diff --git a/Makefile b/Makefile
index d807f91..a764fbd 100644
--- a/Makefile
+++ b/Makefile
@@ -19,9 +19,7 @@ clean:
 
 .PHONY: protoc
 protoc:
-	docker pull ghcr.io/metal-stack/builder
-	docker run --rm --user $$(id -u):$$(id -g) -v ${PWD}:/work ghcr.io/metal-stack/builder protoc -I api --go_out=plugins=grpc:api api/v1/*.proto
-	docker run --rm --user $$(id -u):$$(id -g) -v ${PWD}:/work ghcr.io/metal-stack/builder protoc -I api --go_out=plugins=grpc:api api/grpc/health/v1/*.proto
+	make -C proto protoc
 
 .PHONY: test
 test:
@@ -40,7 +38,7 @@ generate:
 	go generate ./...
 
 .PHONY: server
-server:
+server: protoc generate
 	go build -tags netgo -ldflags "-X 'github.com/metal-stack/v.Version=$(VERSION)' \
 								   -X 'github.com/metal-stack/v.Revision=$(GITVERSION)' \
 								   -X 'github.com/metal-stack/v.GitSHA1=$(SHA)' \
diff --git a/api/grpc/health/v1/health.pb.go b/api/grpc/health/v1/health.pb.go
deleted file mode 100644
index dcad30a..0000000
--- a/api/grpc/health/v1/health.pb.go
+++ /dev/null
@@ -1,485 +0,0 @@
-// Copyright 2015 The gRPC Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// The canonical version of this proto can be found at
-// https://github.com/grpc/grpc-proto/blob/master/grpc/health/v1/health.proto
-
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.20.1
-// source: grpc/health/v1/health.proto
-
-package v1
-
-import (
-	context "context"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-type HealthCheckResponse_ServingStatus int32
-
-const (
-	HealthCheckResponse_UNKNOWN         HealthCheckResponse_ServingStatus = 0
-	HealthCheckResponse_SERVING         HealthCheckResponse_ServingStatus = 1
-	HealthCheckResponse_NOT_SERVING     HealthCheckResponse_ServingStatus = 2
-	HealthCheckResponse_SERVICE_UNKNOWN HealthCheckResponse_ServingStatus = 3 // Used only by the Watch method.
-)
-
-// Enum value maps for HealthCheckResponse_ServingStatus.
-var (
-	HealthCheckResponse_ServingStatus_name = map[int32]string{
-		0: "UNKNOWN",
-		1: "SERVING",
-		2: "NOT_SERVING",
-		3: "SERVICE_UNKNOWN",
-	}
-	HealthCheckResponse_ServingStatus_value = map[string]int32{
-		"UNKNOWN":         0,
-		"SERVING":         1,
-		"NOT_SERVING":     2,
-		"SERVICE_UNKNOWN": 3,
-	}
-)
-
-func (x HealthCheckResponse_ServingStatus) Enum() *HealthCheckResponse_ServingStatus {
-	p := new(HealthCheckResponse_ServingStatus)
-	*p = x
-	return p
-}
-
-func (x HealthCheckResponse_ServingStatus) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (HealthCheckResponse_ServingStatus) Descriptor() protoreflect.EnumDescriptor {
-	return file_grpc_health_v1_health_proto_enumTypes[0].Descriptor()
-}
-
-func (HealthCheckResponse_ServingStatus) Type() protoreflect.EnumType {
-	return &file_grpc_health_v1_health_proto_enumTypes[0]
-}
-
-func (x HealthCheckResponse_ServingStatus) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Use HealthCheckResponse_ServingStatus.Descriptor instead.
-func (HealthCheckResponse_ServingStatus) EnumDescriptor() ([]byte, []int) {
-	return file_grpc_health_v1_health_proto_rawDescGZIP(), []int{1, 0}
-}
-
-type HealthCheckRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
-}
-
-func (x *HealthCheckRequest) Reset() {
-	*x = HealthCheckRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_grpc_health_v1_health_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *HealthCheckRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*HealthCheckRequest) ProtoMessage() {}
-
-func (x *HealthCheckRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_grpc_health_v1_health_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use HealthCheckRequest.ProtoReflect.Descriptor instead.
-func (*HealthCheckRequest) Descriptor() ([]byte, []int) {
-	return file_grpc_health_v1_health_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *HealthCheckRequest) GetService() string {
-	if x != nil {
-		return x.Service
-	}
-	return ""
-}
-
-type HealthCheckResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Status HealthCheckResponse_ServingStatus `protobuf:"varint,1,opt,name=status,proto3,enum=grpc.health.v1.HealthCheckResponse_ServingStatus" json:"status,omitempty"`
-}
-
-func (x *HealthCheckResponse) Reset() {
-	*x = HealthCheckResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_grpc_health_v1_health_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *HealthCheckResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*HealthCheckResponse) ProtoMessage() {}
-
-func (x *HealthCheckResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_grpc_health_v1_health_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use HealthCheckResponse.ProtoReflect.Descriptor instead.
-func (*HealthCheckResponse) Descriptor() ([]byte, []int) {
-	return file_grpc_health_v1_health_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *HealthCheckResponse) GetStatus() HealthCheckResponse_ServingStatus {
-	if x != nil {
-		return x.Status
-	}
-	return HealthCheckResponse_UNKNOWN
-}
-
-var File_grpc_health_v1_health_proto protoreflect.FileDescriptor
-
-var file_grpc_health_v1_health_proto_rawDesc = []byte{
-	0x0a, 0x1b, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x2f, 0x76, 0x31,
-	0x2f, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0e, 0x67,
-	0x72, 0x70, 0x63, 0x2e, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x22, 0x2e, 0x0a,
-	0x12, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x22, 0xb1, 0x01,
-	0x0a, 0x13, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x49, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x31, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x68, 0x65, 0x61,
-	0x6c, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65,
-	0x63, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69,
-	0x6e, 0x67, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x22, 0x4f, 0x0a, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x6e, 0x67, 0x53, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x0b,
-	0x0a, 0x07, 0x53, 0x45, 0x52, 0x56, 0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x0f, 0x0a, 0x0b, 0x4e,
-	0x4f, 0x54, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x49, 0x4e, 0x47, 0x10, 0x02, 0x12, 0x13, 0x0a, 0x0f,
-	0x53, 0x45, 0x52, 0x56, 0x49, 0x43, 0x45, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10,
-	0x03, 0x32, 0xae, 0x01, 0x0a, 0x06, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x12, 0x50, 0x0a, 0x05,
-	0x43, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x22, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x68, 0x65, 0x61,
-	0x6c, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65,
-	0x63, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x67, 0x72, 0x70, 0x63,
-	0x2e, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74,
-	0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x52,
-	0x0a, 0x05, 0x57, 0x61, 0x74, 0x63, 0x68, 0x12, 0x22, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x68,
-	0x65, 0x61, 0x6c, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43,
-	0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x67, 0x72,
-	0x70, 0x63, 0x2e, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x65, 0x61,
-	0x6c, 0x74, 0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x30, 0x01, 0x42, 0x12, 0x5a, 0x10, 0x2e, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x68, 0x65, 0x61,
-	0x6c, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
-
-var (
-	file_grpc_health_v1_health_proto_rawDescOnce sync.Once
-	file_grpc_health_v1_health_proto_rawDescData = file_grpc_health_v1_health_proto_rawDesc
-)
-
-func file_grpc_health_v1_health_proto_rawDescGZIP() []byte {
-	file_grpc_health_v1_health_proto_rawDescOnce.Do(func() {
-		file_grpc_health_v1_health_proto_rawDescData = protoimpl.X.CompressGZIP(file_grpc_health_v1_health_proto_rawDescData)
-	})
-	return file_grpc_health_v1_health_proto_rawDescData
-}
-
-var file_grpc_health_v1_health_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_grpc_health_v1_health_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_grpc_health_v1_health_proto_goTypes = []interface{}{
-	(HealthCheckResponse_ServingStatus)(0), // 0: grpc.health.v1.HealthCheckResponse.ServingStatus
-	(*HealthCheckRequest)(nil),             // 1: grpc.health.v1.HealthCheckRequest
-	(*HealthCheckResponse)(nil),            // 2: grpc.health.v1.HealthCheckResponse
-}
-var file_grpc_health_v1_health_proto_depIdxs = []int32{
-	0, // 0: grpc.health.v1.HealthCheckResponse.status:type_name -> grpc.health.v1.HealthCheckResponse.ServingStatus
-	1, // 1: grpc.health.v1.Health.Check:input_type -> grpc.health.v1.HealthCheckRequest
-	1, // 2: grpc.health.v1.Health.Watch:input_type -> grpc.health.v1.HealthCheckRequest
-	2, // 3: grpc.health.v1.Health.Check:output_type -> grpc.health.v1.HealthCheckResponse
-	2, // 4: grpc.health.v1.Health.Watch:output_type -> grpc.health.v1.HealthCheckResponse
-	3, // [3:5] is the sub-list for method output_type
-	1, // [1:3] is the sub-list for method input_type
-	1, // [1:1] is the sub-list for extension type_name
-	1, // [1:1] is the sub-list for extension extendee
-	0, // [0:1] is the sub-list for field type_name
-}
-
-func init() { file_grpc_health_v1_health_proto_init() }
-func file_grpc_health_v1_health_proto_init() {
-	if File_grpc_health_v1_health_proto != nil {
-		return
-	}
-	if !protoimpl.UnsafeEnabled {
-		file_grpc_health_v1_health_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HealthCheckRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_grpc_health_v1_health_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HealthCheckResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_grpc_health_v1_health_proto_rawDesc,
-			NumEnums:      1,
-			NumMessages:   2,
-			NumExtensions: 0,
-			NumServices:   1,
-		},
-		GoTypes:           file_grpc_health_v1_health_proto_goTypes,
-		DependencyIndexes: file_grpc_health_v1_health_proto_depIdxs,
-		EnumInfos:         file_grpc_health_v1_health_proto_enumTypes,
-		MessageInfos:      file_grpc_health_v1_health_proto_msgTypes,
-	}.Build()
-	File_grpc_health_v1_health_proto = out.File
-	file_grpc_health_v1_health_proto_rawDesc = nil
-	file_grpc_health_v1_health_proto_goTypes = nil
-	file_grpc_health_v1_health_proto_depIdxs = nil
-}
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ context.Context
-var _ grpc.ClientConnInterface
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-const _ = grpc.SupportPackageIsVersion6
-
-// HealthClient is the client API for Health service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
-type HealthClient interface {
-	// If the requested service is unknown, the call will fail with status
-	// NOT_FOUND.
-	Check(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (*HealthCheckResponse, error)
-	// Performs a watch for the serving status of the requested service.
-	// The server will immediately send back a message indicating the current
-	// serving status.  It will then subsequently send a new message whenever
-	// the service's serving status changes.
-	//
-	// If the requested service is unknown when the call is received, the
-	// server will send a message setting the serving status to
-	// SERVICE_UNKNOWN but will *not* terminate the call.  If at some
-	// future point, the serving status of the service becomes known, the
-	// server will send a new message with the service's serving status.
-	//
-	// If the call terminates with status UNIMPLEMENTED, then clients
-	// should assume this method is not supported and should not retry the
-	// call.  If the call terminates with any other status (including OK),
-	// clients should retry the call with appropriate exponential backoff.
-	Watch(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (Health_WatchClient, error)
-}
-
-type healthClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewHealthClient(cc grpc.ClientConnInterface) HealthClient {
-	return &healthClient{cc}
-}
-
-func (c *healthClient) Check(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (*HealthCheckResponse, error) {
-	out := new(HealthCheckResponse)
-	err := c.cc.Invoke(ctx, "/grpc.health.v1.Health/Check", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *healthClient) Watch(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (Health_WatchClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Health_serviceDesc.Streams[0], "/grpc.health.v1.Health/Watch", opts...)
-	if err != nil {
-		return nil, err
-	}
-	x := &healthWatchClient{stream}
-	if err := x.ClientStream.SendMsg(in); err != nil {
-		return nil, err
-	}
-	if err := x.ClientStream.CloseSend(); err != nil {
-		return nil, err
-	}
-	return x, nil
-}
-
-type Health_WatchClient interface {
-	Recv() (*HealthCheckResponse, error)
-	grpc.ClientStream
-}
-
-type healthWatchClient struct {
-	grpc.ClientStream
-}
-
-func (x *healthWatchClient) Recv() (*HealthCheckResponse, error) {
-	m := new(HealthCheckResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-// HealthServer is the server API for Health service.
-type HealthServer interface {
-	// If the requested service is unknown, the call will fail with status
-	// NOT_FOUND.
-	Check(context.Context, *HealthCheckRequest) (*HealthCheckResponse, error)
-	// Performs a watch for the serving status of the requested service.
-	// The server will immediately send back a message indicating the current
-	// serving status.  It will then subsequently send a new message whenever
-	// the service's serving status changes.
-	//
-	// If the requested service is unknown when the call is received, the
-	// server will send a message setting the serving status to
-	// SERVICE_UNKNOWN but will *not* terminate the call.  If at some
-	// future point, the serving status of the service becomes known, the
-	// server will send a new message with the service's serving status.
-	//
-	// If the call terminates with status UNIMPLEMENTED, then clients
-	// should assume this method is not supported and should not retry the
-	// call.  If the call terminates with any other status (including OK),
-	// clients should retry the call with appropriate exponential backoff.
-	Watch(*HealthCheckRequest, Health_WatchServer) error
-}
-
-// UnimplementedHealthServer can be embedded to have forward compatible implementations.
-type UnimplementedHealthServer struct {
-}
-
-func (*UnimplementedHealthServer) Check(context.Context, *HealthCheckRequest) (*HealthCheckResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Check not implemented")
-}
-func (*UnimplementedHealthServer) Watch(*HealthCheckRequest, Health_WatchServer) error {
-	return status.Errorf(codes.Unimplemented, "method Watch not implemented")
-}
-
-func RegisterHealthServer(s *grpc.Server, srv HealthServer) {
-	s.RegisterService(&_Health_serviceDesc, srv)
-}
-
-func _Health_Check_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(HealthCheckRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(HealthServer).Check(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/grpc.health.v1.Health/Check",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HealthServer).Check(ctx, req.(*HealthCheckRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Health_Watch_Handler(srv interface{}, stream grpc.ServerStream) error {
-	m := new(HealthCheckRequest)
-	if err := stream.RecvMsg(m); err != nil {
-		return err
-	}
-	return srv.(HealthServer).Watch(m, &healthWatchServer{stream})
-}
-
-type Health_WatchServer interface {
-	Send(*HealthCheckResponse) error
-	grpc.ServerStream
-}
-
-type healthWatchServer struct {
-	grpc.ServerStream
-}
-
-func (x *healthWatchServer) Send(m *HealthCheckResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
-
-var _Health_serviceDesc = grpc.ServiceDesc{
-	ServiceName: "grpc.health.v1.Health",
-	HandlerType: (*HealthServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "Check",
-			Handler:    _Health_Check_Handler,
-		},
-	},
-	Streams: []grpc.StreamDesc{
-		{
-			StreamName:    "Watch",
-			Handler:       _Health_Watch_Handler,
-			ServerStreams: true,
-		},
-	},
-	Metadata: "grpc/health/v1/health.proto",
-}
diff --git a/api/grpc/health/v1/health.proto b/api/grpc/health/v1/health.proto
deleted file mode 100644
index 76f0d47..0000000
--- a/api/grpc/health/v1/health.proto
+++ /dev/null
@@ -1,59 +0,0 @@
-// Copyright 2015 The gRPC Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// The canonical version of this proto can be found at
-// https://github.com/grpc/grpc-proto/blob/master/grpc/health/v1/health.proto
-
-syntax = "proto3";
-
-package grpc.health.v1;
-
-option go_package = "./grpc/health/v1";
-
-message HealthCheckRequest {
-  string service = 1;
-}
-
-message HealthCheckResponse {
-  enum ServingStatus {
-    UNKNOWN = 0;
-    SERVING = 1;
-    NOT_SERVING = 2;
-    SERVICE_UNKNOWN = 3;  // Used only by the Watch method.
-  }
-  ServingStatus status = 1;
-}
-
-service Health {
-  // If the requested service is unknown, the call will fail with status
-  // NOT_FOUND.
-  rpc Check(HealthCheckRequest) returns (HealthCheckResponse);
-
-  // Performs a watch for the serving status of the requested service.
-  // The server will immediately send back a message indicating the current
-  // serving status.  It will then subsequently send a new message whenever
-  // the service's serving status changes.
-  //
-  // If the requested service is unknown when the call is received, the
-  // server will send a message setting the serving status to
-  // SERVICE_UNKNOWN but will *not* terminate the call.  If at some
-  // future point, the serving status of the service becomes known, the
-  // server will send a new message with the service's serving status.
-  //
-  // If the call terminates with status UNIMPLEMENTED, then clients
-  // should assume this method is not supported and should not retry the
-  // call.  If the call terminates with any other status (including OK),
-  // clients should retry the call with appropriate exponential backoff.
-  rpc Watch(HealthCheckRequest) returns (stream HealthCheckResponse);
-}
diff --git a/api/v1/common.pb.go b/api/v1/common.pb.go
index b1d9b62..201e5a8 100644
--- a/api/v1/common.pb.go
+++ b/api/v1/common.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.20.1
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
 // source: v1/common.proto
 
