakeKubeClusters creates ui kube objects and returns a list.
-func MakeKubeClusters(clusters []types.KubeCluster, userRoles services.RoleSet) []KubeCluster {
+func MakeKubeClusters(clusters []types.KubeCluster, accessChecker services.AccessChecker) []KubeCluster {
 	uiKubeClusters := make([]KubeCluster, 0, len(clusters))
 	for _, cluster := range clusters {
 		staticLabels := cluster.GetStaticLabels()
 		dynamicLabels := cluster.GetDynamicLabels()
 		uiLabels := makeLabels(staticLabels, transformCommandLabels(dynamicLabels))
 
-		kubeUsers, kubeGroups := getAllowedKubeUsersAndGroupsForCluster(userRoles, cluster)
+		kubeUsers, kubeGroups := getAllowedKubeUsersAndGroupsForCluster(accessChecker, cluster)
 
 		uiKubeClusters = append(uiKubeClusters, KubeCluster{
 			Name:       cluster.GetName(),
@@ -170,14 +170,14 @@ func MakeKubeResources(resources []*types.KubernetesResourceV1, cluster string)
 // This function ignores any verification of the TTL associated with
 // each Role, and focuses only on listing all users and groups that the user may
 // have access to.
-func getAllowedKubeUsersAndGroupsForCluster(roles services.RoleSet, kube types.KubeCluster) (kubeUsers []string, kubeGroups []string) {
-	matcher := services.NewKubernetesClusterLabelMatcher(kube.GetAllLabels())
+func getAllowedKubeUsersAndGroupsForCluster(accessChecker services.AccessChecker, kube types.KubeCluster) (kubeUsers []string, kubeGroups []string) {
+	matcher := services.NewKubernetesClusterLabelMatcher(kube.GetAllLabels(), accessChecker.Traits())
 	// We ignore the TTL verification because we want to include every possibility.
 	// Later, if the user certificate expiration is longer than the maximum allowed TTL
 	// for the role that defines the `kubernetes_*` principals the request will be
 	// denied by Kubernetes Service.
 	// We ignore the returning error since we are only interested in allowed users and groups.
-	kubeGroups, kubeUsers, _ = roles.CheckKubeGroupsAndUsers(0, true /* force ttl override*/, matcher)
+	kubeGroups, kubeUsers, _ = accessChecker.CheckKubeGroupsAndUsers(0, true /* force ttl override*/, matcher)
 	return
 }
 
@@ -347,7 +347,7 @@ type Desktop struct {
 }
 
 // MakeDesktop converts a desktop from its API form to a type the UI can display.
-func MakeDesktop(windowsDesktop types.WindowsDesktop, userRoles services.RoleSet) (Desktop, error) {
+func MakeDesktop(windowsDesktop types.WindowsDesktop, accessChecker services.AccessChecker) (Desktop, error) {
 	// stripRdpPort strips the default rdp port from an ip address since it is unimportant to display
 	stripRdpPort := func(addr string) string {
 		splitAddr := strings.Split(addr, ":")
@@ -359,7 +359,7 @@ func MakeDesktop(windowsDesktop types.WindowsDesktop, userRoles services.RoleSet
 
 	uiLabels := makeLabels(windowsDesktop.GetAllLabels())
 
-	logins, err := userRoles.GetAllowedLoginsForResource(windowsDesktop)
+	logins, err := accessChecker.GetAllowedLoginsForResource(windowsDesktop)
 	if err != nil {
 		return Desktop{}, trace.Wrap(err)
 	}
@@ -375,11 +375,11 @@ func MakeDesktop(windowsDesktop types.WindowsDesktop, userRoles services.RoleSet
 }
 
 // MakeDesktops converts desktops from their API form to a type the UI can display.
-func MakeDesktops(windowsDesktops []types.WindowsDesktop, userRoles services.RoleSet) ([]Desktop, error) {
+func MakeDesktops(windowsDesktops []types.WindowsDesktop, accessChecker services.AccessChecker) ([]Desktop, error) {
 	uiDesktops := make([]Desktop, 0, len(windowsDesktops))
 
 	for _, windowsDesktop := range windowsDesktops {
-		uiDesktop, err := MakeDesktop(windowsDesktop, userRoles)
+		uiDesktop, err := MakeDesktop(windowsDesktop, accessChecker)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/web/ui/server_test.go b/lib/web/ui/server_test.go
index 1fc10aa80a1c5..2f693fc384d48 100644
--- a/lib/web/ui/server_test.go
+++ b/lib/web/ui/server_test.go
@@ -311,7 +311,8 @@ func TestGetAllowedKubeUsersAndGroupsForCluster(t *testing.T) {
 	}
 	for _, tc := range tt[:1] {
 		t.Run(tc.name, func(t *testing.T) {
-			users, groups := getAllowedKubeUsersAndGroupsForCluster(tc.roleSet, tc.cluster)
+			accessChecker := services.NewAccessCheckerWithRoleSet(&services.AccessInfo{}, "clustername", tc.roleSet)
+			users, groups := getAllowedKubeUsersAndGroupsForCluster(accessChecker, tc.cluster)
 			require.Equal(t, tc.expectedUsers, users)
 			require.Equal(t, tc.expectedGroups, groups)
 		})
@@ -361,7 +362,8 @@ func TestMakeClusterHiddenLabels(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			clusters := MakeKubeClusters(tc.clusters, tc.roleSet)
+			accessChecker := services.NewAccessCheckerWithRoleSet(&services.AccessInfo{}, "clusterName", tc.roleSet)
+			clusters := MakeKubeClusters(tc.clusters, accessChecker)
 			for i, cluster := range clusters {
 				require.Equal(t, tc.expectedLabels[i], cluster.Labels)
 			}
@@ -401,7 +403,8 @@ func TestMakeServersHiddenLabels(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			servers, err := MakeServers(tc.clusterName, tc.servers, tc.roleSet)
+			accessChecker := services.NewAccessCheckerWithRoleSet(&services.AccessInfo{}, "clustername", tc.roleSet)
+			servers, err := MakeServers(tc.clusterName, tc.servers, accessChecker)
 			require.NoError(t, err)
 			for i, server := range servers {
 				require.Equal(t, tc.expectedLabels[i], server.Labels)
@@ -448,7 +451,8 @@ func TestMakeDesktopHiddenLabel(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	desktop, err := MakeDesktop(windowsDesktop, services.NewRoleSet())
+	accessChecker := services.NewAccessCheckerWithRoleSet(&services.AccessInfo{}, "clustername", services.RoleSet{})
+	desktop, err := MakeDesktop(windowsDesktop, accessChecker)
 	require.NoError(t, err)
 	labels := []Label{
 		{
diff --git a/lib/web/ui/user_groups.go b/lib/web/ui/user_groups.go
index 8c44f69e31ab4..bb9b67bffc41e 100644
--- a/lib/web/ui/user_groups.go
+++ b/lib/web/ui/user_groups.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2015 Gravitational, Inc.
+Copyright 2023 Gravitational, Inc.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -29,18 +29,41 @@ type UserGroup struct {
 	Description string `json:"description"`
 	// Labels is the user group list of labels
 	Labels []Label `json:"labels"`
+	// FriendlyName is a friendly name for the user group.
+	FriendlyName string `json:"friendlyName,omitempty"`
+	// Applications is a list of associated applications.
+	Applications []ApplicationAndFriendlyName `json:"applications,omitempty"`
+}
+
+// ApplicationAndFriendlyName is an application name and its friendly name.
+type ApplicationAndFriendlyName struct {
+	// Name is the name of the application.
+	Name string `json:"name"`
+	// FriendlyName is the friendly name of the application.
+	FriendlyName string `json:"friendlyName"`
 }
 
 // MakeUserGroups creates user group objects for the UI.
-func MakeUserGroups(clusterName string, userGroups []types.UserGroup, userRoles services.RoleSet) ([]UserGroup, error) {
+func MakeUserGroups(userGroups []types.UserGroup, userGroupsToApps map[string]types.Apps) ([]UserGroup, error) {
 	uiUserGroups := []UserGroup{}
 	for _, userGroup := range userGroups {
 		uiLabels := makeLabels(userGroup.GetStaticLabels())
 
+		apps := userGroupsToApps[userGroup.GetName()]
+		appsAndFriendlyNames := make([]ApplicationAndFriendlyName, len(apps))
+		for i, app := range apps {
+			appsAndFriendlyNames[i] = ApplicationAndFriendlyName{
+				Name:         app.GetName(),
+				FriendlyName: services.FriendlyName(app),
+			}
+		}
+
 		uiUserGroups = append(uiUserGroups, UserGroup{
-			Name:        userGroup.GetName(),
-			Description: userGroup.GetMetadata().Description,
-			Labels:      uiLabels,
+			Name:         userGroup.GetName(),
+			Description:  userGroup.GetMetadata().Description,
+			Labels:       uiLabels,
+			FriendlyName: services.FriendlyName(userGroup),
+			Applications: appsAndFriendlyNames,
 		})
 	}
 
diff --git a/lib/web/ui/user_groups_test.go b/lib/web/ui/user_groups_test.go
new file mode 100644
index 0000000000000..c0941c10a346d
--- /dev/null
+++ b/lib/web/ui/user_groups_test.go
@@ -0,0 +1,131 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ui
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+)
+
+func TestMakeUserGroups(t *testing.T) {
+	tests := []struct {
+		name             string
+		userGroups       types.UserGroups
+		userGroupsToApps map[string]types.Apps
+		expected         []UserGroup
+	}{
+		{
+			name:     "empty",
+			expected: []UserGroup{},
+		},
+		{
+			name: "user groups with no apps",
+			userGroups: types.UserGroups{
+				newGroup(t, "group1", "group1 desc", map[string]string{"label1": "value1"}),
+				newGroup(t, "group2", "group2 desc", map[string]string{"label2": "value2", types.OriginLabel: types.OriginOkta}),
+			},
+			expected: []UserGroup{
+				{
+					Name:         "group1",
+					Description:  "group1 desc",
+					Labels:       []Label{{Name: "label1", Value: "value1"}},
+					Applications: []ApplicationAndFriendlyName{},
+				},
+				{
+					Name:         "group2",
+					Description:  "group2 desc",
+					FriendlyName: "group2 desc",
+					Labels: []Label{
+						{Name: "label2", Value: "value2"},
+						{Name: types.OriginLabel, Value: types.OriginOkta},
+					},
+					Applications: []ApplicationAndFriendlyName{},
+				},
+			},
+		},
+		{
+			name: "user groups with apps",
+			userGroups: types.UserGroups{
+				newGroup(t, "group1", "group1 desc", map[string]string{"label1": "value1"}),
+				newGroup(t, "group2", "group2 desc", map[string]string{"label2": "value2", types.OriginLabel: types.OriginOkta}),
+			},
+			userGroupsToApps: map[string]types.Apps{
+				"group1": {
+					newApp(t, "1", "1.com", "1 desc", nil),
+					newApp(t, "2", "2.com", "2 desc", map[string]string{types.OriginLabel: types.OriginOkta}),
+				},
+				"group2": {
+					newApp(t, "2", "2.com", "2 desc", map[string]string{types.OriginLabel: types.OriginOkta}),
+					newApp(t, "3", "3.com", "3 desc", nil),
+				},
+				// This should be ignored
+				"group3": {
+					newApp(t, "3", "3.com", "3 desc", nil),
+				},
+			},
+			expected: []UserGroup{
+				{
+					Name:        "group1",
+					Description: "group1 desc",
+					Labels:      []Label{{Name: "label1", Value: "value1"}},
+					Applications: []ApplicationAndFriendlyName{
+						{Name: "1"},
+						{Name: "2", FriendlyName: "2 desc"},
+					},
+				},
+				{
+					Name:         "group2",
+					Description:  "group2 desc",
+					FriendlyName: "group2 desc",
+					Labels: []Label{
+						{Name: "label2", Value: "value2"},
+						{Name: types.OriginLabel, Value: types.OriginOkta},
+					},
+					Applications: []ApplicationAndFriendlyName{
+						{Name: "2", FriendlyName: "2 desc"},
+						{Name: "3"},
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			userGroups, err := MakeUserGroups(test.userGroups, test.userGroupsToApps)
+			require.NoError(t, err)
+			require.Empty(t, cmp.Diff(test.expected, userGroups))
+		})
+	}
+}
+
+func newGroup(t *testing.T, name, description string, labels map[string]string) types.UserGroup {
+	userGroup, err := types.NewUserGroup(types.Metadata{
+		Name:        name,
+		Description: description,
+		Labels:      labels,
+	}, types.UserGroupSpecV1{})
+	require.NoError(t, err)
+	return userGroup
+}
diff --git a/lib/web/ui/usercontext.go b/lib/web/ui/usercontext.go
index 79d985be2199f..62c379f92a728 100644
--- a/lib/web/ui/usercontext.go
+++ b/lib/web/ui/usercontext.go
@@ -18,20 +18,10 @@ package ui
 
 import (
 	"github.com/gravitational/teleport/api/client/proto"
-	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/services"
 )
 
-type access struct {
-	List   bool `json:"list"`
-	Read   bool `json:"read"`
-	Edit   bool `json:"edit"`
-	Create bool `json:"create"`
-	Delete bool `json:"remove"`
-	Use    bool `json:"use"`
-}
-
 type accessStrategy struct {
 	// Type determines how a user should access teleport resources.
 	// ie: does the user require a request to access resources?
@@ -49,63 +39,6 @@ type AccessCapabilities struct {
 	SuggestedReviewers []string `json:"suggestedReviewers"`
 }
 
-type userACL struct {
-	// RecordedSessions defines access to recorded sessions.
-	RecordedSessions access `json:"recordedSessions"`
-	// ActiveSessions defines access to active sessions.
-	ActiveSessions access `json:"activeSessions"`
-	// AuthConnectors defines access to auth.connectors.
-	AuthConnectors access `json:"authConnectors"`
-	// Roles defines access to roles.
-	Roles access `json:"roles"`
-	// Users defines access to users.
-	Users access `json:"users"`
-	// TrustedClusters defines access to trusted clusters.
-	TrustedClusters access `json:"trustedClusters"`
-	// Events defines access to audit logs.
-	Events access `json:"events"`
-	// Tokens defines access to tokens.
-	Tokens access `json:"tokens"`
-	// Nodes defines access to nodes.
-	Nodes access `json:"nodes"`
-	// AppServers defines access to application servers
-	AppServers access `json:"appServers"`
-	// DBServers defines access to database servers.
-	DBServers access `json:"dbServers"`
-	// DB defines access to database resource.
-	DB access `json:"db"`
-	// KubeServers defines access to kubernetes servers.
-	KubeServers access `json:"kubeServers"`
-	// Desktops defines access to desktops.
-	Desktops access `json:"desktops"`
-	// AccessRequests defines access to access requests.
-	AccessRequests access `json:"accessRequests"`
-	// Billing defines access to billing information.
-	Billing access `json:"billing"`
-	// ConnectionDiagnostic defines access to connection diagnostics.
-	ConnectionDiagnostic access `json:"connectionDiagnostic"`
-	// Clipboard defines whether the user can use a shared clipboard during windows desktop sessions.
-	Clipboard bool `json:"clipboard"`
-	// DesktopSessionRecording defines whether the user's desktop sessions are being recorded.
-	DesktopSessionRecording bool `json:"desktopSessionRecording"`
-	// DirectorySharing defines whether a user is permitted to share a directory during windows desktop sessions.
-	DirectorySharing bool `json:"directorySharing"`
-	// Download defines whether the user has access to download Teleport Enterprise Binaries
-	Download access `json:"download"`
-	// Download defines whether the user has access to download the license
-	License access `json:"license"`
-	// Plugins defines whether the user has access to manage hosted plugin instances
-	Plugins access `json:"plugins"`
-	// Integrations defines whether the user has access to manage integrations.
-	Integrations access `json:"integrations"`
-	// DeviceTrust defines access to device trust.
-	DeviceTrust access `json:"deviceTrust"`
-	// Locks defines access to locking resources.
-	Locks access `json:"lock"`
-	// Assist defines access to assist feature.
-	Assist access `json:"assist"`
-}
-
 type authType string
 
 const (
@@ -120,7 +53,7 @@ type UserContext struct {
 	// Name is this user name.
 	Name string `json:"userName"`
 	// ACL contains user access control list.
-	ACL userACL `json:"userAcl"`
+	ACL services.UserACL `json:"userAcl"`
 	// Cluster contains cluster detail for this user's context.
 	Cluster *Cluster `json:"cluster"`
 	// AccessStrategy describes how a user should access teleport resources.
@@ -132,28 +65,6 @@ type UserContext struct {
 	ConsumedAccessRequestID string `json:"accessRequestId,omitempty"`
 }
 
-func hasAccess(roleSet services.RoleSet, ctx *services.Context, kind string, verbs ...string) bool {
-	for _, verb := range verbs {
-		// Since this check occurs often and does not imply the caller is trying to
-		// access any resource, silence any logging done on the proxy.
-		if err := roleSet.GuessIfAccessIsPossible(ctx, apidefaults.Namespace, kind, verb, true); err != nil {
-			return false
-		}
-	}
-	return true
-}
-
-func newAccess(roleSet services.RoleSet, ctx *services.Context, kind string) access {
-	return access{
-		List:   hasAccess(roleSet, ctx, kind, types.VerbList),
-		Read:   hasAccess(roleSet, ctx, kind, types.VerbRead),
-		Edit:   hasAccess(roleSet, ctx, kind, types.VerbUpdate),
-		Create: hasAccess(roleSet, ctx, kind, types.VerbCreate),
-		Delete: hasAccess(roleSet, ctx, kind, types.VerbDelete),
-		Use:    hasAccess(roleSet, ctx, kind, types.VerbUse),
-	}
-}
-
 func getAccessStrategy(roleset services.RoleSet) accessStrategy {
 	strategy := types.RequestStrategyOptional
 	prompt := ""
@@ -180,78 +91,8 @@ func getAccessStrategy(roleset services.RoleSet) accessStrategy {
 
 // NewUserContext returns user context
 func NewUserContext(user types.User, userRoles services.RoleSet, features proto.Features, desktopRecordingEnabled bool) (*UserContext, error) {
-	ctx := &services.Context{User: user}
-	recordedSessionAccess := newAccess(userRoles, ctx, types.KindSession)
-	activeSessionAccess := newAccess(userRoles, ctx, types.KindSSHSession)
-	roleAccess := newAccess(userRoles, ctx, types.KindRole)
-	authConnectors := newAccess(userRoles, ctx, types.KindAuthConnector)
-	trustedClusterAccess := newAccess(userRoles, ctx, types.KindTrustedCluster)
-	eventAccess := newAccess(userRoles, ctx, types.KindEvent)
-	userAccess := newAccess(userRoles, ctx, types.KindUser)
-	tokenAccess := newAccess(userRoles, ctx, types.KindToken)
-	nodeAccess := newAccess(userRoles, ctx, types.KindNode)
-	appServerAccess := newAccess(userRoles, ctx, types.KindAppServer)
-	dbServerAccess := newAccess(userRoles, ctx, types.KindDatabaseServer)
-	dbAccess := newAccess(userRoles, ctx, types.KindDatabase)
-	kubeServerAccess := newAccess(userRoles, ctx, types.KindKubeServer)
-	requestAccess := newAccess(userRoles, ctx, types.KindAccessRequest)
-	desktopAccess := newAccess(userRoles, ctx, types.KindWindowsDesktop)
-	cnDiagnosticAccess := newAccess(userRoles, ctx, types.KindConnectionDiagnostic)
-
-	var assistAccess access
-	if features.Assist {
-		assistAccess = newAccess(userRoles, ctx, types.KindAssistant)
-	}
-
-	var billingAccess access
-	if features.Cloud {
-		billingAccess = newAccess(userRoles, ctx, types.KindBilling)
-	}
-
-	var pluginsAccess access
-	if features.Plugins {
-		pluginsAccess = newAccess(userRoles, ctx, types.KindPlugin)
-	}
-
+	acl := services.NewUserACL(user, userRoles, features, desktopRecordingEnabled)
 	accessStrategy := getAccessStrategy(userRoles)
-	clipboard := userRoles.DesktopClipboard()
-	desktopSessionRecording := desktopRecordingEnabled && userRoles.RecordDesktopSession()
-	directorySharing := userRoles.DesktopDirectorySharing()
-	download := newAccess(userRoles, ctx, types.KindDownload)
-	license := newAccess(userRoles, ctx, types.KindLicense)
-	deviceTrust := newAccess(userRoles, ctx, types.KindDevice)
-	integrationsAccess := newAccess(userRoles, ctx, types.KindIntegration)
-	lockAccess := newAccess(userRoles, ctx, types.KindLock)
-
-	acl := userACL{
-		AccessRequests:          requestAccess,
-		AppServers:              appServerAccess,
-		DBServers:               dbServerAccess,
-		DB:                      dbAccess,
-		KubeServers:             kubeServerAccess,
-		Desktops:                desktopAccess,
-		AuthConnectors:          authConnectors,
-		TrustedClusters:         trustedClusterAccess,
-		RecordedSessions:        recordedSessionAccess,
-		ActiveSessions:          activeSessionAccess,
-		Roles:                   roleAccess,
-		Events:                  eventAccess,
-		Users:                   userAccess,
-		Tokens:                  tokenAccess,
-		Nodes:                   nodeAccess,
-		Billing:                 billingAccess,
-		ConnectionDiagnostic:    cnDiagnosticAccess,
-		Clipboard:               clipboard,
-		DesktopSessionRecording: desktopSessionRecording,
-		DirectorySharing:        directorySharing,
-		Download:                download,
-		License:                 license,
-		Plugins:                 pluginsAccess,
-		Integrations:            integrationsAccess,
-		DeviceTrust:             deviceTrust,
-		Locks:                   lockAccess,
-		Assist:                  assistAccess,
-	}
 
 	// local user
 	authType := authLocal
diff --git a/lib/web/ui/usercontext_test.go b/lib/web/ui/usercontext_test.go
index 6374ee76286fd..2a5f233794b12 100644
--- a/lib/web/ui/usercontext_test.go
+++ b/lib/web/ui/usercontext_test.go
@@ -25,7 +25,6 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/services"
 )
 
 func TestNewUserContext(t *testing.T) {
@@ -40,80 +39,21 @@ func TestNewUserContext(t *testing.T) {
 	// set some rules
 	role1 := &types.RoleV6{}
 	role1.SetNamespaces(types.Allow, []string{apidefaults.Namespace})
-	role1.SetRules(types.Allow, []types.Rule{
-		{
-			Resources: []string{types.KindAuthConnector},
-			Verbs:     services.RW(),
-		},
-		{
-			Resources: []string{types.KindWindowsDesktop},
-			Verbs:     services.RW(),
-		},
-		{
-			Resources: []string{types.KindIntegration},
-			Verbs:     append(services.RW(), types.VerbUse),
-		},
-	})
-
-	// not setting the rule, or explicitly denying, both denies access
-	role1.SetRules(types.Deny, []types.Rule{
-		{
-			Resources: []string{types.KindEvent},
-			Verbs:     services.RW(),
-		},
-	})
 
 	role2 := &types.RoleV6{}
 	role2.SetNamespaces(types.Allow, []string{apidefaults.Namespace})
-	role2.SetRules(types.Allow, []types.Rule{
-		{
-			Resources: []string{types.KindTrustedCluster},
-			Verbs:     services.RW(),
-		},
-		{
-			Resources: []string{types.KindBilling},
-			Verbs:     services.RO(),
-		},
-	})
 
 	roleSet := []types.Role{role1, role2}
 	userContext, err := NewUserContext(user, roleSet, proto.Features{}, true)
 	require.NoError(t, err)
 
-	allowedRW := access{true, true, true, true, true, false}
-	denied := access{false, false, false, false, false, false}
-
-	// test user name and acl
+	// test user name
 	require.Equal(t, userContext.Name, "root")
-	require.Empty(t, cmp.Diff(userContext.ACL.AuthConnectors, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.TrustedClusters, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.AppServers, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.Locks, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.DBServers, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.KubeServers, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.Events, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.RecordedSessions, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.Roles, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.Users, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.Tokens, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.Nodes, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.AccessRequests, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.ConnectionDiagnostic, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.Desktops, allowedRW))
 	require.Empty(t, cmp.Diff(userContext.AccessStrategy, accessStrategy{
 		Type:   types.RequestStrategyOptional,
 		Prompt: "",
 	}))
 
-	require.Empty(t, cmp.Diff(userContext.ACL.Billing, denied))
-	require.Equal(t, userContext.ACL.Clipboard, true)
-	require.Equal(t, userContext.ACL.DesktopSessionRecording, true)
-	require.Empty(t, cmp.Diff(userContext.ACL.License, denied))
-	require.Empty(t, cmp.Diff(userContext.ACL.Download, denied))
-
-	// test enabling of the 'Use' verb
-	require.Empty(t, cmp.Diff(userContext.ACL.Integrations, access{true, true, true, true, true, true}))
-
 	// test local auth type
 	require.Equal(t, userContext.AuthType, authLocal)
 
@@ -122,15 +62,6 @@ func TestNewUserContext(t *testing.T) {
 	userContext, err = NewUserContext(user, roleSet, proto.Features{}, true)
 	require.NoError(t, err)
 	require.Equal(t, userContext.AuthType, authSSO)
-
-	userContext, err = NewUserContext(user, roleSet, proto.Features{Cloud: true}, true)
-	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(userContext.ACL.Billing, access{true, true, false, false, false, false}))
-
-	// test that desktopRecordingEnabled being false overrides the roleSet.RecordDesktopSession() returning true
-	userContext, err = NewUserContext(user, roleSet, proto.Features{}, false)
-	require.NoError(t, err)
-	require.Equal(t, userContext.ACL.DesktopSessionRecording, false)
 }
 
 func TestNewUserContextCloud(t *testing.T) {
@@ -144,45 +75,15 @@ func TestNewUserContextCloud(t *testing.T) {
 
 	role := &types.RoleV6{}
 	role.SetNamespaces(types.Allow, []string{"*"})
-	role.SetRules(types.Allow, []types.Rule{
-		{
-			Resources: []string{"*"},
-			Verbs:     services.RW(),
-		},
-	})
-
-	role.SetWindowsLogins(types.Allow, []string{"a", "b"})
-	role.SetWindowsLogins(types.Deny, []string{"c"})
 
 	roleSet := []types.Role{role}
 
-	allowedRW := access{true, true, true, true, true, false}
-
 	userContext, err := NewUserContext(user, roleSet, proto.Features{Cloud: true}, true)
 	require.NoError(t, err)
 
 	require.Equal(t, userContext.Name, "root")
-	require.Empty(t, cmp.Diff(userContext.ACL.AuthConnectors, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.TrustedClusters, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.AppServers, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.DBServers, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.KubeServers, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.Events, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.RecordedSessions, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.Roles, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.Users, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.Tokens, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.Nodes, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.AccessRequests, allowedRW))
 	require.Empty(t, cmp.Diff(userContext.AccessStrategy, accessStrategy{
 		Type:   types.RequestStrategyOptional,
 		Prompt: "",
 	}))
-
-	require.Equal(t, userContext.ACL.Clipboard, true)
-	require.Equal(t, userContext.ACL.DesktopSessionRecording, true)
-
-	// cloud-specific asserts
-	require.Empty(t, cmp.Diff(userContext.ACL.Billing, allowedRW))
-	require.Empty(t, cmp.Diff(userContext.ACL.Desktops, allowedRW))
 }
diff --git a/lib/web/user_groups.go b/lib/web/user_groups.go
index 59e1c5fed0c15..c2a1bc02e7b51 100644
--- a/lib/web/user_groups.go
+++ b/lib/web/user_groups.go
@@ -21,17 +21,20 @@ package web
 
 import (
 	"net/http"
+	"sort"
 
 	"github.com/gravitational/trace"
 	"github.com/julienschmidt/httprouter"
 
 	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/web/ui"
 )
 
-func (h *Handler) getUserGroups(_ http.ResponseWriter, r *http.Request, params httprouter.Params, sctx *SessionContext, site reversetunnel.RemoteSite) (any, error) {
+func (h *Handler) getUserGroups(_ http.ResponseWriter, r *http.Request, params httprouter.Params, sctx *SessionContext, site reversetunnelclient.RemoteSite) (any, error) {
 	// Get a client to the Auth Server with the logged in user's identity. The
 	// identity of the logged in user is used to fetch the list of nodes.
 	clt, err := sctx.GetUserClient(r.Context(), site)
@@ -49,12 +52,36 @@ func (h *Handler) getUserGroups(_ http.ResponseWriter, r *http.Request, params h
 		return nil, trace.Wrap(err)
 	}
 
-	accessChecker, err := sctx.GetUserAccessChecker()
+	appServers, err := apiclient.GetAllResources[types.AppServer](r.Context(), clt, &proto.ListResourcesRequest{
+		ResourceType:     types.KindAppServer,
+		Namespace:        apidefaults.Namespace,
+		UseSearchAsRoles: true,
+	})
 	if err != nil {
-		return nil, trace.Wrap(err)
+		h.log.Debugf("Unable to fetch applications while listing user groups, unable to display associated applications: %v", err)
+	}
+
+	appServerLookup := make(map[string]types.AppServer, len(appServers))
+	for _, appServer := range appServers {
+		appServerLookup[appServer.GetName()] = appServer
+	}
+
+	userGroupsToApps := map[string]types.Apps{}
+	for _, userGroup := range page.Resources {
+		apps := make(types.Apps, 0, len(userGroup.GetApplications()))
+		for _, appName := range userGroup.GetApplications() {
+			app := appServerLookup[appName]
+			if app == nil {
+				h.log.Debugf("Unable to find application %s when creating user groups, skipping", appName)
+				continue
+			}
+			apps = append(apps, app.GetApp())
+		}
+		sort.Sort(apps)
+		userGroupsToApps[userGroup.GetName()] = apps
 	}
 
-	userGroups, err := ui.MakeUserGroups(site.GetName(), page.Resources, accessChecker.Roles())
+	userGroups, err := ui.MakeUserGroups(page.Resources, userGroupsToApps)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/userpreferences.go b/lib/web/userpreferences.go
new file mode 100644
index 0000000000000..f5ae62ffe879f
--- /dev/null
+++ b/lib/web/userpreferences.go
@@ -0,0 +1,129 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package web
+
+import (
+	"net/http"
+
+	"github.com/gravitational/trace"
+	"github.com/julienschmidt/httprouter"
+
+	userpreferencesv1 "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1"
+	"github.com/gravitational/teleport/lib/httplib"
+)
+
+// AssistUserPreferencesResponse is the JSON response for the assist user preferences.
+type AssistUserPreferencesResponse struct {
+	PreferredLogins []string                         `json:"preferredLogins"`
+	ViewMode        userpreferencesv1.AssistViewMode `json:"viewMode"`
+}
+
+type OnboardUserPreferencesResponse struct {
+	PreferredResources []userpreferencesv1.Resource `json:"preferredResources"`
+}
+
+// UserPreferencesResponse is the JSON response for the user preferences.
+type UserPreferencesResponse struct {
+	Assist  AssistUserPreferencesResponse  `json:"assist"`
+	Theme   userpreferencesv1.Theme        `json:"theme"`
+	Onboard OnboardUserPreferencesResponse `json:"onboard"`
+}
+
+// getUserPreferences is a handler for GET /webapi/user/preferences
+func (h *Handler) getUserPreferences(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext) (any, error) {
+	authClient, err := sctx.GetClient()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resp, err := authClient.GetUserPreferences(r.Context(), &userpreferencesv1.GetUserPreferencesRequest{
+		Username: sctx.GetUser(),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return userPreferencesResponse(resp.Preferences), nil
+}
+
+// updateUserPreferences is a handler for PUT /webapi/user/preferences.
+func (h *Handler) updateUserPreferences(_ http.ResponseWriter, r *http.Request, p httprouter.Params, sctx *SessionContext) (any, error) {
+	req := UserPreferencesResponse{}
+
+	if err := httplib.ReadJSON(r, &req); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	authClient, err := sctx.GetClient()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	preferences := &userpreferencesv1.UpsertUserPreferencesRequest{
+		Username: sctx.GetUser(),
+		Preferences: &userpreferencesv1.UserPreferences{
+			Theme: req.Theme,
+			Assist: &userpreferencesv1.AssistUserPreferences{
+				PreferredLogins: req.Assist.PreferredLogins,
+				ViewMode:        req.Assist.ViewMode,
+			},
+			Onboard: &userpreferencesv1.OnboardUserPreferences{
+				PreferredResources: req.Onboard.PreferredResources,
+			},
+		},
+	}
+
+	if err := authClient.UpsertUserPreferences(r.Context(), preferences); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return OK(), nil
+}
+
+// userPreferencesResponse creates a JSON response for the user preferences.
+func userPreferencesResponse(resp *userpreferencesv1.UserPreferences) *UserPreferencesResponse {
+	jsonResp := &UserPreferencesResponse{
+		Assist:  assistUserPreferencesResponse(resp.Assist),
+		Theme:   resp.Theme,
+		Onboard: onboardUserPreferencesResponse(resp.Onboard),
+	}
+
+	return jsonResp
+}
+
+// assistUserPreferencesResponse creates a JSON response for the assist user preferences.
+func assistUserPreferencesResponse(resp *userpreferencesv1.AssistUserPreferences) AssistUserPreferencesResponse {
+	jsonResp := AssistUserPreferencesResponse{
+		PreferredLogins: make([]string, 0, len(resp.PreferredLogins)),
+		ViewMode:        resp.ViewMode,
+	}
+
+	jsonResp.PreferredLogins = append(jsonResp.PreferredLogins, resp.PreferredLogins...)
+
+	return jsonResp
+}
+
+// onboardUserPreferencesResponse creates a JSON response for the onboard user preferences.
+func onboardUserPreferencesResponse(resp *userpreferencesv1.OnboardUserPreferences) OnboardUserPreferencesResponse {
+	jsonResp := OnboardUserPreferencesResponse{
+		PreferredResources: make([]userpreferencesv1.Resource, 0, len(resp.PreferredResources)),
+	}
+
+	jsonResp.PreferredResources = append(jsonResp.PreferredResources, resp.PreferredResources...)
+
+	return jsonResp
+}
diff --git a/lib/web/users.go b/lib/web/users.go
index 3f0d56ca559a0..a21826ee60b80 100644
--- a/lib/web/users.go
+++ b/lib/web/users.go
@@ -176,6 +176,10 @@ func getUsers(m userAPIGetter) ([]ui.UserListEntry, error) {
 
 	var uiUsers []ui.UserListEntry
 	for _, u := range users {
+		// Do not display system users in the WebUI
+		if types.IsSystemResource(u) {
+			continue
+		}
 		uiuser, err := ui.NewUserListEntry(u)
 		if err != nil {
 			return nil, trace.Wrap(err)
diff --git a/lib/windowsexec/syscall_windows.go b/lib/windowsexec/syscall_windows.go
new file mode 100644
index 0000000000000..40714b7e47272
--- /dev/null
+++ b/lib/windowsexec/syscall_windows.go
@@ -0,0 +1,154 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package windowsexec
+
+// this package is called windowsexec rather than just `windows` because
+// calling the package `windows` causes `mkwinsyscall` to generate code
+// without the appropriate package name.
+
+import (
+	"strings"
+	"time"
+	"unsafe"
+
+	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+//go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go syscall_windows.go
+//sys	shellExecuteExW(info *shellExecuteInfoW) (err error) [failretval==0] = shell32.ShellExecuteExW
+
+// shellExecuteInfoW is the input/output struct for ShellExecuteExW.
+// See the docs for information about the fields:
+// https://learn.microsoft.com/en-us/windows/win32/api/shellapi/ns-shellapi-shellexecuteinfow
+type shellExecuteInfoW struct {
+	cbSize         uint32
+	fMask          uint32
+	hwnd           windows.Handle
+	lpVerb         uintptr
+	lpFile         uintptr
+	lpParameters   uintptr
+	lpDirectory    uintptr
+	nShow          int
+	hInstApp       windows.Handle
+	lpIDList       uintptr
+	lpClass        uintptr
+	hkeyClass      windows.Handle
+	dwHotKey       uint32
+	hIconOrMonitor windows.Handle
+	hProcess       windows.Handle
+}
+
+// These consts are copied verbatim from
+// https://learn.microsoft.com/en-us/windows/win32/api/shellapi/ns-shellapi-shellexecuteinfow
+const (
+	// SEE_MASK_NOCLOSEPROCESS (0x00000040):
+	// Use to indicate that the hProcess member receives the process handle.
+	// This handle is typically used to allow an application to find out when a
+	// process created with ShellExecuteEx terminates. In some cases, such as
+	// when execution is satisfied through a DDE conversation, no handle will be
+	// returned. The calling application is responsible for closing the handle
+	// when it is no longer needed.
+	SEE_MASK_NOCLOSEPROCESS = 0x40
+)
+
+// RunAsAndWait uses `ShellExecuteExW` to create a new process with elevated
+// privileges on Windows. It waits for the process to exit, or until timeout,
+// is exhausted. It will return an error if the process exits with a non-zero
+// status code.
+func RunAsAndWait(
+	file, directory string, timeout time.Duration, parameters []string,
+) error {
+	// Convert our various string inputs to UTF16Ptrs
+	lpVerb, err := windows.UTF16PtrFromString("runas")
+	if err != nil {
+		return trace.Wrap(err, "converting verb to ptr")
+	}
+	lpFile, err := windows.UTF16PtrFromString(file)
+	if err != nil {
+		return trace.Wrap(err, "converting file to ptr")
+	}
+	lpDirectory, err := windows.UTF16PtrFromString(directory)
+	if err != nil {
+		return trace.Wrap(err, "converting directory to ptr")
+	}
+	lpParameters, err := windows.UTF16PtrFromString(strings.Join(parameters, " "))
+	if err != nil {
+		return trace.Wrap(err, "converting parameters to ptr")
+	}
+
+	// https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-shellexecuteexw
+	// Results are returned back into info :)
+	info := &shellExecuteInfoW{
+		fMask:        SEE_MASK_NOCLOSEPROCESS,
+		lpVerb:       uintptr(unsafe.Pointer(lpVerb)),
+		lpFile:       uintptr(unsafe.Pointer(lpFile)),
+		lpParameters: uintptr(unsafe.Pointer(lpParameters)),
+		lpDirectory:  uintptr(unsafe.Pointer(lpDirectory)),
+		nShow:        windows.SW_NORMAL,
+	}
+	// Set the size field of info to the size of info.
+	info.cbSize = uint32(unsafe.Sizeof(*info))
+	err = shellExecuteExW(info)
+	if err != nil {
+		// Errors from this can be a little vague, and the contents of hInstApp
+		// can provide additional context. We'll emit a debug log so this is a
+		// little easier to investigate if a user experience issues with this.
+		log.WithFields(log.Fields{
+			"err":      err,
+			"hInstApp": info.hInstApp,
+		}).Debug("Encountered error calling shellExecuteExW")
+		return trace.Wrap(err, "calling shellExecuteExW")
+	}
+	if info.hProcess == 0 {
+		return trace.Errorf("unexpected null hProcess handle from shellExecuteExW call")
+	}
+
+	// Since we provided SEE_MASK_NOCLOSEPROCESS, closing info.hProcess is our
+	// responsibility.
+	defer windows.CloseHandle(info.hProcess)
+
+	waitTime := windows.INFINITE
+	if timeout > 0 {
+		waitTime = int(timeout.Milliseconds())
+	}
+
+	// Wait for the process to finish.
+	w, err := windows.WaitForSingleObject(info.hProcess, uint32(waitTime))
+	if err != nil {
+		return trace.Wrap(err, "could not wait for elevated process")
+	}
+	switch w {
+	case windows.WAIT_OBJECT_0:
+		// This means the process exited.
+		break
+	case uint32(windows.WAIT_TIMEOUT):
+		return trace.Errorf("timed out waiting for elevated process to finish")
+	default:
+		return trace.Errorf("waiting for process resulted in unknown result: %d", w)
+	}
+
+	// Check the exit code.
+	var code uint32
+	if err := windows.GetExitCodeProcess(info.hProcess, &code); err != nil {
+		return err
+	}
+	if code != 0 {
+		return trace.Errorf("elevated process exited with non-zero code: %d", code)
+	}
+
+	return nil
+}
diff --git a/lib/windowsexec/zsyscall_windows.go b/lib/windowsexec/zsyscall_windows.go
new file mode 100644
index 0000000000000..3ec311e759a51
--- /dev/null
+++ b/lib/windowsexec/zsyscall_windows.go
@@ -0,0 +1,52 @@
+// Code generated by 'go generate'; DO NOT EDIT.
+
+package windowsexec
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+	errERROR_EINVAL     error = syscall.EINVAL
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return errERROR_EINVAL
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+var (
+	modshell32 = windows.NewLazySystemDLL("shell32.dll")
+
+	procShellExecuteExW = modshell32.NewProc("ShellExecuteExW")
+)
+
+func shellExecuteExW(info *shellExecuteInfoW) (err error) {
+	r1, _, e1 := syscall.Syscall(procShellExecuteExW.Addr(), 1, uintptr(unsafe.Pointer(info)), 0, 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/package.json b/package.json
index 222edb8e4e946..f9c900c551ba8 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
     "x-default-browser": "^0.5.2"
   },
   "devDependencies": {
-    "typescript": "^5.0.4"
+    "typescript": "^5.1.3"
   },
   "workspaces": {
     "packages": [
diff --git a/proto/prehog/v1alpha/teleport.proto b/proto/prehog/v1alpha/teleport.proto
index 9883c2a56ef48..9585098a4c6ea 100644
--- a/proto/prehog/v1alpha/teleport.proto
+++ b/proto/prehog/v1alpha/teleport.proto
@@ -19,12 +19,27 @@ package prehog.v1alpha;
 import "google/protobuf/duration.proto";
 import "google/protobuf/timestamp.proto";
 
+// a successful user login
+//
+// PostHog event: tp.user.login
 message UserLoginEvent {
-  // anonymized
+  // anonymized Teleport username, 32 bytes (HMAC-SHA-256) encoded in base64;
+  // should always be a real user as bots and service accounts with long-term
+  // credentials don't ever login
+  //
+  // PostHog property: tp.user_name
   string user_name = 1;
-  // local/github/saml/oidc
+
+  // type of the auth connector used in the login, should be
+  // "local"/"github"/"saml"/"oidc"
+  //
+  // PostHog property: tp.connector_type
   string connector_type = 2;
-  // The anonymized device ID, for logins where device trust is enabled.
+
+  // anonymized device ID, empty or 32 bytes (HMAC-SHA-256) encoded in base64;
+  // for logins where device trust is enabled
+  //
+  // PostHog property: tp.device_id
   string device_id = 3;
 }
 
@@ -44,49 +59,113 @@ message ResourceCreateEvent {
 // the kind of a "resource" as intended by ResourceHeartbeatEvent
 enum ResourceKind {
   RESOURCE_KIND_UNSPECIFIED = 0;
+
+  // PostHog property value: "node"
   RESOURCE_KIND_NODE = 1;
+
+  // PostHog property value: "app_server"
   RESOURCE_KIND_APP_SERVER = 2;
+
+  // PostHog property value: "kube_server"
   RESOURCE_KIND_KUBE_SERVER = 3;
+
+  // PostHog property value: "db_server"
   RESOURCE_KIND_DB_SERVER = 4;
+
+  // PostHog property value: "windows_desktop"
   RESOURCE_KIND_WINDOWS_DESKTOP = 5;
+
+  // ServerV3 ("node") heartbeat with a subkind of "openssh" (as opposed to
+  // empty or "teleport"); not used in keepalives
+  //
+  // PostHog property value: "node.openssh"
   RESOURCE_KIND_NODE_OPENSSH = 6;
 }
 
 // a heartbeat for a resource served by a Teleport instance outside of the
 // control plane (i.e. not auth, not proxy)
+//
+// PostHog event: tp.resource.hb
 message ResourceHeartbeatEvent {
-  // anonymized, 32 bytes (HMAC-SHA-256)
+  // anonymized name of the resource, 32 bytes (HMAC-SHA-256); the name is the
+  // host ID for nodes but the actual user-facing name for other resources, so
+  // an app or a database served by multiple agents won't be counted multiple
+  // times
+  //
+  // PreHog property: tp.resource_name (in base64)
   bytes resource_name = 1;
+
+  // kind of the resource (node, app, db)
+  //
+  // PostHog property: tp.resource_type (as a string, see ResourceKind)
   ResourceKind resource_kind = 2;
+
   // true if the heartbeat has no expiration
+  //
+  // PostHog property: tp.is_static
   bool static = 3;
 }
 
+// an event representing one of several audit events: session.start, port,
+// app.session.start, db.session.start, windows.desktop.session.start; i.e. a
+// SSH shell or port-forward, kubectl exec or kubectl port-forward, DB, App or
+// Desktop connection
+//
+// an earlier encoding (as "tp.session.start") mixed SSH sessions and kubectl
+// execs under a session type of "ssh"
+//
+// PostHog event: tp.session.start
 message SessionStartEvent {
-  // anonymized
+  // anonymized Teleport username, 32 bytes (HMAC-SHA-256) encoded in base64
+  //
+  // PostHog property: tp.user_name
   string user_name = 1;
-  // ssh/kube/desktop, maybe db?
+
+  // type of the session, should be "ssh"/"k8s"/"db"/"app"/"desktop" (matching
+  // the values for api/types.SessionKind) or "app_tcp", "ssh_port_v2" or
+  // "k8s_port" for TCP Application Access connections, SSH port forwards and
+  // kubectl port-forward respectively; a type of "ssh_port" represents either a
+  // SSH port forwarding connection or a kubectl port-forward (not used in new
+  // events)
+  //
+  // PostHog property: tp.session_type
   string session_type = 2;
 }
 
+// the issuance of a user certificate from the user CA
+//
+// PostHog event: tp.certificate.issued
 message UserCertificateIssuedEvent {
-  // The anonymized username/principal of the entity that requested the
-  // certificate.
+  // anonymized Teleport username, 32 bytes (HMAC-SHA-256) encoded in base64; it
+  // can be the username of a bot user rather than of a regular user
+  //
+  // PostHog property: tp.user_name
   string user_name = 1;
-  // The issued certificate TTL.
+
+  // the TTL of the issued certificate, typically 8 or 12 hours
+  //
+  // PostHog property: tp.ttl_minutes (in minutes, rounded up)
   google.protobuf.Duration ttl = 2;
+
   // If true, the certificate was requested by a bot (i.e. Machine ID) user.
+  // PostHog property: tp.is_bot
   bool is_bot = 3;
   // If true, the certificate usage is restricted to database access.
+  // PostHog property: tp.usage_database
   bool usage_database = 4;
   // If true, the certificate usage is restricted to app access.
+  // PostHog property: tp.usage_app
   bool usage_app = 5;
   // If true, the certificate usage is restricted to Kubernetes access.
+  // PostHog property: tp.usage_kubernetes
   bool usage_kubernetes = 6;
   // If true, the certificate usage is restricted to desktop access.
+  // PostHog property: tp.usage_desktop
   bool usage_desktop = 7;
 }
 
+// UIBannerClickEvent is a usage event sent by the UI when the upgrade
+// banner is clicked.
 message UIBannerClickEvent {
   // anonymized
   string user_name = 1;
@@ -94,26 +173,36 @@ message UIBannerClickEvent {
   string alert = 2;
 }
 
+// UIOnboardCompleteGoToDashboardClickEvent is a UI event sent when initial
+// registration is complete.
 message UIOnboardCompleteGoToDashboardClickEvent {
   // anonymized
   string user_name = 1;
 }
 
+// UIOnboardAddFirstResourceClickEvent is a UI event sent when a user clicks the
+// "add first resource" button.
 message UIOnboardAddFirstResourceClickEvent {
   // anonymized
   string user_name = 1;
 }
 
+// UIOnboardAddFirstResourceLaterClickEvent is a UI event sent when a user
+// clicks the "add first resource later" button.
 message UIOnboardAddFirstResourceLaterClickEvent {
   // anonymized
   string user_name = 1;
 }
 
+// UIOnboardSetCredentialSubmitEvent is a UI event sent during registration when
+// users configure their credentials.
 message UIOnboardSetCredentialSubmitEvent {
   // anonymized
   string user_name = 1;
 }
 
+// UIOnboardRegisterChallengeSubmitEvent is a UI event sent during registration
+// when the MFA challenge is completed.
 message UIOnboardRegisterChallengeSubmitEvent {
   // anonymized
   string user_name = 1;
@@ -121,16 +210,29 @@ message UIOnboardRegisterChallengeSubmitEvent {
   string login_flow = 3;
 }
 
+// UIOnboardQuestionnaireSubmitEvent is a UI event sent during registration when
+// user submits their onboarding questionnaire.
+message UIOnboardQuestionnaireSubmitEvent {
+  // anonymized
+  string user_name = 1;
+}
+
+// UIRecoveryCodesContinueClickEvent is a UI event sent during
+// registration when the user configures cluster recovery codes.
 message UIRecoveryCodesContinueClickEvent {
   // anonymized
   string user_name = 1;
 }
 
+// UIRecoveryCodesCopyClickEvent is a UI event sent during
+// registration when the user copies recovery codes.
 message UIRecoveryCodesCopyClickEvent {
   // anonymized
   string user_name = 1;
 }
 
+// UIRecoveryCodesPrintClickEvent is a UI event sent during
+// registration when the user prints recovery codes.
 message UIRecoveryCodesPrintClickEvent {
   // anonymized
   string user_name = 1;
@@ -191,6 +293,8 @@ enum DiscoverResource {
   DISCOVER_RESOURCE_DOC_DATABASE_RDS_PROXY = 34;
   DISCOVER_RESOURCE_DOC_DATABASE_HIGH_AVAILABILITY = 35;
   DISCOVER_RESOURCE_DOC_DATABASE_DYNAMIC_REGISTRATION = 36;
+
+  DISCOVER_RESOURCE_SAML_APPLICATION = 37;
 }
 
 // DiscoverResourceMetadata contains common metadata identifying resource type being added.
@@ -268,6 +372,34 @@ message UIDiscoverDeployServiceEvent {
   DiscoverMetadata metadata = 1;
   DiscoverResourceMetadata resource = 2;
   DiscoverStepStatus status = 3;
+
+  // DeployMethod describes the method used to deploy a service.
+  enum DeployMethod {
+    // DEPLOY_METHOD_UNSPECIFIED means there was an existing service
+    // so deploying step got skipped.
+    DEPLOY_METHOD_UNSPECIFIED = 0;
+    // DEPLOY_METHOD_AUTO means Teleport deployed a service for the user.
+    DEPLOY_METHOD_AUTO = 1;
+    // DEPLOY_METHOD_MANUAL means a user deployed a service by themselves.
+    DEPLOY_METHOD_MANUAL = 2;
+  }
+
+  DeployMethod deploy_method = 4;
+
+  // DeployType describes the type of deployment.
+  enum DeployType {
+    // DEPLOY_METHOD_UNSPECIFIED means there was an existing service
+    // so deploying step got skipped.
+    DEPLOY_TYPE_UNSPECIFIED = 0;
+    // DEPLOY_TYPE_INSTALL_SCRIPT means service was deployed using an
+    // install script.
+    DEPLOY_TYPE_INSTALL_SCRIPT = 1;
+    // DEPLOY_TYPE_AMAZON_ECS means service was deployed using amazon's
+    // elastic container service.
+    DEPLOY_TYPE_AMAZON_ECS = 2;
+  }
+
+  DeployType deploy_type = 5;
 }
 
 // UIDiscoverDatabaseRegisterEvent is emitted when a user is finished with the step that registers a database resource.
@@ -344,18 +476,55 @@ message RoleCreateEvent {
   string role_name = 2;
 }
 
+// BotCreateEvent is emitted when user creates a bot.
+message BotCreateEvent {
+  // user_name is the anonymized name of the user who created the bot
+  string user_name = 1;
+  // anonymized
+  string bot_user_name = 2;
+  // role_name is the anonymized name of the bot role that was created.
+  string role_name = 3;
+  // role_count is the number of roles that the bot role can impersonate on
+  // creation.
+  int64 role_count = 4;
+  // join_method is the join method of the token associated with the bot on
+  // creation.
+  string join_method = 5;
+  // bot_name is the anonymised name of the bot.
+  string bot_name = 6;
+}
+
+// BotJoinEvent is emitted when a bot joins a Teleport cluster.
+message BotJoinEvent {
+  // bot_name is the anonymised name of the bot.
+  string bot_name = 1;
+  // join_method is the join method of the token associated with the bot on
+  // creation. This will be the string value of `api/types.JoinMethod`.
+  string join_method = 2;
+  // join_token_name is the anonymised name of the token used to join
+  // the cluster.
+  string join_token_name = 3;
+}
+
+// UICreateNewRoleClickEvent is an event that can be triggered during custom role creation
 message UICreateNewRoleClickEvent {
   //anonymized
   string user_name = 1;
 }
+
+// UICreateNewRoleSaveClickEvent is an event that can be triggered during custom role creation
 message UICreateNewRoleSaveClickEvent {
   //anonymized
   string user_name = 1;
 }
+
+// UICreateNewRoleCancelClickEvent is an event that can be triggered during custom role creation
 message UICreateNewRoleCancelClickEvent {
   //anonymized
   string user_name = 1;
 }
+
+// UICreateNewRoleViewDocumentationClickEvent is an event that can be triggered during custom role creation
 message UICreateNewRoleViewDocumentationClickEvent {
   //anonymized
   string user_name = 1;
@@ -377,15 +546,27 @@ enum CTA {
   CTA_PREMIUM_SUPPORT = 4;
   CTA_TRUSTED_DEVICES = 5;
   CTA_UPGRADE_BANNER = 6;
+  CTA_BILLING_SUMMARY = 7;
 }
 
+// a request forwarded to a kube cluster's API server (other than exec and
+// port-forward)
+//
+// PostHog event: tp.kube.request
 message KubeRequestEvent {
-  // anonymized
+  // anonymized Teleport username, 32 bytes (HMAC-SHA-256) encoded in base64
+  //
+  // PostHog property: tp.user_name
   string user_name = 1;
 }
 
+// an sftp event, represents a single operation on a file
+//
+// PostHog event: tp.sftp
 message SFTPEvent {
-  // anonymized
+  // anonymized Teleport username, 32 bytes (HMAC-SHA-256) encoded in base64
+  //
+  // PostHog property: tp.user_name
   string user_name = 1;
   // matching SFTPAction in teleport/api/types/events/events.proto
   int32 action = 2;
@@ -464,13 +645,35 @@ message UIIntegrationEnrollCompleteEvent {
   IntegrationEnrollMetadata metadata = 1;
 }
 
+// EditorChangeEvent is an event that is emitted when a user role set changes resulting in
+// a editor role being added on removed
+message EditorChangeEvent {
+  // anonymized user name
+  string user_name = 1;
+  EditorChangeStatus status = 2;
+}
+
+// EditorChangeStatus is the possible value of an EditorChangeEvent event status
+enum EditorChangeStatus {
+  EDITOR_CHANGE_STATUS_UNSPECIFIED = 0;
+  // Status when the editor role is granted
+  EDITOR_CHANGE_STATUS_ROLE_GRANTED = 1;
+  // Status when the editor role is removed
+  EDITOR_CHANGE_STATUS_ROLE_REMOVED = 2;
+}
+
 message SubmitEventRequest {
-  // anonymized
+  // anonymized, 32 bytes (HMAC-SHA-256) encoded in base64
+  //
+  // PostHog property: tp.cluster_name (still in base64)
   string cluster_name = 1;
 
   // optional, will default to the ingest time if unset
+  //
+  // PostHog timestamp
   google.protobuf.Timestamp timestamp = 2;
 
+  // the event being submitted
   oneof event {
     UserLoginEvent user_login = 3;
     SSOCreateEvent sso_create = 4;
@@ -532,6 +735,14 @@ message SubmitEventRequest {
 
     UIIntegrationEnrollStartEvent ui_integration_enroll_start_event = 44;
     UIIntegrationEnrollCompleteEvent ui_integration_enroll_complete_event = 45;
+
+    EditorChangeEvent editor_change_event = 46;
+
+    BotCreateEvent bot_create = 47;
+
+    UIOnboardQuestionnaireSubmitEvent ui_onboard_questionnaire_submit = 48;
+
+    BotJoinEvent bot_join = 49;
   }
 
   reserved 8; // UIOnboardGetStartedClickEvent
@@ -540,6 +751,7 @@ message SubmitEventRequest {
 message SubmitEventResponse {}
 
 message SubmitEventsRequest {
+  // individual events to be submitted in a batch, up to 500 at once
   repeated SubmitEventRequest events = 1;
 }
 message SubmitEventsResponse {}
@@ -548,9 +760,21 @@ message HelloTeleportRequest {}
 message HelloTeleportResponse {}
 
 service TeleportReportingService {
+  // equivalent to SubmitEvents with a single event, should be unused by now
   rpc SubmitEvent(SubmitEventRequest) returns (SubmitEventResponse) {
     option deprecated = true;
   }
+
+  // encodes and forwards usage events to the PostHog event database; each
+  // event is annotated with some properties that depend on the identity of the
+  // caller:
+  // - tp.account_id (UUID in string form, can be empty if missing from the
+  //   license)
+  // - tp.license_name (should always be a UUID)
+  // - tp.license_authority (name of the authority that signed the license file
+  //   used for authentication)
+  // - tp.is_cloud (boolean)
   rpc SubmitEvents(SubmitEventsRequest) returns (SubmitEventsResponse) {}
+
   rpc HelloTeleport(HelloTeleportRequest) returns (HelloTeleportResponse) {}
 }
diff --git a/proto/teleport/lib/teleterm/v1/access_request.proto b/proto/teleport/lib/teleterm/v1/access_request.proto
index 974a6cc4957f1..2b89461ed2878 100644
--- a/proto/teleport/lib/teleterm/v1/access_request.proto
+++ b/proto/teleport/lib/teleterm/v1/access_request.proto
@@ -63,6 +63,7 @@ message ResourceID {
 
 message ResourceDetails {
   string hostname = 1;
+  string friendly_name = 2;
 }
 
 message Resource {
diff --git a/proto/teleport/lib/teleterm/v1/cluster.proto b/proto/teleport/lib/teleterm/v1/cluster.proto
index fb0197c3ab60b..ce64eaeaa4805 100644
--- a/proto/teleport/lib/teleterm/v1/cluster.proto
+++ b/proto/teleport/lib/teleterm/v1/cluster.proto
@@ -64,8 +64,9 @@ message LoggedInUser {
 
 // ACL is the access control list of the user
 message ACL {
-  // sessions defines access to recorded sessions
-  ResourceAccess sessions = 1;
+  // sessions was replaced by recorded_sessions and active_sessions
+  reserved 1;
+  reserved "sessions";
   // auth_connectors defines access to auth.connectors
   ResourceAccess auth_connectors = 2;
   // Roles defines access to roles
@@ -88,6 +89,10 @@ message ACL {
   ResourceAccess kubeservers = 11;
   // access_requests defines access to access requests
   ResourceAccess access_requests = 12;
+  // recorded_sessions defines access to recorded sessions.
+  ResourceAccess recorded_sessions = 13;
+  // active_sessions defines access to active sessions.
+  ResourceAccess active_sessions = 14;
 }
 
 // ResourceAccess describes access verbs
@@ -102,10 +107,14 @@ message ResourceAccess {
   bool create = 4;
   // delete determines "delete" access
   bool delete = 5;
+  // use determines "use" access
+  bool use = 6;
 }
 
 // Features describes the auth servers features
 message Features {
-  // AdvancedAccessWorkflows enables search-based access requests
+  // advanced_access_workflows enables search-based access requests
   bool advanced_access_workflows = 1;
+  // is_usage_based_billing determines if the cloud user subscription is usage-based (pay-as-you-go).
+  bool is_usage_based_billing = 2;
 }
diff --git a/proto/teleport/lib/teleterm/v1/service.proto b/proto/teleport/lib/teleterm/v1/service.proto
index 7d0715a102826..2ff6762b33419 100644
--- a/proto/teleport/lib/teleterm/v1/service.proto
+++ b/proto/teleport/lib/teleterm/v1/service.proto
@@ -27,7 +27,12 @@ import "teleport/lib/teleterm/v1/usage_events.proto";
 
 option go_package = "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1;teletermv1";
 
-// TerminalService describes Teleterm service
+// TerminalService is used by the Electron app to communicate with the tsh daemon.
+//
+// While we aim to preserve backwards compatibility in order to satisfy CI checks and follow the
+// proto practices used within the company, this service is not guaranteed to be stable across
+// versions. The packaging process of Teleport Connect ensures that the server and the client use
+// the same version of the service.
 service TerminalService {
   // UpdateTshdEventsServerAddress lets the Electron app update the address the tsh daemon is
   // supposed to use when connecting to the tshd events gRPC service. This RPC needs to be made
diff --git a/rfd/0000-rfds.md b/rfd/0000-rfds.md
index 9f2ec6d710adb..30db7f79f4fbe 100644
--- a/rfd/0000-rfds.md
+++ b/rfd/0000-rfds.md
@@ -55,29 +55,29 @@ Use this RFD as an example.
 Here's the process from and RFD idea in your head to a working implementation
 in the main Teleport branch.
 
-1. pick the RFD number
+1. Pick the RFD number. RFD numbers are claimed by pushing a branch named
+   `rfd/$number-title`.
 
-   check [submitted](https://github.com/gravitational/teleport/tree/master/rfd)
-   and
-   [pending](https://github.com/gravitational/teleport/pulls?q=is%3Apr+is%3Aopen+label%3Arfd)
-   RFDs and pick the next available number.
+   Use this one-liner to get the highest-numbered RFD branch that's been pushed:
 
-   For example, you're writing an RFD titled 'Teleport IRC Access' and end up
-   with number 18.
+   ```bash
+   git fetch --quiet && git branch -r -v | grep origin/rfd/ | awk -F'[/,-]' '{ n=$3+0; print n }' | sort -n | tail -n 1
+   ```
 
 1. make a branch off of `master` called `rfd/$number-your-title`
 
-   In our example, it'll be branch `rfd/0018-irc-access`.
+   For example, you're writing an RFD titled 'Teleport IRC Access' and end up
+   with number 18 - your branch would be called `rfd/0018-irc-access`.
 
 1. write your RFD under `/rfd/$number-your-title.md`
 
    Our example RFD is in `/rfd/0018-irc-access.md`.
 
-1. submit a PR titled `RFD $number: Your Title` and tag it with the `rfd` label
+1. submit a PR titled `RFD $number: Your Title`
 
    Our example RFD title: `RFD 18: IRC Access`
 
-1. iterated on the RFD based on reviewer feedback and get approvals
+1. iterate on the RFD based on reviewer feedback and get approvals
 
    Note: it's OK to use meetings or chat to discuss the RFD, but please write
    down the outcome in PR comments. A future reader will be grateful!
@@ -85,7 +85,7 @@ in the main Teleport branch.
 1. merge the PR and start implementing
 
 1. once implemented, make another PR changing the `state` to `implemented` and
-   updating any details that changed during implementation
+   updating any details that changed during implementation.
 
 If an RFD is eventually deprecated (e.g. a feature is removed), make a PR
 changing the `state` to `deprecated` and optionally link to the replacement RFD
@@ -147,12 +147,10 @@ Describe the UX changes and impact of your design doc.
 * Consider the UX of configuration changes and their impact on Teleport upgrades
 * Consider the UX scenarios for Cloud users
 
-
 ### Proto Specification
 
 Include any `.proto` changes or additions that are necessary for your design.
 
-
 ### Backward Compatibility
 
 Describe the impact that your design doc has on backwards compatibility and
@@ -164,12 +162,21 @@ include any migration steps.
 * Are there any backend migrations required?
 * How will changes be rolled out across future versions?
 
-
 ### Audit Events
 
 Include any new events that are required to audit the behavior
 introduced in your design doc and the criteria required to emit them.
 
+### Observability
+
+Describe how you will know the feature is working correctly and with acceptable
+performance. Consider whether you should add new Prometheus metrics, distributed
+tracing, or emit log messages with a particular format to detect errors.
+
+### Product Usage
+
+Describe how we can determine whether the feature is being adopted. Consider new
+telemetry or usage events.
 
 ### Test Plan
 
diff --git a/rfd/0009-locking.md b/rfd/0009-locking.md
index 97ed36d2d1711..e3a3500632128 100644
--- a/rfd/0009-locking.md
+++ b/rfd/0009-locking.md
@@ -54,10 +54,24 @@ message LockTarget {
 
     // Node specifies the name or UUID of a node.
     // A matching node is also prevented from heartbeating to the auth server.
+    // DEPRECATED: use ServerID instead.
     string Node;
 
     // MFADevice specifies the UUID of a user MFA device.
     string MFADevice;
+
+    // WindowsDesktop specifies the name of a Windows desktop.
+    string WindowsDesktop string
+
+    // AccessRequest specifies the UUID of an access request.
+    AccessRequest string
+
+    // Device is the device ID of a trusted device.
+    // Requires Teleport Enterprise.
+    Device               string
+
+    // ServerID specifies the UUID of a Teleport server.
+    ServerID             string
 }
 ```
 
@@ -234,14 +248,41 @@ Lock targeting Role:"developers" is in force: Cluster maintenance.
 the connection was closed on the remote side on  15 Jun 21 10:43 CEST
 ```
 
-#### Locking out a node
+#### Locking out a node (Deprecated)
+
+`tctl lock --node` was deprecated in favor of `tctl lock --server-id` in Teleport 13.x.x,
+12.4.x and 11.3.x. The `--node` flag is still supported for backward compatibility but
+it is recommended to use `--server-id` instead.
 
 ```
 $ tctl lock --node=node-uuid
 ```
 
+#### Locking out any agent
+
+`tctl lock --server-id` was introduced in Teleport 13.x.x,
+12.4.x and 11.3.x and allows locking out any agent (SSH, Kubernetes, Database, etc)
+by specifying the agent's UUID. If the agent runs multiple services, all of them
+will be locked out.
+
+```
+$ tctl lock --server-id=agent-uuid
+```
+
 #### Locking out an MFA device ID
 
 ```
 $ tctl lock --mfa-device=device-uuid
 ```
+
+#### Locking out a Trusted device ID
+
+```
+$ tctl lock --device=device-uuid
+```
+
+#### Locking out a Windows Desktop
+
+```
+$ tctl lock --windows-desktop=windows-desktop-name
+```
diff --git a/rfd/0057-automatic-user-provisioning.md b/rfd/0057-automatic-user-provisioning.md
index 2602aa8c07fe0..ec59c2c38f602 100644
--- a/rfd/0057-automatic-user-provisioning.md
+++ b/rfd/0057-automatic-user-provisioning.md
@@ -134,11 +134,118 @@ Groups will not be cleaned up and will be created once and be reused
 this is to avoid files created with specified groups will remain
 accessible between sessions to users in those groups.
 
+
 ### Multiple matching roles
 
 Automatic user provisioning will require that all roles matching a
 node via `labels` have `create_host_user=true`
 
+
+## Update: allow host users to not be deleted after session end
+
+This will deprecate the current `create_host_user` option and replace
+it with an option called `create_host_user_mode`. The new option will
+have 3 possible settings:
+- `off`: disables host user creation
+- `drop`: deletes users after the session ends (current behaviour)
+- `keep`: leaves host users after the session ends.
+
+If the deprecated `create_host_user` option is specified and
+`create_host_user_mode` is not, it will default to using `drop` when
+it is true, and `off` when it is false.
+
+If `create_host_user_mode` is set, its setting will always be used
+instead of the `create_host_user` setting.
+
+If multiple roles matching a node specify the `create_host_user_mode`
+option with both `drop` and `keep`, teleport will default to `keep`
+
+Once `create_host_user` is to be removed, a role migration will be
+triggered and any roles including `create_host_user` will be migrated
+to use `create_host_user_mode` setting it to `drop` if
+`create_host_user` was set.
+
+### Examples
+
+#### Behaviour using the deprecated option will remain the same as it is currently:
+```yaml
+kind: role
+version: v5
+metadata:
+  name: auto-user-groups
+spec:
+  options:
+    # allow auto provisioning of users.
+    create_host_user: true
+  allow:
+    # username from external okta attribute
+    logins: [ "{{external.username}}" ]
+```
+
+will be equivalent to:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: auto-user-groups
+spec:
+  options:
+    # allow auto provisioning of users, drop them at session end.
+    create_host_user_mode: drop
+  allow:
+    # username from external okta attribute
+    logins: [ "{{external.username}}" ]
+```
+
+#### User will not be deleted at session end
+```yaml
+kind: role
+version: v5
+metadata:
+  name: auto-user-groups
+spec:
+  options:
+    # allow auto provisioning of users and for them to remain after session ends.
+    create_host_user_mode: keep
+  allow:
+    # username from external okta attribute
+    logins: [ "{{external.username}}" ]
+```
+
+#### Multiple roles specify `create_host_user_mode`:
+
+Multiple roles specify `create_host_user_mode`, teleport will default to `keep`
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: auto-user-groups
+spec:
+  options:
+    # allow auto provisioning of users and for them to remain after session ends.
+    create_host_user_mode: keep
+  allow:
+    # username from external okta attribute
+    logins: [ "{{external.username}}" ]
+```
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: auto-user-groups-other
+spec:
+  options:
+    # allow auto provisioning of users, drop them at session end.
+    create_host_user_mode: drop
+  allow:
+    # username from external okta attribute
+    logins: [ "{{external.username}}" ]
+```
+
+
 ## UX Examples
 
 ### Teleport admin wants each user to have a dedicated host user defined by their Okta attributes
@@ -209,7 +316,8 @@ spec:
 
 ### Teleport admin wants to prohibit some nodes from auto-creating users
 
-Include the below config for the Teleport node that should not allow automatic user creation:
+Include the below config for the Teleport node that should not allow
+automatic user creation:
 
 ```yaml
 ssh_service:
diff --git a/rfd/0109-cloud-agent-upgrades.md b/rfd/0109-cloud-agent-upgrades.md
index af7aa59efe9b5..57ceec19ae520 100644
--- a/rfd/0109-cloud-agent-upgrades.md
+++ b/rfd/0109-cloud-agent-upgrades.md
@@ -72,7 +72,7 @@ their control planes are always compatible with the current version targeted by
 The current `cloud-stable` target version will be served via an `s3` bucket backed by CloudFront. Ex:
 
 ```
-$ VERSION="$(curl --proto '=https' --tlsv1.2 -sSf https://update.gravitational.io/v1/cloud-stable/version)"
+$ VERSION="$(curl --proto '=https' --tlsv1.2 -sSf https://updates.releases.teleport.dev/v1/cloud/stable/version)"
 ```
 
 Formally, this will be the only definition of what the current "cloud-stable" target is. An agent "downgrade" will
@@ -123,8 +123,8 @@ is treated as non-critical.
 Example usage:
 
 ```bash
-VERSION="$(curl --proto '=https' --tlsv1.2 -sSf https://update.gravitational.io/v1/cloud-stable/version)"
-CRITICAL="$(curl --proto '=https' --tlsv1.2 -sSf https://update.gravitational.io/v1/cloud-stable/critical)"
+VERSION="$(curl --proto '=https' --tlsv1.2 -sSf https://updates.releases.teleport.dev/v1/cloud/stable/version)"
+CRITICAL="$(curl --proto '=https' --tlsv1.2 -sSf https://updates.releases.teleport.dev/v1/cloud/stable/critical)"
 
 if [[ "$CRITICAL" == "yes" || "$UPGRADE_WINDOW" == "yes" ]]
 then
diff --git a/rfd/0116-label-expressions.md b/rfd/0116-label-expressions.md
index 52851cf843231..286eb1c81096b 100644
--- a/rfd/0116-label-expressions.md
+++ b/rfd/0116-label-expressions.md
@@ -1,6 +1,6 @@
 ---
 authors: Nic Klaassen (nic@goteleport.com)
-state: draft
+state: implemented (v13.2.0)
 ---
 
 # RFD 116 - RBAC Label Expressions
@@ -138,10 +138,10 @@ Label expressions can appear in `allow` or `deny` role conditions.
 
 Label expressions will have access to the following context:
 
-| Syntax             | Type                  | Description |
-|--------------------|-----------------------|-------------|
-| `labels`           | `map[string]string`   | Combined static and dynamic labels of the resource (node, app, db, etc.) being accessed |
-| `user.spec.traits` | `map[string][]string` | `external` or `internal` traits of the user accessing the resource |
+| Syntax             | Type                    | Description |
+|--------------------|-------------------------|-------------|
+| `user.spec.traits` | `map[string][]string`   | `external` or `internal` traits of the user accessing the resource |
+| `labels`           | `map[string]string`     | Combined static and dynamic labels of the resource (node, app, db, etc.) being accessed |
 
 #### Helper functions
 
@@ -155,10 +155,14 @@ resource label or a string literal).
 | Syntax | Return type | Description | Example |
 |--------|-------------|-------------|---------|
 | `contains(list, item)` | Boolean | Returns true if `list` contains an exact match for `item` | `contains(user.spec.traits[teams], labels["team"])` |
+| `contains_any(list, items)` | Boolean | Returns true if `list` contains an exact match for any element of `items` | `contains_any(user.spec.traits["projects"], labels_matching("project-*"))` |
+| `contains_all(list, items)` | Boolean | Returns true if `list` contains an exact match for all elements of `items` | `contains_all(user.spec.traits["projects"], labels_matching("project-*"))` |
 | `regexp.match(list, re)` | Boolean | Returns true if `list` contains a match for `re` | `regexp.match(labels["team"], "dev-team-\d+$")` |
 | `regexp.replace(list, re, replacement)` | `[]string` | Replaces all matches of `re` with replacement for all items in `list` | `contains(regexp.replace(user.spec.traits["allowed-env"], "^env-(.*)$", "$1"), labels["env"])`
+| `email.local(list)` | `[]string` | Returns the local part of each email in `list`, or an error if any email fails to parse | `contains(email.local(user.spec.traits["email"]), labels["owner"])`
 | `strings.upper(list)` | `[]string` | Converts all items of the list to uppercase | `contains(strings.upper(user.spec.traits["username"]), labels["owner"])`
 | `strings.lower(list)` | `[]string` | Converts all items of the list to lowercase | `contains(strings.lower(user.spec.traits["username"]), labels["owner"])`
+| `labels_matching(re)` | `[]string` | Returns the aggregate of all label values with keys matching `re`, which can be a glob or a regular expression. | `contains(labels_matching("^project-(team|label)$"), "skunkworks")`
 
 #### Operators
 
@@ -231,10 +235,33 @@ Ultimately, performance will be benchmarked for multiple scenarios with the goal
 of staying within 10% of the performance of the existing implementation.
 Benchmarks will be written comparing similar RBAC constraints written with both
 the existing label matchers and the new label expressions.
-Benchmarks will run `ListResources` with 50k unique (simulated) nodes, 64 unique
-roles, and 2k unique users.
+Benchmarks will run `ListResources` with 50k unique (simulated) nodes and 32
+unique roles.
 
-Benchmark results: TBD
+Benchmark results:
+
+```
+$ go test ./lib/auth -bench=. -run=^$ -v -benchtime 1x
+goos: darwin
+goarch: amd64
+pkg: github.com/gravitational/teleport/lib/auth
+cpu: Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
+BenchmarkListNodes
+BenchmarkListNodes/simple_labels
+BenchmarkListNodes/simple_labels-16                    1        1079886286 ns/op        525128104 B/op   8831939 allocs/op
+BenchmarkListNodes/simple_expression
+BenchmarkListNodes/simple_expression-16                1         770118479 ns/op        432667432 B/op   6514790 allocs/op
+BenchmarkListNodes/labels
+BenchmarkListNodes/labels-16                           1        1931843502 ns/op        741444360 B/op  15159333 allocs/op
+BenchmarkListNodes/expression
+BenchmarkListNodes/expression-16                       1        1040855282 ns/op        509643128 B/op   8120970 allocs/op
+BenchmarkListNodes/complex_labels
+BenchmarkListNodes/complex_labels-16                   1        2274376396 ns/op        792948904 B/op  17084107 allocs/op
+BenchmarkListNodes/complex_expression
+BenchmarkListNodes/complex_expression-16               1        1518800599 ns/op        738532920 B/op  12483748 allocs/op
+PASS
+ok      github.com/gravitational/teleport/lib/auth      11.679s
+```
 
 #### Caching
 
diff --git a/rfd/0120-hardening-amis.md b/rfd/0120-hardening-amis.md
new file mode 100644
index 0000000000000..405bfcd4e15b5
--- /dev/null
+++ b/rfd/0120-hardening-amis.md
@@ -0,0 +1,229 @@
+---
+authors: Trent Clarke (trent@goteleport.com)
+state: Draft
+---
+
+# RFD 0120 - Delivering hardened AMIs
+
+# Required Approvers
+* Engineering: `@r0mant`
+* Security: `@reedloden && @jentfoo`
+* Product: `@xinding33 || @klizhentas`
+
+## What
+
+This RFD discusses structures and processes to increase the security of the
+Amazon EC2 Disk Images (a.k.a AMIs) used to ship Teleport to customers.
+
+## Why
+
+One way our customers consume Teleport is by using a pre-built and  -configured
+AMI to run Teleport in AWS EC2 instances. As a provider of these images we are 
+(at least partially) responsible for the security of all software included in
+the image, not just Teleport. 
+
+We should endeavor to not ship vulnerabilities to our clients, even if those
+vulnerabilities are not directly in our software.
+
+This is not simply an academic exercise. Customers have been asking for hardened
+AMIs - especially for AMIs that conform to well-known security benchmarks. See 
+[here](https://github.com/gravitational/teleport/issues/8078) for an example.
+
+## Details
+
+### Current Situation
+
+We currently use [Packer](https://www.hashicorp.com/products/packer) and a shell
+script to provision our AMIs, based on Amazon Linux 2. The same Packerfile is used
+as a basis for several AMIs
+
+Inclusions for all AMIs:
+  * [Telegraf](https://www.influxdata.com/time-series-platform/telegraf/)
+    for capturing monitoring data
+  * [InfluxDB](https://www.influxdata.com/) as a data store for Telegraf
+  * [Grafana](https://grafana.com/) to display time series data
+  * [nginx](https://nginx.com) to serve Grafana's front end  
+  * EFF [`certbot`](https://https://certbot.eff.org/) for ACME Certificate
+    Rotation (used by optional ssm `systemd` units)
+  * Python 3 and `pip` for installing and running `certbot`
+  * `uuid` for token generation (used by optional ssm `systemd` units)
+  * `gcc` for ???
+  * `libffi-dev` for ???
+  * `openssl-devel` for ???
+  * `libfontconfig` for ???
+
+Whether or not the actual services are *enabled* depends on post-build 
+actions by the eventual AMI consumer, such as enabling various `systemd`
+units.
+
+### Current Benchmarking
+
+We currently do not test our images against a benchmark.
+
+### Proposed Solution
+
+ * Build a Teleport maintained STIG-high AL2 "Golden" base image using the
+   AWS EC2 Image Builder
+ * Use this hardened image as the base for all Teleport supplied AMIs built
+   with Packer
+ * [Optional] Slimming the AMIs to reduce attack surface
+ * Post-build validation using Amazon Inspector
+ * Ongoing vulnerability scanning with Trivy
+
+#### **CIS vs STIG**
+
+The two best-known standards for security hardening are 
+ * CIS Benchmarks (Level 1 & 2), and
+ * The US DoD [Security Technical Implementation Guides](https://public.cyber.mil/stigs) (STIGs)
+
+Both of these standards are pretty comprehensive and have wide
+application, although private organizations tend to favor CIS
+over STIG. 
+
+So why choose STIG over CIS?
+
+The decision largely comes down to what tooling is immediately available. Both
+standards are comprehensive - the AL2 CIS benchmark document runs to about 600 
+pages. At an estimated 2 pages per item, that's 300 separate items that need
+detection, remediation and validation. I don't believe that Teleport wants 
+to maintain scripts to do that ourselves, so I have been focused on finding 
+tools to do it for us.
+
+Somewhat unsurprisingly, nearly all of the automated AMI hardening tools I have 
+found are tied to the AWS EC2 Image Builder Tool. Both standards are represented, 
+but while the STIG-compliance components are free for use on any image, the 
+CIS tooling has several drawbacks:
+
+  1. The hardening components require the use of a CIS-supplied base image that
+     incurs an added per-minute royalty to CIS. As we are using this image as a
+     delivery channel to our customers, this is a non-starter.
+  2. The use of the CIS hardening tools requires a subscription to/partnership with 
+     CIS that we do not currently have
+
+The decision to go with STIG is based on being able to improve the situation
+for our customers *now*, while still being able to add CIS hardening tools as
+we develop that relationship in the future.
+
+#### **How do security benchmarks realate to AMIs?**
+
+Both the CIS Benchmarks and STIG e es
+
+#### **Hardened Base Image**
+
+My proposed solution is to use AWS EC2 Image builder, using the available STIG
+tooling, to create a hardened base image. 
+
+We can do this as part of the build process, or on some frequent schedule 
+(e.g. daily, weekly).
+
+I suggest the latter, scheduled option;
+
+ 1. The release build process is already complicated enough, and
+ 2. There is no real advantage to creating a per-release base image, as there 
+    is no way to inject parameters into the image build pipeline.
+
+#### **Why ImageBuilder *AND* Packer?**
+
+As mentioned above, there is no way to inject parameters into an EC2 ImageBuilder
+pipeline. The pipeline is the pipeline. There is some customization available at
+the build component level, but there is no way (that I can see, at least) to
+say something like "Trigger this pipeline using Teleport `vX.Y.Z` and save the
+resulting image as `teleport-oss-X.Y.Z`". All you can do is trigger the pipeline
+and have it produce (or replace) a single image.
+
+So this brings us to an obvious division of labor:
+
+ * **EC2 ImageBuilder** to build the hardened base image, which will be used as
+   the common base for all AMIs we produce, across all supported Teleport
+   versions, and
+ * **Packer** for the final, individual AMIs that are tailored to a specific
+   Teleport version and configuration.
+
+There is a side benefit here: were we to move the entire process into EC2 Image
+Builder, it would require moving a lot of Teleport-specific code and configuration
+*out* of the `teleport` Git repositories and into `teleport-cloud` terraform.
+
+From experience, keeping Teleport-specific things closer to `teleport` is generally
+a better idea than splitting them apart.
+
+#### **[Optional] Slimming the AMIs**
+
+In the spirit of moving towards distroless OCI container images, I propose slimming
+the contents of the AMIs in order to reduce their attack surface. 
+
+#### **Publishing to `teleport-prod`**
+
+These new images will be published to the `teleport-prod` AWS account. This will
+partially obviate the need to move the legacy images from the `gravitational`
+AWS account. 
+
+As per the existing AMI builds, AMIs will be constructed as part of the tag build, and
+made public on promotion.
+
+#### **Post-build validation using Amazon Inspector**
+
+While the CIS-hardening tooling on Amazon requires royalties and subscriptions,
+the Amazon Inspector tool contains CIS benchmarks appears to be royalty free. 
+
+Amazon Inspector can't examine AMIs directly, but it is possible to 
+ 1. spin up an EC2 instance based on the given AMI, 
+ 2. install the AWS Inspector agent onto the Instance,
+ 3. run an Inspector assessment over the instance,
+ 4. interrogate the resulting list of findings to decide if a build passes
+    or not
+
+This idea is based on a [Continuous Vulnerability Assessment](https://aws.amazon.com/blogs/security/how-to-set-up-continuous-golden-ami-vulnerability-assessments-with-amazon-inspector/) example from the AWS security blog, minus the scheduled lambda to trigger the assessment.
+
+#### **Ongoing Scanning**
+
+We should mirror our approach for OCI container Images ([See RFD-0112](./0112-securing-docker-images.md)), which boils down to:
+
+ * Routine (e.g. daily) scanning of the most recent release of each 
+   supported Teleport version (i.e. 3 most recent major versions). 
+ * Detected issues written to the `teleport.e` GitHub Security Issues 
+   tab
+ * Any further processing to be handled by our Panther SIEM
+
+The `trivy` scanner is [known to support scanning AMIs](https://aquasecurity.github.io/trivy/v0.35/docs/vm/aws/), 
+and we already it for OCI container images and other resources. We should
+use it for our AMIs as well.
+
+#### **AMI Cleanup**
+
+There is a default 1114 limit of public AMIs allowed in an AWS region. While this 
+can be raised on request, it seems reasonable to periodically clean up our public
+images.
+
+Proposed deletion criteria:
+ * non-release builds (i.e. anything with a semver suffix) older than 6 months
+ * release builds with Teleport major version <= 5 (updated over time )
+
+### **Implementation Plan**
+
+  * **Phase 1:** 
+    * Hardened base image, 
+    * re-based AMIs, 
+    * publishing to `teleport-prod`
+  * **Phase 2:**
+    * Post-build validation
+  * **Phase 3:**
+    * Ongoing scanning
+  * **Phase 4:**
+    * AMI Cleanup
+
+I expect that Phases 2-4 can be performed in any order, even in parallel,
+depending on what is the highest value target.
+
+### **Migration Plan**
+
+Changing the contents and configuration of the shipped AMIs is considered a
+compatibility breaking change, and so needs to be handled with some care. 
+
+We will be rolling out the images over 3 major releases of Teleport:
+
+1. **Teleport 13**: begin publishing hardened images to `teleport-prod` in
+   parallel with legacy images in `gravitational` account.
+2. **Teleport 14**: make hardened images the default, and deprecate (but 
+   still publish) legacy ones
+3. **Teleport 15**: stop publishing legacy images
+
diff --git a/rfd/0123-tls-routing-behind-layer7-lb.md b/rfd/0123-tls-routing-behind-layer7-lb.md
index 22cd830b4e8f2..b462487e95b0d 100644
--- a/rfd/0123-tls-routing-behind-layer7-lb.md
+++ b/rfd/0123-tls-routing-behind-layer7-lb.md
@@ -228,6 +228,28 @@ See [RFD 0121 - Kubernetes MFA
 sessions](https://github.com/gravitational/teleport/blob/master/rfd/0121-kube-mfa-sessions.md)
 for more details.
 
+### Client source IPs
+
+Correct client source IPs must be reported for IP pinning and audit logs.
+
+Unlike layer 4 load balancers, layer 7 load balancers usually CANNOT transparently forward original clients' IPs or add
+standard [PROXY](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) protocol headers to layer 7 payload. The
+standard way for layer 7 load balancers to report correct client source IPs is through the
+["X-Forwarded-For"](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For) (XFF) header.
+
+The Proxy service will examine the values of the XFF headers when `proxy_service.use_x_forwarded_for` is enabled (more
+details in security section).
+
+ALL web APIs will take client source IPs from the XFF headers. This includes login APIs, Web UI APIs (including wss
+sessions) and the ALPN connection upgrade API, to make sure a correct IP is always logged.
+
+Teleport should support XFF header with both IPv4 and IPv6 addresses, with or without port numbers. In case no port is
+reported in the XFF header, port can be taken from the observed TCP connection or use an arbitrary number, since the
+port is usually trivial.
+
+To keep things simple, only XFF header containing one IP address is accepted. Any requests with multiple XFF headers or
+headers containing multiple IPs will be rejected.
+
 ### User Experience
 
 Once the connection upgrade support to all protocols is implemented, users can be recommended to upgrade their Teleport
@@ -299,8 +321,32 @@ for different clusters.
 UX is the same as when [TLS Routing is
 enabled](https://github.com/gravitational/teleport/blob/master/rfd/0039-sni-alpn-teleport-proxy-routing.md#local-teleport-proxy).
 
+#### 5 - Client source IPs
+
+A new setting is added to the Proxy service for web APIs to take client IPs from the "X-Forwarded-For" headers:
+```
+proxy_service:
+  # Enables the Proxy service to take client source IPs from the
+  # "X-Forwarded-For" headers for web APIs recevied from layer 7 load balancers
+  # or reverse proxies.
+  # 
+  # IMPORTANT: please make sure the service is behind a layer 7 load balancer or
+  # reverse proxy that sets or appends client IPs in the "X-Forwarded-For"
+  # headers.
+  #
+  # default: false
+  use_x_forwarded_for: true
+```
+
+Note that this setting is NOT mutually exclusive with the `proxy_protocol` setting. For example, in a separate-port
+setup, web APIs including the ALPN connection upgrade endpoint (e.g. called by `tsh proxy db`) can take client source
+IPs from the XFF headers set by a layer 7 load balancer, whereas SSH, reverse tunnels and separate DB ports can take
+client source IPs from the PROXY headers set by a layer 4 load balancer.
+
 ### Security
 
+#### 1 - Connection upgrade
+
 When upgrading the connection, the Teleport client verifies the load balancer's TLS cert using SystemCertPool. And as
 mentioned early, at the TLS Routing request, the Teleport client will be configured with a Teleport CA for verifying the
 Proxy server.
@@ -308,6 +354,24 @@ Proxy server.
 There is no authentication at the connection upgrade request. Authentication is deferred to the TLS Routing request so
 authentication remains the same as if there is no connection upgrade.
 
+#### 2 - Client source IPs
+
+The premise of the IP Pinning feature is to protect against hackers using comproised credentials from different
+locations.
+
+A hacker can easily modify a Teleport client with a fake IP in the "X-Forwarded-For" (XFF) if the Proxy service trusts
+this value without conditions. Remember the ALPN connection upgrade endpoint can embed all Teleport protocols in TLS
+routing requests, and the endpoint is publicly available regardless of whether the Proxy is behind a load balancer or
+not.
+
+To minimize this risk, the web APIs will only take client source IPs from XFF headers when
+`proxy_service.use_x_forwarded_for` is explicitly set to true. Users have the responsibility to ensure that the Proxy
+service is indeed behind a layer 7 load balancer AND the load balancer is configured to set correct values in the XFF
+headers.
+
+Further more, requests with multiple XFF headers or headers containing multiple IPs will be rejected as it is difficult
+to know which is the truth without extra knowledge of the setup.
+
 ### Performance
 
 #### 1 - Performance on the connection upgrade
diff --git a/rfd/0129-discovery-name-templating.md b/rfd/0129-discovery-name-templating.md
new file mode 100644
index 0000000000000..122464ee7a1cf
--- /dev/null
+++ b/rfd/0129-discovery-name-templating.md
@@ -0,0 +1,448 @@
+---
+authors: Gavin Frazar (gavin.frazar@goteleport.com)
+state: draft
+---
+
+# RFD 0129 - Avoid Discovery Resource Name Collisions
+
+## Required Approvers
+
+- Engineering: `@r0mant && @smallinsky && @tigrato`
+- Product: `@klizhentas || @xinding33`
+- Security: `@reedloden || @jentfoo`
+
+## What
+
+Auto-Discovery shall name discovered resources such that other resources of
+the same kind are unlikely to have the same name.
+
+In particular, discovered cloud resource names shall include uniquely
+identifying metadata in the name such as region, account ID, or sub-type name.
+
+`tsh` sub-commands shall allow users to use a prefix of the resource name when
+the prefix unambiguously identifies a resource.
+
+Additionally, `tsh` sub-commands shall support using label selectors to
+unambiguously select a single resource.
+
+This RFD does not apply to ssh server instance discovery, since servers are
+already identified within the Teleport cluster by a UUID.
+
+## Why
+
+Multiple discovery agents can discover resources with identical names.
+For example, this happened when customers had databases in different AWS
+regions or accounts with the same name. When a name collision occurs, only one
+of the databases can be accessed by users.
+
+Name collisions can be avoided with the addition of other resource metadata
+in the resource name.
+
+Since discovered resource names will be longer and more tedious to use, we
+should support resource name prefixes and label matching in `tsh`, Teleport
+Connect, and the web UI for better UX.
+
+Relevant issue:
+- https://github.com/gravitational/teleport/issues/22438
+
+## Details
+
+#### AWS Discovery
+
+Discovered database and kube cluster names shall have a lowercase suffix
+appended to it that includes:
+
+- Name of the AWS matcher type
+  - `eks`, `rds`, `rdsproxy`, `redshift`, `redshift-serverless`, `elasticache`,
+    `memorydb` (as of writing this RFD)
+- AWS region
+- AWS account ID
+
+All of these AWS resource types require a unique name within an AWS account
+and region.
+
+By including the region and account ID, resources of the same kind
+in different AWS accounts or regions will avoid name collision with each-other.
+
+By including the Teleport matcher type in the name, resources of different
+sub-kinds will also avoid name collision.
+
+By combining these properties, resource names will not collide.
+
+The reason for including `eks` in kube cluster names, even though this is the
+only "kind" of kube cluster we discover in AWS, is to clearly distinguish the
+cluster further from clusters in other clouds, although this isn't strictly
+necessary.
+
+Example:
+```yaml
+discovery_service:
+  enabled: true
+  aws:
+    - types: ["eks", "rds", "redshift"]
+      regions: ["us-west-1", "us-west-2"]
+      assume_role_arn: "arn:aws:iam::111111111111:role/DiscoveryRole"
+      external_id: "123abc"
+      tags:
+        "*": "*"
+    - types: ["eks", "rds", "redshift"]
+      regions: ["us-west-1", "us-west-2"]
+      assume_role_arn: "arn:aws:iam::222222222222:role/DiscoveryRole"
+      external_id: "456def"
+      tags:
+        "*": "*"
+```
+
+If the discovery service is configured like the above, the discovery agent will
+discover AWS EKS clusters and AWS RDS and Redshift databases in the `us-west-1`
+and `us-west-2` AWS regions, in AWS accounts `111111111111` and `222222222222`.
+
+Now suppose that an EKS cluster, RDS database, and Redshift database all named
+`foo` exist in both regions in both AWS accounts.
+If the discovery service applies the new naming convention, the discovered
+resources should be named:
+
+- `foo-eks-us-west-1-111111111111`
+- `foo-eks-us-west-2-111111111111`
+- `foo-eks-us-west-1-222222222222`
+- `foo-eks-us-west-2-222222222222`
+- `foo-rds-us-west-1-111111111111`
+- `foo-rds-us-west-2-111111111111`
+- `foo-rds-us-west-1-222222222222`
+- `foo-rds-us-west-2-222222222222`
+- `foo-redshift-us-west-1-111111111111`
+- `foo-redshift-us-west-2-111111111111`
+- `foo-redshift-us-west-1-222222222222`
+- `foo-redshift-us-west-2-222222222222`
+
+This naming convention does not violate our database name validation regex,
+`^[a-z]([-a-z0-9]*[a-z0-9])?$`,
+and does not violate our kube cluster name validation regex `^[a-zA-Z0-9._-]+$`.
+
+#### Azure Discovery
+
+Azure resources have a resource ID that uniquely identifies the resource, e.g.:
+`/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/<group name>/providers/<provider name>/<name>`
+
+We could use this ID as the database name, but it is unnecessarily verbose.
+It will also fail to match our database name validation regex:
+`[a-z]([-a-z0-9]*[a-z0-9])?`.
+
+Additionally, all of the Azure databases that Teleport currently supports
+require globally unique names (within the same type of database), because Azure
+assigns a DNS name:
+
+- Redis: `<name>.redis.cache.windows.net`.
+- SQL Server: `<name>.database.windows.net`.
+- Postgres: `<name.postgres.database.azure.com`.
+- MySQL: `<name>.mysql.database.azure.com`.
+
+MySQL/Postgres server names must be unique among both single-server and
+flexible-server instances.
+
+Therefore, we can form a uniquely identifying name among Azure resources just by
+adding the kind of matcher to the resource name.
+However, AKS kube clusters do not require globally unique names - they only need
+to be unique within the same resource group in the same subscription.
+
+Additionally, resource group names may contain characters that are not valid
+in Teleport database/kube names, so we must either omit the resource group name
+in those cases or perform some kind of string transform.
+If we include the resource region, it will serve as a heuristic to avoid name
+collision when resource group names contain invalid characters.
+Including resource region will also be consistent with the other cloud naming
+schemes.
+
+To make the naming convention consistent, and to "future-proof" it, the
+naming convention will be to append a suffix that includes:
+
+- Name of the Azure matcher type
+  - `aks`, `mysql`, `postgres`, `redis`, `sqlserver` (as of writing this RFD)
+- Azure region
+- Azure resource group name
+  - resource group names may contain characters that we do not allow in database
+    or kube cluster names.
+    The resource group name should be checked for invalid characters and dropped
+    from the name suffix if it is invalid.
+    This is only a heuristic, but any approach here will be a heuristic, and
+    this is the simplest string transform we can do, which avoids confusing
+    users with strange resource group names they don't recognize.
+- Azure subscription ID
+  - subscription IDs only contains letters, digits, and hyphens.
+
+Example:
+```yaml
+discovery_service:
+  enabled: true
+  aws:
+    - types: ["aks", "mysql", "postgres"]
+      regions: ["eastus"]
+      subscriptions:
+        - "11111111-1111-1111-1111-111111111111"
+        - "22222222-2222-2222-2222-222222222222"
+      resource_groups: ["group1", "group2", "weird-)(-group-name"]
+      tags:
+        "*": "*"
+```
+
+If the discovery service is configured like the above, the discovery agent will
+discover Azure AKS kube clusters, Azure MySQL, and Azure PostgreSQL databases.
+
+Now suppose that four AKS kube clusters named `foo` exist in each combination of
+resource group and subscription ID, and a MySQL database and Postgres database
+both named `foo` exist in the the `1111..` subscription and `group1`.
+If the discovery service applies the new naming convention, the discovered
+resources should be named:
+
+- `foo-eastus-aks-group1-11111111-1111-1111-1111-111111111111`
+- `foo-eastus-aks-group2-11111111-1111-1111-1111-111111111111`
+- `foo-eastus-aks-group1-22222222-2222-2222-2222-222222222222`
+- `foo-eastus-aks-group2-22222222-2222-2222-2222-222222222222`
+- `foo-eastus-mysql-group1-11111111-1111-1111-1111-111111111111`
+- `foo-eastus-postgres-group1-11111111-1111-1111-1111-111111111111`
+
+If resources exist within the Azure resource group `weird-)(-group-name`,
+then we simply drop the resource group name from the resource name:
+
+- `foo-eastus-aks-11111111-1111-1111-1111-111111111111`
+- `foo-eastus-aks-22222222-2222-2222-2222-222222222222`
+- `foo-eastus-mysql-11111111-1111-1111-1111-111111111111`
+- ...
+
+Unfortunately, this would allow name collisions across resource groups.
+
+Alternatively, we could apply a transformation to the resource group name to
+make it valid.
+For example, base64 encode it, make the string lowercase, and replace the
+`[+/=]` characters with valid characters, maybe even truncating the result:
+(another heuristic, although less likely to collide names):
+
+```sh
+$ echo "weird-)(-group-name" | base64 | sed 's#[+/=]#x#g' | tr '[:upper:]' '[:lower:]' | cut -c1-8 
+d2vpcmqt
+$ echo "other-weird-)(-group-name" | base64 | sed 's#[+/=]#x#g' | tr '[:upper:]' '[:lower:]' | cut -c1-8 
+b3rozxit
+```
+
+- `foo-eastus-aks-d2vpcmqt-11111111-1111-1111-1111-111111111111`
+- `foo-eastus-aks-b3rozxit-11111111-1111-1111-1111-111111111111`
+- ...
+
+Each database name will be unique, since `foo` must be globally unique among
+all Azure MySQL databases and globally unique among all Azure Postgres databases.
+
+Even if a new database type is added that doesn't have this globally unique
+name property, the resource group name and subscription ID will avoid name
+collisions, and the databases will be distinguished from databases in other
+clouds.
+If resource group name has invalid characters, the Azure region will make name
+collisions even more unlikely.
+
+Likewise, the discovered AKS clusters will avoid colliding with other kube
+clusters in Azure or other clouds.
+
+This naming convention does not violate our database name validation regex,
+`^[a-z]([-a-z0-9]*[a-z0-9])?$`,
+and does not violate our kube cluster name validation regex `^[a-zA-Z0-9._-]+$`.
+
+#### GCP Discovery
+
+GCP discovery currently supports discovering only GKE kube clusters.
+
+GKE cluster names are unique within the same GCP project ID and location/zone.
+
+The discovery naming convention for GKE clusters shall be to append a suffix to
+the cluster name that includes:
+
+- Name of the Teleport GCP matcher type
+  - `gke`
+- GCP project ID
+  - These can be custom, but will only consist of characters, digits, hyphens.
+- GCP location
+
+```yaml
+    gcp:
+    - types: ["gke"]
+      locations: ["us-west1", "us-west2"]
+      tags:
+        "*": "*"
+      project_ids: ["my-project"]
+```
+
+If the discovery service is configured like the above, the discovery agent will
+discover GCP GKE kube clusters in "my-project" in the `us-west1` and `us-west2`
+locations.
+
+Now suppose GKE clusters named `foo` exist in each region.
+If the discovery service applies the new naming convention, the discovered
+resources should be named:
+
+- `foo-gke-us-west1-my-project`
+- `foo-gke-us-west2-my-project`
+
+This naming convention avoids name collisions between GKE clusters and does not
+collide with discovered AWS/Azure clusters.
+
+This naming convention does not violate our kube cluster name validation regex:
+`^[a-zA-Z0-9._-]+$`
+
+### `tsh` UX
+
+Users will be frustrated if they are forced to type out verbose resource names
+when using `tsh`.
+To avoid this poor UX, sub-commands should support prefix resource names, label
+matching, or using a predicate expression to select a resource.
+
+The same UX should apply to all `tsh` sub-commands that take a resource name
+argument. These commands shall support
+`tsh <sub-command> [--labels keys=val1,key2=val2,...] [--query <predicate>] [name | prefix]` syntax:
+
+- `tsh db login`
+- `tsh db logout`
+- `tsh db connect`
+- `tsh db env`
+- `tsh db config`
+- `tsh kube login`
+- `tsh app login`
+- `tsh app logout`
+- `tsh app config`
+- `tsh proxy db`
+- `tsh proxy kube`
+- `tsh proxy app`
+
+To support prefix names, we add a new predicate expression function
+`hasPrefix`, and change the `tsh` API calls to use `hasPrefix(name, "<prefix>")`
+rather than the current predicate expression `name == "<name>"`.
+
+The `--query` flag provides the full power of the predicate language, which
+includes label matching.
+The `--labels` flag provides a less powerful, but more convenient notation for
+selecting a resource by matching labels.
+
+We already support both of these cli features as either a flag or positional arg
+in other `tsh` commands, e.g. `tsh db ls --query="..." key1=val1,key2=val2,...`
+
+When `--query` is used along with a positional arg for the resource name or
+prefix, we will need to combine the two as a single predicate expression, e.g.
+`tsh db connect --query='labels.env == "prod"' foo-db`
+will be combined into the predicate expression `hasPrefix(name, "foo-db") && (labels.env == "prod")`
+
+#### `tsh` examples
+
+To illustrate the new UX for `tsh` sub-commands, here is an example using
+`tsh db connect` to select a database (the same applies for other commands):
+
+```sh
+$ tsh db ls
+Name   Description         Allowed Users       Labels                      Connect 
+------ ------------------- ------------------- --------------------------- ------- 
+bar    RDS instance in ... [*] account-id=123456789012,region=us-west-1,env=dev,...
+bar    RDS instance in ... [*] account-id=123456789012,region=us-west-2,env=dev,...
+foo    RDS instance in ... [*] account-id=123456789012,region=us-west-1,env=prod,...
+
+# connect by prefix name
+$ tsh db connect --db-user=alice --db-name-postgres foo
+#...connects to "foo-rds-us-west-1-123456789012" by prefix...
+
+# ambiguous prefix name is an error
+$ tsh db connect --db-user=alice --db-name-postgres bar
+error: ambiguous database name could match multiple databases:
+Name                           Description               Protocol Type URI                                                   Allowed Users Labels                                                                                                                                    Connect 
+------------------------------ ------------------------- -------- ---- ----------------------------------------------------- ------------- ----------------------------------------------------------------------------------------------------------------------------------------- ------- 
+bar-rds-us-west-1-123456789012 RDS instance in us-west-1 postgres rds  bar.abcdefghijklmnop.us-west-1.rds.amazonaws.com:5432 [*]           account-id=123456789012,endpoint-type=instance,engine-version=13.10,engine=postgres,env=dev,region=us-west-1,teleport.dev/origin=dynamic          
+bar-rds-us-west-2-123456789012 RDS instance in us-west-2 postgres rds  bar.abcdefghijklmnop.us-west-2.rds.amazonaws.com:5432 [*]           account-id=123456789012,endpoint-type=instance,engine-version=13.10,engine=postgres,env=dev,region=us-west-2,teleport.dev/origin=dynamic          
+
+Hint: try addressing the database by its full name or by matching its labels (ex: tsh db connect key1=value1,key2=value2).
+Hint: use `tsh db ls -v` or `tsh db ls --format=[yaml | json]` to list all databases with verbose details.
+
+# resolve the error by connecting with an unambiguous prefix 
+$ tsh db connect --db-user=alice --db-name-postgres bar-rds-us-west-2
+#...connects to "bar-rds-us-west-2-123456789012" by prefix...
+
+# or connect by label(s) using --labels
+$ tsh db connect --db-user=alice --db-name-postgres --labels region=us-west-2
+#...connects to "bar-rds-us-west-2-123456789012" by matching region label...
+
+# or connect by label(s) in a --query predicate
+$ tsh db connect --db-user=alice --db-name-postgres --query 'labels.region == "us-west-2"'
+#...connects to "bar-rds-us-west-2-123456789012" by matching region label...
+
+# ambiguous label(s) match is also an error
+$ tsh db connect --db-user=alice --db-name-postgres --query 'labels.region == "us-west-1"'
+error: ambiguous database query matches multiple databases:
+Name                           Description               Protocol Type URI                                                   Allowed Users Labels                                                                                                                                    Connect 
+------------------------------ ------------------------- -------- ---- ----------------------------------------------------- ------------- ----------------------------------------------------------------------------------------------------------------------------------------- ------- 
+bar-rds-us-west-1-123456789012 RDS instance in us-west-1 postgres rds  bar.abcdefghijklmnop.us-west-1.rds.amazonaws.com:5432 [*]           account-id=123456789012,endpoint-type=instance,engine-version=13.10,engine=postgres,env=dev,region=us-west-1,teleport.dev/origin=dynamic          
+foo-rds-us-west-1-123456789012 RDS instance in us-west-1 postgres rds  foo.abcdefghijklmnop.us-west-1.rds.amazonaws.com:5432 [*]           account-id=123456789012,endpoint-type=instance,engine-version=13.10,engine=postgres,env=prod,region=us-west-1,teleport.dev/origin=dynamic         
+
+Hint: try addressing the database by its full name or by matching its labels (ex: tsh db connect key1=value1,key2=value2).
+Hint: use `tsh db ls -v` or `tsh db ls --format=[yaml | json]` to list all databases with verbose details.
+
+# resolve the error by using either more specific labels or adding a prefix name
+$ tsh db connect --db-user=alice --db-name-postgres --query 'labels.region == "us-west-1"' foo
+#...connects to "foo-rds-us-west-1-123456789012" by prefix and label...
+$ tsh db connect --db-user=alice --db-name-postgres --query 'labels.region == "us-west-1" && labels.env == "prod"'
+#...connects to "foo-rds-us-west-1-123456789012" by multiple labels...
+```
+
+### Web UI and Teleport Connect UX
+
+Both the web UI and Teleport Connect already support searching for substrings
+in resource names and labels.
+
+Searching by substring is a "fuzzier" kind of search than prefix-based name
+search (like this RFD proposed prefix-based search for `tsh`) - it's more
+likely to match more than one resource.
+However, GUI UX is fundamentally different from CLI - users can search and then
+interactively select from multiple matching resources.
+So this kind of search is appropriate for the web UI and Teleport Connect, but
+not for `tsh`.
+
+Both web UI and Teleport Connect also support label-based searching with
+the predicate language, e.g.:
+
+```
+labels["env"] == "dev" && labels["region"] == "us-west-1"
+```
+
+Therefore, no UX changes are required for these user interfaces.
+
+### Security
+
+No security concerns I can think of.
+
+### Backward Compatibility
+
+
+If the Teleport Discovery service is upgraded, but `tsh` is not, then
+we may break backwards compatibility with user automation scripts, and/or
+frustrate users with long names they must type fully, since their `tsh` does
+not have the UX improvements.
+
+Solution: backport `tsh` UX changes to prior versions and reserve changes to 
+the Teleport Discovery naming schema for v14.
+This way users can continue to type the old names of discovered resources and
+connect by prefix match.
+
+`tsh` UX changes will add a new predicate expression `hasPrefix` to the
+server-side predicate resource parser.
+If a user has a newer `tsh` version than the server, then `hasPrefix` may not
+be supported by the server and `tsh` will get an error.
+To avoid issues, we can make `tsh` fallback to listing resources without a
+predicate expression and filter the results by matching prefix name.
+
+### Audit Events
+
+N/A
+
+### Test Plan
+
+We should test that discovering multiple resources with identical names does not
+suffer name collisions.
+
+Setup identically named RDS databases and kube clusters in different AWS regions
+and a discovery agent to discover them.
+
+Check that the resources in each region are discovered and differentiated by
+region in their name.
+
diff --git a/tool/tbot/anonymous_telemetry.go b/tool/tbot/anonymous_telemetry.go
index 6a00317a883cf..56cc1a7bb5a06 100644
--- a/tool/tbot/anonymous_telemetry.go
+++ b/tool/tbot/anonymous_telemetry.go
@@ -27,7 +27,6 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/types"
 	prehogv1a "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha"
 	prehogv1ac "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha/prehogv1alphaconnect"
 	"github.com/gravitational/teleport/lib/tbot/config"
@@ -86,11 +85,8 @@ func sendTelemetry(
 	log.Infof("Anonymous telemetry is enabled. Find out more about Machine ID's anonymous telemetry at %s", telemetryDocs)
 
 	data := &prehogv1a.TbotStartEvent{
-		RunMode: prehogv1a.TbotStartEvent_RUN_MODE_DAEMON,
-		// Default to reporting the "token" join method to account for
-		// scenarios where initial join has onboarding configured but future
-		// starts renew using credentials.
-		JoinType: string(types.JoinMethodToken),
+		RunMode:  prehogv1a.TbotStartEvent_RUN_MODE_DAEMON,
+		JoinType: string(cfg.Onboarding.JoinMethod),
 		Version:  teleport.Version,
 	}
 	if cfg.Oneshot {
@@ -100,16 +96,13 @@ func sendTelemetry(
 		data.Helper = helper
 		data.HelperVersion = envGetter(helperVersionEnv)
 	}
-	if cfg.Onboarding != nil && cfg.Onboarding.JoinMethod != "" {
-		data.JoinType = string(cfg.Onboarding.JoinMethod)
-	}
-	for _, dest := range cfg.Destinations {
-		switch {
-		case dest.App != nil:
+	for _, output := range cfg.Outputs {
+		switch output.(type) {
+		case *config.ApplicationOutput:
 			data.DestinationsApplication++
-		case dest.Database != nil:
+		case *config.DatabaseOutput:
 			data.DestinationsDatabase++
-		case dest.KubernetesCluster != nil:
+		case *config.KubernetesOutput:
 			data.DestinationsKubernetes++
 		default:
 			data.DestinationsOther++
diff --git a/tool/tbot/anonymous_telemetry_test.go b/tool/tbot/anonymous_telemetry_test.go
index 81d3fc1731c55..919074468ccb5 100644
--- a/tool/tbot/anonymous_telemetry_test.go
+++ b/tool/tbot/anonymous_telemetry_test.go
@@ -59,38 +59,21 @@ func TestSendTelemetry(t *testing.T) {
 		}
 		cfg := &config.BotConfig{
 			Oneshot: true,
-			Onboarding: &config.OnboardingConfig{
+			Onboarding: config.OnboardingConfig{
 				JoinMethod: types.JoinMethodGitHub,
 			},
-			Destinations: []*config.DestinationConfig{
-				{
-					DestinationMixin: config.DestinationMixin{
-						Directory: &config.DestinationDirectory{},
-					},
+			Outputs: []config.Output{
+				&config.IdentityOutput{
+					Destination: &config.DestinationDirectory{},
 				},
-				{
-					DestinationMixin: config.DestinationMixin{
-						Directory: &config.DestinationDirectory{},
-					},
-					KubernetesCluster: &config.KubernetesCluster{
-						ClusterName: "foo",
-					},
+				&config.KubernetesOutput{
+					Destination: &config.DestinationDirectory{},
 				},
-				{
-					DestinationMixin: config.DestinationMixin{
-						Directory: &config.DestinationDirectory{},
-					},
-					App: &config.App{
-						App: "bar",
-					},
+				&config.ApplicationOutput{
+					Destination: &config.DestinationDirectory{},
 				},
-				{
-					DestinationMixin: config.DestinationMixin{
-						Directory: &config.DestinationDirectory{},
-					},
-					Database: &config.Database{
-						Database: "biz",
-					},
+				&config.DatabaseOutput{
+					Destination: &config.DestinationDirectory{},
 				},
 			},
 		}
diff --git a/tool/tbot/db.go b/tool/tbot/db.go
index 6be3b18a4b064..ab1b91083f336 100644
--- a/tool/tbot/db.go
+++ b/tool/tbot/db.go
@@ -36,27 +36,17 @@ func onDBCommand(botConfig *config.BotConfig, cf *config.CLIConf) error {
 		return trace.Wrap(err)
 	}
 
-	destination, err := tshwrap.GetDestination(botConfig, cf)
+	destination, err := tshwrap.GetDestinationDirectory(botConfig)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	destinationPath, err := tshwrap.GetDestinationPath(destination)
+	env, err := tshwrap.GetEnvForTSH(destination.Path)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	identityTemplate, err := tshwrap.GetIdentityTemplate(destination)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	env, err := tshwrap.GetEnvForTSH(destination)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	identityPath := filepath.Join(destinationPath, identityTemplate.FileName)
+	identityPath := filepath.Join(destination.Path, config.IdentityFilePath)
 	identity, err := tshwrap.LoadIdentity(identityPath)
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/tool/tbot/init.go b/tool/tbot/init.go
index fce1c2e0b7065..d1df1142ff20f 100644
--- a/tool/tbot/init.go
+++ b/tool/tbot/init.go
@@ -42,15 +42,10 @@ const aclTestFailedMessage = "ACLs are not usable for destination %s; " +
 	"Change the destination's ACL mode to `off` to silence this warning."
 