 package v1
@@ -87,8 +87,14 @@ var file_v1_common_proto_rawDesc = []byte{
 	0x04, 0x70, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x12, 0x19, 0x0a, 0x05, 0x63, 0x6f, 0x75, 0x6e,
 	0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x48, 0x01, 0x52, 0x05, 0x63, 0x6f, 0x75, 0x6e, 0x74,
 	0x88, 0x01, 0x01, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x70, 0x61, 0x67, 0x65, 0x42, 0x08, 0x0a, 0x06,
-	0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x76, 0x31, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x42, 0x67, 0x0a, 0x06, 0x63, 0x6f, 0x6d, 0x2e, 0x76, 0x31,
+	0x42, 0x0b, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
+	0x28, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6d, 0x65, 0x74, 0x61,
+	0x6c, 0x2d, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x2f, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72, 0x64, 0x61,
+	0x74, 0x61, 0x2d, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0xa2, 0x02, 0x03, 0x56, 0x58, 0x58, 0xaa,
+	0x02, 0x02, 0x56, 0x31, 0xca, 0x02, 0x02, 0x56, 0x31, 0xe2, 0x02, 0x0e, 0x56, 0x31, 0x5c, 0x47,
+	0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x02, 0x56, 0x31, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/api/v1/common.proto b/api/v1/common.proto
deleted file mode 100644
index 71abf99..0000000
--- a/api/v1/common.proto
+++ /dev/null
@@ -1,13 +0,0 @@
-syntax = "proto3";
-
-package v1;
-
-option go_package = "./v1";
-
-message Paging {
-    // page is used for pagination, if unset only the first page is returned,
-    // the list response contains then the page number for the next page.
-    optional uint64 page = 1;
-    // count is the number of results returned per page, if not given server side defaults apply
-    optional uint64 count = 2;
-}
\ No newline at end of file
diff --git a/api/v1/iam.pb.go b/api/v1/iam.pb.go
index b4d5ce2..dda8bdb 100644
--- a/api/v1/iam.pb.go
+++ b/api/v1/iam.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.20.1
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
 // source: v1/iam.proto
 
 package v1
@@ -532,8 +532,13 @@ var file_v1_iam_proto_rawDesc = []byte{
 	0x28, 0x09, 0x52, 0x0a, 0x69, 0x64, 0x6d, 0x52, 0x65, 0x71, 0x55, 0x73, 0x65, 0x72, 0x12, 0x22,
 	0x0a, 0x0d, 0x69, 0x64, 0x6d, 0x5f, 0x72, 0x65, 0x71, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18,
 	0x0f, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x69, 0x64, 0x6d, 0x52, 0x65, 0x71, 0x45, 0x6d, 0x61,
-	0x69, 0x6c, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x69, 0x6c, 0x42, 0x64, 0x0a, 0x06, 0x63, 0x6f, 0x6d, 0x2e, 0x76, 0x31, 0x42, 0x08, 0x49, 0x61,
+	0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x28, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x6c, 0x2d, 0x73, 0x74, 0x61, 0x63, 0x6b,
+	0x2f, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72, 0x64, 0x61, 0x74, 0x61, 0x2d, 0x61, 0x70, 0x69, 0x2f,
+	0x76, 0x31, 0xa2, 0x02, 0x03, 0x56, 0x58, 0x58, 0xaa, 0x02, 0x02, 0x56, 0x31, 0xca, 0x02, 0x02,
+	0x56, 0x31, 0xe2, 0x02, 0x0e, 0x56, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0xea, 0x02, 0x02, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/api/v1/iam.proto b/api/v1/iam.proto
deleted file mode 100644
index f967f7f..0000000
--- a/api/v1/iam.proto
+++ /dev/null
@@ -1,72 +0,0 @@
-syntax = "proto3";
-
-package v1;
-
-option go_package = "./v1";
-
-import "google/protobuf/wrappers.proto";
-
-message IAMConfig {
-    IssuerConfig issuer_config = 1;
-    IDMConfig idm_config = 2;
-    NamespaceGroupConfig group_config = 3;
-}
-
-message IssuerConfig {
-    string url = 1;
-    string client_id = 2;
-}
-
-// mandatory config
-message IDMConfig {
-    string idm_type = 1;
-
-    // optional
-    ConnectorConfig connector_config = 2;
-}
-
-// Config for group-rolebinding-controller
-message NamespaceGroupConfig {
-    // no action is taken or any namespace in this list
-    string excluded_namespaces = 1;
-
-    // for each element a RoleBinding is created in any Namespace - ClusterRoles are bound with this name
-    // admin,edit,view
-    string expected_groups_list = 2;
-
-    // Maximum length of namespace-part in clusterGroupname and therefore in the corresponding groupname in the directory.
-    // 20 chars für AD, given the naming-conventions
-    int32 namespace_max_length = 3;
-
-    // The created RoleBindings will reference this group (from token).
-    // oidc:{{ .Namespace }}-{{ .Group }}
-    string cluster_groupname_template = 4;
-
-    // The RoleBindings will created with this name.
-    // oidc-{{ .Namespace }}-{{ .Group }}
-    string rolebinding_name_template = 5;
-}
-
-// optional config if idm webhook is used to automatically create/delete groups/roles in the tenant idm
-message ConnectorConfig {
-    // the following are all mandatory
-    string idm_api_url = 1;
-    string idm_api_user = 2;
-    string idm_api_password = 3;
-
-    string idm_system_id = 4;
-    string idm_access_code = 5;
-    string idm_customer_id = 6;
-    string idm_group_ou = 7;
-    // optional
-    google.protobuf.StringValue idm_groupname_template = 8;
-
-    string idm_domain_name = 9;
-    string idm_tenant_prefix = 10;
-
-    string idm_submitter = 11;
-    string idm_job_info = 12;
-    string idm_req_system = 13;
-    string idm_req_user = 14;
-    string idm_req_email = 15;
-}
diff --git a/api/v1/meta.pb.go b/api/v1/meta.pb.go
index 5e729c7..50ab2ca 100644
--- a/api/v1/meta.pb.go
+++ b/api/v1/meta.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.20.1
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
 // source: v1/meta.proto
 
 package v1
@@ -153,8 +153,14 @@ var file_v1_meta_proto_rawDesc = []byte{
 	0x0a, 0x10, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74,
 	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
 	0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x06,
-	0x5a, 0x04, 0x2e, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x65,
+	0x0a, 0x06, 0x63, 0x6f, 0x6d, 0x2e, 0x76, 0x31, 0x42, 0x09, 0x4d, 0x65, 0x74, 0x61, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x28, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x6c, 0x2d, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x2f, 0x6d, 0x61,
+	0x73, 0x74, 0x65, 0x72, 0x64, 0x61, 0x74, 0x61, 0x2d, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0xa2,
+	0x02, 0x03, 0x56, 0x58, 0x58, 0xaa, 0x02, 0x02, 0x56, 0x31, 0xca, 0x02, 0x02, 0x56, 0x31, 0xe2,
+	0x02, 0x0e, 0x56, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0xea, 0x02, 0x02, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/api/v1/meta.proto b/api/v1/meta.proto
deleted file mode 100644
index d2ff543..0000000
--- a/api/v1/meta.proto
+++ /dev/null
@@ -1,18 +0,0 @@
-syntax = "proto3";
-
-package v1;
-
-option go_package = "./v1";
-
-import "google/protobuf/timestamp.proto";
-
-message Meta {
-    string id = 1;
-    string kind = 2;
-    string apiversion = 3;
-    int64 version = 4;
-    google.protobuf.Timestamp created_time = 5;
-    google.protobuf.Timestamp updated_time = 6;
-    map<string, string> annotations = 7;
-    repeated string labels = 8;
-}
\ No newline at end of file
diff --git a/api/v1/project.pb.go b/api/v1/project.pb.go
index b205437..fc765eb 100644
--- a/api/v1/project.pb.go
+++ b/api/v1/project.pb.go
@@ -1,16 +1,12 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.20.1
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
 // source: v1/project.proto
 
 package v1
 
 import (
-	context "context"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
@@ -543,14 +539,14 @@ var File_v1_project_proto protoreflect.FileDescriptor
 
 var file_v1_project_proto_rawDesc = []byte{
 	0x0a, 0x10, 0x76, 0x31, 0x2f, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x12, 0x02, 0x76, 0x31, 0x1a, 0x0f, 0x76, 0x31, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0d, 0x76, 0x31, 0x2f, 0x6d, 0x65, 0x74, 0x61,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0e, 0x76, 0x31, 0x2f, 0x71, 0x75, 0x6f, 0x74, 0x61,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70,
+	0x74, 0x6f, 0x12, 0x02, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70,
 	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
-	0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa0, 0x01, 0x0a, 0x07, 0x50, 0x72, 0x6f, 0x6a,
+	0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72,
+	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0f, 0x76, 0x31, 0x2f, 0x63, 0x6f, 0x6d, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0d, 0x76, 0x31, 0x2f, 0x6d, 0x65, 0x74,
+	0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0e, 0x76, 0x31, 0x2f, 0x71, 0x75, 0x6f, 0x74,
+	0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa0, 0x01, 0x0a, 0x07, 0x50, 0x72, 0x6f, 0x6a,
 	0x65, 0x63, 0x74, 0x12, 0x1c, 0x0a, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28,
 	0x0b, 0x32, 0x08, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x04, 0x6d, 0x65, 0x74,
 	0x61, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
@@ -638,8 +634,14 @@ var file_v1_project_proto_rawDesc = []byte{
 	0x6e, 0x64, 0x12, 0x16, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x46,
 	0x69, 0x6e, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x76, 0x31, 0x2e,
 	0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x33,
+	0x6e, 0x73, 0x65, 0x42, 0x68, 0x0a, 0x06, 0x63, 0x6f, 0x6d, 0x2e, 0x76, 0x31, 0x42, 0x0c, 0x50,
+	0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x28, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x6c, 0x2d,
+	0x73, 0x74, 0x61, 0x63, 0x6b, 0x2f, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72, 0x64, 0x61, 0x74, 0x61,
+	0x2d, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0xa2, 0x02, 0x03, 0x56, 0x58, 0x58, 0xaa, 0x02, 0x02,
+	0x56, 0x31, 0xca, 0x02, 0x02, 0x56, 0x31, 0xe2, 0x02, 0x0e, 0x56, 0x31, 0x5c, 0x47, 0x50, 0x42,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x02, 0x56, 0x31, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -843,263 +845,3 @@ func file_v1_project_proto_init() {
 	file_v1_project_proto_goTypes = nil
 	file_v1_project_proto_depIdxs = nil
 }
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ context.Context
-var _ grpc.ClientConnInterface
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-const _ = grpc.SupportPackageIsVersion6
-
-// ProjectServiceClient is the client API for ProjectService service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
-type ProjectServiceClient interface {
-	Create(ctx context.Context, in *ProjectCreateRequest, opts ...grpc.CallOption) (*ProjectResponse, error)
-	Update(ctx context.Context, in *ProjectUpdateRequest, opts ...grpc.CallOption) (*ProjectResponse, error)
-	Delete(ctx context.Context, in *ProjectDeleteRequest, opts ...grpc.CallOption) (*ProjectResponse, error)
-	Get(ctx context.Context, in *ProjectGetRequest, opts ...grpc.CallOption) (*ProjectResponse, error)
-	GetHistory(ctx context.Context, in *ProjectGetHistoryRequest, opts ...grpc.CallOption) (*ProjectResponse, error)
-	Find(ctx context.Context, in *ProjectFindRequest, opts ...grpc.CallOption) (*ProjectListResponse, error)
-}
-
-type projectServiceClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewProjectServiceClient(cc grpc.ClientConnInterface) ProjectServiceClient {
-	return &projectServiceClient{cc}
-}
-
-func (c *projectServiceClient) Create(ctx context.Context, in *ProjectCreateRequest, opts ...grpc.CallOption) (*ProjectResponse, error) {
-	out := new(ProjectResponse)
-	err := c.cc.Invoke(ctx, "/v1.ProjectService/Create", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *projectServiceClient) Update(ctx context.Context, in *ProjectUpdateRequest, opts ...grpc.CallOption) (*ProjectResponse, error) {
-	out := new(ProjectResponse)
-	err := c.cc.Invoke(ctx, "/v1.ProjectService/Update", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *projectServiceClient) Delete(ctx context.Context, in *ProjectDeleteRequest, opts ...grpc.CallOption) (*ProjectResponse, error) {
-	out := new(ProjectResponse)
-	err := c.cc.Invoke(ctx, "/v1.ProjectService/Delete", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *projectServiceClient) Get(ctx context.Context, in *ProjectGetRequest, opts ...grpc.CallOption) (*ProjectResponse, error) {
-	out := new(ProjectResponse)
-	err := c.cc.Invoke(ctx, "/v1.ProjectService/Get", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *projectServiceClient) GetHistory(ctx context.Context, in *ProjectGetHistoryRequest, opts ...grpc.CallOption) (*ProjectResponse, error) {
-	out := new(ProjectResponse)
-	err := c.cc.Invoke(ctx, "/v1.ProjectService/GetHistory", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *projectServiceClient) Find(ctx context.Context, in *ProjectFindRequest, opts ...grpc.CallOption) (*ProjectListResponse, error) {
-	out := new(ProjectListResponse)
-	err := c.cc.Invoke(ctx, "/v1.ProjectService/Find", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// ProjectServiceServer is the server API for ProjectService service.
-type ProjectServiceServer interface {
-	Create(context.Context, *ProjectCreateRequest) (*ProjectResponse, error)
-	Update(context.Context, *ProjectUpdateRequest) (*ProjectResponse, error)
-	Delete(context.Context, *ProjectDeleteRequest) (*ProjectResponse, error)
-	Get(context.Context, *ProjectGetRequest) (*ProjectResponse, error)
-	GetHistory(context.Context, *ProjectGetHistoryRequest) (*ProjectResponse, error)
-	Find(context.Context, *ProjectFindRequest) (*ProjectListResponse, error)
-}
-
-// UnimplementedProjectServiceServer can be embedded to have forward compatible implementations.
-type UnimplementedProjectServiceServer struct {
-}
-
-func (*UnimplementedProjectServiceServer) Create(context.Context, *ProjectCreateRequest) (*ProjectResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Create not implemented")
-}
-func (*UnimplementedProjectServiceServer) Update(context.Context, *ProjectUpdateRequest) (*ProjectResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Update not implemented")
-}
-func (*UnimplementedProjectServiceServer) Delete(context.Context, *ProjectDeleteRequest) (*ProjectResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Delete not implemented")
-}
-func (*UnimplementedProjectServiceServer) Get(context.Context, *ProjectGetRequest) (*ProjectResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Get not implemented")
-}
-func (*UnimplementedProjectServiceServer) GetHistory(context.Context, *ProjectGetHistoryRequest) (*ProjectResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetHistory not implemented")
-}
-func (*UnimplementedProjectServiceServer) Find(context.Context, *ProjectFindRequest) (*ProjectListResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Find not implemented")
-}
-
-func RegisterProjectServiceServer(s *grpc.Server, srv ProjectServiceServer) {
-	s.RegisterService(&_ProjectService_serviceDesc, srv)
-}
-
-func _ProjectService_Create_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ProjectCreateRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ProjectServiceServer).Create(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.ProjectService/Create",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ProjectServiceServer).Create(ctx, req.(*ProjectCreateRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ProjectService_Update_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ProjectUpdateRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ProjectServiceServer).Update(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.ProjectService/Update",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ProjectServiceServer).Update(ctx, req.(*ProjectUpdateRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ProjectService_Delete_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ProjectDeleteRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ProjectServiceServer).Delete(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.ProjectService/Delete",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ProjectServiceServer).Delete(ctx, req.(*ProjectDeleteRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ProjectService_Get_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ProjectGetRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ProjectServiceServer).Get(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.ProjectService/Get",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ProjectServiceServer).Get(ctx, req.(*ProjectGetRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ProjectService_GetHistory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ProjectGetHistoryRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ProjectServiceServer).GetHistory(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.ProjectService/GetHistory",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ProjectServiceServer).GetHistory(ctx, req.(*ProjectGetHistoryRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _ProjectService_Find_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ProjectFindRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ProjectServiceServer).Find(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.ProjectService/Find",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ProjectServiceServer).Find(ctx, req.(*ProjectFindRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-var _ProjectService_serviceDesc = grpc.ServiceDesc{
-	ServiceName: "v1.ProjectService",
-	HandlerType: (*ProjectServiceServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "Create",
-			Handler:    _ProjectService_Create_Handler,
-		},
-		{
-			MethodName: "Update",
-			Handler:    _ProjectService_Update_Handler,
-		},
-		{
-			MethodName: "Delete",
-			Handler:    _ProjectService_Delete_Handler,
-		},
-		{
-			MethodName: "Get",
-			Handler:    _ProjectService_Get_Handler,
-		},
-		{
-			MethodName: "GetHistory",
-			Handler:    _ProjectService_GetHistory_Handler,
-		},
-		{
-			MethodName: "Find",
-			Handler:    _ProjectService_Find_Handler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "v1/project.proto",
-}
diff --git a/api/v1/project.proto b/api/v1/project.proto
deleted file mode 100644
index 36fddbd..0000000
--- a/api/v1/project.proto
+++ /dev/null
@@ -1,69 +0,0 @@
-syntax = "proto3";
-
-package v1;
-
-option go_package = "./v1";
-
-import "v1/common.proto";
-import "v1/meta.proto";
-import "v1/quota.proto";
-import "google/protobuf/wrappers.proto";
-import "google/protobuf/timestamp.proto";
-
-service ProjectService {
-    rpc Create(ProjectCreateRequest) returns (ProjectResponse);
-    rpc Update(ProjectUpdateRequest) returns (ProjectResponse);
-    rpc Delete(ProjectDeleteRequest) returns (ProjectResponse);
-    rpc Get(ProjectGetRequest) returns (ProjectResponse);
-    rpc GetHistory(ProjectGetHistoryRequest) returns (ProjectResponse);
-    rpc Find(ProjectFindRequest) returns (ProjectListResponse);
-}
-
-// Project is the database model
-message Project {
-    Meta meta = 1;
-    string name = 2;
-    string description = 3;
-    string tenant_id = 4;
-    QuotaSet quotas = 5;
-}
-
-message ProjectCreateRequest {
-    Project project = 1;
-}
-
-message ProjectUpdateRequest {
-    Project project = 1;
-}
-
-message ProjectDeleteRequest {
-    string id = 1;
-}
-
-message ProjectGetRequest {
-    string id = 1;
-}
-
-message ProjectGetHistoryRequest {
-    string id = 1;
-    google.protobuf.Timestamp at = 2;
-}
-
-message ProjectFindRequest {
-    google.protobuf.StringValue id = 1;
-    google.protobuf.StringValue name = 2;
-    google.protobuf.StringValue description = 3;
-    google.protobuf.StringValue tenant_id = 4;
-    Paging paging = 5;
-    map <string,string> annotations = 6;
-}
-
-message ProjectResponse {
-    Project project = 1;
-}
-
-message ProjectListResponse {
-    repeated Project projects = 1;
-    // next_page_token is used for pagination, returns the next page to be fetched and must then be provided in the list request.
-    optional uint64 next_page = 2;
-}
diff --git a/api/v1/project_grpc.pb.go b/api/v1/project_grpc.pb.go
new file mode 100644
index 0000000..04a1ca2
--- /dev/null
+++ b/api/v1/project_grpc.pb.go
@@ -0,0 +1,292 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: v1/project.proto
+
+package v1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	ProjectService_Create_FullMethodName     = "/v1.ProjectService/Create"
+	ProjectService_Update_FullMethodName     = "/v1.ProjectService/Update"
+	ProjectService_Delete_FullMethodName     = "/v1.ProjectService/Delete"
+	ProjectService_Get_FullMethodName        = "/v1.ProjectService/Get"
+	ProjectService_GetHistory_FullMethodName = "/v1.ProjectService/GetHistory"
+	ProjectService_Find_FullMethodName       = "/v1.ProjectService/Find"
+)
+
+// ProjectServiceClient is the client API for ProjectService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ProjectServiceClient interface {
+	Create(ctx context.Context, in *ProjectCreateRequest, opts ...grpc.CallOption) (*ProjectResponse, error)
+	Update(ctx context.Context, in *ProjectUpdateRequest, opts ...grpc.CallOption) (*ProjectResponse, error)
+	Delete(ctx context.Context, in *ProjectDeleteRequest, opts ...grpc.CallOption) (*ProjectResponse, error)
+	Get(ctx context.Context, in *ProjectGetRequest, opts ...grpc.CallOption) (*ProjectResponse, error)
+	GetHistory(ctx context.Context, in *ProjectGetHistoryRequest, opts ...grpc.CallOption) (*ProjectResponse, error)
+	Find(ctx context.Context, in *ProjectFindRequest, opts ...grpc.CallOption) (*ProjectListResponse, error)
+}
+
+type projectServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewProjectServiceClient(cc grpc.ClientConnInterface) ProjectServiceClient {
+	return &projectServiceClient{cc}
+}
+
+func (c *projectServiceClient) Create(ctx context.Context, in *ProjectCreateRequest, opts ...grpc.CallOption) (*ProjectResponse, error) {
+	out := new(ProjectResponse)
+	err := c.cc.Invoke(ctx, ProjectService_Create_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *projectServiceClient) Update(ctx context.Context, in *ProjectUpdateRequest, opts ...grpc.CallOption) (*ProjectResponse, error) {
+	out := new(ProjectResponse)
+	err := c.cc.Invoke(ctx, ProjectService_Update_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *projectServiceClient) Delete(ctx context.Context, in *ProjectDeleteRequest, opts ...grpc.CallOption) (*ProjectResponse, error) {
+	out := new(ProjectResponse)
+	err := c.cc.Invoke(ctx, ProjectService_Delete_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *projectServiceClient) Get(ctx context.Context, in *ProjectGetRequest, opts ...grpc.CallOption) (*ProjectResponse, error) {
+	out := new(ProjectResponse)
+	err := c.cc.Invoke(ctx, ProjectService_Get_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *projectServiceClient) GetHistory(ctx context.Context, in *ProjectGetHistoryRequest, opts ...grpc.CallOption) (*ProjectResponse, error) {
+	out := new(ProjectResponse)
+	err := c.cc.Invoke(ctx, ProjectService_GetHistory_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *projectServiceClient) Find(ctx context.Context, in *ProjectFindRequest, opts ...grpc.CallOption) (*ProjectListResponse, error) {
+	out := new(ProjectListResponse)
+	err := c.cc.Invoke(ctx, ProjectService_Find_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ProjectServiceServer is the server API for ProjectService service.
+// All implementations should embed UnimplementedProjectServiceServer
+// for forward compatibility
+type ProjectServiceServer interface {
+	Create(context.Context, *ProjectCreateRequest) (*ProjectResponse, error)
+	Update(context.Context, *ProjectUpdateRequest) (*ProjectResponse, error)
+	Delete(context.Context, *ProjectDeleteRequest) (*ProjectResponse, error)
+	Get(context.Context, *ProjectGetRequest) (*ProjectResponse, error)
+	GetHistory(context.Context, *ProjectGetHistoryRequest) (*ProjectResponse, error)
+	Find(context.Context, *ProjectFindRequest) (*ProjectListResponse, error)
+}
+
+// UnimplementedProjectServiceServer should be embedded to have forward compatible implementations.
+type UnimplementedProjectServiceServer struct {
+}
+
+func (UnimplementedProjectServiceServer) Create(context.Context, *ProjectCreateRequest) (*ProjectResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Create not implemented")
+}
+func (UnimplementedProjectServiceServer) Update(context.Context, *ProjectUpdateRequest) (*ProjectResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Update not implemented")
+}
+func (UnimplementedProjectServiceServer) Delete(context.Context, *ProjectDeleteRequest) (*ProjectResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Delete not implemented")
+}
+func (UnimplementedProjectServiceServer) Get(context.Context, *ProjectGetRequest) (*ProjectResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Get not implemented")
+}
+func (UnimplementedProjectServiceServer) GetHistory(context.Context, *ProjectGetHistoryRequest) (*ProjectResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetHistory not implemented")
+}
+func (UnimplementedProjectServiceServer) Find(context.Context, *ProjectFindRequest) (*ProjectListResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Find not implemented")
+}
+
+// UnsafeProjectServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ProjectServiceServer will
+// result in compilation errors.
+type UnsafeProjectServiceServer interface {
+	mustEmbedUnimplementedProjectServiceServer()
+}
+
+func RegisterProjectServiceServer(s grpc.ServiceRegistrar, srv ProjectServiceServer) {
+	s.RegisterService(&ProjectService_ServiceDesc, srv)
+}
+
+func _ProjectService_Create_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ProjectCreateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProjectServiceServer).Create(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ProjectService_Create_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProjectServiceServer).Create(ctx, req.(*ProjectCreateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ProjectService_Update_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ProjectUpdateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProjectServiceServer).Update(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ProjectService_Update_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProjectServiceServer).Update(ctx, req.(*ProjectUpdateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ProjectService_Delete_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ProjectDeleteRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProjectServiceServer).Delete(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ProjectService_Delete_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProjectServiceServer).Delete(ctx, req.(*ProjectDeleteRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ProjectService_Get_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ProjectGetRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProjectServiceServer).Get(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ProjectService_Get_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProjectServiceServer).Get(ctx, req.(*ProjectGetRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ProjectService_GetHistory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ProjectGetHistoryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProjectServiceServer).GetHistory(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ProjectService_GetHistory_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProjectServiceServer).GetHistory(ctx, req.(*ProjectGetHistoryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ProjectService_Find_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ProjectFindRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProjectServiceServer).Find(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ProjectService_Find_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProjectServiceServer).Find(ctx, req.(*ProjectFindRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ProjectService_ServiceDesc is the grpc.ServiceDesc for ProjectService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ProjectService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "v1.ProjectService",
+	HandlerType: (*ProjectServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Create",
+			Handler:    _ProjectService_Create_Handler,
+		},
+		{
+			MethodName: "Update",
+			Handler:    _ProjectService_Update_Handler,
+		},
+		{
+			MethodName: "Delete",
+			Handler:    _ProjectService_Delete_Handler,
+		},
+		{
+			MethodName: "Get",
+			Handler:    _ProjectService_Get_Handler,
+		},
+		{
+			MethodName: "GetHistory",
+			Handler:    _ProjectService_GetHistory_Handler,
+		},
+		{
+			MethodName: "Find",
+			Handler:    _ProjectService_Find_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "v1/project.proto",
+}
diff --git a/api/v1/quota.pb.go b/api/v1/quota.pb.go
index b36b33a..dc5fec9 100644
--- a/api/v1/quota.pb.go
+++ b/api/v1/quota.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.20.1
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
 // source: v1/quota.proto
 