 // getInitArtifacts returns a map of all desired artifacts for the destination
-func getInitArtifacts(destination *config.DestinationConfig) (map[string]bool, error) {
+func getInitArtifacts(output config.Output) map[string]bool {
 	// true = directory, false = regular file
 	toCreate := map[string]bool{}
 
-	destImpl, err := destination.GetDestination()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	// Collect all base artifacts and filter for the destination.
 	for _, artifact := range identity.GetArtifacts() {
 		if artifact.Matches(identity.DestinationKinds()...) {
@@ -59,18 +54,11 @@ func getInitArtifacts(destination *config.DestinationConfig) (map[string]bool, e
 	}
 
 	// Collect all config template artifacts.
-	for _, templateConfig := range destination.Configs {
-		template, err := templateConfig.GetConfigTemplate()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		for _, file := range template.Describe(destImpl) {
-			toCreate[file.Name] = file.IsDir
-		}
+	for _, fd := range output.Describe() {
+		toCreate[fd.Name] = fd.IsDir
 	}
 
-	return toCreate, nil
+	return toCreate
 }
 
 // getExistingArtifacts fetches all entries in a destination directory
@@ -391,25 +379,24 @@ func getAndTestACLOptions(cf *config.CLIConf, destDir string) (*user.User, *user
 }
 
 func onInit(botConfig *config.BotConfig, cf *config.CLIConf) error {
-	var destination *config.DestinationConfig
+	var output config.Output
 	var err error
-
-	// First, resolve the correct destination. If using a config file with only
+	// First, resolve the correct output. If using a config file with only
 	// 1 destination we can assume we want to init that one; otherwise,
 	// --init-dir is required.
 	if cf.InitDir == "" {
-		if len(botConfig.Destinations) == 1 {
-			destination = botConfig.Destinations[0]
+		if len(botConfig.Outputs) == 1 {
+			output = botConfig.Outputs[0]
 		} else {
-			return trace.BadParameter("A destination to initialize must be specified with --init-dir")
+			return trace.BadParameter("An output to initialize must be specified with --init-dir")
 		}
 	} else {
-		destination, err = botConfig.GetDestinationByPath(cf.InitDir)
+		output, err = botConfig.GetOutputByPath(cf.InitDir)
 		if err != nil {
 			return trace.WrapWithMessage(err, "Could not find specified destination %q", cf.InitDir)
 		}
 
-		if destination == nil {
+		if output == nil {
 			// TODO: in the future if/when other backends are supported,
 			// destination might be nil because the user tried to enter a non
 			// filesystem path, so this error message could be misleading.
@@ -418,10 +405,7 @@ func onInit(botConfig *config.BotConfig, cf *config.CLIConf) error {
 		}
 	}
 
-	destImpl, err := destination.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
+	destImpl := output.GetDestination()
 
 	destDir, ok := destImpl.(*config.DestinationDirectory)
 	if !ok {
@@ -430,14 +414,9 @@ func onInit(botConfig *config.BotConfig, cf *config.CLIConf) error {
 
 	log.Infof("Initializing destination: %s", destImpl)
 
-	subdirs, err := destination.ListSubdirectories()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
 	// Create the directory if needed. We haven't checked directory ownership,
 	// but it will fail when the ACLs are created if anything is misconfigured.
-	if err := destDir.Init(subdirs); err != nil {
+	if err := output.Init(); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -483,11 +462,7 @@ func onInit(botConfig *config.BotConfig, cf *config.CLIConf) error {
 	}
 
 	// Next, resolve what we want and what we already have.
-	desired, err := getInitArtifacts(destination)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
+	desired := getInitArtifacts(output)
 	existing, err := getExistingArtifacts(destDir.Path)
 	if err != nil {
 		return trace.Wrap(err)
@@ -560,7 +535,7 @@ func onInit(botConfig *config.BotConfig, cf *config.CLIConf) error {
 		}
 	}
 
-	log.Infof("Destination %s has been initialized. Note that these files "+
+	log.Infof("destination %s has been initialized. Note that these files "+
 		"will be empty and invalid until the bot issues certificates.",
 		destImpl)
 
diff --git a/tool/tbot/init_test.go b/tool/tbot/init_test.go
index 0e8334c0b0577..95fd66b813cef 100644
--- a/tool/tbot/init_test.go
+++ b/tool/tbot/init_test.go
@@ -112,7 +112,7 @@ func testConfigFromCLI(t *testing.T, cf *config.CLIConf) *config.BotConfig {
 
 // testConfigFromString parses a YAML config file from a string.
 func testConfigFromString(t *testing.T, yaml string) *config.BotConfig {
-	cfg, err := config.ReadConfig(strings.NewReader(yaml))
+	cfg, err := config.ReadConfig(strings.NewReader(yaml), false)
 	require.NoError(t, err)
 
 	return cfg
@@ -120,9 +120,8 @@ func testConfigFromString(t *testing.T, yaml string) *config.BotConfig {
 
 // validateFileDestinations ensures all files in a destination exist on disk as
 // expected, and returns the destination.
-func validateFileDestination(t *testing.T, dest *config.DestinationConfig) *config.DestinationDirectory {
-	destImpl, err := dest.GetDestination()
-	require.NoError(t, err)
+func validateFileDestination(t *testing.T, output config.Output) *config.DestinationDirectory {
+	destImpl := output.GetDestination()
 
 	destDir, ok := destImpl.(*config.DestinationDirectory)
 	require.True(t, ok)
@@ -152,7 +151,7 @@ func TestInit(t *testing.T) {
 	require.NoError(t, onInit(cfg, cf))
 
 	// Make sure everything was created.
-	_ = validateFileDestination(t, cfg.Destinations[0])
+	_ = validateFileDestination(t, cfg.Outputs[0])
 }
 
 // TestInitMaybeACLs tests defaults with ACLs possibly enabled, by supplying
@@ -202,7 +201,7 @@ func TestInitMaybeACLs(t *testing.T) {
 	require.NoError(t, onInit(cfg, cf))
 
 	// Make sure everything was created.
-	destDir := validateFileDestination(t, cfg.Destinations[0])
+	destDir := validateFileDestination(t, cfg.Outputs[0])
 
 	// If we expect ACLs, verify them.
 	if expectACLs {
@@ -215,12 +214,15 @@ func TestInitMaybeACLs(t *testing.T) {
 // testInitSymlinksTemplate is a config template with a configurable symlinks
 // mode and ACLs disabled.
 const testInitSymlinksTemplate = `
+version: v2
 auth_server: example.com
-destinations:
-  - directory:
-      path: %s
-      acls: off
-      symlinks: %s
+outputs:
+- type: identity
+  destination:
+    type: directory
+    path: %s
+    acls: off
+    symlinks: %s
 `
 
 // TestInitSymlink tests tbot init with a symlink in the path.
@@ -246,7 +248,7 @@ func TestInitSymlink(t *testing.T) {
 	require.NoError(t, onInit(cfg, &config.CLIConf{}))
 
 	// Make sure everything was created.
-	_ = validateFileDestination(t, cfg.Destinations[0])
+	_ = validateFileDestination(t, cfg.Outputs[0])
 }
 
 // TestInitSymlinksInsecure should work on all platforms.
diff --git a/tool/tbot/kube.go b/tool/tbot/kube.go
index 23ef8e7e3b930..a6a93f862b0ea 100644
--- a/tool/tbot/kube.go
+++ b/tool/tbot/kube.go
@@ -62,23 +62,13 @@ func getCredentialData(idFile *identityfile.IdentityFile, currentTime time.Time)
 	return data, nil
 }
 
-func onKubeCredentialsCommand(cfg *config.BotConfig, cf *config.CLIConf) error {
-	destination, err := tshwrap.GetDestination(cfg, cf)
+func onKubeCredentialsCommand(cfg *config.BotConfig) error {
+	destination, err := tshwrap.GetDestinationDirectory(cfg)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	identityTemplate, err := tshwrap.GetIdentityTemplate(destination)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	destImpl, err := destination.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	idData, err := destImpl.Read(identityTemplate.FileName)
+	idData, err := destination.Read(config.IdentityFilePath)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tbot/main.go b/tool/tbot/main.go
index 33b8a8a5acb94..6c0c50139382d 100644
--- a/tool/tbot/main.go
+++ b/tool/tbot/main.go
@@ -28,9 +28,11 @@ import (
 
 	"github.com/gravitational/trace"
 	"github.com/sirupsen/logrus"
-	"gopkg.in/yaml.v2"
+	"gopkg.in/yaml.v3"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/tbot"
 	"github.com/gravitational/teleport/lib/tbot/config"
 	"github.com/gravitational/teleport/lib/utils"
@@ -83,7 +85,7 @@ func Run(args []string, stdout io.Writer) error {
 	startCmd.Flag("destination-dir", "Directory to write short-lived machine certificates.").StringVar(&cf.DestinationDir)
 	startCmd.Flag("certificate-ttl", "TTL of short-lived machine certificates.").DurationVar(&cf.CertificateTTL)
 	startCmd.Flag("renewal-interval", "Interval at which short-lived certificates are renewed; must be less than the certificate TTL.").DurationVar(&cf.RenewalInterval)
-	startCmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).Default(config.DefaultJoinMethod).EnumVar(&cf.JoinMethod, config.SupportedJoinMethods...)
+	startCmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).EnumVar(&cf.JoinMethod, config.SupportedJoinMethods...)
 	startCmd.Flag("oneshot", "If set, quit after the first renewal.").BoolVar(&cf.Oneshot)
 	startCmd.Flag("diag-addr", "If set and the bot is in debug mode, a diagnostics service will listen on specified address.").StringVar(&cf.DiagAddr)
 
@@ -100,13 +102,14 @@ func Run(args []string, stdout io.Writer) error {
 	configureCmd.Flag("ca-pin", "CA pin to validate the Teleport Auth Server; used on first connect.").StringsVar(&cf.CAPins)
 	configureCmd.Flag("certificate-ttl", "TTL of short-lived machine certificates.").Default("60m").DurationVar(&cf.CertificateTTL)
 	configureCmd.Flag("data-dir", "Directory to store internal bot data. Access to this directory should be limited.").StringVar(&cf.DataDir)
-	configureCmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).Default(config.DefaultJoinMethod).EnumVar(&cf.JoinMethod, config.SupportedJoinMethods...)
+	configureCmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).EnumVar(&cf.JoinMethod, config.SupportedJoinMethods...)
 	configureCmd.Flag("oneshot", "If set, quit after the first renewal.").BoolVar(&cf.Oneshot)
 	configureCmd.Flag("renewal-interval", "Interval at which short-lived certificates are renewed; must be less than the certificate TTL.").DurationVar(&cf.RenewalInterval)
 	configureCmd.Flag("token", "A bot join token, if attempting to onboard a new bot; used on first connect.").Envar(tokenEnvVar).StringVar(&cf.Token)
 	configureCmd.Flag("output", "Path to write the generated configuration file to rather than write to stdout.").Short('o').StringVar(&cf.ConfigureOutput)
 
-	watchCmd := app.Command("watch", "Watch a destination directory for changes.").Hidden()
+	migrateCmd := app.Command("migrate", "Migrates a config file from an older version to the newest version. Outputs to stdout by default.")
+	migrateCmd.Flag("output", "Path to write the generated configuration file to rather than write to stdout.").Short('o').StringVar(&cf.ConfigureOutput)
 
 	dbCmd := app.Command("db", "Execute database commands through tsh.")
 	dbCmd.Flag("proxy", "The Teleport proxy server to use, in host:port form.").Required().StringVar(&cf.Proxy)
@@ -151,6 +154,12 @@ func Run(args []string, stdout io.Writer) error {
 		utils.InitLogger(utils.LoggingForDaemon, logrus.DebugLevel)
 	}
 
+	// If migration is specified, we want to run this before the config is
+	// loaded normally.
+	if migrateCmd.FullCommand() == command {
+		return onMigrate(cf, stdout)
+	}
+
 	botConfig, err := config.FromCLIConf(&cf)
 	if err != nil {
 		return trace.Wrap(err)
@@ -165,14 +174,12 @@ func Run(args []string, stdout io.Writer) error {
 		err = onConfigure(cf, stdout)
 	case initCmd.FullCommand():
 		err = onInit(botConfig, &cf)
-	case watchCmd.FullCommand():
-		err = onWatch(botConfig)
 	case dbCmd.FullCommand():
 		err = onDBCommand(botConfig, &cf)
 	case proxyCmd.FullCommand():
 		err = onProxyCommand(botConfig, &cf)
 	case kubeCredentialsCmd.FullCommand():
-		err = onKubeCredentialsCommand(botConfig, &cf)
+		err = onKubeCredentialsCommand(botConfig)
 	default:
 		// This should only happen when there's a missing switch case above.
 		err = trace.BadParameter("command %q not configured", command)
@@ -182,7 +189,7 @@ func Run(args []string, stdout io.Writer) error {
 }
 
 func onVersion() error {
-	utils.PrintVersion()
+	modules.GetModules().PrintVersion()
 	return nil
 }
 
@@ -208,10 +215,15 @@ func onConfigure(
 	if err != nil {
 		return nil
 	}
+	// Ensure they have provided a join method to use in the configuration.
+	if cfg.Onboarding.JoinMethod == types.JoinMethodUnspecified {
+		return trace.BadParameter("join method must be provided")
+	}
 
 	fmt.Fprintln(out, "# tbot config file generated by `configure` command")
 
 	enc := yaml.NewEncoder(out)
+	enc.SetIndent(2)
 	if err := enc.Encode(cfg); err != nil {
 		return trace.Wrap(err)
 	}
@@ -229,15 +241,67 @@ func onConfigure(
 	return nil
 }
 
-func onWatch(botConfig *config.BotConfig) error {
-	return trace.NotImplemented("watch not yet implemented")
+func onMigrate(
+	cf config.CLIConf,
+	stdout io.Writer,
+) error {
+	if cf.ConfigPath == "" {
+		return trace.BadParameter("source config file must be provided with -c")
+	}
+
+	out := stdout
+	outPath := cf.ConfigureOutput
+	if outPath != "" {
+		if outPath == cf.ConfigPath {
+			return trace.BadParameter("migrated config output path should not be the same as the source config path")
+		}
+
+		f, err := os.Create(outPath)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		defer f.Close()
+		out = f
+	}
+
+	// We do not want to load an existing configuration file as this will cause
+	// it to be merged with the provided flags and defaults.
+	cfg, err := config.ReadConfigFromFile(cf.ConfigPath, true)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return trace.Wrap(err, "validating new config")
+	}
+
+	fmt.Fprintln(out, "# tbot config file generated by `migrate` command")
+
+	enc := yaml.NewEncoder(out)
+	enc.SetIndent(2)
+	if err := enc.Encode(cfg); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := enc.Close(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	if outPath != "" {
+		log.Infof(
+			"Generated config file written to file: %s", outPath,
+		)
+	}
+
+	return nil
 }
 
 func onStart(botConfig *config.BotConfig) error {
-	reloadChan := make(chan struct{})
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
-	go handleSignals(log, reloadChan, cancel)
+
+	reloadCh := make(chan struct{})
+	botConfig.ReloadCh = reloadCh
+	go handleSignals(log, cancel, reloadCh)
 
 	telemetrySentCh := make(chan struct{})
 	go func() {
@@ -276,24 +340,28 @@ func onStart(botConfig *config.BotConfig) error {
 		}
 	}()
 
-	b := tbot.New(botConfig, log, reloadChan)
+	b := tbot.New(botConfig, log)
 	return trace.Wrap(b.Run(ctx))
 }
 
 // handleSignals handles incoming Unix signals.
-func handleSignals(log logrus.FieldLogger, reload chan struct{}, cancel context.CancelFunc) {
+func handleSignals(log logrus.FieldLogger, cancel context.CancelFunc, reloadCh chan<- struct{}) {
 	signals := make(chan os.Signal, 1)
 	signal.Notify(signals, syscall.SIGINT, syscall.SIGHUP, syscall.SIGUSR1)
 
-	for signal := range signals {
-		switch signal {
+	for sig := range signals {
+		switch sig {
 		case syscall.SIGINT:
-			log.Info("Received interrupt, canceling...")
+			log.Info("Received interrupt, triggering shutdown.")
 			cancel()
 			return
 		case syscall.SIGHUP, syscall.SIGUSR1:
-			log.Info("Received reload signal, reloading...")
-			reload <- struct{}{}
+			log.Info("Received reload signal, queueing reload.")
+			select {
+			case reloadCh <- struct{}{}:
+			default:
+				log.Warn("Unable to queue reload, reload already queued.")
+			}
 		}
 	}
 }
diff --git a/tool/tbot/main_test.go b/tool/tbot/main_test.go
index cd766066c1c24..c8752b4f5cdb5 100644
--- a/tool/tbot/main_test.go
+++ b/tool/tbot/main_test.go
@@ -45,7 +45,7 @@ func TestRun_Configure(t *testing.T) {
 		return cpy
 	}
 
-	baseArgs := []string{"configure"}
+	baseArgs := []string{"configure", "--join-method", "token"}
 	tests := []struct {
 		name string
 		args []string
diff --git a/tool/tbot/proxy.go b/tool/tbot/proxy.go
index 52838bd1ceb87..baa5abcae3a9b 100644
--- a/tool/tbot/proxy.go
+++ b/tool/tbot/proxy.go
@@ -35,27 +35,17 @@ func onProxyCommand(botConfig *config.BotConfig, cf *config.CLIConf) error {
 		return trace.Wrap(err)
 	}
 
-	destination, err := tshwrap.GetDestination(botConfig, cf)
+	destination, err := tshwrap.GetDestinationDirectory(botConfig)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	destinationPath, err := tshwrap.GetDestinationPath(destination)
+	env, err := tshwrap.GetEnvForTSH(destination.Path)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	identityTemplate, err := tshwrap.GetIdentityTemplate(destination)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	env, err := tshwrap.GetEnvForTSH(destination)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	identityPath := filepath.Join(destinationPath, identityTemplate.FileName)
+	identityPath := filepath.Join(destination.Path, config.IdentityFilePath)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tbot/testdata/TestRun_Configure/all_parameters_provided/file.golden b/tool/tbot/testdata/TestRun_Configure/all_parameters_provided/file.golden
index 2de37caa03207..6aed3c59c9cb8 100644
--- a/tool/tbot/testdata/TestRun_Configure/all_parameters_provided/file.golden
+++ b/tool/tbot/testdata/TestRun_Configure/all_parameters_provided/file.golden
@@ -1,15 +1,15 @@
 # tbot config file generated by `configure` command
+version: v2
 onboarding:
   token: xxyzz
-  ca_path: ""
   ca_pins:
-  - sha256:capindata
+    - sha256:capindata
   join_method: token
 storage:
-  directory:
-    path: /custom/data/dir
-    symlinks: secure
-    acls: try
+  type: directory
+  path: /custom/data/dir
+  symlinks: secure
+  acls: try
 debug: false
 auth_server: example.com
 certificate_ttl: 42m0s
diff --git a/tool/tbot/testdata/TestRun_Configure/all_parameters_provided/stdout.golden b/tool/tbot/testdata/TestRun_Configure/all_parameters_provided/stdout.golden
index 2de37caa03207..6aed3c59c9cb8 100644
--- a/tool/tbot/testdata/TestRun_Configure/all_parameters_provided/stdout.golden
+++ b/tool/tbot/testdata/TestRun_Configure/all_parameters_provided/stdout.golden
@@ -1,15 +1,15 @@
 # tbot config file generated by `configure` command
+version: v2
 onboarding:
   token: xxyzz
-  ca_path: ""
   ca_pins:
-  - sha256:capindata
+    - sha256:capindata
   join_method: token
 storage:
-  directory:
-    path: /custom/data/dir
-    symlinks: secure
-    acls: try
+  type: directory
+  path: /custom/data/dir
+  symlinks: secure
+  acls: try
 debug: false
 auth_server: example.com
 certificate_ttl: 42m0s
diff --git a/tool/tbot/testdata/TestRun_Configure/no_parameters_provided/file.golden b/tool/tbot/testdata/TestRun_Configure/no_parameters_provided/file.golden
index a729b3488df36..db43e046b280d 100644
--- a/tool/tbot/testdata/TestRun_Configure/no_parameters_provided/file.golden
+++ b/tool/tbot/testdata/TestRun_Configure/no_parameters_provided/file.golden
@@ -1,9 +1,12 @@
 # tbot config file generated by `configure` command
+version: v2
+onboarding:
+  join_method: token
 storage:
-  directory:
-    path: /var/lib/teleport/bot
-    symlinks: secure
-    acls: try
+  type: directory
+  path: /var/lib/teleport/bot
+  symlinks: secure
+  acls: try
 debug: false
 auth_server: ""
 certificate_ttl: 1h0m0s
diff --git a/tool/tbot/testdata/TestRun_Configure/no_parameters_provided/stdout.golden b/tool/tbot/testdata/TestRun_Configure/no_parameters_provided/stdout.golden
index a729b3488df36..db43e046b280d 100644
--- a/tool/tbot/testdata/TestRun_Configure/no_parameters_provided/stdout.golden
+++ b/tool/tbot/testdata/TestRun_Configure/no_parameters_provided/stdout.golden
@@ -1,9 +1,12 @@
 # tbot config file generated by `configure` command
+version: v2
+onboarding:
+  join_method: token
 storage:
-  directory:
-    path: /var/lib/teleport/bot
-    symlinks: secure
-    acls: try
+  type: directory
+  path: /var/lib/teleport/bot
+  symlinks: secure
+  acls: try
 debug: false
 auth_server: ""
 certificate_ttl: 1h0m0s
diff --git a/tool/tctl/common/auth_command.go b/tool/tctl/common/auth_command.go
index b2fa6b3d6b33b..a2889b8d5c44d 100644
--- a/tool/tctl/common/auth_command.go
+++ b/tool/tctl/common/auth_command.go
@@ -848,7 +848,13 @@ func (a *AuthCommand) generateUserKeys(ctx context.Context, clusterAPI auth.Clie
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	fmt.Printf("\nThe credentials have been written to %s\n", strings.Join(filesWritten, ", "))
+	// Print a tip guiding people towards Machine ID. We use stderr here in case
+	// someone is programatically parsing stdout.
+	_, _ = fmt.Fprintln(
+		os.Stderr,
+		"\nGenerating credentials to allow a machine access to Teleport? We recommend Teleport's Machine ID! Find out more at https://goteleport.com/r/machineid-tip",
+	)
+	fmt.Printf("The credentials have been written to %s\n", strings.Join(filesWritten, ", "))
 
 	return nil
 }
diff --git a/tool/tctl/common/bots_command.go b/tool/tctl/common/bots_command.go
index c226324ec9b7b..7552d2bf12540 100644
--- a/tool/tctl/common/bots_command.go
+++ b/tool/tctl/common/bots_command.go
@@ -224,12 +224,8 @@ func (c *BotsCommand) AddBot(ctx context.Context, client auth.ClientI) error {
 	}
 
 	joinMethod := response.JoinMethod
-	// omit join method output for the token method
-	switch joinMethod {
-	case types.JoinMethodUnspecified, types.JoinMethodToken:
-		// the template will omit an empty string
-		joinMethod = ""
-	default:
+	if joinMethod == types.JoinMethodUnspecified {
+		joinMethod = types.JoinMethodToken
 	}
 
 	return startMessageTemplate.Execute(os.Stdout, map[string]interface{}{
diff --git a/tool/tctl/common/resource_command.go b/tool/tctl/common/resource_command.go
index ad025d295062e..f7aef214f380a 100644
--- a/tool/tctl/common/resource_command.go
+++ b/tool/tctl/common/resource_command.go
@@ -846,7 +846,7 @@ func (rc *ResourceCommand) createSAMLIdPServiceProvider(ctx context.Context, cli
 }
 
 func (rc *ResourceCommand) createDevice(ctx context.Context, client auth.ClientI, raw services.UnknownResource) error {
-	res, err := types.UnmarshalDevice(raw.Raw)
+	res, err := services.UnmarshalDevice(raw.Raw)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/tctl.go b/tool/tctl/common/tctl.go
index 3c8c783cd3f79..89c2e890fcd45 100644
--- a/tool/tctl/common/tctl.go
+++ b/tool/tctl/common/tctl.go
@@ -39,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/lib/client/identityfile"
 	"github.com/gravitational/teleport/lib/config"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/tool/common"
@@ -176,7 +177,7 @@ func TryRun(commands []CLICommand, args []string) error {
 
 	// "version" command?
 	if selectedCmd == ver.FullCommand() {
-		utils.PrintVersion()
+		modules.GetModules().PrintVersion()
 		return nil
 	}
 
diff --git a/tool/tctl/common/token_command.go b/tool/tctl/common/token_command.go
index 5fb4d01202544..042dbec18cfab 100644
--- a/tool/tctl/common/token_command.go
+++ b/tool/tctl/common/token_command.go
@@ -52,7 +52,7 @@ Use this token to add an MDM service to Teleport.
 > teleport start \
    --token={{.token}} \{{range .ca_pins}}
    --ca-pin={{.}} \{{end}}
-   -c=/path/to/teleport.yaml
+   --config=/path/to/teleport.yaml
 
 `))
 
diff --git a/tool/tctl/sso/tester/format_test.go b/tool/tctl/sso/tester/format_test.go
index 65c957c5a488c..8618a8797eec4 100644
--- a/tool/tctl/sso/tester/format_test.go
+++ b/tool/tctl/sso/tester/format_test.go
@@ -87,7 +87,6 @@ options:
   cert_format: ""
   create_db_user: null
   create_desktop_user: null
-  create_host_user: null
   desktop_clipboard: null
   desktop_directory_sharing: null
   forward_agent: false
@@ -137,7 +136,6 @@ func Test_formatJSON(t *testing.T) {
         "record_session": null,
         "desktop_clipboard": null,
         "desktop_directory_sharing": null,
-        "create_host_user": null,
         "pin_source_ip": false,
         "ssh_file_copy": null,
         "create_desktop_user": null,
diff --git a/tool/teleport/common/teleport.go b/tool/teleport/common/teleport.go
index 7bd93d215b4ac..5582986aaca45 100644
--- a/tool/teleport/common/teleport.go
+++ b/tool/teleport/common/teleport.go
@@ -36,6 +36,7 @@ import (
 	"github.com/gravitational/teleport/lib/config"
 	awsconfigurators "github.com/gravitational/teleport/lib/configurators/aws"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/integrations/awsoidc"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/openssh"
 	"github.com/gravitational/teleport/lib/service"
@@ -254,6 +255,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	dbConfigureCreate.Flag("redshift-serverless-discovery", "List of AWS regions in which the agent will discover Redshift Serverless instances.").StringsVar(&dbConfigCreateFlags.RedshiftServerlessDiscoveryRegions)
 	dbConfigureCreate.Flag("elasticache-discovery", "List of AWS regions in which the agent will discover ElastiCache Redis clusters.").StringsVar(&dbConfigCreateFlags.ElastiCacheDiscoveryRegions)
 	dbConfigureCreate.Flag("memorydb-discovery", "List of AWS regions in which the agent will discover MemoryDB clusters.").StringsVar(&dbConfigCreateFlags.MemoryDBDiscoveryRegions)
+	dbConfigureCreate.Flag("opensearch-discovery", "List of AWS regions in which the agent will discover OpenSearch domains.").StringsVar(&dbConfigCreateFlags.OpenSearchDiscoveryRegions)
 	dbConfigureCreate.Flag("aws-tags", "(Only for AWS discoveries) Comma-separated list of AWS resource tags to match, for example env=dev,dept=it").StringVar(&dbConfigCreateFlags.AWSRawTags)
 	dbConfigureCreate.Flag("azure-mysql-discovery", "List of Azure regions in which the agent will discover MySQL servers.").StringsVar(&dbConfigCreateFlags.AzureMySQLDiscoveryRegions)
 	dbConfigureCreate.Flag("azure-postgres-discovery", "List of Azure regions in which the agent will discover PostgreSQL servers.").StringsVar(&dbConfigCreateFlags.AzurePostgresDiscoveryRegions)
@@ -267,7 +269,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	dbConfigureCreate.Flag("protocol", fmt.Sprintf("Proxied database protocol. Supported are: %v.", defaults.DatabaseProtocols)).StringVar(&dbConfigCreateFlags.StaticDatabaseProtocol)
 	dbConfigureCreate.Flag("uri", "Address the proxied database is reachable at.").StringVar(&dbConfigCreateFlags.StaticDatabaseURI)
 	dbConfigureCreate.Flag("labels", "Comma-separated list of labels for the database, for example env=dev,dept=it").StringVar(&dbConfigCreateFlags.StaticDatabaseRawLabels)
-	dbConfigureCreate.Flag("aws-region", "(Only for AWS-hosted databases) AWS region RDS, Aurora, Redshift, Redshift Serverless, ElastiCache, or MemoryDB database instance is running in.").StringVar(&dbConfigCreateFlags.DatabaseAWSRegion)
+	dbConfigureCreate.Flag("aws-region", "(Only for AWS-hosted databases) AWS region RDS, Aurora, Redshift, Redshift Serverless, ElastiCache, OpenSearch or MemoryDB database instance is running in.").StringVar(&dbConfigCreateFlags.DatabaseAWSRegion)
 	dbConfigureCreate.Flag("aws-account-id", "(Only for Keyspaces or DynamoDB) AWS Account ID.").StringVar(&dbConfigCreateFlags.DatabaseAWSAccountID)
 	dbConfigureCreate.Flag("aws-assume-role-arn", "Optional AWS IAM role to assume.").StringVar(&dbConfigCreateFlags.DatabaseAWSAssumeRoleARN)
 	dbConfigureCreate.Flag("aws-external-id", "(Only for AWS-hosted databases) Optional AWS external ID to use when assuming AWS roles.").StringVar(&dbConfigCreateFlags.DatabaseAWSExternalID)
@@ -407,12 +409,12 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	dumpNodeConfigure.Flag("node-name", "Name for the Teleport node.").StringVar(&dumpFlags.NodeName)
 
 	waitCmd := app.Command(teleport.WaitSubCommand, "Used internally by Teleport to onWait until a specific condition is reached.").Hidden()
-	waitNoResolveCmd := waitCmd.Command("no-resolve", "Used internally to onWait until a domain stops resolving IP addresses.")
-	waitNoResolveCmd.Arg("domain", "Domain that is resolved.").StringVar(&waitFlags.domain)
-	waitNoResolveCmd.Flag("period", "Resolution try period. A jitter is applied.").Default(waitNoResolveDefaultPeriod).DurationVar(&waitFlags.period)
-	waitNoResolveCmd.Flag("timeout", "Stops waiting after this duration and exits in error.").Default(waitNoResolveDefaultTimeout).DurationVar(&waitFlags.timeout)
-	waitDurationCmd := waitCmd.Command("duration", "Used internally to onWait a given duration before exiting.")
-	waitDurationCmd.Arg("duration", "Duration to onWait before exit.").DurationVar(&waitFlags.duration)
+	waitNoResolveCmd := waitCmd.Command("no-resolve", "Used internally to onWait until a domain stops resolving IP addresses.").Hidden()
+	waitNoResolveCmd.Arg("domain", "Domain that is resolved.").Hidden().StringVar(&waitFlags.domain)
+	waitNoResolveCmd.Flag("period", "Resolution try period. A jitter is applied.").Default(waitNoResolveDefaultPeriod).Hidden().DurationVar(&waitFlags.period)
+	waitNoResolveCmd.Flag("timeout", "Stops waiting after this duration and exits in error.").Default(waitNoResolveDefaultTimeout).Hidden().DurationVar(&waitFlags.timeout)
+	waitDurationCmd := waitCmd.Command("duration", "Used internally to onWait a given duration before exiting.").Hidden()
+	waitDurationCmd.Arg("duration", "Duration to onWait before exit.").Hidden().DurationVar(&waitFlags.duration)
 
 	kubeState := app.Command("kube-state", "Used internally by Teleport to operate Kubernetes Secrets where Teleport stores its state.").Hidden()
 	kubeStateDelete := kubeState.Command("delete", "Used internally to delete Kubernetes states when the helm chart is uninstalled.").Hidden()
@@ -433,6 +435,15 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 
 	joinOpenSSH.Flag("debug", "Enable verbose logging to stderr.").Short('d').BoolVar(&ccf.Debug)
 
+	integrationCmd := app.Command("integration", "Integration commands")
+	integrationConfigureCmd := integrationCmd.Command("configure", "Configure an integration")
+	integrationConfDeployServiceCmd := integrationConfigureCmd.Command("deployservice-iam", "Create the required IAM Roles for the AWS OIDC Deploy Service.")
+	integrationConfDeployServiceCmd.Flag("cluster", "Teleport Cluster's name.").Required().StringVar(&ccf.IntegrationConfDeployServiceIAMArguments.Cluster)
+	integrationConfDeployServiceCmd.Flag("name", "Integration name.").Required().StringVar(&ccf.IntegrationConfDeployServiceIAMArguments.Name)
+	integrationConfDeployServiceCmd.Flag("aws-region", "AWS Region.").Required().StringVar(&ccf.IntegrationConfDeployServiceIAMArguments.Region)
+	integrationConfDeployServiceCmd.Flag("role", "The AWS Role used by the AWS OIDC Integration.").Required().StringVar(&ccf.IntegrationConfDeployServiceIAMArguments.Role)
+	integrationConfDeployServiceCmd.Flag("task-role", "The AWS Role to be used by the deployed service.").Required().StringVar(&ccf.IntegrationConfDeployServiceIAMArguments.TaskRole)
+
 	// parse CLI commands+flags:
 	utils.UpdateAppUsageTemplate(app, options.Args)
 	command, err := app.Parse(options.Args)
@@ -500,7 +511,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 			// by the systemd unit upgrader).
 			fmt.Printf("%s\n", teleport.Version)
 		} else {
-			utils.PrintVersion()
+			modules.GetModules().PrintVersion()
 		}
 	case dbConfigureCreate.FullCommand():
 		err = onDumpDatabaseConfig(dbConfigCreateFlags)
@@ -518,6 +529,8 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 		err = onConfigureDiscoveryBootstrap(configureDiscoveryBootstrapFlags)
 	case joinOpenSSH.FullCommand():
 		err = onJoinOpenSSH(ccf, conf)
+	case integrationConfDeployServiceCmd.FullCommand():
+		err = onIntegrationConfDeployService(ccf.IntegrationConfDeployServiceIAMArguments)
 	}
 	if err != nil {
 		utils.FatalError(err)
@@ -547,7 +560,7 @@ func onStatus() error {
 	sshClient := os.Getenv("SSH_CLIENT")
 	systemUser := os.Getenv("USER")
 	teleportUser := os.Getenv(teleport.SSHTeleportUser)
-	proxyAddr := os.Getenv(teleport.SSHSessionWebproxyAddr)
+	proxyAddr := os.Getenv(teleport.SSHSessionWebProxyAddr)
 	clusterName := os.Getenv(teleport.SSHTeleportClusterName)
 	hostUUID := os.Getenv(teleport.SSHTeleportHostUUID)
 	sid := os.Getenv(teleport.SSHSessionID)
@@ -842,3 +855,25 @@ func onJoinOpenSSH(clf config.CommandLineFlags, conf *servicecfg.Config) error {
 	}
 	return nil
 }
+
+func onIntegrationConfDeployService(params config.IntegrationConfDeployServiceIAM) error {
+	ctx := context.Background()
+
+	iamClient, err := awsoidc.NewDeployServiceIAMConfigureClient(ctx, params.Region)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	err = awsoidc.ConfigureDeployServiceIAM(ctx, iamClient, awsoidc.DeployServiceIAMConfigureRequest{
+		Cluster:         params.Cluster,
+		IntegrationName: params.Name,
+		Region:          params.Region,
+		IntegrationRole: params.Role,
+		TaskRole:        params.TaskRole,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
diff --git a/tool/teleport/common/usage.go b/tool/teleport/common/usage.go
index 3618c0de5ffcb..d042139bf53f3 100644
--- a/tool/teleport/common/usage.go
+++ b/tool/teleport/common/usage.go
@@ -87,7 +87,7 @@ the "us-west-1" and "us-west-2" regions.
    --proxy=localhost:3080 \
    --name=sample-db \
    --protocol=postgres \
-   --uri=postgres://localhost:5432 \
+   --uri=localhost:5432 \
    --labels=env=prod
 Generates a configuration with a Postgres database.
 
@@ -119,7 +119,7 @@ const (
 # A Sample Teleport configuration file.
 #
 # Things to update:
-#  1. license.pem: You only need a license from https://dashboard.goteleport.com
+#  1. license.pem: Retrieve a license from your Teleport account https://teleport.sh
 #     if you are an Enterprise customer.
 #`
 )
diff --git a/tool/teleport/testenv/test_server.go b/tool/teleport/testenv/test_server.go
new file mode 100644
index 0000000000000..7483e0ccfbff9
--- /dev/null
+++ b/tool/teleport/testenv/test_server.go
@@ -0,0 +1,324 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package testenv provides functions for creating test servers for testing.
+package testenv
+
+import (
+	"context"
+	"crypto"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/breaker"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/keys"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/cloud"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/modules"
+	"github.com/gravitational/teleport/lib/service"
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/srv"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/tool/teleport/common"
+)
+
+// used to easily join test services
+const staticToken = "test-static-token"
+
+func init() {
+	// If the test is re-executing itself, execute the command that comes over
+	// the pipe. Used to test tsh ssh and tsh scp commands.
+	if srv.IsReexec() {
+		common.Run(common.Options{Args: os.Args[1:]})
+		return
+	}
+
+	modules.SetModules(&cliModules{})
+}
+
+// MakeTestServer creates a Teleport Server for testing.
+func MakeTestServer(t *testing.T, opts ...TestServerOptFunc) (process *service.TeleportProcess) {
+	t.Helper()
+
+	var options TestServersOpts
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	// Set up a test auth server with default config.
+	cfg := servicecfg.MakeDefaultConfig()
+	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
+	cfg.CachePolicy.Enabled = false
+	// Disables cloud auto-imported labels when running tests in cloud envs
+	// such as Github Actions.
+	//
+	// This is required otherwise Teleport will import cloud instance
+	// labels, and use them for example as labels in Kubernetes Service and
+	// cause some tests to fail because the output includes unexpected
+	// labels.
+	//
+	// It is also found that Azure metadata client can throw "Too many
+	// requests" during CI which fails services.NewTeleport.
+	cfg.InstanceMetadataClient = cloud.NewDisabledIMDSClient()
+
+	cfg.Hostname = "server01"
+	cfg.DataDir = t.TempDir()
+	cfg.Log = utils.NewLoggerForTests()
+	authAddr := utils.NetAddr{AddrNetwork: "tcp", Addr: NewTCPListener(t, service.ListenerAuth, &cfg.FileDescriptors)}
+	cfg.SetToken(staticToken)
+	cfg.SetAuthServerAddress(authAddr)
+
+	cfg.Auth.ListenAddr = authAddr
+	cfg.Auth.BootstrapResources = options.Bootstrap
+	cfg.Auth.StorageConfig.Params = backend.Params{defaults.BackendPath: filepath.Join(cfg.DataDir, defaults.BackendDir)}
+	staticToken, err := types.NewStaticTokens(types.StaticTokensSpecV2{
+		StaticTokens: []types.ProvisionTokenV1{{
+			Roles:   []types.SystemRole{types.RoleProxy, types.RoleDatabase, types.RoleTrustedCluster, types.RoleNode, types.RoleApp},
+			Expires: time.Now().Add(time.Minute),
+			Token:   staticToken,
+		}},
+	})
+	require.NoError(t, err)
+	cfg.Auth.StaticTokens = staticToken
+
+	cfg.Proxy.WebAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: NewTCPListener(t, service.ListenerProxyWeb, &cfg.FileDescriptors)}
+	cfg.Proxy.SSHAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: NewTCPListener(t, service.ListenerProxySSH, &cfg.FileDescriptors)}
+	cfg.Proxy.ReverseTunnelListenAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: NewTCPListener(t, service.ListenerProxyTunnel, &cfg.FileDescriptors)}
+	cfg.Proxy.DisableWebInterface = true
+
+	cfg.SSH.Addr = utils.NetAddr{AddrNetwork: "tcp", Addr: NewTCPListener(t, service.ListenerNodeSSH, &cfg.FileDescriptors)}
+	cfg.SSH.DisableCreateHostUser = true
+
+	// Apply options
+	for _, fn := range options.ConfigFuncs {
+		fn(cfg)
+	}
+
+	process, err = service.NewTeleport(cfg)
+	require.NoError(t, err, trace.DebugReport(err))
+	require.NoError(t, process.Start())
+	t.Cleanup(func() {
+		require.NoError(t, process.Close())
+		require.NoError(t, process.Wait())
+	})
+
+	waitForServices(t, process, cfg)
+
+	return process
+}
+
+// NewTCPListener creates a new TCP listener on 127.0.0.1:0, adds it to the
+// FileDescriptor slice (with the specified type) and returns its actual local
+// address as a string (for use in configuration). Takes a pointer to the slice
+// so that it's convenient to call in the middle of a FileConfig or Config
+// struct literal.
+func NewTCPListener(t *testing.T, lt service.ListenerType, fds *[]servicecfg.FileDescriptor) string {
+	t.Helper()
+
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer l.Close()
+	addr := l.Addr().String()
+
+	// File() returns a dup of the listener's file descriptor as an *os.File, so
+	// the original net.Listener still needs to be closed.
+	lf, err := l.(*net.TCPListener).File()
+	require.NoError(t, err)
+	// If the file descriptor slice ends up being passed to a TeleportProcess
+	// that successfully starts, listeners will either get "imported" and used
+	// or discarded and closed, this is just an extra safety measure that closes
+	// the listener at the end of the test anyway (the finalizer would do that
+	// anyway, in principle).
+	t.Cleanup(func() { lf.Close() })
+
+	*fds = append(*fds, servicecfg.FileDescriptor{
+		Type:    string(lt),
+		Address: addr,
+		File:    lf,
+	})
+
+	return addr
+}
+
+func waitForServices(t *testing.T, auth *service.TeleportProcess, cfg *servicecfg.Config) {
+	var serviceReadyEvents []string
+	if cfg.Proxy.Enabled {
+		serviceReadyEvents = append(serviceReadyEvents, service.ProxyWebServerReady)
+	}
+	if cfg.SSH.Enabled {
+		serviceReadyEvents = append(serviceReadyEvents, service.NodeSSHReady)
+	}
+	if cfg.Databases.Enabled {
+		serviceReadyEvents = append(serviceReadyEvents, service.DatabasesReady)
+	}
+	if cfg.Apps.Enabled {
+		serviceReadyEvents = append(serviceReadyEvents, service.AppsReady)
+	}
+	if cfg.Auth.Enabled {
+		serviceReadyEvents = append(serviceReadyEvents, service.AuthTLSReady)
+	}
+	waitForEvents(t, auth, serviceReadyEvents...)
+
+	if cfg.Auth.Enabled && cfg.Databases.Enabled {
+		waitForDatabases(t, auth, cfg.Databases.Databases)
+	}
+}
+
+func waitForEvents(t *testing.T, svc service.Supervisor, events ...string) {
+	for _, event := range events {
+		_, err := svc.WaitForEventTimeout(10*time.Second, event)
+		require.NoError(t, err, "service server didn't receive %v event after 10s", event)
+	}
+}
+
+func waitForDatabases(t *testing.T, auth *service.TeleportProcess, dbs []servicecfg.Database) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	for {
+		select {
+		case <-time.After(500 * time.Millisecond):
+			all, err := auth.GetAuthServer().GetDatabaseServers(ctx, apidefaults.Namespace)
+			require.NoError(t, err)
+
+			// Count how many input "dbs" are registered.
+			var registered int
+			for _, db := range dbs {
+				for _, a := range all {
+					if a.GetName() == db.Name {
+						registered++
+						break
+					}
+				}
+			}
+
+			if registered == len(dbs) {
+				return
+			}
+		case <-ctx.Done():
+			t.Fatal("Databases not registered after 10s")
+		}
+	}
+}
+
+type TestServersOpts struct {
+	Bootstrap   []types.Resource
+	ConfigFuncs []func(cfg *servicecfg.Config)
+}
+
+type TestServerOptFunc func(o *TestServersOpts)
+
+func WithBootstrap(bootstrap ...types.Resource) TestServerOptFunc {
+	return func(o *TestServersOpts) {
+		o.Bootstrap = bootstrap
+	}
+}
+
+func WithConfig(fn func(cfg *servicecfg.Config)) TestServerOptFunc {
+	return func(o *TestServersOpts) {
+		o.ConfigFuncs = append(o.ConfigFuncs, fn)
+	}
+}
+
+func WithAuthConfig(fn func(*servicecfg.AuthConfig)) TestServerOptFunc {
+	return WithConfig(func(cfg *servicecfg.Config) {
+		fn(&cfg.Auth)
+	})
+}
+
+func WithClusterName(t *testing.T, n string) TestServerOptFunc {
+	return WithAuthConfig(func(cfg *servicecfg.AuthConfig) {
+		clusterName, err := services.NewClusterNameWithRandomID(
+			types.ClusterNameSpecV2{
+				ClusterName: n,
+			})
+		require.NoError(t, err)
+		cfg.ClusterName = clusterName
+	})
+}
+
+func WithHostname(hostname string) TestServerOptFunc {
+	return WithConfig(func(cfg *servicecfg.Config) {
+		cfg.Hostname = hostname
+	})
+}
+
+func WithSSHPublicAddrs(addrs ...string) TestServerOptFunc {
+	return WithConfig(func(cfg *servicecfg.Config) {
+		cfg.SSH.PublicAddrs = utils.MustParseAddrList(addrs...)
+	})
+}
+
+func WithSSHLabel(key, value string) TestServerOptFunc {
+	return WithConfig(func(cfg *servicecfg.Config) {
+		if cfg.SSH.Labels == nil {
+			cfg.SSH.Labels = make(map[string]string)
+		}
+		cfg.SSH.Labels[key] = value
+	})
+}
+
+type cliModules struct{}
+
+// BuildType returns build type.
+func (p *cliModules) BuildType() string {
+	return "CLI"
+}
+
+// PrintVersion prints the Teleport version.
+func (p *cliModules) PrintVersion() {
+	fmt.Println("Teleport CLI")
+}
+
+// Features returns supported features
+func (p *cliModules) Features() modules.Features {
+	return modules.Features{
+		Kubernetes:              true,
+		DB:                      true,
+		App:                     true,
+		AdvancedAccessWorkflows: true,
+		AccessControls:          true,
+	}
+}
+
+// IsBoringBinary checks if the binary was compiled with BoringCrypto.
+func (p *cliModules) IsBoringBinary() bool {
+	return false
+}
+
+// AttestHardwareKey attests a hardware key.
+func (p *cliModules) AttestHardwareKey(_ context.Context, _ interface{}, _ keys.PrivateKeyPolicy, _ *keys.AttestationStatement, _ crypto.PublicKey, _ time.Duration) (keys.PrivateKeyPolicy, error) {
+	return keys.PrivateKeyPolicyNone, nil
+}
+
+func (p *cliModules) EnableRecoveryCodes() {
+}
+
+func (p *cliModules) EnablePlugins() {
+}
+
+func (p *cliModules) SetFeatures(f modules.Features) {
+}
diff --git a/tool/tsh/access_request.go b/tool/tsh/common/access_request.go
similarity index 99%
rename from tool/tsh/access_request.go
rename to tool/tsh/common/access_request.go
index 67cbd429423a2..1f1ef95ce42a9 100644
--- a/tool/tsh/access_request.go
+++ b/tool/tsh/common/access_request.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"fmt"
diff --git a/tool/tsh/access_request_test.go b/tool/tsh/common/access_request_test.go
similarity index 99%
rename from tool/tsh/access_request_test.go
rename to tool/tsh/common/access_request_test.go
index 3f660f982b777..c3b9ddccfea47 100644
--- a/tool/tsh/access_request_test.go
+++ b/tool/tsh/common/access_request_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"bytes"
diff --git a/tool/tsh/aliases.go b/tool/tsh/common/aliases.go
similarity index 98%
rename from tool/tsh/aliases.go
rename to tool/tsh/common/aliases.go
index f878a2d8c4c40..05f2eadc43a25 100644
--- a/tool/tsh/aliases.go
+++ b/tool/tsh/common/aliases.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"context"
@@ -41,7 +41,7 @@ type aliasRunner struct {
 	aliases map[string]string
 
 	// runTshMain is a function to run tsh; for example Run().
-	runTshMain func(ctx context.Context, args []string, opts ...cliOption) error
+	runTshMain func(ctx context.Context, args []string, opts ...CliOption) error
 	// runExternalCommand is a function to execute the command passed in as argument; outside of test, it should simply invoke the Run() method.
 	runExternalCommand func(cmd *exec.Cmd) error
 }
diff --git a/tool/tsh/aliases_test.go b/tool/tsh/common/aliases_test.go
similarity index 98%
rename from tool/tsh/aliases_test.go
rename to tool/tsh/common/aliases_test.go
index 034204a2a8824..838086a3efede 100644
--- a/tool/tsh/aliases_test.go
+++ b/tool/tsh/common/aliases_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"context"
@@ -34,7 +34,7 @@ func newTestAliasRunner(t *testing.T) *aliasRunner {
 			t.Fatalf("calling uninitialized function 'setEnv(key=%q,value=%q)'", key, value)
 			return nil
 		},
-		runTshMain: func(ctx context.Context, args []string, opts ...cliOption) error {
+		runTshMain: func(ctx context.Context, args []string, opts ...CliOption) error {
 			t.Fatalf("calling uninitialized function 'runTshMain(ctx=%v,args=%v,opts=%v)'", ctx, args, opts)
 			return nil
 		},
@@ -353,7 +353,7 @@ func Test_runAliasCommand(t *testing.T) {
 	externalCalls := 0
 
 	ar := &aliasRunner{
-		runTshMain: func(ctx context.Context, args []string, opts ...cliOption) error {
+		runTshMain: func(ctx context.Context, args []string, opts ...CliOption) error {
 			mainCalls++
 			return nil
 		},
diff --git a/tool/tsh/app.go b/tool/tsh/common/app.go
similarity index 99%
rename from tool/tsh/app.go
rename to tool/tsh/common/app.go
index fd2195ecadb37..dcc32ed708bbf 100644
--- a/tool/tsh/app.go
+++ b/tool/tsh/common/app.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"crypto/tls"
diff --git a/tool/tsh/app_aws.go b/tool/tsh/common/app_aws.go
similarity index 99%
rename from tool/tsh/app_aws.go
rename to tool/tsh/common/app_aws.go
index e6c9841318e57..2e8ff2ebf7057 100644
--- a/tool/tsh/app_aws.go
+++ b/tool/tsh/common/app_aws.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"fmt"
diff --git a/tool/tsh/app_aws_test.go b/tool/tsh/common/app_aws_test.go
similarity index 97%
rename from tool/tsh/app_aws_test.go
rename to tool/tsh/common/app_aws_test.go
index 463d0af4ac35d..fe4f963b4d58f 100644
--- a/tool/tsh/app_aws_test.go
+++ b/tool/tsh/common/app_aws_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
@@ -58,8 +58,8 @@ func TestAWS(t *testing.T) {
 	// Log into Teleport cluster.
 	err = Run(context.Background(), []string{
 		"login", "--insecure", "--debug", "--auth", connector.GetName(), "--proxy", proxyAddr.String(),
-	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, authServer, user)
+	}, setHomePath(tmpHomePath), CliOption(func(cf *CLIConf) error {
+		cf.MockSSOLogin = mockSSOLogin(t, authServer, user)
 		return nil
 	}))
 	require.NoError(t, err)
diff --git a/tool/tsh/app_azure.go b/tool/tsh/common/app_azure.go
similarity index 99%
rename from tool/tsh/app_azure.go
rename to tool/tsh/common/app_azure.go
index ca4e8a5ab38cd..91383d28ae072 100644
--- a/tool/tsh/app_azure.go
+++ b/tool/tsh/common/app_azure.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"fmt"
diff --git a/tool/tsh/app_azure_test.go b/tool/tsh/common/app_azure_test.go
similarity index 99%
rename from tool/tsh/app_azure_test.go
rename to tool/tsh/common/app_azure_test.go
index 2b2e527a69ac7..59178777926d5 100644
--- a/tool/tsh/app_azure_test.go
+++ b/tool/tsh/common/app_azure_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
@@ -57,10 +57,10 @@ func TestAzure(t *testing.T) {
 	require.NoError(t, err)
 
 	// helper function
-	run := func(args []string, opts ...cliOption) {
+	run := func(args []string, opts ...CliOption) {
 		opts = append(opts, setHomePath(tmpHomePath))
 		opts = append(opts, func(cf *CLIConf) error {
-			cf.mockSSOLogin = mockSSOLogin(t, authServer, user)
+			cf.MockSSOLogin = mockSSOLogin(t, authServer, user)
 			return nil
 		})
 		err := Run(context.Background(), args, opts...)
@@ -213,6 +213,8 @@ func makeUserWithAzureRole(t *testing.T) (types.User, types.Role) {
 }
 
 func Test_getAzureIdentityFromFlags(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name              string
 		requestedIdentity string
@@ -441,6 +443,8 @@ func Test_getMSISecret(t *testing.T) {
 }
 
 func Test_formatAzureIdentities(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name       string
 		identities []string
diff --git a/tool/tsh/app_cloud.go b/tool/tsh/common/app_cloud.go
similarity index 99%
rename from tool/tsh/app_cloud.go
rename to tool/tsh/common/app_cloud.go
index 67a63810db243..c844961af715e 100644
--- a/tool/tsh/app_cloud.go
+++ b/tool/tsh/common/app_cloud.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"strings"
diff --git a/tool/tsh/app_cloud_test.go b/tool/tsh/common/app_cloud_test.go
similarity index 98%
rename from tool/tsh/app_cloud_test.go
rename to tool/tsh/common/app_cloud_test.go
index 8a59f328157ad..9094163440c0c 100644
--- a/tool/tsh/app_cloud_test.go
+++ b/tool/tsh/common/app_cloud_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"testing"
@@ -23,6 +23,8 @@ import (
 )
 
 func Test_filterApps(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name            string
 		matchRouteToApp func(tlsca.RouteToApp) bool
diff --git a/tool/tsh/app_gcp.go b/tool/tsh/common/app_gcp.go
similarity index 99%
rename from tool/tsh/app_gcp.go
rename to tool/tsh/common/app_gcp.go
index a24cc4a28a93c..f826177725afd 100644
--- a/tool/tsh/app_gcp.go
+++ b/tool/tsh/common/app_gcp.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"fmt"
diff --git a/tool/tsh/app_gcp_test.go b/tool/tsh/common/app_gcp_test.go
similarity index 99%
rename from tool/tsh/app_gcp_test.go
rename to tool/tsh/common/app_gcp_test.go
index 133e5b0df5a4e..359f7bac74154 100644
--- a/tool/tsh/app_gcp_test.go
+++ b/tool/tsh/common/app_gcp_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"fmt"
@@ -27,6 +27,8 @@ import (
 )
 
 func Test_getGCPServiceAccountFromFlags(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name                    string
 		requestedServiceAccount string
@@ -139,6 +141,8 @@ func Test_getGCPServiceAccountFromFlags(t *testing.T) {
 }
 
 func Test_formatGCPServiceAccounts(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name     string
 		accounts []string
diff --git a/tool/tsh/app_test.go b/tool/tsh/common/app_test.go
similarity index 98%
rename from tool/tsh/app_test.go
rename to tool/tsh/common/app_test.go
index 435f053141ccc..96ebeae13ac41 100644
--- a/tool/tsh/app_test.go
+++ b/tool/tsh/common/app_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"bytes"
@@ -36,7 +36,7 @@ import (
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/client"
 	defaults2 "github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/reversetunnel"
+	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 )
@@ -86,7 +86,7 @@ func TestAppLoginLeaf(t *testing.T) {
 	rootAuth, rootProxy := makeTestServers(t, withClusterName(t, "root"), withBootstrap(connector, alice), withConfig(configStorage))
 	event, err := rootAuth.WaitForEventTimeout(time.Second, service.ProxyReverseTunnelReady)
 	require.NoError(t, err)
-	tunnel, ok := event.Payload.(reversetunnel.Server)
+	tunnel, ok := event.Payload.(reversetunnelclient.Server)
 	require.True(t, ok)
 
 	rootAppURL := startDummyHTTPServer(t, "rootapp")
@@ -147,7 +147,7 @@ func TestAppLoginLeaf(t *testing.T) {
 	getHelpers := func(t *testing.T) (func(cluster string) string, func(args ...string) string) {
 		tmpHomePath := t.TempDir()
 
-		run := func(args []string, opts ...cliOption) string {
+		run := func(args []string, opts ...CliOption) string {
 			ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
 			defer cancel()
 
@@ -169,7 +169,7 @@ func TestAppLoginLeaf(t *testing.T) {
 				cluster}
 
 			opt := func(cf *CLIConf) error {
-				cf.mockSSOLogin = mockSSOLogin(t, rootAuth.GetAuthServer(), alice)
+				cf.MockSSOLogin = mockSSOLogin(t, rootAuth.GetAuthServer(), alice)
 				return nil
 			}
 
diff --git a/tool/tsh/config.go b/tool/tsh/common/config.go
similarity index 96%
rename from tool/tsh/config.go
rename to tool/tsh/common/config.go
index 74acf36bad788..6a8b229ce1d47 100644
--- a/tool/tsh/config.go
+++ b/tool/tsh/common/config.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"fmt"
@@ -49,7 +49,7 @@ func onConfig(cf *CLIConf) error {
 
 	// Note: TeleportClient.connectToProxy() overrides the proxy address when
 	// JumpHosts are in use, which this does not currently implement.
-	proxyHost, _, err := net.SplitHostPort(tc.Config.SSHProxyAddr)
+	proxyHost, proxyPort, err := net.SplitHostPort(tc.Config.WebProxyAddr)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -89,6 +89,7 @@ func onConfig(cf *CLIConf) error {
 		CertificateFilePath: keypaths.SSHCertPath(keysDir, proxyHost,
 			tc.Config.Username, rootClusterName),
 		ProxyHost:      proxyHost,
+		ProxyPort:      proxyPort,
 		ExecutablePath: cf.executablePath,
 	}, nil); err != nil {
 		return trace.Wrap(err)
diff --git a/tool/tsh/config_test.go b/tool/tsh/common/config_test.go
similarity index 96%
rename from tool/tsh/config_test.go
rename to tool/tsh/common/config_test.go
index 4e1b14f256e1b..f2af42207ea7d 100644
--- a/tool/tsh/config_test.go
+++ b/tool/tsh/common/config_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"strings"
@@ -42,7 +42,7 @@ Host *.test-cluster localhost
 # Flags for all test-cluster hosts except the proxy
 Host *.test-cluster !localhost
     Port 3022
-    ProxyCommand "/bin/tsh" proxy ssh --cluster=test-cluster --proxy=localhost %r@%h:%p
+    ProxyCommand "/bin/tsh" proxy ssh --cluster=test-cluster --proxy=localhost:3080 %r@%h:%p
 
 # End generated Teleport configuration
 `
@@ -55,6 +55,7 @@ Host *.test-cluster !localhost
 		IdentityFilePath:    "/tmp/alice",
 		CertificateFilePath: "/tmp/localhost-cert.pub",
 		ProxyHost:           "localhost",
+		ProxyPort:           "3080",
 		ExecutablePath:      "/bin/tsh",
 	}, func() (*semver.Version, error) {
 		return semver.New("9.0.0"), nil
diff --git a/tool/tsh/daemon.go b/tool/tsh/common/daemon.go
similarity index 98%
rename from tool/tsh/daemon.go
rename to tool/tsh/common/daemon.go
index b749751bdda45..d3cd3cedb2884 100644
--- a/tool/tsh/daemon.go
+++ b/tool/tsh/common/daemon.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
diff --git a/tool/tsh/daemonstop_unix.go b/tool/tsh/common/daemonstop_unix.go
similarity index 98%
rename from tool/tsh/daemonstop_unix.go
rename to tool/tsh/common/daemonstop_unix.go
index cf13675e25f89..5c9f673ced62c 100644
--- a/tool/tsh/daemonstop_unix.go
+++ b/tool/tsh/common/daemonstop_unix.go
@@ -15,7 +15,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 // onDaemonStop implements the "tsh daemon stop" command. It handles graceful shutdown of the daemon
 // on Windows, so it's a noop on other platforms. See daemonstop_windows.go for more details.
diff --git a/tool/tsh/daemonstop_windows.go b/tool/tsh/common/daemonstop_windows.go
similarity index 99%
rename from tool/tsh/daemonstop_windows.go
rename to tool/tsh/common/daemonstop_windows.go
index 20887a5359830..b685738b41b7b 100644
--- a/tool/tsh/daemonstop_windows.go
+++ b/tool/tsh/common/daemonstop_windows.go
@@ -15,7 +15,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"syscall"
diff --git a/tool/tsh/db.go b/tool/tsh/common/db.go
similarity index 96%
rename from tool/tsh/db.go
rename to tool/tsh/common/db.go
index 7c297b97dbf42..4d196e3f6e6b9 100644
--- a/tool/tsh/db.go
+++ b/tool/tsh/common/db.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"bytes"
@@ -82,7 +82,7 @@ func onListDatabases(cf *CLIConf) error {
 		return trace.Wrap(err)
 	}
 
-	roleSet, err := fetchRoleSetForCluster(cf.Context, profile, proxy, tc.SiteName)
+	accessChecker, err := accessCheckerForRemoteCluster(cf.Context, profile, proxy, tc.SiteName)
 	if err != nil {
 		log.Debugf("Failed to fetch user roles: %v.", err)
 	}
@@ -93,28 +93,25 @@ func onListDatabases(cf *CLIConf) error {
 	}
 
 	sort.Sort(types.Databases(databases))
-	return trace.Wrap(showDatabases(cf.Stdout(), cf.SiteName, databases, activeDatabases, roleSet, cf.Format, cf.Verbose))
+	return trace.Wrap(showDatabases(cf.Stdout(), cf.SiteName, databases, activeDatabases, accessChecker, cf.Format, cf.Verbose))
 }
 
-func fetchRoleSetForCluster(ctx context.Context, profile *client.ProfileStatus, proxy *client.ProxyClient, clusterName string) (services.RoleSet, error) {
+func accessCheckerForRemoteCluster(ctx context.Context, profile *client.ProfileStatus, proxy *client.ProxyClient, clusterName string) (services.AccessChecker, error) {
 	cluster, err := proxy.ConnectToCluster(ctx, clusterName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	defer cluster.Close()
 
-	roleSet, err := services.FetchAllClusterRoles(ctx, cluster, profile.Roles, profile.Traits)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return roleSet, nil
+	accessChecker, err := services.NewAccessCheckerForRemoteCluster(ctx, profile.AccessInfo(), clusterName, cluster)
+	return accessChecker, trace.Wrap(err)
 }
 
 type databaseListing struct {
-	Proxy    string           `json:"proxy"`
-	Cluster  string           `json:"cluster"`
-	roleSet  services.RoleSet `json:"-"`
-	Database types.Database   `json:"database"`
+	Proxy         string                 `json:"proxy"`
+	Cluster       string                 `json:"cluster"`
+	accessChecker services.AccessChecker `json:"-"`
+	Database      types.Database         `json:"database"`
 }
 
 type databaseListings []databaseListing
@@ -188,7 +185,7 @@ func listDatabasesAllClusters(cf *CLIConf) error {
 				return nil
 			}
 
-			roleSet, err := fetchRoleSetForCluster(ctx, cluster.profile, cluster.proxy, cluster.name)
+			accessChecker, err := accessCheckerForRemoteCluster(ctx, cluster.profile, cluster.proxy, cluster.name)
 			if err != nil {
 				log.Debugf("Failed to fetch user roles: %v.", err)
 			}
@@ -196,10 +193,10 @@ func listDatabasesAllClusters(cf *CLIConf) error {
 			localDBListings := make(databaseListings, 0, len(databases))
 			for _, database := range databases {
 				localDBListings = append(localDBListings, databaseListing{
-					Proxy:    cluster.profile.ProxyURL.Host,
-					Cluster:  cluster.name,
-					roleSet:  roleSet,
-					Database: database,
+					Proxy:         cluster.profile.ProxyURL.Host,
+					Cluster:       cluster.name,
+					accessChecker: accessChecker,
+					Database:      database,
 				})
 			}
 			mu.Lock()
@@ -895,13 +892,13 @@ func newDatabaseInfo(cf *CLIConf, tc *client.TeleportClient, route tlsca.RouteTo
 	}
 	defer proxy.Close()
 
-	roleSet, err := fetchRoleSetForCluster(cf.Context, profile, proxy, tc.SiteName)
+	checker, err := accessCheckerForRemoteCluster(cf.Context, profile, proxy, tc.SiteName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	if needDBUser {
-		dbUser, err := getDefaultDBUser(db, roleSet)
+		dbUser, err := getDefaultDBUser(db, checker)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -909,7 +906,7 @@ func newDatabaseInfo(cf *CLIConf, tc *client.TeleportClient, route tlsca.RouteTo
 		dbInfo.Username = dbUser
 	}
 	if needDBName {
-		dbName, err := getDefaultDBName(db, roleSet)
+		dbName, err := getDefaultDBName(db, checker)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -923,7 +920,7 @@ func newDatabaseInfo(cf *CLIConf, tc *client.TeleportClient, route tlsca.RouteTo
 // getDefaultDBUser enumerates the allowed database users for a given database
 // and selects one if it is the only non-wildcard database user allowed.
 // Returns an error if there are no allowed database users or more than one.
-func getDefaultDBUser(db types.Database, roleSet services.RoleSet) (string, error) {
+func getDefaultDBUser(db types.Database, checker services.AccessChecker) (string, error) {
 	var extraUsers []string
 	if db.GetProtocol() == defaults.ProtocolRedis {
 		// Check for the Redis default username "default" in the same way as
@@ -932,7 +929,7 @@ func getDefaultDBUser(db types.Database, roleSet services.RoleSet) (string, erro
 		// ref: https://redis.io/commands/auth
 		extraUsers = append(extraUsers, defaults.DefaultRedisUsername)
 	}
-	dbUsers := roleSet.EnumerateDatabaseUsers(db, extraUsers...)
+	dbUsers := checker.EnumerateDatabaseUsers(db, extraUsers...)
 	allowed := dbUsers.Allowed()
 	if len(allowed) == 1 {
 		return allowed[0], nil
@@ -960,8 +957,8 @@ func getDefaultDBUser(db types.Database, roleSet services.RoleSet) (string, erro
 // getDefaultDBName enumerates the allowed database names for a given database
 // and selects one if it is the only non-wildcard database name allowed.
 // Returns an error if there are no allowed database names or more than one.
-func getDefaultDBName(db types.Database, roleSet services.RoleSet) (string, error) {
-	dbNames := roleSet.EnumerateDatabaseNames(db)
+func getDefaultDBName(db types.Database, checker services.AccessChecker) (string, error) {
+	dbNames := checker.EnumerateDatabaseNames(db)
 	allowed := dbNames.Allowed()
 	if len(allowed) == 1 {
 		return allowed[0], nil
diff --git a/tool/tsh/db_test.go b/tool/tsh/common/db_test.go
similarity index 97%
rename from tool/tsh/db_test.go
rename to tool/tsh/common/db_test.go
index 481d5b224da0d..1981a5bbffd95 100644
--- a/tool/tsh/db_test.go
+++ b/tool/tsh/common/db_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"bytes"
@@ -32,6 +32,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/breaker"
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
@@ -115,8 +116,8 @@ func TestDatabaseLogin(t *testing.T) {
 	// Log into Teleport cluster.
 	err = Run(context.Background(), []string{
 		"login", "--insecure", "--debug", "--auth", connector.GetName(), "--proxy", proxyAddr.String(),
-	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+	}, setHomePath(tmpHomePath), CliOption(func(cf *CLIConf) error {
+		cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 		return nil
 	}))
 	require.NoError(t, err)
@@ -251,8 +252,8 @@ func TestLocalProxyRequirement(t *testing.T) {
 	// Log into Teleport cluster.
 	err = Run(context.Background(), []string{
 		"login", "--insecure", "--debug", "--auth", connector.GetName(), "--proxy", proxyAddr.String(),
-	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+	}, setHomePath(tmpHomePath), CliOption(func(cf *CLIConf) error {
+		cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 		return nil
 	}))
 	require.NoError(t, err)
@@ -315,6 +316,7 @@ func TestLocalProxyRequirement(t *testing.T) {
 				Context:         ctx,
 				TracingProvider: tracing.NoopProvider(),
 				HomePath:        tmpHomePath,
+				tracer:          tracing.NoopTracer(teleport.ComponentTSH),
 			}
 			tc, err := makeClient(cf)
 			require.NoError(t, err)
@@ -372,6 +374,7 @@ func TestListDatabase(t *testing.T) {
 		"--insecure",
 		"--debug",
 	}, setCopyStdout(captureStdout))
+
 	require.NoError(t, err)
 	require.Contains(t, captureStdout.String(), "root-postgres")
 
@@ -384,11 +387,14 @@ func TestListDatabase(t *testing.T) {
 		"--insecure",
 		"--debug",
 	}, setCopyStdout(captureStdout))
+
 	require.NoError(t, err)
 	require.Contains(t, captureStdout.String(), "leaf-postgres")
 }
 
 func TestFormatDatabaseListCommand(t *testing.T) {
+	t.Parallel()
+
 	t.Run("default", func(t *testing.T) {
 		require.Equal(t, "tsh db ls", formatDatabaseListCommand(""))
 	})
@@ -399,6 +405,8 @@ func TestFormatDatabaseListCommand(t *testing.T) {
 }
 
 func TestFormatConfigCommand(t *testing.T) {
+	t.Parallel()
+
 	db := tlsca.RouteToDatabase{
 		ServiceName: "example-db",
 	}
@@ -413,6 +421,8 @@ func TestFormatConfigCommand(t *testing.T) {
 }
 
 func TestDBInfoHasChanged(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name               string
 		databaseUserName   string
@@ -774,7 +784,8 @@ func TestGetDefaultDBNameAndUser(t *testing.T) {
 					},
 				},
 			}
-			dbUser, err := getDefaultDBUser(test.db, services.RoleSet{role})
+			accessChecker := services.NewAccessCheckerWithRoleSet(&services.AccessInfo{}, "clustername", services.NewRoleSet(role))
+			dbUser, err := getDefaultDBUser(test.db, accessChecker)
 			if test.expectErr != "" {
 				require.ErrorContains(t, err, test.expectErr)
 				if test.expectDBUserHint != "" {
@@ -784,7 +795,7 @@ func TestGetDefaultDBNameAndUser(t *testing.T) {
 			}
 			require.NoError(t, err)
 			require.Equal(t, test.expectDBUser, dbUser)
-			dbName, err := getDefaultDBName(test.db, services.RoleSet{role})
+			dbName, err := getDefaultDBName(test.db, accessChecker)
 			if test.expectErr != "" {
 				require.ErrorContains(t, err, test.expectErr)
 				if test.expectDBNameHint != "" {
diff --git a/tool/tsh/device.go b/tool/tsh/common/device.go
similarity index 69%
rename from tool/tsh/device.go
rename to tool/tsh/common/device.go
index 85e539dca8ebd..c0e12d0d16013 100644
--- a/tool/tsh/device.go
+++ b/tool/tsh/common/device.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"fmt"
@@ -34,13 +34,18 @@ type deviceCommand struct {
 	// collect and keyget are debug commands.
 	collect *deviceCollectCommand
 	keyget  *deviceKeygetCommand
+
+	// activateCredential is a hidden command invoked on an elevated child
+	// process
+	activateCredential *deviceActivateCredentialCommand
 }
 
 func newDeviceCommand(app *kingpin.Application) *deviceCommand {
 	root := &deviceCommand{
-		enroll:  &deviceEnrollCommand{},
-		collect: &deviceCollectCommand{},
-		keyget:  &deviceKeygetCommand{},
+		enroll:             &deviceEnrollCommand{},
+		collect:            &deviceCollectCommand{},
+		keyget:             &deviceKeygetCommand{},
+		activateCredential: &deviceActivateCredentialCommand{},
 	}
 
 	// "tsh device" command.
@@ -57,7 +62,13 @@ func newDeviceCommand(app *kingpin.Application) *deviceCommand {
 	// "tsh device" hidden debug commands.
 	root.collect.CmdClause = parentCmd.Command("collect", "Simulate enroll/authn device data collection").Hidden()
 	root.keyget.CmdClause = parentCmd.Command("keyget", "Get information about the device key").Hidden()
-
+	root.activateCredential.CmdClause = parentCmd.Command("tpm-activate-credential", "").Hidden()
+	root.activateCredential.Flag("encrypted-credential", "").
+		Required().
+		StringVar(&root.activateCredential.encryptedCredential)
+	root.activateCredential.Flag("encrypted-credential-secret", "").
+		Required().
+		StringVar(&root.activateCredential.encryptedCredentialSecret)
 	return root
 }
 
@@ -89,7 +100,7 @@ func (c *deviceEnrollCommand) run(cf *CLIConf) error {
 		defer authClient.Close()
 
 		devices := authClient.DevicesClient()
-		dev, err = enroll.RunCeremony(ctx, devices, c.token)
+		dev, err = enroll.RunCeremony(ctx, devices, cf.Debug, c.token)
 		return trace.Wrap(err)
 	}); err != nil {
 		return trace.Wrap(err)
@@ -147,3 +158,25 @@ func (c *deviceKeygetCommand) run(cf *CLIConf) error {
 	fmt.Printf("DeviceCredential %s\n", val)
 	return nil
 }
+
+type deviceActivateCredentialCommand struct {
+	*kingpin.CmdClause
+	encryptedCredential       string
+	encryptedCredentialSecret string
+}
+
+func (c *deviceActivateCredentialCommand) run(cf *CLIConf) error {
+	//nolint:staticcheck // HandleTPMActivateCredential works depending on the platform.
+	err := dtnative.HandleTPMActivateCredential(
+		c.encryptedCredential, c.encryptedCredentialSecret,
+	)
+	//nolint:staticcheck // `err` can indeed be nil.
+	if cf.Debug && err != nil {
+		// On error, wait for user input before executing. This is because this
+		// opens in a second window. If we return the error immediately, then
+		// this window closes before the user can inspect it.
+		log.WithError(err).Error("An error occurred during credential activation. Press enter to close this window.")
+		_, _ = fmt.Scanln()
+	}
+	return trace.Wrap(err)
+}
diff --git a/tool/tsh/fido2.go b/tool/tsh/common/fido2.go
similarity index 99%
rename from tool/tsh/fido2.go
rename to tool/tsh/common/fido2.go
index 16df89c801dfa..f4a3d24055608 100644
--- a/tool/tsh/fido2.go
+++ b/tool/tsh/common/fido2.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"crypto/x509"
diff --git a/tool/tsh/help.go b/tool/tsh/common/help.go
similarity index 77%
rename from tool/tsh/help.go
rename to tool/tsh/common/help.go
index dee8cc003d15b..3810edc053d3d 100644
--- a/tool/tsh/help.go
+++ b/tool/tsh/common/help.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 const (
 	// loginUsageFooter is printed at the bottom of `tsh help login` output
@@ -40,10 +40,10 @@ EXAMPLES:
   For passwordless authentication use:
   $ tsh login --auth=passwordless`
 
-	// missingPrincipalsFooter is printed at the bottom of `tsh ls` when no results are returned.
-	missingPrincipalsFooter = `
-  Not seeing nodes? Your user may be missing Linux principals. If trying Teleport for the first time, follow this guide:
+	// emptyNodesFooter is printed at the bottom of `tsh ls` when no results are returned for nodes.
+	emptyNodesFooter = `
+  Not seeing nodes? Either no nodes are available or your user's roles do not match the labels of at least one node.
 
-https://goteleport.com/docs/getting-started/linux-server/#step-46-create-a-teleport-user-and-set-up-two-factor-authentication
+  Check with your Teleport cluster administrator that your user's roles should have nodes available.
   `
 )
diff --git a/tool/tsh/kube.go b/tool/tsh/common/kube.go
similarity index 98%
rename from tool/tsh/kube.go
rename to tool/tsh/common/kube.go
index 8a0b4244af548..7761984c06ff2 100644
--- a/tool/tsh/kube.go
+++ b/tool/tsh/common/kube.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
@@ -648,7 +648,7 @@ func (c *kubeCredentialsCommand) run(cf *CLIConf) error {
 		return trace.Wrap(c.issueCert(cf))
 	}
 
-	if err := c.checkLocalProxyRequirement(profile.TLSRoutingConnUpgradeRequired); err != nil {
+	if err := c.checkLocalProxyRequirement(profile); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -684,7 +684,7 @@ func (c *kubeCredentialsCommand) issueCert(cf *CLIConf) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	if err := c.checkLocalProxyRequirement(tc.TLSRoutingConnUpgradeRequired); err != nil {
+	if err := c.checkLocalProxyRequirement(tc.Profile()); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -729,7 +729,7 @@ func (c *kubeCredentialsCommand) issueCert(cf *CLIConf) error {
 	err = client.RetryWithRelogin(ctx, tc, func() error {
 		// The requirement may change after a new login so check again just in
 		// case.
-		if err := c.checkLocalProxyRequirement(tc.TLSRoutingConnUpgradeRequired); err != nil {
+		if err := c.checkLocalProxyRequirement(tc.Profile()); err != nil {
 			return trace.Wrap(err)
 		}
 
@@ -773,8 +773,8 @@ func isNetworkError(err error) bool {
 	return errors.As(err, &opErr) || trace.IsConnectionProblem(err)
 }
 
-func (c *kubeCredentialsCommand) checkLocalProxyRequirement(connUpgradeRequired bool) error {
-	if connUpgradeRequired {
+func (c *kubeCredentialsCommand) checkLocalProxyRequirement(profile *profile.Profile) error {
+	if profile.RequireKubeLocalProxy() {
 		return trace.BadParameter("Cannot connect Kubernetes clients to Teleport Proxy directly. Please use `tsh proxy kube` or `tsh kubectl` instead.")
 	}
 	return nil
@@ -1183,7 +1183,7 @@ func (c *kubeLoginCommand) run(cf *CLIConf) error {
 }
 
 func (c *kubeLoginCommand) printUserMessage(cf *CLIConf, tc *client.TeleportClient) {
-	if c.localProxyRequired(tc) {
+	if tc.Profile().RequireKubeLocalProxy() {
 		c.printLocalProxyUserMessage(cf)
 		return
 	}
@@ -1213,10 +1213,6 @@ Use the kubeconfig provided by the local proxy, select a context, and try 'kubec
 	}
 }
 
-func (c *kubeLoginCommand) localProxyRequired(tc *client.TeleportClient) bool {
-	return tc.TLSRoutingConnUpgradeRequired
-}
-
 func fetchKubeClusters(ctx context.Context, tc *client.TeleportClient) (teleportCluster string, kubeClusters []types.KubeCluster, err error) {
 	err = client.RetryWithRelogin(ctx, tc, func() error {
 		pc, err := tc.ConnectToProxy(ctx)
@@ -1398,8 +1394,8 @@ func updateKubeConfig(cf *CLIConf, tc *client.TeleportClient, path string, overr
 func getKubeConfigPath(cf *CLIConf, path string) string {
 	// cf.kubeConfigPath is used in tests to allow Teleport to run tsh login commands
 	// in parallel. If defined, it should take precedence over kubeconfig.PathFromEnv().
-	if path == "" && cf.kubeConfigPath != "" {
-		path = cf.kubeConfigPath
+	if path == "" && cf.KubeConfigPath != "" {
+		path = cf.KubeConfigPath
 	} else if path == "" {
 		path = kubeconfig.PathFromEnv()
 	}
diff --git a/tool/tsh/kube_proxy.go b/tool/tsh/common/kube_proxy.go
similarity index 99%
rename from tool/tsh/kube_proxy.go
rename to tool/tsh/common/kube_proxy.go
index d0c0c20a2e51a..f76aab20ff02a 100644
--- a/tool/tsh/kube_proxy.go
+++ b/tool/tsh/common/kube_proxy.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
diff --git a/tool/tsh/kube_proxy_test.go b/tool/tsh/common/kube_proxy_test.go
similarity index 99%
rename from tool/tsh/kube_proxy_test.go
rename to tool/tsh/common/kube_proxy_test.go
index 3fe13d98b7e8e..073321765bbe9 100644
--- a/tool/tsh/kube_proxy_test.go
+++ b/tool/tsh/common/kube_proxy_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
diff --git a/tool/tsh/kube_test.go b/tool/tsh/common/kube_test.go
similarity index 99%
rename from tool/tsh/kube_test.go
rename to tool/tsh/common/kube_test.go
index 4964f7488060b..b50240854bf09 100644
--- a/tool/tsh/kube_test.go
+++ b/tool/tsh/common/kube_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"bytes"
diff --git a/tool/tsh/kubectl.go b/tool/tsh/common/kubectl.go
similarity index 98%
rename from tool/tsh/kubectl.go
rename to tool/tsh/common/kubectl.go
index cafe160e72d3a..1bd1bfd70a58f 100644
--- a/tool/tsh/kubectl.go
+++ b/tool/tsh/common/kubectl.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"bufio"
@@ -50,6 +50,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/kube/kubeconfig"
+	"github.com/gravitational/teleport/lib/observability/tracing"
 )
 
 var (
@@ -151,14 +152,13 @@ func wrapConfigFn(cf *CLIConf) func(c *rest.Config) *rest.Config {
 // paths.
 func runKubectlCode(cf *CLIConf, args []string) {
 	closeTracer := func() {}
+	cf.TracingProvider = tracing.NoopProvider()
+	cf.tracer = cf.TracingProvider.Tracer(teleport.ComponentTSH)
 	if cf.SampleTraces {
 		provider, err := newTraceProvider(cf, "", nil)
 		if err != nil {
 			log.WithError(err).Debug("Failed to set up span forwarding")
 		} else {
-			// only update the provider if we successfully set it up
-			cf.TracingProvider = provider
-
 			// ensure that the provider is shutdown on exit to flush any spans
 			// that haven't been forwarded yet.
 			closeTracer = func() {
@@ -453,11 +453,11 @@ func makeAndStartKubeLocalProxy(cf *CLIConf, config *clientcmdapi.Config, cluste
 }
 
 // shouldUseKubeLocalProxy checks if a local proxy is required for kube
-// access.
+// access for `tsh kubectl` or `tsh kube exec`.
 //
 // The local proxy is required when all of these conditions are met:
 // - profile is loadable
-// - kube access is enabled
+// - kube access is enabled, and is accessed through web proxy address
 // - ALPN connection upgrade is required (e.g. Proxy behind ALB)
 // - not `kubectl config` commands
 // - original/default kubeconfig is loadable
@@ -470,9 +470,7 @@ func shouldUseKubeLocalProxy(cf *CLIConf, kubectlArgs []string) (*clientcmdapi.C
 		return nil, nil, false
 	}
 
-	// Only use local proxy when Kube is enabled and ALPN connection upgrade is
-	// required.
-	if !profile.TLSRoutingConnUpgradeRequired || profile.KubeProxyAddr == "" {
+	if !profile.RequireKubeLocalProxy() {
 		return nil, nil, false
 	}
 
diff --git a/tool/tsh/kubectl_test.go b/tool/tsh/common/kubectl_test.go
similarity index 99%
rename from tool/tsh/kubectl_test.go
rename to tool/tsh/common/kubectl_test.go
index 72e0aafd9b1e8..feccc3f0d007f 100644
--- a/tool/tsh/kubectl_test.go
+++ b/tool/tsh/common/kubectl_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"path"
diff --git a/tool/tsh/mfa.go b/tool/tsh/common/mfa.go
similarity index 98%
rename from tool/tsh/mfa.go
rename to tool/tsh/common/mfa.go
index 4a0d5500ee617..f7a1da9063f93 100644
--- a/tool/tsh/mfa.go
+++ b/tool/tsh/common/mfa.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
@@ -41,6 +41,7 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/prompt"
+	"golang.org/x/exp/slices"
 
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/ghodss/yaml"
@@ -220,6 +221,14 @@ func (c *mfaAddCommand) run(cf *CLIConf) error {
 	}
 	ctx := cf.Context
 
+	// Attempt to diagnose clamshell failures.
+	if !slices.Contains(defaultDeviceTypes, touchIDDeviceType) {
+		diag, err := touchid.Diag()
+		if err == nil && diag.IsClamshellFailure() {
+			log.Warn("Touch ID support disabled, is your MacBook lid closed?")
+		}
+	}
+
 	if c.devType == "" {
 		// If we are prompting the user for the device type, then take a glimpse at
 		// server-side settings and adjust the options accordingly.
diff --git a/tool/tsh/options.go b/tool/tsh/common/options.go
similarity index 99%
rename from tool/tsh/options.go
rename to tool/tsh/common/options.go
index 1ceac7c0ba7cb..4987cdd7b00f7 100644
--- a/tool/tsh/options.go
+++ b/tool/tsh/common/options.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"fmt"
diff --git a/tool/tsh/options_test.go b/tool/tsh/common/options_test.go
similarity index 99%
rename from tool/tsh/options_test.go
rename to tool/tsh/common/options_test.go
index ef797cdfaa836..9f29a53c5a337 100644
--- a/tool/tsh/options_test.go
+++ b/tool/tsh/common/options_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"testing"
diff --git a/tool/tsh/proxy.go b/tool/tsh/common/proxy.go
similarity index 99%
rename from tool/tsh/proxy.go
rename to tool/tsh/common/proxy.go
index 6be1715f7820e..29e45359758ff 100644
--- a/tool/tsh/proxy.go
+++ b/tool/tsh/common/proxy.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
@@ -258,7 +258,7 @@ func dialSSHProxy(ctx context.Context, tc *libclient.TeleportClient, sp sshProxy
 				InsecureSkipVerify: tc.InsecureSkipVerify,
 				ServerName:         sp.proxyHost,
 			},
-			ALPNConnUpgradeRequired: tc.IsALPNConnUpgradeRequiredForWebProxy(remoteProxyAddr),
+			ALPNConnUpgradeRequired: tc.IsALPNConnUpgradeRequiredForWebProxy(ctx, remoteProxyAddr),
 		})
 
 	default:
diff --git a/tool/tsh/proxy_test.go b/tool/tsh/common/proxy_test.go
similarity index 98%
rename from tool/tsh/proxy_test.go
rename to tool/tsh/common/proxy_test.go
index 8a4798cdb98bf..d8ca333bc3089 100644
--- a/tool/tsh/proxy_test.go
+++ b/tool/tsh/common/proxy_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"bytes"
@@ -290,7 +290,7 @@ func TestProxySSH(t *testing.T) {
 				s.root.Config.Auth.ClusterName.GetClusterName(),
 				s.root.Config.SSH.Addr.Port(defaults.SSHServerListenPort))
 
-			runProxySSH := func(proxyRequest string, opts ...cliOption) error {
+			runProxySSH := func(proxyRequest string, opts ...CliOption) error {
 				return Run(ctx, []string{
 					"--insecure",
 					"--proxy", s.root.Config.Proxy.WebAddr.Addr,
@@ -398,7 +398,7 @@ func TestProxySSHJumpHost(t *testing.T) {
 
 			s := newTestSuite(t, tc.opts...)
 
-			runProxySSHJump := func(opts ...cliOption) error {
+			runProxySSHJump := func(opts ...CliOption) error {
 				proxyRequest := fmt.Sprintf("%s:%d",
 					s.leaf.Config.Proxy.SSHAddr.Host(),
 					s.leaf.Config.SSH.Addr.Port(defaults.SSHServerListenPort))
@@ -699,7 +699,8 @@ func TestList(t *testing.T) {
 	}
 }
 
-func createAgent(t *testing.T) string {
+// create a new local agent key ring and serve it on $SSH_AUTH_SOCK for tests.
+func createAgent(t *testing.T) (agent.ExtendedAgent, string) {
 	t.Helper()
 
 	currentUser, err := user.Current()
@@ -725,7 +726,7 @@ func createAgent(t *testing.T) string {
 
 	t.Setenv(teleport.SSHAuthSock, teleAgent.Path)
 
-	return teleAgent.Path
+	return keyring, teleAgent.Path
 }
 
 func disableAgent(t *testing.T) {
@@ -733,9 +734,9 @@ func disableAgent(t *testing.T) {
 	t.Setenv(teleport.SSHAuthSock, "")
 }
 
-func setMockSSOLogin(t *testing.T, s *suite) cliOption {
+func setMockSSOLogin(t *testing.T, s *suite) CliOption {
 	return func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, s.root.GetAuthServer(), s.user)
+		cf.MockSSOLogin = mockSSOLogin(t, s.root.GetAuthServer(), s.user)
 		cf.AuthConnector = s.connector.GetName()
 		return nil
 	}
@@ -776,7 +777,7 @@ func mustLoginSetEnv(t *testing.T, s *suite, args ...string) string {
 	return tshHome
 }
 
-func mustLoginIdentity(t *testing.T, s *suite, opts ...cliOption) string {
+func mustLoginIdentity(t *testing.T, s *suite, opts ...CliOption) string {
 	identityFile := path.Join(t.TempDir(), "identity.pem")
 	mustLogin(t, s, "--out", identityFile)
 	return identityFile
@@ -811,10 +812,11 @@ func runOpenSSHCommand(t *testing.T, configFile string, sshConnString string, po
 	sshPath, err := exec.LookPath("ssh")
 	require.NoError(t, err)
 
+	_, agentPath := createAgent(t)
 	cmd := exec.Command(sshPath, ss...)
 	cmd.Env = []string{
 		fmt.Sprintf("%s=1", tshBinMainTestEnv),
-		fmt.Sprintf("SSH_AUTH_SOCK=%s", createAgent(t)),
+		fmt.Sprintf("SSH_AUTH_SOCK=%s", agentPath),
 		fmt.Sprintf("PATH=%s", filepath.Dir(sshPath)),
 		fmt.Sprintf("%s=%s", types.HomeEnvVar, os.Getenv(types.HomeEnvVar)),
 	}
@@ -1132,7 +1134,7 @@ func TestPrintProxyAWSTemplate(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			buf := new(bytes.Buffer)
-			test.inputCLIConf.overrideStdout = buf
+			test.inputCLIConf.OverrideStdout = buf
 			require.NoError(t, printProxyAWSTemplate(test.inputCLIConf, test.inputAWSApp))
 			for _, wantSnippet := range test.wantSnippets {
 				require.Contains(t, buf.String(), wantSnippet)
diff --git a/tool/tsh/recording_export.go b/tool/tsh/common/recording_export.go
similarity index 99%
rename from tool/tsh/recording_export.go
rename to tool/tsh/common/recording_export.go
index 64eb877fee61d..2c7ad9521ee5e 100644
--- a/tool/tsh/recording_export.go
+++ b/tool/tsh/common/recording_export.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"bytes"
diff --git a/tool/tsh/recording_export_test.go b/tool/tsh/common/recording_export_test.go
similarity index 95%
rename from tool/tsh/recording_export_test.go
rename to tool/tsh/common/recording_export_test.go
index 1910c95e6dbf4..f86683aacf0cb 100644
--- a/tool/tsh/recording_export_test.go
+++ b/tool/tsh/common/recording_export_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
@@ -45,6 +45,8 @@ func init() {
 }
 
 func TestWriteMovieCanBeCanceled(t *testing.T) {
+	t.Parallel()
+
 	events := []apievents.AuditEvent{
 		&apievents.WindowsDesktopSessionStart{},
 	}
@@ -53,18 +55,20 @@ func TestWriteMovieCanBeCanceled(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 
-	frames, err := writeMovie(ctx, fs, session.ID("test"), "test.avi")
+	frames, err := writeMovie(ctx, fs, "test", "test.avi")
 	require.Equal(t, context.Canceled, err)
 	require.Equal(t, 0, frames)
 }
 
 func TestWriteMovieDoesNotSupportSSH(t *testing.T) {
+	t.Parallel()
+
 	events := []apievents.AuditEvent{
 		&apievents.SessionStart{},
 	}
 	fs := eventstest.NewFakeStreamer(events, 0)
 
-	frames, err := writeMovie(context.Background(), fs, session.ID("test"), "test.avi")
+	frames, err := writeMovie(context.Background(), fs, "test", "test.avi")
 	require.True(t, trace.IsBadParameter(err), "expected bad paramater error, got %v", err)
 	require.Equal(t, 0, frames)
 }
@@ -75,6 +79,8 @@ func TestWriteMovieDoesNotSupportSSH(t *testing.T) {
 // At the time of this implementation, desktop access does not support resizing during the
 // screen during a session. This test exists to prevent regressions should that behavior change.
 func TestWriteMovieMultipleScreenSpecs(t *testing.T) {
+	t.Parallel()
+
 	events := []apievents.AuditEvent{
 		tdpEvent(t, tdp.ClientScreenSpec{Width: 1920, Height: 1080}),
 		tdpEvent(t, tdp.ClientScreenSpec{Width: 1920, Height: 1080}),
@@ -88,6 +94,8 @@ func TestWriteMovieMultipleScreenSpecs(t *testing.T) {
 }
 
 func TestWriteMovieWritesOneFrame(t *testing.T) {
+	t.Parallel()
+
 	oneFrame := frameDelayMillis
 	// need a PNG that will actually decode
 	events := []apievents.AuditEvent{
@@ -103,6 +111,8 @@ func TestWriteMovieWritesOneFrame(t *testing.T) {
 }
 
 func TestWriteMovieWritesManyFrames(t *testing.T) {
+	t.Parallel()
+
 	events := []apievents.AuditEvent{
 		tdpEventMillis(t, tdp.ClientScreenSpec{Width: 128, Height: 128}, 0),
 		tdpEventMillis(t, tdp.PNG2Frame(pngFrame), 0),
diff --git a/tool/tsh/resolve_default_addr.go b/tool/tsh/common/resolve_default_addr.go
similarity index 99%
rename from tool/tsh/resolve_default_addr.go
rename to tool/tsh/common/resolve_default_addr.go
index edc93a06a8aae..638e526f7ea82 100644
--- a/tool/tsh/resolve_default_addr.go
+++ b/tool/tsh/common/resolve_default_addr.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
diff --git a/tool/tsh/resolve_default_addr_test.go b/tool/tsh/common/resolve_default_addr_test.go
similarity index 99%
rename from tool/tsh/resolve_default_addr_test.go
rename to tool/tsh/common/resolve_default_addr_test.go
index 8d66374d006cb..ed6b118c3b987 100644
--- a/tool/tsh/resolve_default_addr_test.go
+++ b/tool/tsh/common/resolve_default_addr_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
diff --git a/tool/tsh/tctl_test.go b/tool/tsh/common/tctl_test.go
similarity index 94%
rename from tool/tsh/tctl_test.go
rename to tool/tsh/common/tctl_test.go
index ec8c184e7008f..15a46610d7175 100644
--- a/tool/tsh/tctl_test.go
+++ b/tool/tsh/common/tctl_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
@@ -54,8 +54,8 @@ func TestLoadConfigFromProfile(t *testing.T) {
 		"--debug",
 		"--auth", connector.GetName(),
 		"--proxy", proxyAddr.String(),
-	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+	}, setHomePath(tmpHomePath), CliOption(func(cf *CLIConf) error {
+		cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 		return nil
 	}))
 	require.NoError(t, err)
@@ -116,8 +116,8 @@ func TestRemoteTctlWithProfile(t *testing.T) {
 		"--debug",
 		"--auth", connector.GetName(),
 		"--proxy", proxyAddr.String(),
-	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+	}, setHomePath(tmpHomePath), CliOption(func(cf *CLIConf) error {
+		cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 		return nil
 	}))
 	require.NoError(t, err)
@@ -182,8 +182,8 @@ func TestSetAuthServerFlagWhileLoggedIn(t *testing.T) {
 		"--debug",
 		"--auth", connector.GetName(),
 		"--proxy", proxyAddr.String(),
-	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+	}, setHomePath(tmpHomePath), CliOption(func(cf *CLIConf) error {
+		cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 		return nil
 	}))
 	require.NoError(t, err)
diff --git a/tool/tsh/touchid.go b/tool/tsh/common/touchid.go
similarity index 96%
rename from tool/tsh/touchid.go
rename to tool/tsh/common/touchid.go
index c39226d926b73..26bebe1676729 100644
--- a/tool/tsh/touchid.go
+++ b/tool/tsh/common/touchid.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"fmt"
@@ -70,6 +70,11 @@ func (c *touchIDDiagCommand) run(cf *CLIConf) error {
 	fmt.Printf("Passed LAPolicy test? %v\n", res.PassedLAPolicyTest)
 	fmt.Printf("Passed Secure Enclave test? %v\n", res.PassedSecureEnclaveTest)
 	fmt.Printf("Touch ID enabled? %v\n", res.IsAvailable)
+
+	if res.IsClamshellFailure() {
+		fmt.Printf("\nTouch ID diagnostics failed, is your MacBook lid closed?\n")
+	}
+
 	return nil
 }
 
diff --git a/tool/tsh/tsh.go b/tool/tsh/common/tsh.go
similarity index 95%
rename from tool/tsh/tsh.go
rename to tool/tsh/common/tsh.go
index e3720d90f61d2..9a78bf04d235b 100644
--- a/tool/tsh/tsh.go
+++ b/tool/tsh/common/tsh.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"bytes"
@@ -322,18 +322,18 @@ type CLIConf struct {
 	// unsetEnvironment unsets Teleport related environment variables.
 	unsetEnvironment bool
 
-	// overrideStdout allows to switch standard output source for resource command. Used in tests.
-	overrideStdout io.Writer
+	// OverrideStdout allows to switch standard output source for resource command. Used in tests.
+	OverrideStdout io.Writer
 	// overrideStderr allows to switch standard error source for resource command. Used in tests.
 	overrideStderr io.Writer
 	// overrideStdin allows to switch standard in source for resource command. Used in tests.
 	overrideStdin io.Reader
 
-	// mockSSOLogin used in tests to override sso login handler in teleport client.
-	mockSSOLogin client.SSOLoginFunc
+	// MockSSOLogin used in tests to override sso login handler in teleport client.
+	MockSSOLogin client.SSOLoginFunc
 
-	// mockHeadlessLogin used in tests to override Headless login handler in teleport client.
-	mockHeadlessLogin client.SSHLoginFunc
+	// MockHeadlessLogin used in tests to override Headless login handler in teleport client.
+	MockHeadlessLogin client.SSHLoginFunc
 
 	// HomePath is where tsh stores profiles
 	HomePath string
@@ -430,11 +430,11 @@ type CLIConf struct {
 	// kubeAllNamespaces allows users to search for pods in every namespace.
 	kubeAllNamespaces bool
 
-	// kubeConfigPath is the location of the Kubeconfig for the current test.
+	// KubeConfigPath is the location of the Kubeconfig for the current test.
 	// Setting this value allows Teleport tests to run `tsh login` commands in
 	// parallel.
 	// It shouldn't be used outside testing.
-	kubeConfigPath string
+	KubeConfigPath string
 
 	// Client only version display.  Skips checking proxy version.
 	clientOnlyVersionCheck bool
@@ -451,12 +451,21 @@ type CLIConf struct {
 
 	// HeadlessAuthenticationID is the ID of a headless authentication.
 	HeadlessAuthenticationID string
+
+	// headlessSkipConfirm determines whether to provide a y/N
+	// confirmation prompt before prompting for MFA.
+	headlessSkipConfirm bool
+
+	// DTAuthnRunCeremony allows tests to override the default device
+	// authentication function.
+	// Defaults to [dtauthn.NewCeremony().Run].
+	DTAuthnRunCeremony client.DTAuthnRunCeremonyFunc
 }
 
 // Stdout returns the stdout writer.
 func (c *CLIConf) Stdout() io.Writer {
-	if c.overrideStdout != nil {
-		return c.overrideStdout
+	if c.OverrideStdout != nil {
+		return c.OverrideStdout
 	}
 	return os.Stdout
 }
@@ -490,7 +499,7 @@ func (c *CLIConf) RunCommand(cmd *exec.Cmd) error {
 	return trace.Wrap(cmd.Run())
 }
 
-func main() {
+func Main() {
 	cmdLineOrig := os.Args[1:]
 	var cmdLine []string
 
@@ -520,13 +529,14 @@ func main() {
 }
 
 const (
-	authEnvVar        = "TELEPORT_AUTH"
-	clusterEnvVar     = "TELEPORT_CLUSTER"
-	kubeClusterEnvVar = "TELEPORT_KUBE_CLUSTER"
-	loginEnvVar       = "TELEPORT_LOGIN"
-	bindAddrEnvVar    = "TELEPORT_LOGIN_BIND_ADDR"
-	proxyEnvVar       = "TELEPORT_PROXY"
-	headlessEnvVar    = "TELEPORT_HEADLESS"
+	authEnvVar                = "TELEPORT_AUTH"
+	clusterEnvVar             = "TELEPORT_CLUSTER"
+	kubeClusterEnvVar         = "TELEPORT_KUBE_CLUSTER"
+	loginEnvVar               = "TELEPORT_LOGIN"
+	bindAddrEnvVar            = "TELEPORT_LOGIN_BIND_ADDR"
+	proxyEnvVar               = "TELEPORT_PROXY"
+	headlessEnvVar            = "TELEPORT_HEADLESS"
+	headlessSkipConfirmEnvVar = "TELEPORT_HEADLESS_SKIP_CONFIRM"
 	// TELEPORT_SITE uses the older deprecated "site" terminology to refer to a
 	// cluster. All new code should use TELEPORT_CLUSTER instead.
 	siteEnvVar               = "TELEPORT_SITE"
@@ -567,8 +577,8 @@ const (
 // env vars that tsh status will check to provide hints about active env vars to a user.
 var tshStatusEnvVars = [...]string{proxyEnvVar, clusterEnvVar, siteEnvVar, kubeClusterEnvVar, teleport.EnvKubeConfig}
 
-// cliOption is used in tests to inject/override configuration within Run
-type cliOption func(*CLIConf) error
+// CliOption is used in tests to inject/override configuration within Run
+type CliOption func(*CLIConf) error
 
 // initLogger initializes the logger taking into account --debug and TELEPORT_DEBUG. If TELEPORT_DEBUG is set, it will also enable CLIConf.Debug.
 func initLogger(cf *CLIConf) {
@@ -582,7 +592,7 @@ func initLogger(cf *CLIConf) {
 }
 
 // Run executes TSH client. same as main() but easier to test
-func Run(ctx context.Context, args []string, opts ...cliOption) error {
+func Run(ctx context.Context, args []string, opts ...CliOption) error {
 	cf := CLIConf{
 		Context:         ctx,
 		TracingProvider: tracing.NoopProvider(),
@@ -834,7 +844,7 @@ func Run(ctx context.Context, args []string, opts ...cliOption) error {
 	play.Arg("session-id", "ID of the session to play").Required().StringVar(&cf.SessionID)
 
 	// scp
-	scp := app.Command("scp", "Transfer files to a remote Node.")
+	scp := app.Command("scp", "Transfer files to a remote SSH node.")
 	scp.Flag("cluster", clusterHelp).Short('c').StringVar(&cf.SiteName)
 	scp.Arg("from, to", "Source and destination to copy, one must be a local path and one must be a remote path").Required().StringsVar(&cf.CopySpec)
 	scp.Flag("recursive", "Recursive copy of subdirectories").Short('r').BoolVar(&cf.RecursiveCopy)
@@ -882,7 +892,7 @@ func Run(ctx context.Context, args []string, opts ...cliOption) error {
 	logout := app.Command("logout", "Delete a cluster certificate.")
 
 	// bench
-	bench := app.Command("bench", "Run shell or execute a command on a remote SSH node.").Hidden()
+	bench := app.Command("bench", "Run Teleport benchmark tests.").Hidden()
 	bench.Flag("cluster", clusterHelp).Short('c').StringVar(&cf.SiteName)
 	bench.Flag("duration", "Test duration").Default("1s").DurationVar(&cf.BenchDuration)
 	bench.Flag("rate", "Requests per second rate").Default("10").IntVar(&cf.BenchRate)
@@ -891,14 +901,21 @@ func Run(ctx context.Context, args []string, opts ...cliOption) error {
 	bench.Flag("ticks", "Ticks per half distance").Default("100").Int32Var(&cf.BenchTicks)
 	bench.Flag("scale", "Value scale in which to scale the recorded values").Default("1.0").Float64Var(&cf.BenchValueScale)
 
-	benchSSH := bench.Command("ssh", "Run SSH benchmark test").Hidden()
+	benchSSH := bench.Command("ssh", "Run SSH benchmark tests").Hidden()
 	benchSSH.Arg("[user@]host", "Remote hostname and the login to use").Required().StringVar(&cf.UserHost)
 	benchSSH.Arg("command", "Command to execute on a remote host").Required().StringsVar(&cf.RemoteCommand)
 	benchSSH.Flag("port", "SSH port on a remote host").Short('p').Int32Var(&cf.NodePort)
-	benchSSH.Flag("interactive", "Create interactive SSH session").BoolVar(&cf.BenchInteractive)
 	benchSSH.Flag("random", "Connect to random hosts for each SSH session. The provided hostname must be all: tsh bench ssh --random <user>@all <command>").BoolVar(&cf.BenchRandom)
+
+	benchWeb := bench.Command("web", "Run Web benchmark tests").Hidden()
+	benchWebSSH := benchWeb.Command("ssh", "Run SSH benchmark tests").Hidden()
+	benchWebSSH.Arg("[user@]host", "Remote hostname and the login to use").Required().StringVar(&cf.UserHost)
+	benchWebSSH.Arg("command", "Command to execute on a remote host").Required().StringsVar(&cf.RemoteCommand)
+	benchWebSSH.Flag("port", "SSH port on a remote host").Short('p').Int32Var(&cf.NodePort)
+	benchWebSSH.Flag("random", "Connect to random hosts for each SSH session. The provided hostname must be all: tsh bench ssh --random <user>@all <command>").BoolVar(&cf.BenchRandom)
+
 	var benchKubeOpts benchKubeOptions
-	benchKube := bench.Command("kube", "Run Kube benchmark test").Hidden()
+	benchKube := bench.Command("kube", "Run Kube benchmark tests").Hidden()
 	benchKube.Flag("kube-namespace", "Selects the ").Default("default").StringVar(&benchKubeOpts.namespace)
 	benchListKube := benchKube.Command("ls", "Run a benchmark test to list Pods").Hidden()
 	benchListKube.Arg("kube_cluster", "Kubernetes cluster to use").Required().StringVar(&cf.KubernetesCluster)
@@ -970,8 +987,9 @@ func Run(ctx context.Context, args []string, opts ...cliOption) error {
 
 	// Headless login approval
 	headless := app.Command("headless", "Headless authentication commands.").Interspersed(true)
-	approve := headless.Command("approve", "Approve a headless authentication request.").Interspersed(true)
-	approve.Arg("request id", "Headless authentication request ID").StringVar(&cf.HeadlessAuthenticationID)
+	headlessApprove := headless.Command("approve", "Approve a headless authentication request.").Interspersed(true)
+	headlessApprove.Arg("request id", "Headless authentication request ID").StringVar(&cf.HeadlessAuthenticationID)
+	headlessApprove.Flag("skip-confirm", "Skip confirmation and prompt for MFA immediately").Envar(headlessSkipConfirmEnvVar).BoolVar(&cf.headlessSkipConfirm)
 
 	reqDrop := req.Command("drop", "Drop one more access requests from current identity.")
 	reqDrop.Arg("request-id", "IDs of requests to drop (default drops all requests)").Default("*").StringsVar(&cf.RequestIDs)
@@ -1084,6 +1102,8 @@ func Run(ctx context.Context, args []string, opts ...cliOption) error {
 	// because the data that we would be tracing would be the tsh kubectl command.
 	// Instead, we want to enable tracing for the re-executed kubectl command and
 	// we do that in the kubectl command handler.
+	cf.TracingProvider = tracing.NoopProvider()
+	cf.tracer = cf.TracingProvider.Tracer(teleport.ComponentTSH)
 	if cf.SampleTraces && cf.command != kubectl.FullCommand() {
 		// login only needs to be ignored if forwarding to auth
 		var ignored []string
@@ -1094,16 +1114,13 @@ func Run(ctx context.Context, args []string, opts ...cliOption) error {
 		if err != nil {
 			log.WithError(err).Debug("failed to set up span forwarding.")
 		} else {
-			// only update the provider if we successfully set it up
-			cf.TracingProvider = provider
-
 			// ensure that the provider is shutdown on exit to flush any spans
 			// that haven't been forwarded yet.
 			defer func() {
 				shutdownCtx, cancel := context.WithTimeout(cf.Context, 1*time.Second)
 				defer cancel()
 				err := provider.Shutdown(shutdownCtx)
-				if err != nil && !strings.Contains(err.Error(), context.DeadlineExceeded.Error()) {
+				if err != nil && !errors.Is(err, context.DeadlineExceeded) {
 					log.WithError(err).Debugf("failed to shutdown trace provider")
 				}
 			}()
@@ -1112,7 +1129,7 @@ func Run(ctx context.Context, args []string, opts ...cliOption) error {
 
 	// start the span for the command and update the config context so that all spans created
 	// in the future will be rooted at this span.
-	ctx, span := cf.TracingProvider.Tracer(teleport.ComponentTSH).Start(cf.Context, command)
+	ctx, span := cf.tracer.Start(cf.Context, command)
 	cf.Context = ctx
 	defer span.End()
 
@@ -1177,6 +1194,15 @@ func Run(ctx context.Context, args []string, opts ...cliOption) error {
 				Random:  cf.BenchRandom,
 			},
 		)
+	case benchWebSSH.FullCommand():
+		err = onBenchmark(
+			&cf,
+			&benchmark.WebSSHBenchmark{
+				Command:  cf.RemoteCommand,
+				Random:   cf.BenchRandom,
+				Duration: cf.BenchDuration,
+			},
+		)
 	case benchListKube.FullCommand():
 		err = onBenchmark(
 			&cf,
@@ -1323,10 +1349,12 @@ func Run(ctx context.Context, args []string, opts ...cliOption) error {
 		err = deviceCmd.collect.run(&cf)
 	case deviceCmd.keyget.FullCommand():
 		err = deviceCmd.keyget.run(&cf)
+	case deviceCmd.activateCredential.FullCommand():
+		err = deviceCmd.activateCredential.run(&cf)
 	case kubectl.FullCommand():
 		idx := slices.Index(args, kubectl.FullCommand())
 		err = onKubectlCommand(&cf, args, args[idx:])
-	case approve.FullCommand():
+	case headlessApprove.FullCommand():
 		err = onHeadlessApprove(&cf)
 	default:
 		// Handle commands that might not be available.
@@ -1376,6 +1404,8 @@ func newTraceProvider(cf *CLIConf, command string, ignored []string) (*tracing.P
 			SamplingRate: 1.0,
 		})
 
+		cf.TracingProvider = provider
+		cf.tracer = provider.Tracer(teleport.ComponentTSH)
 		return provider, trace.Wrap(err)
 	}
 
@@ -1412,6 +1442,8 @@ func newTraceProvider(cf *CLIConf, command string, ignored []string) (*tracing.P
 		return nil, trace.Wrap(err)
 	}
 
+	cf.TracingProvider = provider
+	cf.tracer = provider.Tracer(teleport.ComponentTSH)
 	return provider, nil
 }
 
@@ -1432,7 +1464,7 @@ func onVersion(cf *CLIConf) error {
 	format := strings.ToLower(cf.Format)
 	switch format {
 	case teleport.Text, "":
-		utils.PrintVersion()
+		modules.GetModules().PrintVersion()
 		if proxyVersion != "" {
 			fmt.Printf("Proxy version: %s\n", proxyVersion)
 			fmt.Printf("Proxy: %s\n", proxyPublicAddr)
@@ -1692,7 +1724,13 @@ func onLogin(cf *CLIConf) error {
 			// Try updating kube config. If it fails, then we may have
 			// switched to an inactive profile. Continue to normal login.
 			if err := updateKubeConfigOnLogin(cf, tc, updateKubeConfigOption); err == nil {
-				return trace.Wrap(onStatus(cf))
+				profile, profiles, err = cf.FullProfileStatus()
+				if err != nil {
+					return trace.Wrap(err)
+				}
+
+				// Print status to show information of the logged in user.
+				return trace.Wrap(printProfiles(cf, profile, profiles))
 			}
 
 		// proxy is unspecified or the same as the currently provided proxy,
@@ -1718,7 +1756,8 @@ func onLogin(cf *CLIConf) error {
 				return trace.Wrap(err)
 			}
 
-			return trace.Wrap(onStatus(cf))
+			// Print status to show information of the logged in user.
+			return trace.Wrap(printProfiles(cf, profile, profiles))
 		// proxy is unspecified or the same as the currently provided proxy,
 		// but desired roles or request ID is specified, treat this as a
 		// privilege escalation request for the same login session.
@@ -1733,7 +1772,8 @@ func onLogin(cf *CLIConf) error {
 			if err := updateKubeConfigOnLogin(cf, tc, updateKubeConfigOption); err != nil {
 				return trace.Wrap(err)
 			}
-			return trace.Wrap(onStatus(cf))
+			// Print status to show information of the logged in user.
+			return trace.Wrap(printProfiles(cf, profile, profiles))
 
 		// otherwise just pass through to standard login
 		default:
@@ -1764,9 +1804,14 @@ func onLogin(cf *CLIConf) error {
 	// "authoritative" source.
 	cf.Username = tc.Username
 
-	if err := tc.ActivateKey(cf.Context, key); err != nil {
+	proxyClient, rootAuthClient, err := tc.ConnectToRootCluster(cf.Context, key)
+	if err != nil {
 		return trace.Wrap(err)
 	}
+	defer func() {
+		rootAuthClient.Close()
+		proxyClient.Close()
+	}()
 
 	// TODO(fspmarshall): Refactor access request & cert reissue logic to allow
 	// access requests to be applied to identity files.
@@ -1774,8 +1819,7 @@ func onLogin(cf *CLIConf) error {
 		// key.TrustedCA at this point only has the CA of the root cluster we
 		// logged into. We need to fetch all the CAs for leaf clusters too, to
 		// make them available in the identity file.
-		rootClusterName := key.TrustedCerts[0].ClusterName
-		authorities, err := tc.GetTrustedCA(cf.Context, rootClusterName)
+		authorities, err := rootAuthClient.GetCertAuthorities(cf.Context, types.HostCA, false)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -1807,7 +1851,7 @@ func onLogin(cf *CLIConf) error {
 	// Attempt device login. This activates a fresh key if successful.
 	// We do not save the resulting in the identity file above on purpose, as this
 	// certificate is bound to the present device.
-	if err := tc.AttemptDeviceLogin(cf.Context, key); err != nil {
+	if err := tc.AttemptDeviceLogin(cf.Context, key, rootAuthClient); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -1824,33 +1868,24 @@ func onLogin(cf *CLIConf) error {
 	}
 
 	if autoRequest && cf.DesiredRoles == "" && cf.RequestID == "" {
-		var capabailities *types.AccessCapabilities
-		err = tc.WithRootClusterClient(cf.Context, func(clt auth.ClientI) error {
-			cap, err := clt.GetAccessCapabilities(cf.Context, types.AccessCapabilitiesRequest{
-				User: cf.Username,
-			})
-			if err != nil {
-				return trace.Wrap(err)
-			}
-
-			capabailities = cap
-
-			return nil
+		capabilities, err := rootAuthClient.GetAccessCapabilities(cf.Context, types.AccessCapabilitiesRequest{
+			User: cf.Username,
 		})
+
 		if err != nil {
 			logoutErr := tc.Logout()
 			return trace.NewAggregate(err, logoutErr)
 		}
-		if capabailities.RequireReason && cf.RequestReason == "" {
+		if capabilities.RequireReason && cf.RequestReason == "" {
 			msg := "--request-reason must be specified"
-			if capabailities.RequestPrompt != "" {
-				msg = msg + ", prompt=" + capabailities.RequestPrompt
+			if capabilities.RequestPrompt != "" {
+				msg = msg + ", prompt=" + capabilities.RequestPrompt
 			}
 			err := trace.BadParameter(msg)
 			logoutErr := tc.Logout()
 			return trace.NewAggregate(err, logoutErr)
 		}
-		if capabailities.AutoRequest {
+		if capabilities.AutoRequest {
 			cf.DesiredRoles = "*"
 		}
 	}
@@ -1886,16 +1921,15 @@ func onLogin(cf *CLIConf) error {
 		alertSeverityMax = types.AlertSeverity_HIGH
 	}
 
-	if err := common.ShowClusterAlerts(cf.Context, tc, os.Stderr, map[string]string{
-		types.AlertOnLogin: "yes",
-	}, types.AlertSeverity_LOW, alertSeverityMax); err != nil {
-		log.WithError(err).Warn("Failed to display cluster alerts.")
-	}
-
 	// NOTE: we currently print all alerts that are marked as `on-login`, because we
 	// don't use the alert API very heavily. If we start to make more use of it, we
 	// could probably add a separate `tsh alerts ls` command, and truncate the list
 	// with a message like "run 'tsh alerts ls' to view N additional alerts".
+	if err := common.ShowClusterAlerts(cf.Context, proxyClient.CurrentCluster(), os.Stderr, map[string]string{
+		types.AlertOnLogin: "yes",
+	}, types.AlertSeverity_LOW, alertSeverityMax); err != nil {
+		log.WithError(err).Warn("Failed to display cluster alerts.")
+	}
 
 	return nil
 }
@@ -2255,7 +2289,7 @@ func listNodesAllClusters(cf *CLIConf) error {
 
 	// Sometimes a user won't see any nodes because they're missing principals.
 	if len(listings) == 0 {
-		if _, err := fmt.Fprintln(cf.Stderr(), missingPrincipalsFooter); err != nil {
+		if _, err := fmt.Fprintln(cf.Stderr(), emptyNodesFooter); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -2453,7 +2487,7 @@ func printNodes(nodes []types.Server, conf *CLIConf) error {
 
 	// Sometimes a user won't see any nodes because they're missing principals.
 	if len(nodes) == 0 {
-		if _, err := fmt.Fprintln(conf.Stderr(), missingPrincipalsFooter); err != nil {
+		if _, err := fmt.Fprintln(conf.Stderr(), emptyNodesFooter); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -2614,13 +2648,13 @@ func showAppsAsText(apps []types.Application, active []tlsca.RouteToApp, verbose
 	fmt.Println(t.AsBuffer().String())
 }
 
-func showDatabases(w io.Writer, clusterFlag string, databases []types.Database, active []tlsca.RouteToDatabase, roleSet services.RoleSet, format string, verbose bool) error {
+func showDatabases(w io.Writer, clusterFlag string, databases []types.Database, active []tlsca.RouteToDatabase, accessChecker services.AccessChecker, format string, verbose bool) error {
 	format = strings.ToLower(format)
 	switch format {
 	case teleport.Text, "":
-		showDatabasesAsText(w, clusterFlag, databases, active, roleSet, verbose)
+		showDatabasesAsText(w, clusterFlag, databases, active, accessChecker, verbose)
 	case teleport.JSON, teleport.YAML:
-		out, err := serializeDatabases(databases, format, roleSet)
+		out, err := serializeDatabases(databases, format, accessChecker)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -2631,12 +2665,12 @@ func showDatabases(w io.Writer, clusterFlag string, databases []types.Database,
 	return nil
 }
 
-func serializeDatabases(databases []types.Database, format string, roleSet services.RoleSet) (string, error) {
+func serializeDatabases(databases []types.Database, format string, accessChecker services.AccessChecker) (string, error) {
 	if databases == nil {
 		databases = []types.Database{}
 	}
 
-	printObj, err := getDatabasePrintObject(databases, roleSet)
+	printObj, err := getDatabasePrintObject(databases, accessChecker)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -2651,11 +2685,11 @@ func serializeDatabases(databases []types.Database, format string, roleSet servi
 	return string(out), trace.Wrap(err)
 }
 
-func getDatabasePrintObject(databases []types.Database, roleSet services.RoleSet) (any, error) {
-	if roleSet == nil || len(databases) == 0 {
+func getDatabasePrintObject(databases []types.Database, accessChecker services.AccessChecker) (any, error) {
+	if accessChecker == nil || len(accessChecker.RoleNames()) == 0 || len(databases) == 0 {
 		return databases, nil
 	}
-	dbsWithUsers, err := getDatabasesWithUsers(databases, roleSet)
+	dbsWithUsers, err := getDatabasesWithUsers(databases, accessChecker)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -2674,8 +2708,8 @@ type databaseWithUsers struct {
 	Users *dbUsers `json:"users"`
 }
 
-func getDBUsers(db types.Database, roles services.RoleSet) *dbUsers {
-	users := roles.EnumerateDatabaseUsers(db)
+func getDBUsers(db types.Database, accessChecker services.AccessChecker) *dbUsers {
+	users := accessChecker.EnumerateDatabaseUsers(db)
 	var denied []string
 	allowed := users.Allowed()
 	if users.WildcardAllowed() {
@@ -2690,9 +2724,9 @@ func getDBUsers(db types.Database, roles services.RoleSet) *dbUsers {
 	}
 }
 
-func newDatabaseWithUsers(db types.Database, roles services.RoleSet) (*databaseWithUsers, error) {
+func newDatabaseWithUsers(db types.Database, accessChecker services.AccessChecker) (*databaseWithUsers, error) {
 	dbWithUsers := &databaseWithUsers{
-		Users: getDBUsers(db, roles),
+		Users: getDBUsers(db, accessChecker),
 	}
 	switch db := db.(type) {
 	case *types.DatabaseV3:
@@ -2703,10 +2737,10 @@ func newDatabaseWithUsers(db types.Database, roles services.RoleSet) (*databaseW
 	return dbWithUsers, nil
 }
 
-func getDatabasesWithUsers(databases types.Databases, roles services.RoleSet) ([]*databaseWithUsers, error) {
+func getDatabasesWithUsers(databases types.Databases, accessChecker services.AccessChecker) ([]*databaseWithUsers, error) {
 	var dbsWithUsers []*databaseWithUsers
 	for _, db := range databases {
-		dbWithUsers, err := newDatabaseWithUsers(db, roles)
+		dbWithUsers, err := newDatabaseWithUsers(db, accessChecker)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -2729,13 +2763,13 @@ func serializeDatabasesAllClusters(dbListings []databaseListing, format string)
 	return string(out), trace.Wrap(err)
 }
 
-func formatUsersForDB(database types.Database, roleSet services.RoleSet) string {
+func formatUsersForDB(database types.Database, accessChecker services.AccessChecker) string {
 	// may happen if fetching the role set failed for any reason.
-	if roleSet == nil {
+	if accessChecker == nil {
 		return "(unknown)"
 	}
 
-	dbUsers := getDBUsers(database, roleSet)
+	dbUsers := getDBUsers(database, accessChecker)
 	if len(dbUsers.Allowed) == 0 {
 		return "(none)"
 	}
@@ -2746,7 +2780,7 @@ func formatUsersForDB(database types.Database, roleSet services.RoleSet) string
 	return fmt.Sprintf("%v, except: %v", dbUsers.Allowed, dbUsers.Denied)
 }
 
-func getDatabaseRow(proxy, cluster, clusterFlag string, database types.Database, active []tlsca.RouteToDatabase, roleSet services.RoleSet, verbose bool) []string {
+func getDatabaseRow(proxy, cluster, clusterFlag string, database types.Database, active []tlsca.RouteToDatabase, accessChecker services.AccessChecker, verbose bool) []string {
 	name := database.GetName()
 	var connect string
 	for _, a := range active {
@@ -2774,7 +2808,7 @@ func getDatabaseRow(proxy, cluster, clusterFlag string, database types.Database,
 			database.GetProtocol(),
 			database.GetType(),
 			database.GetURI(),
-			formatUsersForDB(database, roleSet),
+			formatUsersForDB(database, accessChecker),
 			database.LabelsString(),
 			connect,
 		)
@@ -2782,7 +2816,7 @@ func getDatabaseRow(proxy, cluster, clusterFlag string, database types.Database,
 		row = append(row,
 			name,
 			database.GetDescription(),
-			formatUsersForDB(database, roleSet),
+			formatUsersForDB(database, accessChecker),
 			formatDatabaseLabels(database),
 			connect,
 		)
@@ -2791,14 +2825,14 @@ func getDatabaseRow(proxy, cluster, clusterFlag string, database types.Database,
 	return row
 }
 
-func showDatabasesAsText(w io.Writer, clusterFlag string, databases []types.Database, active []tlsca.RouteToDatabase, roleSet services.RoleSet, verbose bool) {
+func showDatabasesAsText(w io.Writer, clusterFlag string, databases []types.Database, active []tlsca.RouteToDatabase, accessChecker services.AccessChecker, verbose bool) {
 	var rows [][]string
 	for _, database := range databases {
 		rows = append(rows, getDatabaseRow("", "",
 			clusterFlag,
 			database,
 			active,
-			roleSet,
+			accessChecker,
 			verbose))
 	}
 	var t asciitable.Table
@@ -2819,7 +2853,7 @@ func printDatabasesWithClusters(clusterFlag string, dbListings []databaseListing
 			clusterFlag,
 			listing.Database,
 			active,
-			listing.roleSet,
+			listing.accessChecker,
 			verbose))
 	}
 	var t asciitable.Table
@@ -3218,7 +3252,7 @@ func onJoin(cf *CLIConf) error {
 		return trace.BadParameter("'%v' is not a valid session ID (must be GUID)", cf.SessionID)
 	}
 	err = client.RetryWithRelogin(cf.Context, tc, func() error {
-		return tc.Join(context.TODO(), types.SessionParticipantMode(cf.JoinMode), cf.Namespace, *sid, nil)
+		return tc.Join(cf.Context, types.SessionParticipantMode(cf.JoinMode), cf.Namespace, *sid, nil)
 	})
 	if err != nil {
 		return trace.Wrap(err)
@@ -3314,10 +3348,10 @@ func makeClientForProxy(cf *CLIConf, proxy string) (*client.TeleportClient, erro
 func loadClientConfigFromCLIConf(cf *CLIConf, proxy string) (*client.Config, error) {
 	if cf.TracingProvider == nil {
 		cf.TracingProvider = tracing.NoopProvider()
+		cf.tracer = cf.TracingProvider.Tracer(teleport.ComponentTSH)
 	}
 
-	cf.tracer = cf.TracingProvider.Tracer(teleport.ComponentTSH)
-	ctx, span := cf.tracer.Start(cf.Context, "loadClientConfigFromCLIConf/init")
+	ctx, span := cf.tracer.Start(cf.Context, "loadClientConfigFromCLIConf")
 	defer span.End()
 
 	// Parse OpenSSH style options.
@@ -3326,11 +3360,6 @@ func loadClientConfigFromCLIConf(cf *CLIConf, proxy string) (*client.Config, err
 		return nil, trace.Wrap(err)
 	}
 
-	// apply defaults
-	if cf.MinsToLive == 0 {
-		cf.MinsToLive = int32(apidefaults.CertDuration / time.Minute)
-	}
-
 	// split login & host
 	hostLogin := cf.NodeLogin
 	hostUser := cf.UserHost
@@ -3418,8 +3447,7 @@ func loadClientConfigFromCLIConf(cf *CLIConf, proxy string) (*client.Config, err
 			log.Debugf("Will connect to proxy %q according to proxy template.", tProxy)
 		}
 
-		// Don't overwrite cluster if explicitly provided
-		if cf.SiteName == "" && tCluster != "" {
+		if tCluster != "" {
 			cf.SiteName = tCluster
 			log.Debugf("Will connect to cluster %q according to proxy template.", tCluster)
 		}
@@ -3442,6 +3470,7 @@ func loadClientConfigFromCLIConf(cf *CLIConf, proxy string) (*client.Config, err
 		cf.AuthConnector = constants.HeadlessConnector
 	}
 
+	// When using Headless, user must be provided explicitly.
 	if cf.AuthConnector == constants.HeadlessConnector && !cf.ExplicitUsername {
 		return nil, trace.BadParameter("user must be set explicitly for headless login with the --user flag or $TELEPORT_USER env variable")
 	}
@@ -3584,11 +3613,20 @@ func loadClientConfigFromCLIConf(cf *CLIConf, proxy string) (*client.Config, err
 		c.AddKeysToAgent = client.AddKeysToAgentNo
 	}
 
+	// headless login produces short-lived MFA-verifed certs, which should never be added to the agent.
+	if cf.AuthConnector == constants.HeadlessConnector {
+		if cf.AddKeysToAgent == client.AddKeysToAgentYes || cf.AddKeysToAgent == client.AddKeysToAgentOnly {
+			log.Info("Skipping adding keys to agent for headless login")
+		}
+		c.AddKeysToAgent = client.AddKeysToAgentNo
+	}
+
 	c.EnableEscapeSequences = cf.EnableEscapeSequences
 
-	// pass along mock sso login if provided (only used in tests)
-	c.MockSSOLogin = cf.mockSSOLogin
-	c.MockHeadlessLogin = cf.mockHeadlessLogin
+	// pass along mock functions if provided (only used in tests)
+	c.MockSSOLogin = cf.MockSSOLogin
+	c.MockHeadlessLogin = cf.MockHeadlessLogin
+	c.DTAuthnRunCeremony = cf.DTAuthnRunCeremony
 
 	// Set tsh home directory
 	c.HomePath = cf.HomePath
@@ -3776,8 +3814,6 @@ func proxyHostsErrorMsgDefault(proxyAddress string, ports []int) string {
 //
 // If successful, setClientWebProxyAddr will modify the client Config in-place.
 func setClientWebProxyAddr(ctx context.Context, cf *CLIConf, c *client.Config) error {
-	ctx, span := cf.tracer.Start(ctx, "makeClientForProxy/setClientWebProxyAddr")
-	defer span.End()
 	// If the user has specified a proxy on the command line, and one has not
 	// already been specified from configuration...
 