 package v1
@@ -168,7 +168,13 @@ var file_v1_quota_proto_rawDesc = []byte{
 	0x75, 0x6f, 0x74, 0x61, 0x12, 0x31, 0x0a, 0x05, 0x71, 0x75, 0x6f, 0x74, 0x61, 0x18, 0x01, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65,
-	0x52, 0x05, 0x71, 0x75, 0x6f, 0x74, 0x61, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x76, 0x31, 0x62,
+	0x52, 0x05, 0x71, 0x75, 0x6f, 0x74, 0x61, 0x42, 0x66, 0x0a, 0x06, 0x63, 0x6f, 0x6d, 0x2e, 0x76,
+	0x31, 0x42, 0x0a, 0x51, 0x75, 0x6f, 0x74, 0x61, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
+	0x28, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6d, 0x65, 0x74, 0x61,
+	0x6c, 0x2d, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x2f, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72, 0x64, 0x61,
+	0x74, 0x61, 0x2d, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0xa2, 0x02, 0x03, 0x56, 0x58, 0x58, 0xaa,
+	0x02, 0x02, 0x56, 0x31, 0xca, 0x02, 0x02, 0x56, 0x31, 0xe2, 0x02, 0x0e, 0x56, 0x31, 0x5c, 0x47,
+	0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x02, 0x56, 0x31, 0x62,
 	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
diff --git a/api/v1/quota.proto b/api/v1/quota.proto
deleted file mode 100644
index 7ce1a63..0000000
--- a/api/v1/quota.proto
+++ /dev/null
@@ -1,28 +0,0 @@
-syntax = "proto3";
-
-package v1;
-
-option go_package = "./v1";
-
-import "google/protobuf/wrappers.proto";
-
-// QuotaSet defines the types of possible Quotas
-// might be specified by project or tenant
-// whatever quota is reached first counts
-// it always defines the max amount of this type
-message QuotaSet {
-    // cluster the amount of clusters
-    Quota cluster = 1;
-    // machine the amount of machines
-    Quota machine = 2;
-    // ip the amount of aquired ip´s
-    Quota ip = 3;
-    // project the amount of projects of a tenant
-    Quota project = 4;
-}
-
-// Quota is the actual maximum amount
-message Quota {
-    // quota is the maximum amount for the current QuotaSet, can be nil
-    google.protobuf.Int32Value quota = 1;
-}
diff --git a/api/v1/tenant.pb.go b/api/v1/tenant.pb.go
index 0e836f1..dad60dd 100644
--- a/api/v1/tenant.pb.go
+++ b/api/v1/tenant.pb.go
@@ -1,16 +1,12 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.20.1
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
 // source: v1/tenant.proto
 
 package v1
 
 import (
-	context "context"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
@@ -534,14 +530,14 @@ var File_v1_tenant_proto protoreflect.FileDescriptor
 
 var file_v1_tenant_proto_rawDesc = []byte{
 	0x0a, 0x0f, 0x76, 0x31, 0x2f, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x12, 0x02, 0x76, 0x31, 0x1a, 0x0f, 0x76, 0x31, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0d, 0x76, 0x31, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0e, 0x76, 0x31, 0x2f, 0x71, 0x75, 0x6f, 0x74, 0x61, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0c, 0x76, 0x31, 0x2f, 0x69, 0x61, 0x6d, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70,
+	0x6f, 0x12, 0x02, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0f, 0x76, 0x31, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0c, 0x76, 0x31, 0x2f, 0x69, 0x61, 0x6d, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0d, 0x76, 0x31, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0e, 0x76, 0x31, 0x2f, 0x71, 0x75, 0x6f, 0x74, 0x61, 0x2e, 0x70,
 	0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe5, 0x01, 0x0a, 0x06, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x74, 0x12,
 	0x1c, 0x0a, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x08, 0x2e,
 	0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x12, 0x12, 0x0a,
@@ -624,8 +620,14 @@ var file_v1_tenant_proto_rawDesc = []byte{
 	0x65, 0x12, 0x35, 0x0a, 0x04, 0x46, 0x69, 0x6e, 0x64, 0x12, 0x15, 0x2e, 0x76, 0x31, 0x2e, 0x54,
 	0x65, 0x6e, 0x61, 0x6e, 0x74, 0x46, 0x69, 0x6e, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
 	0x1a, 0x16, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x74, 0x4c, 0x69, 0x73, 0x74,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x76, 0x31,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x67, 0x0a, 0x06, 0x63, 0x6f, 0x6d, 0x2e,
+	0x76, 0x31, 0x42, 0x0b, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x74, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
+	0x01, 0x5a, 0x28, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6d, 0x65,
+	0x74, 0x61, 0x6c, 0x2d, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x2f, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72,
+	0x64, 0x61, 0x74, 0x61, 0x2d, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0xa2, 0x02, 0x03, 0x56, 0x58,
+	0x58, 0xaa, 0x02, 0x02, 0x56, 0x31, 0xca, 0x02, 0x02, 0x56, 0x31, 0xe2, 0x02, 0x0e, 0x56, 0x31,
+	0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x02, 0x56,
+	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -698,9 +700,9 @@ func file_v1_tenant_proto_init() {
 		return
 	}
 	file_v1_common_proto_init()
+	file_v1_iam_proto_init()
 	file_v1_meta_proto_init()
 	file_v1_quota_proto_init()
-	file_v1_iam_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_v1_tenant_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Tenant); i {
@@ -831,263 +833,3 @@ func file_v1_tenant_proto_init() {
 	file_v1_tenant_proto_goTypes = nil
 	file_v1_tenant_proto_depIdxs = nil
 }
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ context.Context
-var _ grpc.ClientConnInterface
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-const _ = grpc.SupportPackageIsVersion6
-
-// TenantServiceClient is the client API for TenantService service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
-type TenantServiceClient interface {
-	Create(ctx context.Context, in *TenantCreateRequest, opts ...grpc.CallOption) (*TenantResponse, error)
-	Update(ctx context.Context, in *TenantUpdateRequest, opts ...grpc.CallOption) (*TenantResponse, error)
-	Delete(ctx context.Context, in *TenantDeleteRequest, opts ...grpc.CallOption) (*TenantResponse, error)
-	Get(ctx context.Context, in *TenantGetRequest, opts ...grpc.CallOption) (*TenantResponse, error)
-	GetHistory(ctx context.Context, in *TenantGetHistoryRequest, opts ...grpc.CallOption) (*TenantResponse, error)
-	Find(ctx context.Context, in *TenantFindRequest, opts ...grpc.CallOption) (*TenantListResponse, error)
-}
-
-type tenantServiceClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewTenantServiceClient(cc grpc.ClientConnInterface) TenantServiceClient {
-	return &tenantServiceClient{cc}
-}
-
-func (c *tenantServiceClient) Create(ctx context.Context, in *TenantCreateRequest, opts ...grpc.CallOption) (*TenantResponse, error) {
-	out := new(TenantResponse)
-	err := c.cc.Invoke(ctx, "/v1.TenantService/Create", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *tenantServiceClient) Update(ctx context.Context, in *TenantUpdateRequest, opts ...grpc.CallOption) (*TenantResponse, error) {
-	out := new(TenantResponse)
-	err := c.cc.Invoke(ctx, "/v1.TenantService/Update", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *tenantServiceClient) Delete(ctx context.Context, in *TenantDeleteRequest, opts ...grpc.CallOption) (*TenantResponse, error) {
-	out := new(TenantResponse)
-	err := c.cc.Invoke(ctx, "/v1.TenantService/Delete", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *tenantServiceClient) Get(ctx context.Context, in *TenantGetRequest, opts ...grpc.CallOption) (*TenantResponse, error) {
-	out := new(TenantResponse)
-	err := c.cc.Invoke(ctx, "/v1.TenantService/Get", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *tenantServiceClient) GetHistory(ctx context.Context, in *TenantGetHistoryRequest, opts ...grpc.CallOption) (*TenantResponse, error) {
-	out := new(TenantResponse)
-	err := c.cc.Invoke(ctx, "/v1.TenantService/GetHistory", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *tenantServiceClient) Find(ctx context.Context, in *TenantFindRequest, opts ...grpc.CallOption) (*TenantListResponse, error) {
-	out := new(TenantListResponse)
-	err := c.cc.Invoke(ctx, "/v1.TenantService/Find", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// TenantServiceServer is the server API for TenantService service.
-type TenantServiceServer interface {
-	Create(context.Context, *TenantCreateRequest) (*TenantResponse, error)
-	Update(context.Context, *TenantUpdateRequest) (*TenantResponse, error)
-	Delete(context.Context, *TenantDeleteRequest) (*TenantResponse, error)
-	Get(context.Context, *TenantGetRequest) (*TenantResponse, error)
-	GetHistory(context.Context, *TenantGetHistoryRequest) (*TenantResponse, error)
-	Find(context.Context, *TenantFindRequest) (*TenantListResponse, error)
-}
-
-// UnimplementedTenantServiceServer can be embedded to have forward compatible implementations.
-type UnimplementedTenantServiceServer struct {
-}
-
-func (*UnimplementedTenantServiceServer) Create(context.Context, *TenantCreateRequest) (*TenantResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Create not implemented")
-}
-func (*UnimplementedTenantServiceServer) Update(context.Context, *TenantUpdateRequest) (*TenantResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Update not implemented")
-}
-func (*UnimplementedTenantServiceServer) Delete(context.Context, *TenantDeleteRequest) (*TenantResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Delete not implemented")
-}
-func (*UnimplementedTenantServiceServer) Get(context.Context, *TenantGetRequest) (*TenantResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Get not implemented")
-}
-func (*UnimplementedTenantServiceServer) GetHistory(context.Context, *TenantGetHistoryRequest) (*TenantResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetHistory not implemented")
-}
-func (*UnimplementedTenantServiceServer) Find(context.Context, *TenantFindRequest) (*TenantListResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Find not implemented")
-}
-
-func RegisterTenantServiceServer(s *grpc.Server, srv TenantServiceServer) {
-	s.RegisterService(&_TenantService_serviceDesc, srv)
-}
-
-func _TenantService_Create_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(TenantCreateRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(TenantServiceServer).Create(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.TenantService/Create",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(TenantServiceServer).Create(ctx, req.(*TenantCreateRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _TenantService_Update_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(TenantUpdateRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(TenantServiceServer).Update(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.TenantService/Update",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(TenantServiceServer).Update(ctx, req.(*TenantUpdateRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _TenantService_Delete_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(TenantDeleteRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(TenantServiceServer).Delete(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.TenantService/Delete",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(TenantServiceServer).Delete(ctx, req.(*TenantDeleteRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _TenantService_Get_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(TenantGetRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(TenantServiceServer).Get(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.TenantService/Get",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(TenantServiceServer).Get(ctx, req.(*TenantGetRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _TenantService_GetHistory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(TenantGetHistoryRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(TenantServiceServer).GetHistory(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.TenantService/GetHistory",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(TenantServiceServer).GetHistory(ctx, req.(*TenantGetHistoryRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _TenantService_Find_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(TenantFindRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(TenantServiceServer).Find(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/v1.TenantService/Find",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(TenantServiceServer).Find(ctx, req.(*TenantFindRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-var _TenantService_serviceDesc = grpc.ServiceDesc{
-	ServiceName: "v1.TenantService",
-	HandlerType: (*TenantServiceServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "Create",
-			Handler:    _TenantService_Create_Handler,
-		},
-		{
-			MethodName: "Update",
-			Handler:    _TenantService_Update_Handler,
-		},
-		{
-			MethodName: "Delete",
-			Handler:    _TenantService_Delete_Handler,
-		},
-		{
-			MethodName: "Get",
-			Handler:    _TenantService_Get_Handler,
-		},
-		{
-			MethodName: "GetHistory",
-			Handler:    _TenantService_GetHistory_Handler,
-		},
-		{
-			MethodName: "Find",
-			Handler:    _TenantService_Find_Handler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "v1/tenant.proto",
-}
diff --git a/api/v1/tenant.proto b/api/v1/tenant.proto
deleted file mode 100644
index c25e3bb..0000000
--- a/api/v1/tenant.proto
+++ /dev/null
@@ -1,68 +0,0 @@
-syntax = "proto3";
-
-package v1;
-
-option go_package = "./v1";
-
-import "v1/common.proto";
-import "v1/meta.proto";
-import "v1/quota.proto";
-import "v1/iam.proto";
-import "google/protobuf/wrappers.proto";
-import "google/protobuf/timestamp.proto";
-
-service TenantService {
-    rpc Create(TenantCreateRequest) returns(TenantResponse);
-    rpc Update(TenantUpdateRequest) returns(TenantResponse);
-    rpc Delete(TenantDeleteRequest) returns(TenantResponse);
-    rpc Get(TenantGetRequest) returns(TenantResponse);
-    rpc GetHistory(TenantGetHistoryRequest) returns(TenantResponse);
-    rpc Find(TenantFindRequest) returns(TenantListResponse);
-}
-
-message Tenant {
-    Meta meta = 1;
-    string name = 2;
-    string description = 3;
-    QuotaSet default_quotas = 4;
-    QuotaSet quotas = 5;
-    IAMConfig iam_config = 6;
-}
-
-message TenantCreateRequest {
-    Tenant tenant = 1;
-}
-
-message TenantUpdateRequest {
-    Tenant tenant = 1;
-}
-
-message TenantDeleteRequest {
-    string id = 1;
-}
-
-message TenantGetRequest {
-    string id = 1;
-}
-
-message TenantGetHistoryRequest {
-    string id = 1;
-    google.protobuf.Timestamp at = 2;
-}
-
-message TenantFindRequest {
-    google.protobuf.StringValue id = 1;
-    google.protobuf.StringValue name = 2;
-    Paging paging = 3;
-    map <string,string> annotations = 4;
-}
-
-message TenantResponse {
-    Tenant tenant = 1;
-}
-
-message TenantListResponse {
-    repeated Tenant tenants = 1;
-    // next_page is used for pagination, returns the next page to be fetched and must then be provided in the list request.
-    optional uint64 next_page = 2;
-}
diff --git a/api/v1/tenant_grpc.pb.go b/api/v1/tenant_grpc.pb.go
new file mode 100644
index 0000000..92f034a
--- /dev/null
+++ b/api/v1/tenant_grpc.pb.go
@@ -0,0 +1,292 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: v1/tenant.proto
+
+package v1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	TenantService_Create_FullMethodName     = "/v1.TenantService/Create"
+	TenantService_Update_FullMethodName     = "/v1.TenantService/Update"
+	TenantService_Delete_FullMethodName     = "/v1.TenantService/Delete"
+	TenantService_Get_FullMethodName        = "/v1.TenantService/Get"
+	TenantService_GetHistory_FullMethodName = "/v1.TenantService/GetHistory"
+	TenantService_Find_FullMethodName       = "/v1.TenantService/Find"
+)
+
+// TenantServiceClient is the client API for TenantService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type TenantServiceClient interface {
+	Create(ctx context.Context, in *TenantCreateRequest, opts ...grpc.CallOption) (*TenantResponse, error)
+	Update(ctx context.Context, in *TenantUpdateRequest, opts ...grpc.CallOption) (*TenantResponse, error)
+	Delete(ctx context.Context, in *TenantDeleteRequest, opts ...grpc.CallOption) (*TenantResponse, error)
+	Get(ctx context.Context, in *TenantGetRequest, opts ...grpc.CallOption) (*TenantResponse, error)
+	GetHistory(ctx context.Context, in *TenantGetHistoryRequest, opts ...grpc.CallOption) (*TenantResponse, error)
+	Find(ctx context.Context, in *TenantFindRequest, opts ...grpc.CallOption) (*TenantListResponse, error)
+}
+
+type tenantServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewTenantServiceClient(cc grpc.ClientConnInterface) TenantServiceClient {
+	return &tenantServiceClient{cc}
+}
+
+func (c *tenantServiceClient) Create(ctx context.Context, in *TenantCreateRequest, opts ...grpc.CallOption) (*TenantResponse, error) {
+	out := new(TenantResponse)
+	err := c.cc.Invoke(ctx, TenantService_Create_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *tenantServiceClient) Update(ctx context.Context, in *TenantUpdateRequest, opts ...grpc.CallOption) (*TenantResponse, error) {
+	out := new(TenantResponse)
+	err := c.cc.Invoke(ctx, TenantService_Update_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *tenantServiceClient) Delete(ctx context.Context, in *TenantDeleteRequest, opts ...grpc.CallOption) (*TenantResponse, error) {
+	out := new(TenantResponse)
+	err := c.cc.Invoke(ctx, TenantService_Delete_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *tenantServiceClient) Get(ctx context.Context, in *TenantGetRequest, opts ...grpc.CallOption) (*TenantResponse, error) {
+	out := new(TenantResponse)
+	err := c.cc.Invoke(ctx, TenantService_Get_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *tenantServiceClient) GetHistory(ctx context.Context, in *TenantGetHistoryRequest, opts ...grpc.CallOption) (*TenantResponse, error) {
+	out := new(TenantResponse)