@@ -4618,8 +4654,6 @@ func setEnvFlags(cf *CLIConf, getEnv envGetter) {
 			cf.SiteName = clusterName
 		} else if clusterName = getEnv(siteEnvVar); clusterName != "" {
 			cf.SiteName = clusterName
-		} else if clusterName = getEnv(teleport.SSHTeleportClusterName); clusterName != "" {
-			cf.SiteName = clusterName
 		}
 	}
 
@@ -4627,12 +4661,17 @@ func setEnvFlags(cf *CLIConf, getEnv envGetter) {
 		cf.KubernetesCluster = getEnv(kubeClusterEnvVar)
 	}
 
-	if cf.Username == "" {
-		cf.Username = getEnv(teleport.SSHTeleportUser)
-	}
-
-	if cf.Proxy == "" {
-		cf.Proxy = getEnv(teleport.SSHSessionWebproxyAddr)
+	// When using Headless, check for missing proxy/user/cluster values from the teleport session env variables.
+	if cf.Headless || cf.AuthConnector == constants.HeadlessConnector {
+		if cf.Proxy == "" {
+			cf.Proxy = getEnv(teleport.SSHSessionWebProxyAddr)
+		}
+		if cf.Username == "" {
+			cf.Username = getEnv(teleport.SSHTeleportUser)
+		}
+		if cf.SiteName == "" {
+			cf.SiteName = getEnv(teleport.SSHTeleportClusterName)
+		}
 	}
 }
 
@@ -4817,7 +4856,7 @@ func onHeadlessApprove(cf *CLIConf) error {
 
 	tc.Stdin = os.Stdin
 	err = client.RetryWithRelogin(cf.Context, tc, func() error {
-		return tc.HeadlessApprove(cf.Context, cf.HeadlessAuthenticationID)
+		return tc.HeadlessApprove(cf.Context, cf.HeadlessAuthenticationID, !cf.headlessSkipConfirm)
 	})
 	return trace.Wrap(err)
 }
diff --git a/tool/tsh/tsh_helper_test.go b/tool/tsh/common/tsh_helper_test.go
similarity index 99%
rename from tool/tsh/tsh_helper_test.go
rename to tool/tsh/common/tsh_helper_test.go
index b42717e0b61fd..f0ec2f62aec3c 100644
--- a/tool/tsh/tsh_helper_test.go
+++ b/tool/tsh/common/tsh_helper_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"context"
diff --git a/tool/tsh/tsh_test.go b/tool/tsh/common/tsh_test.go
similarity index 95%
rename from tool/tsh/tsh_test.go
rename to tool/tsh/common/tsh_test.go
index 106a8e2d2298f..624c9b46bbfc5 100644
--- a/tool/tsh/tsh_test.go
+++ b/tool/tsh/common/tsh_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"bufio"
@@ -94,7 +94,7 @@ func init() {
 	// Needed for tests that generate OpenSSH config by tsh config command where
 	// tsh proxy ssh command is used as ProxyCommand.
 	if os.Getenv(tshBinMainTestEnv) != "" {
-		main()
+		Main()
 		// main will only exit if there is an error.
 		// since we are here, there was no error, so we must do so ourselves.
 		os.Exit(0)
@@ -313,7 +313,7 @@ func TestFailedLogin(t *testing.T) {
 		"--auth", connector.GetName(),
 		"--proxy", proxyAddr.String(),
 	}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
-		cf.mockSSOLogin = ssoLogin
+		cf.MockSSOLogin = ssoLogin
 		return nil
 	})
 	require.ErrorIs(t, err, loginFailed)
@@ -407,7 +407,7 @@ func TestOIDCLogin(t *testing.T) {
 		"--proxy", proxyAddr.String(),
 		"--user", "alice", // explicitly use wrong name
 	}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+		cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 		cf.SiteName = "localhost"
 		cf.overrideStderr = buf
 		return nil
@@ -523,7 +523,7 @@ func TestLoginIdentityOut(t *testing.T) {
 				"--proxy", proxyAddr.String(),
 				"--out", identPath,
 			}, tt.extraArgs...), setHomePath(tmpHomePath), func(cf *CLIConf) error {
-				cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+				cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 				return nil
 			})
 			require.NoError(t, err)
@@ -581,7 +581,7 @@ func TestRelogin(t *testing.T) {
 		"--auth", connector.GetName(),
 		"--proxy", proxyAddr.String(),
 	}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+		cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 		cf.overrideStderr = buf
 		return nil
 	})
@@ -596,7 +596,7 @@ func TestRelogin(t *testing.T) {
 		"localhost",
 	}, setHomePath(tmpHomePath),
 		func(cf *CLIConf) error {
-			cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+			cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 			cf.overrideStderr = buf
 			return nil
 		})
@@ -618,7 +618,7 @@ func TestRelogin(t *testing.T) {
 		"--proxy", proxyAddr.String(),
 		"localhost",
 	}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+		cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 		cf.overrideStderr = buf
 		return nil
 	})
@@ -667,7 +667,7 @@ func TestSwitchingProxies(t *testing.T) {
 		"--auth", connector.GetName(),
 		"--proxy", proxyAddr1.String(),
 	}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, authServer1, alice)
+		cf.MockSSOLogin = mockSSOLogin(t, authServer1, alice)
 		return nil
 	})
 	require.NoError(t, err)
@@ -680,7 +680,7 @@ func TestSwitchingProxies(t *testing.T) {
 		"--proxy", proxyAddr2.String(),
 	}, setHomePath(tmpHomePath),
 		func(cf *CLIConf) error {
-			cf.mockSSOLogin = mockSSOLogin(t, authServer2, alice)
+			cf.MockSSOLogin = mockSSOLogin(t, authServer2, alice)
 			return nil
 		})
 
@@ -788,7 +788,7 @@ func TestMakeClient(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, localUser, tc.Config.HostLogin)
-	require.Equal(t, apidefaults.CertDuration, tc.Config.KeyTTL)
+	require.Equal(t, time.Duration(0), tc.Config.KeyTTL)
 
 	// specific configuration
 	conf.MinsToLive = 5
@@ -875,7 +875,7 @@ func TestMakeClient(t *testing.T) {
 	// makeClient should call Ping on the proxy to fetch SSHProxyAddr
 	conf = CLIConf{
 		Proxy:              proxyWebAddr.String(),
-		IdentityFileIn:     "../../fixtures/certs/identities/tls.pem",
+		IdentityFileIn:     "../../../fixtures/certs/identities/tls.pem",
 		Context:            context.Background(),
 		InsecureSkipVerify: true,
 	}
@@ -1494,7 +1494,7 @@ func TestSSHOnMultipleNodes(t *testing.T) {
 				tt.cluster,
 			}, setHomePath(tmpHomePath),
 				func(cf *CLIConf) error {
-					cf.mockSSOLogin = mockSSOLogin(t, tt.auth, alice)
+					cf.MockSSOLogin = mockSSOLogin(t, tt.auth, alice)
 					return nil
 				},
 			)
@@ -1516,8 +1516,8 @@ func TestSSHOnMultipleNodes(t *testing.T) {
 				setHomePath(tmpHomePath),
 				func(conf *CLIConf) error {
 					conf.overrideStdin = &bytes.Buffer{}
-					conf.overrideStdout = stdout
-					conf.mockHeadlessLogin = mockHeadlessLogin(t, tt.auth, alice)
+					conf.OverrideStdout = stdout
+					conf.MockHeadlessLogin = mockHeadlessLogin(t, tt.auth, alice)
 					return nil
 				},
 			)
@@ -1632,8 +1632,8 @@ func TestSSHAccessRequest(t *testing.T) {
 		"--auth", connector.GetName(),
 		"--proxy", proxyAddr.String(),
 		"--user", "alice",
-	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, rootAuth.GetAuthServer(), alice)
+	}, setHomePath(tmpHomePath), CliOption(func(cf *CLIConf) error {
+		cf.MockSSOLogin = mockSSOLogin(t, rootAuth.GetAuthServer(), alice)
 		return nil
 	}))
 	require.NoError(t, err)
@@ -1729,8 +1729,8 @@ func TestSSHAccessRequest(t *testing.T) {
 		"--auth", connector.GetName(),
 		"--proxy", proxyAddr.String(),
 		"--user", "alice",
-	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, rootAuth.GetAuthServer(), alice)
+	}, setHomePath(tmpHomePath), CliOption(func(cf *CLIConf) error {
+		cf.MockSSOLogin = mockSSOLogin(t, rootAuth.GetAuthServer(), alice)
 		return nil
 	}))
 	require.NoError(t, err)
@@ -1847,7 +1847,7 @@ func TestAccessRequestOnLeaf(t *testing.T) {
 		"--auth", connector.GetName(),
 		"--proxy", rootProxyAddr.String(),
 	}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, rootAuthServer, alice)
+		cf.MockSSOLogin = mockSSOLogin(t, rootAuthServer, alice)
 		return nil
 	})
 	require.NoError(t, err)
@@ -2006,7 +2006,7 @@ func TestKubeCredentialsLock(t *testing.T) {
 			"--auth", connector.GetName(),
 			"--proxy", proxyAddr.String(),
 		}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
-			cf.mockSSOLogin = ssoFunc
+			cf.MockSSOLogin = ssoFunc
 			return nil
 		})
 		require.NoError(t, err)
@@ -2067,7 +2067,7 @@ iUK/veLmZ6XoouiWLCdU1VJz/1Fcwe/IEamg6ETfofvsqOCgcNYJ
 				"--teleport-cluster", teleportClusterName.GetClusterName(),
 				"--kube-cluster", kubeClusterName,
 			}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
-				cf.mockSSOLogin = ssoFunc
+				cf.MockSSOLogin = ssoFunc
 				return nil
 			})
 			errChan <- credErr
@@ -2209,9 +2209,9 @@ func TestSSHHeadless(t *testing.T) {
 	require.NoError(t, err)
 	bob.SetRoles([]string{"requester"})
 
-	sshHostName := "test-ssh-host"
+	sshHostname := "test-ssh-host"
 	rootAuth, rootProxy := makeTestServers(t, withBootstrap(nodeAccess, alice, requester, bob), withConfig(func(cfg *servicecfg.Config) {
-		cfg.Hostname = sshHostName
+		cfg.Hostname = sshHostname
 		cfg.SSH.Enabled = true
 		cfg.SSH.Addr = utils.NetAddr{AddrNetwork: "tcp", Addr: net.JoinHostPort("127.0.0.1", ports.Pop())}
 	}))
@@ -2262,12 +2262,12 @@ func TestSSHHeadless(t *testing.T) {
 				"--proxy", proxyAddr.String(),
 			}, tc.args...)
 			args = append(args,
-				fmt.Sprintf("%s@%s", user.Username, sshHostName),
+				fmt.Sprintf("%s@%s", user.Username, sshHostname),
 				"echo", "test",
 			)
 
-			err := Run(ctx, args, cliOption(func(cf *CLIConf) error {
-				cf.mockHeadlessLogin = mockHeadlessLogin(t, rootAuth.GetAuthServer(), alice)
+			err := Run(ctx, args, CliOption(func(cf *CLIConf) error {
+				cf.MockHeadlessLogin = mockHeadlessLogin(t, rootAuth.GetAuthServer(), alice)
 				return nil
 			}))
 			tc.assertErr(t, err)
@@ -2275,6 +2275,81 @@ func TestSSHHeadless(t *testing.T) {
 	}
 }
 
+func TestHeadlessDoesNotAddKeysToAgent(t *testing.T) {
+	modules.SetTestModules(t, &modules.TestModules{TestBuildType: modules.BuildEnterprise})
+	agentKeyring, _ := createAgent(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	user, err := user.Current()
+	require.NoError(t, err)
+
+	// Headless ssh should pass session mfa requirements
+	nodeAccess, err := types.NewRole("node-access", types.RoleSpecV6{
+		Options: types.RoleOptions{
+			RequireMFAType: types.RequireMFAType_SESSION,
+		},
+		Allow: types.RoleConditions{
+			Logins:     []string{user.Username},
+			NodeLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
+		},
+	})
+	require.NoError(t, err)
+
+	alice, err := types.NewUser("alice@example.com")
+	require.NoError(t, err)
+	alice.SetRoles([]string{"node-access"})
+
+	sshHostname := "test-ssh-host"
+	rootAuth, rootProxy := makeTestServers(t, withBootstrap(nodeAccess, alice), withConfig(func(cfg *servicecfg.Config) {
+		cfg.Hostname = sshHostname
+		cfg.SSH.Enabled = true
+		cfg.SSH.Addr = utils.NetAddr{AddrNetwork: "tcp", Addr: net.JoinHostPort("127.0.0.1", ports.Pop())}
+	}))
+
+	proxyAddr, err := rootProxy.ProxyWebAddr()
+	require.NoError(t, err)
+
+	require.NoError(t, rootAuth.GetAuthServer().SetAuthPreference(ctx, &types.AuthPreferenceV2{
+		Spec: types.AuthPreferenceSpecV2{
+			Type:         constants.Local,
+			SecondFactor: constants.SecondFactorOptional,
+			Webauthn: &types.Webauthn{
+				RPID: "127.0.0.1",
+			},
+		},
+	}))
+
+	go func() {
+		if err := approveAllAccessRequests(ctx, rootAuth.GetAuthServer()); err != nil {
+			assert.ErrorIs(t, err, context.Canceled, "unexpected error from approveAllAccessRequests")
+		}
+		// Cancel the context, so Run calls don't block
+		cancel()
+	}()
+
+	err = Run(ctx, []string{
+		"ssh",
+		"-d",
+		"--insecure",
+		"--proxy", proxyAddr.String(),
+		"--headless",
+		"--user", "alice",
+		"--add-keys-to-agent=yes",
+		fmt.Sprintf("%s@%s", user.Username, sshHostname),
+		"echo", "test",
+	}, CliOption(func(cf *CLIConf) error {
+		cf.MockHeadlessLogin = mockHeadlessLogin(t, rootAuth.GetAuthServer(), alice)
+		return nil
+	}))
+	require.NoError(t, err)
+
+	keys, err := agentKeyring.List()
+	require.NoError(t, err)
+	require.Empty(t, keys)
+}
+
 func TestFormatConnectCommand(t *testing.T) {
 	t.Parallel()
 
@@ -2488,6 +2563,73 @@ func TestEnvFlags(t *testing.T) {
 			},
 		}))
 	})
+
+	t.Run("tsh ssh session env", func(t *testing.T) {
+		t.Run("ignore ssh session env without headless", testEnvFlag(testCase{
+			inCLIConf: CLIConf{
+				Headless: false,
+			},
+			envMap: map[string]string{
+				teleport.SSHSessionWebProxyAddr: "proxy.example.com",
+				teleport.SSHTeleportUser:        "alice",
+				teleport.SSHTeleportClusterName: "root-cluster",
+			},
+			outCLIConf: CLIConf{
+				Headless: false,
+			},
+		}))
+		t.Run("use ssh session env with headless cli flag", testEnvFlag(testCase{
+			inCLIConf: CLIConf{
+				Headless: true,
+			},
+			envMap: map[string]string{
+				teleport.SSHSessionWebProxyAddr: "proxy.example.com",
+				teleport.SSHTeleportUser:        "alice",
+				teleport.SSHTeleportClusterName: "root-cluster",
+			},
+			outCLIConf: CLIConf{
+				Headless: true,
+				Proxy:    "proxy.example.com",
+				Username: "alice",
+				SiteName: "root-cluster",
+			},
+		}))
+		t.Run("use ssh session env with headless auth connector cli flag", testEnvFlag(testCase{
+			inCLIConf: CLIConf{
+				AuthConnector: constants.HeadlessConnector,
+			},
+			envMap: map[string]string{
+				teleport.SSHSessionWebProxyAddr: "proxy.example.com",
+				teleport.SSHTeleportUser:        "alice",
+				teleport.SSHTeleportClusterName: "root-cluster",
+			},
+			outCLIConf: CLIConf{
+				AuthConnector: constants.HeadlessConnector,
+				Proxy:         "proxy.example.com",
+				Username:      "alice",
+				SiteName:      "root-cluster",
+			},
+		}))
+		t.Run("does not overwrite cli flags", testEnvFlag(testCase{
+			inCLIConf: CLIConf{
+				Headless: true,
+				Proxy:    "proxy.example.com",
+				Username: "alice",
+				SiteName: "root-cluster",
+			},
+			envMap: map[string]string{
+				teleport.SSHSessionWebProxyAddr: "other.example.com",
+				teleport.SSHTeleportUser:        "bob",
+				teleport.SSHTeleportClusterName: "leaf-cluster",
+			},
+			outCLIConf: CLIConf{
+				Headless: true,
+				Proxy:    "proxy.example.com",
+				Username: "alice",
+				SiteName: "root-cluster",
+			},
+		}))
+	})
 }
 
 func TestKubeConfigUpdate(t *testing.T) {
@@ -2943,7 +3085,7 @@ func TestAuthClientFromTSHProfile(t *testing.T) {
 		"--auth", connector.GetName(),
 		"--proxy", proxyAddr.String(),
 	}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
-		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+		cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 		return nil
 	})
 	require.NoError(t, err)
@@ -3189,39 +3331,39 @@ func mockHeadlessLogin(t *testing.T, authServer *auth.Server, user types.User) c
 	}
 }
 
-func setOverrideStdout(stdout io.Writer) cliOption {
+func setOverrideStdout(stdout io.Writer) CliOption {
 	return func(cf *CLIConf) error {
-		cf.overrideStdout = stdout
+		cf.OverrideStdout = stdout
 		return nil
 	}
 }
 
-func setCopyStdout(stdout io.Writer) cliOption {
+func setCopyStdout(stdout io.Writer) CliOption {
 	return setOverrideStdout(io.MultiWriter(os.Stdout, stdout))
 }
 
-func setHomePath(path string) cliOption {
+func setHomePath(path string) CliOption {
 	return func(cf *CLIConf) error {
 		cf.HomePath = path
 		return nil
 	}
 }
 
-func setKubeConfigPath(path string) cliOption {
+func setKubeConfigPath(path string) CliOption {
 	return func(cf *CLIConf) error {
-		cf.kubeConfigPath = path
+		cf.KubeConfigPath = path
 		return nil
 	}
 }
 
-func setIdentity(path string) cliOption {
+func setIdentity(path string) CliOption {
 	return func(cf *CLIConf) error {
 		cf.IdentityFileIn = path
 		return nil
 	}
 }
 
-func setCmdRunner(cmdRunner func(*exec.Cmd) error) cliOption {
+func setCmdRunner(cmdRunner func(*exec.Cmd) error) CliOption {
 	return func(cf *CLIConf) error {
 		cf.cmdRunner = cmdRunner
 		return nil
@@ -3367,6 +3509,7 @@ func TestSerializeDatabases(t *testing.T) {
         "elasticache": {},
         "secret_store": {},
         "memorydb": {},
+        "opensearch": {},
         "rdsproxy": {},
         "redshift_serverless": {}
       },
@@ -3381,7 +3524,8 @@ func TestSerializeDatabases(t *testing.T) {
       "ad": {
         "domain": "",
         "spn": ""
-      }
+      },
+      "mongo_atlas": {}
     },
     "status": {
       "mysql": {},
@@ -3393,6 +3537,7 @@ func TestSerializeDatabases(t *testing.T) {
         "elasticache": {},
         "secret_store": {},
         "memorydb": {},
+        "opensearch": {},
         "rdsproxy": {},
         "redshift_serverless": {}
       },
@@ -3531,9 +3676,10 @@ func TestSerializeDatabases(t *testing.T) {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
+			accessChecker := services.NewAccessCheckerWithRoleSet(&services.AccessInfo{}, "clustername", tt.roles)
 			expected := fmt.Sprintf(expectedFmt, tt.dbUsersData)
 			testSerialization(t, expected, func(f string) (string, error) {
-				return serializeDatabases([]types.Database{db}, f, tt.roles)
+				return serializeDatabases([]types.Database{db}, f, accessChecker)
 			})
 		})
 	}
@@ -4189,10 +4335,13 @@ func TestListDatabasesWithUsers(t *testing.T) {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			gotUsers := getDBUsers(tt.database, tt.roles)
+
+			accessChecker := services.NewAccessCheckerWithRoleSet(&services.AccessInfo{}, "clustername", tt.roles)
+
+			gotUsers := getDBUsers(tt.database, accessChecker)
 			require.Equal(t, tt.wantUsers, gotUsers)
 
-			gotText := formatUsersForDB(tt.database, tt.roles)
+			gotText := formatUsersForDB(tt.database, accessChecker)
 			require.Equal(t, tt.wantText, gotText)
 		})
 	}
@@ -4304,7 +4453,7 @@ func TestForwardingTraces(t *testing.T) {
 				"--proxy", proxyAddr.String(),
 				"--trace",
 			}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
-				cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+				cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 				return nil
 			})
 			require.NoError(t, err)
@@ -4423,7 +4572,7 @@ func TestExportingTraces(t *testing.T) {
 				"--trace",
 				"--trace-exporter", tshCollector.GRPCAddr(),
 			}, setHomePath(tmpHomePath), func(cf *CLIConf) error {
-				cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+				cf.MockSSOLogin = mockSSOLogin(t, authServer, alice)
 				return nil
 			})
 			require.NoError(t, err)
diff --git a/tool/tsh/tshconfig.go b/tool/tsh/common/tshconfig.go
similarity index 99%
rename from tool/tsh/tshconfig.go
rename to tool/tsh/common/tshconfig.go
index 2f80515c97113..2f8e6ae362709 100644
--- a/tool/tsh/tshconfig.go
+++ b/tool/tsh/common/tshconfig.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"errors"
diff --git a/tool/tsh/tshconfig_test.go b/tool/tsh/common/tshconfig_test.go
similarity index 98%
rename from tool/tsh/tshconfig_test.go
rename to tool/tsh/common/tshconfig_test.go
index 63698b280c590..36dc403095d94 100644
--- a/tool/tsh/tshconfig_test.go
+++ b/tool/tsh/common/tshconfig_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package common
 
 import (
 	"os"
@@ -111,6 +111,8 @@ func TestLoadAllConfigs(t *testing.T) {
 }
 
 func TestTshConfigMerge(t *testing.T) {
+	t.Parallel()
+
 	sampleConfig := TshConfig{
 		ExtraHeaders: []ExtraProxyHeaders{{
 			Proxy: "foo",
@@ -254,6 +256,8 @@ func TestTshConfigMerge(t *testing.T) {
 
 // TestProxyTemplatesApply verifies proxy templates matching functionality.
 func TestProxyTemplatesApply(t *testing.T) {
+	t.Parallel()
+
 	tshConfig := TshConfig{
 		ProxyTemplates: ProxyTemplates{
 			{
@@ -331,6 +335,8 @@ func TestProxyTemplatesApply(t *testing.T) {
 
 // TestProxyTemplates verifies proxy templates apply properly to client config.
 func TestProxyTemplatesMakeClient(t *testing.T) {
+	t.Parallel()
+
 	tshConfig := TshConfig{
 		ProxyTemplates: ProxyTemplates{
 			{
@@ -439,7 +445,7 @@ func TestProxyTemplatesMakeClient(t *testing.T) {
 			}},
 		},
 		{
-			name: "match does not overwrite user specified cluster or proxy jump",
+			name: "match does not overwrite user specified proxy jump",
 			InConf: newCLIConf(func(conf *CLIConf) {
 				conf.UserHost = "node-1.us.example.com:3022"
 				conf.SiteName = "specified.cluster"
@@ -447,7 +453,7 @@ func TestProxyTemplatesMakeClient(t *testing.T) {
 			}),
 			outHost:    "node-1",
 			outPort:    4022,
-			outCluster: "specified.cluster",
+			outCluster: "us.example.com",
 			outJumpHosts: []utils.JumpHost{{
 				Addr: utils.NetAddr{
 					Addr:        "specified.proxy.com:443",
diff --git a/tool/tsh/winwebauthn.go b/tool/tsh/common/winwebauthn.go
similarity index 99%
rename from tool/tsh/winwebauthn.go
rename to tool/tsh/common/winwebauthn.go
index c1cb7d7ba809b..c8ad0adc7e5e7 100644
--- a/tool/tsh/winwebauthn.go
+++ b/tool/tsh/common/winwebauthn.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package main
+package common
 
 import (
 	"fmt"
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/index.ts b/tool/tsh/main.go
similarity index 76%
rename from web/packages/teleport/src/Assist/Chat/ChatItem/index.ts
rename to tool/tsh/main.go
index 81b6d3e61e542..e7238312cc2c0 100644
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/index.ts
+++ b/tool/tsh/main.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2023 Gravitational, Inc.
+Copyright 2016-2021 Gravitational, Inc.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,4 +14,12 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-export { ChatItem } from './ChatItem';
+package main
+
+import (
+	tshcommon "github.com/gravitational/teleport/tool/tsh/common"
+)
+
+func main() {
+	tshcommon.Main()
+}
diff --git a/web/.storybook/preview.js b/web/.storybook/preview.js
index 0a96b8be94fb4..a66f7597613c2 100644
--- a/web/.storybook/preview.js
+++ b/web/.storybook/preview.js
@@ -15,15 +15,19 @@ limitations under the License.
 */
 
 import React from 'react';
-import { setupWorker, rest } from 'msw';
+import { rest, setupWorker } from 'msw';
 import { addDecorator, addParameters } from '@storybook/react';
 import { darkTheme, lightTheme } from './../packages/design/src/theme';
 import DefaultThemeProvider from '../packages/design/src/ThemeProvider';
 import Box from './../packages/design/src/Box';
 import '../packages/teleport/src/lib/polyfillRandomUuid';
-import { ThemeProvider as TeletermThemeProvider } from './../packages/teleterm/src/ui/ThemeProvider';
-import { theme as TeletermTheme } from './../packages/teleterm/src/ui/ThemeProvider/theme';
+import { StaticThemeProvider as TeletermThemeProvider } from './../packages/teleterm/src/ui/ThemeProvider';
+import {
+  darkTheme as teletermDarkTheme,
+  lightTheme as teletermLightTheme,
+} from './../packages/teleterm/src/ui/ThemeProvider/theme';
 import { handlersTeleport } from './../packages/teleport/src/mocks/handlers';
+import { UserContextProvider } from 'teleport/User';
 
 // Checks we are running non-node environment (browser)
 if (typeof global.process === 'undefined') {
@@ -41,7 +45,10 @@ const ThemeDecorator = (storyFn, meta) => {
 
   if (meta.title.startsWith('Teleterm/')) {
     ThemeProvider = TeletermThemeProvider;
-    theme = TeletermTheme;
+    theme =
+      meta.globals.theme === 'Dark Theme'
+        ? teletermDarkTheme
+        : teletermLightTheme;
   } else {
     ThemeProvider = DefaultThemeProvider;
     theme = meta.globals.theme === 'Dark Theme' ? darkTheme : lightTheme;
@@ -54,6 +61,21 @@ const ThemeDecorator = (storyFn, meta) => {
   );
 };
 
+// wrap stories with an argument of {userContext: true} with user context provider
+const UserDecorator = (storyFn, meta) => {
+  if (meta.args.userContext) {
+    const UserProvider = UserContextProvider;
+    return (
+      <UserProvider>
+        <Box p={3}>{storyFn()}</Box>
+      </UserProvider>
+    );
+  }
+
+  return <Box p={3}>{storyFn()}</Box>;
+};
+
+addDecorator(UserDecorator);
 addDecorator(ThemeDecorator);
 addParameters({
   options: {
diff --git a/web/packages/build/package.json b/web/packages/build/package.json
index 03976069d4fbf..574d3cdd82aac 100644
--- a/web/packages/build/package.json
+++ b/web/packages/build/package.json
@@ -91,7 +91,7 @@
     "react-transition-group": "^4.4.2",
     "rollup-plugin-visualizer": "^5.9.0",
     "styled-components": "5.1.0",
-    "vite": "^4.2.0",
+    "vite": "^4.2.3",
     "vite-tsconfig-paths": "^4.0.7",
     "webpack": "^5.76.2",
     "webpack-bundle-analyzer": "^4.6.1",
diff --git a/web/packages/design/src/Card/Card.jsx b/web/packages/design/src/Card/Card.jsx
index 16fbd88cb23d2..95dc3f2224a94 100644
--- a/web/packages/design/src/Card/Card.jsx
+++ b/web/packages/design/src/Card/Card.jsx
@@ -22,11 +22,11 @@ import { darkTheme } from './../theme';
 const Card = styled(Box)`
   box-shadow: ${props => props.theme.boxShadow[2]};
   border-radius: 8px;
+  background-color: ${props => props.theme.colors.levels.surface};
 `;
 
 Card.defaultProps = {
   theme: { darkTheme },
-  bg: 'levels.surface',
 };
 
 Card.displayName = 'Card';
diff --git a/web/packages/design/src/CardError/__snapshots__/CardError.story.test.jsx.snap b/web/packages/design/src/CardError/__snapshots__/CardError.story.test.jsx.snap
index a0dbbaad67b70..076419228c019 100644
--- a/web/packages/design/src/CardError/__snapshots__/CardError.story.test.jsx.snap
+++ b/web/packages/design/src/CardError/__snapshots__/CardError.story.test.jsx.snap
@@ -36,6 +36,7 @@ exports[`rendering of Error Cards 1`] = `
   background-color: #344179;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c1 {
diff --git a/web/packages/design/src/CardSuccess/__snapshots__/CardSuccess.test.jsx.snap b/web/packages/design/src/CardSuccess/__snapshots__/CardSuccess.test.jsx.snap
index 3d6c1209cff82..273faaf68d395 100644
--- a/web/packages/design/src/CardSuccess/__snapshots__/CardSuccess.test.jsx.snap
+++ b/web/packages/design/src/CardSuccess/__snapshots__/CardSuccess.test.jsx.snap
@@ -9,10 +9,10 @@ exports[`rendering of CardSuccess components 1`] = `
   margin-bottom: 24px;
   padding: 48px;
   width: 540px;
-  background-color: #222C59;
   text-align: center;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c1 {
diff --git a/web/packages/design/src/DraggableList/DraggableList.tsx b/web/packages/design/src/DraggableList/DraggableList.tsx
new file mode 100644
index 0000000000000..745795e30b40d
--- /dev/null
+++ b/web/packages/design/src/DraggableList/DraggableList.tsx
@@ -0,0 +1,172 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, {
+  Children,
+  PropsWithChildren,
+  useEffect,
+  useLayoutEffect,
+  useRef,
+  useState,
+} from 'react';
+import styled from 'styled-components';
+
+import { animated, to, useSprings } from '@react-spring/web';
+import { useGesture } from '@use-gesture/react';
+import { ReactDOMAttributes } from '@use-gesture/react/dist/declarations/src/types';
+
+const Container = styled.div`
+  position: relative;
+`;
+
+interface DraggableListProps {
+  onOrderChange: (newOrder: number[]) => void;
+}
+
+export function DraggableList(props: PropsWithChildren<DraggableListProps>) {
+  const children = Children.toArray(props.children);
+
+  const [childrenHeight, setChildrenHeight] = useState(0);
+
+  const animatedDiv = useRef<HTMLDivElement>(null);
+  const order = useRef<number[]>(children.map((_, index) => index));
+
+  function createPropsGetter(
+    orderList: number[] = order.current,
+    down?: boolean,
+    originalIndex?: number,
+    newHeight?: number
+  ) {
+    return function getProps(index: number) {
+      if (down && index === originalIndex) {
+        return {
+          height: newHeight,
+          width: 0,
+          zIndex: 1,
+          immediate: (key: string) =>
+            key === 'active' || key === 'height' || key === 'zIndex',
+        };
+      }
+
+      return {
+        height: childrenHeight * orderList.indexOf(index),
+        width: 0,
+        zIndex: 0,
+        immediate: false,
+      };
+    };
+  }
+
+  const [springs, api] = useSprings(children.length, createPropsGetter());
+
+  const bind = useGesture({
+    onDrag: state => {
+      const [, offset] = state.movement;
+      if (offset === 0) {
+        return;
+      }
+
+      const [originalIndex] = state.args;
+
+      const curIndex = order.current.indexOf(originalIndex);
+      const newHeight = childrenHeight * curIndex + offset;
+      const nextIndex = clamp(
+        Math.round(newHeight / childrenHeight),
+        0,
+        children.length - 1
+      );
+      const newOrder = swap(order.current, curIndex, nextIndex);
+
+      api.start(
+        createPropsGetter(newOrder, state.down, originalIndex, newHeight)
+      );
+      if (!state.down) {
+        order.current = newOrder;
+      }
+    },
+    onDragEnd: () => {
+      api.start(createPropsGetter());
+      props.onOrderChange(order.current);
+    },
+  }) as unknown as (...args: any[]) => ReactDOMAttributes; // useGesture typings are wrong https://github.com/pmndrs/use-gesture/issues/362
+
+  useEffect(() => {
+    order.current = children.map((_, index) => index);
+
+    api.start(createPropsGetter());
+  }, [children.length]);
+
+  useLayoutEffect(() => {
+    if (!animatedDiv.current) {
+      return;
+    }
+
+    const height = animatedDiv.current.scrollHeight;
+    if (childrenHeight !== height) {
+      setChildrenHeight(height);
+
+      return;
+    }
+
+    api.start(createPropsGetter());
+  }, [api, childrenHeight, children.length]);
+
+  return (
+    <Container
+      style={{ height: childrenHeight * (springs.length + 1) }}
+      onClick={e => e.stopPropagation()}
+    >
+      {springs.map((spring, index) => {
+        const { width, height, zIndex } = spring;
+
+        return (
+          <animated.div
+            ref={animatedDiv}
+            {...bind(index)}
+            key={index}
+            style={{
+              position: 'absolute',
+              zIndex,
+              width: '100%',
+              transform: to(
+                [width, height],
+                (x, y) => `translate3d(${x}px, ${y}px, 0)`
+              ),
+              touchAction: 'none',
+            }}
+          >
+            {children[index]}
+          </animated.div>
+        );
+      })}
+    </Container>
+  );
+}
+
+function clamp(pos: number, low: number, high: number) {
+  const mid = Math.max(pos, low);
+
+  return Math.min(mid, high);
+}
+
+function swap<T>(arr: T[], a: number, b: number): T[] {
+  const copy = [...arr];
+  const [index] = copy.splice(a, 1);
+
+  copy.splice(b, 0, index);
+
+  return copy;
+}
diff --git a/web/packages/design/src/DraggableList/index.ts b/web/packages/design/src/DraggableList/index.ts
new file mode 100644
index 0000000000000..d502f2f0f781c
--- /dev/null
+++ b/web/packages/design/src/DraggableList/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { DraggableList } from './DraggableList';
diff --git a/web/packages/design/src/SVGIcon/Brain.tsx b/web/packages/design/src/SVGIcon/Brain.tsx
new file mode 100644
index 0000000000000..940504f3e5d27
--- /dev/null
+++ b/web/packages/design/src/SVGIcon/Brain.tsx
@@ -0,0 +1,31 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import React from 'react';
+
+import { SVGIcon } from './SVGIcon';
+
+import type { SVGIconProps } from './common';
+
+export function BrainIcon({ size = 22, fill }: SVGIconProps) {
+  return (
+    <SVGIcon fill={fill} size={size} viewBox="0 0 20 20">
+      <path d="M12.5 7a.5.5 0 0 1 0-1c.276 0 .5-.224.5-.5a.5.5 0 0 1 1 0c0 .827-.673 1.5-1.5 1.5zM12.585 15a.499.499 0 0 1-.471-.333 2.002 2.002 0 0 1 2.553-2.553.5.5 0 0 1-.333.943 1.002 1.002 0 0 0-1.276 1.276.5.5 0 0 1-.472.667z" />
+      <path d="M19 10.5c0-2.459-.764-4.801-2.21-6.779a3.998 3.998 0 0 0-2.339-2.45 3 3 0 0 0-4.951.072 3 3 0 0 0-4.951-.072 3.993 3.993 0 0 0-2.339 2.45A11.406 11.406 0 0 0 0 10.5c0 .655.056 1.312.166 1.953A7.175 7.175 0 0 0 0 14c0 1.584.508 3.078 1.431 4.206C2.378 19.363 3.645 20 5 20c.263 0 .527-.025.785-.073A3.501 3.501 0 0 0 9.5 18.301a3.501 3.501 0 0 0 3.715 1.626c.259.049.522.073.785.073 1.355 0 2.622-.637 3.569-1.794C18.492 17.078 19 15.584 19 14c0-.531-.056-1.049-.166-1.547.11-.641.166-1.297.166-1.953zM6.5 19A2.503 2.503 0 0 1 4 16.5a.5.5 0 0 0-1 0c0 .876.323 1.677.857 2.292C2.207 18.176 1 16.261 1 14c0-1.158.326-2.288.917-3.181a.5.5 0 0 0-.834-.552l-.082.127a10.429 10.429 0 0 1 1.087-4.557 3.976 3.976 0 0 0 1.055 1.962.499.499 0 1 0 .714-.7 2.998 2.998 0 0 1 .153-4.345 3.015 3.015 0 0 0 .05.846.5.5 0 0 0 .98-.198A2.002 2.002 0 0 1 7 1.001c1.103 0 2 .897 2 2v6.766a2.987 2.987 0 0 0-2.604-.705.5.5 0 0 0 .2.98A2.002 2.002 0 0 1 9 12.001v4.5c0 1.378-1.122 2.5-2.5 2.5zm8.643-.209A3.486 3.486 0 0 0 16 16.5a.5.5 0 0 0-1 0c0 1.378-1.122 2.5-2.5 2.5S10 17.878 10 16.5V12a2.002 2.002 0 0 1 2.404-1.959.5.5 0 0 0 .2-.98A2.987 2.987 0 0 0 10 9.766V3c0-1.103.897-2 2-2a2.002 2.002 0 0 1 1.96 2.401.499.499 0 1 0 .98.198 3.005 3.005 0 0 0 .05-.845 3 3 0 0 1 .153 4.345.5.5 0 0 0 .714.7 3.972 3.972 0 0 0 1.055-1.962 10.425 10.425 0 0 1 1.087 4.557 5.51 5.51 0 0 0-.082-.127.5.5 0 0 0-.834.552c.591.893.917 2.023.917 3.181 0 2.26-1.206 4.175-2.857 4.791z" />
+      <path d="M6.5 7C5.673 7 5 6.327 5 5.5a.5.5 0 0 1 1 0c0 .276.224.5.5.5a.5.5 0 0 1 0 1zM6.415 15a.5.5 0 0 1-.472-.667 1.002 1.002 0 0 0-1.276-1.276.5.5 0 1 1-.333-.943 2.002 2.002 0 0 1 2.553 2.553.5.5 0 0 1-.471.333z" />
+    </SVGIcon>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/utils.ts b/web/packages/design/src/SVGIcon/Check.tsx
similarity index 64%
rename from web/packages/teleport/src/Assist/Chat/ChatItem/utils.ts
rename to web/packages/design/src/SVGIcon/Check.tsx
index e31a9ac9e012e..44d1d2fbb14f3 100644
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/utils.ts
+++ b/web/packages/design/src/SVGIcon/Check.tsx
@@ -14,14 +14,16 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-export function getBorderRadius(
-  isTeleport: boolean,
-  isFirst: boolean,
-  isLast: boolean
-) {
-  if (isTeleport) {
-    return `${isFirst ? '14px' : '5px'} 14px 14px ${isLast ? '14px' : '5px'}`;
-  }
+import React from 'react';
 
-  return `14px ${isFirst ? '14px' : '5px'} ${isLast ? '14px' : '5px'} 14px`;
+import { SVGIcon } from './SVGIcon';
+
+import type { SVGIconProps } from './common';
+
+export function CheckIcon({ size = 32, fill }: SVGIconProps) {
+  return (
+    <SVGIcon fill={fill} size={size} viewBox="0 0 32 32">
+      <path d="M27 4 12 19l-7-7-5 5 12 12L32 9z" />
+    </SVGIcon>
+  );
 }
diff --git a/web/packages/teleport/src/Assist/ConversationTitle.tsx b/web/packages/design/src/SVGIcon/ConversationList.tsx
similarity index 54%
rename from web/packages/teleport/src/Assist/ConversationTitle.tsx
rename to web/packages/design/src/SVGIcon/ConversationList.tsx
index 31d51fe6f0e82..f3519bec84857 100644
--- a/web/packages/teleport/src/Assist/ConversationTitle.tsx
+++ b/web/packages/design/src/SVGIcon/ConversationList.tsx
@@ -15,23 +15,15 @@ limitations under the License.
 */
 
 import React from 'react';
-import { useParams } from 'react-router';
 
-import { useConversations } from 'teleport/Assist/contexts/conversations';
+import { SVGIcon } from './SVGIcon';
 
-export function ConversationTitle() {
-  const { conversations } = useConversations();
-  const params = useParams<{ conversationId: string }>();
+import type { SVGIconProps } from './common';
 
-  if (params.conversationId) {
-    const conversation = conversations.find(
-      conversation => conversation.id === params.conversationId
-    );
-
-    if (conversation) {
-      return <>{conversation.title}</>;
-    }
-  }
-
-  return null;
+export function ConversationListIcon({ size = 24, fill }: SVGIconProps) {
+  return (
+    <SVGIcon fill={fill} size={size} viewBox="0 0 24 24">
+      <path d="M18 8.016V6H6v2.016h12zm-3.984 6V12H6v2.016h8.016zM6 9v2.016h12V9H6zm14.016-6.984q.797 0 1.383.586t.586 1.383v12q0 .797-.586 1.406T20.016 18H6l-3.984 3.984v-18q0-.797.586-1.383t1.383-.586h16.031z" />
+    </SVGIcon>
+  );
 }
diff --git a/web/packages/design/src/SVGIcon/Display.tsx b/web/packages/design/src/SVGIcon/Display.tsx
new file mode 100644
index 0000000000000..82596fae137ce
--- /dev/null
+++ b/web/packages/design/src/SVGIcon/Display.tsx
@@ -0,0 +1,29 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import React from 'react';
+
+import { SVGIcon } from './SVGIcon';
+
+import type { SVGIconProps } from './common';
+
+export function DisplayIcon({ size = 32, fill }: SVGIconProps) {
+  return (
+    <SVGIcon fill={fill} size={size} viewBox="0 0 32 32">
+      <path d="M30.662 9.003a98.793 98.793 0 0 0-8.815-.851L27 2.999l-2-2-7.017 7.017c-.656-.011-1.317-.017-1.983-.017l-8-8-2 2 6.069 6.069c-3.779.133-7.386.454-10.731.935C.478 12.369 0 16.089 0 20s.477 7.63 1.338 10.997C5.827 31.642 10.786 32 16 32s10.173-.358 14.662-1.003C31.522 27.631 32 23.911 32 20s-.477-7.63-1.338-10.997zm-3.665 18.328C23.63 27.761 19.911 28 16 28s-7.63-.239-10.997-.669C4.358 25.087 4 22.607 4 20s.358-5.087 1.003-7.331C8.369 12.239 12.089 12 16 12s7.63.239 10.996.669C27.641 14.913 28 17.393 28 20s-.358 5.087-1.003 7.331z" />
+    </SVGIcon>
+  );
+}
diff --git a/web/packages/design/src/SVGIcon/Error.tsx b/web/packages/design/src/SVGIcon/Error.tsx
new file mode 100644
index 0000000000000..d17d0391e51e6
--- /dev/null
+++ b/web/packages/design/src/SVGIcon/Error.tsx
@@ -0,0 +1,29 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import React from 'react';
+
+import { SVGIcon } from './SVGIcon';
+
+import type { SVGIconProps } from './common';
+
+export function ErrorIcon({ size = 24, fill }: SVGIconProps) {
+  return (
+    <SVGIcon fill={fill} size={size} viewBox="0 0 24 24">
+      <path d="M12.984 12.984v-6h-1.969v6h1.969zm0 4.032V15h-1.969v2.016h1.969zm-.984-15q4.125 0 7.055 2.93t2.93 7.055-2.93 7.055T12 21.986t-7.055-2.93-2.93-7.055 2.93-7.055T12 2.016z" />
+    </SVGIcon>
+  );
+}
diff --git a/web/packages/design/src/SVGIcon/Expand.tsx b/web/packages/design/src/SVGIcon/Expand.tsx
new file mode 100644
index 0000000000000..4bbb1390c65f8
--- /dev/null
+++ b/web/packages/design/src/SVGIcon/Expand.tsx
@@ -0,0 +1,29 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import React from 'react';
+
+import { SVGIcon } from './SVGIcon';
+
+import type { SVGIconProps } from './common';
+
+export function ExpandIcon({ size = 16, fill }: SVGIconProps) {
+  return (
+    <SVGIcon fill={fill} size={size} viewBox="0 0 16 16">
+      <path d="m15 5-1.284-1.284-3.29 3.29-1.432-1.432 3.29-3.29L11 1a1 1 0 0 1 1-1h3a1 1 0 0 1 1 1v3a1 1 0 0 1-1 1zM5 15a1 1 0 0 1-1 1H1a1 1 0 0 1-1-1v-3a1 1 0 0 1 1-1l1.284 1.284 3.29-3.29 1.432 1.432-3.29 3.291L5 15z" />
+    </SVGIcon>
+  );
+}
diff --git a/web/packages/design/src/SVGIcon/Popup.tsx b/web/packages/design/src/SVGIcon/Popup.tsx
new file mode 100644
index 0000000000000..9d43489268611
--- /dev/null
+++ b/web/packages/design/src/SVGIcon/Popup.tsx
@@ -0,0 +1,29 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import React from 'react';
+
+import { SVGIcon } from './SVGIcon';
+
+import type { SVGIconProps } from './common';
+
+export function PopupIcon({ size = 20, fill }: SVGIconProps) {
+  return (
+    <SVGIcon fill={fill} size={size} viewBox="0 0 20 20">
+      <path d="M16 2H7.979C6.88 2 6 2.88 6 3.98V12c0 1.1.9 2 2 2h8c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 10H8V4h8v8zM4 10H2v6c0 1.1.9 2 2 2h6v-2H4v-6z" />
+    </SVGIcon>
+  );
+}
diff --git a/web/packages/design/src/SVGIcon/Settings.tsx b/web/packages/design/src/SVGIcon/Settings.tsx
new file mode 100644
index 0000000000000..4231971cffaa9
--- /dev/null
+++ b/web/packages/design/src/SVGIcon/Settings.tsx
@@ -0,0 +1,29 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import React from 'react';
+
+import { SVGIcon } from './SVGIcon';
+
+import type { SVGIconProps } from './common';
+
+export function SettingsIcon({ size = 32, fill }: SVGIconProps) {
+  return (
+    <SVGIcon fill={fill} size={size} viewBox="0 0 32 32">
+      <path d="M29.181 19.07c-1.679-2.908-.669-6.634 2.255-8.328l-3.145-5.447a6.022 6.022 0 0 1-3.058.829c-3.361 0-6.085-2.742-6.085-6.125h-6.289a6.023 6.023 0 0 1-.811 3.07C10.369 5.977 6.637 6.966 3.709 5.28L.565 10.727a6.023 6.023 0 0 1 2.246 2.234c1.676 2.903.672 6.623-2.241 8.319l3.145 5.447a6.022 6.022 0 0 1 3.044-.82c3.35 0 6.067 2.725 6.084 6.092h6.289a6.032 6.032 0 0 1 .811-3.038c1.676-2.903 5.399-3.894 8.325-2.219l3.145-5.447a6.032 6.032 0 0 1-2.232-2.226zM16 22.479A6.48 6.48 0 1 1 16 9.52a6.48 6.48 0 0 1 0 12.959z" />
+    </SVGIcon>
+  );
+}
diff --git a/web/packages/design/src/SVGIcon/Sidebar.tsx b/web/packages/design/src/SVGIcon/Sidebar.tsx
new file mode 100644
index 0000000000000..7ef3aef9b4394
--- /dev/null
+++ b/web/packages/design/src/SVGIcon/Sidebar.tsx
@@ -0,0 +1,29 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import React from 'react';
+
+import { SVGIcon } from './SVGIcon';
+
+import type { SVGIconProps } from './common';
+
+export function SidebarIcon({ size = 24, fill }: SVGIconProps) {
+  return (
+    <SVGIcon fill={fill} size={size} viewBox="0 0 24 24">
+      <path d="M5 2a2.997 2.997 0 0 0-3 3v14a2.997 2.997 0 0 0 3 3h14a2.997 2.997 0 0 0 3-3V5a2.997 2.997 0 0 0-3-3zm5 18V4h9c.276 0 .525.111.707.293S20 4.724 20 5v14c0 .276-.111.525-.293.707S19.276 20 19 20zM8 4v16H5c-.276 0-.525-.111-.707-.293S4 19.276 4 19V5c0-.276.111-.525.293-.707S4.724 4 5 4z" />
+    </SVGIcon>
+  );
+}
diff --git a/web/packages/teleport/src/services/ping/ping.ts b/web/packages/design/src/SVGIcon/Terminal.tsx
similarity index 58%
rename from web/packages/teleport/src/services/ping/ping.ts
rename to web/packages/design/src/SVGIcon/Terminal.tsx
index 78beeadc518bb..47b629c89e336 100644
--- a/web/packages/teleport/src/services/ping/ping.ts
+++ b/web/packages/design/src/SVGIcon/Terminal.tsx
@@ -14,15 +14,16 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import api from 'teleport/services/api';
-import cfg from 'teleport/config';
+import React from 'react';
 
-import { makePing } from './makePing';
+import { SVGIcon } from './SVGIcon';
 
-const service = {
-  fetchPing() {
-    return api.get(cfg.api.webapiPingPath).then(makePing);
-  },
-};
+import type { SVGIconProps } from './common';
 
-export default service;
+export function TerminalIcon({ size = 32, fill }: SVGIconProps) {
+  return (
+    <SVGIcon fill={fill} size={size} viewBox="0 0 32 32">
+      <path d="M0 2v28h32V2H0zm30 26H2V4h28v24zM28 6H4v20h24V6zM14 16h-2v2h-2v2H8v-2h2v-2h2v-2h-2v-2H8v-2h2v2h2v2h2v2zm8 4h-6v-2h6v2z" />
+    </SVGIcon>
+  );
+}
diff --git a/web/packages/design/src/SVGIcon/index.ts b/web/packages/design/src/SVGIcon/index.ts
index 905fa3bdd72ec..7f20066ee38a6 100644
--- a/web/packages/design/src/SVGIcon/index.ts
+++ b/web/packages/design/src/SVGIcon/index.ts
@@ -21,15 +21,21 @@ export { ApplicationsIcon } from './Applications';
 export { AuditLogIcon } from './AuditLog';
 export { AuthConnectorsIcon } from './AuthConnectors';
 export { AWSIcon } from './AWS';
+export { BrainIcon } from './Brain';
 export { ChatIcon } from './Chat';
+export { CheckIcon } from './Check';
 export { ChevronDownIcon } from './ChevronDown';
 export { ChevronRightIcon } from './ChevronRight';
 export { CloseIcon } from './Close';
+export { ConversationListIcon } from './ConversationList';
 export { DatabasesIcon } from './Databases';
 export { DesktopsIcon } from './Desktops';
 export { DevicesIcon } from './Devices';
+export { DisplayIcon } from './Display';
 export { DownloadsIcon } from './Downloads';
 export { EditIcon } from './Edit';
+export { ErrorIcon } from './Error';
+export { ExpandIcon } from './Expand';
 export { ExternalLinkIcon } from './ExternalLink';
 export { IntegrationsIcon } from './Integrations';
 export { KubernetesIcon } from './Kubernetes';
@@ -39,6 +45,7 @@ export { LogoutIcon } from './Logout';
 export { ManageClustersIcon } from './ManageClusters';
 export { OpenAIIcon } from './OpenAI';
 export { PlusIcon } from './Plus';
+export { PopupIcon } from './Popup';
 export { RemoteCommandIcon } from './RemoteCommand';
 export { RolesIcon } from './Roles';
 export { RunIcon } from './Run';
@@ -46,7 +53,10 @@ export { SearchIcon } from './Search';
 export { ServerIcon } from './Server';
 export { ServersIcon } from './Servers';
 export { SessionRecordingsIcon } from './SessionRecordings';
+export { SettingsIcon } from './Settings';
+export { SidebarIcon } from './Sidebar';
 export { SupportIcon } from './Support';
+export { TerminalIcon } from './Terminal';
 export { TrustedClustersIcon } from './TrustedClusters';
 export { UpgradeIcon } from './Upgrade';
 export { UserIcon } from './User';
diff --git a/web/packages/design/src/StepSlider/StepSlider.story.tsx b/web/packages/design/src/StepSlider/StepSlider.story.tsx
index 8d2b19673b26a..853c33de97a25 100644
--- a/web/packages/design/src/StepSlider/StepSlider.story.tsx
+++ b/web/packages/design/src/StepSlider/StepSlider.story.tsx
@@ -27,7 +27,7 @@ export default {
 const singleFlow = { default: [Body1, Body2] };
 export const SingleStaticFlow = () => {
   return (
-    <Card bg="levels.surface" my="5" mx="auto" width={464}>
+    <Card my="5" mx="auto" width={464}>
       <Text typography="h3" pt={5} textAlign="center" color="text.main">
         Static Title
       </Text>
@@ -61,7 +61,7 @@ export const MultiCardFlow = () => {
   }
 
   return (
-    <Card as="form" bg="levels.surface" mx="auto" width={464}>
+    <Card as="form" mx="auto" width={464}>
       <StepSlider<typeof multiflows>
         flows={multiflows}
         currFlow={flow}
diff --git a/web/packages/design/src/ThemeProvider/index.tsx b/web/packages/design/src/ThemeProvider/index.tsx
index f5ffd734ab162..8b43c7e0a1022 100644
--- a/web/packages/design/src/ThemeProvider/index.tsx
+++ b/web/packages/design/src/ThemeProvider/index.tsx
@@ -14,28 +14,42 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import React, { useState, useEffect } from 'react';
+import React, { useEffect, useState } from 'react';
 import {
-  ThemeProvider as StyledThemeProvider,
   StyleSheetManager,
+  ThemeProvider as StyledThemeProvider,
 } from 'styled-components';
 
 import storage, { KeysEnum } from 'teleport/services/localStorage';
 
+import { ThemePreference } from 'teleport/services/userPreferences/types';
+
 import { darkTheme, lightTheme } from '../theme';
 
 import { GlobalStyle } from './globals';
 
-import type { ThemeOption } from '../theme';
+function themePreferenceToTheme(themePreference: ThemePreference) {
+  return themePreference === ThemePreference.Light ? lightTheme : darkTheme;
+}
 
 const ThemeProvider = props => {
+  const [themePreference, setThemePreference] = useState<ThemePreference>(
+    storage.getThemePreference()
+  );
+
   useEffect(() => {
     storage.subscribe(receiveMessage);
 
     function receiveMessage(event) {
       const { key, newValue } = event;
-      if (key === KeysEnum.THEME && newValue) {
-        setThemeOption(newValue);
+
+      if (!newValue || key !== KeysEnum.USER_PREFERENCES) {
+        return;
+      }
+
+      const preferences = JSON.parse(newValue);
+      if (preferences.theme !== themePreference) {
+        setThemePreference(preferences.theme);
       }
     }
 
@@ -43,16 +57,12 @@ const ThemeProvider = props => {
     return function unsubscribe() {
       storage.unsubscribe(receiveMessage);
     };
-  }, []);
-
-  const [themeOption, setThemeOption] = useState<ThemeOption>(
-    storage.getThemeOption()
-  );
-
-  const theme = themeOption === 'dark' ? darkTheme : lightTheme;
+  }, [themePreference]);
 
   return (
-    <StyledThemeProvider theme={props.theme || theme}>
+    <StyledThemeProvider
+      theme={props.theme || themePreferenceToTheme(themePreference)}
+    >
       <StyleSheetManager disableVendorPrefixes>
         <React.Fragment>
           <GlobalStyle />
diff --git a/web/packages/design/src/assets/images/icons/okta.svg b/web/packages/design/src/assets/images/icons/okta.svg
new file mode 100644
index 0000000000000..0f59179983432
--- /dev/null
+++ b/web/packages/design/src/assets/images/icons/okta.svg
@@ -0,0 +1,10 @@
+<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_7541_35943)">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M39.6051 0.5L38.1251 18.74C37.4251 18.66 36.7251 18.62 36.0051 18.62C35.1051 18.62 34.2251 18.68 33.3651 18.82L32.5251 9.98C32.5051 9.7 32.7251 9.46 33.0051 9.46H34.5051L33.7851 0.52C33.7651 0.24 33.9851 0 34.2451 0H39.1451C39.4251 0 39.6451 0.24 39.6051 0.52V0.5ZM27.2451 1.4C27.1651 1.14 26.8851 0.98 26.6251 1.08L22.0251 2.76C21.7651 2.86 21.6451 3.16 21.7651 3.4L25.5051 11.56L24.0851 12.08C23.8251 12.18 23.7051 12.48 23.8251 12.72L27.6451 20.74C29.0251 19.98 30.5251 19.4 32.1051 19.04L27.2651 1.4H27.2451ZM15.9651 6.48L26.5451 21.4C25.2051 22.28 23.9851 23.32 22.9451 24.52L16.6051 18.28C16.4051 18.08 16.4251 17.76 16.6251 17.58L17.7851 16.62L11.4851 10.24C11.2851 10.04 11.3051 9.72 11.5251 9.54L15.2651 6.4C15.4851 6.22 15.7851 6.26 15.9451 6.48H15.9651ZM7.08508 15.12C6.86508 14.96 6.54508 15.04 6.40508 15.28L3.96508 19.52C3.82508 19.76 3.92508 20.06 4.16508 20.18L12.2851 24.02L11.5251 25.32C11.3851 25.56 11.4851 25.88 11.7451 25.98L19.8251 29.68C20.4051 28.18 21.1851 26.78 22.1451 25.52L7.08508 15.12ZM1.10508 26.64C1.14508 26.36 1.42508 26.2 1.68508 26.26L19.3851 30.88C18.9251 32.38 18.6651 33.96 18.6251 35.6L9.76508 34.88C9.48508 34.86 9.28508 34.6 9.34508 34.32L9.60508 32.84L0.66508 32C0.38508 31.98 0.205079 31.72 0.245079 31.44L1.08508 26.62L1.10508 26.64ZM0.445079 38.6C0.165079 38.62 -0.0149205 38.88 0.0250795 39.16L0.88508 43.98C0.92508 44.26 1.20508 44.42 1.46508 44.36L10.1451 42.1L10.4051 43.58C10.4451 43.86 10.7251 44.02 10.9851 43.96L19.5451 41.6C19.0451 40.12 18.7251 38.54 18.6451 36.92L0.425079 38.6H0.445079ZM3.28508 51.28C3.14508 51.04 3.24508 50.74 3.48508 50.62L20.0051 42.78C20.6251 44.26 21.4651 45.64 22.4651 46.88L15.2251 52.04C15.0051 52.2 14.6851 52.14 14.5451 51.9L13.7851 50.58L6.40508 55.68C6.18508 55.84 5.86508 55.76 5.72508 55.52L3.26508 51.28H3.28508ZM23.3051 47.84L10.4451 60.86C10.2451 61.06 10.2651 61.38 10.4851 61.56L14.2451 64.7C14.4651 64.88 14.7651 64.84 14.9251 64.62L20.1251 57.3L21.2851 58.28C21.5051 58.46 21.8251 58.42 21.9851 58.18L27.0251 50.86C25.6651 50.02 24.4051 49 23.3251 47.84H23.3051ZM20.7651 68.74C20.5051 68.64 20.3851 68.34 20.5051 68.1L28.1251 51.46C29.5251 52.18 31.0451 52.72 32.6251 53.02L30.3851 61.62C30.3251 61.88 30.0251 62.04 29.7651 61.94L28.3451 61.42L25.9651 70.08C25.8851 70.34 25.6051 70.5 25.3451 70.4L20.7451 68.72L20.7651 68.74ZM33.8851 53.24L32.4051 71.48C32.3851 71.76 32.6051 72 32.8651 72H37.7651C38.0451 72 38.2651 71.76 38.2251 71.48L37.5051 62.54H39.0051C39.2851 62.54 39.5051 62.3 39.4851 62.02L38.6451 53.18C37.7851 53.32 36.9051 53.38 36.0051 53.38C35.2851 53.38 34.5851 53.34 33.8851 53.24ZM51.5251 3.86C51.6451 3.6 51.5251 3.32 51.2651 3.22L46.6651 1.54C46.4051 1.44 46.1251 1.6 46.0451 1.86L43.6651 10.52L42.2451 10C41.9851 9.9 41.7051 10.06 41.6251 10.32L39.3851 18.92C40.9851 19.24 42.4851 19.78 43.8851 20.48L51.5251 3.86ZM61.5651 11.12L48.7051 24.14C47.6251 22.98 46.3851 21.96 45.0051 21.12L50.0451 13.8C50.2051 13.58 50.5251 13.52 50.7451 13.7L51.9051 14.68L57.1051 7.36C57.2651 7.14 57.5851 7.1 57.7851 7.28L61.5451 10.42C61.7651 10.6 61.7651 10.92 61.5851 11.12H61.5651ZM68.5251 21.36C68.7851 21.24 68.8651 20.94 68.7251 20.7L66.2651 16.46C66.1251 16.22 65.8051 16.16 65.5851 16.3L58.2051 21.4L57.4451 20.1C57.3051 19.86 56.9851 19.78 56.7651 19.96L49.5251 25.12C50.5251 26.36 51.3451 27.74 51.9851 29.22L68.5051 21.38L68.5251 21.36ZM71.1251 28L71.9651 32.82C72.0051 33.1 71.8251 33.34 71.5451 33.38L53.3251 35.08C53.2451 33.44 52.9251 31.88 52.4251 30.4L60.9851 28.04C61.2451 27.96 61.5251 28.14 61.5651 28.42L61.8251 29.9L70.5051 27.64C70.7651 27.58 71.0451 27.74 71.0851 28.02L71.1251 28ZM70.3051 45.7C70.5651 45.76 70.8451 45.6 70.8851 45.32L71.7251 40.5C71.7651 40.22 71.5851 39.98 71.3051 39.94L62.3651 39.1L62.6251 37.62C62.6651 37.34 62.4851 37.1 62.2051 37.06L53.3451 36.34C53.3051 37.98 53.0451 39.56 52.5851 41.06L70.2851 45.68L70.3051 45.7ZM65.5851 56.7C65.4451 56.94 65.1251 57 64.9051 56.86L49.8451 46.46C50.8051 45.2 51.5851 43.8 52.1651 42.3L60.2451 46C60.5051 46.12 60.6051 46.42 60.4651 46.66L59.7051 47.96L67.8251 51.8C68.0651 51.92 68.1651 52.22 68.0251 52.46L65.5851 56.7ZM45.4451 50.56L56.0251 65.48C56.1851 65.7 56.5051 65.74 56.7051 65.56L60.4451 62.42C60.6651 62.24 60.6651 61.92 60.4851 61.72L54.1851 55.34L55.3451 54.38C55.5651 54.2 55.5651 53.88 55.3651 53.68L49.0251 47.44C47.9651 48.64 46.7651 49.7 45.4251 50.56H45.4451ZM45.3451 70.88C45.0851 70.98 44.8051 70.82 44.7251 70.56L39.8851 52.92C41.4651 52.56 42.9651 51.98 44.3451 51.22L48.1651 59.24C48.2851 59.5 48.1651 59.8 47.9051 59.88L46.4851 60.4L50.2251 68.56C50.3451 68.82 50.2251 69.1 49.9651 69.2L45.3651 70.88H45.3451Z" fill="black"/>
+</g>
+<defs>
+<clipPath id="clip0_7541_35943">
+<rect width="72" height="72" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/web/packages/design/src/assets/images/icons/opsgenie.svg b/web/packages/design/src/assets/images/icons/opsgenie.svg
new file mode 100644
index 0000000000000..912e42191c799
--- /dev/null
+++ b/web/packages/design/src/assets/images/icons/opsgenie.svg
@@ -0,0 +1,15 @@
+<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M35.9508 35.8541C45.9212 35.8541 54.0043 27.8279 54.0043 17.9271C54.0043 8.02626 45.9212 0 35.9508 0C25.9802 0 17.8975 8.02626 17.8975 17.9271C17.8975 27.8279 25.9802 35.8541 35.9508 35.8541Z" fill="url(#paint0_linear_6733_29871)"/>
+<path d="M34.4321 71.6076C22.667 64.0541 12.8289 53.8819 5.83074 41.7962C5.32363 40.7889 5.6279 39.5804 6.64213 39.0768H6.74355L20.4357 32.4298C21.3485 31.9262 22.5656 32.3292 23.0727 33.2354C29.9694 44.7168 40.2132 53.9825 52.4852 59.6226C47.9215 64.1548 42.9516 68.1833 37.5762 71.6076C36.5619 72.1112 35.3449 72.1112 34.4321 71.6076Z" fill="url(#paint1_linear_6733_29871)"/>
+<path d="M37.4714 71.6085C49.338 64.1557 59.0747 53.8828 66.174 41.8981C66.6811 40.8908 66.3771 39.6823 65.3628 39.1787H65.2615L51.5692 32.5314C50.6563 32.0278 49.4393 32.4307 48.9322 33.3373C42.0355 44.8188 31.7917 54.0844 19.5195 59.7245C23.9821 64.2563 29.0533 68.2853 34.4287 71.7092C35.3416 72.1121 36.5586 72.1121 37.4714 71.6085Z" fill="#2684FF"/>
+<defs>
+<linearGradient id="paint0_linear_6733_29871" x1="35.974" y1="5.97255" x2="35.974" y2="42.8641" gradientUnits="userSpaceOnUse">
+<stop stop-color="#2684FF"/>
+<stop offset="0.82" stop-color="#0052CC"/>
+</linearGradient>
+<linearGradient id="paint1_linear_6733_29871" x1="24.8289" y1="41.8316" x2="37.1321" y2="67.7622" gradientUnits="userSpaceOnUse">
+<stop stop-color="#2684FF"/>
+<stop offset="0.62" stop-color="#0052CC"/>
+</linearGradient>
+</defs>
+</svg>
diff --git a/web/packages/teleport/src/components/Empty/assets/appplication.png b/web/packages/design/src/assets/resources/appplication.png
similarity index 100%
rename from web/packages/teleport/src/components/Empty/assets/appplication.png
rename to web/packages/design/src/assets/resources/appplication.png
diff --git a/web/packages/teleport/src/components/Empty/assets/database.png b/web/packages/design/src/assets/resources/database.png
similarity index 100%
rename from web/packages/teleport/src/components/Empty/assets/database.png
rename to web/packages/design/src/assets/resources/database.png
diff --git a/web/packages/teleport/src/components/Empty/assets/desktop.png b/web/packages/design/src/assets/resources/desktop.png
similarity index 100%
rename from web/packages/teleport/src/components/Empty/assets/desktop.png
rename to web/packages/design/src/assets/resources/desktop.png
diff --git a/web/packages/teleport/src/components/Empty/assets/stack.png b/web/packages/design/src/assets/resources/stack.png
similarity index 100%
rename from web/packages/teleport/src/components/Empty/assets/stack.png
rename to web/packages/design/src/assets/resources/stack.png
diff --git a/web/packages/design/src/theme/darkTheme.ts b/web/packages/design/src/theme/darkTheme.ts
index 67fc950a9f48d..476e2cd130961 100644
--- a/web/packages/design/src/theme/darkTheme.ts
+++ b/web/packages/design/src/theme/darkTheme.ts
@@ -16,24 +16,54 @@ limitations under the License.
 
 import { fonts } from './fonts';
 import { getContrastRatio, lighten } from './utils/colorManipulator';
-import { lightBlue, blueGrey, yellow } from './palette';
+import { blueGrey, lightBlue, yellow } from './palette';
 import typography, { fontSizes, fontWeights } from './typography';
 import { sharedStyles } from './sharedStyles';
 
 const space = [0, 4, 8, 16, 24, 32, 40, 48, 56, 64, 72, 80];
 const contrastThreshold = 3;
 
+const dataVisualisationColors = {
+  primary: {
+    purple: '#9F85FF',
+    wednesdays: '#F74DFF',
+    picton: '#009EFF',
+    sunflower: '#FFAB00',
+    caribbean: '#00BFA6',
+    abbey: '#FF6257',
+    cyan: '#00D3F0',
+  },
+  secondary: {
+    purple: '#7D59FF',
+    wednesdays: '#D50DE0',
+    picton: '#007CC9',
+    sunflower: '#AC7400',
+    caribbean: '#008775',
+    abbey: '#DB3F34',
+    cyan: '#009CB1',
+  },
+  tertiary: {
+    purple: '#B9A6FF',
+    wednesdays: '#FA96FF',
+    picton: '#7BCDFF',
+    sunflower: '#FFD98C',
+    caribbean: '#2EFFD5',
+    abbey: '#FF948D',
+    cyan: '#74EEFF',
+  },
+};
+
 const colors = {
   /*
-  Colors in `levels` are used to reflect the perceived depth of elements in the UI.
-  The further back an element is, the more "sunken" it is, and the more forwards it is, the more "elevated" it is (think CSS z-index).
+    Colors in `levels` are used to reflect the perceived depth of elements in the UI.
+    The further back an element is, the more "sunken" it is, and the more forwards it is, the more "elevated" it is (think CSS z-index).
 
-  A `sunken` color would be used to represent something like the background of the app.
-  While `surface` would be the color of the primary surface where most content is located (such as tables).
-  Any colors more "elevated" than that would be used for things such as popovers, menus, and dialogs.
+    A `sunken` color would be used to represent something like the background of the app.
+    While `surface` would be the color of the primary surface where most content is located (such as tables).
+    Any colors more "elevated" than that would be used for things such as popovers, menus, and dialogs.
 
-  For more information on this concept: https://m3.material.io/styles/elevation/applying-elevation
- */
+    For more information on this concept: https://m3.material.io/styles/elevation/applying-elevation
+   */
   levels: {
     deep: '#000000',
 
@@ -114,6 +144,10 @@ const colors = {
     },
   },
 
+  tooltip: {
+    background: '#212B2F',
+  },
+
   progressBarColor: '#00BFA5',
 
   dark: '#000000',
@@ -146,26 +180,35 @@ const colors = {
 
   terminal: {
     foreground: '#F1F2F4',
-    background: '#010B1C', // bgTerminal
+    background: '#0C143D', // sunken
     selectionBackground: 'rgba(255, 255, 255, 0.18)',
     cursor: '#FFF',
-    cursorAccent: '#010B1C',
-    red: '#FF6257',
-    green: '#00BFA6',
-    yellow: '#FFAB00',
-    blue: '#009EFF',
-    magenta: '#9F85FF',
-    cyan: '#00D3F0',
-    brightWhite: lighten('#010B1C', 0.89),
-    white: lighten('#010B1C', 0.78),
-    brightBlack: lighten('#010B1C', 0.61),
+    cursorAccent: '#0C143D',
+    red: dataVisualisationColors.primary.abbey,
+    green: dataVisualisationColors.primary.caribbean,
+    yellow: dataVisualisationColors.primary.sunflower,
+    blue: dataVisualisationColors.primary.picton,
+    magenta: dataVisualisationColors.primary.purple,
+    cyan: dataVisualisationColors.primary.cyan,
+    brightWhite: lighten('#0C143D', 0.89),
+    white: lighten('#0C143D', 0.78),
+    brightBlack: lighten('#0C143D', 0.61),
     black: '#000',
-    brightRed: '#FF948D',
-    brightGreen: '#2EFFD5',
-    brightYellow: '#FFD98C',
-    brightBlue: '#7BCDFF',
-    brightMagenta: '#B9A6FF',
-    brightCyan: '#74EEFF',
+    brightRed: dataVisualisationColors.tertiary.abbey,
+    brightGreen: dataVisualisationColors.tertiary.caribbean,
+    brightYellow: dataVisualisationColors.tertiary.sunflower,
+    brightBlue: dataVisualisationColors.tertiary.picton,
+    brightMagenta: dataVisualisationColors.tertiary.purple,
+    brightCyan: dataVisualisationColors.tertiary.cyan,
+  },
+
+  editor: {
+    abbey: dataVisualisationColors.tertiary.abbey,
+    purple: dataVisualisationColors.tertiary.purple,
+    cyan: dataVisualisationColors.tertiary.cyan,
+    picton: dataVisualisationColors.tertiary.picton,
+    sunflower: dataVisualisationColors.tertiary.sunflower,
+    caribbean: dataVisualisationColors.tertiary.caribbean,
   },
 
   subtle: blueGrey[50],
@@ -175,6 +218,8 @@ const colors = {
   disabled: blueGrey[500],
   info: lightBlue[600],
   success: '#00BFA5',
+
+  dataVisualisation: dataVisualisationColors,
 };
 
 const borders = [
diff --git a/web/packages/design/src/theme/index.ts b/web/packages/design/src/theme/index.ts
index f812bf4f3c40a..5706244a7b4f2 100644
--- a/web/packages/design/src/theme/index.ts
+++ b/web/packages/design/src/theme/index.ts
@@ -18,4 +18,4 @@ import darkTheme from './darkTheme';
 import lightTheme from './lightTheme';
 
 export { darkTheme, lightTheme };
-export type { ThemeOption } from './types';
+export type { DeprecatedThemeOption } from './types';
diff --git a/web/packages/design/src/theme/lightTheme.ts b/web/packages/design/src/theme/lightTheme.ts
index 13fa6e453da72..669746defc895 100644
--- a/web/packages/design/src/theme/lightTheme.ts
+++ b/web/packages/design/src/theme/lightTheme.ts
@@ -23,6 +23,36 @@ import { sharedStyles } from './sharedStyles';
 const space = [0, 4, 8, 16, 24, 32, 40, 48, 56, 64, 72, 80];
 const contrastThreshold = 3;
 
+const dataVisualisationColors = {
+  primary: {
+    purple: '#5531D4',
+    wednesdays: '#A70DAF',
+    picton: '#006BB8',
+    sunflower: '#8F5F00',
+    caribbean: '#007562',
+    abbey: '#BF372E',
+    cyan: '#007282',
+  },
+  secondary: {
+    purple: '#6F4CED',
+    wednesdays: '#DC37E5',
+    picton: '#0089DE',
+    sunflower: '#B27800',
+    caribbean: '#009681',
+    abbey: '#D4635B',
+    cyan: '#1792A3',
+  },
+  tertiary: {
+    purple: '#3D1BB2',
+    wednesdays: '#690274',
+    picton: '#004B89',
+    sunflower: '#704B00',
+    caribbean: '#005742',
+    abbey: '#9D0A00',
+    cyan: '#015C6E',
+  },
+};
+
 const colors = {
   /*
   Colors in `levels` are used to reflect the perceived depth of elements in the UI.
@@ -110,6 +140,10 @@ const colors = {
     },
   },
 
+  tooltip: {
+    background: '#F0F2F4',
+  },
+
   progressBarColor: '#007D6B',
 
   dark: '#000000',
@@ -146,22 +180,31 @@ const colors = {
     selectionBackground: 'rgba(0, 0, 0, 0.18)',
     cursor: '#000',
     cursorAccent: '#F1F2F4',
-    red: '#9D0A00',
-    green: '#005742',
-    yellow: '#704B00',
-    blue: '#004B89',
-    magenta: '#3D1BB2',
-    cyan: '#015C6E',
+    red: dataVisualisationColors.tertiary.abbey,
+    green: dataVisualisationColors.tertiary.caribbean,
+    yellow: dataVisualisationColors.tertiary.sunflower,
+    blue: dataVisualisationColors.tertiary.picton,
+    magenta: dataVisualisationColors.tertiary.purple,
+    cyan: dataVisualisationColors.tertiary.cyan,
     brightWhite: darken('#F1F2F4', 0.55),
     white: darken('#F1F2F4', 0.68),
     brightBlack: darken('#F1F2F4', 0.8),
     black: '#000',
-    brightRed: '#BF372E',
-    brightGreen: '#007562',
-    brightYellow: '#8F5F00',
-    brightBlue: '#006BB8',
-    brightMagenta: '#5531D4',
-    brightCyan: '#007282',
+    brightRed: dataVisualisationColors.primary.abbey,
+    brightGreen: dataVisualisationColors.primary.caribbean,
+    brightYellow: dataVisualisationColors.primary.sunflower,
+    brightBlue: dataVisualisationColors.primary.picton,
+    brightMagenta: dataVisualisationColors.primary.purple,
+    brightCyan: dataVisualisationColors.primary.cyan,
+  },
+
+  editor: {
+    abbey: dataVisualisationColors.primary.abbey,
+    purple: dataVisualisationColors.primary.purple,
+    cyan: dataVisualisationColors.primary.cyan,
+    picton: dataVisualisationColors.primary.picton,
+    sunflower: dataVisualisationColors.primary.sunflower,
+    caribbean: dataVisualisationColors.primary.caribbean,
   },
 
   subtle: blueGrey[50],
@@ -171,6 +214,8 @@ const colors = {
   disabled: blueGrey[500],
   info: lightBlue[600],
   success: '#007D6B',
+
+  dataVisualisation: dataVisualisationColors,
 };
 
 const borders = [
diff --git a/web/packages/design/src/theme/types.ts b/web/packages/design/src/theme/types.ts
index b6fc90ea84c17..a75e463113112 100644
--- a/web/packages/design/src/theme/types.ts
+++ b/web/packages/design/src/theme/types.ts
@@ -14,4 +14,4 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-export type ThemeOption = 'dark' | 'light';
+export type DeprecatedThemeOption = 'dark' | 'light';
diff --git a/web/packages/shared/components/FieldInput/__snapshots__/FieldInput.test.tsx.snap b/web/packages/shared/components/FieldInput/__snapshots__/FieldInput.test.tsx.snap
index 5d85572df9408..216e65c499225 100644
--- a/web/packages/shared/components/FieldInput/__snapshots__/FieldInput.test.tsx.snap
+++ b/web/packages/shared/components/FieldInput/__snapshots__/FieldInput.test.tsx.snap
@@ -10,7 +10,6 @@ exports[`snapshot tests 1`] = `
   display: inline-block;
   transition: color 0.3s;
   color: #FFFFFF;
-  font-size: 18px;
 }
 
 .c2 {
@@ -76,6 +75,11 @@ exports[`snapshot tests 1`] = `
   margin-bottom: 0px;
 }
 
+.c7 {
+  font-size: 18px;
+  color: inherit;
+}
+
 .c5 {
   vertical-align: middle;
   display: inline-block;
@@ -149,10 +153,10 @@ exports[`snapshot tests 1`] = `
       </span>
       <span
         class="c5"
+        role="icon"
       >
         <span
-          class="c6 icon icon-info_outline "
-          font-size="4"
+          class="c6 icon icon-info_outline c7"
         />
       </span>
       <input
@@ -186,10 +190,10 @@ exports[`snapshot tests 1`] = `
       </span>
       <span
         class="c5"
+        role="icon"
       >
         <span
-          class="c6 icon icon-info_outline "
-          font-size="4"
+          class="c6 icon icon-info_outline c7"
         />
       </span>
       <input
diff --git a/web/packages/shared/components/FieldSelect/FieldSelect.tsx b/web/packages/shared/components/FieldSelect/FieldSelect.tsx
index bdab9a908d649..373c3222efb88 100644
--- a/web/packages/shared/components/FieldSelect/FieldSelect.tsx
+++ b/web/packages/shared/components/FieldSelect/FieldSelect.tsx
@@ -27,6 +27,7 @@ export default function FieldSelect({
   labelTip,
   value,
   options,
+  name,
   onChange,
   placeholder,
   maxMenuHeight,
@@ -54,6 +55,7 @@ export default function FieldSelect({
       )}
       <Select
         inputId="select"
+        name={name}
         menuPosition={menuPosition}
         hasError={hasError}
         isSimpleValue={isSimpleValue}
diff --git a/web/packages/shared/components/FieldTextArea/FieldTextArea.tsx b/web/packages/shared/components/FieldTextArea/FieldTextArea.tsx
index 9d76fd025890c..56c76ab8b6ea3 100644
--- a/web/packages/shared/components/FieldTextArea/FieldTextArea.tsx
+++ b/web/packages/shared/components/FieldTextArea/FieldTextArea.tsx
@@ -16,7 +16,6 @@
 
 import React from 'react';
 import { Box, LabelInput, Text, TextArea } from 'design';
-
 import { TextAreaProps } from 'design/TextArea';
 
 import { useRule } from 'shared/components/Validation';
diff --git a/web/packages/shared/components/FileTransfer/FileTransfer.tsx b/web/packages/shared/components/FileTransfer/FileTransfer.tsx
index 510e31d65e92d..28cf69efc598c 100644
--- a/web/packages/shared/components/FileTransfer/FileTransfer.tsx
+++ b/web/packages/shared/components/FileTransfer/FileTransfer.tsx
@@ -25,7 +25,6 @@ import {
 import { FileTransferContainer } from './FileTransferContainer';
 
 interface FileTransferProps {
-  backgroundColor?: string;
   transferHandlers: TransferHandlers;
   // errorText is any general error that isn't related to a specific transfer
   errorText?: string;
@@ -85,7 +84,6 @@ export function FileTransfer(props: FileTransferProps) {
         <FileTransferDialog
           errorText={props.errorText}
           openedDialog={openedDialog}
-          backgroundColor={props.backgroundColor}
           transferHandlers={props.transferHandlers}
           onCloseDialog={handleCloseDialog}
         />
@@ -95,10 +93,7 @@ export function FileTransfer(props: FileTransferProps) {
 }
 
 export function FileTransferDialog(
-  props: Pick<
-    FileTransferProps,
-    'transferHandlers' | 'backgroundColor' | 'errorText'
-  > & {
+  props: Pick<FileTransferProps, 'transferHandlers' | 'errorText'> & {
     openedDialog: FileTransferDialogDirection;
     onCloseDialog(isAnyTransferInProgress: boolean): void;
   }
@@ -135,7 +130,6 @@ export function FileTransferDialog(
       openedDialog={props.openedDialog}
       files={filesStore.files}
       onCancel={filesStore.cancel}
-      backgroundColor={props.backgroundColor}
       onClose={handleClose}
       onAddUpload={handleAddUpload}
       onAddDownload={handleAddDownload}
diff --git a/web/packages/shared/components/FileTransfer/FileTransferStateless/FileTransferStateless.tsx b/web/packages/shared/components/FileTransfer/FileTransferStateless/FileTransferStateless.tsx
index e9ed155f2d128..d8cb7d004b58d 100644
--- a/web/packages/shared/components/FileTransfer/FileTransferStateless/FileTransferStateless.tsx
+++ b/web/packages/shared/components/FileTransfer/FileTransferStateless/FileTransferStateless.tsx
@@ -90,8 +90,7 @@ function ButtonClose(props: { onClick(): void }) {
 }
 
 const Container = styled.div`
-  background: ${props =>
-    props.backgroundColor || props.theme.colors.levels.surface};
+  background: ${props => props.theme.colors.levels.surface};
   box-shadow: 0 8px 32px rgba(0, 0, 0, 0.1);
   box-sizing: border-box;
   border-radius: ${props => props.theme.radii[2]}px;
diff --git a/web/packages/shared/components/FormPassword/FormPassword.tsx b/web/packages/shared/components/FormPassword/FormPassword.tsx
index ff1bd09eb3807..090469036bbe6 100644
--- a/web/packages/shared/components/FormPassword/FormPassword.tsx
+++ b/web/packages/shared/components/FormPassword/FormPassword.tsx
@@ -107,7 +107,7 @@ function FormPassword(props: Props) {
   return (
     <Validation>
       {({ validator }) => (
-        <Card as="form" bg="levels.surface" width="456px" p="6">
+        <Card as="form" width="456px" p="6">
           <Status attempt={attempt} />
           <FieldInput
             rule={requiredField('Current Password is required')}
diff --git a/web/packages/shared/components/FormPassword/__snapshots__/FormPassword.test.tsx.snap b/web/packages/shared/components/FormPassword/__snapshots__/FormPassword.test.tsx.snap
index f0e887fb5f85e..ae4759cb820a9 100644
--- a/web/packages/shared/components/FormPassword/__snapshots__/FormPassword.test.tsx.snap
+++ b/web/packages/shared/components/FormPassword/__snapshots__/FormPassword.test.tsx.snap
@@ -64,9 +64,9 @@ exports[`auth2faType "on" should render form with hardware key as first option i
   box-sizing: border-box;
   padding: 40px;
   width: 456px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c3 {
@@ -507,9 +507,9 @@ exports[`auth2faType "optional" should render form with hardware key as first op
   box-sizing: border-box;
   padding: 40px;
   width: 456px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c3 {
diff --git a/web/packages/shared/components/Select/types.ts b/web/packages/shared/components/Select/types.ts
index 0ab7b97633e7f..5ffb338139e95 100644
--- a/web/packages/shared/components/Select/types.ts
+++ b/web/packages/shared/components/Select/types.ts
@@ -35,6 +35,7 @@ export type Props = {
   options: Option<any, any>[];
   width?: string | number;
   menuPlacement?: string;
+  name?: string;
   minMenuHeight?: number;
   components?: any;
   customProps?: Record<string, any>;
@@ -65,3 +66,24 @@ export type Option<T = string, S = string> = {
 export type ActionMeta = {
   action: 'set-value' | 'input-change' | 'input-blur' | 'menu-close';
 };
+
+/**
+ * CustomSelectComponentProps defines a prop type for the custom
+ * components you define for react-select's `components` prop.
+ *
+ * @template CustomProps - type defining all the custom props being passed
+ * down to custom component.
+ *
+ * @template CustomOption - the data type used for react-select `options`
+ */
+export type CustomSelectComponentProps<CustomProps, CustomOption = Option> =
+  CustomOption & {
+    /**
+     * selectProps is the field to use to access the props that were
+     * passed down to react-select's component.
+     *
+     * Use `customProps` field to easily identify non react-select props
+     * that are intended to be used in custom components.
+     */
+    selectProps: { customProps: CustomProps };
+  };
diff --git a/web/packages/shared/components/TextEditor/StyledTextEditor.jsx b/web/packages/shared/components/TextEditor/StyledTextEditor.jsx
index 2bd47c16b4f65..eadefca8995a3 100644
--- a/web/packages/shared/components/TextEditor/StyledTextEditor.jsx
+++ b/web/packages/shared/components/TextEditor/StyledTextEditor.jsx
@@ -15,6 +15,7 @@ limitations under the License.
 */
 
 import styled from 'styled-components';
+import { color } from 'design/system';
 
 const StyledTextEditor = styled.div`
   overflow: hidden;
@@ -23,24 +24,161 @@ const StyledTextEditor = styled.div`
   display: flex;
   position: relative;
   border: none;
-  background: ${props => props.theme.colors.bgTerminal};
 
-  .ace-monokai {
-    background: ${props => props.theme.colors.bgTerminal};
-  }
-
-  .ace-monokai .ace_gutter,
-  .ace-monokai .ace_gutter-cell {
-    color: rgba(255, 255, 255, 0.56);
-    background: ${props => props.theme.colors.bgTerminal};
-  }
+  ${color};
 
   > .ace_editor {
     position: absolute;
     top: 8px;
-    right: 0px;
-    bottom: 0px;
-    left: 0px;
+    right: 0;
+    bottom: 0;
+    left: 0;
+  }
+
+  // Theme based on Tomorrow Night Blue theme
+  .ace-teleport {
+    color: ${props => props.theme.colors.text.main};
+  }
+
+  /* Editor gutter contains of line numbers and annotation marks. */
+
+  .ace-teleport .ace_gutter {
+    color: ${props => props.theme.colors.text.muted};
+  }
+
+  .ace-teleport .ace_constant.ace_other,
+  .ace-teleport .ace_cursor {
+    color: ${props => props.theme.colors.text.main};
+  }
+
+  .ace-teleport .ace_marker-layer .ace_selection {
+    background-color: ${props => props.theme.colors.spotBackground[2]};
+  }
+
+  .ace-teleport.ace_multiselect .ace_selection.ace_start {
+    box-shadow: 0 0 3px 0 ${props => props.theme.colors.levels.sunken};
+  }
+
+  /* Debugger line,  NOT RELEVANT FOR YAML  */
+
+  .ace-teleport .ace_marker-layer .ace_step {
+    background-color: ${props => props.theme.colors.terminal.brightYellow};
+  }
+
+  .ace-teleport .ace_marker-layer .ace_bracket {
+    margin: -1px 0 0 -1px;
+    border: 1px solid ${props => props.theme.colors.levels.popout};
+  }
+
+  /* Background color of active editor's line */
+
+  .ace-teleport .ace_marker-layer .ace_active-line {
+    background-color: ${props => props.theme.colors.spotBackground[1]};
+  }
+
+  /* Background color of gutter active line */
+
+  .ace-teleport .ace_gutter-active-line {
+    background-color: inherit;
+  }
+
+  /* Style of selected words. Try it by double clicking on any word in Result tab*/
+
+  .ace-teleport .ace_marker-layer .ace_selected-word {
+    box-shadow: 0 0 0 1px ${props => props.theme.colors.text.main};
+    border-radius: 2px;
+  }
+
+  /* We just want to make it a hair wider without breaking the layout */
+
+  .ace-teleport .ace_fold_widget {
+    width: 13px;
+    margin-right: -14px;
+    background-color: ${props => props.theme.colors.spotBackground[1]};
+  }
+
+  .ace-teleport .ace_invisible {
+    color: ${props => props.theme.colors.levels.popout};
+  }
+
+  .ace-teleport .ace_keyword,
+  .ace-teleport .ace_meta,
+  .ace-teleport .ace_storage,
+  .ace-teleport .ace_storage.ace_type,
+  .ace-teleport .ace_support.ace_type {
+    color: ${props => props.theme.colors.editor.purple};
+  }
+
+  .ace-teleport .ace_keyword.ace_operator {
+    color: ${props => props.theme.colors.editor.cyan};
+  }
+
+  .ace-teleport .ace_constant.ace_character,
+  .ace-teleport .ace_constant.ace_language,
+  .ace-teleport .ace_constant.ace_numeric,
+  .ace-teleport .ace_keyword.ace_other.ace_unit,
+  .ace-teleport .ace_support.ace_constant,
+  .ace-teleport .ace_variable.ace_parameter {
+    color: ${props => props.theme.colors.editor.abbey};
+  }
+
+  .ace-teleport .ace_invalid {
+    color: ${props => props.theme.colors.text.main};
+    background-color: ${props =>
+      props.theme.colors.dataVisualisation.secondary.abbey};
+  }
+
+  .ace-teleport .ace_invalid.ace_deprecated {
+    color: ${props => props.theme.colors.text.main};
+    background-color: ${props => props.theme.colors.editor.purple};
+  }
+
+  .ace-teleport .ace_fold {
+    border-color: ${props => props.theme.colors.text.main};
+    background-color: ${props => props.theme.colors.editor.purple};
+  }
+
+  .ace-teleport .ace_entity.ace_name.ace_function,
+  .ace-teleport .ace_support.ace_function,
+  .ace-teleport .ace_variable {
+    color: ${props => props.theme.colors.editor.picton};
+  }
+
+  .ace-teleport .ace_support.ace_class,
+  .ace-teleport .ace_support.ace_type {
+    color: ${props => props.theme.colors.editor.sunflower};
+  }
+
+  .ace-teleport .ace_heading,
+  .ace-teleport .ace_markup.ace_heading,
+  .ace-teleport .ace_string {
+    color: ${props => props.theme.colors.editor.caribbean};
+  }
+
+  .ace-teleport .ace_entity.ace_name.ace_tag,
+  .ace-teleport .ace_entity.ace_other.ace_attribute-name,
+  .ace-teleport .ace_meta.ace_tag,
+  .ace-teleport .ace_string.ace_regexp,
+  .ace-teleport .ace_variable {
+    color: ${props => props.theme.colors.editor.purple};
+  }
+
+  .ace-teleport .ace_comment {
+    color: ${props => props.theme.colors.text.muted};
+  }
+
+  /* End: different token styles */
+
+  .ace-teleport .ace_indent-guide {
+    /* Indent guide style */
+    background: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAACCAYAAACZgbYnAAAAEklEQVQImWNgYGBgYHB3d/8PAAOIAdULw8qMAAAAAElFTkSuQmCC)
+      right repeat-y;
+  }
+
+  .ace-teleport .ace_indent-guide-active {
+    /* Active indent guide style */
+    background: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAACAQMAAACjTyRkAAAABlBMVEUAAADCwsK76u2xAAAAAXRSTlMAQObYZgAAAAxJREFUCNdjYGBoAAAAhACBGFbxzQAAAABJRU5ErkJggg==')
+      right repeat-y;
   }
 `;
 
diff --git a/web/packages/shared/components/TextEditor/TextEditor.jsx b/web/packages/shared/components/TextEditor/TextEditor.jsx
index 0adb6463fd28d..a119768d7a852 100644
--- a/web/packages/shared/components/TextEditor/TextEditor.jsx
+++ b/web/packages/shared/components/TextEditor/TextEditor.jsx
@@ -19,7 +19,6 @@ import ace from 'ace-builds/src-min-noconflict/ace';
 
 import 'ace-builds/src-noconflict/mode-json';
 import 'ace-builds/src-noconflict/mode-yaml';
-import 'ace-builds/src-noconflict/theme-monokai';
 import 'ace-builds/src-noconflict/ext-searchbox';
 import StyledTextEditor from './StyledTextEditor';
 
@@ -79,7 +78,7 @@ class TextEditor extends React.Component {
   }
 
   componentDidMount() {
-    const { data, readOnly, theme = 'ace/theme/monokai' } = this.props;
+    const { data, readOnly } = this.props;
     this.editor = ace.edit(this.ace_viewer);
     this.editor.setFadeFoldWidgets(true);
     this.editor.setWrapBehavioursEnabled(true);
@@ -90,7 +89,7 @@ class TextEditor extends React.Component {
     this.editor.renderer.setShowGutter(true);
     this.editor.on('input', this.onChange);
     this.editor.setReadOnly(readOnly);
-    this.editor.setTheme(theme);
+    this.editor.setTheme({ cssClass: 'ace-teleport' });
     this.initSessions(data);
     this.editor.focus();
   }
@@ -102,8 +101,9 @@ class TextEditor extends React.Component {
   }
 
   render() {
+    const { bg = 'levels.sunken' } = this.props;
     return (
-      <StyledTextEditor>
+      <StyledTextEditor bg={bg}>
         <div ref={e => (this.ace_viewer = e)} />
       </StyledTextEditor>
     );
diff --git a/web/packages/shared/components/ToolTip/ToolTip.story.tsx b/web/packages/shared/components/ToolTip/ToolTip.story.tsx
index b4dcf9f87f6f8..19fb2e05f8d1f 100644
--- a/web/packages/shared/components/ToolTip/ToolTip.story.tsx
+++ b/web/packages/shared/components/ToolTip/ToolTip.story.tsx
@@ -50,3 +50,12 @@ export const LongContent = () => (
     </ToolTipInfo>
   </Flex>
 );
+
+export const WithMutedIconColor = () => (
+  <>
+    <span css={{ marginRight: '4px', verticalAlign: 'middle' }}>
+      Hover the icon
+    </span>
+    <ToolTipInfo muteIconColor>"some popover content"</ToolTipInfo>
+  </>
+);
diff --git a/web/packages/shared/components/ToolTip/ToolTip.tsx b/web/packages/shared/components/ToolTip/ToolTip.tsx
index 4d9f1e4ac8f01..cad7531159354 100644
--- a/web/packages/shared/components/ToolTip/ToolTip.tsx
+++ b/web/packages/shared/components/ToolTip/ToolTip.tsx
@@ -17,10 +17,13 @@
 import React, { useState } from 'react';
 import styled from 'styled-components';
 
-import { Text, Popover } from 'design';
+import { Popover, Text } from 'design';
 import * as Icons from 'design/Icon';
 
-export const ToolTipInfo: React.FC = ({ children }) => {
+export const ToolTipInfo: React.FC<{ muteIconColor?: boolean }> = ({
+  children,
+  muteIconColor,
+}) => {
   const [anchorEl, setAnchorEl] = useState();
   const open = Boolean(anchorEl);
 
@@ -35,6 +38,7 @@ export const ToolTipInfo: React.FC = ({ children }) => {
   return (
     <>
       <span
+        role="icon"
         aria-owns={open ? 'mouse-over-popover' : undefined}
         onMouseEnter={handlePopoverOpen}
         onMouseLeave={handlePopoverClose}
@@ -47,7 +51,7 @@ export const ToolTipInfo: React.FC = ({ children }) => {
           height: 18px;
         `}
       >
-        <Icons.Info fontSize={4} />
+        <InfoIcon $muteIconColor={muteIconColor} />
       </span>
       <Popover
         modalCss={modalCss}
@@ -76,7 +80,12 @@ const modalCss = () => `
 `;
 
 const StyledOnHover = styled(Text)`
-  background-color: white;
-  color: black;
+  color: ${props => props.theme.colors.text.main};
+  background-color: ${props => props.theme.colors.tooltip.background};
   max-width: 350px;
 `;
+
+const InfoIcon = styled(Icons.Info)`
+  font-size: 18px;
+  color: ${p => (p.$muteIconColor ? p.theme.colors.text.disabled : 'inherit')};
+`;
diff --git a/web/packages/shared/package.json b/web/packages/shared/package.json
index 090fa04ef29eb..b454c20a89cd9 100644
--- a/web/packages/shared/package.json
+++ b/web/packages/shared/package.json
@@ -10,6 +10,8 @@
     "directory": "packages/shared"
   },
   "dependencies": {
+    "@react-spring/web": "^9.7.2",
+    "@use-gesture/react": "^10.2.27",
     "ace-builds": "1.4.6",
     "create-react-class": "^15.6.3",
     "cross-env": "5.0.5",
@@ -21,9 +23,11 @@
     "react": "^16.8.4",
     "react-day-picker": "7.3.2",
     "react-dom": "^16.8.4",
+    "react-markdown": "^8.0.7",
     "react-router": "5.1.1",
     "react-router-dom": "5.1.1",
     "react-select": "^3.0.8",
+    "remark-gfm": "^3.0.1",
     "tslib": "^2.4.0",
     "whatwg-fetch": "^3.0.0",
     "@gravitational/design": "1.0.0"
diff --git a/web/packages/shared/typings.d.ts b/web/packages/shared/typings.d.ts
index 229be3b84d9bc..06a01b89e64be 100644
--- a/web/packages/shared/typings.d.ts
+++ b/web/packages/shared/typings.d.ts
@@ -20,3 +20,8 @@ declare module '*.jpg';
 declare module '*.gif';
 declare module '*.ico';
 declare module '*.yaml?raw';
+
+// Subset is like Partial<T> but it works on nested objects.
+type Subset<K> = {
+  [attr in keyof K]?: K[attr] extends object ? Subset<K[attr]> : K[attr];
+};
diff --git a/web/packages/teleport/src/AppLauncher/AppLauncher.test.tsx b/web/packages/teleport/src/AppLauncher/AppLauncher.test.tsx
index 00acadeccdffe..aebe69577cd77 100644
--- a/web/packages/teleport/src/AppLauncher/AppLauncher.test.tsx
+++ b/web/packages/teleport/src/AppLauncher/AppLauncher.test.tsx
@@ -15,40 +15,125 @@
  */
 
 import React from 'react';
-import { render } from 'design/utils/testing';
-
+import { render, waitFor } from 'design/utils/testing';
 import { createMemoryHistory } from 'history';
 import { Router } from 'react-router';
 
 import { Route } from 'teleport/components/Router';
-
+import api from 'teleport/services/api';
 import cfg from 'teleport/config';
-
 import service from 'teleport/services/apps';
 
 import { AppLauncher } from './AppLauncher';
 
-test('arn is url decoded', () => {
-  jest.spyOn(service, 'createAppSession');
+const testCases: { name: string; query: string; expectedPath: string }[] = [
+  {
+    name: 'no path or query',
+    query: '?path=',
+    expectedPath: '',
+  },
+  {
+    name: 'root path',
+    query: '?path=%2F',
+    expectedPath: '/',
+  },
+  {
+    name: 'with multi path',
+    query: '?path=%2Ffoo%2Fbar',
+    expectedPath: '/foo/bar',
+  },
+  {
+    name: 'with only query',
+    query: '?path=&query=foo%3Dbar',
+    expectedPath: '?foo=bar',
+  },
+  {
+    name: 'with query with same keys used to store the original path and query',
+    query: '?path=foo&query=foo%3Dbar%26query%3Dtest1%26path%3Dtest',
+    expectedPath: '/foo?foo=bar&query=test1&path=test',
+  },
+  {
+    name: 'with query and root path',
+    query: '?path=%2F&query=foo%3Dbar%26baz%3Dqux%26fruit%3Dapple',
+    expectedPath: '/?foo=bar&baz=qux&fruit=apple',
+  },
+  {
+    name: 'queries with encoded spaces',
+    query:
+      '?path=%2Falerting%2Flist&query=search%3Dstate%3Ainactive%2520type%3Aalerting%2520health%3Anodata',
+    expectedPath:
+      '/alerting/list?search=state:inactive%20type:alerting%20health:nodata',
+  },
+  {
+    name: 'queries with non-encoded spaces',
+    query:
+      '?path=%2Falerting+%2Flist&query=search%3Dstate%3Ainactive+type%3Aalerting+health%3Anodata',
+    expectedPath:
+      '/alerting /list?search=state:inactive type:alerting health:nodata',
+  },
+];
+
+describe('app launcher path is properly formed', () => {
+  const realLocation = window.location;
+  const assignMock = jest.fn();
+
+  beforeEach(() => {
+    global.fetch = jest.fn(() => Promise.resolve({})) as jest.Mock;
+    jest.spyOn(api, 'get').mockResolvedValue({});
+    jest.spyOn(api, 'post').mockResolvedValue({});
+
+    delete window.location;
+    window.location = { ...realLocation, replace: assignMock };
+  });
+
+  afterEach(() => {
+    window.location = realLocation;
+    assignMock.mockClear();
+  });
+
+  test.each(testCases)('$name', async ({ query, expectedPath }) => {
+    const launcherPath = `/web/launch/grafana.localhost${query}`;
+    const mockHistory = createMemoryHistory({
+      initialEntries: [launcherPath],
+    });
+
+    render(
+      <Router history={mockHistory}>
+        <Route path={cfg.routes.appLauncher}>
+          <AppLauncher />
+        </Route>
+      </Router>
+    );
 
-  const launcherPath =
-    '/web/launch/test-app.test.teleport/test.teleport/test-app.test.teleport/arn:aws:iam::joe123:role%2FEC2FullAccess';
-  const mockHistory = createMemoryHistory({
-    initialEntries: [launcherPath],
+    await waitFor(() =>
+      expect(window.location.replace).toHaveBeenCalledWith(
+        `https://grafana.localhost${expectedPath}`
+      )
+    );
   });
 
-  render(
-    <Router history={mockHistory}>
-      <Route path={cfg.routes.appLauncher}>
-        <AppLauncher />
-      </Route>
-    </Router>
-  );
-
-  expect(service.createAppSession).toHaveBeenCalledWith({
-    fqdn: 'test-app.test.teleport',
-    clusterId: 'test.teleport',
-    publicAddr: 'test-app.test.teleport',
-    arn: 'arn:aws:iam::joe123:role/EC2FullAccess',
+  test('arn is url decoded', () => {
+    jest.spyOn(service, 'createAppSession');
+
+    const launcherPath =
+      '/web/launch/test-app.test.teleport/test.teleport/test-app.test.teleport/arn:aws:iam::joe123:role%2FEC2FullAccess';
+    const mockHistory = createMemoryHistory({
+      initialEntries: [launcherPath],
+    });
+
+    render(
+      <Router history={mockHistory}>
+        <Route path={cfg.routes.appLauncher}>
+          <AppLauncher />
+        </Route>
+      </Router>
+    );
+
+    expect(service.createAppSession).toHaveBeenCalledWith({
+      fqdn: 'test-app.test.teleport',
+      clusterId: 'test.teleport',
+      publicAddr: 'test-app.test.teleport',
+      arn: 'arn:aws:iam::joe123:role/EC2FullAccess',
+    });
   });
 });
diff --git a/web/packages/teleport/src/AppLauncher/AppLauncher.tsx b/web/packages/teleport/src/AppLauncher/AppLauncher.tsx
index a7d0fb24d8d15..ef15ab6e954c2 100644
--- a/web/packages/teleport/src/AppLauncher/AppLauncher.tsx
+++ b/web/packages/teleport/src/AppLauncher/AppLauncher.tsx
@@ -51,6 +51,7 @@ export function AppLauncher() {
 
       const session = await service.createAppSession(params);
 
+      // Setting cookie
       await fetch(`https://${fqdn}${port}/x-teleport-auth`, {
         method: 'POST',
         credentials: 'include',
@@ -62,11 +63,15 @@ export function AppLauncher() {
 
       let path = '';
       if (queryParams.has('path')) {
-        path = decodeURIComponent(queryParams.get('path'));
+        path = queryParams.get('path');
 
-        if (!path.startsWith('/')) {
+        if (path && !path.startsWith('/')) {
           path = `/${path}`;
         }
+
+        if (queryParams.has('query')) {
+          path += '?' + queryParams.get('query');
+        }
       }
 
       window.location.replace(`https://${fqdn}${port}${path}`);
diff --git a/web/packages/teleport/src/Apps/AppList/AppList.test.tsx b/web/packages/teleport/src/Apps/AppList/AppList.test.tsx
index 79b9bb95d524f..141142c1c4e88 100644
--- a/web/packages/teleport/src/Apps/AppList/AppList.test.tsx
+++ b/web/packages/teleport/src/Apps/AppList/AppList.test.tsx
@@ -64,6 +64,7 @@ test('correct launch url is generated for a selected role', () => {
           fqdn: 'awsconsole-1.com',
           id: 'one-aws-console-1-awsconsole-1.teleport-proxy.com',
           launchUrl: '',
+          userGroups: [],
         },
       ]}
     />
diff --git a/web/packages/teleport/src/Assist/Assist.tsx b/web/packages/teleport/src/Assist/Assist.tsx
index ebacae54eb444..88a517b03dd02 100644
--- a/web/packages/teleport/src/Assist/Assist.tsx
+++ b/web/packages/teleport/src/Assist/Assist.tsx
@@ -1,69 +1,386 @@
-/*
-Copyright 2023 Gravitational, Inc.
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
+import React, { useEffect, useState } from 'react';
+import styled, { keyframes } from 'styled-components';
 
-    http://www.apache.org/licenses/LICENSE-2.0
+import { Header } from 'teleport/Assist/Header';
+import { ConversationHistory } from 'teleport/Assist/ConversationHistory';
+import {
+  AssistContextProvider,
+  useAssist,
+} from 'teleport/Assist/context/AssistContext';
+import { ConversationList } from 'teleport/Assist/ConversationList';
+import { useLayout } from 'teleport/Main/LayoutContext';
+import { ViewMode } from 'teleport/Assist/types';
+import { Settings } from 'teleport/Assist/Settings';
+import { ErrorBanner, ErrorList } from 'teleport/Assist/ErrorBanner';
+import { useUser } from 'teleport/User/UserContext';
 
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+interface AssistProps {
+  onClose: () => void;
+}
+
+const fadeIn = keyframes`
+  from {
+    opacity: 0;
+  }
+
+  to {
+    opacity: 1;
+  }
+`;
+
+const slideIn = keyframes`
+  from {
+    transform: translate3d(calc(var(--assist-width) + var(--assist-gutter)), 0, 0);
+  }
+
+  to {
+    transform: translate3d(0, 0, 0);
+  }
+`;
+
+function variables(props: { viewMode: ViewMode }) {
+  switch (props.viewMode) {
+    case ViewMode.Popup:
+      return {
+        '--assist-gutter': '20px',
+        '--assist-border-radius': '15px',
+        '--assist-left': 'auto',
+        '--assist-right': 'var(--assist-gutter)',
+        '--assist-width': '550px',
+        '--assist-height': '780px',
+        '--assist-box-shadow': '0 30px 60px 0 rgba(0, 0, 0, 0.4)',
+        '--assist-left-border': 'none',
+        '--assist-header-height': '59px',
+        '--assist-bottom-padding': '5px',
+      };
+
+    case ViewMode.PopupExpanded:
+    case ViewMode.PopupExpandedSidebarVisible:
+      return {
+        '--assist-gutter': '20px',
+        '--assist-border-radius': '15px',
+        '--assist-left': 'auto',
+        '--assist-right': 'var(--assist-gutter)',
+        '--assist-width': '1100px',
+        '--assist-height': 'calc(100vh - calc(var(--assist-gutter) * 2))',
+        '--assist-box-shadow': '0 30px 60px 0 rgba(0, 0, 0, 0.4)',
+        '--assist-left-border': 'none',
+        '--assist-header-height': '59px',
+        '--assist-bottom-padding': '5px',
+      };
+
+    case ViewMode.Docked:
+      return {
+        '--assist-gutter': '0',
+        '--assist-border-radius': '0',
+        '--assist-left': 'auto',
+        '--assist-right': '0',
+        '--assist-width': '520px',
+        '--assist-height': '100vh',
+        '--assist-box-shadow': 'none',
+        '--assist-left-border': '1px solid rgba(0, 0, 0, 0.1)',
+        '--assist-header-height': '72px',
+        '--assist-bottom-padding': '5px',
+      };
+  }
+}
+
+function sidebarVariables(props: {
+  viewMode: ViewMode;
+  sidebarVisible: boolean;
+}) {
+  switch (props.viewMode) {
+    case ViewMode.Popup:
+      if (props.sidebarVisible) {
+        return {
+          '--conversation-width': '550px',
+          '--conversation-list-width': '550px',
+          '--conversation-list-margin': '0',
+          '--command-input-width': '400px',
+          '--conversation-list-display': 'flex',
+          '--conversation-list-position': 'absolute',
+        };
+      }
+
+      return {
+        '--conversation-width': '555px',
+        '--conversation-list-width': '550px',
+        '--conversation-list-margin':
+          'calc((var(--conversation-list-width) * -1) - 4px)',
+        '--command-input-width': '400px',
+        '--conversation-list-display': 'none',
+        '--conversation-list-position': 'absolute',
+      };
 
-import React from 'react';
-import styled from 'styled-components';
+    case ViewMode.PopupExpanded:
+    case ViewMode.PopupExpandedSidebarVisible:
+      if (props.sidebarVisible) {
+        return {
+          '--conversation-list-margin': '0',
+          '--conversation-width': '900px',
+          '--conversation-list-width': '250px',
+          '--command-input-width': '600px',
+          '--conversation-list-display': 'flex',
+          '--conversation-list-position': 'static',
+        };
+      }
 
-import { createPortal } from 'react-dom';
+      return {
+        '--conversation-width': '1100px',
+        '--conversation-list-width': '250px',
+        '--conversation-list-margin':
+          'calc((var(--conversation-list-width) * -1))',
+        '--command-input-width': '700px',
+        '--conversation-list-display': 'none',
+        '--conversation-list-position': 'absolute',
+      };
 
-import { useParams } from 'react-router';
+    case ViewMode.Docked:
+      if (props.sidebarVisible) {
+        return {
+          '--conversation-width': '520px',
+          '--conversation-list-width': '520px',
+          '--conversation-list-margin': '0',
+          '--command-input-width': '380px',
+          '--conversation-list-display': 'flex',
+          '--conversation-list-position': 'absolute',
+        };
+      }
 
-import { MessagesContextProvider } from 'teleport/Assist/contexts/messages';
-import { ConversationsContextProvider } from 'teleport/Assist/contexts/conversations';
-import { ConversationTitle } from 'teleport/Assist/ConversationTitle';
-import { LandingPage } from 'teleport/Assist/LandingPage';
-import { Chat } from 'teleport/Assist/Chat';
-import { Sidebar } from 'teleport/Assist/Sidebar';
+      return {
+        '--conversation-width': '525px',
+        '--conversation-list-width': '520px',
+        '--conversation-list-margin':
+          'calc((var(--conversation-list-width) * -1) - 1px)',
+        '--command-input-width': '380px',
+        '--conversation-list-display': 'none',
+        '--conversation-list-position': 'absolute',
+      };
+  }
+}
 
-const Container = styled.div`
+const Container = styled.div<{ docked: boolean }>`
+  position: fixed;
+  top: 0;
+  left: ${p => (p.docked ? 'auto' : '0')};
+  right: 0;
+  bottom: 0;
+  opacity: 0;
+  animation: forwards ${fadeIn} 0.3s ease-in-out;
+  background: rgba(0, 0, 0, 0.5);
+  z-index: 1000;
   display: flex;
+  justify-content: flex-end;
 `;
 
-const ChatContainer = styled.div`
+const AssistContainer = styled.div`
+  ${variables};
+  ${sidebarVariables};
+
+  transform: translate3d(
+    calc(var(--assist-width) + var(--assist-gutter)),
+    0,
+    0
+  );
+  animation: forwards ${slideIn} 0.5s cubic-bezier(0.33, 1, 0.68, 1);
+  transition: width 0.5s cubic-bezier(0.33, 1, 0.68, 1),
+    height 0.5s cubic-bezier(0.33, 1, 0.68, 1);
+  background: ${p => p.theme.colors.levels.popout};
+  border-radius: var(--assist-border-radius);
+  box-shadow: var(--assist-box-shadow);
+  position: absolute;
+  width: var(--assist-width);
+  max-height: calc(100vh - var(--assist-gutter) * 2);
+  height: var(--assist-height);
+  top: var(--assist-gutter);
+  right: var(--assist-right);
+  left: var(--assist-left);
+  bottom: var(--assist-gutter);
   display: flex;
-  max-width: 1600px;
-  height: calc(100vh - 72px);
-  width: 100%;
+  flex-direction: column;
+  border-left: var(--assist-left-border);
+  overflow: hidden;
 `;
 
-export function Assist() {
-  const params = useParams<{ conversationId: string }>();
+const AssistConversation = styled.div`
+  display: flex;
+  flex-direction: column;
+  width: var(--conversation-width);
+  overflow-y: auto;
+  height: 100%;
+`;
 
+const Content = styled.div`
+  flex: 1;
+  overflow-y: auto;
+  overflow-x: hidden;
+  display: flex;
+  position: relative;
+`;
+
+export function Assist(props: AssistProps) {
   return (
-    <ConversationsContextProvider>
-      {params.conversationId ? (
-        <MessagesContextProvider
-          conversationId={params.conversationId}
-          key={params.conversationId}
-        >
-          <Container>
-            <ChatContainer>
-              <Chat conversationId={params.conversationId} />
-            </ChatContainer>
-          </Container>
-        </MessagesContextProvider>
-      ) : (
-        <LandingPage />
-      )}
+    <AssistContextProvider>
+      <AssistContent onClose={props.onClose} />
+    </AssistContextProvider>
+  );
+}
+
+let errorIndex = 0;
+
+interface AssistError {
+  message: string;
+  index: number;
+}
+
+function getInitialErrors(conversations: { error?: string }) {
+  const errors: AssistError[] = [];
+
+  if (conversations.error) {
+    errors.push({
+      message: conversations.error,
+      index: errorIndex++,
+    });
+  }
+
+  return errors;
+}
+
+function AssistContent(props: AssistProps) {
+  const { preferences } = useUser();
+  const { conversations, sidebarVisible, toggleSidebar } = useAssist();
+
+  const [errors, setErrors] = useState<{ message: string; index: number }[]>(
+    () => getInitialErrors(conversations)
+  );
+  const [settingsOpen, setSettingsOpen] = useState(false);
+  const [debugMenuEnabled, setDebugMenuEnabled] = useState(false);
+
+  const { hasDockedElement, setHasDockedElement } = useLayout();
+
+  useEffect(() => {
+    if (!hasDockedElement && preferences.assist.viewMode === ViewMode.Docked) {
+      setHasDockedElement(true);
+    }
+
+    if (hasDockedElement && preferences.assist.viewMode !== ViewMode.Docked) {
+      setHasDockedElement(false);
+    }
+  }, [hasDockedElement, preferences.assist.viewMode]);
+
+  function handleClick(e: React.MouseEvent<HTMLElement>) {
+    e.stopPropagation();
+  }
+
+  function handleConversationSelect() {
+    if (!sidebarVisible) {
+      return;
+    }
 