+	err := c.cc.Invoke(ctx, TenantService_GetHistory_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *tenantServiceClient) Find(ctx context.Context, in *TenantFindRequest, opts ...grpc.CallOption) (*TenantListResponse, error) {
+	out := new(TenantListResponse)
+	err := c.cc.Invoke(ctx, TenantService_Find_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// TenantServiceServer is the server API for TenantService service.
+// All implementations should embed UnimplementedTenantServiceServer
+// for forward compatibility
+type TenantServiceServer interface {
+	Create(context.Context, *TenantCreateRequest) (*TenantResponse, error)
+	Update(context.Context, *TenantUpdateRequest) (*TenantResponse, error)
+	Delete(context.Context, *TenantDeleteRequest) (*TenantResponse, error)
+	Get(context.Context, *TenantGetRequest) (*TenantResponse, error)
+	GetHistory(context.Context, *TenantGetHistoryRequest) (*TenantResponse, error)
+	Find(context.Context, *TenantFindRequest) (*TenantListResponse, error)
+}
+
+// UnimplementedTenantServiceServer should be embedded to have forward compatible implementations.
+type UnimplementedTenantServiceServer struct {
+}
+
+func (UnimplementedTenantServiceServer) Create(context.Context, *TenantCreateRequest) (*TenantResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Create not implemented")
+}
+func (UnimplementedTenantServiceServer) Update(context.Context, *TenantUpdateRequest) (*TenantResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Update not implemented")
+}
+func (UnimplementedTenantServiceServer) Delete(context.Context, *TenantDeleteRequest) (*TenantResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Delete not implemented")
+}
+func (UnimplementedTenantServiceServer) Get(context.Context, *TenantGetRequest) (*TenantResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Get not implemented")
+}
+func (UnimplementedTenantServiceServer) GetHistory(context.Context, *TenantGetHistoryRequest) (*TenantResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetHistory not implemented")
+}
+func (UnimplementedTenantServiceServer) Find(context.Context, *TenantFindRequest) (*TenantListResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Find not implemented")
+}
+
+// UnsafeTenantServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to TenantServiceServer will
+// result in compilation errors.
+type UnsafeTenantServiceServer interface {
+	mustEmbedUnimplementedTenantServiceServer()
+}
+
+func RegisterTenantServiceServer(s grpc.ServiceRegistrar, srv TenantServiceServer) {
+	s.RegisterService(&TenantService_ServiceDesc, srv)
+}
+
+func _TenantService_Create_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TenantCreateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TenantServiceServer).Create(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: TenantService_Create_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TenantServiceServer).Create(ctx, req.(*TenantCreateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TenantService_Update_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TenantUpdateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TenantServiceServer).Update(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: TenantService_Update_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TenantServiceServer).Update(ctx, req.(*TenantUpdateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TenantService_Delete_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TenantDeleteRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TenantServiceServer).Delete(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: TenantService_Delete_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TenantServiceServer).Delete(ctx, req.(*TenantDeleteRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TenantService_Get_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TenantGetRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TenantServiceServer).Get(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: TenantService_Get_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TenantServiceServer).Get(ctx, req.(*TenantGetRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TenantService_GetHistory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TenantGetHistoryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TenantServiceServer).GetHistory(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: TenantService_GetHistory_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TenantServiceServer).GetHistory(ctx, req.(*TenantGetHistoryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TenantService_Find_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TenantFindRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TenantServiceServer).Find(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: TenantService_Find_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TenantServiceServer).Find(ctx, req.(*TenantFindRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// TenantService_ServiceDesc is the grpc.ServiceDesc for TenantService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var TenantService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "v1.TenantService",
+	HandlerType: (*TenantServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Create",
+			Handler:    _TenantService_Create_Handler,
+		},
+		{
+			MethodName: "Update",
+			Handler:    _TenantService_Update_Handler,
+		},
+		{
+			MethodName: "Delete",
+			Handler:    _TenantService_Delete_Handler,
+		},
+		{
+			MethodName: "Get",
+			Handler:    _TenantService_Get_Handler,
+		},
+		{
+			MethodName: "GetHistory",
+			Handler:    _TenantService_GetHistory_Handler,
+		},
+		{
+			MethodName: "Find",
+			Handler:    _TenantService_Find_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "v1/tenant.proto",
+}
diff --git a/go.mod b/go.mod
index 7021d9c..ff7643c 100644
--- a/go.mod
+++ b/go.mod
@@ -5,15 +5,15 @@ go 1.21
 require (
 	github.com/Masterminds/squirrel v1.5.4
 	github.com/google/go-cmp v0.5.9
-	github.com/google/uuid v1.3.0
+	github.com/google/uuid v1.3.1
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
 	github.com/jmoiron/sqlx v1.3.5
 	github.com/json-iterator/go v1.1.12
 	github.com/lib/pq v1.10.9
 	github.com/lopezator/migrator v0.3.1
-	github.com/metal-stack/metal-lib v0.13.0
-	github.com/metal-stack/security v0.6.6
+	github.com/metal-stack/metal-lib v0.13.3
+	github.com/metal-stack/security v0.6.7
 	github.com/metal-stack/v v1.0.3
 	github.com/prometheus/client_golang v1.16.0
 	github.com/spf13/cobra v1.7.0
@@ -21,7 +21,7 @@ require (
 	github.com/stretchr/testify v1.8.4
 	github.com/testcontainers/testcontainers-go v0.23.0
 	go.uber.org/zap v1.25.0
-	google.golang.org/grpc v1.57.0
+	google.golang.org/grpc v1.58.0
 	google.golang.org/protobuf v1.31.0
 	sigs.k8s.io/yaml v1.3.0
 )
@@ -36,13 +36,13 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/containerd/containerd v1.7.3 // indirect
+	github.com/containerd/containerd v1.7.5 // indirect
 	github.com/coreos/go-oidc/v3 v3.6.0 // indirect
 	github.com/cpuguy83/dockercfg v0.3.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
 	github.com/docker/distribution v2.8.2+incompatible // indirect
-	github.com/docker/docker v24.0.5+incompatible // indirect
+	github.com/docker/docker v24.0.6+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
@@ -73,7 +73,7 @@ require (
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/moby/patternmatcher v0.5.0 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -83,7 +83,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0-rc4 // indirect
 	github.com/opencontainers/runc v1.1.9 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.9 // indirect
+	github.com/pelletier/go-toml/v2 v2.1.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.4.0 // indirect
@@ -98,16 +98,16 @@ require (
 	github.com/subosito/gotenv v1.6.0 // indirect
 	go.mongodb.org/mongo-driver v1.12.1 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.12.0 // indirect
-	golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb // indirect
+	golang.org/x/crypto v0.13.0 // indirect
+	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
 	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/net v0.14.0 // indirect
-	golang.org/x/oauth2 v0.11.0 // indirect
-	golang.org/x/sys v0.11.0 // indirect
-	golang.org/x/text v0.12.0 // indirect
-	golang.org/x/tools v0.12.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230815205213-6bfd019c3878 // indirect
+	golang.org/x/net v0.15.0 // indirect
+	golang.org/x/oauth2 v0.12.0 // indirect
+	golang.org/x/sys v0.12.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
+	golang.org/x/tools v0.13.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
diff --git a/go.sum b/go.sum
index a84af62..9ed38a9 100644
--- a/go.sum
+++ b/go.sum
@@ -43,8 +43,8 @@ cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3f
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20230106234847-43070de90fa1 h1:EKPd1INOIyr5hWOWhvpmQpY6tKjeG0hT1s3AMC/9fic=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20230106234847-43070de90fa1/go.mod h1:VzwV+t+dZ9j/H867F1M2ziD+yLHtB46oM35FxxMJ4d0=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
@@ -74,8 +74,8 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/containerd/containerd v1.7.3 h1:cKwYKkP1eTj54bP3wCdXXBymmKRQMrWjkLSWZZJDa8o=
-github.com/containerd/containerd v1.7.3/go.mod h1:32FOM4/O0RkNg7AjQj3hDzN9cUGtu+HMvaKUNiqCZB8=
+github.com/containerd/containerd v1.7.5 h1:i9T9XpAWMe11BHMN7pu1BZqOGjXaKTPyz2v+KYOZgkY=
+github.com/containerd/containerd v1.7.5/go.mod h1:ieJNCSzASw2shSGYLHx8NAE7WsZ/gEigo5fQ78W5Zvw=
 github.com/coreos/go-oidc/v3 v3.6.0 h1:AKVxfYw1Gmkn/w96z0DbT/B/xFnzTd3MkZvWLjF4n/o=
 github.com/coreos/go-oidc/v3 v3.6.0/go.mod h1:ZpHUsHBucTUj6WOkrP4E20UPynbLZzhTQ1XKCXkxyPc=
 github.com/cpuguy83/dockercfg v0.3.1 h1:/FpZ+JaygUR/lZP2NlFI2DVfrOEMAIKP5wWEJdoYe9E=
@@ -84,8 +84,6 @@ github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46t
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
-github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI=
-github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -94,8 +92,8 @@ github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 h1:8UrgZ3GkP4i/CLijOJx79Yu+etly
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
 github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
 github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v24.0.5+incompatible h1:WmgcE4fxyI6EEXxBRxsHnZXrO1pQ3smi0k/jho4HLeY=
-github.com/docker/docker v24.0.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v24.0.6+incompatible h1:hceabKCtUgDqPu+qm0NgsaXf28Ljf4/pWFL7xjWWDgE=
+github.com/docker/docker v24.0.6+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -172,6 +170,7 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
@@ -205,8 +204,8 @@ github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
@@ -294,16 +293,16 @@ github.com/mattn/go-sqlite3 v1.14.6 h1:dNPt6NO46WmLVt2DLNpwczCmdV5boIZ6g/tlDrlRU
 github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
 github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
 github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
-github.com/metal-stack/metal-lib v0.13.0 h1:Wv3OczQx3GzjH1WRsuwid0pwI+kTip8AjqyC0/ahVcQ=
-github.com/metal-stack/metal-lib v0.13.0/go.mod h1:+eUAh+8Db9PhQzhhbUsDrxfAveTEMDrXLOrSI6Hfp5o=
-github.com/metal-stack/security v0.6.6 h1:KSPNN8YZd2EJEjsJ0xCBcd5o53uU0iFupahHA9Twuh0=
-github.com/metal-stack/security v0.6.6/go.mod h1:WchPm3+2Xjj1h7AxM+DsnR9EWgLw+ktoGCl/0gcmgSA=
+github.com/metal-stack/metal-lib v0.13.3 h1:BOhwcKHILmBZd2pz2YMOhj8QxzDaz3G0F/CGuYhnu8o=
+github.com/metal-stack/metal-lib v0.13.3/go.mod h1:BAR7fjdoV7DDg8i9GpJQBDaNSFirOcBs0vLYTBnhHQU=
+github.com/metal-stack/security v0.6.7 h1:8wstGy0pdUmphVclAlT+9RKQmx9lF+cIGklJZAB5cIc=
+github.com/metal-stack/security v0.6.7/go.mod h1:dXyrQ8PYZuUiodWFQ/NwSROxu6tajwRBc5yR/PoK5uE=
 github.com/metal-stack/v v1.0.3 h1:Sh2oBlnxrCUD+mVpzfC8HiqL045YWkxs0gpTvkjppqs=
 github.com/metal-stack/v v1.0.3/go.mod h1:YTahEu7/ishwpYKnp/VaW/7nf8+PInogkfGwLcGPdXg=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/moby/patternmatcher v0.5.0 h1:YCZgJOeULcxLw1Q+sVR636pmS7sPEn1Qo2iAN6M7DBo=
-github.com/moby/patternmatcher v0.5.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
+github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
 github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
 github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
@@ -326,8 +325,8 @@ github.com/opencontainers/image-spec v1.1.0-rc4/go.mod h1:X4pATf0uXsnn3g5aiGIsVn
 github.com/opencontainers/runc v1.1.9 h1:XR0VIHTGce5eWPkaPesqTBrhW2yAcaraWfsEalNwQLM=
 github.com/opencontainers/runc v1.1.9/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
-github.com/pelletier/go-toml/v2 v2.0.9 h1:uH2qQXheeefCCkuBBSLi7jCiSmj3VRh2+Goq2N7Xxu0=
-github.com/pelletier/go-toml/v2 v2.0.9/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
+github.com/pelletier/go-toml/v2 v2.1.0 h1:FnwAJ4oYMvbT/34k9zzHuZNrhlz48GB3/s6at6/MHO4=
+github.com/pelletier/go-toml/v2 v2.1.0/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -421,8 +420,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
-golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk=
-golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
+golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -433,8 +432,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb h1:mIKbk8weKhSeLH2GmUTrvx8CjkyJmnU1wFmg59CUjFA=
-golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
+golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g=
+golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -497,8 +496,8 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
-golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
+golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -508,8 +507,8 @@ golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.11.0 h1:vPL4xzxBM4niKCW6g9whtaWVXTJf1U5e4aZxxFx/gbU=
-golang.org/x/oauth2 v0.11.0/go.mod h1:LdF7O/8bLR/qWK9DrpXmbHLTouvRHK0SgJl0GmDBchk=
+golang.org/x/oauth2 v0.12.0 h1:smVPGxink+n1ZI5pkQa8y6fZT0RW0MgCO5bFpepy4B4=
+golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -568,8 +567,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -585,8 +584,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc=
-golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -644,8 +643,8 @@ golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss=
-golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
+golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -675,8 +674,9 @@ google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -714,8 +714,8 @@ google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230815205213-6bfd019c3878 h1:lv6/DhyiFFGsmzxbsUUTOkN29II+zeWHxvT8Lpdxsv0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230815205213-6bfd019c3878/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d h1:uvYuEyMHKNt+lT4K3bN6fGswmK8qSvcreM3BwjDh+y4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -732,8 +732,8 @@ google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
-google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
+google.golang.org/grpc v1.58.0 h1:32JY8YpPMSR45K+c3o6b8VL73V+rR8k+DeMIr4vRH8o=
+google.golang.org/grpc v1.58.0/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
diff --git a/pkg/auth/hmacauther.go b/pkg/auth/hmacauther.go
index 9bf4c34..3f4c305 100644
--- a/pkg/auth/hmacauther.go
+++ b/pkg/auth/hmacauther.go
@@ -16,7 +16,8 @@ type contextKey string
 
 const (
 	// HmacDefaultKey is a exported constant for convenience
-	HmacDefaultKey = "4Rahs0WnJ4rJE8ZiwiLec62z"
+	// FIXME where is this used ?
+	HmacDefaultKey = "4Rahs0WnJ4rJE8ZiwiLec62z" //nolint:gosec
 
 	// hmacMethod fictive non-rest-method used for HMAC-Token
 	hmacMethod = "GRPC"
@@ -61,7 +62,7 @@ func NewHMACAuther(logger *zap.Logger, hmacKey string, user security.User) (*HMA
 // If there is no authentication info in the request, or the verification of the HMAC
 // fails an Status-Error is returned with Code Unauthenticated.
 //
-//  see GetUser()
+//	see GetUser()
 //
 // Used on the service/server-side.
 func (a *HMACAuther) Auth(ctx context.Context) (context.Context, error) {
diff --git a/pkg/datastore/bootstrap.go b/pkg/datastore/bootstrap.go
index 53a282b..facc087 100644
--- a/pkg/datastore/bootstrap.go
+++ b/pkg/datastore/bootstrap.go
@@ -11,10 +11,10 @@ import (
 	"time"
 
 	"github.com/jmoiron/sqlx"
-	healthv1 "github.com/metal-stack/masterdata-api/api/grpc/health/v1"
 	v1 "github.com/metal-stack/masterdata-api/api/v1"
 	"github.com/metal-stack/masterdata-api/pkg/health"
 	"go.uber.org/zap"
+	healthv1 "google.golang.org/grpc/health/grpc_health_v1"
 	"sigs.k8s.io/yaml"
 )
 
diff --git a/pkg/datastore/migrate.go b/pkg/datastore/migrate.go
index 62183a9..25894aa 100644
--- a/pkg/datastore/migrate.go
+++ b/pkg/datastore/migrate.go
@@ -6,10 +6,10 @@ import (
 
 	"github.com/jmoiron/sqlx"
 	"github.com/lopezator/migrator"
-	healthv1 "github.com/metal-stack/masterdata-api/api/grpc/health/v1"
 	v1 "github.com/metal-stack/masterdata-api/api/v1"
 	"github.com/metal-stack/masterdata-api/pkg/health"
 	"go.uber.org/zap"
+	healthv1 "google.golang.org/grpc/health/grpc_health_v1"
 )
 
 // MigrateDB applies necessary DB Migrations.
diff --git a/pkg/health/health.go b/pkg/health/health.go
index 9a63a38..9d5f226 100644
--- a/pkg/health/health.go
+++ b/pkg/health/health.go
@@ -5,8 +5,8 @@ import (
 
 	"sync"
 
-	v1 "github.com/metal-stack/masterdata-api/api/grpc/health/v1"
 	"google.golang.org/grpc/codes"
+	v1 "google.golang.org/grpc/health/grpc_health_v1"
 	"google.golang.org/grpc/status"
 )
 