-      {createPortal(<Sidebar />, document.getElementById('assist-sidebar'))}
-      {createPortal(
-        <ConversationTitle />,
-        document.getElementById('topbar-portal')
+    if (
+      preferences.assist.viewMode === ViewMode.Popup ||
+      preferences.assist.viewMode === ViewMode.Docked
+    ) {
+      toggleSidebar(false);
+    }
+  }
+
+  function handleClose() {
+    props.onClose();
+    setHasDockedElement(false);
+
+    if (
+      sidebarVisible &&
+      preferences.assist.viewMode !== ViewMode.PopupExpandedSidebarVisible
+    ) {
+      toggleSidebar(false);
+    }
+  }
+
+  function handleToggleSidebar() {
+    toggleSidebar(!sidebarVisible);
+  }
+
+  function handleDebugMenuToggle(enabled: boolean) {
+    if (process.env.NODE_ENV !== 'development') {
+      throw new Error('Debug menu is only available in development mode');
+    }
+
+    setDebugMenuEnabled(enabled);
+  }
+
+  function handleError(message: string) {
+    setErrors([...errors, { message, index: errorIndex++ }]);
+  }
+
+  function removeError(index: number) {
+    setErrors(errors.filter(error => error.index !== index));
+  }
+
+  const errorList = errors.map(error => (
+    <ErrorBanner key={error.index} onDismiss={() => removeError(error.index)}>
+      {error.message}
+    </ErrorBanner>
+  ));
+
+  return (
+    <Container
+      onClick={handleClose}
+      docked={preferences.assist.viewMode === ViewMode.Docked}
+    >
+      {settingsOpen && (
+        <Settings
+          onClose={() => setSettingsOpen(false)}
+          debugMenuEnabled={debugMenuEnabled}
+          onDebugMenuToggle={handleDebugMenuToggle}
+        />
       )}
-    </ConversationsContextProvider>
+
+      <AssistContainer
+        onClick={handleClick}
+        viewMode={preferences.assist.viewMode}
+        sidebarVisible={sidebarVisible}
+      >
+        <Header
+          onClose={handleClose}
+          onSettingsOpen={() => setSettingsOpen(true)}
+          onToggleSidebar={handleToggleSidebar}
+          sidebarVisible={sidebarVisible}
+          viewMode={preferences.assist.viewMode}
+          onError={handleError}
+        />
+
+        <ErrorList>{errorList}</ErrorList>
+
+        <Content>
+          {sidebarVisible && (
+            <ConversationHistory
+              onConversationSelect={handleConversationSelect}
+              viewMode={preferences.assist.viewMode}
+              onError={handleError}
+            />
+          )}
+          <AssistConversation>
+            <ConversationList viewMode={preferences.assist.viewMode} />
+          </AssistConversation>
+        </Content>
+      </AssistContainer>
+    </Container>
   );
 }
diff --git a/web/packages/teleport/src/Assist/Chat/Avatar.ts b/web/packages/teleport/src/Assist/Chat/Avatar.ts
deleted file mode 100644
index d7c8fb99e7aa1..0000000000000
--- a/web/packages/teleport/src/Assist/Chat/Avatar.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import styled from 'styled-components';
-
-export const AvatarContainer = styled.div`
-  display: flex;
-  align-items: center;
-  color: rgba(0, 0, 0, 0.5);
-
-  strong {
-    display: block;
-    margin-right: 10px;
-    color: rgba(0, 0, 0, 0.9);
-  }
-`;
-
-export const ChatItemAvatarImage = styled.div<{ backgroundImage: string }>`
-  background: url(${p => p.backgroundImage}) no-repeat;
-  width: 22px;
-  height: 22px;
-  overflow: hidden;
-  background-size: cover;
-`;
-
-export const ChatItemAvatarTeleport = styled.div`
-  background: ${props => props.theme.colors.brand};
-  padding: 4px;
-  border-radius: 10px;
-  left: 0;
-  right: auto;
-  margin-right: 10px;
-`;
diff --git a/web/packages/teleport/src/Assist/Chat/Chat.tsx b/web/packages/teleport/src/Assist/Chat/Chat.tsx
deleted file mode 100644
index e64c3b0f1c36c..0000000000000
--- a/web/packages/teleport/src/Assist/Chat/Chat.tsx
+++ /dev/null
@@ -1,211 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import React, { useCallback, useEffect, useRef, useState } from 'react';
-import styled from 'styled-components';
-
-import teleport from 'design/assets/images/icons/teleport.png';
-
-import logger from 'shared/libs/logger';
-
-import { Dots } from 'teleport/Assist/Dots';
-
-import {
-  Typing,
-  TypingContainer,
-  TypingDot,
-} from 'teleport/Assist/Chat/Typing';
-
-import {
-  AvatarContainer,
-  ChatItemAvatarImage,
-  ChatItemAvatarTeleport,
-} from 'teleport/Assist/Chat/Avatar';
-
-import { useConversations } from 'teleport/Assist/contexts/conversations';
-
-import {
-  generateTitle,
-  setConversationTitle,
-  useMessages,
-} from '../contexts/messages';
-
-import { ChatBox } from './ChatBox';
-import { ChatItem } from './ChatItem';
-
-const Container = styled.div`
-  flex: 1;
-  position: relative;
-  overflow: hidden;
-  display: flex;
-  flex-direction: column;
-`;
-
-const Content = styled.div.attrs({ 'data-scrollbar': 'default' })`
-  flex: 1 1 auto;
-  overflow-y: auto;
-  padding-top: 30px;
-  display: flex;
-  justify-content: center;
-`;
-
-const Padding = styled.div`
-  padding: 30px;
-  box-sizing: border-box;
-`;
-
-const LoadingContainer = styled.div`
-  width: 100%;
-  height: 100%;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-`;
-
-const Width = styled.div`
-  max-width: 1200px;
-  width: 100%;
-`;
-
-class ChatProps {
-  conversationId: string;
-}
-
-export function Chat(props: ChatProps) {
-  const ref = useRef<HTMLDivElement>(null);
-
-  const [error, setError] = useState<string>(null);
-  const {
-    send,
-    messages,
-    loading,
-    responding,
-    error: messagesError,
-  } = useMessages();
-  const { conversations, setConversations } = useConversations();
-
-  const scrollTextarea = useCallback(() => {
-    ref.current?.scrollIntoView({ behavior: 'smooth' });
-  }, [ref.current]);
-
-  useEffect(() => {
-    scrollTextarea();
-  }, [messages, scrollTextarea]);
-
-  const handleSubmit = useCallback(
-    (message: string) => {
-      send(message).then(() => {
-        if (messages.length == 1) {
-          // Use the second message/first message from a user to generate the title.
-          (async () => {
-            try {
-              // Generate title using the last message and OpenAI API.
-              const title = await generateTitle(message);
-              // Set the title in the backend.
-              await setConversationTitle(props.conversationId, title);
-              // Update the title in the frontend.
-              setConversations(conversations =>
-                conversations.map(c => {
-                  if (c.id === props.conversationId) {
-                    c.title = title;
-                  }
-                  return c;
-                })
-              );
-            } catch (err) {
-              setError('An error occurred when setting the conversation title');
-
-              logger.error(err);
-            }
-          })();
-        }
-      });
-    },
-    [messages, conversations, setConversations]
-  );
-
-  const items = messages.map((message, index) => (
-    <ChatItem
-      scrollTextarea={scrollTextarea}
-      key={index}
-      message={message}
-      isNew={message.isNew}
-      hideAvatar={
-        messages[index + 1] && messages[index + 1].author === message.author
-      }
-      isLastFromUser={
-        messages[index + 1]
-          ? messages[index + 1].author !== message.author
-          : true
-      }
-      isFirstFromUser={
-        messages[index - 1]
-          ? messages[index - 1].author !== message.author
-          : true
-      }
-    />
-  ));
-
-  let content;
-  if (loading) {
-    content = (
-      <LoadingContainer>
-        <Dots />
-      </LoadingContainer>
-    );
-  } else {
-    content = (
-      <Padding>
-        {items}
-
-        {responding && (
-          <Typing>
-            <AvatarContainer>
-              <ChatItemAvatarTeleport>
-                <ChatItemAvatarImage backgroundImage={teleport} />
-              </ChatItemAvatarTeleport>
-
-              <TypingContainer>
-                <TypingDot style={{ animationDelay: '0s' }} />
-                <TypingDot style={{ animationDelay: '0.2s' }} />
-                <TypingDot style={{ animationDelay: '0.4s' }} />
-              </TypingContainer>
-            </AvatarContainer>
-          </Typing>
-        )}
-
-        <div ref={ref} />
-      </Padding>
-    );
-  }
-
-  return (
-    <Container>
-      <Content>
-        <Width>{content}</Width>
-      </Content>
-
-      <div style={{ display: 'flex', justifyContent: 'center' }}>
-        <Width>
-          <ChatBox
-            onSubmit={handleSubmit}
-            errorMessage={error || messagesError}
-          />
-        </Width>
-      </div>
-    </Container>
-  );
-}
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/Action.tsx b/web/packages/teleport/src/Assist/Chat/ChatItem/Action/Action.tsx
deleted file mode 100644
index ca575beaa5838..0000000000000
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/Action.tsx
+++ /dev/null
@@ -1,343 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import React, { ReactElement, useCallback, useState } from 'react';
-import styled from 'styled-components';
-
-import { EditIcon, SearchIcon, UserIcon } from 'design/SVGIcon';
-
-import Select from 'shared/components/Select';
-
-import { ActionState } from 'teleport/Assist/Chat/ChatItem/Action/types';
-
-import { ActionForm } from './ActionForm';
-import { Container, Items, Title } from './common';
-
-interface ActionProps {
-  state: ActionState[];
-  onStateUpdate: (actionState: ActionState[]) => void;
-}
-
-const Item = styled.div`
-  padding: 10px 15px;
-  background: ${p => p.theme.colors.spotBackground[0]};
-  border: 1px solid ${p => p.theme.colors.spotBackground[0]};
-  border-radius: 5px;
-  margin-right: 10px;
-  font-size: 14px;
-  font-family: SFMono-Regular, Consolas, Liberation Mono, Menlo, Courier,
-    monospace;
-  font-weight: bold;
-`;
-
-const Buttons = styled.div`
-  position: absolute;
-  right: 8px;
-  top: 8px;
-  opacity: 0.6;
-`;
-
-const EditButton = styled.div`
-  border-radius: 10px;
-  width: 32px;
-  height: 32px;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  cursor: pointer;
-
-  &:hover {
-    background: rgba(255, 255, 255, 0.2);
-  }
-`;
-
-const Query = styled.div`
-  padding: 10px 15px;
-  background: ${p => p.theme.colors.spotBackground[0]};
-  border: 1px solid ${p => p.theme.colors.spotBackground[0]};
-  border-radius: 5px;
-  align-items: center;
-  display: flex;
-  margin-right: 10px;
-  font-size: 14px;
-  font-family: SFMono-Regular, Consolas, Liberation Mono, Menlo, Courier,
-    monospace;
-  font-weight: bold;
-
-  svg {
-    margin-right: 10px;
-  }
-`;
-
-const As = styled.div`
-  padding: 10px 15px;
-  margin-left: -10px;
-`;
-
-const User = styled.div`
-  padding: 10px 15px;
-  background: ${p => p.theme.colors.spotBackground[0]};
-  border: 1px solid ${p => p.theme.colors.spotBackground[0]};
-  border-radius: 5px;
-  display: flex;
-  align-items: center;
-  font-weight: bold;
-
-  svg {
-    margin-right: 10px;
-  }
-`;
-
-function actionStateToItems(formState: ActionState[]) {
-  const items = [] as ReactElement[];
-
-  for (const [index, state] of formState.entries()) {
-    if (state.type === 'command') {
-      items.push(<Item key={0}>{state.value}</Item>);
-    }
-
-    if (state.type === 'query') {
-      items.push(
-        <Query key={`query-${index}`}>
-          <SearchIcon size={16} />
-          {state.value}
-        </Query>
-      );
-    }
-
-    if (state.type === 'availableUsers') {
-      items.push(
-        <React.Fragment key="user">
-          <As>as</As>
-          <User>
-            <UserIcon size={16} />
-            <Select
-              onChange={() => {}}
-              value={{ value: state.value[0], label: state.value[0] }}
-              options={state.value.map(option => {
-                return { label: option, value: option };
-              })}
-              css={'width: 20vh; padding: 5px'}
-            />
-          </User>
-        </React.Fragment>
-      );
-    }
-  }
-
-  return items;
-}
-
-export function Action(props: ActionProps) {
-  const [editing, setEditing] = useState(false);
-
-  const handleSave = useCallback(
-    (state: ActionState[]) => {
-      props.onStateUpdate(state);
-      setEditing(false);
-    },
-    [props.onStateUpdate]
-  );
-
-  if (editing) {
-    return (
-      <ActionForm
-        initialState={props.state}
-        onSave={handleSave}
-        onCancel={() => setEditing(false)}
-      />
-    );
-  }
-
-  const items = actionStateToItems(props.state);
-
-  return (
-    <Container>
-      <Buttons>
-        <EditButton onClick={() => setEditing(true)}>
-          <EditIcon size={18} />
-        </EditButton>
-      </Buttons>
-
-      <Items>{items}</Items>
-    </Container>
-  );
-}
-
-interface NodesAndLabelsProps {
-  initialQuery: string | undefined;
-  selectedLogin: string | undefined;
-  availableLogins: string[] | undefined;
-  onStateUpdate: (state: ActionState[]) => void;
-  disabled: boolean;
-}
-
-function propsToState(props: NodesAndLabelsProps): ActionState[] {
-  const items: ActionState[] = [];
-
-  // Always include query.
-  items.push({ type: 'query', value: props.initialQuery ?? '' });
-
-  if (props.availableLogins) {
-    items.push({ type: 'availableUsers', value: props.availableLogins });
-  }
-
-  if (props.selectedLogin) {
-    items.push({ type: 'user', value: props.selectedLogin });
-  }
-
-  return items;
-}
-
-function stateToItems(
-  updateUser: (state: ActionState[]) => void,
-  formState: ActionState[]
-) {
-  const items = [];
-
-  for (const [index, state] of formState.entries()) {
-    if (state.type === 'command') {
-      items.push(<Item key={0}>{state.value}</Item>);
-    }
-
-    if (state.type === 'query') {
-      items.push(
-        <Query key={`query-${index}`}>
-          <SearchIcon size={16} />
-          {state.value}
-        </Query>
-      );
-    }
-
-    const handleChange = event => {
-      updateUser([...formState, { type: 'user', value: event.value }]);
-    };
-
-    if (state.type === 'user') {
-      items.push(
-        <React.Fragment key={'user-key'}>
-          <As key="as">as</As>
-          <User key="user">
-            <UserIcon size={16} />
-            <Select
-              onChange={handleChange}
-              value={{ value: state.value, label: state.value }}
-              options={[{ value: state.value, label: state.value }]}
-              isDisabled={true}
-              css={'width: 20vh'}
-            />
-          </User>
-        </React.Fragment>
-      );
-    }
-  }
-
-  return items;
-}
-
-export function NodesAndLabels(props: NodesAndLabelsProps) {
-  const [editing, setEditing] = useState(false);
-
-  const state = propsToState(props);
-
-  const handleSave = useCallback(
-    (state: ActionState[]) => {
-      props.onStateUpdate(state);
-      setEditing(false);
-    },
-    [props.onStateUpdate]
-  );
-
-  if (editing) {
-    return (
-      <ActionForm
-        initialState={state}
-        onSave={handleSave}
-        onCancel={() => setEditing(false)}
-      />
-    );
-  }
-
-  return (
-    <Container>
-      <Title>Connect using query</Title>
-
-      {!props.disabled && (
-        <Buttons>
-          <EditButton onClick={() => setEditing(true)}>
-            <EditIcon size={18} />
-          </EditButton>
-        </Buttons>
-      )}
-
-      <Items>{stateToItems(handleSave, state)}</Items>
-    </Container>
-  );
-}
-
-interface CommandProps {
-  command: string;
-  onStateUpdate: (command: string) => void;
-  disabled: boolean;
-}
-
-export function Command(props: CommandProps) {
-  const [editing, setEditing] = useState(false);
-
-  const state: ActionState[] = [{ type: 'command', value: props.command }];
-
-  const handleSave = useCallback(
-    (state: ActionState[]) => {
-      let command = '';
-
-      for (const item of state) {
-        if (item.type === 'command') {
-          command = item.value;
-        }
-      }
-
-      props.onStateUpdate(command);
-      setEditing(false);
-    },
-    [props.onStateUpdate]
-  );
-
-  if (editing) {
-    return (
-      <ActionForm
-        initialState={state}
-        onSave={handleSave}
-        onCancel={() => setEditing(false)}
-      />
-    );
-  }
-
-  return (
-    <Container>
-      <Title>Execute</Title>
-
-      {!props.disabled && (
-        <Buttons>
-          <EditButton onClick={() => setEditing(true)}>
-            <EditIcon size={18} />
-          </EditButton>
-        </Buttons>
-      )}
-
-      <Items>{stateToItems(handleSave, state)}</Items>
-    </Container>
-  );
-}
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/ActionForm.tsx b/web/packages/teleport/src/Assist/Chat/ChatItem/Action/ActionForm.tsx
deleted file mode 100644
index 41a9979fa22a9..0000000000000
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/ActionForm.tsx
+++ /dev/null
@@ -1,250 +0,0 @@
-/**
- * Copyright 2023 Gravitational, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import React, { useCallback, useState } from 'react';
-import styled from 'styled-components';
-
-import { SearchIcon, UserIcon } from 'design/SVGIcon';
-import { Cross } from 'design/Icon';
-
-import Select from 'shared/components/Select';
-
-import { ActionState } from 'teleport/Assist/Chat/ChatItem/Action/types';
-
-import { Container, Items } from './common';
-
-interface ActionFormProps {
-  initialState: ActionState[];
-  onSave: (state: ActionState[]) => void;
-  onCancel: () => void;
-}
-
-const CommandInput = styled.input`
-  padding: 10px 15px;
-  background: ${p => p.theme.colors.spotBackground[0]};
-  border-radius: 5px;
-  font-size: 16px;
-  font-family: SFMono-Regular, Consolas, Liberation Mono, Menlo, Courier,
-    monospace;
-  font-weight: bold;
-  border: none;
-  color: ${p => p.theme.colors.text.main};
-  width: 100%;
-  box-sizing: border-box;
-
-  &:focus {
-    outline: none;
-  }
-`;
-
-const CancelButton = styled.div`
-  font-weight: bold;
-  border-radius: 5px;
-  padding: 5px 15px;
-  display: inline-flex;
-  align-self: flex-end;
-  cursor: pointer;
-  margin-right: 10px;
-
-  &:hover {
-    background: ${p => p.theme.colors.spotBackground[0]};
-  }
-`;
-
-const SaveButton = styled.div`
-  margin-top: 10px;
-  background: ${p => p.theme.colors.buttons.primary.default};
-  font-weight: bold;
-  color: ${p => p.theme.colors.buttons.primary.text};
-  border-radius: 5px;
-  padding: 5px 15px;
-  display: inline-flex;
-  align-self: flex-end;
-  cursor: pointer;
-
-  &:hover {
-    background: ${p => p.theme.colors.buttons.primary.hover};
-  }
-`;
-
-const LabelForm = styled.div`
-  display: flex;
-  background: ${p => p.theme.colors.spotBackground[0]};
-  align-items: center;
-  padding: 1px 15px;
-  border-radius: 5px;
-  margin-right: 10px;
-`;
-
-const LabelFormContent = styled.div`
-  display: flex;
-  align-items: center;
-`;
-
-const Input = styled.input`
-  background: transparent;
-  padding: 10px 15px;
-  border-radius: 5px;
-  margin-right: 10px;
-  font-size: 16px;
-  font-weight: bold;
-  border: none;
-  width: 340px;
-  box-sizing: border-box;
-  color: ${p => p.theme.colors.text.main};
-
-  &:focus {
-    outline: none;
-  }
-`;
-
-const DeleteButton = styled.div`
-  padding: 1px 4px;
-  border-radius: 5px;
-  cursor: pointer;
-  justify-self: flex-end;
-
-  &:hover {
-    background: rgba(255, 255, 255, 0.2);
-  }
-`;
-
-const FormFooter = styled.div`
-  display: flex;
-  justify-content: space-between;
-  align-items: flex-end;
-`;
-
-const FooterButtons = styled.div``;
-
-const As = styled.div`
-  padding: 10px 15px;
-  margin-left: -10px;
-`;
-
-export function ActionForm(props: ActionFormProps) {
-  const currentSelectedUser = props.initialState.find(e => e.type === 'user');
-  const [formState, setFormState] = useState<ActionState[]>(props.initialState);
-  const [currentUser, setCurrentUser] = useState<string>(
-    currentSelectedUser ? (currentSelectedUser.value as string) : ''
-  );
-
-  const handleChange = useCallback((index: number, value: any) => {
-    setFormState(existing =>
-      existing.map((item, i) => {
-        if (index === i) {
-          return {
-            ...item,
-            value,
-          };
-        }
-
-        return item;
-      })
-    );
-  }, []);
-
-  const handleUserChange = useCallback((index: number, value: string) => {
-    setCurrentUser(value);
-    setFormState(existing =>
-      existing.map(item => {
-        if (item.type === 'user') {
-          return {
-            ...item,
-            value: value,
-          };
-        }
-
-        return item;
-      }, [])
-    );
-  }, []);
-
-  const handleDelete = useCallback(index => {
-    setFormState(existing => existing.filter((item, i) => i !== index));
-  }, []);
-
-  const items = [];
-
-  for (const [index, stateItem] of formState.entries()) {
-    if (stateItem.type === 'command') {
-      items.push(
-        <CommandInput
-          autoFocus
-          key="command"
-          value={stateItem.value}
-          onChange={event => handleChange(index, event.target.value)}
-        />
-      );
-    }
-
-    if (stateItem.type === 'query') {
-      items.push(
-        <LabelForm key={`query-${index}`}>
-          <LabelFormContent>
-            <SearchIcon size={16} />
-
-            <Input
-              key="query"
-              value={stateItem.value}
-              onChange={event => handleChange(index, event.target.value)}
-            />
-          </LabelFormContent>
-
-          <DeleteButton onClick={() => handleDelete(index)}>
-            <Cross />
-          </DeleteButton>
-        </LabelForm>
-      );
-    }
-
-    if (stateItem.type === 'availableUsers') {
-      items.push(
-        <As key={`as-${index}`}>as</As>,
-        <LabelForm key={`user-${index}`}>
-          <LabelFormContent>
-            <UserIcon size={16} />
-            <Select
-              onChange={event => handleUserChange(index, event['value'])}
-              value={{ value: currentUser, label: currentUser }}
-              options={stateItem.value.map(option => {
-                return { label: option, value: option };
-              })}
-              css={'width: 20vh; padding: 5px; margin-left: 10px;'}
-            />
-          </LabelFormContent>
-
-          <DeleteButton onClick={() => handleDelete(index)}>
-            <Cross />
-          </DeleteButton>
-        </LabelForm>
-      );
-    }
-  }
-
-  return (
-    <Container>
-      <Items>{items}</Items>
-
-      <FormFooter>
-        <FooterButtons>
-          <CancelButton onClick={() => props.onCancel()}>Cancel</CancelButton>
-          <SaveButton onClick={() => props.onSave(formState)}>Save</SaveButton>
-        </FooterButtons>
-      </FormFooter>
-    </Container>
-  );
-}
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/Actions.tsx b/web/packages/teleport/src/Assist/Chat/ChatItem/Action/Actions.tsx
deleted file mode 100644
index 127681d544dcc..0000000000000
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/Actions.tsx
+++ /dev/null
@@ -1,196 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import React, { useCallback, useEffect, useState } from 'react';
-import styled, { useTheme } from 'styled-components';
-
-import { RunIcon } from 'design/SVGIcon';
-
-import { ActionState } from 'teleport/Assist/Chat/ChatItem/Action/types';
-import {
-  Command,
-  NodesAndLabels,
-} from 'teleport/Assist/Chat/ChatItem/Action/Action';
-import { RunCommand } from 'teleport/Assist/Chat/ChatItem/Action/RunAction';
-import useStickyClusterId from 'teleport/useStickyClusterId';
-
-import ErrorMessage from 'teleport/components/AgentErrorMessage';
-
-import { remoteCommandToMessage } from 'teleport/Assist/contexts/messages';
-
-import { ExecuteRemoteCommandContent, Type } from '../../../services/messages';
-
-interface ActionsProps {
-  actions: ExecuteRemoteCommandContent;
-  scrollTextarea: () => void;
-  showRunButton: boolean;
-}
-
-const Container = styled.div`
-  width: 100%;
-  min-width: 500px;
-  padding-bottom: 15px;
-`;
-
-const Title = styled.div`
-  font-size: 15px;
-  margin-bottom: 10px;
-`;
-
-const Buttons = styled.div`
-  display: flex;
-  justify-content: flex-end;
-  margin-top: 20px;
-`;
-
-const Button = styled.div`
-  display: flex;
-  padding: 5px 15px 5px 10px;
-  border-radius: 5px;
-  font-weight: bold;
-  font-size: 15px;
-  align-items: center;
-  margin-left: 10px;
-  cursor: pointer;
-
-  svg {
-    margin-right: 10px;
-  }
-`;
-
-const ButtonRun = styled(Button)<{ disabled: boolean }>`
-  border: 2px solid ${p => (p.disabled ? '#cccccc' : '#20b141')};
-  opacity: ${p => (p.disabled ? 0.8 : 1)};
-  cursor: ${p => (p.disabled ? 'not-allowed' : 'pointer')};
-  color: ${p => (p.theme.name === 'light' ? '#20b141' : 'white')};
-
-  &:hover {
-    background: ${p => (p.disabled ? 'none' : '#20b141')};
-    color: white;
-
-    svg,
-    path {
-      fill: white;
-    }
-  }
-`;
-
-const Spacer = styled.div`
-  text-align: center;
-  padding: 10px 0;
-  font-size: 14px;
-`;
-
-export function Actions(props: ActionsProps) {
-  const theme = useTheme();
-
-  const [running, setRunning] = useState(false);
-  const [actions, setActions] = useState({ ...props.actions });
-  const { clusterId } = useStickyClusterId();
-
-  const [result] = useState(false);
-
-  useEffect(() => {
-    props.scrollTextarea();
-  }, [running, props.scrollTextarea]);
-
-  const run = useCallback(async () => {
-    if (running) {
-      return;
-    }
-
-    setRunning(true);
-  }, [running]);
-
-  const handleSave = useCallback(
-    (newActionState: ActionState[]) => {
-      const newActions: ExecuteRemoteCommandContent = {
-        type: Type.ExecuteRemoteCommand,
-        selectedLogin: '',
-        availableLogins: [],
-        query: '',
-        command: actions.command,
-        errorMsg: '',
-      };
-
-      for (const item of newActionState) {
-        if (item.type == 'query') {
-          newActions.query = item.value;
-        }
-
-        if (item.type === 'user') {
-          newActions.selectedLogin = item.value;
-        }
-
-        if (item.type === 'availableUsers') {
-          newActions.availableLogins = item.value;
-        }
-      }
-
-      remoteCommandToMessage(newActions, clusterId).then(e => setActions(e));
-    },
-    [actions]
-  );
-
-  const handleCommandUpdate = useCallback(
-    (newCommand: string) => {
-      const newActions: ExecuteRemoteCommandContent = {
-        ...actions,
-        command: newCommand,
-      };
-
-      setActions(newActions);
-    },
-    [actions]
-  );
-
-  return (
-    <Container>
-      {actions.errorMsg && <ErrorMessage message={actions.errorMsg} />}
-      {!result && <Title>Teleport would like to</Title>}
-
-      <NodesAndLabels
-        initialQuery={actions.query}
-        selectedLogin={actions.selectedLogin}
-        availableLogins={actions.availableLogins}
-        onStateUpdate={handleSave}
-        disabled={running || !props.showRunButton}
-      />
-
-      <Spacer>and</Spacer>
-
-      <Command
-        command={actions.command}
-        onStateUpdate={handleCommandUpdate}
-        disabled={running || !props.showRunButton}
-      />
-
-      {!result && !running && props.showRunButton && (
-        <Buttons>
-          <ButtonRun onClick={() => run()}>
-            <RunIcon
-              size={30}
-              fill={theme.name === 'light' ? '#20b141' : 'white'}
-            />
-            Run
-          </ButtonRun>
-        </Buttons>
-      )}
-
-      {running && <RunCommand actions={actions} />}
-    </Container>
-  );
-}
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/ExecResult.tsx b/web/packages/teleport/src/Assist/Chat/ChatItem/Action/ExecResult.tsx
deleted file mode 100644
index 5ba2bf8ef4245..0000000000000
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/ExecResult.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import React, { useState } from 'react';
-import styled from 'styled-components';
-
-import { ExecOutput } from '../../../services/messages';
-
-interface ExecResultProps {
-  result: ExecOutput;
-}
-
-const Container = styled.div`
-  margin-top: 20px;
-  margin-bottom: 40px;
-  background: rgba(0, 0, 0, 0.2);
-  padding: 15px 20px;
-  border-radius: 10px;
-  font-size: 18px;
-  position: relative;
-`;
-
-const Title = styled.div`
-  font-size: 15px;
-  margin-bottom: 15px;
-`;
-
-const ActionButton = styled.div`
-  font-size: 14px;
-  background: rgba(0, 0, 0, 0.7);
-  padding: 5px 10px;
-  position: absolute;
-  top: 10px;
-  right: 15px;
-  border-radius: 5px;
-  cursor: pointer;
-  &:hover {
-    text-decoration: underline;
-  }
-`;
-
-const CommandOutput = styled.div`
-  margin-bottom: 15px;
-
-  &:last-of-type {
-    margin-bottom: 0;
-  }
-`;
-
-const MachineName = styled.div`
-  font-size: 15px;
-  margin-bottom: 5px;
-`;
-
-const Output = styled.div`
-  background: rgba(255, 255, 255, 0.1);
-  border-radius: 5px;
-  padding: 5px 10px;
-  font-family: SFMono-Regular, Consolas, Liberation Mono, Menlo, Courier,
-    monospace;
-  font-size: 16px;
-`;
-
-export function ExecResult(props: ExecResultProps) {
-  const [showOutput, setShowOutput] = useState(false);
-
-  if (showOutput) {
-    const items = [];
-
-    for (const [index, item] of props.result.commandOutputs.entries()) {
-      items.push(
-        <CommandOutput key={index}>
-          <MachineName>{item.serverName}</MachineName>
-          <Output>{item.commandOutput}</Output>
-        </CommandOutput>
-      );
-    }
-
-    return (
-      <Container>
-        <Title>Output</Title>
-
-        <ActionButton onClick={() => setShowOutput(false)}>
-          Show result
-        </ActionButton>
-
-        {items}
-      </Container>
-    );
-  }
-
-  return (
-    <Container>
-      <Title>Result</Title>
-
-      <ActionButton onClick={() => setShowOutput(true)}>
-        Show output
-      </ActionButton>
-
-      {props.result.humanInterpretation}
-    </Container>
-  );
-}
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/RunAction.tsx b/web/packages/teleport/src/Assist/Chat/ChatItem/Action/RunAction.tsx
deleted file mode 100644
index df7deabc2b857..0000000000000
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/RunAction.tsx
+++ /dev/null
@@ -1,287 +0,0 @@
-/*
- *
- * Copyright 2023 Gravitational, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import React, { useCallback, useState } from 'react';
-import styled from 'styled-components';
-
-import { useParams } from 'react-router';
-
-import useStickyClusterId from 'teleport/useStickyClusterId';
-import { getAccessToken, getHostName } from 'teleport/services/api';
-
-import { ExecuteRemoteCommandContent } from 'teleport/Assist/services/messages';
-import { MessageTypeEnum, Protobuf } from 'teleport/lib/term/protobuf';
-import { Dots } from 'teleport/Assist/Dots';
-import cfg from 'teleport/config';
-import { WebauthnAssertionResponse } from 'teleport/services/auth';
-import useWebAuthn from 'teleport/lib/useWebAuthn';
-import { EventEmitterWebAuthnSender } from 'teleport/lib/EventEmitterWebAuthnSender';
-import AuthnDialog from 'teleport/components/AuthnDialog';
-import { TermEvent } from 'teleport/lib/term/enums';
-
-interface RunCommandProps {
-  actions: ExecuteRemoteCommandContent;
-}
-
-function convertContentToCommand(message: ExecuteRemoteCommandContent) {
-  const command = {
-    command: '',
-    login: '',
-    query: '',
-  };
-
-  if (message.selectedLogin) {
-    command.login = message.selectedLogin;
-  }
-
-  if (message.command) {
-    command.command = message.command;
-  }
-
-  if (message.query) {
-    command.query = message.query;
-  }
-
-  return command;
-}
-
-enum RunActionStatus {
-  Connecting,
-  Finished,
-}
-
-interface NodeState {
-  nodeId: string;
-  status: RunActionStatus;
-  stdout?: string;
-}
-
-interface RawPayload {
-  node_id: string;
-  payload: string;
-}
-
-interface SessionData {
-  session: { server_id: string };
-}
-
-class assistClient extends EventEmitterWebAuthnSender {
-  private readonly ws: WebSocket;
-  readonly proto: Protobuf = new Protobuf();
-  readonly encoder = new window.TextEncoder();
-
-  constructor(
-    url: string,
-    setState: React.Dispatch<React.SetStateAction<any[]>>
-  ) {
-    super();
-
-    this.ws = new WebSocket(url);
-    this.ws.binaryType = 'arraybuffer';
-
-    this.ws.onclose = () => {
-      setState(state => {
-        return state.map(n => ({
-          ...n,
-          stdout: n.stdout || '',
-          status: RunActionStatus.Finished,
-        }));
-      });
-    };
-
-    this.ws.onmessage = event => {
-      const uintArray = new Uint8Array(event.data);
-      const msg = this.proto.decode(uintArray);
-
-      switch (msg.type) {
-        case MessageTypeEnum.SESSION_DATA:
-          const sessionData = JSON.parse(msg.payload) as SessionData;
-          setState(state => {
-            state.push({
-              nodeId: sessionData.session.server_id,
-              status: RunActionStatus.Connecting,
-            });
-            return state;
-          });
-          break;
-
-        case MessageTypeEnum.RAW:
-          const data = JSON.parse(msg.payload) as RawPayload;
-          const payload = atob(data.payload);
-
-          setState(state => {
-            const results = state.find(node => node.nodeId == data.node_id);
-            if (!results) {
-              state.push({
-                nodeId: data.node_id,
-                status: RunActionStatus.Connecting,
-              });
-            }
-
-            return state.map(item => {
-              if (item.nodeId === data.node_id) {
-                if (!item.stdout) {
-                  item.stdout = '';
-                }
-                return {
-                  ...item,
-                  status: RunActionStatus.Finished,
-                  stdout: item.stdout + payload,
-                };
-              }
-
-              return item;
-            });
-          });
-
-          break;
-        case MessageTypeEnum.ERROR:
-          console.error(msg.payload);
-          break;
-        case MessageTypeEnum.WEBAUTHN_CHALLENGE:
-          this.emit(TermEvent.WEBAUTHN_CHALLENGE, msg.payload);
-          break;
-      }
-    };
-  }
-
-  sendWebAuthn(data: WebauthnAssertionResponse) {
-    const msg = this.encoder.encode(JSON.stringify(data));
-    this.send(msg);
-  }
-
-  send(data) {
-    if (!this.ws || this.ws.readyState !== WebSocket.OPEN || !data) {
-      console.warn('websocket unavailable', this.ws, data);
-      return;
-    }
-
-    const msg = this.proto.encodeRawMessage(data);
-    const bytearray = new Uint8Array(msg);
-    this.ws.send(bytearray.buffer);
-  }
-}
-
-export function RunCommand(props: RunCommandProps) {
-  const { clusterId } = useStickyClusterId();
-  const urlParams = useParams<{ conversationId: string }>();
-
-  const [state, setState] = useState(() => []);
-
-  const params = convertContentToCommand(props.actions);
-
-  const execParams = {
-    ...params,
-    conversation_id: urlParams.conversationId,
-    execution_id: crypto.randomUUID(),
-  };
-
-  const url = cfg.getAssistExecuteCommandUrl(
-    getHostName(),
-    clusterId,
-    getAccessToken(),
-    execParams
-  );
-
-  const [assistClt] = useState(() => new assistClient(url, setState));
-  const webauthn = useWebAuthn(assistClt);
-
-  const cancelCallback = useCallback(() => {
-    webauthn.setState(prevState => {
-      return {
-        ...prevState,
-        requested: false,
-      };
-    });
-  }, [webauthn]);
-
-  const nodes = state.map((item, index) => (
-    <NodeOutput key={index} state={item} />
-  ));
-
-  return (
-    <>
-      {webauthn.requested && (
-        <AuthnDialog
-          onContinue={webauthn.authenticate}
-          onCancel={cancelCallback}
-          errorText={webauthn.errorText}
-        />
-      )}
-      <div style={{ marginTop: '40px' }}>{nodes}</div>
-    </>
-  );
-}
-
-interface NodeOutputProps {
-  state: NodeState;
-}
-
-const NodeContainer = styled.div`
-  margin-bottom: 20px;
-  background: ${p => p.theme.colors.spotBackground[0]};
-  border-radius: 5px;
-  padding: 10px 15px 10px;
-`;
-
-const NodeTitle = styled.div`
-  font-size: 16px;
-  font-weight: bold;
-  margin-bottom: 10px;
-`;
-
-const NodeContent = styled.div`
-  background: #020308;
-  margin-bottom: 10px;
-  min-width: 500px;
-  border-radius: 5px;
-  padding: 1px 20px;
-  color: white;
-`;
-
-const LoadingContainer = styled.div`
-  display: flex;
-  justify-content: center;
-  margin: 30px 0 20px;
-`;
-
-const Output = styled.pre`
-  overflow-x: auto;
-`;
-
-function NodeOutput(props: NodeOutputProps) {
-  return (
-    <NodeContainer>
-      <NodeTitle>{props.state.nodeId}</NodeTitle>
-
-      {props.state.status === RunActionStatus.Connecting && (
-        <LoadingContainer>
-          <Dots />
-        </LoadingContainer>
-      )}
-
-      {props.state.stdout !== undefined &&
-        (props.state.stdout === '' ? (
-          'Empty output.'
-        ) : (
-          <NodeContent>
-            <Output>{props.state.stdout}</Output>
-          </NodeContent>
-        ))}
-    </NodeContainer>
-  );
-}
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/ChatItem.tsx b/web/packages/teleport/src/Assist/Chat/ChatItem/ChatItem.tsx
deleted file mode 100644
index f58f7daf8fcb7..0000000000000
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/ChatItem.tsx
+++ /dev/null
@@ -1,304 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import React from 'react';
-import styled, { keyframes } from 'styled-components';
-
-import DOMPurify from 'dompurify';
-import highlight from 'highlight.js';
-
-import { marked } from 'marked';
-
-import teleport from 'design/assets/images/icons/teleport.png';
-
-import { useTeleport } from 'teleport';
-
-import { getBorderRadius } from 'teleport/Assist/Chat/ChatItem/utils';
-
-import { Author, Message, Type } from '../../services/messages';
-
-import { Timestamp } from '../Timestamp';
-
-import { codeCSS } from './styles/code';
-import { markdownCSS } from './styles/markdown';
-
-import { Actions } from './Action';
-
-interface ChatItemProps {
-  message: Message;
-  isNew: boolean;
-  scrollTextarea: () => void;
-  hideAvatar: boolean;
-  isFirstFromUser: boolean;
-  isLastFromUser: boolean;
-}
-
-const appear = keyframes`
-  to {
-    transform: translate3d(0, 0, 0);
-    opacity: 1;
-  }
-`;
-
-const Content = styled.div`
-  padding: 20px 25px 4px;
-  box-shadow: 0 6px 12px -2px rgba(50, 50, 93, 0.05),
-    0 3px 7px -3px rgba(0, 0, 0, 0.1);
-  max-width: 90%;
-`;
-
-const Container = styled.div<{
-  teleport?: boolean;
-  isLast: boolean;
-  isNew: boolean;
-}>`
-  display: flex;
-  flex-direction: column;
-  align-items: ${p => (p.teleport ? 'flex-start' : 'flex-end')};
-  justify-content: ${p => (p.teleport ? '' : 'flex-end')};
-  margin: 0 30px ${p => (p.hasSpacing ? '25px' : '15px')} 30px;
-  position: relative;
-  animation: ${appear} 0.6s linear forwards;
-  transform: ${p => (p.isNew ? 'translate3d(0, 30px, 0)' : 'none')};
-  opacity: ${p => (p.isNew ? 0 : 1)};
-  font-size: 14px;
-
-  ${Content} {
-    background: ${p =>
-      p.teleport
-        ? p.theme.colors.levels.popout
-        : p.theme.colors.buttons.primary.default};
-    color: ${p =>
-      p.teleport
-        ? p.theme.colors.text.main
-        : p.theme.colors.buttons.primary.text};
-    border-radius: ${p =>
-      getBorderRadius(p.teleport, p.isFirstFromUser, p.isLastFromUser)};
-  }
-`;
-
-const ChatItemAvatarUser = styled.div`
-  width: 30px;
-  height: 30px;
-  border-radius: 10px;
-  overflow: hidden;
-  font-size: 14px;
-  font-weight: bold;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  background-size: cover;
-  margin-right: 10px;
-  background: ${props => props.theme.colors.brand};
-  color: ${p => p.theme.colors.buttons.primary.text};
-`;
-
-const ChatItemAvatarImage = styled.div<{ backgroundImage: string }>`
-  background: url(${p => p.backgroundImage}) no-repeat;
-  width: 22px;
-  height: 22px;
-  overflow: hidden;
-  background-size: cover;
-`;
-
-const AvatarContainer = styled.div`
-  display: flex;
-  align-items: center;
-  color: ${props => props.theme.colors.text.slightlyMuted};
-  margin-top: 20px;
-
-  strong {
-    display: block;
-    margin-right: 10px;
-    color: ${props => props.theme.colors.text.main};
-  }
-`;
-
-const UserAvatarContainer = styled(AvatarContainer)`
-  right: 0;
-`;
-
-const TeleportAvatarContainer = styled(AvatarContainer)`
-  left: 0;
-`;
-
-const ChatItemAvatarTeleport = styled.div`
-  background: ${props => props.theme.colors.brand};
-  color: ${p => p.theme.colors.buttons.primary.text};
-  padding: 4px;
-  border-radius: 10px;
-  left: 0;
-  right: auto;
-  margin-right: 10px;
-`;
-
-const ChatItemContent = styled.div`
-  font-size: 15px;
-  width: 100%;
-  position: relative;
-
-  ${markdownCSS}
-  ${codeCSS}
-`;
-
-// TODO(jakule || ryan): Remove duplicated styles.
-const CommandOutput = styled.div`
-  margin-bottom: 15px;
-  min-width: 100%;
-`;
-
-const MachineName = styled.div`
-  margin-bottom: 5px;
-  font-size: 14px;
-`;
-
-const Output = styled.div`
-  white-space: pre-wrap;
-  background: #020308;
-  color: white;
-  border-radius: 5px;
-  min-width: 500px;
-  padding: 5px 10px;
-  font-family: SFMono-Regular, Consolas, Liberation Mono, Menlo, Courier,
-    monospace;
-`;
-
-const ErrorMessage = styled.div`
-  color: ${p => p.theme.colors.error.main};
-  font-size: 15px;
-  font-weight: 500;
-`;
-
-marked.setOptions({
-  renderer: new marked.Renderer(),
-  highlight: function (code, lang) {
-    const language = highlight.getLanguage(lang) ? lang : 'plaintext';
-
-    return highlight.highlight(code, { language }).value;
-  },
-  langPrefix: 'hljs language-',
-  pedantic: false,
-  gfm: true,
-  breaks: true,
-  sanitize: false,
-  smartLists: true,
-  smartypants: false,
-  xhtml: false,
-});
-
-export function ChatItem(props: ChatItemProps) {
-  const ctx = useTeleport();
-
-  let content;
-
-  switch (props.message.content.type) {
-    case Type.Message:
-      content = (
-        <ChatItemContent
-          dangerouslySetInnerHTML={{
-            __html: DOMPurify.sanitize(
-              marked.parse(props.message.content.value)
-            ),
-          }}
-        />
-      );
-
-      break;
-
-    case Type.ExecuteRemoteCommand:
-      content = (
-        <Actions
-          scrollTextarea={props.scrollTextarea}
-          actions={props.message.content}
-          key="commands"
-          showRunButton={props.isNew}
-        />
-      );
-
-      break;
-    case Type.ExecuteCommandOutput:
-      return (
-        <Container
-          teleport={props.message.author === Author.Teleport}
-          isNew={props.isNew}
-          isFirstFromUser={props.isFirstFromUser}
-          isLastFromUser={props.isLastFromUser}
-          hasSpacing={!props.hideAvatar}
-        >
-          <Content>
-            <CommandOutput
-              key={
-                props.message.content.nodeId?.toString() +
-                props.message.content.executionId
-              }
-            >
-              <MachineName>
-                Command ran on node{' '}
-                <strong>{props.message.content.nodeId}</strong>
-              </MachineName>
-              {props.message.content.errorMsg ? (
-                <ErrorMessage>{props.message.content.errorMsg}</ErrorMessage>
-              ) : props.message.content.payload === '' ? (
-                <p>Empty output.</p>
-              ) : (
-                <Output>{props.message.content.payload}</Output>
-              )}
-            </CommandOutput>
-          </Content>
-        </Container>
-      );
-  }
-
-  let avatar = (
-    <TeleportAvatarContainer>
-      <ChatItemAvatarTeleport>
-        <ChatItemAvatarImage backgroundImage={teleport} />
-      </ChatItemAvatarTeleport>
-
-      <strong>Teleport</strong>
-
-      <Timestamp isoTimestamp={props.message.timestamp} />
-    </TeleportAvatarContainer>
-  );
-
-  if (props.message.author === Author.User) {
-    avatar = (
-      <UserAvatarContainer>
-        <ChatItemAvatarUser>
-          {ctx.storeUser.state.username.slice(0, 1).toUpperCase()}
-        </ChatItemAvatarUser>
-
-        <strong>You</strong>
-
-        <Timestamp isoTimestamp={props.message.timestamp} />
-      </UserAvatarContainer>
-    );
-  }
-
-  return (
-    <Container
-      teleport={props.message.author === Author.Teleport}
-      isNew={props.isNew}
-      isFirstFromUser={props.isFirstFromUser}
-      isLastFromUser={props.isLastFromUser}
-      hasSpacing={!props.hideAvatar}
-    >
-      <Content>{content}</Content>
-
-      {!props.hideAvatar && avatar}
-    </Container>
-  );
-}
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/styles/code.ts b/web/packages/teleport/src/Assist/Chat/ChatItem/styles/code.ts
deleted file mode 100644
index 3a657f99fd427..0000000000000
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/styles/code.ts
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import { css } from 'styled-components';
-
-export const codeCSS = css`
-  pre .hljs-comment,
-  pre .hljs-title {
-    color: #7285b7;
-  }
-
-  pre .hljs-variable,
-  pre .hljs-attribute,
-  pre .hljs-tag,
-  pre .hljs-regexp,
-  pre .hljs-ruby .constant,
-  pre .hljs-xml .tag .title,
-  pre .hljs-xml .pi,
-  pre .hljs-xml .doctype,
-  pre .hljs-html .doctype,
-  pre .hljs-css .id,
-  pre .hljs-css .class,
-  pre .hljs-css .pseudo {
-    color: #ff9da4;
-  }
-
-  pre .hljs-number,
-  pre .hljs-preprocessor,
-  pre .hljs-built_in,
-  pre .hljs-literal,
-  pre .hljs-params,
-  pre .hljs-constant {
-    color: #ffc58f;
-  }
-
-  pre .hljs-class,
-  pre .hljs-ruby .class .title,
-  pre .hljs-css .rules .attribute {
-    color: #ffeead;
-  }
-
-  pre .hljs-string,
-  pre .hljs-value,
-  pre .hljs-inheritance,
-  pre .hljs-header,
-  pre .hljs-ruby .symbol,
-  pre .hljs-xml .cdata {
-    color: #d1f1a9;
-  }
-
-  pre .hljs-css .hexcolor {
-    color: #99ffff;
-  }
-
-  pre .hljs-function,
-  pre .hljs-python .decorator,
-  pre .hljs-python .title,
-  pre .hljs-ruby .function .title,
-  pre .hljs-ruby .title .keyword,
-  pre .hljs-perl .sub,
-  pre .hljs-javascript .title,
-  pre .hljs-coffeescript .title {
-    color: #bbdaff;
-  }
-
-  pre .hljs-keyword,
-  pre .hljs-javascript .function {
-    color: #ebbbff;
-  }
-
-  pre code {
-    display: block;
-    color: white;
-    font-family: Menlo, Monaco, Consolas, monospace;
-    font-size: 14px;
-    line-height: 26px;
-    border-radius: 10px;
-  }
-`;
diff --git a/web/packages/teleport/src/Assist/Conversation/Avatar.tsx b/web/packages/teleport/src/Assist/Conversation/Avatar.tsx
new file mode 100644
index 0000000000000..02a4f9bed5808
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Conversation/Avatar.tsx
@@ -0,0 +1,72 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import styled from 'styled-components';
+
+import teleport from 'design/assets/images/icons/teleport.png';
+
+import { useTeleport } from 'teleport';
+
+export const TeleportImage = styled.div<{ backgroundImage: string }>`
+  background: url(${teleport}) no-repeat;
+  width: 22px;
+  height: 22px;
+  overflow: hidden;
+  background-size: cover;
+`;
+
+export const TeleportAvatarContainer = styled.div`
+  background: ${props => props.theme.colors.brand};
+  padding: 4px;
+  border-radius: 10px;
+  left: 0;
+  right: auto;
+  margin-right: 10px;
+`;
+
+export function TeleportAvatar() {
+  return (
+    <TeleportAvatarContainer>
+      <TeleportImage />
+    </TeleportAvatarContainer>
+  );
+}
+
+const UserAvatarContainer = styled.div`
+  width: 30px;
+  height: 30px;
+  border-radius: 10px;
+  overflow: hidden;
+  font-size: 14px;
+  font-weight: bold;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background-size: cover;
+  margin-right: 10px;
+  background: ${props => props.theme.colors.brand};
+  color: ${p => p.theme.colors.buttons.primary.text};
+`;
+
+export function UserAvatar() {
+  const ctx = useTeleport();
+
+  return (
+    <UserAvatarContainer>
+      {ctx.storeUser.state.username.slice(0, 1).toUpperCase()}
+    </UserAvatarContainer>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Conversation/CommandResultEntry.tsx b/web/packages/teleport/src/Assist/Conversation/CommandResultEntry.tsx
new file mode 100644
index 0000000000000..196d01fffdf1b
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Conversation/CommandResultEntry.tsx
@@ -0,0 +1,100 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import styled, { keyframes } from 'styled-components';
+
+interface CommandResultEntryProps {
+  nodeId: string;
+  nodeName: string;
+  output: string;
+  finished: boolean;
+  errorMessage?: string;
+}
+
+const Container = styled.div`
+  border-radius: 10px;
+  font-size: 18px;
+  position: relative;
+`;
+
+const Title = styled.div`
+  font-size: 15px;
+  font-weight: 600;
+  padding: 10px 15px;
+`;
+
+const Output = styled.pre.attrs({ 'data-scrollbar': 'default' })`
+  background: #161b22;
+  color: white;
+  padding: 10px 15px;
+  margin: 0;
+  overflow-x: auto;
+  font-family: ${p => p.theme.fonts.mono};
+  font-size: 13px;
+`;
+
+const Header = styled.div`
+  display: flex;
+  justify-content: space-between;
+  padding-right: 20px;
+`;
+
+const spin = keyframes`
+  to {
+    transform: rotate(360deg);
+  }
+`;
+
+const Spinner = styled.div`
+  width: 20px;
+  height: 20px;
+
+  &:after {
+    content: ' ';
+    display: block;
+    width: 12px;
+    height: 12px;
+    margin: 8px;
+    border-radius: 50%;
+    border: 3px solid ${p => p.theme.colors.text.main};
+    border-color: ${p => p.theme.colors.text.main} transparent
+      ${p => p.theme.colors.text.main} transparent;
+    animation: ${spin} 1.2s linear infinite;
+  }
+`;
+
+const SpinnerContainer = styled.div`
+  position: relative;
+  top: 4px;
+`;
+
+export function CommandResultEntry(props: CommandResultEntryProps) {
+  return (
+    <Container>
+      <Header>
+        <Title>Command output for {props.nodeName || props.nodeId}</Title>
+        {!props.finished && (
+          <SpinnerContainer>
+            <Spinner />
+          </SpinnerContainer>
+        )}
+      </Header>
+
+      <Output>{props.errorMessage ? props.errorMessage : props.output}</Output>
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Conversation/CommandResultSummaryEntry.tsx b/web/packages/teleport/src/Assist/Conversation/CommandResultSummaryEntry.tsx
new file mode 100644
index 0000000000000..5fb7626a8563b
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Conversation/CommandResultSummaryEntry.tsx
@@ -0,0 +1,71 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import styled from 'styled-components';
+
+import ReactMarkdown from 'react-markdown';
+import remarkGfm from 'remark-gfm';
+
+import { markdownCSS } from 'teleport/Assist/markdown';
+
+interface CommandResultSummaryEntryProps {
+  command: string;
+  summary: string;
+}
+
+const Container = styled.div`
+  border-radius: 10px;
+  position: relative;
+`;
+
+const Title = styled.div`
+  font-size: 15px;
+  font-weight: 600;
+  padding: 10px 15px;
+`;
+
+const Summary = styled.div`
+  padding: 10px 15px 0 17px;
+
+  ${markdownCSS}
+`;
+
+const Header = styled.div`
+  display: flex;
+  justify-content: space-between;
+  padding-right: 20px;
+`;
+
+export function CommandResultSummaryEntry(
+  props: CommandResultSummaryEntryProps
+) {
+  return (
+    <Container>
+      <Header>
+        <Title>
+          Summary of command execution <pre>{props.command}</pre>
+        </Title>
+      </Header>
+
+      <Summary>
+        <ReactMarkdown remarkPlugins={[remarkGfm]}>
+          {props.summary}
+        </ReactMarkdown>
+      </Summary>
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Conversation/Conversation.tsx b/web/packages/teleport/src/Assist/Conversation/Conversation.tsx
new file mode 100644
index 0000000000000..4790a7186005b
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Conversation/Conversation.tsx
@@ -0,0 +1,114 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { useState } from 'react';
+import styled from 'styled-components';
+
+import { useAssist } from 'teleport/Assist/context/AssistContext';
+import { Message } from 'teleport/Assist/Conversation/Message';
+import {
+  TypingContainer,
+  TypingDot,
+} from 'teleport/Assist/Conversation/Typing';
+import AuthnDialog from 'teleport/components/AuthnDialog';
+import { makeWebauthnAssertionResponse } from 'teleport/services/auth';
+
+const Container = styled.ul`
+  list-style: none;
+  padding: 0;
+  margin: 0;
+  flex: 1;
+  position: relative;
+`;
+
+const Loading = styled.div`
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  height: calc(100% - 10px);
+  width: inherit;
+`;
+
+export function Conversation() {
+  const {
+    cancelMfaChallenge,
+    messages,
+    mfa,
+    selectedConversationMessages,
+    sendMfaChallenge,
+  } = useAssist();
+
+  const [mfaErrorMessage, setMfaErrorMessage] = useState<string | null>(null);
+
+  if (messages.loading) {
+    return (
+      <Loading>
+        <TypingContainer>
+          <TypingDot style={{ animationDelay: '0s' }} />
+          <TypingDot style={{ animationDelay: '0.2s' }} />
+          <TypingDot style={{ animationDelay: '0.4s' }} />
+        </TypingContainer>
+      </Loading>
+    );
+  }
+
+  if (!selectedConversationMessages) {
+    return null;
+  }
+
+  const items = selectedConversationMessages.map((message, index) => (
+    <Message
+      key={index}
+      message={message}
+      lastMessage={index === selectedConversationMessages.length - 1}
+    />
+  ));
+
+  async function mfaAuthenticate() {
+    if (!window.PublicKeyCredential) {
+      const errorText =
+        'This browser does not support WebAuthn required for hardware tokens, \
+      please try the latest version of Chrome, Firefox or Safari.';
+
+      setMfaErrorMessage(errorText);
+
+      return;
+    }
+
+    try {
+      const res = await navigator.credentials.get({ publicKey: mfa.publicKey });
+      const credential = makeWebauthnAssertionResponse(res);
+
+      sendMfaChallenge(credential);
+    } catch (err) {
+      setMfaErrorMessage(err.message);
+    }
+  }
+
+  return (
+    <>
+      {mfa.prompt && (
+        <AuthnDialog
+          onContinue={mfaAuthenticate}
+          onCancel={cancelMfaChallenge}
+          errorText={mfaErrorMessage}
+        />
+      )}
+
+      <Container>{items}</Container>
+    </>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Conversation/EntryContainer.tsx b/web/packages/teleport/src/Assist/Conversation/EntryContainer.tsx
new file mode 100644
index 0000000000000..b0ffdd359f7c4
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Conversation/EntryContainer.tsx
@@ -0,0 +1,106 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { PropsWithChildren } from 'react';
+import styled, { keyframes } from 'styled-components';
+
+import { Author } from 'teleport/Assist/types';
+
+interface EntryContainerProps {
+  author: Author;
+  index: number;
+  length: number;
+  streaming: boolean;
+  lastMessage: boolean;
+  hideOverflow?: boolean;
+}
+
+const Container = styled.div<EntryContainerProps>`
+  display: flex;
+  flex-direction: column;
+  align-items: ${p =>
+    p.author === Author.Teleport ? 'flex-start' : 'flex-end'};
+  justify-content: ${p => (p.author === Author.Teleport ? '' : 'flex-end')};
+  position: relative;
+  font-size: 14px;
+  margin-bottom: 5px;
+
+  --content-overflow: ${p => (p.hideOverflow ? 'hidden' : 'visible')};
+  --content-background: ${p =>
+    p.author === Author.Teleport
+      ? p.theme.colors.levels.popout
+      : p.theme.colors.buttons.primary.default};
+  --content-color: ${p =>
+    p.author === Author.Teleport
+      ? p.theme.colors.text.main
+      : p.theme.colors.buttons.primary.text};
+  --content-border-radius: ${p =>
+    getBorderRadius(p.author === Author.Teleport, p.index, p.length)};
+`;
+
+const blink = keyframes`
+  to {
+    visibility: hidden;
+  }
+`;
+
+const Content = styled.div`
+  background: var(--content-background);
+  color: var(--content-color);
+  border-radius: var(--content-border-radius);
+  box-shadow: 0 6px 12px -2px rgba(50, 50, 93, 0.05),
+    0 3px 7px -3px rgba(0, 0, 0, 0.1);
+  max-width: 90%;
+  border: 1px solid ${p => p.theme.colors.spotBackground[1]};
+  overflow: var(--content-overflow);
+
+  &.streaming {
+    > div > :not(ol):not(ul):not(pre):last-child:after,
+    > div > ol:last-child li:last-child:after,
+    > div > pre:last-child code:after,
+    > div > ul:last-child li:last-child:after {
+      animation: ${blink} 1s steps(5, start) infinite;
+      content: '▋';
+      margin-left: 0.25rem;
+      vertical-align: baseline;
+      opacity: 0.8;
+    }
+  }
+`;
+
+export function EntryContainer(props: PropsWithChildren<EntryContainerProps>) {
+  const authorIsTeleport = props.author === Author.Teleport;
+  const streaming = props.streaming && props.lastMessage && authorIsTeleport;
+
+  return (
+    <Container {...props}>
+      <Content className={streaming ? 'streaming' : null}>
+        {props.children}
+      </Content>
+    </Container>
+  );
+}
+
+function getBorderRadius(isTeleport: boolean, index: number, length: number) {
+  const isLast = index === length - 1;
+  const isFirst = index === 0;
+
+  if (isTeleport) {
+    return `${isFirst ? '14px' : '5px'} 14px 14px ${isLast ? '14px' : '5px'}`;
+  }
+
+  return `14px ${isFirst ? '14px' : '5px'} ${isLast ? '14px' : '5px'} 14px`;
+}
diff --git a/web/packages/teleport/src/Assist/Conversation/ExecuteRemoteCommandEntry.tsx b/web/packages/teleport/src/Assist/Conversation/ExecuteRemoteCommandEntry.tsx
new file mode 100644
index 0000000000000..ed062eae21cfe
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Conversation/ExecuteRemoteCommandEntry.tsx
@@ -0,0 +1,219 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { useEffect, useState } from 'react';
+import styled from 'styled-components';
+import Flex from 'design/Flex';
+
+import Select from 'shared/components/Select';
+import { ButtonPrimary, ButtonSecondary } from 'design';
+
+import { useAssist } from 'teleport/Assist/context/AssistContext';
+import { getLoginsForQuery } from 'teleport/Assist/service';
+import useStickyClusterId from 'teleport/useStickyClusterId';
+import { useUser } from 'teleport/User/UserContext';
+
+interface ExecuteRemoteCommandEntryProps {
+  command: string;
+  query: string;
+  disabled: boolean;
+}
+
+const Container = styled.div`
+  padding: 15px 15px 15px 17px;
+  width: var(--command-input-width);
+`;
+
+const StyledInput = styled.input<{ hasError: boolean }>`
+  border: 1px solid
+    ${p =>
+      p.hasError
+        ? p.theme.colors.error.main
+        : p.theme.colors.spotBackground[0]};
+  padding: 12px 15px;
+  border-radius: 5px;
+  font-family: ${p => p.theme.fonts.mono};
+  background: ${p => p.theme.colors.levels.surface};
+
+  &:disabled {
+    background: ${p => p.theme.colors.spotBackground[0]};
+  }
+
+  &:active:not(:disabled),
+  &:focus:not(:disabled) {
+    outline: none;
+    border-color: ${p => p.theme.colors.text.slightlyMuted};
+  }
+`;
+
+const QueryInput = styled(StyledInput)`
+  flex: 1;
+`;
+
+const ErrorMessage = styled.div`
+  color: ${p => p.theme.colors.error.main};
+`;
+
+const CommandInput = styled(StyledInput)`
+  width: calc(100% - 32px);
+`;
+
+const Spacer = styled.div`
+  padding: 0 10px;
+`;
+
+const InfoText = styled.span`
+  display: block;
+  font-size: 14px;
+  font-weight: 600;
+  margin: 5px 0;
+`;
+
+export function ExecuteRemoteCommandEntry(
+  props: ExecuteRemoteCommandEntryProps
+) {
+  const { preferences } = useUser();
+  const { executeCommand } = useAssist();
+
+  const [hasRan, setHasRan] = useState(false);
+  const [command, setCommand] = useState(props.command);
+  const [query, setQuery] = useState(props.query);
+  const [selectedLogin, setSelectedLogin] = useState('');
+  const [availableLogins, setAvailableLogins] = useState<string[]>([]);
+  const [errorMessage, setErrorMessage] = useState<string | null>(null);
+
+  const { clusterId } = useStickyClusterId();
+
+  async function updateAvailableLogins() {
+    if (props.disabled) {
+      return;
+    }
+
+    setErrorMessage(null);
+
+    try {
+      const logins = await getLoginsForQuery(query, clusterId);
+
+      const preferredLogin = logins.find(login =>
+        preferences.assist.preferredLogins.includes(login)
+      );
+      if (preferredLogin) {
+        setSelectedLogin(preferredLogin);
+      } else if (!selectedLogin || !logins.includes(selectedLogin)) {
+        setSelectedLogin(logins[0]);
+      }
+
+      setAvailableLogins(logins);
+    } catch (err) {
+      if (err instanceof Error) {
+        if (err.message.includes('failed to parse predicate expression')) {
+          setErrorMessage('Invalid query');
+
+          return;
+        }
+
+        setErrorMessage(err.message);
+
+        return;
+      }
+
+      setErrorMessage('Something went wrong');
+    }
+  }
+
+  useEffect(() => {
+    updateAvailableLogins();
+  }, []);
+
+  function handleQueryChange(event: React.ChangeEvent<HTMLInputElement>) {
+    setQuery(event.target.value);
+  }
+
+  function handleCommandChange(event: React.ChangeEvent<HTMLInputElement>) {
+    setCommand(event.target.value);
+  }
+
+  function handleReset() {
+    setQuery(props.query);
+    setCommand(props.command);
+    updateAvailableLogins();
+  }
+
+  const disabled =
+    errorMessage !== null || !selectedLogin || !command || props.disabled;
+
+  function handleRun() {
+    if (disabled) {
+      return;
+    }
+
+    setHasRan(true);
+    executeCommand(selectedLogin, command, query);
+  }
+
+  return (
+    <Container>
+      <InfoText style={{ marginTop: 0 }}>
+        Teleport would like to connect to
+      </InfoText>
+
+      <Flex justifyContent="space-between" alignItems="center">
+        <QueryInput
+          hasError={errorMessage !== null}
+          value={query}
+          onChange={handleQueryChange}
+          onBlur={updateAvailableLogins}
+          disabled={hasRan || props.disabled}
+        />
+
+        <Spacer>as</Spacer>
+
+        <Select
+          onChange={event => setSelectedLogin(event['value'])}
+          isDisabled={hasRan || props.disabled}
+          value={{ value: selectedLogin, label: selectedLogin }}
+          options={availableLogins.map(option => {
+            return { label: option, value: option };
+          })}
+          css={'width: 150px;'}
+        />
+      </Flex>
+
+      {errorMessage && <ErrorMessage>{errorMessage}</ErrorMessage>}
+
+      <InfoText>and run</InfoText>
+
+      <CommandInput
+        hasError={!command}
+        value={command}
+        onChange={handleCommandChange}
+        disabled={hasRan || props.disabled}
+      />
+
+      {!command && <ErrorMessage>Command is required</ErrorMessage>}
+
+      {!hasRan && !props.disabled && (
+        <Flex mt={3} justifyContent="flex-end">
+          <ButtonSecondary onClick={handleReset}>Reset</ButtonSecondary>
+
+          <ButtonPrimary ml={3} onClick={handleRun} disabled={disabled}>
+            Run
+          </ButtonPrimary>
+        </Flex>
+      )}
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Conversation/Message.tsx b/web/packages/teleport/src/Assist/Conversation/Message.tsx
new file mode 100644
index 0000000000000..effcc450df6e7
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Conversation/Message.tsx
@@ -0,0 +1,229 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import styled from 'styled-components';
+
+import { CheckIcon } from 'design/SVGIcon';
+
+import {
+  Author,
+  ConversationMessage,
+  ResolvedServerMessage,
+  ServerMessageType,
+} from 'teleport/Assist/types';
+
+import {
+  TeleportAvatar,
+  UserAvatar,
+} from 'teleport/Assist/Conversation/Avatar';
+import {
+  TypingContainer,
+  TypingDot,
+} from 'teleport/Assist/Conversation/Typing';
+import { Timestamp } from 'teleport/Assist/Conversation/Timestamp';
+import { EntryContainer } from 'teleport/Assist/Conversation/EntryContainer';
+import { MessageEntry } from 'teleport/Assist/Conversation/MessageEntry';
+import { useAssist } from 'teleport/Assist/context/AssistContext';
+import { ExecuteRemoteCommandEntry } from 'teleport/Assist/Conversation/ExecuteRemoteCommandEntry';
+import { CommandResultEntry } from 'teleport/Assist/Conversation/CommandResultEntry';
+import { CommandResultSummaryEntry } from 'teleport/Assist/Conversation/CommandResultSummaryEntry';
+
+interface MessageProps {
+  message: ConversationMessage;
+  lastMessage: boolean;
+}
+
+const Container = styled.li`
+  padding: 0 20px;
+  margin: 0 0 20px;
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+`;
+
+const Entries = styled.ul`
+  list-style: none;
+  padding: 20px 0 5px;
+  margin: 0;
+`;
+
+const Footer = styled.footer`
+  display: flex;
+  align-items: center;
+  color: ${props => props.theme.colors.text.muted};
+
+  strong {
+    display: block;
+    margin-right: 10px;
+    color: ${props => props.theme.colors.text.main};
+  }
+`;
+
+const TimestampContainer = styled.span`
+  font-size: 12px;
+`;
+
+const Thought = styled.div`
+  display: flex;
+  align-items: center;
+  margin: 10px 0;
+  font-size: 13px;
+
+  ${TypingContainer} {
+    padding: 0;
+    margin-right: 10px;
+  }
+
+  ${TypingDot} {
+    width: 5px;
+    height: 5px;
+    margin-right: 5px;
+  }
+`;
+
+const ThoughtIcon = styled.div`
+  margin-right: 10px;
+  height: 16px;
+`;
+
+function createComponentForEntry(
+  entry: ResolvedServerMessage,
+  lastMessage: boolean
+) {
+  switch (entry.type) {
+    case ServerMessageType.Assist:
+    case ServerMessageType.User:
+    case ServerMessageType.Error:
+      return <MessageEntry content={entry.message} />;
+
+    case ServerMessageType.Command:
+      return (
+        <ExecuteRemoteCommandEntry
+          command={entry.command}
+          query={entry.query}
+          disabled={!lastMessage}
+        />
+      );
+
+    case ServerMessageType.CommandResultStream:
+      return (
+        <CommandResultEntry
+          nodeId={entry.nodeId}
+          nodeName={entry.nodeName}
+          output={entry.output}
+          finished={entry.finished}
+        />
+      );
+
+    case ServerMessageType.CommandResult:
+      return (
+        <CommandResultEntry
+          nodeId={entry.nodeId}
+          nodeName={entry.nodeName}
+          output={entry.output}
+          finished={true}
+          errorMessage={entry.errorMessage}
+        />
+      );
+    case ServerMessageType.CommandResultSummary:
+      return (
+        <CommandResultSummaryEntry
+          command={entry.command}
+          summary={entry.summary}
+        />
+      );
+  }
+}
+
+export function Message(props: MessageProps) {
+  const { messages } = useAssist();
+
+  const entries = props.message.entries.map((entry, index) =>
+    entry.type === ServerMessageType.AssistThought ? (
+      <Thought key={index}>
+        {index === props.message.entries.length - 1 ? (
+          <TypingContainer>
+            <TypingDot style={{ animationDelay: '0s' }} />
+            <TypingDot style={{ animationDelay: '0.2s' }} />
+            <TypingDot style={{ animationDelay: '0.4s' }} />
+          </TypingContainer>
+        ) : (
+          <ThoughtIcon>
+            <CheckIcon size={16} fill="#34a853" />
+          </ThoughtIcon>
+        )}
+
+        {entry.message}
+      </Thought>
+    ) : (
+      <EntryContainer
+        author={props.message.author}
+        key={index}
+        index={index}
+        length={props.message.entries.length}
+        streaming={messages.streaming}
+        lastMessage={props.lastMessage}
+        hideOverflow={
+          entry.type === ServerMessageType.CommandResultStream ||
+          entry.type === ServerMessageType.CommandResult
+        }
+      >
+        {createComponentForEntry(
+          entry,
+          props.lastMessage && index === props.message.entries.length - 1
+        )}
+      </EntryContainer>
+    )
+  );
+
+  const authorIsTeleport = props.message.author === Author.Teleport;
+  const typing = authorIsTeleport && props.lastMessage && messages.streaming;
+
+  return (
+    <Container>
+      <Entries>{entries}</Entries>
+
+      <Footer
+        style={{
+          justifyContent: authorIsTeleport ? 'flex-start' : 'flex-end',
+        }}
+      >
+        {authorIsTeleport ? (
+          <>
+            <TeleportAvatar /> <strong>Teleport</strong>
+          </>
+        ) : (
+          <>
+            <UserAvatar /> <strong>You</strong>
+          </>
+        )}
+
+        {typing ? (
+          <TypingContainer>
+            <TypingDot style={{ animationDelay: '0s' }} />
+            <TypingDot style={{ animationDelay: '0.2s' }} />
+            <TypingDot style={{ animationDelay: '0.4s' }} />
+          </TypingContainer>
+        ) : (
+          <TimestampContainer>
+            <Timestamp timestamp={props.message.timestamp} />
+          </TimestampContainer>
+        )}
+      </Footer>
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Conversation/MessageEntry.tsx b/web/packages/teleport/src/Assist/Conversation/MessageEntry.tsx
new file mode 100644
index 0000000000000..0bc2170be472b
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Conversation/MessageEntry.tsx
@@ -0,0 +1,41 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import styled from 'styled-components';
+
+import ReactMarkdown from 'react-markdown';
+import remarkGfm from 'remark-gfm';
+
+import { markdownCSS } from 'teleport/Assist/markdown';
+
+interface MessageEntryProps {
+  content: string;
+}
+
+const Container = styled.div`
+  padding: 10px 15px 0 17px;
+
+  ${markdownCSS}
+`;
+
+export function MessageEntry(props: MessageEntryProps) {
+  return (
+    <Container>
+      <ReactMarkdown remarkPlugins={[remarkGfm]}>{props.content}</ReactMarkdown>
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Chat/Timestamp.tsx b/web/packages/teleport/src/Assist/Conversation/Timestamp.tsx
similarity index 90%
rename from web/packages/teleport/src/Assist/Chat/Timestamp.tsx
rename to web/packages/teleport/src/Assist/Conversation/Timestamp.tsx
index a4446581e737b..f5dbc4a8a477b 100644
--- a/web/packages/teleport/src/Assist/Chat/Timestamp.tsx
+++ b/web/packages/teleport/src/Assist/Conversation/Timestamp.tsx
@@ -19,11 +19,10 @@ import React, { useEffect, useState } from 'react';
 import { formatRelative } from 'date-fns';
 
 interface TimestampProps {
-  isoTimestamp: string;
+  timestamp: Date;
 }
 
 export function Timestamp(props: TimestampProps) {
-  const [date] = useState(() => new Date(props.isoTimestamp));
   const [, setCounter] = useState(0);
 
   useEffect(() => {
@@ -37,7 +36,11 @@ export function Timestamp(props: TimestampProps) {
     };
   }, []);
 
-  return <span title={date.toLocaleString()}>{formatDate(date)}</span>;
+  return (
+    <span title={props.timestamp.toLocaleString()}>
+      {formatDate(props.timestamp)}
+    </span>
+  );
 }
 
 function formatDate(date: Date) {
diff --git a/web/packages/teleport/src/Assist/Chat/Typing.ts b/web/packages/teleport/src/Assist/Conversation/Typing.ts
similarity index 100%
rename from web/packages/teleport/src/Assist/Chat/Typing.ts
rename to web/packages/teleport/src/Assist/Conversation/Typing.ts
diff --git a/web/packages/teleport/src/Assist/Conversation/index.ts b/web/packages/teleport/src/Assist/Conversation/index.ts
new file mode 100644
index 0000000000000..36bce8f1ec33f
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Conversation/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { Conversation } from './Conversation';
diff --git a/web/packages/teleport/src/Assist/ConversationHistory/ConversationHistory.tsx b/web/packages/teleport/src/Assist/ConversationHistory/ConversationHistory.tsx
new file mode 100644
index 0000000000000..829e47a8724b8
--- /dev/null
+++ b/web/packages/teleport/src/Assist/ConversationHistory/ConversationHistory.tsx
@@ -0,0 +1,133 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { useState } from 'react';
+import styled from 'styled-components';
+
+import { useAssist } from 'teleport/Assist/context/AssistContext';
+import { ConversationHistoryItem } from 'teleport/Assist/ConversationHistory/ConversationHistoryItem';
+import { DeleteConversationDialog } from 'teleport/Assist/ConversationHistory/DeleteConversationDialog';
+import { ViewMode } from 'teleport/Assist/types';
+
+interface ConversationHistoryProps {
+  onConversationSelect: (id: string) => void;
+  viewMode: ViewMode;
+  onError: (message: string) => void;
+}
+
+const Container = styled.ul.attrs({ 'data-scrollbar': 'default' })`
+  border-right: 1px solid ${p => p.theme.colors.spotBackground[0]};
+  display: flex;
+  flex-direction: column;
+  gap: 5px;
+  box-sizing: border-box;
+  list-style: none;
+  padding: 0;
+  width: var(--conversation-list-width);
+  margin: 0;
+  position: var(--conversation-list-position);
+  top: 0;
+  bottom: 0;
+  background: ${p => p.theme.colors.levels.popout};
+  z-index: 999;
+`;
+
+const List = styled.ul.attrs({ 'data-scrollbar': 'default' })`
+  display: flex;
+  padding: 10px 10px;
+  width: 100%;
+  flex-direction: column;
+  gap: 5px;
+  box-sizing: border-box;
+  list-style: none;
+  overflow-y: auto;
+`;
+
+function isExpanded(viewMode: ViewMode) {
+  return (
+    viewMode === ViewMode.PopupExpanded ||
+    viewMode === ViewMode.PopupExpandedSidebarVisible
+  );
+}
+
+export function ConversationHistory(props: ConversationHistoryProps) {
+  const { conversations, deleteConversation, setSelectedConversationId } =
+    useAssist();
+
+  const [deleting, setDeleting] = useState(false);
+  const [deleteErrorMessage, setDeleteErrorMessage] =
+    useState<string | null>(null);
+  const [conversationIdToDelete, setConversationIdToDelete] =
+    useState<string | null>(null);
+
+  async function handleSelectConversation(id: string) {
+    try {
+      props.onConversationSelect(id);
+
+      await setSelectedConversationId(id);
+    } catch (err) {
+      props.onError('Failed to load the conversation.');
+    }
+  }
+
+  async function handleDelete() {
+    setDeleteErrorMessage(null);
+    setDeleting(true);
+
+    try {
+      await deleteConversation(conversationIdToDelete);
+
+      setConversationIdToDelete(null);
+    } catch (err) {
+      setDeleteErrorMessage(err.message);
+    }
+
+    setDeleting(false);
+  }
+
+  const conversationToDelete = conversations.data.find(
+    conversation => conversation.id === conversationIdToDelete
+  );
+
+  const items = conversations.data.map(conversation => (
+    <ConversationHistoryItem
+      key={conversation.id}
+      conversation={conversation}
+      active={
+        conversations.selectedId === conversation.id &&
+        isExpanded(props.viewMode) // avoid showing a background color when the sidebar is a separate view (collapsed & docked)
+      }
+      onSelect={() => handleSelectConversation(conversation.id)}
+      onDelete={() => setConversationIdToDelete(conversation.id)}
+    />
+  ));
+
+  return (
+    <Container>
+      {conversationIdToDelete && (
+        <DeleteConversationDialog
+          conversationTitle={conversationToDelete?.title || ''}
+          onDelete={handleDelete}
+          onClose={() => setConversationIdToDelete(null)}
+          disabled={deleting}
+          error={deleteErrorMessage}
+        />
+      )}
+
+      <List>{items}</List>
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/ConversationHistory/ConversationHistoryItem.tsx b/web/packages/teleport/src/Assist/ConversationHistory/ConversationHistoryItem.tsx
new file mode 100644
index 0000000000000..9803f4f126d00
--- /dev/null
+++ b/web/packages/teleport/src/Assist/ConversationHistory/ConversationHistoryItem.tsx
@@ -0,0 +1,106 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import styled from 'styled-components';
+
+import { CloseIcon } from 'design/SVGIcon';
+
+import type { Conversation } from 'teleport/Assist/types';
+
+interface ConversationHistoryItemProps {
+  conversation: Conversation;
+  active: boolean;
+  onSelect: () => void;
+  onDelete: (id: string) => void;
+}
+
+const Buttons = styled.div`
+  position: absolute;
+  right: 5px;
+  top: 0;
+  bottom: 0;
+  display: none;
+  align-items: center;
+  justify-content: center;
+`;
+
+const Container = styled.li<{ active: boolean }>`
+  margin: 0;
+  padding: 5px 11px;
+  display: flex;
+  position: relative;
+  justify-content: space-between;
+  border-radius: 5px;
+  cursor: pointer;
+  background: ${p => (p.active ? p.theme.colors.spotBackground[0] : 'none')};
+
+  &:hover {
+    background: ${p => p.theme.colors.spotBackground[0]};
+    padding-right: 36px;
+
+    ${Buttons} {
+      display: flex;
+    }
+  }
+
+  --title-weight: ${p => (p.active ? 600 : 400)};
+`;
+
+const Title = styled.h3`
+  margin: 0;
+  font-weight: var(--title-weight);
+  font-size: 15px;
+  overflow: hidden;
+  white-space: nowrap;
+  text-overflow: ellipsis;
+`;
+
+const DeleteButton = styled.div`
+  cursor: pointer;
+  padding: 5px 5px 0;
+  background: ${p => p.theme.colors.spotBackground[0]};
+  border-radius: 7px;
+
+  &:hover {
+    background: ${p => p.theme.colors.error.main};
+
+    svg path {
+      stroke: white;
+    }
+  }
+`;
+
+export function ConversationHistoryItem(props: ConversationHistoryItemProps) {
+  function handleDelete(event: React.MouseEvent<HTMLDivElement>) {
+    event.preventDefault();
+    event.stopPropagation();
+
+    props.onDelete(props.conversation.id);
+  }
+
+  return (
+    <Container active={props.active} onClick={props.onSelect}>
+      <Title>{props.conversation.title}</Title>
+
+      <Buttons>
+        <DeleteButton onClick={handleDelete}>
+          <CloseIcon size={16} />
+        </DeleteButton>
+      </Buttons>
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Sidebar/DeleteConversationDialog.tsx b/web/packages/teleport/src/Assist/ConversationHistory/DeleteConversationDialog.tsx
similarity index 100%
rename from web/packages/teleport/src/Assist/Sidebar/DeleteConversationDialog.tsx
rename to web/packages/teleport/src/Assist/ConversationHistory/DeleteConversationDialog.tsx
index 720ee814dfcfa..73fff1fa69dd2 100644
--- a/web/packages/teleport/src/Assist/Sidebar/DeleteConversationDialog.tsx
+++ b/web/packages/teleport/src/Assist/ConversationHistory/DeleteConversationDialog.tsx
@@ -45,6 +45,7 @@ export function DeleteConversationDialog(props: DeleteConversationDialogProps) {
       <DialogHeader>
         <DialogTitle>Are you sure?</DialogTitle>
       </DialogHeader>
+      {props.error && <Danger>{props.error}</Danger>}
       <DialogContent width="400px">
         <p style={{ margin: 0 }}>
           You are about to delete the conversation{' '}
@@ -54,7 +55,6 @@ export function DeleteConversationDialog(props: DeleteConversationDialogProps) {
           You will not be able to access the conversation afterwards.
         </p>
       </DialogContent>
-      {props.error && <Danger>{props.error}</Danger>}
       <DialogFooter>
         <ButtonPrimary
           disabled={props.disabled}
diff --git a/web/packages/teleport/src/Assist/ConversationHistory/index.ts b/web/packages/teleport/src/Assist/ConversationHistory/index.ts
new file mode 100644
index 0000000000000..f89646cae42a7
--- /dev/null
+++ b/web/packages/teleport/src/Assist/ConversationHistory/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { ConversationHistory } from './ConversationHistory';
diff --git a/web/packages/teleport/src/Assist/ConversationList/ConversationList.tsx b/web/packages/teleport/src/Assist/ConversationList/ConversationList.tsx
new file mode 100644
index 0000000000000..314ca4cece4a0
--- /dev/null
+++ b/web/packages/teleport/src/Assist/ConversationList/ConversationList.tsx
@@ -0,0 +1,89 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { useEffect, useLayoutEffect, useRef } from 'react';
+import styled from 'styled-components';
+
+import { Conversation } from 'teleport/Assist/Conversation';
+import { useAssist } from 'teleport/Assist/context/AssistContext';
+import { MessageBox } from 'teleport/Assist/MessageBox';
+import { LandingPage } from 'teleport/Assist/LandingPage';
+import { ViewMode } from 'teleport/Assist/types';
+
+interface ConversationListProps {
+  viewMode: ViewMode;
+}
+
+const Container = styled.div.attrs({ 'data-scrollbar': 'default' })`
+  flex: 1 1 auto;
+  overflow-y: auto;
+
+  &:after {
+    content: '';
+    display: block;
+    height: 10px;
+    width: 100%;
+  }
+`;
+
+export function ConversationList(props: ConversationListProps) {
+  const ref = useRef<HTMLDivElement>();
+
+  const scrolling = useRef<boolean>(false);
+
+  const { conversations, selectedConversationMessages } = useAssist();
+
+  function scroll() {
+    scrolling.current = true;
+
+    ref.current.scrollIntoView({ behavior: 'smooth' });
+
+    window.setTimeout(() => (scrolling.current = false), 1000);
+  }
+
+  useEffect(() => {
+    if (!ref.current || scrolling.current) {
+      return;
+    }
+
+    scroll();
+  }, [selectedConversationMessages, scrolling.current]);
+
+  useLayoutEffect(() => {
+    if (!ref.current || scrolling.current) {
+      return;
+    }
+
+    const id = window.setTimeout(scroll, 500);
+
+    return () => window.clearTimeout(id);
+  }, [props.viewMode, scrolling.current]);
+
+  if (!conversations.selectedId) {
+    return <LandingPage />;
+  }
+
+  return (
+    <>
+      <Container>
+        <Conversation />
+
+        <div ref={ref} />
+      </Container>
+      <MessageBox errorMessage={null} />
+    </>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/ConversationList/index.ts b/web/packages/teleport/src/Assist/ConversationList/index.ts
new file mode 100644
index 0000000000000..bdc7f2756f6c1
--- /dev/null
+++ b/web/packages/teleport/src/Assist/ConversationList/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { ConversationList } from './ConversationList';
diff --git a/web/packages/teleport/src/Assist/Dots.tsx b/web/packages/teleport/src/Assist/Dots.tsx
deleted file mode 100644
index 05646f72bd3fc..0000000000000
--- a/web/packages/teleport/src/Assist/Dots.tsx
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import styled, { keyframes } from 'styled-components';
-
-const loader = keyframes`
-  0% {
-    transform: translateX(0);
-  }
-  50% {
-    transform: translateX(1420%);
-  }
-  100% {
-    transform: translateX(0);
-  }
-`;
-
-const DotsContainer = styled.div`
-  position: relative;
-  width: 100%;
-  padding-top: 6.6%;
-`;
-
-const Container = styled.div`
-  box-sizing: border-box;
-  width: 100px;
-  height: 5px;
-
-  *,
-  *:before,
-  *:after {
-    box-sizing: inherit;
-  }
-`;
-
-const Dot = styled.div`
-  width: 6.6%;
-  padding-top: 6.6%;
-  animation: ${loader} 2s ease-in-out infinite;
-  border-radius: 100%;
-  display: inline-block;
-  position: absolute;
-  top: 0;
-  left: 0;
-`;
-
-export function Dots() {
-  let dots = new Array(6).fill('').map((e, index) => {
-    return (
-      <Dot
-        key={index}
-        style={{
-          backgroundColor: 'white',
-          opacity: 0.5,
-          animationDelay: `0.${index}s`,
-        }}
-      ></Dot>
-    );
-  });
-
-  return (
-    <Container>
-      <DotsContainer>{dots}</DotsContainer>
-    </Container>
-  );
-}
diff --git a/web/packages/teleport/src/Assist/ErrorBanner/ErrorBanner.tsx b/web/packages/teleport/src/Assist/ErrorBanner/ErrorBanner.tsx
new file mode 100644
index 0000000000000..b7ff443bb1c62
--- /dev/null
+++ b/web/packages/teleport/src/Assist/ErrorBanner/ErrorBanner.tsx
@@ -0,0 +1,110 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { PropsWithChildren, useState } from 'react';
+import styled, { keyframes } from 'styled-components';
+
+import { CloseIcon, ErrorIcon } from 'design/SVGIcon';
+
+interface ErrorBannerProps {
+  onDismiss: () => void;
+}
+
+const appear = keyframes`
+  to {
+    opacity: 1;
+  }
+`;
+
+const disappear = keyframes`
+  to {
+    opacity: 0;
+  }
+`;
+
+const Container = styled.div`
+  position: relative;
+  border-top: 2px solid ${props => props.theme.colors.error.main};
+  border-bottom: 2px solid ${props => props.theme.colors.error.main};
+  padding: 5px 45px 5px 10px;
+  display: flex;
+  align-items: center;
+  color: ${props => props.theme.colors.error.active};
+  opacity: ${p => (p.hiding ? 1 : 0)};
+  animation: ${p => (p.hiding ? disappear : appear)} 0.5s ease-in-out forwards;
+
+  & + & {
+    border-top: none;
+  }
+`;
+
+const ErrorIconContainer = styled.div`
+  display: flex;
+  align-items: center;
+
+  svg {
+    margin-right: 10px;
+  }
+
+  svg path {
+    fill: ${props => props.theme.colors.error.active};
+  }
+`;
+
+const CloseButton = styled.div`
+  position: absolute;
+  top: 50%;
+  right: 5px;
+  transform: translateY(-50%);
+  cursor: pointer;
+  padding: 5px;
+  border-radius: 5px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 999;
+
+  &:hover {
+    background: ${p => p.theme.colors.spotBackground[0]};
+  }
+
+  svg path {
+    stroke: ${p => p.theme.colors.text.main};
+  }
+`;
+
+export function ErrorBanner(props: PropsWithChildren<ErrorBannerProps>) {
+  const [hiding, setHiding] = useState(false);
+
+  function handleClose() {
+    setHiding(true);
+    setTimeout(() => props.onDismiss(), 500);
+  }
+
+  return (
+    <Container hiding={hiding}>
+      <ErrorIconContainer>
+        <ErrorIcon size={18} />
+      </ErrorIconContainer>
+
+      {props.children}
+
+      <CloseButton onClick={handleClose}>
+        <CloseIcon size={18} />
+      </CloseButton>
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/ErrorBanner/ErrorList.tsx b/web/packages/teleport/src/Assist/ErrorBanner/ErrorList.tsx
new file mode 100644
index 0000000000000..84a53391194f4
--- /dev/null
+++ b/web/packages/teleport/src/Assist/ErrorBanner/ErrorList.tsx
@@ -0,0 +1,23 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import styled from 'styled-components';
+
+export const ErrorList = styled.div`
+  transition: height 0.3s ease-in-out;
+  margin-top: -1px; // cover up the header's bottom border
+  height: ${p => 2 + p.children.length * 36}px;
+`;
diff --git a/web/packages/teleport/src/Assist/ErrorBanner/index.ts b/web/packages/teleport/src/Assist/ErrorBanner/index.ts
new file mode 100644
index 0000000000000..687dccfb80709
--- /dev/null
+++ b/web/packages/teleport/src/Assist/ErrorBanner/index.ts
@@ -0,0 +1,18 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { ErrorBanner } from './ErrorBanner';
+export { ErrorList } from './ErrorList';
diff --git a/web/packages/teleport/src/Assist/Header/Header.tsx b/web/packages/teleport/src/Assist/Header/Header.tsx
new file mode 100644
index 0000000000000..25da1180b1509
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Header/Header.tsx
@@ -0,0 +1,126 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import styled from 'styled-components';
+
+import {
+  CloseIcon,
+  ConversationListIcon,
+  PlusIcon,
+  SettingsIcon,
+} from 'design/SVGIcon';
+
+import { useAssist } from 'teleport/Assist/context/AssistContext';
+import { Tooltip } from 'teleport/Assist/shared/Tooltip';
+import { ViewMode } from 'teleport/Assist/types';
+import { HeaderIcon } from 'teleport/Assist/shared';
+
+interface HeaderProps {
+  viewMode: ViewMode;
+  sidebarVisible: boolean;
+  onClose: () => void;
+  onToggleSidebar: () => void;
+  onSettingsOpen: () => void;
+  onError: (message: string) => void;
+}
+
+const Container = styled.header`
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 10px 15px;
+  border-bottom: 1px solid ${p => p.theme.colors.spotBackground[0]};
+  user-select: none;
+  flex: 0 0 var(--assist-header-height);
+  box-sizing: border-box;
+  position: relative;
+  z-index: 9999;
+`;
+
+const Icons = styled.section`
+  display: flex;
+  align-items: center;
+  flex: 0 0 100px;
+`;
+
+const Title = styled.h2`
+  margin: 0;
+  font-size: 16px;
+  white-space: nowrap;
+  text-overflow: ellipsis;
+  overflow: hidden;
+`;
+
+const ConversationListIconWrapper = styled.div`
+  position: relative;
+  top: 5.5px; // align with the plus icon
+`;
+
+export function Header(props: HeaderProps) {
+  const {
+    conversations: { selectedId, data },
+    createConversation,
+  } = useAssist();
+
+  const title = selectedId
+    ? data.find(conversation => conversation.id === selectedId)?.title
+    : 'Teleport Assist';
+
+  async function handleCreateNewConversation() {
+    try {
+      await createConversation();
+    } catch (err) {
+      props.onError('There was an error creating a new conversation.');
+    }
+  }
+
+  return (
+    <Container>
+      <Icons>
+        <HeaderIcon onClick={props.onToggleSidebar}>
+          <ConversationListIconWrapper>
+            <ConversationListIcon size={22} />
+          </ConversationListIconWrapper>
+
+          <Tooltip>
+            {props.sidebarVisible ? 'Close' : 'Open'} conversation history
+          </Tooltip>
+        </HeaderIcon>
+        <HeaderIcon onClick={handleCreateNewConversation}>
+          <PlusIcon size={22} />
+
+          <Tooltip>Start a new conversation</Tooltip>
+        </HeaderIcon>
+      </Icons>
+
+      <Title>{title}</Title>
+
+      <Icons style={{ justifyContent: 'flex-end' }}>
+        <HeaderIcon onClick={props.onSettingsOpen}>
+          <SettingsIcon size={18} />
+
+          <Tooltip position="middle">Open settings</Tooltip>
+        </HeaderIcon>
+        <HeaderIcon onClick={() => props.onClose()}>
+          <CloseIcon size={24} />
+
+          <Tooltip position="right">Hide Assist</Tooltip>
+        </HeaderIcon>
+      </Icons>
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Header/index.ts b/web/packages/teleport/src/Assist/Header/index.ts
new file mode 100644
index 0000000000000..e04a14e7a6842
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Header/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { Header } from './Header';
diff --git a/web/packages/teleport/src/Assist/LandingPage.tsx b/web/packages/teleport/src/Assist/LandingPage/LandingPage.tsx
similarity index 76%
rename from web/packages/teleport/src/Assist/LandingPage.tsx
rename to web/packages/teleport/src/Assist/LandingPage/LandingPage.tsx
index 117f74a868ac8..5cc09aee94c18 100644
--- a/web/packages/teleport/src/Assist/LandingPage.tsx
+++ b/web/packages/teleport/src/Assist/LandingPage/LandingPage.tsx
@@ -1,20 +1,20 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import React, { useCallback } from 'react';
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
 import styled, { useTheme } from 'styled-components';
 
 import {
@@ -25,28 +25,23 @@ import {
   ServerIcon,
 } from 'design/SVGIcon';
 
-import { useHistory } from 'react-router';
-
 import Flex from 'design/Flex';
 
 import Link from 'design/Link';
 
-import cfg from 'teleport/config';
-import { useConversations } from 'teleport/Assist/contexts/conversations';
+import { useAssist } from 'teleport/Assist/context/AssistContext';
 
 const Container = styled.div`
   display: flex;
-  flex: 1;
   justify-content: center;
 `;
 
 const Content = styled.div`
   background: ${p => p.theme.colors.levels.popout};
   color: ${p => p.theme.colors.text.main};
-  font-size: 15px;
+  font-size: 14px;
   padding: 20px 25px;
   border-radius: 7px;
-  margin-top: 50px;
   width: 700px;
 `;
 
@@ -116,15 +111,7 @@ const NewChatButton = styled.div`
 export function LandingPage() {
   const theme = useTheme();
 
-  const history = useHistory();
-
-  const { create } = useConversations();
-
-  const handleNewChat = useCallback(() => {
-    create().then(conversationId =>
-      history.push(cfg.getAssistConversationUrl(conversationId))
-    );
-  }, []);
+  const { createConversation } = useAssist();
 
   return (
     <Container>
@@ -185,7 +172,7 @@ export function LandingPage() {
         </Features>
 
         <Flex justifyContent="center">
-          <NewChatButton onClick={() => handleNewChat()}>
+          <NewChatButton onClick={() => createConversation()}>
             <PlusIcon size={16} fill={theme.colors.buttons.primary.text} />
             Start a new conversation
           </NewChatButton>
diff --git a/web/packages/teleport/src/Assist/LandingPage/index.ts b/web/packages/teleport/src/Assist/LandingPage/index.ts
new file mode 100644
index 0000000000000..572eb3a5bd638
--- /dev/null
+++ b/web/packages/teleport/src/Assist/LandingPage/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { LandingPage } from './LandingPage';
diff --git a/web/packages/teleport/src/Assist/Chat/ChatBox/ChatBox.tsx b/web/packages/teleport/src/Assist/MessageBox/MessageBox.tsx
similarity index 64%
rename from web/packages/teleport/src/Assist/Chat/ChatBox/ChatBox.tsx
rename to web/packages/teleport/src/Assist/MessageBox/MessageBox.tsx
index 4c4c3e97ee41b..c75c93fb9344e 100644
--- a/web/packages/teleport/src/Assist/Chat/ChatBox/ChatBox.tsx
+++ b/web/packages/teleport/src/Assist/MessageBox/MessageBox.tsx
@@ -18,21 +18,52 @@ import React, {
   ChangeEvent,
   KeyboardEvent,
   useEffect,
+  useLayoutEffect,
   useRef,
   useState,
 } from 'react';
-import styled from 'styled-components';
+import styled, { keyframes } from 'styled-components';
 
-import { useMessages } from 'teleport/Assist/contexts/messages';
+import { useAssist } from 'teleport/Assist/context/AssistContext';
 
-interface ChatBoxProps {
+const spin = keyframes`
+  to {
+    transform: rotate(360deg);
+  }
+`;
+
+interface MessageBoxProps {
   disabled?: boolean;
-  onSubmit: (value: string) => void;
   errorMessage: string | null;
 }
 
 const Container = styled.div`
-  padding: 0 30px 30px;
+  padding: 0 15px var(--assist-bottom-padding) 15px;
+  position: relative;
+`;
+
+const Spinner = styled.div`
+  width: 20px;
+  height: 20px;
+
+  &:after {
+    content: ' ';
+    display: block;
+    width: 12px;
+    height: 12px;
+    margin: 8px;
+    border-radius: 50%;
+    border: 3px solid ${p => p.theme.colors.text.main};
+    border-color: ${p => p.theme.colors.text.main} transparent
+      ${p => p.theme.colors.text.main} transparent;
+    animation: ${spin} 1.2s linear infinite;
+  }
+`;
+
+const SpinnerContainer = styled.div`
+  position: absolute;
+  top: 12px;
+  right: 40px;
 `;
 
 const TextArea = styled.textarea`
@@ -42,10 +73,11 @@ const TextArea = styled.textarea`
   border: 2px solid ${props => props.theme.colors.spotBackground[1]};
   border-radius: 10px;
   resize: none;
-  padding: 20px 20px 5px 30px;
-  font-size: 16px;
-  line-height: 24px;
+  padding: 17px 20px 1px 20px;
+  font-size: 14px;
+  line-height: 18px;
   box-sizing: border-box;
+  overflow-y: hidden;
 
   &:focus {
     outline: none;
@@ -63,11 +95,11 @@ const ErrorMessage = styled.div`
   margin-bottom: 5px;
 `;
 
-export function ChatBox(props: ChatBoxProps) {
+export function MessageBox(props: MessageBoxProps) {
   const [value, setValue] = useState('');
   const ref = useRef<HTMLTextAreaElement>(null);
 
-  const { responding } = useMessages();
+  const { conversations, messages, sendMessage } = useAssist();
 
   useEffect(() => {
     if (ref.current) {
@@ -82,7 +114,13 @@ export function ChatBox(props: ChatBoxProps) {
     if (ref.current) {
       ref.current.focus();
     }
-  }, [props.disabled]);
+  }, [props.disabled, ref.current]);
+
+  useLayoutEffect(() => {
+    if (ref.current) {
+      ref.current.focus();
+    }
+  }, [conversations.selectedId, ref.current]);
 
   function handleChange(event: ChangeEvent<HTMLTextAreaElement>) {
     setValue(event.target.value);
@@ -93,8 +131,8 @@ export function ChatBox(props: ChatBoxProps) {
       event.preventDefault();
       event.stopPropagation();
 
-      if (!responding && value) {
-        props.onSubmit(value);
+      if (!messages.streaming && value) {
+        sendMessage(value);
         setValue('');
       }
     }
@@ -104,6 +142,12 @@ export function ChatBox(props: ChatBoxProps) {
     <Container>
       {props.errorMessage && <ErrorMessage>{props.errorMessage}</ErrorMessage>}
 
+      {messages.streaming && (
+        <SpinnerContainer>
+          <Spinner />
+        </SpinnerContainer>
+      )}
+
       <TextArea
         disabled={props.disabled}
         ref={ref}
diff --git a/web/packages/teleport/src/Assist/MessageBox/index.ts b/web/packages/teleport/src/Assist/MessageBox/index.ts
new file mode 100644
index 0000000000000..11d8a7160cee0
--- /dev/null
+++ b/web/packages/teleport/src/Assist/MessageBox/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { MessageBox } from './MessageBox';
diff --git a/web/packages/teleport/src/Navigation/AssistTooltip.ts b/web/packages/teleport/src/Assist/Popup/Popup.ts
similarity index 73%
rename from web/packages/teleport/src/Navigation/AssistTooltip.ts
rename to web/packages/teleport/src/Assist/Popup/Popup.ts
index aa92a173039b7..3f75986fb5a8e 100644
--- a/web/packages/teleport/src/Navigation/AssistTooltip.ts
+++ b/web/packages/teleport/src/Assist/Popup/Popup.ts
@@ -18,7 +18,7 @@ import styled from 'styled-components';
 
 import teleport from 'design/assets/images/icons/teleport.png';
 
-export const TooltipLogosSpacer = styled.div`
+export const PopupLogosSpacer = styled.div`
   padding: 0 8px;
 `;
 
@@ -30,23 +30,23 @@ export const TeleportIcon = styled.div`
   filter: invert(${p => (p.light ? '100%' : '0%')});
 `;
 
-export const TooltipLogos = styled.div`
+export const PopupLogos = styled.div`
   display: flex;
   align-items: center;
 `;
 
-export const TooltipFooter = styled.div`
+export const PopupFooter = styled.div`
   margin-top: 20px;
   display: flex;
   justify-content: space-between;
   align-items: center;
 `;
 
-export const Tooltip = styled.div`
+export const Popup = styled.div`
   position: absolute;
   z-index: 100;
-  top: 150px;
-  left: 210px;
+  top: 50px;
+  right: -4px;
   background: ${({ theme }) => theme.colors.levels.popout};
   border-radius: 5px;
   width: 270px;
@@ -61,32 +61,37 @@ export const Tooltip = styled.div`
     width: 0;
     height: 0;
     border-style: solid;
-    border-width: 10px 10px 10px 0;
-    border-color: transparent ${({ theme }) => theme.colors.levels.popout}
-      transparent transparent;
-    left: -10px;
-    top: 20px;
+    border-width: 0 10px 10px 10px;
+    border-color: transparent transparent
+      ${({ theme }) => theme.colors.levels.popout} transparent;
+    right: 20px;
+    top: -10px;
   }
 `;
 
-export const TooltipTitle = styled.div`
+export const PopupTitle = styled.div`
   font-size: 18px;
   font-weight: bold;
   border-radius: 5px;
   margin-bottom: 15px;
 `;
 
-export const TooltipTitleBackground = styled.span`
+export const PopupTitleBackground = styled.span`
   background: linear-gradient(-45deg, #ee7752, #e73c7e);
   padding: 5px;
   border-radius: 5px;
   color: white;
 `;
 
-export const TooltipButton = styled.div`
+export const PopupButton = styled.div`
   cursor: pointer;
   display: inline-flex;
   border: 1px solid ${({ theme }) => theme.colors.text.slightlyMuted};
+  color: ${({ theme }) => theme.colors.buttons.text};
   border-radius: 5px;
   padding: 8px 15px;
+
+  &:hover {
+    background: ${({ theme }) => theme.colors.buttons.border.hover};
+  }
 `;
diff --git a/web/packages/teleport/src/Assist/Popup/index.ts b/web/packages/teleport/src/Assist/Popup/index.ts
new file mode 100644
index 0000000000000..4a5ba7bdd7f6b
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Popup/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { Popup } from './Popup';
diff --git a/web/packages/teleport/src/Assist/Settings/DisplaySettings.tsx b/web/packages/teleport/src/Assist/Settings/DisplaySettings.tsx
new file mode 100644
index 0000000000000..6f1d7ef50de5b
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Settings/DisplaySettings.tsx
@@ -0,0 +1,309 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import styled from 'styled-components';
+
+import logoLight from 'teleport/Navigation/logoLight.svg';
+import logoDark from 'teleport/Navigation/logoDark.svg';
+import { ViewMode } from 'teleport/Assist/types';
+import { Description, Title } from 'teleport/Assist/Settings/shared';
+
+interface DisplaySettingsProps {
+  viewMode: ViewMode;
+  onChange: (viewMode: ViewMode) => void;
+}
+
+const ViewModes = styled.div`
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
+`;
+
+const ViewModeExample = styled.div`
+  width: 200px;
+  height: 100px;
+  box-shadow: 0 2px 5px 0 rgba(0, 0, 0, 0.2);
+  border-radius: 5px;
+  position: relative;
+  overflow: hidden;
+  display: flex;
+`;
+
+const DimmedBackground = styled.div`
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  background: rgba(0, 0, 0, 0.3);
+`;
+
+const ViewModeContainer = styled.div`
+  color: ${p =>
+    p.active
+      ? p.theme.colors.buttons.primary.default
+      : p.theme.colors.text.main};
+  font-weight: ${p => (p.active ? 'bold' : 'normal')};
+  cursor: pointer;
+
+  ${ViewModeExample} {
+    border: 2px solid
+      ${p =>
+        p.active ? p.theme.colors.buttons.primary.default : 'transparent'};
+  }
+
+  &:hover ${ViewModeExample} {
+    border: 2px solid ${p => p.theme.colors.buttons.primary.default};
+  }
+`;
+
+const Assist = styled.div`
+  background: ${p => p.theme.colors.levels.popout};
+  box-shadow: 0 5px 10px 0 rgba(0, 0, 0, 0.3);
+  position: absolute;
+  overflow: hidden;
+`;
+
+const Chat = styled.div`
+  display: flex;
+  flex-direction: column;
+  padding: 5px;
+`;
+
+const Message = styled.div`
+  height: 6px;
+  flex: 0 0 6px;
+  margin-bottom: 5px;
+  background: ${p =>
+    p.author === 'teleport'
+      ? p.theme.colors.levels.popout
+      : p.theme.colors.buttons.primary.default};
+  align-self: ${p => (p.author === 'teleport' ? 'flex-start' : 'flex-end')};
+  border-radius: 5px;
+  border: 1px solid ${p => p.theme.colors.spotBackground[1]};
+`;
+
+const PopupAssist = styled(Assist)`
+  top: 10px;
+  right: 10px;
+  width: 60px;
+  height: 60px;
+  border-radius: 7px;
+`;
+
+const ExpandedAssist = styled(Assist)`
+  top: 10px;
+  right: 10px;
+  width: 120px;
+  height: 80px;
+  border-radius: 7px;
+  display: flex;
+
+  ${Chat} {
+    flex: 1;
+  }
+`;
+
+const DockedAssist = styled(Assist)`
+  position: static;
+  box-shadow: none;
+  border-left: 1px solid ${p => p.theme.colors.spotBackground[1]};
+  flex: 0 0 60px;
+`;
+
+const Conversation = styled.div`
+  height: 7px;
+  margin-bottom: 5px;
+  background: ${p => p.theme.colors.spotBackground[1]};
+  border-radius: 3px;
+`;
+
+const Sidebar = styled.div`
+  flex: 0 0 30px;
+  padding: 5px;
+  border-right: 1px solid ${p => p.theme.colors.spotBackground[1]};
+`;
+
+const Page = styled.div`
+  display: flex;
+  background: ${p => p.theme.colors.levels.sunken};
+  height: inherit;
+  flex: 1;
+`;
+
+const PageNavigation = styled.div`
+  background: ${p => p.theme.colors.levels.surface};
+  flex: 0 0 45px;
+  height: inherit;
+  box-shadow: 0px 2px 1px -1px rgba(0, 0, 0, 0.2),
+    0px 1px 1px rgba(0, 0, 0, 0.14), 0px 1px 3px rgba(0, 0, 0, 0.12);
+`;
+
+const NavigationLogo = styled.div`
+  background: url(${p => (p.theme.name === 'light' ? logoLight : logoDark)})
+    no-repeat;
+  background-size: contain;
+  width: 36px;
+  height: 32px;
+  margin-top: 5px;
+  margin-left: 5px;
+`;
+
+const PageContent = styled.div`
+  flex: 1;
+`;
+
+const PageHeader = styled.div`
+  height: 15px;
+  border-bottom: 1px solid ${p => p.theme.colors.spotBackground[0]};
+`;
+
+const PageTitle = styled.div`
+  font-size: 8px;
+  line-height: 10px;
+  margin-bottom: 5px;
+  color: ${p => p.theme.colors.text.main};
+  font-weight: 400;
+`;
+
+const PagePadding = styled.div`
+  padding: 5px;
+`;
+
+const PageTable = styled.div`
+  background: ${p => p.theme.colors.levels.surface};
+  width: 100%;
+  height: 40px;
+  border-radius: 3px;
+  box-shadow: 0px 2px 1px -1px rgba(0, 0, 0, 0.1),
+    0px 1px 1px rgba(0, 0, 0, 0.07), 0px 1px 3px rgba(0, 0, 0, 0.06);
+`;
+
+function MockPage() {
+  return (
+    <Page>
+      <PageNavigation>
+        <NavigationLogo />
+      </PageNavigation>
+
+      <PageContent>
+        <PageHeader />
+
+        <PagePadding>
+          <PageTitle>Servers</PageTitle>
+
+          <PageTable></PageTable>
+        </PagePadding>
+      </PageContent>
+    </Page>
+  );
+}
+
+function MockChat() {
+  return (
+    <Chat>
+      <Message author="teleport" style={{ width: '25px' }} />
+      <Message author="user" style={{ width: '20px' }} />
+      <Message author="teleport" style={{ width: '35px' }} />
+      <Message author="teleport" style={{ width: '15px' }} />
+      <Message author="user" style={{ width: '30px' }} />
+      <Message author="teleport" style={{ width: '25px' }} />
+      <Message author="user" style={{ width: '27px' }} />
+      <Message author="teleport" style={{ width: '32px' }} />
+    </Chat>
+  );
+}
+
+export function DisplaySettings(props: DisplaySettingsProps) {
+  return (
+    <div>
+      <Title>View Mode</Title>
+
+      <Description>
+        Choose how you want Assist to be shown on your screen.
+      </Description>
+
+      <ViewModes>
+        <ViewModeContainer
+          active={props.viewMode === ViewMode.Popup}
+          onClick={() => props.onChange(ViewMode.Popup)}
+        >
+          <ViewModeExample>
+            <DimmedBackground />
+
+            <MockPage />
+
+            <PopupAssist>
+              <MockChat />
+            </PopupAssist>
+          </ViewModeExample>
+          Popup
+        </ViewModeContainer>
+        <ViewModeContainer
+          active={props.viewMode === ViewMode.Docked}
+          onClick={() => props.onChange(ViewMode.Docked)}
+        >
+          <ViewModeExample>
+            <MockPage />
+
+            <DockedAssist>
+              <MockChat />
+            </DockedAssist>
+          </ViewModeExample>
+          Docked
+        </ViewModeContainer>
+        <ViewModeContainer
+          active={props.viewMode === ViewMode.PopupExpanded}
+          onClick={() => props.onChange(ViewMode.PopupExpanded)}
+        >
+          <ViewModeExample>
+            <DimmedBackground />
+
+            <MockPage />
+
+            <ExpandedAssist>
+              <MockChat />
+            </ExpandedAssist>
+          </ViewModeExample>
+          Expanded popup
+        </ViewModeContainer>
+        <ViewModeContainer
+          active={props.viewMode === ViewMode.PopupExpandedSidebarVisible}
+          onClick={() => props.onChange(ViewMode.PopupExpandedSidebarVisible)}
+        >
+          <ViewModeExample>
+            <DimmedBackground />
+
+            <MockPage />
+
+            <ExpandedAssist>
+              <Sidebar>
+                <Conversation />
+                <Conversation />
+                <Conversation />
+                <Conversation />
+              </Sidebar>
+
+              <MockChat />
+            </ExpandedAssist>
+          </ViewModeExample>
+          Expanded popup with sidebar
+        </ViewModeContainer>
+      </ViewModes>
+    </div>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Settings/RemoteExecutionSettings.tsx b/web/packages/teleport/src/Assist/Settings/RemoteExecutionSettings.tsx
new file mode 100644
index 0000000000000..fd879a551bfe0
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Settings/RemoteExecutionSettings.tsx
@@ -0,0 +1,224 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { useEffect, useRef, useState } from 'react';
+import styled from 'styled-components';
+
+import Select, { Option } from 'shared/components/Select';
+import { CloseIcon } from 'design/SVGIcon';
+
+import { DraggableList } from 'design/DraggableList';
+
+import { Description, Title } from 'teleport/Assist/Settings/shared';
+
+import { getNodesFromQuery } from 'teleport/Assist/service';
+import useStickyClusterId from 'teleport/useStickyClusterId';
+
+import type { Node } from 'teleport/services/nodes/types';
+
+interface RemoteExecutionSettingsProps {
+  preferredLogins: string[];
+  onChange: (preferredLogins: string[]) => void;
+}
+
+const Login = styled.div`
+  display: flex;
+  justify-content: space-between;
+  background: ${p => p.theme.colors.spotBackground[0]};
+  width: 420px;
+  padding: 10px 15px;
+  border-radius: 5px;
+  overflow: hidden;
+  user-select: none;
+  cursor: grab;
+  position: relative;
+  height: 40px;
+  box-sizing: border-box;
+`;
+
+const DeleteButton = styled.div`
+  cursor: pointer;
+  padding: 10px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: ${p => p.theme.colors.spotBackground[0]};
+  position: absolute;
+  right: 0;
+  top: 0;
+  bottom: 0;
+
+  &:hover {
+    background: ${p => p.theme.colors.error.main};
+
+    svg path {
+      stroke: white;
+    }
+  }
+`;
+
+const ErrorMessage = styled.div`
+  color: ${p => p.theme.colors.error.main};
+`;
+
+const Loading = styled.div`
+  color: ${props => props.theme.colors.text.muted};
+`;
+
+const LoginContainer = styled.div`
+  height: 50px;
+`;
+
+function getLoginsForNodes(nodes: Node[]) {
+  const logins = new Set<string>();
+
+  for (const node of nodes) {
+    for (const login of node.sshLogins) {
+      logins.add(login);
+    }
+  }
+
+  return Array.from(logins);
+}
+
+export function RemoteExecutionSettings(props: RemoteExecutionSettingsProps) {
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState(false);
+  const [logins, setLogins] = useState(props.preferredLogins);
+  const [, setCount] = useState(0);
+
+  const order = useRef<number[]>(logins.map((_, index) => index));
+
+  const [options, setOptions] = useState<Option[]>([]);
+
+  const { clusterId } = useStickyClusterId();
+
+  async function fetchLogins() {
+    try {
+      const { agents } = await getNodesFromQuery('', clusterId);
+
+      const logins = getLoginsForNodes(agents)
+        .filter(login => !props.preferredLogins.includes(login))
+        .map(login => ({ label: login, value: login }));
+
+      setOptions(logins);
+    } catch {
+      setError(true);
+    }
+
+    setLoading(false);
+  }
+
+  useEffect(() => {
+    fetchLogins();
+  }, []);
+
+  const loginsByOrder = order.current.map(index => logins[index]);
+
+  function handleReorder(newOrder: number[]) {
+    order.current = newOrder;
+
+    props.onChange(order.current.map(index => logins[index]));
+
+    // force a re-render to update the number prefixed to the login (1., 2., etc.)
+    setCount(count => count + 1);
+  }
+
+  function onChangeOption(e: Option) {
+    const newLogins = [...logins, e.value];
+
+    order.current = [...order.current, newLogins.length - 1];
+
+    setOptions(options.filter(o => o.value !== e.value));
+    setLogins(newLogins);
+
+    props.onChange(order.current.map(index => newLogins[index]));
+  }
+
+  function handleRemove(login: string) {
+    const newLogins = logins.filter(l => l !== login);
+
+    order.current = newLogins.map((_, index) => index);
+
+    setLogins(newLogins);
+    setOptions([...options, { label: login, value: login }]);
+
+    props.onChange(order.current.map(index => newLogins[index]));
+  }
+
+  let content;
+  if (error) {
+    content = (
+      <ErrorMessage>
+        There was an issue fetching the available logins.
+      </ErrorMessage>
+    );
+  } else if (loading) {
+    content = <Loading>Loading logins...</Loading>;
+  } else {
+    content = (
+      <>
+        <div style={{ marginBottom: 20 }}>
+          <Select
+            placeholder="Select a login to add..."
+            value={null}
+            onChange={onChangeOption}
+            options={options}
+            hasError={false}
+            maxMenuHeight={400}
+            isSearchable
+            isSimpleValue={false}
+            isClearable={false}
+          />
+        </div>
+
+        <DraggableList onOrderChange={handleReorder}>
+          {logins.map(item => (
+            <LoginContainer key={item}>
+              <Login>
+                <div>
+                  {loginsByOrder.indexOf(item) + 1}. {item}
+                </div>
+
+                <DeleteButton onClick={() => handleRemove(item)}>
+                  <CloseIcon size={16} />
+                </DeleteButton>
+              </Login>
+            </LoginContainer>
+          ))}
+        </DraggableList>
+      </>
+    );
+  }
+
+  return (
+    <div>
+      <Title>Preferred logins</Title>
+
+      <Description>
+        Set a list of preferred logins to be used when running remote commands
+        on nodes. Assist will use the first login in this list if it can be used
+        to connect to all the nodes.
+      </Description>
+
+      <Description>
+        Hint: drag and drop the logins to change the order of preference.
+      </Description>
+
+      {content}
+    </div>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Settings/Settings.tsx b/web/packages/teleport/src/Assist/Settings/Settings.tsx
new file mode 100644
index 0000000000000..11443b46a4b9c
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Settings/Settings.tsx
@@ -0,0 +1,263 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { useRef, useState } from 'react';
+import styled from 'styled-components';
+
+import { CloseIcon, DisplayIcon, TerminalIcon } from 'design/SVGIcon';
+
+import Flex from 'design/Flex';
+
+import { AssistUserPreferences, ViewMode } from 'teleport/Assist/types';
+import { useAssist } from 'teleport/Assist/context/AssistContext';
+import { Tooltip } from 'teleport/Assist/shared/Tooltip';
+import { HeaderIcon } from 'teleport/Assist/shared';
+
+import { DisplaySettings } from 'teleport/Assist/Settings/DisplaySettings';
+
+import { RemoteExecutionSettings } from 'teleport/Assist/Settings/RemoteExecutionSettings';
+import { ErrorBanner, ErrorList } from 'teleport/Assist/ErrorBanner';
+import { useUser } from 'teleport/User/UserContext';
+
+interface SettingsProps {
+  onClose: () => void;
+  debugMenuEnabled: boolean;
+  onDebugMenuToggle: (enabled: boolean) => void;
+}
+
+const Container = styled.div<{ viewMode: ViewMode }>`
+  position: fixed;
+  top: 0;
+  left: 0;
+  bottom: 0;
+  right: 0;
+  background: rgba(0, 0, 0, 0.4);
+  z-index: 9999;
+`;
+
+const SettingsContainer = styled.div`
+  background: ${p => p.theme.colors.levels.popout};
+  border-radius: 15px;
+  box-shadow: 0 30px 60px 0 rgba(0, 0, 0, 0.4);
+  width: 740px;
+  height: 520px;
+  position: absolute;
+  top: 50%;
+  left: 50%;
+  transform: translate(-50%, -50%);
+  display: flex;
+  flex-direction: column;
+  overflow: hidden;
+`;
+
+const Sidebar = styled.ul`
+  flex: 0 0 200px;
+  border-right: 1px solid ${p => p.theme.colors.spotBackground[1]};
+  list-style: none;
+  margin: 0;
+  padding: 15px 10px 20px 0;
+`;
+
+const SettingsPage = styled.div`
+  flex: 1;
+  padding: 20px 20px;
+  overflow-y: auto;
+  height: 100%;
+  box-sizing: border-box;
+`;
+
+const SidebarItemIcon = styled.div`
+  flex: 0 0 28px;
+  display: flex;
+  align-items: center;
+`;
+
+const SidebarItem = styled.div`
+  display: flex;
+  align-items: center;
+  margin-bottom: 5px;
+  border-radius: 7px;
+  padding: 5px 12px;
+  cursor: pointer;
+  font-weight: ${p => (p.active ? 600 : 400)};
+  color: ${p => (p.active ? 'white' : p.theme.colors.text.primary)};
+  background: ${p => (p.active ? p.theme.colors.brand : 'transparent')};
+
+  ${SidebarItemIcon} {
+    opacity: ${p => (p.active ? 1 : 0.7)};
+
+    path {
+      fill: ${p => (p.active ? 'white' : 0.7)};
+    }
+  }
+
+  &:hover {
+    background: ${p =>
+      p.active ? p.theme.colors.brand : p.theme.colors.spotBackground[0]};
+  }
+`;
+
+const Content = styled.div`
+  display: flex;
+  padding: 0 0 0 15px;
+  flex: 1;
+  min-height: 0;
+`;
+
+const DisplayIconContainer = styled.div`
+  position: relative;
+  top: 2px;
+`;
+
+const Header = styled.div`
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  border-bottom: 1px solid ${p => p.theme.colors.spotBackground[1]};
+  padding: 8px 15px;
+`;
+
+const Title = styled.h2`
+  margin: 0;
+  font-size: 16px;
+`;
+
+enum Page {
+  Display,
+  RemoteExecution,
+}
+
+export function Settings(props: SettingsProps) {
+  const savingTimeoutRef = useRef<number | null>(null);
+
+  const { toggleSidebar } = useAssist();
+  const { preferences, updatePreferences } = useUser();
+
+  const [saving, setSaving] = useState(false);
+  const [errorMessage, setErrorMessage] = useState<string | null>(null);
+  const [selectedPage, setSelectedPage] = useState(Page.Display);
+
+  async function saveSettings(settings: Partial<AssistUserPreferences>) {
+    setSaving(true);
+
+    window.clearTimeout(savingTimeoutRef.current);
+
+    try {
+      await updatePreferences({ assist: settings });
+    } catch {
+      setErrorMessage('Failed to save settings');
+    }
+
+    // Stop "Saving..." from flickering really fast by showing it for at least half a second
+    savingTimeoutRef.current = window.setTimeout(() => setSaving(false), 500);
+  }
+
+  function handleChangeViewMode(viewMode: ViewMode) {
+    if (viewMode === preferences.assist.viewMode) {
+      return;
+    }
+
+    toggleSidebar(viewMode === ViewMode.PopupExpandedSidebarVisible);
+    saveSettings({ viewMode });
+  }
+
+  function handleChangePreferredLogins(preferredLogins: string[]) {
+    // We can't compare the arrays directly because they will be different instances.
+    // Instead, we stringify them to JSON (['foo','bar']) and compare the strings.
+    if (
+      JSON.stringify(preferredLogins) ===
+      JSON.stringify(preferences.assist.preferredLogins)
+    ) {
+      return;
+    }
+
+    saveSettings({ preferredLogins });
+  }
+
+  function handleClose(event: React.MouseEvent) {
+    event.stopPropagation();
+    props.onClose();
+  }
+
+  return (
+    <Container viewMode={preferences.assist.viewMode} onClick={handleClose}>
+      <SettingsContainer onClick={e => e.stopPropagation()}>
+        <Header>
+          <Title>Teleport Assist Settings</Title>
+
+          <Flex alignItems="center">
+            {saving && <>Saving settings...</>}
+
+            <HeaderIcon onClick={() => props.onClose()}>
+              <CloseIcon size={24} />
+
+              <Tooltip position="right">Close Settings</Tooltip>
+            </HeaderIcon>
+          </Flex>
+        </Header>
+
+        {errorMessage && (
+          <ErrorList>
+            <ErrorBanner onDismiss={() => setErrorMessage(null)}>
+              There was an error saving the settings.
+            </ErrorBanner>
+          </ErrorList>
+        )}
+
+        <Content>
+          <Sidebar>
+            <SidebarItem
+              active={selectedPage === Page.Display}
+              onClick={() => setSelectedPage(Page.Display)}
+            >
+              <SidebarItemIcon>
+                <DisplayIconContainer>
+                  <DisplayIcon size={16} />
+                </DisplayIconContainer>
+              </SidebarItemIcon>
+              Displays
+            </SidebarItem>
+            <SidebarItem
+              active={selectedPage === Page.RemoteExecution}
+              onClick={() => setSelectedPage(Page.RemoteExecution)}
+            >
+              <SidebarItemIcon>
+                <TerminalIcon size={16} />
+              </SidebarItemIcon>
+              Remote execution
+            </SidebarItem>
+          </Sidebar>
+
+          <SettingsPage>
+            {selectedPage === Page.Display && (
+              <DisplaySettings
+                viewMode={preferences.assist.viewMode}
+                onChange={handleChangeViewMode}
+              />
+            )}
+
+            {selectedPage === Page.RemoteExecution && (
+              <RemoteExecutionSettings
+                preferredLogins={preferences.assist.preferredLogins}
+                onChange={handleChangePreferredLogins}
+              />
+            )}
+          </SettingsPage>
+        </Content>
+      </SettingsContainer>
+    </Container>
+  );
+}
diff --git a/web/packages/teleport/src/Assist/Settings/index.ts b/web/packages/teleport/src/Assist/Settings/index.ts
new file mode 100644
index 0000000000000..db048273e61f7
--- /dev/null
+++ b/web/packages/teleport/src/Assist/Settings/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { Settings } from './Settings';
diff --git a/web/packages/teleport/src/services/ping/makePing.ts b/web/packages/teleport/src/Assist/Settings/shared.ts
similarity index 69%
rename from web/packages/teleport/src/services/ping/makePing.ts
rename to web/packages/teleport/src/Assist/Settings/shared.ts
index 5a8e607706693..89851f12eb751 100644
--- a/web/packages/teleport/src/services/ping/makePing.ts
+++ b/web/packages/teleport/src/Assist/Settings/shared.ts
@@ -14,14 +14,13 @@
  * limitations under the License.
  */
 
-import { PingResponse } from './types';
+import styled from 'styled-components';
 
-export function makePing(json: any): PingResponse {
-  json = json || {};
-  const { proxy, automatic_upgrades } = json;
+export const Title = styled.h3`
+  margin: 0;
+`;
 
-  return {
-    automaticUpgrades: automatic_upgrades,
-    assistEnabled: proxy?.assist_enabled,
-  };
-}
+export const Description = styled.p`
+  font-size: 14px;
+  margin: 0 0 10px;
+`;
diff --git a/web/packages/teleport/src/Assist/Sidebar/Sidebar.tsx b/web/packages/teleport/src/Assist/Sidebar/Sidebar.tsx
deleted file mode 100644
index a535d7da60530..0000000000000
--- a/web/packages/teleport/src/Assist/Sidebar/Sidebar.tsx
+++ /dev/null
@@ -1,243 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import React, { useCallback, useState } from 'react';
-import styled, { useTheme } from 'styled-components';
-
-import { NavLink } from 'react-router-dom';
-
-import { useHistory } from 'react-router';
-
-import { ChatIcon, CloseIcon, PlusIcon } from 'design/SVGIcon';
-
-import useAttempt from 'shared/hooks/useAttemptNext';
-
-import {
-  Conversation,
-  useConversations,
-} from 'teleport/Assist/contexts/conversations';
-
-import cfg from 'teleport/config';
-import api from 'teleport/services/api';
-import { DeleteConversationDialog } from 'teleport/Assist/Sidebar/DeleteConversationDialog';
-
-const Container = styled.div`
-  display: flex;
-  flex-direction: column;
-  margin-top: 10px;
-  height: calc(100vh - 230px);
-`;
-
-const ChatHistoryTitle = styled.div`
-  font-size: 13px;
-  line-height: 14px;
-  color: ${props => props.theme.colors.text.main};
-  font-weight: bold;
-  margin-left: 32px;
-  margin-bottom: 13px;
-`;
-
-const ChatHistoryItemButtons = styled.div`
-  position: absolute;
-  right: 5px;
-  top: 0;
-  bottom: 0;
-  display: none;
-  align-items: center;
-  justify-content: center;
-`;
-
-const ChatHistoryItemDeleteButton = styled.div`
-  cursor: pointer;
-  padding: 5px 5px 0;
-  background: ${p => p.theme.colors.spotBackground[0]};
-  border-radius: 7px;
-
-  &:hover {
-    background: ${p => p.theme.colors.error.main};
-
-    svg path {
-      stroke: white;
-    }
-  }
-`;
-
-const ChatHistoryItemTitle = styled.div`
-  overflow: hidden;
-  white-space: nowrap;
-  text-overflow: ellipsis;
-  padding-right: 20px;
-  opacity: 0.7;
-`;
-
-const ChatHistoryItemIcon = styled.div`
-  flex: 0 0 14px;
-  margin-right: 10px;
-  padding-top: 4px;
-  opacity: 0.7;
-`;
-
-const ChatHistoryItem = styled(NavLink)`
-  display: flex;
-  color: ${props => props.theme.colors.text.main};
-  padding: 7px 0px 7px 30px;
-  font-weight: 300;
-  line-height: 1.4;
-  align-items: center;
-  cursor: pointer;
-  text-decoration: none;
-  border-left: 4px solid transparent;
-  position: relative;
-  font-size: 14px;
-
-  &.active {
-    background: ${props => props.theme.colors.spotBackground[0]};
-    border-left-color: ${props => props.theme.colors.brand};
-    font-weight: 700;
-
-    ${ChatHistoryItemTitle}, ${ChatHistoryItemIcon} {
-      opacity: 1;
-    }
-  }
-
-  &:hover {
-    background: ${props => props.theme.colors.spotBackground[0]};
-
-    ${ChatHistoryItemTitle} {
-      padding-right: 40px;
-    }
-
-    ${ChatHistoryItemButtons} {
-      display: flex;
-    }
-  }
-`;
-
-const NewChatButton = styled.div`
-  padding: 10px 20px;
-  border-radius: 7px;
-  font-size: 15px;
-  font-weight: bold;
-  display: flex;
-  cursor: pointer;
-  margin: 0 15px;
-  background: ${p => p.theme.colors.buttons.primary.default};
-  color: ${p => p.theme.colors.buttons.primary.text};
-  align-items: center;
-
-  svg {
-    position: relative;
-    margin-right: 10px;
-  }
-
-  &:hover {
-    background: ${p => p.theme.colors.buttons.primary.hover};
-  }
-`;
-
-const ChatHistoryList = styled.div.attrs({ 'data-scrollbar': 'default' })`
-  overflow-y: auto;
-  flex: 1;
-`;
-
-const ErrorMessage = styled.div`
-  color: ${p => p.theme.colors.error.main};
-  font-weight: 700;
-  margin-bottom: 5px;
-  padding: 0 15px 15px;
-`;
-
-export function Sidebar() {
-  const theme = useTheme();
-
-  const history = useHistory();
-
-  const { attempt, run } = useAttempt();
-
-  const { create, remove, conversations, error } = useConversations();
-
-  const [conversationToDelete, setConversationToDelete] =
-    useState<Conversation>(null);
-
-  const handleNewChat = useCallback(() => {
-    create().then(conversationId =>
-      history.push(cfg.getAssistConversationUrl(conversationId))
-    );
-  }, []);
-
-  const handleDeleteChat = useCallback(async (conversationId: string) => {
-    const ok = await run(async () => {
-      await api.delete(cfg.getAssistConversationHistoryUrl(conversationId));
-      await remove(conversationId);
-      history.push(cfg.routes.assistBase);
-    });
-
-    ok && setConversationToDelete(null);
-  }, []);
-
-  const handleDeleteButtonClick = useCallback(
-    (event: React.MouseEvent, conversation: Conversation) => {
-      event.preventDefault();
-      event.stopPropagation();
-
-      setConversationToDelete(conversation);
-    },
-    []
-  );
-
-  const chatHistory = conversations.map(conversation => (
-    <ChatHistoryItem
-      key={conversation.id}
-      to={`/web/assist/${conversation.id}`}
-    >
-      <ChatHistoryItemIcon>
-        <ChatIcon size={14} />
-      </ChatHistoryItemIcon>
-      <ChatHistoryItemTitle>{conversation.title}</ChatHistoryItemTitle>
-      <ChatHistoryItemButtons>
-        <ChatHistoryItemDeleteButton
-          onClick={event => handleDeleteButtonClick(event, conversation)}
-        >
-          <CloseIcon size={16} />
-        </ChatHistoryItemDeleteButton>
-      </ChatHistoryItemButtons>
-    </ChatHistoryItem>
-  ));
-
-  return (
-    <Container>
-      {conversationToDelete && (
-        <DeleteConversationDialog
-          conversationTitle={conversationToDelete.title}
-          onDelete={() => handleDeleteChat(conversationToDelete.id)}
-          onClose={() => setConversationToDelete(null)}
-          disabled={attempt.status === 'processing'}
-          error={attempt.status === 'failed' ? attempt.statusText : null}
-        />
-      )}
-
-      {error && <ErrorMessage>{error}</ErrorMessage>}
-
-      <ChatHistoryTitle>Chat History</ChatHistoryTitle>
-      <ChatHistoryList>{chatHistory}</ChatHistoryList>
-
-      <NewChatButton onClick={() => handleNewChat()}>
-        <PlusIcon size={16} fill={theme.colors.buttons.primary.text} />
-        New Conversation
-      </NewChatButton>
-    </Container>
-  );
-}
diff --git a/web/packages/teleport/src/Assist/context/AssistContext.tsx b/web/packages/teleport/src/Assist/context/AssistContext.tsx
new file mode 100644
index 0000000000000..fa6d0cb47877c
--- /dev/null
+++ b/web/packages/teleport/src/Assist/context/AssistContext.tsx
@@ -0,0 +1,586 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, {
+  createContext,
+  PropsWithChildren,
+  useContext,
+  useEffect,
+  useMemo,
+  useReducer,
+  useRef,
+} from 'react';
+
+import { AssistStateActionType, reducer } from 'teleport/Assist/context/state';
+
+import { convertServerMessages } from 'teleport/Assist/context/utils';
+import useStickyClusterId from 'teleport/useStickyClusterId';
+import cfg from 'teleport/config';
+import { getAccessToken, getHostName } from 'teleport/services/api';
+
+import {
+  ExecutionEnvelopeType,
+  RawPayload,
+  ServerMessageType,
+} from 'teleport/Assist/types';
+
+import { MessageTypeEnum, Protobuf } from 'teleport/lib/term/protobuf';
+
+import {
+  makeMfaAuthenticateChallenge,
+  WebauthnAssertionResponse,
+} from 'teleport/services/auth';
+
+import * as service from '../service';
+import {
+  resolveServerAssistThoughtMessage,
+  resolveServerCommandMessage,
+  resolveServerMessage,
+} from '../service';
+
+import type {
+  ConversationMessage,
+  ResolvedServerMessage,
+  ServerMessage,
+} from 'teleport/Assist/types';
+import type { AssistState } from 'teleport/Assist/context/state';
+
+interface AssistContextValue {
+  cancelMfaChallenge: () => void;
+  createConversation: () => Promise<string>;
+  deleteConversation: (conversationId: string) => void;
+  executeCommand: (login: string, command: string, query: string) => void;
+  sendMessage: (message: string) => void;
+  sendMfaChallenge: (data: WebauthnAssertionResponse) => void;
+  selectedConversationMessages: ConversationMessage[];
+  setSelectedConversationId: (conversationId: string) => Promise<void>;
+  toggleSidebar: (visible: boolean) => void;
+}
+
+const AssistContext = createContext<AssistState & AssistContextValue>(null);
+
+let lastCommandExecutionResultId = 0;
+
+const TEN_MINUTES = 10 * 60 * 1000;
+
+export function AssistContextProvider(props: PropsWithChildren<unknown>) {
+  const activeWebSocket = useRef<WebSocket>(null);
+  const executeCommandWebSocket = useRef<WebSocket>(null);
+  const refreshWebSocketTimeout = useRef<number | null>(null);
+
+  const { clusterId } = useStickyClusterId();
+
+  const [state, dispatch] = useReducer(reducer, {
+    sidebarVisible: false,
+    conversations: {
+      loading: false,
+      data: [],
+      selectedId: null,
+    },
+    messages: {
+      loading: false,
+      streaming: false,
+      data: new Map(),
+    },
+    mfa: {
+      prompt: false,
+      publicKey: null,
+    },
+  });
+
+  async function loadConversations() {
+    dispatch({
+      type: AssistStateActionType.SetConversationsLoading,
+      loading: true,
+    });
+
+    const conversations = await service.loadConversations();
+
+    dispatch({
+      type: AssistStateActionType.ReplaceConversations,
+      conversations,
+    });
+  }
+
+  function setupWebSocket(conversationId: string, initialMessage?: string) {
+    activeWebSocket.current = new WebSocket(
+      cfg.getAssistConversationWebSocketUrl(
+        getHostName(),
+        clusterId,
+        getAccessToken(),
+        conversationId
+      )
+    );
+
+    window.clearTimeout(refreshWebSocketTimeout.current);
+
+    // refresh the websocket connection just before the ten-minute timeout of the session
+    refreshWebSocketTimeout.current = window.setTimeout(
+      () => setupWebSocket(conversationId),
+      TEN_MINUTES * 0.8
+    );
+
+    activeWebSocket.current.onopen = () => {
+      if (initialMessage) {
+        activeWebSocket.current.send(initialMessage);
+      }
+    };
+
+    activeWebSocket.current.onclose = () => {
+      dispatch({
+        type: AssistStateActionType.SetStreaming,
+        streaming: false,
+      });
+    };
+
+    activeWebSocket.current.onmessage = async event => {
+      const data = JSON.parse(event.data) as ServerMessage;
+
+      switch (data.type) {
+        case ServerMessageType.Assist:
+          dispatch({
+            type: AssistStateActionType.AddMessage,
+            messageType: ServerMessageType.Assist,
+            message: data.payload,
+            conversationId,
+          });
+
+          dispatch({
+            type: AssistStateActionType.SetStreaming,
+            streaming: false,
+          });
+
+          break;
+
+        case ServerMessageType.AssistPartialMessageEnd:
+          dispatch({
+            type: AssistStateActionType.SetStreaming,
+            streaming: false,
+          });
+
+          break;
+
+        case ServerMessageType.AssistPartialMessage: {
+          dispatch({
+            type: AssistStateActionType.AddPartialMessage,
+            message: data.payload,
+            conversationId,
+          });
+
+          break;
+        }
+
+        case ServerMessageType.AssistThought:
+          const message = resolveServerAssistThoughtMessage(data);
+          dispatch({
+            type: AssistStateActionType.AddThought,
+            message: message.message,
+            conversationId,
+          });
+
+          break;
+        case ServerMessageType.Command: {
+          const message = resolveServerCommandMessage(data);
+
+          dispatch({
+            type: AssistStateActionType.AddExecuteRemoteCommand,
+            message,
+            conversationId,
+          });
+
+          dispatch({
+            type: AssistStateActionType.SetStreaming,
+            streaming: false,
+          });
+
+          break;
+        }
+
+        case ServerMessageType.Error:
+          dispatch({
+            type: AssistStateActionType.AddMessage,
+            messageType: ServerMessageType.Error,
+            message: data.payload,
+            conversationId,
+          });
+
+          dispatch({
+            type: AssistStateActionType.SetStreaming,
+            streaming: false,
+          });
+
+          break;
+      }
+    };
+  }
+
+  async function createConversation() {
+    if (state.messages.streaming) {
+      dispatch({
+        type: AssistStateActionType.SetStreaming,
+        streaming: false,
+      });
+    }
+
+    dispatch({
+      type: AssistStateActionType.SetConversationsLoading,
+      loading: true,
+    });
+
+    const conversationId = await service.createConversation();
+
+    dispatch({
+      type: AssistStateActionType.AddConversation,
+      conversationId,
+    });
+
+    setupWebSocket(conversationId);
+
+    const serverMessages = await service.loadConversationMessages(
+      conversationId
+    );
+    const messages: ResolvedServerMessage[] = [];
+
+    for (const message of serverMessages) {
+      messages.push(await resolveServerMessage(message, clusterId));
+    }
+
+    dispatch({
+      type: AssistStateActionType.SetConversationMessages,
+      conversationId,
+      messages,
+    });
+
+    return conversationId;
+  }
+
+  async function setSelectedConversationId(conversationId: string) {
+    if (activeWebSocket.current) {
+      activeWebSocket.current.close();
+    }
+
+    if (state.messages.streaming) {
+      dispatch({
+        type: AssistStateActionType.SetStreaming,
+        streaming: false,
+      });
+    }
+
+    dispatch({
+      type: AssistStateActionType.SetSelectedConversationId,
+      conversationId,
+    });
+
+    if (!state.messages.data.has(conversationId)) {
+      dispatch({
+        type: AssistStateActionType.SetConversationMessagesLoading,
+        loading: true,
+      });
+
+      const serverMessages = await service.loadConversationMessages(
+        conversationId
+      );
+      const messages: ResolvedServerMessage[] = [];
+
+      for (const message of serverMessages) {
+        messages.push(await resolveServerMessage(message, clusterId));
+      }
+
+      dispatch({
+        type: AssistStateActionType.SetConversationMessages,
+        conversationId,
+        messages,
+      });
+    }
+
+    setupWebSocket(conversationId);
+  }
+
+  async function sendMessage(message: string) {
+    if (!activeWebSocket.current) {
+      return;
+    }
+
+    const messages = state.messages.data.get(state.conversations.selectedId);
+
+    dispatch({
+      type: AssistStateActionType.SetStreaming,
+      streaming: true,
+    });
+
+    const data = JSON.stringify({ payload: message });
+
+    if (
+      !activeWebSocket.current ||
+      activeWebSocket.current.readyState === WebSocket.CLOSED
+    ) {
+      setupWebSocket(state.conversations.selectedId, data);
+    } else {
+      activeWebSocket.current.send(data);
+    }
+
+    dispatch({
+      type: AssistStateActionType.AddMessage,
+      messageType: ServerMessageType.User,
+      conversationId: state.conversations.selectedId,
+      message,
+    });
+
+    if (messages.length === 1) {
+      const title = await service.generateTitle(message);
+
+      await service.setConversationTitle(state.conversations.selectedId, title);
+
+      dispatch({
+        type: AssistStateActionType.UpdateConversationTitle,
+        conversationId: state.conversations.selectedId,
+        title,
+      });
+    }
+  }
+
+  function sendMfaChallenge(data: WebauthnAssertionResponse) {
+    if (
+      !executeCommandWebSocket.current ||
+      executeCommandWebSocket.current.readyState !== WebSocket.OPEN ||
+      !data
+    ) {
+      console.warn(
+        'websocket unavailable',
+        executeCommandWebSocket.current,
+        data
+      );
+
+      return;
+    }
+
+    dispatch({
+      type: AssistStateActionType.PromptMfa,
+      promptMfa: false,
+      publicKey: null,
+    });
+
+    const encoder = new window.TextEncoder();
+    const proto = new Protobuf();
+
+    const encodedMessage = encoder.encode(JSON.stringify(data));
+    const message = proto.encodeChallengeResponse(encodedMessage);
+    const bytearray = new Uint8Array(message);
+
+    executeCommandWebSocket.current.send(bytearray.buffer);
+  }
+
+  async function executeCommand(login: string, command: string, query: string) {
+    if (executeCommandWebSocket.current) {
+      executeCommandWebSocket.current.close();
+    }
+
+    dispatch({
+      type: AssistStateActionType.AddThought,
+      conversationId: state.conversations.selectedId,
+      message: 'Connecting to nodes',
+    });
+
+    const nodes = await service.getNodesFromQuery(query, clusterId);
+
+    const nodeIdToResultId = new Map<string, number>();
+
+    for (const node of nodes.agents) {
+      const id = lastCommandExecutionResultId++;
+
+      nodeIdToResultId.set(node.id, id);
+
+      dispatch({
+        type: AssistStateActionType.AddCommandResult,
+        conversationId: state.conversations.selectedId,
+        id,
+        nodeName: node.hostname,
+        nodeId: node.id,
+      });
+    }
+
+    const execParams = {
+      login,
+      command,
+      query,
+      conversation_id: state.conversations.selectedId,
+      execution_id: crypto.randomUUID(),
+    };
+
+    const url = cfg.getAssistExecuteCommandUrl(
+      getHostName(),
+      clusterId,
+      getAccessToken(),
+      execParams
+    );
+
+    const proto = new Protobuf();
+
+    executeCommandWebSocket.current = new WebSocket(url);
+    executeCommandWebSocket.current.binaryType = 'arraybuffer';
+
+    let sessionsEnded = 0;
+
+    executeCommandWebSocket.current.onmessage = event => {
+      const uintArray = new Uint8Array(event.data);
+
+      const msg = proto.decode(uintArray);
+
+      switch (msg.type) {
+        case MessageTypeEnum.RAW:
+          const data = JSON.parse(msg.payload) as RawPayload;
+          const payload = atob(data.payload);
+
+          if (data.type === ExecutionEnvelopeType) {
+            dispatch({
+              type: AssistStateActionType.AddCommandResultSummary,
+              conversationId: state.conversations.selectedId,
+              summary: payload,
+              executionId: execParams.execution_id,
+              command: execParams.command,
+            });
+          } else {
+            dispatch({
+              type: AssistStateActionType.UpdateCommandResult,
+              conversationId: state.conversations.selectedId,
+              commandResultId: nodeIdToResultId.get(data.node_id),
+              output: payload,
+            });
+          }
+          break;
+
+        case MessageTypeEnum.WEBAUTHN_CHALLENGE:
+          const challenge = JSON.parse(msg.payload);
+          const publicKey =
+            makeMfaAuthenticateChallenge(challenge).webauthnPublicKey;
+
+          dispatch({
+            type: AssistStateActionType.PromptMfa,
+            promptMfa: true,
+            publicKey,
+          });
+
+          break;
+
+        case MessageTypeEnum.ERROR:
+          console.error(msg.payload);
+
+          break;
+
+        case MessageTypeEnum.SESSION_END:
+          // we don't know the nodeId of the session that ended, so we have to
+          // count the finished sessions and then mark them all as done once
+          // they've all finished
+          sessionsEnded += 1;
+
+          if (sessionsEnded === nodeIdToResultId.size) {
+            const message = proto.encodeCloseMessage();
+            const bytearray = new Uint8Array(message);
+
+            for (const nodeId of nodeIdToResultId.keys()) {
+              dispatch({
+                type: AssistStateActionType.FinishCommandResult,
+                conversationId: state.conversations.selectedId,
+                commandResultId: nodeIdToResultId.get(nodeId),
+              });
+
+              executeCommandWebSocket.current.send(bytearray.buffer);
+            }
+
+            nodeIdToResultId.clear();
+          }
+
+          break;
+      }
+    };
+
+    executeCommandWebSocket.current.onclose = () => {
+      executeCommandWebSocket.current = null;
+
+      // If the execution failed, we won't get a SESSION_END message, so we
+      // need to mark all the results as finished here.
+      for (const nodeId of nodeIdToResultId.keys()) {
+        dispatch({
+          type: AssistStateActionType.FinishCommandResult,
+          conversationId: state.conversations.selectedId,
+          commandResultId: nodeIdToResultId.get(nodeId),
+        });
+      }
+      nodeIdToResultId.clear();
+    };
+  }
+
+  async function deleteConversation(conversationId: string) {
+    await service.deleteConversation(conversationId);
+
+    dispatch({
+      type: AssistStateActionType.DeleteConversation,
+      conversationId,
+    });
+  }
+
+  function cancelMfaChallenge() {
+    dispatch({
+      type: AssistStateActionType.PromptMfa,
+      promptMfa: false,
+      publicKey: null,
+    });
+  }
+
+  function toggleSidebar(visible: boolean) {
+    dispatch({
+      type: AssistStateActionType.ToggleSidebar,
+      visible,
+    });
+  }
+
+  useEffect(() => {
+    loadConversations();
+  }, []);
+
+  const selectedConversationMessages = useMemo(
+    () =>
+      state.messages.data.has(state.conversations.selectedId)
+        ? convertServerMessages(
+            state.messages.data.get(state.conversations.selectedId)
+          )
+        : null,
+    [state.conversations.selectedId, state.messages.data]
+  );
+
+  return (
+    <AssistContext.Provider
+      value={{
+        ...state,
+        cancelMfaChallenge,
+        createConversation,
+        deleteConversation,
+        executeCommand,
+        selectedConversationMessages,
+        sendMessage,
+        sendMfaChallenge,
+        setSelectedConversationId,
+        toggleSidebar,
+      }}
+    >
+      {props.children}
+    </AssistContext.Provider>
+  );
+}
+
+export function useAssist() {
+  return useContext(AssistContext);
+}
diff --git a/web/packages/teleport/src/Assist/context/state.test.ts b/web/packages/teleport/src/Assist/context/state.test.ts
new file mode 100644
index 0000000000000..6c853fd88966b
--- /dev/null
+++ b/web/packages/teleport/src/Assist/context/state.test.ts
@@ -0,0 +1,184 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {
+  ResolvedUserServerMessage,
+  ServerMessageType,
+} from 'teleport/Assist/types';
+
+import {
+  AssistStateActionType,
+  replaceConversations,
+  setConversationMessages,
+  setConversationMessagesLoading,
+  setConversationsLoading,
+  setSelectedConversationId,
+} from './state';
+
+import type {
+  AssistState,
+  ReplaceConversationsAction,
+  SetConversationMessagesAction,
+  SetConversationMessagesLoadingAction,
+  SetConversationsLoadingAction,
+  SetSelectedConversationIdAction,
+} from './state';
+
+const defaultState: AssistState = {
+  sidebarVisible: false,
+  conversations: {
+    loading: false,
+    selectedId: null,
+    error: null,
+    data: [],
+  },
+  messages: {
+    loading: false,
+    streaming: false,
+    data: new Map(),
+  },
+  mfa: {
+    prompt: false,
+    publicKey: null,
+  },
+};
+
+describe('assist state', () => {
+  it('should set conversations loading', () => {
+    const action: SetConversationsLoadingAction = {
+      type: AssistStateActionType.SetConversationsLoading,
+      loading: true,
+    };
+
+    expect(defaultState.conversations.loading).toBe(false);
+
+    const nextState = setConversationsLoading(defaultState, action);
+
+    expect(nextState.conversations.loading).toBe(true);
+  });
+
+  it('should replace conversations', () => {
+    const state = {
+      ...defaultState,
+      conversations: {
+        ...defaultState.conversations,
+        data: [
+          {
+            id: '3',
+            title: 'Conversation 3',
+            created: new Date('2020-01-03'),
+          },
+        ],
+      },
+    };
+
+    const action: ReplaceConversationsAction = {
+      type: AssistStateActionType.ReplaceConversations,
+      conversations: [
+        {
+          id: '1',
+          title: 'Conversation 1',
+          created: new Date('2020-01-01'),
+        },
+        {
+          id: '2',
+          title: 'Conversation 2',
+          created: new Date('2020-01-02'),
+        },
+      ],
+    };
+
+    const nextState = replaceConversations(state, action);
+
+    expect(nextState.conversations.data).toHaveLength(2);
+
+    expect(nextState.conversations.data[0].id).toBe('1');
+    expect(nextState.conversations.data[0].title).toBe('Conversation 1');
+
+    expect(nextState.conversations.data[1].id).toBe('2');
+    expect(nextState.conversations.data[1].title).toBe('Conversation 2');
+  });
+
+  it('should set selected conversation id', () => {
+    const action: SetSelectedConversationIdAction = {
+      type: AssistStateActionType.SetSelectedConversationId,
+      conversationId: '1',
+    };
+
+    expect(defaultState.conversations.selectedId).toBeNull();
+
+    const nextState = setSelectedConversationId(defaultState, action);
+
+    expect(nextState.conversations.selectedId).toBe('1');
+  });
+
+  it('should set conversation messages loading', () => {
+    const action: SetConversationMessagesLoadingAction = {
+      type: AssistStateActionType.SetConversationMessagesLoading,
+      loading: true,
+    };
+
+    expect(defaultState.messages.loading).toBe(false);
+
+    const nextState = setConversationMessagesLoading(defaultState, action);
+
+    expect(nextState.messages.loading).toBe(true);
+  });
+
+  it('should set conversation messages', () => {
+    const state: AssistState = {
+      ...defaultState,
+      messages: {
+        ...defaultState.messages,
+        data: new Map([
+          [
+            '1',
+            [
+              {
+                type: ServerMessageType.User,
+                message: 'Message 1',
+                created: new Date('2020-01-01'),
+              },
+            ],
+          ],
+        ]),
+      },
+    };
+
+    const action: SetConversationMessagesAction = {
+      type: AssistStateActionType.SetConversationMessages,
+      conversationId: '2',
+      messages: [
+        {
+          type: ServerMessageType.User,
+          message: 'Message 2',
+          created: new Date('2020-01-02'),
+        },
+      ],
+    };
+
+    expect(state.messages.data.has('2')).toBe(false);
+
+    const nextState = setConversationMessages(state, action);
+
+    const newMessage = nextState.messages.data.get(
+      '2'
+    ) as ResolvedUserServerMessage[];
+
+    expect(newMessage).toHaveLength(1);
+    expect(newMessage[0].message).toBe('Message 2');
+  });
+});
diff --git a/web/packages/teleport/src/Assist/context/state.ts b/web/packages/teleport/src/Assist/context/state.ts
new file mode 100644
index 0000000000000..acce9c6303b3b
--- /dev/null
+++ b/web/packages/teleport/src/Assist/context/state.ts
@@ -0,0 +1,713 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { ServerMessageType } from 'teleport/Assist/types';
+
+import type {
+  Conversation,
+  ResolvedAssistServerMessage,
+  ResolvedCommandServerMessage,
+  ResolvedServerMessage,
+} from 'teleport/Assist/types';
+
+export interface AssistState {
+  sidebarVisible: boolean;
+  conversations: {
+    selectedId: string | null;
+    error?: string;
+    loading: boolean;
+    data: Conversation[];
+  };
+  messages: {
+    loading: boolean;
+    error?: string;
+    streaming: boolean;
+    data: Map<string, ResolvedServerMessage[]>; // conversationId -> messages
+  };
+  mfa: {
+    prompt: boolean;
+    publicKey: PublicKeyCredentialRequestOptions | null;
+  };
+}
+
+export enum AssistStateActionType {
+  SetConversationsLoading,
+  ReplaceConversations,
+  SetSelectedConversationId,
+  SetConversationMessagesLoading,
+  SetConversationMessages,
+  AddMessage,
+  SetStreaming,
+  AddPartialMessage,
+  AddExecuteRemoteCommand,
+  AddConversation,
+  AddThought,
+  AddCommandResult,
+  UpdateCommandResult,
+  FinishCommandResult,
+  PromptMfa,
+  DeleteConversation,
+  UpdateConversationTitle,
+  AddCommandResultSummary,
+  ToggleSidebar,
+}
+
+export interface ReplaceConversationsAction {
+  type: AssistStateActionType.ReplaceConversations;
+  conversations: Conversation[];
+}
+
+export interface SetSelectedConversationIdAction {
+  type: AssistStateActionType.SetSelectedConversationId;
+  conversationId: string;
+}
+
+export interface SetConversationsLoadingAction {
+  type: AssistStateActionType.SetConversationsLoading;
+  loading: boolean;
+}
+
+export interface SetConversationMessagesLoadingAction {
+  type: AssistStateActionType.SetConversationMessagesLoading;
+  loading: boolean;
+}
+
+export interface SetConversationMessagesAction {
+  type: AssistStateActionType.SetConversationMessages;
+  messages: ResolvedServerMessage[];
+  conversationId: string;
+}
+
+export interface AddMessageAction {
+  type: AssistStateActionType.AddMessage;
+  messageType:
+    | ServerMessageType.User
+    | ServerMessageType.Assist
+    | ServerMessageType.Error;
+  message: string;
+  conversationId: string;
+}
+
+export interface SetStreamingAction {
+  type: AssistStateActionType.SetStreaming;
+  streaming: boolean;
+}
+
+export interface AddPartialMessageAction {
+  type: AssistStateActionType.AddPartialMessage;
+  message: string;
+  conversationId: string;
+}
+
+export interface AddExecuteRemoteCommandAction {
+  type: AssistStateActionType.AddExecuteRemoteCommand;
+  message: ResolvedCommandServerMessage;
+  conversationId: string;
+}
+
+export interface AddConversationAction {
+  type: AssistStateActionType.AddConversation;
+  conversationId: string;
+}
+
+export interface AddThoughtAction {
+  type: AssistStateActionType.AddThought;
+  message: string;
+  conversationId: string;
+}
+
+export interface AddCommandResultAction {
+  type: AssistStateActionType.AddCommandResult;
+  id: number;
+  nodeId: string;
+  nodeName: string;
+  conversationId: string;
+}
+
+export interface UpdateCommandResultAction {
+  type: AssistStateActionType.UpdateCommandResult;
+  commandResultId: number;
+  output: string;
+  conversationId: string;
+}
+
+export interface FinishCommandResultAction {
+  type: AssistStateActionType.FinishCommandResult;
+  commandResultId: number;
+  conversationId: string;
+}
+
+export interface PromptMfaAction {
+  type: AssistStateActionType.PromptMfa;
+  publicKey: PublicKeyCredentialRequestOptions | null;
+  promptMfa: boolean;
+}
+
+export interface DeleteConversationAction {
+  type: AssistStateActionType.DeleteConversation;
+  conversationId: string;
+}
+
+export interface UpdateConversationTitleAction {
+  type: AssistStateActionType.UpdateConversationTitle;
+  conversationId: string;
+  title: string;
+}
+
+export interface AddCommandResultSummaryAction {
+  type: AssistStateActionType.AddCommandResultSummary;
+  summary: string;
+  conversationId: string;
+  command: string;
+  executionId: string;
+}
+
+export interface ToggleSidebarAction {
+  type: AssistStateActionType.ToggleSidebar;
+  visible: boolean;
+}
+
+export type AssistContextAction =
+  | SetConversationsLoadingAction
+  | ReplaceConversationsAction
+  | SetSelectedConversationIdAction
+  | SetConversationMessagesLoadingAction
+  | SetConversationMessagesAction
+  | AddMessageAction
+  | SetStreamingAction
+  | AddPartialMessageAction
+  | AddExecuteRemoteCommandAction
+  | AddConversationAction
+  | AddThoughtAction
+  | AddCommandResultAction
+  | UpdateCommandResultAction
+  | FinishCommandResultAction
+  | PromptMfaAction
+  | DeleteConversationAction
+  | UpdateConversationTitleAction
+  | AddCommandResultSummaryAction
+  | ToggleSidebarAction;
+
+export function reducer(
+  state: AssistState,
+  action: AssistContextAction
+): AssistState {
+  switch (action.type) {
+    case AssistStateActionType.SetConversationsLoading:
+      return setConversationsLoading(state, action);
+
+    case AssistStateActionType.ReplaceConversations:
+      return replaceConversations(state, action);
+
+    case AssistStateActionType.SetSelectedConversationId:
+      return setSelectedConversationId(state, action);
+
+    case AssistStateActionType.SetConversationMessagesLoading:
+      return setConversationMessagesLoading(state, action);
+
+    case AssistStateActionType.SetConversationMessages:
+      return setConversationMessages(state, action);
+
+    case AssistStateActionType.AddMessage:
+      return addMessage(state, action);
+
+    case AssistStateActionType.SetStreaming:
+      return setStreaming(state, action);
+
+    case AssistStateActionType.AddPartialMessage:
+      return addPartialMessage(state, action);
+
+    case AssistStateActionType.AddExecuteRemoteCommand:
+      return addExecuteRemoteCommand(state, action);
+
+    case AssistStateActionType.AddConversation:
+      return addConversation(state, action);
+
+    case AssistStateActionType.AddThought:
+      return addThought(state, action);
+
+    case AssistStateActionType.AddCommandResult:
+      return addCommandResult(state, action);
+
+    case AssistStateActionType.UpdateCommandResult:
+      return updateCommandResult(state, action);
+
+    case AssistStateActionType.FinishCommandResult:
+      return finishCommandResult(state, action);
+
+    case AssistStateActionType.PromptMfa:
+      return promptMfa(state, action);
+
+    case AssistStateActionType.DeleteConversation:
+      return deleteConversation(state, action);
+
+    case AssistStateActionType.UpdateConversationTitle:
+      return updateConversationTitle(state, action);
+
+    case AssistStateActionType.AddCommandResultSummary:
+      return addCommandResultSummary(state, action);
+
+    case AssistStateActionType.ToggleSidebar:
+      return toggleSidebar(state, action);
+
+    default:
+      return state;
+  }
+}
+
+export function setConversationsLoading(
+  state: AssistState,
+  action: SetConversationsLoadingAction
+): AssistState {
+  return {
+    ...state,
+    conversations: {
+      ...state.conversations,
+      loading: action.loading,
+    },
+  };
+}
+
+export function replaceConversations(
+  state: AssistState,
+  action: ReplaceConversationsAction
+): AssistState {
+  return {
+    ...state,
+    conversations: {
+      selectedId: state.conversations.selectedId,
+      loading: false,
+      error: null,
+      data: action.conversations,
+    },
+  };
+}
+
+export function setSelectedConversationId(
+  state: AssistState,
+  action: SetSelectedConversationIdAction
+): AssistState {
+  return {
+    ...state,
+    conversations: {
+      ...state.conversations,
+      selectedId: action.conversationId,
+    },
+  };
+}
+
+export function setConversationMessagesLoading(
+  state: AssistState,
+  action: SetConversationMessagesLoadingAction
+): AssistState {
+  return {
+    ...state,
+    messages: {
+      ...state.messages,
+      loading: action.loading,
+    },
+  };
+}
+
+export function setConversationMessages(
+  state: AssistState,
+  action: SetConversationMessagesAction
+): AssistState {
+  const messages = new Map(state.messages.data);
+
+  messages.set(action.conversationId, action.messages);
+
+  return {
+    ...state,
+    messages: {
+      loading: false,
+      streaming: false,
+      data: messages,
+    },
+  };
+}
+
+export function addMessage(
+  state: AssistState,
+  action: AddMessageAction
+): AssistState {
+  const messages = new Map(state.messages.data);
+
+  if (messages.has(action.conversationId)) {
+    const existingMessages = messages.get(action.conversationId);
+
+    messages.set(action.conversationId, [
+      ...existingMessages,
+      {
+        type: action.messageType,
+        message: action.message,
+        created: new Date(),
+      },
+    ]);
+  } else {
+    messages.set(action.conversationId, [
+      {
+        type: action.messageType,
+        message: action.message,
+        created: new Date(),
+      },
+    ]);
+  }
+
+  return {
+    ...state,
+    messages: {
+      ...state.messages,
+      data: messages,
+    },
+  };
+}
+
+export function setStreaming(
+  state: AssistState,
+  action: SetStreamingAction
+): AssistState {
+  return {
+    ...state,
+    messages: {
+      ...state.messages,
+      streaming: action.streaming,
+    },
+  };
+}
+
+export function addPartialMessage(
+  state: AssistState,
+  action: AddPartialMessageAction
+): AssistState {
+  const messages = new Map(state.messages.data);
+
+  let conversationMessages = messages.get(action.conversationId);
+
+  if (
+    conversationMessages[conversationMessages.length - 1].type ===
+    ServerMessageType.Assist
+  ) {
+    conversationMessages = conversationMessages.map(
+      (message: ResolvedAssistServerMessage, index) => {
+        if (index === conversationMessages.length - 1) {
+          return {
+            ...message,
+            message: message.message + action.message,
+          };
+        }
+
+        return message;
+      }
+    );
+  } else {
+    conversationMessages = [
+      ...conversationMessages,
+      {
+        type: ServerMessageType.Assist,
+        message: action.message,
+        created: new Date(),
+      },
+    ];
+  }
+
+  messages.set(action.conversationId, conversationMessages);
+
+  return {
+    ...state,
+    messages: {
+      ...state.messages,
+      data: messages,
+    },
+  };
+}
+
+export function addExecuteRemoteCommand(
+  state: AssistState,
+  action: AddExecuteRemoteCommandAction
+): AssistState {
+  const messages = new Map(state.messages.data);
+
+  let conversationMessages = messages.get(action.conversationId);
+
+  conversationMessages = [
+    ...conversationMessages,
+    {
+      type: ServerMessageType.Command,
+      created: new Date(),
+      query: action.message.query,
+      command: action.message.command,
+    },
+  ];
+
+  messages.set(action.conversationId, conversationMessages);
+
+  return {
+    ...state,
+    messages: {
+      ...state.messages,
+      data: messages,
+    },
+  };
+}
+
+export function addConversation(
+  state: AssistState,
+  action: AddConversationAction
+): AssistState {
+  const conversations = state.conversations.data;
+
+  return {
+    ...state,
+    conversations: {
+      ...state.conversations,
+      selectedId: action.conversationId,
+      data: [
+        {
+          id: action.conversationId,
+          title: 'New conversation',
+          created: new Date(),
+        },
+        ...conversations,
+      ],
+    },
+  };
+}
+
+export function addThought(
+  state: AssistState,
+  action: AddThoughtAction
+): AssistState {
+  const messages = new Map(state.messages.data);
+
+  let conversationMessages = messages.get(action.conversationId);
+
+  conversationMessages = [
+    ...conversationMessages,
+    {
+      type: ServerMessageType.AssistThought,
+      created: new Date(),
+      message: action.message,
+    },
+  ];
+
+  messages.set(action.conversationId, conversationMessages);
+
+  return {
+    ...state,
+    messages: {
+      ...state.messages,
+      data: messages,
+    },
+  };
+}
+
+export function addCommandResult(
+  state: AssistState,
+  action: AddCommandResultAction
+): AssistState {
+  const messages = new Map(state.messages.data);
+
+  let conversationMessages = messages.get(action.conversationId);
+
+  conversationMessages = [
+    ...conversationMessages,
+    {
+      type: ServerMessageType.CommandResultStream,
+      id: action.id,
+      nodeId: action.nodeId,
+      nodeName: action.nodeName,
+      created: new Date(),
+      finished: false,
+      output: '',
+    },
+  ];
+
+  messages.set(action.conversationId, conversationMessages);
+
+  return {
+    ...state,
+    messages: {
+      ...state.messages,
+      data: messages,
+    },
+  };
+}
+
+export function updateCommandResult(
+  state: AssistState,
+  action: UpdateCommandResultAction
+): AssistState {
+  const messages = new Map(state.messages.data);
+
+  const conversationMessages = messages
+    .get(action.conversationId)
+    .map(message => {
+      if (
+        message.type === ServerMessageType.CommandResultStream &&
+        message.id === action.commandResultId
+      ) {
+        return {
+          ...message,
+          output: message.output + action.output,
+        };
+      }
+
+      return message;
+    });
+
+  messages.set(action.conversationId, conversationMessages);
+
+  return {
+    ...state,
+    messages: {
+      ...state.messages,
+      data: messages,
+    },
+  };
+}
+
+export function finishCommandResult(
+  state: AssistState,
+  action: FinishCommandResultAction
+): AssistState {
+  const messages = new Map(state.messages.data);
+
+  const conversationMessages = messages
+    .get(action.conversationId)
+    .map(message => {
+      if (
+        message.type === ServerMessageType.CommandResultStream &&
+        message.id === action.commandResultId
+      ) {
+        return {
+          ...message,
+          finished: true,
+        };
+      }
+
+      return message;
+    });
+
+  messages.set(action.conversationId, conversationMessages);
+
+  return {
+    ...state,
+    messages: {
+      ...state.messages,
+      data: messages,
+    },
+  };
+}
+
+export function addCommandResultSummary(
+  state: AssistState,
+  action: AddCommandResultSummaryAction
+): AssistState {
+  const messages = new Map(state.messages.data);
+
+  let conversationMessages = messages.get(action.conversationId);
+
+  conversationMessages = [
+    ...conversationMessages,
+    {
+      type: ServerMessageType.CommandResultSummary,
+      created: new Date(),
+      executionId: action.executionId,
+      command: action.command,
+      summary: action.summary,
+    },
+  ];
+
+  messages.set(action.conversationId, conversationMessages);
+
+  return {
+    ...state,
+    messages: {
+      ...state.messages,
+      data: messages,
+    },
+  };
+}
+export function promptMfa(
+  state: AssistState,
+  action: PromptMfaAction
+): AssistState {
+  return {
+    ...state,
+    mfa: {
+      prompt: action.promptMfa,
+      publicKey: action.publicKey,
+    },
+  };
+}
+
+export function deleteConversation(
+  state: AssistState,
+  action: DeleteConversationAction
+): AssistState {
+  const conversations = state.conversations.data;
+
+  const newSelectedId =
+    state.conversations.selectedId === action.conversationId
+      ? null
+      : state.conversations.selectedId;
+
+  return {
+    ...state,
+    conversations: {
+      ...state.conversations,
+      selectedId: newSelectedId,
+      data: conversations.filter(
+        conversation => conversation.id !== action.conversationId
+      ),
+    },
+  };
+}
+
+export function updateConversationTitle(
+  state: AssistState,
+  action: UpdateConversationTitleAction
+): AssistState {
+  const conversations = state.conversations.data;
+
+  return {
+    ...state,
+    conversations: {
+      ...state.conversations,
+      data: conversations.map(conversation => {
+        if (conversation.id === action.conversationId) {
+          return {
+            ...conversation,
+            title: action.title,
+          };
+        }
+
+        return conversation;
+      }),
+    },
+  };
+}
+
+export function toggleSidebar(
+  state: AssistState,
+  action: ToggleSidebarAction
+): AssistState {
+  return {
+    ...state,
+    sidebarVisible: action.visible,
+  };
+}
diff --git a/web/packages/teleport/src/Assist/context/utils.ts b/web/packages/teleport/src/Assist/context/utils.ts
new file mode 100644
index 0000000000000..795dcda0c7e23
--- /dev/null
+++ b/web/packages/teleport/src/Assist/context/utils.ts
@@ -0,0 +1,149 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Author, ServerMessageType } from 'teleport/Assist/types';
+
+import type {
+  ConversationMessage,
+  ExecuteRemoteCommandPayload,
+  ResolvedServerMessage,
+} from 'teleport/Assist/types';
+
+function getMessageTypeAuthor(type: string) {
+  switch (type) {
+    case ServerMessageType.User:
+      return Author.User;
+
+    case ServerMessageType.Assist:
+    case ServerMessageType.AssistThought:
+    case ServerMessageType.Command:
+    case ServerMessageType.CommandResult:
+    case ServerMessageType.CommandResultStream:
+    case ServerMessageType.CommandResultSummary:
+    case ServerMessageType.Error:
+      return Author.Teleport;
+  }
+}
+
+function findConsecutiveMessagesFromSameAuthor(
+  messages: ResolvedServerMessage[],
+  index: number,
+  author: Author
+) {
+  let i = index;
+
+  const consecutiveMessagesFromSameAuthor: ResolvedServerMessage[] = [];
+
+  while (i < messages.length) {
+    if (getMessageTypeAuthor(messages[i].type) !== author) {
+      break;
+    }
+
+    consecutiveMessagesFromSameAuthor.push(messages[i]);
+
+    i++;
+  }
+
+  return { nextIndex: i, consecutiveMessagesFromSameAuthor };
+}
+
+export function convertServerMessages(
+  messages: ResolvedServerMessage[]
+): ConversationMessage[] {
+  const conversationMessages: ConversationMessage[] = [];
+
+  let i = 0;
+
+  while (i < messages.length) {
+    const message = messages[i];
+    const author = getMessageTypeAuthor(message.type);
+
+    const { nextIndex, consecutiveMessagesFromSameAuthor } =
+      findConsecutiveMessagesFromSameAuthor(messages, i, author);
+
+    const timestamp =
+      consecutiveMessagesFromSameAuthor[
+        consecutiveMessagesFromSameAuthor.length - 1
+      ].created;
+
+    const conversationMessage: ConversationMessage = {
+      streaming: false,
+      entries: consecutiveMessagesFromSameAuthor,
+      author,
+      timestamp,
+    };
+
+    conversationMessages.push(conversationMessage);
+
+    i = nextIndex;
+  }
+
+  return conversationMessages;
+}
+
+export function convertPayloadToQuery(payload: ExecuteRemoteCommandPayload) {
+  let query = '';
+
+  if (payload.nodes?.length) {
+    query += payload.nodes.map(node => `name == "${node}"`).join(' || ');
+  }
+
+  if (payload.labels) {
+    if (payload.nodes?.length) {
+      query += ' || ';
+    }
+
+    query += payload.labels
+      .map(label => `labels["${label.key}"] == "${label.value}"`)
+      .join(' || ');
+  }
+
+  return query;
+}
+
+const ROOT_LOGINS = ['root', 'ec2-user', 'ubuntu', 'admin', 'centos'];
+
+export function sortLoginsWithRootLoginsLast(logins: string[]): string[] {
+  return logins.sort((a, b) => {
+    if (ROOT_LOGINS.includes(a) && !ROOT_LOGINS.includes(b)) {
+      return 1;
+    }
+
+    if (!ROOT_LOGINS.includes(a) && ROOT_LOGINS.includes(b)) {
+      return -1;
+    }
+
+    return a.localeCompare(b);
+  });
+}
+
+export function findIntersection<T>(elements: T[][]): T[] {
+  if (elements.length == 0) {
+    return [];
+  }
+
+  if (elements.length == 1) {
+    return elements[0];
+  }
+
+  const intersectSets = (a: Set<T>, b: Set<T>) => {
+    const c = new Set<T>();
+    a.forEach(v => b.has(v) && c.add(v));
+    return c;
+  };
+
+  return [...elements.map(e => new Set(e)).reduce(intersectSets)];
+}
diff --git a/web/packages/teleport/src/Assist/contexts/conversations.tsx b/web/packages/teleport/src/Assist/contexts/conversations.tsx
deleted file mode 100644
index df74d9a058825..0000000000000
--- a/web/packages/teleport/src/Assist/contexts/conversations.tsx
+++ /dev/null
@@ -1,145 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import React, {
-  createContext,
-  PropsWithChildren,
-  useCallback,
-  useContext,
-  useEffect,
-  useState,
-} from 'react';
-
-import Logger from 'shared/libs/logger';
-
-import api from 'teleport/services/api';
-import cfg from 'teleport/config';
-
-export interface Conversation {
-  id: string;
-  title: string;
-}
-
-interface MessageContextValue {
-  create: () => Promise<string>;
-  remove: (id: string) => Promise<void>;
-  conversations: Conversation[];
-  setConversations: React.Dispatch<React.SetStateAction<Conversation[]>>;
-  error: string | null;
-}
-
-interface CreateConversationResponse {
-  id: string;
-}
-
-interface ListConversationsResponse {
-  conversations: [
-    {
-      id: string;
-      title?: string;
-    }
-  ];
-}
-
-const logger = Logger.create('assist');
-
-const ConversationsContext = createContext<MessageContextValue>({
-  conversations: [],
-  create: () => Promise.resolve(void 0),
-  remove: () => Promise.resolve(void 0),
-  setConversations: () => void 0,
-  error: null,
-});
-
-export function ConversationsContextProvider(
-  props: PropsWithChildren<unknown>
-) {
-  const [error, setError] = useState<string>(null);
-  const [conversations, setConversations] = useState<Conversation[]>([]);
-
-  const load = useCallback(async () => {
-    setConversations([]);
-
-    const res: ListConversationsResponse = await api.get(
-      cfg.api.assistConversationsPath
-    );
-
-    setConversations(
-      res.conversations?.reverse().map(conversation => ({
-        id: conversation.id,
-        title: conversation.title ?? 'New Chat',
-      }))
-    );
-  }, []);
-
-  const create = useCallback(async () => {
-    try {
-      const res: CreateConversationResponse = await api.post(
-        cfg.api.assistConversationsPath
-      );
-
-      setConversations(conversations => [
-        {
-          id: res.id,
-          title: 'New Chat',
-        },
-        ...conversations,
-      ]);
-
-      return res.id;
-    } catch (err) {
-      setError('An error occurred whilst creating a new conversation');
-
-      logger.error(err);
-    }
-  }, []);
-
-  const remove = useCallback(async (id: string) => {
-    try {
-      setConversations(conversations =>
-        conversations.filter(conversation => conversation.id !== id)
-      );
-    } catch (err) {
-      setError('An error occurred whilst removing the conversation');
-
-      logger.error(err);
-    }
-  }, []);
-
-  useEffect(() => {
-    (async () => {
-      try {
-        await load();
-      } catch (err) {
-        setError('An error occurred whilst loading the conversation history');
-
-        logger.error(err);
-      }
-    })();
-  }, []);
-
-  return (
-    <ConversationsContext.Provider
-      value={{ conversations, create, remove, setConversations, error }}
-    >
-      {props.children}
-    </ConversationsContext.Provider>
-  );
-}
-
-export function useConversations(): MessageContextValue {
-  return useContext(ConversationsContext);
-}
diff --git a/web/packages/teleport/src/Assist/contexts/messages.test.ts b/web/packages/teleport/src/Assist/contexts/messages.test.ts
deleted file mode 100644
index ffff1a6d35815..0000000000000
--- a/web/packages/teleport/src/Assist/contexts/messages.test.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-/**
- * Copyright 2023 Gravitational, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { sortLoginsWithRootLoginsLast } from './messages';
-
-describe('assist messages', () => {
-  it('should sort logins alphabetically', () => {
-    const logins = ['test', 'login1', 'awesome', 'random', 'login2'];
-
-    const sorted = sortLoginsWithRootLoginsLast(logins);
-
-    expect(sorted).toEqual(['awesome', 'login1', 'login2', 'random', 'test']);
-  });
-
-  it('should put root logins last', () => {
-    const logins = [
-      'root',
-      'admin',
-      'test',
-      'login1',
-      'awesome',
-      'random',
-      'login2',
-    ];
-
-    const sorted = sortLoginsWithRootLoginsLast(logins);
-
-    expect(sorted).toEqual([
-      'awesome',
-      'login1',
-      'login2',
-      'random',
-      'test',
-      'admin',
-      'root',
-    ]);
-  });
-});
diff --git a/web/packages/teleport/src/Assist/contexts/messages.tsx b/web/packages/teleport/src/Assist/contexts/messages.tsx
deleted file mode 100644
index 657b07d3cbcba..0000000000000
--- a/web/packages/teleport/src/Assist/contexts/messages.tsx
+++ /dev/null
@@ -1,511 +0,0 @@
-/*
- * Copyright 2023 Gravitational, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import React, {
-  createContext,
-  PropsWithChildren,
-  useCallback,
-  useContext,
-  useEffect,
-  useRef,
-  useState,
-} from 'react';
-
-import Logger from 'shared/libs/logger';
-
-import api, { getAccessToken, getHostName } from 'teleport/services/api';
-
-import NodeService from 'teleport/services/nodes';
-import useStickyClusterId from 'teleport/useStickyClusterId';
-
-import cfg from 'teleport/config';
-
-import { ApiError } from 'teleport/services/api/parseError';
-
-import { EventType } from 'teleport/lib/term/enums';
-
-import {
-  Author,
-  ExecuteRemoteCommandContent,
-  ExecuteRemoteCommandPayload,
-  Message,
-  TextMessageContent,
-  Type,
-} from '../services/messages';
-
-interface MessageContextValue {
-  send: (message: string) => Promise<void>;
-  messages: Message[];
-  loading: boolean;
-  responding: boolean;
-  error: string | null;
-}
-
-interface ServerMessage {
-  conversation_id: string;
-  type: string;
-  payload: string;
-  created_time: string;
-}
-
-interface ConversationHistoryResponse {
-  messages: ServerMessage[];
-}
-
-const MessagesContext = createContext<MessageContextValue>({
-  messages: [],
-  send: () => Promise.resolve(void 0),
-  loading: true,
-  responding: false,
-  error: null,
-});
-
-interface MessagesContextProviderProps {
-  conversationId: string;
-}
-
-type MessagesAction = (messages: Message[]) => void;
-
-interface PartialMessagePayload {
-  content: string;
-  idx: number;
-}
-
-interface ExecEvent {
-  event: EventType.EXEC;
-  exitError?: string;
-}
-type SessionEvent = ExecEvent | { event: string };
-
-const convertToQuery = (cmd: ExecuteRemoteCommandPayload): string => {
-  let query = '';
-
-  if (cmd.nodes) {
-    query += cmd.nodes.map(node => `name == "${node}"`).join(' || ');
-  }
-
-  if (cmd.labels) {
-    if (cmd.nodes) {
-      query += ' || ';
-    }
-
-    query += cmd.labels
-      .map(label => `labels["${label.key}"] == "${label.value}"`)
-      .join(' || ');
-  }
-
-  return query;
-};
-
-const ROOT_LOGINS = ['root', 'ec2-user', 'ubuntu', 'admin', 'centos'];
-
-export function sortLoginsWithRootLoginsLast(logins: string[]): string[] {
-  return logins.sort((a, b) => {
-    if (ROOT_LOGINS.includes(a) && !ROOT_LOGINS.includes(b)) {
-      return 1;
-    }
-
-    if (!ROOT_LOGINS.includes(a) && ROOT_LOGINS.includes(b)) {
-      return -1;
-    }
-
-    return a.localeCompare(b);
-  });
-}
-
-export const remoteCommandToMessage = async (
-  execCmd: ExecuteRemoteCommandContent,
-  clusterId: string
-): Promise<ExecuteRemoteCommandContent> => {
-  try {
-    const ns = new NodeService();
-    // fetch available users
-    const nodes = await ns.fetchNodes(clusterId, {
-      query: execCmd.query,
-      limit: 100, // TODO: What if there is more nodes?
-    });
-
-    if (nodes.agents.length == 0) {
-      return {
-        ...execCmd,
-        selectedLogin: '',
-        availableLogins: [],
-        errorMsg: 'no nodes found',
-      };
-    }
-
-    const availableLogins = findIntersection(
-      nodes.agents.map(e => e.sshLogins)
-    );
-
-    let errorMsg = '';
-    if (availableLogins.length == 0) {
-      errorMsg = 'no users found';
-    }
-
-    // If the login has been selected, use it.
-    let avLogin = execCmd.selectedLogin;
-    if (!avLogin) {
-      // If the login has not been selected, use the first one.
-      avLogin = availableLogins
-        ? sortLoginsWithRootLoginsLast(availableLogins)[0]
-        : '';
-    } else {
-      // If the login has been selected, check if it is available.
-      // Updated query could have changed the available logins.
-      if (!availableLogins.includes(avLogin)) {
-        avLogin = availableLogins
-          ? sortLoginsWithRootLoginsLast(availableLogins)[0]
-          : '';
-      }
-    }
-
-    return {
-      ...execCmd,
-      selectedLogin: avLogin,
-      availableLogins: availableLogins,
-      errorMsg: errorMsg,
-    };
-  } catch (e) {
-    return {
-      ...execCmd,
-      errorMsg: (e as ApiError).message,
-    };
-  }
-};
-
-function isExecEvent(e: SessionEvent): e is ExecEvent {
-  return e.event == EventType.EXEC;
-}
-
-async function convertServerMessage(
-  message: ServerMessage,
-  clusterId: string
-): Promise<MessagesAction> {
-  if (
-    message.type === 'CHAT_MESSAGE_ASSISTANT' ||
-    message.type === 'CHAT_MESSAGE_ERROR'
-  ) {
-    const newMessage: Message = {
-      author: Author.Teleport,
-      timestamp: message.created_time,
-      content: {
-        type: Type.Message,
-        value: message.payload,
-      },
-    };
-
-    return (messages: Message[]) => messages.push(newMessage);
-  }
-
-  if (message.type === 'CHAT_PARTIAL_MESSAGE_ASSISTANT') {
-    return (messages: Message[]) => {
-      const partial: PartialMessagePayload = JSON.parse(message.payload);
-      const existing = messages.findIndex(m => m.idx === partial.idx);
-      if (existing !== -1) {
-        const copy = JSON.parse(JSON.stringify(messages[existing]));
-        (copy.content as TextMessageContent).value += partial.content;
-        messages[existing] = copy;
-      } else {
-        const newMessage: Message = {
-          author: Author.Teleport,
-          timestamp: message.created_time,
-          content: {
-            type: Type.Message,
-            value: partial.content,
-          },
-          idx: partial.idx,
-        };
-
-        messages.push(newMessage);
-      }
-    };
-  }
-
-  if (message.type === 'CHAT_PARTIAL_MESSAGE_ASSISTANT_FINALIZE') {
-    return () => {};
-  }
-
-  if (message.type == 'COMMAND_RESULT') {
-    const payload = JSON.parse(message.payload) as {
-      session_id: string;
-      execution_id: string;
-      node_id: string;
-    };
-
-    const sessionUrl = cfg.getSshPlaybackPrefixUrl({
-      clusterId: clusterId,
-      sid: payload.session_id,
-    });
-
-    const eventsResp = await api.fetch(sessionUrl + '/events');
-    const sessionExists = eventsResp.status === 200;
-    const eventsData = (await eventsResp.json()) as {
-      events: SessionEvent[];
-    };
-    const execEvent = eventsData.events.find(isExecEvent);
-
-    let msg;
-    let errorMsg;
-    if (sessionExists) {
-      // The offset here is set base on A/B test that was run between me, myself and I.
-      const stream = await api.fetch(
-        sessionUrl + '/stream?offset=0&bytes=4096',
-        {
-          Accept: 'text/plain',
-          'Content-Type': 'text/plain; charset=utf-8',
-        }
-      );
-      if (stream.status === 200) {
-        msg = await stream.text();
-      } else {
-        msg = execEvent?.exitError || ''; // empty output handled in <Output>
-      }
-    } else {
-      errorMsg = 'No session recording. The command execution failed.';
-    }
-
-    const newMessage: Message = {
-      author: Author.Teleport,
-      timestamp: message.created_time,
-      content: {
-        type: Type.ExecuteCommandOutput,
-        nodeId: payload.node_id,
-        executionId: payload.execution_id,
-        payload: msg,
-        errorMsg,
-      },
-    };
-
-    return (messages: Message[]) => messages.push(newMessage);
-  }
-
-  if (message.type === 'CHAT_MESSAGE_USER') {
-    const newMessage: Message = {
-      author: Author.User,
-      timestamp: message.created_time,
-      content: {
-        type: Type.Message,
-        value: message.payload,
-      },
-    };
-
-    return (messages: Message[]) => messages.push(newMessage);
-  }
-
-  if (message.type === 'COMMAND') {
-    const execCmd: ExecuteRemoteCommandPayload = JSON.parse(message.payload);
-    const searchQuery = convertToQuery(execCmd);
-    const executionContent = await remoteCommandToMessage(
-      {
-        ...execCmd,
-        type: Type.ExecuteRemoteCommand,
-        query: searchQuery,
-        selectedLogin: '',
-        availableLogins: [],
-        errorMsg: '',
-      },
-      clusterId
-    );
-    const newMessage = {
-      author: Author.Teleport,
-      isNew: true,
-      timestamp: message.created_time,
-      content: executionContent,
-    };
-
-    return (messages: Message[]) => messages.push(newMessage);
-  }
-
-  throw new Error('unrecognized message type');
-}
-
-function findIntersection<T>(elems: T[][]): T[] {
-  if (elems.length == 0) {
-    return [];
-  }
-
-  if (elems.length == 1) {
-    return elems[0];
-  }
-
-  const intersectSets = (a: Set<T>, b: Set<T>) => {
-    const c = new Set<T>();
-    a.forEach(v => b.has(v) && c.add(v));
-    return c;
-  };
-
-  return [...elems.map(e => new Set(e)).reduce(intersectSets)];
-}
-
-export async function generateTitle(messageContent: string): Promise<string> {
-  const res: {
-    title: string;
-  } = await api.post(cfg.api.assistGenerateSummaryPath, {
-    message: messageContent,
-  });
-  return res.title;
-}
-
-export async function setConversationTitle(
-  conversationId: string,
-  title: string
-): Promise<void> {
-  await api.post(cfg.getAssistSetConversationTitleUrl(conversationId), {
-    title: title,
-  });
-}
-
-const TEN_MINUTES = 10 * 60 * 1000;
-
-const logger = Logger.create('assist');
-
-export function MessagesContextProvider(
-  props: PropsWithChildren<MessagesContextProviderProps>
-) {
-  const { clusterId } = useStickyClusterId();
-
-  const [error, setError] = useState<string>(null);
-  const [loading, setLoading] = useState(true);
-  const [responding, setResponding] = useState(false);
-  const [messages, setMessages] = useState<Message[]>([]);
-
-  const webSocketRef = useRef<WebSocket>(null);
-
-  const setupWebSocket = useCallback(() => {
-    if (webSocketRef.current) {
-      webSocketRef.current.close();
-    }
-
-    const socketUrl = cfg.getAssistConversationWebSocketUrl(
-      getHostName(),
-      clusterId,
-      getAccessToken(),
-      props.conversationId
-    );
-
-    webSocketRef.current = new WebSocket(socketUrl);
-
-    webSocketRef.current.onmessage = async (event: MessageEvent) => {
-      const value = JSON.parse(event.data) as ServerMessage;
-
-      // When a streaming message ends, or a non-streaming message arrives
-      if (
-        value.type === 'CHAT_PARTIAL_MESSAGE_ASSISTANT_FINALIZE' ||
-        value.type === 'COMMAND' ||
-        value.type === 'CHAT_MESSAGE_ASSISTANT' ||
-        value.type === 'CHAT_MESSAGE_ERROR'
-      ) {
-        setResponding(false);
-      }
-
-      convertServerMessage(value, clusterId).then(res => {
-        setMessages(prev => {
-          const curr = [...prev];
-          res(curr);
-          return curr;
-        });
-      });
-    };
-  }, []);
-
-  useEffect(() => {
-    setupWebSocket();
-
-    // refresh the websocket connection every 10 minutes to avoid
-    // session timeouts
-    const id = window.setInterval(setupWebSocket, TEN_MINUTES * 0.8);
-
-    return () => {
-      window.clearInterval(id);
-
-      if (webSocketRef.current) {
-        webSocketRef.current.close();
-      }
-    };
-  }, []);
-
-  const load = useCallback(async () => {
-    setMessages([]);
-
-    const res: ConversationHistoryResponse = await api.get(
-      cfg.getAssistConversationHistoryUrl(props.conversationId)
-    );
-
-    if (!res.messages) {
-      return;
-    }
-
-    let messages: Message[] = [];
-    for (const m of res.messages) {
-      const action = await convertServerMessage(m, clusterId);
-      action(messages);
-    }
-
-    setMessages(messages.map(message => ({ ...message, isNew: false })));
-  }, [props.conversationId]);
-
-  useEffect(() => {
-    (async () => {
-      setLoading(true);
-
-      try {
-        await load();
-
-        setLoading(false);
-      } catch (err) {
-        setError('An error occurred whilst loading the conversation history');
-
-        logger.error(err);
-      }
-    })();
-  }, [props.conversationId]);
-
-  const send = useCallback(
-    async (message: string) => {
-      setResponding(true);
-
-      const newMessages = [
-        ...messages,
-        {
-          author: Author.User,
-          timestamp: new Date().toISOString(),
-          isNew: true,
-          content: { type: Type.Message, value: message } as const,
-        },
-      ];
-
-      setMessages(newMessages);
-
-      const data = JSON.stringify({ payload: message });
-
-      webSocketRef.current.send(data);
-    },
-    [messages]
-  );
-
-  return (
-    <MessagesContext.Provider
-      value={{ messages, send, loading, responding, error }}
-    >
-      {props.children}
-    </MessagesContext.Provider>
-  );
-}
-
-export function useMessages() {
-  return useContext(MessagesContext);
-}
diff --git a/web/packages/teleport/src/Assist/index.ts b/web/packages/teleport/src/Assist/index.ts
index 591627ba1a73a..163e4172e7213 100644
--- a/web/packages/teleport/src/Assist/index.ts
+++ b/web/packages/teleport/src/Assist/index.ts
@@ -1,17 +1,17 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
 export { Assist as default } from './Assist';
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/styles/markdown.ts b/web/packages/teleport/src/Assist/markdown.ts
similarity index 96%
rename from web/packages/teleport/src/Assist/Chat/ChatItem/styles/markdown.ts
rename to web/packages/teleport/src/Assist/markdown.ts
index 93bff8473f379..87275960a47f2 100644
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/styles/markdown.ts
+++ b/web/packages/teleport/src/Assist/markdown.ts
@@ -1,18 +1,18 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
 import { css } from 'styled-components';
 
@@ -321,7 +321,7 @@ export const markdownCSS = css`
   h5,
   h6 {
     margin-top: 24px;
-    margin-bottom: 16px;
+    margin-bottom: 10px;
     font-weight: var(--base-text-weight-semibold, 600);
     line-height: 1.25;
   }
@@ -468,7 +468,7 @@ export const markdownCSS = css`
   pre,
   details {
     margin-top: 0;
-    margin-bottom: 16px;
+    margin-bottom: 10px;
   }
 
   blockquote > :first-of-type {
@@ -608,7 +608,7 @@ export const markdownCSS = css`
 
   dl dd {
     padding: 0 16px;
-    margin-bottom: 16px;
+    margin-bottom: 10px;
   }
 
   table th {
@@ -774,7 +774,7 @@ export const markdownCSS = css`
   }
 
   .highlight {
-    margin-bottom: 16px;
+    margin-bottom: 10px;
   }
 
   .highlight pre {
@@ -789,6 +789,7 @@ export const markdownCSS = css`
     font-size: 85%;
     line-height: 1.45;
     background-color: var(--color-canvas-subtle);
+    color: white;
     border-radius: 6px;
   }
 
diff --git a/web/packages/teleport/src/Assist/service.test.ts b/web/packages/teleport/src/Assist/service.test.ts
new file mode 100644
index 0000000000000..dca38cbcbfcf0
--- /dev/null
+++ b/web/packages/teleport/src/Assist/service.test.ts
@@ -0,0 +1,155 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { rest } from 'msw';
+import { setupServer } from 'msw/node';
+
+import cfg from 'teleport/config';
+import { EventType } from 'teleport/lib/term/enums';
+import {
+  getLoginsForQuery,
+  getSessionEvents,
+  resolveServerCommandResultMessage,
+} from 'teleport/Assist/service';
+import { ExecEvent, ServerMessageType } from 'teleport/Assist/types';
+
+const sessionUrl = cfg.getSshPlaybackPrefixUrl({
+  clusterId: 'test-cluster',
+  sid: 'some-session-id',
+});
+
+const sessionUrlEmptyStream = cfg.getSshPlaybackPrefixUrl({
+  clusterId: 'test-cluster',
+  sid: 'some-empty-stream-session-id',
+});
+
+const nodesUrl = cfg
+  .getClusterNodesUrl('cluster-id-nodes', { query: 'name == "node"' })
+  .split('?')[0]; // remove the query params to make MSW happy;
+const noNodesUrl = cfg
+  .getClusterNodesUrl('cluster-id-no-nodes', { query: 'name == "node"' })
+  .split('?')[0]; // remove the query params to make MSW happy;
+
+const server = setupServer(
+  rest.get(sessionUrl + '/events', (req, res, ctx) => {
+    return res(
+      ctx.json({
+        events: [
+          {
+            event: EventType.EXEC,
+            exitError: 'some error',
+          },
+        ],
+      })
+    );
+  }),
+  rest.get(sessionUrl + '/stream', (req, res, ctx) => {
+    return res(ctx.text('some text'));
+  }),
+  rest.get(sessionUrlEmptyStream + '/stream', (req, res, ctx) => {
+    return res(ctx.status(404));
+  }),
+  rest.get(sessionUrlEmptyStream + '/events', (req, res, ctx) => {
+    return res(
+      ctx.json({
+        events: [
+          {
+            event: EventType.EXEC,
+            exitError: 'some error',
+          },
+        ],
+      })
+    );
+  }),
+  rest.get(nodesUrl, (req, res, ctx) => {
+    return res(
+      ctx.json({
+        items: [
+          {
+            id: 'node-id',
+            sshLogins: [],
+          },
+        ],
+      })
+    );
+  }),
+  rest.get(noNodesUrl, (req, res, ctx) => {
+    return res(
+      ctx.json({
+        items: [],
+      })
+    );
+  })
+);
+
+beforeAll(() => server.listen());
+
+afterEach(() => server.resetHandlers());
+
+afterAll(() => server.close());
+
+describe('assist service', () => {
+  it('should return session events', async () => {
+    const events = await getSessionEvents(sessionUrl);
+
+    expect(events.events).toHaveLength(1);
+    expect((events.events[0] as ExecEvent).exitError).toBe('some error');
+  });
+
+  it('should resolve a command result output to the stream text', async () => {
+    const resolvedMessage = await resolveServerCommandResultMessage(
+      {
+        type: ServerMessageType.CommandResult,
+        payload: JSON.stringify({
+          session_id: 'some-session-id',
+        }),
+        created_time: '2021-01-01T00:00:00Z',
+        conversation_id: 'some-conversation-id',
+      },
+      'test-cluster'
+    );
+
+    expect(resolvedMessage.output).toBe('some text');
+  });
+
+  it('should resolve a command result output to exec events exit error if no stream', async () => {
+    const resolvedMessage = await resolveServerCommandResultMessage(
+      {
+        type: ServerMessageType.CommandResult,
+        payload: JSON.stringify({
+          session_id: 'some-empty-stream-session-id',
+        }),
+        created_time: '2021-01-01T00:00:00Z',
+        conversation_id: 'some-conversation-id',
+      },
+      'test-cluster'
+    );
+
+    expect(resolvedMessage.output).toBe('some error');
+  });
+
+  it('should throw an error if there are no nodes', async () => {
+    await expect(
+      getLoginsForQuery('name == "node"', 'cluster-id-no-nodes')
+    ).rejects.toThrow('No nodes match the query');
+  });
+
+  it('should throw an error if there are no logins for the nodes', async () => {
+    await expect(
+      getLoginsForQuery('name == "node"', 'cluster-id-nodes')
+    ).rejects.toThrow('No available logins found');
+  });
+});
diff --git a/web/packages/teleport/src/Assist/service.ts b/web/packages/teleport/src/Assist/service.ts
new file mode 100644
index 0000000000000..9de574d06da5a
--- /dev/null
+++ b/web/packages/teleport/src/Assist/service.ts
@@ -0,0 +1,264 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import api from 'teleport/services/api';
+import cfg from 'teleport/config';
+
+import {
+  convertPayloadToQuery,
+  findIntersection,
+  sortLoginsWithRootLoginsLast,
+} from 'teleport/Assist/context/utils';
+
+import { EventType } from 'teleport/lib/term/enums';
+
+import NodeService from 'teleport/services/nodes';
+
+import {
+  ResolvedAssistThoughtServerMessage,
+  ServerMessageType,
+  ThoughtMessagePayload,
+} from './types';
+
+import type {
+  CommandResultPayload,
+  CommandResultSummaryPayload,
+  Conversation,
+  CreateConversationResponse,
+  ExecEvent,
+  ExecuteRemoteCommandPayload,
+  GenerateTitleResponse,
+  GetConversationMessagesResponse,
+  GetConversationsResponse,
+  ResolvedCommandResultServerMessage,
+  ResolvedCommandResultSummaryServerMessage,
+  ResolvedCommandServerMessage,
+  ResolvedServerMessage,
+  ServerMessage,
+  SessionEvent,
+} from './types';
+
+export async function loadConversations(): Promise<Conversation[]> {
+  const res: GetConversationsResponse = await api.get(
+    cfg.api.assistConversationsPath
+  );
+
+  return res.conversations.reverse().map(({ id, title, created_time }) => ({
+    id,
+    title: title || 'New Conversation',
+    created: new Date(created_time),
+  }));
+}
+
+export async function resolveServerMessage(
+  message: ServerMessage,
+  clusterId: string
+): Promise<ResolvedServerMessage> {
+  switch (message.type) {
+    case ServerMessageType.Command:
+      return resolveServerCommandMessage(message);
+
+    case ServerMessageType.CommandResult:
+      return resolveServerCommandResultMessage(message, clusterId);
+
+    case ServerMessageType.CommandResultSummary:
+      return resolveServerCommandResultSummaryMessage(message);
+    case ServerMessageType.AssistThought:
+      return resolveServerAssistThoughtMessage(message);
+    case ServerMessageType.Assist:
+    case ServerMessageType.User:
+      return {
+        type: message.type,
+        message: message.payload,
+        created: new Date(message.created_time),
+      };
+  }
+}
+
+export async function getSessionEvents(sessionUrl: string): Promise<{
+  events: SessionEvent[] | null;
+}> {
+  const response = await api.fetch(sessionUrl + '/events');
+
+  if (response.status !== 200) {
+    throw new Error('No session recording. The command execution failed.');
+  }
+
+  return response.json();
+}
+
+export async function getSessionStream(sessionUrl: string) {
+  const stream = await api.fetch(sessionUrl + '/stream?offset=0&bytes=4096', {
+    Accept: 'text/plain',
+    'Content-Type': 'text/plain; charset=utf-8',
+  });
+
+  if (stream.status === 200) {
+    return stream.text();
+  }
+}
+
+function isExecEvent(e: SessionEvent): e is ExecEvent {
+  return e.event == EventType.EXEC;
+}
+
+export function getNodesFromQuery(query: string, clusterId: string) {
+  const ns = new NodeService();
+
+  return ns.fetchNodes(clusterId, {
+    query,
+    limit: 100, // TODO: What if there is more nodes?
+  });
+}
+
+export async function getLoginsForQuery(query: string, clusterId: string) {
+  const nodes = await getNodesFromQuery(query, clusterId);
+
+  if (!nodes.agents.length) {
+    throw new Error('No nodes match the query');
+  }
+
+  const availableLogins = findIntersection(nodes.agents.map(e => e.sshLogins));
+
+  if (!availableLogins.length) {
+    throw new Error('No available logins found');
+  }
+
+  return sortLoginsWithRootLoginsLast(availableLogins);
+}
+
+export async function resolveServerCommandResultMessage(
+  message: ServerMessage,
+  clusterId: string
+): Promise<ResolvedCommandResultServerMessage> {
+  const payload = JSON.parse(message.payload) as CommandResultPayload;
+
+  try {
+    const sessionUrl = cfg.getSshPlaybackPrefixUrl({
+      clusterId,
+      sid: payload.session_id,
+    });
+
+    let output = await getSessionStream(sessionUrl);
+
+    if (!output) {
+      const events = await getSessionEvents(sessionUrl);
+      const execEvent = events.events?.find(isExecEvent);
+
+      output = execEvent?.exitError || 'Empty output';
+    }
+
+    return {
+      type: ServerMessageType.CommandResult,
+      nodeId: payload.node_id,
+      nodeName: payload.node_name,
+      executionId: payload.execution_id,
+      sessionId: payload.session_id,
+      created: new Date(message.created_time),
+      output,
+    };
+  } catch (err) {
+    return {
+      type: ServerMessageType.CommandResult,
+      nodeId: payload.node_id,
+      nodeName: payload.node_name,
+      executionId: payload.execution_id,
+      sessionId: payload.session_id,
+      created: new Date(message.created_time),
+      errorMessage: err.message,
+    };
+  }
+}
+
+export function resolveServerCommandResultSummaryMessage(
+  message: ServerMessage
+): ResolvedCommandResultSummaryServerMessage {
+  const payload = JSON.parse(message.payload) as CommandResultSummaryPayload;
+
+  return {
+    type: ServerMessageType.CommandResultSummary,
+    executionId: payload.execution_id,
+    command: payload.command,
+    summary: payload.summary,
+    created: new Date(message.created_time),
+  };
+}
+
+export function resolveServerAssistThoughtMessage(
+  message: ServerMessage
+): ResolvedAssistThoughtServerMessage {
+  const payload = JSON.parse(message.payload) as ThoughtMessagePayload;
+
+  return {
+    type: ServerMessageType.AssistThought,
+    message: payload.action,
+    created: new Date(message.created_time),
+  };
+}
+
+export function resolveServerCommandMessage(
+  message: ServerMessage
+): ResolvedCommandServerMessage {
+  const payload: ExecuteRemoteCommandPayload = JSON.parse(message.payload);
+  const query = convertPayloadToQuery(payload);
+
+  return {
+    type: ServerMessageType.Command,
+    created: new Date(message.created_time),
+    query,
+    command: payload.command,
+  };
+}
+
+export async function loadConversationMessages(conversationId: string) {
+  const res: GetConversationMessagesResponse = await api.get(
+    cfg.getAssistConversationHistoryUrl(conversationId)
+  );
+
+  return res.messages;
+}
+
+export async function createConversation() {
+  const res: CreateConversationResponse = await api.post(
+    cfg.api.assistConversationsPath
+  );
+
+  return res.id;
+}
+
+export function deleteConversation(conversationId: string) {
+  return api.delete(cfg.getAssistConversationHistoryUrl(conversationId));
+}
+
+export async function generateTitle(messageContent: string): Promise<string> {
+  const res: GenerateTitleResponse = await api.post(
+    cfg.api.assistGenerateSummaryPath,
+    {
+      message: messageContent,
+    }
+  );
+
+  return res.title;
+}
+
+export async function setConversationTitle(
+  conversationId: string,
+  title: string
+): Promise<void> {
+  await api.post(cfg.getAssistSetConversationTitleUrl(conversationId), {
+    title: title,
+  });
+}
diff --git a/web/packages/teleport/src/Assist/services/messages.ts b/web/packages/teleport/src/Assist/services/messages.ts
deleted file mode 100644
index c896e5c0f79de..0000000000000
--- a/web/packages/teleport/src/Assist/services/messages.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-export enum Author {
-  Teleport,
-  User,
-}
-
-export enum Type {
-  Message = 'message',
-  ExecuteRemoteCommand = 'connect',
-  ExecuteCommandOutput = 'execution_output',
-}
-
-export interface Label {
-  key: string;
-  value: string;
-}
-
-export interface ExecuteRemoteCommandContent {
-  type: Type.ExecuteRemoteCommand;
-  command: string;
-  selectedLogin: string;
-  availableLogins: string[];
-  query: string;
-  errorMsg: string;
-}
-
-export interface ExecuteRemoteCommandPayload {
-  type: Type.ExecuteRemoteCommand;
-  command: string;
-  login?: string;
-  labels?: { key: string; value: string }[];
-  nodes?: string[];
-}
-
-export interface TextMessageContent {
-  type: Type.Message;
-  value: string;
-}
-
-export interface CommandExecutionOutput {
-  type: Type.ExecuteCommandOutput;
-  nodeId: string;
-  executionId: string;
-  payload: string;
-  errorMsg?: string;
-}
-
-export type MessageContent =
-  | TextMessageContent
-  | ExecuteRemoteCommandContent
-  | CommandExecutionOutput;
-
-export interface Message {
-  isNew?: boolean;
-  content: MessageContent;
-  author: Author;
-  idx?: number;
-  timestamp: string;
-}
-
-export interface ExecOutput {
-  humanInterpretation: string;
-  commandOutputs: { serverName: string; commandOutput: string }[];
-}
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/common.ts b/web/packages/teleport/src/Assist/shared/HeaderIcon.ts
similarity index 53%
rename from web/packages/teleport/src/Assist/Chat/ChatItem/Action/common.ts
rename to web/packages/teleport/src/Assist/shared/HeaderIcon.ts
index 6e526bafa2022..a2a67e55d2704 100644
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/common.ts
+++ b/web/packages/teleport/src/Assist/shared/HeaderIcon.ts
@@ -16,40 +16,32 @@
 
 import styled from 'styled-components';
 
-import { Type } from 'teleport/Assist/services/messages';
+import { Tooltip } from 'teleport/Assist/shared/Tooltip';
 
-export const Container = styled.div`
-  border: 1px solid ${p => p.theme.colors.spotBackground[2]};
-  border-radius: 10px;
-  padding: 15px 20px;
-  position: relative;
-  width: 100%;
-  box-sizing: border-box;
-  display: flex;
-  flex-direction: column;
-`;
-
-export const Title = styled.div`
-  font-size: 14px;
-  margin-bottom: 10px;
-`;
-
-export const Items = styled.div`
+export const HeaderIcon = styled.div`
+  border-radius: 7px;
+  width: 38px;
+  height: 38px;
   display: flex;
-  flex-wrap: wrap;
-  margin-top: -10px;
   align-items: center;
+  justify-content: center;
+  cursor: pointer;
+  transition: 0.2s ease-in-out opacity;
+  position: relative;
 
-  > * {
-    margin-top: 10px;
+  ${Tooltip} {
+    display: none;
   }
-`;
 
-export function getTextForType(type: Type) {
-  switch (type) {
-    case Type.ExecuteRemoteCommand:
-      return 'Connect to';
-    case Type.Message:
-      return '';
+  svg {
+    transform: ${p => (p.rotated ? 'rotate(180deg)' : 'none')};
+  }
+
+  &:hover {
+    background: ${p => p.theme.colors.spotBackground[0]};
+
+    ${Tooltip} {
+      display: block;
+    }
   }
-}
+`;
diff --git a/web/packages/teleport/src/Assist/shared/Tooltip.ts b/web/packages/teleport/src/Assist/shared/Tooltip.ts
new file mode 100644
index 0000000000000..69a557167c1a9
--- /dev/null
+++ b/web/packages/teleport/src/Assist/shared/Tooltip.ts
@@ -0,0 +1,81 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import styled from 'styled-components';
+
+interface TooltipPositionProps {
+  position: 'left' | 'middle' | 'right';
+}
+
+const tooltipPosition = (props: TooltipPositionProps) => {
+  if (props.position === 'right') {
+    return {
+      right: '2px',
+    };
+  }
+  if (props.position === 'middle') {
+    return {
+      left: '50%',
+      transform: 'translateX(-50%)',
+    };
+  }
+  return {
+    left: '2px',
+  };
+};
+const tooltipCaretPosition = (props: TooltipPositionProps) => {
+  if (props.position === 'right') {
+    return {
+      right: '10px',
+    };
+  }
+  if (props.position === 'middle') {
+    return {
+      left: '50%',
+      transform: 'translateX(-50%)',
+    };
+  }
+  return {
+    left: '10px',
+  };
+};
+
+export const Tooltip = styled.div<TooltipPositionProps>`
+  ${tooltipPosition};
+
+  position: absolute;
+  white-space: nowrap;
+  pointer-events: none;
+  top: 40px;
+  z-index: 999;
+  background: rgba(0, 0, 0, 0.8);
+  color: white;
+  border-radius: 7px;
+  padding: 5px 8px;
+
+  &:after {
+    content: '';
+    position: absolute;
+    width: 0;
+    height: 0;
+    border-style: solid;
+    border-width: 0 7px 7px 7px;
+    border-color: transparent transparent rgba(0, 0, 0, 0.8) transparent;
+    top: -7px;
+
+    ${tooltipCaretPosition};
+  }
+`;
diff --git a/web/packages/teleport/src/Assist/shared/index.ts b/web/packages/teleport/src/Assist/shared/index.ts
new file mode 100644
index 0000000000000..4e34619f11062
--- /dev/null
+++ b/web/packages/teleport/src/Assist/shared/index.ts
@@ -0,0 +1,18 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { HeaderIcon } from './HeaderIcon';
+export { Tooltip } from './Tooltip';
diff --git a/web/packages/teleport/src/Assist/types.ts b/web/packages/teleport/src/Assist/types.ts
new file mode 100644
index 0000000000000..5e205d3a0c5e7
--- /dev/null
+++ b/web/packages/teleport/src/Assist/types.ts
@@ -0,0 +1,212 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { EventType } from 'teleport/lib/term/enums';
+
+export enum ServerMessageType {
+  Assist = 'CHAT_MESSAGE_ASSISTANT',
+  User = 'CHAT_MESSAGE_USER',
+  Error = 'CHAT_MESSAGE_ERROR',
+  Command = 'COMMAND',
+  CommandResult = 'COMMAND_RESULT',
+  CommandResultSummary = 'COMMAND_RESULT_SUMMARY',
+  CommandResultStream = 'COMMAND_RESULT_STREAM',
+  AssistPartialMessage = 'CHAT_PARTIAL_MESSAGE_ASSISTANT',
+  AssistPartialMessageEnd = 'CHAT_PARTIAL_MESSAGE_ASSISTANT_FINALIZE',
+  AssistThought = 'CHAT_MESSAGE_PROGRESS_UPDATE',
+}
+
+export const ExecutionEnvelopeType = 'summary';
+
+export interface Conversation {
+  id: string;
+  title?: string;
+  created: Date;
+}
+
+export interface GetConversationsResponse {
+  conversations: [
+    {
+      id: string;
+      title?: string;
+      created_time: string;
+    }
+  ];
+}
+
+export interface ServerMessage {
+  type: ServerMessageType;
+  conversation_id: string;
+  payload: string;
+  created_time: string;
+}
+
+export interface ResolvedCommandServerMessage {
+  type: ServerMessageType.Command;
+  created: Date;
+  query: string;
+  command: string;
+}
+
+export interface ResolvedCommandResultServerMessage {
+  type: ServerMessageType.CommandResult;
+  nodeId: string;
+  nodeName: string;
+  executionId: string;
+  sessionId: string;
+  output?: string;
+  errorMessage?: string;
+  created: Date;
+}
+
+export interface ResolvedCommandResultSummaryServerMessage {
+  type: ServerMessageType.CommandResultSummary;
+  executionId: string;
+  summary: string;
+  command: string;
+  created: Date;
+}
+
+export interface ResolvedAssistThoughtServerMessage {
+  type: ServerMessageType.AssistThought;
+  message: string;
+  created: Date;
+}
+
+export interface ResolvedAssistServerMessage {
+  type: ServerMessageType.Assist;
+  message: string;
+  created: Date;
+}
+
+export interface ResolvedUserServerMessage {
+  type: ServerMessageType.User;
+  message: string;
+  created: Date;
+}
+
+export interface ResolvedErrorServerMessage {
+  type: ServerMessageType.Error;
+  message: string;
+  created: Date;
+}
+
+export interface ResolvedCommandResultStreamServerMessage {
+  type: ServerMessageType.CommandResultStream;
+  id: number;
+  nodeId: string;
+  nodeName: string;
+  output: string;
+  finished: boolean;
+  created: Date;
+}
+
+export type ResolvedServerMessage =
+  | ResolvedCommandServerMessage
+  | ResolvedAssistServerMessage
+  | ResolvedUserServerMessage
+  | ResolvedErrorServerMessage
+  | ResolvedCommandResultServerMessage
+  | ResolvedCommandResultSummaryServerMessage
+  | ResolvedAssistThoughtServerMessage
+  | ResolvedCommandResultStreamServerMessage;
+
+export interface GetConversationMessagesResponse {
+  messages: ServerMessage[];
+}
+
+export enum Author {
+  Teleport,
+  User,
+}
+
+export interface CreateConversationResponse {
+  id: string;
+}
+
+export interface GenerateTitleResponse {
+  title: string;
+}
+
+export interface ConversationMessage {
+  streaming: boolean;
+  entries: ResolvedServerMessage[];
+  author: Author;
+  timestamp: Date;
+}
+
+export interface CommandResultPayload {
+  node_id: string;
+  node_name: string;
+  session_id: string;
+  execution_id: string;
+}
+
+export interface CommandResultSummaryPayload {
+  execution_id: string;
+  command: string;
+  summary: string;
+}
+
+export interface ThoughtMessagePayload {
+  action: string;
+}
+
+export interface ExecEvent {
+  event: EventType.EXEC;
+  exitError?: string;
+}
+
+export type SessionEvent = ExecEvent | { event: string };
+
+export enum RunActionStatus {
+  Connecting,
+  Finished,
+}
+
+export interface NodeState {
+  nodeId: string;
+  status: RunActionStatus;
+  stdout?: string;
+}
+
+export interface RawPayload {
+  node_id: string;
+  type: string;
+  payload: string;
+}
+
+export interface SessionData {
+  session: { server_id: string };
+}
+
+export interface ExecuteRemoteCommandPayload {
+  command: string;
+  login?: string;
+  labels?: { key: string; value: string }[];
+  nodes?: string[];
+}
+
+export enum ViewMode {
+  Docked = 1,
+  Popup = 2,
+  PopupExpanded = 3,
+  PopupExpandedSidebarVisible = 4,
+}
+
+export interface AssistUserPreferences {
+  preferredLogins: string[];
+  viewMode: ViewMode;
+}
diff --git a/web/packages/teleport/src/Console/ActionBar/ActionBar.tsx b/web/packages/teleport/src/Console/ActionBar/ActionBar.tsx
index ef7bf804902d6..45ac040e00265 100644
--- a/web/packages/teleport/src/Console/ActionBar/ActionBar.tsx
+++ b/web/packages/teleport/src/Console/ActionBar/ActionBar.tsx
@@ -31,7 +31,7 @@ export default function ActionBar(props: Props) {
       >
         <MenuItem as={NavLink} to={cfg.routes.root}>
           <MenuItemIcon as={Icons.Home} mr="2" />
-          Main
+          Home
         </MenuItem>
         <MenuItem>
           <ButtonPrimary my={3} block onClick={props.onLogout}>
diff --git a/web/packages/teleport/src/Console/Console.story.tsx b/web/packages/teleport/src/Console/Console.story.tsx
index 0b7fa4a7032bb..4a38d37c442d6 100644
--- a/web/packages/teleport/src/Console/Console.story.tsx
+++ b/web/packages/teleport/src/Console/Console.story.tsx
@@ -21,7 +21,6 @@ import { createMemoryHistory } from 'history';
 import { Router, Route } from 'react-router';
 
 import Console from './Console';
-import { colors } from './colors';
 import ConsoleContext from './consoleContext';
 import ConsoleContextProvider from './consoleContextProvider';
 
@@ -59,7 +58,6 @@ export function TestLayout(props: PropType) {
             style={{ position: 'absolute' }}
             width="100%"
             height="100%"
-            bg={colors.bgTerminal}
           >
             {props.children}
           </Flex>
diff --git a/web/packages/teleport/src/Console/Console.tsx b/web/packages/teleport/src/Console/Console.tsx
index 7f16a0936a995..ab7c74f6fe8c5 100644
--- a/web/packages/teleport/src/Console/Console.tsx
+++ b/web/packages/teleport/src/Console/Console.tsx
@@ -25,7 +25,6 @@ import AjaxPoller from 'teleport/components/AjaxPoller';
 
 import { useConsoleContext, useStoreDocs } from './consoleContextProvider';
 import * as stores from './stores/types';
-import { colors } from './colors';
 import Tabs from './Tabs';
 import ActionBar from './ActionBar';
 import DocumentSsh from './DocumentSsh';
@@ -36,8 +35,6 @@ import useTabRouting from './useTabRouting';
 import useOnExitConfirmation from './useOnExitConfirmation';
 import useKeyboardNav from './useKeyboardNav';
 
-import { ConsoleThemeProvider } from './ThemeProvider';
-
 const POLL_INTERVAL = 5000; // every 5 sec
 
 export default function Console() {
@@ -87,39 +84,37 @@ export default function Console() {
   ));
 
   return (
-    <ConsoleThemeProvider>
-      <StyledConsole>
-        {attempt.status === 'failed' && (
-          <Danger>{`Error: ${attempt.statusText} (Try refreshing the page)`}</Danger>
-        )}
-        {attempt.status === 'processing' && (
-          <Box textAlign="center" m={10}>
-            <Indicator />
-          </Box>
-        )}
-        {attempt.status === 'success' && (
-          <>
-            <Flex bg={colors.terminalDark} height="32px">
-              <Tabs
-                flex="1"
-                items={documents}
-                onClose={onTabClose}
-                onSelect={onTabClick}
-                activeTab={activeDocId}
-                clusterId={clusterId}
-                disableNew={disableNewTab}
-                onNew={onTabNew}
-              />
-              <ActionBar onLogout={onLogout} />
-            </Flex>
-            {$docs}
-            {hasSshSessions && (
-              <AjaxPoller time={POLL_INTERVAL} onFetch={onRefresh} />
-            )}
-          </>
-        )}
-      </StyledConsole>
-    </ConsoleThemeProvider>
+    <StyledConsole>
+      {attempt.status === 'failed' && (
+        <Danger>{`Error: ${attempt.statusText} (Try refreshing the page)`}</Danger>
+      )}
+      {attempt.status === 'processing' && (
+        <Box textAlign="center" m={10}>
+          <Indicator />
+        </Box>
+      )}
+      {attempt.status === 'success' && (
+        <>
+          <Flex bg="levels.surface" height="32px">
+            <Tabs
+              flex="1"
+              items={documents}
+              onClose={onTabClose}
+              onSelect={onTabClick}
+              activeTab={activeDocId}
+              clusterId={clusterId}
+              disableNew={disableNewTab}
+              onNew={onTabNew}
+            />
+            <ActionBar onLogout={onLogout} />
+          </Flex>
+          {$docs}
+          {hasSshSessions && (
+            <AjaxPoller time={POLL_INTERVAL} onFetch={onRefresh} />
+          )}
+        </>
+      )}
+    </StyledConsole>
   );
 }
 
@@ -141,7 +136,7 @@ function MemoizedDocument(props: { doc: stores.Document; visible: boolean }) {
 }
 
 const StyledConsole = styled.div`
-  background-color: ${colors.bgTerminal};
+  background-color: ${props => props.theme.colors.levels.sunken};
   bottom: 0;
   left: 0;
   position: absolute;
diff --git a/web/packages/teleport/src/Console/Document/Document.tsx b/web/packages/teleport/src/Console/Document/Document.tsx
index 3f04f1e29b208..0252eb6b1137d 100644
--- a/web/packages/teleport/src/Console/Document/Document.tsx
+++ b/web/packages/teleport/src/Console/Document/Document.tsx
@@ -17,8 +17,6 @@ limitations under the License.
 import React from 'react';
 import { Flex } from 'design';
 
-import { colors } from '../colors';
-
 const Document: React.FC<{ visible: boolean; [x: string]: any }> = ({
   visible,
   children,
@@ -28,7 +26,6 @@ const Document: React.FC<{ visible: boolean; [x: string]: any }> = ({
     flex="1"
     style={{
       overflow: 'auto',
-      background: colors.bgTerminal,
       display: visible ? 'flex' : 'none',
       position: 'relative',
     }}
diff --git a/web/packages/teleport/src/Console/DocumentBlank/DocumentBlank.tsx b/web/packages/teleport/src/Console/DocumentBlank/DocumentBlank.tsx
index 73bff25406be4..f684bdbf612c5 100644
--- a/web/packages/teleport/src/Console/DocumentBlank/DocumentBlank.tsx
+++ b/web/packages/teleport/src/Console/DocumentBlank/DocumentBlank.tsx
@@ -21,8 +21,6 @@ import * as Icons from 'design/Icon';
 import { useConsoleContext } from 'teleport/Console/consoleContextProvider';
 import * as stores from 'teleport/Console/stores';
 
-import { colors } from '../colors';
-
 import Document from './../Document';
 
 export default function DocumentBlank(props: PropTypes) {
@@ -40,7 +38,9 @@ export default function DocumentBlank(props: PropTypes) {
           fontSize="256px"
           mt="10"
           mb="6"
-          color={colors.terminalDark}
+          css={`
+            color: ${props => props.theme.colors.spotBackground[1]};
+          `}
         />
         <ButtonPrimary onClick={onClick} children="Start a New Session" />
       </Flex>
diff --git a/web/packages/teleport/src/Console/DocumentBlank/__snapshots__/DocumentBlank.story.test.tsx.snap b/web/packages/teleport/src/Console/DocumentBlank/__snapshots__/DocumentBlank.story.test.tsx.snap
index 6082b37813cc8..18ce296773300 100644
--- a/web/packages/teleport/src/Console/DocumentBlank/__snapshots__/DocumentBlank.story.test.tsx.snap
+++ b/web/packages/teleport/src/Console/DocumentBlank/__snapshots__/DocumentBlank.story.test.tsx.snap
@@ -1,7 +1,7 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`render DocumentBlank 1`] = `
-.c4 {
+.c5 {
   line-height: 1.5;
   margin: 0;
   display: inline-flex;
@@ -27,16 +27,16 @@ exports[`render DocumentBlank 1`] = `
   padding: 0px 24px;
 }
 
-.c4:hover,
-.c4:focus {
+.c5:hover,
+.c5:focus {
   background: #B29DFF;
 }
 
-.c4:active {
+.c5:active {
   background: #C5B6FF;
 }
 
-.c4:disabled {
+.c5:disabled {
   background: rgba(255,255,255,0.12);
   color: rgba(255,255,255,0.3);
   cursor: auto;
@@ -48,7 +48,6 @@ exports[`render DocumentBlank 1`] = `
   color: #FFFFFF;
   margin-bottom: 40px;
   margin-top: 72px;
-  color: #01172C;
   font-size: 256px;
 }
 
@@ -57,7 +56,6 @@ exports[`render DocumentBlank 1`] = `
   margin: -16px;
   height: 100%;
   width: 100%;
-  background-color: #010B1C;
   display: flex;
 }
 
@@ -75,6 +73,10 @@ exports[`render DocumentBlank 1`] = `
   flex-direction: column;
 }
 
+.c4 {
+  color: rgba(255,255,255,0.13);
+}
+
 <div
   class="c0"
   height="100%"
@@ -83,18 +85,17 @@ exports[`render DocumentBlank 1`] = `
 >
   <div
     class="c1"
-    style="overflow: auto; background: rgb(1, 11, 28); display: flex; position: relative;"
+    style="overflow: auto; display: flex; position: relative;"
   >
     <div
       class="c2"
     >
       <span
-        class="c3 icon icon-terminal "
-        color="#01172C"
+        class="c3 icon icon-terminal c4"
         font-size="256px"
       />
       <button
-        class="c4"
+        class="c5"
         kind="primary"
       >
         Start a New Session
diff --git a/web/packages/teleport/src/Console/DocumentNodes/ClusterSelector/ClusterSelector.story.tsx b/web/packages/teleport/src/Console/DocumentNodes/ClusterSelector/ClusterSelector.story.tsx
index 01a6aed58d43a..80fda2a7fa037 100644
--- a/web/packages/teleport/src/Console/DocumentNodes/ClusterSelector/ClusterSelector.story.tsx
+++ b/web/packages/teleport/src/Console/DocumentNodes/ClusterSelector/ClusterSelector.story.tsx
@@ -18,7 +18,6 @@ import React from 'react';
 
 import { TestLayout } from 'teleport/Console/Console.story';
 import ConsoleContext from 'teleport/Console/consoleContext';
-import { ConsoleThemeProvider } from 'teleport/Console/ThemeProvider';
 
 import ClusterSelector from './ClusterSelector';
 
@@ -58,17 +57,15 @@ export const Failed = () => {
 function renderlusterSelector(ctx, { ...props } = {}) {
   return (
     <TestLayout ctx={ctx}>
-      <ConsoleThemeProvider>
-        <ClusterSelector
-          mx="auto"
-          open={true}
-          value={'clusterId'}
-          width="400px"
-          maxMenuHeight={200}
-          onChange={() => null}
-          {...props}
-        />
-      </ConsoleThemeProvider>
+      <ClusterSelector
+        mx="auto"
+        open={true}
+        value={'clusterId'}
+        width="400px"
+        maxMenuHeight={200}
+        onChange={() => null}
+        {...props}
+      />
     </TestLayout>
   );
 }
diff --git a/web/packages/teleport/src/Console/DocumentNodes/__snapshots__/DocumentNodes.story.test.tsx.snap b/web/packages/teleport/src/Console/DocumentNodes/__snapshots__/DocumentNodes.story.test.tsx.snap
index 6659e5c9d2c9f..4dc8216ff695d 100644
--- a/web/packages/teleport/src/Console/DocumentNodes/__snapshots__/DocumentNodes.story.test.tsx.snap
+++ b/web/packages/teleport/src/Console/DocumentNodes/__snapshots__/DocumentNodes.story.test.tsx.snap
@@ -201,7 +201,6 @@ exports[`render DocumentNodes 1`] = `
   margin: -16px;
   height: 100%;
   width: 100%;
-  background-color: #010B1C;
   display: flex;
 }
 
@@ -755,7 +754,7 @@ exports[`render DocumentNodes 1`] = `
 >
   <div
     class="c1"
-    style="overflow: auto; background: rgb(1, 11, 28); display: flex; position: relative;"
+    style="overflow: auto; display: flex; position: relative;"
   >
     <div
       class="c2"
diff --git a/web/packages/teleport/src/Console/DocumentSsh/DocumentSsh.tsx b/web/packages/teleport/src/Console/DocumentSsh/DocumentSsh.tsx
index 2862ee3839add..959c9ad778c3c 100644
--- a/web/packages/teleport/src/Console/DocumentSsh/DocumentSsh.tsx
+++ b/web/packages/teleport/src/Console/DocumentSsh/DocumentSsh.tsx
@@ -15,6 +15,7 @@ limitations under the License.
 */
 
 import React, { useRef, useEffect } from 'react';
+import { useTheme } from 'styled-components';
 
 import { Indicator, Box } from 'design';
 
@@ -26,14 +27,13 @@ import {
 } from 'shared/components/FileTransfer';
 
 import * as stores from 'teleport/Console/stores';
-import { colors } from 'teleport/Console/colors';
 
 import AuthnDialog from 'teleport/components/AuthnDialog';
 import useWebAuthn from 'teleport/lib/useWebAuthn';
 
 import Document from '../Document';
 
-import Terminal from './Terminal';
+import { Terminal, TerminalRef } from './Terminal';
 import useSshSession from './useSshSession';
 import { useFileTransfer } from './useFileTransfer';
 
@@ -46,7 +46,7 @@ export default function DocumentSshWrapper(props: PropTypes) {
 }
 
 function DocumentSsh({ doc, visible }: PropTypes) {
-  const refTerminal = useRef<Terminal>();
+  const terminalRef = useRef<TerminalRef>();
   const { tty, status, closeDocument, session } = useSshSession(doc);
   const webauthn = useWebAuthn(tty);
   const {
@@ -55,9 +55,10 @@ function DocumentSsh({ doc, visible }: PropTypes) {
     getUploader,
     fileTransferRequests,
   } = useFileTransfer(tty, session, doc, webauthn.addMfaToScpUrls);
+  const theme = useTheme();
 
   function handleCloseFileTransfer() {
-    refTerminal.current.terminal.term.focus();
+    terminalRef.current?.focus();
   }
 
   function handleFileTransferDecision(requestId: string, approve: boolean) {
@@ -65,10 +66,8 @@ function DocumentSsh({ doc, visible }: PropTypes) {
   }
 
   useEffect(() => {
-    if (refTerminal?.current) {
-      // when switching tabs or closing tabs, focus on visible terminal
-      refTerminal.current.terminal.term.focus();
-    }
+    // when switching tabs or closing tabs, focus on visible terminal
+    terminalRef.current?.focus();
   }, [visible, webauthn.requested]);
 
   return (
@@ -86,7 +85,14 @@ function DocumentSsh({ doc, visible }: PropTypes) {
           errorText={webauthn.errorText}
         />
       )}
-      {status === 'initialized' && <Terminal tty={tty} ref={refTerminal} />}
+      {status === 'initialized' && (
+        <Terminal
+          ref={terminalRef}
+          tty={tty}
+          fontFamily={theme.fonts.mono}
+          theme={theme.colors.terminal}
+        />
+      )}
       <FileTransfer
         FileTransferRequestsComponent={
           <FileTransferRequests
@@ -104,7 +110,6 @@ function DocumentSsh({ doc, visible }: PropTypes) {
             : null
         }
         afterClose={handleCloseFileTransfer}
-        backgroundColor={colors.levels.surface}
         transferHandlers={{
           getDownloader,
           getUploader,
diff --git a/web/packages/teleport/src/Console/DocumentSsh/Terminal/Terminal.tsx b/web/packages/teleport/src/Console/DocumentSsh/Terminal/Terminal.tsx
index 326428c2b7916..0c0354d033aee 100644
--- a/web/packages/teleport/src/Console/DocumentSsh/Terminal/Terminal.tsx
+++ b/web/packages/teleport/src/Console/DocumentSsh/Terminal/Terminal.tsx
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 Gravitational, Inc.
+Copyright 2023 Gravitational, Inc.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,9 +14,14 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import React from 'react';
-import { ThemeContext } from 'styled-components';
+import React, {
+  forwardRef,
+  useEffect,
+  useImperativeHandle,
+  useRef,
+} from 'react';
 import { Flex } from 'design';
+import { ITheme } from 'xterm';
 
 import { getPlatform } from 'design/theme/utils';
 
@@ -26,56 +31,67 @@ import { getMappedAction } from 'teleport/Console/useKeyboardNav';
 
 import StyledXterm from '../../StyledXterm';
 
-export default class Terminal extends React.Component<{ tty: Tty }> {
-  static contextType = ThemeContext;
+export interface TerminalRef {
+  focus(): void;
+}
+
+export interface TerminalProps {
+  tty: Tty;
+  fontFamily: string;
+  theme: ITheme;
+}
 
-  terminal: XTermCtrl;
+export const Terminal = forwardRef<TerminalRef, TerminalProps>((props, ref) => {
+  const termCtrlRef = useRef<XTermCtrl>();
+  const elementRef = useRef<HTMLElement>();
 
-  refTermContainer = React.createRef<HTMLElement>();
+  useImperativeHandle(
+    ref,
+    () => ({
+      focus: () => termCtrlRef.current.term.focus(),
+    }),
+    []
+  );
 
-  componentDidMount() {
+  useEffect(() => {
     const platform = getPlatform();
     const fontSize = platform.isMac ? 12 : 14;
 
-    this.terminal = new XTermCtrl(this.props.tty, {
-      el: this.refTermContainer.current,
-      fontFamily: this.context.fonts.mono,
+    const termCtrl = new XTermCtrl(props.tty, {
+      el: elementRef.current,
+      fontFamily: props.fontFamily,
       fontSize,
+      theme: props.theme,
     });
+    termCtrlRef.current = termCtrl;
 
-    this.terminal.open();
+    termCtrl.open();
 
-    this.terminal.term.attachCustomKeyEventHandler(event => {
+    termCtrl.term.attachCustomKeyEventHandler(event => {
       const { tabSwitch } = getMappedAction(event);
       if (tabSwitch) {
         return false;
       }
     });
-  }
-
-  componentWillUnmount() {
-    this.terminal.destroy();
-  }
-
-  shouldComponentUpdate() {
-    return false;
-  }
-
-  focus() {
-    this.terminal.term.focus();
-  }
-
-  render() {
-    return (
-      <Flex
-        flexDirection="column"
-        height="100%"
-        width="100%"
-        px="2"
-        style={{ overflow: 'auto' }}
-      >
-        <StyledXterm ref={this.refTermContainer} />
-      </Flex>
-    );
-  }
-}
+
+    return () => termCtrl.destroy();
+    // do not re-initialize xterm when theme changes, use specialized handlers.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  useEffect(() => {
+    termCtrlRef.current?.updateTheme(props.theme);
+  }, [props.theme]);
+
+  return (
+    <Flex
+      flexDirection="column"
+      height="100%"
+      width="100%"
+      px="2"
+      style={{ overflow: 'auto' }}
+    >
+      <StyledXterm ref={elementRef} />
+    </Flex>
+  );
+});
diff --git a/web/packages/teleport/src/Console/DocumentSsh/Terminal/index.ts b/web/packages/teleport/src/Console/DocumentSsh/Terminal/index.ts
index fc620f54061e9..560554f13bf7d 100644
--- a/web/packages/teleport/src/Console/DocumentSsh/Terminal/index.ts
+++ b/web/packages/teleport/src/Console/DocumentSsh/Terminal/index.ts
@@ -14,6 +14,4 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import Terminal from './Terminal';
-
-export default Terminal;
+export * from './Terminal';
diff --git a/web/packages/teleport/src/Console/StyledXterm/StyledXterm.tsx b/web/packages/teleport/src/Console/StyledXterm/StyledXterm.tsx
index 5a96a4da760f2..d9ed7b9c75c3a 100644
--- a/web/packages/teleport/src/Console/StyledXterm/StyledXterm.tsx
+++ b/web/packages/teleport/src/Console/StyledXterm/StyledXterm.tsx
@@ -18,17 +18,12 @@ import styled from 'styled-components';
 import { Box } from 'design';
 
 import 'xterm/css/xterm.css';
-import { colors } from 'teleport/Console/colors';
 
 const StyledXterm = styled(Box)(
   () => `
   height: 100%;
   width: 100%;
   overflow: hidden;
-
-  .terminal .xterm-viewport {
-    background-color: ${colors.bgTerminal} !important;
-  }
 `
 );
 
diff --git a/web/packages/teleport/src/Console/Tabs/JoinedUsers/JoinedUsers.jsx b/web/packages/teleport/src/Console/Tabs/JoinedUsers/JoinedUsers.jsx
index be1d2bb659277..a961b1d19923c 100644
--- a/web/packages/teleport/src/Console/Tabs/JoinedUsers/JoinedUsers.jsx
+++ b/web/packages/teleport/src/Console/Tabs/JoinedUsers/JoinedUsers.jsx
@@ -79,7 +79,7 @@ export default function JoinedUsers(props) {
       >
         <Box
           minWidth="200px"
-          bg="white"
+          bg="levels.elevated"
           borderRadius="8px"
           onMouseLeave={handleClose}
         >
@@ -102,13 +102,16 @@ const StyledUsers = styled.div`
   border-radius: 50%;
   justify-content: center;
   margin-right: 3px;
+  color: ${props => props.theme.colors.text.primaryInverse};
   background-color: ${props =>
-    props.active ? props.theme.colors.brand : props.theme.colors.grey[900]};
+    props.active
+      ? props.theme.colors.brand
+      : props.theme.colors.text.slightlyMuted};
 `;
 
 const StyledAvatar = styled.div`
-  background: ${props => props.theme.colors.brand};
-  color: ${props => props.theme.colors.light};
+  background: ${props => props.theme.colors.buttons.primary.default};
+  color: ${props => props.theme.colors.buttons.primary.text};
   border-radius: 50%;
   display: flex;
   justify-content: center;
@@ -121,8 +124,8 @@ const StyledAvatar = styled.div`
 `;
 
 const UserItem = styled.div`
-  border-bottom: 1px solid ${props => props.theme.colors.grey[50]};
-  color: ${props => props.theme.colors.grey[600]};
+  border-bottom: 1px solid ${props => props.theme.colors.spotBackground[1]};
+  color: ${props => props.theme.colors.text.main};
   font-size: 12px;
   align-items: center;
   display: flex;
diff --git a/web/packages/teleport/src/Console/Tabs/TabItem.tsx b/web/packages/teleport/src/Console/Tabs/TabItem.tsx
index 9e0096226ad2e..4ded79166fd86 100644
--- a/web/packages/teleport/src/Console/Tabs/TabItem.tsx
+++ b/web/packages/teleport/src/Console/Tabs/TabItem.tsx
@@ -33,7 +33,12 @@ export default function TabItem(props: Props) {
         </Text>
       </StyledTabButton>
       <StyledCloseButton title="Close" onClick={onClose}>
-        <CloseIcon />
+        <CloseIcon
+          css={`
+            transition: none;
+            color: inherit;
+          `}
+        />
       </StyledCloseButton>
     </StyledTabItem>
   );
@@ -51,7 +56,7 @@ type Props = {
 function fromProps({ theme, active }) {
   let styles: Record<any, any> = {
     border: 'none',
-    borderRight: `1px solid ${theme.colors.bgTerminal}`,
+    borderRight: `1px solid ${theme.colors.levels.sunken}`,
     '&:hover, &:focus': {
       color: theme.colors.text.main,
       transition: 'color .3s',
@@ -61,7 +66,7 @@ function fromProps({ theme, active }) {
   if (active) {
     styles = {
       ...styles,
-      backgroundColor: theme.colors.bgTerminal,
+      backgroundColor: theme.colors.levels.sunken,
       color: theme.colors.text.main,
       fontWeight: 'bold',
       transition: 'none',
@@ -85,7 +90,6 @@ const StyledTabButton = styled.button`
   text-decoration: none;
   outline: none;
   margin: 0;
-  text-decoration: none;
   color: inherit;
   line-height: 32px;
   background-color: transparent;
@@ -97,6 +101,9 @@ const StyledTabButton = styled.button`
 `;
 
 const StyledCloseButton = styled.button`
+  display: flex;
+  align-items: center;
+  justify-content: center;
   background: transparent;
   border-radius: 2px;
   border: none;
@@ -109,7 +116,9 @@ const StyledCloseButton = styled.button`
   transition: all 0.3s;
 
   &:hover {
+    color: ${props => props.theme.colors.text.primaryInverse};
     background: ${props => props.theme.colors.error.main};
   }
+
   ${space}
 `;
diff --git a/web/packages/teleport/src/Console/Tabs/Tabs.tsx b/web/packages/teleport/src/Console/Tabs/Tabs.tsx
index d10a183a49a13..e4f1e43edf23b 100644
--- a/web/packages/teleport/src/Console/Tabs/Tabs.tsx
+++ b/web/packages/teleport/src/Console/Tabs/Tabs.tsx
@@ -26,8 +26,6 @@ import { useStore } from 'shared/libs/stores';
 import * as stores from 'teleport/Console/stores';
 import { useConsoleContext } from 'teleport/Console/consoleContextProvider';
 
-import { colors } from '../colors';
-
 import TabItem from './TabItem';
 
 export default function TabsContainer(props: Props) {
@@ -109,7 +107,7 @@ type Props = {
 };
 
 const StyledTabs = styled(Box)`
-  background: ${colors.terminalDark};
+  background: ${props => props.theme.colors.levels.surface};
   min-height: 32px;
   border-radius: 4px;
   display: flex;
diff --git a/web/packages/teleport/src/Console/Tabs/__snapshots__/Tabs.story.test.tsx.snap b/web/packages/teleport/src/Console/Tabs/__snapshots__/Tabs.story.test.tsx.snap
index bb87246a1ab16..9dbe134f5d4c0 100644
--- a/web/packages/teleport/src/Console/Tabs/__snapshots__/Tabs.story.test.tsx.snap
+++ b/web/packages/teleport/src/Console/Tabs/__snapshots__/Tabs.story.test.tsx.snap
@@ -7,14 +7,14 @@ exports[`render ConsoleTabs 1`] = `
   color: #FFFFFF;
 }
 
-.c10 {
+.c11 {
   display: inline-block;
   transition: color 0.3s;
   color: #FFFFFF;
   font-size: 16px;
 }
 
-.c9 {
+.c10 {
   align-items: center;
   border: none;
   cursor: pointer;
@@ -35,25 +35,25 @@ exports[`render ConsoleTabs 1`] = `
   margin-left: 8px;
 }
 
-.c9 .c6 {
+.c10 .c6 {
   color: inherit;
 }
 
-.c9:disabled {
+.c10:disabled {
   color: rgba(255,255,255,0.36);
 }
 
-.c9:disabled {
+.c10:disabled {
   color: rgba(255,255,255,0.36);
   cursor: default;
 }
 
-.c9:hover:enabled,
-.c9:focus:enabled {
+.c10:hover:enabled,
+.c10:focus:enabled {
   background: rgba(255,255,255,0.13);
 }
 
-.c9:active:enabled {
+.c10:active:enabled {
   background: rgba(255,255,255,0.18);
 }
 
@@ -70,7 +70,6 @@ exports[`render ConsoleTabs 1`] = `
   margin: -16px;
   height: 100%;
   width: 100%;
-  background-color: #010B1C;
   display: flex;
 }
 
@@ -81,8 +80,8 @@ exports[`render ConsoleTabs 1`] = `
   max-width: 200px;
   height: 100%;
   border: none;
-  border-right: 1px solid #010B1C;
-  background-color: #010B1C;
+  border-right: 1px solid #0C143D;
+  background-color: #0C143D;
   color: #FFFFFF;
   font-weight: bold;
   transition: none;
@@ -94,18 +93,18 @@ exports[`render ConsoleTabs 1`] = `
   transition: color .3s;
 }
 
-.c8 {
+.c9 {
   box-sizing: border-box;
   display: flex;
   align-items: center;
   max-width: 200px;
   height: 100%;
   border: none;
-  border-right: 1px solid #010B1C;
+  border-right: 1px solid #0C143D;
 }
 
-.c8:hover,
-.c8:focus {
+.c9:hover,
+.c9:focus {
   color: #FFFFFF;
   transition: color .3s;
 }
@@ -118,7 +117,6 @@ exports[`render ConsoleTabs 1`] = `
   text-decoration: none;
   outline: none;
   margin: 0;
-  text-decoration: none;
   color: inherit;
   line-height: 32px;
   background-color: transparent;
@@ -130,6 +128,9 @@ exports[`render ConsoleTabs 1`] = `
 }
 
 .c5 {
+  display: flex;
+  align-items: center;
+  justify-content: center;
   background: transparent;
   border-radius: 2px;
   border: none;
@@ -143,15 +144,21 @@ exports[`render ConsoleTabs 1`] = `
 }
 
 .c5:hover {
+  color: #000000;
   background: #FF6257;
 }
 
+.c8 {
+  transition: none;
+  color: inherit;
+}
+
 .c1 {
   box-sizing: border-box;
   height: 32px;
   width: 100%;
   color: rgba(255,255,255,0.72);
-  background: #01172C;
+  background: #222C59;
   min-height: 32px;
   border-radius: 4px;
   display: flex;
@@ -195,12 +202,12 @@ exports[`render ConsoleTabs 1`] = `
         title="Close"
       >
         <span
-          class="c6 c7 icon icon-close "
+          class="c6 c7 icon icon-close c8"
         />
       </button>
     </div>
     <div
-      class="c8"
+      class="c9"
       style="flex: 1; flex-basis: 0px; flex-grow: 1;"
     >
       <button
@@ -218,12 +225,12 @@ exports[`render ConsoleTabs 1`] = `
         title="Close"
       >
         <span
-          class="c6 c7 icon icon-close "
+          class="c6 c7 icon icon-close c8"
         />
       </button>
     </div>
     <div
-      class="c8"
+      class="c9"
       style="flex: 1; flex-basis: 0px; flex-grow: 1;"
     >
       <button
@@ -241,16 +248,16 @@ exports[`render ConsoleTabs 1`] = `
         title="Close"
       >
         <span
-          class="c6 c7 icon icon-close "
+          class="c6 c7 icon icon-close c8"
         />
       </button>
     </div>
     <button
-      class="c9"
+      class="c10"
       title="New Tab"
     >
       <span
-        class="c6 c10 icon icon-add "
+        class="c6 c11 icon icon-add "
         font-size="16px"
       />
     </button>
diff --git a/web/packages/teleport/src/Console/ThemeProvider.tsx b/web/packages/teleport/src/Console/ThemeProvider.tsx
deleted file mode 100644
index 6a2067a07362b..0000000000000
--- a/web/packages/teleport/src/Console/ThemeProvider.tsx
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
-Copyright 2019 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import React from 'react';
-import { darkTheme } from 'design/theme';
-import ThemeProvider from 'design/ThemeProvider';
-
-import { colors } from './colors';
-
-const customTheme = {
-  // Force dark theme until we have a light theme for console.
-  ...darkTheme,
-  colors: {
-    ...darkTheme.colors,
-    levels: {
-      ...darkTheme.colors.levels,
-      ...colors.levels,
-    },
-    buttons: {
-      ...darkTheme.colors.buttons,
-      ...colors.buttons,
-    },
-  },
-};
-
-export const ConsoleThemeProvider = props => (
-  <ThemeProvider theme={customTheme} children={props.children} />
-);
diff --git a/web/packages/teleport/src/Console/colors.ts b/web/packages/teleport/src/Console/colors.ts
deleted file mode 100644
index 1b23dbb371c1a..0000000000000
--- a/web/packages/teleport/src/Console/colors.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
-Copyright 2019 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-/**
- * Colors are un-themeable color variables used by console
- */
-export const colors = {
-  dark: '#000',
-  light: '#fff',
-  subtle: '#CFD8DC',
-  inverse: '#B0BEC5',
-  link: '#039BE5',
-  error: '#FF1744',
-  terminal: '#28FE14',
-  terminalDark: '#01172C',
-  bgTerminal: '#010B1C',
-  levels: {
-    surface: '#03203C',
-    elevated: '#092F52',
-    sunkenSecondary: '#01172C',
-    surfaceSecondary: '#010B1C',
-  },
-  buttons: {
-    border: {
-      default: '#092F52',
-      hover: '#092F52',
-      border: '#010B1C',
-      borderHover: 'rgba(255, 255, 255, 0.1)',
-    },
-  },
-  text: '#263238',
-  success: '#00BFA5',
-  progressBarColor: '#00BFA5',
-};
diff --git a/web/packages/teleport/src/Discover/Database/ConnectAwsAccount/ConnectAwsAccount.tsx b/web/packages/teleport/src/Discover/Database/ConnectAwsAccount/ConnectAwsAccount.tsx
index f89f47eecb9bd..8684ac3a934fa 100644
--- a/web/packages/teleport/src/Discover/Database/ConnectAwsAccount/ConnectAwsAccount.tsx
+++ b/web/packages/teleport/src/Discover/Database/ConnectAwsAccount/ConnectAwsAccount.tsx
@@ -110,6 +110,7 @@ export function ConnectAwsAccount() {
           <Flex minHeight="215px" mt={3}>
             <TextEditor
               readOnly={true}
+              bg="levels.deep"
               data={[{ content: integrationRWEAndDbCU, type: 'yaml' }]}
             />
           </Flex>
diff --git a/web/packages/teleport/src/Discover/Database/CreateDatabase/CreateDatabase.tsx b/web/packages/teleport/src/Discover/Database/CreateDatabase/CreateDatabase.tsx
index 983003f08164b..e02c021dd57e3 100644
--- a/web/packages/teleport/src/Discover/Database/CreateDatabase/CreateDatabase.tsx
+++ b/web/packages/teleport/src/Discover/Database/CreateDatabase/CreateDatabase.tsx
@@ -110,6 +110,7 @@ export function CreateDatabaseView({
               <Flex minHeight="195px" mt={3}>
                 <TextEditor
                   readOnly={true}
+                  bg="levels.deep"
                   data={[{ content: dbCU, type: 'yaml' }]}
                 />
               </Flex>
diff --git a/web/packages/teleport/src/Discover/Database/CreateDatabase/useCreateDatabase.test.tsx b/web/packages/teleport/src/Discover/Database/CreateDatabase/useCreateDatabase.test.tsx
index 3ea0f87163bd9..1a9f276536037 100644
--- a/web/packages/teleport/src/Discover/Database/CreateDatabase/useCreateDatabase.test.tsx
+++ b/web/packages/teleport/src/Discover/Database/CreateDatabase/useCreateDatabase.test.tsx
@@ -259,6 +259,7 @@ describe('registering new databases, mainly error checking', () => {
         engine: DatabaseEngine.AuroraMysql,
       },
     } as any,
+    exitFlow: () => null,
     viewConfig: null,
     indexedViews: [],
     setResourceSpec: () => null,
diff --git a/web/packages/teleport/src/Discover/Database/CreateDatabase/useCreateDatabase.ts b/web/packages/teleport/src/Discover/Database/CreateDatabase/useCreateDatabase.ts
index dd31f215e3732..afef7ae2cef22 100644
--- a/web/packages/teleport/src/Discover/Database/CreateDatabase/useCreateDatabase.ts
+++ b/web/packages/teleport/src/Discover/Database/CreateDatabase/useCreateDatabase.ts
@@ -24,7 +24,7 @@ import { usePoll } from 'teleport/Discover/Shared/usePoll';
 import { compareByString } from 'teleport/lib/util';
 import { ApiError } from 'teleport/services/api/parseError';
 
-import { matchLabels } from '../util';
+import { matchLabels } from '../common';
 
 import type {
   CreateDatabaseRequest,
@@ -195,6 +195,7 @@ export function useCreateDatabase() {
           ...(agentMeta as DbMeta),
           resourceName: db.name,
           agentMatcherLabels: db.labels,
+          selectedAwsRdsDb: db.awsRds,
         });
         setAttempt({ status: 'success' });
         return;
diff --git a/web/packages/teleport/src/Discover/Database/DeployService/AutoDeploy/AutoDeploy.story.tsx b/web/packages/teleport/src/Discover/Database/DeployService/AutoDeploy/AutoDeploy.story.tsx
new file mode 100644
index 0000000000000..6bb8562147a53
--- /dev/null
+++ b/web/packages/teleport/src/Discover/Database/DeployService/AutoDeploy/AutoDeploy.story.tsx
@@ -0,0 +1,123 @@
+/**
+ * Copyright 2022 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import { MemoryRouter } from 'react-router';
+
+import { Context as TeleportContext, ContextProvider } from 'teleport';
+import cfg from 'teleport/config';
+import { ResourceKind } from 'teleport/Discover/Shared';
+import { PingTeleportProvider } from 'teleport/Discover/Shared/PingTeleportContext';
+import { getUserContext } from 'teleport/mocks/contexts';
+import { FeaturesContextProvider } from 'teleport/FeaturesContext';
+import {
+  DatabaseEngine,
+  DatabaseLocation,
+} from 'teleport/Discover/SelectResource';
+import {
+  DiscoverProvider,
+  DiscoverContextState,
+} from 'teleport/Discover/useDiscover';
+
+import { AutoDeploy } from './AutoDeploy';
+
+export default {
+  title: 'Teleport/Discover/Database/Deploy/Auto',
+};
+
+export const Init = () => {
+  return (
+    <Provider>
+      <AutoDeploy />
+    </Provider>
+  );
+};
+
+export const InitWithLabels = () => {
+  return (
+    <Provider
+      agentMeta={{
+        agentMatcherLabels: [
+          { name: 'env', value: 'staging' },
+          { name: 'os', value: 'windows' },
+        ],
+      }}
+    >
+      <AutoDeploy />
+    </Provider>
+  );
+};
+
+const Provider = props => {
+  const ctx = createTeleportContext();
+  const discoverCtx: DiscoverContextState = {
+    agentMeta: {
+      resourceName: 'db-name',
+      agentMatcherLabels: [],
+      db: {} as any,
+      selectedAwsRdsDb: { region: 'us-east-1' } as any,
+      ...props.agentMeta,
+    },
+    currentStep: 0,
+    nextStep: () => null,
+    prevStep: () => null,
+    onSelectResource: () => null,
+    resourceSpec: {
+      dbMeta: {
+        location: DatabaseLocation.Aws,
+        engine: DatabaseEngine.AuroraMysql,
+      },
+    } as any,
+    exitFlow: () => null,
+    viewConfig: null,
+    indexedViews: [],
+    setResourceSpec: () => null,
+    updateAgentMeta: () => null,
+    emitErrorEvent: () => null,
+    emitEvent: () => null,
+    eventState: null,
+  };
+
+  return (
+    <MemoryRouter
+      initialEntries={[
+        { pathname: cfg.routes.discover, state: { entity: 'database' } },
+      ]}
+    >
+      <ContextProvider ctx={ctx}>
+        <FeaturesContextProvider value={[]}>
+          <DiscoverProvider mockCtx={discoverCtx}>
+            <PingTeleportProvider
+              interval={props.interval || 100000}
+              resourceKind={ResourceKind.Database}
+            >
+              {props.children}
+            </PingTeleportProvider>
+          </DiscoverProvider>
+        </FeaturesContextProvider>
+      </ContextProvider>
+    </MemoryRouter>
+  );
+};
+
+function createTeleportContext() {
+  const ctx = new TeleportContext();
+
+  ctx.isEnterprise = false;
+  ctx.storeUser.setState(getUserContext());
+
+  return ctx;
+}
diff --git a/web/packages/teleport/src/Discover/Database/DeployService/AutoDeploy/AutoDeploy.tsx b/web/packages/teleport/src/Discover/Database/DeployService/AutoDeploy/AutoDeploy.tsx
new file mode 100644
index 0000000000000..eefd23c6efd06
--- /dev/null
+++ b/web/packages/teleport/src/Discover/Database/DeployService/AutoDeploy/AutoDeploy.tsx
@@ -0,0 +1,376 @@
+/**
+ * Copyright 2022 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { useState, useEffect } from 'react';
+import styled from 'styled-components';
+import { Box, ButtonSecondary, Link, Text } from 'design';
+import * as Icons from 'design/Icon';
+import FieldInput from 'shared/components/FieldInput';
+import Validation, { Validator } from 'shared/components/Validation';
+import { requiredField } from 'shared/components/Validation/rules';
+import useAttempt from 'shared/hooks/useAttemptNext';
+
+import { TextSelectCopyMulti } from 'teleport/components/TextSelectCopy';
+import { usePingTeleport } from 'teleport/Discover/Shared/PingTeleportContext';
+import {
+  HintBox,
+  SuccessBox,
+  WaitingInfo,
+} from 'teleport/Discover/Shared/HintBox';
+import {
+  AwsOidcDeployServiceResponse,
+  integrationService,
+} from 'teleport/services/integrations';
+import { useDiscover, DbMeta } from 'teleport/Discover/useDiscover';
+import { DiscoverEventStatus } from 'teleport/services/userEvent';
+
+import {
+  ActionButtons,
+  HeaderSubtitle,
+  TextIcon,
+  useShowHint,
+  Header,
+  DiscoverLabel,
+  AlternateInstructionButton,
+  Mark,
+} from '../../../Shared';
+
+import { DeployServiceProp } from '../DeployService';
+import { hasMatchingLabels, Labels } from '../../common';
+
+import type { Database } from 'teleport/services/databases';
+
+export function AutoDeploy({ toggleDeployMethod }: DeployServiceProp) {
+  const { emitErrorEvent, nextStep, emitEvent, agentMeta, updateAgentMeta } =
+    useDiscover();
+  const { attempt, setAttempt } = useAttempt('');
+  const [showLabelMatchErr, setShowLabelMatchErr] = useState(true);
+
+  const [taskRoleArn, setTaskRoleArn] = useState('TeleportDatabaseAccess');
+  const [deploySvcResp, setDeploySvcResp] =
+    useState<AwsOidcDeployServiceResponse>();
+  const [deployFinished, setDeployFinished] = useState(false);
+
+  const hasDbLabels = agentMeta?.agentMatcherLabels?.length;
+  const dbLabels = hasDbLabels ? agentMeta.agentMatcherLabels : [];
+  const [labels, setLabels] = useState<DiscoverLabel[]>([
+    { name: '*', value: '*', isFixed: dbLabels.length === 0 },
+  ]);
+  const agent = agentMeta as DbMeta;
+
+  useEffect(() => {
+    // Turn off error once user changes labels.
+    if (showLabelMatchErr) {
+      setShowLabelMatchErr(false);
+    }
+  }, [labels]);
+
+  function handleDeploy(validator: Validator) {
+    if (!validator.validate()) {
+      return;
+    }
+
+    if (!hasMatchingLabels(dbLabels, labels)) {
+      setShowLabelMatchErr(true);
+      return;
+    }
+
+    setShowLabelMatchErr(false);
+    setAttempt({ status: 'processing' });
+    integrationService
+      .deployAwsOidcService(agent.integrationName, {
+        deploymentMode: 'database-service',
+        region: agent.selectedAwsRdsDb?.region,
+        subnetIds: agent.selectedAwsRdsDb?.subnets,
+        taskRoleArn,
+        databaseAgentMatcherLabels: labels,
+      })
+      // The user is still technically in the "processing"
+      // state, because after this call succeeds, we will
+      // start pinging for the newly registered db
+      // to get picked up by this service we deployed.
+      // So setting the attempt here to "success"
+      // is not necessary.
+      .then(setDeploySvcResp)
+      .catch((err: Error) => {
+        setAttempt({ status: 'failed', statusText: err.message });
+        emitErrorEvent(`deploy request failed: ${err.message}`);
+      });
+  }
+
+  function handleOnProceed() {
+    nextStep(2); // skip the IAM policy view
+    emitEvent(
+      { stepStatus: DiscoverEventStatus.Success }
+      // TODO(lisa) uncomment after backend handles this field
+      // { deployMethod: 'auto' }
+    );
+  }
+
+  function handleDeployFinished(db: Database) {
+    setDeployFinished(true);
+    updateAgentMeta({ ...agentMeta, db, serviceDeployedMethod: 'auto' });
+  }
+
+  function abortDeploying() {
+    if (attempt.status === 'processing') {
+      emitErrorEvent(
+        `aborted in middle of auto deploying (>= 5 minutes of waiting)`
+      );
+    }
+    setDeploySvcResp(null);
+    setAttempt({ status: '' });
+    toggleDeployMethod();
+  }
+
+  const isProcessing = attempt.status === 'processing' && !!deploySvcResp;
+  const isDeploying = isProcessing && !!deploySvcResp;
+  const hasError = attempt.status === 'failed';
+
+  return (
+    <Box>
+      <Validation>
+        {({ validator }) => (
+          <>
+            <Heading
+              toggleDeployMethod={abortDeploying}
+              togglerDisabled={isProcessing}
+              region={agent.selectedAwsRdsDb.region}
+            />
+
+            {/* step one */}
+            <CreateAccessRole
+              taskRoleArn={taskRoleArn}
+              setTaskRoleArn={setTaskRoleArn}
+              disabled={isProcessing}
+            />
+
+            {/* step two */}
+            <StyledBox mb={5}>
+              <Text bold>Step 2</Text>
+              <Box mb={4}>
+                <Labels
+                  labels={labels}
+                  setLabels={setLabels}
+                  disableBtns={attempt.status === 'processing'}
+                  showLabelMatchErr={showLabelMatchErr}
+                  dbLabels={dbLabels}
+                  autoFocus={false}
+                  region={agent.selectedAwsRdsDb?.region}
+                />
+              </Box>
+              <ButtonSecondary
+                width="215px"
+                type="submit"
+                onClick={() => handleDeploy(validator)}
+                disabled={attempt.status === 'processing'}
+                mb={2}
+              >
+                Deploy Teleport Service
+              </ButtonSecondary>
+              {hasError && (
+                <Box>
+                  <TextIcon mt={3}>
+                    <Icons.Warning ml={1} color="error.main" />
+                    Encountered Error: {attempt.statusText}
+                  </TextIcon>
+                </Box>
+              )}
+            </StyledBox>
+
+            {/* step three */}
+            {isDeploying && (
+              <DeployHints
+                deployFinished={handleDeployFinished}
+                resourceName={(agentMeta as DbMeta).resourceName}
+                abortDeploying={abortDeploying}
+                deploySvcResp={deploySvcResp}
+              />
+            )}
+
+            <ActionButtons
+              onProceed={handleOnProceed}
+              disableProceed={!deployFinished}
+            />
+          </>
+        )}
+      </Validation>
+    </Box>
+  );
+}
+
+const Heading = ({
+  toggleDeployMethod,
+  togglerDisabled,
+  region,
+}: {
+  toggleDeployMethod(): void;
+  togglerDisabled: boolean;
+  region: string;
+}) => {
+  return (
+    <>
+      <Header>Automatically Deploy a Database Service</Header>
+      <HeaderSubtitle>
+        Teleport needs a database service to be able to connect to your
+        database. Teleport can configure the permissions required to spin up an
+        ECS Fargate container (0.xxx vCPU, 1GB memory) in your Amazon account
+        with the ability to access databases in this region (
+        <Mark>{region}</Mark>). You will only need to do this once for all
+        databases per geographical region. <br />
+        <br />
+        Want to deploy a database service manually from one of your existing
+        servers?{' '}
+        <AlternateInstructionButton
+          onClick={toggleDeployMethod}
+          disabled={togglerDisabled}
+        />
+      </HeaderSubtitle>
+    </>
+  );
+};
+
+const CreateAccessRole = ({
+  taskRoleArn,
+  setTaskRoleArn,
+  disabled,
+}: {
+  taskRoleArn: string;
+  setTaskRoleArn(r: string): void;
+  disabled: boolean;
+}) => {
+  return (
+    <StyledBox mb={5}>
+      <Text bold>Step 1</Text>
+      <Text mb={2}>Create an Access Role for the Database Service</Text>
+      <FieldInput
+        mb={4}
+        disabled={disabled}
+        rule={requiredField('Task Role ARN is required')}
+        label="Name a Task Role ARN"
+        autoFocus
+        value={taskRoleArn}
+        placeholder="teleport"
+        width="400px"
+        mr="3"
+        onChange={e => setTaskRoleArn(e.target.value)}
+        toolTipContent="Lorem ipsume dolores"
+      />
+      <Text mb={2}>
+        Then open{' '}
+        <Link
+          href="https://console.aws.amazon.com/cloudshell/home"
+          target="_blank"
+        >
+          Amazon CloudShell
+        </Link>{' '}
+        and copy/paste the following command to create an access role for your
+        database service:
+      </Text>
+      <Box mb={2}>
+        <TextSelectCopyMulti
+          // TODO(lisa): replace with actual script when ready
+          lines={[
+            {
+              text: 'sudo bash -c "$(curl -fsSL https://kenny-r-test.teleport.sh/scripts/40884566df6fbdb02411364e641f78b2/set-up-aws-role.sh)"',
+            },
+          ]}
+        />
+      </Box>
+    </StyledBox>
+  );
+};
+
+const DeployHints = ({
+  resourceName,
+  deployFinished,
+  abortDeploying,
+  deploySvcResp,
+}: {
+  resourceName: string;
+  deployFinished(dbResult: Database): void;
+  abortDeploying(): void;
+  deploySvcResp: AwsOidcDeployServiceResponse;
+}) => {
+  // Starts resource querying interval.
+  const { result, active } = usePingTeleport<Database>(resourceName);
+
+  const showHint = useShowHint(active);
+
+  useEffect(() => {
+    if (result) {
+      deployFinished(result);
+    }
+  }, [result]);
+
+  if (showHint && !result) {
+    return (
+      <HintBox header="We're still in the process of creating your Database Service">
+        <Text mb={3}>
+          The network may be slow. Try continuing to wait for a few more minutes
+          or{' '}
+          <AlternateInstructionButton onClick={abortDeploying}>
+            try manually deploying your own service.
+          </AlternateInstructionButton>{' '}
+          You can visit your AWS{' '}
+          <Link target="_blank" href={deploySvcResp.serviceDashboardUrl}>
+            dashboard
+          </Link>{' '}
+          to see progress details.
+        </Text>
+      </HintBox>
+    );
+  }
+
+  if (result) {
+    return (
+      <SuccessBox>
+        Successfully created and detected your new Database Service.
+      </SuccessBox>
+    );
+  }
+
+  return (
+    <WaitingInfo>
+      <TextIcon
+        css={`
+          white-space: pre;
+          margin-right: 4px;
+          padding-right: 4px;
+        `}
+      >
+        <Icons.Restore fontSize={4} />
+      </TextIcon>
+      <Text>
+        Teleport is currently deploying a Database Service. It will take at
+        least a minute for the Database Service to be created and joined to your
+        cluster. <br />
+        We will update this status once detected, meanwhile visit your AWS{' '}
+        <Link target="_blank" href={deploySvcResp.serviceDashboardUrl}>
+          dashboard
+        </Link>{' '}
+        to see progress details.
+      </Text>
+    </WaitingInfo>
+  );
+};
+
+const StyledBox = styled(Box)`
+  max-width: 1000px;
+  background-color: ${props => props.theme.colors.spotBackground[0]};
+  padding: ${props => `${props.theme.space[3]}px`};
+  border-radius: ${props => `${props.theme.space[2]}px`};
+`;
diff --git a/web/packages/teleport/src/Discover/Database/DeployService/AutoDeploy/index.tsx b/web/packages/teleport/src/Discover/Database/DeployService/AutoDeploy/index.tsx
new file mode 100644
index 0000000000000..e076a347b994b
--- /dev/null
+++ b/web/packages/teleport/src/Discover/Database/DeployService/AutoDeploy/index.tsx
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { AutoDeploy } from './AutoDeploy';
diff --git a/web/packages/teleport/src/Discover/Database/DeployService/DeployService.tsx b/web/packages/teleport/src/Discover/Database/DeployService/DeployService.tsx
new file mode 100644
index 0000000000000..4ec07496f6f85
--- /dev/null
+++ b/web/packages/teleport/src/Discover/Database/DeployService/DeployService.tsx
@@ -0,0 +1,40 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { useState } from 'react';
+
+import { ServiceDeployMethod } from '../common';
+
+import { ManualDeploy } from './ManualDeploy';
+import { AutoDeploy } from './AutoDeploy';
+
+export function DeployService() {
+  const [deployMethod, setDeployMethod] = useState<ServiceDeployMethod>('auto');
+
+  function toggleDeployMethod() {
+    setDeployMethod(deployMethod === 'auto' ? 'manual' : 'auto');
+  }
+
+  if (deployMethod === 'auto') {
+    return <AutoDeploy toggleDeployMethod={toggleDeployMethod} />;
+  }
+
+  return <ManualDeploy toggleDeployMethod={toggleDeployMethod} />;
+}
+
+export type DeployServiceProp = {
+  toggleDeployMethod?(): void;
+};
diff --git a/web/packages/teleport/src/Discover/Database/DeployService/ManualDeploy/ManualDeploy.story.tsx b/web/packages/teleport/src/Discover/Database/DeployService/ManualDeploy/ManualDeploy.story.tsx
new file mode 100644
index 0000000000000..a165d4b77769a
--- /dev/null
+++ b/web/packages/teleport/src/Discover/Database/DeployService/ManualDeploy/ManualDeploy.story.tsx
@@ -0,0 +1,125 @@
+/**
+ * Copyright 2022 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import { MemoryRouter } from 'react-router';
+
+import { Context as TeleportContext, ContextProvider } from 'teleport';
+import cfg from 'teleport/config';
+import { ResourceKind } from 'teleport/Discover/Shared';
+import { PingTeleportProvider } from 'teleport/Discover/Shared/PingTeleportContext';
+import { getUserContext } from 'teleport/mocks/contexts';
+import { FeaturesContextProvider } from 'teleport/FeaturesContext';
+import {
+  DatabaseEngine,
+  DatabaseLocation,
+} from 'teleport/Discover/SelectResource';
+import {
+  DiscoverProvider,
+  DiscoverContextState,
+} from 'teleport/Discover/useDiscover';
+
+import ManualDeploy from './ManualDeploy';
+
+const DEFAULT_PING_INTERVAL = 1000 * 100; // 100 seconds
+
+export default {
+  title: 'Teleport/Discover/Database/Deploy/Manual',
+};
+
+export const Init = () => {
+  return (
+    <Provider>
+      <ManualDeploy />
+    </Provider>
+  );
+};
+
+export const InitWithLabels = () => {
+  return (
+    <Provider
+      agentMeta={{
+        agentMatcherLabels: [
+          { name: 'env', value: 'staging' },
+          { name: 'os', value: 'windows' },
+        ],
+      }}
+    >
+      <ManualDeploy />
+    </Provider>
+  );
+};
+
+const Provider = props => {
+  const ctx = createTeleportContext();
+  const discoverCtx: DiscoverContextState = {
+    agentMeta: {
+      resourceName: 'db-name',
+      agentMatcherLabels: [],
+      db: {} as any,
+      selectedAwsRdsDb: {} as any,
+      ...props.agentMeta,
+    },
+    currentStep: 0,
+    nextStep: () => null,
+    prevStep: () => null,
+    onSelectResource: () => null,
+    resourceSpec: {
+      dbMeta: {
+        location: DatabaseLocation.Aws,
+        engine: DatabaseEngine.AuroraMysql,
+      },
+    } as any,
+    exitFlow: () => null,
+    viewConfig: null,
+    indexedViews: [],
+    setResourceSpec: () => null,
+    updateAgentMeta: () => null,
+    emitErrorEvent: () => null,
+    emitEvent: () => null,
+    eventState: null,
+  };
+
+  return (
+    <MemoryRouter
+      initialEntries={[
+        { pathname: cfg.routes.discover, state: { entity: 'database' } },
+      ]}
+    >
+      <ContextProvider ctx={ctx}>
+        <FeaturesContextProvider value={[]}>
+          <DiscoverProvider mockCtx={discoverCtx}>
+            <PingTeleportProvider
+              interval={props.interval || DEFAULT_PING_INTERVAL}
+              resourceKind={ResourceKind.Database}
+            >
+              {props.children}
+            </PingTeleportProvider>
+          </DiscoverProvider>
+        </FeaturesContextProvider>
+      </ContextProvider>
+    </MemoryRouter>
+  );
+};
+
+function createTeleportContext() {
+  const ctx = new TeleportContext();
+
+  ctx.isEnterprise = false;
+  ctx.storeUser.setState(getUserContext());
+
+  return ctx;
+}
diff --git a/web/packages/teleport/src/Discover/Database/DownloadScript/DownloadScript.tsx b/web/packages/teleport/src/Discover/Database/DeployService/ManualDeploy/ManualDeploy.tsx
similarity index 61%
rename from web/packages/teleport/src/Discover/Database/DownloadScript/DownloadScript.tsx
rename to web/packages/teleport/src/Discover/Database/DeployService/ManualDeploy/ManualDeploy.tsx
index c9fc0ab3a170f..7ba40608ba900 100644
--- a/web/packages/teleport/src/Discover/Database/DownloadScript/DownloadScript.tsx
+++ b/web/packages/teleport/src/Discover/Database/DeployService/ManualDeploy/ManualDeploy.tsx
@@ -15,7 +15,7 @@
  */
 
 import React, { Suspense, useState, useEffect } from 'react';
-import { Box, ButtonSecondary, Label as Pill, Text } from 'design';
+import { Box, ButtonSecondary, Text } from 'design';
 import * as Icons from 'design/Icon';
 import Validation, { Validator } from 'shared/components/Validation';
 
@@ -38,25 +38,28 @@ import {
 } from 'teleport/Discover/Shared/HintBox';
 
 import { CommandBox } from 'teleport/Discover/Shared/CommandBox';
+import { DbMeta, useDiscover } from 'teleport/Discover/useDiscover';
+import { DatabaseLocation } from 'teleport/Discover/SelectResource';
+import { DiscoverEventStatus } from 'teleport/services/userEvent';
 
 import {
   ActionButtons,
+  AlternateInstructionButton,
   DiscoverLabel,
   Header,
   HeaderSubtitle,
-  LabelsCreater,
   Mark,
   ResourceKind,
   TextIcon,
   useShowHint,
-} from '../../Shared';
-import { matchLabels } from '../util';
+} from '../../../Shared';
+import { Labels, hasMatchingLabels } from '../../common';
+import { DeployServiceProp } from '../DeployService';
 
-import type { AgentStepProps } from '../../types';
-
-export default function Container(props: AgentStepProps) {
-  const hasDbLabels = props.agentMeta?.agentMatcherLabels?.length;
-  const dbLabels = hasDbLabels ? props.agentMeta.agentMatcherLabels : [];
+export default function Container({ toggleDeployMethod }: DeployServiceProp) {
+  const { agentMeta } = useDiscover();
+  const hasDbLabels = agentMeta?.agentMatcherLabels?.length;
+  const dbLabels = hasDbLabels ? agentMeta.agentMatcherLabels : [];
   const [labels, setLabels] = useState<DiscoverLabel[]>(
     // TODO(lisa): we will always be defaulting to asterisks, so
     // instead of defining the default here, define it inside
@@ -69,6 +72,8 @@ export default function Container(props: AgentStepProps) {
 
   const labelProps = { labels, setLabels, dbLabels };
 
+  const heading = <Heading toggleDeployMethod={toggleDeployMethod} />;
+
   return (
     <Validation>
       {({ validator }) => (
@@ -76,7 +81,7 @@ export default function Container(props: AgentStepProps) {
           onRetry={() => clearCachedJoinTokenResult(ResourceKind.Database)}
           fallbackFn={fbProps => (
             <Box>
-              <Heading />
+              {heading}
               <Labels {...labelProps} />
               <Box>
                 <TextIcon mt={3}>
@@ -91,20 +96,24 @@ export default function Container(props: AgentStepProps) {
           <Suspense
             fallback={
               <Box>
-                <Heading />
+                {heading}
                 <Labels {...labelProps} disableBtns={true} />
                 <ActionButtons onProceed={() => null} disableProceed={true} />
               </Box>
             }
           >
             {!showScript && (
-              <LoadedView {...labelProps} setShowScript={setShowScript} />
+              <LoadedView
+                {...labelProps}
+                setShowScript={setShowScript}
+                toggleDeployMethod={toggleDeployMethod}
+              />
             )}
             {showScript && (
-              <DownloadScript
-                {...props}
+              <ManualDeploy
                 {...labelProps}
                 validator={validator}
+                toggleDeployMethod={toggleDeployMethod}
               />
             )}
           </Suspense>
@@ -114,14 +123,15 @@ export default function Container(props: AgentStepProps) {
   );
 }
 
-export function DownloadScript(
-  props: AgentStepProps & {
-    labels: AgentLabel[];
-    setLabels(l: AgentLabel[]): void;
-    dbLabels: AgentLabel[];
-    validator: Validator;
-  }
-) {
+export function ManualDeploy(props: {
+  labels: AgentLabel[];
+  setLabels(l: AgentLabel[]): void;
+  dbLabels: AgentLabel[];
+  validator: Validator;
+  toggleDeployMethod(): void;
+}) {
+  const { agentMeta, updateAgentMeta, nextStep, emitEvent } = useDiscover();
+
   // Fetches join token.
   const { joinToken } = useJoinTokenSuspender(
     ResourceKind.Database,
@@ -129,19 +139,24 @@ export function DownloadScript(
   );
 
   // Starts resource querying interval.
-  const { active, result } = usePingTeleport<Database>(
-    props.agentMeta.resourceName
-  );
+  const { active, result } = usePingTeleport<Database>(agentMeta.resourceName);
 
   const showHint = useShowHint(active);
 
   function handleNextStep() {
-    props.updateAgentMeta({
-      ...props.agentMeta,
+    updateAgentMeta({
+      ...agentMeta,
       resourceName: result.name,
       db: result,
+      serviceDeployedMethod: 'manual',
     });
-    props.nextStep();
+    nextStep();
+
+    emitEvent(
+      { stepStatus: DiscoverEventStatus.Success }
+      // TODO(lisa) uncomment after backend handles this field
+      // { deployMethod: 'manual' }
+    );
   }
 
   let hint;
@@ -193,12 +208,13 @@ export function DownloadScript(
 
   return (
     <Box>
-      <Heading />
+      <Heading toggleDeployMethod={props.toggleDeployMethod} />
       <Labels
         labels={props.labels}
         setLabels={props.setLabels}
         disableBtns={true}
         dbLabels={props.dbLabels}
+        region={(agentMeta as DbMeta).selectedAwsRdsDb?.region}
       />
       <Box mt={6}>
         <CommandBox>
@@ -216,87 +232,26 @@ export function DownloadScript(
   );
 }
 
-const Heading = () => {
+const Heading = ({ toggleDeployMethod }: { toggleDeployMethod(): void }) => {
+  const { resourceSpec } = useDiscover();
+  const isAwsRds = resourceSpec.dbMeta?.location === DatabaseLocation.Aws;
+  const canChangeDeployMethod = isAwsRds && toggleDeployMethod;
+
   return (
     <>
-      <Header>Deploy a Database Service</Header>
+      <Header>Manually Deploy a Database Service</Header>
       <HeaderSubtitle>
         On the host where you will run the Teleport Database Service, execute
         the generated command that will install and start Teleport with the
         appropriate configuration.
-      </HeaderSubtitle>
-    </>
-  );
-};
-
-export const Labels = ({
-  labels,
-  setLabels,
-  disableBtns = false,
-  dbLabels,
-  showLabelMatchErr = false,
-}: {
-  labels: AgentLabel[];
-  setLabels(l: AgentLabel[]): void;
-  disableBtns?: boolean;
-  dbLabels: AgentLabel[];
-  showLabelMatchErr?: boolean;
-}) => {
-  const hasDbLabels = dbLabels.length > 0;
-  return (
-    <Box mb={2}>
-      <Text bold>Optionally Define Matcher Labels</Text>
-      <Text typography="subtitle1" mb={2}>
-        {!hasDbLabels && (
-          <>
-            Since no labels were defined for the registered database from the
-            previous step, the matcher labels are defaulted to wildcards which
-            will allow this database service to match any database.
-          </>
-        )}
-        {hasDbLabels && (
+        {canChangeDeployMethod && (
           <>
-            Default wildcards label allows this database service to match any
-            database.
-            <br />
-            You can define your own labels that this database service will use
-            to identify your registered database. The labels you define must
-            match the labels that were defined for the registered database (from
-            previous step):
+            <br /> Want us to deploy the database service for you?{' '}
+            <AlternateInstructionButton onClick={toggleDeployMethod} />
           </>
         )}
-      </Text>
-      {hasDbLabels && (
-        <Box mb={3}>
-          {dbLabels.map((label, index) => {
-            const labelText = `${label.name}: ${label.value}`;
-            return (
-              <Pill
-                key={`${label.name}${label.value}${index}`}
-                mr="1"
-                kind="secondary"
-              >
-                {labelText}
-              </Pill>
-            );
-          })}
-        </Box>
-      )}
-      <LabelsCreater
-        labels={labels}
-        setLabels={setLabels}
-        disableBtns={disableBtns || dbLabels.length === 0}
-      />
-      <Box mt={1} mb={3}>
-        {showLabelMatchErr && (
-          <TextIcon>
-            <Icons.Warning ml={1} color="error.main" />
-            The matcher labels must be able to match with the labels defined for
-            the registered database. Use wildcards to match with any labels.
-          </TextIcon>
-        )}
-      </Box>
-    </Box>
+      </HeaderSubtitle>
+    </>
   );
 };
 
@@ -304,35 +259,13 @@ function createBashCommand(tokenId: string) {
   return `sudo bash -c "$(curl -fsSL ${cfg.getDbScriptUrl(tokenId)})"`;
 }
 
-// hasMatchingLabels will go through each 'agentLabels' and find matches from
-// 'dbLabels'. The 'agentLabels' must have same amount of matching labels
-// with 'dbLabels' either with asteriks (match all) or by exact match.
-//
-// `agentLabels` have OR comparison eg:
-//  - If agent labels was defined like this [`fruit: apple`, `fruit: banana`]
-//    it's translated as `fruit: [apple OR banana]`.
-//
-// asterisks can be used for keys, values, or both key and value eg:
-//  - `fruit: *` match by key `fruit` with any value
-//  - `*: apple` match by value `apple` with any key
-//  - `*: *` match by any key and any value
-export function hasMatchingLabels(
-  dbLabels: AgentLabel[],
-  agentLabels: AgentLabel[]
-) {
-  // Convert agentLabels into a map of key of value arrays.
-  const matcherLabels: Record<string, string[]> = {};
-  agentLabels.forEach(l => {
-    if (!matcherLabels[l.name]) {
-      matcherLabels[l.name] = [];
-    }
-    matcherLabels[l.name] = [...matcherLabels[l.name], l.value];
-  });
-
-  return matchLabels(dbLabels, matcherLabels);
-}
-
-function LoadedView({ labels, setLabels, dbLabels, setShowScript }) {
+function LoadedView({
+  labels,
+  setLabels,
+  dbLabels,
+  setShowScript,
+  toggleDeployMethod,
+}) {
   const [showLabelMatchErr, setShowLabelMatchErr] = useState(true);
 
   useEffect(() => {
@@ -354,7 +287,7 @@ function LoadedView({ labels, setLabels, dbLabels, setShowScript }) {
 
   return (
     <Box>
-      <Heading />
+      <Heading toggleDeployMethod={toggleDeployMethod} />
       <Labels
         labels={labels}
         setLabels={setLabels}
diff --git a/web/packages/teleport/src/Discover/Database/DownloadScript/index.ts b/web/packages/teleport/src/Discover/Database/DeployService/ManualDeploy/index.ts
similarity index 89%
rename from web/packages/teleport/src/Discover/Database/DownloadScript/index.ts
rename to web/packages/teleport/src/Discover/Database/DeployService/ManualDeploy/index.ts
index cb37f9f4a720b..7dbf77c03d011 100644
--- a/web/packages/teleport/src/Discover/Database/DownloadScript/index.ts
+++ b/web/packages/teleport/src/Discover/Database/DeployService/ManualDeploy/index.ts
@@ -13,5 +13,5 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import DownloadScript from './DownloadScript';
-export { DownloadScript };
+import ManualDeploy from './ManualDeploy';
+export { ManualDeploy };
diff --git a/web/packages/teleport/src/Discover/Database/DeployService/index.ts b/web/packages/teleport/src/Discover/Database/DeployService/index.ts
new file mode 100644
index 0000000000000..09560f34531d3
--- /dev/null
+++ b/web/packages/teleport/src/Discover/Database/DeployService/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { DeployService } from './DeployService';
diff --git a/web/packages/teleport/src/Discover/Database/DownloadScript/DownloadScript.story.tsx b/web/packages/teleport/src/Discover/Database/DownloadScript/DownloadScript.story.tsx
deleted file mode 100644
index 62dc97e359394..0000000000000
--- a/web/packages/teleport/src/Discover/Database/DownloadScript/DownloadScript.story.tsx
+++ /dev/null
@@ -1,175 +0,0 @@
-/**
- * Copyright 2022 Gravitational, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import React from 'react';
-import { MemoryRouter } from 'react-router';
-
-import { Context as TeleportContext, ContextProvider } from 'teleport';
-import cfg from 'teleport/config';
-import { ResourceKind } from 'teleport/Discover/Shared';
-import { clearCachedJoinTokenResult } from 'teleport/Discover/Shared/useJoinTokenSuspender';
-import { PingTeleportProvider } from 'teleport/Discover/Shared/PingTeleportContext';
-import { getUserContext } from 'teleport/mocks/contexts';
-
-import DownloadScript from './DownloadScript';
-
-const { worker, rest } = window.msw;
-
-export default {
-  title: 'Teleport/Discover/Database/DownloadScript',
-  decorators: [
-    Story => {
-      // Reset request handlers added in individual stories.
-      worker.resetHandlers();
-      clearCachedJoinTokenResult(ResourceKind.Database);
-      return <Story />;
-    },
-  ],
-};
-
-export const Init = () => {
-  return (
-    <Provider>
-      <DownloadScript {...props} />
-    </Provider>
-  );
-};
-
-export const InitWithLabels = () => {
-  return (
-    <Provider>
-      <DownloadScript
-        {...props}
-        agentMeta={{
-          ...props.agentMeta,
-          agentMatcherLabels: [
-            { name: 'env', value: 'staging' },
-            { name: 'os', value: 'windows' },
-          ],
-        }}
-      />
-    </Provider>
-  );
-};
-
-export const Polling = () => {
-  // Use default fetch token handler defined in mocks/handlers
-
-  worker.use(
-    rest.get(cfg.api.databasesPath, (req, res, ctx) => {
-      return res(ctx.delay('infinite'));
-    })
-  );
-  return (
-    <Provider>
-      <DownloadScript {...props} />
-    </Provider>
-  );
-};
-
-export const PollingSuccess = () => {
-  // Use default fetch token handler defined in mocks/handlers
-
-  worker.use(
-    rest.get(cfg.api.databasesPath, (req, res, ctx) => {
-      return res(ctx.json({ items: [{}] }));
-    })
-  );
-  return (
-    <Provider interval={5}>
-      <DownloadScript {...props} />
-    </Provider>
-  );
-};
-
-export const PollingError = () => {
-  // Use default fetch token handler defined in mocks/handlers
-
-  worker.use(
-    rest.get(cfg.api.databasesPath, (req, res, ctx) => {
-      return res(ctx.delay('infinite'));
-    })
-  );
-  return (
-    <Provider timeout={50}>
-      <DownloadScript {...props} />
-    </Provider>
-  );
-};
-export const Processing = () => {
-  worker.use(
-    rest.post(cfg.api.joinTokenPath, (req, res, ctx) => {
-      return res(ctx.delay('infinite'));
-    })
-  );
-  return (
-    <Provider interval={5}>
-      <DownloadScript {...props} />
-    </Provider>
-  );
-};
-
-export const Failed = () => {
-  worker.use(
-    rest.post(cfg.api.joinTokenPath, (req, res, ctx) => {
-      return res.once(ctx.status(500));
-    })
-  );
-  return (
-    <Provider>
-      <DownloadScript {...props} />
-    </Provider>
-  );
-};
-
-const Provider = props => {
-  const ctx = createTeleportContext();
-
-  return (
-    <MemoryRouter
-      initialEntries={[
-        { pathname: cfg.routes.discover, state: { entity: 'database' } },
-      ]}
-    >
-      <ContextProvider ctx={ctx}>
-        <PingTeleportProvider
-          interval={props.interval || 100000}
-          resourceKind={ResourceKind.Database}
-        >
-          {props.children}
-        </PingTeleportProvider>
-      </ContextProvider>
-    </MemoryRouter>
-  );
-};
-
-function createTeleportContext() {
-  const ctx = new TeleportContext();
-
-  ctx.isEnterprise = false;
-  ctx.storeUser.setState(getUserContext());
-
-  return ctx;
-}
-
-const props = {
-  agentMeta: {
-    resourceName: 'db-name',
-    agentMatcherLabels: [],
-    db: {} as any,
-  },
-  nextStep: () => null,
-};
diff --git a/web/packages/teleport/src/Discover/Database/DownloadScript/DownloadScript.test.ts b/web/packages/teleport/src/Discover/Database/DownloadScript/DownloadScript.test.ts
deleted file mode 100644
index 0e7feb1c3cc6d..0000000000000
--- a/web/packages/teleport/src/Discover/Database/DownloadScript/DownloadScript.test.ts
+++ /dev/null
@@ -1,114 +0,0 @@
-/**
- * Copyright 2022 Gravitational, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { hasMatchingLabels } from './DownloadScript';
-
-const dbLabels = [
-  { name: 'os', value: 'mac' },
-  { name: 'env', value: 'prod' },
-  { name: 'tag', value: 'v11.0.0' },
-];
-
-const testCases = [
-  {
-    name: 'match with exact values',
-    dbLabels: dbLabels,
-    agentLabels: [
-      { name: 'tag', value: 'v11.0.0' }, // match
-      { name: 'os', value: 'linux' },
-      { name: 'os', value: 'windows' },
-      { name: 'env', value: 'prod' }, // match
-      { name: 'env', value: 'dev' },
-      { name: 'os', value: 'mac' }, // match
-      { name: 'tag', value: 'v12.0.0' },
-    ],
-    expectedMatch: true,
-  },
-  {
-    name: 'match by all asteriks',
-    dbLabels: dbLabels,
-    agentLabels: [
-      { name: 'fruit', value: 'apple' },
-      { name: '*', value: '*' },
-    ],
-    expectedMatch: true,
-  },
-  {
-    name: 'match by all asteriks, with no dbLabels defined',
-    dbLabels: [],
-    agentLabels: [
-      { name: 'fruit', value: 'apple' },
-      { name: '*', value: '*' },
-    ],
-    expectedMatch: true,
-  },
-  {
-    name: 'match by key asteriks',
-    dbLabels: dbLabels,
-    agentLabels: [
-      { name: 'os', value: '*' },
-      { name: 'env', value: '*' },
-      { name: 'tag', value: '*' },
-    ],
-    expectedMatch: true,
-  },
-  {
-    name: 'match by value asteriks',
-    dbLabels: dbLabels,
-    agentLabels: [
-      { name: '*', value: 'prod' },
-      { name: '*', value: 'mac' },
-      { name: '*', value: 'v11.0.0' },
-    ],
-    expectedMatch: true,
-  },
-  {
-    name: 'match by asteriks and exacts',
-    dbLabels: dbLabels,
-    agentLabels: [
-      { name: 'os', value: 'windows' },
-      { name: '*', value: 'prod' },
-      { name: 'os', value: '*' },
-      { name: 'tag', value: 'v11.0.0' },
-      { name: 'tag', value: 'v12.0.0' },
-      { name: '*', value: 'banana' },
-    ],
-    expectedMatch: true,
-  },
-  {
-    name: 'no match despite having all matching labels',
-    dbLabels: dbLabels,
-    agentLabels: [
-      ...dbLabels,
-      { name: 'fruit', value: 'banana' }, // the culprit
-    ],
-  },
-  {
-    name: 'no matches',
-    dbLabels: dbLabels,
-    agentLabels: [{ name: 'fruit', value: 'banana' }],
-  },
-  {
-    name: 'no matches with empty agentLabels list',
-    dbLabels: dbLabels,
-    agentLabels: [],
-  },
-];
-
-test.each(testCases)('$name', ({ dbLabels, agentLabels, expectedMatch }) => {
-  const match = hasMatchingLabels(dbLabels, agentLabels);
-  expect(match).toEqual(Boolean(expectedMatch));
-});
diff --git a/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/AwsRegionSelector.tsx b/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/AwsRegionSelector.tsx
index 9754fb1567806..d70b9329c294d 100644
--- a/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/AwsRegionSelector.tsx
+++ b/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/AwsRegionSelector.tsx
@@ -15,11 +15,8 @@
  */
 
 import React, { useState } from 'react';
-import { Box, ButtonPrimary, Text, Flex, ButtonSecondary } from 'design';
-import FieldSelect from 'shared/components/FieldSelect';
-import { Option } from 'shared/components/Select';
-import { requiredField } from 'shared/components/Validation/rules';
-import Validation, { Validator } from 'shared/components/Validation';
+import { Box, Text, Flex, ButtonSecondary, LabelInput } from 'design';
+import Select, { Option } from 'shared/components/Select';
 import { Refresh as RefreshIcon } from 'design/Icon';
 
 import { awsRegionMap, Regions } from 'teleport/services/integrations';
@@ -27,83 +24,59 @@ import { awsRegionMap, Regions } from 'teleport/services/integrations';
 export function AwsRegionSelector({
   onFetch,
   onRefresh,
-  disableFetch,
   disableSelector,
   clear,
 }: {
   onFetch(region: Regions): void;
   onRefresh(): void;
-  disableFetch: boolean;
   disableSelector: boolean;
   clear(): void;
 }) {
   const [selectedRegion, setSelectedRegion] = useState<RegionOption>();
 