diff --git a/proto/Makefile b/proto/Makefile
new file mode 100644
index 0000000..479f57e
--- /dev/null
+++ b/proto/Makefile
@@ -0,0 +1,20 @@
+MAKEFLAGS += --no-print-directory
+BUF_VERSION := 1.26.1
+
+_buf:
+	docker run --rm \
+		--entrypoint sh \
+		-v $(PWD)/..:/workspace \
+		-w /workspace/proto \
+		bufbuild/buf:$(BUF_VERSION) \
+		-c "buf $(CMD) && chown -R $(shell id -u):$(shell id -g) /workspace"
+
+
+.PHONY: protolint
+protolint:
+	@$(MAKE)	_buf	CMD="format -w v1"
+	@$(MAKE)	_buf	CMD="lint -v"
+
+.PHONY: protoc
+protoc: protolint
+	@$(MAKE)	_buf	CMD="generate -v"
\ No newline at end of file
diff --git a/proto/buf.gen.yaml b/proto/buf.gen.yaml
new file mode 100644
index 0000000..bb5723c
--- /dev/null
+++ b/proto/buf.gen.yaml
@@ -0,0 +1,14 @@
+version: v1
+managed:
+  enabled: true
+  go_package_prefix:
+    default: github.com/metal-stack/masterdata-api
+plugins:
+  # generate go structs for protocol buffer definition
+  - plugin: buf.build/grpc/go:v1.3.0
+    out: ../api
+    opt: paths=source_relative,require_unimplemented_servers=false
+  # generate go structs for protocol buffer definition
+  - plugin: buf.build/protocolbuffers/go:v1.31.0
+    out: ../api
+    opt: paths=source_relative
diff --git a/proto/buf.lock b/proto/buf.lock
new file mode 100644
index 0000000..2630fad
--- /dev/null
+++ b/proto/buf.lock
@@ -0,0 +1,43 @@
+# Generated by buf. DO NOT EDIT.
+version: v1
+deps:
+  - remote: buf.build
+    owner: cncf
+    repository: xds
+    commit: 0d869d8e763c430498070035c02ac001
+    digest: shake256:b86eabc7d6290b46989d8db4ea39f7e4932d736373960ad4bf0d3118a76d5159c40cab7086fbb82d981aad1effcf45a3ff514adfff882460aa9dd2eb6d5535f5
+  - remote: buf.build
+    owner: envoyproxy
+    repository: envoy
+    commit: 1ec8ea8729b64cde89d18b254411ff28
+    digest: shake256:8e972e382fe3e88301c4d3a51297e0edbfd696dc61e958dfd9ba0b0cb9c8ec6659d3f248e6206ea70987947a84ffc2107437d8275381d0ce1bda6e35c012be2a
+  - remote: buf.build
+    owner: envoyproxy
+    repository: protoc-gen-validate
+    commit: eac44469a7af47e7839a7f1f3d7ac004
+    digest: shake256:0feabcde01b6b11e3c75a5e3f807968d5995626546f39c37e5d4205892b3a59cced0ed83b35a2eb9e6dddd3309660ad46b737c9dcd224b425de0a6654ce04417
+  - remote: buf.build
+    owner: googleapis
+    repository: googleapis
+    commit: 28151c0d0a1641bf938a7672c500e01d
+    digest: shake256:49215edf8ef57f7863004539deff8834cfb2195113f0b890dd1f67815d9353e28e668019165b9d872395871eeafcbab3ccfdb2b5f11734d3cca95be9e8d139de
+  - remote: buf.build
+    owner: grpc
+    repository: grpc
+    commit: a5b3a068eb8c45dea1ce4f36873286f8
+    digest: shake256:ea78e2b906f1a2d5094d4b7fb576f4a05f5ab2f2a6957c4a6fb780e3aa49a5d7dc9a1845f9bff115e8033600cd5ede8f22284d7e8bc7c32c73bde753cfce24a8
+  - remote: buf.build
+    owner: opencensus
+    repository: opencensus
+    commit: 7e475551350545bda1ccb1e258c7b125
+    digest: shake256:22499ad9824a29151f38e3ea026166bd2258f1f1b40d11246cb80718bff5d4a7fecd47ef857f5cd98609d7847c93329f603a4e43348abd7ac1ead22a6a964b05
+  - remote: buf.build
+    owner: opentelemetry
+    repository: opentelemetry
+    commit: 2ad07e196ee74068901737616c3f9e6c
+    digest: shake256:b3ac419a36c0ab35b3d05ac4425cb6d824f8d8dbdebf12dd71f6f7ef6e728a527251080d22dddcfeae104840457153bf4f70e890562d120e76c609958c386fdc
+  - remote: buf.build
+    owner: prometheus
+    repository: client-model
+    commit: 741a6a7bbc7645f89b588c47a06fceb3
+    digest: shake256:1b6db8908bc8557f4e87b308ea98debe476a119fb620e41d873df1065dd0d1b04dbb4466b5da52b985efd47f5f6658c2e33d11df63557e96ff6d54752cffdef2
diff --git a/proto/buf.yaml b/proto/buf.yaml
new file mode 100644
index 0000000..48c9a52
--- /dev/null
+++ b/proto/buf.yaml
@@ -0,0 +1,14 @@
+version: v1
+breaking:
+  use:
+    - FILE
+lint:
+  use:
+    - DEFAULT
+  except:
+    - RPC_REQUEST_RESPONSE_UNIQUE
+    - RPC_REQUEST_STANDARD_NAME
+    - RPC_RESPONSE_STANDARD_NAME
+    - PACKAGE_VERSION_SUFFIX
+deps:
+  - buf.build/grpc/grpc
\ No newline at end of file
diff --git a/proto/v1/common.proto b/proto/v1/common.proto
new file mode 100644
index 0000000..0b177f9
--- /dev/null
+++ b/proto/v1/common.proto
@@ -0,0 +1,11 @@
+syntax = "proto3";
+
+package v1;
+
+message Paging {
+  // page is used for pagination, if unset only the first page is returned,
+  // the list response contains then the page number for the next page.
+  optional uint64 page = 1;
+  // count is the number of results returned per page, if not given server side defaults apply
+  optional uint64 count = 2;
+}
diff --git a/proto/v1/iam.proto b/proto/v1/iam.proto
new file mode 100644
index 0000000..2272a2d
--- /dev/null
+++ b/proto/v1/iam.proto
@@ -0,0 +1,70 @@
+syntax = "proto3";
+
+package v1;
+
+import "google/protobuf/wrappers.proto";
+
+message IAMConfig {
+  IssuerConfig issuer_config = 1;
+  IDMConfig idm_config = 2;
+  NamespaceGroupConfig group_config = 3;
+}
+
+message IssuerConfig {
+  string url = 1;
+  string client_id = 2;
+}
+
+// mandatory config
+message IDMConfig {
+  string idm_type = 1;
+
+  // optional
+  ConnectorConfig connector_config = 2;
+}
+
+// Config for group-rolebinding-controller
+message NamespaceGroupConfig {
+  // no action is taken or any namespace in this list
+  string excluded_namespaces = 1;
+
+  // for each element a RoleBinding is created in any Namespace - ClusterRoles are bound with this name
+  // admin,edit,view
+  string expected_groups_list = 2;
+
+  // Maximum length of namespace-part in clusterGroupname and therefore in the corresponding groupname in the directory.
+  // 20 chars für AD, given the naming-conventions
+  int32 namespace_max_length = 3;
+
+  // The created RoleBindings will reference this group (from token).
+  // oidc:{{ .Namespace }}-{{ .Group }}
+  string cluster_groupname_template = 4;
+
+  // The RoleBindings will created with this name.
+  // oidc-{{ .Namespace }}-{{ .Group }}
+  string rolebinding_name_template = 5;
+}
+
+// optional config if idm webhook is used to automatically create/delete groups/roles in the tenant idm
+message ConnectorConfig {
+  // the following are all mandatory
+  string idm_api_url = 1;
+  string idm_api_user = 2;
+  string idm_api_password = 3;
+
+  string idm_system_id = 4;
+  string idm_access_code = 5;
+  string idm_customer_id = 6;
+  string idm_group_ou = 7;
+  // optional
+  google.protobuf.StringValue idm_groupname_template = 8;
+
+  string idm_domain_name = 9;
+  string idm_tenant_prefix = 10;
+
+  string idm_submitter = 11;
+  string idm_job_info = 12;
+  string idm_req_system = 13;
+  string idm_req_user = 14;
+  string idm_req_email = 15;
+}
diff --git a/proto/v1/meta.proto b/proto/v1/meta.proto
new file mode 100644
index 0000000..855f0c8
--- /dev/null
+++ b/proto/v1/meta.proto
@@ -0,0 +1,16 @@
+syntax = "proto3";
+
+package v1;
+
+import "google/protobuf/timestamp.proto";
+
+message Meta {
+  string id = 1;
+  string kind = 2;
+  string apiversion = 3;
+  int64 version = 4;
+  google.protobuf.Timestamp created_time = 5;
+  google.protobuf.Timestamp updated_time = 6;
+  map<string, string> annotations = 7;
+  repeated string labels = 8;
+}
diff --git a/proto/v1/project.proto b/proto/v1/project.proto
new file mode 100644
index 0000000..93902bd
--- /dev/null
+++ b/proto/v1/project.proto
@@ -0,0 +1,67 @@
+syntax = "proto3";
+
+package v1;
+
+import "google/protobuf/timestamp.proto";
+import "google/protobuf/wrappers.proto";
+import "v1/common.proto";
+import "v1/meta.proto";
+import "v1/quota.proto";
+
+service ProjectService {
+  rpc Create(ProjectCreateRequest) returns (ProjectResponse);
+  rpc Update(ProjectUpdateRequest) returns (ProjectResponse);
+  rpc Delete(ProjectDeleteRequest) returns (ProjectResponse);
+  rpc Get(ProjectGetRequest) returns (ProjectResponse);
+  rpc GetHistory(ProjectGetHistoryRequest) returns (ProjectResponse);
+  rpc Find(ProjectFindRequest) returns (ProjectListResponse);
+}
+
+// Project is the database model
+message Project {
+  Meta meta = 1;
+  string name = 2;
+  string description = 3;
+  string tenant_id = 4;
+  QuotaSet quotas = 5;
+}
+
+message ProjectCreateRequest {
+  Project project = 1;
+}
+
+message ProjectUpdateRequest {
+  Project project = 1;
+}
+
+message ProjectDeleteRequest {
+  string id = 1;
+}
+
+message ProjectGetRequest {
+  string id = 1;
+}
+
+message ProjectGetHistoryRequest {
+  string id = 1;
+  google.protobuf.Timestamp at = 2;
+}
+
+message ProjectFindRequest {
+  google.protobuf.StringValue id = 1;
+  google.protobuf.StringValue name = 2;
+  google.protobuf.StringValue description = 3;
+  google.protobuf.StringValue tenant_id = 4;
+  Paging paging = 5;
+  map<string, string> annotations = 6;
+}
+
+message ProjectResponse {
+  Project project = 1;
+}
+
+message ProjectListResponse {
+  repeated Project projects = 1;
+  // next_page_token is used for pagination, returns the next page to be fetched and must then be provided in the list request.
+  optional uint64 next_page = 2;
+}
diff --git a/proto/v1/quota.proto b/proto/v1/quota.proto
new file mode 100644
index 0000000..83a4049
--- /dev/null
+++ b/proto/v1/quota.proto
@@ -0,0 +1,26 @@
+syntax = "proto3";
+
+package v1;
+
+import "google/protobuf/wrappers.proto";
+
+// QuotaSet defines the types of possible Quotas
+// might be specified by project or tenant
+// whatever quota is reached first counts
+// it always defines the max amount of this type
+message QuotaSet {
+  // cluster the amount of clusters
+  Quota cluster = 1;
+  // machine the amount of machines
+  Quota machine = 2;
+  // ip the amount of aquired ip´s
+  Quota ip = 3;
+  // project the amount of projects of a tenant
+  Quota project = 4;
+}
+
+// Quota is the actual maximum amount
+message Quota {
+  // quota is the maximum amount for the current QuotaSet, can be nil
+  google.protobuf.Int32Value quota = 1;
+}
diff --git a/proto/v1/tenant.proto b/proto/v1/tenant.proto
new file mode 100644
index 0000000..028f697
--- /dev/null
+++ b/proto/v1/tenant.proto
@@ -0,0 +1,66 @@
+syntax = "proto3";
+
+package v1;
+
+import "google/protobuf/timestamp.proto";
+import "google/protobuf/wrappers.proto";
+import "v1/common.proto";
+import "v1/iam.proto";
+import "v1/meta.proto";
+import "v1/quota.proto";
+
+service TenantService {
+  rpc Create(TenantCreateRequest) returns (TenantResponse);
+  rpc Update(TenantUpdateRequest) returns (TenantResponse);
+  rpc Delete(TenantDeleteRequest) returns (TenantResponse);
+  rpc Get(TenantGetRequest) returns (TenantResponse);
+  rpc GetHistory(TenantGetHistoryRequest) returns (TenantResponse);
+  rpc Find(TenantFindRequest) returns (TenantListResponse);
+}
+
+message Tenant {
+  Meta meta = 1;
+  string name = 2;
+  string description = 3;
+  QuotaSet default_quotas = 4;
+  QuotaSet quotas = 5;
+  IAMConfig iam_config = 6;
+}
+
+message TenantCreateRequest {
+  Tenant tenant = 1;
+}
+
+message TenantUpdateRequest {
+  Tenant tenant = 1;
+}
+
+message TenantDeleteRequest {
+  string id = 1;
+}
+
+message TenantGetRequest {
+  string id = 1;
+}
+
+message TenantGetHistoryRequest {
+  string id = 1;
+  google.protobuf.Timestamp at = 2;
+}
+
+message TenantFindRequest {
+  google.protobuf.StringValue id = 1;
+  google.protobuf.StringValue name = 2;
+  Paging paging = 3;
+  map<string, string> annotations = 4;
+}
+
+message TenantResponse {
+  Tenant tenant = 1;
+}
+
+message TenantListResponse {
+  repeated Tenant tenants = 1;
+  // next_page is used for pagination, returns the next page to be fetched and must then be provided in the list request.
+  optional uint64 next_page = 2;
+}
diff --git a/server/main.go b/server/main.go
index 54d8beb..4650389 100644
--- a/server/main.go
+++ b/server/main.go
@@ -24,7 +24,6 @@ import (
 	grpc_recovery "github.com/grpc-ecosystem/go-grpc-middleware/recovery"
 	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
 	grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
-	healthv1 "github.com/metal-stack/masterdata-api/api/grpc/health/v1"
 	apiv1 "github.com/metal-stack/masterdata-api/api/v1"
 	"github.com/metal-stack/masterdata-api/pkg/datastore"
 	"github.com/metal-stack/masterdata-api/pkg/service"
@@ -35,6 +34,7 @@ import (
 	"go.uber.org/zap/zapcore"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
+	healthv1 "google.golang.org/grpc/health/grpc_health_v1"
 )
 
 const (