-  function handleFetch(validator: Validator) {
-    if (!validator.validate()) {
-      return;
-    }
-    onFetch(selectedRegion.value);
-  }
-
   function handleRegionSelect(option: RegionOption) {
     clear();
     setSelectedRegion(option);
+    onFetch(option.value);
   }
 
   return (
-    <Validation>
-      {({ validator }) => (
-        <Box>
-          <Text mt={4}>
-            Select the AWS Region you would like to see databases for:
-          </Text>
-          <Flex alignItems="center" gap={3} mt={2} mb={3}>
-            <Box width="320px">
-              <FieldSelect
-                label="AWS Region"
-                rule={requiredField('Region is required')}
-                placeholder="Select a Region"
-                isSearchable
-                isSimpleValue
-                value={selectedRegion}
-                onChange={handleRegionSelect}
-                options={options}
-                isDisabled={disableSelector}
-              />
-            </Box>
-            <Flex alignItems="center">
-              <ButtonPrimary
-                disabled={disableFetch || !selectedRegion}
-                onClick={() => handleFetch(validator)}
-                width="160px"
-                height="40px"
-                mt={1}
-              >
-                Fetch Databases
-              </ButtonPrimary>
-              <ButtonSecondary
-                onClick={onRefresh}
-                ml={3}
-                mt={1}
-                title="Refresh database table"
-                height="40px"
-                width="30px"
-                css={`
-                  &:disabled {
-                    opacity: 0.35;
-                    pointer-events: none;
-                  }
-                `}
-                disabled={disableSelector || !disableFetch}
-              >
-                <RefreshIcon fontSize={3} />
-              </ButtonSecondary>
-            </Flex>
-          </Flex>
+    <Box>
+      <Text mt={4}>
+        Select the AWS Region you would like to see databases for:
+      </Text>
+      <Flex alignItems="center" gap={3} mt={2} mb={3}>
+        <Box width="320px" mb={4}>
+          <LabelInput htmlFor={'select'}>AWS Region</LabelInput>
+          <Select
+            inputId="select"
+            isSearchable
+            value={selectedRegion}
+            onChange={handleRegionSelect}
+            options={options}
+            placeholder="Select a region"
+            autoFocus
+            isDisabled={disableSelector}
+          />
         </Box>
-      )}
-    </Validation>
+        <ButtonSecondary
+          onClick={onRefresh}
+          mt={1}
+          title="Refresh database table"
+          height="40px"
+          width="30px"
+          css={`
+            &:disabled {
+              opacity: 0.35;
+              pointer-events: none;
+            }
+          `}
+          disabled={disableSelector || !selectedRegion}
+        >
+          <RefreshIcon fontSize={3} />
+        </ButtonSecondary>
+      </Flex>
+    </Box>
   );
 }
 
diff --git a/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/EnrollRdsDatabase.story.tsx b/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/EnrollRdsDatabase.story.tsx
index d309298a1ed76..dae7750031f50 100644
--- a/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/EnrollRdsDatabase.story.tsx
+++ b/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/EnrollRdsDatabase.story.tsx
@@ -27,7 +27,6 @@ export default {
 export const AwsRegionsSelectorDisabled = () => (
   <AwsRegionSelector
     onFetch={() => null}
-    disableFetch={true}
     onRefresh={() => null}
     disableSelector={true}
     clear={() => null}
@@ -37,7 +36,6 @@ export const AwsRegionsSelectorDisabled = () => (
 export const AwsRegionsSelectorEnabled = () => (
   <AwsRegionSelector
     onFetch={() => null}
-    disableFetch={false}
     onRefresh={() => null}
     disableSelector={false}
     clear={() => null}
@@ -47,7 +45,6 @@ export const AwsRegionsSelectorEnabled = () => (
 export const AwsRegionsSelectorRefreshEnabled = () => (
   <AwsRegionSelector
     onFetch={() => null}
-    disableFetch={true}
     onRefresh={() => null}
     disableSelector={false}
     clear={() => null}
@@ -93,6 +90,8 @@ const fixtures: CheckedAwsRdsDatabase[] = [
     status: 'available',
     accountId: '',
     resourceId: '',
+    region: 'us-west-2',
+    subnets: ['subnet1', 'subnet2'],
   },
   {
     name: 'mysql-name',
@@ -103,6 +102,8 @@ const fixtures: CheckedAwsRdsDatabase[] = [
     accountId: '',
     resourceId: '',
     dbServerExists: true,
+    region: 'us-west-2',
+    subnets: ['subnet1', 'subnet2'],
   },
   {
     name: 'alpaca',
@@ -115,6 +116,8 @@ const fixtures: CheckedAwsRdsDatabase[] = [
     status: 'deleting',
     accountId: '',
     resourceId: '',
+    region: 'us-west-2',
+    subnets: ['subnet1', 'subnet2'],
   },
   {
     name: 'banana',
@@ -124,6 +127,8 @@ const fixtures: CheckedAwsRdsDatabase[] = [
     status: 'failed',
     accountId: '',
     resourceId: '',
+    region: 'us-west-2',
+    subnets: ['subnet1', 'subnet2'],
   },
   {
     name: 'watermelon',
@@ -138,6 +143,8 @@ const fixtures: CheckedAwsRdsDatabase[] = [
     accountId: '',
     resourceId: '',
     dbServerExists: true,
+    region: 'us-west-2',
+    subnets: ['subnet1', 'subnet2'],
   },
   {
     name: 'llama',
@@ -147,5 +154,7 @@ const fixtures: CheckedAwsRdsDatabase[] = [
     status: 'available',
     accountId: '',
     resourceId: '',
+    region: 'us-west-2',
+    subnets: ['subnet1', 'subnet2'],
   },
 ];
diff --git a/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/EnrollRdsDatabase.test.tsx b/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/EnrollRdsDatabase.test.tsx
new file mode 100644
index 0000000000000..fc4667e7f91f6
--- /dev/null
+++ b/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/EnrollRdsDatabase.test.tsx
@@ -0,0 +1,147 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import { MemoryRouter } from 'react-router';
+import { render, screen, fireEvent } from 'design/utils/testing';
+
+import { ContextProvider } from 'teleport';
+import {
+  AwsRdsDatabase,
+  integrationService,
+} from 'teleport/services/integrations';
+import { createTeleportContext } from 'teleport/mocks/contexts';
+import cfg from 'teleport/config';
+import TeleportContext from 'teleport/teleportContext';
+import {
+  DiscoverContextState,
+  DiscoverProvider,
+} from 'teleport/Discover/useDiscover';
+import {
+  DatabaseEngine,
+  DatabaseLocation,
+} from 'teleport/Discover/SelectResource';
+import { FeaturesContextProvider } from 'teleport/FeaturesContext';
+
+import { EnrollRdsDatabase } from './EnrollRdsDatabase';
+
+describe('test EnrollRdsDatabase.tsx', () => {
+  const ctx = createTeleportContext();
+  const discoverCtx: DiscoverContextState = {
+    agentMeta: {} as any,
+    currentStep: 0,
+    nextStep: jest.fn(x => x),
+    prevStep: () => null,
+    onSelectResource: () => null,
+    resourceSpec: {
+      dbMeta: {
+        location: DatabaseLocation.Aws,
+        engine: DatabaseEngine.AuroraMysql,
+      },
+    } as any,
+    viewConfig: null,
+    exitFlow: null,
+    indexedViews: [],
+    setResourceSpec: () => null,
+    updateAgentMeta: jest.fn(x => x),
+    emitErrorEvent: () => null,
+    emitEvent: () => null,
+    eventState: null,
+  };
+
+  beforeEach(() => {
+    jest
+      .spyOn(ctx.databaseService, 'fetchDatabases')
+      .mockResolvedValue({ agents: [] });
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('without rds database result, does not attempt to fetch db servers', async () => {
+    renderRdsDatabase(ctx, discoverCtx);
+    jest
+      .spyOn(integrationService, 'fetchAwsRdsDatabases')
+      .mockResolvedValue({ databases: [] });
+
+    // select a region from selector.
+    const selectEl = screen.getByLabelText(/aws region/i);
+    fireEvent.focus(selectEl);
+    fireEvent.keyDown(selectEl, { key: 'ArrowDown', keyCode: 40 });
+    fireEvent.click(screen.getByText('us-east-2'));
+
+    // No results are rendered.
+    await screen.findByText(/no result/i);
+
+    expect(integrationService.fetchAwsRdsDatabases).toHaveBeenCalledTimes(1);
+    expect(ctx.databaseService.fetchDatabases).not.toHaveBeenCalled();
+  });
+
+  test('with rds database result, makes a fetch request for db servers', async () => {
+    renderRdsDatabase(ctx, discoverCtx);
+    jest.spyOn(integrationService, 'fetchAwsRdsDatabases').mockResolvedValue({
+      databases: mockAwsDbs,
+    });
+
+    // select a region from selector.
+    const selectEl = screen.getByLabelText(/aws region/i);
+    fireEvent.focus(selectEl);
+    fireEvent.keyDown(selectEl, { key: 'ArrowDown', keyCode: 40 });
+    fireEvent.click(screen.getByText('us-east-2'));
+
+    // Rds results renders result.
+    await screen.findByText(/rds-1/i);
+
+    expect(integrationService.fetchAwsRdsDatabases).toHaveBeenCalledTimes(1);
+    expect(ctx.databaseService.fetchDatabases).toHaveBeenCalledTimes(1);
+  });
+});
+
+function renderRdsDatabase(
+  ctx: TeleportContext,
+  discoverCtx: DiscoverContextState
+) {
+  return render(
+    <MemoryRouter
+      initialEntries={[
+        { pathname: cfg.routes.discover, state: { entity: 'database' } },
+      ]}
+    >
+      <ContextProvider ctx={ctx}>
+        <FeaturesContextProvider value={[]}>
+          <DiscoverProvider mockCtx={discoverCtx}>
+            <EnrollRdsDatabase />
+          </DiscoverProvider>
+        </FeaturesContextProvider>
+      </ContextProvider>
+    </MemoryRouter>
+  );
+}
+
+const mockAwsDbs: AwsRdsDatabase[] = [
+  {
+    engine: 'postgres',
+    name: 'rds-1',
+    uri: 'endpoint-1',
+    status: 'available',
+    labels: [{ name: 'env', value: 'prod' }],
+    accountId: 'account-id-1',
+    resourceId: 'resource-id-1',
+    region: 'us-east-2',
+    subnets: ['subnet1', 'subnet2'],
+  },
+];
diff --git a/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/EnrollRdsDatabase.tsx b/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/EnrollRdsDatabase.tsx
index d9a1aceae14fe..e74cb4861dca3 100644
--- a/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/EnrollRdsDatabase.tsx
+++ b/web/packages/teleport/src/Discover/Database/EnrollRdsDatabase/EnrollRdsDatabase.tsx
@@ -114,6 +114,13 @@ export function EnrollRdsDatabase() {
           }
         );
 
+      // Abort if there were no rds dbs for the selected region.
+      if (fetchedRdsDbs.length <= 0) {
+        setFetchDbAttempt({ status: 'success' });
+        setTableData({ ...data, fetchStatus: 'disabled' });
+        return;
+      }
+
       // Check if fetched rds databases have a database
       // server for it, to prevent user from enrolling
       // the same db and getting an error from it.
@@ -183,10 +190,7 @@ export function EnrollRdsDatabase() {
         protocol: selectedDb.engine,
         uri: selectedDb.uri,
         labels: selectedDb.labels,
-        awsRds: {
-          accountId: selectedDb.accountId,
-          resourceId: selectedDb.resourceId,
-        },
+        awsRds: selectedDb,
       },
       // Corner case where if registering db fails a user can:
       //   1) change region, which will list new databases or
@@ -206,9 +210,6 @@ export function EnrollRdsDatabase() {
         onRefresh={refreshDatabaseList}
         clear={clear}
         disableSelector={fetchDbAttempt.status === 'processing'}
-        disableFetch={
-          fetchDbAttempt.status === 'processing' || tableData.items.length > 0
-        }
       />
       <DatabaseList
         items={tableData.items}
diff --git a/web/packages/teleport/src/Discover/Database/MutualTls/MutualTls.tsx b/web/packages/teleport/src/Discover/Database/MutualTls/MutualTls.tsx
index 0f2bfb779d8b4..a92b7d36e57d1 100644
--- a/web/packages/teleport/src/Discover/Database/MutualTls/MutualTls.tsx
+++ b/web/packages/teleport/src/Discover/Database/MutualTls/MutualTls.tsx
@@ -69,6 +69,7 @@ export function MutualTlsView({
           <Flex minHeight="195px" mt={3}>
             <TextEditor
               readOnly={true}
+              bg="levels.deep"
               data={[{ content: dbCU, type: 'yaml' }]}
             />
           </Flex>
diff --git a/web/packages/teleport/src/Discover/Database/utils.test.ts b/web/packages/teleport/src/Discover/Database/common.test.ts
similarity index 98%
rename from web/packages/teleport/src/Discover/Database/utils.test.ts
rename to web/packages/teleport/src/Discover/Database/common.test.ts
index a606758ecb811..75c72fc452d32 100644
--- a/web/packages/teleport/src/Discover/Database/utils.test.ts
+++ b/web/packages/teleport/src/Discover/Database/common.test.ts
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-import { matchLabels } from './util';
+import { matchLabels } from './common';
 
 const newDbLabels = [
   { name: 'env', value: 'prod' },
diff --git a/web/packages/teleport/src/Discover/Database/common.tsx b/web/packages/teleport/src/Discover/Database/common.tsx
new file mode 100644
index 0000000000000..b21d5303d022a
--- /dev/null
+++ b/web/packages/teleport/src/Discover/Database/common.tsx
@@ -0,0 +1,207 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import { Box, Label as Pill, Text } from 'design';
+import * as Icons from 'design/Icon';
+
+import { AgentLabel } from 'teleport/services/agents';
+import { LabelsCreater, Mark, TextIcon } from 'teleport/Discover/Shared';
+import { Regions } from 'teleport/services/integrations';
+
+// serviceDeployedMethod is a flag to determine if user opted to
+// deploy database service automagically (teleport deploys for user)
+// or manually (user has their own server).
+export type ServiceDeployMethod = 'auto' | 'manual';
+
+export const Labels = ({
+  labels,
+  setLabels,
+  disableBtns = false,
+  dbLabels,
+  showLabelMatchErr = false,
+  autoFocus = true,
+  region,
+}: {
+  labels: AgentLabel[];
+  setLabels(l: AgentLabel[]): void;
+  disableBtns?: boolean;
+  dbLabels: AgentLabel[];
+  showLabelMatchErr?: boolean;
+  autoFocus?: boolean;
+  region?: Regions;
+}) => {
+  const hasDbLabels = dbLabels.length > 0;
+  return (
+    <Box mb={2}>
+      <Text bold>Optionally Define Matcher Labels</Text>
+      {!hasDbLabels && (
+        <Text typography="subtitle1" mb={2}>
+          Since no labels were defined for the registered database from the
+          previous step, the matcher labels are defaulted to wildcards which
+          will allow this database service to match any database.
+        </Text>
+      )}
+      {hasDbLabels && (
+        <>
+          <Text typography="subtitle1" mb={2}>
+            The default wildcard label allows this database service to match any
+            database. If you're unsure about how label matching works in
+            Teleport, leave this for now.
+          </Text>
+          <Text typography="subtitle1" mb={2}>
+            Alternatively, you can define narrower labels for identifying the
+            databases you register
+            {region ? (
+              <span>
+                {' '}
+                in this region (<Mark>{region}</Mark>).
+              </span>
+            ) : (
+              '.'
+            )}{' '}
+            In order to identify the database you registered in the previous
+            step, the labels you define here must match with one of its existing
+            labels:
+          </Text>
+          <Box mb={3}>
+            {dbLabels.map((label, index) => {
+              const labelText = `${label.name}: ${label.value}`;
+              return (
+                <Pill
+                  key={`${label.name}${label.value}${index}`}
+                  mr="1"
+                  kind="secondary"
+                >
+                  {labelText}
+                </Pill>
+              );
+            })}
+          </Box>
+        </>
+      )}
+      <LabelsCreater
+        autoFocus={autoFocus}
+        labels={labels}
+        setLabels={setLabels}
+        disableBtns={disableBtns || dbLabels.length === 0}
+      />
+      <Box mt={1} mb={3}>
+        {showLabelMatchErr && (
+          <TextIcon>
+            <Icons.Warning ml={1} color="error.main" />
+            The matcher labels must be able to match with the labels defined for
+            the registered database. Use wildcards to match with any labels.
+          </TextIcon>
+        )}
+      </Box>
+    </Box>
+  );
+};
+
+export function matchLabels(
+  newDbLabels: AgentLabel[],
+  matcherLabels: Record<string, string[]>
+) {
+  // Sorting to match by asteriks sooner.
+  const entries = Object.entries({ ...matcherLabels }).sort();
+
+  if (!entries.length) {
+    return false;
+  }
+
+  // Create a map for db labels for easy lookup.
+  let dbKeyMap = {};
+  let dbValMap = {};
+
+  newDbLabels.forEach(label => {
+    dbKeyMap[label.name] = label.value;
+    dbValMap[label.value] = label.name;
+  });
+
+  // All matching labels must make a match with the new database labels.
+  let matched = true;
+  for (let i = 0; i < entries.length; i++) {
+    const [key, vals] = entries[i];
+    // Check if this label set contains asteriks, which means match all.
+    // A service with match all can pick up any database regardless of other labels
+    // or no labels.
+    const foundAsterikAsValue = vals.includes('*');
+    if (key === '*' && foundAsterikAsValue) {
+      return true;
+    }
+
+    // If no newDbLabels labels were defined, there are no matches to make,
+    // which makes this service not a match.
+    if (!newDbLabels.length) {
+      matched = false;
+      break;
+    }
+
+    // Start matching by values.
+
+    // This means any key is fine, as long as a value matches.
+    if (key === '*' && vals.find(val => dbValMap[val])) {
+      continue;
+    }
+
+    // This means any value is fine, as long as a key matches.
+    if (foundAsterikAsValue && dbKeyMap[key]) {
+      continue;
+    }
+
+    // Match against key and value.
+    const dbVal = dbKeyMap[key];
+    if (dbVal && vals.find(val => val === dbVal)) {
+      continue;
+    }
+
+    // No matches were found for this label set which
+    // means this service not a match.
+    matched = false;
+    break;
+  } // label set loop
+
+  return matched;
+}
+
+// hasMatchingLabels will go through each 'agentLabels' and find matches from
+// 'dbLabels'. The 'agentLabels' must have same amount of matching labels
+// with 'dbLabels' either with asteriks (match all) or by exact match.
+//
+// `agentLabels` have OR comparison eg:
+//  - If agent labels was defined like this [`fruit: apple`, `fruit: banana`]
+//    it's translated as `fruit: [apple OR banana]`.
+//
+// asterisks can be used for keys, values, or both key and value eg:
+//  - `fruit: *` match by key `fruit` with any value
+//  - `*: apple` match by value `apple` with any key
+//  - `*: *` match by any key and any value
+export function hasMatchingLabels(
+  dbLabels: AgentLabel[],
+  agentLabels: AgentLabel[]
+) {
+  // Convert agentLabels into a map of key of value arrays.
+  const matcherLabels: Record<string, string[]> = {};
+  agentLabels.forEach(l => {
+    if (!matcherLabels[l.name]) {
+      matcherLabels[l.name] = [];
+    }
+    matcherLabels[l.name] = [...matcherLabels[l.name], l.value];
+  });
+
+  return matchLabels(dbLabels, matcherLabels);
+}
diff --git a/web/packages/teleport/src/Discover/Database/index.tsx b/web/packages/teleport/src/Discover/Database/index.tsx
index 0cd1b163dc2d3..85fa4a741c9a3 100644
--- a/web/packages/teleport/src/Discover/Database/index.tsx
+++ b/web/packages/teleport/src/Discover/Database/index.tsx
@@ -26,7 +26,7 @@ import {
 
 import { CreateDatabase } from 'teleport/Discover/Database/CreateDatabase';
 import { SetupAccess } from 'teleport/Discover/Database/SetupAccess';
-import { DownloadScript } from 'teleport/Discover/Database/DownloadScript';
+import { ManualDeploy } from 'teleport/Discover/Database/DeployService/ManualDeploy';
 import { MutualTls } from 'teleport/Discover/Database/MutualTls';
 import { TestConnection } from 'teleport/Discover/Database/TestConnection';
 import { DiscoverEvent } from 'teleport/services/userEvent';
@@ -68,7 +68,7 @@ export const DatabaseResource: ResourceViewConfig<ResourceSpec> = {
             },
             {
               title: 'Deploy Database Service',
-              component: DownloadScript,
+              component: ManualDeploy,
               eventName: DiscoverEvent.DeployService,
             },
             {
@@ -89,7 +89,7 @@ export const DatabaseResource: ResourceViewConfig<ResourceSpec> = {
             },
             {
               title: 'Deploy Database Service',
-              component: DownloadScript,
+              component: ManualDeploy,
               eventName: DiscoverEvent.DeployService,
             },
             {
diff --git a/web/packages/teleport/src/Discover/Database/util.ts b/web/packages/teleport/src/Discover/Database/util.ts
deleted file mode 100644
index 5e71d3f9805b0..0000000000000
--- a/web/packages/teleport/src/Discover/Database/util.ts
+++ /dev/null
@@ -1,83 +0,0 @@
-/**
- * Copyright 2023 Gravitational, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import type { AgentLabel } from 'teleport/services/agents';
-
-export function matchLabels(
-  newDbLabels: AgentLabel[],
-  matcherLabels: Record<string, string[]>
-) {
-  // Sorting to match by asteriks sooner.
-  const entries = Object.entries({ ...matcherLabels }).sort();
-
-  if (!entries.length) {
-    return false;
-  }
-
-  // Create a map for db labels for easy lookup.
-  let dbKeyMap = {};
-  let dbValMap = {};
-
-  newDbLabels.forEach(label => {
-    dbKeyMap[label.name] = label.value;
-    dbValMap[label.value] = label.name;
-  });
-
-  // All matching labels must make a match with the new database labels.
-  let matched = true;
-  for (let i = 0; i < entries.length; i++) {
-    const [key, vals] = entries[i];
-    // Check if this label set contains asteriks, which means match all.
-    // A service with match all can pick up any database regardless of other labels
-    // or no labels.
-    const foundAsterikAsValue = vals.includes('*');
-    if (key === '*' && foundAsterikAsValue) {
-      return true;
-    }
-
-    // If no newDbLabels labels were defined, there are no matches to make,
-    // which makes this service not a match.
-    if (!newDbLabels.length) {
-      matched = false;
-      break;
-    }
-
-    // Start matching by values.
-
-    // This means any key is fine, as long as a value matches.
-    if (key === '*' && vals.find(val => dbValMap[val])) {
-      continue;
-    }
-
-    // This means any value is fine, as long as a key matches.
-    if (foundAsterikAsValue && dbKeyMap[key]) {
-      continue;
-    }
-
-    // Match against key and value.
-    const dbVal = dbKeyMap[key];
-    if (dbVal && vals.find(val => val === dbVal)) {
-      continue;
-    }
-
-    // No matches were found for this label set which
-    // means this service not a match.
-    matched = false;
-    break;
-  } // label set loop
-
-  return matched;
-}
diff --git a/web/packages/teleport/src/Discover/Discover.tsx b/web/packages/teleport/src/Discover/Discover.tsx
index 4d22ac690130f..900de517a70e4 100644
--- a/web/packages/teleport/src/Discover/Discover.tsx
+++ b/web/packages/teleport/src/Discover/Discover.tsx
@@ -22,9 +22,10 @@ import { Box } from 'design';
 import { FeatureBox } from 'teleport/components/Layout';
 
 import { Navigation } from 'teleport/Discover/Navigation/Navigation';
-import { SelectResource } from 'teleport/Discover/SelectResource/SelectResource';
+import { SelectResource } from 'teleport/Discover/SelectResource';
 import cfg from 'teleport/config';
 
+import { EViewConfigs } from './types';
 import { findViewAtIndex } from './flow';
 
 import { DiscoverProvider, useDiscover } from './useDiscover';
@@ -86,10 +87,18 @@ function DiscoverContent() {
   );
 }
 
-export function Discover() {
+export function DiscoverComponent({ eViewConfigs = [] }: Props) {
   return (
-    <DiscoverProvider>
+    <DiscoverProvider eViewConfigs={eViewConfigs}>
       <DiscoverContent />
     </DiscoverProvider>
   );
 }
+
+export function Discover() {
+  return <DiscoverComponent />;
+}
+
+type Props = {
+  eViewConfigs?: EViewConfigs;
+};
diff --git a/web/packages/teleport/src/Discover/SelectResource/PermissionsErrorMessage.tsx b/web/packages/teleport/src/Discover/SelectResource/PermissionsErrorMessage.tsx
index e244b24620a27..c0ef39b5e70b3 100644
--- a/web/packages/teleport/src/Discover/SelectResource/PermissionsErrorMessage.tsx
+++ b/web/packages/teleport/src/Discover/SelectResource/PermissionsErrorMessage.tsx
@@ -19,13 +19,15 @@ import { Text, Box } from 'design';
 
 import { ResourceKind } from '../Shared';
 
+import { ResourceSpec } from './types';
+
 export function PermissionsErrorMessage({
-  resourceKind,
+  resource,
 }: PermissionsErrorMessageProps) {
   let action = 'add new';
   let productName = '';
 
-  switch (resourceKind) {
+  switch (resource.kind) {
     case ResourceKind.Application:
       action = `${action} Applications`;
       productName = 'Access Application';
@@ -51,8 +53,8 @@ export function PermissionsErrorMessage({
 
       break;
     default:
-      action = 'unimplemented';
-      productName = 'unimplemented';
+      action = `${action} ${resource.name}s`;
+      productName = `adding ${resource.name}s`;
   }
 
   return (
@@ -75,5 +77,5 @@ export function PermissionsErrorMessage({
 }
 
 interface PermissionsErrorMessageProps {
-  resourceKind: ResourceKind;
+  resource: ResourceSpec;
 }
diff --git a/web/packages/teleport/src/Discover/SelectResource/SelectResource.test.tsx b/web/packages/teleport/src/Discover/SelectResource/SelectResource.test.tsx
new file mode 100644
index 0000000000000..a890198fad25f
--- /dev/null
+++ b/web/packages/teleport/src/Discover/SelectResource/SelectResource.test.tsx
@@ -0,0 +1,153 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { ResourceKind } from '../Shared';
+
+import { sortResources } from './SelectResource';
+import { ResourceSpec } from './types';
+
+test('sortResources sorts resources alphabetically with guided resources first', () => {
+  const sorted = sortResources(mockUnsorted);
+
+  expect(sorted).toMatchObject(mockSorted);
+});
+
+const mockUnsorted: ResourceSpec[] = [
+  {
+    name: 'jenkins',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+    unguidedLink: 'test.com',
+  },
+  {
+    name: 'grafana',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+    unguidedLink: 'test.com',
+  },
+  {
+    name: 'linux',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+    unguidedLink: 'test.com',
+  },
+  {
+    name: 'apple',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+    unguidedLink: 'test.com',
+  },
+  // Guided
+  {
+    name: 'zapier',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+  },
+  {
+    name: 'amazon',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+  },
+  {
+    name: 'costco',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+  },
+];
+
+const mockSorted: ResourceSpec[] = [
+  {
+    name: 'amazon',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+  },
+  {
+    name: 'costco',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+  },
+  {
+    name: 'zapier',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+  },
+  {
+    name: 'apple',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+    unguidedLink: 'test.com',
+  },
+  {
+    name: 'grafana',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+    unguidedLink: 'test.com',
+  },
+  {
+    name: 'jenkins',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+    unguidedLink: 'test.com',
+  },
+  {
+    name: 'linux',
+    kind: ResourceKind.Application,
+    icon: 'Apple',
+    event: null,
+    keywords: 'test',
+    hasAccess: true,
+    unguidedLink: 'test.com',
+  },
+];
diff --git a/web/packages/teleport/src/Discover/SelectResource/SelectResource.tsx b/web/packages/teleport/src/Discover/SelectResource/SelectResource.tsx
index 039a067c524d5..e4401b56005a2 100644
--- a/web/packages/teleport/src/Discover/SelectResource/SelectResource.tsx
+++ b/web/packages/teleport/src/Discover/SelectResource/SelectResource.tsx
@@ -45,7 +45,7 @@ interface SelectResourceProps {
   onSelect: (resource: ResourceSpec) => void;
 }
 
-export function SelectResource(props: SelectResourceProps) {
+export function SelectResource({ onSelect }: SelectResourceProps) {
   const ctx = useTeleport();
   const location = useLocation<{ entity: AddButtonResourceKind }>();
   const history = useHistory();
@@ -86,7 +86,8 @@ export function SelectResource(props: SelectResourceProps) {
       ...updatedResources.filter(r => r.hasAccess),
       ...updatedResources.filter(r => !r.hasAccess),
     ];
-    setDefaultResources(filteredResourcesByPerm);
+    const sortedResources = sortResources(filteredResourcesByPerm);
+    setDefaultResources(sortedResources);
 
     // A user can come to this screen by clicking on
     // a `add <specific-resource-type>` button.
@@ -97,11 +98,11 @@ export function SelectResource(props: SelectResourceProps) {
     if (resourceKindSpecifiedByUrlLoc) {
       const sortedResourcesByKind = sortResourcesByKind(
         resourceKindSpecifiedByUrlLoc,
-        filteredResourcesByPerm
+        sortedResources
       );
       onSearch(resourceKindSpecifiedByUrlLoc, sortedResourcesByKind);
     } else {
-      setResources(filteredResourcesByPerm);
+      setResources(sortedResources);
     }
 
     // Processing of the lists should only happen once on init.
@@ -140,8 +141,8 @@ export function SelectResource(props: SelectResourceProps) {
                 resourceCardProps = {
                   onClick: () => {
                     if (r.hasAccess) {
-                      props.onSelect(r);
                       setShowApp(true);
+                      onSelect(r);
                     }
                   },
                 };
@@ -154,7 +155,7 @@ export function SelectResource(props: SelectResourceProps) {
                 };
               } else {
                 resourceCardProps = {
-                  onClick: () => r.hasAccess && props.onSelect(r),
+                  onClick: () => r.hasAccess && onSelect(r),
                 };
               }
 
@@ -178,9 +179,7 @@ export function SelectResource(props: SelectResourceProps) {
                   )}
                   {!r.hasAccess && (
                     <ToolTipNoPermBadge
-                      children={
-                        <PermissionsErrorMessage resourceKind={r.kind} />
-                      }
+                      children={<PermissionsErrorMessage resource={r} />}
                     />
                   )}
                   <Flex px={2} alignItems="center">
@@ -274,6 +273,8 @@ function checkHasAccess(acl: Acl, resourceKind: ResourceKind) {
       return acl.kubeServers.read && acl.kubeServers.list;
     case ResourceKind.Server:
       return acl.nodes.list;
+    case ResourceKind.SamlApplication:
+      return acl.samlIdpServiceProvider.create;
     default:
       return false;
   }
@@ -319,6 +320,25 @@ function sortResourcesByKind(
   return sorted;
 }
 
+// Sort the resources alphabetically and with the Guided resources listed first.
+export function sortResources(resources: ResourceSpec[]) {
+  const sortedResources = [...resources];
+  sortedResources.sort((a, b) => {
+    if (!a.unguidedLink && a.hasAccess && !b.unguidedLink && b.hasAccess) {
+      return a.name.localeCompare(b.name);
+    }
+    if (!b.unguidedLink && b.hasAccess) {
+      return 1;
+    }
+    if (!a.unguidedLink && a.hasAccess) {
+      return -1;
+    }
+    return a.name.localeCompare(b.name);
+  });
+
+  return sortedResources;
+}
+
 function makeResourcesWithHasAccessField(acl: Acl): ResourceSpec[] {
   return RESOURCES.map(r => {
     const hasAccess = checkHasAccess(acl, r.kind);
diff --git a/web/packages/teleport/src/Discover/SelectResource/__snapshots__/SelectResource.story.test.tsx.snap b/web/packages/teleport/src/Discover/SelectResource/__snapshots__/SelectResource.story.test.tsx.snap
index 10e2ea83c331f..db7433a22d74a 100644
--- a/web/packages/teleport/src/Discover/SelectResource/__snapshots__/SelectResource.story.test.tsx.snap
+++ b/web/packages/teleport/src/Discover/SelectResource/__snapshots__/SelectResource.story.test.tsx.snap
@@ -26,7 +26,7 @@ exports[`render with URL loc state set to "server" 1`] = `
   width: 600px;
 }
 
-.c16 {
+.c15 {
   box-sizing: border-box;
 }
 
@@ -53,7 +53,7 @@ exports[`render with URL loc state set to "server" 1`] = `
   margin: 0px;
 }
 
-.c17 {
+.c16 {
   overflow: hidden;
   text-overflow: ellipsis;
   font-size: 12px;
@@ -61,7 +61,7 @@ exports[`render with URL loc state set to "server" 1`] = `
   color: rgba(255,255,255,0.72);
 }
 
-.c18 {
+.c17 {
   overflow: hidden;
   text-overflow: ellipsis;
   font-weight: 600;
@@ -101,7 +101,7 @@ exports[`render with URL loc state set to "server" 1`] = `
   margin-left: 8px;
 }
 
-.c15 {
+.c18 {
   display: block;
   outline: none;
   width: 23.9px;
@@ -282,27 +282,45 @@ exports[`render with URL loc state set to "server" 1`] = `
           class="c14"
           width="24px"
         >
-          <img
-            class="c15"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
-          class="c16"
+          class="c15"
         >
           <div
-            class="c17"
+            class="c16"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Server
           </div>
           <div
-            class="c18"
+            class="c17"
           >
-            Ubuntu 14.04+
+            Amazon Linux 2
           </div>
         </div>
       </div>
@@ -324,24 +342,24 @@ exports[`render with URL loc state set to "server" 1`] = `
           width="24px"
         >
           <img
-            class="c15"
+            class="c18"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c16"
+          class="c15"
         >
           <div
-            class="c17"
+            class="c16"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Server
           </div>
           <div
-            class="c18"
+            class="c17"
           >
             Debian 8+
           </div>
@@ -364,27 +382,25 @@ exports[`render with URL loc state set to "server" 1`] = `
           class="c14"
           width="24px"
         >
-          <img
-            class="c15"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
+          <span
+            class="c19 icon icon-apple "
+            font-size="22"
           />
         </div>
         <div
-          class="c16"
+          class="c15"
         >
           <div
-            class="c17"
+            class="c16"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Server
           </div>
           <div
-            class="c18"
+            class="c17"
           >
-            RHEL/CentOS 7+
+            macOS
           </div>
         </div>
       </div>
@@ -405,45 +421,27 @@ exports[`render with URL loc state set to "server" 1`] = `
           class="c14"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c18"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c16"
+          class="c15"
         >
           <div
-            class="c17"
+            class="c16"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Server
           </div>
           <div
-            class="c18"
+            class="c17"
           >
-            Amazon Linux 2
+            RHEL/CentOS 7+
           </div>
         </div>
       </div>
@@ -464,25 +462,27 @@ exports[`render with URL loc state set to "server" 1`] = `
           class="c14"
           width="24px"
         >
-          <span
-            class="c19 icon icon-apple "
-            font-size="22"
+          <img
+            class="c18"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
           />
         </div>
         <div
-          class="c16"
+          class="c15"
         >
           <div
-            class="c17"
+            class="c16"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Server
           </div>
           <div
-            class="c18"
+            class="c17"
           >
-            macOS
+            Ubuntu 14.04+
           </div>
         </div>
       </div>
@@ -503,17 +503,17 @@ exports[`render with URL loc state set to "server" 1`] = `
           width="24px"
         >
           <img
-            class="c15"
+            class="c18"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c16"
+          class="c15"
         >
           <div
-            class="c17"
+            class="c16"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -544,17 +544,17 @@ exports[`render with URL loc state set to "server" 1`] = `
           width="24px"
         >
           <img
-            class="c15"
+            class="c18"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c16"
+          class="c15"
         >
           <div
-            class="c17"
+            class="c16"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -585,17 +585,17 @@ exports[`render with URL loc state set to "server" 1`] = `
           width="24px"
         >
           <img
-            class="c15"
+            class="c18"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c16"
+          class="c15"
         >
           <div
-            class="c17"
+            class="c16"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -630,7 +630,7 @@ exports[`render with URL loc state set to "server" 1`] = `
 `;
 
 exports[`render with all access 1`] = `
-.c16 {
+.c15 {
   display: inline-block;
   transition: color 0.3s;
   color: #FFFFFF;
@@ -648,7 +648,7 @@ exports[`render with all access 1`] = `
   width: 600px;
 }
 
-.c11 {
+.c12 {
   box-sizing: border-box;
 }
 
@@ -669,12 +669,12 @@ exports[`render with all access 1`] = `
   margin-bottom: 32px;
 }
 
-.c12 {
+.c13 {
   overflow: hidden;
   text-overflow: ellipsis;
-  font-weight: 600;
+  font-size: 12px;
   margin: 0px;
-  color: #FFFFFF;
+  color: rgba(255,255,255,0.72);
 }
 
 .c14 {
@@ -684,12 +684,12 @@ exports[`render with all access 1`] = `
   margin: 0px;
 }
 
-.c15 {
+.c17 {
   overflow: hidden;
   text-overflow: ellipsis;
-  font-size: 12px;
+  font-weight: 600;
   margin: 0px;
-  color: rgba(255,255,255,0.72);
+  color: #FFFFFF;
 }
 
 .c18 {
@@ -700,7 +700,7 @@ exports[`render with all access 1`] = `
   margin-top: 40px;
 }
 
-.c17 {
+.c16 {
   color: #009EFF;
   font-weight: normal;
   background: none;
@@ -717,14 +717,14 @@ exports[`render with all access 1`] = `
   margin-left: 8px;
 }
 
-.c10 {
+.c11 {
   display: block;
   outline: none;
   width: 23.9px;
   height: 24px;
 }
 
-.c8 {
+.c9 {
   box-sizing: border-box;
   padding-left: 8px;
   padding-right: 8px;
@@ -732,7 +732,7 @@ exports[`render with all access 1`] = `
   align-items: center;
 }
 
-.c9 {
+.c10 {
   box-sizing: border-box;
   margin-right: 16px;
   width: 24px;
@@ -765,7 +765,7 @@ exports[`render with all access 1`] = `
   background: rgba(255,255,255,0.13);
 }
 
-.c13 {
+.c8 {
   position: absolute;
   background: #9F85FF;
   color: #000000;
@@ -839,230 +839,253 @@ exports[`render with all access 1`] = `
   >
     <div
       class="c7"
-      data-testid="0"
+      data-testid="2"
     >
       <div
         class="c8"
-      >
-        <div
-          class="c9"
-          width="24px"
-        >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
-        </div>
-        <div
-          class="c11"
-        >
-          
-          <div
-            class="c12"
-            color="text.main"
-          >
-            Application
-          </div>
-        </div>
-      </div>
-    </div>
-    <div
-      class="c7"
-      data-testid="3"
-    >
-      <div
-        class="c13"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
-          
+          <div
+            class="c13"
+            color="text.slightlyMuted"
+            font-size="12px"
+          >
+            Windows Desktop
+          </div>
           <div
             class="c14"
           >
-            Kubernetes
+            Active Directory
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="2"
+      data-testid="4"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Windows Desktop
+            Server
           </div>
           <div
             class="c14"
           >
-            Active Directory
+            Amazon Linux 2
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="4"
+      data-testid="0"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
-          <div
-            class="c15"
-            color="text.slightlyMuted"
-            font-size="12px"
-          >
-            Server
-          </div>
+          
           <div
             class="c14"
           >
-            Ubuntu 14.04+
+            Application
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="4"
+      data-testid="1"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
-        </div>
-        <div
-          class="c11"
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
+        </div>
+        <div
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Server
+            Amazon Web Services (AWS)
           </div>
           <div
             class="c14"
           >
-            Debian 8+
+            Aurora MySQL/MariaDB
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="4"
+      data-testid="1"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Server
+            Amazon Web Services (AWS)
           </div>
           <div
             class="c14"
           >
-            RHEL/CentOS 7+
+            Aurora PostgreSQL
           </div>
         </div>
       </div>
@@ -1072,47 +1095,29 @@ exports[`render with all access 1`] = `
       data-testid="4"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -1121,37 +1126,72 @@ exports[`render with all access 1`] = `
           <div
             class="c14"
           >
-            Amazon Linux 2
+            Debian 8+
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="4"
+      data-testid="3"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
+      <div
+        class="c9"
+      >
+        <div
+          class="c10"
+          width="24px"
+        >
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
+        </div>
+        <div
+          class="c12"
+        >
+          
+          <div
+            class="c14"
+          >
+            Kubernetes
+          </div>
+        </div>
+      </div>
+    </div>
+    <div
+      class="c7"
+      data-testid="4"
+    >
       <div
         class="c8"
+      >
+        Guided
+      </div>
+      <div
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <span
-            class="c16 icon icon-apple "
+            class="c15 icon icon-apple "
             font-size="22"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -1170,56 +1210,38 @@ exports[`render with all access 1`] = `
       data-testid="1"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Self-Hosted
           </div>
           <div
             class="c14"
           >
-            RDS PostgreSQL
+            MySQL/MariaDB
           </div>
         </div>
       </div>
@@ -1229,56 +1251,38 @@ exports[`render with all access 1`] = `
       data-testid="1"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Self-Hosted
           </div>
           <div
             class="c14"
           >
-            Aurora PostgreSQL
+            PostgreSQL
           </div>
         </div>
       </div>
@@ -1288,15 +1292,15 @@ exports[`render with all access 1`] = `
       data-testid="1"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <svg
@@ -1325,10 +1329,10 @@ exports[`render with all access 1`] = `
           </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -1347,15 +1351,15 @@ exports[`render with all access 1`] = `
       data-testid="1"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <svg
@@ -1384,10 +1388,10 @@ exports[`render with all access 1`] = `
           </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -1396,623 +1400,623 @@ exports[`render with all access 1`] = `
           <div
             class="c14"
           >
-            Aurora MySQL/MariaDB
+            RDS PostgreSQL
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="1"
+      data-testid="4"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Server
           </div>
           <div
             class="c14"
           >
-            PostgreSQL
+            RHEL/CentOS 7+
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="1"
+      data-testid="4"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Server
           </div>
           <div
             class="c14"
           >
-            MySQL/MariaDB
+            Ubuntu 14.04+
           </div>
         </div>
       </div>
     </div>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/aws-dynamodb"
+      href="https://goteleport.com/docs/database-access/guides/azure-redis"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Azure
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            DynamoDB
+            Cache for Redis
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/redis-aws"
+      href="https://goteleport.com/docs/database-access/guides/cassandra-self-hosted"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Self-Hosted
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            ElastiCache & MemoryDB
+            Cassandra & ScyllaDB
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/aws-cassandra-keyspaces"
+      href="https://goteleport.com/docs/database-access/guides/mysql-cloudsql"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Google Cloud Provider (GCP)
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            Keyspaces (Apache Cassandra)
+            Cloud SQL MySQL
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/postgres-redshift"
+      href="https://goteleport.com/docs/database-access/guides/postgres-cloudsql"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Google Cloud Provider (GCP)
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            Redshift PostgreSQL
+            Cloud SQL PostgreSQL
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/redshift-serverless"
+      href="https://goteleport.com/docs/database-access/guides/cockroachdb-self-hosted"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Self-Hosted
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            Redshift Serverless
+            CockroachDB
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/azure-redis"
+      href="https://goteleport.com/docs/database-access/guides/dynamic-registration"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Azure
+            Database
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            Cache for Redis
+            Dynamic Registration
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/azure-postgres-mysql"
+      href="https://goteleport.com/docs/database-access/guides/aws-dynamodb"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Azure
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            PostgreSQL
+            DynamoDB
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/azure-postgres-mysql"
+      href="https://goteleport.com/docs/database-access/guides/redis-aws"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Azure
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            MySQL
+            ElastiCache & MemoryDB
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/azure-sql-server-ad"
+      href="https://goteleport.com/docs/database-access/guides/elastic"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Azure
+            Self-Hosted
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            SQL Server (Preview)
+            Elasticsearch
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/sql-server-ad"
+      href="https://goteleport.com/docs/database-access/guides/ha"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Microsoft
+            Database
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            SQL Server (Preview)
+            High Availability
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/mysql-cloudsql"
+      href="https://goteleport.com/docs/database-access/guides/aws-cassandra-keyspaces"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
-        </div>
-        <div
-          class="c11"
-        >
-          <div
-            class="c15"
-            color="text.slightlyMuted"
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
+        </div>
+        <div
+          class="c12"
+        >
+          <div
+            class="c13"
+            color="text.slightlyMuted"
             font-size="12px"
           >
-            Google Cloud Provider (GCP)
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            Cloud SQL MySQL
+            Keyspaces (Apache Cassandra)
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/postgres-cloudsql"
+      href="https://goteleport.com/docs/database-access/guides/mongodb-self-hosted"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Google Cloud Provider (GCP)
+            Self-Hosted
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            Cloud SQL PostgreSQL
+            MongoDB
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
       href="https://goteleport.com/docs/database-access/guides/mongodb-atlas"
       rel="noreferrer"
@@ -2020,25 +2024,25 @@ exports[`render with all access 1`] = `
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
             MongoDB Atlas
@@ -2047,423 +2051,423 @@ exports[`render with all access 1`] = `
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/cassandra-self-hosted"
+      href="https://goteleport.com/docs/database-access/guides/azure-postgres-mysql"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Azure
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            Cassandra & ScyllaDB
+            MySQL
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/cockroachdb-self-hosted"
+      href="https://goteleport.com/docs/database-access/guides/azure-postgres-mysql"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Azure
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            CockroachDB
+            PostgreSQL
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/elastic"
+      href="https://goteleport.com/docs/database-access/guides/rds-proxy"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            Elasticsearch
+            RDS Proxy
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/mongodb-self-hosted"
+      href="https://goteleport.com/docs/database-access/guides/redis"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Self-Hosted
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            MongoDB
+            Redis
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/redis"
+      href="https://goteleport.com/docs/database-access/guides/redis-cluster"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Self-Hosted
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            Redis
+            Redis Cluster
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/redis-cluster"
+      href="https://goteleport.com/docs/database-access/guides/postgres-redshift"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            Redis Cluster
+            Redshift PostgreSQL
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/snowflake"
+      href="https://goteleport.com/docs/database-access/guides/redshift-serverless"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
-          
           <div
-            class="c12"
+            class="c13"
+            color="text.slightlyMuted"
+            font-size="12px"
+          >
+            Amazon Web Services (AWS)
+          </div>
+          <div
+            class="c17"
             color="text.main"
           >
-            Snowflake (Preview)
+            Redshift Serverless
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/rds-proxy"
+      href="https://goteleport.com/docs/database-access/guides/snowflake"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
+          
           <div
-            class="c15"
-            color="text.slightlyMuted"
-            font-size="12px"
-          >
-            Amazon Web Services (AWS)
-          </div>
-          <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            RDS Proxy
+            Snowflake (Preview)
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/ha"
+      href="https://goteleport.com/docs/database-access/guides/azure-sql-server-ad"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Database
+            Azure
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            High Availability
+            SQL Server (Preview)
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c16 c7"
       data-testid="1"
-      href="https://goteleport.com/docs/database-access/guides/dynamic-registration"
+      href="https://goteleport.com/docs/database-access/guides/sql-server-ad"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Database
+            Microsoft
           </div>
           <div
-            class="c12"
+            class="c17"
             color="text.main"
           >
-            Dynamic Registration
+            SQL Server (Preview)
           </div>
         </div>
       </div>
@@ -2488,7 +2492,7 @@ exports[`render with all access 1`] = `
 `;
 
 exports[`render with no access 1`] = `
-.c16 {
+.c17 {
   display: inline-block;
   transition: color 0.3s;
   color: #FFFFFF;
@@ -2530,9 +2534,9 @@ exports[`render with no access 1`] = `
 .c13 {
   overflow: hidden;
   text-overflow: ellipsis;
-  font-weight: 600;
+  font-size: 12px;
   margin: 0px;
-  color: #FFFFFF;
+  color: rgba(255,255,255,0.72);
 }
 
 .c14 {
@@ -2542,12 +2546,12 @@ exports[`render with no access 1`] = `
   margin: 0px;
 }
 
-.c15 {
+.c16 {
   overflow: hidden;
   text-overflow: ellipsis;
-  font-size: 12px;
+  font-weight: 600;
   margin: 0px;
-  color: rgba(255,255,255,0.72);
+  color: #FFFFFF;
 }
 
 .c18 {
@@ -2558,7 +2562,7 @@ exports[`render with no access 1`] = `
   margin-top: 40px;
 }
 
-.c17 {
+.c15 {
   color: #009EFF;
   font-weight: normal;
   background: none;
@@ -2600,7 +2604,6 @@ exports[`render with no access 1`] = `
 
 .c8 {
   box-sizing: border-box;
-  background-color: red;
   border-top-right-radius: 4px;
   border-bottom-left-radius: 4px;
   position: absolute;
@@ -2608,6 +2611,7 @@ exports[`render with no access 1`] = `
   top: 0px;
   right: 0px;
   font-size: 10px;
+  background-color: #FF6257;
 }
 
 .c6 {
@@ -2697,7 +2701,7 @@ exports[`render with no access 1`] = `
   >
     <div
       class="c7"
-      data-testid="0"
+      data-testid="2"
     >
       <div
         class="c8"
@@ -2722,19 +2726,24 @@ exports[`render with no access 1`] = `
         <div
           class="c12"
         >
-          
           <div
             class="c13"
-            color="text.main"
+            color="text.slightlyMuted"
+            font-size="12px"
           >
-            Application
+            Windows Desktop
+          </div>
+          <div
+            class="c14"
+          >
+            Active Directory
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="3"
+      data-testid="4"
     >
       <div
         class="c8"
@@ -2749,28 +2758,52 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <img
-            class="c11"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
           class="c12"
         >
-          
+          <div
+            class="c13"
+            color="text.slightlyMuted"
+            font-size="12px"
+          >
+            Server
+          </div>
           <div
             class="c14"
           >
-            Kubernetes
+            Amazon Linux 2
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="2"
+      data-testid="0"
     >
       <div
         class="c8"
@@ -2795,24 +2828,18 @@ exports[`render with no access 1`] = `
         <div
           class="c12"
         >
-          <div
-            class="c15"
-            color="text.slightlyMuted"
-            font-size="12px"
-          >
-            Windows Desktop
-          </div>
+          
           <div
             class="c14"
           >
-            Active Directory
+            Application
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="4"
+      data-testid="1"
     >
       <div
         class="c8"
@@ -2827,34 +2854,52 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <img
-            class="c11"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Server
+            Amazon Web Services (AWS)
           </div>
           <div
             class="c14"
           >
-            Ubuntu 14.04+
+            Aurora MySQL/MariaDB
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="4"
+      data-testid="1"
     >
       <div
         class="c8"
@@ -2869,34 +2914,55 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <img
-            class="c11"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Server
+            Amazon Web Services (AWS)
           </div>
           <div
             class="c14"
           >
-            Debian 8+
+            Aurora PostgreSQL
           </div>
         </div>
       </div>
     </div>
-    <div
-      class="c7"
-      data-testid="4"
+    <a
+      class="c15 c7"
+      data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
         class="c8"
@@ -2922,23 +2988,27 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Server
+            Azure
           </div>
           <div
-            class="c14"
+            class="c16"
+            color="text.main"
           >
-            RHEL/CentOS 7+
+            Cache for Redis
           </div>
         </div>
       </div>
-    </div>
-    <div
-      class="c7"
-      data-testid="4"
+    </a>
+    <a
+      class="c15 c7"
+      data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
         class="c8"
@@ -2953,52 +3023,38 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Server
+            Self-Hosted
           </div>
           <div
-            class="c14"
+            class="c16"
+            color="text.main"
           >
-            Amazon Linux 2
+            Cassandra & ScyllaDB
           </div>
         </div>
       </div>
-    </div>
-    <div
-      class="c7"
-      data-testid="4"
+    </a>
+    <a
+      class="c15 c7"
+      data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
         class="c8"
@@ -3013,32 +3069,38 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <span
-            class="c16 icon icon-apple "
-            font-size="22"
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
           />
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Server
+            Google Cloud Provider (GCP)
           </div>
           <div
-            class="c14"
+            class="c16"
+            color="text.main"
           >
-            macOS
+            Cloud SQL MySQL
           </div>
         </div>
       </div>
-    </div>
-    <div
-      class="c7"
+    </a>
+    <a
+      class="c15 c7"
       data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
         class="c8"
@@ -3053,52 +3115,38 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Google Cloud Provider (GCP)
           </div>
           <div
-            class="c14"
+            class="c16"
+            color="text.main"
           >
-            RDS PostgreSQL
+            Cloud SQL PostgreSQL
           </div>
         </div>
       </div>
-    </div>
-    <div
-      class="c7"
+    </a>
+    <a
+      class="c15 c7"
       data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
         class="c8"
@@ -3113,52 +3161,35 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Self-Hosted
           </div>
           <div
-            class="c14"
+            class="c16"
+            color="text.main"
           >
-            Aurora PostgreSQL
+            CockroachDB
           </div>
         </div>
       </div>
-    </div>
+    </a>
     <div
       class="c7"
-      data-testid="1"
+      data-testid="4"
     >
       <div
         class="c8"
@@ -3173,52 +3204,37 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Server
           </div>
           <div
             class="c14"
           >
-            RDS MySQL/MariaDB
+            Debian 8+
           </div>
         </div>
       </div>
     </div>
-    <div
-      class="c7"
+    <a
+      class="c15 c7"
       data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
         class="c8"
@@ -3233,52 +3249,38 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Database
           </div>
           <div
-            class="c14"
+            class="c16"
+            color="text.main"
           >
-            Aurora MySQL/MariaDB
+            Dynamic Registration
           </div>
         </div>
       </div>
-    </div>
-    <div
-      class="c7"
+    </a>
+    <a
+      class="c15 c7"
       data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
         class="c8"
@@ -3304,23 +3306,27 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c14"
+            class="c16"
+            color="text.main"
           >
-            PostgreSQL
+            DynamoDB
           </div>
         </div>
       </div>
-    </div>
-    <div
-      class="c7"
+    </a>
+    <a
+      class="c15 c7"
       data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
         class="c8"
@@ -3335,33 +3341,52 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <img
-            class="c11"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c14"
+            class="c16"
+            color="text.main"
           >
-            MySQL/MariaDB
+            ElastiCache & MemoryDB
           </div>
         </div>
       </div>
-    </div>
+    </a>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -3391,23 +3416,23 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Self-Hosted
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            DynamoDB
+            Elasticsearch
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -3426,52 +3451,34 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Database
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            ElastiCache & MemoryDB
+            High Availability
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -3519,14 +3526,14 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Amazon Web Services (AWS)
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
             Keyspaces (Apache Cassandra)
@@ -3534,12 +3541,9 @@ exports[`render with no access 1`] = `
         </div>
       </div>
     </a>
-    <a
-      class="c17 c7"
-      data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
+    <div
+      class="c7"
+      data-testid="3"
     >
       <div
         class="c8"
@@ -3564,28 +3568,18 @@ exports[`render with no access 1`] = `
         <div
           class="c12"
         >
+          
           <div
-            class="c15"
-            color="text.slightlyMuted"
-            font-size="12px"
-          >
-            Amazon Web Services (AWS)
-          </div>
-          <div
-            class="c13"
-            color="text.main"
+            class="c14"
           >
-            Redshift PostgreSQL
+            Kubernetes
           </div>
         </div>
       </div>
-    </a>
-    <a
-      class="c17 c7"
-      data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
+    </div>
+    <div
+      class="c7"
+      data-testid="4"
     >
       <div
         class="c8"
@@ -3600,34 +3594,31 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <img
-            class="c11"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
+          <span
+            class="c17 icon icon-apple "
+            font-size="22"
           />
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Server
           </div>
           <div
-            class="c13"
-            color="text.main"
+            class="c14"
           >
-            Redshift Serverless
+            macOS
           </div>
         </div>
       </div>
-    </a>
+    </div>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -3657,23 +3648,23 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Azure
+            Self-Hosted
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            Cache for Redis
+            MongoDB
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -3702,24 +3693,18 @@ exports[`render with no access 1`] = `
         <div
           class="c12"
         >
+          
           <div
-            class="c15"
-            color="text.slightlyMuted"
-            font-size="12px"
-          >
-            Azure
-          </div>
-          <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            PostgreSQL
+            MongoDB Atlas
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -3749,14 +3734,14 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Azure
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
             MySQL
@@ -3764,12 +3749,9 @@ exports[`render with no access 1`] = `
         </div>
       </div>
     </a>
-    <a
-      class="c17 c7"
+    <div
+      class="c7"
       data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
     >
       <div
         class="c8"
@@ -3795,27 +3777,23 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Azure
+            Self-Hosted
           </div>
           <div
-            class="c13"
-            color="text.main"
+            class="c14"
           >
-            SQL Server (Preview)
+            MySQL/MariaDB
           </div>
         </div>
       </div>
-    </a>
-    <a
-      class="c17 c7"
+    </div>
+    <div
+      class="c7"
       data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
     >
       <div
         class="c8"
@@ -3841,23 +3819,22 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Microsoft
+            Self-Hosted
           </div>
           <div
-            class="c13"
-            color="text.main"
+            class="c14"
           >
-            SQL Server (Preview)
+            PostgreSQL
           </div>
         </div>
       </div>
-    </a>
+    </div>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -3887,27 +3864,24 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Google Cloud Provider (GCP)
+            Azure
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            Cloud SQL MySQL
+            PostgreSQL
           </div>
         </div>
       </div>
     </a>
-    <a
-      class="c17 c7"
+    <div
+      class="c7"
       data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
     >
       <div
         class="c8"
@@ -3922,38 +3896,52 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <img
-            class="c11"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Google Cloud Provider (GCP)
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c13"
-            color="text.main"
+            class="c14"
           >
-            Cloud SQL PostgreSQL
+            RDS MySQL/MariaDB
           </div>
         </div>
       </div>
-    </a>
-    <a
-      class="c17 c7"
+    </div>
+    <div
+      class="c7"
       data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
     >
       <div
         class="c8"
@@ -3968,28 +3956,51 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <img
-            class="c11"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
           class="c12"
         >
-          
           <div
             class="c13"
-            color="text.main"
+            color="text.slightlyMuted"
+            font-size="12px"
           >
-            MongoDB Atlas
+            Amazon Web Services (AWS)
+          </div>
+          <div
+            class="c14"
+          >
+            RDS PostgreSQL
           </div>
         </div>
       </div>
-    </a>
+    </div>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -4008,34 +4019,52 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <img
-            class="c11"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            Cassandra & ScyllaDB
+            RDS Proxy
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -4065,23 +4094,23 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Self-Hosted
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            CockroachDB
+            Redis
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -4111,23 +4140,23 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Self-Hosted
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            Elasticsearch
+            Redis Cluster
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -4157,23 +4186,23 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            MongoDB
+            Redshift PostgreSQL
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -4203,27 +4232,24 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            Redis
+            Redshift Serverless
           </div>
         </div>
       </div>
     </a>
-    <a
-      class="c17 c7"
-      data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
+    <div
+      class="c7"
+      data-testid="4"
     >
       <div
         class="c8"
@@ -4249,23 +4275,22 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Server
           </div>
           <div
-            class="c13"
-            color="text.main"
+            class="c14"
           >
-            Redis Cluster
+            RHEL/CentOS 7+
           </div>
         </div>
       </div>
-    </a>
+    </div>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -4296,7 +4321,7 @@ exports[`render with no access 1`] = `
         >
           
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
             Snowflake (Preview)
@@ -4305,7 +4330,7 @@ exports[`render with no access 1`] = `
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -4324,52 +4349,34 @@ exports[`render with no access 1`] = `
           class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Azure
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            RDS Proxy
+            SQL Server (Preview)
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c17 c7"
+      class="c15 c7"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
@@ -4399,27 +4406,24 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Database
+            Microsoft
           </div>
           <div
-            class="c13"
+            class="c16"
             color="text.main"
           >
-            High Availability
+            SQL Server (Preview)
           </div>
         </div>
       </div>
     </a>
-    <a
-      class="c17 c7"
-      data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
+    <div
+      class="c7"
+      data-testid="4"
     >
       <div
         class="c8"
@@ -4445,21 +4449,20 @@ exports[`render with no access 1`] = `
           class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Database
+            Server
           </div>
           <div
-            class="c13"
-            color="text.main"
+            class="c14"
           >
-            Dynamic Registration
+            Ubuntu 14.04+
           </div>
         </div>
       </div>
-    </a>
+    </div>
   </div>
   <div
     class="c18"
@@ -4480,7 +4483,7 @@ exports[`render with no access 1`] = `
 `;
 
 exports[`render with partial access 1`] = `
-.c16 {
+.c15 {
   display: inline-block;
   transition: color 0.3s;
   color: #FFFFFF;
@@ -4498,7 +4501,7 @@ exports[`render with partial access 1`] = `
   width: 600px;
 }
 
-.c11 {
+.c12 {
   box-sizing: border-box;
 }
 
@@ -4519,12 +4522,12 @@ exports[`render with partial access 1`] = `
   margin-bottom: 32px;
 }
 
-.c12 {
+.c13 {
   overflow: hidden;
   text-overflow: ellipsis;
-  font-weight: 600;
+  font-size: 12px;
   margin: 0px;
-  color: #FFFFFF;
+  color: rgba(255,255,255,0.72);
 }
 
 .c14 {
@@ -4534,12 +4537,12 @@ exports[`render with partial access 1`] = `
   margin: 0px;
 }
 
-.c15 {
+.c19 {
   overflow: hidden;
   text-overflow: ellipsis;
-  font-size: 12px;
+  font-weight: 600;
   margin: 0px;
-  color: rgba(255,255,255,0.72);
+  color: #FFFFFF;
 }
 
 .c20 {
@@ -4550,7 +4553,7 @@ exports[`render with partial access 1`] = `
   margin-top: 40px;
 }
 
-.c19 {
+.c18 {
   color: #009EFF;
   font-weight: normal;
   background: none;
@@ -4567,14 +4570,14 @@ exports[`render with partial access 1`] = `
   margin-left: 8px;
 }
 
-.c10 {
+.c11 {
   display: block;
   outline: none;
   width: 23.9px;
   height: 24px;
 }
 
-.c8 {
+.c9 {
   box-sizing: border-box;
   padding-left: 8px;
   padding-right: 8px;
@@ -4582,7 +4585,7 @@ exports[`render with partial access 1`] = `
   align-items: center;
 }
 
-.c9 {
+.c10 {
   box-sizing: border-box;
   margin-right: 16px;
   width: 24px;
@@ -4590,9 +4593,8 @@ exports[`render with partial access 1`] = `
   justify-content: center;
 }
 
-.c18 {
+.c17 {
   box-sizing: border-box;
-  background-color: red;
   border-top-right-radius: 4px;
   border-bottom-left-radius: 4px;
   position: absolute;
@@ -4600,6 +4602,7 @@ exports[`render with partial access 1`] = `
   top: 0px;
   right: 0px;
   font-size: 10px;
+  background-color: #FF6257;
 }
 
 .c6 {
@@ -4627,7 +4630,7 @@ exports[`render with partial access 1`] = `
   background: rgba(255,255,255,0.13);
 }
 
-.c17 {
+.c16 {
   display: flex;
   position: relative;
   align-items: center;
@@ -4641,11 +4644,11 @@ exports[`render with partial access 1`] = `
   opacity: 0.45;
 }
 
-.c17:hover {
+.c16:hover {
   background: rgba(255,255,255,0.13);
 }
 
-.c13 {
+.c8 {
   position: absolute;
   background: #9F85FF;
   color: #000000;
@@ -4719,107 +4722,135 @@ exports[`render with partial access 1`] = `
   >
     <div
       class="c7"
-      data-testid="0"
+      data-testid="2"
     >
       <div
         class="c8"
+      >
+        Guided
+      </div>
+      <div
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
-          
           <div
-            class="c12"
-            color="text.main"
+            class="c13"
+            color="text.slightlyMuted"
+            font-size="12px"
           >
-            Application
+            Windows Desktop
+          </div>
+          <div
+            class="c14"
+          >
+            Active Directory
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="3"
+      data-testid="4"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
-          
+          <div
+            class="c13"
+            color="text.slightlyMuted"
+            font-size="12px"
+          >
+            Server
+          </div>
           <div
             class="c14"
           >
-            Kubernetes
+            Amazon Linux 2
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="2"
+      data-testid="0"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
-          <div
-            class="c15"
-            color="text.slightlyMuted"
-            font-size="12px"
-          >
-            Windows Desktop
-          </div>
+          
           <div
             class="c14"
           >
-            Active Directory
+            Application
           </div>
         </div>
       </div>
@@ -4829,29 +4860,29 @@ exports[`render with partial access 1`] = `
       data-testid="4"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -4860,48 +4891,42 @@ exports[`render with partial access 1`] = `
           <div
             class="c14"
           >
-            Ubuntu 14.04+
+            Debian 8+
           </div>
         </div>
       </div>
     </div>
     <div
       class="c7"
-      data-testid="4"
+      data-testid="3"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
-          <div
-            class="c15"
-            color="text.slightlyMuted"
-            font-size="12px"
-          >
-            Server
-          </div>
+          
           <div
             class="c14"
           >
-            Debian 8+
+            Kubernetes
           </div>
         </div>
       </div>
@@ -4911,29 +4936,27 @@ exports[`render with partial access 1`] = `
       data-testid="4"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
+          <span
+            class="c15 icon icon-apple "
+            font-size="22"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -4942,7 +4965,7 @@ exports[`render with partial access 1`] = `
           <div
             class="c14"
           >
-            RHEL/CentOS 7+
+            macOS
           </div>
         </div>
       </div>
@@ -4952,47 +4975,29 @@ exports[`render with partial access 1`] = `
       data-testid="4"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -5001,7 +5006,7 @@ exports[`render with partial access 1`] = `
           <div
             class="c14"
           >
-            Amazon Linux 2
+            RHEL/CentOS 7+
           </div>
         </div>
       </div>
@@ -5011,27 +5016,29 @@ exports[`render with partial access 1`] = `
       data-testid="4"
     >
       <div
-        class="c13"
+        class="c8"
       >
         Guided
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <span
-            class="c16 icon icon-apple "
-            font-size="22"
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -5040,26 +5047,26 @@ exports[`render with partial access 1`] = `
           <div
             class="c14"
           >
-            macOS
+            Ubuntu 14.04+
           </div>
         </div>
       </div>
     </div>
     <div
-      class="c17"
+      class="c16"
       data-testid="1"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <svg
@@ -5088,10 +5095,10 @@ exports[`render with partial access 1`] = `
           </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -5100,26 +5107,26 @@ exports[`render with partial access 1`] = `
           <div
             class="c14"
           >
-            RDS PostgreSQL
+            Aurora MySQL/MariaDB
           </div>
         </div>
       </div>
     </div>
     <div
-      class="c17"
+      class="c16"
       data-testid="1"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <svg
@@ -5148,10 +5155,10 @@ exports[`render with partial access 1`] = `
           </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
@@ -5165,338 +5172,346 @@ exports[`render with partial access 1`] = `
         </div>
       </div>
     </div>
-    <div
-      class="c17"
+    <a
+      class="c18 c16"
       data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Azure
           </div>
           <div
-            class="c14"
+            class="c19"
+            color="text.main"
           >
-            RDS MySQL/MariaDB
+            Cache for Redis
           </div>
         </div>
       </div>
-    </div>
-    <div
-      class="c17"
+    </a>
+    <a
+      class="c18 c16"
       data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
+        </div>
+        <div
+          class="c12"
+        >
+          <div
+            class="c13"
+            color="text.slightlyMuted"
+            font-size="12px"
           >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+            Self-Hosted
+          </div>
+          <div
+            class="c19"
+            color="text.main"
+          >
+            Cassandra & ScyllaDB
+          </div>
+        </div>
+      </div>
+    </a>
+    <a
+      class="c18 c16"
+      data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
+    >
+      <div
+        class="c17"
+        data-testid="tooltip"
+      >
+        Lacking Permissions
+      </div>
+      <div
+        class="c9"
+      >
+        <div
+          class="c10"
+          width="24px"
+        >
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Google Cloud Provider (GCP)
           </div>
           <div
-            class="c14"
+            class="c19"
+            color="text.main"
           >
-            Aurora MySQL/MariaDB
+            Cloud SQL MySQL
           </div>
         </div>
       </div>
-    </div>
-    <div
-      class="c17"
+    </a>
+    <a
+      class="c18 c16"
       data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Google Cloud Provider (GCP)
           </div>
           <div
-            class="c14"
+            class="c19"
+            color="text.main"
           >
-            PostgreSQL
+            Cloud SQL PostgreSQL
           </div>
         </div>
       </div>
-    </div>
-    <div
-      class="c17"
+    </a>
+    <a
+      class="c18 c16"
       data-testid="1"
+      rel="noreferrer"
+      style="text-decoration: none;"
+      target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Self-Hosted
           </div>
           <div
-            class="c14"
+            class="c19"
+            color="text.main"
           >
-            MySQL/MariaDB
+            CockroachDB
           </div>
         </div>
       </div>
-    </div>
+    </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Database
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            DynamoDB
+            Dynamic Registration
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            ElastiCache & MemoryDB
+            DynamoDB
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <svg
@@ -5525,946 +5540,938 @@ exports[`render with partial access 1`] = `
           </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            Keyspaces (Apache Cassandra)
+            ElastiCache & MemoryDB
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Self-Hosted
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            Redshift PostgreSQL
+            Elasticsearch
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Amazon Web Services (AWS)
+            Database
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            Redshift Serverless
+            High Availability
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
-        </div>
-        <div
-          class="c11"
-        >
-          <div
-            class="c15"
-            color="text.slightlyMuted"
-            font-size="12px"
-          >
-            Azure
-          </div>
-          <div
-            class="c12"
-            color="text.main"
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
           >
-            Cache for Redis
-          </div>
-        </div>
-      </div>
-    </a>
-    <a
-      class="c19 c17"
-      data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
-    >
-      <div
-        class="c18"
-        data-testid="tooltip"
-      >
-        Lacking Permissions
-      </div>
-      <div
-        class="c8"
-      >
-        <div
-          class="c9"
-          width="24px"
-        >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Azure
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            PostgreSQL
+            Keyspaces (Apache Cassandra)
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Azure
+            Self-Hosted
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            MySQL
+            MongoDB
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
+          
           <div
-            class="c15"
-            color="text.slightlyMuted"
-            font-size="12px"
-          >
-            Azure
-          </div>
-          <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            SQL Server (Preview)
+            MongoDB Atlas
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Microsoft
+            Azure
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            SQL Server (Preview)
+            MySQL
           </div>
         </div>
       </div>
     </a>
-    <a
-      class="c19 c17"
+    <div
+      class="c16"
       data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Google Cloud Provider (GCP)
+            Self-Hosted
           </div>
           <div
-            class="c12"
-            color="text.main"
+            class="c14"
           >
-            Cloud SQL MySQL
+            MySQL/MariaDB
           </div>
         </div>
       </div>
-    </a>
-    <a
-      class="c19 c17"
+    </div>
+    <div
+      class="c16"
       data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Google Cloud Provider (GCP)
+            Self-Hosted
           </div>
           <div
-            class="c12"
-            color="text.main"
+            class="c14"
           >
-            Cloud SQL PostgreSQL
+            PostgreSQL
           </div>
         </div>
       </div>
-    </a>
+    </div>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
-          
           <div
-            class="c12"
+            class="c13"
+            color="text.slightlyMuted"
+            font-size="12px"
+          >
+            Azure
+          </div>
+          <div
+            class="c19"
             color="text.main"
           >
-            MongoDB Atlas
+            PostgreSQL
           </div>
         </div>
       </div>
     </a>
-    <a
-      class="c19 c17"
+    <div
+      class="c16"
       data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
-            color="text.main"
+            class="c14"
           >
-            Cassandra & ScyllaDB
+            RDS MySQL/MariaDB
           </div>
         </div>
       </div>
-    </a>
-    <a
-      class="c19 c17"
+    </div>
+    <div
+      class="c16"
       data-testid="1"
-      rel="noreferrer"
-      style="text-decoration: none;"
-      target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
-            color="text.main"
+            class="c14"
           >
-            CockroachDB
+            RDS PostgreSQL
           </div>
         </div>
       </div>
-    </a>
+    </div>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <img
-            class="c10"
-            height="24px"
-            src="file_stub"
-            width="23.9px"
-          />
+          <svg
+            data-testid="svg"
+            fill="#FFFFFF"
+            height="24"
+            viewBox="0 0 304 182"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+            <path
+              clip-rule="evenodd"
+              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
+              fill="#f90"
+              fill-rule="evenodd"
+            />
+          </svg>
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            Elasticsearch
+            RDS Proxy
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Self-Hosted
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            MongoDB
+            Redis
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
             Self-Hosted
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            Redis
+            Redis Cluster
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Self-Hosted
+            Amazon Web Services (AWS)
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            Redis Cluster
+            Redshift PostgreSQL
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
-          
           <div
-            class="c12"
+            class="c13"
+            color="text.slightlyMuted"
+            font-size="12px"
+          >
+            Amazon Web Services (AWS)
+          </div>
+          <div
+            class="c19"
             color="text.main"
           >
-            Snowflake (Preview)
+            Redshift Serverless
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
-          <svg
-            data-testid="svg"
-            fill="#FFFFFF"
-            height="24"
-            viewBox="0 0 304 182"
-            width="24"
-            xmlns="http://www.w3.org/2000/svg"
-          >
-            <path
-              d="M86.4 66.4c0 3.7.4 6.7 1.1 8.9.8 2.2 1.8 4.6 3.2 7.2.5.8.7 1.6.7 2.3 0 1-.6 2-1.9 3L83.2 92c-.9.6-1.8.9-2.6.9-1 0-2-.5-3-1.4-1.4-1.5-2.6-3.1-3.6-4.7-1-1.7-2-3.6-3.1-5.9-7.8 9.2-17.6 13.8-29.4 13.8-8.4 0-15.1-2.4-20-7.2-4.9-4.8-7.4-11.2-7.4-19.2 0-8.5 3-15.4 9.1-20.6 6.1-5.2 14.2-7.8 24.5-7.8 3.4 0 6.9.3 10.6.8 3.7.5 7.5 1.3 11.5 2.2v-7.3c0-7.6-1.6-12.9-4.7-16-3.2-3.1-8.6-4.6-16.3-4.6-3.5 0-7.1.4-10.8 1.3-3.7.9-7.3 2-10.8 3.4-1.6.7-2.8 1.1-3.5 1.3-.7.2-1.2.3-1.6.3-1.4 0-2.1-1-2.1-3.1v-4.9c0-1.6.2-2.8.7-3.5.5-.7 1.4-1.4 2.8-2.1 3.5-1.8 7.7-3.3 12.6-4.5C41 1.9 46.2 1.3 51.7 1.3c11.9 0 20.6 2.7 26.2 8.1 5.5 5.4 8.3 13.6 8.3 24.6v32.4zM45.8 81.6c3.3 0 6.7-.6 10.3-1.8 3.6-1.2 6.8-3.4 9.5-6.4 1.6-1.9 2.8-4 3.4-6.4.6-2.4 1-5.3 1-8.7v-4.2c-2.9-.7-6-1.3-9.2-1.7-3.2-.4-6.3-.6-9.4-.6-6.7 0-11.6 1.3-14.9 4-3.3 2.7-4.9 6.5-4.9 11.5 0 4.7 1.2 8.2 3.7 10.6 2.4 2.5 5.9 3.7 10.5 3.7zm80.3 10.8c-1.8 0-3-.3-3.8-1-.8-.6-1.5-2-2.1-3.9L96.7 10.2c-.6-2-.9-3.3-.9-4 0-1.6.8-2.5 2.4-2.5h9.8c1.9 0 3.2.3 3.9 1 .8.6 1.4 2 2 3.9l16.8 66.2 15.6-66.2c.5-2 1.1-3.3 1.9-3.9.8-.6 2.2-1 4-1h8c1.9 0 3.2.3 4 1 .8.6 1.5 2 1.9 3.9l15.8 67 17.3-67c.6-2 1.3-3.3 2-3.9.8-.6 2.1-1 3.9-1h9.3c1.6 0 2.5.8 2.5 2.5 0 .5-.1 1-.2 1.6-.1.6-.3 1.4-.7 2.5l-24.1 77.3c-.6 2-1.3 3.3-2.1 3.9-.8.6-2.1 1-3.8 1h-8.6c-1.9 0-3.2-.3-4-1-.8-.7-1.5-2-1.9-4L156 23l-15.4 64.4c-.5 2-1.1 3.3-1.9 4-.8.7-2.2 1-4 1h-8.6zm128.5 2.7c-5.2 0-10.4-.6-15.4-1.8-5-1.2-8.9-2.5-11.5-4-1.6-.9-2.7-1.9-3.1-2.8-.4-.9-.6-1.9-.6-2.8v-5.1c0-2.1.8-3.1 2.3-3.1.6 0 1.2.1 1.8.3.6.2 1.5.6 2.5 1 3.4 1.5 7.1 2.7 11 3.5 4 .8 7.9 1.2 11.9 1.2 6.3 0 11.2-1.1 14.6-3.3 3.4-2.2 5.2-5.4 5.2-9.5 0-2.8-.9-5.1-2.7-7-1.8-1.9-5.2-3.6-10.1-5.2L246 52c-7.3-2.3-12.7-5.7-16-10.2-3.3-4.4-5-9.3-5-14.5 0-4.2.9-7.9 2.7-11.1 1.8-3.2 4.2-6 7.2-8.2 3-2.3 6.4-4 10.4-5.2 4-1.2 8.2-1.7 12.6-1.7 2.2 0 4.5.1 6.7.4 2.3.3 4.4.7 6.5 1.1 2 .5 3.9 1 5.7 1.6 1.8.6 3.2 1.2 4.2 1.8 1.4.8 2.4 1.6 3 2.5.6.8.9 1.9.9 3.3v4.7c0 2.1-.8 3.2-2.3 3.2-.8 0-2.1-.4-3.8-1.2-5.7-2.6-12.1-3.9-19.2-3.9-5.7 0-10.2.9-13.3 2.8-3.1 1.9-4.7 4.8-4.7 8.9 0 2.8 1 5.2 3 7.1 2 1.9 5.7 3.8 11 5.5l14.2 4.5c7.2 2.3 12.4 5.5 15.5 9.6 3.1 4.1 4.6 8.8 4.6 14 0 4.3-.9 8.2-2.6 11.6-1.8 3.4-4.2 6.4-7.3 8.8-3.1 2.5-6.8 4.3-11.1 5.6-4.5 1.4-9.2 2.1-14.3 2.1z"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M273.5 143.7c-32.9 24.3-80.7 37.2-121.8 37.2-57.6 0-109.5-21.3-148.7-56.7-3.1-2.8-.3-6.6 3.4-4.4 42.4 24.6 94.7 39.5 148.8 39.5 36.5 0 76.6-7.6 113.5-23.2 5.5-2.5 10.2 3.6 4.8 7.6z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-            <path
-              clip-rule="evenodd"
-              d="M287.2 128.1c-4.2-5.4-27.8-2.6-38.5-1.3-3.2.4-3.7-2.4-.8-4.5 18.8-13.2 49.7-9.4 53.3-5 3.6 4.5-1 35.4-18.6 50.2-2.7 2.3-5.3 1.1-4.1-1.9 4-9.9 12.9-32.2 8.7-37.5z"
-              fill="#f90"
-              fill-rule="evenodd"
-            />
-          </svg>
+          <img
+            class="c11"
+            height="24px"
+            src="file_stub"
+            width="23.9px"
+          />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
+          
           <div
-            class="c15"
-            color="text.slightlyMuted"
-            font-size="12px"
-          >
-            Amazon Web Services (AWS)
-          </div>
-          <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            RDS Proxy
+            Snowflake (Preview)
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Database
+            Azure
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            High Availability
+            SQL Server (Preview)
           </div>
         </div>
       </div>
     </a>
     <a
-      class="c19 c17"
+      class="c18 c16"
       data-testid="1"
       rel="noreferrer"
       style="text-decoration: none;"
       target="_blank"
     >
       <div
-        class="c18"
+        class="c17"
         data-testid="tooltip"
       >
         Lacking Permissions
       </div>
       <div
-        class="c8"
+        class="c9"
       >
         <div
-          class="c9"
+          class="c10"
           width="24px"
         >
           <img
-            class="c10"
+            class="c11"
             height="24px"
             src="file_stub"
             width="23.9px"
           />
         </div>
         <div
-          class="c11"
+          class="c12"
         >
           <div
-            class="c15"
+            class="c13"
             color="text.slightlyMuted"
             font-size="12px"
           >
-            Database
+            Microsoft
           </div>
           <div
-            class="c12"
+            class="c19"
             color="text.main"
           >
-            Dynamic Registration
+            SQL Server (Preview)
           </div>
         </div>
       </div>
diff --git a/web/packages/teleport/src/Discover/SelectResource/assets/grafana.png b/web/packages/teleport/src/Discover/SelectResource/assets/grafana.png
new file mode 100644
index 0000000000000..f04e6cc6f020c
Binary files /dev/null and b/web/packages/teleport/src/Discover/SelectResource/assets/grafana.png differ
diff --git a/web/packages/teleport/src/Discover/SelectResource/icons.tsx b/web/packages/teleport/src/Discover/SelectResource/icons.tsx
index c2f89b821fd52..ed2922621427a 100644
--- a/web/packages/teleport/src/Discover/SelectResource/icons.tsx
+++ b/web/packages/teleport/src/Discover/SelectResource/icons.tsx
@@ -39,6 +39,7 @@ import snowflake from './assets/snowflake.png';
 import k8s from './assets/kubernetes.png';
 import server from './assets/server.png';
 import application from './assets/application.png';
+import grafana from './assets/grafana.png';
 
 export const icons = {
   Apple: <Icons.Apple fontSize={22} />,
@@ -51,6 +52,7 @@ export const icons = {
   Ec2: <Image src={ec2} width="23.9px" height="24px" />,
   Eks: <Image src={eks} width="23.9px" height="24px" />,
   Gcp: <Image src={gcp} width="23.9px" height="24px" />,
+  Grafana: <Image src={grafana} width="23.9px" height="24px" />,
   Jenkins: <Image src={jenkins} width="23.9px" height="24px" />,
   Linux: <Image src={linux} width="23.9px" height="24px" />,
   Kube: <Image src={k8s} width="23.9px" height="24px" />,
diff --git a/web/packages/teleport/src/Discover/SelectResource/resources.tsx b/web/packages/teleport/src/Discover/SelectResource/resources.tsx
index 46ef27c632277..0e2ca835ae5f7 100644
--- a/web/packages/teleport/src/Discover/SelectResource/resources.tsx
+++ b/web/packages/teleport/src/Discover/SelectResource/resources.tsx
@@ -15,6 +15,7 @@
  */
 
 import { DiscoverEventResource } from 'teleport/services/userEvent';
+import cfg from 'teleport/config';
 
 import { ResourceKind } from '../Shared/ResourceKind';
 
@@ -24,6 +25,7 @@ import {
   DATABASES_UNGUIDED_DOC,
 } from './databases';
 import { ResourceSpec, DatabaseLocation, DatabaseEngine } from './types';
+import { SAML_APPLICATIONS } from './resourcesE';
 
 const baseServerKeywords = 'server node';
 export const SERVERS: ResourceSpec[] = [
@@ -70,8 +72,7 @@ export const APPLICATIONS: ResourceSpec[] = [
     kind: ResourceKind.Application,
     keywords: 'application',
     icon: 'Application',
-    unguidedLink:
-      'https://goteleport.com/docs/application-access/getting-started/',
+    isDialog: true,
     event: DiscoverEventResource.ApplicationHttp,
   },
 ];
@@ -103,7 +104,7 @@ export const KUBERNETES: ResourceSpec[] = [
   },
 ];
 
-export const RESOURCES: ResourceSpec[] = [
+const BASE_RESOURCES: ResourceSpec[] = [
   ...APPLICATIONS,
   ...KUBERNETES,
   ...WINDOWS_DESKTOPS,
@@ -113,6 +114,10 @@ export const RESOURCES: ResourceSpec[] = [
   ...DATABASES_UNGUIDED_DOC,
 ];
 
+export const RESOURCES = !cfg.isEnterprise
+  ? BASE_RESOURCES
+  : [...BASE_RESOURCES, ...SAML_APPLICATIONS];
+
 export function getResourcePretitle(r: ResourceSpec) {
   if (!r) {
     return {};
diff --git a/web/packages/teleport/src/Discover/SelectResource/resourcesE.tsx b/web/packages/teleport/src/Discover/SelectResource/resourcesE.tsx
new file mode 100644
index 0000000000000..3a264ee0803b1
--- /dev/null
+++ b/web/packages/teleport/src/Discover/SelectResource/resourcesE.tsx
@@ -0,0 +1,38 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { DiscoverEventResource } from 'teleport/services/userEvent';
+
+import { ResourceKind } from '../Shared';
+
+import { ResourceSpec } from './types';
+
+export const SAML_APPLICATIONS: ResourceSpec[] = [
+  {
+    name: 'SAML Application',
+    kind: ResourceKind.SamlApplication,
+    keywords: 'saml sso application idp',
+    icon: 'Application',
+    event: DiscoverEventResource.SamlApplication,
+  },
+  {
+    name: 'SAML Application (Grafana)',
+    kind: ResourceKind.SamlApplication,
+    keywords: 'saml sso application idp grafana',
+    icon: 'Grafana',
+    event: DiscoverEventResource.SamlApplication,
+  },
+];
diff --git a/web/packages/teleport/src/Discover/SelectResource/types.ts b/web/packages/teleport/src/Discover/SelectResource/types.ts
index 286f7de3921b6..605f183c1f69e 100644
--- a/web/packages/teleport/src/Discover/SelectResource/types.ts
+++ b/web/packages/teleport/src/Discover/SelectResource/types.ts
@@ -17,6 +17,7 @@
 import { ResourceKind } from '../Shared/ResourceKind';
 
 import type { DiscoverEventResource } from 'teleport/services/userEvent';
+
 import type { ResourceIconName } from './icons';
 
 export enum DatabaseLocation {
@@ -64,6 +65,9 @@ export interface ResourceSpec {
   // It is used as a flag, that when defined, means that
   // this resource is not "guided" (has no UI interactive flow).
   unguidedLink?: string;
+  // isDialog is whether or not the flow for this resource is a popover dialog as opposed to a Discover flow.
+  // This is the case for the 'Application' resource.
+  isDialog?: boolean;
   // event is the expected backend enum event name that describes
   // the type of this resource (eg. server v. kubernetes),
   // used for usage reporting.
diff --git a/web/packages/teleport/src/Discover/Shared/ActionButtons.tsx b/web/packages/teleport/src/Discover/Shared/ActionButtons.tsx
index 13df44be5fbd9..a2c581dc09072 100644
--- a/web/packages/teleport/src/Discover/Shared/ActionButtons.tsx
+++ b/web/packages/teleport/src/Discover/Shared/ActionButtons.tsx
@@ -15,7 +15,7 @@
  */
 
 import React from 'react';
-import { Box, ButtonPrimary, ButtonSecondary } from 'design';
+import { Box, ButtonPrimary, ButtonSecondary, ButtonText } from 'design';
 
 export const ActionButtons = ({
   onProceed = null,
@@ -73,3 +73,24 @@ export const ActionButtons = ({
     </Box>
   );
 };
+
+export const AlternateInstructionButton: React.FC<{
+  onClick(): void;
+  disabled?: boolean;
+}> = ({ onClick, children, disabled = false }) => {
+  return (
+    <ButtonText
+      disabled={disabled}
+      onClick={onClick}
+      css={`
+        padding-left: 1px;
+        color: ${p => p.theme.colors.buttons.link.default};
+        text-decoration: underline;
+        font-weight: normal;
+        font-size: inherit;
+      `}
+    >
+      {children || 'Use these instructions instead.'}
+    </ButtonText>
+  );
+};
diff --git a/web/packages/teleport/src/Discover/Shared/LabelsCreater/LabelsCreater.tsx b/web/packages/teleport/src/Discover/Shared/LabelsCreater/LabelsCreater.tsx
index e3bc2f2145e00..b615dc0906999 100644
--- a/web/packages/teleport/src/Discover/Shared/LabelsCreater/LabelsCreater.tsx
+++ b/web/packages/teleport/src/Discover/Shared/LabelsCreater/LabelsCreater.tsx
@@ -29,12 +29,14 @@ export function LabelsCreater({
   disableBtns = false,
   isLabelOptional = false,
   noDuplicateKey = false,
+  autoFocus = false,
 }: {
   labels: DiscoverLabel[];
   setLabels(l: DiscoverLabel[]): void;
   disableBtns?: boolean;
   isLabelOptional?: boolean;
   noDuplicateKey?: boolean;
+  autoFocus?: boolean;
 }) {
   const validator = useValidation() as Validator;
 
@@ -124,7 +126,7 @@ export function LabelsCreater({
                 <FieldInput
                   Input
                   rule={requiredUniqueKey}
-                  autoFocus
+                  autoFocus={autoFocus}
                   value={label.name}
                   placeholder="label key"
                   width="170px"
diff --git a/web/packages/teleport/src/Discover/Shared/ResourceKind.ts b/web/packages/teleport/src/Discover/Shared/ResourceKind.ts
index 0852bb899a7ae..01fd681c2e955 100644
--- a/web/packages/teleport/src/Discover/Shared/ResourceKind.ts
+++ b/web/packages/teleport/src/Discover/Shared/ResourceKind.ts
@@ -22,6 +22,7 @@ export enum ResourceKind {
   Desktop,
   Kubernetes,
   Server,
+  SamlApplication,
 }
 
 export function resourceKindToJoinRole(kind: ResourceKind): JoinRole {
diff --git a/web/packages/teleport/src/Discover/Shared/SetupAccess/AccessInfo.tsx b/web/packages/teleport/src/Discover/Shared/SetupAccess/AccessInfo.tsx
index f89c323e83964..bc12b3e961e13 100644
--- a/web/packages/teleport/src/Discover/Shared/SetupAccess/AccessInfo.tsx
+++ b/web/packages/teleport/src/Discover/Shared/SetupAccess/AccessInfo.tsx
@@ -143,7 +143,13 @@ const Info = ({ children }: { children: React.ReactNode }) => (
 );
 
 const ReadOnlyYamlEditor = ({ content }: { content: string }) => {
-  return <TextEditor readOnly={true} data={[{ content, type: 'yaml' }]} />;
+  return (
+    <TextEditor
+      readOnly={true}
+      data={[{ content, type: 'yaml' }]}
+      bg="levels.deep"
+    />
+  );
 };
 
 type AccessKind =
diff --git a/web/packages/teleport/src/Discover/Shared/SetupAccess/SetupAccessWrapper.story.tsx b/web/packages/teleport/src/Discover/Shared/SetupAccess/SetupAccessWrapper.story.tsx
index d4a9cc858981e..e3fc66c25cc8c 100644
--- a/web/packages/teleport/src/Discover/Shared/SetupAccess/SetupAccessWrapper.story.tsx
+++ b/web/packages/teleport/src/Discover/Shared/SetupAccess/SetupAccessWrapper.story.tsx
@@ -22,7 +22,7 @@ import { SetupAccessWrapper } from './SetupAccessWrapper';
 import type { Props } from './SetupAccessWrapper';
 
 export default {
-  title: 'Teleport/Discover/Shared/SetupAccessContainer',
+  title: 'Teleport/Discover/Shared/SetupAccessWrapper',
 };
 
 export const HasAccessAndTraits = () => (
diff --git a/web/packages/teleport/src/Discover/Shared/SetupAccess/useUserTraits.ts b/web/packages/teleport/src/Discover/Shared/SetupAccess/useUserTraits.ts
index 020b714bddbaf..145142df3265a 100644
--- a/web/packages/teleport/src/Discover/Shared/SetupAccess/useUserTraits.ts
+++ b/web/packages/teleport/src/Discover/Shared/SetupAccess/useUserTraits.ts
@@ -278,7 +278,10 @@ export function useUserTraits(props: AgentStepProps) {
   // For server and kubernetes, the prev screen is the download
   // script which wouldn't make sense to go back to.
   let onPrev;
-  if (props.resourceSpec.kind === ResourceKind.Database) {
+  if (
+    props.resourceSpec.kind === ResourceKind.Database &&
+    (props.agentMeta as DbMeta).serviceDeployedMethod !== 'auto'
+  ) {
     onPrev = props.prevStep;
   }
 
diff --git a/web/packages/teleport/src/Discover/Shared/StepBox.tsx b/web/packages/teleport/src/Discover/Shared/StepBox.tsx
new file mode 100644
index 0000000000000..dedc195d3c3ec
--- /dev/null
+++ b/web/packages/teleport/src/Discover/Shared/StepBox.tsx
@@ -0,0 +1,26 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import styled from 'styled-components';
+import { Box } from 'design';
+
+export const StepBox = styled(Box)`
+  max-width: 1000px;
+  background-color: ${props => props.theme.colors.spotBackground[0]};
+  padding: ${props => `${props.theme.space[3]}px`};
+  border-radius: ${props => `${props.theme.space[2]}px`};
+  border: 2px solid #2f3659;
+`;
diff --git a/web/packages/teleport/src/Discover/Shared/index.ts b/web/packages/teleport/src/Discover/Shared/index.ts
index 62be24b5e622f..7db05d57e0e1a 100644
--- a/web/packages/teleport/src/Discover/Shared/index.ts
+++ b/web/packages/teleport/src/Discover/Shared/index.ts
@@ -14,13 +14,12 @@
  * limitations under the License.
  */
 
-export { ActionButtons } from './ActionButtons';
+export { ActionButtons, AlternateInstructionButton } from './ActionButtons';
 export { ButtonBlueText } from './ButtonBlueText';
 export { Header, HeaderSubtitle, HeaderWithBackBtn } from './Header';
 export { Finished } from './Finished';
 export { Mark } from './Mark';
 export { PermissionsErrorMessage } from '../SelectResource/PermissionsErrorMessage';
-export { ReadOnlyYamlEditor } from './YAML';
 export { ResourceKind } from './ResourceKind';
 export { Step, StepContainer } from './Step';
 export { TextBox, TextIcon } from './Text';
@@ -30,5 +29,6 @@ export {
   useConnectionDiagnostic,
 } from './ConnectionDiagnostic';
 export { useShowHint } from './useShowHint';
+export { StepBox } from './StepBox';
 
 export type { DiscoverLabel } from './LabelsCreater';
diff --git a/web/packages/teleport/src/Discover/types.ts b/web/packages/teleport/src/Discover/types.ts
index f61d6b8336eb0..6205973ab1924 100644
--- a/web/packages/teleport/src/Discover/types.ts
+++ b/web/packages/teleport/src/Discover/types.ts
@@ -15,6 +15,7 @@
  */
 
 import { State } from './useDiscover';
+import { ResourceViewConfig } from './flow';
 
 export type AgentStepProps = {
   // agentMeta describes fields specific to an agent kind.
@@ -30,3 +31,6 @@ export type AgentStepProps = {
 };
 
 export type AgentStepComponent = (props: AgentStepProps) => JSX.Element;
+
+/** EViewConfigs are enterprise-only view configs to add to Discover that arent defined in `Discover/resourceViewConfigs.ts`. */
+export type EViewConfigs = ResourceViewConfig[];
diff --git a/web/packages/teleport/src/Discover/useDiscover.test.tsx b/web/packages/teleport/src/Discover/useDiscover.test.tsx
index 9252003de6706..98d7d94917295 100644
--- a/web/packages/teleport/src/Discover/useDiscover.test.tsx
+++ b/web/packages/teleport/src/Discover/useDiscover.test.tsx
@@ -24,6 +24,8 @@ import {
   DiscoverEvent,
   DiscoverEventResource,
   DiscoverEventStatus,
+  DiscoverServiceDeployMethod,
+  DiscoverServiceDeployType,
   userEventService,
 } from 'teleport/services/userEvent';
 import { FeaturesContextProvider } from 'teleport/FeaturesContext';
@@ -145,6 +147,10 @@ describe('emitting events', () => {
           id,
           resource: DiscoverEventResource.Server,
           stepStatus: DiscoverEventStatus.Success,
+          serviceDeploy: {
+            method: DiscoverServiceDeployMethod.Unspecified,
+            type: DiscoverServiceDeployType.Unspecified,
+          },
         },
       })
     );
@@ -202,6 +208,10 @@ describe('emitting events', () => {
           id,
           resource: DiscoverEventResource.Server,
           stepStatus: DiscoverEventStatus.Success,
+          serviceDeploy: {
+            method: DiscoverServiceDeployMethod.Unspecified,
+            type: DiscoverServiceDeployType.Unspecified,
+          },
         },
       })
     );
@@ -255,6 +265,10 @@ describe('emitting events', () => {
           id,
           resource: DiscoverEventResource.Server,
           stepStatus: DiscoverEventStatus.Skipped,
+          serviceDeploy: {
+            method: DiscoverServiceDeployMethod.Unspecified,
+            type: DiscoverServiceDeployType.Unspecified,
+          },
         },
       })
     );
@@ -285,6 +299,10 @@ describe('emitting events', () => {
           stepStatusError: 'some error message',
           selectedResourcesCount: 0,
           autoDiscoverResourcesCount: 0,
+          serviceDeploy: {
+            method: DiscoverServiceDeployMethod.Unspecified,
+            type: DiscoverServiceDeployType.Unspecified,
+          },
         },
       })
     );
diff --git a/web/packages/teleport/src/Discover/useDiscover.tsx b/web/packages/teleport/src/Discover/useDiscover.tsx
index 754b01c10d7d8..26b15088e6c25 100644
--- a/web/packages/teleport/src/Discover/useDiscover.tsx
+++ b/web/packages/teleport/src/Discover/useDiscover.tsx
@@ -23,6 +23,9 @@ import {
   DiscoverEvent,
   DiscoverEventResource,
   userEventService,
+  DiscoverServiceDeployMethod,
+  DiscoverServiceDeploy,
+  DiscoverServiceDeployType,
 } from 'teleport/services/userEvent';
 import cfg from 'teleport/config';
 
@@ -33,12 +36,15 @@ import {
   View,
 } from './flow';
 import { viewConfigs } from './resourceViewConfigs';
+import { EViewConfigs } from './types';
+import { ServiceDeployMethod } from './Database/common';
 
 import type { Node } from 'teleport/services/nodes';
 import type { Kube } from 'teleport/services/kube';
 import type { Database } from 'teleport/services/databases';
 import type { AgentLabel } from 'teleport/services/agents';
 import type { ResourceSpec } from './SelectResource';
+import type { AwsRdsDatabase } from 'teleport/services/integrations';
 
 export interface DiscoverContextState<T = any> {
   agentMeta: AgentMeta;
@@ -46,6 +52,7 @@ export interface DiscoverContextState<T = any> {
   nextStep: (count?: number) => void;
   prevStep: () => void;
   onSelectResource: (resource: ResourceSpec) => void;
+  exitFlow: () => void;
   resourceSpec: ResourceSpec;
   viewConfig: ResourceViewConfig<T>;
   indexedViews: View[];
@@ -68,11 +75,14 @@ type CustomEventInput = {
   eventResourceName?: DiscoverEventResource;
   autoDiscoverResourcesCount?: number;
   selectedResourcesCount?: number;
+  serviceDeploy?: DiscoverServiceDeploy;
 };
 
 type DiscoverProviderProps = {
   // mockCtx used for testing purposes.
   mockCtx?: DiscoverContextState;
+  // Extra view configs that are passed in. This is used to add view configs from Enterprise.
+  eViewConfigs?: EViewConfigs;
 };
 
 // DiscoverUrlLocationState define fields to preserve state between
@@ -94,9 +104,11 @@ export type DiscoverUrlLocationState = {
 
 const discoverContext = React.createContext<DiscoverContextState>(null);
 
-export function DiscoverProvider(
-  props: React.PropsWithChildren<DiscoverProviderProps>
-) {
+export function DiscoverProvider({
+  mockCtx,
+  children,
+  eViewConfigs = [],
+}: React.PropsWithChildren<DiscoverProviderProps>) {
   const history = useHistory();
   const location = useLocation<DiscoverUrlLocationState>();
 
@@ -114,13 +126,28 @@ export function DiscoverProvider(
     (status: DiscoverEventStepStatus, custom?: CustomEventInput) => {
       const { id, currEventName } = eventState;
 
+      const event = custom?.eventName || currEventName;
+
+      let serviceDeploy: DiscoverServiceDeploy;
+      if (event === DiscoverEvent.DeployService) {
+        if (custom?.serviceDeploy) {
+          serviceDeploy = custom.serviceDeploy;
+        } else {
+          serviceDeploy = {
+            method: DiscoverServiceDeployMethod.Unspecified,
+            type: DiscoverServiceDeployType.Unspecified,
+          };
+        }
+      }
+
       userEventService.captureDiscoverEvent({
-        event: custom?.eventName || currEventName,
+        event,
         eventData: {
           id: id || custom.id,
           resource: custom?.eventResourceName || resourceSpec?.event,
           autoDiscoverResourcesCount: custom?.autoDiscoverResourcesCount,
           selectedResourcesCount: custom?.selectedResourcesCount,
+          serviceDeploy,
           ...status,
         },
       });
@@ -225,7 +252,7 @@ export function DiscoverProvider(
     // We still want to emit an event if user clicked on an
     // unguided link to gather data on which unguided resource
     // is most popular.
-    if (resource.unguidedLink) {
+    if (resource.unguidedLink || resource.isDialog) {
       emitEvent(
         { stepStatus: DiscoverEventStatus.Success },
         {
@@ -258,7 +285,9 @@ export function DiscoverProvider(
     targetViewIndex = 0
   ) {
     // Process each view and assign each with an index number.
-    const currCfg = viewConfigs.find(r => r.kind === resource.kind);
+    const currCfg = [...viewConfigs, ...eViewConfigs].find(
+      r => r.kind === resource.kind
+    );
     let indexedViews = [];
     if (typeof currCfg.views === 'function') {
       indexedViews = addIndexToViews(currCfg.views(resource));
@@ -351,10 +380,7 @@ export function DiscoverProvider(
     if (currentStep === 0) {
       // Emit abort since we are starting over with resource selection.
       emitEvent({ stepStatus: DiscoverEventStatus.Aborted });
-      initEventState();
-      setViewConfig(null);
-      setResourceSpec(null);
-      setIndexedViews([]);
+      exitFlow();
       return;
     }
 
@@ -365,6 +391,13 @@ export function DiscoverProvider(
     }
   }
 
+  function exitFlow() {
+    initEventState();
+    setViewConfig(null);
+    setResourceSpec(null);
+    setIndexedViews([]);
+  }
+
   function updateAgentMeta(meta: AgentMeta) {
     setAgentMeta(meta);
   }
@@ -375,7 +408,14 @@ export function DiscoverProvider(
         stepStatus: DiscoverEventStatus.Error,
         stepStatusError: errorStr,
       },
-      { autoDiscoverResourcesCount: 0, selectedResourcesCount: 0 }
+      {
+        autoDiscoverResourcesCount: 0,
+        selectedResourcesCount: 0,
+        serviceDeploy: {
+          method: DiscoverServiceDeployMethod.Unspecified,
+          type: DiscoverServiceDeployType.Unspecified,
+        },
+      }
     );
   }
 
@@ -385,6 +425,7 @@ export function DiscoverProvider(
     nextStep,
     prevStep,
     onSelectResource,
+    exitFlow,
     resourceSpec,
     viewConfig,
     setResourceSpec,
@@ -396,8 +437,8 @@ export function DiscoverProvider(
   };
 
   return (
-    <discoverContext.Provider value={props.mockCtx || value}>
-      {props.children}
+    <discoverContext.Provider value={mockCtx || value}>
+      {children}
     </discoverContext.Provider>
   );
 }
@@ -431,6 +472,10 @@ export type DbMeta = BaseMeta & {
   // The enroll event expects num count of enrolled RDS's, update accordingly.
   db: Database;
   integrationName?: string;
+  selectedAwsRdsDb: AwsRdsDatabase;
+  // serviceDeployedMethod flag will be undefined if user skipped
+  // deploying service (service already existed).
+  serviceDeployedMethod?: ServiceDeployMethod;
 };
 
 // KubeMeta describes the fields for a kube resource
diff --git a/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles.tsx b/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles.tsx
index a3b9e876cb6b1..6fbf143393d8c 100644
--- a/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles.tsx
+++ b/web/packages/teleport/src/Integrations/Enroll/IntegrationTiles.tsx
@@ -53,7 +53,13 @@ export function IntegrationTiles({
       </Text>
       {!hasAccess && (
         <ToolTipNoPermBadge
-          children={`You do not have access to create integrations`}
+          children={
+            <div>
+              You don’t have sufficient permissions to create an integration.
+              Reach out to your Teleport administrator to request additional
+              permissions.
+            </div>
+          }
         />
       )}
     </IntegrationTile>
diff --git a/web/packages/teleport/src/Integrations/Enroll/common.tsx b/web/packages/teleport/src/Integrations/Enroll/common.tsx
index 644fac6b96737..afc6e64dbd079 100644
--- a/web/packages/teleport/src/Integrations/Enroll/common.tsx
+++ b/web/packages/teleport/src/Integrations/Enroll/common.tsx
@@ -52,9 +52,8 @@ export const NoCodeIntegrationDescription = () => (
       No-Code Integrations
     </Text>
     <Text typography="body1">
-      Hosted Integrations eliminate the setup work so you can quickly connect
-      applications to Teleport for alerting and other useful functions. This
-      list is short for now, but it will grow with time!
+      Set up Teleport to post notifications to messaging apps, discover and
+      import resources from cloud providers and other services.
     </Text>
   </Box>
 );
diff --git a/web/packages/teleport/src/Integrations/IntegrationList.tsx b/web/packages/teleport/src/Integrations/IntegrationList.tsx
index 30aee712a088a..d82acabd00365 100644
--- a/web/packages/teleport/src/Integrations/IntegrationList.tsx
+++ b/web/packages/teleport/src/Integrations/IntegrationList.tsx
@@ -22,6 +22,8 @@ import { AWSIcon } from 'design/SVGIcon';
 import slackIcon from 'design/assets/images/icons/slack.svg';
 import openaiIcon from 'design/assets/images/icons/openai.svg';
 import jamfIcon from 'design/assets/images/icons/jamf.svg';
+import opsgenieIcon from 'design/assets/images/icons/opsgenie.svg';
+import oktaIcon from 'design/assets/images/icons/okta.svg';
 import Table, { Cell } from 'design/DataTable';
 import { MenuButton, MenuItem } from 'shared/components/MenuAction';
 import { ToolTipInfo } from 'shared/components/ToolTip';
@@ -192,6 +194,14 @@ const IconCell = ({ item }: { item: IntegrationLike }) => {
         formattedText = 'Jamf';
         icon = <IconContainer src={jamfIcon} />;
         break;
+      case 'okta':
+        formattedText = 'Okta';
+        icon = <IconContainer src={oktaIcon} />;
+        break;
+      case 'opsgenie':
+        formattedText = 'Opsgenie';
+        icon = <IconContainer src={opsgenieIcon} />;
+        break;
     }
   } else {
     // Default is integration.
diff --git a/web/packages/teleport/src/Integrations/fixtures.ts b/web/packages/teleport/src/Integrations/fixtures.ts
index a0b150774dfac..2832494bf777b 100644
--- a/web/packages/teleport/src/Integrations/fixtures.ts
+++ b/web/packages/teleport/src/Integrations/fixtures.ts
@@ -67,6 +67,30 @@ export const plugins: Plugin[] = [
     statusCode: IntegrationStatusCode.Running,
     spec: {},
   },
+  {
+    resourceType: 'plugin',
+    name: 'okta',
+    details: '',
+    kind: 'okta',
+    statusCode: IntegrationStatusCode.Running,
+    spec: {},
+  },
+  {
+    resourceType: 'plugin',
+    name: 'opsgenie',
+    details: '',
+    kind: 'opsgenie',
+    statusCode: IntegrationStatusCode.Running,
+    spec: {},
+  },
+  {
+    resourceType: 'plugin',
+    name: 'jamf',
+    details: '',
+    kind: 'jamf',
+    statusCode: IntegrationStatusCode.Running,
+    spec: {},
+  },
 ];
 
 export const integrations: Integration[] = [
diff --git a/web/packages/teleport/src/LocksV2/NewLock/ResourceList/ServerSideSupportedList/Nodes.tsx b/web/packages/teleport/src/LocksV2/NewLock/ResourceList/ServerSideSupportedList/Nodes.tsx
index 9256056d44d61..ead9f55f44c8f 100644
--- a/web/packages/teleport/src/LocksV2/NewLock/ResourceList/ServerSideSupportedList/Nodes.tsx
+++ b/web/packages/teleport/src/LocksV2/NewLock/ResourceList/ServerSideSupportedList/Nodes.tsx
@@ -54,12 +54,14 @@ export function Nodes(props: ServerSideListProps & { nodes: Node[] }) {
         {
           altKey: 'action-btn',
           render: agent =>
-            renderActionCell(Boolean(selectedResources.node[agent.id]), () =>
-              toggleSelectResource({
-                kind: 'node',
-                targetValue: agent.id,
-                friendlyName: agent.hostname,
-              })
+            renderActionCell(
+              Boolean(selectedResources.server_id[agent.id]),
+              () =>
+                toggleSelectResource({
+                  kind: 'server_id',
+                  targetValue: agent.id,
+                  friendlyName: agent.hostname,
+                })
             ),
         },
       ]}
diff --git a/web/packages/teleport/src/LocksV2/NewLock/common.tsx b/web/packages/teleport/src/LocksV2/NewLock/common.tsx
index 8116a1c8636aa..965d7a3d299ed 100644
--- a/web/packages/teleport/src/LocksV2/NewLock/common.tsx
+++ b/web/packages/teleport/src/LocksV2/NewLock/common.tsx
@@ -45,6 +45,7 @@ export type LockResourceKind =
   | 'role'
   | 'login'
   | 'node'
+  | 'server_id'
   | 'mfa_device'
   | 'windows_desktop'
   | 'access_request'
@@ -69,6 +70,7 @@ export function getEmptyResourceMap(): LockResourceMap {
     login: {},
     access_request: {},
     device: {},
+    server_id: {},
   };
 }
 
@@ -116,7 +118,7 @@ export const baseResourceKindOpts: LockResourceOption[] = [
     listKind: 'logins',
   },
   {
-    value: 'node',
+    value: 'server_id',
     label: 'Servers',
     listKind: 'server-side',
   },
diff --git a/web/packages/teleport/src/Login/Login.story.tsx b/web/packages/teleport/src/Login/Login.story.tsx
index 26873668bde2a..9f12549316e90 100644
--- a/web/packages/teleport/src/Login/Login.story.tsx
+++ b/web/packages/teleport/src/Login/Login.story.tsx
@@ -52,4 +52,7 @@ const sample: State = {
   isPasswordlessEnabled: false,
   primaryAuthType: 'local',
   privateKeyPolicyEnabled: false,
+  motd: '',
+  showMotd: false,
+  acknowledgeMotd: () => null,
 };
diff --git a/web/packages/teleport/src/Login/Login.test.tsx b/web/packages/teleport/src/Login/Login.test.tsx
index f3ea802acd0fc..8102775cb9653 100644
--- a/web/packages/teleport/src/Login/Login.test.tsx
+++ b/web/packages/teleport/src/Login/Login.test.tsx
@@ -113,3 +113,42 @@ test('login with private key policy enabled through role setting', async () => {
   expect(screen.queryByPlaceholderText(/username/i)).not.toBeInTheDocument();
   expect(screen.getByText(/login disabled/i)).toBeInTheDocument();
 });
+
+test('show motd only if motd is set', async () => {
+  // default login form
+  const { unmount } = render(<Login />);
+  expect(screen.getByPlaceholderText(/username/i)).toBeInTheDocument();
+  expect(
+    screen.queryByText('Welcome to cluster, your activity will be recorded.')
+  ).not.toBeInTheDocument();
+  unmount();
+
+  // now set motd
+  jest
+    .spyOn(cfg, 'getMotd')
+    .mockImplementation(
+      () => 'Welcome to cluster, your activity will be recorded.'
+    );
+
+  render(<Login />);
+
+  expect(
+    screen.getByText('Welcome to cluster, your activity will be recorded.')
+  ).toBeInTheDocument();
+  expect(screen.queryByPlaceholderText(/username/i)).not.toBeInTheDocument();
+});
+
+test('show login form after modt acknowledge', async () => {
+  jest
+    .spyOn(cfg, 'getMotd')
+    .mockImplementation(
+      () => 'Welcome to cluster, your activity will be recorded.'
+    );
+  render(<Login />);
+  expect(
+    screen.getByText('Welcome to cluster, your activity will be recorded.')
+  ).toBeInTheDocument();
+
+  fireEvent.click(screen.getByText('Acknowledge'));
+  expect(screen.getByPlaceholderText(/username/i)).toBeInTheDocument();
+});
diff --git a/web/packages/teleport/src/Login/Login.tsx b/web/packages/teleport/src/Login/Login.tsx
index ec1ef14fc47a0..5a35110cce0ec 100644
--- a/web/packages/teleport/src/Login/Login.tsx
+++ b/web/packages/teleport/src/Login/Login.tsx
@@ -22,6 +22,7 @@ import FormLogin from 'teleport/components/FormLogin';
 import Logo from 'teleport/components/LogoHero';
 
 import useLogin, { State } from './useLogin';
+import Motd from './Motd';
 
 export default function Container() {
   const state = useLogin();
@@ -41,25 +42,32 @@ export function Login({
   isPasswordlessEnabled,
   primaryAuthType,
   privateKeyPolicyEnabled,
+  motd,
+  showMotd,
+  acknowledgeMotd,
 }: State) {
   return (
     <>
       <Logo src={logoSrc} />
-      <FormLogin
-        title={'Sign in to Teleport'}
-        authProviders={authProviders}
-        auth2faType={auth2faType}
-        preferredMfaType={preferredMfaType}
-        isLocalAuthEnabled={isLocalAuthEnabled}
-        onLoginWithSso={onLoginWithSso}
-        onLoginWithWebauthn={onLoginWithWebauthn}
-        onLogin={onLogin}
-        attempt={attempt}
-        clearAttempt={clearAttempt}
-        isPasswordlessEnabled={isPasswordlessEnabled}
-        primaryAuthType={primaryAuthType}
-        privateKeyPolicyEnabled={privateKeyPolicyEnabled}
-      />
+      {showMotd ? (
+        <Motd message={motd} onClick={acknowledgeMotd} />
+      ) : (
+        <FormLogin
+          title={'Sign in to Teleport'}
+          authProviders={authProviders}
+          auth2faType={auth2faType}
+          preferredMfaType={preferredMfaType}
+          isLocalAuthEnabled={isLocalAuthEnabled}
+          onLoginWithSso={onLoginWithSso}
+          onLoginWithWebauthn={onLoginWithWebauthn}
+          onLogin={onLogin}
+          attempt={attempt}
+          clearAttempt={clearAttempt}
+          isPasswordlessEnabled={isPasswordlessEnabled}
+          primaryAuthType={primaryAuthType}
+          privateKeyPolicyEnabled={privateKeyPolicyEnabled}
+        />
+      )}
     </>
   );
 }
diff --git a/web/packages/teleport/src/Login/Motd/Motd.tsx b/web/packages/teleport/src/Login/Motd/Motd.tsx
new file mode 100644
index 0000000000000..ad26965f71764
--- /dev/null
+++ b/web/packages/teleport/src/Login/Motd/Motd.tsx
@@ -0,0 +1,38 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import React from 'react';
+import { Card, Box, Text, ButtonPrimary } from 'design';
+
+export function Motd({ message, onClick }: Props) {
+  return (
+    <Card bg="levels.surface" my={6} mx="auto" width="464px">
+      <Box p={6}>
+        <Text typography="h5" mb={3} textAlign="center">
+          {message}
+        </Text>
+        <ButtonPrimary width="100%" mt={3} size="large" onClick={onClick}>
+          Acknowledge
+        </ButtonPrimary>
+      </Box>
+    </Card>
+  );
+}
+
+type Props = {
+  message: string;
+  onClick(): void;
+};
diff --git a/web/packages/teleport/src/Assist/Chat/ChatBox/index.ts b/web/packages/teleport/src/Login/Motd/index.ts
similarity index 93%
rename from web/packages/teleport/src/Assist/Chat/ChatBox/index.ts
rename to web/packages/teleport/src/Login/Motd/index.ts
index 134f7a76376bd..811eedbe483a5 100644
--- a/web/packages/teleport/src/Assist/Chat/ChatBox/index.ts
+++ b/web/packages/teleport/src/Login/Motd/index.ts
@@ -14,4 +14,4 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-export { ChatBox } from './ChatBox';
+export { Motd as default } from './Motd';
diff --git a/web/packages/teleport/src/Login/__snapshots__/LoginFailed.test.tsx.snap b/web/packages/teleport/src/Login/__snapshots__/LoginFailed.test.tsx.snap
index 9c8099b2abc59..ca3aaf54c3546 100644
--- a/web/packages/teleport/src/Login/__snapshots__/LoginFailed.test.tsx.snap
+++ b/web/packages/teleport/src/Login/__snapshots__/LoginFailed.test.tsx.snap
@@ -36,6 +36,7 @@ exports[`callback error message 1`] = `
   background-color: #344179;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c2 {
@@ -146,6 +147,7 @@ exports[`default error message 1`] = `
   background-color: #344179;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c2 {
diff --git a/web/packages/teleport/src/Login/__snapshots__/LoginSuccess.test.tsx.snap b/web/packages/teleport/src/Login/__snapshots__/LoginSuccess.test.tsx.snap
index aeff85a90c93b..d5639bf7a8114 100644
--- a/web/packages/teleport/src/Login/__snapshots__/LoginSuccess.test.tsx.snap
+++ b/web/packages/teleport/src/Login/__snapshots__/LoginSuccess.test.tsx.snap
@@ -18,10 +18,10 @@ exports[`renders 1`] = `
   margin-bottom: 24px;
   padding: 48px;
   width: 540px;
-  background-color: #222C59;
   text-align: center;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c3 {
diff --git a/web/packages/teleport/src/Login/useLogin.ts b/web/packages/teleport/src/Login/useLogin.ts
index cbf24265c6757..5ce89419d3be4 100644
--- a/web/packages/teleport/src/Login/useLogin.ts
+++ b/web/packages/teleport/src/Login/useLogin.ts
@@ -38,6 +38,12 @@ export default function useLogin() {
   const authProviders = cfg.getAuthProviders();
   const auth2faType = cfg.getAuth2faType();
   const isLocalAuthEnabled = cfg.getLocalAuthFlag();
+  const motd = cfg.getMotd();
+  const [showMotd, setShowMotd] = useState(!!motd);
+
+  function acknowledgeMotd() {
+    setShowMotd(false);
+  }
 
   function onLogin(email, password, token) {
     attemptActions.start();
@@ -87,6 +93,9 @@ export default function useLogin() {
     isPasswordlessEnabled: cfg.isPasswordlessEnabled(),
     primaryAuthType: cfg.getPrimaryAuthType(),
     privateKeyPolicyEnabled,
+    motd,
+    showMotd,
+    acknowledgeMotd,
   };
 }
 
diff --git a/web/packages/teleport/src/Main/LayoutContext.tsx b/web/packages/teleport/src/Main/LayoutContext.tsx
new file mode 100644
index 0000000000000..99d4f96724f2b
--- /dev/null
+++ b/web/packages/teleport/src/Main/LayoutContext.tsx
@@ -0,0 +1,43 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, {
+  createContext,
+  PropsWithChildren,
+  useContext,
+  useState,
+} from 'react';
+
+interface LayoutContextValue {
+  hasDockedElement: boolean;
+  setHasDockedElement: (value: boolean) => void;
+}
+
+const LayoutContext = createContext<LayoutContextValue>(null);
+
+export function LayoutContextProvider(props: PropsWithChildren<unknown>) {
+  const [hasDockedElement, setHasDockedElement] = useState(false);
+
+  return (
+    <LayoutContext.Provider value={{ hasDockedElement, setHasDockedElement }}>
+      {props.children}
+    </LayoutContext.Provider>
+  );
+}
+
+export function useLayout() {
+  return useContext(LayoutContext);
+}
diff --git a/web/packages/teleport/src/Main/MainContainer.tsx b/web/packages/teleport/src/Main/MainContainer.tsx
index 8504cd865e4fa..f6d98354c9859 100644
--- a/web/packages/teleport/src/Main/MainContainer.tsx
+++ b/web/packages/teleport/src/Main/MainContainer.tsx
@@ -22,7 +22,6 @@ import styled from 'styled-components';
 // odd issues around the MainContainer component being available at certain
 // times.
 export const MainContainer = styled.div`
-  width: 100%;
   display: flex;
   flex: 1;
   min-height: 0;
diff --git a/web/packages/teleport/src/Navigation/NavigationCategoryContainer.tsx b/web/packages/teleport/src/Navigation/NavigationCategoryContainer.tsx
index 9392ae5b94006..9daa54355bf67 100644
--- a/web/packages/teleport/src/Navigation/NavigationCategoryContainer.tsx
+++ b/web/packages/teleport/src/Navigation/NavigationCategoryContainer.tsx
@@ -56,16 +56,6 @@ export function NavigationCategoryContainer(props: NavigationCategoryProps) {
     .filter(feature => feature.category === props.category)
     .filter(feature => !feature.parent);
 
-  if (props.category === NavigationCategory.Assist) {
-    // Return an empty div for a portal to be created by the assist route
-    // This allows for the conversation history to be put in the sidebar.
-    return (
-      <Container visible={props.visible}>
-        <div id="assist-sidebar"></div>
-      </Container>
-    );
-  }
-
   if (props.category === NavigationCategory.Resources) {
     const transitionDelayPerItem = TRANSITION_TOTAL_TIME / items.length;
 
diff --git a/web/packages/teleport/src/Navigation/NavigationSwitcher.tsx b/web/packages/teleport/src/Navigation/NavigationSwitcher.tsx
index db85907e3dfe6..3f6919754686d 100644
--- a/web/packages/teleport/src/Navigation/NavigationSwitcher.tsx
+++ b/web/packages/teleport/src/Navigation/NavigationSwitcher.tsx
@@ -15,34 +15,12 @@ limitations under the License.
 */
 
 import React, { useCallback, useEffect, useRef, useState } from 'react';
-import styled, { useTheme } from 'styled-components';
+import styled from 'styled-components';
 
 import { ChevronDownIcon } from 'design/SVGIcon/ChevronDown';
 
-import { useLocalStorage } from 'shared/hooks/useLocalStorage';
-import { OpenAIIcon } from 'design/SVGIcon/OpenAI';
-
-import { useHistory, useLocation } from 'react-router';
-
 import { NavigationCategory } from 'teleport/Navigation/categories';
 
-import { useTeleport } from 'teleport';
-
-import { KeysEnum } from 'teleport/services/localStorage';
-
-import cfg from 'teleport/config';
-
-import {
-  TeleportIcon,
-  Tooltip,
-  TooltipButton,
-  TooltipFooter,
-  TooltipLogos,
-  TooltipLogosSpacer,
-  TooltipTitle,
-  TooltipTitleBackground,
-} from './AssistTooltip';
-
 interface NavigationSwitcherProps {
   onChange: (value: NavigationCategory) => void;
   value: NavigationCategory;
@@ -130,33 +108,8 @@ const Arrow = styled.div<OpenProps>`
   }
 `;
 
-const Background = styled.div`
-  position: fixed;
-  top: 0;
-  left: 0;
-  right: 0;
-  bottom: 0;
-  z-index: 98;
-  background: rgba(0, 0, 0, 0.6);
-`;
-
 export function NavigationSwitcher(props: NavigationSwitcherProps) {
-  const ctx = useTeleport();
-  const assistEnabled = ctx.getFeatureFlags().assist && ctx.assistEnabled;
-
-  const location = useLocation();
-  const isAssistRoute = location.pathname.startsWith(cfg.routes.assistBase);
-
-  const [showAssist, setShowAssist] = useLocalStorage(
-    KeysEnum.SHOW_ASSIST_POPUP,
-    assistEnabled && !isAssistRoute
-  );
-
-  const theme = useTheme();
-
-  const [open, setOpen] = useState(showAssist);
-
-  const history = useHistory();
+  const [open, setOpen] = useState(false);
 
   const ref = useRef<HTMLDivElement>();
   const activeValueRef = useRef<HTMLDivElement>();
@@ -166,17 +119,11 @@ export function NavigationSwitcher(props: NavigationSwitcherProps) {
 
   const handleClickOutside = useCallback(
     (event: MouseEvent) => {
-      // prevent the dropdown from closing when the assist tooltip is visible
-      // this prevents the switcher from closing when the user closes the discover modal
-      if (showAssist) {
-        return;
-      }
-
       if (ref.current && !ref.current.contains(event.target as HTMLElement)) {
         setOpen(false);
       }
     },
-    [showAssist, ref.current]
+    [ref.current]
   );
 
   useEffect(() => {
@@ -255,16 +202,10 @@ export function NavigationSwitcher(props: NavigationSwitcherProps) {
 
   const handleChange = useCallback(
     (value: NavigationCategory) => {
-      setShowAssist(false);
-
       if (props.value !== value) {
         props.onChange(value);
       }
 
-      if (value === NavigationCategory.Assist) {
-        history.push(cfg.routes.assistBase);
-      }
-
       setOpen(false);
     },
     [props.value]
@@ -273,10 +214,6 @@ export function NavigationSwitcher(props: NavigationSwitcherProps) {
   const items = [];
 
   for (const [index, item] of props.items.entries()) {
-    if (item === NavigationCategory.Assist && !assistEnabled) {
-      continue;
-    }
-
     items.push(
       <DropdownItem
         ref={index === 0 ? firstValueRef : null}
@@ -294,30 +231,6 @@ export function NavigationSwitcher(props: NavigationSwitcherProps) {
 
   return (
     <Container ref={ref}>
-      {showAssist && (
-        <>
-          <Background />
-          <Tooltip>
-            <TooltipTitle>
-              <TooltipTitleBackground>New!</TooltipTitleBackground>
-            </TooltipTitle>{' '}
-            Try out Teleport Assist, a GPT-4-powered AI assistant that leverages
-            your infrastructure
-            <TooltipFooter>
-              <TooltipLogos>
-                <OpenAIIcon size={30} />
-                <TooltipLogosSpacer>+</TooltipLogosSpacer>
-                <TeleportIcon light={theme.name === 'light'} />
-              </TooltipLogos>
-
-              <TooltipButton onClick={() => setShowAssist(false)}>
-                Close
-              </TooltipButton>
-            </TooltipFooter>
-          </Tooltip>
-        </>
-      )}
-
       <ActiveValue
         ref={activeValueRef}
         onClick={() => setOpen(!open)}
diff --git a/web/packages/teleport/src/Navigation/categories.ts b/web/packages/teleport/src/Navigation/categories.ts
index 1127f973955e2..b1c2f7e8f7783 100644
--- a/web/packages/teleport/src/Navigation/categories.ts
+++ b/web/packages/teleport/src/Navigation/categories.ts
@@ -17,7 +17,6 @@ limitations under the License.
 export enum NavigationCategory {
   Resources = 'Resources',
   Management = 'Management',
-  Assist = 'Assist',
 }
 
 export enum ManagementSection {
@@ -37,5 +36,4 @@ export const MANAGEMENT_NAVIGATION_SECTIONS = [
 export const NAVIGATION_CATEGORIES = [
   NavigationCategory.Resources,
   NavigationCategory.Management,
-  NavigationCategory.Assist,
 ];
diff --git a/web/packages/teleport/src/Player/Player.tsx b/web/packages/teleport/src/Player/Player.tsx
index 2d94d2dfd1c52..baf9c3f42b379 100644
--- a/web/packages/teleport/src/Player/Player.tsx
+++ b/web/packages/teleport/src/Player/Player.tsx
@@ -20,13 +20,10 @@ import styled from 'styled-components';
 import { Flex, Box } from 'design';
 
 import { Danger } from 'design/Alert';
-import ThemeProvider from 'design/ThemeProvider';
-import { darkTheme } from 'design/theme';
 
 import { useParams, useLocation } from 'teleport/components/Router';
 
 import session from 'teleport/services/websession';
-import { colors } from 'teleport/Console/colors';
 import { UrlPlayerParams } from 'teleport/config';
 import { getUrlParameter } from 'teleport/services/history';
 
@@ -86,35 +83,31 @@ export default function Player() {
   }
 
   return (
-    // Force dark theme until we have light theme for player
-    <ThemeProvider theme={darkTheme}>
-      <StyledPlayer>
-        <Flex bg={colors.levels.surface} height="38px">
-          <Tabs flex="1 0">
-            <TabItem title="Session Player" />
-          </Tabs>
-          <ActionBar onLogout={onLogout} />
-        </Flex>
-        <Flex
-          bg={colors.bgTerminal}
-          flex="1"
-          style={{
-            overflow: 'auto',
-            position: 'relative',
-          }}
-        >
-          {recordingType === 'desktop' ? (
-            <DesktopPlayer
-              sid={sid}
-              clusterId={clusterId}
-              durationMs={durationMs}
-            />
-          ) : (
-            <SshPlayer sid={sid} clusterId={clusterId} />
-          )}
-        </Flex>
-      </StyledPlayer>
-    </ThemeProvider>
+    <StyledPlayer>
+      <Flex bg="levels.surface" height="38px">
+        <Tabs flex="1 0">
+          <TabItem title="Session Player" />
+        </Tabs>
+        <ActionBar onLogout={onLogout} />
+      </Flex>
+      <Flex
+        flex="1"
+        style={{
+          overflow: 'auto',
+          position: 'relative',
+        }}
+      >
+        {recordingType === 'desktop' ? (
+          <DesktopPlayer
+            sid={sid}
+            clusterId={clusterId}
+            durationMs={durationMs}
+          />
+        ) : (
+          <SshPlayer sid={sid} clusterId={clusterId} />
+        )}
+      </Flex>
+    </StyledPlayer>
   );
 }
 const StyledPlayer = styled.div`
diff --git a/web/packages/teleport/src/Player/PlayerTabs/PlayerTabs.tsx b/web/packages/teleport/src/Player/PlayerTabs/PlayerTabs.tsx
index 09ec8f149f173..89fa80cc8b331 100644
--- a/web/packages/teleport/src/Player/PlayerTabs/PlayerTabs.tsx
+++ b/web/packages/teleport/src/Player/PlayerTabs/PlayerTabs.tsx
@@ -47,7 +47,7 @@ const StyledTabItem = styled(Box)`
   }
 
   ${({ theme }) => ({
-    backgroundColor: theme.colors.bgTerminal,
+    backgroundColor: theme.colors.levels.sunken,
     color: theme.colors.text.main,
     fontWeight: 'bold',
     transition: 'none',
@@ -56,7 +56,7 @@ const StyledTabItem = styled(Box)`
   ${({ theme }) => {
     return {
       border: 'none',
-      borderRight: `1px solid ${theme.colors.bgTerminal}`,
+      borderRight: `1px solid ${theme.colors.levels.sunken}`,
       '&:hover, &:focus': {
         color: theme.colors.text.main,
         transition: 'color .3s',
diff --git a/web/packages/teleport/src/Player/ProgressBar/ProgressBar.tsx b/web/packages/teleport/src/Player/ProgressBar/ProgressBar.tsx
index 99b504c1340e9..38bd6ca238445 100644
--- a/web/packages/teleport/src/Player/ProgressBar/ProgressBar.tsx
+++ b/web/packages/teleport/src/Player/ProgressBar/ProgressBar.tsx
@@ -18,8 +18,6 @@ import React from 'react';
 import styled from 'styled-components';
 import * as Icons from 'design/Icon';
 
-import { colors } from 'teleport/Console/colors';
-
 import Slider from './Slider';
 
 export default function ProgressBar(props: ProgressBarProps) {
@@ -103,8 +101,7 @@ function PlaySpeedSelector(props: { onChange?: (speed: number) => void }) {
 const PlaySpeedSelectorItem = styled.select`
   margin-left: 8px;
   border: none;
-  background: ${colors.dark};
-  color: ${colors.light};
+  background: inherit;
 `;
 
 const SliderContainer = styled.div`
@@ -125,9 +122,8 @@ const TimeText = styled.div(
 );
 
 const ActionButton = styled.button`
-  background: ${colors.dark};
+  background: inherit;
   border: none;
-  color: ${colors.light};
   cursor: pointer;
   font-size: 24px;
   height: 24px;
@@ -138,15 +134,11 @@ const ActionButton = styled.button`
   transition: all 0.3s;
   width: 24px;
 
-  .icon {
-    color: ${colors.light};
-  }
-
   &:hover {
     opacity: 1;
 
     .icon {
-      color: ${colors.progressBarColor};
+      color: ${props => props.theme.colors.success};
     }
   }
 
@@ -157,9 +149,9 @@ const ActionButton = styled.button`
 `;
 
 const StyledProgessBar = styled.div`
-  background-color: ${colors.dark};
+  background: ${props => props.theme.colors.levels.surface};
   display: flex;
-  color: ${colors.light};
+  color: ${props => props.theme.colors.text.main};
   padding: 16px;
 
   .grv-slider {
@@ -175,7 +167,7 @@ const StyledProgessBar = styled.div`
   }
 
   .grv-slider .handle {
-    background-color: ${colors.light};
+    background-color: ${props => props.theme.colors.text.main};
     border-radius: 200px;
     box-shadow: 0 0 4px rgba(0, 0, 0, 0.12), 0 4px 4px rgba(0, 0, 0, 0.24);
     width: 16px;
@@ -185,11 +177,11 @@ const StyledProgessBar = styled.div`
   }
 
   .grv-slider .bar-0 {
-    background-color: ${colors.success};
+    background-color: ${props => props.theme.colors.success};
     box-shadow: none;
   }
 
   .grv-slider .bar-1 {
-    background-color: ${colors.text};
+    background-color: ${props => props.theme.colors.spotBackground[2]};
   }
 `;
diff --git a/web/packages/teleport/src/Player/Xterm/Xterm.tsx b/web/packages/teleport/src/Player/Xterm/Xterm.tsx
index b2e78bc8018f9..5c46c6c7adc22 100644
--- a/web/packages/teleport/src/Player/Xterm/Xterm.tsx
+++ b/web/packages/teleport/src/Player/Xterm/Xterm.tsx
@@ -26,14 +26,17 @@ import StyledXterm from 'teleport/Console/StyledXterm';
 export default function Xterm({ tty }: { tty: Tty }) {
   const refContainer = useRef<HTMLElement>();
   const theme = useTheme();
+  const terminalPlayer = useRef<TerminalPlayer>();
 
   useEffect(() => {
     const term = new TerminalPlayer(tty, {
       el: refContainer.current,
       fontFamily: theme.fonts.mono,
       fontSize: getPlatform().isMac ? 12 : 14,
+      theme: theme.colors.terminal,
     });
 
+    terminalPlayer.current = term;
     term.open();
     term.term.focus();
 
@@ -56,8 +59,14 @@ export default function Xterm({ tty }: { tty: Tty }) {
     }
 
     return cleanup;
+    // do not re-initialize xterm when theme changes, use specialized handlers.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [tty]);
 
+  useEffect(() => {
+    terminalPlayer.current?.updateTheme(theme.colors.terminal);
+  }, [theme]);
+
   return <StyledXterm ref={refContainer} />;
 }
 
diff --git a/web/packages/teleport/src/Roles/Roles.tsx b/web/packages/teleport/src/Roles/Roles.tsx
index 24abfa8f6e415..01b4a789a071b 100644
--- a/web/packages/teleport/src/Roles/Roles.tsx
+++ b/web/packages/teleport/src/Roles/Roles.tsx
@@ -93,9 +93,10 @@ export function Roles(props: State) {
               Role-based access control
             </Text>
             <Text typography="subtitle1" mb={3}>
-              Kubernetes and SSH authentication in one place. A Teleport role
-              can be assigned based on user identity when used with single
-              sign-on (SSO).
+              Teleport Role-based access control (RBAC) provides fine-grained
+              control over who can access resources and in which contexts. A
+              Teleport role can be assigned automatically based on user identity
+              when used with single sign-on (SSO).
             </Text>
             <Text>
               Learn more in{' '}
diff --git a/web/packages/teleport/src/Sessions/__snapshots__/Sessions.story.test.tsx.snap b/web/packages/teleport/src/Sessions/__snapshots__/Sessions.story.test.tsx.snap
index bd534179c0bc0..7edcae1d242fc 100644
--- a/web/packages/teleport/src/Sessions/__snapshots__/Sessions.story.test.tsx.snap
+++ b/web/packages/teleport/src/Sessions/__snapshots__/Sessions.story.test.tsx.snap
@@ -1070,7 +1070,7 @@ exports[`loaded with CTA 1`] = `
   color: inherit;
   font-weight: 500;
   font-size: 15px;
-  margin-right: 4px;
+  margin-right: 10px;
 }
 
 .c24 {
@@ -1263,8 +1263,9 @@ exports[`loaded with CTA 1`] = `
       <a
         class="c4"
         height="36px"
-        href="https://goteleport.com/r/upgrade-team?4.4.0-dev&campaign=CTA_ACTIVE_SESSIONS"
+        href="https://goteleport.com/r/upgrade-team?4.4.0-dev&utm_campaign=CTA_ACTIVE_SESSIONS"
         kind="primary"
+        rel="noreferrer"
         style="text-transform: none;"
         target="blank"
         width="100%"
diff --git a/web/packages/teleport/src/Support/__snapshots__/Support.story.test.tsx.snap b/web/packages/teleport/src/Support/__snapshots__/Support.story.test.tsx.snap
index 37dd7e4d478f8..790525004fb5c 100644
--- a/web/packages/teleport/src/Support/__snapshots__/Support.story.test.tsx.snap
+++ b/web/packages/teleport/src/Support/__snapshots__/Support.story.test.tsx.snap
@@ -17,9 +17,9 @@ exports[`support Cloud 1`] = `
   padding-top: 4px;
   padding-left: 32px;
   padding-right: 32px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c5 {
@@ -398,9 +398,9 @@ exports[`support Enterprise 1`] = `
   padding-top: 4px;
   padding-left: 32px;
   padding-right: 32px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c5 {
@@ -831,9 +831,9 @@ exports[`support Enterprise with CTA 1`] = `
   padding-top: 4px;
   padding-left: 32px;
   padding-right: 32px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c5 {
@@ -917,7 +917,7 @@ exports[`support Enterprise with CTA 1`] = `
   color: inherit;
   font-weight: 500;
   font-size: 15px;
-  margin-right: 4px;
+  margin-right: 10px;
 }
 
 .c12 {
@@ -1016,8 +1016,9 @@ exports[`support Enterprise with CTA 1`] = `
         </a>
         <a
           class="c9"
-          href="https://goteleport.com/r/upgrade-team?4.4.0-dev&campaign=CTA_PREMIUM_SUPPORT"
+          href="https://goteleport.com/r/upgrade-team?4.4.0-dev&utm_campaign=CTA_PREMIUM_SUPPORT"
           kind="primary"
+          rel="noreferrer"
           style="text-transform: none;"
           target="blank"
           width="100%"
@@ -1243,9 +1244,9 @@ exports[`support OSS 1`] = `
   padding-top: 4px;
   padding-left: 32px;
   padding-right: 32px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c5 {
diff --git a/web/packages/teleport/src/Teleport.tsx b/web/packages/teleport/src/Teleport.tsx
index adf1dd9363ef0..63e18027ff516 100644
--- a/web/packages/teleport/src/Teleport.tsx
+++ b/web/packages/teleport/src/Teleport.tsx
@@ -14,15 +14,18 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import React, { Suspense, lazy } from 'react';
+import React, { lazy, Suspense } from 'react';
 import ThemeProvider from 'design/ThemeProvider';
 
-import { Router, Route, Switch } from 'teleport/components/Router';
+import { Route, Router, Switch } from 'teleport/components/Router';
 import { CatchError } from 'teleport/components/CatchError';
 import Authenticated from 'teleport/components/Authenticated';
 
 import { getOSSFeatures } from 'teleport/features';
 
+import { LayoutContextProvider } from 'teleport/Main/LayoutContext';
+import { UserContextProvider } from 'teleport/User';
+
 import TeleportContextProvider from './TeleportContextProvider';
 import TeleportContext from './teleportContext';
 import cfg from './config';
@@ -39,26 +42,30 @@ const Teleport: React.FC<Props> = props => {
   return (
     <CatchError>
       <ThemeProvider>
-        <Router history={history}>
-          <Suspense fallback={null}>
-            <Switch>
-              {createPublicRoutes()}
-              <Route path={cfg.routes.root}>
-                <Authenticated>
-                  <TeleportContextProvider ctx={ctx}>
-                    <Switch>
-                      <Route
-                        path={cfg.routes.appLauncher}
-                        component={AppLauncher}
-                      />
-                      <Route>{createPrivateRoutes()}</Route>
-                    </Switch>
-                  </TeleportContextProvider>
-                </Authenticated>
-              </Route>
-            </Switch>
-          </Suspense>
-        </Router>
+        <LayoutContextProvider>
+          <Router history={history}>
+            <Suspense fallback={null}>
+              <Switch>
+                {createPublicRoutes()}
+                <Route path={cfg.routes.root}>
+                  <Authenticated>
+                    <UserContextProvider>
+                      <TeleportContextProvider ctx={ctx}>
+                        <Switch>
+                          <Route
+                            path={cfg.routes.appLauncher}
+                            component={AppLauncher}
+                          />
+                          <Route>{createPrivateRoutes()}</Route>
+                        </Switch>
+                      </TeleportContextProvider>
+                    </UserContextProvider>
+                  </Authenticated>
+                </Route>
+              </Switch>
+            </Suspense>
+          </Router>
+        </LayoutContextProvider>
       </ThemeProvider>
     </CatchError>
   );
diff --git a/web/packages/teleport/src/TopBar/TopBar.story.tsx b/web/packages/teleport/src/TopBar/TopBar.story.tsx
index 0615108b0763c..85b3673cc1ead 100644
--- a/web/packages/teleport/src/TopBar/TopBar.story.tsx
+++ b/web/packages/teleport/src/TopBar/TopBar.story.tsx
@@ -23,17 +23,20 @@ import { getOSSFeatures } from 'teleport/features';
 import TeleportContext from 'teleport/teleportContext';
 import { makeUserContext } from 'teleport/services/user';
 import TeleportContextProvider from 'teleport/TeleportContextProvider';
+import { LayoutContextProvider } from 'teleport/Main/LayoutContext';
 
 import { TopBar } from './TopBar';
 
 export default {
   title: 'Teleport/TopBar',
+  args: { userContext: true },
 };
 
 export function Story() {
   const ctx = new TeleportContext();
 
   ctx.storeUser.state = makeUserContext({
+    userName: 'admin',
     cluster: {
       name: 'test-cluster',
       lastConnected: Date.now(),
@@ -42,11 +45,13 @@ export function Story() {
 
   return (
     <Router history={createMemoryHistory()}>
-      <TeleportContextProvider ctx={ctx}>
-        <FeaturesContextProvider value={getOSSFeatures()}>
-          <TopBar />
-        </FeaturesContextProvider>
-      </TeleportContextProvider>
+      <LayoutContextProvider>
+        <TeleportContextProvider ctx={ctx}>
+          <FeaturesContextProvider value={getOSSFeatures()}>
+            <TopBar />
+          </FeaturesContextProvider>
+        </TeleportContextProvider>
+      </LayoutContextProvider>
     </Router>
   );
 }
diff --git a/web/packages/teleport/src/TopBar/TopBar.tsx b/web/packages/teleport/src/TopBar/TopBar.tsx
index 92454b7d22585..fd682fb9c1635 100644
--- a/web/packages/teleport/src/TopBar/TopBar.tsx
+++ b/web/packages/teleport/src/TopBar/TopBar.tsx
@@ -14,12 +14,16 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import React from 'react';
-import styled from 'styled-components';
-import { Text, Flex, TopNav } from 'design';
+import React, { Suspense, useState } from 'react';
+import styled, { useTheme } from 'styled-components';
+import { Flex, Text, TopNav } from 'design';
 
 import { matchPath, useHistory } from 'react-router';
 
+import { BrainIcon, OpenAIIcon } from 'design/SVGIcon';
+
+import { useLocalStorage } from 'shared/hooks/useLocalStorage';
+
 import useTeleport from 'teleport/useTeleport';
 import useStickyClusterId from 'teleport/useStickyClusterId';
 import { UserMenuNav } from 'teleport/components/UserMenuNav';
@@ -27,15 +31,74 @@ import { useFeatures } from 'teleport/FeaturesContext';
 
 import cfg from 'teleport/config';
 
+import { useLayout } from 'teleport/Main/LayoutContext';
+
+import { KeysEnum } from 'teleport/services/localStorage';
+import {
+  Popup,
+  PopupButton,
+  PopupFooter,
+  PopupLogos,
+  PopupLogosSpacer,
+  PopupTitle,
+  PopupTitleBackground,
+  TeleportIcon,
+} from 'teleport/Assist/Popup/Popup';
+
 import ClusterSelector from './ClusterSelector';
 
+const Assist = React.lazy(() => import('teleport/Assist'));
+
+const AssistButton = styled.div`
+  padding: 0 10px;
+  height: 48px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  border-radius: 5px;
+  cursor: pointer;
+  user-select: none;
+  margin-right: 5px;
+
+  &:hover {
+    background: ${props => props.theme.colors.spotBackground[0]};
+  }
+`;
+
+const AssistButtonContainer = styled.div`
+  position: relative;
+`;
+
+const Background = styled.div`
+  position: fixed;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  z-index: 98;
+  background: rgba(0, 0, 0, 0.6);
+`;
+
 export function TopBar() {
+  const theme = useTheme();
+
   const ctx = useTeleport();
   const history = useHistory();
   const features = useFeatures();
 
+  const assistEnabled = ctx.getFeatureFlags().assist && ctx.assistEnabled;
+
+  const [showAssistPopup, setShowAssistPopup] = useLocalStorage(
+    KeysEnum.SHOW_ASSIST_POPUP,
+    assistEnabled
+  );
+
+  const [showAssist, setShowAssist] = useState(false);
+
   const { clusterId, hasClusterUrl } = useStickyClusterId();
 
+  const { hasDockedElement } = useLayout();
+
   function loadClusters() {
     return ctx.clusterService.fetchClusters();
   }
@@ -84,9 +147,46 @@ export function TopBar() {
         onLoad={loadClusters}
         style={styles}
       />
-      <Flex ml="auto" height="100%">
+      <Flex ml="auto" height="100%" alignItems="center">
+        {!hasDockedElement && assistEnabled && (
+          <AssistButtonContainer>
+            <AssistButton onClick={() => setShowAssist(true)}>
+              <BrainIcon />
+            </AssistButton>
+
+            {showAssistPopup && (
+              <>
+                <Background />
+                <Popup>
+                  <PopupTitle>
+                    <PopupTitleBackground>New!</PopupTitleBackground>
+                  </PopupTitle>{' '}
+                  Try out Teleport Assist, a GPT-4-powered AI assistant that
+                  leverages your infrastructure
+                  <PopupFooter>
+                    <PopupLogos>
+                      <OpenAIIcon size={30} />
+                      <PopupLogosSpacer>+</PopupLogosSpacer>
+                      <TeleportIcon light={theme.name === 'light'} />
+                    </PopupLogos>
+
+                    <PopupButton onClick={() => setShowAssistPopup(false)}>
+                      Close
+                    </PopupButton>
+                  </PopupFooter>
+                </Popup>
+              </>
+            )}
+          </AssistButtonContainer>
+        )}
         <UserMenuNav username={ctx.storeUser.state.username} />
       </Flex>
+
+      {showAssist && (
+        <Suspense fallback={null}>
+          <Assist onClose={() => setShowAssist(false)} />
+        </Suspense>
+      )}
     </TopBarContainer>
   );
 }
diff --git a/web/packages/teleport/src/User/UserContext.test.tsx b/web/packages/teleport/src/User/UserContext.test.tsx
new file mode 100644
index 0000000000000..9cfcb72920f76
--- /dev/null
+++ b/web/packages/teleport/src/User/UserContext.test.tsx
@@ -0,0 +1,161 @@
+/**
+ * Copyright 2022 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+
+import { setupServer } from 'msw/node';
+import { rest } from 'msw';
+
+import { render, screen, waitFor } from '@testing-library/react';
+
+import '@testing-library/jest-dom';
+
+import cfg from 'teleport/config';
+
+import { UserContextProvider } from 'teleport/User';
+
+import { ThemePreference } from 'teleport/services/userPreferences/types';
+import { useUser } from 'teleport/User/UserContext';
+import { KeysEnum } from 'teleport/services/localStorage';
+
+function ThemeName() {
+  const { preferences } = useUser();
+
+  return (
+    <div>
+      theme: {preferences.theme === ThemePreference.Light ? 'light' : 'dark'}
+    </div>
+  );
+}
+
+describe('user context - success state', () => {
+  const server = setupServer(
+    rest.get(cfg.api.userPreferencesPath, (req, res, ctx) => {
+      return res(
+        ctx.json({
+          theme: ThemePreference.Light,
+          assist: {},
+        })
+      );
+    })
+  );
+
+  beforeAll(() => server.listen());
+  beforeEach(() => localStorage.clear());
+  afterEach(() => server.resetHandlers());
+  afterAll(() => server.close());
+
+  it('should render with the settings from the backend', async () => {
+    render(
+      <UserContextProvider>
+        <ThemeName />
+      </UserContextProvider>
+    );
+
+    const theme = await screen.findByText(/theme: light/i);
+
+    expect(theme).toBeInTheDocument();
+  });
+
+  it('should migrate the previous theme setting from local storage', async () => {
+    let updateBody = {};
+
+    server.use(
+      rest.put(cfg.api.userPreferencesPath, async (req, res, ctx) => {
+        updateBody = await req.json();
+
+        return res(ctx.status(200), ctx.json({}));
+      })
+    );
+
+    localStorage.setItem(KeysEnum.THEME, 'dark');
+
+    render(
+      <UserContextProvider>
+        <ThemeName />
+      </UserContextProvider>
+    );
+
+    await waitFor(() =>
+      expect(updateBody).toEqual({
+        theme: ThemePreference.Dark,
+      })
+    );
+
+    const theme = await screen.findByText(/theme: dark/i);
+
+    expect(theme).toBeInTheDocument();
+  });
+});
+
+describe('user context - error state', () => {
+  const server = setupServer(
+    rest.get(cfg.api.userPreferencesPath, (req, res, ctx) => {
+      return res(ctx.status(500));
+    })
+  );
+
+  beforeAll(() => server.listen());
+  beforeEach(() => localStorage.clear());
+  afterEach(() => server.resetHandlers());
+  afterAll(() => server.close());
+
+  it('should render with the default settings', async () => {
+    render(
+      <UserContextProvider>
+        <ThemeName />
+      </UserContextProvider>
+    );
+
+    const theme = await screen.findByText(/theme: light/i);
+
+    expect(theme).toBeInTheDocument();
+  });
+
+  it('should render with the theme from the previous local storage setting', async () => {
+    localStorage.setItem(KeysEnum.THEME, 'dark');
+
+    render(
+      <UserContextProvider>
+        <ThemeName />
+      </UserContextProvider>
+    );
+
+    const theme = await screen.findByText(/theme: dark/i);
+
+    expect(theme).toBeInTheDocument();
+  });
+
+  it('should render with the settings from local storage', async () => {
+    localStorage.setItem(
+      KeysEnum.USER_PREFERENCES,
+      JSON.stringify({
+        theme: 'dark',
+        assist: {},
+      })
+    );
+
+    render(
+      <UserContextProvider>
+        <ThemeName />
+      </UserContextProvider>
+    );
+
+    const theme = await screen.findByText(/theme: dark/i);
+
+    expect(theme).toBeInTheDocument();
+  });
+});
diff --git a/web/packages/teleport/src/User/UserContext.tsx b/web/packages/teleport/src/User/UserContext.tsx
new file mode 100644
index 0000000000000..d0320f9f0bf76
--- /dev/null
+++ b/web/packages/teleport/src/User/UserContext.tsx
@@ -0,0 +1,143 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import React, {
+  createContext,
+  PropsWithChildren,
+  useContext,
+  useEffect,
+  useState,
+} from 'react';
+
+import useAttempt from 'shared/hooks/useAttemptNext';
+
+import { Indicator } from 'design';
+
+import { StyledIndicator } from 'teleport/Main';
+
+import * as service from 'teleport/services/userPreferences';
+
+import storage, { KeysEnum } from 'teleport/services/localStorage';
+
+import { ThemePreference } from 'teleport/services/userPreferences/types';
+
+import { makeDefaultUserPreferences } from 'teleport/services/userPreferences/userPreferences';
+
+import type {
+  UserPreferences,
+  UserPreferencesSubset,
+} from 'teleport/services/userPreferences/types';
+
+export interface UserContextValue {
+  preferences: UserPreferences;
+  updatePreferences: (preferences: UserPreferencesSubset) => Promise<void>;
+}
+
+export const UserContext = createContext<UserContextValue>(null);
+
+export function useUser(): UserContextValue {
+  return useContext(UserContext);
+}
+
+export function UserContextProvider(props: PropsWithChildren<unknown>) {
+  const { attempt, run } = useAttempt('processing');
+
+  const [preferences, setPreferences] = useState<UserPreferences>(
+    makeDefaultUserPreferences()
+  );
+
+  async function loadUserPreferences() {
+    const storedPreferences = storage.getUserPreferences();
+    const theme = storage.getThemePreference();
+
+    try {
+      const preferences = await service.getUserPreferences();
+
+      if (!storedPreferences) {
+        // there are no mirrored user preferences in local storage so this is the first time
+        // the user has requested their preferences
+
+        // update the preferences with the previous theme setting in local storage
+        preferences.theme = theme;
+
+        if (theme !== ThemePreference.Light) {
+          // the light theme is the default, so only update the backend if it is not light
+          updatePreferences({ theme });
+        }
+      }
+
+      setPreferences(preferences);
+      storage.setUserPreferences(preferences);
+    } catch (err) {
+      if (storedPreferences) {
+        setPreferences(storedPreferences);
+
+        return;
+      }
+
+      if (theme) {
+        setPreferences({ ...preferences, theme });
+      }
+    }
+  }
+
+  function updatePreferences(newPreferences: UserPreferencesSubset) {
+    const nextPreferences = {
+      ...preferences,
+      ...newPreferences,
+      assist: {
+        ...preferences.assist,
+        ...newPreferences.assist,
+      },
+    } as UserPreferences;
+
+    setPreferences(nextPreferences);
+    storage.setUserPreferences(nextPreferences);
+
+    return service.updateUserPreferences(newPreferences);
+  }
+
+  useEffect(() => {
+    function receiveMessage(event: StorageEvent) {
+      if (!event.newValue || event.key !== KeysEnum.USER_PREFERENCES) {
+        return;
+      }
+
+      setPreferences(JSON.parse(event.newValue));
+    }
+
+    storage.subscribe(receiveMessage);
+
+    return () => storage.unsubscribe(receiveMessage);
+  }, []);
+
+  useEffect(() => {
+    run(loadUserPreferences);
+  }, []);
+
+  if (attempt.status === 'processing') {
+    return (
+      <StyledIndicator>
+        <Indicator />
+      </StyledIndicator>
+    );
+  }
+
+  return (
+    <UserContext.Provider value={{ preferences, updatePreferences }}>
+      {props.children}
+    </UserContext.Provider>
+  );
+}
diff --git a/web/packages/teleport/src/User/index.ts b/web/packages/teleport/src/User/index.ts
new file mode 100644
index 0000000000000..3f0f216ba6af4
--- /dev/null
+++ b/web/packages/teleport/src/User/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { UserContextProvider } from './UserContext';
diff --git a/web/packages/teleport/src/User/testHelpers/makeTestUserContext.ts b/web/packages/teleport/src/User/testHelpers/makeTestUserContext.ts
new file mode 100644
index 0000000000000..b189a1e6419aa
--- /dev/null
+++ b/web/packages/teleport/src/User/testHelpers/makeTestUserContext.ts
@@ -0,0 +1,38 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { UserContextValue } from 'teleport/User/UserContext';
+
+export const makeTestUserContext = (
+  overrides?: Partial<UserContextValue>
+): UserContextValue => {
+  return Object.assign(
+    {
+      preferences: {
+        theme: 1,
+        assist: {
+          preferredLogins: [],
+          viewMode: 1,
+        },
+        onboard: {
+          preferredResources: [],
+        },
+      },
+      updatePreferences: () => Promise.resolve(),
+    },
+    overrides
+  );
+};
diff --git a/web/packages/teleport/src/Discover/Shared/YAML.tsx b/web/packages/teleport/src/User/testHelpers/mockUserContextWith.ts
similarity index 65%
rename from web/packages/teleport/src/Discover/Shared/YAML.tsx
rename to web/packages/teleport/src/User/testHelpers/mockUserContextWith.ts
index 91454e128c3b8..ee2f4b938ec93 100644
--- a/web/packages/teleport/src/Discover/Shared/YAML.tsx
+++ b/web/packages/teleport/src/User/testHelpers/mockUserContextWith.ts
@@ -14,10 +14,13 @@
  * limitations under the License.
  */
 
-import React from 'react';
+import * as UserContext from 'teleport/User/UserContext';
+import { UserContextValue } from 'teleport/User/UserContext';
 
-import TextEditor from 'shared/components/TextEditor';
-
-export const ReadOnlyYamlEditor = ({ content }: { content: string }) => {
-  return <TextEditor readOnly={true} data={[{ content, type: 'yaml' }]} />;
+export const mockUserContextProviderWith = (
+  data: UserContextValue
+): jest.SpyInstance => {
+  const hookSpy = jest.spyOn(UserContext, 'useUser');
+  hookSpy.mockReturnValue(data);
+  return hookSpy;
 };
diff --git a/web/packages/teleport/src/Welcome/CardWelcome.tsx b/web/packages/teleport/src/Welcome/CardWelcome.tsx
index 95dad3554e6c7..5c0f5a04d84fd 100644
--- a/web/packages/teleport/src/Welcome/CardWelcome.tsx
+++ b/web/packages/teleport/src/Welcome/CardWelcome.tsx
@@ -19,7 +19,7 @@ import { Card, Box, Text, ButtonPrimary } from 'design';
 
 export function CardWelcome({ title, subTitle, btnText, onClick }: Props) {
   return (
-    <Card bg="levels.surface" my={6} mx="auto" width="464px">
+    <Card my={6} mx="auto" width="464px">
       <Box p={6}>
         <Text typography="h2" mb={3} textAlign="center" color="text.main">
           {title}
diff --git a/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.story.test.tsx b/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.story.test.tsx
index 0fbdcc6aab0a0..d2f2d7ec6267f 100644
--- a/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.story.test.tsx
+++ b/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.story.test.tsx
@@ -48,3 +48,28 @@ test('story.MfaDeviceOn', () => {
   const { container } = render(<story.MfaDeviceOn />);
   expect(container.firstChild).toMatchSnapshot();
 });
+
+test('story.SuccessRegister', () => {
+  const { container } = render(<story.SuccessRegister />);
+  expect(container.firstChild).toMatchSnapshot();
+});
+test('story.SuccessReset', () => {
+  const { container } = render(<story.SuccessReset />);
+  expect(container.firstChild).toMatchSnapshot();
+});
+test('story.SuccessAndPrivateKeyEnabledRegister', () => {
+  const { container } = render(<story.SuccessAndPrivateKeyEnabledRegister />);
+  expect(container.firstChild).toMatchSnapshot();
+});
+test('story.SuccessAndPrivateKeyEnabledReset', () => {
+  const { container } = render(<story.SuccessAndPrivateKeyEnabledReset />);
+  expect(container.firstChild).toMatchSnapshot();
+});
+test('story.SuccessRegisterDashboard', () => {
+  const { container } = render(<story.SuccessRegisterDashboard />);
+  expect(container.firstChild).toMatchSnapshot();
+});
+test('story.SuccessResetDashboard', () => {
+  const { container } = render(<story.SuccessResetDashboard />);
+  expect(container.firstChild).toMatchSnapshot();
+});
diff --git a/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.story.tsx b/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.story.tsx
index c54a95789f2d7..026846ebabaf8 100644
--- a/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.story.tsx
+++ b/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.story.tsx
@@ -152,10 +152,21 @@ export const SuccessAndPrivateKeyEnabledReset = () => (
     privateKeyPolicyEnabled={true}
   />
 );
+export const SuccessRegisterDashboard = () => (
+  <NewCredentials {...props} success={true} isDashboard={true} />
+);
+export const SuccessResetDashboard = () => (
+  <NewCredentials
+    {...props}
+    success={true}
+    resetMode={true}
+    isDashboard={true}
+  />
+);
 
 function CardWrapper({ children }) {
   return (
-    <Card as="form" bg="levels.surface" my={5} mx="auto" width={464}>
+    <Card as="form" my={5} mx="auto" width={464}>
       {children}
     </Card>
   );
@@ -233,4 +244,5 @@ const props: Props = {
       'QUKIICFEkBAiSAgRJIQ8GZ3rjnbtD76d3X92ber60v0xsClnB9/OsnUO3pAgIUSQECJICBEkhAgSQgQJ' +
       'IYKEEEFCiCAh5KMwdgQ8OCEhRJAQ8v8AAAD//1QuL6EmJFBiAAAAAElFTkSuQmCC',
   },
+  isDashboard: false,
 };
diff --git a/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.tsx b/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.tsx
index 4d4f6a8c2e456..27d6986e3dc94 100644
--- a/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.tsx
+++ b/web/packages/teleport/src/Welcome/NewCredentials/NewCredentials.tsx
@@ -23,6 +23,8 @@ import { NewFlow, StepComponentProps, StepSlider } from 'design/StepSlider';
 import RecoveryCodes from 'teleport/components/RecoveryCodes';
 import { PrivateKeyLoginDisabledCard } from 'teleport/components/PrivateKeyPolicy';
 
+import cfg from 'teleport/config';
+
 import useToken, { State } from '../useToken';
 
 import { Expired } from './Expired';
@@ -43,7 +45,13 @@ const loginFlows = {
 
 export function Container({ tokenId = '', resetMode = false }) {
   const state = useToken(tokenId);
-  return <NewCredentials {...state} resetMode={resetMode} />;
+  return (
+    <NewCredentials
+      {...state}
+      resetMode={resetMode}
+      isDashboard={cfg.isDashboard}
+    />
+  );
 }
 
 export function NewCredentials(props: State & Props) {
@@ -57,6 +65,7 @@ export function NewCredentials(props: State & Props) {
     success,
     finishedRegister,
     privateKeyPolicyEnabled,
+    isDashboard,
   } = props;
 
   if (fetchAttempt.status === 'failed') {
@@ -81,6 +90,7 @@ export function NewCredentials(props: State & Props) {
         redirect={redirect}
         resetMode={resetMode}
         username={resetToken.user}
+        isDashboard={isDashboard}
       />
     );
   }
@@ -119,7 +129,7 @@ export function NewCredentials(props: State & Props) {
   }
 
   return (
-    <Card as="form" bg="levels.surface" my={5} mx="auto" width={464}>
+    <Card as="form" my={5} mx="auto" width={464}>
       <StepSlider<typeof loginFlows>
         flows={loginFlows}
         currFlow={flow}
@@ -136,4 +146,5 @@ export function NewCredentials(props: State & Props) {
 
 export type Props = State & {
   resetMode?: boolean;
+  isDashboard: boolean;
 };
diff --git a/web/packages/teleport/src/Welcome/NewCredentials/Success.tsx b/web/packages/teleport/src/Welcome/NewCredentials/Success.tsx
index ffac2547fd646..fe9191b3ba41f 100644
--- a/web/packages/teleport/src/Welcome/NewCredentials/Success.tsx
+++ b/web/packages/teleport/src/Welcome/NewCredentials/Success.tsx
@@ -25,10 +25,12 @@ export function RegisterSuccess({
   redirect,
   resetMode = false,
   username = '',
+  isDashboard,
 }: {
   redirect(): void;
   resetMode: boolean;
   username?: string;
+  isDashboard: boolean;
 }) {
   const actionTxt = resetMode ? 'reset' : 'registration';
 
@@ -69,7 +71,7 @@ export function RegisterSuccess({
         Proceed to access your account.
       </Text>
       <ButtonPrimary width="100%" size="large" onClick={handleRedirect}>
-        Go to Dashboard
+        Go to {isDashboard ? 'Dashboard' : 'Cluster'}
       </ButtonPrimary>
     </Card>
   );
diff --git a/web/packages/teleport/src/Welcome/NewCredentials/__snapshots__/NewCredentials.story.test.tsx.snap b/web/packages/teleport/src/Welcome/NewCredentials/__snapshots__/NewCredentials.story.test.tsx.snap
index 9d2beee5d6761..9bb35eb557f5a 100644
--- a/web/packages/teleport/src/Welcome/NewCredentials/__snapshots__/NewCredentials.story.test.tsx.snap
+++ b/web/packages/teleport/src/Welcome/NewCredentials/__snapshots__/NewCredentials.story.test.tsx.snap
@@ -107,9 +107,9 @@ exports[`story.MfaDeviceError 1`] = `
   margin-top: 32px;
   margin-bottom: 32px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c5 {
@@ -493,9 +493,9 @@ exports[`story.MfaDeviceOn 1`] = `
   margin-top: 32px;
   margin-bottom: 32px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c5 {
@@ -850,9 +850,9 @@ exports[`story.MfaDeviceOtp 1`] = `
   margin-top: 32px;
   margin-bottom: 32px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c5 {
@@ -1230,9 +1230,9 @@ exports[`story.MfaDeviceWebauthn 1`] = `
   margin-top: 32px;
   margin-bottom: 32px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c5 {
@@ -1574,9 +1574,9 @@ exports[`story.PasswordOnlyError 1`] = `
   margin-top: 32px;
   margin-bottom: 32px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c4 {
@@ -1913,9 +1913,9 @@ exports[`story.PrimaryPasswordlessError 1`] = `
   margin-top: 32px;
   margin-bottom: 32px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c4 {
@@ -2091,3 +2091,831 @@ exports[`story.PrimaryPasswordlessError 1`] = `
   </div>
 </form>
 `;
+
+exports[`story.SuccessAndPrivateKeyEnabledRegister 1`] = `
+.c2 {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  border-radius: 2px;
+  box-sizing: border-box;
+  box-shadow: 0 1px 4px rgba(0,0,0,0.24);
+  margin: 0 0 24px 0;
+  min-height: 40px;
+  padding: 8px 16px;
+  overflow: auto;
+  word-break: break-word;
+  line-height: 1.5;
+  margin-top: 32px;
+  margin-bottom: 32px;
+  background: #FF6257;
+  color: #000000;
+}
+
+.c2 a {
+  color: #FFFFFF;
+}
+
+.c0 {
+  box-sizing: border-box;
+  margin-left: auto;
+  margin-right: auto;
+  margin-top: 32px;
+  margin-bottom: 32px;
+  padding-bottom: 24px;
+  padding-left: 32px;
+  padding-right: 32px;
+  width: 464px;
+  box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
+  border-radius: 8px;
+  background-color: #222C59;
+}
+
+.c1 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-weight: 300;
+  font-size: 22px;
+  line-height: 32px;
+  margin: 0px;
+  padding-top: 24px;
+  color: #FFFFFF;
+  text-align: center;
+}
+
+.c3 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-weight: 300;
+  font-size: 12px;
+  line-height: 24px;
+  margin: 0px;
+  margin-bottom: 8px;
+}
+
+.c4 {
+  color: #009EFF;
+  font-weight: normal;
+  background: none;
+  text-decoration: underline;
+  text-transform: none;
+  color: #FFFFFF;
+}
+
+<div
+  class="c0"
+  width="464px"
+>
+  <div
+    class="c1"
+    color="text.main"
+  >
+    Registration Complete
+  </div>
+  <div
+    class="c2"
+    kind="danger"
+  >
+    Web UI Login Disabled
+  </div>
+  <div
+    class="c3"
+  >
+    This Teleport Cluster requires that user
+     
+    <a
+      class="c4"
+      color="text.main"
+      href="https://goteleport.com/docs/access-controls/guides/hardware-key-support/"
+      rel="noreferrer"
+      target="_blank"
+    >
+      private keys
+    </a>
+     
+    be stored on hardware authentication devices. Since these keys are not accessible by web browsers, Web UI login has been disabled. Please use
+     
+    <a
+      class="c4"
+      color="text.main"
+      href="https://goteleport.com/docs/connect-your-client/teleport-connect/"
+      rel="noreferrer"
+      target="_blank"
+    >
+      Teleport Connect
+    </a>
+     
+    or
+     
+    <a
+      class="c4"
+      color="text.main"
+      href="https://goteleport.com/docs/connect-your-client/tsh/#installing-tsh"
+      rel="noreferrer"
+      target="_blank"
+    >
+      tsh
+    </a>
+     
+    to log in.
+  </div>
+</div>
+`;
+
+exports[`story.SuccessAndPrivateKeyEnabledReset 1`] = `
+.c2 {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  border-radius: 2px;
+  box-sizing: border-box;
+  box-shadow: 0 1px 4px rgba(0,0,0,0.24);
+  margin: 0 0 24px 0;
+  min-height: 40px;
+  padding: 8px 16px;
+  overflow: auto;
+  word-break: break-word;
+  line-height: 1.5;
+  margin-top: 32px;
+  margin-bottom: 32px;
+  background: #FF6257;
+  color: #000000;
+}
+
+.c2 a {
+  color: #FFFFFF;
+}
+
+.c0 {
+  box-sizing: border-box;
+  margin-left: auto;
+  margin-right: auto;
+  margin-top: 32px;
+  margin-bottom: 32px;
+  padding-bottom: 24px;
+  padding-left: 32px;
+  padding-right: 32px;
+  width: 464px;
+  box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
+  border-radius: 8px;
+  background-color: #222C59;
+}
+
+.c1 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-weight: 300;
+  font-size: 22px;
+  line-height: 32px;
+  margin: 0px;
+  padding-top: 24px;
+  color: #FFFFFF;
+  text-align: center;
+}
+
+.c3 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-weight: 300;
+  font-size: 12px;
+  line-height: 24px;
+  margin: 0px;
+  margin-bottom: 8px;
+}
+
+.c4 {
+  color: #009EFF;
+  font-weight: normal;
+  background: none;
+  text-decoration: underline;
+  text-transform: none;
+  color: #FFFFFF;
+}
+
+<div
+  class="c0"
+  width="464px"
+>
+  <div
+    class="c1"
+    color="text.main"
+  >
+    Reset Complete
+  </div>
+  <div
+    class="c2"
+    kind="danger"
+  >
+    Web UI Login Disabled
+  </div>
+  <div
+    class="c3"
+  >
+    This Teleport Cluster requires that user
+     
+    <a
+      class="c4"
+      color="text.main"
+      href="https://goteleport.com/docs/access-controls/guides/hardware-key-support/"
+      rel="noreferrer"
+      target="_blank"
+    >
+      private keys
+    </a>
+     
+    be stored on hardware authentication devices. Since these keys are not accessible by web browsers, Web UI login has been disabled. Please use
+     
+    <a
+      class="c4"
+      color="text.main"
+      href="https://goteleport.com/docs/connect-your-client/teleport-connect/"
+      rel="noreferrer"
+      target="_blank"
+    >
+      Teleport Connect
+    </a>
+     
+    or
+     
+    <a
+      class="c4"
+      color="text.main"
+      href="https://goteleport.com/docs/connect-your-client/tsh/#installing-tsh"
+      rel="noreferrer"
+      target="_blank"
+    >
+      tsh
+    </a>
+     
+    to log in.
+  </div>
+</div>
+`;
+
+exports[`story.SuccessRegister 1`] = `
+.c5 {
+  line-height: 1.5;
+  margin: 0;
+  display: inline-flex;
+  justify-content: center;
+  align-items: center;
+  box-sizing: border-box;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-family: inherit;
+  font-weight: 600;
+  outline: none;
+  position: relative;
+  text-align: center;
+  text-decoration: none;
+  text-transform: uppercase;
+  transition: all 0.3s;
+  -webkit-font-smoothing: antialiased;
+  color: #000000;
+  background: #9F85FF;
+  min-height: 40px;
+  font-size: 12px;
+  padding: 0px 40px;
+  width: 100%;
+}
+
+.c5:hover,
+.c5:focus {
+  background: #B29DFF;
+}
+
+.c5:active {
+  background: #C5B6FF;
+}
+
+.c5:disabled {
+  background: rgba(255,255,255,0.12);
+  color: rgba(255,255,255,0.3);
+  cursor: auto;
+}
+
+.c0 {
+  box-sizing: border-box;
+  margin-top: 40px;
+  margin-left: auto;
+  margin-right: auto;
+  padding: 40px;
+  width: 540px;
+  background-color: #222C59;
+  text-align: center;
+  box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
+  border-radius: 8px;
+  background-color: #222C59;
+}
+
+.c1 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-weight: 300;
+  font-size: 22px;
+  line-height: 32px;
+  margin: 0px;
+  margin-bottom: 16px;
+}
+
+.c1 color {
+  main: #FFFFFF;
+  slightly-muted: rgba(255,255,255,0.72);
+  muted: rgba(255,255,255,0.54);
+  disabled: rgba(255,255,255,0.36);
+  primary-inverse: #000000;
+}
+
+.c4 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-size: 14px;
+  margin: 0px;
+  margin-bottom: 24px;
+  color: rgba(255,255,255,0.72);
+}
+
+.c3 {
+  display: block;
+  outline: none;
+  width: 200px;
+  height: 143px;
+}
+
+.c2 {
+  box-sizing: border-box;
+  margin-bottom: 16px;
+  display: flex;
+  justify-content: center;
+}
+
+<div
+  class="c0"
+  width="540px"
+>
+  <div
+    class="c1"
+    color="text"
+    style="text-transform: capitalize;"
+  >
+    registration
+     successful
+  </div>
+  <div
+    class="c2"
+  >
+    <img
+      class="c3"
+      height="143px"
+      src="file_stub"
+      width="200px"
+    />
+  </div>
+  <div
+    class="c4"
+    color="text.slightlyMuted"
+    font-size="2"
+  >
+    Congratulations your 
+    registration
+     is completed.
+    <br />
+    Proceed to access your account.
+  </div>
+  <button
+    class="c5"
+    kind="primary"
+    width="100%"
+  >
+    Go to 
+    Cluster
+  </button>
+</div>
+`;
+
+exports[`story.SuccessRegisterDashboard 1`] = `
+.c5 {
+  line-height: 1.5;
+  margin: 0;
+  display: inline-flex;
+  justify-content: center;
+  align-items: center;
+  box-sizing: border-box;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-family: inherit;
+  font-weight: 600;
+  outline: none;
+  position: relative;
+  text-align: center;
+  text-decoration: none;
+  text-transform: uppercase;
+  transition: all 0.3s;
+  -webkit-font-smoothing: antialiased;
+  color: #000000;
+  background: #9F85FF;
+  min-height: 40px;
+  font-size: 12px;
+  padding: 0px 40px;
+  width: 100%;
+}
+
+.c5:hover,
+.c5:focus {
+  background: #B29DFF;
+}
+
+.c5:active {
+  background: #C5B6FF;
+}
+
+.c5:disabled {
+  background: rgba(255,255,255,0.12);
+  color: rgba(255,255,255,0.3);
+  cursor: auto;
+}
+
+.c0 {
+  box-sizing: border-box;
+  margin-top: 40px;
+  margin-left: auto;
+  margin-right: auto;
+  padding: 40px;
+  width: 540px;
+  background-color: #222C59;
+  text-align: center;
+  box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
+  border-radius: 8px;
+  background-color: #222C59;
+}
+
+.c1 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-weight: 300;
+  font-size: 22px;
+  line-height: 32px;
+  margin: 0px;
+  margin-bottom: 16px;
+}
+
+.c1 color {
+  main: #FFFFFF;
+  slightly-muted: rgba(255,255,255,0.72);
+  muted: rgba(255,255,255,0.54);
+  disabled: rgba(255,255,255,0.36);
+  primary-inverse: #000000;
+}
+
+.c4 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-size: 14px;
+  margin: 0px;
+  margin-bottom: 24px;
+  color: rgba(255,255,255,0.72);
+}
+
+.c3 {
+  display: block;
+  outline: none;
+  width: 200px;
+  height: 143px;
+}
+
+.c2 {
+  box-sizing: border-box;
+  margin-bottom: 16px;
+  display: flex;
+  justify-content: center;
+}
+
+<div
+  class="c0"
+  width="540px"
+>
+  <div
+    class="c1"
+    color="text"
+    style="text-transform: capitalize;"
+  >
+    registration
+     successful
+  </div>
+  <div
+    class="c2"
+  >
+    <img
+      class="c3"
+      height="143px"
+      src="file_stub"
+      width="200px"
+    />
+  </div>
+  <div
+    class="c4"
+    color="text.slightlyMuted"
+    font-size="2"
+  >
+    Congratulations your 
+    registration
+     is completed.
+    <br />
+    Proceed to access your account.
+  </div>
+  <button
+    class="c5"
+    kind="primary"
+    width="100%"
+  >
+    Go to 
+    Dashboard
+  </button>
+</div>
+`;
+
+exports[`story.SuccessReset 1`] = `
+.c5 {
+  line-height: 1.5;
+  margin: 0;
+  display: inline-flex;
+  justify-content: center;
+  align-items: center;
+  box-sizing: border-box;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-family: inherit;
+  font-weight: 600;
+  outline: none;
+  position: relative;
+  text-align: center;
+  text-decoration: none;
+  text-transform: uppercase;
+  transition: all 0.3s;
+  -webkit-font-smoothing: antialiased;
+  color: #000000;
+  background: #9F85FF;
+  min-height: 40px;
+  font-size: 12px;
+  padding: 0px 40px;
+  width: 100%;
+}
+
+.c5:hover,
+.c5:focus {
+  background: #B29DFF;
+}
+
+.c5:active {
+  background: #C5B6FF;
+}
+
+.c5:disabled {
+  background: rgba(255,255,255,0.12);
+  color: rgba(255,255,255,0.3);
+  cursor: auto;
+}
+
+.c0 {
+  box-sizing: border-box;
+  margin-top: 40px;
+  margin-left: auto;
+  margin-right: auto;
+  padding: 40px;
+  width: 540px;
+  background-color: #222C59;
+  text-align: center;
+  box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
+  border-radius: 8px;
+  background-color: #222C59;
+}
+
+.c1 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-weight: 300;
+  font-size: 22px;
+  line-height: 32px;
+  margin: 0px;
+  margin-bottom: 16px;
+}
+
+.c1 color {
+  main: #FFFFFF;
+  slightly-muted: rgba(255,255,255,0.72);
+  muted: rgba(255,255,255,0.54);
+  disabled: rgba(255,255,255,0.36);
+  primary-inverse: #000000;
+}
+
+.c4 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-size: 14px;
+  margin: 0px;
+  margin-bottom: 24px;
+  color: rgba(255,255,255,0.72);
+}
+
+.c3 {
+  display: block;
+  outline: none;
+  width: 200px;
+  height: 143px;
+}
+
+.c2 {
+  box-sizing: border-box;
+  margin-bottom: 16px;
+  display: flex;
+  justify-content: center;
+}
+
+<div
+  class="c0"
+  width="540px"
+>
+  <div
+    class="c1"
+    color="text"
+    style="text-transform: capitalize;"
+  >
+    reset
+     successful
+  </div>
+  <div
+    class="c2"
+  >
+    <img
+      class="c3"
+      height="143px"
+      src="file_stub"
+      width="200px"
+    />
+  </div>
+  <div
+    class="c4"
+    color="text.slightlyMuted"
+    font-size="2"
+  >
+    Congratulations your 
+    reset
+     is completed.
+    <br />
+    Proceed to access your account.
+  </div>
+  <button
+    class="c5"
+    kind="primary"
+    width="100%"
+  >
+    Go to 
+    Cluster
+  </button>
+</div>
+`;
+
+exports[`story.SuccessResetDashboard 1`] = `
+.c5 {
+  line-height: 1.5;
+  margin: 0;
+  display: inline-flex;
+  justify-content: center;
+  align-items: center;
+  box-sizing: border-box;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-family: inherit;
+  font-weight: 600;
+  outline: none;
+  position: relative;
+  text-align: center;
+  text-decoration: none;
+  text-transform: uppercase;
+  transition: all 0.3s;
+  -webkit-font-smoothing: antialiased;
+  color: #000000;
+  background: #9F85FF;
+  min-height: 40px;
+  font-size: 12px;
+  padding: 0px 40px;
+  width: 100%;
+}
+
+.c5:hover,
+.c5:focus {
+  background: #B29DFF;
+}
+
+.c5:active {
+  background: #C5B6FF;
+}
+
+.c5:disabled {
+  background: rgba(255,255,255,0.12);
+  color: rgba(255,255,255,0.3);
+  cursor: auto;
+}
+
+.c0 {
+  box-sizing: border-box;
+  margin-top: 40px;
+  margin-left: auto;
+  margin-right: auto;
+  padding: 40px;
+  width: 540px;
+  background-color: #222C59;
+  text-align: center;
+  box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
+  border-radius: 8px;
+  background-color: #222C59;
+}
+
+.c1 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-weight: 300;
+  font-size: 22px;
+  line-height: 32px;
+  margin: 0px;
+  margin-bottom: 16px;
+}
+
+.c1 color {
+  main: #FFFFFF;
+  slightly-muted: rgba(255,255,255,0.72);
+  muted: rgba(255,255,255,0.54);
+  disabled: rgba(255,255,255,0.36);
+  primary-inverse: #000000;
+}
+
+.c4 {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-size: 14px;
+  margin: 0px;
+  margin-bottom: 24px;
+  color: rgba(255,255,255,0.72);
+}
+
+.c3 {
+  display: block;
+  outline: none;
+  width: 200px;
+  height: 143px;
+}
+
+.c2 {
+  box-sizing: border-box;
+  margin-bottom: 16px;
+  display: flex;
+  justify-content: center;
+}
+
+<div
+  class="c0"
+  width="540px"
+>
+  <div
+    class="c1"
+    color="text"
+    style="text-transform: capitalize;"
+  >
+    reset
+     successful
+  </div>
+  <div
+    class="c2"
+  >
+    <img
+      class="c3"
+      height="143px"
+      src="file_stub"
+      width="200px"
+    />
+  </div>
+  <div
+    class="c4"
+    color="text.slightlyMuted"
+    font-size="2"
+  >
+    Congratulations your 
+    reset
+     is completed.
+    <br />
+    Proceed to access your account.
+  </div>
+  <button
+    class="c5"
+    kind="primary"
+    width="100%"
+  >
+    Go to 
+    Dashboard
+  </button>
+</div>
+`;
diff --git a/web/packages/teleport/src/Welcome/Questionnaire/Company.tsx b/web/packages/teleport/src/Welcome/Questionnaire/Company.tsx
new file mode 100644
index 0000000000000..e489908730432
--- /dev/null
+++ b/web/packages/teleport/src/Welcome/Questionnaire/Company.tsx
@@ -0,0 +1,58 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import { Option } from 'shared/components/Select';
+import FieldInput from 'shared/components/FieldInput';
+import FieldSelect from 'shared/components/FieldSelect';
+import { requiredField } from 'shared/components/Validation/rules';
+
+import { EmployeeSelectOptions } from './constants';
+import { CompanyProps, EmployeeOptionsStrings } from './types';
+
+export const Company = ({
+  updateFields,
+  companyName,
+  numberOfEmployees,
+}: CompanyProps) => (
+  <>
+    <FieldInput
+      label="Company Name"
+      rule={requiredField('Company Name is required')}
+      id="company-name"
+      type="text"
+      value={companyName}
+      placeholder="ex. GitHub"
+      onChange={e => {
+        updateFields({ companyName: e.target.value });
+      }}
+    />
+    <FieldSelect
+      label="Number of Employees"
+      rule={requiredField('Number of Employees is required')}
+      placeholder="Select Team Size"
+      onChange={(e: Option<EmployeeOptionsStrings, string>) =>
+        updateFields({ employeeCount: e.value })
+      }
+      value={
+        numberOfEmployees
+          ? { label: numberOfEmployees, value: numberOfEmployees }
+          : null
+      }
+      options={EmployeeSelectOptions}
+    />
+  </>
+);
diff --git a/web/packages/teleport/src/Welcome/Questionnaire/Questionnaire.story.tsx b/web/packages/teleport/src/Welcome/Questionnaire/Questionnaire.story.tsx
new file mode 100644
index 0000000000000..ff914e5c04a2e
--- /dev/null
+++ b/web/packages/teleport/src/Welcome/Questionnaire/Questionnaire.story.tsx
@@ -0,0 +1,28 @@
+/**
+ * Copyright 2020 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+
+import { Questionnaire } from './Questionnaire';
+
+export default {
+  title: 'Teleport/Welcome/Questionnaire',
+  args: { userContext: true },
+};
+
+export const Loaded = () => {
+  return <Questionnaire username="" />;
+};
diff --git a/web/packages/teleport/src/Welcome/Questionnaire/Questionnaire.test.tsx b/web/packages/teleport/src/Welcome/Questionnaire/Questionnaire.test.tsx
new file mode 100644
index 0000000000000..200505b147537
--- /dev/null
+++ b/web/packages/teleport/src/Welcome/Questionnaire/Questionnaire.test.tsx
@@ -0,0 +1,44 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import { render, screen } from 'design/utils/testing';
+
+import { mockUserContextProviderWith } from 'teleport/User/testHelpers/mockUserContextWith';
+import { makeTestUserContext } from 'teleport/User/testHelpers/makeTestUserContext';
+
+import { Questionnaire } from './Questionnaire';
+
+describe('questionnaire', () => {
+  beforeEach(() => {
+    mockUserContextProviderWith(makeTestUserContext());
+  });
+
+  test('loads each question', () => {
+    render(<Questionnaire username="" />);
+
+    expect(screen.getByText('Tell us about yourself')).toBeInTheDocument();
+    expect(screen.getByLabelText('Company Name')).toBeInTheDocument();
+    expect(screen.getByLabelText('Number of Employees')).toBeInTheDocument();
+    expect(screen.getByLabelText('Which Team are you on?')).toBeInTheDocument();
+    expect(screen.getByLabelText('Job Title')).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        'Which infrastructure resources do you need to access frequently?'
+      )
+    ).toBeInTheDocument();
+  });
+});
diff --git a/web/packages/teleport/src/Welcome/Questionnaire/Questionnaire.tsx b/web/packages/teleport/src/Welcome/Questionnaire/Questionnaire.tsx
new file mode 100644
index 0000000000000..2495e12b0d00b
--- /dev/null
+++ b/web/packages/teleport/src/Welcome/Questionnaire/Questionnaire.tsx
@@ -0,0 +1,111 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { useState } from 'react';
+import { ButtonPrimary, Card, Text } from 'design';
+import Validation, { Validator } from 'shared/components/Validation';
+
+import { useUser } from 'teleport/User/UserContext';
+import { CaptureEvent, userEventService } from 'teleport/services/userEvent';
+
+import { QuestionnaireFormFields, QuestionnaireProps } from './types';
+import { Company } from './Company';
+import { Role } from './Role';
+import { Resources } from './Resources';
+import { supportedResources } from './constants';
+
+export const Questionnaire = ({
+  username,
+}: QuestionnaireProps): React.ReactElement => {
+  const { updatePreferences } = useUser();
+  const [formFields, setFormFields] = useState<QuestionnaireFormFields>({
+    companyName: '',
+    employeeCount: undefined,
+    team: undefined,
+    role: undefined,
+    resources: [],
+  });
+
+  const updateForm = (fields: Partial<QuestionnaireFormFields>) => {
+    setFormFields({
+      role: fields.role ?? formFields.role,
+      team: fields.team ?? formFields.team,
+      resources: fields.resources ?? formFields.resources,
+      companyName: fields.companyName ?? formFields.companyName,
+      employeeCount: fields.employeeCount ?? formFields.employeeCount,
+    });
+  };
+
+  const submitForm = (validator: Validator) => {
+    if (!validator.validate()) {
+      return;
+    }
+
+    // submit Posthog event
+    userEventService.capturePreUserEvent({
+      event: CaptureEvent.PreUserOnboardQuestionnaireSubmitEvent,
+      username: username,
+    });
+
+    void updatePreferences({
+      onboard: {
+        preferredResources: formFields.resources,
+      },
+    });
+
+    // todo (michellescripts) submit all Qs to Sales Center
+    // todo (michellescripts) set resource Q on user state
+  };
+
+  // todo (michellescripts) only display <Company .../> if the survey is unanswered for the account
+  return (
+    <Card mx="auto" maxWidth="600px" p="4">
+      <Text typography="h2" mb={4}>
+        Tell us about yourself
+      </Text>
+      <Validation>
+        {({ validator }) => (
+          <>
+            <Company
+              companyName={formFields.companyName}
+              numberOfEmployees={formFields.employeeCount}
+              updateFields={updateForm}
+            />
+            <Role
+              role={formFields.role}
+              team={formFields.team}
+              updateFields={updateForm}
+            />
+            <Resources
+              resources={supportedResources}
+              checked={formFields.resources}
+              updateFields={updateForm}
+            />
+
+            <ButtonPrimary
+              mt={3}
+              width="100%"
+              size="large"
+              onClick={() => submitForm(validator)}
+            >
+              Submit
+            </ButtonPrimary>
+          </>
+        )}
+      </Validation>
+    </Card>
+  );
+};
diff --git a/web/packages/teleport/src/Welcome/Questionnaire/ResourceWrapper.ts b/web/packages/teleport/src/Welcome/Questionnaire/ResourceWrapper.ts
new file mode 100644
index 0000000000000..44848ed7bce10
--- /dev/null
+++ b/web/packages/teleport/src/Welcome/Questionnaire/ResourceWrapper.ts
@@ -0,0 +1,41 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import styled from 'styled-components';
+import { Flex } from 'design';
+
+export const ResourceWrapper = styled(Flex)`
+  flex-direction: column;
+  height: 100%;
+  background-color: ${props => props.theme.colors.levels.surface};
+  padding: 12px 0;
+  gap: 16px;
+  border-radius: ${props => props.theme.radii[2]}px;
+
+  &:hover {
+    background-color: ${props => props.theme.colors.spotBackground[0]};
+  }
+
+  border: ${({ isSelected, invalid, theme }) => {
+    if (isSelected) {
+      return `1px solid ${theme.colors.brand}`;
+    }
+    if (invalid) {
+      return `1px solid ${theme.colors.error.main}`;
+    }
+    return `1px solid ${theme.colors.levels.elevated}`;
+  }};
+`;
diff --git a/web/packages/teleport/src/Welcome/Questionnaire/Resources.tsx b/web/packages/teleport/src/Welcome/Questionnaire/Resources.tsx
new file mode 100644
index 0000000000000..28ddf6e4644eb
--- /dev/null
+++ b/web/packages/teleport/src/Welcome/Questionnaire/Resources.tsx
@@ -0,0 +1,102 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Flex, LabelInput, Text } from 'design';
+import React from 'react';
+import Image from 'design/Image';
+import { CheckboxInput } from 'design/Checkbox';
+import { useRule } from 'shared/components/Validation';
+
+import { requiredResourceField } from 'teleport/Welcome/Questionnaire/constants';
+
+import { ResourcesProps, ResourceType, Resource } from './types';
+import { ResourceWrapper } from './ResourceWrapper';
+
+export const Resources = ({
+  resources,
+  checked,
+  updateFields,
+}: ResourcesProps) => {
+  const { valid, message } = useRule(requiredResourceField(checked));
+
+  const updateResources = (label: Resource) => {
+    let updated = checked;
+    if (updated.includes(label)) {
+      updated = updated.filter(r => r !== label);
+    } else {
+      updated.push(label);
+    }
+
+    updateFields({ resources: updated });
+  };
+
+  const renderCheck = (resource: ResourceType) => {
+    const isSelected = checked.includes(resource.label);
+    return (
+      <label
+        htmlFor={`box-${resource.label}`}
+        data-testid={`box-${resource.label}`}
+        key={resource.label}
+        style={{
+          width: '100%',
+          height: '100%',
+        }}
+        onClick={() => updateResources(resource.label)}
+      >
+        <ResourceWrapper isSelected={isSelected} invalid={!valid}>
+          <CheckboxInput
+            aria-labelledby="resources"
+            role="checkbox"
+            type="checkbox"
+            name={resource.label}
+            readOnly
+            checked={checked.includes(resource.label)}
+            rule={requiredResourceField(checked)}
+            style={{
+              alignSelf: 'flex-end',
+            }}
+          />
+          <Flex
+            flexDirection="column"
+            alignItems="center"
+            justifyContent="center"
+          >
+            <Image src={resource.image} height="64px" width="64px" />
+            <Text textAlign="center" typography="body3">
+              {resource.label}
+            </Text>
+          </Flex>
+        </ResourceWrapper>
+      </label>
+    );
+  };
+
+  return (
+    <>
+      <Flex gap={1} mb={1}>
+        <LabelInput htmlFor={'resources'} hasError={!valid}>
+          {valid
+            ? `Which infrastructure resources do you need to access frequently?`
+            : message}
+          <i>&nbsp;Select all that apply.</i>
+        </LabelInput>
+      </Flex>
+      <Flex gap={2} alignItems="flex-start" height="170px">
+        {resources.map((r: ResourceType) => renderCheck(r))}
+      </Flex>
+    </>
+  );
+};
diff --git a/web/packages/teleport/src/Welcome/Questionnaire/Role.tsx b/web/packages/teleport/src/Welcome/Questionnaire/Role.tsx
new file mode 100644
index 0000000000000..8491e2c678477
--- /dev/null
+++ b/web/packages/teleport/src/Welcome/Questionnaire/Role.tsx
@@ -0,0 +1,48 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import { Option } from 'shared/components/Select';
+import FieldSelect from 'shared/components/FieldSelect';
+import { requiredField } from 'shared/components/Validation/rules';
+
+import { RoleProps, TeamOptionsStrings, TitleOptionsStrings } from './types';
+import { teamSelectOptions, titleSelectOptions } from './constants';
+
+export const Role = ({ team, role, updateFields }: RoleProps) => (
+  <>
+    <FieldSelect
+      label="Which Team are you on?"
+      rule={requiredField('Team is required')}
+      placeholder="Select Team"
+      onChange={(e: Option<TeamOptionsStrings, string>) =>
+        updateFields({ team: e.value })
+      }
+      options={teamSelectOptions}
+      value={team ? { label: team, value: team } : null}
+    />
+    <FieldSelect
+      label="Job Title"
+      rule={requiredField('Job Title is required')}
+      placeholder="Select Job Title"
+      onChange={(e: Option<TitleOptionsStrings, string>) =>
+        updateFields({ role: e.value })
+      }
+      options={titleSelectOptions}
+      value={role ? { label: role, value: role } : null}
+    />
+  </>
+);
diff --git a/web/packages/teleport/src/Welcome/Questionnaire/constants.ts b/web/packages/teleport/src/Welcome/Questionnaire/constants.ts
new file mode 100644
index 0000000000000..04a205a939394
--- /dev/null
+++ b/web/packages/teleport/src/Welcome/Questionnaire/constants.ts
@@ -0,0 +1,101 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import application from 'design/assets/resources/appplication.png';
+import desktop from 'design/assets/resources/desktop.png';
+import database from 'design/assets/resources/database.png';
+import stack from 'design/assets/resources/stack.png';
+import { Option } from 'shared/components/Select';
+
+import {
+  EmployeeOptionsStrings,
+  Resource,
+  TeamOptionsStrings,
+  TitleOptionsStrings,
+} from './types';
+
+export enum EmployeeOptions {
+  '0-19',
+  '20-199',
+  '200-499',
+  '500-999',
+  '1000-4999',
+  '5000+',
+}
+
+export const EmployeeSelectOptions: Option<
+  EmployeeOptionsStrings,
+  EmployeeOptionsStrings
+>[] = Object.values(EmployeeOptions)
+  .filter(v => !isNaN(Number(v)))
+  .map(key => ({
+    value: EmployeeOptions[key],
+    label: EmployeeOptions[key],
+  }));
+
+export enum TeamOptions {
+  'Software Engineering',
+  'DevOps Engineering',
+  'IT',
+  'Support',
+  'Finance',
+  'Legal',
+  'Other (free-form field)',
+}
+
+export const teamSelectOptions: Option<
+  TeamOptionsStrings,
+  TeamOptionsStrings
+>[] = Object.values(TeamOptions)
+  .filter(v => !isNaN(Number(v)))
+  .map(key => ({
+    value: TeamOptions[key],
+    label: TeamOptions[key],
+  }));
+
+export enum TitleOptions {
+  'Individual contributor',
+  'Manager',
+  'Director',
+  'VP',
+  'C-Suite/Owner',
+}
+
+export const titleSelectOptions: Option<
+  TitleOptionsStrings,
+  TitleOptionsStrings
+>[] = Object.values(TitleOptions)
+  .filter(v => !isNaN(Number(v)))
+  .map(key => ({
+    value: TitleOptions[key],
+    label: TitleOptions[key],
+  }));
+
+export const supportedResources = [
+  { label: Resource.RESOURCE_WEB_APPLICATIONS, image: application },
+  { label: Resource.RESOURCE_WINDOWS_DESKTOPS, image: desktop },
+  { label: Resource.RESOURCE_SERVER_SSH, image: stack },
+  { label: Resource.RESOURCE_DATABASES, image: database },
+  { label: Resource.RESOURCE_KUBERNETES, image: stack },
+];
+
+export const requiredResourceField = (value: Resource[]) => () => {
+  const valid = !!value.length;
+  return {
+    valid,
+    message: 'Resource is required',
+  };
+};
diff --git a/web/packages/teleport/src/Welcome/Questionnaire/types.ts b/web/packages/teleport/src/Welcome/Questionnaire/types.ts
new file mode 100644
index 0000000000000..bb2e117622eef
--- /dev/null
+++ b/web/packages/teleport/src/Welcome/Questionnaire/types.ts
@@ -0,0 +1,65 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { EmployeeOptions, TeamOptions, TitleOptions } from './constants';
+
+export type QuestionnaireProps = {
+  username: string;
+};
+
+export type QuestionProps = {
+  updateFields: (fields: Partial<QuestionnaireFormFields>) => void;
+};
+
+export type CompanyProps = QuestionProps & {
+  companyName: string;
+  numberOfEmployees: EmployeeOptionsStrings;
+};
+
+export type RoleProps = QuestionProps & {
+  role: TitleOptionsStrings;
+  team: TeamOptionsStrings;
+};
+
+export type ResourceType = {
+  label: Resource;
+  image: string;
+};
+
+export type ResourcesProps = QuestionProps & {
+  resources: ResourceType[];
+  checked: Resource[];
+};
+
+export enum Resource {
+  RESOURCE_WINDOWS_DESKTOPS = 'Windows Desktops',
+  RESOURCE_SERVER_SSH = 'Server/SSH',
+  RESOURCE_DATABASES = 'Databases',
+  RESOURCE_KUBERNETES = 'Kubernetes',
+  RESOURCE_WEB_APPLICATIONS = 'Web Applications',
+}
+
+export type QuestionnaireFormFields = {
+  companyName: string;
+  employeeCount: EmployeeOptionsStrings;
+  role: TitleOptionsStrings;
+  team: TeamOptionsStrings;
+  resources: Resource[];
+};
+
+export type EmployeeOptionsStrings = keyof typeof EmployeeOptions;
+export type TeamOptionsStrings = keyof typeof TeamOptions;
+export type TitleOptionsStrings = keyof typeof TitleOptions;
diff --git a/web/packages/teleport/src/components/BannerList/BannerList.test.tsx b/web/packages/teleport/src/components/BannerList/BannerList.test.tsx
index 7555d03375272..0d11fddca1ac4 100644
--- a/web/packages/teleport/src/components/BannerList/BannerList.test.tsx
+++ b/web/packages/teleport/src/components/BannerList/BannerList.test.tsx
@@ -15,12 +15,22 @@ limitations under the License.
 */
 
 import React from 'react';
-import { render, fireEvent, screen } from 'design/utils/testing';
+import {
+  fireEvent,
+  screen,
+  render as testingRender,
+} from 'design/utils/testing';
+
+import { LayoutContextProvider } from 'teleport/Main/LayoutContext';
 
 import { BannerList } from './BannerList';
 
 import type { BannerType } from './BannerList';
 
+function render(banner: React.ReactNode) {
+  return testingRender(<LayoutContextProvider>{banner}</LayoutContextProvider>);
+}
+
 describe('components/BannerList/Banner', () => {
   let banners: BannerType[] = null;
   beforeEach(() => {
diff --git a/web/packages/teleport/src/components/BannerList/BannerList.tsx b/web/packages/teleport/src/components/BannerList/BannerList.tsx
index 71b884f9fb0ec..58a602349d0b3 100644
--- a/web/packages/teleport/src/components/BannerList/BannerList.tsx
+++ b/web/packages/teleport/src/components/BannerList/BannerList.tsx
@@ -21,6 +21,8 @@ import { Box } from 'design';
 
 import { MainContainer } from 'teleport/Main/MainContainer';
 
+import { useLayout } from 'teleport/Main/LayoutContext';
+
 import { Banner } from './Banner';
 
 import type { Severity } from './Banner';
@@ -33,6 +35,8 @@ export const BannerList = ({
   billingBanners = [],
   onBannerDismiss = () => {},
 }: Props) => {
+  const { hasDockedElement } = useLayout();
+
   const [bannerData, setBannerData] = useState<{ [id: string]: BannerType }>(
     {}
   );
@@ -58,6 +62,7 @@ export const BannerList = ({
 
   return (
     <Wrapper
+      hasDockedElement={hasDockedElement}
       bannerCount={
         shownBanners.length + customBanners.length + billingBanners.length
       }
@@ -79,10 +84,11 @@ export const BannerList = ({
   );
 };
 
-const Wrapper = styled(Box)`
+const Wrapper = styled(Box)<{ bannerCount: number; hasDockedElement: boolean }>`
   display: flex;
   height: 100vh;
   flex-direction: column;
+  width: ${p => (p.hasDockedElement ? 'calc(100vw - 520px)' : '100vw')};
 
   ${MainContainer} {
     flex: 1;
diff --git a/web/packages/teleport/src/components/ButtonLockedFeature/ButtonLockedFeature.test.tsx b/web/packages/teleport/src/components/ButtonLockedFeature/ButtonLockedFeature.test.tsx
index 60cb1f2718cdf..514fe7be2a48b 100644
--- a/web/packages/teleport/src/components/ButtonLockedFeature/ButtonLockedFeature.test.tsx
+++ b/web/packages/teleport/src/components/ButtonLockedFeature/ButtonLockedFeature.test.tsx
@@ -53,7 +53,7 @@ describe('buttonLockedFeature', () => {
     );
     expect(screen.getByText('text').closest('a')).toHaveAttribute(
       'href',
-      `https://goteleport.com/r/upgrade-team?${version}&campaign=undefined`
+      `https://goteleport.com/r/upgrade-team?${version}&utm_campaign=undefined`
     );
 
     renderWithContext(
@@ -63,7 +63,7 @@ describe('buttonLockedFeature', () => {
     );
     expect(screen.getByText('othertext').closest('a')).toHaveAttribute(
       'href',
-      `https://goteleport.com/r/upgrade-team?${version}&campaign=${
+      `https://goteleport.com/r/upgrade-team?${version}&utm_campaign=${
         CtaEvent[CtaEvent.CTA_ACCESS_REQUESTS]
       }`
     );
diff --git a/web/packages/teleport/src/components/ButtonLockedFeature/ButtonLockedFeature.tsx b/web/packages/teleport/src/components/ButtonLockedFeature/ButtonLockedFeature.tsx
index 0209066a6aca2..0cf7db3debab8 100644
--- a/web/packages/teleport/src/components/ButtonLockedFeature/ButtonLockedFeature.tsx
+++ b/web/packages/teleport/src/components/ButtonLockedFeature/ButtonLockedFeature.tsx
@@ -55,6 +55,7 @@ export function ButtonLockedFeature({
       py="12px"
       width="100%"
       style={{ textTransform: 'none' }}
+      rel="noreferrer"
       {...rest}
     >
       <Flex alignItems="center">
@@ -70,12 +71,14 @@ function getParams(
   isEnterprise: boolean,
   event: CtaEvent
 ): string {
-  return `${isEnterprise ? 'e_' : ''}${version}&campaign=${CtaEvent[event]}`;
+  return `${isEnterprise ? 'e_' : ''}${version}&utm_campaign=${
+    CtaEvent[event]
+  }`;
 }
 
 const UnlockIcon = styled(Unlock)`
   color: inherit;
   font-weight: 500;
   font-size: 15px;
-  margin-right: 4px;
+  margin-right: 10px;
 `;
diff --git a/web/packages/teleport/src/components/Empty/Empty.tsx b/web/packages/teleport/src/components/Empty/Empty.tsx
index 9e5a5a49215d9..3432c8f733994 100644
--- a/web/packages/teleport/src/components/Empty/Empty.tsx
+++ b/web/packages/teleport/src/components/Empty/Empty.tsx
@@ -20,12 +20,12 @@ import { Link } from 'react-router-dom';
 import { Text, Box, Flex, ButtonPrimary, ButtonBorder } from 'design';
 import Image from 'design/Image';
 
-import cfg from 'teleport/config';
+import application from 'design/assets/resources/appplication.png';
+import database from 'design/assets/resources/database.png';
+import desktop from 'design/assets/resources/desktop.png';
+import stack from 'design/assets/resources/stack.png';
 
-import application from './assets/appplication.png';
-import database from './assets/database.png';
-import desktop from './assets/desktop.png';
-import stack from './assets/stack.png';
+import cfg from 'teleport/config';
 
 type ResourceType =
   | 'application'
diff --git a/web/packages/teleport/src/components/FormLogin/FormLogin.tsx b/web/packages/teleport/src/components/FormLogin/FormLogin.tsx
index ece7dd9b5eeab..0e5057b032d0a 100644
--- a/web/packages/teleport/src/components/FormLogin/FormLogin.tsx
+++ b/web/packages/teleport/src/components/FormLogin/FormLogin.tsx
@@ -74,7 +74,7 @@ export default function LoginForm(props: Props) {
   // and display sso providers if any.
   if (!isLocalAuthEnabled && ssoEnabled) {
     return (
-      <Card bg="levels.surface" my="5" mx="auto" width="464px" pb={4}>
+      <Card my="5" mx="auto" width="464px" pb={4}>
         <Text typography="h3" pt={4} textAlign="center">
           {title}
         </Text>
@@ -90,7 +90,7 @@ export default function LoginForm(props: Props) {
 
   if (!isLocalAuthEnabled) {
     return (
-      <Card bg="levels.surface" my="5" mx="auto" width="464px" px={5} pb={4}>
+      <Card my="5" mx="auto" width="464px" px={5} pb={4}>
         <Text typography="h3" pt={4} textAlign="center">
           {title}
         </Text>
@@ -105,7 +105,7 @@ export default function LoginForm(props: Props) {
 
   // Everything below requires local auth to be enabled.
   return (
-    <Card bg="levels.surface" my="5" mx="auto" width={464} pb={4}>
+    <Card my="5" mx="auto" width={464} pb={4}>
       <Text typography="h3" pt={4} textAlign="center">
         {title}
       </Text>
diff --git a/web/packages/teleport/src/components/FormLogin/__snapshots__/FormLogin.story.test.tsx.snap b/web/packages/teleport/src/components/FormLogin/__snapshots__/FormLogin.story.test.tsx.snap
index 12b4ebc058b59..689bd6e829322 100644
--- a/web/packages/teleport/src/components/FormLogin/__snapshots__/FormLogin.story.test.tsx.snap
+++ b/web/packages/teleport/src/components/FormLogin/__snapshots__/FormLogin.story.test.tsx.snap
@@ -68,9 +68,9 @@ exports[`auth2faType: off 1`] = `
   margin-bottom: 32px;
   padding-bottom: 24px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c1 {
@@ -345,9 +345,9 @@ exports[`auth2faType: optional rendering 1`] = `
   margin-bottom: 32px;
   padding-bottom: 24px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c1 {
@@ -878,9 +878,9 @@ exports[`auth2faType: otp rendering 1`] = `
   margin-bottom: 32px;
   padding-bottom: 24px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c1 {
@@ -1424,9 +1424,9 @@ exports[`auth2faType: webauthn rendering 1`] = `
   margin-bottom: 32px;
   padding-bottom: 24px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c1 {
@@ -2031,9 +2031,9 @@ exports[`cloud auth2faType: on rendering 1`] = `
   margin-bottom: 32px;
   padding-bottom: 24px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c1 {
@@ -2534,9 +2534,9 @@ exports[`no login enabled 1`] = `
   padding-left: 32px;
   padding-right: 32px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c1 {
@@ -2675,9 +2675,9 @@ exports[`server error rendering 1`] = `
   margin-bottom: 32px;
   padding-bottom: 24px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c1 {
@@ -2994,9 +2994,9 @@ exports[`sso list still renders when local auth is disabled 1`] = `
   margin-bottom: 32px;
   padding-bottom: 24px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c1 {
@@ -3279,9 +3279,9 @@ exports[`sso providers rendering 1`] = `
   margin-bottom: 32px;
   padding-bottom: 24px;
   width: 464px;
-  background-color: #222C59;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c1 {
diff --git a/web/packages/teleport/src/components/PrivateKeyPolicy/PrivateKeyPolicy.tsx b/web/packages/teleport/src/components/PrivateKeyPolicy/PrivateKeyPolicy.tsx
index 729b68d7d6b37..9e4cb8c20ec24 100644
--- a/web/packages/teleport/src/components/PrivateKeyPolicy/PrivateKeyPolicy.tsx
+++ b/web/packages/teleport/src/components/PrivateKeyPolicy/PrivateKeyPolicy.tsx
@@ -49,7 +49,7 @@ export const PrivateKeyLoginDisabledCard = ({
   // lost password or two-factor device.
   onRecover?: (isRecoverPassword: boolean) => void;
 }) => (
-  <Card bg="levels.surface" my="5" mx="auto" width="464px" px={5} pb={4}>
+  <Card my="5" mx="auto" width="464px" px={5} pb={4}>
     <Text typography="h3" pt={4} textAlign="center" color="text.main">
       {title}
     </Text>
diff --git a/web/packages/teleport/src/components/RecoveryCodes/__snapshots__/RecoveryCodes.story.test.tsx.snap b/web/packages/teleport/src/components/RecoveryCodes/__snapshots__/RecoveryCodes.story.test.tsx.snap
index 07c265ae43d10..05999b1849b02 100644
--- a/web/packages/teleport/src/components/RecoveryCodes/__snapshots__/RecoveryCodes.story.test.tsx.snap
+++ b/web/packages/teleport/src/components/RecoveryCodes/__snapshots__/RecoveryCodes.story.test.tsx.snap
@@ -147,11 +147,11 @@ exports[`render correct dialog after creating a new account 1`] = `
   min-width: 584px;
   margin-left: auto;
   margin-right: auto;
-  background-color: #222C59;
   border-radius: 8px;
   overflow: hidden;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c5 {
@@ -217,7 +217,6 @@ exports[`render correct dialog after creating a new account 1`] = `
   min-width: 584px;
   margin-left: auto;
   margin-right: auto;
-  background-color: levels.surface;
   border-radius: 8px;
   overflow: hidden;
   display: flex;
@@ -566,11 +565,11 @@ exports[`render correct dialog after resetting account 1`] = `
   min-width: 584px;
   margin-left: auto;
   margin-right: auto;
-  background-color: #222C59;
   border-radius: 8px;
   overflow: hidden;
   box-shadow: 0px 3px 5px -1px rgba(0,0,0,0.2),0px 6px 10px rgba(0,0,0,0.14),0px 1px 18px rgba(0,0,0,0.12);
   border-radius: 8px;
+  background-color: #222C59;
 }
 
 .c5 {
@@ -636,7 +635,6 @@ exports[`render correct dialog after resetting account 1`] = `
   min-width: 584px;
   margin-left: auto;
   margin-right: auto;
-  background-color: levels.surface;
   border-radius: 8px;
   overflow: hidden;
   display: flex;
diff --git a/web/packages/teleport/src/components/ToolTipNoPermBadge/ToolTipNoPermBadge.tsx b/web/packages/teleport/src/components/ToolTipNoPermBadge/ToolTipNoPermBadge.tsx
index 8e0c126fc9335..8d1314a1c1c2f 100644
--- a/web/packages/teleport/src/components/ToolTipNoPermBadge/ToolTipNoPermBadge.tsx
+++ b/web/packages/teleport/src/components/ToolTipNoPermBadge/ToolTipNoPermBadge.tsx
@@ -46,13 +46,13 @@ export const ToolTipNoPermBadge: React.FC<Props> = ({
         onMouseLeave={handlePopoverClose}
         borderTopRightRadius={borderRadius}
         borderBottomLeftRadius={borderRadius}
-        bg="red"
         css={`
           position: absolute;
           padding: 0px 6px;
           top: 0px;
           right: 0px;
           font-size: 10px;
+          background-color: ${p => p.theme.colors.error.main};
         `}
       >
         Lacking Permissions
diff --git a/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.story.tsx b/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.story.tsx
index 074b5fbc122e3..8bd51c18cc8ca 100644
--- a/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.story.tsx
+++ b/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.story.tsx
@@ -18,16 +18,36 @@ import React from 'react';
 import { MemoryRouter } from 'react-router';
 import * as Icons from 'design/Icon';
 
+import TeleportContextProvider from 'teleport/TeleportContextProvider';
+import TeleportContext from 'teleport/teleportContext';
+import { makeUserContext } from 'teleport/services/user';
+import { FeaturesContextProvider } from 'teleport/FeaturesContext';
+import { getOSSFeatures } from 'teleport/features';
+
 import { UserMenuNav } from './UserMenuNav';
 
 export default {
   title: 'Teleport/UserMenuNav',
+  args: { userContext: true },
 };
 
 export function Loaded() {
+  const ctx = new TeleportContext();
+
+  ctx.storeUser.state = makeUserContext({
+    cluster: {
+      name: 'test-cluster',
+      lastConnected: Date.now(),
+    },
+  });
+
   return (
     <MemoryRouter>
-      <UserMenuNav {...props} />
+      <TeleportContextProvider ctx={ctx}>
+        <FeaturesContextProvider value={getOSSFeatures()}>
+          <UserMenuNav {...props} />
+        </FeaturesContextProvider>
+      </TeleportContextProvider>
     </MemoryRouter>
   );
 }
diff --git a/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.test.tsx b/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.test.tsx
index b50ac25898b1e..57be57925a6b8 100644
--- a/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.test.tsx
+++ b/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.test.tsx
@@ -17,6 +17,9 @@
 import React from 'react';
 import { MemoryRouter } from 'react-router';
 
+import { setupServer } from 'msw/node';
+import { rest } from 'msw';
+
 import {
   render as testingRender,
   screen,
@@ -33,8 +36,32 @@ import TeleportContext from 'teleport/teleportContext';
 
 import { makeUserContext } from 'teleport/services/user';
 
+import { ThemePreference } from 'teleport/services/userPreferences/types';
+
+import { mockUserContextProviderWith } from 'teleport/User/testHelpers/mockUserContextWith';
+import { makeTestUserContext } from 'teleport/User/testHelpers/makeTestUserContext';
+
 import { UserMenuNav } from './UserMenuNav';
 
+const server = setupServer(
+  rest.get(cfg.api.userPreferencesPath, (req, res, ctx) => {
+    return res(
+      ctx.json({
+        theme: ThemePreference.Light,
+        assist: {},
+      })
+    );
+  })
+);
+
+beforeAll(() => server.listen());
+
+beforeEach(() => mockUserContextProviderWith(makeTestUserContext()));
+
+afterEach(() => server.resetHandlers());
+
+afterAll(() => server.close());
+
 describe('navigation items rendering', () => {
   test.each`
     path                  | menuName
@@ -42,11 +69,11 @@ describe('navigation items rendering', () => {
     ${cfg.routes.support} | ${'Help & Support'}
   `(
     'there is an element `$menuName` that links to `$path`',
-    ({ path, menuName }) => {
+    async ({ path, menuName }) => {
       render(path);
 
       // Click on dropdown menu.
-      fireEvent.click(screen.getByText(/llama/i));
+      fireEvent.click(await screen.findByText(/llama/i));
 
       // Only one checkmark should be rendered at a time.
       const targetEl = screen.getByText(menuName);
diff --git a/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.tsx b/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.tsx
index 38424158be74d..c00e249b99d70 100644
--- a/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.tsx
+++ b/web/packages/teleport/src/components/UserMenuNav/UserMenuNav.tsx
@@ -17,7 +17,7 @@
 import React, { useCallback, useEffect, useRef, useState } from 'react';
 import styled, { css } from 'styled-components';
 
-import { Sun, Moon } from 'design/Icon';
+import { Moon, Sun } from 'design/Icon';
 import { ChevronDownIcon } from 'design/SVGIcon/ChevronDown';
 import { Text } from 'design';
 import { LogoutIcon } from 'design/SVGIcon';
@@ -26,7 +26,8 @@ import { NavLink } from 'react-router-dom';
 import session from 'teleport/services/websession';
 import { useFeatures } from 'teleport/FeaturesContext';
 import { useTeleport } from 'teleport';
-import storage from 'teleport/services/localStorage/localStorage';
+import { useUser } from 'teleport/User/UserContext';
+import { ThemePreference } from 'teleport/services/userPreferences/types';
 
 interface UserMenuNavProps {
   username: string;
@@ -169,19 +170,21 @@ const DropdownDivider = styled.div`
 export function UserMenuNav({ username }: UserMenuNavProps) {
   const [open, setOpen] = useState(false);
 
+  const { preferences, updatePreferences } = useUser();
+
   const ref = useRef<HTMLDivElement>();
 
   const ctx = useTeleport();
   const clusterId = ctx.storeUser.getClusterId();
   const features = useFeatures();
 
-  const currentThemeOption = storage.getThemeOption();
   const onThemeChange = () => {
-    if (currentThemeOption === 'dark') {
-      storage.setThemeOption('light');
-    } else {
-      storage.setThemeOption('dark');
-    }
+    const nextTheme =
+      preferences.theme === ThemePreference.Light
+        ? ThemePreference.Dark
+        : ThemePreference.Light;
+
+    updatePreferences({ theme: nextTheme });
     setOpen(false);
   };
 
@@ -259,9 +262,11 @@ export function UserMenuNav({ username }: UserMenuNavProps) {
         >
           <DropdownItemButton onClick={onThemeChange}>
             <DropdownItemIcon>
-              {currentThemeOption === 'dark' ? <Sun /> : <Moon />}
+              {preferences.theme === ThemePreference.Light ? <Sun /> : <Moon />}
             </DropdownItemIcon>
-            Switch to {currentThemeOption === 'dark' ? 'Light' : 'Dark'} Theme
+            Switch to{' '}
+            {preferences.theme === ThemePreference.Dark ? 'Light' : 'Dark'}{' '}
+            Theme
           </DropdownItemButton>
         </DropdownItem>
         <DropdownItem
diff --git a/web/packages/teleport/src/config.ts b/web/packages/teleport/src/config.ts
index 67edd2b64f8c9..1196b7c207199 100644
--- a/web/packages/teleport/src/config.ts
+++ b/web/packages/teleport/src/config.ts
@@ -37,6 +37,8 @@ import type { ParticipantMode } from 'teleport/services/session';
 const cfg = {
   isEnterprise: false,
   isCloud: false,
+  assistEnabled: false,
+  automaticUpgrades: false,
   isDashboard: false,
   tunnelPublicAddress: '',
   recoveryCodesEnabled: false,
@@ -64,6 +66,8 @@ const cfg = {
     authType: 'local' as AuthType,
     preferredLocalMfa: '' as PreferredMfaType,
     privateKeyPolicy: 'none' as PrivateKeyPolicy,
+    // motd is message of the day, displayed to users before login.
+    motd: '',
   },
 
   proxyCluster: 'localhost',
@@ -223,6 +227,8 @@ const cfg = {
     thumbprintPath: '/v1/webapi/thumbprint',
     awsRdsDbListPath:
       '/v1/webapi/sites/:clusterId/integrations/aws-oidc/:name/databases',
+    awsDeployTeleportServicePath:
+      '/v1/webapi/sites/:clusterId/integrations/aws-oidc/:name/deployservice',
 
     userGroupsListPath:
       '/v1/webapi/sites/:clusterId/user-groups?searchAsRoles=:searchAsRoles?&limit=:limit?&startKey=:startKey?&query=:query?&search=:search?&sort=:sort?',
@@ -237,6 +243,7 @@ const cfg = {
       '/v1/webapi/assistant/conversations/:conversationId',
     assistExecuteCommandWebSocketPath:
       'wss://:hostname/v1/webapi/command/:clusterId/execute',
+    userPreferencesPath: '/v1/webapi/user/preferences',
   },
 
   getAppFqdnUrl(params: UrlAppParams) {
@@ -278,6 +285,10 @@ const cfg = {
     return cfg.auth ? cfg.auth.preferredLocalMfa : null;
   },
 
+  getMotd() {
+    return cfg.auth.motd;
+  },
+
   getLocalAuthFlag() {
     return cfg.auth.localAuthEnabled;
   },
@@ -663,6 +674,15 @@ const cfg = {
     });
   },
 
+  getAwsDeployTeleportServiceUrl(integrationName: string) {
+    const clusterId = cfg.proxyCluster;
+
+    return generatePath(cfg.api.awsDeployTeleportServicePath, {
+      clusterId,
+      name: integrationName,
+    });
+  },
+
   getUserGroupsListUrl(clusterId: string, params: UrlResourcesParams) {
     return generateResourcePath(cfg.api.userGroupsListPath, {
       clusterId,
diff --git a/web/packages/teleport/src/features.tsx b/web/packages/teleport/src/features.tsx
index e49d12e3b5183..487fa9938fcc2 100644
--- a/web/packages/teleport/src/features.tsx
+++ b/web/packages/teleport/src/features.tsx
@@ -68,7 +68,6 @@ const Integrations = lazy(() => import('./Integrations'));
 const IntegrationEnroll = lazy(
   () => import('@gravitational/teleport/src/Integrations/Enroll')
 );
-const Assist = lazy(() => import('./Assist'));
 
 // ****************************
 // Resource Features
@@ -366,6 +365,10 @@ export class FeatureDiscover implements TeleportFeature {
   hasAccess(flags: FeatureFlags) {
     return flags.discover;
   }
+
+  getRoute() {
+    return this.route;
+  }
 }
 
 export class FeatureIntegrations implements TeleportFeature {
@@ -573,21 +576,6 @@ export class FeatureHelpAndSupport implements TeleportFeature {
   };
 }
 
-export class FeatureAssist implements TeleportFeature {
-  category = NavigationCategory.Assist;
-
-  route = {
-    title: 'Assist',
-    path: cfg.routes.assist,
-    exact: false,
-    component: Assist,
-  };
-
-  hasAccess(flags: FeatureFlags) {
-    return flags.assist;
-  }
-}
-
 export function getOSSFeatures(): TeleportFeature[] {
   return [
     // Resources
@@ -621,6 +609,5 @@ export function getOSSFeatures(): TeleportFeature[] {
     // Other
     new FeatureAccount(),
     new FeatureHelpAndSupport(),
-    new FeatureAssist(),
   ];
 }
diff --git a/web/packages/teleport/src/lib/term/protobuf.js b/web/packages/teleport/src/lib/term/protobuf.js
index 96f67ef6cd4bd..c654dacbef29c 100644
--- a/web/packages/teleport/src/lib/term/protobuf.js
+++ b/web/packages/teleport/src/lib/term/protobuf.js
@@ -56,6 +56,7 @@ export const messageFields = {
       data: MessageTypeEnum.RAW.charCodeAt(0),
       event: MessageTypeEnum.AUDIT.charCodeAt(0),
       close: MessageTypeEnum.SESSION_END.charCodeAt(0),
+      challengeResponse: MessageTypeEnum.WEBAUTHN_CHALLENGE.charCodeAt(0),
     },
   },
 };
@@ -73,6 +74,10 @@ export class Protobuf {
     return this.encode(messageFields.type.values.resize, message);
   }
 
+  encodeChallengeResponse(message) {
+    return this.encode(messageFields.type.values.challengeResponse, message);
+  }
+
   encodeFileTransferRequest(message) {
     return this.encode(messageFields.type.values.fileTransferRequest, message);
   }
@@ -85,6 +90,11 @@ export class Protobuf {
     return this.encode(messageFields.type.values.data, message);
   }
 
+  encodeCloseMessage() {
+    // Close message has no payload
+    return this.encode(messageFields.type.values.close, '');
+  }
+
   encodePayload(buffer, text) {
     // set type
     buffer.push(messageFields.payload.code);
diff --git a/web/packages/teleport/src/lib/term/terminal.ts b/web/packages/teleport/src/lib/term/terminal.ts
index a70e441b9daf3..7fec05b42bded 100644
--- a/web/packages/teleport/src/lib/term/terminal.ts
+++ b/web/packages/teleport/src/lib/term/terminal.ts
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 import 'xterm/css/xterm.css';
-import { Terminal } from 'xterm';
+import { ITheme, Terminal } from 'xterm';
 import { FitAddon } from 'xterm-addon-fit';
 import { debounce, isInteger } from 'shared/utils/highbar';
 import { WebLinksAddon } from 'xterm-addon-web-links';
@@ -46,7 +46,7 @@ export default class TtyTerminal {
   _fitAddon = new FitAddon();
   _webLinksAddon = new WebLinksAddon();
 
-  constructor(tty: Tty, options: Options) {
+  constructor(tty: Tty, private options: Options) {
     const { el, scrollBack, fontFamily, fontSize } = options;
     this._el = el;
     this._fontFamily = fontFamily || undefined;
@@ -69,7 +69,8 @@ export default class TtyTerminal {
       fontSize: this._fontSize,
       scrollback: this._scrollBack,
       cursorBlink: false,
-      allowTransparency: true,
+      minimumContrastRatio: 4.5, // minimum for WCAG AA compliance
+      theme: this.options.theme,
     });
 
     this.term.loadAddon(this._fitAddon);
@@ -98,6 +99,10 @@ export default class TtyTerminal {
     this.tty.connect(this.term.cols, this.term.rows);
   }
 
+  updateTheme(theme: ITheme): void {
+    this.term.options.theme = theme;
+  }
+
   destroy() {
     this._disconnect();
     this._debouncedResize.cancel();
@@ -173,6 +178,7 @@ export default class TtyTerminal {
 
 type Options = {
   el: HTMLElement;
+  theme: ITheme;
   scrollBack?: number;
   fontFamily?: string;
   fontSize?: number;
diff --git a/web/packages/teleport/src/lib/term/tty.ts b/web/packages/teleport/src/lib/term/tty.ts
index 602cba36932de..852898ef020d9 100644
--- a/web/packages/teleport/src/lib/term/tty.ts
+++ b/web/packages/teleport/src/lib/term/tty.ts
@@ -78,7 +78,9 @@ class Tty extends EventEmitterWebAuthnSender {
   }
 
   sendWebAuthn(data: WebauthnAssertionResponse) {
-    this.send(JSON.stringify(data));
+    const encoded = this._proto.encodeChallengeResponse(JSON.stringify(data));
+    const bytearray = new Uint8Array(encoded);
+    this.socket.send(bytearray);
   }
 
   _sendFileTransferRequest(message: string) {
diff --git a/web/packages/teleport/src/mocks/contexts.ts b/web/packages/teleport/src/mocks/contexts.ts
index 40c7befe0ca70..ea778e897900a 100644
--- a/web/packages/teleport/src/mocks/contexts.ts
+++ b/web/packages/teleport/src/mocks/contexts.ts
@@ -64,6 +64,7 @@ export const allAccessAcl: Acl = {
   deviceTrust: fullAccess,
   lock: fullAccess,
   assist: fullAccess,
+  samlIdpServiceProvider: fullAccess,
 };
 
 export function getAcl(cfg?: { noAccess: boolean }) {
diff --git a/web/packages/teleport/src/services/apps/apps.test.ts b/web/packages/teleport/src/services/apps/apps.test.ts
index df80cab260d43..57973ae74fbfb 100644
--- a/web/packages/teleport/src/services/apps/apps.test.ts
+++ b/web/packages/teleport/src/services/apps/apps.test.ts
@@ -34,12 +34,14 @@ test('correct formatting of apps fetch response', async () => {
         labels: [{ name: 'env', value: 'dev' }],
         clusterId: 'cluster-id',
         fqdn: 'app-name.example.com',
+        friendlyName: '',
         launchUrl:
           '/web/launch/app-name.example.com/cluster-id/app-name.example.com',
         awsRoles: [],
         awsConsole: false,
         isCloudOrTcpEndpoint: false,
         addrWithProtocol: 'https://app-name.example.com',
+        userGroups: [],
       },
       {
         id: 'cluster-id-cloud-app-cloud://some-addr',
@@ -50,11 +52,13 @@ test('correct formatting of apps fetch response', async () => {
         labels: [],
         clusterId: 'cluster-id',
         fqdn: '',
+        friendlyName: '',
         launchUrl: '',
         awsRoles: [],
         awsConsole: false,
         isCloudOrTcpEndpoint: true,
         addrWithProtocol: 'cloud://some-addr',
+        userGroups: [],
       },
       {
         id: 'cluster-id-tcp-app-tcp://some-addr',
@@ -65,11 +69,13 @@ test('correct formatting of apps fetch response', async () => {
         labels: [],
         clusterId: 'cluster-id',
         fqdn: '',
+        friendlyName: '',
         launchUrl: '',
         awsRoles: [],
         awsConsole: false,
         isCloudOrTcpEndpoint: true,
         addrWithProtocol: 'tcp://some-addr',
+        userGroups: [],
       },
     ],
     startKey: mockResponse.startKey,
diff --git a/web/packages/teleport/src/services/apps/makeApps.ts b/web/packages/teleport/src/services/apps/makeApps.ts
index fb20dbd3a3684..2bdd87bd30e4b 100644
--- a/web/packages/teleport/src/services/apps/makeApps.ts
+++ b/web/packages/teleport/src/services/apps/makeApps.ts
@@ -28,6 +28,7 @@ export default function makeApp(json: any): App {
     clusterId = '',
     fqdn = '',
     awsConsole = false,
+    friendlyName = '',
   } = json;
 
   const canCreateUrl = fqdn && clusterId && publicAddr;
@@ -37,6 +38,7 @@ export default function makeApp(json: any): App {
   const id = `${clusterId}-${name}-${publicAddr || uri}`;
   const labels = json.labels || [];
   const awsRoles = json.awsRoles || [];
+  const userGroups = json.userGroups || [];
 
   const isTcp = uri && uri.startsWith('tcp://');
   const isCloud = uri && uri.startsWith('cloud://');
@@ -66,5 +68,7 @@ export default function makeApp(json: any): App {
     awsConsole,
     isCloudOrTcpEndpoint: isTcp || isCloud,
     addrWithProtocol,
+    friendlyName,
+    userGroups,
   };
 }
diff --git a/web/packages/teleport/src/services/apps/types.ts b/web/packages/teleport/src/services/apps/types.ts
index 581d4a68242b3..14adf2e66a67f 100644
--- a/web/packages/teleport/src/services/apps/types.ts
+++ b/web/packages/teleport/src/services/apps/types.ts
@@ -32,9 +32,16 @@ export interface App {
   // addrWithProtocol can either be a public address or
   // if public address wasn't defined, fallback to uri
   addrWithProtocol?: string;
+  friendlyName?: string;
+  userGroups: UserGroupAndDescription[];
 }
 
 export type AwsRole = {
   arn: string;
   display: string;
 };
+
+export type UserGroupAndDescription = {
+  name: string;
+  description: string;
+};
diff --git a/web/packages/teleport/src/services/auth/makeMfa.ts b/web/packages/teleport/src/services/auth/makeMfa.ts
index 40dad7ec7ba67..b19e94c781607 100644
--- a/web/packages/teleport/src/services/auth/makeMfa.ts
+++ b/web/packages/teleport/src/services/auth/makeMfa.ts
@@ -131,6 +131,17 @@ export function makeWebauthnAssertionResponse(res) {
   };
 }
 
-export type WebauthnAssertionResponse = ReturnType<
-  typeof makeWebauthnAssertionResponse
->;
+export type WebauthnAssertionResponse = {
+  id: string;
+  type: string;
+  extensions: {
+    appid: boolean;
+  };
+  rawId: string;
+  response: {
+    authenticatorData: string;
+    clientDataJSON: string;
+    signature: string;
+    userHandle: string;
+  };
+};
diff --git a/web/packages/teleport/src/services/databases/databases.test.ts b/web/packages/teleport/src/services/databases/databases.test.ts
index eb08c2ce36f79..b6182ff77584a 100644
--- a/web/packages/teleport/src/services/databases/databases.test.ts
+++ b/web/packages/teleport/src/services/databases/databases.test.ts
@@ -43,6 +43,8 @@ test('correct formatting of database fetch response', async () => {
         aws: {
           rds: {
             resourceId: 'resource-id',
+            region: 'us-west-1',
+            subnets: ['sn1', 'sn2'],
           },
         },
       },
@@ -177,6 +179,8 @@ const mockResponse = {
       aws: {
         rds: {
           resource_id: 'resource-id',
+          region: 'us-west-1',
+          subnets: ['sn1', 'sn2'],
         },
       },
     },
diff --git a/web/packages/teleport/src/services/databases/makeDatabase.ts b/web/packages/teleport/src/services/databases/makeDatabase.ts
index 4597afc3eb434..3c8cb4c33080f 100644
--- a/web/packages/teleport/src/services/databases/makeDatabase.ts
+++ b/web/packages/teleport/src/services/databases/makeDatabase.ts
@@ -16,19 +16,23 @@ limitations under the License.
 
 import { formatDatabaseInfo } from 'shared/services/databases';
 
-import { Database, DatabaseService } from './types';
+import { Aws, Database, DatabaseService } from './types';
 
 export function makeDatabase(json: any): Database {
   const { name, desc, protocol, type, aws } = json;
 
   const labels = json.labels || [];
 
-  // Only setting RDS fields for now.
-  let rds;
-  if (aws && aws.rds) {
-    rds = {
+  // The backend will return the field `aws` as undefined
+  // if this database is not hosted by AWS.
+  // (Only setting RDS fields for now.)
+  let madeAws: Aws;
+  if (aws) {
+    madeAws = {
       rds: {
-        resourceId: aws.rds.resource_id,
+        resourceId: aws.rds?.resource_id,
+        region: aws.rds?.region,
+        subnets: aws.rds?.subnets || [],
       },
     };
   }
@@ -42,7 +46,7 @@ export function makeDatabase(json: any): Database {
     names: json.database_names || [],
     users: json.database_users || [],
     hostname: json.hostname,
-    aws: rds,
+    aws: madeAws,
   };
 }
 
diff --git a/web/packages/teleport/src/services/databases/types.ts b/web/packages/teleport/src/services/databases/types.ts
index 469927a1559c4..68d04a8099b11 100644
--- a/web/packages/teleport/src/services/databases/types.ts
+++ b/web/packages/teleport/src/services/databases/types.ts
@@ -18,10 +18,10 @@ import { DbProtocol } from 'shared/services/databases';
 
 import { AgentLabel } from 'teleport/services/agents';
 
-import { RdsEngine } from '../integrations';
+import { AwsRdsDatabase, RdsEngine } from '../integrations';
 
 export type Aws = {
-  rds?: { resourceId: string };
+  rds: Pick<AwsRdsDatabase, 'resourceId' | 'region' | 'subnets'>;
 };
 
 export interface Database {
@@ -54,12 +54,7 @@ export type CreateDatabaseRequest = {
   protocol: DbProtocol | RdsEngine;
   uri: string;
   labels?: AgentLabel[];
-  awsRds?: AwsRds;
-};
-
-export type AwsRds = {
-  accountId: string;
-  resourceId: string;
+  awsRds?: AwsRdsDatabase;
 };
 
 export type DatabaseIamPolicyResponse = {
diff --git a/web/packages/teleport/src/services/integrations/integrations.ts b/web/packages/teleport/src/services/integrations/integrations.ts
index 5012b20455090..f8413f834bd89 100644
--- a/web/packages/teleport/src/services/integrations/integrations.ts
+++ b/web/packages/teleport/src/services/integrations/integrations.ts
@@ -27,6 +27,8 @@ import {
   AwsRdsDatabase,
   ListAwsRdsDatabaseResponse,
   RdsEngineIdentifier,
+  AwsOidcDeployServiceRequest,
+  AwsOidcDeployServiceResponse,
 } from './types';
 
 export const integrationService = {
@@ -113,6 +115,13 @@ export const integrationService = {
         };
       });
   },
+
+  deployAwsOidcService(
+    integrationName,
+    req: AwsOidcDeployServiceRequest
+  ): Promise<AwsOidcDeployServiceResponse> {
+    return api.post(cfg.getAwsDeployTeleportServiceUrl(integrationName), req);
+  },
 };
 
 export function makeIntegrations(json: any): Integration[] {
@@ -149,7 +158,9 @@ export function makeAwsDatabase(json: any): AwsRdsDatabase {
     uri,
     status: aws?.status,
     labels: labels ?? [],
+    subnets: aws?.rds?.subnets,
     resourceId: aws?.rds?.resource_id,
     accountId: aws?.account_id,
+    region: aws?.region,
   };
 }
diff --git a/web/packages/teleport/src/services/integrations/types.ts b/web/packages/teleport/src/services/integrations/types.ts
index b7872dbce46c7..246b5a29b5ad4 100644
--- a/web/packages/teleport/src/services/integrations/types.ts
+++ b/web/packages/teleport/src/services/integrations/types.ts
@@ -92,7 +92,21 @@ export function getStatusCodeDescription(
 
 export type Plugin = Integration<'plugin', PluginKind, PluginSpec>;
 export type PluginSpec = Record<string, never>; // currently no 'spec' fields exposed to the frontend
-export type PluginKind = 'slack' | 'openai' | 'jamf';
+// PluginKind represents the type of the plugin
+// and should be the same value as defined in the backend (check master branch for the latest):
+// https://github.com/gravitational/teleport/blob/a410acef01e0023d41c18ca6b0a7b384d738bb32/api/types/plugin.go#L27
+export type PluginKind =
+  | 'slack'
+  | 'openai'
+  | 'pagerduty'
+  | 'email'
+  | 'jira'
+  | 'discord'
+  | 'mattermost'
+  | 'msteams'
+  | 'opsgenie'
+  | 'okta'
+  | 'jamf';
 
 export type IntegrationCreateRequest = {
   name: string;
@@ -188,6 +202,10 @@ export type AwsRdsDatabase = {
   accountId: string;
   // labels contains this Instance tags.
   labels: Label[];
+  // subnets is a list of subnets for the RDS instance.
+  subnets: string[];
+  // region is the AWS cloud region that this database is from.
+  region: Regions;
   // status contains this Instance status.
   // There is a lot of status states available so only a select few were
   // hard defined to use to determine the status color.
@@ -207,3 +225,26 @@ export type IntegrationUpdateRequest = {
     roleArn: string;
   };
 };
+
+export type AwsOidcDeployServiceRequest = {
+  deploymentMode: 'database-service';
+  region: Regions;
+  subnetIds: string[];
+  taskRoleArn: string;
+  databaseAgentMatcherLabels: Label[];
+};
+
+export type AwsOidcDeployServiceResponse = {
+  // clusterArn is the Amazon ECS Cluster ARN
+  // where the task was started.
+  clusterArn: string;
+  // serviceArn is the Amazon ECS Cluster Service
+  // ARN created to run the task.
+  serviceArn: string;
+  // taskDefinitionArn is the Amazon ECS Task Definition
+  // ARN created to run the Service.
+  taskDefinitionArn: string;
+  // serviceDashboardUrl is a link to the service's Dashboard
+  // URL in Amazon Console.
+  serviceDashboardUrl: string;
+};
diff --git a/web/packages/teleport/src/services/localStorage/localStorage.ts b/web/packages/teleport/src/services/localStorage/localStorage.ts
index 310b88f11615a..4e74f81c9a25e 100644
--- a/web/packages/teleport/src/services/localStorage/localStorage.ts
+++ b/web/packages/teleport/src/services/localStorage/localStorage.ts
@@ -14,17 +14,23 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import { DeprecatedThemeOption } from 'design/theme/types';
+
 import { BearerToken } from 'teleport/services/websession';
 import { OnboardDiscover } from 'teleport/services/user';
 
-import { KeysEnum } from './types';
+import {
+  ThemePreference,
+  UserPreferences,
+} from 'teleport/services/userPreferences/types';
 
-import type { ThemeOption } from 'design/theme';
+import { KeysEnum } from './types';
 
 // This is an array of local storage `KeysEnum` that are kept when a user logs out
 const KEEP_LOCALSTORAGE_KEYS_ON_LOGOUT = [
   KeysEnum.THEME,
   KeysEnum.SHOW_ASSIST_POPUP,
+  KeysEnum.USER_PREFERENCES,
 ];
 
 const storage = {
@@ -92,20 +98,41 @@ const storage = {
     return null;
   },
 
-  setThemeOption(theme: ThemeOption) {
-    window.localStorage.setItem(KeysEnum.THEME, theme);
-    // This is to trigger the event listener in the current tab
+  getUserPreferences(): UserPreferences {
+    const preferences = window.localStorage.getItem(KeysEnum.USER_PREFERENCES);
+    if (preferences) {
+      return JSON.parse(preferences);
+    }
+    return null;
+  },
+
+  setUserPreferences(preferences: UserPreferences) {
+    const json = JSON.stringify(preferences);
+
+    window.localStorage.setItem(KeysEnum.USER_PREFERENCES, json);
+
     window.dispatchEvent(
       new StorageEvent('storage', {
-        key: KeysEnum.THEME,
-        newValue: theme,
+        key: KeysEnum.USER_PREFERENCES,
+        newValue: json,
       })
     );
   },
 
-  getThemeOption(): ThemeOption {
-    const theme = window.localStorage.getItem(KeysEnum.THEME) as ThemeOption;
-    return theme || 'light';
+  getThemePreference(): ThemePreference {
+    const userPreferences = storage.getUserPreferences();
+    if (userPreferences) {
+      return userPreferences.theme;
+    }
+
+    const theme = window.localStorage.getItem(
+      KeysEnum.THEME
+    ) as DeprecatedThemeOption;
+    if (theme) {
+      return theme === 'light' ? ThemePreference.Light : ThemePreference.Dark;
+    }
+
+    return ThemePreference.Light;
   },
 
   broadcast(messageType, messageBody) {
diff --git a/web/packages/teleport/src/services/localStorage/types.ts b/web/packages/teleport/src/services/localStorage/types.ts
index c89dd1e008849..123a299cfc1ed 100644
--- a/web/packages/teleport/src/services/localStorage/types.ts
+++ b/web/packages/teleport/src/services/localStorage/types.ts
@@ -21,4 +21,6 @@ export const KeysEnum = {
   DISCOVER: 'grv_teleport_discover',
   THEME: 'grv_teleport_ui_theme',
   SHOW_ASSIST_POPUP: 'grv_teleport_show_assist',
+  ASSIST_VIEW_MODE: 'grv_teleport_assist_view_mode',
+  USER_PREFERENCES: 'grv_teleport_user_preferences',
 };
diff --git a/web/packages/teleport/src/services/ping/index.ts b/web/packages/teleport/src/services/ping/index.ts
deleted file mode 100644
index 2aa19217be71e..0000000000000
--- a/web/packages/teleport/src/services/ping/index.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
-Copyright 2023 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import service from './ping';
-export * from './types';
-export default service;
diff --git a/web/packages/teleport/src/services/ping/ping.test.ts b/web/packages/teleport/src/services/ping/ping.test.ts
deleted file mode 100644
index b03fcf361ccbf..0000000000000
--- a/web/packages/teleport/src/services/ping/ping.test.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-/**
- * Copyright 2023 Gravitational, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import api from 'teleport/services/api';
-
-import ping from './ping';
-
-test('undefined automatic upgrade resolves to false', async () => {
-  const mockContext = { assist: {} };
-
-  jest.spyOn(api, 'get').mockResolvedValue(mockContext);
-
-  const response = await ping.fetchPing();
-  expect(response.automaticUpgrades).toBeFalsy();
-});
-
-test('null automatic upgrade resolves to false', async () => {
-  const mockContext = {
-    automatic_upgrades: null,
-  };
-
-  jest.spyOn(api, 'get').mockResolvedValue(mockContext);
-
-  const response = await ping.fetchPing();
-  expect(response.automaticUpgrades).toBeFalsy();
-});
-
-test('automatic upgrade set to true, resolves to true', async () => {
-  const mockContext = {
-    automatic_upgrades: true,
-  };
-
-  jest.spyOn(api, 'get').mockResolvedValue(mockContext);
-
-  const response = await ping.fetchPing();
-  expect(response.automaticUpgrades).toBeTruthy();
-});
-
-test('automatic upgrade set to false, resolves to false', async () => {
-  const mockContext = {
-    automatic_upgrades: false,
-  };
-
-  jest.spyOn(api, 'get').mockResolvedValue(mockContext);
-
-  const response = await ping.fetchPing();
-  expect(response.automaticUpgrades).toBeFalsy();
-});
diff --git a/web/packages/teleport/src/services/user/makeAcl.ts b/web/packages/teleport/src/services/user/makeAcl.ts
index d29291ebae7f5..8266cd9f7ca6b 100644
--- a/web/packages/teleport/src/services/user/makeAcl.ts
+++ b/web/packages/teleport/src/services/user/makeAcl.ts
@@ -59,6 +59,8 @@ export function makeAcl(json): Acl {
   const deviceTrust = json.deviceTrust || defaultAccess;
   const assist = json.assist || defaultAccess;
 
+  const samlIdpServiceProvider = json.samlIdpServiceProvider || defaultAccess;
+
   return {
     authConnectors,
     trustedClusters,
@@ -87,6 +89,7 @@ export function makeAcl(json): Acl {
     deviceTrust,
     lock,
     assist,
+    samlIdpServiceProvider,
   };
 }
 
diff --git a/web/packages/teleport/src/services/user/types.ts b/web/packages/teleport/src/services/user/types.ts
index 57bfce315cb94..ad7a17e15a8cd 100644
--- a/web/packages/teleport/src/services/user/types.ts
+++ b/web/packages/teleport/src/services/user/types.ts
@@ -79,6 +79,7 @@ export interface Acl {
   deviceTrust: Access;
   lock: Access;
   assist: Access;
+  samlIdpServiceProvider: Access;
 }
 
 export interface User {
diff --git a/web/packages/teleport/src/services/user/user.test.ts b/web/packages/teleport/src/services/user/user.test.ts
index 5734e78500055..9365f5c58ac89 100644
--- a/web/packages/teleport/src/services/user/user.test.ts
+++ b/web/packages/teleport/src/services/user/user.test.ts
@@ -219,6 +219,13 @@ test('undefined values in context response gives proper default values', async (
         create: false,
         remove: false,
       },
+      samlIdpServiceProvider: {
+        list: false,
+        read: false,
+        edit: false,
+        create: false,
+        remove: false,
+      },
       clipboardSharingEnabled: true,
       desktopSessionRecordingEnabled: true,
       directorySharingEnabled: true,
diff --git a/web/packages/teleport/src/services/userEvent/types.ts b/web/packages/teleport/src/services/userEvent/types.ts
index ab13fe091c42b..6fd2042f82337 100644
--- a/web/packages/teleport/src/services/userEvent/types.ts
+++ b/web/packages/teleport/src/services/userEvent/types.ts
@@ -15,7 +15,6 @@
  */
 
 // these constants are 1:1 with constants found in lib/usagereporter/web/userevent.go
-
 export enum CaptureEvent {
   // UserEvent types
   BannerClickEvent = 'tp.ui.banner.click',
@@ -33,6 +32,7 @@ export enum CaptureEvent {
 
   PreUserOnboardSetCredentialSubmitEvent = 'tp.ui.onboard.setCredential.submit',
   PreUserOnboardRegisterChallengeSubmitEvent = 'tp.ui.onboard.registerChallenge.submit',
+  PreUserOnboardQuestionnaireSubmitEvent = 'tp.ui.onboard.questionnaire.submit',
   PreUserCompleteGoToDashboardClickEvent = 'tp.ui.onboard.completeGoToDashboard.click',
 
   PreUserRecoveryCodesContinueClickEvent = 'tp.ui.recoveryCodesContinue.click',
@@ -123,6 +123,8 @@ export enum DiscoverEventResource {
   ApplicationHttp = 'DISCOVER_RESOURCE_APPLICATION_HTTP',
   ApplicationTcp = 'DISCOVER_RESOURCE_APPLICATION_TCP',
   WindowsDesktop = 'DISCOVER_RESOURCE_WINDOWS_DESKTOP',
+
+  SamlApplication = 'DISCOVER_RESOURCE_SAML_APPLICATION',
 }
 
 export enum DiscoverEventStatus {
@@ -174,6 +176,10 @@ export type DiscoverEventData = DiscoverEventStepStatus & {
   // in the RDS enrollment screen for event
   // tp.ui.discover.database.enroll.rds
   selectedResourcesCount?: number;
+
+  // serviceDeploy is only considered for 'tp.ui.discover.deployService'
+  // event and describes how an agent got deployed.
+  serviceDeploy?: DiscoverServiceDeploy;
 };
 
 export type DiscoverEventStepStatus = {
@@ -181,7 +187,23 @@ export type DiscoverEventStepStatus = {
   stepStatusError?: string;
 };
 
-// TODO(mcbattirola): import this from protofile instead of copying it here
+export type DiscoverServiceDeploy = {
+  method: DiscoverServiceDeployMethod;
+  type: DiscoverServiceDeployType;
+};
+
+export enum DiscoverServiceDeployMethod {
+  Unspecified = 'DEPLOY_METHOD_UNSPECIFIED',
+  Auto = 'DEPLOY_METHOD_AUTO',
+  Manual = 'DEPLOY_METHOD_MANUAL',
+}
+
+export enum DiscoverServiceDeployType {
+  Unspecified = 'DEPLOY_TYPE_UNSPECIFIED',
+  InstallScript = 'DEPLOY_TYPE_INSTALL_SCRIPT',
+  AmazonEcs = 'DEPLOY_TYPE_AMAZON_ECS',
+}
+
 export enum CtaEvent {
   CTA_UNSPECIFIED = 0,
   CTA_AUTH_CONNECTOR = 1,
@@ -190,4 +212,5 @@ export enum CtaEvent {
   CTA_PREMIUM_SUPPORT = 4,
   CTA_TRUSTED_DEVICES = 5,
   CTA_UPGRADE_BANNER = 6,
+  CTA_BILLING_SUMMARY = 7,
 }
diff --git a/web/packages/teleport/src/services/userGroups/makeUserGroup.ts b/web/packages/teleport/src/services/userGroups/makeUserGroup.ts
index ddd41aad03cff..6be5b208efb1c 100644
--- a/web/packages/teleport/src/services/userGroups/makeUserGroup.ts
+++ b/web/packages/teleport/src/services/userGroups/makeUserGroup.ts
@@ -17,13 +17,16 @@
 import type { UserGroup } from './types';
 
 export function makeUserGroup(json): UserGroup {
-  const { name, description } = json;
+  const { name, description, friendlyName } = json;
 
   const labels = json.labels || [];
+  const applications = json.applications || [];
 
   return {
     name,
     description,
     labels,
+    friendlyName,
+    applications,
   };
 }
diff --git a/web/packages/teleport/src/services/userGroups/types.ts b/web/packages/teleport/src/services/userGroups/types.ts
index 4678e53eb1555..cdc630e682bef 100644
--- a/web/packages/teleport/src/services/userGroups/types.ts
+++ b/web/packages/teleport/src/services/userGroups/types.ts
@@ -24,6 +24,15 @@ export type UserGroup = {
   description: string;
   // Labels for the user group.
   labels: AgentLabel[];
+  // FriendlyName for the user group.
+  friendlyName?: string;
+  // Applications is a list of associated applications.
+  applications?: ApplicationAndFriendlyName[];
+};
+
+export type ApplicationAndFriendlyName = {
+  name: string;
+  friendlyName: string;
 };
 
 export type UserGroupsResponse = {
diff --git a/web/packages/teleport/src/services/userPreferences/index.ts b/web/packages/teleport/src/services/userPreferences/index.ts
new file mode 100644
index 0000000000000..904e36f89f252
--- /dev/null
+++ b/web/packages/teleport/src/services/userPreferences/index.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { getUserPreferences, updateUserPreferences } from './userPreferences';
diff --git a/web/packages/teleport/src/services/userPreferences/types.ts b/web/packages/teleport/src/services/userPreferences/types.ts
new file mode 100644
index 0000000000000..fffade8461f2d
--- /dev/null
+++ b/web/packages/teleport/src/services/userPreferences/types.ts
@@ -0,0 +1,36 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type { AssistUserPreferences } from 'teleport/Assist/types';
+import type { Resource } from 'teleport/Welcome/Questionnaire/types';
+
+export enum ThemePreference {
+  Light = 1,
+  Dark = 2,
+}
+
+export type OnboardUserPreferences = {
+  preferredResources: Resource[];
+};
+
+export interface UserPreferences {
+  theme: ThemePreference;
+  assist: AssistUserPreferences;
+  onboard: OnboardUserPreferences;
+}
+
+export type UserPreferencesSubset = Subset<UserPreferences>;
+export type GetUserPreferencesResponse = UserPreferences;
diff --git a/web/packages/teleport/src/services/userPreferences/userPreferences.ts b/web/packages/teleport/src/services/userPreferences/userPreferences.ts
new file mode 100644
index 0000000000000..282afb5cfe017
--- /dev/null
+++ b/web/packages/teleport/src/services/userPreferences/userPreferences.ts
@@ -0,0 +1,52 @@
+/**
+ * Copyright 2023 Gravitational, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import cfg from 'teleport/config';
+import api from 'teleport/services/api';
+
+import { ThemePreference } from 'teleport/services/userPreferences/types';
+import { ViewMode } from 'teleport/Assist/types';
+
+import type {
+  GetUserPreferencesResponse,
+  UserPreferences,
+  UserPreferencesSubset,
+} from 'teleport/services/userPreferences/types';
+
+export async function getUserPreferences() {
+  const res: GetUserPreferencesResponse = await api.get(
+    cfg.api.userPreferencesPath
+  );
+
+  return res;
+}
+
+export function updateUserPreferences(preferences: UserPreferencesSubset) {
+  return api.put(cfg.api.userPreferencesPath, preferences);
+}
+
+export function makeDefaultUserPreferences(): UserPreferences {
+  return {
+    theme: ThemePreference.Light,
+    assist: {
+      viewMode: ViewMode.Docked,
+      preferredLogins: [],
+    },
+    onboard: {
+      preferredResources: [],
+    },
+  };
+}
diff --git a/web/packages/teleport/src/teleportContext.tsx b/web/packages/teleport/src/teleportContext.tsx
index 3cfc6838846f6..5aeb022427a15 100644
--- a/web/packages/teleport/src/teleportContext.tsx
+++ b/web/packages/teleport/src/teleportContext.tsx
@@ -25,7 +25,6 @@ import clusterService from './services/clusters';
 import sessionService from './services/session';
 import ResourceService from './services/resources';
 import userService from './services/user';
-import pingService from './services/ping';
 import appService from './services/apps';
 import JoinTokenService from './services/joinToken';
 import KubeService from './services/kube';
@@ -59,8 +58,8 @@ class TeleportContext implements types.Context {
 
   isEnterprise = cfg.isEnterprise;
   isCloud = cfg.isCloud;
-  automaticUpgradesEnabled = false;
-  assistEnabled = false;
+  automaticUpgradesEnabled = cfg.automaticUpgrades;
+  assistEnabled = cfg.assistEnabled;
   agentService = agentService;
 
   // lockedFeatures are the features disabled in the user's cluster.
@@ -91,10 +90,6 @@ class TeleportContext implements types.Context {
         await userService.checkUserHasAccessToRegisteredResource();
       localStorage.setOnboardDiscover({ hasResource });
     }
-
-    const pingResponse = await pingService.fetchPing();
-    this.automaticUpgradesEnabled = pingResponse.automaticUpgrades;
-    this.assistEnabled = pingResponse.assistEnabled;
   }
 
   getFeatureFlags(): types.FeatureFlags {
diff --git a/web/packages/teleport/src/useStickyClusterId.ts b/web/packages/teleport/src/useStickyClusterId.ts
index 3a57e7d261291..794ce0f6ad55a 100644
--- a/web/packages/teleport/src/useStickyClusterId.ts
+++ b/web/packages/teleport/src/useStickyClusterId.ts
@@ -20,6 +20,8 @@ import { useRef } from 'react';
 import { StickyCluster } from 'teleport/types';
 import cfg from 'teleport/config';
 
+// useStickyClusterId determines the current :clusterId in the URL.
+// When a route contains `:clusterId` it can refer to the root or the leaf cluster.
 export default function useStickyClusterId(): StickyCluster {
   // assign initial values where the default cluster is a proxy
   const stickyCluster = useRef({
diff --git a/web/packages/teleterm/package.json b/web/packages/teleterm/package.json
index be7178b955c2a..e4c267b22eb3e 100644
--- a/web/packages/teleterm/package.json
+++ b/web/packages/teleterm/package.json
@@ -40,7 +40,7 @@
     "@types/node-forge": "^1.0.4",
     "clean-webpack-plugin": "4.0.0",
     "cross-env": "5.0.5",
-    "electron": "24.3.0",
+    "electron": "25.1.1",
     "electron-notarize": "^1.2.1",
     "eslint-import-resolver-webpack": "0.13.2",
     "eslint-loader": "3.0.3",
diff --git a/web/packages/teleterm/src/main.ts b/web/packages/teleterm/src/main.ts
index 4687b03025a36..a57a9c1d49944 100644
--- a/web/packages/teleterm/src/main.ts
+++ b/web/packages/teleterm/src/main.ts
@@ -18,7 +18,7 @@ import { spawn } from 'child_process';
 
 import path from 'path';
 
-import { app, globalShortcut, shell } from 'electron';
+import { app, globalShortcut, shell, nativeTheme } from 'electron';
 
 import MainProcess from 'teleterm/mainProcess';
 import { getRuntimeSettings } from 'teleterm/mainProcess/runtimeSettings';
@@ -59,6 +59,8 @@ async function initializeApp(): Promise<void> {
     jsonSchemaFile: configJsonSchemaFileStorage,
     platform: settings.platform,
   });
+
+  nativeTheme.themeSource = configService.get('theme').value;
   const windowsManager = new WindowsManager(appStateFileStorage, settings);
 
   process.on('uncaughtException', (error, origin) => {
diff --git a/web/packages/teleterm/src/mainProcess/fixtures/mocks.ts b/web/packages/teleterm/src/mainProcess/fixtures/mocks.ts
index 318aec0ad0c0a..f15d25fc30cae 100644
--- a/web/packages/teleterm/src/mainProcess/fixtures/mocks.ts
+++ b/web/packages/teleterm/src/mainProcess/fixtures/mocks.ts
@@ -68,6 +68,14 @@ export class MockMainProcessClient implements MainProcessClient {
   async openConfigFile() {
     return '';
   }
+
+  shouldUseDarkColors() {
+    return true;
+  }
+
+  subscribeToNativeThemeUpdate() {
+    return { cleanup: () => undefined };
+  }
 }
 
 export const makeRuntimeSettings = (
diff --git a/web/packages/teleterm/src/mainProcess/mainProcess.ts b/web/packages/teleterm/src/mainProcess/mainProcess.ts
index ed795bce04694..edfbef8cbb637 100644
--- a/web/packages/teleterm/src/mainProcess/mainProcess.ts
+++ b/web/packages/teleterm/src/mainProcess/mainProcess.ts
@@ -26,6 +26,7 @@ import {
   ipcMain,
   Menu,
   MenuItemConstructorOptions,
+  nativeTheme,
   shell,
 } from 'electron';
 import { wait } from 'shared/utils/wait';
@@ -193,6 +194,10 @@ export default class MainProcess {
       event.returnValue = this.settings;
     });
 
+    ipcMain.on('main-process-should-use-dark-colors', event => {
+      event.returnValue = nativeTheme.shouldUseDarkColors;
+    });
+
     ipcMain.handle('main-process-get-resolved-child-process-addresses', () => {
       return this.resolvedChildProcessAddresses;
     });
@@ -332,10 +337,7 @@ export default class MainProcess {
         role: 'help',
         submenu: [
           { label: 'Learn More', click: openDocsUrl },
-          {
-            label: 'About Teleport Connect',
-            click: app.showAboutPanel,
-          },
+          { role: 'about' },
         ],
       },
     ];
@@ -345,8 +347,7 @@ export default class MainProcess {
   }
 
   private updateAboutPanelIfNeeded(): void {
-    // There is no about menu for Linux. See https://github.com/electron/electron/issues/18918
-    // On Windows default menu does not show copyrights.
+    // On Windows and Linux default menu does not show copyrights.
     if (
       this.settings.platform === 'linux' ||
       this.settings.platform === 'win32'
diff --git a/web/packages/teleterm/src/mainProcess/mainProcessClient.ts b/web/packages/teleterm/src/mainProcess/mainProcessClient.ts
index 6bb35619a05c6..1bb317f1cf880 100644
--- a/web/packages/teleterm/src/mainProcess/mainProcessClient.ts
+++ b/web/packages/teleterm/src/mainProcess/mainProcessClient.ts
@@ -53,8 +53,20 @@ export default function createMainProcessClient(): MainProcessClient {
     removeTshSymlinkMacOs() {
       return ipcRenderer.invoke('main-process-remove-tsh-symlink-macos');
     },
-    openConfigFile(): Promise<string> {
+    openConfigFile() {
       return ipcRenderer.invoke('main-process-open-config-file');
     },
+    shouldUseDarkColors() {
+      return ipcRenderer.sendSync('main-process-should-use-dark-colors');
+    },
+    subscribeToNativeThemeUpdate: listener => {
+      const onThemeChange = (_, value: { shouldUseDarkColors: boolean }) =>
+        listener(value);
+      const channel = 'main-process-native-theme-update';
+      ipcRenderer.addListener(channel, onThemeChange);
+      return {
+        cleanup: () => ipcRenderer.removeListener(channel, onThemeChange),
+      };
+    },
   };
 }
diff --git a/web/packages/teleterm/src/mainProcess/types.ts b/web/packages/teleterm/src/mainProcess/types.ts
index 28798a576207b..62e8d51288ada 100644
--- a/web/packages/teleterm/src/mainProcess/types.ts
+++ b/web/packages/teleterm/src/mainProcess/types.ts
@@ -75,6 +75,13 @@ export type MainProcessClient = {
 
   /** Opens config file and returns a path to it. */
   openConfigFile(): Promise<string>;
+  shouldUseDarkColors(): boolean;
+  /** Subscribes to updates of the native theme. Returns a cleanup function. */
+  subscribeToNativeThemeUpdate: (
+    listener: (value: { shouldUseDarkColors: boolean }) => void
+  ) => {
+    cleanup: () => void;
+  };
 };
 
 export type ChildProcessAddresses = {
diff --git a/web/packages/teleterm/src/mainProcess/windowsManager.ts b/web/packages/teleterm/src/mainProcess/windowsManager.ts
index 934a0530c001f..2244f08529794 100644
--- a/web/packages/teleterm/src/mainProcess/windowsManager.ts
+++ b/web/packages/teleterm/src/mainProcess/windowsManager.ts
@@ -16,11 +16,18 @@
 
 import path from 'path';
 
-import { app, BrowserWindow, Menu, Rectangle, screen } from 'electron';
+import {
+  app,
+  BrowserWindow,
+  Menu,
+  Rectangle,
+  screen,
+  nativeTheme,
+} from 'electron';
 
 import { FileStorage } from 'teleterm/services/fileStorage';
 import { RuntimeSettings } from 'teleterm/mainProcess/types';
-import theme from 'teleterm/ui/ThemeProvider/theme';
+import { darkTheme, lightTheme } from 'teleterm/ui/ThemeProvider/theme';
 
 type WindowState = Rectangle;
 
@@ -47,13 +54,16 @@ export class WindowsManager {
   }
 
   createWindow(): void {
+    const activeTheme = nativeTheme.shouldUseDarkColors
+      ? darkTheme
+      : lightTheme;
     const windowState = this.getWindowState();
     const window = new BrowserWindow({
       x: windowState.x,
       y: windowState.y,
       width: windowState.width,
       height: windowState.height,
-      backgroundColor: theme.colors.levels.sunken,
+      backgroundColor: activeTheme.colors.levels.sunken,
       minWidth: 400,
       minHeight: 300,
       show: false,
@@ -88,6 +98,12 @@ export class WindowsManager {
       this.popupUniversalContextMenu(window, props);
     });
 
+    nativeTheme.on('updated', () => {
+      window.webContents.send('main-process-native-theme-update', {
+        shouldUseDarkColors: nativeTheme.shouldUseDarkColors,
+      });
+    });
+
     window.webContents.session.setPermissionRequestHandler(
       (webContents, permission, callback) => {
         // deny all permissions requests, we currently do not require any
@@ -131,12 +147,12 @@ export class WindowsManager {
       return;
     }
 
-    // What follows is a special focus handler for windows.
-    //
-    // On Windows, app.focus() doesn't work as expected so instead we call win.focus().
-    // If the window is minimized, win.focus() will bring it to the front and give it focus.
-    // If the window is not minimized but simply covered by other another window, win.focus() will
+    // On Windows, app.focus() doesn't work the same as on the other platforms.
+    // If the window is minimized, app.focus() will bring it to the front and give it focus.
+    // If the window is not minimized but simply covered by other another window, app.focus() will
     // flash the icon of Connect in the task bar.
+    // To make things even more complicated, the app behaves like that only when it is packaged.
+    // When it is in dev mode, it seems to work correctly (it is brought to the front every time).
     //
     // Ideally, we'd like the not minimized window to receive focus too. We considered two
     // workarounds to bring focus to a window that's not minimized:
@@ -155,21 +171,20 @@ export class WindowsManager {
     //
     // https://github.com/electron/electron/issues/2867#issuecomment-1080573240
     //
-    // I don't understand why calling win.focus() on a minimized window gives it focus in the
+    // I don't understand why calling app.focus() on a minimized window gives it focus in the
     // first place. In theory it shouldn't work, see the links below:
     //
     // https://stackoverflow.com/a/72620653/742872
     // https://devblogs.microsoft.com/oldnewthing/20090220-00/?p=19083
     // https://github.com/electron/electron/issues/2867#issuecomment-142480964
     // https://github.com/electron/electron/issues/2867#issuecomment-142511956
-    if (this.settings.platform === 'win32') {
-      this.window.focus();
-      return;
-    }
 
     app.dock?.bounce('informational');
+
     // app.focus() alone doesn't un-minimize the window if the window is minimized.
-    this.window.show();
+    if (this.window.isMinimized()) {
+      this.window.restore();
+    }
     app.focus({ steal: true });
   }
 
diff --git a/web/packages/teleterm/src/services/config/appConfigSchema.ts b/web/packages/teleterm/src/services/config/appConfigSchema.ts
index 62d17451d2d38..a18f81469dbdf 100644
--- a/web/packages/teleterm/src/services/config/appConfigSchema.ts
+++ b/web/packages/teleterm/src/services/config/appConfigSchema.ts
@@ -31,6 +31,27 @@ export const createAppConfigSchema = (platform: Platform) => {
 
   // `keymap.` prefix is used in `initUi.ts` in a predicate function.
   return z.object({
+    theme: z
+      .enum(['light', 'dark', 'system'])
+      .default('system')
+      .describe('Color theme for the app.'),
+    /**
+     * This value can be provided by the user and is unsanitized. This means that it cannot be directly interpolated
+     * in a styled component or used in CSS, as it may inject malicious CSS code.
+     * Before using it, sanitize it with `CSS.escape` or pass it as a `style` prop.
+     * Read more https://frontarm.com/james-k-nelson/how-can-i-use-css-in-js-securely/.
+     */
+    'terminal.fontFamily': z
+      .string()
+      .default(defaultTerminalFont)
+      .describe('Font family for the terminal.'),
+    'terminal.fontSize': z
+      .number()
+      .int()
+      .min(1)
+      .max(256)
+      .default(15)
+      .describe('Font size for the terminal.'),
     'usageReporting.enabled': z
       .boolean()
       .default(false)
@@ -89,23 +110,10 @@ export const createAppConfigSchema = (platform: Platform) => {
     'keymap.openSearchBar': shortcutSchema
       .default(defaultKeymap['openSearchBar'])
       .describe(getShortcutDesc('open the search bar')),
-    /**
-     * This value can be provided by the user and is unsanitized. This means that it cannot be directly interpolated
-     * in a styled component or used in CSS, as it may inject malicious CSS code.
-     * Before using it, sanitize it with `CSS.escape` or pass it as a `style` prop.
-     * Read more https://frontarm.com/james-k-nelson/how-can-i-use-css-in-js-securely/.
-     */
-    'terminal.fontFamily': z
-      .string()
-      .default(defaultTerminalFont)
-      .describe('Font family for the terminal.'),
-    'terminal.fontSize': z
-      .number()
-      .int()
-      .min(1)
-      .max(256)
-      .default(15)
-      .describe('Font size for the terminal.'),
+    'feature.connectMyComputer': z
+      .boolean()
+      .default(false)
+      .describe('Enables sharing the computer.'),
   });
 };
 
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/types.ts b/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputerSetup/DocumentConnectMyComputerSetup.story.tsx
similarity index 61%
rename from web/packages/teleport/src/Assist/Chat/ChatItem/Action/types.ts
rename to web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputerSetup/DocumentConnectMyComputerSetup.story.tsx
index b0d05a6bb87b9..a13a80cf72b59 100644
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/types.ts
+++ b/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputerSetup/DocumentConnectMyComputerSetup.story.tsx
@@ -14,28 +14,14 @@
  * limitations under the License.
  */
 
-export interface CommandState {
-  type: 'command';
-  value: string;
-}
+import React from 'react';
 
-export interface QueryState {
-  type: 'query';
-  value: string;
-}
+import { DocumentConnectMyComputerSetup } from './DocumentConnectMyComputerSetup';
 
-export interface UserState {
-  type: 'user';
-  value: string;
-}
+export default {
+  title: 'Teleterm/ConnectMyComputer/DocumentConnectMyComputerSetup',
+};
 
-export interface AvailableUsersState {
-  type: 'availableUsers';
-  value: string[];
+export function Default() {
+  return <DocumentConnectMyComputerSetup visible={true} doc={undefined} />;
 }
-
-export type ActionState =
-  | CommandState
-  | QueryState
-  | UserState
-  | AvailableUsersState;
diff --git a/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputerSetup/DocumentConnectMyComputerSetup.tsx b/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputerSetup/DocumentConnectMyComputerSetup.tsx
new file mode 100644
index 0000000000000..5e572bfd0a034
--- /dev/null
+++ b/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputerSetup/DocumentConnectMyComputerSetup.tsx
@@ -0,0 +1,98 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import React, { useState } from 'react';
+import { Box, ButtonPrimary, Text } from 'design';
+
+import * as types from 'teleterm/ui/services/workspacesService';
+import Document from 'teleterm/ui/Document';
+
+interface DocumentConnectMyComputerSetupProps {
+  visible: boolean;
+  doc: types.DocumentConnectMyComputerSetup;
+}
+
+export function DocumentConnectMyComputerSetup(
+  props: DocumentConnectMyComputerSetupProps
+) {
+  const [step, setStep] =
+    useState<'information' | 'agent-setup'>('information');
+
+  return (
+    <Document visible={props.visible}>
+      <Box maxWidth="590px" mx="auto" mt="4" px="5" width="100%">
+        <Text typography="h3" mb="4">
+          Connect My Computer
+        </Text>
+        {step === 'information' && (
+          <Information onSetUpAgentClick={() => setStep('agent-setup')} />
+        )}
+        {step === 'agent-setup' && <AgentSetup />}
+      </Box>
+    </Document>
+  );
+}
+
+function Information(props: { onSetUpAgentClick(): void }) {
+  return (
+    <>
+      {/* TODO(gzdunek): change the temporary copy */}
+      <Text>
+        The setup process will download the teleport agent and configure it to
+        make your computer available in the <strong>acme.teleport.sh</strong>{' '}
+        cluster.
+        <br />
+        All cluster users with the role{' '}
+        <strong>connect-my-computer-robert@acme.com</strong> will be able to
+        access your computer as <strong>bob</strong>.
+        <br />
+        You can stop computer sharing at any time from Connect My Computer menu.
+      </Text>
+      <ButtonPrimary
+        mt={4}
+        mx="auto"
+        css={`
+          display: block;
+        `}
+        onClick={props.onSetUpAgentClick}
+      >
+        Set up agent
+      </ButtonPrimary>
+    </>
+  );
+}
+
+function AgentSetup() {
+  const steps = [
+    'Setting up roles',
+    'Downloading the agent',
+    'Generating the config file',
+    'Joining the cluster',
+  ];
+
+  return (
+    <ol
+      css={`
+        padding-left: 0;
+        list-style: inside decimal;
+      `}
+    >
+      {steps.map(step => (
+        <li key={step}>{step}</li>
+      ))}
+    </ol>
+  );
+}
diff --git a/web/packages/teleterm/src/ui/ConnectMyComputer/NavigationMenu.tsx b/web/packages/teleterm/src/ui/ConnectMyComputer/NavigationMenu.tsx
new file mode 100644
index 0000000000000..2a24ba99a3e6e
--- /dev/null
+++ b/web/packages/teleterm/src/ui/ConnectMyComputer/NavigationMenu.tsx
@@ -0,0 +1,93 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { useRef, useState } from 'react';
+import Popover from 'design/Popover';
+import styled from 'styled-components';
+import { Box } from 'design';
+
+import { useAppContext } from 'teleterm/ui/appContextProvider';
+import { ListItem } from 'teleterm/ui/components/ListItem';
+import { ClusterUri } from 'teleterm/ui/uri';
+
+import { NavigationMenuIcon } from './NavigationMenuIcon';
+import { canUseConnectMyComputer } from './permissions';
+
+interface NavigationMenuProps {
+  clusterUri: ClusterUri;
+}
+
+export function NavigationMenu(props: NavigationMenuProps) {
+  const iconRef = useRef();
+  const [isPopoverOpened, setIsPopoverOpened] = useState(false);
+  const appCtx = useAppContext();
+  // DocumentCluster renders this component only if the cluster exists.
+  const cluster = appCtx.clustersService.findCluster(props.clusterUri);
+
+  if (cluster.leaf) {
+    return null;
+  }
+
+  const rootCluster = cluster;
+
+  function togglePopover() {
+    setIsPopoverOpened(wasOpened => !wasOpened);
+  }
+
+  function openSetupDocument(): void {
+    const documentService =
+      appCtx.workspacesService.getWorkspaceDocumentService(rootCluster.uri);
+    const document = documentService.createConnectMyComputerSetupDocument({
+      rootClusterUri: rootCluster.uri,
+    });
+    documentService.add(document);
+    documentService.open(document.uri);
+    setIsPopoverOpened(false);
+  }
+
+  if (
+    !canUseConnectMyComputer(
+      rootCluster,
+      appCtx.configService,
+      appCtx.mainProcessClient.getRuntimeSettings()
+    )
+  ) {
+    return null;
+  }
+
+  return (
+    <>
+      <NavigationMenuIcon onClick={togglePopover} ref={iconRef} />
+      <Popover
+        open={isPopoverOpened}
+        anchorEl={iconRef.current}
+        anchorOrigin={{
+          vertical: 'bottom',
+          horizontal: 'right',
+        }}
+        onClose={() => setIsPopoverOpened(false)}
+      >
+        <Container width="200px">
+          <ListItem onClick={openSetupDocument}>Set up agent</ListItem>
+        </Container>
+      </Popover>
+    </>
+  );
+}
+
+const Container = styled(Box)`
+  background: ${props => props.theme.colors.levels.elevated};
+`;
diff --git a/web/packages/teleterm/src/ui/ConnectMyComputer/NavigationMenuIcon.tsx b/web/packages/teleterm/src/ui/ConnectMyComputer/NavigationMenuIcon.tsx
new file mode 100644
index 0000000000000..d1291d9b8fd55
--- /dev/null
+++ b/web/packages/teleterm/src/ui/ConnectMyComputer/NavigationMenuIcon.tsx
@@ -0,0 +1,48 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React, { forwardRef } from 'react';
+import styled from 'styled-components';
+import { Wand } from 'design/Icon';
+import { Button } from 'design';
+
+interface NavigationMenuIconProps {
+  onClick(): void;
+}
+
+export const NavigationMenuIcon = forwardRef<
+  HTMLDivElement,
+  NavigationMenuIconProps
+>((props, ref) => {
+  return (
+    <StyledButton
+      setRef={ref}
+      onClick={props.onClick}
+      kind="secondary"
+      size="small"
+      title="Open Connect My Computer"
+    >
+      <Wand fontSize={16} />
+    </StyledButton>
+  );
+});
+
+const StyledButton = styled(Button)`
+  background: ${props => props.theme.colors.spotBackground[0]};
+  padding: 0;
+  width: ${props => props.theme.space[5]}px;
+  height: ${props => props.theme.space[5]}px;
+`;
diff --git a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/index.ts b/web/packages/teleterm/src/ui/ConnectMyComputer/index.ts
similarity index 77%
rename from web/packages/teleport/src/Assist/Chat/ChatItem/Action/index.ts
rename to web/packages/teleterm/src/ui/ConnectMyComputer/index.ts
index b75b118609679..c01d682d018ee 100644
--- a/web/packages/teleport/src/Assist/Chat/ChatItem/Action/index.ts
+++ b/web/packages/teleterm/src/ui/ConnectMyComputer/index.ts
@@ -14,5 +14,5 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-export { Action } from './Action';
-export { Actions } from './Actions';
+export * from './DocumentConnectMyComputerSetup/DocumentConnectMyComputerSetup';
+export { NavigationMenu as ConnectMyComputerNavigationMenu } from './NavigationMenu';
diff --git a/web/packages/teleterm/src/ui/ConnectMyComputer/permissions.test.ts b/web/packages/teleterm/src/ui/ConnectMyComputer/permissions.test.ts
new file mode 100644
index 0000000000000..45099a7a4adff
--- /dev/null
+++ b/web/packages/teleterm/src/ui/ConnectMyComputer/permissions.test.ts
@@ -0,0 +1,119 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { createMockConfigService } from 'teleterm/services/config/fixtures/mocks';
+import { makeRuntimeSettings } from 'teleterm/mainProcess/fixtures/mocks';
+import { Platform } from 'teleterm/mainProcess/types';
+import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
+
+import { canUseConnectMyComputer } from './permissions';
+
+const testCases: {
+  name: string;
+  platform: Platform;
+  canCreateToken: boolean;
+  isUsageBasedBilling: boolean;
+  isFeatureFlagEnabled: boolean;
+  expect: boolean;
+}[] = [
+  {
+    name: 'darwin, can create token, usage based plan, feature flag enabled',
+    platform: 'darwin',
+    canCreateToken: true,
+    isUsageBasedBilling: true,
+    isFeatureFlagEnabled: true,
+    expect: true,
+  },
+  {
+    name: 'linux, can create token, usage based plan, feature flag enabled',
+    platform: 'linux',
+    canCreateToken: true,
+    isUsageBasedBilling: true,
+    isFeatureFlagEnabled: true,
+    expect: true,
+  },
+  {
+    name: 'windows, can create token, usage based plan, feature flag enabled',
+    platform: 'win32',
+    canCreateToken: true,
+    isUsageBasedBilling: true,
+    isFeatureFlagEnabled: true,
+    expect: false,
+  },
+  {
+    name: 'darwin, cannot create token, usage based plan, feature flag enabled',
+    platform: 'darwin',
+    canCreateToken: false,
+    isUsageBasedBilling: true,
+    isFeatureFlagEnabled: true,
+    expect: false,
+  },
+  {
+    name: 'darwin, can create token, non-usage based plan, feature flag enabled',
+    platform: 'darwin',
+    canCreateToken: true,
+    isUsageBasedBilling: false,
+    isFeatureFlagEnabled: true,
+    expect: false,
+  },
+  {
+    name: 'darwin, can create token, usage based plan, feature flag not enabled',
+    platform: 'darwin',
+    canCreateToken: true,
+    isUsageBasedBilling: true,
+    isFeatureFlagEnabled: false,
+    expect: false,
+  },
+];
+
+test.each(testCases)('$name', testCase => {
+  const cluster = makeRootCluster({
+    features: {
+      advancedAccessWorkflows: false,
+      isUsageBasedBilling: testCase.isUsageBasedBilling,
+    },
+    loggedInUser: {
+      name: 'test',
+      activeRequestsList: [],
+      assumedRequests: {},
+      rolesList: [],
+      sshLoginsList: [],
+      requestableRolesList: [],
+      suggestedReviewersList: [],
+      acl: {
+        tokens: {
+          create: testCase.canCreateToken,
+          edit: false,
+          list: false,
+          use: false,
+          read: false,
+          pb_delete: false,
+        },
+      },
+    },
+  });
+  const configService = createMockConfigService({
+    'feature.connectMyComputer': testCase.isFeatureFlagEnabled,
+  });
+  const runtimeSettings = makeRuntimeSettings({ platform: testCase.platform });
+
+  const isPermitted = canUseConnectMyComputer(
+    cluster,
+    configService,
+    runtimeSettings
+  );
+  expect(isPermitted).toEqual(testCase.expect);
+});
diff --git a/web/packages/teleterm/src/ui/ConnectMyComputer/permissions.ts b/web/packages/teleterm/src/ui/ConnectMyComputer/permissions.ts
new file mode 100644
index 0000000000000..d0a168aaa53ae
--- /dev/null
+++ b/web/packages/teleterm/src/ui/ConnectMyComputer/permissions.ts
@@ -0,0 +1,49 @@
+/**
+ * Copyright 2023 Gravitational, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Cluster } from 'teleterm/services/tshd/types';
+import { ConfigService } from 'teleterm/services/config';
+import { RuntimeSettings } from 'teleterm/mainProcess/types';
+
+/**
+ * Checks if Connect My Computer can be used for the given root cluster.
+ *
+ * The root cluster is required because `loggedInUser` and `features` are not fully defined for leaves.
+ *
+ * TODO(gzdunek): we should have a single place where all permissions are defined.
+ * This will make it easier to understand what the user can and cannot do without having to jump around the code base.
+ * https://github.com/gravitational/teleport/pull/28346#discussion_r1246653846
+ * */
+export function canUseConnectMyComputer(
+  rootCluster: Cluster,
+  configService: ConfigService,
+  runtimeSettings: RuntimeSettings
+): boolean {
+  if (rootCluster.leaf) {
+    return false;
+  }
+
+  const isUnix =
+    runtimeSettings.platform === 'darwin' ||
+    runtimeSettings.platform === 'linux';
+
+  return (
+    isUnix &&
+    rootCluster.loggedInUser?.acl?.tokens.create &&
+    rootCluster.features?.isUsageBasedBilling &&
+    configService.get('feature.connectMyComputer').value
+  );
+}
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/ClusterResources/ClusterResources.tsx b/web/packages/teleterm/src/ui/DocumentCluster/ClusterResources/ClusterResources.tsx
index 3f75954e0d383..91a2269746c00 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/ClusterResources/ClusterResources.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/ClusterResources/ClusterResources.tsx
@@ -19,6 +19,7 @@ import styled from 'styled-components';
 import { Flex } from 'design';
 
 import { useClusterContext } from 'teleterm/ui/DocumentCluster/clusterContext';
+import { ConnectMyComputerNavigationMenu } from 'teleterm/ui/ConnectMyComputer';
 
 import SideNav from './SideNav';
 import Servers from './Servers';
@@ -41,7 +42,10 @@ export default function ClusterResources() {
   return (
     <StyledMain>
       <Flex pb={5} flexDirection="column">
-        <SideNav mb={2} />
+        <Flex justifyContent="space-between">
+          <SideNav mb={2} />
+          <ConnectMyComputerNavigationMenu clusterUri={clusterCtx.clusterUri} />
+        </Flex>
         <HorizontalSplit>
           {clusterCtx.isLocationActive('/resources/servers') && <Servers />}
           {clusterCtx.isLocationActive('/resources/databases') && <Databases />}
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/ClusterResources/SideNav/SideNav.tsx b/web/packages/teleterm/src/ui/DocumentCluster/ClusterResources/SideNav/SideNav.tsx
index 839f9dcd9efa3..d983a10d8ad89 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/ClusterResources/SideNav/SideNav.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/ClusterResources/SideNav/SideNav.tsx
@@ -51,7 +51,6 @@ export type SideNavItem = {
 const StyledNav = styled(Flex)`
   min-width: 180px;
   overflow: auto;
-  height: 100%;
 `;
 
 function createItems(): SideNavItem[] {
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/DocumentCluster.tsx b/web/packages/teleterm/src/ui/DocumentCluster/DocumentCluster.tsx
index f193b7c3f3041..b92823c0d5b75 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/DocumentCluster.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/DocumentCluster.tsx
@@ -82,7 +82,7 @@ export function Cluster() {
   }
 
   return (
-    <Layout mx="auto" px={5} pt={3} height="100%">
+    <Layout mx="auto" px={5} pt={2} height="100%">
       <ClusterResources />
     </Layout>
   );
diff --git a/web/packages/teleterm/src/ui/DocumentTerminal/Terminal/Terminal.tsx b/web/packages/teleterm/src/ui/DocumentTerminal/Terminal/Terminal.tsx
index 29353a7bf7a02..cfcecd04f1674 100644
--- a/web/packages/teleterm/src/ui/DocumentTerminal/Terminal/Terminal.tsx
+++ b/web/packages/teleterm/src/ui/DocumentTerminal/Terminal/Terminal.tsx
@@ -15,7 +15,7 @@ limitations under the License.
 */
 
 import React, { useEffect, useRef, useState } from 'react';
-import styled from 'styled-components';
+import styled, { useTheme } from 'styled-components';
 import { Box, Flex } from 'design';
 import { debounce } from 'shared/utils/highbar';
 import {
@@ -54,6 +54,7 @@ export function Terminal(props: TerminalProps) {
   const [startPtyProcessAttempt, setStartPtyProcessAttempt] = useState<
     Attempt<void>
   >(makeEmptyAttempt());
+  const theme = useTheme();
 
   useEffect(() => {
     const removeOnStartErrorListener = props.ptyProcess.onStartError(
@@ -69,6 +70,7 @@ export function Terminal(props: TerminalProps) {
     const ctrl = new XTermCtrl(props.ptyProcess, {
       el: refElement.current,
       fontSize: props.fontSize,
+      theme: theme.colors.terminal,
     });
 
     // Start the PTY process.
@@ -103,6 +105,12 @@ export function Terminal(props: TerminalProps) {
     refCtrl.current.requestResize();
   }, [props.visible]);
 
+  useEffect(() => {
+    if (refCtrl.current) {
+      refCtrl.current.term.options.theme = theme.colors.terminal;
+    }
+  }, [theme]);
+
   return (
     <Flex
       flexDirection="column"
diff --git a/web/packages/teleterm/src/ui/DocumentTerminal/Terminal/ctrl.ts b/web/packages/teleterm/src/ui/DocumentTerminal/Terminal/ctrl.ts
index c93053aaef25a..b3213c9e97c62 100644
--- a/web/packages/teleterm/src/ui/DocumentTerminal/Terminal/ctrl.ts
+++ b/web/packages/teleterm/src/ui/DocumentTerminal/Terminal/ctrl.ts
@@ -15,19 +15,19 @@ limitations under the License.
 */
 
 import 'xterm/css/xterm.css';
-import { IDisposable, Terminal } from 'xterm';
+import { IDisposable, ITheme, Terminal } from 'xterm';
 import { FitAddon } from 'xterm-addon-fit';
 import { debounce } from 'shared/utils/highbar';
 
 import { IPtyProcess } from 'teleterm/sharedProcess/ptyHost';
 import Logger from 'teleterm/logger';
-import theme from 'teleterm/ui/ThemeProvider/theme';
 
 const WINDOW_RESIZE_DEBOUNCE_DELAY = 200;
 
 type Options = {
   el: HTMLElement;
   fontSize: number;
+  theme: ITheme;
 };
 
 export default class TtyTerminal {
@@ -62,29 +62,7 @@ export default class TtyTerminal {
       fontSize: this.options.fontSize,
       scrollback: 5000,
       minimumContrastRatio: 4.5, // minimum for WCAG AA compliance
-      theme: {
-        foreground: theme.colors.terminal.foreground,
-        background: theme.colors.terminal.background,
-        selectionBackground: theme.colors.terminal.selectionBackground,
-        cursor: theme.colors.terminal.cursor,
-        cursorAccent: theme.colors.terminal.cursorAccent,
-        red: theme.colors.terminal.red,
-        green: theme.colors.terminal.green,
-        yellow: theme.colors.terminal.yellow,
-        blue: theme.colors.terminal.blue,
-        magenta: theme.colors.terminal.magenta,
-        cyan: theme.colors.terminal.cyan,
-        brightWhite: theme.colors.terminal.brightWhite,
-        white: theme.colors.terminal.white,
-        brightBlack: theme.colors.terminal.brightBlack,
-        black: theme.colors.terminal.black,
-        brightRed: theme.colors.terminal.brightRed,
-        brightGreen: theme.colors.terminal.brightGreen,
-        brightYellow: theme.colors.terminal.brightYellow,
-        brightBlue: theme.colors.terminal.brightBlue,
-        brightMagenta: theme.colors.terminal.brightMagenta,
-        brightCyan: theme.colors.terminal.brightCyan,
-      },
+      theme: this.options.theme,
       windowOptions: {
         setWinSizeChars: true,
       },
diff --git a/web/packages/teleterm/src/ui/Documents/DocumentsRenderer.tsx b/web/packages/teleterm/src/ui/Documents/DocumentsRenderer.tsx
index ce1c7ba890cf1..d5bce83781644 100644
--- a/web/packages/teleterm/src/ui/Documents/DocumentsRenderer.tsx
+++ b/web/packages/teleterm/src/ui/Documents/DocumentsRenderer.tsx
@@ -32,6 +32,7 @@ import {
 import DocumentCluster from 'teleterm/ui/DocumentCluster';
 import DocumentGateway from 'teleterm/ui/DocumentGateway';
 import { DocumentTerminal } from 'teleterm/ui/DocumentTerminal';
+import { DocumentConnectMyComputerSetup } from 'teleterm/ui/ConnectMyComputer';
 
 import Document from 'teleterm/ui/Document';
 import { RootClusterUri } from 'teleterm/ui/uri';
@@ -106,6 +107,8 @@ function MemoizedDocument(props: { doc: types.Document; visible: boolean }) {
         return <DocumentTerminal doc={doc} visible={visible} />;
       case 'doc.access_requests':
         return <DocumentAccessRequests doc={doc} visible={visible} />;
+      case 'doc.connect_my_computer_setup':
+        return <DocumentConnectMyComputerSetup doc={doc} visible={visible} />;
       default:
         return (
           <Document visible={visible}>
diff --git a/web/packages/teleterm/src/ui/Documents/KeyboardShortcutsPanel.tsx b/web/packages/teleterm/src/ui/Documents/KeyboardShortcutsPanel.tsx
index 2d635df24a19d..058ef1117f878 100644
--- a/web/packages/teleterm/src/ui/Documents/KeyboardShortcutsPanel.tsx
+++ b/web/packages/teleterm/src/ui/Documents/KeyboardShortcutsPanel.tsx
@@ -73,10 +73,17 @@ export function KeyboardShortcutsPanel() {
 function Entry(props: { title: string; accelerator: string }) {
   return (
     <>
-      <Text textAlign="right" color="light" typography="subtitle1" py="4px">
+      <Text textAlign="right" typography="subtitle1" py="4px">
         {props.title}
       </Text>
-      <MonoText bg="levels.surface" textAlign="left" px="12px" py="4px">
+      <MonoText
+        css={`
+          background: ${props => props.theme.colors.spotBackground[0]};
+        `}
+        textAlign="left"
+        px="12px"
+        py="4px"
+      >
         {props.accelerator}
       </MonoText>
     </>
@@ -84,9 +91,7 @@ function Entry(props: { title: string; accelerator: string }) {
 }
 
 const MonoText = styled(Text)`
-  font-family: ${props => props.theme.fonts.mono};
   width: fit-content;
-  opacity: 0.7;
   border-radius: 4px;
 `;
 
diff --git a/web/packages/teleterm/src/ui/Search/SearchBar.tsx b/web/packages/teleterm/src/ui/Search/SearchBar.tsx
index f3f69e201db10..d29d28ef40549 100644
--- a/web/packages/teleterm/src/ui/Search/SearchBar.tsx
+++ b/web/packages/teleterm/src/ui/Search/SearchBar.tsx
@@ -144,6 +144,7 @@ function SearchBar() {
         height: 100%;
         border: 1px ${props => props.theme.colors.buttons.border.border} solid;
         border-radius: ${props => props.theme.radii[2]}px;
+
         &:hover {
           background: ${props => props.theme.colors.spotBackground[0]};
         }
@@ -152,10 +153,20 @@ function SearchBar() {
       ref={containerRef}
     >
       {!isOpen && (
-        <>
-          <Input {...defaultInputProps} />
+        <Flex alignItems="center" flex={1}>
+          <Input
+            {...defaultInputProps}
+            // Adds `text-overflow: ellipsis` only to the closed state.
+            // Generally, ellipsis does not work when the input is focused.
+            // This causes flickering when an item is selected by clicking -
+            // the input loses focus, the ellipsis activates for a moment,
+            // and after a fraction of a second is removed when the input receives focus back.
+            css={`
+              text-overflow: ellipsis;
+            `}
+          />
           <Shortcut>{getAccelerator(OPEN_SEARCH_BAR_SHORTCUT_ACTION)}</Shortcut>
-        </>
+        </Flex>
       )}
       {isOpen && (
         <activePicker.picker
@@ -189,11 +200,7 @@ const Input = styled.input`
   }
 `;
 
-const Shortcut = styled(Box).attrs({ p: 1 })`
-  position: absolute;
-  right: ${props => props.theme.space[2]}px;
-  top: 50%;
-  transform: translate(0, -50%);
+const Shortcut = styled(Box).attrs({ p: 1, mr: 2 })`
   color: ${({ theme }) => theme.colors.text.slightlyMuted};
   background-color: ${({ theme }) => theme.colors.spotBackground[0]};
   line-height: 12px;
diff --git a/web/packages/teleterm/src/ui/Search/useSearch.ts b/web/packages/teleterm/src/ui/Search/useSearch.ts
index 12a29bf32422a..9cdc84b927849 100644
--- a/web/packages/teleterm/src/ui/Search/useSearch.ts
+++ b/web/packages/teleterm/src/ui/Search/useSearch.ts
@@ -181,9 +181,9 @@ export function useFilterSearch() {
       };
       const getResourceType = () => {
         let resourceTypes = [
-          'kubes' as const,
           'servers' as const,
           'databases' as const,
+          'kubes' as const,
         ];
         if (search) {
           resourceTypes = resourceTypes.filter(resourceType =>
diff --git a/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/RecentClusters.tsx b/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/RecentClusters.tsx
index e58c9ac9164b2..f2f226376697c 100644
--- a/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/RecentClusters.tsx
+++ b/web/packages/teleterm/src/ui/TabHost/ClusterConnectPanel/RecentClusters.tsx
@@ -47,7 +47,7 @@ export function RecentClusters() {
   }
 
   return (
-    <Card p={3} maxWidth="480px" bg="levels.surface" m="auto">
+    <Card p={3} maxWidth="480px" m="auto">
       <Text bold fontSize={3} mb={1}>
         Recent clusters
       </Text>
diff --git a/web/packages/teleterm/src/ui/TabHost/TabHost.tsx b/web/packages/teleterm/src/ui/TabHost/TabHost.tsx
index fdc544e0a49d9..7a76a18c9e35d 100644
--- a/web/packages/teleterm/src/ui/TabHost/TabHost.tsx
+++ b/web/packages/teleterm/src/ui/TabHost/TabHost.tsx
@@ -106,7 +106,6 @@ export function TabHost({ ctx }: { ctx: IAppContext }) {
           onContextMenu={handleTabContextMenu}
           activeTab={activeDocument?.uri}
           onMoved={handleTabMoved}
-          disableNew={false}
           onNew={openClusterTab}
           newTabTooltip={getLabelWithAccelerator('New Tab', 'newTab')}
           closeTabTooltip={getLabelWithAccelerator('Close', 'closeTab')}
diff --git a/web/packages/teleterm/src/ui/Tabs/TabItem.tsx b/web/packages/teleterm/src/ui/Tabs/TabItem.tsx
index 5b0e6a6419b23..d69b9e59c59ea 100644
--- a/web/packages/teleterm/src/ui/Tabs/TabItem.tsx
+++ b/web/packages/teleterm/src/ui/Tabs/TabItem.tsx
@@ -16,7 +16,7 @@ limitations under the License.
 
 import React, { useRef } from 'react';
 import styled from 'styled-components';
-import { Close as CloseIcon } from 'design/Icon';
+import * as Icons from 'design/Icon';
 import { ButtonIcon, Text } from 'design';
 
 import LinearProgress from 'teleterm/ui/components/LinearProgress';
@@ -27,6 +27,7 @@ type TabItemProps = {
   index?: number;
   name?: string;
   active?: boolean;
+  nextActive?: boolean;
   closeTabTooltip?: string;
   isLoading?: boolean;
   onClick?(): void;
@@ -39,6 +40,7 @@ export function TabItem(props: TabItemProps) {
   const {
     name,
     active,
+    nextActive,
     onClick,
     onClose,
     index,
@@ -62,71 +64,104 @@ export function TabItem(props: TabItemProps) {
   };
 
   return (
-    <StyledTabItem
+    <RelativeContainer
       onClick={onClick}
       onContextMenu={onContextMenu}
-      ref={ref}
-      active={active}
-      dragging={isDragging}
-      title={name}
-      canDrag={canDrag}
+      css={`
+        flex-grow: 1;
+        min-width: 0;
+      `}
     >
-      <Title color="inherit" fontWeight={700} fontSize="12px">
-        {name}
-      </Title>
-      {isLoading && active && <LinearProgress transparentBackground={true} />}
-      {onClose && (
+      <TabContent
+        ref={ref}
+        active={active}
+        dragging={isDragging}
+        canDrag={canDrag}
+        title={name}
+      >
+        <Title color="inherit" fontWeight={700} fontSize="12px">
+          {name}
+        </Title>
+        {isLoading && active && <LinearProgress transparentBackground={true} />}
+        {onClose && (
+          <ButtonIcon
+            size={0}
+            mr={1}
+            title={closeTabTooltip}
+            css={`
+              transition: none;
+            `}
+            onClick={handleClose}
+          >
+            <Icons.Close fontSize="16px" />
+          </ButtonIcon>
+        )}
+      </TabContent>
+      {!active && !nextActive && <Separator />}
+      {(!active || isDragging) && <BottomShadow />}
+    </RelativeContainer>
+  );
+}
+
+type NewTabItemProps = {
+  tooltip: string;
+  onClick(): void;
+};
+
+export function NewTabItem(props: NewTabItemProps) {
+  return (
+    <RelativeContainer>
+      <TabContent active={false}>
         <ButtonIcon
+          ml="1"
+          mr="2"
           size={0}
-          mr={1}
-          title={closeTabTooltip}
-          css={`
-            transition: none;
-          `}
-          onClick={handleClose}
+          title={props.tooltip}
+          onClick={props.onClick}
         >
-          <CloseIcon fontSize="16px" />
+          <Icons.Add fontSize="16px" />
         </ButtonIcon>
-      )}
-    </StyledTabItem>
+      </TabContent>
+      <BottomShadow />
+    </RelativeContainer>
   );
 }
 
-const StyledTabItem = styled.div(({ theme, active, dragging, canDrag }) => {
-  const styles: any = {
-    display: 'flex',
-    flexBasis: '0',
-    flexGrow: '1',
-    opacity: '1',
-    color: theme.colors.text.slightlyMuted,
-    alignItems: 'center',
-    minWidth: '0',
-    height: '100%',
-    border: 'none',
-    borderRadius: '8px 8px 0 0',
-    '&:hover, &:focus': {
-      color: theme.colors.text.main,
-      transition: 'color .3s',
-    },
-    position: 'relative',
-  };
-
-  if (active) {
-    styles['backgroundColor'] = theme.colors.levels.sunken;
-    styles['color'] = theme.colors.text.main;
-    styles['transition'] = 'none';
-  }
-
-  if (dragging) {
-    styles['opacity'] = 0;
-  }
+const RelativeContainer = styled.div`
+  position: relative;
+  display: flex;
+  flex-basis: 0;
+  align-items: center;
+  height: 100%;
+`;
 
-  if (canDrag) {
-    styles['cursor'] = 'pointer';
+const TabContent = styled.div`
+  display: flex;
+  z-index: 1; // covers shadow from the top
+  align-items: center;
+  min-width: 0;
+  width: 100%;
+  height: 100%;
+  border-radius: 8px 8px 0 0;
+  position: relative;
+  opacity: ${props => (props.dragging ? 0 : 1)};
+  color: ${props =>
+    props.active
+      ? props.theme.colors.text.main
+      : props.theme.colors.text.slightlyMuted};
+  background: ${props =>
+    props.active
+      ? props.theme.colors.levels.sunken
+      : props.theme.colors.levels.surface};
+  box-shadow: ${props =>
+    props.active ? 'inset 0px 2px 1.5px -1px rgba(0, 0, 0, 0.12)' : undefined};
+
+  &:hover,
+  &:focus {
+    color: ${props => props.theme.colors.text.main};
+    transition: color 0.3s;
   }
-
-  return styles;
-});
+`;
 
 const Title = styled(Text)`
   display: block;
@@ -142,3 +177,23 @@ const Title = styled(Text)`
   min-width: 0;
   width: 100%;
 `;
+
+const BottomShadow = styled.div`
+  box-shadow: 0 2px 1px -1px rgba(0, 0, 0, 0.2), 0 1px 1.5px rgba(0, 0, 0, 0.13),
+    0 1px 4px rgba(0, 0, 0, 0.12);
+  position: absolute;
+  bottom: 0;
+  left: 0;
+  right: 0;
+  height: 1px;
+  background: inherit;
+`;
+
+const Separator = styled.div`
+  height: 23px;
+  width: 1px;
+  position: absolute;
+  z-index: 1;
+  right: 0;
+  background: ${props => props.theme.colors.spotBackground[2]};
+`;
diff --git a/web/packages/teleterm/src/ui/Tabs/Tabs.tsx b/web/packages/teleterm/src/ui/Tabs/Tabs.tsx
index 7914f144ceb9e..5add8560ef5ce 100644
--- a/web/packages/teleterm/src/ui/Tabs/Tabs.tsx
+++ b/web/packages/teleterm/src/ui/Tabs/Tabs.tsx
@@ -14,15 +14,14 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import React, { Fragment } from 'react';
+import React from 'react';
 import styled from 'styled-components';
 import { typography } from 'design/system';
-import { Box, ButtonIcon } from 'design';
-import * as Icons from 'design/Icon';
+import { Box } from 'design';
 
 import { Document } from 'teleterm/ui/services/workspacesService';
 
-import { TabItem } from './TabItem';
+import { TabItem, NewTabItem } from './TabItem';
 
 export function Tabs(props: Props) {
   const {
@@ -31,7 +30,6 @@ export function Tabs(props: Props) {
     onSelect,
     onClose,
     onNew,
-    disableNew,
     onMoved,
     onContextMenu,
     newTabTooltip,
@@ -39,48 +37,34 @@ export function Tabs(props: Props) {
     ...styledProps
   } = props;
 
-  const $emptyTab = (
-    <>
-      <TabItem active={true} />
-      <Separator />
-    </>
+  const $items = items.length ? (
+    items.map((item, index) => {
+      const active = item.uri === activeTab;
+      const nextActive = items[index + 1]?.uri === activeTab;
+      return (
+        <TabItem
+          key={item.uri}
+          index={index}
+          name={item.title}
+          active={active}
+          nextActive={nextActive}
+          onClick={() => onSelect(item)}
+          onClose={() => onClose(item)}
+          onContextMenu={() => onContextMenu(item)}
+          onMoved={onMoved}
+          isLoading={getIsLoading(item)}
+          closeTabTooltip={closeTabTooltip}
+        />
+      );
+    })
+  ) : (
+    <TabItem active={true} />
   );
 
-  const $items = items.length
-    ? items.map((item, index) => {
-        const active = item.uri === activeTab;
-        return (
-          <Fragment key={item.uri}>
-            <TabItem
-              index={index}
-              name={item.title}
-              active={active}
-              onClick={() => onSelect(item)}
-              onClose={() => onClose(item)}
-              onContextMenu={() => onContextMenu(item)}
-              onMoved={onMoved}
-              isLoading={getIsLoading(item)}
-              closeTabTooltip={closeTabTooltip}
-            />
-            <Separator />
-          </Fragment>
-        );
-      })
-    : $emptyTab;
-
   return (
     <StyledTabs as="nav" typography="h5" bold {...styledProps}>
       {$items}
-      <ButtonIcon
-        ml="1"
-        mr="2"
-        size={0}
-        disabled={disableNew}
-        title={newTabTooltip}
-        onClick={onNew}
-      >
-        <Icons.Add fontSize="16px" />
-      </ButtonIcon>
+      <NewTabItem tooltip={newTabTooltip} onClick={onNew} />
     </StyledTabs>
   );
 }
@@ -92,7 +76,6 @@ function getIsLoading(doc: Document): boolean {
 type Props = {
   items: Document[];
   activeTab: string;
-  disableNew: boolean;
   newTabTooltip: string;
   closeTabTooltip: string;
   onNew: () => void;
@@ -102,13 +85,6 @@ type Props = {
   [index: string]: any;
 };
 
-const Separator = styled.div`
-  height: 23px;
-  width: 1px;
-  margin: 0 1px;
-  background: ${props => props.theme.colors.spotBackground[2]};
-`;
-
 const StyledTabs = styled(Box)`
   background-color: ${props => props.theme.colors.levels.surface};
   min-height: 32px;
@@ -116,10 +92,8 @@ const StyledTabs = styled(Box)`
   flex-wrap: nowrap;
   align-items: center;
   flex-shrink: 0;
-  overflow: hidden;
+  max-width: 100%;
   position: relative;
   z-index: 1;
-  box-shadow: 0px 1px 10px 0px rgba(0, 0, 0, 0.12),
-    0px 4px 5px 0px rgba(0, 0, 0, 0.14), 0px 2px 4px -1px rgba(0, 0, 0, 0.2);
   ${typography}
 `;
diff --git a/web/packages/teleterm/src/ui/ThemeProvider/ThemeProvider.tsx b/web/packages/teleterm/src/ui/ThemeProvider/ThemeProvider.tsx
index 568f1b2b91cae..3b54b2318d86e 100644
--- a/web/packages/teleterm/src/ui/ThemeProvider/ThemeProvider.tsx
+++ b/web/packages/teleterm/src/ui/ThemeProvider/ThemeProvider.tsx
@@ -14,22 +14,62 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import React from 'react';
+import React, { useEffect, useState } from 'react';
 import {
   ThemeProvider as StyledThemeProvider,
   StyleSheetManager,
 } from 'styled-components';
 
+import { useAppContext } from 'teleterm/ui/appContextProvider';
+
 import { GlobalStyle } from './globals';
-import theme from './theme';
-
-export const ThemeProvider: React.FC = props => (
-  <StyledThemeProvider theme={theme}>
-    <StyleSheetManager disableVendorPrefixes>
-      <React.Fragment>
-        <GlobalStyle />
-        {props.children}
-      </React.Fragment>
-    </StyleSheetManager>
-  </StyledThemeProvider>
-);
+import { darkTheme, lightTheme } from './theme';
+
+export const ThemeProvider = (props: React.PropsWithChildren<unknown>) => {
+  // Listening to Electron's nativeTheme.on('updated') is a workaround.
+  // The renderer should be able to get the current theme via "prefers-color-scheme" media query.
+  // Unfortunately, it does not work correctly on Ubuntu where the query from above always returns the old value
+  // (for example, when the app was launched in a dark mode, it always returns 'dark'
+  // ignoring that the system theme is now 'light').
+  // Related Electron issue: https://github.com/electron/electron/issues/21427#issuecomment-589796481,
+  // Related Chromium issue: https://bugs.chromium.org/p/chromium/issues/detail?id=998903
+  //
+  // Additional issue is that nativeTheme does not return correct values at all on Fedora:
+  // https://github.com/electron/electron/issues/33635#issuecomment-1502215450
+  const ctx = useAppContext();
+  const [activeTheme, setActiveTheme] = useState(() =>
+    ctx.mainProcessClient.shouldUseDarkColors() ? darkTheme : lightTheme
+  );
+
+  useEffect(() => {
+    const { cleanup } = ctx.mainProcessClient.subscribeToNativeThemeUpdate(
+      ({ shouldUseDarkColors }) => {
+        setActiveTheme(shouldUseDarkColors ? darkTheme : lightTheme);
+      }
+    );
+
+    return cleanup;
+  }, [ctx.mainProcessClient]);
+
+  return (
+    <StaticThemeProvider theme={activeTheme}>
+      {props.children}
+    </StaticThemeProvider>
+  );
+};
+
+/** Uses a theme from a prop. Useful in storybook. */
+export const StaticThemeProvider = (
+  props: React.PropsWithChildren<{ theme?: unknown }>
+) => {
+  return (
+    <StyledThemeProvider theme={props.theme}>
+      <StyleSheetManager disableVendorPrefixes>
+        <React.Fragment>
+          <GlobalStyle />
+          {props.children}
+        </React.Fragment>
+      </StyleSheetManager>
+    </StyledThemeProvider>
+  );
+};
diff --git a/web/packages/teleterm/src/ui/ThemeProvider/index.ts b/web/packages/teleterm/src/ui/ThemeProvider/index.ts
index 8820126cfdff8..186c255fc6085 100644
--- a/web/packages/teleterm/src/ui/ThemeProvider/index.ts
+++ b/web/packages/teleterm/src/ui/ThemeProvider/index.ts
@@ -14,4 +14,4 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-export { ThemeProvider } from './ThemeProvider';
+export * from './ThemeProvider';
diff --git a/web/packages/teleterm/src/ui/ThemeProvider/theme.ts b/web/packages/teleterm/src/ui/ThemeProvider/theme.ts
index 682ca96a998f2..53e0c361994d2 100644
--- a/web/packages/teleterm/src/ui/ThemeProvider/theme.ts
+++ b/web/packages/teleterm/src/ui/ThemeProvider/theme.ts
@@ -19,23 +19,11 @@ import {
   darkTheme as designDarkTheme,
   lightTheme as designLightTheme,
 } from 'design/theme';
-import { lighten } from 'design/theme/utils/colorManipulator';
 
 const sansSerif = 'system-ui';
 
-const darkTheme = {
+export const darkTheme = {
   ...designDarkTheme,
-  colors: {
-    ...designDarkTheme.colors,
-    terminal: {
-      ...designDarkTheme.colors.terminal,
-      background: designDarkTheme.colors.levels.sunken,
-      cursorAccent: designDarkTheme.colors.levels.sunken,
-      brightWhite: lighten(designDarkTheme.colors.levels.sunken, 0.89),
-      white: lighten(designDarkTheme.colors.levels.sunken, 0.78),
-      brightBlack: lighten(designDarkTheme.colors.levels.sunken, 0.61),
-    },
-  },
   font: sansSerif,
   fonts: {
     sansSerif,
@@ -43,8 +31,7 @@ const darkTheme = {
   },
 };
 
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-const lightTheme = {
+export const lightTheme = {
   ...designLightTheme,
   font: sansSerif,
   fonts: {
@@ -52,5 +39,3 @@ const lightTheme = {
     mono: fonts.mono,
   },
 };
-
-export default darkTheme;
diff --git a/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsIcon/ConnectionsIcon.tsx b/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsIcon/ConnectionsIcon.tsx
index 36d5e483eaee7..be5af2260a58a 100644
--- a/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsIcon/ConnectionsIcon.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/Connections/ConnectionsIcon/ConnectionsIcon.tsx
@@ -58,7 +58,7 @@ const Container = styled.div`
 
 const StyledButton = styled(Button)`
   background: ${props => props.theme.colors.spotBackground[0]};
-  padding: 9px;
-  width: 30px;
-  height: 30px;
+  padding: 0;
+  width: ${props => props.theme.space[5]}px;
+  height: ${props => props.theme.space[5]}px;
 `;
diff --git a/web/packages/teleterm/src/ui/TopBar/TopBar.tsx b/web/packages/teleterm/src/ui/TopBar/TopBar.tsx
index ab435bce7e278..1d5d49a7ec17a 100644
--- a/web/packages/teleterm/src/ui/TopBar/TopBar.tsx
+++ b/web/packages/teleterm/src/ui/TopBar/TopBar.tsx
@@ -49,7 +49,6 @@ const Grid = styled(Flex).attrs({ gap: 3, py: 2, px: 3 })`
   height: 56px;
   align-items: center;
   justify-content: space-between;
-  z-index: 2; // minimally higher z-index than the one defined in StyledTabs, so that its drop-shadow doesn't cover the TopBar
 `;
 
 const CentralContainer = styled(Flex).attrs({ gap: 3 })`
@@ -60,9 +59,7 @@ const CentralContainer = styled(Flex).attrs({ gap: 3 })`
   max-width: calc(${props => props.theme.space[10]}px * 9);
 `;
 
-const JustifyLeft = styled.div`
-  display: flex;
-  justify-self: start;
+const JustifyLeft = styled(Flex).attrs({ gap: 3 })`
   align-items: center;
   height: 100%;
 `;
diff --git a/web/packages/teleterm/src/ui/services/clusters/clustersService.ts b/web/packages/teleterm/src/ui/services/clusters/clustersService.ts
index 8fe0fc6735122..d6c181693e31b 100644
--- a/web/packages/teleterm/src/ui/services/clusters/clustersService.ts
+++ b/web/packages/teleterm/src/ui/services/clusters/clustersService.ts
@@ -151,8 +151,6 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
    */
   private async syncRootCluster(clusterUri: uri.RootClusterUri) {
     await Promise.all([
-      // syncClusterInfo never fails with a retryable error since it reads data from disk.
-      // syncLeafClusters reaches out to the proxy so it might return a retryable error.
       this.syncClusterInfo(clusterUri),
       this.syncLeafClustersList(clusterUri),
     ]);
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsService.ts b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsService.ts
index c96a35c9fd66f..444a6e798827a 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsService.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsService.ts
@@ -15,7 +15,13 @@ limitations under the License.
 */
 
 import { unique } from 'teleterm/ui/utils/uid';
-import { DocumentUri, ServerUri, paths, routing } from 'teleterm/ui/uri';
+import {
+  DocumentUri,
+  ServerUri,
+  paths,
+  routing,
+  RootClusterUri,
+} from 'teleterm/ui/uri';
 
 import {
   CreateAccessRequestDocumentOpts,
@@ -25,6 +31,7 @@ import {
   Document,
   DocumentAccessRequests,
   DocumentCluster,
+  DocumentConnectMyComputerSetup,
   DocumentGateway,
   DocumentGatewayCliClient,
   DocumentOrigin,
@@ -181,6 +188,21 @@ export class DocumentsService {
     };
   }
 
+  createConnectMyComputerSetupDocument(opts: {
+    // URI of the root cluster could be passed to the `DocumentsService`
+    // constructor and then to the document, instead of being taken from the parameter.
+    // However, we decided not to do so because other documents are based only on the provided parameters.
+    rootClusterUri: RootClusterUri;
+  }): DocumentConnectMyComputerSetup {
+    const uri = routing.getDocUri({ docId: unique() });
+    return {
+      uri,
+      kind: 'doc.connect_my_computer_setup',
+      title: 'Connect My Computer',
+      rootClusterUri: opts.rootClusterUri,
+    };
+  }
+
   openNewTerminal(opts: { rootClusterId: string; leafClusterId?: string }) {
     const doc = ((): Document => {
       const activeDocument = this.getActive();
@@ -263,7 +285,10 @@ export class DocumentsService {
 
   isActive(uri: string) {
     const location = this.getLocation();
-    return !!routing.parseUri(location, { exact: true, path: uri });
+    return !!routing.parseUri(location, {
+      exact: true,
+      path: uri,
+    });
   }
 
   add(doc: Document, position?: number) {
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsUtils.ts b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsUtils.ts
index 826f7cd528a66..6f4b09a763103 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsUtils.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/documentsUtils.ts
@@ -49,6 +49,8 @@ export function getResourceUri(
         rootClusterId: document.rootClusterId,
         leafClusterId: document.leafClusterId,
       });
+    case 'doc.connect_my_computer_setup':
+      return document.rootClusterUri;
     case 'doc.blank':
       return undefined;
     default:
diff --git a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/types.ts b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/types.ts
index 29c8b5c3260ec..fa84444d11d73 100644
--- a/web/packages/teleterm/src/ui/services/workspacesService/documentsService/types.ts
+++ b/web/packages/teleterm/src/ui/services/workspacesService/documentsService/types.ts
@@ -152,6 +152,14 @@ export interface DocumentPtySession extends DocumentBase {
   leafClusterId?: string;
 }
 
+export interface DocumentConnectMyComputerSetup extends DocumentBase {
+  kind: 'doc.connect_my_computer_setup';
+  // `DocumentConnectMyComputerSetup` always operates on the root cluster, so in theory `rootClusterUri` is not needed.
+  // However, there are a few components in the system, such as `getResourceUri`, which need to determine the relation
+  // between a document and a cluster just by looking at the document fields.
+  rootClusterUri: uri.RootClusterUri;
+}
+
 export type DocumentTerminal =
   | DocumentPtySession
   | DocumentGatewayCliClient
@@ -163,7 +171,8 @@ export type Document =
   | DocumentBlank
   | DocumentGateway
   | DocumentCluster
-  | DocumentTerminal;
+  | DocumentTerminal
+  | DocumentConnectMyComputerSetup;
 
 export function isDocumentTshNodeWithLoginHost(
   doc: Document
diff --git a/yarn.lock b/yarn.lock
index 7ce325b5f439e..04bef222876ef 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2605,6 +2605,45 @@
   resolved "https://registry.yarnpkg.com/@react-dnd/shallowequal/-/shallowequal-2.0.0.tgz#a3031eb54129f2c66b2753f8404266ec7bf67f0a"
   integrity sha512-Pc/AFTdwZwEKJxFJvlxrSmGe/di+aAOBn60sremrpLo6VI/6cmiUYNNwlI5KNYttg7uypzA3ILPMPgxB2GYZEg==
 
+"@react-spring/animated@~9.7.3":
+  version "9.7.3"
+  resolved "https://registry.yarnpkg.com/@react-spring/animated/-/animated-9.7.3.tgz#4211b1a6d48da0ff474a125e93c0f460ff816e0f"
+  integrity sha512-5CWeNJt9pNgyvuSzQH+uy2pvTg8Y4/OisoscZIR8/ZNLIOI+CatFBhGZpDGTF/OzdNFsAoGk3wiUYTwoJ0YIvw==
+  dependencies:
+    "@react-spring/shared" "~9.7.3"
+    "@react-spring/types" "~9.7.3"
+
+"@react-spring/core@~9.7.3":
+  version "9.7.3"
+  resolved "https://registry.yarnpkg.com/@react-spring/core/-/core-9.7.3.tgz#60056bcb397f2c4f371c6c9a5f882db77ae90095"
+  integrity sha512-IqFdPVf3ZOC1Cx7+M0cXf4odNLxDC+n7IN3MDcVCTIOSBfqEcBebSv+vlY5AhM0zw05PDbjKrNmBpzv/AqpjnQ==
+  dependencies:
+    "@react-spring/animated" "~9.7.3"
+    "@react-spring/shared" "~9.7.3"
+    "@react-spring/types" "~9.7.3"
+
+"@react-spring/shared@~9.7.3":
+  version "9.7.3"
+  resolved "https://registry.yarnpkg.com/@react-spring/shared/-/shared-9.7.3.tgz#4cf29797847c689912aec4e62e34c99a4d5d9e53"
+  integrity sha512-NEopD+9S5xYyQ0pGtioacLhL2luflh6HACSSDUZOwLHoxA5eku1UPuqcJqjwSD6luKjjLfiLOspxo43FUHKKSA==
+  dependencies:
+    "@react-spring/types" "~9.7.3"
+
+"@react-spring/types@~9.7.3":
+  version "9.7.3"
+  resolved "https://registry.yarnpkg.com/@react-spring/types/-/types-9.7.3.tgz#ea78fd447cbc2612c1f5d55852e3c331e8172a0b"
+  integrity sha512-Kpx/fQ/ZFX31OtlqVEFfgaD1ACzul4NksrvIgYfIFq9JpDHFwQkMVZ10tbo0FU/grje4rcL4EIrjekl3kYwgWw==
+
+"@react-spring/web@^9.7.2":
+  version "9.7.3"
+  resolved "https://registry.yarnpkg.com/@react-spring/web/-/web-9.7.3.tgz#d9f4e17fec259f1d65495a19502ada4f5b57fa3d"
+  integrity sha512-BXt6BpS9aJL/QdVqEIX9YoUy8CE6TJrU0mNCqSoxdXlIeNcEBWOfIyE6B14ENNsyQKS3wOWkiJfco0tCr/9tUg==
+  dependencies:
+    "@react-spring/animated" "~9.7.3"
+    "@react-spring/core" "~9.7.3"
+    "@react-spring/shared" "~9.7.3"
+    "@react-spring/types" "~9.7.3"
+
 "@sindresorhus/is@^4.0.0":
   version "4.6.0"
   resolved "https://registry.yarnpkg.com/@sindresorhus/is/-/is-4.6.0.tgz#3c7c9c46e678feefe7a2e5bb609d3dbd665ffb3f"
@@ -3565,6 +3604,13 @@
   resolved "https://registry.yarnpkg.com/@types/cookie/-/cookie-0.4.1.tgz#bfd02c1f2224567676c1545199f87c3a861d878d"
   integrity sha512-XW/Aa8APYr6jSVVA1y/DEIZX0/GMKLEVekNG727R8cs56ahETkRAy/3DR7+fJyh7oUgGwNQaRfXCun0+KbWY7Q==
 
+"@types/debug@^4.0.0":
+  version "4.1.8"
+  resolved "https://registry.yarnpkg.com/@types/debug/-/debug-4.1.8.tgz#cef723a5d0a90990313faec2d1e22aee5eecb317"
+  integrity sha512-/vPO1EPOs306Cvhwv7KfVfYvOJqA/S/AXjaHQiJboCZzcNDb+TIJFN9/2C9DZ//ijSKWioNyUxD792QmDJ+HKQ==
+  dependencies:
+    "@types/ms" "*"
+
 "@types/debug@^4.1.6", "@types/debug@^4.1.7":
   version "4.1.7"
   resolved "https://registry.yarnpkg.com/@types/debug/-/debug-4.1.7.tgz#7cc0ea761509124709b8b2d1090d8f6c17aadb82"
@@ -3873,6 +3919,11 @@
   resolved "https://registry.yarnpkg.com/@types/prop-types/-/prop-types-15.7.4.tgz#fcf7205c25dff795ee79af1e30da2c9790808f11"
   integrity sha512-rZ5drC/jWjrArrS8BR6SIr4cWpW09RNTYt9AMZo3Jwwif+iacXAqgVjm0B0Bv/S1jhDXKHqRVNCbACkJ89RAnQ==
 
+"@types/prop-types@^15.0.0":
+  version "15.7.5"
+  resolved "https://registry.yarnpkg.com/@types/prop-types/-/prop-types-15.7.5.tgz#5f19d2b85a98e9558036f6a3cacc8819420f05cf"
+  integrity sha512-JCB8C6SnDoQf0cNycqd/35A7MjcnK+ZTqE7judS6o7utxUCg6imJg3QK2qzHKszlTjcj2cn+NwMB2i96ubpj7w==
+
 "@types/qs@*", "@types/qs@^6.9.5":
   version "6.9.7"
   resolved "https://registry.yarnpkg.com/@types/qs/-/qs-6.9.7.tgz#63bb7d067db107cc1e457c303bc25d511febf6cb"
@@ -4276,6 +4327,18 @@
     "@typescript-eslint/types" "5.59.5"
     eslint-visitor-keys "^3.3.0"
 
+"@use-gesture/core@10.2.27":
+  version "10.2.27"
+  resolved "https://registry.yarnpkg.com/@use-gesture/core/-/core-10.2.27.tgz#0f24b17c036cd828ba07e3451ff45e2df959c6f5"
+  integrity sha512-V4XV7hn9GAD2MYu8yBBVi5iuWBsAMfjPRMsEVzoTNGYH72tf0kFP+OKqGKc8YJFQIJx6yj+AOqxmEHOmx2/MEA==
+
+"@use-gesture/react@^10.2.27":
+  version "10.2.27"
+  resolved "https://registry.yarnpkg.com/@use-gesture/react/-/react-10.2.27.tgz#7fbd50d14449ec5bc49c9b6cfef8a2845f5e0608"
+  integrity sha512-7E5vnWCxeslWlxwZ8uKIcnUZVMTRMZ8cvSnLLKF1NkyNb3PnNiAzoXM4G1vTKJKRhgOTeI6wK1YsEpwo9ABV5w==
+  dependencies:
+    "@use-gesture/core" "10.2.27"
+
 "@vitejs/plugin-react-swc@^3.2.0":
   version "3.2.0"
   resolved "https://registry.yarnpkg.com/@vitejs/plugin-react-swc/-/plugin-react-swc-3.2.0.tgz#7c4f6e116a296c27f680d05750f9dbf798cf7709"
@@ -5186,6 +5249,11 @@ bail@^1.0.0:
   resolved "https://registry.yarnpkg.com/bail/-/bail-1.0.5.tgz#b6fa133404a392cbc1f8c4bf63f5953351e7a776"
   integrity sha512-xFbRxM1tahm08yHBP16MMjVUAvDaBMD38zsM9EMAUN61omwLmKlOpB/Zku5QkjZ8TZ4vn53pj+t518cH0S03RQ==
 
+bail@^2.0.0:
+  version "2.0.2"
+  resolved "https://registry.yarnpkg.com/bail/-/bail-2.0.2.tgz#d26f5cd8fe5d6f832a31517b9f7c356040ba6d5d"
+  integrity sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==
+
 balanced-match@^1.0.0:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.2.tgz#e83e3a7e3f300b34cb9d87f615fa0cbf357690ee"
@@ -5630,6 +5698,11 @@ ccount@^1.0.0:
   resolved "https://registry.yarnpkg.com/ccount/-/ccount-1.1.0.tgz#246687debb6014735131be8abab2d93898f8d043"
   integrity sha512-vlNK021QdI7PNeiUh/lKkC/mNHHfV0m/Ad5JoI0TYtlBnJAslM/JIkm/tGC88bkLIwO6OQ5uV6ztS6kVAtCDlg==
 
+ccount@^2.0.0:
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/ccount/-/ccount-2.0.1.tgz#17a3bf82302e0870d6da43a01311a8bc02a3ecf5"
+  integrity sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==
+
 chalk@4.1.1:
   version "4.1.1"
   resolved "https://registry.yarnpkg.com/chalk/-/chalk-4.1.1.tgz#c80b3fab28bf6371e6863325eee67e618b77e6ad"
@@ -5678,6 +5751,11 @@ character-entities@^1.0.0:
   resolved "https://registry.yarnpkg.com/character-entities/-/character-entities-1.2.4.tgz#e12c3939b7eaf4e5b15e7ad4c5e28e1d48c5b16b"
   integrity sha512-iBMyeEHxfVnIakwOuDXpVkc54HijNgCyQB2w0VfGQThle6NXn50zU6V/u+LDhxHcDUPojn6Kpga3PTAD8W1bQw==
 
+character-entities@^2.0.0:
+  version "2.0.2"
+  resolved "https://registry.yarnpkg.com/character-entities/-/character-entities-2.0.2.tgz#2d09c2e72cd9523076ccb21157dff66ad43fcc22"
+  integrity sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==
+
 character-reference-invalid@^1.0.0:
   version "1.1.4"
   resolved "https://registry.yarnpkg.com/character-reference-invalid/-/character-reference-invalid-1.1.4.tgz#083329cda0eae272ab3dbbf37e9a382c13af1560"
@@ -5960,6 +6038,11 @@ comma-separated-tokens@^1.0.0:
   resolved "https://registry.yarnpkg.com/comma-separated-tokens/-/comma-separated-tokens-1.0.8.tgz#632b80b6117867a158f1080ad498b2fbe7e3f5ea"
   integrity sha512-GHuDRO12Sypu2cV70d1dkA2EUmXHgntrzbpvOB+Qy+49ypNfGgFQIC2fhhXbnyrJRynDCAARsT7Ou0M6hirpfw==
 
+comma-separated-tokens@^2.0.0:
+  version "2.0.3"
+  resolved "https://registry.yarnpkg.com/comma-separated-tokens/-/comma-separated-tokens-2.0.3.tgz#4e89c9458acb61bc8fef19f4529973b2392839ee"
+  integrity sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==
+
 commander@^2.19.0, commander@^2.20.0:
   version "2.20.3"
   resolved "https://registry.yarnpkg.com/commander/-/commander-2.20.3.tgz#fd485e84c03eb4881c20722ba48035e8531aeb33"
@@ -6392,7 +6475,7 @@ debug@2.6.9, debug@^2.2.0, debug@^2.3.3, debug@^2.6.0, debug@^2.6.9:
   dependencies:
     ms "2.0.0"
 
-debug@4, debug@^4.3.3, debug@^4.3.4:
+debug@4, debug@^4.0.0, debug@^4.3.3, debug@^4.3.4:
   version "4.3.4"
   resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.4.tgz#1319f6579357f2338d3337d2cdd4914bb5dcc865"
   integrity sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==
@@ -6418,6 +6501,13 @@ decimal.js@^10.2.1, decimal.js@^10.4.2:
   resolved "https://registry.yarnpkg.com/decimal.js/-/decimal.js-10.4.3.tgz#1044092884d245d1b7f65725fa4ad4c6f781cc23"
   integrity sha512-VBBaLc1MgL5XpzgIP7ny5Z6Nx3UrRkIViUkPUdtl9aya5amy3De1gsUUSB1g3+3sExYNjCAsAznmukyxCb1GRA==
 
+decode-named-character-reference@^1.0.0:
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/decode-named-character-reference/-/decode-named-character-reference-1.0.2.tgz#daabac9690874c394c81e4162a0304b35d824f0e"
+  integrity sha512-O8x12RzrUF8xyVcY0KJowWsmaJxQbmy0/EtnNtHRpsOcT7dFk5W598coHqBVpmWo1oQQfsCqfCmkZN5DJrZVdg==
+  dependencies:
+    character-entities "^2.0.0"
+
 decode-uri-component@^0.2.0:
   version "0.2.2"
   resolved "https://registry.yarnpkg.com/decode-uri-component/-/decode-uri-component-0.2.2.tgz#e69dbe25d37941171dd540e024c444cd5188e1e9"
@@ -6541,6 +6631,11 @@ depd@^1.1.2, depd@~1.1.2:
   resolved "https://registry.yarnpkg.com/depd/-/depd-1.1.2.tgz#9bcd52e14c097763e749b274c4346ed2e560b5a9"
   integrity sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==
 
+dequal@^2.0.0:
+  version "2.0.3"
+  resolved "https://registry.yarnpkg.com/dequal/-/dequal-2.0.3.tgz#2644214f1997d39ed0ee0ece72335490a7ac67be"
+  integrity sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==
+
 destroy@1.2.0:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/destroy/-/destroy-1.2.0.tgz#4803735509ad8be552934c67df614f94e66fa015"
@@ -6593,6 +6688,11 @@ diff-sequences@^27.5.1:
   resolved "https://registry.yarnpkg.com/diff-sequences/-/diff-sequences-27.5.1.tgz#eaecc0d327fd68c8d9672a1e64ab8dccb2ef5327"
   integrity sha512-k1gCAXAsNgLwEL+Y8Wvl+M6oEFj5bgazfZULpS5CneoPPXRaCCW7dm+q21Ky2VEE5X+VeRDBVg1Pcvvsr4TtNQ==
 
+diff@^5.0.0:
+  version "5.1.0"
+  resolved "https://registry.yarnpkg.com/diff/-/diff-5.1.0.tgz#bc52d298c5ea8df9194800224445ed43ffc87e40"
+  integrity sha512-D+mk+qE8VC/PAUrlAU34N+VfXev0ghe5ywmpqrawphmVZc1bEfn56uo9qpyGp1p4xpzOHkSW4ztBd6L7Xx4ACw==
+
 dir-compare@^3.0.0:
   version "3.3.0"
   resolved "https://registry.yarnpkg.com/dir-compare/-/dir-compare-3.3.0.tgz#2c749f973b5c4b5d087f11edaae730db31788416"
@@ -6835,10 +6935,10 @@ electron-to-chromium@^1.4.284:
   resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.4.304.tgz#d6eb7fea4073aacc471cf117df08b4b4978dc6ad"
   integrity sha512-6c8M+ojPgDIXN2NyfGn8oHASXYnayj+gSEnGeLMKb9zjsySeVB/j7KkNAAG9yDcv8gNlhvFg5REa1N/kQU6pgA==
 
-electron@24.3.0:
-  version "24.3.0"
-  resolved "https://registry.yarnpkg.com/electron/-/electron-24.3.0.tgz#d1ef519b0d6d86cc4992519b49821372cb957fe6"
-  integrity sha512-M7PpfpOzGdLeZPr2xhxXuvJeoXPEHMH40Rtv8BCGleRPolwna9BepAGc0H0F+Uz5kGKOv3xcm99fTurvXUH0nw==
+electron@25.1.1:
+  version "25.1.1"
+  resolved "https://registry.yarnpkg.com/electron/-/electron-25.1.1.tgz#b7aaf0d66a56fbbbad987c13cee108642f63bd50"
+  integrity sha512-WvFUfVsJn6YiP35UxdibYVjU2LceastyMm4SVp2bmb4XvKEvItAIiwxgm7tPC5Syl1243aRCvQLqr84sZ71pyQ==
   dependencies:
     "@electron/get" "^2.0.0"
     "@types/node" "^18.11.18"
@@ -7162,6 +7262,11 @@ escape-string-regexp@^4.0.0:
   resolved "https://registry.yarnpkg.com/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz#14ba83a5d373e3d311e5afca29cf5bfad965bf34"
   integrity sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==
 
+escape-string-regexp@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz#4683126b500b61762f2dbebace1806e8be31b1c8"
+  integrity sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==
+
 escodegen@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/escodegen/-/escodegen-2.0.0.tgz#5e32b12833e8aa8fa35e1bf0befa89380484c7dd"
@@ -8619,6 +8724,11 @@ hast-util-to-parse5@^6.0.0:
     xtend "^4.0.0"
     zwitch "^1.0.0"
 
+hast-util-whitespace@^2.0.0:
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/hast-util-whitespace/-/hast-util-whitespace-2.0.1.tgz#0ec64e257e6fc216c7d14c8a1b74d27d650b4557"
+  integrity sha512-nAxA0v8+vXSBDt3AnRUNjyRIQ0rD+ntpbAp4LnPkumc5M9yUbSMa4XDU9Q6etY4f1Wp4bNgvc1yjiZtsTTrSng==
+
 hastscript@^6.0.0:
   version "6.0.0"
   resolved "https://registry.yarnpkg.com/hastscript/-/hastscript-6.0.0.tgz#e8768d7eac56c3fdeac8a92830d58e811e5bf640"
@@ -9206,7 +9316,7 @@ is-core-module@^2.11.0, is-core-module@^2.8.0, is-core-module@^2.9.0:
   dependencies:
     has "^1.0.3"
 
-is-core-module@^2.2.0, is-core-module@^2.7.0:
+is-core-module@^2.7.0:
   version "2.8.0"
   resolved "https://registry.yarnpkg.com/is-core-module/-/is-core-module-2.8.0.tgz#0321336c3d0925e497fd97f5d95cb114a5ccd548"
   integrity sha512-vd15qHsaqrRL7dtH6QNuy0ndJmRDrS9HAM1CAiSifNUFv4x1a0CCVsj18hJ1mShxIG6T2i1sO78MkP56r0nYRw==
@@ -9403,6 +9513,11 @@ is-plain-obj@^3.0.0:
   resolved "https://registry.yarnpkg.com/is-plain-obj/-/is-plain-obj-3.0.0.tgz#af6f2ea14ac5a646183a5bbdb5baabbc156ad9d7"
   integrity sha512-gwsOE28k+23GP1B6vFl1oVh/WOzmawBrKwo5Ev6wMKzPkaXaCDIQKzLnvsA42DRlbVTWorkgTKIviAKCWkfUwA==
 
+is-plain-obj@^4.0.0:
+  version "4.1.0"
+  resolved "https://registry.yarnpkg.com/is-plain-obj/-/is-plain-obj-4.1.0.tgz#d65025edec3657ce032fd7db63c97883eaed71f0"
+  integrity sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==
+
 is-plain-object@5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/is-plain-object/-/is-plain-object-5.0.0.tgz#4427f50ab3429e9025ea7d52e9043a9ef4159344"
@@ -10328,6 +10443,11 @@ kleur@^3.0.3:
   resolved "https://registry.yarnpkg.com/kleur/-/kleur-3.0.3.tgz#a79c9ecc86ee1ce3fa6206d1216c501f147fc07e"
   integrity sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==
 
+kleur@^4.0.3:
+  version "4.1.5"
+  resolved "https://registry.yarnpkg.com/kleur/-/kleur-4.1.5.tgz#95106101795f7050c6c650f350c683febddb1780"
+  integrity sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==
+
 klona@^2.0.4:
   version "2.0.5"
   resolved "https://registry.yarnpkg.com/klona/-/klona-2.0.5.tgz#d166574d90076395d9963aa7a928fabb8d76afbc"
@@ -10491,6 +10611,11 @@ long@^4.0.0:
   resolved "https://registry.yarnpkg.com/long/-/long-4.0.0.tgz#9a7b71cfb7d361a194ea555241c92f7468d5bf28"
   integrity sha512-XsP+KhQif4bjX1kbuSiySJFNAehNxgLb6hPRGJ9QsUr8ajHkuXGdrHmFUTUUXhDwVX2R5bY4JNZEwbUiMhV+MA==
 
+longest-streak@^3.0.0:
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/longest-streak/-/longest-streak-3.1.0.tgz#62fa67cd958742a1574af9f39866364102d90cd4"
+  integrity sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==
+
 loose-envify@^1.1.0, loose-envify@^1.2.0, loose-envify@^1.3.1, loose-envify@^1.4.0:
   version "1.4.0"
   resolved "https://registry.yarnpkg.com/loose-envify/-/loose-envify-1.4.0.tgz#71ee51fa7be4caec1a63839f7e682d8132d30caf"
@@ -10615,6 +10740,11 @@ markdown-escapes@^1.0.0:
   resolved "https://registry.yarnpkg.com/markdown-escapes/-/markdown-escapes-1.0.4.tgz#c95415ef451499d7602b91095f3c8e8975f78535"
   integrity sha512-8z4efJYk43E0upd0NbVXwgSTQs6cT3T06etieCMEg7dRbzCbxUCK/GHlX8mhHRDcp+OLlHkPKsvqQTCvsRl2cg==
 
+markdown-table@^3.0.0:
+  version "3.0.3"
+  resolved "https://registry.yarnpkg.com/markdown-table/-/markdown-table-3.0.3.tgz#e6331d30e493127e031dd385488b5bd326e4a6bd"
+  integrity sha512-Z1NL3Tb1M9wH4XESsCDEksWoKTdlUafKc4pt0GRwjUyXaCFZ+dc3g2erqB6zm3szA2IUSi7VnPI+o/9jnxh9hw==
+
 marked@^4.3.0:
   version "4.3.0"
   resolved "https://registry.yarnpkg.com/marked/-/marked-4.3.0.tgz#796362821b019f734054582038b116481b456cf3"
@@ -10641,6 +10771,109 @@ mdast-util-definitions@^4.0.0:
   dependencies:
     unist-util-visit "^2.0.0"
 
+mdast-util-definitions@^5.0.0:
+  version "5.1.2"
+  resolved "https://registry.yarnpkg.com/mdast-util-definitions/-/mdast-util-definitions-5.1.2.tgz#9910abb60ac5d7115d6819b57ae0bcef07a3f7a7"
+  integrity sha512-8SVPMuHqlPME/z3gqVwWY4zVXn8lqKv/pAhC57FuJ40ImXyBpmO5ukh98zB2v7Blql2FiHjHv9LVztSIqjY+MA==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    "@types/unist" "^2.0.0"
+    unist-util-visit "^4.0.0"
+
+mdast-util-find-and-replace@^2.0.0:
+  version "2.2.2"
+  resolved "https://registry.yarnpkg.com/mdast-util-find-and-replace/-/mdast-util-find-and-replace-2.2.2.tgz#cc2b774f7f3630da4bd592f61966fecade8b99b1"
+  integrity sha512-MTtdFRz/eMDHXzeK6W3dO7mXUlF82Gom4y0oOgvHhh/HXZAGvIQDUvQ0SuUx+j2tv44b8xTHOm8K/9OoRFnXKw==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    escape-string-regexp "^5.0.0"
+    unist-util-is "^5.0.0"
+    unist-util-visit-parents "^5.0.0"
+
+mdast-util-from-markdown@^1.0.0:
+  version "1.3.1"
+  resolved "https://registry.yarnpkg.com/mdast-util-from-markdown/-/mdast-util-from-markdown-1.3.1.tgz#9421a5a247f10d31d2faed2a30df5ec89ceafcf0"
+  integrity sha512-4xTO/M8c82qBcnQc1tgpNtubGUW/Y1tBQ1B0i5CtSoelOLKFYlElIr3bvgREYYO5iRqbMY1YuqZng0GVOI8Qww==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    "@types/unist" "^2.0.0"
+    decode-named-character-reference "^1.0.0"
+    mdast-util-to-string "^3.1.0"
+    micromark "^3.0.0"
+    micromark-util-decode-numeric-character-reference "^1.0.0"
+    micromark-util-decode-string "^1.0.0"
+    micromark-util-normalize-identifier "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+    unist-util-stringify-position "^3.0.0"
+    uvu "^0.5.0"
+
+mdast-util-gfm-autolink-literal@^1.0.0:
+  version "1.0.3"
+  resolved "https://registry.yarnpkg.com/mdast-util-gfm-autolink-literal/-/mdast-util-gfm-autolink-literal-1.0.3.tgz#67a13abe813d7eba350453a5333ae1bc0ec05c06"
+  integrity sha512-My8KJ57FYEy2W2LyNom4n3E7hKTuQk/0SES0u16tjA9Z3oFkF4RrC/hPAPgjlSpezsOvI8ObcXcElo92wn5IGA==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    ccount "^2.0.0"
+    mdast-util-find-and-replace "^2.0.0"
+    micromark-util-character "^1.0.0"
+
+mdast-util-gfm-footnote@^1.0.0:
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/mdast-util-gfm-footnote/-/mdast-util-gfm-footnote-1.0.2.tgz#ce5e49b639c44de68d5bf5399877a14d5020424e"
+  integrity sha512-56D19KOGbE00uKVj3sgIykpwKL179QsVFwx/DCW0u/0+URsryacI4MAdNJl0dh+u2PSsD9FtxPFbHCzJ78qJFQ==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    mdast-util-to-markdown "^1.3.0"
+    micromark-util-normalize-identifier "^1.0.0"
+
+mdast-util-gfm-strikethrough@^1.0.0:
+  version "1.0.3"
+  resolved "https://registry.yarnpkg.com/mdast-util-gfm-strikethrough/-/mdast-util-gfm-strikethrough-1.0.3.tgz#5470eb105b483f7746b8805b9b989342085795b7"
+  integrity sha512-DAPhYzTYrRcXdMjUtUjKvW9z/FNAMTdU0ORyMcbmkwYNbKocDpdk+PX1L1dQgOID/+vVs1uBQ7ElrBQfZ0cuiQ==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    mdast-util-to-markdown "^1.3.0"
+
+mdast-util-gfm-table@^1.0.0:
+  version "1.0.7"
+  resolved "https://registry.yarnpkg.com/mdast-util-gfm-table/-/mdast-util-gfm-table-1.0.7.tgz#3552153a146379f0f9c4c1101b071d70bbed1a46"
+  integrity sha512-jjcpmNnQvrmN5Vx7y7lEc2iIOEytYv7rTvu+MeyAsSHTASGCCRA79Igg2uKssgOs1i1po8s3plW0sTu1wkkLGg==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    markdown-table "^3.0.0"
+    mdast-util-from-markdown "^1.0.0"
+    mdast-util-to-markdown "^1.3.0"
+
+mdast-util-gfm-task-list-item@^1.0.0:
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/mdast-util-gfm-task-list-item/-/mdast-util-gfm-task-list-item-1.0.2.tgz#b280fcf3b7be6fd0cc012bbe67a59831eb34097b"
+  integrity sha512-PFTA1gzfp1B1UaiJVyhJZA1rm0+Tzn690frc/L8vNX1Jop4STZgOE6bxUhnzdVSB+vm2GU1tIsuQcA9bxTQpMQ==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    mdast-util-to-markdown "^1.3.0"
+
+mdast-util-gfm@^2.0.0:
+  version "2.0.2"
+  resolved "https://registry.yarnpkg.com/mdast-util-gfm/-/mdast-util-gfm-2.0.2.tgz#e92f4d8717d74bdba6de57ed21cc8b9552e2d0b6"
+  integrity sha512-qvZ608nBppZ4icQlhQQIAdc6S3Ffj9RGmzwUKUWuEICFnd1LVkN3EktF7ZHAgfcEdvZB5owU9tQgt99e2TlLjg==
+  dependencies:
+    mdast-util-from-markdown "^1.0.0"
+    mdast-util-gfm-autolink-literal "^1.0.0"
+    mdast-util-gfm-footnote "^1.0.0"
+    mdast-util-gfm-strikethrough "^1.0.0"
+    mdast-util-gfm-table "^1.0.0"
+    mdast-util-gfm-task-list-item "^1.0.0"
+    mdast-util-to-markdown "^1.0.0"
+
+mdast-util-phrasing@^3.0.0:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/mdast-util-phrasing/-/mdast-util-phrasing-3.0.1.tgz#c7c21d0d435d7fb90956038f02e8702781f95463"
+  integrity sha512-WmI1gTXUBJo4/ZmSk79Wcb2HcjPJBzM1nlI/OUWA8yk2X9ik3ffNbBGsU+09BFmXaL1IBb9fiuvq6/KMiNycSg==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    unist-util-is "^5.0.0"
+
 mdast-util-to-hast@10.0.1:
   version "10.0.1"
   resolved "https://registry.yarnpkg.com/mdast-util-to-hast/-/mdast-util-to-hast-10.0.1.tgz#0cfc82089494c52d46eb0e3edb7a4eb2aea021eb"
@@ -10655,6 +10888,41 @@ mdast-util-to-hast@10.0.1:
     unist-util-position "^3.0.0"
     unist-util-visit "^2.0.0"
 
+mdast-util-to-hast@^12.1.0:
+  version "12.3.0"
+  resolved "https://registry.yarnpkg.com/mdast-util-to-hast/-/mdast-util-to-hast-12.3.0.tgz#045d2825fb04374e59970f5b3f279b5700f6fb49"
+  integrity sha512-pits93r8PhnIoU4Vy9bjW39M2jJ6/tdHyja9rrot9uujkN7UTU9SDnE6WNJz/IGyQk3XHX6yNNtrBH6cQzm8Hw==
+  dependencies:
+    "@types/hast" "^2.0.0"
+    "@types/mdast" "^3.0.0"
+    mdast-util-definitions "^5.0.0"
+    micromark-util-sanitize-uri "^1.1.0"
+    trim-lines "^3.0.0"
+    unist-util-generated "^2.0.0"
+    unist-util-position "^4.0.0"
+    unist-util-visit "^4.0.0"
+
+mdast-util-to-markdown@^1.0.0, mdast-util-to-markdown@^1.3.0:
+  version "1.5.0"
+  resolved "https://registry.yarnpkg.com/mdast-util-to-markdown/-/mdast-util-to-markdown-1.5.0.tgz#c13343cb3fc98621911d33b5cd42e7d0731171c6"
+  integrity sha512-bbv7TPv/WC49thZPg3jXuqzuvI45IL2EVAr/KxF0BSdHsU0ceFHOmwQn6evxAh1GaoK/6GQ1wp4R4oW2+LFL/A==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    "@types/unist" "^2.0.0"
+    longest-streak "^3.0.0"
+    mdast-util-phrasing "^3.0.0"
+    mdast-util-to-string "^3.0.0"
+    micromark-util-decode-string "^1.0.0"
+    unist-util-visit "^4.0.0"
+    zwitch "^2.0.0"
+
+mdast-util-to-string@^3.0.0, mdast-util-to-string@^3.1.0:
+  version "3.2.0"
+  resolved "https://registry.yarnpkg.com/mdast-util-to-string/-/mdast-util-to-string-3.2.0.tgz#66f7bb6324756741c5f47a53557f0cbf16b6f789"
+  integrity sha512-V4Zn/ncyN1QNSqSBxTrMOLpjr+IKdHl2v3KVLoWmDPscP4r9GcCi71gjgvUV1SFSKh92AjAG4peFuBl2/YgCJg==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+
 mdurl@^1.0.0:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/mdurl/-/mdurl-1.0.1.tgz#fe85b2ec75a59037f2adfec100fd6c601761152e"
@@ -10744,6 +11012,279 @@ microevent.ts@~0.1.1:
   resolved "https://registry.yarnpkg.com/microevent.ts/-/microevent.ts-0.1.1.tgz#70b09b83f43df5172d0205a63025bce0f7357fa0"
   integrity sha512-jo1OfR4TaEwd5HOrt5+tAZ9mqT4jmpNAusXtyfNzqVm9uiSYFZlKM1wYL4oU7azZW/PxQW53wM0S6OR1JHNa2g==
 
+micromark-core-commonmark@^1.0.0, micromark-core-commonmark@^1.0.1:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-core-commonmark/-/micromark-core-commonmark-1.1.0.tgz#1386628df59946b2d39fb2edfd10f3e8e0a75bb8"
+  integrity sha512-BgHO1aRbolh2hcrzL2d1La37V0Aoz73ymF8rAcKnohLy93titmv62E0gP8Hrx9PKcKrqCZ1BbLGbP3bEhoXYlw==
+  dependencies:
+    decode-named-character-reference "^1.0.0"
+    micromark-factory-destination "^1.0.0"
+    micromark-factory-label "^1.0.0"
+    micromark-factory-space "^1.0.0"
+    micromark-factory-title "^1.0.0"
+    micromark-factory-whitespace "^1.0.0"
+    micromark-util-character "^1.0.0"
+    micromark-util-chunked "^1.0.0"
+    micromark-util-classify-character "^1.0.0"
+    micromark-util-html-tag-name "^1.0.0"
+    micromark-util-normalize-identifier "^1.0.0"
+    micromark-util-resolve-all "^1.0.0"
+    micromark-util-subtokenize "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.1"
+    uvu "^0.5.0"
+
+micromark-extension-gfm-autolink-literal@^1.0.0:
+  version "1.0.5"
+  resolved "https://registry.yarnpkg.com/micromark-extension-gfm-autolink-literal/-/micromark-extension-gfm-autolink-literal-1.0.5.tgz#5853f0e579bbd8ef9e39a7c0f0f27c5a063a66e7"
+  integrity sha512-z3wJSLrDf8kRDOh2qBtoTRD53vJ+CWIyo7uyZuxf/JAbNJjiHsOpG1y5wxk8drtv3ETAHutCu6N3thkOOgueWg==
+  dependencies:
+    micromark-util-character "^1.0.0"
+    micromark-util-sanitize-uri "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+
+micromark-extension-gfm-footnote@^1.0.0:
+  version "1.1.2"
+  resolved "https://registry.yarnpkg.com/micromark-extension-gfm-footnote/-/micromark-extension-gfm-footnote-1.1.2.tgz#05e13034d68f95ca53c99679040bc88a6f92fe2e"
+  integrity sha512-Yxn7z7SxgyGWRNa4wzf8AhYYWNrwl5q1Z8ii+CSTTIqVkmGZF1CElX2JI8g5yGoM3GAman9/PVCUFUSJ0kB/8Q==
+  dependencies:
+    micromark-core-commonmark "^1.0.0"
+    micromark-factory-space "^1.0.0"
+    micromark-util-character "^1.0.0"
+    micromark-util-normalize-identifier "^1.0.0"
+    micromark-util-sanitize-uri "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+    uvu "^0.5.0"
+
+micromark-extension-gfm-strikethrough@^1.0.0:
+  version "1.0.7"
+  resolved "https://registry.yarnpkg.com/micromark-extension-gfm-strikethrough/-/micromark-extension-gfm-strikethrough-1.0.7.tgz#c8212c9a616fa3bf47cb5c711da77f4fdc2f80af"
+  integrity sha512-sX0FawVE1o3abGk3vRjOH50L5TTLr3b5XMqnP9YDRb34M0v5OoZhG+OHFz1OffZ9dlwgpTBKaT4XW/AsUVnSDw==
+  dependencies:
+    micromark-util-chunked "^1.0.0"
+    micromark-util-classify-character "^1.0.0"
+    micromark-util-resolve-all "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+    uvu "^0.5.0"
+
+micromark-extension-gfm-table@^1.0.0:
+  version "1.0.7"
+  resolved "https://registry.yarnpkg.com/micromark-extension-gfm-table/-/micromark-extension-gfm-table-1.0.7.tgz#dcb46074b0c6254c3fc9cc1f6f5002c162968008"
+  integrity sha512-3ZORTHtcSnMQEKtAOsBQ9/oHp9096pI/UvdPtN7ehKvrmZZ2+bbWhi0ln+I9drmwXMt5boocn6OlwQzNXeVeqw==
+  dependencies:
+    micromark-factory-space "^1.0.0"
+    micromark-util-character "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+    uvu "^0.5.0"
+
+micromark-extension-gfm-tagfilter@^1.0.0:
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/micromark-extension-gfm-tagfilter/-/micromark-extension-gfm-tagfilter-1.0.2.tgz#aa7c4dd92dabbcb80f313ebaaa8eb3dac05f13a7"
+  integrity sha512-5XWB9GbAUSHTn8VPU8/1DBXMuKYT5uOgEjJb8gN3mW0PNW5OPHpSdojoqf+iq1xo7vWzw/P8bAHY0n6ijpXF7g==
+  dependencies:
+    micromark-util-types "^1.0.0"
+
+micromark-extension-gfm-task-list-item@^1.0.0:
+  version "1.0.5"
+  resolved "https://registry.yarnpkg.com/micromark-extension-gfm-task-list-item/-/micromark-extension-gfm-task-list-item-1.0.5.tgz#b52ce498dc4c69b6a9975abafc18f275b9dde9f4"
+  integrity sha512-RMFXl2uQ0pNQy6Lun2YBYT9g9INXtWJULgbt01D/x8/6yJ2qpKyzdZD3pi6UIkzF++Da49xAelVKUeUMqd5eIQ==
+  dependencies:
+    micromark-factory-space "^1.0.0"
+    micromark-util-character "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+    uvu "^0.5.0"
+
+micromark-extension-gfm@^2.0.0:
+  version "2.0.3"
+  resolved "https://registry.yarnpkg.com/micromark-extension-gfm/-/micromark-extension-gfm-2.0.3.tgz#e517e8579949a5024a493e49204e884aa74f5acf"
+  integrity sha512-vb9OoHqrhCmbRidQv/2+Bc6pkP0FrtlhurxZofvOEy5o8RtuuvTq+RQ1Vw5ZDNrVraQZu3HixESqbG+0iKk/MQ==
+  dependencies:
+    micromark-extension-gfm-autolink-literal "^1.0.0"
+    micromark-extension-gfm-footnote "^1.0.0"
+    micromark-extension-gfm-strikethrough "^1.0.0"
+    micromark-extension-gfm-table "^1.0.0"
+    micromark-extension-gfm-tagfilter "^1.0.0"
+    micromark-extension-gfm-task-list-item "^1.0.0"
+    micromark-util-combine-extensions "^1.0.0"
+    micromark-util-types "^1.0.0"
+
+micromark-factory-destination@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-factory-destination/-/micromark-factory-destination-1.1.0.tgz#eb815957d83e6d44479b3df640f010edad667b9f"
+  integrity sha512-XaNDROBgx9SgSChd69pjiGKbV+nfHGDPVYFs5dOoDd7ZnMAE+Cuu91BCpsY8RT2NP9vo/B8pds2VQNCLiu0zhg==
+  dependencies:
+    micromark-util-character "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+
+micromark-factory-label@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-factory-label/-/micromark-factory-label-1.1.0.tgz#cc95d5478269085cfa2a7282b3de26eb2e2dec68"
+  integrity sha512-OLtyez4vZo/1NjxGhcpDSbHQ+m0IIGnT8BoPamh+7jVlzLJBH98zzuCoUeMxvM6WsNeh8wx8cKvqLiPHEACn0w==
+  dependencies:
+    micromark-util-character "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+    uvu "^0.5.0"
+
+micromark-factory-space@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-factory-space/-/micromark-factory-space-1.1.0.tgz#c8f40b0640a0150751d3345ed885a080b0d15faf"
+  integrity sha512-cRzEj7c0OL4Mw2v6nwzttyOZe8XY/Z8G0rzmWQZTBi/jjwyw/U4uqKtUORXQrR5bAZZnbTI/feRV/R7hc4jQYQ==
+  dependencies:
+    micromark-util-character "^1.0.0"
+    micromark-util-types "^1.0.0"
+
+micromark-factory-title@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-factory-title/-/micromark-factory-title-1.1.0.tgz#dd0fe951d7a0ac71bdc5ee13e5d1465ad7f50ea1"
+  integrity sha512-J7n9R3vMmgjDOCY8NPw55jiyaQnH5kBdV2/UXCtZIpnHH3P6nHUKaH7XXEYuWwx/xUJcawa8plLBEjMPU24HzQ==
+  dependencies:
+    micromark-factory-space "^1.0.0"
+    micromark-util-character "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+
+micromark-factory-whitespace@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-factory-whitespace/-/micromark-factory-whitespace-1.1.0.tgz#798fb7489f4c8abafa7ca77eed6b5745853c9705"
+  integrity sha512-v2WlmiymVSp5oMg+1Q0N1Lxmt6pMhIHD457whWM7/GUlEks1hI9xj5w3zbc4uuMKXGisksZk8DzP2UyGbGqNsQ==
+  dependencies:
+    micromark-factory-space "^1.0.0"
+    micromark-util-character "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+
+micromark-util-character@^1.0.0:
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-character/-/micromark-util-character-1.2.0.tgz#4fedaa3646db249bc58caeb000eb3549a8ca5dcc"
+  integrity sha512-lXraTwcX3yH/vMDaFWCQJP1uIszLVebzUa3ZHdrgxr7KEU/9mL4mVgCpGbyhvNLNlauROiNUq7WN5u7ndbY6xg==
+  dependencies:
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+
+micromark-util-chunked@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-chunked/-/micromark-util-chunked-1.1.0.tgz#37a24d33333c8c69a74ba12a14651fd9ea8a368b"
+  integrity sha512-Ye01HXpkZPNcV6FiyoW2fGZDUw4Yc7vT0E9Sad83+bEDiCJ1uXu0S3mr8WLpsz3HaG3x2q0HM6CTuPdcZcluFQ==
+  dependencies:
+    micromark-util-symbol "^1.0.0"
+
+micromark-util-classify-character@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-classify-character/-/micromark-util-classify-character-1.1.0.tgz#6a7f8c8838e8a120c8e3c4f2ae97a2bff9190e9d"
+  integrity sha512-SL0wLxtKSnklKSUplok1WQFoGhUdWYKggKUiqhX+Swala+BtptGCu5iPRc+xvzJ4PXE/hwM3FNXsfEVgoZsWbw==
+  dependencies:
+    micromark-util-character "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+
+micromark-util-combine-extensions@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-combine-extensions/-/micromark-util-combine-extensions-1.1.0.tgz#192e2b3d6567660a85f735e54d8ea6e3952dbe84"
+  integrity sha512-Q20sp4mfNf9yEqDL50WwuWZHUrCO4fEyeDCnMGmG5Pr0Cz15Uo7KBs6jq+dq0EgX4DPwwrh9m0X+zPV1ypFvUA==
+  dependencies:
+    micromark-util-chunked "^1.0.0"
+    micromark-util-types "^1.0.0"
+
+micromark-util-decode-numeric-character-reference@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-1.1.0.tgz#b1e6e17009b1f20bc652a521309c5f22c85eb1c6"
+  integrity sha512-m9V0ExGv0jB1OT21mrWcuf4QhP46pH1KkfWy9ZEezqHKAxkj4mPCy3nIH1rkbdMlChLHX531eOrymlwyZIf2iw==
+  dependencies:
+    micromark-util-symbol "^1.0.0"
+
+micromark-util-decode-string@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-decode-string/-/micromark-util-decode-string-1.1.0.tgz#dc12b078cba7a3ff690d0203f95b5d5537f2809c"
+  integrity sha512-YphLGCK8gM1tG1bd54azwyrQRjCFcmgj2S2GoJDNnh4vYtnL38JS8M4gpxzOPNyHdNEpheyWXCTnnTDY3N+NVQ==
+  dependencies:
+    decode-named-character-reference "^1.0.0"
+    micromark-util-character "^1.0.0"
+    micromark-util-decode-numeric-character-reference "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+
+micromark-util-encode@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-encode/-/micromark-util-encode-1.1.0.tgz#92e4f565fd4ccb19e0dcae1afab9a173bbeb19a5"
+  integrity sha512-EuEzTWSTAj9PA5GOAs992GzNh2dGQO52UvAbtSOMvXTxv3Criqb6IOzJUBCmEqrrXSblJIJBbFFv6zPxpreiJw==
+
+micromark-util-html-tag-name@^1.0.0:
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-html-tag-name/-/micromark-util-html-tag-name-1.2.0.tgz#48fd7a25826f29d2f71479d3b4e83e94829b3588"
+  integrity sha512-VTQzcuQgFUD7yYztuQFKXT49KghjtETQ+Wv/zUjGSGBioZnkA4P1XXZPT1FHeJA6RwRXSF47yvJ1tsJdoxwO+Q==
+
+micromark-util-normalize-identifier@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-1.1.0.tgz#7a73f824eb9f10d442b4d7f120fecb9b38ebf8b7"
+  integrity sha512-N+w5vhqrBihhjdpM8+5Xsxy71QWqGn7HYNUvch71iV2PM7+E3uWGox1Qp90loa1ephtCxG2ftRV/Conitc6P2Q==
+  dependencies:
+    micromark-util-symbol "^1.0.0"
+
+micromark-util-resolve-all@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-resolve-all/-/micromark-util-resolve-all-1.1.0.tgz#4652a591ee8c8fa06714c9b54cd6c8e693671188"
+  integrity sha512-b/G6BTMSg+bX+xVCshPTPyAu2tmA0E4X98NSR7eIbeC6ycCqCeE7wjfDIgzEbkzdEVJXRtOG4FbEm/uGbCRouA==
+  dependencies:
+    micromark-util-types "^1.0.0"
+
+micromark-util-sanitize-uri@^1.0.0, micromark-util-sanitize-uri@^1.1.0:
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-1.2.0.tgz#613f738e4400c6eedbc53590c67b197e30d7f90d"
+  integrity sha512-QO4GXv0XZfWey4pYFndLUKEAktKkG5kZTdUNaTAkzbuJxn2tNBOr+QtxR2XpWaMhbImT2dPzyLrPXLlPhph34A==
+  dependencies:
+    micromark-util-character "^1.0.0"
+    micromark-util-encode "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+
+micromark-util-subtokenize@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-subtokenize/-/micromark-util-subtokenize-1.1.0.tgz#941c74f93a93eaf687b9054aeb94642b0e92edb1"
+  integrity sha512-kUQHyzRoxvZO2PuLzMt2P/dwVsTiivCK8icYTeR+3WgbuPqfHgPPy7nFKbeqRivBvn/3N3GBiNC+JRTMSxEC7A==
+  dependencies:
+    micromark-util-chunked "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.0"
+    uvu "^0.5.0"
+
+micromark-util-symbol@^1.0.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-symbol/-/micromark-util-symbol-1.1.0.tgz#813cd17837bdb912d069a12ebe3a44b6f7063142"
+  integrity sha512-uEjpEYY6KMs1g7QfJ2eX1SQEV+ZT4rUD3UcF6l57acZvLNK7PBZL+ty82Z1qhK1/yXIY4bdx04FKMgR0g4IAag==
+
+micromark-util-types@^1.0.0, micromark-util-types@^1.0.1:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/micromark-util-types/-/micromark-util-types-1.1.0.tgz#e6676a8cae0bb86a2171c498167971886cb7e283"
+  integrity sha512-ukRBgie8TIAcacscVHSiddHjO4k/q3pnedmzMQ4iwDcK0FtFCohKOlFbaOL/mPgfnPsL3C1ZyxJa4sbWrBl3jg==
+
+micromark@^3.0.0:
+  version "3.2.0"
+  resolved "https://registry.yarnpkg.com/micromark/-/micromark-3.2.0.tgz#1af9fef3f995ea1ea4ac9c7e2f19c48fd5c006e9"
+  integrity sha512-uD66tJj54JLYq0De10AhWycZWGQNUvDI55xPgk2sQM5kn1JYlhbCMTtEeT27+vAhW2FBQxLlOmS3pmA7/2z4aA==
+  dependencies:
+    "@types/debug" "^4.0.0"
+    debug "^4.0.0"
+    decode-named-character-reference "^1.0.0"
+    micromark-core-commonmark "^1.0.1"
+    micromark-factory-space "^1.0.0"
+    micromark-util-character "^1.0.0"
+    micromark-util-chunked "^1.0.0"
+    micromark-util-combine-extensions "^1.0.0"
+    micromark-util-decode-numeric-character-reference "^1.0.0"
+    micromark-util-encode "^1.0.0"
+    micromark-util-normalize-identifier "^1.0.0"
+    micromark-util-resolve-all "^1.0.0"
+    micromark-util-sanitize-uri "^1.0.0"
+    micromark-util-subtokenize "^1.0.0"
+    micromark-util-symbol "^1.0.0"
+    micromark-util-types "^1.0.1"
+    uvu "^0.5.0"
+
 micromatch@^3.1.10:
   version "3.1.10"
   resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-3.1.10.tgz#70859bc95c9840952f359a068a3fc49f9ecfac23"
@@ -10968,6 +11509,11 @@ moo-color@^1.0.2:
   dependencies:
     color-name "^1.1.4"
 
+mri@^1.1.0:
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/mri/-/mri-1.2.0.tgz#6721480fec2a11a4889861115a48b6cbe7cc8f0b"
+  integrity sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==
+
 mrmime@^1.0.0:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/mrmime/-/mrmime-1.0.1.tgz#5f90c825fad4bdd41dc914eff5d1a8cfdaf24f27"
@@ -11037,7 +11583,7 @@ nan@^2.17.0:
   resolved "https://registry.yarnpkg.com/nan/-/nan-2.17.0.tgz#c0150a2368a182f033e9aa5195ec76ea41a199cb"
   integrity sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ==
 
-nanoid@^3.1.30, nanoid@^3.3.1, nanoid@^3.3.4:
+nanoid@^3.3.1, nanoid@^3.3.4:
   version "3.3.4"
   resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.4.tgz#730b67e3cd09e2deacf03c027c81c9d9dbc5e8ab"
   integrity sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw==
@@ -11750,7 +12296,7 @@ path-key@^3.0.0, path-key@^3.1.0:
   resolved "https://registry.yarnpkg.com/path-key/-/path-key-3.1.1.tgz#581f6ade658cbba65a0d3380de7753295054f375"
   integrity sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==
 
-path-parse@^1.0.6, path-parse@^1.0.7:
+path-parse@^1.0.7:
   version "1.0.7"
   resolved "https://registry.yarnpkg.com/path-parse/-/path-parse-1.0.7.tgz#fbc114b60ca42b30d9daf5858e4bd68bbedb6735"
   integrity sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==
@@ -11991,16 +12537,7 @@ postcss@^7.0.14, postcss@^7.0.26, postcss@^7.0.32, postcss@^7.0.36, postcss@^7.0
     picocolors "^0.2.1"
     source-map "^0.6.1"
 
-postcss@^8.2.15:
-  version "8.4.1"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.4.1.tgz#73051f825509ad1a716ef500108001bf3d1fa8f7"
-  integrity sha512-WqLs/TTzXdG+/A4ZOOK9WDZiikrRaiA+eoEb/jz2DT9KUhMNHgP7yKPO8vwi62ZCsb703Gwb7BMZwDzI54Y2Ag==
-  dependencies:
-    nanoid "^3.1.30"
-    picocolors "^1.0.0"
-    source-map-js "^1.0.1"
-
-postcss@^8.4.21:
+postcss@^8.2.15, postcss@^8.4.21:
   version "8.4.21"
   resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.4.21.tgz#c639b719a57efc3187b13a1d765675485f4134f4"
   integrity sha512-tP7u/Sn/dVxK2NnruI4H9BG+x+Wxz6oeZ1cJ8P6G/PZY0IKk4k/63TDsQf2kQq3+qoJeLm2kIBUNlZe3zgb4Zg==
@@ -12126,6 +12663,15 @@ prompts@^2.0.1, prompts@^2.4.0:
     kleur "^3.0.3"
     sisteransi "^1.0.5"
 
+prop-types@^15.0.0, prop-types@^15.8.1:
+  version "15.8.1"
+  resolved "https://registry.yarnpkg.com/prop-types/-/prop-types-15.8.1.tgz#67d87bf1a694f48435cf332c24af10214a3140b5"
+  integrity sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==
+  dependencies:
+    loose-envify "^1.4.0"
+    object-assign "^4.1.1"
+    react-is "^16.13.1"
+
 prop-types@^15.5.8, prop-types@^15.6.0, prop-types@^15.6.2, prop-types@^15.7.2:
   version "15.7.2"
   resolved "https://registry.yarnpkg.com/prop-types/-/prop-types-15.7.2.tgz#52c41e75b8c87e72b9d9360e0206b99dcbffa6c5"
@@ -12135,15 +12681,6 @@ prop-types@^15.5.8, prop-types@^15.6.0, prop-types@^15.6.2, prop-types@^15.7.2:
     object-assign "^4.1.1"
     react-is "^16.8.1"
 
-prop-types@^15.8.1:
-  version "15.8.1"
-  resolved "https://registry.yarnpkg.com/prop-types/-/prop-types-15.8.1.tgz#67d87bf1a694f48435cf332c24af10214a3140b5"
-  integrity sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==
-  dependencies:
-    loose-envify "^1.4.0"
-    object-assign "^4.1.1"
-    react-is "^16.13.1"
-
 property-information@^5.0.0, property-information@^5.3.0:
   version "5.6.0"
   resolved "https://registry.yarnpkg.com/property-information/-/property-information-5.6.0.tgz#61675545fb23002f245c6540ec46077d4da3ed69"
@@ -12151,6 +12688,11 @@ property-information@^5.0.0, property-information@^5.3.0:
   dependencies:
     xtend "^4.0.0"
 
+property-information@^6.0.0:
+  version "6.2.0"
+  resolved "https://registry.yarnpkg.com/property-information/-/property-information-6.2.0.tgz#b74f522c31c097b5149e3c3cb8d7f3defd986a1d"
+  integrity sha512-kma4U7AFCTwpqq5twzC1YVIDXSqg6qQK6JN0smOw8fgRy1OkMi0CYSzFmsy6dnqSenamAtj0CyXMUJ1Mf6oROg==
+
 protobufjs@^6.10.0:
   version "6.11.3"
   resolved "https://registry.yarnpkg.com/protobufjs/-/protobufjs-6.11.3.tgz#637a527205a35caa4f3e2a9a4a13ddffe0e7af74"
@@ -12384,6 +12926,32 @@ react-is@^16.13.1, react-is@^16.6.0, react-is@^16.7.0, react-is@^16.8.0, react-i
   resolved "https://registry.yarnpkg.com/react-is/-/react-is-16.13.1.tgz#789729a4dc36de2999dc156dd6c1d9c18cea56a4"
   integrity sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==
 
+react-is@^18.0.0:
+  version "18.2.0"
+  resolved "https://registry.yarnpkg.com/react-is/-/react-is-18.2.0.tgz#199431eeaaa2e09f86427efbb4f1473edb47609b"
+  integrity sha512-xWGDIW6x921xtzPkhiULtthJHoJvBbF3q26fzloPCK0hsvxtPVelvftw3zjbHWSkR2km9Z+4uxbDDK/6Zw9B8w==
+
+react-markdown@^8.0.7:
+  version "8.0.7"
+  resolved "https://registry.yarnpkg.com/react-markdown/-/react-markdown-8.0.7.tgz#c8dbd1b9ba5f1c5e7e5f2a44de465a3caafdf89b"
+  integrity sha512-bvWbzG4MtOU62XqBx3Xx+zB2raaFFsq4mYiAzfjXJMEz2sixgeAfraA3tvzULF02ZdOMUOKTBFFaZJDDrq+BJQ==
+  dependencies:
+    "@types/hast" "^2.0.0"
+    "@types/prop-types" "^15.0.0"
+    "@types/unist" "^2.0.0"
+    comma-separated-tokens "^2.0.0"
+    hast-util-whitespace "^2.0.0"
+    prop-types "^15.0.0"
+    property-information "^6.0.0"
+    react-is "^18.0.0"
+    remark-parse "^10.0.0"
+    remark-rehype "^10.0.0"
+    space-separated-tokens "^2.0.0"
+    style-to-object "^0.4.0"
+    unified "^10.0.0"
+    unist-util-visit "^4.0.0"
+    vfile "^5.0.0"
+
 react-refresh@^0.11.0:
   version "0.11.0"
   resolved "https://registry.yarnpkg.com/react-refresh/-/react-refresh-0.11.0.tgz#77198b944733f0f1f1a90e791de4541f9f074046"
@@ -12636,6 +13204,16 @@ remark-footnotes@2.0.0:
   resolved "https://registry.yarnpkg.com/remark-footnotes/-/remark-footnotes-2.0.0.tgz#9001c4c2ffebba55695d2dd80ffb8b82f7e6303f"
   integrity sha512-3Clt8ZMH75Ayjp9q4CorNeyjwIxHFcTkaektplKGl2A1jNGEUey8cKL0ZC5vJwfcD5GFGsNLImLG/NGzWIzoMQ==
 
+remark-gfm@^3.0.1:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/remark-gfm/-/remark-gfm-3.0.1.tgz#0b180f095e3036545e9dddac0e8df3fa5cfee54f"
+  integrity sha512-lEFDoi2PICJyNrACFOfDD3JlLkuSbOa5Wd8EPt06HUdptv8Gn0bxYTdbU/XXQ3swAPkEaGxxPN9cbnMHvVu1Ig==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    mdast-util-gfm "^2.0.0"
+    micromark-extension-gfm "^2.0.0"
+    unified "^10.0.0"
+
 remark-mdx@1.6.22:
   version "1.6.22"
   resolved "https://registry.yarnpkg.com/remark-mdx/-/remark-mdx-1.6.22.tgz#06a8dab07dcfdd57f3373af7f86bd0e992108bbd"
@@ -12672,6 +13250,25 @@ remark-parse@8.0.3:
     vfile-location "^3.0.0"
     xtend "^4.0.1"
 
+remark-parse@^10.0.0:
+  version "10.0.2"
+  resolved "https://registry.yarnpkg.com/remark-parse/-/remark-parse-10.0.2.tgz#ca241fde8751c2158933f031a4e3efbaeb8bc262"
+  integrity sha512-3ydxgHa/ZQzG8LvC7jTXccARYDcRld3VfcgIIFs7bI6vbRSxJJmzgLEIIoYKyrfhaY+ujuWaf/PJiMZXoiCXgw==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    mdast-util-from-markdown "^1.0.0"
+    unified "^10.0.0"
+
+remark-rehype@^10.0.0:
+  version "10.1.0"
+  resolved "https://registry.yarnpkg.com/remark-rehype/-/remark-rehype-10.1.0.tgz#32dc99d2034c27ecaf2e0150d22a6dcccd9a6279"
+  integrity sha512-EFmR5zppdBp0WQeDVZ/b66CWJipB2q2VLNFMabzDSGR66Z2fQii83G5gTBbgGEnEEA0QRussvrFHxk1HWGJskw==
+  dependencies:
+    "@types/hast" "^2.0.0"
+    "@types/mdast" "^3.0.0"
+    mdast-util-to-hast "^12.1.0"
+    unified "^10.0.0"
+
 remark-squeeze-paragraphs@4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/remark-squeeze-paragraphs/-/remark-squeeze-paragraphs-4.0.0.tgz#76eb0e085295131c84748c8e43810159c5653ead"
@@ -12777,15 +13374,7 @@ resolve.exports@^1.1.0:
   resolved "https://registry.yarnpkg.com/resolve.exports/-/resolve.exports-1.1.1.tgz#05cfd5b3edf641571fd46fa608b610dda9ead999"
   integrity sha512-/NtpHNDN7jWhAaQ9BvBUYZ6YTXsRBgfqWFWP7BZBaoMJO/I3G5OFzvTuWNlZC3aPjins1F+TNrLKsGbH4rfsRQ==
 
-resolve@^1.10.0, resolve@^1.12.0, resolve@^1.14.2, resolve@^1.19.0, resolve@^1.20.0, resolve@^1.3.2:
-  version "1.20.0"
-  resolved "https://registry.yarnpkg.com/resolve/-/resolve-1.20.0.tgz#629a013fb3f70755d6f0b7935cc1c2c5378b1975"
-  integrity sha512-wENBPt4ySzg4ybFQW2TT1zMQucPK95HSh/nq2CFTZVOGut2+pQvSsgtda4d26YrYcr067wjbmzOG8byDPBX63A==
-  dependencies:
-    is-core-module "^2.2.0"
-    path-parse "^1.0.6"
-
-resolve@^1.22.1, resolve@^1.9.0:
+resolve@^1.10.0, resolve@^1.12.0, resolve@^1.14.2, resolve@^1.19.0, resolve@^1.20.0, resolve@^1.22.1, resolve@^1.3.2, resolve@^1.9.0:
   version "1.22.1"
   resolved "https://registry.yarnpkg.com/resolve/-/resolve-1.22.1.tgz#27cb2ebb53f91abb49470a928bba7558066ac177"
   integrity sha512-nBpuuYuY5jFsli/JIs1oldw6fOQCBioohqWZg/2hiaOybXOft4lonv85uDOKXdf8rhyK159cxU5cDcK/NKk8zw==
@@ -12900,6 +13489,13 @@ rxjs@^7.5.5:
   dependencies:
     tslib "^2.1.0"
 
+sade@^1.7.3:
+  version "1.8.1"
+  resolved "https://registry.yarnpkg.com/sade/-/sade-1.8.1.tgz#0a78e81d658d394887be57d2a409bf703a3b2701"
+  integrity sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A==
+  dependencies:
+    mri "^1.1.0"
+
 safe-buffer@5.1.1:
   version "5.1.1"
   resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.1.1.tgz#893312af69b2123def71f57889001671eeb2c853"
@@ -13389,7 +13985,7 @@ source-list-map@^2.0.0:
   resolved "https://registry.yarnpkg.com/source-list-map/-/source-list-map-2.0.1.tgz#3993bd873bfc48479cca9ea3a547835c7c154b34"
   integrity sha512-qnQ7gVMxGNxsiL4lEuJwe/To8UnK7fAnmbGEEH8RpLouuKbeEm0lhbQVFIrNSuB+G7tVrAlVsZgETT5nljf+Iw==
 
-source-map-js@^1.0.1, source-map-js@^1.0.2:
+source-map-js@^1.0.2:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.0.2.tgz#adbc361d9c62df380125e7f161f71c826f1e490c"
   integrity sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw==
@@ -13451,6 +14047,11 @@ space-separated-tokens@^1.0.0:
   resolved "https://registry.yarnpkg.com/space-separated-tokens/-/space-separated-tokens-1.1.5.tgz#85f32c3d10d9682007e917414ddc5c26d1aa6899"
   integrity sha512-q/JSVd1Lptzhf5bkYm4ob4iWPjx0KiRe3sRFBNrVqbJkFaBm5vbbowy1mymoPNLRa52+oadOhJ+K49wsSeSjTA==
 
+space-separated-tokens@^2.0.0:
+  version "2.0.2"
+  resolved "https://registry.yarnpkg.com/space-separated-tokens/-/space-separated-tokens-2.0.2.tgz#1ecd9d2350a3844572c3f4a312bceb018348859f"
+  integrity sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==
+
 spdx-correct@^3.0.0:
   version "3.1.1"
   resolved "https://registry.yarnpkg.com/spdx-correct/-/spdx-correct-3.1.1.tgz#dece81ac9c1e6713e5f7d1b6f17d468fa53d89a9"
@@ -13790,6 +14391,13 @@ style-to-object@0.3.0, style-to-object@^0.3.0:
   dependencies:
     inline-style-parser "0.1.1"
 
+style-to-object@^0.4.0:
+  version "0.4.1"
+  resolved "https://registry.yarnpkg.com/style-to-object/-/style-to-object-0.4.1.tgz#53cf856f7cf7f172d72939d9679556469ba5de37"
+  integrity sha512-HFpbb5gr2ypci7Qw+IOhnP2zOU7e77b+rzM+wTzXzfi1PrtBCX0E7Pk4wL4iTLnhzZ+JgEGAhX81ebTg/aYjQw==
+  dependencies:
+    inline-style-parser "0.1.1"
+
 styled-components@5.1.0:
   version "5.1.0"
   resolved "https://registry.yarnpkg.com/styled-components/-/styled-components-5.1.0.tgz#2e3985b54f461027e1c91af3229e1c2530872a4e"
@@ -14156,6 +14764,11 @@ tr46@~0.0.3:
   resolved "https://registry.yarnpkg.com/tr46/-/tr46-0.0.3.tgz#8184fd347dac9cdc185992f3a6622e14b9d9ab6a"
   integrity sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==
 
+trim-lines@^3.0.0:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/trim-lines/-/trim-lines-3.0.1.tgz#d802e332a07df861c48802c04321017b1bd87338"
+  integrity sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==
+
 trim-trailing-lines@^1.0.0:
   version "1.1.4"
   resolved "https://registry.yarnpkg.com/trim-trailing-lines/-/trim-trailing-lines-1.1.4.tgz#bd4abbec7cc880462f10b2c8b5ce1d8d1ec7c2c0"
@@ -14176,6 +14789,11 @@ trough@^1.0.0:
   resolved "https://registry.yarnpkg.com/trough/-/trough-1.0.5.tgz#b8b639cefad7d0bb2abd37d433ff8293efa5f406"
   integrity sha512-rvuRbTarPXmMb79SmzEp8aqXNKcK+y0XaB298IXueQ8I2PsrATcPBCSPyK/dDNa2iWOhKlfNnOjdAOTBU/nkFA==
 
+trough@^2.0.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/trough/-/trough-2.1.0.tgz#0f7b511a4fde65a46f18477ab38849b22c554876"
+  integrity sha512-AqTiAOLcj85xS7vQ8QkAV41hPDIJ71XJB4RCUrzo/1GM2CQwhkJGaf9Hgr7BOugMRpgGUrqRg/DrBDl4H40+8g==
+
 truncate-utf8-bytes@^1.0.0:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/truncate-utf8-bytes/-/truncate-utf8-bytes-1.0.2.tgz#405923909592d56f78a5818434b0b78489ca5f2b"
@@ -14318,10 +14936,10 @@ typescript@^4.0.2:
   resolved "https://registry.yarnpkg.com/typescript/-/typescript-4.8.4.tgz#c464abca159669597be5f96b8943500b238e60e6"
   integrity sha512-QCh+85mCy+h0IGff8r5XWzOVSbBO+KfeYrMQh7NJ58QujwcE22u+NUSmUxqF+un70P9GXKxa2HCNiTTMJknyjQ==
 
-typescript@^5.0.4:
-  version "5.0.4"
-  resolved "https://registry.yarnpkg.com/typescript/-/typescript-5.0.4.tgz#b217fd20119bd61a94d4011274e0ab369058da3b"
-  integrity sha512-cW9T5W9xY37cc+jfEnaUvX91foxtHkza3Nw3wkoF4sSlKn0MONdkdEndig/qPBWXNkmplh3NzayQzCiHM4/hqw==
+typescript@^5.1.3:
+  version "5.1.3"
+  resolved "https://registry.yarnpkg.com/typescript/-/typescript-5.1.3.tgz#8d84219244a6b40b6fb2b33cc1c062f715b9e826"
+  integrity sha512-XH627E9vkeqhlZFQuL+UsyAXEnibT0kWR2FWONlr4sTjvxyJYnyefgrkyECLzM5NenmKzRAy2rR/OlYLA1HkZw==
 
 uglify-js@^3.1.4:
   version "3.14.3"
@@ -14386,6 +15004,19 @@ unified@9.2.0:
     trough "^1.0.0"
     vfile "^4.0.0"
 
+unified@^10.0.0:
+  version "10.1.2"
+  resolved "https://registry.yarnpkg.com/unified/-/unified-10.1.2.tgz#b1d64e55dafe1f0b98bb6c719881103ecf6c86df"
+  integrity sha512-pUSWAi/RAnVy1Pif2kAoeWNBa3JVrx0MId2LASj8G+7AiHWoKZNTomq6LG326T68U7/e263X6fTdcXIy7XnF7Q==
+  dependencies:
+    "@types/unist" "^2.0.0"
+    bail "^2.0.0"
+    extend "^3.0.0"
+    is-buffer "^2.0.0"
+    is-plain-obj "^4.0.0"
+    trough "^2.0.0"
+    vfile "^5.0.0"
+
 union-value@^1.0.0:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/union-value/-/union-value-1.0.1.tgz#0b6fe7b835aecda61c6ea4d4f02c14221e109847"
@@ -14434,16 +15065,35 @@ unist-util-generated@^1.0.0:
   resolved "https://registry.yarnpkg.com/unist-util-generated/-/unist-util-generated-1.1.6.tgz#5ab51f689e2992a472beb1b35f2ce7ff2f324d4b"
   integrity sha512-cln2Mm1/CZzN5ttGK7vkoGw+RZ8VcUH6BtGbq98DDtRGquAAOXig1mrBQYelOwMXYS8rK+vZDyyojSjp7JX+Lg==
 
+unist-util-generated@^2.0.0:
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/unist-util-generated/-/unist-util-generated-2.0.1.tgz#e37c50af35d3ed185ac6ceacb6ca0afb28a85cae"
+  integrity sha512-qF72kLmPxAw0oN2fwpWIqbXAVyEqUzDHMsbtPvOudIlUzXYFIeQIuxXQCRCFh22B7cixvU0MG7m3MW8FTq/S+A==
+
 unist-util-is@^4.0.0:
   version "4.1.0"
   resolved "https://registry.yarnpkg.com/unist-util-is/-/unist-util-is-4.1.0.tgz#976e5f462a7a5de73d94b706bac1b90671b57797"
   integrity sha512-ZOQSsnce92GrxSqlnEEseX0gi7GH9zTJZ0p9dtu87WRb/37mMPO2Ilx1s/t9vBHrFhbgweUwb+t7cIn5dxPhZg==
 
+unist-util-is@^5.0.0:
+  version "5.2.1"
+  resolved "https://registry.yarnpkg.com/unist-util-is/-/unist-util-is-5.2.1.tgz#b74960e145c18dcb6226bc57933597f5486deae9"
+  integrity sha512-u9njyyfEh43npf1M+yGKDGVPbY/JWEemg5nH05ncKPfi+kBbKBJoTdsogMu33uhytuLlv9y0O7GH7fEdwLdLQw==
+  dependencies:
+    "@types/unist" "^2.0.0"
+
 unist-util-position@^3.0.0:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/unist-util-position/-/unist-util-position-3.1.0.tgz#1c42ee6301f8d52f47d14f62bbdb796571fa2d47"
   integrity sha512-w+PkwCbYSFw8vpgWD0v7zRCl1FpY3fjDSQ3/N/wNd9Ffa4gPi8+4keqt99N3XW6F99t/mUzp2xAhNmfKWp95QA==
 
+unist-util-position@^4.0.0:
+  version "4.0.4"
+  resolved "https://registry.yarnpkg.com/unist-util-position/-/unist-util-position-4.0.4.tgz#93f6d8c7d6b373d9b825844645877c127455f037"
+  integrity sha512-kUBE91efOWfIVBo8xzh/uZQ7p9ffYRtUbMRZBNFYwf0RK8koUMx6dGUfwylLOKmaT2cs4wSW96QoYUSXAyEtpg==
+  dependencies:
+    "@types/unist" "^2.0.0"
+
 unist-util-remove-position@^2.0.0:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/unist-util-remove-position/-/unist-util-remove-position-2.0.1.tgz#5d19ca79fdba712301999b2b73553ca8f3b352cc"
@@ -14465,6 +15115,13 @@ unist-util-stringify-position@^2.0.0:
   dependencies:
     "@types/unist" "^2.0.2"
 
+unist-util-stringify-position@^3.0.0:
+  version "3.0.3"
+  resolved "https://registry.yarnpkg.com/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz#03ad3348210c2d930772d64b489580c13a7db39d"
+  integrity sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==
+  dependencies:
+    "@types/unist" "^2.0.0"
+
 unist-util-visit-parents@^3.0.0:
   version "3.1.1"
   resolved "https://registry.yarnpkg.com/unist-util-visit-parents/-/unist-util-visit-parents-3.1.1.tgz#65a6ce698f78a6b0f56aa0e88f13801886cdaef6"
@@ -14473,6 +15130,14 @@ unist-util-visit-parents@^3.0.0:
     "@types/unist" "^2.0.0"
     unist-util-is "^4.0.0"
 
+unist-util-visit-parents@^5.0.0, unist-util-visit-parents@^5.1.1:
+  version "5.1.3"
+  resolved "https://registry.yarnpkg.com/unist-util-visit-parents/-/unist-util-visit-parents-5.1.3.tgz#b4520811b0ca34285633785045df7a8d6776cfeb"
+  integrity sha512-x6+y8g7wWMyQhL1iZfhIPhDAs7Xwbn9nRosDXl7qoPTSCy0yNxnKc+hWokFifWQIDGi154rdUqKvbCa4+1kLhg==
+  dependencies:
+    "@types/unist" "^2.0.0"
+    unist-util-is "^5.0.0"
+
 unist-util-visit@2.0.3, unist-util-visit@^2.0.0:
   version "2.0.3"
   resolved "https://registry.yarnpkg.com/unist-util-visit/-/unist-util-visit-2.0.3.tgz#c3703893146df47203bb8a9795af47d7b971208c"
@@ -14482,6 +15147,15 @@ unist-util-visit@2.0.3, unist-util-visit@^2.0.0:
     unist-util-is "^4.0.0"
     unist-util-visit-parents "^3.0.0"
 
+unist-util-visit@^4.0.0:
+  version "4.1.2"
+  resolved "https://registry.yarnpkg.com/unist-util-visit/-/unist-util-visit-4.1.2.tgz#125a42d1eb876283715a3cb5cceaa531828c72e2"
+  integrity sha512-MSd8OUGISqHdVvfY9TPhyK2VdUrPgxkUtWSuMHF6XAAFuL4LokseigBnZtPnJMu+FbynTkFNnFlyjxpVKujMRg==
+  dependencies:
+    "@types/unist" "^2.0.0"
+    unist-util-is "^5.0.0"
+    unist-util-visit-parents "^5.1.1"
+
 universalify@^0.1.0:
   version "0.1.2"
   resolved "https://registry.yarnpkg.com/universalify/-/universalify-0.1.2.tgz#b646f69be3942dabcecc9d6639c80dc105efaa66"
@@ -14608,6 +15282,16 @@ uuid@^8.3.2:
   resolved "https://registry.yarnpkg.com/uuid/-/uuid-8.3.2.tgz#80d5b5ced271bb9af6c445f21a1a04c606cefbe2"
   integrity sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==
 
+uvu@^0.5.0:
+  version "0.5.6"
+  resolved "https://registry.yarnpkg.com/uvu/-/uvu-0.5.6.tgz#2754ca20bcb0bb59b64e9985e84d2e81058502df"
+  integrity sha512-+g8ENReyr8YsOc6fv/NVJs2vFdHBnBNdfE49rshrTzDWOlUx4Gq7KOS2GD8eqhy2j+Ejq29+SbKH8yjkAqXqoA==
+  dependencies:
+    dequal "^2.0.0"
+    diff "^5.0.0"
+    kleur "^4.0.3"
+    sade "^1.7.3"
+
 v8-to-istanbul@^8.0.0:
   version "8.1.0"
   resolved "https://registry.yarnpkg.com/v8-to-istanbul/-/v8-to-istanbul-8.1.0.tgz#0aeb763894f1a0a1676adf8a8b7612a38902446c"
@@ -14666,6 +15350,14 @@ vfile-message@^2.0.0:
     "@types/unist" "^2.0.0"
     unist-util-stringify-position "^2.0.0"
 
+vfile-message@^3.0.0:
+  version "3.1.4"
+  resolved "https://registry.yarnpkg.com/vfile-message/-/vfile-message-3.1.4.tgz#15a50816ae7d7c2d1fa87090a7f9f96612b59dea"
+  integrity sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==
+  dependencies:
+    "@types/unist" "^2.0.0"
+    unist-util-stringify-position "^3.0.0"
+
 vfile@^4.0.0:
   version "4.2.1"
   resolved "https://registry.yarnpkg.com/vfile/-/vfile-4.2.1.tgz#03f1dce28fc625c625bc6514350fbdb00fa9e624"
@@ -14676,6 +15368,16 @@ vfile@^4.0.0:
     unist-util-stringify-position "^2.0.0"
     vfile-message "^2.0.0"
 
+vfile@^5.0.0:
+  version "5.3.7"
+  resolved "https://registry.yarnpkg.com/vfile/-/vfile-5.3.7.tgz#de0677e6683e3380fafc46544cfe603118826ab7"
+  integrity sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==
+  dependencies:
+    "@types/unist" "^2.0.0"
+    is-buffer "^2.0.0"
+    unist-util-stringify-position "^3.0.0"
+    vfile-message "^3.0.0"
+
 vite-tsconfig-paths@^4.0.7:
   version "4.0.7"
   resolved "https://registry.yarnpkg.com/vite-tsconfig-paths/-/vite-tsconfig-paths-4.0.7.tgz#e109036d4890029e9539291e08a84ac01ef8dec4"
@@ -14685,10 +15387,10 @@ vite-tsconfig-paths@^4.0.7:
     globrex "^0.1.2"
     tsconfck "^2.0.1"
 
-vite@^4.2.0:
-  version "4.2.0"
-  resolved "https://registry.yarnpkg.com/vite/-/vite-4.2.0.tgz#d4e6eafbc034f3faf0ab376bd5b76ac15775eb99"
-  integrity sha512-AbDTyzzwuKoRtMIRLGNxhLRuv1FpRgdIw+1y6AQG73Q5+vtecmvzKo/yk8X/vrHDpETRTx01ABijqUHIzBXi0g==
+vite@^4.2.3:
+  version "4.2.3"
+  resolved "https://registry.yarnpkg.com/vite/-/vite-4.2.3.tgz#067ada47ebd52e078d014bf1f92badda9d10564d"
+  integrity sha512-kLU+m2q0Y434Y1kCy3TchefAdtFso0ILi0dLyFV8Us3InXTU11H/B5ZTqCKIQHzSKNxVG/yEx813EA9f1imQ9A==
   dependencies:
     esbuild "^0.17.5"
     postcss "^8.4.21"
@@ -15359,3 +16061,8 @@ zwitch@^1.0.0:
   version "1.0.5"
   resolved "https://registry.yarnpkg.com/zwitch/-/zwitch-1.0.5.tgz#d11d7381ffed16b742f6af7b3f223d5cd9fe9920"
   integrity sha512-V50KMwwzqJV0NpZIZFwfOD5/lyny3WlSzRiXgA0G7VUnRlqttta1L6UQIHzd6EuBY/cHGfwTIck7w1yH6Q5zUw==
+
+zwitch@^2.0.0:
+  version "2.0.4"
+  resolved "https://registry.yarnpkg.com/zwitch/-/zwitch-2.0.4.tgz#c827d4b0acb76fc3e685a4c6ec2902d51070e9d7"
+  integrity sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==